audit-tools 0.34.20 → 0.34.21

package/dist/audit/orchestrator/intentCheckpointGate.js

@@ -1,66 +1,87 @@
 /**
- * O2 — the intent_checkpoint semantic-equivalence gate.
+ * O2 — the intent_checkpoint semantic-equivalence gate (DD-9, wired).
  *
- * The ONE place that decides whether a re-confirmed intent_checkpoint value is
- * semantically EQUIVALENT to the prior one (so dependents need not re-stale) or
- * CHANGED (so the `intent_checkpoint_current` obligation must re-fire and
- * downstream artifacts re-derive). A raw byte/JSON compare over-stales: a host
- * re-confirming the same intent with reordered keys, whitespace, or a benign
- * rephrase would needlessly invalidate the whole planning tree. A pure structural
- * compare under-stales: a genuine intent change phrased to hash-collide on the
- * normalized form would be silently dropped. So the gate is
- * normalize-then-bounded-LLM-judge:
+ * Decides whether a re-confirmed intent_checkpoint is semantically EQUIVALENT to
+ * the form downstreams last derived against (so dependents need not re-stale) or
+ * CHANGED (so the planning cascade re-derives). A raw byte/JSON compare
+ * over-stales: a host re-confirming the same intent with a fresh timestamp,
+ * reordered keys, or a benign rephrase would needlessly invalidate the whole
+ * planning tree. A pure structural compare under-stales: a genuine intent change
+ * phrased to normalize identically would be silently dropped.
  *
- *  1. NORMALIZE both values deterministically (`normalizeCheckpointValue`). Equal
- *     normal forms ⟹ `unchanged` with no judge call (the common, free case).
- *  2. Otherwise a BOUNDED LLM judge decides semantic equivalence. The judge is
- *     FAIL-SAFE: any uncertain / errored / malformed verdict resolves to
- *     `'changed'` (INV-O2-fail-3) — the gate never silently treats an
- *     unverified pair as equivalent.
+ * The semantic surface is SPLIT into two normal forms:
  *
- * VERSION-KEYED VERDICT CACHE (INV-O2-inv-5): a judge verdict is cached on
- * `(priorValue, newValue, gate_version)`. `gate_version` is a LOCALLY-resolved
- * token — `hash(normalizeConfig) + judge-id token + prompt-template version` —
- * computed with NO network/API probe (INV-O2-inv-6). Bumping the normalize
- * config, swapping the locally-resolved judge, or revising the prompt template
- * invalidates every cached verdict deterministically; an unchanged trio is a
- * cache hit so a re-confirm never re-pays the judge.
+ *  - STRUCTURED (`structuredFields`): scope/lens/filter/constraint/design-review
+ *    fields. A structured delta is DETERMINISTICALLY `changed` — an LLM judge
+ *    never arbitrates a numeric/list delta (a `ceiling` 3→5 must never be waved
+ *    through as "equivalent prose").
+ *  - PROSE (`proseFields`): the free-text summaries. A prose-only delta is the
+ *    ONLY thing the bounded host judge arbitrates, and the judge is FAIL-SAFE:
+ *    anything but an explicit `equivalent` verdict resolves to `changed`.
+ *
+ * The judge is the HOST via a bounded step (conversation-first — audit-code has
+ * no in-process LLM): see `intentEquivalenceExecutor.ts` for the obligation /
+ * commit machinery and `artifactMetadata.ts` for how the committed baseline
+ * mirrors the intent entry's revision. There is no in-process lock choreography
+ * and no verdict cache: a verdict is materialized into the persisted baseline at
+ * commit, and the step round-trip re-checks the judged pair against the live
+ * pair before committing (an interleaved intent edit discards the verdict and
+ * re-fires the obligation).
  *
- * LOCK INTERLEAVE DISCIPLINE (INV-O2-inv-7 / inv-8, the O2 lock contract): the
- * judge is SLOW and MUST run OUTSIDE the artifact-tree lock. `runIntentCheckpointGate`
- * therefore: reads a ledger/version token under the lock, releases, runs the
- * judge unlocked, then RE-ACQUIRES the lock and compares the token captured at
- * read against the token now. Any interleaved append (token moved) forces a
- * re-derive — bounded to N attempts. On exhaustion it falls back to taking the
- * lock ACROSS the judge for one final guaranteed-committing derivation, and
- * records that fallback firing through the best-effort friction sink (CE-010
- * residual: a contended friction append under the held non-reentrant lock is
- * swallowed best-effort, never blocking the commit).
+ * VERSION KEYING (INV-O2-inv-5/6): `computeGateVersion` is a LOCALLY-resolved
+ * token — `hash(normalizeConfig) + judge-id token + prompt-template version` —
+ * computed with NO network/API probe. The judge id is the constant `"host"`
+ * (conversation-first: the host agent is always the judge), so every component
+ * is derivable at compare time; a stale component invalidates the persisted
+ * baseline, which the executor resolves as `changed` (over-stale, safe).
+ */
+import { hashContent, stableStringify } from 'audit-tools/shared';
+/**
+ * The single active normalization config (INV-O2-inv-5 input). The two lists
+ * together cover every `IntentCheckpoint` field except the provenance pair
+ * (`confirmed_at`, `confirmed_by`) — which `NON_SEMANTIC_FIELDS_BY_ARTIFACT`
+ * also strips from the canonical content hash. `schema_version` is deliberately
+ * STRUCTURED (a schema migration is a semantic reinterpretation, not
+ * provenance).
  */
-import { captureStepBoundaryFriction, hashContent, stableStringify } from 'audit-tools/shared';
-/** The single active normalization config (INV-O2-inv-5 input). */
 export const DEFAULT_NORMALIZE_CONFIG = {
-    version: 'intent-checkpoint-normalize/v1',
-    semanticFields: ['scope_summary', 'intent_summary', 'free_form_intent', 'constraint_clauses'],
+    version: 'intent-checkpoint-normalize/v2',
+    structuredFields: [
+        'schema_version',
+        'excluded_scope',
+        'must_not_touch',
+        'filters',
+        'disposition_overrides',
+        'lens_selection',
+        'design_review',
+    ],
+    // `constraint_clauses` is PROSE per DD-9's explicit listing (host_answer
+    // rephrases are judge-arbitrated): the clauses array rides the prose normal
+    // form in full, so a clause addition/removal is visible to the judge and a
+    // benign answer rephrase is judgeable rather than deterministically re-staling
+    // the cascade.
+    proseFields: [
+        'scope_summary',
+        'intent_summary',
+        'free_form_intent',
+        'constraint_clauses',
+    ],
 };
 /** Static prompt-template version — bump on any judge-prompt change. */
 export const INTENT_GATE_PROMPT_TEMPLATE_VERSION = 'intent-checkpoint-judge-prompt/v1';
 /**
- * Deterministically normalize an intent_checkpoint value to its semantic normal
- * form. Only `config.semanticFields` participate; values are canonically
- * serialized (stable key order) so reordering/whitespace is invisible. An absent
- * checkpoint normalizes to a stable empty marker so present-vs-absent is a real
- * difference, not a crash.
+ * The locally-resolved judge id (conversation-first: the host agent is always
+ * the judge). A constant so every `gate_version` component is derivable at
+ * compare time with no probe.
  */
-export function normalizeCheckpointValue(checkpoint, config = DEFAULT_NORMALIZE_CONFIG) {
-    if (!checkpoint)
-        return stableStringify({ __absent: true });
+export const HOST_JUDGE_ID = 'host';
+function projectFields(checkpoint, fields) {
     const projection = {};
-    for (const field of config.semanticFields) {
+    for (const field of fields) {
         const value = checkpoint[field];
         if (value !== undefined) {
-            // free_form_intent is whitespace-insensitive at the edges; clauses/objects
-            // are compared structurally via the stable serializer.
+            // Prose is whitespace-insensitive at the edges; structured values are
+            // compared structurally via the stable serializer (key order invisible).
             projection[field] =
                 typeof value === 'string' ? value.trim() : value;
         }
@@ -68,127 +89,41 @@ export function normalizeCheckpointValue(checkpoint, config = DEFAULT_NORMALIZE_
     return stableStringify(projection);
 }
 /**
- * Compute the LOCALLY-resolved `gate_version` cache key component:
- * `hash(normalizeConfig) + judge-id token + prompt-template version`.
- *
- * NO network/API probe (INV-O2-inv-6): the judge id is a caller-supplied LOCAL
- * token (e.g. a configured model id string already known to the host, or a
- * sentinel like `'host'`), never a live capability query. Bumping the normalize
- * config, the judge id, or the prompt template deterministically invalidates the
- * verdict cache.
+ * Deterministically normalize an intent_checkpoint value to its two semantic
+ * normal forms. An absent checkpoint normalizes to a stable empty marker so
+ * present-vs-absent is a real difference, not a crash.
  */
-export function computeGateVersion(input) {
-    const normalizeConfig = input.normalizeConfig ?? DEFAULT_NORMALIZE_CONFIG;
-    const promptTemplateVersion = input.promptTemplateVersion ?? INTENT_GATE_PROMPT_TEMPLATE_VERSION;
-    const configHash = hashContent(stableStringify(normalizeConfig), { length: 16 });
-    return `${configHash}:${input.judgeId}:${promptTemplateVersion}`;
-}
-/** Build the deterministic verdict-cache key from the version-keyed trio. */
-export function verdictCacheKey(priorNormalized, newNormalized, gateVersion) {
-    return hashContent(stableStringify([priorNormalized, newNormalized, gateVersion]));
+export function normalizeCheckpointForms(checkpoint, config = DEFAULT_NORMALIZE_CONFIG) {
+    if (!checkpoint) {
+        const absent = stableStringify({ __absent: true });
+        return { structured: absent, prose: absent };
+    }
+    return {
+        structured: projectFields(checkpoint, config.structuredFields),
+        prose: projectFields(checkpoint, config.proseFields),
+    };
 }
 /**
- * The normalize-then-bounded-LLM-judge equivalence gate.
- *
- * 1. Normalize both values; equal normal forms ⟹ `unchanged`, no judge call.
- * 2. Cache hit on (priorNormalized, newNormalized, gate_version) ⟹ cached verdict.
- * 3. Otherwise run the bounded judge; FAIL-SAFE — uncertain/errored/non-boolean
- *    ⟹ `'changed'`. Cache and return.
- *
- * Pure decision: holds no lock and does no artifact IO. The lock-interleave
- * discipline lives in `runIntentCheckpointGate`.
+ * Compute the LOCALLY-resolved `gate_version` token:
+ * `hash(normalizeConfig) + judge-id token + prompt-template version`.
+ * NO network/API probe (INV-O2-inv-6). Bumping the normalize config, the judge
+ * id, or the prompt template deterministically invalidates the persisted
+ * baseline (the executor resolves the mismatch as `changed` — over-stale, the
+ * safe direction).
  */
-export async function intentCheckpointEquivalenceGate(input) {
-    const config = input.normalizeConfig ?? DEFAULT_NORMALIZE_CONFIG;
-    const priorNormalized = normalizeCheckpointValue(input.prior, config);
-    const newNormalized = normalizeCheckpointValue(input.next, config);
-    const gateVersion = computeGateVersion({
-        normalizeConfig: config,
-        judgeId: input.judgeId,
-        promptTemplateVersion: input.promptTemplateVersion,
-    });
-    if (priorNormalized === newNormalized) {
-        return { verdict: 'unchanged', gateVersion, judged: false };
-    }
-    const cacheKey = verdictCacheKey(priorNormalized, newNormalized, gateVersion);
-    const cached = input.cache?.get(cacheKey);
-    if (cached !== undefined) {
-        return { verdict: cached, gateVersion, judged: false };
-    }
-    let verdict;
-    try {
-        const equivalent = await input.judge({ priorNormalized, newNormalized });
-        // FAIL-SAFE: only an explicit `true` resolves to unchanged; anything else
-        // (false, non-boolean, undefined) is treated as changed.
-        verdict = equivalent === true ? 'unchanged' : 'changed';
-    }
-    catch {
-        // FAIL-SAFE: a judge error never silently passes as equivalent.
-        verdict = 'changed';
-    }
-    input.cache?.set(cacheKey, verdict);
-    return { verdict, gateVersion, judged: true };
+export function computeGateVersion(input) {
+    const normalizeConfig = input?.normalizeConfig ?? DEFAULT_NORMALIZE_CONFIG;
+    const judgeId = input?.judgeId ?? HOST_JUDGE_ID;
+    const promptTemplateVersion = input?.promptTemplateVersion ?? INTENT_GATE_PROMPT_TEMPLATE_VERSION;
+    const configHash = hashContent(stableStringify(normalizeConfig), { length: 16 });
+    return `${configHash}:${judgeId}:${promptTemplateVersion}`;
 }
 /**
- * Run the intent_checkpoint gate under the O2 lock-interleave discipline.
- *
- * The judge is SLOW and runs OUTSIDE the held lock. Sequence per attempt:
- *  1. Acquire the lock; read the current ledger/version token; release.
- *  2. Run the bounded equivalence gate (judge) UNLOCKED.
- *  3. Re-acquire the lock; read the token again. If unchanged, COMMIT the verdict
- *     under the lock and return. If an interleaved append moved the token,
- *     release and re-derive (bounded to `maxAttempts`).
- *  4. On attempt exhaustion, take the lock ACROSS the judge for one final
- *     guaranteed-committing derivation, recording the fallback firing through the
- *     best-effort friction sink (CE-010 residual — never blocks the commit).
- *
- * `withLock` is the artifact-tree lock wrapper (e.g. `withFileLock` bound to the
- * artifact-tree lock path); `commit` persists the decided verdict under the held
- * lock and is the single mutation point.
+ * Hash one normal form for pair identification (the judge submission names the
+ * pair it judged by these hashes, and consumption re-derives them from the live
+ * checkpoint to detect an interleaved edit).
  */
-export async function runIntentCheckpointGate(deps) {
-    const maxAttempts = deps.maxAttempts ?? 3;
-    for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
-        // (1) Capture the read-time token under the lock, then release.
-        const readToken = await deps.withLock(() => deps.readLedgerToken());
-        // (2) Run the slow judge UNLOCKED.
-        const { verdict } = await deps.gate();
-        // (3) Re-acquire; if no interleave, commit under the lock.
-        const outcome = await deps.withLock(async () => {
-            const nowToken = await deps.readLedgerToken();
-            if (nowToken !== readToken) {
-                // Interleaved append — bail out of this attempt and re-derive.
-                return { committed: undefined, interleaved: true };
-            }
-            const committed = await deps.commit(verdict);
-            return { committed, interleaved: false };
-        });
-        if (!outcome.interleaved) {
-            return { verdict, committed: outcome.committed, usedFallback: false };
-        }
-        // else: token moved during the unlocked judge — loop and re-derive.
-    }
-    // (4) Attempts exhausted under repeated contention: take the lock ACROSS the
-    // judge for one final guaranteed-committing derivation. Record the fallback
-    // firing best-effort (CE-010 residual: a contended friction append under the
-    // held non-reentrant lock is swallowed best-effort, never blocking the commit).
-    return deps.withLock(async () => {
-        if (deps.artifactsDir && deps.runId) {
-            // Fire-and-forget but awaited: captureFrictionEvent is itself best-effort
-            // and never throws, so it can never block the commit below.
-            await captureStepBoundaryFriction(deps.artifactsDir, deps.runId, {
-                eventType: 'intent_gate_fallback',
-                discriminator: 'lock-across-judge-fallback',
-                category: 'trap',
-                severity: 'low',
-                area: 'intent_checkpoint gate',
-                note: 'intent_checkpoint gate fell back to taking the lock across the LLM judge after ' +
-                    `${maxAttempts} interleaved re-derive attempts; one guaranteed-committing derivation ran under the held lock.`,
-            }, 'audit-code');
-        }
-        const { verdict } = await deps.gate();
-        const committed = await deps.commit(verdict);
-        return { verdict, committed, usedFallback: true };
-    });
+export function normalFormHash(normalized) {
+    return hashContent(normalized, { length: 16 });
 }
 //# sourceMappingURL=intentCheckpointGate.js.map

package/dist/audit/orchestrator/intentCheckpointGate.js.map

@@ -1 +1 @@
-{"version":3,"file":"intentCheckpointGate.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/intentCheckpointGate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EAAE,2BAA2B,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAkC/F,mEAAmE;AACnE,MAAM,CAAC,MAAM,wBAAwB,GAAoB;IACvD,OAAO,EAAE,gCAAgC;IACzC,cAAc,EAAE,CAAC,eAAe,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,oBAAoB,CAAC;CAC9F,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,mCAAmC,GAAG,mCAAmC,CAAC;AAEvF;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAwC,EACxC,SAA0B,wBAAwB;IAElD,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,UAAU,GAA4B,EAAE,CAAC;IAC/C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,2EAA2E;YAC3E,uDAAuD;YACvD,UAAU,CAAC,KAAe,CAAC;gBACzB,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QACrD,CAAC;IACH,CAAC;IACD,OAAO,eAAe,CAAC,UAAU,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAKlC;IACC,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,wBAAwB,CAAC;IAC1E,MAAM,qBAAqB,GACzB,KAAK,CAAC,qBAAqB,IAAI,mCAAmC,CAAC;IACrE,MAAM,UAAU,GAAG,WAAW,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IACjF,OAAO,GAAG,UAAU,IAAI,KAAK,CAAC,OAAO,IAAI,qBAAqB,EAAE,CAAC;AACnE,CAAC;AAQD,6EAA6E;AAC7E,MAAM,UAAU,eAAe,CAC7B,eAAuB,EACvB,aAAqB,EACrB,WAAmB;IAEnB,OAAO,WAAW,CAChB,eAAe,CAAC,CAAC,eAAe,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAC/D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAQrD;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,eAAe,IAAI,wBAAwB,CAAC;IACjE,MAAM,eAAe,GAAG,wBAAwB,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,aAAa,GAAG,wBAAwB,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnE,MAAM,WAAW,GAAG,kBAAkB,CAAC;QACrC,eAAe,EAAE,MAAM;QACvB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;KACnD,CAAC,CAAC;IAEH,IAAI,eAAe,KAAK,aAAa,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,eAAe,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC,CAAC;QACzE,0EAA0E;QAC1E,yDAAyD;QACzD,OAAO,GAAG,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;QAChE,OAAO,GAAG,SAAS,CAAC;IACtB,CAAC;IACD,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACpC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAChD,CAAC;AAaD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAI,IAShD;IACC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;IAE1C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAC1D,gEAAgE;QAChE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;QAEpE,mCAAmC;QACnC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAEtC,2DAA2D;QAC3D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE;YAC7C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;YAC9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,+DAA+D;gBAC/D,OAAO,EAAE,SAAS,EAAE,SAA0B,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;YACtE,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAc,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QAC7E,CAAC;QACD,oEAAoE;IACtE,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,gFAAgF;IAChF,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE;QAC9B,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACpC,0EAA0E;YAC1E,4DAA4D;YAC5D,MAAM,2BAA2B,CAC/B,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,KAAK,EACV;gBACE,SAAS,EAAE,sBAAsB;gBACjC,aAAa,EAAE,4BAA4B;gBAC3C,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,KAAK;gBACf,IAAI,EAAE,wBAAwB;gBAC9B,IAAI,EACF,iFAAiF;oBACjF,GAAG,WAAW,gGAAgG;aACjH,EACD,YAAY,CACb,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"intentCheckpointGate.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/intentCheckpointGate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAuBlE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAoB;IACvD,OAAO,EAAE,gCAAgC;IACzC,gBAAgB,EAAE;QAChB,gBAAgB;QAChB,gBAAgB;QAChB,gBAAgB;QAChB,SAAS;QACT,uBAAuB;QACvB,gBAAgB;QAChB,eAAe;KAChB;IACD,yEAAyE;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,+EAA+E;IAC/E,eAAe;IACf,WAAW,EAAE;QACX,eAAe;QACf,gBAAgB;QAChB,kBAAkB;QAClB,oBAAoB;KACrB;CACF,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,mCAAmC,GAAG,mCAAmC,CAAC;AAEvF;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC;AAQpC,SAAS,aAAa,CACpB,UAA4B,EAC5B,MAA2C;IAE3C,MAAM,UAAU,GAA4B,EAAE,CAAC;IAC/C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,sEAAsE;YACtE,yEAAyE;YACzE,UAAU,CAAC,KAAe,CAAC;gBACzB,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QACrD,CAAC;IACH,CAAC;IACD,OAAO,eAAe,CAAC,UAAU,CAAC,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAwC,EACxC,SAA0B,wBAAwB;IAElD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO;QACL,UAAU,EAAE,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC,gBAAgB,CAAC;QAC9D,KAAK,EAAE,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC;KACrD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAKlC;IACC,MAAM,eAAe,GAAG,KAAK,EAAE,eAAe,IAAI,wBAAwB,CAAC;IAC3E,MAAM,OAAO,GAAG,KAAK,EAAE,OAAO,IAAI,aAAa,CAAC;IAChD,MAAM,qBAAqB,GACzB,KAAK,EAAE,qBAAqB,IAAI,mCAAmC,CAAC;IACtE,MAAM,UAAU,GAAG,WAAW,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IACjF,OAAO,GAAG,UAAU,IAAI,OAAO,IAAI,qBAAqB,EAAE,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,OAAO,WAAW,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC"}

package/dist/audit/orchestrator/intentEquivalenceExecutor.d.ts

@@ -0,0 +1,83 @@
+/**
+ * DD-9 — the intent-equivalence obligation's executor.
+ *
+ * Decides whether the live `intent_checkpoint.json` is semantically equivalent
+ * to the baseline downstreams last derived against, and COMMITS the resolution
+ * into `artifact_metadata.intent_baseline` — the revision authority the
+ * metadata stamper mirrors (see `artifactMetadata.ts`): a committed `changed`
+ * advances `baseline.revision` (downstreams re-stale exactly once); an
+ * `equivalent` advances only the normal forms (downstreams never notice).
+ *
+ * Arms (see `deriveIntentEquivalenceStatus`):
+ *  - `satisfied` — no checkpoint, or forms match the gate-current baseline.
+ *  - `stamp_baseline` — no baseline yet: stamp from the current checkpoint
+ *    (deterministic, drainable). First-contact on legacy run dirs.
+ *  - `gate_version_stale` — the persisted baseline predates the current
+ *    normalize-config / judge / prompt-template trio: resolve as CHANGED
+ *    (over-stale, the safe direction; the old normal forms are not comparable).
+ *  - `structured_changed` — the STRUCTURED normal form moved: deterministically
+ *    CHANGED, no judge (an LLM must never arbitrate a numeric/list delta).
+ *  - `prose_judgment_pending` — structured equal, prose moved: the bounded host
+ *    judge owns the verdict (conversation flow emits the judge step; pure
+ *    headless resolves as CHANGED, fail-safe).
+ *
+ * A judge submission names the pair it judged (`judged_pair` normal-form
+ * hashes); consumption re-derives the live pair and DISCARDS a stale verdict
+ * (the checkpoint moved again mid-judgment) so the obligation re-fires on the
+ * new pair — the O2 interleave property realized by the step round-trip itself.
+ */
+import { z } from "zod";
+import type { ArtifactBundle } from "../io/artifacts.js";
+import type { ExecutorRunResult } from "./executorResult.js";
+export declare const IntentEquivalenceVerdictSchema: z.ZodObject<{
+    verdict: z.ZodEnum<["equivalent", "changed"]>;
+    judged_pair: z.ZodObject<{
+        prior_hash: z.ZodString;
+        new_hash: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        prior_hash: string;
+        new_hash: string;
+    }, {
+        prior_hash: string;
+        new_hash: string;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    verdict: "changed" | "equivalent";
+    judged_pair: {
+        prior_hash: string;
+        new_hash: string;
+    };
+}, {
+    verdict: "changed" | "equivalent";
+    judged_pair: {
+        prior_hash: string;
+        new_hash: string;
+    };
+}>;
+export type IntentEquivalenceVerdictSubmission = z.infer<typeof IntentEquivalenceVerdictSchema>;
+export type IntentEquivalenceStatus = {
+    kind: "satisfied";
+} | {
+    kind: "stamp_baseline";
+} | {
+    kind: "gate_version_stale";
+} | {
+    kind: "structured_changed";
+} | {
+    kind: "prose_judgment_pending";
+    prior_prose: string;
+    current_prose: string;
+    prior_hash: string;
+    new_hash: string;
+};
+/** Pure derivation of the obligation's state from the live bundle. */
+export declare function deriveIntentEquivalenceStatus(bundle: ArtifactBundle): IntentEquivalenceStatus;
+/**
+ * Resolve the obligation. `verdict` is the consumed judge submission when one
+ * arrived this step; absent, every arm resolves deterministically — including
+ * `prose_judgment_pending` → CHANGED, which is only reachable verdict-less in
+ * the pure-headless drain (the conversation flow emits the judge step instead)
+ * and is the fail-safe direction there.
+ */
+export declare function runIntentEquivalenceResolve(bundle: ArtifactBundle, verdict?: IntentEquivalenceVerdictSubmission): ExecutorRunResult;
+//# sourceMappingURL=intentEquivalenceExecutor.d.ts.map

package/dist/audit/orchestrator/intentEquivalenceExecutor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"intentEquivalenceExecutor.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/intentEquivalenceExecutor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAQ7D,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;EAUhC,CAAC;AACZ,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CACtD,OAAO,8BAA8B,CACtC,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAC/B;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAC1B;IAAE,IAAI,EAAE,oBAAoB,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,oBAAoB,CAAA;CAAE,GAC9B;IACE,IAAI,EAAE,wBAAwB,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEN,sEAAsE;AACtE,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,cAAc,GACrB,uBAAuB,CAsBzB;AAsBD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,cAAc,EACtB,OAAO,CAAC,EAAE,kCAAkC,GAC3C,iBAAiB,CAsHnB"}

package/dist/audit/orchestrator/intentEquivalenceExecutor.js

@@ -0,0 +1,188 @@
+/**
+ * DD-9 — the intent-equivalence obligation's executor.
+ *
+ * Decides whether the live `intent_checkpoint.json` is semantically equivalent
+ * to the baseline downstreams last derived against, and COMMITS the resolution
+ * into `artifact_metadata.intent_baseline` — the revision authority the
+ * metadata stamper mirrors (see `artifactMetadata.ts`): a committed `changed`
+ * advances `baseline.revision` (downstreams re-stale exactly once); an
+ * `equivalent` advances only the normal forms (downstreams never notice).
+ *
+ * Arms (see `deriveIntentEquivalenceStatus`):
+ *  - `satisfied` — no checkpoint, or forms match the gate-current baseline.
+ *  - `stamp_baseline` — no baseline yet: stamp from the current checkpoint
+ *    (deterministic, drainable). First-contact on legacy run dirs.
+ *  - `gate_version_stale` — the persisted baseline predates the current
+ *    normalize-config / judge / prompt-template trio: resolve as CHANGED
+ *    (over-stale, the safe direction; the old normal forms are not comparable).
+ *  - `structured_changed` — the STRUCTURED normal form moved: deterministically
+ *    CHANGED, no judge (an LLM must never arbitrate a numeric/list delta).
+ *  - `prose_judgment_pending` — structured equal, prose moved: the bounded host
+ *    judge owns the verdict (conversation flow emits the judge step; pure
+ *    headless resolves as CHANGED, fail-safe).
+ *
+ * A judge submission names the pair it judged (`judged_pair` normal-form
+ * hashes); consumption re-derives the live pair and DISCARDS a stale verdict
+ * (the checkpoint moved again mid-judgment) so the obligation re-fires on the
+ * new pair — the O2 interleave property realized by the step round-trip itself.
+ */
+import { z } from "zod";
+import { METADATA_SCHEMA_VERSION } from "../types/artifactMetadata.js";
+import { computeGateVersion, normalizeCheckpointForms, normalFormHash, } from "./intentCheckpointGate.js";
+import { hashArtifactValue } from "./artifactFreshness.js";
+export const IntentEquivalenceVerdictSchema = z
+    .object({
+    verdict: z.enum(["equivalent", "changed"]),
+    judged_pair: z
+        .object({
+        prior_hash: z.string(),
+        new_hash: z.string(),
+    })
+        .strict(),
+})
+    .strict();
+/** Pure derivation of the obligation's state from the live bundle. */
+export function deriveIntentEquivalenceStatus(bundle) {
+    const checkpoint = bundle.intent_checkpoint;
+    if (!checkpoint)
+        return { kind: "satisfied" };
+    const baseline = bundle.artifact_metadata?.intent_baseline;
+    if (!baseline)
+        return { kind: "stamp_baseline" };
+    if (baseline.gate_version !== computeGateVersion()) {
+        return { kind: "gate_version_stale" };
+    }
+    const forms = normalizeCheckpointForms(checkpoint);
+    if (forms.structured !== baseline.normalized_structured) {
+        return { kind: "structured_changed" };
+    }
+    if (forms.prose !== baseline.normalized_prose) {
+        return {
+            kind: "prose_judgment_pending",
+            prior_prose: baseline.normalized_prose,
+            current_prose: forms.prose,
+            prior_hash: normalFormHash(baseline.normalized_prose),
+            new_hash: normalFormHash(forms.prose),
+        };
+    }
+    return { kind: "satisfied" };
+}
+function withBaseline(bundle, baseline) {
+    const manifest = bundle.artifact_metadata ?? {
+        metadata_schema_version: METADATA_SCHEMA_VERSION,
+        artifacts: {},
+    };
+    return {
+        ...bundle,
+        artifact_metadata: { ...manifest, intent_baseline: baseline },
+    };
+}
+function currentEntryRevision(bundle) {
+    return (bundle.artifact_metadata?.artifacts["intent_checkpoint.json"]?.revision ?? 0);
+}
+/**
+ * Resolve the obligation. `verdict` is the consumed judge submission when one
+ * arrived this step; absent, every arm resolves deterministically — including
+ * `prose_judgment_pending` → CHANGED, which is only reachable verdict-less in
+ * the pure-headless drain (the conversation flow emits the judge step instead)
+ * and is the fail-safe direction there.
+ */
+export function runIntentEquivalenceResolve(bundle, verdict) {
+    const status = deriveIntentEquivalenceStatus(bundle);
+    const checkpoint = bundle.intent_checkpoint;
+    if (status.kind === "satisfied" || !checkpoint) {
+        return {
+            updated: bundle,
+            artifacts_written: [],
+            progress_summary: "Intent-equivalence baseline already current; nothing to resolve.",
+        };
+    }
+    const forms = normalizeCheckpointForms(checkpoint);
+    const gateVersion = computeGateVersion();
+    const resolveChanged = (why) => {
+        const baseline = {
+            normalized_structured: forms.structured,
+            normalized_prose: forms.prose,
+            revision: currentEntryRevision(bundle) + 1,
+            gate_version: gateVersion,
+        };
+        return {
+            updated: withBaseline(bundle, baseline),
+            artifacts_written: [],
+            progress_summary: `Intent checkpoint resolved as CHANGED (${why}); downstream planning artifacts re-stale once.`,
+        };
+    };
+    if (status.kind === "stamp_baseline") {
+        // First contact. If the recorded entry hash does NOT match the live
+        // checkpoint, a change is PENDING whose prior semantics are unknowable (no
+        // baseline was ever recorded) — adopting the old revision here would let
+        // the revision mirror restamp the entry and silently evaporate the
+        // downstream staleness that change legitimately owes (fail-OPEN on legacy
+        // run dirs). Resolve it as CHANGED instead (over-stale, safe). Only a
+        // hash-consistent first contact stamps quietly at the current revision.
+        const entry = bundle.artifact_metadata?.artifacts["intent_checkpoint.json"];
+        if (entry &&
+            entry.content_hash !== hashArtifactValue("intent_checkpoint.json", checkpoint)) {
+            return resolveChanged("first contact with a pending checkpoint change; prior semantics unrecorded");
+        }
+        const baseline = {
+            normalized_structured: forms.structured,
+            normalized_prose: forms.prose,
+            // Mirror what the ordinary bump rules will assign this entry at the next
+            // metadata pass: an existing entry keeps its revision; a first-ever entry
+            // gets 1 (0 + 1).
+            revision: Math.max(currentEntryRevision(bundle), 1),
+            gate_version: gateVersion,
+        };
+        return {
+            updated: withBaseline(bundle, baseline),
+            artifacts_written: [],
+            progress_summary: "Stamped the intent-equivalence baseline from the current checkpoint (first contact).",
+        };
+    }
+    if (status.kind === "gate_version_stale") {
+        return resolveChanged("normalize/judge/prompt version moved; prior baseline not comparable");
+    }
+    if (status.kind === "structured_changed") {
+        return resolveChanged("structured intent fields differ — deterministic, never LLM-judged");
+    }
+    // prose_judgment_pending
+    if (!verdict) {
+        return resolveChanged("prose differs and no host judge is available (headless fail-safe)");
+    }
+    if (verdict.judged_pair.prior_hash !== status.prior_hash ||
+        verdict.judged_pair.new_hash !== status.new_hash) {
+        // The checkpoint moved again mid-judgment: discard the stale verdict; the
+        // obligation stays pending and the judge step re-fires on the live pair.
+        // Loud on stderr (mirrors the quarantine path) — the host otherwise sees a
+        // fresh judge step with different hashes and no statement of why its
+        // verdict vanished.
+        process.stderr.write(`[audit-code] intent-equivalence verdict discarded: it judged pair ` +
+            `${verdict.judged_pair.prior_hash}:${verdict.judged_pair.new_hash} but the live pair is ` +
+            `${status.prior_hash}:${status.new_hash} (the checkpoint changed again mid-judgment). ` +
+            `The judge step re-fires with the current pair.\n`);
+        return {
+            updated: bundle,
+            artifacts_written: [],
+            progress_summary: "Discarded a stale intent-equivalence verdict (the checkpoint changed again mid-judgment); the judge step re-fires on the live pair.",
+        };
+    }
+    if (verdict.verdict === "changed") {
+        return resolveChanged("host judge verdict: changed");
+    }
+    // equivalent: advance the normal forms; the revision authority stays put, so
+    // downstream `dependency_revisions` compares stay clean and nothing re-derives.
+    const baseline = {
+        normalized_structured: forms.structured,
+        normalized_prose: forms.prose,
+        revision: bundle.artifact_metadata?.intent_baseline?.revision ??
+            Math.max(currentEntryRevision(bundle), 1),
+        gate_version: gateVersion,
+    };
+    return {
+        updated: withBaseline(bundle, baseline),
+        artifacts_written: [],
+        progress_summary: "Host judge verdict: EQUIVALENT — baseline normal forms advanced; downstream planning artifacts stay fresh (no re-derivation).",
+    };
+}
+//# sourceMappingURL=intentEquivalenceExecutor.js.map

package/dist/audit/orchestrator/intentEquivalenceExecutor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"intentEquivalenceExecutor.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/intentEquivalenceExecutor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAIvE,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,cAAc,GACf,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC5C,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC1C,WAAW,EAAE,CAAC;SACX,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;KACrB,CAAC;SACD,MAAM,EAAE;CACZ,CAAC;KACD,MAAM,EAAE,CAAC;AAkBZ,sEAAsE;AACtE,MAAM,UAAU,6BAA6B,CAC3C,MAAsB;IAEtB,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAC5C,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB,EAAE,eAAe,CAAC;IAC3D,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACjD,IAAI,QAAQ,CAAC,YAAY,KAAK,kBAAkB,EAAE,EAAE,CAAC;QACnD,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,KAAK,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;IACnD,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,qBAAqB,EAAE,CAAC;QACxD,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;IACxC,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAC9C,OAAO;YACL,IAAI,EAAE,wBAAwB;YAC9B,WAAW,EAAE,QAAQ,CAAC,gBAAgB;YACtC,aAAa,EAAE,KAAK,CAAC,KAAK;YAC1B,UAAU,EAAE,cAAc,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACrD,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC;SACtC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,YAAY,CACnB,MAAsB,EACtB,QAAwB;IAExB,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB,IAAI;QAC3C,uBAAuB,EAAE,uBAAuB;QAChD,SAAS,EAAE,EAAE;KACd,CAAC;IACF,OAAO;QACL,GAAG,MAAM;QACT,iBAAiB,EAAE,EAAE,GAAG,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE;KAC9D,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAsB;IAClD,OAAO,CACL,MAAM,CAAC,iBAAiB,EAAE,SAAS,CAAC,wBAAwB,CAAC,EAAE,QAAQ,IAAI,CAAC,CAC7E,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAsB,EACtB,OAA4C;IAE5C,MAAM,MAAM,GAAG,6BAA6B,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAC5C,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/C,OAAO;YACL,OAAO,EAAE,MAAM;YACf,iBAAiB,EAAE,EAAE;YACrB,gBAAgB,EACd,kEAAkE;SACrE,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,WAAW,GAAG,kBAAkB,EAAE,CAAC;IAEzC,MAAM,cAAc,GAAG,CAAC,GAAW,EAAqB,EAAE;QACxD,MAAM,QAAQ,GAAmB;YAC/B,qBAAqB,EAAE,KAAK,CAAC,UAAU;YACvC,gBAAgB,EAAE,KAAK,CAAC,KAAK;YAC7B,QAAQ,EAAE,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC;YAC1C,YAAY,EAAE,WAAW;SAC1B,CAAC;QACF,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC;YACvC,iBAAiB,EAAE,EAAE;YACrB,gBAAgB,EAAE,0CAA0C,GAAG,iDAAiD;SACjH,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACrC,oEAAoE;QACpE,2EAA2E;QAC3E,yEAAyE;QACzE,mEAAmE;QACnE,0EAA0E;QAC1E,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,KAAK,GACT,MAAM,CAAC,iBAAiB,EAAE,SAAS,CAAC,wBAAwB,CAAC,CAAC;QAChE,IACE,KAAK;YACL,KAAK,CAAC,YAAY,KAAK,iBAAiB,CAAC,wBAAwB,EAAE,UAAU,CAAC,EAC9E,CAAC;YACD,OAAO,cAAc,CACnB,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAmB;YAC/B,qBAAqB,EAAE,KAAK,CAAC,UAAU;YACvC,gBAAgB,EAAE,KAAK,CAAC,KAAK;YAC7B,yEAAyE;YACzE,0EAA0E;YAC1E,kBAAkB;YAClB,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACnD,YAAY,EAAE,WAAW;SAC1B,CAAC;QACF,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC;YACvC,iBAAiB,EAAE,EAAE;YACrB,gBAAgB,EACd,sFAAsF;SACzF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QACzC,OAAO,cAAc,CAAC,qEAAqE,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QACzC,OAAO,cAAc,CAAC,mEAAmE,CAAC,CAAC;IAC7F,CAAC;IAED,yBAAyB;IACzB,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,cAAc,CACnB,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,IACE,OAAO,CAAC,WAAW,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU;QACpD,OAAO,CAAC,WAAW,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAChD,CAAC;QACD,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,qEAAqE;QACrE,oBAAoB;QACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oEAAoE;YAClE,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,IAAI,OAAO,CAAC,WAAW,CAAC,QAAQ,wBAAwB;YACzF,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,gDAAgD;YACvF,kDAAkD,CACrD,CAAC;QACF,OAAO;YACL,OAAO,EAAE,MAAM;YACf,iBAAiB,EAAE,EAAE;YACrB,gBAAgB,EACd,qIAAqI;SACxI,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,cAAc,CAAC,6BAA6B,CAAC,CAAC;IACvD,CAAC;IACD,6EAA6E;IAC7E,gFAAgF;IAChF,MAAM,QAAQ,GAAmB;QAC/B,qBAAqB,EAAE,KAAK,CAAC,UAAU;QACvC,gBAAgB,EAAE,KAAK,CAAC,KAAK;QAC7B,QAAQ,EACN,MAAM,CAAC,iBAAiB,EAAE,eAAe,EAAE,QAAQ;YACnD,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3C,YAAY,EAAE,WAAW;KAC1B,CAAC;IACF,OAAO;QACL,OAAO,EAAE,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC;QACvC,iBAAiB,EAAE,EAAE;QACrB,gBAAgB,EACd,+HAA+H;KAClI,CAAC;AACJ,CAAC"}

package/dist/audit/orchestrator/nextStep.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nextStep.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/nextStep.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAI1E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,UAAU,CAAC;IAClB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,6BAA6B,CAAC;AAEzE,eAAO,MAAM,QAAQ,EAAE,MAAM,EA+B5B,CAAC;AAkCF,wBAAgB,cAAc,CAC5B,WAAW,EAAE,eAAe,EAAE,GAC7B,eAAe,GAAG,SAAS,CAE7B;AAED,oCAAoC;AACpC,MAAM,WAAW,qBAAqB;IACpC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAChD;AAED,wBAAgB,cAAc,CAC5B,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,qBAA0B,GAClC,gBAAgB,CA6ClB;AAED;;;;;;GAMG;AACH,wBAAsB,2BAA2B,CAC/C,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,sBAAsB,CAAC,CAEjC"}
+{"version":3,"file":"nextStep.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/nextStep.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAI1E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,UAAU,CAAC;IAClB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,6BAA6B,CAAC;AAEzE,eAAO,MAAM,QAAQ,EAAE,MAAM,EAmC5B,CAAC;AAkCF,wBAAgB,cAAc,CAC5B,WAAW,EAAE,eAAe,EAAE,GAC7B,eAAe,GAAG,SAAS,CAE7B;AAED,oCAAoC;AACpC,MAAM,WAAW,qBAAqB;IACpC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAChD;AAED,wBAAgB,cAAc,CAC5B,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,qBAA0B,GAClC,gBAAgB,CA6ClB;AAED;;;;;;GAMG;AACH,wBAAsB,2BAA2B,CAC/C,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,sBAAsB,CAAC,CAEjC"}

package/dist/audit/orchestrator/nextStep.js

@@ -21,6 +21,10 @@ export const PRIORITY = [
     "design_assessment_current",
     "structure_decomposition_current",
     "intent_checkpoint_current",
+    // DD-9: the equivalence gate sits between the checkpoint and EVERY consumer
+    // of it (charters, coverage, tasks all derive at/below the charter slot), so
+    // a pending prose judgment pauses the cascade instead of racing it.
+    "intent_equivalence_current",
     "charter_extraction_current",
     "charter_delta_current",
     "design_review_contract_completed",