audit-tools 0.40.1 → 0.41.0

package/dist/shared/submission/handRecovery.js

@@ -0,0 +1,123 @@
+/**
+ * Hand recovery — the ONLY place a human hand may re-land a submission.
+ *
+ * An operator sometimes has to rescue a submission a host mangled. The danger
+ * is that the rescue becomes a second, weaker door into the tool: a path that
+ * skips the schema the normal lane enforces, or that lets the operator choose
+ * where the payload lands. Both are closed here by construction — the caller
+ * hands in the NORMAL lane's validator (there is no other validator to pass),
+ * and the destination is derived from the submission id, so `--from` says what
+ * to land and never where.
+ *
+ * The third property is that the rescue is not erased: a successful recovery
+ * appends `recovered_by_hand`, so a run repaired by an operator stays
+ * distinguishable from one the host got right.
+ */
+import { unlink } from "node:fs/promises";
+import { readOptionalJsonFile, writeJsonFile } from "../io/json.js";
+import { discardOnSchemaVersionMismatch } from "../io/schemaVersion.js";
+import { expectedSubmissionsPath, submissionsDir, } from "../io/auditToolsPaths.js";
+import { EXPECTED_SET_CONTRACT_VERSION } from "./expectedSubmissions.js";
+import { readSubmissionDocument } from "./submissionClassifier.js";
+import { absoluteSubmissionPath, submissionPathFor, } from "./submissionIdentity.js";
+import { SUBMISSION_LEDGER_EVENT_CONTRACT_VERSION, appendSubmissionEvent, } from "./submissionLedger.js";
+/**
+ * Resolve which lane the id belongs to from the recorded expectation, so the
+ * ledger entry reads in lane vocabulary. Best-effort: a draw that keeps its
+ * expected set somewhere other than the artifacts dir simply records the id.
+ *
+ * The set is REGENERABLE bookkeeping (rewritten at every emit), so one left by
+ * another release is discarded rather than read under this release's field
+ * semantics — a lane name is a label on the record, and a wrong one taken from
+ * a foreign contract is worse than the raw id this function already falls back
+ * to. Discarding lands on exactly that existing degrade path.
+ */
+async function resolveLane(artifactsDir, submissionId) {
+    const set = discardOnSchemaVersionMismatch(await readOptionalJsonFile(expectedSubmissionsPath(artifactsDir)).catch(() => undefined), EXPECTED_SET_CONTRACT_VERSION);
+    return (set?.entries?.find((entry) => entry.submission_id === submissionId)?.lane ??
+        submissionId);
+}
+/**
+ * Validate the operator's payload with the normal lane's validator and, only
+ * if it passes, land it at the tool-owned path. A refusal writes nothing and
+ * records nothing — a run must never look hand-repaired because a repair was
+ * ATTEMPTED.
+ */
+export async function recoverSubmission(request, validate) {
+    const paths = {
+        root: request.root,
+        submissionDir: request.submissionDir ?? submissionsDir(request.artifactsDir),
+    };
+    // BOTH destinations are resolved first, because both can refuse: the
+    // repo-relative form runs the containment check, and a submission directory
+    // that escapes the declared root throws. Computed after the write, that
+    // refusal arrived with the payload already landed and `recovered_by_hand`
+    // already appended — a rescue reported as failed that a re-run would then
+    // record twice. Resolved here, a refusal is what the rejection path already
+    // guarantees: nothing written, nothing recorded.
+    const landingPath = absoluteSubmissionPath(paths, request.submissionId);
+    const boundPath = submissionPathFor(paths, request.submissionId);
+    const read = await readSubmissionDocument(request.fromPath);
+    if (read.kind === "missing") {
+        return {
+            ok: false,
+            issue: {
+                code: "submission_missing",
+                message: `nothing to recover at ${request.fromPath}`,
+                submission_id: request.submissionId,
+            },
+        };
+    }
+    if (read.kind === "malformed") {
+        return {
+            ok: false,
+            issue: {
+                code: "submission_malformed",
+                message: `the payload at ${request.fromPath} is not JSON: ${read.detail}`,
+                submission_id: request.submissionId,
+            },
+        };
+    }
+    const issue = validate(read.value);
+    if (issue !== null) {
+        return { ok: false, issue };
+    }
+    const lane = request.lane ?? (await resolveLane(request.artifactsDir, request.submissionId));
+    await writeJsonFile(landingPath, read.value);
+    try {
+        await appendSubmissionEvent(request.artifactsDir, {
+            contract_version: SUBMISSION_LEDGER_EVENT_CONTRACT_VERSION,
+            run_id: request.runId,
+            submission_id: request.submissionId,
+            lane,
+            kind: "recovered_by_hand",
+            message: `re-landed by hand from ${request.fromPath}`,
+            recorded_at: new Date().toISOString(),
+        });
+    }
+    catch (error) {
+        // The payload is landed but the repair is unrecorded — the single state
+        // this verb must never leave behind, because the next `next-step` would
+        // consume it as a clean first-try submission and the run would read as one
+        // that never drifted. That is precisely the distinguishability the ledger
+        // exists to guarantee, so the write is rolled back and the operator keeps a
+        // failed rescue they can retry rather than a silent falsification.
+        const detail = error instanceof Error ? error.message : String(error);
+        try {
+            await unlink(landingPath);
+        }
+        catch (rollbackError) {
+            const rollbackDetail = rollbackError instanceof Error
+                ? rollbackError.message
+                : String(rollbackError);
+            throw new Error(`hand recovery for '${request.submissionId}' could not record the ledger event ` +
+                `(${detail}), and the landed payload could NOT be rolled back (${rollbackDetail}). ` +
+                `The payload IS on disk at ${boundPath} with no recovered_by_hand record — ` +
+                "remove it or retry the recovery before the next next-step consumes it.", { cause: error });
+        }
+        throw new Error(`hand recovery for '${request.submissionId}' could not record the ledger event: ` +
+            `${detail}. The payload was NOT landed (rolled back) — retry the recovery.`, { cause: error });
+    }
+    return { ok: true, submission_path: boundPath };
+}
+//# sourceMappingURL=handRecovery.js.map

package/dist/shared/submission/handRecovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handRecovery.js","sourceRoot":"","sources":["../../../src/shared/submission/handRecovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EACL,uBAAuB,EACvB,cAAc,GACf,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AAGzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,wCAAwC,EACxC,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AA4B/B;;;;;;;;;;GAUG;AACH,KAAK,UAAU,WAAW,CACxB,YAAoB,EACpB,YAAoB;IAEpB,MAAM,GAAG,GAAG,8BAA8B,CACxC,MAAM,oBAAoB,CACxB,uBAAuB,CAAC,YAAY,CAAC,CACtC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EACxB,6BAA6B,CAC9B,CAAC;IACF,OAAO,CACL,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,KAAK,YAAY,CAAC,EAAE,IAAI;QACzE,YAAY,CACb,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAA4B,EAC5B,QAAoD;IAEpD,MAAM,KAAK,GAAG;QACZ,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,cAAc,CAAC,OAAO,CAAC,YAAY,CAAC;KAC7E,CAAC;IACF,qEAAqE;IACrE,4EAA4E;IAC5E,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,iDAAiD;IACjD,MAAM,WAAW,GAAG,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,yBAAyB,OAAO,CAAC,QAAQ,EAAE;gBACpD,aAAa,EAAE,OAAO,CAAC,YAAY;aACpC;SACF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC9B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,kBAAkB,OAAO,CAAC,QAAQ,iBAAiB,IAAI,CAAC,MAAM,EAAE;gBACzE,aAAa,EAAE,OAAO,CAAC,YAAY;aACpC;SACF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,IAAI,GACR,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IAClF,MAAM,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,qBAAqB,CAAC,OAAO,CAAC,YAAY,EAAE;YAChD,gBAAgB,EAAE,wCAAwC;YAC1D,MAAM,EAAE,OAAO,CAAC,KAAK;YACrB,aAAa,EAAE,OAAO,CAAC,YAAY;YACnC,IAAI;YACJ,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,0BAA0B,OAAO,CAAC,QAAQ,EAAE;YACrD,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wEAAwE;QACxE,wEAAwE;QACxE,2EAA2E;QAC3E,0EAA0E;QAC1E,4EAA4E;QAC5E,mEAAmE;QACnE,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,aAAa,EAAE,CAAC;YACvB,MAAM,cAAc,GAClB,aAAa,YAAY,KAAK;gBAC5B,CAAC,CAAC,aAAa,CAAC,OAAO;gBACvB,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,sBAAsB,OAAO,CAAC,YAAY,sCAAsC;gBAC9E,IAAI,MAAM,uDAAuD,cAAc,KAAK;gBACpF,6BAA6B,SAAS,sCAAsC;gBAC5E,wEAAwE,EAC1E,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,sBAAsB,OAAO,CAAC,YAAY,uCAAuC;YAC/E,GAAG,MAAM,kEAAkE,EAC7E,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC;AAClD,CAAC"}

package/dist/shared/submission/submissionClassifier.d.ts

@@ -0,0 +1,48 @@
+export declare const SUBMISSION_ISSUE_CODES: readonly ["submission_missing", "submission_malformed", "submission_contract_invalid", "submission_rejected", "duplicate_submission_id"];
+export type SubmissionIssueCode = (typeof SUBMISSION_ISSUE_CODES)[number];
+/**
+ * One classified failure. `TCode` widens for a draw that adds its own domain
+ * codes; the base parameterization is the shared vocabulary above.
+ *
+ * Two optional locators, because a submission is identified differently on the
+ * two lanes it can arrive through: an expected-set member is named by
+ * `submission_id` + `submission_path`, and a host work item by `work_item_id` +
+ * `result_path` (the field name its own persisted contract already uses).
+ */
+export interface SubmissionIssue<TCode extends string = SubmissionIssueCode> {
+    readonly code: TCode;
+    readonly message: string;
+    readonly submission_id?: string;
+    readonly submission_path?: string;
+    readonly work_item_id?: string;
+    readonly result_path?: string;
+}
+/** The three-way read every gate narrows on — never a throw out of one lane. */
+export type SubmissionReadOutcome = {
+    readonly kind: "missing";
+} | {
+    readonly kind: "malformed";
+    readonly detail: string;
+} | {
+    readonly kind: "value";
+    readonly value: unknown;
+};
+/**
+ * Read the bytes at a bound path and classify the outcome. A file that is not
+ * there and a file that will not parse are DIFFERENT answers; every other IO
+ * failure reads as malformed rather than escaping, so one unreadable lane can
+ * never destroy a sibling lane's already-consumed work.
+ */
+export declare function readSubmissionDocument(absolutePath: string): Promise<SubmissionReadOutcome>;
+/** Where a classified read came from, for the issue's message and locators. */
+export interface SubmissionReadContext {
+    readonly submissionId: string;
+    readonly lane: string;
+    readonly submissionPath: string;
+}
+/**
+ * Turn a non-`value` read into the issue that names it, or `null` when the
+ * submission arrived. Lane vocabulary throughout: a member is a lane.
+ */
+export declare function classifyRead(outcome: SubmissionReadOutcome, context: SubmissionReadContext): SubmissionIssue | null;
+//# sourceMappingURL=submissionClassifier.d.ts.map

package/dist/shared/submission/submissionClassifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"submissionClassifier.d.ts","sourceRoot":"","sources":["../../../src/shared/submission/submissionClassifier.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,sBAAsB,0IAWzB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe,CAAC,KAAK,SAAS,MAAM,GAAG,mBAAmB;IACzE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,gFAAgF;AAChF,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAExD;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,qBAAqB,CAAC,CAqBhC;AAED,+EAA+E;AAC/E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,qBAAqB,GAC7B,eAAe,GAAG,IAAI,CAkBxB"}

package/dist/shared/submission/submissionClassifier.js

@@ -0,0 +1,83 @@
+/**
+ * The ONE failure vocabulary for a host submission both orchestrators read.
+ *
+ * Before this module the two draws had drifted: remediate classified a failed
+ * read into a named issue code, while the audit ingest collapsed a missing
+ * file, unparseable bytes, a contract-invalid body and a failed conversion into
+ * the same bare `null` — so a host that never wrote its submission and a host
+ * that wrote garbage were indistinguishable to every caller. One union, two
+ * thin draws.
+ *
+ * The vocabulary is deliberately narrow: it names what happened to a
+ * SUBMISSION. Domain corroboration a single draw performs (git ancestry, write
+ * scope, a required test rerun) extends this union on that draw's side rather
+ * than pulling its vocabulary in here — see `RemediationIssueCode`.
+ */
+import { readFile } from "node:fs/promises";
+export const SUBMISSION_ISSUE_CODES = [
+    /** Nothing exists at the bound path. */
+    "submission_missing",
+    /** Something exists at the bound path but is not JSON. */
+    "submission_malformed",
+    /** Valid JSON that fails the lane's schema / binding contract. */
+    "submission_contract_invalid",
+    /** Well-formed and valid, but refused for a stated reason. */
+    "submission_rejected",
+    /** A second submission re-uses an identity already accepted this run. */
+    "duplicate_submission_id",
+];
+/**
+ * Read the bytes at a bound path and classify the outcome. A file that is not
+ * there and a file that will not parse are DIFFERENT answers; every other IO
+ * failure reads as malformed rather than escaping, so one unreadable lane can
+ * never destroy a sibling lane's already-consumed work.
+ */
+export async function readSubmissionDocument(absolutePath) {
+    let source;
+    try {
+        source = await readFile(absolutePath, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            return { kind: "missing" };
+        }
+        return {
+            kind: "malformed",
+            detail: error instanceof Error ? error.message : String(error),
+        };
+    }
+    try {
+        return { kind: "value", value: JSON.parse(source) };
+    }
+    catch (error) {
+        return {
+            kind: "malformed",
+            detail: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+/**
+ * Turn a non-`value` read into the issue that names it, or `null` when the
+ * submission arrived. Lane vocabulary throughout: a member is a lane.
+ */
+export function classifyRead(outcome, context) {
+    if (outcome.kind === "value")
+        return null;
+    const locators = {
+        submission_id: context.submissionId,
+        submission_path: context.submissionPath,
+    };
+    if (outcome.kind === "missing") {
+        return {
+            code: "submission_missing",
+            message: `lane '${context.lane}' submitted nothing at its bound path`,
+            ...locators,
+        };
+    }
+    return {
+        code: "submission_malformed",
+        message: `lane '${context.lane}' submitted bytes that are not JSON: ${outcome.detail}`,
+        ...locators,
+    };
+}
+//# sourceMappingURL=submissionClassifier.js.map

package/dist/shared/submission/submissionClassifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"submissionClassifier.js","sourceRoot":"","sources":["../../../src/shared/submission/submissionClassifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,wCAAwC;IACxC,oBAAoB;IACpB,0DAA0D;IAC1D,sBAAsB;IACtB,kEAAkE;IAClE,6BAA6B;IAC7B,8DAA8D;IAC9D,qBAAqB;IACrB,yEAAyE;IACzE,yBAAyB;CACjB,CAAC;AA4BX;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,YAAoB;IAEpB,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,CAAC;QACD,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAY,EAAE,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC;IACJ,CAAC;AACH,CAAC;AASD;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,OAA8B,EAC9B,OAA8B;IAE9B,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,QAAQ,GAAG;QACf,aAAa,EAAE,OAAO,CAAC,YAAY;QACnC,eAAe,EAAE,OAAO,CAAC,cAAc;KAC/B,CAAC;IACX,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,SAAS,OAAO,CAAC,IAAI,uCAAuC;YACrE,GAAG,QAAQ;SACZ,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,SAAS,OAAO,CAAC,IAAI,wCAAwC,OAAO,CAAC,MAAM,EAAE;QACtF,GAAG,QAAQ;KACZ,CAAC;AACJ,CAAC"}

package/dist/shared/submission/submissionIdentity.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Where submissions live for one draw: the repository root a bound path is
+ * expressed relative to, and the directory the payload files sit in.
+ */
+export interface SubmissionRoots {
+    readonly root: string;
+    readonly submissionDir: string;
+}
+/** The identity components a submission id is derived from. */
+export interface SubmissionIdParts {
+    /** The obligation/gate family the submission answers. */
+    readonly kind: string;
+    /** The content-coherent lane within that family. */
+    readonly lane: string;
+    /** The run (or run-equivalent scope) the lane belongs to. */
+    readonly runId: string;
+}
+/**
+ * Mint the submission id for one lane. DETERMINISTIC: the same kind + lane +
+ * run always yields the same id, so a re-emitted step re-declares the identical
+ * bound path and an already-satisfied lane is recognized on resume (K-of-N).
+ * No timestamp, no randomness — an id that changed per call would re-ask for
+ * work the host already delivered.
+ *
+ * The readable prefix is for humans reading the ledger; the trailing digest is
+ * what makes distinct lanes distinct.
+ */
+export declare function mintSubmissionId(parts: SubmissionIdParts): string;
+/** Absolute on-disk path of one submission payload. */
+export declare function absoluteSubmissionPath(paths: SubmissionRoots, submissionId: string): string;
+/**
+ * The bound path as it is declared in a step contract and rendered to a host:
+ * repository-relative and forward-slashed, so the same contract reads
+ * identically on win32 / darwin / linux.
+ */
+export declare function submissionPathFor(paths: SubmissionRoots, submissionId: string): string;
+/**
+ * Resolve `candidate` against `base` and refuse anything that escapes it. The
+ * containment rule both host handoffs hand-rolled.
+ */
+export declare function resolveContainedPath(base: string, candidate: string, label: string): string;
+/** Repository-relative, forward-slashed form of a contained absolute path. */
+export declare function repoRelativePath(root: string, absolutePath: string, label: string): string;
+/**
+ * The shared run-id grammar. A run id becomes a directory segment, so it may
+ * carry nothing that could climb out of the artifacts tree.
+ */
+export declare function assertSubmissionRunId(runId: string, label?: string): void;
+//# sourceMappingURL=submissionIdentity.d.ts.map

package/dist/shared/submission/submissionIdentity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"submissionIdentity.d.ts","sourceRoot":"","sources":["../../../src/shared/submission/submissionIdentity.ts"],"names":[],"mappings":"AAkBA;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAOD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,CAMjE;AAUD,uDAAuD;AACvD,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,eAAe,EACtB,YAAY,EAAE,MAAM,GACnB,MAAM,CAER;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,eAAe,EACtB,YAAY,EAAE,MAAM,GACnB,MAAM,CAMR;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,MAAM,CAWR;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACZ,MAAM,CAOR;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,SAAW,GAAG,IAAI,CAQ3E"}

package/dist/shared/submission/submissionIdentity.js

@@ -0,0 +1,90 @@
+/**
+ * The ONE tool-owned submission path rule.
+ *
+ * A host submission lands at `<submissionDir>/<sha256(submission_id)>.json` and
+ * nowhere else. The id is minted by the tool at step-emit time and the path is
+ * derived from it, so a host cannot invent, mistype, or re-render the name of a
+ * file the tool will read — a write to any other path is simply not read.
+ *
+ * Both draws share this module: the audit host handoff binds its work-item
+ * results through it, and the audit gate lanes bind their submissions through
+ * it. It replaces the two hand-rolled `resultPathFor` copies that carried the
+ * same rule in two places.
+ */
+import { isAbsolute, join, relative, resolve } from "node:path";
+import { hashContent } from "../hash.js";
+import { stableStringify } from "../stableStringify.js";
+/** Non-path-safe characters collapse so the id stays readable in a ledger. */
+function slug(value) {
+    return value.replace(/[^A-Za-z0-9._-]+/gu, "-").replace(/^-+|-+$/gu, "");
+}
+/**
+ * Mint the submission id for one lane. DETERMINISTIC: the same kind + lane +
+ * run always yields the same id, so a re-emitted step re-declares the identical
+ * bound path and an already-satisfied lane is recognized on resume (K-of-N).
+ * No timestamp, no randomness — an id that changed per call would re-ask for
+ * work the host already delivered.
+ *
+ * The readable prefix is for humans reading the ledger; the trailing digest is
+ * what makes distinct lanes distinct.
+ */
+export function mintSubmissionId(parts) {
+    const digest = hashContent(stableStringify({ kind: parts.kind, lane: parts.lane, run_id: parts.runId }), { length: 16 });
+    return `${slug(parts.kind)}.${slug(parts.lane)}.${digest}`;
+}
+/** The single filename rule: the sha256 of the id, nothing else. */
+function submissionFilename(submissionId) {
+    if (typeof submissionId !== "string" || submissionId.length === 0) {
+        throw new Error("submission id must be a non-empty string");
+    }
+    return `${hashContent(submissionId)}.json`;
+}
+/** Absolute on-disk path of one submission payload. */
+export function absoluteSubmissionPath(paths, submissionId) {
+    return join(resolve(paths.submissionDir), submissionFilename(submissionId));
+}
+/**
+ * The bound path as it is declared in a step contract and rendered to a host:
+ * repository-relative and forward-slashed, so the same contract reads
+ * identically on win32 / darwin / linux.
+ */
+export function submissionPathFor(paths, submissionId) {
+    return repoRelativePath(paths.root, absoluteSubmissionPath(paths, submissionId), `submission path for ${submissionId}`);
+}
+/**
+ * Resolve `candidate` against `base` and refuse anything that escapes it. The
+ * containment rule both host handoffs hand-rolled.
+ */
+export function resolveContainedPath(base, candidate, label) {
+    const absoluteBase = resolve(base);
+    const absoluteCandidate = isAbsolute(candidate)
+        ? resolve(candidate)
+        : resolve(absoluteBase, candidate);
+    const rel = relative(absoluteBase, absoluteCandidate);
+    const firstSegment = rel.split(/[\\/]/u)[0];
+    if (isAbsolute(rel) || firstSegment === "..") {
+        throw new Error(`${label} must remain beneath ${absoluteBase}`);
+    }
+    return absoluteCandidate;
+}
+/** Repository-relative, forward-slashed form of a contained absolute path. */
+export function repoRelativePath(root, absolutePath, label) {
+    const contained = resolveContainedPath(root, absolutePath, label);
+    const rel = relative(resolve(root), contained).replaceAll("\\", "/");
+    if (rel.length === 0) {
+        throw new Error(`${label} must identify a path beneath the repository root`);
+    }
+    return rel;
+}
+/**
+ * The shared run-id grammar. A run id becomes a directory segment, so it may
+ * carry nothing that could climb out of the artifacts tree.
+ */
+export function assertSubmissionRunId(runId, label = "run id") {
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(runId) ||
+        runId === "." ||
+        runId === "..") {
+        throw new Error(`Invalid ${label}: ${JSON.stringify(runId)}`);
+    }
+}
+//# sourceMappingURL=submissionIdentity.js.map

package/dist/shared/submission/submissionIdentity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"submissionIdentity.js","sourceRoot":"","sources":["../../../src/shared/submission/submissionIdentity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEhE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAqBxD,8EAA8E;AAC9E,SAAS,IAAI,CAAC,KAAa;IACzB,OAAO,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAwB;IACvD,MAAM,MAAM,GAAG,WAAW,CACxB,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,EAC5E,EAAE,MAAM,EAAE,EAAE,EAAE,CACf,CAAC;IACF,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC;AAC7D,CAAC;AAED,oEAAoE;AACpE,SAAS,kBAAkB,CAAC,YAAoB;IAC9C,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,GAAG,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC;AAC7C,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,sBAAsB,CACpC,KAAsB,EACtB,YAAoB;IAEpB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAsB,EACtB,YAAoB;IAEpB,OAAO,gBAAgB,CACrB,KAAK,CAAC,IAAI,EACV,sBAAsB,CAAC,KAAK,EAAE,YAAY,CAAC,EAC3C,uBAAuB,YAAY,EAAE,CACtC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,SAAiB,EACjB,KAAa;IAEb,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,iBAAiB,GAAG,UAAU,CAAC,SAAS,CAAC;QAC7C,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QACpB,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wBAAwB,YAAY,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,YAAoB,EACpB,KAAa;IAEb,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mDAAmD,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,KAAK,GAAG,QAAQ;IACnE,IACE,CAAC,qCAAqC,CAAC,IAAI,CAAC,KAAK,CAAC;QAClD,KAAK,KAAK,GAAG;QACb,KAAK,KAAK,IAAI,EACd,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChE,CAAC;AACH,CAAC"}

package/dist/shared/submission/submissionLedger.d.ts

@@ -0,0 +1,37 @@
+import type { SubmissionIssueCode } from "./submissionClassifier.js";
+export declare const SUBMISSION_LEDGER_EVENT_CONTRACT_VERSION: "submission-ledger-event/v1alpha1";
+export declare const SUBMISSION_EVENT_KINDS: readonly ["expected", "accepted", "rejected", "recovered_by_hand"];
+export type SubmissionEventKind = (typeof SUBMISSION_EVENT_KINDS)[number];
+export interface SubmissionLedgerEvent {
+    readonly contract_version: typeof SUBMISSION_LEDGER_EVENT_CONTRACT_VERSION;
+    readonly run_id: string;
+    readonly submission_id: string;
+    readonly lane: string;
+    readonly kind: SubmissionEventKind;
+    readonly issue_code?: SubmissionIssueCode;
+    readonly message?: string;
+    /** ISO-8601. A faithful event record is allowed to say when. */
+    readonly recorded_at: string;
+}
+/** `<artifactsDir>/submissions/submission-ledger.jsonl`. */
+export declare function submissionLedgerPath(artifactsDir: string): string;
+/** Append one event. The parent directory is created on demand. */
+export declare function appendSubmissionEvent(artifactsDir: string, event: SubmissionLedgerEvent): Promise<void>;
+/**
+ * Read the ledger in arrival order. An absent ledger reads as empty — a run
+ * that never drifted has nothing to say — and a partially-written tail is
+ * skipped rather than thrown, because a bookkeeping record must never be able
+ * to fail the call it is recording.
+ *
+ * An event stamped with another release's contract version is skipped EXACTLY
+ * like a torn line, per event. The FILE stays a faithful historical record —
+ * nothing is rewritten or dropped from disk — but this function is a REPORTING
+ * surface, and its callers read `kind`, `issue_code` and `message` to decide
+ * whether a lane is outstanding because it was refused, and to dedupe against
+ * the last recorded event. Reinterpreting a foreign contract's event under
+ * those field semantics is how a run gets MISreported; skipping it degrades to
+ * the same shape as a ledger that had not recorded that event yet. The skip is
+ * per line, so the current release's events on either side of it still load.
+ */
+export declare function readSubmissionLedger(artifactsDir: string): Promise<readonly SubmissionLedgerEvent[]>;
+//# sourceMappingURL=submissionLedger.d.ts.map

package/dist/shared/submission/submissionLedger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"submissionLedger.d.ts","sourceRoot":"","sources":["../../../src/shared/submission/submissionLedger.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE,eAAO,MAAM,wCAAwC,EACnD,kCAA2C,CAAC;AAE9C,eAAO,MAAM,sBAAsB,oEASzB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,wCAAwC,CAAC;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,4DAA4D;AAC5D,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,mEAAmE;AACnE,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CAsB3C"}

package/dist/shared/submission/submissionLedger.js

@@ -0,0 +1,81 @@
+/**
+ * The append-only record of what happened to each submission.
+ *
+ * A run that drifted and was repaired must stay distinguishable, after the
+ * fact, from a run that was clean on the first try. Nothing in the pipeline
+ * used to survive the call: an issue rode the returned summary into a prompt
+ * string and was gone. So "the host got it right 9 times out of 10" was a fact
+ * a human read off a transcript rather than one the artifacts could state.
+ *
+ * NDJSON, appended, never rewritten: ARRIVAL order is the file order and a
+ * rejection stays on the record after the later acceptance lands. This is the
+ * one place the stable-content-order rule deliberately does NOT apply — the
+ * ledger is a faithful EVENT record, not a derived artifact, and re-sorting it
+ * by timestamp or id would erase exactly the sequence it exists to preserve.
+ * Any derived summary a reporter renders from it may sort; the file may not.
+ */
+import { join } from "node:path";
+import { readFile } from "node:fs/promises";
+import { appendNdjsonFile } from "../io/json.js";
+import { discardOnSchemaVersionMismatch } from "../io/schemaVersion.js";
+import { submissionsDir } from "../io/auditToolsPaths.js";
+export const SUBMISSION_LEDGER_EVENT_CONTRACT_VERSION = "submission-ledger-event/v1alpha1";
+export const SUBMISSION_EVENT_KINDS = [
+    /** The emission declared this lane owed a submission. */
+    "expected",
+    /** A valid submission arrived and was applied. */
+    "accepted",
+    /** A submission arrived and was refused (held, never discarded). */
+    "rejected",
+    /** An operator re-landed a submission by hand through the recovery lane. */
+    "recovered_by_hand",
+];
+/** `<artifactsDir>/submissions/submission-ledger.jsonl`. */
+export function submissionLedgerPath(artifactsDir) {
+    return join(submissionsDir(artifactsDir), "submission-ledger.jsonl");
+}
+/** Append one event. The parent directory is created on demand. */
+export async function appendSubmissionEvent(artifactsDir, event) {
+    await appendNdjsonFile(submissionLedgerPath(artifactsDir), event);
+}
+/**
+ * Read the ledger in arrival order. An absent ledger reads as empty — a run
+ * that never drifted has nothing to say — and a partially-written tail is
+ * skipped rather than thrown, because a bookkeeping record must never be able
+ * to fail the call it is recording.
+ *
+ * An event stamped with another release's contract version is skipped EXACTLY
+ * like a torn line, per event. The FILE stays a faithful historical record —
+ * nothing is rewritten or dropped from disk — but this function is a REPORTING
+ * surface, and its callers read `kind`, `issue_code` and `message` to decide
+ * whether a lane is outstanding because it was refused, and to dedupe against
+ * the last recorded event. Reinterpreting a foreign contract's event under
+ * those field semantics is how a run gets MISreported; skipping it degrades to
+ * the same shape as a ledger that had not recorded that event yet. The skip is
+ * per line, so the current release's events on either side of it still load.
+ */
+export async function readSubmissionLedger(artifactsDir) {
+    let content;
+    try {
+        content = await readFile(submissionLedgerPath(artifactsDir), "utf8");
+    }
+    catch {
+        return [];
+    }
+    const events = [];
+    for (const line of content.split(/\r?\n/u)) {
+        if (line.trim().length === 0)
+            continue;
+        try {
+            const event = discardOnSchemaVersionMismatch(JSON.parse(line), SUBMISSION_LEDGER_EVENT_CONTRACT_VERSION);
+            if (event !== undefined)
+                events.push(event);
+        }
+        catch {
+            // A torn final line (crash mid-append) drops; every complete event before
+            // it stays readable, which is the whole point of an append-only record.
+        }
+    }
+    return events;
+}
+//# sourceMappingURL=submissionLedger.js.map

package/dist/shared/submission/submissionLedger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"submissionLedger.js","sourceRoot":"","sources":["../../../src/shared/submission/submissionLedger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAG1D,MAAM,CAAC,MAAM,wCAAwC,GACnD,kCAA2C,CAAC;AAE9C,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,yDAAyD;IACzD,UAAU;IACV,kDAAkD;IAClD,UAAU;IACV,oEAAoE;IACpE,UAAU;IACV,4EAA4E;IAC5E,mBAAmB;CACX,CAAC;AAgBX,4DAA4D;AAC5D,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,yBAAyB,CAAC,CAAC;AACvE,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,YAAoB,EACpB,KAA4B;IAE5B,MAAM,gBAAgB,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB;IAEpB,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACvC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,8BAA8B,CAC1C,IAAI,CAAC,KAAK,CAAC,IAAI,CAA0B,EACzC,wCAAwC,CACzC,CAAC;YACF,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,wEAAwE;QAC1E,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/docs/audit-pkg/product.md

@@ -113,7 +113,5 @@ crossings, weak-packet gaps) is how extraction gaps are found and prioritized.
 ## Non-goals
 
 - repositioning the CLI as a peer product surface
-- making session config the normal way to redirect semantic review into a
-  second execution backend
 - making backend implementation details outrank the conversation contract
 - tying packetization quality to one programming language

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "audit-tools",
-  "version": "0.40.1",
+  "version": "0.41.0",
   "private": false,
   "license": "ISC",
   "description": "Provider-neutral code auditing and remediation workflows for arbitrary repositories.",