audit-tools 0.32.20 → 0.32.23

package/dist/shared/types/intentCheckpoint.js

@@ -132,6 +132,17 @@ export const IntentCheckpointSchema = z
         goal_graph: GoalGraphSchema.optional(),
         charters: z.array(CharterSchema).optional(),
         ceiling: CeilingSchema.optional(),
+        /**
+         * The ATTENTION dial (Phase D control surface, currency #3) — how much the
+         * user will converse to align the charters: how many VOI-ranked
+         * charter-clarification questions they answer this round. `0` is the
+         * autonomous mode (every charter-delta becomes a written finding, nothing
+         * interactive); a finite N takes the top-N of the VOI queue; `"all"` takes
+         * every interactive question. Attended and unattended are two settings of
+         * ONE dial, not a forked path. Optional + additive; defaults to `0`
+         * (conversation-first: no human loop unless the user opts in).
+         */
+        attention: z.union([z.number().int().min(0), z.literal("all")]).optional(),
     })
         .strict()
         .optional(),

package/dist/shared/types/intentCheckpoint.js.map

@@ -1 +1 @@
-{"version":3,"file":"intentCheckpoint.js","sourceRoot":"","sources":["../../../src/shared/types/intentCheckpoint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EACL,aAAa,EACb,aAAa,EACb,eAAe,GAChB,MAAM,cAAc,CAAC;AAEtB;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;IACjD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,yDAAyD;IACzD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,wEAAwE;IACxE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,qEAAqE;IACrE,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;SAClE,QAAQ,EAAE;IACb,gDAAgD;IAChD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,gEAAgE;IAChE,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QACxC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QACtC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QACxC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KACvC,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;IACb;;;;;;OAMG;IACH,kBAAkB,EAAE,CAAC;SAClB,KAAK,CACJ,CAAC;SACE,MAAM,CAAC;QACN;;;;;;;;WAQG;QACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,4CAA4C;QAC5C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,kEAAkE;QAClE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;QAC/B,kEAAkE;QAClE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;SACD,MAAM,EAAE,CACZ;SACA,QAAQ,EAAE;IACb;;;;;OAKG;IACH,qBAAqB,EAAE,CAAC;SACrB,KAAK,CACJ,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,MAAM,EAAE,2BAA2B;QACnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;KACnB,CAAC;SACD,MAAM,EAAE,CACZ;SACA,QAAQ,EAAE;IACb;;;;OAIG;IACH,cAAc,EAAE,CAAC;SACd,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QACvC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KACxC,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;IACb;;;;;;;;;;;OAWG;IACH,aAAa,EAAE,CAAC;SACb,MAAM,CAAC;QACN,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;QACxD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAChD;;;;;;;;;;;WAWG;QACH,UAAU,EAAE,eAAe,CAAC,QAAQ,EAAE;QACtC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;QAC3C,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;KAClC,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE,CAAC"}
+{"version":3,"file":"intentCheckpoint.js","sourceRoot":"","sources":["../../../src/shared/types/intentCheckpoint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EACL,aAAa,EACb,aAAa,EACb,eAAe,GAChB,MAAM,cAAc,CAAC;AAEtB;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;IACjD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,yDAAyD;IACzD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,wEAAwE;IACxE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,qEAAqE;IACrE,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;SAClE,QAAQ,EAAE;IACb,gDAAgD;IAChD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,gEAAgE;IAChE,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QACxC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QACtC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QACxC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KACvC,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;IACb;;;;;;OAMG;IACH,kBAAkB,EAAE,CAAC;SAClB,KAAK,CACJ,CAAC;SACE,MAAM,CAAC;QACN;;;;;;;;WAQG;QACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,4CAA4C;QAC5C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,kEAAkE;QAClE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;QAC/B,kEAAkE;QAClE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;SACD,MAAM,EAAE,CACZ;SACA,QAAQ,EAAE;IACb;;;;;OAKG;IACH,qBAAqB,EAAE,CAAC;SACrB,KAAK,CACJ,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,MAAM,EAAE,2BAA2B;QACnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;KACnB,CAAC;SACD,MAAM,EAAE,CACZ;SACA,QAAQ,EAAE;IACb;;;;OAIG;IACH,cAAc,EAAE,CAAC;SACd,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QACvC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KACxC,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;IACb;;;;;;;;;;;OAWG;IACH,aAAa,EAAE,CAAC;SACb,MAAM,CAAC;QACN,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;QACxD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAChD;;;;;;;;;;;WAWG;QACH,UAAU,EAAE,eAAe,CAAC,QAAQ,EAAE;QACtC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;QAC3C,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;QACjC;;;;;;;;;WASG;QACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC3E,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/shared/validation/charterGate.d.ts

@@ -1,4 +1,4 @@
-import type { Charter, CharterDelta } from "../types/charter.js";
+import type { Charter, CharterDelta, CharterClarificationRequest } from "../types/charter.js";
 /**
  * The True-charter gate: a `true` charter is nominatable-never-assertable and
  * falsifiable-or-drop. It survives ONLY if it names BOTH a concrete alternative and
@@ -35,4 +35,23 @@ export declare function charterReviewDisposition(charter: Charter): "opine" | "f
  * of those kinds; a low-confidence charter of a referenced kind trips the downgrade.
  */
 export declare function gateCharterDelta(delta: CharterDelta, charters: Charter[]): CharterDelta;
+/**
+ * The blast-radius RISK GATE (Phase D; design §"Blast radius — the ranking and the
+ * risk gate"). Blast radius is simultaneously priority (high-blast = high-value)
+ * AND risk: acting on a WRONG high-blast finding is catastrophic, so it must clear
+ * a MUCH higher bar of independent adversarial refutation before it is actionable.
+ * This gate is the deterministic side of that bar: a question whose blast radius is
+ * at/above `highBlastThreshold` may only reach the interactive human channel if it
+ * has cleared `requiredRefutations` rounds of independent refutation; otherwise it
+ * is downgraded to `finding_only` (written as a lead, never asked interactively).
+ * Below the threshold, a question is interactive without the extra bar.
+ *
+ * Pure + deterministic: same request + same observed refutation count always
+ * yields the same disposition. `observedRefutations` is supplied by the caller (the
+ * intensity dial's adversarial rounds); the gate never runs the refutation itself.
+ */
+export declare function riskGateClarification(request: CharterClarificationRequest, observedRefutations: number, opts: {
+    highBlastThreshold: number;
+    requiredRefutations: number;
+}): CharterClarificationRequest["disposition"];
 //# sourceMappingURL=charterGate.d.ts.map

package/dist/shared/validation/charterGate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"charterGate.d.ts","sourceRoot":"","sources":["../../../src/shared/validation/charterGate.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEjE;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG;IACzD,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,OAAO,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxD,CA0BA;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,OAAO,GACf,OAAO,GAAG,gBAAgB,CAE5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,YAAY,EACnB,QAAQ,EAAE,OAAO,EAAE,GAClB,YAAY,CAWd"}
+{"version":3,"file":"charterGate.d.ts","sourceRoot":"","sources":["../../../src/shared/validation/charterGate.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,OAAO,EACP,YAAY,EACZ,2BAA2B,EAC5B,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG;IACzD,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,OAAO,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxD,CA0BA;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,OAAO,GACf,OAAO,GAAG,gBAAgB,CAE5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,YAAY,EACnB,QAAQ,EAAE,OAAO,EAAE,GAClB,YAAY,CAWd;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,2BAA2B,EACpC,mBAAmB,EAAE,MAAM,EAC3B,IAAI,EAAE;IAAE,kBAAkB,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAA;CAAE,GAChE,2BAA2B,CAAC,aAAa,CAAC,CAM5C"}

package/dist/shared/validation/charterGate.js

@@ -70,4 +70,27 @@ export function gateCharterDelta(delta, charters) {
     }
     return delta;
 }
+/**
+ * The blast-radius RISK GATE (Phase D; design §"Blast radius — the ranking and the
+ * risk gate"). Blast radius is simultaneously priority (high-blast = high-value)
+ * AND risk: acting on a WRONG high-blast finding is catastrophic, so it must clear
+ * a MUCH higher bar of independent adversarial refutation before it is actionable.
+ * This gate is the deterministic side of that bar: a question whose blast radius is
+ * at/above `highBlastThreshold` may only reach the interactive human channel if it
+ * has cleared `requiredRefutations` rounds of independent refutation; otherwise it
+ * is downgraded to `finding_only` (written as a lead, never asked interactively).
+ * Below the threshold, a question is interactive without the extra bar.
+ *
+ * Pure + deterministic: same request + same observed refutation count always
+ * yields the same disposition. `observedRefutations` is supplied by the caller (the
+ * intensity dial's adversarial rounds); the gate never runs the refutation itself.
+ */
+export function riskGateClarification(request, observedRefutations, opts) {
+    const isHighBlast = request.value.blast_radius >= opts.highBlastThreshold;
+    if (!isHighBlast)
+        return "interactive";
+    return observedRefutations >= opts.requiredRefutations
+        ? "interactive"
+        : "finding_only";
+}
 //# sourceMappingURL=charterGate.js.map

package/dist/shared/validation/charterGate.js.map

@@ -1 +1 @@
-{"version":3,"file":"charterGate.js","sourceRoot":"","sources":["../../../src/shared/validation/charterGate.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,mFAAmF;AACnF,mFAAmF;AACnF,oFAAoF;AACpF,gFAAgF;AAIhF;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAmB;IAItD,MAAM,IAAI,GAAc,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAkD,EAAE,CAAC;IAClE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,IAAI,cAAc,IAAI,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG;gBACd,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,uBAAuB;gBAC/C,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB;aAClC;iBACE,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;iBACtC,IAAI,CAAC,KAAK,CAAC,CAAC;YACf,OAAO,CAAC,IAAI,CAAC;gBACX,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,MAAM,EAAE,6CAA6C,OAAO,yDAAyD;aACtH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAgB;IAEhB,OAAO,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC;AACnE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAmB,EACnB,QAAmB;IAEnB,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,gBAAgB,GAAG,QAAQ,CAAC,IAAI,CACpC,CAAC,OAAO,EAAE,EAAE,CACV,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QACjC,wBAAwB,CAAC,OAAO,CAAC,KAAK,gBAAgB,CACzD,CAAC;IACF,IAAI,gBAAgB,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;QACpD,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"charterGate.js","sourceRoot":"","sources":["../../../src/shared/validation/charterGate.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,mFAAmF;AACnF,mFAAmF;AACnF,oFAAoF;AACpF,gFAAgF;AAQhF;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAmB;IAItD,MAAM,IAAI,GAAc,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAkD,EAAE,CAAC;IAClE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,IAAI,cAAc,IAAI,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG;gBACd,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,uBAAuB;gBAC/C,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB;aAClC;iBACE,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;iBACtC,IAAI,CAAC,KAAK,CAAC,CAAC;YACf,OAAO,CAAC,IAAI,CAAC;gBACX,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,MAAM,EAAE,6CAA6C,OAAO,yDAAyD;aACtH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAgB;IAEhB,OAAO,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC;AACnE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAmB,EACnB,QAAmB;IAEnB,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,gBAAgB,GAAG,QAAQ,CAAC,IAAI,CACpC,CAAC,OAAO,EAAE,EAAE,CACV,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QACjC,wBAAwB,CAAC,OAAO,CAAC,KAAK,gBAAgB,CACzD,CAAC;IACF,IAAI,gBAAgB,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;QACpD,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAoC,EACpC,mBAA2B,EAC3B,IAAiE;IAEjE,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,kBAAkB,CAAC;IAC1E,IAAI,CAAC,WAAW;QAAE,OAAO,aAAa,CAAC;IACvC,OAAO,mBAAmB,IAAI,IAAI,CAAC,mBAAmB;QACpD,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,cAAc,CAAC;AACrB,CAAC"}

package/docs/audit-pkg/operator-guide.md

@@ -175,6 +175,90 @@ Use `ui_mode: "visible"` when debugging provider stdout/stderr. Use
 `subprocess-template` or `vscode-task` only when you have a reliable launcher
 bridge.
 
+## Gate-0 provider confirmation
+
+The first thing an interactive audit run does — before it reads the repo — is
+pause on a **provider confirmation** step (Gate-0). The tool auto-detects the
+provider pool it can dispatch to, prices each candidate, and proposes a cost
+ordering (cheapest capable first). You confirm, reorder, or amend it. The
+mechanism behind the ordering is documented in
+[`spec/cost-first-routing.md`](../../spec/cost-first-routing.md); this section is
+only how to respond to the step.
+
+### When it fires
+
+- On the conversation/CLI path (`audit-code next-step`) it fires on **every** run,
+  even when only one — or zero — providers were auto-detected, so you can reorder,
+  exclude, self-report your own model roster, or add a provider that discovery missed.
+- Headless (`audit-code advance-audit`, no interactive host) it auto-completes with
+  the tool's price-ascending suggestion and never pauses.
+
+### How to respond
+
+The step prints the suggested pool as a priced table and asks you to write your
+decision to:
+
+```text
+.audit-tools/audit/provider-confirmation.input.json
+```
+
+**Writing that file is what lets the run proceed** — its presence is the "operator
+has acted" signal. To accept the suggestion verbatim, write just the version:
+
+```json
+{ "schema_version": "provider-confirmation-input/v1" }
+```
+
+Every other field is optional:
+
+```json
+{
+  "schema_version": "provider-confirmation-input/v1",
+  "cost_order": ["<provider-or-model-key>", "..."],
+  "exclude": ["<provider-name>"],
+  "include": ["<self-spawn-blocked provider to opt back in>"],
+  "host_models": [{ "model_id": "<your model id>", "tier": "frontier|capable|fast" }]
+}
+```
+
+- `cost_order` — the confirmed ordering, cheapest first, as a list of keys. A key
+  is either a **provider name** (as shown in the table) or a **host `model_id`** you
+  report in `host_models`. Keys you omit keep their suggested relative order,
+  appended after the ones you name; unrecognized keys are ignored. Omit it to accept
+  the suggested order.
+- `exclude` — drops a provider from the dispatchable pool.
+- `include` — opts a self-spawn-blocked provider back in. A CLI provider detected
+  while you are already inside a session of that same agent (`claude-code` under
+  `CLAUDECODE`, `codex` under `CODEX`) is excluded by default so the run can't
+  self-spawn a fresh agent; naming it here overrides that. Advanced — normally leave
+  it excluded.
+- `host_models` — reports your own (the host agent's) model roster so those tiers
+  are priced from the models.dev dataset and orderable here, not just at dispatch.
+
+You supply only ordering intent plus your model roster. The tool owns the prices,
+the capability flags, and the roster snapshot — you never hand-author those. If a
+provider you use isn't listed, it wasn't auto-detected: add its config to
+`session-config.json` (an OpenAI-compatible endpoint via
+`openai_compatible.{base_url,model,api_key_env}`, or a CLI backend via its
+`<name>.command`) and re-run the step.
+
+Once the input is written, re-run the continue command the step printed
+(`audit-code next-step`). The tool consumes the input and promotes it into both
+canonical artifacts: the per-tool `provider_confirmation.json` seam and the shared
+`.audit-tools/provider-confirmation.json`.
+
+### The confirmed pool persists — you aren't re-prompted
+
+The shared `.audit-tools/provider-confirmation.json` is written once and reused for
+the rest of the audit→remediate session. A later step, and a subsequent
+`remediate-code` run against the same repo, read and honor that pool without
+prompting again — `remediate-code` has no confirmation step of its own; it consumes
+the audit-side pool. You are only re-prompted if the discovered provider roster
+changes (a provider appears or disappears since it was confirmed), which forces a
+fresh confirmation so a vanished provider is never pinned. If the file is absent
+(for example a standalone remediate run with no prior audit), the run resolves its
+provider independently — absence is never an error.
+
 ## Model selection
 
 Conversation-level model choice belongs to the host conversation. The backend

package/opencode.json

@@ -25,37 +25,53 @@
     },
     "bash": {
       "*": "allow",
-      "audit-code synthesize*": "deny",
-      "*dist*index.js* synthesize*": "deny",
-      "*audit-code.mjs* synthesize*": "deny",
-      "audit-code cleanup*": "deny",
-      "*dist*index.js* cleanup*": "deny",
+      "*audit-code.mjs": "allow",
       "*audit-code.mjs* cleanup*": "deny",
-      "audit-code requeue*": "deny",
-      "*dist*index.js* requeue*": "deny",
+      "*audit-code.mjs* ensure*": "allow",
+      "*audit-code.mjs* ingest-results*": "deny",
+      "*audit-code.mjs* merge-and-ingest*": "allow",
+      "*audit-code.mjs* next-step*": "allow",
+      "*audit-code.mjs* prepare-dispatch*": "allow",
       "*audit-code.mjs* requeue*": "deny",
-      "audit-code ingest-results*": "deny",
+      "*audit-code.mjs* submit-packet*": "allow",
+      "*audit-code.mjs* synthesize*": "deny",
+      "*audit-code.mjs* validate*": "allow",
+      "*audit-code.mjs* worker-run*": "allow",
+      "*dist*index.js* cleanup*": "deny",
       "*dist*index.js* ingest-results*": "deny",
-      "*audit-code.mjs* ingest-results*": "deny",
+      "*dist*index.js* requeue*": "deny",
+      "*dist*index.js* synthesize*": "deny",
+      "*remediate-code.mjs": "allow",
+      "*remediate-code.mjs* ensure*": "allow",
+      "*remediate-code.mjs* merge-document-results*": "allow",
+      "*remediate-code.mjs* merge-implement-results*": "allow",
+      "*remediate-code.mjs* next-step*": "allow",
+      "*remediate-code.mjs* prepare-document-dispatch*": "allow",
+      "*remediate-code.mjs* prepare-implement-dispatch*": "allow",
+      "*remediate-code.mjs* validate-artifacts*": "allow",
+      "Select-String *": "allow",
       "audit-code": "allow",
+      "audit-code cleanup*": "deny",
       "audit-code ensure*": "allow",
-      "*audit-code.mjs* ensure*": "allow",
+      "audit-code ingest-results*": "deny",
+      "audit-code merge-and-ingest*": "allow",
       "audit-code next-step*": "allow",
-      "*audit-code.mjs* next-step*": "allow",
       "audit-code prepare-dispatch*": "allow",
-      "*audit-code.mjs* prepare-dispatch*": "allow",
+      "audit-code requeue*": "deny",
       "audit-code submit-packet*": "allow",
-      "*audit-code.mjs* submit-packet*": "allow",
-      "audit-code merge-and-ingest*": "allow",
-      "*audit-code.mjs* merge-and-ingest*": "allow",
+      "audit-code synthesize*": "deny",
       "audit-code validate*": "allow",
-      "*audit-code.mjs* validate*": "allow",
-      "*audit-code.mjs": "allow",
-      "*audit-code.mjs* worker-run*": "allow",
-      "git status*": "allow",
       "git diff*": "allow",
+      "git status*": "allow",
       "grep *": "allow",
-      "Select-String *": "allow",
+      "remediate-code": "allow",
+      "remediate-code ensure*": "allow",
+      "remediate-code merge-document-results*": "allow",
+      "remediate-code merge-implement-results*": "allow",
+      "remediate-code next-step*": "allow",
+      "remediate-code prepare-document-dispatch*": "allow",
+      "remediate-code prepare-implement-dispatch*": "allow",
+      "remediate-code validate-artifacts*": "allow",
       "rm *": "deny"
     }
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "audit-tools",
-  "version": "0.32.20",
+  "version": "0.32.23",
   "private": false,
   "license": "ISC",
   "description": "Portable hybrid code auditing + remediation orchestrators for arbitrary repositories.",

package/scripts/postinstall.mjs

@@ -13,7 +13,7 @@ import { fileURLToPath } from "node:url";
 let failed = false;
 for (const script of ["./audit/postinstall.mjs", "./remediate/postinstall.mjs"]) {
   const scriptPath = fileURLToPath(new URL(script, import.meta.url));
-  const result = spawnSync(process.execPath, [scriptPath], { stdio: "inherit" });
+  const result = spawnSync(process.execPath, [scriptPath], { stdio: "inherit", windowsHide: true });
   if (result.error) {
     console.warn(`[audit-tools] postinstall: ${script} could not run (${result.error.message}).`);
     failed = true;
@@ -85,6 +85,7 @@ function runGhRepoVisibility(repoRoot) {
       cwd: repoRoot,
       encoding: "utf8",
       shell: process.platform === "win32",
+      windowsHide: true,
     });
     if (result.error || (result.status ?? 0) !== 0) return null;
     return typeof result.stdout === "string" ? result.stdout : null;

package/wrapper/audit-code-wrapper-opencode.mjs

@@ -4,6 +4,7 @@
 let mergeOpenCodeAgentPermissionRule;
 let withoutOpenCodeWildcard;
 let migrateOpenCodeGlobalExternalDirectory;
+let composeOpenCodeBashCeiling;
 export let sharedOpenCodePermissions = false;
 
 try {
@@ -11,6 +12,7 @@ try {
   mergeOpenCodeAgentPermissionRule = shared.mergeOpenCodeAgentPermissionRule;
   withoutOpenCodeWildcard = shared.withoutOpenCodeWildcard;
   migrateOpenCodeGlobalExternalDirectory = shared.migrateOpenCodeGlobalExternalDirectory;
+  composeOpenCodeBashCeiling = shared.composeOpenCodeBashCeiling;
   sharedOpenCodePermissions = true;
 } catch {
   // shared not yet built — callers that need merge logic will throw below
@@ -208,6 +210,19 @@ function mergePermissionBlock(existingPermission, generatedPermission) {
   };
 }
 
+// Collect every agent's bash rule set from a merged agent map (in stable,
+// key-sorted order) so the top-level ceiling is a deterministic union over all
+// present agents — auditor, remediator, or any future agent — not just the one
+// this installer owns. This is what makes the two installers mutually
+// key-aware: whichever one runs unions the block the other already wrote.
+function collectAgentBashRuleSets(agentMap) {
+  const agents = objectValue(agentMap);
+  return Object.keys(agents)
+    .sort()
+    .map((name) => objectValue(objectValue(agents[name]).permission).bash)
+    .filter((bash) => bash && typeof bash === 'object' && !Array.isArray(bash));
+}
+
 export function buildMergedOpenCodeProjectConfig(existing, root) {
   if (!sharedOpenCodePermissions) {
     throw new Error(
@@ -218,22 +233,33 @@ export function buildMergedOpenCodeProjectConfig(existing, root) {
   const mergedMcp = objectValue(existing.mcp);
   delete mergedMcp.auditor;
   const existingAuditor = objectValue(objectValue(existing.agent).auditor);
+  const mergedAgent = {
+    ...objectValue(existing.agent),
+    auditor: {
+      ...existingAuditor,
+      ...generated.agent.auditor,
+      permission: mergePermissionBlock(
+        existingAuditor.permission,
+        generated.agent.auditor.permission,
+      ),
+    },
+  };
+  // Top-level permission: non-bash rules keep the agent-scope merge. The
+  // top-level bash is the union ceiling of EVERY final agent's bash block — a
+  // true global privilege ceiling, order-stable and idempotent regardless of
+  // which installer regenerates the file. User-authored top-level bash keys the
+  // union does not manage are preserved (non-clobber).
+  const topPermission = mergePermissionBlock(existing.permission, generated.permission);
+  topPermission.bash = composeOpenCodeBashCeiling(
+    objectValue(existing.permission).bash,
+    collectAgentBashRuleSets(mergedAgent),
+  );
   return {
     ...existing,
     $schema: existing.$schema ?? generated.$schema,
     command: removeManagedOpenCodeCommand(existing.command),
     mcp: mergedMcp,
-    permission: mergePermissionBlock(existing.permission, generated.permission),
-    agent: {
-      ...objectValue(existing.agent),
-      auditor: {
-        ...existingAuditor,
-        ...generated.agent.auditor,
-        permission: mergePermissionBlock(
-          existingAuditor.permission,
-          generated.agent.auditor.permission,
-        ),
-      },
-    },
+    permission: topPermission,
+    agent: mergedAgent,
   };
 }

package/wrapper/remediate-code-wrapper-opencode.mjs

@@ -3,12 +3,14 @@
 // buildMergedOpenCodeProjectConfig throws a clear error in that case.
 let mergeOpenCodeAgentPermissionRule;
 let withoutOpenCodeWildcard;
+let composeOpenCodeBashCeiling;
 export let sharedOpenCodePermissions = false;
 
 try {
   const shared = await import('audit-tools/shared');
   mergeOpenCodeAgentPermissionRule = shared.mergeOpenCodeAgentPermissionRule;
   withoutOpenCodeWildcard = shared.withoutOpenCodeWildcard;
+  composeOpenCodeBashCeiling = shared.composeOpenCodeBashCeiling;
   sharedOpenCodePermissions = true;
 } catch {
   // shared not yet built — callers that need merge logic will throw below
@@ -170,6 +172,19 @@ function mergePermissionBlock(existingPermission, generatedPermission) {
   };
 }
 
+// Collect every agent's bash rule set from a merged agent map (in stable,
+// key-sorted order) so the top-level ceiling is a deterministic union over all
+// present agents — auditor, remediator, or any future agent — not just the one
+// this installer owns. This is what makes the two installers mutually
+// key-aware: whichever one runs unions the block the other already wrote.
+function collectAgentBashRuleSets(agentMap) {
+  const agents = objectValue(agentMap);
+  return Object.keys(agents)
+    .sort()
+    .map((name) => objectValue(objectValue(agents[name]).permission).bash)
+    .filter((bash) => bash && typeof bash === 'object' && !Array.isArray(bash));
+}
+
 export function buildMergedOpenCodeProjectConfig(existing, root) {
   if (!sharedOpenCodePermissions) {
     throw new Error(
@@ -180,22 +195,33 @@ export function buildMergedOpenCodeProjectConfig(existing, root) {
   const mergedMcp = objectValue(existing.mcp);
   delete mergedMcp.remediator;
   const existingRemediator = objectValue(objectValue(existing.agent).remediator);
+  const mergedAgent = {
+    ...objectValue(existing.agent),
+    remediator: {
+      ...existingRemediator,
+      ...generated.agent.remediator,
+      permission: mergePermissionBlock(
+        existingRemediator.permission,
+        generated.agent.remediator.permission,
+      ),
+    },
+  };
+  // Top-level permission: non-bash rules keep the agent-scope merge. The
+  // top-level bash is the union ceiling of EVERY final agent's bash block — a
+  // true global privilege ceiling, order-stable and idempotent regardless of
+  // which installer regenerates the file. User-authored top-level bash keys the
+  // union does not manage are preserved (non-clobber).
+  const topPermission = mergePermissionBlock(existing.permission, generated.permission);
+  topPermission.bash = composeOpenCodeBashCeiling(
+    objectValue(existing.permission).bash,
+    collectAgentBashRuleSets(mergedAgent),
+  );
   return {
     ...existing,
     $schema: existing.$schema ?? generated.$schema,
     command: removeManagedOpenCodeCommand(existing.command),
     mcp: mergedMcp,
-    permission: mergePermissionBlock(existing.permission, generated.permission),
-    agent: {
-      ...objectValue(existing.agent),
-      remediator: {
-        ...existingRemediator,
-        ...generated.agent.remediator,
-        permission: mergePermissionBlock(
-          existingRemediator.permission,
-          generated.agent.remediator.permission,
-        ),
-      },
-    },
+    permission: topPermission,
+    agent: mergedAgent,
   };
 }