audit-tools 0.40.1 → 0.41.1

package/dist/shared/submission/submissionIdentity.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Where submissions live for one draw: the repository root a bound path is
+ * expressed relative to, and the directory the payload files sit in.
+ */
+export interface SubmissionRoots {
+    readonly root: string;
+    readonly submissionDir: string;
+}
+/** The identity components a submission id is derived from. */
+export interface SubmissionIdParts {
+    /** The obligation/gate family the submission answers. */
+    readonly kind: string;
+    /** The content-coherent lane within that family. */
+    readonly lane: string;
+    /** The run (or run-equivalent scope) the lane belongs to. */
+    readonly runId: string;
+}
+/**
+ * Mint the submission id for one lane. DETERMINISTIC: the same kind + lane +
+ * run always yields the same id, so a re-emitted step re-declares the identical
+ * bound path and an already-satisfied lane is recognized on resume (K-of-N).
+ * No timestamp, no randomness — an id that changed per call would re-ask for
+ * work the host already delivered.
+ *
+ * The readable prefix is for humans reading the ledger; the trailing digest is
+ * what makes distinct lanes distinct.
+ */
+export declare function mintSubmissionId(parts: SubmissionIdParts): string;
+/** Absolute on-disk path of one submission payload. */
+export declare function absoluteSubmissionPath(paths: SubmissionRoots, submissionId: string): string;
+/**
+ * The bound path as it is declared in a step contract and rendered to a host:
+ * repository-relative and forward-slashed, so the same contract reads
+ * identically on win32 / darwin / linux.
+ */
+export declare function submissionPathFor(paths: SubmissionRoots, submissionId: string): string;
+/**
+ * Resolve `candidate` against `base` and refuse anything that escapes it. The
+ * containment rule both host handoffs hand-rolled.
+ */
+export declare function resolveContainedPath(base: string, candidate: string, label: string): string;
+/** Repository-relative, forward-slashed form of a contained absolute path. */
+export declare function repoRelativePath(root: string, absolutePath: string, label: string): string;
+/**
+ * The shared run-id grammar. A run id becomes a directory segment, so it may
+ * carry nothing that could climb out of the artifacts tree.
+ */
+export declare function assertSubmissionRunId(runId: string, label?: string): void;
+//# sourceMappingURL=submissionIdentity.d.ts.map

package/dist/shared/submission/submissionIdentity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"submissionIdentity.d.ts","sourceRoot":"","sources":["../../../src/shared/submission/submissionIdentity.ts"],"names":[],"mappings":"AAkBA;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAOD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,CAMjE;AAUD,uDAAuD;AACvD,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,eAAe,EACtB,YAAY,EAAE,MAAM,GACnB,MAAM,CAER;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,eAAe,EACtB,YAAY,EAAE,MAAM,GACnB,MAAM,CAMR;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,MAAM,CAWR;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACZ,MAAM,CAOR;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,SAAW,GAAG,IAAI,CAQ3E"}

package/dist/shared/submission/submissionIdentity.js

@@ -0,0 +1,90 @@
+/**
+ * The ONE tool-owned submission path rule.
+ *
+ * A host submission lands at `<submissionDir>/<sha256(submission_id)>.json` and
+ * nowhere else. The id is minted by the tool at step-emit time and the path is
+ * derived from it, so a host cannot invent, mistype, or re-render the name of a
+ * file the tool will read — a write to any other path is simply not read.
+ *
+ * Both draws share this module: the audit host handoff binds its work-item
+ * results through it, and the audit gate lanes bind their submissions through
+ * it. It replaces the two hand-rolled `resultPathFor` copies that carried the
+ * same rule in two places.
+ */
+import { isAbsolute, join, relative, resolve } from "node:path";
+import { hashContent } from "../hash.js";
+import { stableStringify } from "../stableStringify.js";
+/** Non-path-safe characters collapse so the id stays readable in a ledger. */
+function slug(value) {
+    return value.replace(/[^A-Za-z0-9._-]+/gu, "-").replace(/^-+|-+$/gu, "");
+}
+/**
+ * Mint the submission id for one lane. DETERMINISTIC: the same kind + lane +
+ * run always yields the same id, so a re-emitted step re-declares the identical
+ * bound path and an already-satisfied lane is recognized on resume (K-of-N).
+ * No timestamp, no randomness — an id that changed per call would re-ask for
+ * work the host already delivered.
+ *
+ * The readable prefix is for humans reading the ledger; the trailing digest is
+ * what makes distinct lanes distinct.
+ */
+export function mintSubmissionId(parts) {
+    const digest = hashContent(stableStringify({ kind: parts.kind, lane: parts.lane, run_id: parts.runId }), { length: 16 });
+    return `${slug(parts.kind)}.${slug(parts.lane)}.${digest}`;
+}
+/** The single filename rule: the sha256 of the id, nothing else. */
+function submissionFilename(submissionId) {
+    if (typeof submissionId !== "string" || submissionId.length === 0) {
+        throw new Error("submission id must be a non-empty string");
+    }
+    return `${hashContent(submissionId)}.json`;
+}
+/** Absolute on-disk path of one submission payload. */
+export function absoluteSubmissionPath(paths, submissionId) {
+    return join(resolve(paths.submissionDir), submissionFilename(submissionId));
+}
+/**
+ * The bound path as it is declared in a step contract and rendered to a host:
+ * repository-relative and forward-slashed, so the same contract reads
+ * identically on win32 / darwin / linux.
+ */
+export function submissionPathFor(paths, submissionId) {
+    return repoRelativePath(paths.root, absoluteSubmissionPath(paths, submissionId), `submission path for ${submissionId}`);
+}
+/**
+ * Resolve `candidate` against `base` and refuse anything that escapes it. The
+ * containment rule both host handoffs hand-rolled.
+ */
+export function resolveContainedPath(base, candidate, label) {
+    const absoluteBase = resolve(base);
+    const absoluteCandidate = isAbsolute(candidate)
+        ? resolve(candidate)
+        : resolve(absoluteBase, candidate);
+    const rel = relative(absoluteBase, absoluteCandidate);
+    const firstSegment = rel.split(/[\\/]/u)[0];
+    if (isAbsolute(rel) || firstSegment === "..") {
+        throw new Error(`${label} must remain beneath ${absoluteBase}`);
+    }
+    return absoluteCandidate;
+}
+/** Repository-relative, forward-slashed form of a contained absolute path. */
+export function repoRelativePath(root, absolutePath, label) {
+    const contained = resolveContainedPath(root, absolutePath, label);
+    const rel = relative(resolve(root), contained).replaceAll("\\", "/");
+    if (rel.length === 0) {
+        throw new Error(`${label} must identify a path beneath the repository root`);
+    }
+    return rel;
+}
+/**
+ * The shared run-id grammar. A run id becomes a directory segment, so it may
+ * carry nothing that could climb out of the artifacts tree.
+ */
+export function assertSubmissionRunId(runId, label = "run id") {
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(runId) ||
+        runId === "." ||
+        runId === "..") {
+        throw new Error(`Invalid ${label}: ${JSON.stringify(runId)}`);
+    }
+}
+//# sourceMappingURL=submissionIdentity.js.map

package/dist/shared/submission/submissionIdentity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"submissionIdentity.js","sourceRoot":"","sources":["../../../src/shared/submission/submissionIdentity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEhE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAqBxD,8EAA8E;AAC9E,SAAS,IAAI,CAAC,KAAa;IACzB,OAAO,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAwB;IACvD,MAAM,MAAM,GAAG,WAAW,CACxB,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,EAC5E,EAAE,MAAM,EAAE,EAAE,EAAE,CACf,CAAC;IACF,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC;AAC7D,CAAC;AAED,oEAAoE;AACpE,SAAS,kBAAkB,CAAC,YAAoB;IAC9C,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,GAAG,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC;AAC7C,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,sBAAsB,CACpC,KAAsB,EACtB,YAAoB;IAEpB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAsB,EACtB,YAAoB;IAEpB,OAAO,gBAAgB,CACrB,KAAK,CAAC,IAAI,EACV,sBAAsB,CAAC,KAAK,EAAE,YAAY,CAAC,EAC3C,uBAAuB,YAAY,EAAE,CACtC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,SAAiB,EACjB,KAAa;IAEb,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,iBAAiB,GAAG,UAAU,CAAC,SAAS,CAAC;QAC7C,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QACpB,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wBAAwB,YAAY,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,YAAoB,EACpB,KAAa;IAEb,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mDAAmD,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,KAAK,GAAG,QAAQ;IACnE,IACE,CAAC,qCAAqC,CAAC,IAAI,CAAC,KAAK,CAAC;QAClD,KAAK,KAAK,GAAG;QACb,KAAK,KAAK,IAAI,EACd,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChE,CAAC;AACH,CAAC"}

package/dist/shared/submission/submissionLedger.d.ts

@@ -0,0 +1,37 @@
+import type { SubmissionIssueCode } from "./submissionClassifier.js";
+export declare const SUBMISSION_LEDGER_EVENT_CONTRACT_VERSION: "submission-ledger-event/v1alpha1";
+export declare const SUBMISSION_EVENT_KINDS: readonly ["expected", "accepted", "rejected", "recovered_by_hand"];
+export type SubmissionEventKind = (typeof SUBMISSION_EVENT_KINDS)[number];
+export interface SubmissionLedgerEvent {
+    readonly contract_version: typeof SUBMISSION_LEDGER_EVENT_CONTRACT_VERSION;
+    readonly run_id: string;
+    readonly submission_id: string;
+    readonly lane: string;
+    readonly kind: SubmissionEventKind;
+    readonly issue_code?: SubmissionIssueCode;
+    readonly message?: string;
+    /** ISO-8601. A faithful event record is allowed to say when. */
+    readonly recorded_at: string;
+}
+/** `<artifactsDir>/submissions/submission-ledger.jsonl`. */
+export declare function submissionLedgerPath(artifactsDir: string): string;
+/** Append one event. The parent directory is created on demand. */
+export declare function appendSubmissionEvent(artifactsDir: string, event: SubmissionLedgerEvent): Promise<void>;
+/**
+ * Read the ledger in arrival order. An absent ledger reads as empty — a run
+ * that never drifted has nothing to say — and a partially-written tail is
+ * skipped rather than thrown, because a bookkeeping record must never be able
+ * to fail the call it is recording.
+ *
+ * An event stamped with another release's contract version is skipped EXACTLY
+ * like a torn line, per event. The FILE stays a faithful historical record —
+ * nothing is rewritten or dropped from disk — but this function is a REPORTING
+ * surface, and its callers read `kind`, `issue_code` and `message` to decide
+ * whether a lane is outstanding because it was refused, and to dedupe against
+ * the last recorded event. Reinterpreting a foreign contract's event under
+ * those field semantics is how a run gets MISreported; skipping it degrades to
+ * the same shape as a ledger that had not recorded that event yet. The skip is
+ * per line, so the current release's events on either side of it still load.
+ */
+export declare function readSubmissionLedger(artifactsDir: string): Promise<readonly SubmissionLedgerEvent[]>;
+//# sourceMappingURL=submissionLedger.d.ts.map

package/dist/shared/submission/submissionLedger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"submissionLedger.d.ts","sourceRoot":"","sources":["../../../src/shared/submission/submissionLedger.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE,eAAO,MAAM,wCAAwC,EACnD,kCAA2C,CAAC;AAE9C,eAAO,MAAM,sBAAsB,oEASzB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,wCAAwC,CAAC;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,4DAA4D;AAC5D,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,mEAAmE;AACnE,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CAsB3C"}

package/dist/shared/submission/submissionLedger.js

@@ -0,0 +1,81 @@
+/**
+ * The append-only record of what happened to each submission.
+ *
+ * A run that drifted and was repaired must stay distinguishable, after the
+ * fact, from a run that was clean on the first try. Nothing in the pipeline
+ * used to survive the call: an issue rode the returned summary into a prompt
+ * string and was gone. So "the host got it right 9 times out of 10" was a fact
+ * a human read off a transcript rather than one the artifacts could state.
+ *
+ * NDJSON, appended, never rewritten: ARRIVAL order is the file order and a
+ * rejection stays on the record after the later acceptance lands. This is the
+ * one place the stable-content-order rule deliberately does NOT apply — the
+ * ledger is a faithful EVENT record, not a derived artifact, and re-sorting it
+ * by timestamp or id would erase exactly the sequence it exists to preserve.
+ * Any derived summary a reporter renders from it may sort; the file may not.
+ */
+import { join } from "node:path";
+import { readFile } from "node:fs/promises";
+import { appendNdjsonFile } from "../io/json.js";
+import { discardOnSchemaVersionMismatch } from "../io/schemaVersion.js";
+import { submissionsDir } from "../io/auditToolsPaths.js";
+export const SUBMISSION_LEDGER_EVENT_CONTRACT_VERSION = "submission-ledger-event/v1alpha1";
+export const SUBMISSION_EVENT_KINDS = [
+    /** The emission declared this lane owed a submission. */
+    "expected",
+    /** A valid submission arrived and was applied. */
+    "accepted",
+    /** A submission arrived and was refused (held, never discarded). */
+    "rejected",
+    /** An operator re-landed a submission by hand through the recovery lane. */
+    "recovered_by_hand",
+];
+/** `<artifactsDir>/submissions/submission-ledger.jsonl`. */
+export function submissionLedgerPath(artifactsDir) {
+    return join(submissionsDir(artifactsDir), "submission-ledger.jsonl");
+}
+/** Append one event. The parent directory is created on demand. */
+export async function appendSubmissionEvent(artifactsDir, event) {
+    await appendNdjsonFile(submissionLedgerPath(artifactsDir), event);
+}
+/**
+ * Read the ledger in arrival order. An absent ledger reads as empty — a run
+ * that never drifted has nothing to say — and a partially-written tail is
+ * skipped rather than thrown, because a bookkeeping record must never be able
+ * to fail the call it is recording.
+ *
+ * An event stamped with another release's contract version is skipped EXACTLY
+ * like a torn line, per event. The FILE stays a faithful historical record —
+ * nothing is rewritten or dropped from disk — but this function is a REPORTING
+ * surface, and its callers read `kind`, `issue_code` and `message` to decide
+ * whether a lane is outstanding because it was refused, and to dedupe against
+ * the last recorded event. Reinterpreting a foreign contract's event under
+ * those field semantics is how a run gets MISreported; skipping it degrades to
+ * the same shape as a ledger that had not recorded that event yet. The skip is
+ * per line, so the current release's events on either side of it still load.
+ */
+export async function readSubmissionLedger(artifactsDir) {
+    let content;
+    try {
+        content = await readFile(submissionLedgerPath(artifactsDir), "utf8");
+    }
+    catch {
+        return [];
+    }
+    const events = [];
+    for (const line of content.split(/\r?\n/u)) {
+        if (line.trim().length === 0)
+            continue;
+        try {
+            const event = discardOnSchemaVersionMismatch(JSON.parse(line), SUBMISSION_LEDGER_EVENT_CONTRACT_VERSION);
+            if (event !== undefined)
+                events.push(event);
+        }
+        catch {
+            // A torn final line (crash mid-append) drops; every complete event before
+            // it stays readable, which is the whole point of an append-only record.
+        }
+    }
+    return events;
+}
+//# sourceMappingURL=submissionLedger.js.map

package/dist/shared/submission/submissionLedger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"submissionLedger.js","sourceRoot":"","sources":["../../../src/shared/submission/submissionLedger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAG1D,MAAM,CAAC,MAAM,wCAAwC,GACnD,kCAA2C,CAAC;AAE9C,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,yDAAyD;IACzD,UAAU;IACV,kDAAkD;IAClD,UAAU;IACV,oEAAoE;IACpE,UAAU;IACV,4EAA4E;IAC5E,mBAAmB;CACX,CAAC;AAgBX,4DAA4D;AAC5D,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,yBAAyB,CAAC,CAAC;AACvE,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,YAAoB,EACpB,KAA4B;IAE5B,MAAM,gBAAgB,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB;IAEpB,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACvC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,8BAA8B,CAC1C,IAAI,CAAC,KAAK,CAAC,IAAI,CAA0B,EACzC,wCAAwC,CACzC,CAAC;YACF,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,wEAAwE;QAC1E,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/shared/types/finding.d.ts

@@ -467,6 +467,22 @@ export declare const FindingSchema: z.ZodObject<{
     } | undefined;
 }>;
 export type Finding = z.infer<typeof FindingSchema>;
+/**
+ * The finding contract as prompt lines, DERIVED from `FindingSchema` — the same
+ * schema result ingestion enforces, so the statement can never drift from the
+ * check.
+ *
+ * A dispatch prompt that says only "findings must satisfy the audit finding
+ * contract" leaves the host to remember or fetch the contract, and a measured
+ * lap lost four complete results to exactly that: findings missing the required
+ * per-finding `lens`, and `evidence`/`reproduction` submitted as a string where
+ * an array is required. Both classes are stated here.
+ *
+ * Memoized: the derivation is pure and the result is embedded in every work-item
+ * prompt (and therefore in every prompt hash), so it must be both cheap and
+ * byte-stable across a run.
+ */
+export declare function findingContractPromptLines(): readonly string[];
 /** Report-level grouping of findings into parallelizable units of work. */
 export declare const WorkBlockSchema: z.ZodObject<{
     id: z.ZodString;

package/dist/shared/types/finding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"finding.d.ts","sourceRoot":"","sources":["../../../src/shared/types/finding.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,iEAAiE;AACjE,eAAO,MAAM,qBAAqB,0DAMhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,sEAAsE;AACtE,eAAO,MAAM,uBAAuB,sCAAoC,CAAC;AACzE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,qBAAqB;;;;;IAKhC;;;;;;OAMG;;IAEH,0EAA0E;;;;;;;;;;;;;;;;EAE1E,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB;;IAEjC,mEAAmE;;;;;;;;EAEnE,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAGjC,qEAAqE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAErE,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,aAAa;;;;;;IAMxB,gEAAgE;;;;;;;;QAzEhE;;;;;;WAMG;;QAEH,0EAA0E;;;;;;;;;;;;;;;;;;;;;;;IA2E1E,yDAAyD;;IAEzD;;;;;;;;OAQG;;IAEH;;;;OAIG;;IAEH;;;;OAIG;;;QA3EH,mEAAmE;;;;;;;;;IA6EnE;;;;;;;OAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QApDH,qEAAqE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAsDrE,4EAA4E;;IAE5E,iFAAiF;;IAEjF,0EAA0E;;IAE1E,+EAA+E;;IAE/E;;;;;OAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAIH,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD,2EAA2E;AAC3E,eAAO,MAAM,eAAe;;;;;IAK1B,wEAAwE;;;;;IAKxE,gFAAgF;;;;;;;;;;;;;;;;;;;;;;EAEhF,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,+FAA+F;AAC/F,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;EAY9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;EAM7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAInC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,eAAe,CASjE;AAED,eAAO,MAAM,0BAA0B;;;;;;;;IAQrC;;;;;;;OAOG;;;;;;;;;;;;;;;;;;;;EAEH,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;QAjBpC;;;;;;;WAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;QA3KH,gEAAgE;;;;;;;;YAzEhE;;;;;;eAMG;;YAEH,0EAA0E;;;;;;;;;;;;;;;;;;;;;;;QA2E1E,yDAAyD;;QAEzD;;;;;;;;WAQG;;QAEH;;;;WAIG;;QAEH;;;;WAIG;;;YA3EH,mEAAmE;;;;;;;;;QA6EnE;;;;;;;WAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YApDH,qEAAqE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAsDrE,4EAA4E;;QAE5E,iFAAiF;;QAEjF,0EAA0E;;QAE1E,+EAA+E;;QAE/E;;;;;WAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAaH,wEAAwE;;;;;QAKxE,gFAAgF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAmH9E;;;;OAIG;;;;;;;QAjML,gEAAgE;;;;;;;;YAzEhE;;;;;;eAMG;;YAEH,0EAA0E;;;;;;;;;;;;;;;;;;;;;;;QA2E1E,yDAAyD;;QAEzD;;;;;;;;WAQG;;QAEH;;;;WAIG;;QAEH;;;;WAIG;;;YA3EH,mEAAmE;;;;;;;;;QA6EnE;;;;;;;WAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YApDH,qEAAqE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAsDrE,4EAA4E;;QAE5E,iFAAiF;;QAEjF,0EAA0E;;QAE1E,+EAA+E;;QAE/E;;;;;WAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA2ID,6EAA6E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkD7E,CAAC;AACL,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}
+{"version":3,"file":"finding.d.ts","sourceRoot":"","sources":["../../../src/shared/types/finding.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,iEAAiE;AACjE,eAAO,MAAM,qBAAqB,0DAMhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,sEAAsE;AACtE,eAAO,MAAM,uBAAuB,sCAAoC,CAAC;AACzE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,qBAAqB;;;;;IAKhC;;;;;;OAMG;;IAEH,0EAA0E;;;;;;;;;;;;;;;;EAE1E,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB;;IAEjC,mEAAmE;;;;;;;;EAEnE,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAGjC,qEAAqE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAErE,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,aAAa;;;;;;IAMxB,gEAAgE;;;;;;;;QAzEhE;;;;;;WAMG;;QAEH,0EAA0E;;;;;;;;;;;;;;;;;;;;;;;IA2E1E,yDAAyD;;IAEzD;;;;;;;;OAQG;;IAEH;;;;OAIG;;IAEH;;;;OAIG;;;QA3EH,mEAAmE;;;;;;;;;IA6EnE;;;;;;;OAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QApDH,qEAAqE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAsDrE,4EAA4E;;IAE5E,iFAAiF;;IAEjF,0EAA0E;;IAE1E,+EAA+E;;IAE/E;;;;;OAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAIH,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AA+BpD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,IAAI,SAAS,MAAM,EAAE,CAuB9D;AAED,2EAA2E;AAC3E,eAAO,MAAM,eAAe;;;;;IAK1B,wEAAwE;;;;;IAKxE,gFAAgF;;;;;;;;;;;;;;;;;;;;;;EAEhF,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,+FAA+F;AAC/F,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;EAY9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;EAM7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAInC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,eAAe,CASjE;AAED,eAAO,MAAM,0BAA0B;;;;;;;;IAQrC;;;;;;;OAOG;;;;;;;;;;;;;;;;;;;;EAEH,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;QAjBpC;;;;;;;WAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;QAhPH,gEAAgE;;;;;;;;YAzEhE;;;;;;eAMG;;YAEH,0EAA0E;;;;;;;;;;;;;;;;;;;;;;;QA2E1E,yDAAyD;;QAEzD;;;;;;;;WAQG;;QAEH;;;;WAIG;;QAEH;;;;WAIG;;;YA3EH,mEAAmE;;;;;;;;;QA6EnE;;;;;;;WAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YApDH,qEAAqE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAsDrE,4EAA4E;;QAE5E,iFAAiF;;QAEjF,0EAA0E;;QAE1E,+EAA+E;;QAE/E;;;;;WAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAkFH,wEAAwE;;;;;QAKxE,gFAAgF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAmH9E;;;;OAIG;;;;;;;QAtQL,gEAAgE;;;;;;;;YAzEhE;;;;;;eAMG;;YAEH,0EAA0E;;;;;;;;;;;;;;;;;;;;;;;QA2E1E,yDAAyD;;QAEzD;;;;;;;;WAQG;;QAEH;;;;WAIG;;QAEH;;;;WAIG;;;YA3EH,mEAAmE;;;;;;;;;QA6EnE;;;;;;;WAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YApDH,qEAAqE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAsDrE,4EAA4E;;QAE5E,iFAAiF;;QAEjF,0EAA0E;;QAE1E,+EAA+E;;QAE/E;;;;;WAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAgND,6EAA6E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkD7E,CAAC;AACL,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}

package/dist/shared/types/finding.js

@@ -10,6 +10,7 @@
 // strict projection below (see `workerFindingSchema`). There is no longer a
 // hand-written JSON schema to drift from these types.
 import { z } from "zod";
+import { zodToJsonSchema } from "zod-to-json-schema";
 import { AnalyzerLeadProvenanceSchema } from "../analyzers/provenance.js";
 import { ContentCoherenceTraceSchema } from "../decompose/contentCoherence.js";
 /** Canonical finding severity vocabulary (most-severe-first). */
@@ -151,6 +152,65 @@ export const FindingSchema = z.object({
      */
     analyzer_provenance: AnalyzerLeadProvenanceSchema.optional().describe("Content-anchored identity of the analyzer lead this finding was born from. Copy it VERBATIM from the injected lead's provenance object; omit for findings not born from an analyzer lead."),
 });
+function describeFindingField(node) {
+    if (node === undefined)
+        return "value";
+    if (Array.isArray(node.enum)) {
+        return `one of ${node.enum.map((value) => String(value)).join("|")}`;
+    }
+    if (node.type === "array") {
+        const item = node.items;
+        if (item?.type === "object") {
+            const required = [...(item.required ?? [])].sort();
+            return required.length > 0
+                ? `array of objects, each requiring ${required.join(" + ")}`
+                : "array of objects";
+        }
+        return typeof item?.type === "string" ? `array of ${item.type}s` : "array";
+    }
+    return typeof node.type === "string" ? node.type : "value";
+}
+let renderedFindingContract;
+/**
+ * The finding contract as prompt lines, DERIVED from `FindingSchema` — the same
+ * schema result ingestion enforces, so the statement can never drift from the
+ * check.
+ *
+ * A dispatch prompt that says only "findings must satisfy the audit finding
+ * contract" leaves the host to remember or fetch the contract, and a measured
+ * lap lost four complete results to exactly that: findings missing the required
+ * per-finding `lens`, and `evidence`/`reproduction` submitted as a string where
+ * an array is required. Both classes are stated here.
+ *
+ * Memoized: the derivation is pure and the result is embedded in every work-item
+ * prompt (and therefore in every prompt hash), so it must be both cheap and
+ * byte-stable across a run.
+ */
+export function findingContractPromptLines() {
+    if (renderedFindingContract !== undefined)
+        return renderedFindingContract;
+    const schema = zodToJsonSchema(FindingSchema, {
+        $refStrategy: "none",
+        target: "jsonSchema7",
+    });
+    const properties = schema.properties ?? {};
+    const required = [...(schema.required ?? [])].sort();
+    const arrayFields = Object.entries(properties)
+        .filter(([, node]) => node.type === "array")
+        .map(([name]) => name)
+        .sort();
+    renderedFindingContract = [
+        "Finding contract — every entry of `findings` must carry these required fields: " +
+            required
+                .map((name) => `${name} (${describeFindingField(properties[name])})`)
+                .join(", ") +
+            ".",
+        "These fields are JSON arrays whenever present, never a bare string or object: " +
+            arrayFields.join(", ") +
+            ". A finding that fails this contract rejects the whole submission.",
+    ];
+    return renderedFindingContract;
+}
 /** Report-level grouping of findings into parallelizable units of work. */
 export const WorkBlockSchema = z.object({
     id: z.string(),

package/dist/shared/types/finding.js.map

@@ -1 +1 @@
-{"version":3,"file":"finding.js","sourceRoot":"","sources":["../../../src/shared/types/finding.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,gFAAgF;AAChF,yEAAyE;AACzE,gFAAgF;AAChF,8EAA8E;AAC9E,mCAAmC;AACnC,EAAE;AACF,iFAAiF;AACjF,+EAA+E;AAC/E,4EAA4E;AAC5E,sDAAsD;AAEtD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAE/E,iEAAiE;AACjE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC1C,UAAU;IACV,MAAM;IACN,QAAQ;IACR,KAAK;IACL,MAAM;CACP,CAAC,CAAC;AAGH,sEAAsE;AACtE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAGzE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B;;;;;;OAMG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,0EAA0E;IAC1E,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;IACrD,mEAAmE;IACnE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAClE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;IAC1C,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;IAC7C,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAClE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CACnE,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,UAAU,EAAE,uBAAuB;IACnC,qEAAqE;IACrE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,QAAQ,EAAE,qBAAqB;IAC/B,UAAU,EAAE,uBAAuB;IACnC,gEAAgE;IAChE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAC9C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,yDAAyD;IACzD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B;;;;;;;;OAQG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACzC;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAC5C;;;;;;;OAOG;IACH,iBAAiB,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IACpD,4EAA4E;IAC5E,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,iFAAiF;IACjF,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,0EAA0E;IAC1E,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,+EAA+E;IAC/E,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACjD;;;;;OAKG;IACH,mBAAmB,EAAE,4BAA4B,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACnE,2LAA2L,CAC5L;CACF,CAAC,CAAC;AAGH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAChC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAChC,wEAAwE;IACxE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;IAChD,YAAY,EAAE,qBAAqB;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/B,gFAAgF;IAChF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAGH,+FAA+F;AAC/F,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QACX,0BAA0B;QAC1B,gBAAgB;QAChB,uBAAuB;KACxB,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAChC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;CAClC,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;IACnC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAoBH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACpD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC9B,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,mCAAmC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACrE,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D;;;;;;;OAOG;IACH,0BAA0B,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACxE,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACvC,MAAM,CAAC;IACN,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,OAAO,EAAE,0BAA0B;IACnC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IAChC,eAAe,EAAE,2BAA2B;IAC5C,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IACrC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAC9C;;;;OAIG;IACH,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IACvD,6EAA6E;IAC7E,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;SACzD,QAAQ,EAAE;IACb,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAC9C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,WAAW,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IAC/B,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC;IACrD,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QACpD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EACL,qEAAqE;SACxE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,WAAW,IAAI,EAAE,CAAC;QAChE,IACE,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;YACtC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,KAAK,UAAU,CAAC,WAAW,CAAC,CAAC,EACnE,CAAC;YACD,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,aAAa,EAAE,KAAK,EAAE,aAAa,CAAC;gBAC3C,OAAO,EACL,iFAAiF;aACpF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvE,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,aAAa,GAAG,MAAM,CAAC,eAAe,CAAC,gBAAgB;SAC1D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;SACtB,IAAI,EAAE,CAAC;IACV,MAAM,OAAO,GAAG,CAAC,IAAc,EAAE,KAAe,EAAW,EAAE,CAC3D,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAC5B,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC;QAC3E,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,iBAAiB,EAAE,YAAY,CAAC;YACvC,OAAO,EACL,iEAAiE;SACpE,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}
+{"version":3,"file":"finding.js","sourceRoot":"","sources":["../../../src/shared/types/finding.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,gFAAgF;AAChF,yEAAyE;AACzE,gFAAgF;AAChF,8EAA8E;AAC9E,mCAAmC;AACnC,EAAE;AACF,iFAAiF;AACjF,+EAA+E;AAC/E,4EAA4E;AAC5E,sDAAsD;AAEtD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAE/E,iEAAiE;AACjE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC1C,UAAU;IACV,MAAM;IACN,QAAQ;IACR,KAAK;IACL,MAAM;CACP,CAAC,CAAC;AAGH,sEAAsE;AACtE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAGzE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B;;;;;;OAMG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,0EAA0E;IAC1E,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;IACrD,mEAAmE;IACnE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAClE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;IAC1C,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;IAC7C,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAClE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CACnE,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,UAAU,EAAE,uBAAuB;IACnC,qEAAqE;IACrE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,QAAQ,EAAE,qBAAqB;IAC/B,UAAU,EAAE,uBAAuB;IACnC,gEAAgE;IAChE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAC9C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,yDAAyD;IACzD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B;;;;;;;;OAQG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACzC;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAC5C;;;;;;;OAOG;IACH,iBAAiB,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IACpD,4EAA4E;IAC5E,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,iFAAiF;IACjF,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,0EAA0E;IAC1E,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,+EAA+E;IAC/E,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACjD;;;;;OAKG;IACH,mBAAmB,EAAE,4BAA4B,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACnE,2LAA2L,CAC5L;CACF,CAAC,CAAC;AAYH,SAAS,oBAAoB,CAAC,IAAmC;IAC/D,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IACvC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO,UAAU,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvE,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,IAAI,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnD,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC;gBACxB,CAAC,CAAC,oCAAoC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;gBAC5D,CAAC,CAAC,kBAAkB,CAAC;QACzB,CAAC;QACD,OAAO,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7E,CAAC;IACD,OAAO,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AAC7D,CAAC;AAED,IAAI,uBAAsD,CAAC;AAE3D;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,0BAA0B;IACxC,IAAI,uBAAuB,KAAK,SAAS;QAAE,OAAO,uBAAuB,CAAC;IAC1E,MAAM,MAAM,GAAG,eAAe,CAAC,aAAa,EAAE;QAC5C,YAAY,EAAE,MAAM;QACpB,MAAM,EAAE,aAAa;KACtB,CAAsB,CAAC;IACxB,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;SAC3C,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC;SAC3C,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC;SACrB,IAAI,EAAE,CAAC;IACV,uBAAuB,GAAG;QACxB,iFAAiF;YAC/E,QAAQ;iBACL,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,oBAAoB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC;iBACpE,IAAI,CAAC,IAAI,CAAC;YACb,GAAG;QACL,gFAAgF;YAC9E,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YACtB,oEAAoE;KACvE,CAAC;IACF,OAAO,uBAAuB,CAAC;AACjC,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAChC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAChC,wEAAwE;IACxE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;IAChD,YAAY,EAAE,qBAAqB;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/B,gFAAgF;IAChF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAGH,+FAA+F;AAC/F,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QACX,0BAA0B;QAC1B,gBAAgB;QAChB,uBAAuB;KACxB,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAChC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;CAClC,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;IACnC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAoBH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACpD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC9B,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,mCAAmC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACrE,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D;;;;;;;OAOG;IACH,0BAA0B,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACxE,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACvC,MAAM,CAAC;IACN,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,OAAO,EAAE,0BAA0B;IACnC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IAChC,eAAe,EAAE,2BAA2B;IAC5C,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IACrC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAC9C;;;;OAIG;IACH,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IACvD,6EAA6E;IAC7E,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;SACzD,QAAQ,EAAE;IACb,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAC9C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,WAAW,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IAC/B,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC;IACrD,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QACpD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EACL,qEAAqE;SACxE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,WAAW,IAAI,EAAE,CAAC;QAChE,IACE,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;YACtC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,KAAK,UAAU,CAAC,WAAW,CAAC,CAAC,EACnE,CAAC;YACD,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,aAAa,EAAE,KAAK,EAAE,aAAa,CAAC;gBAC3C,OAAO,EACL,iFAAiF;aACpF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvE,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,aAAa,GAAG,MAAM,CAAC,eAAe,CAAC,gBAAgB;SAC1D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;SACtB,IAAI,EAAE,CAAC;IACV,MAAM,OAAO,GAAG,CAAC,IAAc,EAAE,KAAe,EAAW,EAAE,CAC3D,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAC5B,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC;QAC3E,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,iBAAiB,EAAE,YAAY,CAAC;YACvC,OAAO,EACL,iEAAiE;SACpE,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}

package/docs/audit-pkg/product.md

@@ -113,7 +113,5 @@ crossings, weak-packet gaps) is how extraction gaps are found and prioritized.
 ## Non-goals
 
 - repositioning the CLI as a peer product surface
-- making session config the normal way to redirect semantic review into a
-  second execution backend
 - making backend implementation details outrank the conversation contract
 - tying packetization quality to one programming language

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "audit-tools",
-  "version": "0.40.1",
+  "version": "0.41.1",
   "private": false,
   "license": "ISC",
   "description": "Provider-neutral code auditing and remediation workflows for arbitrary repositories.",