audit-tools 0.42.1 → 0.44.0

package/dist/remediate/steps/finalGate.js

@@ -1,13 +1,20 @@
 // ---------------------------------------------------------------------------
-// Tool-owned final completion gate (INV-RS-10) + coarse re-block (INV-RS-09)
+// Tool-owned final completion gate (INV-RS-10)
 // ---------------------------------------------------------------------------
 //
-// Behaviour-preserving extraction from `nextStep.ts` (CP-NODE-1): this is the
-// tool-owned final-gate cluster (the gate runner, its bounded coarse-reblock
-// backstop, and the sidecar counter I/O) lifted into a sibling leaf module so
-// the orchestrator god-module no longer owns it inline. `nextStep.ts` imports
-// and re-exports these symbols, so the public surface and existing test imports
-// are unchanged.
+// The gate runner and its red record. A whole-repo gate red is UNATTRIBUTABLE
+// by construction — nothing here computes which item or path caused it — so the
+// only honest response is to record what failed and PAUSE. It does not mutate
+// item statuses, does not move the run's phase, and does not close: a repeat
+// next-step re-runs the gate and proceeds the moment it is green, which makes
+// the pause resumable by construction rather than by a stored counter.
+//
+// This replaces a coarse backstop that re-opened EVERY non-skip item to
+// `pending` on a red and, after a bounded number of tries, abandoned the whole
+// run. It fired on 2026-08-20 against a suite reddened by an unrelated landed
+// commit and wiped 21 accepted resolutions out of state.json — the failure the
+// "Phase-boundary gate false abandonment" entry predicted, doing maximum damage
+// on a red that had nothing to do with the run.
 //
 // INV-RS-10: the final completion gate is a TOOL-OWNED, NON-VACUOUS suite that
 // is INDEPENDENT of any `plan.test_command`. A run can only land green when this
@@ -31,14 +38,28 @@
 // gate must converge deterministically, so they are surfaced for a separate
 // pass instead of being able to strand the run.
 import { join } from "node:path";
-import { readOptionalJsonFile, writeJsonFile, runTracked } from "audit-tools/shared";
-import { isSkipStatus } from "../state/itemStatus.js";
+import { writeJsonFile, runTracked } from "audit-tools/shared";
 import { isAuditToolsMonorepo, toolOwnedFinalGateCommands, } from "./gateCommands.js";
 // `FinalGateCommandSpec`, `isAuditToolsMonorepo`, and `toolOwnedFinalGateCommands`
 // are single-sourced in the leaf module `gateCommands.ts` (so `dispatch.ts` can
 // derive the same pinned merged-base check without an import cycle). Imported
 // here for local use and re-exported to preserve the public surface + test imports.
 export { isAuditToolsMonorepo, toolOwnedFinalGateCommands };
+/**
+ * How much of a failing command's output rides into the persisted record. TAIL,
+ * because a suite prints its verdict last, and BOUNDED because this lands in a
+ * durable artifact — the standing rule against multi-KB tool output riding into
+ * a prompt applies to what a prompt POINTS AT as well.
+ */
+const GATE_OUTPUT_TAIL_LIMIT = 4_000;
+function outputTail(value) {
+    const text = value ?? "";
+    if (text.length === 0)
+        return undefined;
+    return text.length <= GATE_OUTPUT_TAIL_LIMIT
+        ? text
+        : `…${text.slice(text.length - GATE_OUTPUT_TAIL_LIMIT)}`;
+}
 /**
  * Run the tool-owned final gate (INV-RS-10). Each command runs through the
  * shared `runTracked`, which scrubs CLAUDECODE / CLAUDE_CODE_*.
@@ -59,7 +80,16 @@ export async function runToolOwnedFinalGate(root, opts = {}) {
     if (commands.length === 0) {
         // Audit-tools-specific suite does not apply here — declared scope, not a
         // vacuous pass (it never substitutes for a real gate on the audit-tools repo).
-        return { passed: true, results: [], scoped_out: true, runtime_residual };
+        // `passed: true` keeps it NON-BLOCKING, which is the declared design; the
+        // `outcome` beside it is what stops that non-blocking value from being
+        // recorded as if a floor had run green.
+        return {
+            passed: true,
+            results: [],
+            outcome: "scoped_out",
+            scoped_out: true,
+            runtime_residual,
+        };
     }
     const runner = opts.runner ??
         ((argv, cwd, packageDir) => {
@@ -72,106 +102,110 @@ export async function runToolOwnedFinalGate(root, opts = {}) {
                 cwd: effectiveCwd,
                 stdio: ["ignore", "pipe", "pipe"],
             });
-            return { status: result.status };
+            // `runTracked` has always returned the captured streams; this used to read
+            // `status` alone and discard them, which is why a red gate persisted
+            // nothing an operator could read.
+            return {
+                status: result.status,
+                stdout: result.stdout,
+                stderr: result.stderr,
+            };
         });
     const results = [];
     let passed = true;
     for (const spec of commands) {
-        const { status } = runner(spec.argv, root, spec.package_dir);
+        const { status, stdout, stderr } = runner(spec.argv, root, spec.package_dir);
         const cmdPassed = status === 0;
+        const stdoutTail = cmdPassed ? undefined : outputTail(stdout);
+        const stderrTail = cmdPassed ? undefined : outputTail(stderr);
         results.push({
             argv: spec.argv,
             layer: spec.layer,
             ...(spec.package_dir ? { package_dir: spec.package_dir } : {}),
             exit_code: status,
             passed: cmdPassed,
+            ...(stdoutTail === undefined ? {} : { stdout_tail: stdoutTail }),
+            ...(stderrTail === undefined ? {} : { stderr_tail: stderrTail }),
         });
         if (!cmdPassed) {
             passed = false;
             break; // short-circuit: later layers are meaningless on a broken floor
         }
     }
-    return { passed, results, scoped_out: false, runtime_residual };
+    return {
+        passed,
+        results,
+        outcome: "executed",
+        scoped_out: false,
+        runtime_residual,
+    };
 }
+const FINAL_GATE_STATE_FILENAME = "final-gate.json";
+const FINAL_GATE_OUTCOME_FILENAME = "final-gate-outcome.json";
 /**
- * The bound on coarse re-block iterations before the run converges to a terminal
- * `blocked` close (CE-003). Two re-block attempts give a flaky-but-recoverable
- * suite a chance to settle; the third unattributable red terminates
- * deterministically rather than livelocking.
+ * Where the failing gate run is recorded, relative to the artifacts dir. The
+ * step prompt carries this PATH and the failing command line — never the tail
+ * itself, which is what keeps a multi-KB suite log out of the prompt while
+ * still leaving it one open away.
  */
-export const COARSE_REBLOCK_BOUND = 2;
-const FINAL_GATE_STATE_FILENAME = "final-gate.json";
-export async function readFinalGateSidecar(artifactsDir) {
-    const sidecar = await readOptionalJsonFile(join(artifactsDir, FINAL_GATE_STATE_FILENAME));
-    const n = sidecar?.coarse_reblock_count;
-    return {
-        count: typeof n === "number" && Number.isFinite(n) && n >= 0 ? n : 0,
-        terminated: sidecar?.terminated === true,
-    };
+export function finalGateRecordPath(artifactsDir) {
+    return join(artifactsDir, FINAL_GATE_STATE_FILENAME);
 }
-export async function writeFinalGateSidecar(artifactsDir, count, terminated) {
-    await writeJsonFile(join(artifactsDir, FINAL_GATE_STATE_FILENAME), {
-        schema_version: "remediate-code-final-gate/v1alpha1",
-        coarse_reblock_count: count,
-        terminated,
-    });
+/**
+ * Where the LAST gate evaluation's outcome is recorded, relative to the
+ * artifacts dir. Distinct from {@link finalGateRecordPath}, which only exists
+ * when a gate ran and went RED: this one is written on EVERY evaluation,
+ * including the two that run nothing.
+ */
+export function finalGateOutcomePath(artifactsDir) {
+    return join(artifactsDir, FINAL_GATE_OUTCOME_FILENAME);
 }
 /**
- * Coarse re-block-ALL-non-terminal on an unattributable final-gate red
- * (INV-RS-09) with a bounded, monotonic auto-terminate (CE-003).
- *
- * The tool-owned gate is whole-repo, so a red is inherently unattributable to a
- * single node. Below the bound, EVERY non-skip item (including `resolved` ones —
- * a resolved item's own change may have caused the red) is re-opened to `pending`
- * and the run re-attempts the whole repo through the rolling scheduler
- * (`reattempt_all` → `implementing`). At or above the bound, the run STOPS
- * re-attempting and converges DETERMINISTICALLY: every non-skip item becomes
- * terminal `blocked` and the run advances to `closing`.
+ * Record what a gate evaluation was. Overwrites: the file describes the CURRENT
+ * gate state of the run, the same way {@link writeFinalGateRedRecord} does for a
+ * red, and a repeat next-step re-evaluates rather than accumulating a history
+ * nothing reads.
  *
- * CE-003 no-human-host guarantee: the loop is owned entirely by the gate + the
- * rolling scheduler — it NEVER routes through the human triage prompt
- * (`waiting_for_triage`) and is bounded by `bound`, so a permanently-red sibling
- * converges to a terminal `blocked` close deterministically: never livelocking,
- * never stranding on a human prompt, and never force-closed to green (a RED gate
- * always leaves `blocked` items, so close.ts's `!anyBlocked` guard keeps the run
- * out of the fully-green path). User SKIP dispositions (ignored /
- * deemed_inappropriate) are settled decisions and are left alone. Pure (the
- * counter is supplied / returned).
+ * The `passed: null` normalization lives HERE rather than at each call site:
+ * a caller cannot record a not-run gate as a pass even by passing `true`.
  */
-export function applyCoarseReblock(state, currentCount, gateSummary, bound = COARSE_REBLOCK_BOUND) {
-    const now = new Date().toISOString();
-    if (currentCount >= bound) {
-        // Bounded auto-terminate: converge DETERMINISTICALLY to a terminal close for a
-        // no-human host — never livelock, never a triage prompt, never green.
-        //
-        // `abandoned`, NOT `blocked`: this is the force-close seam, and `blocked` is
-        // deliberately non-terminal (triage retries it). Leaving items non-terminal here
-        // meant the run ended with items that had reached no end state, which the close
-        // phase then rendered as a partial-completion outcome — breaking the invariant
-        // that remediation ends binary. `abandoned` is terminal and says which way it
-        // ended: the tool gave up, as distinct from a settled decision not to act.
-        for (const it of Object.values(state.items ?? {})) {
-            if (isSkipStatus(it.status))
-                continue; // settled user decision — never overturn
-            it.status = "abandoned";
-            it.started_at ??= now;
-            it.completed_at = now;
-            it.failure_reason =
-                `Tool-owned final gate failed and the coarse re-block backstop reached its ` +
-                    `bound (${bound}); abandoning the remaining items (no-human host). ${gateSummary}`;
-        }
-        return { state, action: "terminal_blocked", next_count: currentCount };
-    }
-    // Below the bound: re-open every non-skip item to `pending` and re-attempt the
-    // whole repo via the rolling scheduler (NOT the human triage prompt).
-    for (const it of Object.values(state.items ?? {})) {
-        if (isSkipStatus(it.status))
-            continue;
-        it.status = "pending";
-        it.failure_context =
-            `Re-attempted by the coarse final-gate backstop (unattributable whole-repo red). ${gateSummary}`;
-        delete it.completed_at;
-    }
-    return { state, action: "reattempt_all", next_count: currentCount + 1 };
+export async function writeFinalGateOutcomeRecord(artifactsDir, outcome) {
+    const path = finalGateOutcomePath(artifactsDir);
+    const ran = outcome.outcome === "executed";
+    const record = {
+        schema_version: "remediate-code-final-gate-outcome/v1alpha1",
+        scope: outcome.scope,
+        outcome: outcome.outcome,
+        passed: ran ? outcome.passed : null,
+        commands_run: ran ? outcome.commands_run : 0,
+        ...(outcome.reason === undefined ? {} : { reason: outcome.reason }),
+        recorded_at: new Date().toISOString(),
+    };
+    await writeJsonFile(path, record);
+    return path;
+}
+/**
+ * Record the failing command of a red gate run. Overwrites: the file describes
+ * the CURRENT reason the run is paused, and a repeat next-step that still finds
+ * the suite red rewrites it rather than accumulating a history nothing reads.
+ */
+export async function writeFinalGateRedRecord(artifactsDir, scope, failed) {
+    const path = finalGateRecordPath(artifactsDir);
+    const record = {
+        schema_version: "remediate-code-final-gate/v1alpha1",
+        scope,
+        recorded_at: new Date().toISOString(),
+        failing_command: failed ? failed.argv.join(" ") : "(command not reported)",
+        exit_code: failed?.exit_code ?? null,
+        layer: failed?.layer ?? null,
+        ...(failed?.stdout_tail === undefined
+            ? {}
+            : { stdout_tail: failed.stdout_tail }),
+        ...(failed?.stderr_tail === undefined
+            ? {}
+            : { stderr_tail: failed.stderr_tail }),
+    };
+    await writeJsonFile(path, record);
+    return path;
 }
 //# sourceMappingURL=finalGate.js.map

package/dist/remediate/steps/finalGate.js.map

@@ -1 +1 @@
-{"version":3,"file":"finalGate.js","sourceRoot":"","sources":["../../../src/remediate/steps/finalGate.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,EAAE;AACF,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,iBAAiB;AACjB,EAAE;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,iFAAiF;AACjF,6EAA6E;AAC7E,qEAAqE;AACrE,kCAAkC;AAClC,EAAE;AACF,oFAAoF;AACpF,oFAAoF;AACpF,mEAAmE;AACnE,iFAAiF;AACjF,+BAA+B;AAC/B,sGAAsG;AACtG,0CAA0C;AAC1C,EAAE;AACF,oEAAoE;AACpE,+EAA+E;AAC/E,+EAA+E;AAC/E,iFAAiF;AACjF,4EAA4E;AAC5E,gDAAgD;AAEhD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErF,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EACL,oBAAoB,EACpB,0BAA0B,GAE3B,MAAM,mBAAmB,CAAC;AAE3B,mFAAmF;AACnF,gFAAgF;AAChF,8EAA8E;AAC9E,oFAAoF;AACpF,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,CAAC;AAoC5D;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAY,EACZ,OAAgC,EAAE;IAElC,MAAM,gBAAgB,GAAG;QACvB,OAAO,EAAE,8CAA8C;QACvD,QAAQ,EAAE;YACR,mCAAmC;YACnC,uCAAuC;SACxC;KACF,CAAC;IAEF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,yEAAyE;QACzE,+EAA+E;QAC/E,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,MAAM,GACV,IAAI,CAAC,MAAM;QACX,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE;YACzB,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;YAChC,4EAA4E;YAC5E,2DAA2D;YAC3D,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAC/D,4DAA4D;YAC5D,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,EAAE;gBAC5C,GAAG,EAAE,YAAY;gBACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QACnC,CAAC,CAAC,CAAC;IAEL,MAAM,OAAO,GAA6B,EAAE,CAAC;IAC7C,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,GAAG,KAAK,CAAC;YACf,MAAM,CAAC,gEAAgE;QACzE,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAEtC,MAAM,yBAAyB,GAAG,iBAAiB,CAAC;AAQpD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB;IAEpB,MAAM,OAAO,GAAG,MAAM,oBAAoB,CACxC,IAAI,CAAC,YAAY,EAAE,yBAAyB,CAAC,CAC9C,CAAC;IACF,MAAM,CAAC,GAAG,OAAO,EAAE,oBAAoB,CAAC;IACxC,OAAO;QACL,KAAK,EAAE,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,UAAU,EAAE,OAAO,EAAE,UAAU,KAAK,IAAI;KACzC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,YAAoB,EACpB,KAAa,EACb,UAAmB;IAEnB,MAAM,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,yBAAyB,CAAC,EAAE;QACjE,cAAc,EAAE,oCAAoC;QACpD,oBAAoB,EAAE,KAAK;QAC3B,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AAUD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAuB,EACvB,YAAoB,EACpB,WAAmB,EACnB,QAAgB,oBAAoB;IAEpC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAErC,IAAI,YAAY,IAAI,KAAK,EAAE,CAAC;QAC1B,+EAA+E;QAC/E,sEAAsE;QACtE,EAAE;QACF,6EAA6E;QAC7E,iFAAiF;QACjF,gFAAgF;QAChF,+EAA+E;QAC/E,8EAA8E;QAC9E,2EAA2E;QAC3E,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;YAClD,IAAI,YAAY,CAAC,EAAE,CAAC,MAAM,CAAC;gBAAE,SAAS,CAAC,yCAAyC;YAChF,EAAE,CAAC,MAAM,GAAG,WAAW,CAAC;YACxB,EAAE,CAAC,UAAU,KAAK,GAAG,CAAC;YACtB,EAAE,CAAC,YAAY,GAAG,GAAG,CAAC;YACtB,EAAE,CAAC,cAAc;gBACf,4EAA4E;oBAC5E,UAAU,KAAK,sDAAsD,WAAW,EAAE,CAAC;QACvF,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;IACzE,CAAC;IAED,+EAA+E;IAC/E,sEAAsE;IACtE,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;QAClD,IAAI,YAAY,CAAC,EAAE,CAAC,MAAM,CAAC;YAAE,SAAS;QACtC,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC;QACtB,EAAE,CAAC,eAAe;YAChB,mFAAmF,WAAW,EAAE,CAAC;QACnG,OAAO,EAAE,CAAC,YAAY,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,GAAG,CAAC,EAAE,CAAC;AAC1E,CAAC"}
+{"version":3,"file":"finalGate.js","sourceRoot":"","sources":["../../../src/remediate/steps/finalGate.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,+CAA+C;AAC/C,8EAA8E;AAC9E,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,uEAAuE;AACvE,EAAE;AACF,wEAAwE;AACxE,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,gFAAgF;AAChF,gDAAgD;AAChD,EAAE;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,iFAAiF;AACjF,6EAA6E;AAC7E,qEAAqE;AACrE,kCAAkC;AAClC,EAAE;AACF,oFAAoF;AACpF,oFAAoF;AACpF,mEAAmE;AACnE,iFAAiF;AACjF,+BAA+B;AAC/B,sGAAsG;AACtG,0CAA0C;AAC1C,EAAE;AACF,oEAAoE;AACpE,+EAA+E;AAC/E,+EAA+E;AAC/E,iFAAiF;AACjF,4EAA4E;AAC5E,gDAAgD;AAEhD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAK/D,OAAO,EACL,oBAAoB,EACpB,0BAA0B,GAE3B,MAAM,mBAAmB,CAAC;AAE3B,mFAAmF;AACnF,gFAAgF;AAChF,8EAA8E;AAC9E,oFAAoF;AACpF,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,CAAC;AA0F5D;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAErC,SAAS,UAAU,CAAC,KAAyB;IAC3C,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;IACzB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,OAAO,IAAI,CAAC,MAAM,IAAI,sBAAsB;QAC1C,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,sBAAsB,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAY,EACZ,OAAgC,EAAE;IAElC,MAAM,gBAAgB,GAAG;QACvB,OAAO,EAAE,8CAA8C;QACvD,QAAQ,EAAE;YACR,mCAAmC;YACnC,uCAAuC;SACxC;KACF,CAAC;IAEF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,yEAAyE;QACzE,+EAA+E;QAC/E,0EAA0E;QAC1E,uEAAuE;QACvE,wCAAwC;QACxC,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,YAAY;YACrB,UAAU,EAAE,IAAI;YAChB,gBAAgB;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,IAAI,CAAC,MAAM;QACX,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE;YACzB,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;YAChC,4EAA4E;YAC5E,2DAA2D;YAC3D,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAC/D,4DAA4D;YAC5D,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,EAAE;gBAC5C,GAAG,EAAE,YAAY;gBACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAC;YACH,2EAA2E;YAC3E,qEAAqE;YACrE,kCAAkC;YAClC,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC;QACJ,CAAC,CAAC,CAAC;IAEL,MAAM,OAAO,GAA6B,EAAE,CAAC;IAC7C,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC7E,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,CAAC;QAC/B,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,SAAS;YACjB,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;YAChE,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;SACjE,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,GAAG,KAAK,CAAC;YACf,MAAM,CAAC,gEAAgE;QACzE,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM;QACN,OAAO;QACP,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,KAAK;QACjB,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,yBAAyB,GAAG,iBAAiB,CAAC;AACpD,MAAM,2BAA2B,GAAG,yBAAyB,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,YAAoB;IACtD,OAAO,IAAI,CAAC,YAAY,EAAE,yBAAyB,CAAC,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,OAAO,IAAI,CAAC,YAAY,EAAE,2BAA2B,CAAC,CAAC;AACzD,CAAC;AA8BD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,YAAoB,EACpB,OAMC;IAED,MAAM,IAAI,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,KAAK,UAAU,CAAC;IAC3C,MAAM,MAAM,GAA2B;QACrC,cAAc,EAAE,4CAA4C;QAC5D,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QACnC,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC5C,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACnE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;IACF,MAAM,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC;AAyBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,YAAoB,EACpB,KAAa,EACb,MAA0C;IAE1C,MAAM,IAAI,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAuB;QACjC,cAAc,EAAE,oCAAoC;QACpD,KAAK;QACL,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,wBAAwB;QAC1E,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,IAAI;QACpC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,IAAI;QAC5B,GAAG,CAAC,MAAM,EAAE,WAAW,KAAK,SAAS;YACnC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;QACxC,GAAG,CAAC,MAAM,EAAE,WAAW,KAAK,SAAS;YACnC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;KACzC,CAAC;IACF,MAAM,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/remediate/steps/gateCommands.d.ts

@@ -14,6 +14,14 @@ export interface FinalGateCommandSpec {
  * commands) applies to. The gate's command list is audit-tools-specific by
  * design (this remediation run remediates the audit-tools monorepo), so it is
  * scoped to that structure rather than fabricated for an arbitrary target repo.
+ *
+ * The predicate checks every marker AND the script the gate will actually spawn.
+ * Checking only the layout markers made applicability a COINCIDENCE: a tree with
+ * the five markers but no gate script would be judged in-scope, then run
+ * `node <missing path>`, exit 1, and report a whole-repo RED on a healthy repo —
+ * precisely the false-red class this gate's pause design exists to avoid, and
+ * reachable because a five-marker tree is easy to construct (a test fixture is
+ * one). A tree that cannot run the suite is OUT of scope, not failing it.
  */
 export declare function isAuditToolsMonorepo(root: string): boolean;
 /**

package/dist/remediate/steps/gateCommands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gateCommands.d.ts","sourceRoot":"","sources":["../../../src/remediate/steps/gateCommands.ts"],"names":[],"mappings":"AAYA,gDAAgD;AAChD,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,mFAAmF;IACnF,UAAU,EAAE,OAAO,CAAC;IACpB,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,KAAK,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;CACnC;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAU1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,EAAE,CAmC/E"}
+{"version":3,"file":"gateCommands.d.ts","sourceRoot":"","sources":["../../../src/remediate/steps/gateCommands.ts"],"names":[],"mappings":"AAYA,gDAAgD;AAChD,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,mFAAmF;IACnF,UAAU,EAAE,OAAO,CAAC;IACpB,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,KAAK,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;CACnC;AASD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAW1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,EAAE,CAiD/E"}

package/dist/remediate/steps/gateCommands.js

@@ -1,11 +1,25 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
+/**
+ * The vitest gate script the unit leg executes, repo-relative. Named once and
+ * used by BOTH the scoping predicate and the command list, so the file the
+ * predicate checks for is provably the file the gate runs.
+ */
+const VITEST_GATE_SCRIPT = join("scripts", "shared", "run-vitest-gate.mjs");
 /**
  * Whether `root` is the audit-tools monorepo — the repo the tool-owned final
  * gate's suite (INV-RS-10, literally the audit-tools build/check/per-package
  * commands) applies to. The gate's command list is audit-tools-specific by
  * design (this remediation run remediates the audit-tools monorepo), so it is
  * scoped to that structure rather than fabricated for an arbitrary target repo.
+ *
+ * The predicate checks every marker AND the script the gate will actually spawn.
+ * Checking only the layout markers made applicability a COINCIDENCE: a tree with
+ * the five markers but no gate script would be judged in-scope, then run
+ * `node <missing path>`, exit 1, and report a whole-repo RED on a healthy repo —
+ * precisely the false-red class this gate's pause design exists to avoid, and
+ * reachable because a five-marker tree is easy to construct (a test fixture is
+ * one). A tree that cannot run the suite is OUT of scope, not failing it.
  */
 export function isAuditToolsMonorepo(root) {
     // Single-package layout: the three subsystems are inlined under src/ and both
@@ -14,7 +28,8 @@ export function isAuditToolsMonorepo(root) {
         existsSync(join(root, "src", "audit")) &&
         existsSync(join(root, "src", "remediate")) &&
         existsSync(join(root, "audit-code.mjs")) &&
-        existsSync(join(root, "remediate-code.mjs")));
+        existsSync(join(root, "remediate-code.mjs")) &&
+        existsSync(join(root, VITEST_GATE_SCRIPT)));
 }
 /**
  * The tool-owned final-gate command list (INV-RS-10) for the audit-tools
@@ -46,17 +61,31 @@ export function toolOwnedFinalGateCommands(root) {
         // FAIL on the current tree (the .test.mjs files use vitest globals, not node:test).
         //
         // `--retry=2` is FLAKE-TOLERANCE, not flake-masking: the tool-owned gate is a
-        // ROBUSTNESS check (did the remediation's edits break the repo?), and its red is
-        // COARSE-REBLOCK-ALL (INV-RS-09) — a single transient timing flake in the target
-        // suite (e.g. a rolling-dispatch "expected 1 to be 2" race under full parallel
-        // load) otherwise reopens EVERY item to pending and, on a second flake, terminal-
-        // blocks the whole run (CE-003 bound 2) with zero fixes landed — the exact failure
-        // this scoping is closing. A genuinely-broken test still fails all retries → red →
-        // reblock; only a test that PASSES on retry (i.e. was flaky, not broken) is spared.
-        // Gate-scoped ON PURPOSE (never vitest.config `retry`, which would mask flakes in
-        // CI / `npm test` where surfacing them is the point).
+        // ROBUSTNESS check (did the remediation's edits break the repo?), and a red
+        // HALTS the run — it pauses at the boundary until a human makes the suite
+        // green. A single transient timing flake in the target suite (e.g. a
+        // rolling-dispatch "expected 1 to be 2" race under full parallel load) would
+        // otherwise stop a healthy run and demand attention for a failure that does
+        // not reproduce. A genuinely-broken test still fails all retries → red →
+        // pause; only a test that PASSES on retry (i.e. was flaky, not broken) is
+        // spared. Gate-scoped ON PURPOSE (never vitest.config `retry`, which would
+        // mask flakes in CI / `npm test` where surfacing them is the point).
+        //
+        // Routed through `run-vitest-gate.mjs`, never a bare `npx vitest run`: a raw
+        // vitest exit code is not a verdict in this repo. It has exited 0 while
+        // reporting failures (the false-green defect) and exits 1 with ZERO failures
+        // under worker-RPC starvation (the false-RED one) — and a false RED here is
+        // not cosmetic, it is a whole-repo gate red on a healthy tree. The script
+        // decides from the token-bound outcome ledger the reporter writes and fails
+        // closed when it cannot prove the ledger belongs to this run, so its exit IS
+        // trustworthy. Declared here rather than rewritten at execution time so the
+        // command that is declared and the command that runs stay the same string.
         {
-            argv: ["npx", "vitest", "run", "--retry=2"],
+            // Forward slashes: this is an argv token handed to a shell, not a path
+            // joined against the filesystem, and both platforms accept `/` here. The
+            // predicate above checks the same file through `join`, which is the
+            // platform-correct form for an existence test.
+            argv: ["node", "scripts/shared/run-vitest-gate.mjs", "--retry=2"],
             build_free: true,
             layer: "unit",
         },

package/dist/remediate/steps/gateCommands.js.map

@@ -1 +1 @@
-{"version":3,"file":"gateCommands.js","sourceRoot":"","sources":["../../../src/remediate/steps/gateCommands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAsBjC;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,8EAA8E;IAC9E,iFAAiF;IACjF,OAAO,CACL,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACvC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACtC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAC1C,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QACxC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAC7C,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACrD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3C,OAAO;QACL,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE;QACpE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE;QACnE,uEAAuE;QACvE,4EAA4E;QAC5E,6EAA6E;QAC7E,wEAAwE;QACxE,uEAAuE;QACvE,8BAA8B;QAC9B,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE;QACzE,8EAA8E;QAC9E,gFAAgF;QAChF,gFAAgF;QAChF,gFAAgF;QAChF,+EAA+E;QAC/E,oFAAoF;QACpF,EAAE;QACF,8EAA8E;QAC9E,iFAAiF;QACjF,iFAAiF;QACjF,+EAA+E;QAC/E,kFAAkF;QAClF,mFAAmF;QACnF,mFAAmF;QACnF,oFAAoF;QACpF,kFAAkF;QAClF,sDAAsD;QACtD;YACE,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,CAAC;YAC3C,UAAU,EAAE,IAAI;YAChB,KAAK,EAAE,MAAM;SACd;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"gateCommands.js","sourceRoot":"","sources":["../../../src/remediate/steps/gateCommands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAsBjC;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CAAC;AAE5E;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,8EAA8E;IAC9E,iFAAiF;IACjF,OAAO,CACL,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACvC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACtC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAC1C,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QACxC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;QAC5C,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACrD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3C,OAAO;QACL,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE;QACpE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE;QACnE,uEAAuE;QACvE,4EAA4E;QAC5E,6EAA6E;QAC7E,wEAAwE;QACxE,uEAAuE;QACvE,8BAA8B;QAC9B,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE;QACzE,8EAA8E;QAC9E,gFAAgF;QAChF,gFAAgF;QAChF,gFAAgF;QAChF,+EAA+E;QAC/E,oFAAoF;QACpF,EAAE;QACF,8EAA8E;QAC9E,4EAA4E;QAC5E,0EAA0E;QAC1E,qEAAqE;QACrE,6EAA6E;QAC7E,4EAA4E;QAC5E,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,qEAAqE;QACrE,EAAE;QACF,6EAA6E;QAC7E,wEAAwE;QACxE,6EAA6E;QAC7E,4EAA4E;QAC5E,0EAA0E;QAC1E,4EAA4E;QAC5E,6EAA6E;QAC7E,4EAA4E;QAC5E,2EAA2E;QAC3E;YACE,uEAAuE;YACvE,yEAAyE;YACzE,oEAAoE;YACpE,+CAA+C;YAC/C,IAAI,EAAE,CAAC,MAAM,EAAE,oCAAoC,EAAE,WAAW,CAAC;YACjE,UAAU,EAAE,IAAI;YAChB,KAAK,EAAE,MAAM;SACd;KACF,CAAC;AACJ,CAAC"}

package/dist/remediate/steps/nextStep.d.ts

@@ -1,6 +1,7 @@
 import { type RemediationState } from "../state/store.js";
-import { type FrictionTriageDecision, type InterpretedIntent } from "audit-tools/shared";
-import { hostDependencyLevels } from "./dispatch/hostHandoff.js";
+import type { Finding } from "../state/types.js";
+import { RunLogger, type FrictionTriageDecision, type InterpretedIntent } from "audit-tools/shared";
+import { hostDependencyLevels, type RemediationHostIngestSummary } from "./dispatch/hostHandoff.js";
 import type { RemediationStep } from "./types.js";
 import { isTerminalStatus, isVerifiedCompleteStatus } from "../state/itemStatus.js";
 import { type GateRunner } from "./finalGate.js";
@@ -36,6 +37,27 @@ export interface NextStepOptions {
      */
     finalGateRunner?: GateRunner;
 }
+/**
+ * Where an autonomous run's LEFTOVER deliverable pair lands.
+ *
+ * REMEDIATION-OWNED, deliberately. This module used to write the canonical
+ * `.audit-tools/audit-findings.json` + `audit-report.md` pair directly and
+ * unarchived, which destroys the audit source `defaultInputCandidates` resolves
+ * FIRST — the original contract becomes unrecoverable for any external consumer
+ * (INV-RNF-NO-CANONICAL-PAIR-WRITE). The canonical pair belongs to
+ * audit-artifact-promotion-lifecycle, whose exported write-with-archive is the
+ * only sanctioned way to replace it.
+ */
+export declare function autonomousLeftoverFindingsPath(root: string): string;
+export declare function autonomousLeftoverReportPath(root: string): string;
+/**
+ * The intake sources a bare `next-step` discovers, IN PRIORITY ORDER — index 0
+ * wins. Exported so the ordering can be asserted by CALLING it: the property
+ * that matters ("a real audit always beats this run's own leftovers") is a fact
+ * about the returned array, and a test that reads it out of the source text is
+ * asserting the prose, not the order.
+ */
+export declare function defaultInputCandidates(root: string): string[];
 export type { FindingRiskTier, FindingClassification, } from "./stepUtils.js";
 export { dependencyVerifiedComplete, classifyFindingRisk, } from "./stepUtils.js";
 export { isTerminalStatus, isVerifiedCompleteStatus };
@@ -60,8 +82,77 @@ export { hostDependencyLevels };
  * checkpoint for the last/only phase.
  */
 export declare function phaseBoundaryToGate(state: RemediationState): number | null;
-export { isAuditToolsMonorepo, toolOwnedFinalGateCommands, runToolOwnedFinalGate, applyCoarseReblock, COARSE_REBLOCK_BOUND, } from "./finalGate.js";
-export type { FinalGateCommandSpec, FinalGateCommandResult, ToolOwnedFinalGateResult, GateRunner, CoarseReblockAction, CoarseReblockDecision, } from "./finalGate.js";
+export { isAuditToolsMonorepo, toolOwnedFinalGateCommands, runToolOwnedFinalGate, finalGateOutcomePath, writeFinalGateOutcomeRecord, } from "./finalGate.js";
+export type { FinalGateCommandSpec, FinalGateCommandResult, ToolOwnedFinalGateResult, FinalGateOutcomeKind, FinalGateOutcomeRecord, GateRunner, } from "./finalGate.js";
+/**
+ * The re-plan carry-forward identity of a finding: canonical JSON with the
+ * plan-time bookkeeping keys stripped, so a re-plan whose only delta is a
+ * recomputed file hash or a re-evaluated grounding flag carries the prior item
+ * (and its `item_spec`) forward, while a real change to the finding does not.
+ *
+ * EXPORTED so the invariant suite can call THIS function. It was module-internal,
+ * and the suite claiming to cover the invariant declared its own copy of the key
+ * set, the strip and the key builder — so dropping `evidence_grounded` from the
+ * production set, or widening it with a real field like `severity`, left the
+ * block green while carry-forward regressed. A test asserting against its own
+ * re-implementation pins nothing about shipped behaviour.
+ */
+export declare function findingCarryForwardKey(finding: Finding): string;
+/**
+ * The `recover-ingest` verb's whole body: ingest the host's landed results in
+ * RECOVERY mode and persist through the same file-locked, atomically-writing
+ * store, with the same `contract_version` strip.
+ *
+ * It is a separate verb rather than a flag on `next-step` because the
+ * relaxation it enables must be an operator's explicit act — see
+ * `ingestRemediationHostResults`, which states what is waived and the residual
+ * risk. Nothing else here differs from the normal ingestion: the same workload,
+ * the same contract gates, the same eligibility frontier.
+ *
+ * ## Why this runs in two phases
+ *
+ * A required-test rerun is `spawnSync`, which blocks the event loop for its
+ * whole duration. Run inside the state lock, it would starve the lock's own
+ * heartbeat timer (`setInterval` in the shared fileLock) — the held lock's mtime
+ * would stop being refreshed, a second acquirer would classify it as stale at
+ * ~30s and steal it, and mutual exclusion would be gone precisely during the
+ * longest critical section in the codebase. Holding a lock across a blocking
+ * spawn is therefore not merely slow; it is unsound.
+ *
+ * So:
+ *
+ * - **Phase 1, UNLOCKED.** Snapshot the state, capture HEAD, and run every
+ *   distinct required-test command exactly once
+ *   (`precomputeRecoveryTestVerdicts`). HEAD is captured BEFORE the spawns, not
+ *   after, because a host-authored command that MOVES HEAD would otherwise
+ *   produce verdicts of mixed provenance and go undetected. (The guard compares
+ *   commit shas: it sees HEAD movement, not worktree dirt — a command that only
+ *   dirties files is invisible to it, which is acceptable because phase 2's
+ *   corroboration is commit-based.)
+ * - **Phase 2, LOCKED.** Re-read HEAD and abort the whole recovery if it moved
+ *   (`tree_moved_between_phases`) — the phase-1 verdicts would describe a tree
+ *   that no longer exists, and nothing is accepted or appended. Otherwise ingest
+ *   with the pre-computed verdicts, which the ingest only READS: in recovery
+ *   mode it never spawns, and a command missing from the table fails closed.
+ *
+ * What remains inside the lock is git plumbing (ancestry, ref scan, diff-tree),
+ * the ledger append, and the state write — sub-second work, comfortably inside
+ * heartbeat coverage. The HEAD-unchanged guard closes the gap the phase split
+ * opens; the operational protocol is still one writer at a time, now enforced by
+ * a lock that cannot be stolen mid-hold instead of by convention.
+ *
+ * One accepted cost: `StateStore.mutate` always writes, so a recovery run that
+ * changes nothing rewrites `state.json` with identical content. Expressing a
+ * true no-op means plumbing the locked store's `SKIP_WRITE` sentinel through
+ * `StateStore.mutate`, which is a change to the store's API rather than to this
+ * verb. The `state_changed` flag on the returned summary stays authoritative
+ * for callers either way.
+ */
+export declare function recoverIngestHostResults(options: {
+    readonly root: string;
+    readonly artifactsDir: string;
+    readonly runId: string;
+}): Promise<RemediationHostIngestSummary>;
 /**
  * The terminal friction-TRIAGE close-out for the remediate half. Thin delegation to
  * the single-sourced `decideFrictionTriage` (`audit-tools/shared`) — the exact analog
@@ -98,5 +189,5 @@ export interface PersistedIntentInterpretation {
  * throws into the decide loop. The raw `free_form_intent` string is NOT returned
  * or threaded anywhere — only the structured `InterpretedIntent` is (INV-S04).
  */
-export declare function interpretConfirmedCheckpointIntent(artifactsDir: string, checkpoint: IntentCheckpoint | undefined): Promise<PersistedIntentInterpretation | null>;
+export declare function interpretConfirmedCheckpointIntent(artifactsDir: string, checkpoint: IntentCheckpoint | undefined, runLogger?: RunLogger): Promise<PersistedIntentInterpretation | null>;
 //# sourceMappingURL=nextStep.d.ts.map

package/dist/remediate/steps/nextStep.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nextStep.d.ts","sourceRoot":"","sources":["../../../src/remediate/steps/nextStep.ts"],"names":[],"mappings":"AAIA,OAAO,EAAc,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAStE,OAAO,EAuBL,KAAK,sBAAsB,EAG3B,KAAK,iBAAiB,EAEvB,MAAM,oBAAoB,CAAC;AAa5B,OAAO,EAEL,oBAAoB,EAGrB,MAAM,2BAA2B,CAAC;AAkBnC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAKlD,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACzB,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EAKL,KAAK,UAAU,EAChB,MAAM,gBAAgB,CAAC;AAyCxB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAoB3D,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,UAAU,CAAC;CAC9B;AA6KD,YAAY,EACV,eAAe,EACf,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,CAAC;AAmEhC;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAa1E;AAYD,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,EACxB,UAAU,EACV,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AAgexB;;;;;;;;;;GAUG;AACH,wBAAsB,+BAA+B,CACnD,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAC7B,OAAO,CAAC,sBAAsB,CAAC,CAEjC;AA4yDD,wBAAsB,cAAc,CAClC,OAAO,GAAE,eAAe,GAAG,MAAW,GACrC,OAAO,CAAC,eAAe,CAAC,CAmC1B;AA6OD,uFAAuF;AACvF,eAAO,MAAM,8BAA8B,+BAA+B,CAAC;AAC3E,eAAO,MAAM,oCAAoC,kDACA,CAAC;AAElD,MAAM,WAAW,6BAA6B;IAC5C,cAAc,EAAE,OAAO,oCAAoC,CAAC;IAC5D,6EAA6E;IAC7E,WAAW,EAAE,iBAAiB,CAAC;IAC/B;;;;OAIG;IACH,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAsB,kCAAkC,CACtD,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,gBAAgB,GAAG,SAAS,GACvC,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC,CA6B/C"}
+{"version":3,"file":"nextStep.d.ts","sourceRoot":"","sources":["../../../src/remediate/steps/nextStep.ts"],"names":[],"mappings":"AAIA,OAAO,EAAc,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,KAAK,EAEV,OAAO,EAIR,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAUL,SAAS,EAaT,KAAK,sBAAsB,EAG3B,KAAK,iBAAiB,EAEvB,MAAM,oBAAoB,CAAC;AAa5B,OAAO,EAEL,oBAAoB,EAIpB,KAAK,4BAA4B,EAClC,MAAM,2BAA2B,CAAC;AAiBnC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAKlD,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACzB,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAKL,KAAK,UAAU,EAEhB,MAAM,gBAAgB,CAAC;AAyCxB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAoB3D,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,UAAU,CAAC;CAC9B;AAwCD;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAsB7D;AAsHD,YAAY,EACV,eAAe,EACf,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,CAAC;AAmEhC;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAa1E;AAWD,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,UAAU,GACX,MAAM,gBAAgB,CAAC;AA+KxB;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAE/D;AAwKD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAAE;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAwExC;AA0LD;;;;;;;;;;GAUG;AACH,wBAAsB,+BAA+B,CACnD,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAC7B,OAAO,CAAC,sBAAsB,CAAC,CAEjC;AA+nED,wBAAsB,cAAc,CAClC,OAAO,GAAE,eAAe,GAAG,MAAW,GACrC,OAAO,CAAC,eAAe,CAAC,CAmC1B;AA6OD,uFAAuF;AACvF,eAAO,MAAM,8BAA8B,+BAA+B,CAAC;AAC3E,eAAO,MAAM,oCAAoC,kDACA,CAAC;AAElD,MAAM,WAAW,6BAA6B;IAC5C,cAAc,EAAE,OAAO,oCAAoC,CAAC;IAC5D,6EAA6E;IAC7E,WAAW,EAAE,iBAAiB,CAAC;IAC/B;;;;OAIG;IACH,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAsB,kCAAkC,CACtD,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,gBAAgB,GAAG,SAAS,EAIxC,SAAS,CAAC,EAAE,SAAS,GACpB,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC,CAqC/C"}