audit-tools 0.34.29 → 0.34.31

package/dist/shared/types/sessionConfig.d.ts

@@ -3,14 +3,25 @@ import type { DispatchModelTier } from "./stepContract.js";
 export declare const PROVIDER_NAMES: readonly ["auto", "worker-command", "subprocess-template", "claude-code", "claude-worker", "codex", "opencode", "openai-compatible", "vscode-task", "antigravity", "agy"];
 export type ProviderName = (typeof PROVIDER_NAMES)[number];
 export type ResolvedProviderName = Exclude<ProviderName, "auto">;
+/**
+ * A provider that can be the conversation HOST driving a run. `claude-worker` is
+ * the proxied dispatch-worker class and is excluded by construction, so a host
+ * identity can never be typed as one — the type states what
+ * {@link assertHostProviderName} already enforces at runtime.
+ */
+export type HostProviderName = Exclude<ProviderName, "claude-worker">;
 /**
  * Validate a `--host-provider` CLI value against {@link PROVIDER_NAMES}, throwing
  * the same message both orchestrators surface on a typo (host_provider is a
  * quota-ATTRIBUTION key — a silently-wrong value would mis-charge dispatch fan-out
  * to the wrong account). Single-sourced so audit's `getHostProvider` and
  * remediate's `parseHostProviderOption` cannot drift.
+ *
+ * Narrows to {@link HostProviderName}, not `ProviderName`: this function rejects
+ * `claude-worker`, so asserting the wider type would hand every caller a value
+ * the validator just refused.
  */
-export declare function assertHostProviderName(value: string): asserts value is ProviderName;
+export declare function assertHostProviderName(value: string): asserts value is HostProviderName;
 /**
  * The attended-vs-headless discriminator for dispatch (defect-1). TRUE (default,
  * conversation-first) means an attended conversation host is driving THIS invocation
@@ -342,6 +353,19 @@ export interface DispatchableSource {
     api_key_env?: string;
     /** Inline API key (discouraged — prefer `api_key_env`). */
     api_key?: string;
+    /**
+     * Operator-declared: this endpoint takes NO credential (an unauthenticated local
+     * proxy — LiteLLM with no master key, LM Studio, a local vLLM). Reach is then
+     * proven by an endpoint liveness probe instead of by an env var, exactly as the
+     * `claude-worker` proxy lane already does.
+     *
+     * EXPLICIT by design, never inferred from an omitted `api_key_env`: forgetting the
+     * key is the common error, and the liveness probe cannot catch it (any HTTP status
+     * on `/v1/models` counts as alive, so a 401 from a keyed endpoint still reads as
+     * reachable). Declaring it together with `api_key_env` is contradictory and is
+     * refused rather than silently resolved.
+     */
+    no_auth?: boolean;
     /**
      * Worker-kind override (see {@link WorkerKind} / {@link deriveWorkerKind}).
      * Normally DERIVED from the transport — declare it only where genuinely ambiguous.

package/dist/shared/types/sessionConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessionConfig.d.ts","sourceRoot":"","sources":["../../../src/shared/types/sessionConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,eAAO,MAAM,cAAc,2KAYjB,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAC3D,MAAM,MAAM,oBAAoB,GAAG,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AAEjE;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,KAAK,IAAI,YAAY,CAa/B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE;IACrD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE;QAAE,2BAA2B,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,OAAO,CAQV;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IAChD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,OAAO,CAQV;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,GAAE;IAC7C,aAAa,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IACrD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACpB,GAAG,OAAO,CAOf;AAED,eAAO,MAAM,gBAAgB,kCAAmC,CAAC;AACjE,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,MAAM,WAAW,wBAAwB;IACvC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,qGAAqG;IACrG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6GAA6G;IAC7G,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gHAAgH;IAChH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,yHAAyH;IACzH,4BAA4B,CAAC,EAAE,OAAO,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,WAAW,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;IACtE,sJAAsJ;IACtJ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAsB;IACrC,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iGAAiG;IACjG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8FAA8F;IAC9F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,8FAA8F;IAC9F,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iFAAiF;IACjF,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,gFAAgF;IAChF,+BAA+B,CAAC,EAAE,MAAM,CAAC;IACzC;;;;;;;;;;OAUG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,mGAAmG;IACnG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,yGAAyG;IACzG,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,qBAAqB;;;;;;;;;;CAUxB,CAAC;AAEX;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,sHAQ1B,CAAC;AACX,MAAM,MAAM,qBAAqB,GAC/B,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3C;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,qCAAsC,CAAC;AAChE,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAmBvD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,GAAG,aAAa,CAAC,GAC5D,UAAU,CAIZ;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAE5E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,GAAG,aAAa,GAAG,eAAe,CAAC,GAC9E,MAAM,GAAG,IAAI,CASf;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,SAAS,EAAE,qBAAqB,CAAC;IACjC,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,WAAW,CAAC,EAAE,UAAU,CAAC;IACzB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,uEAAuE;IACvE,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;;;;;;;;;;;OAaG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAM1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,iBAAiB,6DAMpB,CAAC;AACX,eAAO,MAAM,qBAAqB,+DAA4B,CAAC;AAC/D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IACtC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;CACtC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,EAAE,YAAY,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,mBAAmB,CAAC,EAAE,wBAAwB,CAAC;IAC/C,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B;;;;OAIG;IACH,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;IAC3C,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5C;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,yBAAyB,CAAC;IACjD,kEAAkE;IAClE,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,mEAAmE;IACnE,aAAa,CAAC,EAAE,kBAAkB,CAAC;CACpC;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,6MAce,CAAC;AAEtD,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;AAExE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAClC,aAAa,EACb,sBAAsB,GAAG,UAAU,CACpC,GAAG;IACF,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B,CAAC"}
+{"version":3,"file":"sessionConfig.d.ts","sourceRoot":"","sources":["../../../src/shared/types/sessionConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,eAAO,MAAM,cAAc,2KAYjB,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAC3D,MAAM,MAAM,oBAAoB,GAAG,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;AAEtE;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,KAAK,IAAI,gBAAgB,CAanC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE;IACrD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE;QAAE,2BAA2B,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,OAAO,CAQV;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IAChD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,OAAO,CAQV;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,GAAE;IAC7C,aAAa,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IACrD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACpB,GAAG,OAAO,CAOf;AAED,eAAO,MAAM,gBAAgB,kCAAmC,CAAC;AACjE,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,MAAM,WAAW,wBAAwB;IACvC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,qGAAqG;IACrG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6GAA6G;IAC7G,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gHAAgH;IAChH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,yHAAyH;IACzH,4BAA4B,CAAC,EAAE,OAAO,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,WAAW,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;IACtE,sJAAsJ;IACtJ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAsB;IACrC,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iGAAiG;IACjG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8FAA8F;IAC9F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,8FAA8F;IAC9F,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iFAAiF;IACjF,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,gFAAgF;IAChF,+BAA+B,CAAC,EAAE,MAAM,CAAC;IACzC;;;;;;;;;;OAUG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,mGAAmG;IACnG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,yGAAyG;IACzG,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,qBAAqB;;;;;;;;;;CAUxB,CAAC;AAEX;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,sHAQ1B,CAAC;AACX,MAAM,MAAM,qBAAqB,GAC/B,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3C;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,qCAAsC,CAAC;AAChE,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAmBvD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,GAAG,aAAa,CAAC,GAC5D,UAAU,CAIZ;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAE5E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,GAAG,aAAa,GAAG,eAAe,CAAC,GAC9E,MAAM,GAAG,IAAI,CASf;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,SAAS,EAAE,qBAAqB,CAAC;IACjC,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,UAAU,CAAC;IACzB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,uEAAuE;IACvE,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;;;;;;;;;;;OAaG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAM1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,iBAAiB,6DAMpB,CAAC;AACX,eAAO,MAAM,qBAAqB,+DAA4B,CAAC;AAC/D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IACtC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;CACtC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,EAAE,YAAY,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,mBAAmB,CAAC,EAAE,wBAAwB,CAAC;IAC/C,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B;;;;OAIG;IACH,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;IAC3C,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5C;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,yBAAyB,CAAC;IACjD,kEAAkE;IAClE,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,mEAAmE;IACnE,aAAa,CAAC,EAAE,kBAAkB,CAAC;CACpC;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,6MAce,CAAC;AAEtD,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;AAExE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAClC,aAAa,EACb,sBAAsB,GAAG,UAAU,CACpC,GAAG;IACF,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B,CAAC"}

package/dist/shared/types/sessionConfig.js

@@ -18,6 +18,10 @@ export const PROVIDER_NAMES = [
  * quota-ATTRIBUTION key — a silently-wrong value would mis-charge dispatch fan-out
  * to the wrong account). Single-sourced so audit's `getHostProvider` and
  * remediate's `parseHostProviderOption` cannot drift.
+ *
+ * Narrows to {@link HostProviderName}, not `ProviderName`: this function rejects
+ * `claude-worker`, so asserting the wider type would hand every caller a value
+ * the validator just refused.
  */
 export function assertHostProviderName(value) {
     // claude-worker is the proxied dispatch WORKER class — it can never be the

package/dist/shared/types/sessionConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessionConfig.js","sourceRoot":"","sources":["../../../src/shared/types/sessionConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,MAAM;IACN,gBAAgB;IAChB,qBAAqB;IACrB,aAAa;IACb,eAAe;IACf,OAAO;IACP,UAAU;IACV,mBAAmB;IACnB,aAAa;IACb,aAAa;IACb,KAAK;CACG,CAAC;AAIX;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAa;IAEb,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,IACE,KAAK,KAAK,eAAe;QACzB,CAAE,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC,EACtD,CAAC;QACD,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,mCAAmC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,KAAK,IAAI,CAC3E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAK7C;IACC,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,EAAE,2BAA2B,CAAC;IAC/D,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAClC,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAClE,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAKxC;IACC,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,EAAE,QAAQ,EAAE,cAAc,CAAC;IAC5D,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAClC,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAClE,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAGlC,EAAE;IACJ,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,EAAE,eAAe,CAAC;IACnD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAClC,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,sBAAsB,CAAC;IACrE,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,UAAU,CAAU,CAAC;AA6KjE,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,qBAAqB,EAAE,qBAAqB;IAC5C,aAAa,EAAE,aAAa;IAC5B,eAAe,EAAE,eAAe;IAChC,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,mBAAmB,EAAE,mBAAmB;IACxC,aAAa,EAAE,aAAa;IAC5B,WAAW,EAAE,aAAa;IAC1B,GAAG,EAAE,KAAK;CACF,CAAC;AAEX;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,mBAAmB;IACnB,OAAO;IACP,UAAU;IACV,gBAAgB;IAChB,qBAAqB;IACrB,KAAK;IACL,eAAe;CACP,CAAC;AAIX;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,SAAS,EAAE,aAAa,CAAU,CAAC;AAGhE;;;;;;GAMG;AACH,MAAM,8BAA8B,GAEhC;IACF,mBAAmB,EAAE,aAAa;IAClC,eAAe,EAAE,SAAS;IAC1B,KAAK,EAAE,SAAS;IAChB,GAAG,EAAE,SAAS;IACd,QAAQ,EAAE,SAAS;CACpB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAA6D;IAE7D,MAAM,KAAK,GAAG,8BAA8B,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,MAAM,CAAC,WAAW,IAAI,SAAS,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,OAAO,8BAA8B,CAAC,SAAkC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA+E;IAE/E,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,gBAAgB,CAAC,MAAM,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,CACL,gFAAgF;QAChF,kFAAkF;QAClF,+EAA+E;QAC/E,6DAA6D,CAC9D,CAAC;AACJ,CAAC;AA+OD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,MAAM;IACN,WAAW;IACX,WAAW;IACX,MAAM;IACN,MAAM;CACE,CAAC;AACX,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;AAuH/D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,UAAU;IACV,eAAe;IACf,qBAAqB;IACrB,aAAa;IACb,eAAe;IACf,OAAO;IACP,UAAU;IACV,mBAAmB;IACnB,aAAa;IACb,aAAa;IACb,KAAK;IACL,SAAS;IACT,kBAAkB;CACiC,CAAC"}
+{"version":3,"file":"sessionConfig.js","sourceRoot":"","sources":["../../../src/shared/types/sessionConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,MAAM;IACN,gBAAgB;IAChB,qBAAqB;IACrB,aAAa;IACb,eAAe;IACf,OAAO;IACP,UAAU;IACV,mBAAmB;IACnB,aAAa;IACb,aAAa;IACb,KAAK;CACG,CAAC;AAYX;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAa;IAEb,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,IACE,KAAK,KAAK,eAAe;QACzB,CAAE,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC,EACtD,CAAC;QACD,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,mCAAmC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,KAAK,IAAI,CAC3E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAK7C;IACC,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,EAAE,2BAA2B,CAAC;IAC/D,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAClC,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAClE,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAKxC;IACC,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,EAAE,QAAQ,EAAE,cAAc,CAAC;IAC5D,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAClC,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAClE,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAGlC,EAAE;IACJ,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,EAAE,eAAe,CAAC;IACnD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAClC,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,sBAAsB,CAAC;IACrE,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,UAAU,CAAU,CAAC;AA6KjE,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,qBAAqB,EAAE,qBAAqB;IAC5C,aAAa,EAAE,aAAa;IAC5B,eAAe,EAAE,eAAe;IAChC,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,mBAAmB,EAAE,mBAAmB;IACxC,aAAa,EAAE,aAAa;IAC5B,WAAW,EAAE,aAAa;IAC1B,GAAG,EAAE,KAAK;CACF,CAAC;AAEX;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,mBAAmB;IACnB,OAAO;IACP,UAAU;IACV,gBAAgB;IAChB,qBAAqB;IACrB,KAAK;IACL,eAAe;CACP,CAAC;AAIX;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,SAAS,EAAE,aAAa,CAAU,CAAC;AAGhE;;;;;;GAMG;AACH,MAAM,8BAA8B,GAEhC;IACF,mBAAmB,EAAE,aAAa;IAClC,eAAe,EAAE,SAAS;IAC1B,KAAK,EAAE,SAAS;IAChB,GAAG,EAAE,SAAS;IACd,QAAQ,EAAE,SAAS;CACpB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAA6D;IAE7D,MAAM,KAAK,GAAG,8BAA8B,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,MAAM,CAAC,WAAW,IAAI,SAAS,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,OAAO,8BAA8B,CAAC,SAAkC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA+E;IAE/E,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,gBAAgB,CAAC,MAAM,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,CACL,gFAAgF;QAChF,kFAAkF;QAClF,+EAA+E;QAC/E,6DAA6D,CAC9D,CAAC;AACJ,CAAC;AA4PD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,MAAM;IACN,WAAW;IACX,WAAW;IACX,MAAM;IACN,MAAM;CACE,CAAC;AACX,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;AAuH/D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,UAAU;IACV,eAAe;IACf,qBAAqB;IACrB,aAAa;IACb,eAAe;IACf,OAAO;IACP,UAAU;IACV,mBAAmB;IACnB,aAAa;IACb,aAAa;IACb,KAAK;IACL,SAAS;IACT,kBAAkB;CACiC,CAAC"}

package/dist/shared/validation/findingGrounding.d.ts

@@ -42,13 +42,25 @@ export declare function isBareBasename(p: string): boolean;
 export declare function resolveBasenameToTrackedPath(basename: string, knownPaths: ReadonlySet<string>): string | undefined;
 /**
  * Case-preserving corpus of the tracked working-tree paths at `root`, via
- * `git ls-files` (forward-slashed, trimmed). This is the sibling of the M-B3
- * gate's `enumerateRepoTreePaths` (which `normalizeRepoPath`-lowercases for
- * membership matching): the remediate consumers that resolve a basename and then
- * read the file off disk (line counting) need the REAL on-disk case, so this one
- * does not lowercase. Degrades to an empty set when git is missing / not a repo
- * (callers then fall back to their existing `existsSync` check — monotonic, never
- * a regression). OS-agnostic: `shell: false`, forward-slash output.
+ * `git ls-files -z` (forward-slashed). THE one git enumeration behind both
+ * grounding corpora: the M-B3 gate's `enumerateRepoTreePaths` is a
+ * `normalizeRepoPath`-lowercased draw over this set, while the remediate
+ * consumers that resolve a basename and then read the file off disk (line
+ * counting) need the REAL on-disk case, so this one does not lowercase.
+ *
+ * `-z` is load-bearing, not a flourish: plain `ls-files` renders any path git
+ * considers unusual in C-quoted form (`core.quotePath` turns a non-ASCII byte
+ * into `\303`, and a path containing a newline is quoted too), so a newline
+ * split yielded an entry that no longer equals the real repo path — every
+ * citation naming that file silently failed to ground while the file-disposition
+ * rule, which already used `-z`, kept it in scope. NUL-delimited output is
+ * unquoted and unambiguous, so entries are taken verbatim (no trim: with no line
+ * terminator to strip, trimming could only damage a legitimately space-padded
+ * POSIX path).
+ *
+ * Degrades to an empty set when git is missing / not a repo (callers then fall
+ * back to their existing `existsSync` check — monotonic, never a regression).
+ * OS-agnostic: `shell: false`, forward-slash output.
  */
 export declare function enumerateTrackedFilePaths(root: string): Set<string>;
 /**

package/dist/shared/validation/findingGrounding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"findingGrounding.d.ts","sourceRoot":"","sources":["../../../src/shared/validation/findingGrounding.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAErE,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAGjD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,GAC9B,MAAM,GAAG,SAAS,CAapB;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAsBnE;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAI7E;AAED,qFAAqF;AACrF,MAAM,MAAM,YAAY,GAAG,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAKrE;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,EAChB,UAAU,GAAE,YAAkC,GAC7C,OAAO,CAAC,gBAAgB,CAAC,CA+B3B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,OAAO,CAE9E;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,GAClC,OAAO,CAET"}
+{"version":3,"file":"findingGrounding.d.ts","sourceRoot":"","sources":["../../../src/shared/validation/findingGrounding.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAErE,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAGjD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,GAC9B,MAAM,GAAG,SAAS,CAapB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAsBnE;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAI7E;AAED,qFAAqF;AACrF,MAAM,MAAM,YAAY,GAAG,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAKrE;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,EAChB,UAAU,GAAE,YAAkC,GAC7C,OAAO,CAAC,gBAAgB,CAAC,CA+B3B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,OAAO,CAE9E;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,GAClC,OAAO,CAET"}

package/dist/shared/validation/findingGrounding.js

@@ -86,19 +86,31 @@ export function resolveBasenameToTrackedPath(basename, knownPaths) {
 }
 /**
  * Case-preserving corpus of the tracked working-tree paths at `root`, via
- * `git ls-files` (forward-slashed, trimmed). This is the sibling of the M-B3
- * gate's `enumerateRepoTreePaths` (which `normalizeRepoPath`-lowercases for
- * membership matching): the remediate consumers that resolve a basename and then
- * read the file off disk (line counting) need the REAL on-disk case, so this one
- * does not lowercase. Degrades to an empty set when git is missing / not a repo
- * (callers then fall back to their existing `existsSync` check — monotonic, never
- * a regression). OS-agnostic: `shell: false`, forward-slash output.
+ * `git ls-files -z` (forward-slashed). THE one git enumeration behind both
+ * grounding corpora: the M-B3 gate's `enumerateRepoTreePaths` is a
+ * `normalizeRepoPath`-lowercased draw over this set, while the remediate
+ * consumers that resolve a basename and then read the file off disk (line
+ * counting) need the REAL on-disk case, so this one does not lowercase.
+ *
+ * `-z` is load-bearing, not a flourish: plain `ls-files` renders any path git
+ * considers unusual in C-quoted form (`core.quotePath` turns a non-ASCII byte
+ * into `\303`, and a path containing a newline is quoted too), so a newline
+ * split yielded an entry that no longer equals the real repo path — every
+ * citation naming that file silently failed to ground while the file-disposition
+ * rule, which already used `-z`, kept it in scope. NUL-delimited output is
+ * unquoted and unambiguous, so entries are taken verbatim (no trim: with no line
+ * terminator to strip, trimming could only damage a legitimately space-padded
+ * POSIX path).
+ *
+ * Degrades to an empty set when git is missing / not a repo (callers then fall
+ * back to their existing `existsSync` check — monotonic, never a regression).
+ * OS-agnostic: `shell: false`, forward-slash output.
  */
 export function enumerateTrackedFilePaths(root) {
     const known = new Set();
     let result;
     try {
-        result = spawnSync("git", ["ls-files"], {
+        result = spawnSync("git", ["ls-files", "-z"], {
             cwd: root,
             encoding: "utf8",
             shell: false,
@@ -112,8 +124,8 @@ export function enumerateTrackedFilePaths(root) {
     if (!result || result.status !== 0 || typeof result.stdout !== "string") {
         return known;
     }
-    for (const line of result.stdout.split("\n")) {
-        const path = line.trim().replace(/\\/g, "/");
+    for (const entry of result.stdout.split("\0")) {
+        const path = entry.replace(/\\/g, "/");
         if (path.length > 0)
             known.add(path);
     }

package/dist/shared/validation/findingGrounding.js.map

@@ -1 +1 @@
-{"version":3,"file":"findingGrounding.js","sourceRoot":"","sources":["../../../src/shared/validation/findingGrounding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAG7C,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAS;IACzC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnB,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAgB,EAChB,UAA+B;IAE/B,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,KAAyB,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,WAAW,EAAE,CAAC;YACvC,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC,CAAC,uBAAuB;YAClE,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE;YACtC,GAAG,EAAE,IAAI;YACT,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,KAAK;YACZ,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;SAC5B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,WAAmB,EAAE,UAAkB;IAClE,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,iBAAiB,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACzD,CAAC;AAKD,MAAM,mBAAmB,GAAiB,CAAC,YAAY,EAAE,EAAE,CACzD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,QAAgB,EAChB,OAAgB,EAChB,aAA2B,mBAAmB;IAE9C,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,MAAM,CAClD,CAAC,GAAG,EAA+C,EAAE,CACnD,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAC3E,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,MAAM,EAAE,YAAY;YACpB,MAAM,EACJ,0EAA0E;SAC7E,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAChF,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,UAAU,CAAC,YAAY,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,kCAAkC,CAAC,CAAC;YAC3D,SAAS;QACX,CAAC;QACD,IAAI,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAChC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,iCAAiC,CAAC,CAAC;IAC5D,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAmC;IACnE,OAAO,OAAO,CAAC,SAAS,EAAE,MAAM,KAAK,UAAU,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iCAAiC,CAC/C,OAAmC;IAEnC,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC"}
+{"version":3,"file":"findingGrounding.js","sourceRoot":"","sources":["../../../src/shared/validation/findingGrounding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAG7C,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAS;IACzC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnB,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAgB,EAChB,UAA+B;IAE/B,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,KAAyB,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,WAAW,EAAE,CAAC;YACvC,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC,CAAC,uBAAuB;YAClE,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE;YAC5C,GAAG,EAAE,IAAI;YACT,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,KAAK;YACZ,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;SAC5B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,WAAmB,EAAE,UAAkB;IAClE,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,iBAAiB,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACzD,CAAC;AAKD,MAAM,mBAAmB,GAAiB,CAAC,YAAY,EAAE,EAAE,CACzD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,QAAgB,EAChB,OAAgB,EAChB,aAA2B,mBAAmB;IAE9C,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,MAAM,CAClD,CAAC,GAAG,EAA+C,EAAE,CACnD,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAC3E,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,MAAM,EAAE,YAAY;YACpB,MAAM,EACJ,0EAA0E;SAC7E,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAChF,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,UAAU,CAAC,YAAY,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,kCAAkC,CAAC,CAAC;YAC3D,SAAS;QACX,CAAC;QACD,IAAI,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAChC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,iCAAiC,CAAC,CAAC;IAC5D,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAmC;IACnE,OAAO,OAAO,CAAC,SAAS,EAAE,MAAM,KAAK,UAAU,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iCAAiC,CAC/C,OAAmC;IAEnC,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC"}

package/docs/audit-pkg/operator-guide.md

@@ -221,7 +221,7 @@ Every other field is optional:
 {
   "schema_version": "provider-confirmation-input/v1",
   "cost_order": ["<provider-or-model-key>", "..."],
-  "exclude": ["<provider>:<model>", "<provider>", "<endpoint-host>"],
+  "exclude": ["transport:<name>", "transport:<name>/<model>", "service:<name>", "host:<endpoint-host>"],
   "include": ["<self-spawn-blocked provider to opt back in>"],
   "host_models": [{ "model_id": "<your model id>", "tier": "frontier|capable|fast" }]
 }
@@ -232,19 +232,29 @@ Every other field is optional:
   report in `host_models`. Keys you omit keep their suggested relative order,
   appended after the ones you name; unrecognized keys are ignored. Omit it to accept
   the suggested order.
-- `exclude` — drops backends from the dispatchable pool. Each entry is a rule, at
-  whatever granularity you mean:
-  - `openai-compatible:gpt-oss-120b` — that **model** of that provider, leaving the
-    provider's other models routable. This is the granularity to reach for: you are
+- `exclude` — drops backends from the dispatchable pool. Each entry names its AXIS
+  explicitly, so the same string means the same thing on every machine:
+  - `transport:openai-compatible/gpt-oss-120b` — that **model** of that transport,
+    leaving its other models routable. This is the granularity to reach for: you are
     confirming model choices, so ruling out one model of a multi-model backend
     should not rule out the backend.
-  - `codex` — the whole **provider**, every model of it.
-  - `integrate.api.nvidia.com` (or `localhost:8000` to pin a port) — every source at
-    that **endpoint host**.
+  - `transport:codex` — the whole **transport**, every model of it.
+  - `service:nim` — every transport reaching that **service**, including ones
+    discovered later.
+  - `host:integrate.api.nvidia.com` (or `host:localhost:8000` to pin a port) — every
+    source at that **endpoint host**.
+
+  The older prefix-less forms (`codex`, `openai-compatible:gpt-oss-120b`,
+  `integrate.api.nvidia.com`) are still accepted and migrated to the axis form on
+  read, so saved rules keep working. A rule naming an axis that does not exist —
+  `model:gpt-oss-120b` — is REFUSED when you submit it, rather than being silently
+  reinterpreted as a host rule that matches nothing.
 
   A rule is a durable decision, not a reachability claim: it keeps applying on a
   later run and on a different machine, whatever is reachable there. A rule that
-  matches nothing is simply inert.
+  matches nothing is legitimate and stays inert — the tool authors one itself every
+  run — but the confirmation summary lists any of YOUR rules that matched nothing,
+  as an advisory, so a model-name typo is visible without blocking anything.
 - `include` — opts a self-spawn-blocked provider back in. A CLI provider detected
   while you are already inside a session of that same agent (`claude-code` under
   `CLAUDECODE`, `codex` under `CODEX`) is excluded by default so the run can't

package/docs/audit-pkg/release.md

@@ -12,6 +12,10 @@ npm run verify:release
 `verify:release` covers:
 
 - TypeScript typecheck (`build`)
+- test-tree typecheck (`check:tests`)
+- raw control-byte gate (`check:control-bytes`)
+- loop-core pattern-list drift check (`check:loop-core-patterns`)
+- backlog size-budget gate (`check:backlog-budget`)
 - dead-code export gate (`check:deadcode`)
 - doc-manifest reconciliation gate (`check:doc-manifest`)
 - full automated test suite (`vitest run`)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "audit-tools",
-  "version": "0.34.29",
+  "version": "0.34.31",
   "private": false,
   "license": "ISC",
   "description": "Portable hybrid code auditing + remediation orchestrators for arbitrary repositories.",
@@ -41,16 +41,18 @@
     "prebuild": "node scripts/shared/guard-no-suite-running.mjs",
     "build": "tsc -p tsconfig.json && node scripts/shared/copy-data-assets.mjs",
     "check": "tsc -p tsconfig.json --noEmit",
+    "check:tests": "tsc -p tsconfig.test.json",
     "nightly:review": "node scripts/nightly/serve.mjs",
     "test:doc-contract": "node scripts/shared/run-vitest-gate.mjs tests/audit/release-contract.test.mjs tests/audit/file-lock-doc-sync.test.mjs tests/audit/host-asset-renderer-drift.test.mjs",
     "test": "npm run build && node scripts/shared/run-vitest-gate.mjs",
     "test:single": "npm run build && node scripts/shared/run-vitest-gate.mjs",
     "verify:guards": "node scripts/shared/run-vitest-gate.mjs --retry=2 --exclude \"**/audit-code-completion.test.mjs\" --exclude \"**/audit-code-wrapper.test.mjs\" --exclude \"**/audit/next-step.test.mjs\" --exclude \"**/seam-host-only-next-step.test.mjs\" --exclude \"**/*-e2e.test.*\" --exclude \"**/next-step-implement-dispatch.test.ts\" --exclude \"**/next-step-pipeline-dispatch.test.ts\"",
-    "verify:checks": "node scripts/shared/profile-run.mjs verify-checks check:control-bytes check:loop-core-patterns check:deadcode check:doc-manifest check:backlog-budget build verify:hosts verify:remediate-hosts smoke:packaged-audit-code smoke:packaged-remediate-code",
+    "verify:checks": "node scripts/shared/profile-run.mjs verify-checks check:control-bytes check:version-gates check:loop-core-patterns check:constitutional-doc-paths check:deadcode check:doc-manifest check:philosophy-brief check:handoff-roadmap check:memory-citations check:backlog-budget check:backlog-status check:tests build verify:hosts verify:remediate-hosts smoke:packaged-audit-code smoke:packaged-remediate-code",
     "verify:release": "npm run verify:checks && node scripts/shared/run-vitest-gate.mjs",
     "check:control-bytes": "node scripts/check-control-bytes.mjs",
     "check:deadcode": "knip --no-config-hints",
     "check:doc-manifest": "node scripts/check-doc-manifest.mjs",
+    "check:philosophy-brief": "node scripts/check-philosophy-brief.mjs",
     "verify:hosts": "node scripts/audit/verify-hosts.mjs",
     "verify:remediate-hosts": "node scripts/remediate/verify-hosts.mjs",
     "smoke:linked-audit-code": "node scripts/audit/smoke-linked-audit-code.mjs",
@@ -70,7 +72,12 @@
     "prepack": "npm run build",
     "prepublishOnly": "npm run verify:release",
     "check:loop-core-patterns": "node scripts/shared/generate-loop-core-patterns.mjs --check",
-    "check:backlog-budget": "node scripts/check-backlog-budget.mjs"
+    "check:backlog-budget": "node scripts/check-backlog-budget.mjs",
+    "check:memory-citations": "node scripts/check-memory-citations.mjs",
+    "check:version-gates": "node scripts/check-version-gates.mjs",
+    "check:constitutional-doc-paths": "node scripts/shared/generate-constitutional-doc-paths.mjs --check",
+    "check:handoff-roadmap": "node scripts/shared/generate-handoff-roadmap.mjs --check",
+    "check:backlog-status": "node scripts/check-backlog-status-tokens.mjs"
   },
   "engines": {
     "node": ">=20"

package/scripts/audit/postinstall.mjs

@@ -73,6 +73,21 @@ const OPENCODE_AUDIT_BASH_PERMISSION = {
 // skipped with a warning instead of failing the whole install.
 const sharedOpenCodePermissions = await resolveSharedOpenCodePermissions();
 
+// A pre-hardening deploy wrote agent-scope bash['*']='allow' (the historically
+// managed broad value). Migrate exactly that value away so the generated 'ask'
+// seed wins on re-deploy; any other user-authored wildcard survives untouched.
+// This mirrors the install wrapper so an upgrade that only ever runs
+// `npm install` converges on the same hardened agent block — otherwise the
+// postinstall is the one path that keeps a broad wildcard alive.
+function withoutManagedBroadBashWildcard(rule) {
+  const { withoutOpenCodeWildcard, OPENCODE_MANAGED_BROAD_VALUE } = sharedOpenCodePermissions;
+  const existing = objectValue(rule);
+  if (existing['*'] !== OPENCODE_MANAGED_BROAD_VALUE) {
+    return rule;
+  }
+  return withoutOpenCodeWildcard(existing);
+}
+
 // Auditor agent scope (read-only agent, parity with the remediator hardening):
 // enumerated audit-code commands stay managed allows/denies, but the bash
 // wildcard defaults to "ask" (an existing user wildcard survives — the
@@ -96,7 +111,7 @@ function mergeOpenCodeAgentPermissionConfig(existingPermission, generatedPermiss
       OPENCODE_AUDIT_EDIT_PERMISSION,
     ),
     bash: mergeOpenCodeAgentPermissionRule(
-      existingPermission.bash,
+      withoutManagedBroadBashWildcard(existingPermission.bash),
       generatedPermission.bash,
       withoutOpenCodeWildcard(OPENCODE_AUDIT_BASH_PERMISSION),
     ),

package/scripts/remediate/postinstall.mjs

@@ -73,6 +73,22 @@ const OPENCODE_REMEDIATE_BASH_PERMISSION = {
 // skipped with a warning instead of failing the whole install.
 const sharedOpenCodePermissions = await resolveSharedOpenCodePermissions();
 
+// A pre-hardening deploy wrote agent-scope bash['*']='allow' (the historically
+// managed broad value). Migrate exactly that value away so the generated 'ask'
+// seed wins on re-deploy; any other user-authored wildcard survives untouched.
+// This mirrors the install wrapper so an upgrade that only ever runs
+// `npm install` converges on the same hardened agent block — otherwise the
+// postinstall is the one path that keeps a broad wildcard alive.
+function withoutManagedBroadBashWildcard(rule) {
+  const { withoutOpenCodeWildcard, OPENCODE_MANAGED_BROAD_VALUE } =
+    sharedOpenCodePermissions;
+  const existing = objectValue(rule);
+  if (existing["*"] !== OPENCODE_MANAGED_BROAD_VALUE) {
+    return rule;
+  }
+  return withoutOpenCodeWildcard(existing);
+}
+
 // Remediator agent scope: managed rules win for specific patterns; an
 // existing user wildcard survives (the managed set is passed without "*").
 function renderOpenCodeAgentPermissionConfig(existing) {
@@ -90,7 +106,7 @@ function renderOpenCodeAgentPermissionConfig(existing) {
       withoutOpenCodeWildcard(OPENCODE_REMEDIATE_EDIT_PERMISSION),
     ),
     bash: mergeOpenCodeAgentPermissionRule(
-      existingPermission.bash,
+      withoutManagedBroadBashWildcard(existingPermission.bash),
       OPENCODE_REMEDIATE_BASH_PERMISSION,
       withoutOpenCodeWildcard(OPENCODE_REMEDIATE_BASH_PERMISSION),
     ),

package/dist/remediate/coverage/findingLedger.d.ts

@@ -1,99 +0,0 @@
-/**
- * Per-finding / per-node coverage ledger (N-coverage-ledger).
- *
- * Source_type-aware denominator (INV-CL-05):
- *   - structured_audit → finding-enumeration denominator (every finding id
- *     from finding-enumeration.json must reach a terminal disposition)
- *   - document / non-enumerable → DAG-node denominator (every promoted
- *     implementation-DAG node must reach a terminal disposition)
- *
- * A 0/0 ledger is INCOMPLETE (fail-closed) — zero denominator never counts as
- * vacuously complete (INV-CL-05).
- *
- * Terminal dispositions: resolved, resolved_no_change, ignored,
- *   deemed_inappropriate, force_closed_unresolved.
- *
- * Non-terminal item statuses (blocked, pending, tested, refactored, verified,
- *   tested_successfully) map to force_closed_unresolved so that the ledger is
- *   always fully populated after build.
- *
- * Identity (drift-plan R2): the ledger keys every entry off a finding/node id
- * that is already the output of the single finding-identity authority —
- * structured_audit denominator ids come from `assignStableFindingIds`
- * (`<LENS>-<sha256(findingIdentitySignature)>`) and DAG-node denominator ids
- * come from `ensureNodeId`. The ledger therefore performs no identity rule of
- * its own; two findings the shared authority deems the same already collapse to
- * one denominator id upstream (cross-lens dedup), so the ledger never
- * double-counts one identity. The duplicate guard below catches the inverse —
- * one identity id claimed by two entries (a merge/build defect).
- */
-import type { PerFindingCoverageLedger, PerFindingDenominatorKind, RemediationItemState } from "../state/types.js";
-/**
- * Parameters for building the per-finding ledger.
- *
- * For `structured_audit` sources pass `enumeratedIds` — the complete list of
- * finding ids from `finding-enumeration.json`.  For document / non-enumerable
- * sources pass `promotedNodeIds` — the ids of all promoted implementation-DAG
- * nodes.
- *
- * `items` is the `RemediationState.items` record: finding_id → state.
- */
-export interface BuildPerFindingLedgerParams {
-    /** "finding_enumeration" for structured_audit; "dag_node" for document sources. */
-    denominatorKind: PerFindingDenominatorKind;
-    /**
-     * The authoritative denominator set.
-     *
-     * - structured_audit: every id from finding-enumeration.json (all findings).
-     * - document: every promoted implementation-DAG node id.
-     */
-    denominatorIds: readonly string[];
-    /** The current `RemediationState.items` (may be undefined when state is pre-plan). */
-    items: Record<string, RemediationItemState> | undefined;
-}
-/**
- * Build a `PerFindingCoverageLedger` from the authoritative denominator set
- * and the current item state.
- *
- * Every id in `denominatorIds` produces exactly one entry.  Ids present in
- * `items` are mapped via `statusToDisposition`; ids absent from `items`
- * (never reached the implement phase) produce `force_closed_unresolved`.
- */
-export declare function buildPerFindingLedger(params: BuildPerFindingLedgerParams): PerFindingCoverageLedger;
-/** Result returned by `assertLedgerComplete`. */
-export interface LedgerCompletenessResult {
-    /** True only when every denominator id has a terminal disposition AND denominator > 0. */
-    complete: boolean;
-    /**
-     * Ids that appear in the denominator but have no terminal disposition
-     * (i.e. missing from entries or mapped to a non-terminal disposition).
-     *
-     * In the current implementation all non-terminal statuses map to
-     * `force_closed_unresolved` (which IS terminal), so `missing` contains ids
-     * that are absent from `entries` altogether — which cannot happen after
-     * `buildPerFindingLedger` runs.  This field is retained for callers that
-     * construct ledgers manually or via partial merges.
-     */
-    missing: string[];
-    /**
-     * Ids that appear more than once in `entries`.  Duplicate entries indicate
-     * a merge/build defect (two workers claimed the same finding).
-     */
-    duplicated: string[];
-    /** How the denominator was derived (pass-through from the ledger). */
-    denominator_kind: PerFindingDenominatorKind;
-}
-/**
- * Assert that a `PerFindingCoverageLedger` is complete.
- *
- * Completeness rules (INV-CL-05):
- * 1. `denominator` must be > 0. A 0/0 ledger is INCOMPLETE (fail-closed).
- * 2. Every entry must have a terminal disposition.
- * 3. No id may appear more than once in `entries` (no duplicates).
- * 4. The number of terminal entries must equal `denominator`.
- *
- * Returns `{complete: true, missing: [], duplicated: [], denominator_kind}`
- * when all rules are satisfied; otherwise `{complete: false, missing, duplicated, ...}`.
- */
-export declare function assertLedgerComplete(ledger: PerFindingCoverageLedger): LedgerCompletenessResult;
-//# sourceMappingURL=findingLedger.d.ts.map

package/dist/remediate/coverage/findingLedger.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"findingLedger.d.ts","sourceRoot":"","sources":["../../../src/remediate/coverage/findingLedger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EACV,wBAAwB,EACxB,yBAAyB,EAGzB,oBAAoB,EACrB,MAAM,mBAAmB,CAAC;AAuB3B;;;;;;;;;GASG;AACH,MAAM,WAAW,2BAA2B;IAC1C,mFAAmF;IACnF,eAAe,EAAE,yBAAyB,CAAC;IAC3C;;;;;OAKG;IACH,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,sFAAsF;IACtF,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,GAAG,SAAS,CAAC;CACzD;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,2BAA2B,GAClC,wBAAwB,CAmB1B;AAID,iDAAiD;AACjD,MAAM,WAAW,wBAAwB;IACvC,0FAA0F;IAC1F,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;;;;;OASG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;OAGG;IACH,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,sEAAsE;IACtE,gBAAgB,EAAE,yBAAyB,CAAC;CAC7C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,wBAAwB,GAC/B,wBAAwB,CAoC1B"}

package/dist/remediate/coverage/findingLedger.js

@@ -1,110 +0,0 @@
-/**
- * Per-finding / per-node coverage ledger (N-coverage-ledger).
- *
- * Source_type-aware denominator (INV-CL-05):
- *   - structured_audit → finding-enumeration denominator (every finding id
- *     from finding-enumeration.json must reach a terminal disposition)
- *   - document / non-enumerable → DAG-node denominator (every promoted
- *     implementation-DAG node must reach a terminal disposition)
- *
- * A 0/0 ledger is INCOMPLETE (fail-closed) — zero denominator never counts as
- * vacuously complete (INV-CL-05).
- *
- * Terminal dispositions: resolved, resolved_no_change, ignored,
- *   deemed_inappropriate, force_closed_unresolved.
- *
- * Non-terminal item statuses (blocked, pending, tested, refactored, verified,
- *   tested_successfully) map to force_closed_unresolved so that the ledger is
- *   always fully populated after build.
- *
- * Identity (drift-plan R2): the ledger keys every entry off a finding/node id
- * that is already the output of the single finding-identity authority —
- * structured_audit denominator ids come from `assignStableFindingIds`
- * (`<LENS>-<sha256(findingIdentitySignature)>`) and DAG-node denominator ids
- * come from `ensureNodeId`. The ledger therefore performs no identity rule of
- * its own; two findings the shared authority deems the same already collapse to
- * one denominator id upstream (cross-lens dedup), so the ledger never
- * double-counts one identity. The duplicate guard below catches the inverse —
- * one identity id claimed by two entries (a merge/build defect).
- */
-import { statusToDisposition } from "../state/itemStatus.js";
-// ── Disposition terminality ─────────────────────────────────────────────────
-// The status→disposition map is single-sourced in state/itemStatus.ts; this
-// module owns only PerFindingDisposition terminality (which dispositions count
-// toward coverage).
-/** Whether a PerFindingDisposition is terminal (contributes to coverage). */
-const TERMINAL_DISPOSITIONS = new Set([
-    "resolved",
-    "resolved_no_change",
-    "ignored",
-    "deemed_inappropriate",
-    "force_closed_unresolved",
-]);
-function dispositionIsTerminal(d) {
-    return TERMINAL_DISPOSITIONS.has(d);
-}
-/**
- * Build a `PerFindingCoverageLedger` from the authoritative denominator set
- * and the current item state.
- *
- * Every id in `denominatorIds` produces exactly one entry.  Ids present in
- * `items` are mapped via `statusToDisposition`; ids absent from `items`
- * (never reached the implement phase) produce `force_closed_unresolved`.
- */
-export function buildPerFindingLedger(params) {
-    const { denominatorKind, denominatorIds, items } = params;
-    const entries = denominatorIds.map((id) => {
-        const stateItem = items?.[id];
-        const disposition = stateItem
-            ? statusToDisposition(stateItem.status)
-            : "force_closed_unresolved";
-        return { id, disposition };
-    });
-    const covered = entries.filter((e) => dispositionIsTerminal(e.disposition)).length;
-    return {
-        denominator_kind: denominatorKind,
-        denominator: denominatorIds.length,
-        covered,
-        entries,
-    };
-}
-/**
- * Assert that a `PerFindingCoverageLedger` is complete.
- *
- * Completeness rules (INV-CL-05):
- * 1. `denominator` must be > 0. A 0/0 ledger is INCOMPLETE (fail-closed).
- * 2. Every entry must have a terminal disposition.
- * 3. No id may appear more than once in `entries` (no duplicates).
- * 4. The number of terminal entries must equal `denominator`.
- *
- * Returns `{complete: true, missing: [], duplicated: [], denominator_kind}`
- * when all rules are satisfied; otherwise `{complete: false, missing, duplicated, ...}`.
- */
-export function assertLedgerComplete(ledger) {
-    const { denominator, entries, denominator_kind } = ledger;
-    // Rule 1: fail-closed on zero denominator.
-    if (denominator === 0) {
-        return { complete: false, missing: [], duplicated: [], denominator_kind };
-    }
-    // Detect duplicates
-    const seen = new Map();
-    for (const entry of entries) {
-        seen.set(entry.id, (seen.get(entry.id) ?? 0) + 1);
-    }
-    const duplicated = [...seen.entries()]
-        .filter(([, count]) => count > 1)
-        .map(([id]) => id);
-    // Ids with non-terminal disposition
-    const nonTerminal = entries
-        .filter((e) => !dispositionIsTerminal(e.disposition))
-        .map((e) => e.id);
-    // Ids missing from entries entirely (if someone built a partial ledger)
-    // We detect this by checking covered vs denominator via the entries array.
-    const terminalCount = entries.filter((e) => dispositionIsTerminal(e.disposition)).length;
-    const missing = nonTerminal; // non-terminal entries = still missing a real closure
-    const complete = duplicated.length === 0 &&
-        missing.length === 0 &&
-        terminalCount === denominator;
-    return { complete, missing, duplicated, denominator_kind };
-}
-//# sourceMappingURL=findingLedger.js.map

package/dist/remediate/coverage/findingLedger.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"findingLedger.js","sourceRoot":"","sources":["../../../src/remediate/coverage/findingLedger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AASH,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAC/E,oBAAoB;AAEpB,6EAA6E;AAC7E,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAwB;IAC3D,UAAU;IACV,oBAAoB;IACpB,SAAS;IACT,sBAAsB;IACtB,yBAAyB;CAC1B,CAAC,CAAC;AAEH,SAAS,qBAAqB,CAAC,CAAwB;IACrD,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC;AA4BD;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAmC;IAEnC,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IAE1D,MAAM,OAAO,GAA4B,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QACjE,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,WAAW,GAA0B,SAAS;YAClD,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC,MAAM,CAAC;YACvC,CAAC,CAAC,yBAAyB,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;IAEnF,OAAO;QACL,gBAAgB,EAAE,eAAe;QACjC,WAAW,EAAE,cAAc,CAAC,MAAM;QAClC,OAAO;QACP,OAAO;KACR,CAAC;AACJ,CAAC;AA4BD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAgC;IAEhC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;IAE1D,2CAA2C;IAC3C,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC;IAC5E,CAAC;IAED,oBAAoB;IACpB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;SACnC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC;SAChC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAErB,oCAAoC;IACpC,MAAM,WAAW,GAAG,OAAO;SACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;SACpD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAEpB,wEAAwE;IACxE,2EAA2E;IAC3E,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACzC,qBAAqB,CAAC,CAAC,CAAC,WAAW,CAAC,CACrC,CAAC,MAAM,CAAC;IAET,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,sDAAsD;IAEnF,MAAM,QAAQ,GACZ,UAAU,CAAC,MAAM,KAAK,CAAC;QACvB,OAAO,CAAC,MAAM,KAAK,CAAC;QACpB,aAAa,KAAK,WAAW,CAAC;IAEhC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC;AAC7D,CAAC"}