audit-tools 0.44.0 → 0.45.0

package/docs/audit-pkg/operator-guide.md

@@ -67,6 +67,7 @@ audit-code validate-results
 audit-code requeue
 audit-code synthesize
 audit-code resynthesize
+audit-code unaccept-results --work-item <id>   # repeatable, or --all
 audit-code cleanup --dry-run
 ```
 
@@ -75,6 +76,13 @@ Lower-level `intake`, `plan`, `ingest-results`,
 debugging and artifact recovery. Normal conversation use should stay on
 `next-step`.
 
+`audit-code unaccept-results` removes entries from the run's accepted
+host-results pair — the supported way back out of an acceptance that turned out
+bad (for example a result accepted before a validator change). It refuses a
+pair it cannot validate, records each removal so a repaired run stays
+distinguishable from a clean one, invalidates the persisted step contract, and
+the next `next-step` re-reads the bound result files for the dropped items.
+
 `audit-code cleanup` removes `.audit-tools/audit/` only when the persisted run
 is complete or not started. Active, blocked, or missing-state runs are refused
 unless the operator explicitly supplies `--force`; `--dry-run` previews the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "audit-tools",
-  "version": "0.44.0",
+  "version": "0.45.0",
   "private": false,
   "license": "ISC",
   "description": "Provider-neutral code auditing and remediation workflows for arbitrary repositories.",

package/schemas/audit_result.schema.json

@@ -101,7 +101,7 @@
               "config_deployment",
               "observability"
             ],
-            "description": "Optional: defaults from the enclosing AuditResult lens when omitted."
+            "description": "defaults from the enclosing AuditResult lens when omitted."
           },
           "summary": {
             "type": "string"

package/schemas/audit_results.schema.json

@@ -103,7 +103,7 @@
                 "config_deployment",
                 "observability"
               ],
-              "description": "Optional: defaults from the enclosing AuditResult lens when omitted."
+              "description": "defaults from the enclosing AuditResult lens when omitted."
             },
             "summary": {
               "type": "string"

package/schemas/finding.schema.json

@@ -47,7 +47,7 @@
         "config_deployment",
         "observability"
       ],
-      "description": "Optional: defaults from the enclosing AuditResult lens when omitted."
+      "description": "defaults from the enclosing AuditResult lens when omitted."
     },
     "summary": {
       "type": "string"

package/wrapper/audit-code-wrapper-lib.mjs

@@ -194,6 +194,7 @@ function printHelp({ usageName, preferredEntrypoint }) {
     '- validate-results --results FILE validates AuditResult payloads against the active task manifest without ingesting them',
     '- explain-task <task_id> prints the resolved file coverage and current status for a task id',
     '- ingest-results --results FILE validates and ingests canonical AuditResult payloads',
+    '- unaccept-results --work-item <id> (repeatable) or --all removes entries from the accepted host-results pair so a poisoned acceptance can be re-ingested after repair',
     '- status summarizes deterministic audit state and pending review work',
     '',
     'Defaults:',