audit-tools 0.45.0 → 0.48.0

package/README.md

@@ -81,27 +81,47 @@ You'll confirm scope, depth, and which lenses to apply (security, correctness, r
 data_integrity, etc.), then it runs autonomously to completion and leaves
 `audit-findings.json` + `audit-report.md` in `.audit-tools/`.
 
-Every finding in the report is adversarially verified against current source by an
-independent reviewer before it's kept. The report opens with a triaged summary and 
-drills down by severity:
+Every finding is re-verified against the source on disk before the report is written. A finding a
+tool-executable check disproves is excluded outright; a finding that cannot be confirmed stays in
+the report, explicitly marked not-confirmed, so an unverifiable claim is surfaced rather than either
+hidden or asserted. The report opens with a summary; each finding then carries its severity,
+confidence, lens, and grounding:
 
-*(Illustrative sample — the counts and the `file:line` citation below are fabricated for the example, not a real finding.)*
+<!-- BEGIN sample-report — generated by scripts/check-readme-sample-report.mjs from the real renderer; do not hand-edit -->
+
+*(Illustrative excerpt — rendered by the real report renderer from a fabricated sample repo and one fixture finding; the cited src/api/auth.ts path belongs to that fabricated repo, not to this repository. A real report carries more sections between Summary and Findings.)*
 
 ```text
-# Audit findings — verified & pruned
-
-- Verified-real findings: 186 (of 204 extracted; 10 false, 8 uncertain)
-- By severity: high 7 · medium 97 · low 78 · info 4
-- By lens: tests 69 · maintainability 68 · correctness 24 · observability 17 · ...
-
-## High (7)
-### Citation-grounding retry leaves extracted plan completion marker
-- Lens: correctness · Category: incorrect-state-transition · Confidence: high
-- Summary: The promotion path writes the plan before running the citation-grounding
-  backstop ... a later step treats the pipeline as complete, bypassing the retry.
-- Affected: src/remediate/steps/contractPipeline.ts:540-548
+# Audit Report
+
+## Summary
+
+- Findings: 1
+- Work blocks: 1
+- Severity breakdown: high: 1
+- Lens breakdown: security: 1
+- Grounding (S7): grounded: 1
+- Fully audited files: 0
+- Excluded non-auditable files: 1
+
+## Findings
+
+### SEC-1e37facc — Expired session tokens are accepted on the refresh path
+
+refreshSession() checks the token signature but never the expiry, so an expired token mints a fresh session.
+
+- Severity: high
+- Confidence: high
+- Lens: security
+- Grounding: grounded
+- Impact: A leaked token stays usable indefinitely.
+- Likelihood: Any expired token replayed against the refresh endpoint.
+- Files: src/api/auth.ts:41–58
+- Evidence: 4 items (top: "The expiry field read at line 44 is never compared against the clock.") — see audit-findings.json for the full list
 ```
 
+<!-- END sample-report -->
+
 **Remediate issues or implement changes:**
 
 ```text
@@ -212,8 +232,21 @@ npm test        # build + test
 Missing `node_modules` makes `audit-tools/shared` resolve a stale `dist/`, producing
 misleading "no exported member" type errors, so install before build/check/test.
 
-See [`CLAUDE.md`](CLAUDE.md) for architecture and design decisions, the specs in
-[`spec/`](spec/), and the product/operator/contract guides in `docs/audit-pkg/`.
+The published package carries the consumer-facing guides only:
+
+- [Product overview](docs/audit-pkg/product.md)
+- [Operator guide](docs/audit-pkg/operator-guide.md)
+- [Contract reference](docs/audit-pkg/contracts.md)
+
+Everything else is repository-only and therefore linked absolutely: architecture
+and design decisions
+([`CLAUDE.md`](https://github.com/OhOkThisIsFine/audit-tools/blob/HEAD/CLAUDE.md)),
+the normative specs
+([`spec/`](https://github.com/OhOkThisIsFine/audit-tools/tree/HEAD/spec)), the
+contributor guide
+([`docs/audit-pkg/development.md`](https://github.com/OhOkThisIsFine/audit-tools/blob/HEAD/docs/audit-pkg/development.md)),
+and the release runbook
+([`docs/audit-pkg/release.md`](https://github.com/OhOkThisIsFine/audit-tools/blob/HEAD/docs/audit-pkg/release.md)).
 
 ## License
 

package/dispatch/merge-results.mjs

@@ -65,7 +65,7 @@ export function mergeResults({ artifactsDir, runId }) {
       ok: false,
       fatal: {
         message:
-          `Cannot read pending manifest ${tasksPath}: ${e.message}\n` +
+          `Cannot read pending manifest ${tasksPath}: ${/** @type {any} */ (e).message}\n` +
           "merge-results judges acceptance against the pending manifest (fail-closed); aborting before any write.",
       },
       passing: [],
@@ -102,7 +102,7 @@ export function mergeResults({ artifactsDir, runId }) {
     try {
       parsed = JSON.parse(readFileSync(filePath, "utf8"));
     } catch (e) {
-      failing.push({ task_id: filename, errors: [`Invalid JSON: ${e.message}`] });
+      failing.push({ task_id: filename, errors: [`Invalid JSON: ${/** @type {any} */ (e).message}`] });
       continue;
     }
 
@@ -206,7 +206,7 @@ function runCli() {
   const result = mergeResults({ artifactsDir, runId });
 
   if (!result.ok) {
-    console.error(result.fatal.message);
+    console.error((/** @type {any} */ (result.fatal)).message);
     process.exit(1);
   }
 

package/dispatch/validate-result.mjs

@@ -25,7 +25,7 @@ export function resolveTaskContext({ artifactsDir, runId, taskId }) {
   } catch (e) {
     return {
       task: null,
-      warning: `[warn] Could not read pending-audit-tasks.json; line-count validation will be skipped: ${e.message}`,
+      warning: `[warn] Could not read pending-audit-tasks.json; line-count validation will be skipped: ${/** @type {any} */ (e).message}`,
     };
   }
 }
@@ -59,7 +59,7 @@ export function validateOneResult({ artifactsDir, runId, taskId }) {
   try {
     resultObj = JSON.parse(readFileSync(resultPath, "utf8"));
   } catch (e) {
-    return { ok: false, fatal: { message: `Invalid JSON in ${resultPath}: ${e.message}` }, resultPath };
+    return { ok: false, fatal: { message: `Invalid JSON in ${resultPath}: ${/** @type {any} */ (e).message}` }, resultPath };
   }
 
   const { task, warning } = resolveTaskContext({ artifactsDir, runId, taskId });
@@ -86,7 +86,7 @@ function runCli() {
   const result = validateOneResult({ artifactsDir, runId, taskId });
 
   if (!result.ok) {
-    console.error(result.fatal.message);
+    console.error((/** @type {any} */ (result.fatal)).message);
     process.exit(1);
   }
 

package/dist/audit/cli/charterExtractionPrompt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"charterExtractionPrompt.d.ts","sourceRoot":"","sources":["../../../src/audit/cli/charterExtractionPrompt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAE/D;;;;;;;;;;;;;;;GAeG;AAEH,uEAAuE;AACvE,MAAM,MAAM,oBAAoB,GAAG,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;AAEhE;;;;GAIG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,OAAO,GAChB,oBAAoB,EAAE,CAExB;AA2CD;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE;IACJ,IAAI,EAAE,oBAAoB,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB,GACA,MAAM,CAsFR"}
+{"version":3,"file":"charterExtractionPrompt.d.ts","sourceRoot":"","sources":["../../../src/audit/cli/charterExtractionPrompt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAK/D;;;;;;;;;;;;;;;GAeG;AAEH,uEAAuE;AACvE,MAAM,MAAM,oBAAoB,GAAG,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;AAEhE;;;;GAIG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,OAAO,GAChB,oBAAoB,EAAE,CAExB;AA2CD;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE;IACJ,IAAI,EAAE,oBAAoB,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB,GACA,MAAM,CA6FR"}

package/dist/audit/cli/charterExtractionPrompt.js

@@ -1,3 +1,6 @@
+import { CharterProvenanceSchema } from "audit-tools/shared";
+/** The provenance-kind alternation, DERIVED from the schema at render time. */
+const PROVENANCE_KINDS = CharterProvenanceSchema.shape.kind.options.join("|");
 /**
  * The extraction kinds a run's ceiling requests, in canonical order. The three
  * estimator channels extract at every charter-authorizing ceiling; `deepest`
@@ -123,7 +126,14 @@ export function renderCharterKindLanePrompt(bundle, opts) {
         '      "purpose": "<telos, not mechanism>",',
         '      "premise_height": 0,',
         '      "files": ["<repo-relative path>", "..."],',
-        '      "provenance": [{ "kind": "doc|code|comment|inferred|...", "ref": "<path/id>", "quote": "<optional>" }],',
+        // Closed enum, exhaustive, NO trailing ellipsis — DERIVED from
+        // CharterProvenanceSchema at render time, so a schema enum change flows into
+        // the prompt automatically; the behavioral pin in
+        // tests/shared/prompt-renders-its-contract.test.ts holds exhaustiveness and
+        // closedness of the RENDERED text instead of teaching a worker a smaller
+        // contract (an open list here coined a member and quarantined a 34-minute
+        // lane run).
+        `      "provenance": [{ "kind": "${PROVENANCE_KINDS}", "ref": "<path/id>", "quote": "<optional>" }],`,
         '      "confidence": "high|medium|low"',
         "    }",
         "  ]",

package/dist/audit/cli/charterExtractionPrompt.js.map

@@ -1 +1 @@
-{"version":3,"file":"charterExtractionPrompt.js","sourceRoot":"","sources":["../../../src/audit/cli/charterExtractionPrompt.ts"],"names":[],"mappings":"AAuBA;;;;GAIG;AACH,MAAM,UAAU,gCAAgC,CAC9C,QAAiB;IAEjB,OAAO,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;AAC9C,CAAC;AAED,mFAAmF;AACnF,MAAM,cAAc,GAGhB;IACF,MAAM,EAAE;QACN,UAAU,EAAE;YACV,0EAA0E;YAC1E,2BAA2B;SAC5B;QACD,OAAO,EAAE;YACP,yEAAyE;YACzE,yEAAyE;YACzE,uBAAuB;SACxB;KACF;IACD,UAAU,EAAE;QACV,UAAU,EAAE;YACV,yEAAyE;YACzE,iEAAiE;SAClE;QACD,OAAO,EAAE;YACP,wEAAwE;YACxE,yEAAyE;YACzE,kEAAkE;SACnE;KACF;IACD,QAAQ,EAAE;QACR,UAAU,EAAE;YACV,2EAA2E;YAC3E,uEAAuE;YACvE,mBAAmB;SACpB;QACD,OAAO,EAAE;YACP,mEAAmE;YACnE,uEAAuE;YACvE,yBAAyB;SAC1B;KACF;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAsB,EACtB,IAIC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,uBAAuB,EAAE,SAAS,IAAI,EAAE,CAAC;IAClE,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEvC,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM;QAChC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACrB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrD,MAAM,IAAI,GACR,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,aAAa,OAAO,GAAG,IAAI,EAAE,CAAC;QAC/D,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC,0EAA0E,CAAC,CAAC;IAEjF,OAAO;QACL,2CAA2C,IAAI,CAAC,IAAI,oCAAoC;QACxF,EAAE;QACF,sEAAsE;QACtE,4EAA4E;QAC5E,0EAA0E;QAC1E,wBAAwB;QACxB,EAAE;QACF,GAAG,IAAI,CAAC,UAAU;QAClB,EAAE;QACF,oEAAoE;QACpE,EAAE;QACF,UAAU,IAAI,CAAC,UAAU,iDAAiD;QAC1E,4EAA4E;QAC5E,qEAAqE;QACrE,EAAE;QACF,GAAG,IAAI,CAAC,OAAO;QACf,EAAE;QACF,sCAAsC;QACtC,EAAE;QACF,0EAA0E;QAC1E,8EAA8E;QAC9E,6EAA6E;QAC7E,4EAA4E;QAC5E,4EAA4E;QAC5E,UAAU;QACV,oCAAoC;QACpC,4EAA4E;QAC5E,4EAA4E;QAC5E,gEAAgE;QAChE,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,qEAAqE;QACrE,EAAE;QACF,yEAAyE;QACzE,mEAAmE;QACnE,GAAG,SAAS;QACZ,EAAE;QACF,6EAA6E;QAC7E,6EAA6E;QAC7E,wEAAwE;QACxE,uEAAuE;QACvE,EAAE;QACF,uCAAuC;QACvC,qEAAqE;QACrE,6EAA6E;QAC7E,wEAAwE;QACxE,8EAA8E;QAC9E,0CAA0C;QAC1C,8EAA8E;QAC9E,wCAAwC;QACxC,EAAE;QACF,WAAW;QACX,sCAAsC,IAAI,CAAC,cAAc,oBAAoB;QAC7E,qCAAqC,IAAI,CAAC,IAAI,yCAAyC;QACvF,EAAE;QACF,SAAS;QACT,GAAG;QACH,cAAc;QACd,OAAO;QACP,kBAAkB,IAAI,CAAC,IAAI,IAAI;QAC/B,4CAA4C;QAC5C,4BAA4B;QAC5B,iDAAiD;QACjD,+GAA+G;QAC/G,uCAAuC;QACvC,OAAO;QACP,KAAK;QACL,GAAG;QACH,KAAK;QACL,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}
+{"version":3,"file":"charterExtractionPrompt.js","sourceRoot":"","sources":["../../../src/audit/cli/charterExtractionPrompt.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAG7D,+EAA+E;AAC/E,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAsB9E;;;;GAIG;AACH,MAAM,UAAU,gCAAgC,CAC9C,QAAiB;IAEjB,OAAO,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;AAC9C,CAAC;AAED,mFAAmF;AACnF,MAAM,cAAc,GAGhB;IACF,MAAM,EAAE;QACN,UAAU,EAAE;YACV,0EAA0E;YAC1E,2BAA2B;SAC5B;QACD,OAAO,EAAE;YACP,yEAAyE;YACzE,yEAAyE;YACzE,uBAAuB;SACxB;KACF;IACD,UAAU,EAAE;QACV,UAAU,EAAE;YACV,yEAAyE;YACzE,iEAAiE;SAClE;QACD,OAAO,EAAE;YACP,wEAAwE;YACxE,yEAAyE;YACzE,kEAAkE;SACnE;KACF;IACD,QAAQ,EAAE;QACR,UAAU,EAAE;YACV,2EAA2E;YAC3E,uEAAuE;YACvE,mBAAmB;SACpB;QACD,OAAO,EAAE;YACP,mEAAmE;YACnE,uEAAuE;YACvE,yBAAyB;SAC1B;KACF;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAsB,EACtB,IAIC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,uBAAuB,EAAE,SAAS,IAAI,EAAE,CAAC;IAClE,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEvC,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM;QAChC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACrB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrD,MAAM,IAAI,GACR,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,aAAa,OAAO,GAAG,IAAI,EAAE,CAAC;QAC/D,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC,0EAA0E,CAAC,CAAC;IAEjF,OAAO;QACL,2CAA2C,IAAI,CAAC,IAAI,oCAAoC;QACxF,EAAE;QACF,sEAAsE;QACtE,4EAA4E;QAC5E,0EAA0E;QAC1E,wBAAwB;QACxB,EAAE;QACF,GAAG,IAAI,CAAC,UAAU;QAClB,EAAE;QACF,oEAAoE;QACpE,EAAE;QACF,UAAU,IAAI,CAAC,UAAU,iDAAiD;QAC1E,4EAA4E;QAC5E,qEAAqE;QACrE,EAAE;QACF,GAAG,IAAI,CAAC,OAAO;QACf,EAAE;QACF,sCAAsC;QACtC,EAAE;QACF,0EAA0E;QAC1E,8EAA8E;QAC9E,6EAA6E;QAC7E,4EAA4E;QAC5E,4EAA4E;QAC5E,UAAU;QACV,oCAAoC;QACpC,4EAA4E;QAC5E,4EAA4E;QAC5E,gEAAgE;QAChE,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,qEAAqE;QACrE,EAAE;QACF,yEAAyE;QACzE,mEAAmE;QACnE,GAAG,SAAS;QACZ,EAAE;QACF,6EAA6E;QAC7E,6EAA6E;QAC7E,wEAAwE;QACxE,uEAAuE;QACvE,EAAE;QACF,uCAAuC;QACvC,qEAAqE;QACrE,6EAA6E;QAC7E,wEAAwE;QACxE,8EAA8E;QAC9E,0CAA0C;QAC1C,8EAA8E;QAC9E,wCAAwC;QACxC,EAAE;QACF,WAAW;QACX,sCAAsC,IAAI,CAAC,cAAc,oBAAoB;QAC7E,qCAAqC,IAAI,CAAC,IAAI,yCAAyC;QACvF,EAAE;QACF,SAAS;QACT,GAAG;QACH,cAAc;QACd,OAAO;QACP,kBAAkB,IAAI,CAAC,IAAI,IAAI;QAC/B,4CAA4C;QAC5C,4BAA4B;QAC5B,iDAAiD;QACjD,+DAA+D;QAC/D,6EAA6E;QAC7E,kDAAkD;QAClD,4EAA4E;QAC5E,yEAAyE;QACzE,0EAA0E;QAC1E,aAAa;QACb,mCAAmC,gBAAgB,kDAAkD;QACrG,uCAAuC;QACvC,OAAO;QACP,KAAK;QACL,GAAG;QACH,KAAK;QACL,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/audit/cli/cleanupCommand.d.ts

@@ -1,2 +1,27 @@
+export type CleanupTargetValidation = {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Validate the cleanup TARGET itself — a purely structural check, independent
+ * of audit state, flags, and eligibility (CP-NODE-16). `--force` overrides the
+ * interactive/status confirmation inside cleanupStaleArtifactsDir; it must
+ * never override this: a mistyped or overly broad `--artifacts-dir` (`.`, a
+ * checkout root, a filesystem root) reaching a recursive rm is exactly the
+ * accident this verb has to make impossible.
+ *
+ * Two rules:
+ *   1. the path must BE an artifacts dir — `<X>/.audit-tools/audit`, never a
+ *      filesystem root — decided from the path shape alone, so it holds even
+ *      when the directory does not exist yet;
+ *   2. `--force` additionally requires the `audit_state.json` marker on disk:
+ *      force waives the STATUS evidence, never the IDENTITY evidence. Without
+ *      `--force` a missing marker changes nothing — the eligibility gate in
+ *      cleanupStaleArtifactsDir already refuses to delete, so the verb's
+ *      skipped / crashed-audit contract is untouched.
+ */
+export declare function validateCleanupTarget(artifactsDir: string): CleanupTargetValidation;
 export declare function cmdCleanup(argv: string[]): Promise<void>;
 //# sourceMappingURL=cleanupCommand.d.ts.map

package/dist/audit/cli/cleanupCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cleanupCommand.d.ts","sourceRoot":"","sources":["../../../src/audit/cli/cleanupCommand.ts"],"names":[],"mappings":"AAGA,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAoC9D"}
+{"version":3,"file":"cleanupCommand.d.ts","sourceRoot":"","sources":["../../../src/audit/cli/cleanupCommand.ts"],"names":[],"mappings":"AAiBA,MAAM,MAAM,uBAAuB,GAC/B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,MAAM,GACnB,uBAAuB,CAqBzB;AAsBD,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA4D9D"}

package/dist/audit/cli/cleanupCommand.js

@@ -1,15 +1,90 @@
+import { existsSync } from "node:fs";
+import { basename, dirname, parse, resolve } from "node:path";
+import { AUDIT_TOOLS_DIRNAME, auditArtifactsDir } from "audit-tools/shared";
 import { getArtifactsDir, hasFlag } from "./args.js";
 import { cleanupStaleArtifactsDir } from "./cleanup.js";
+// The structural identity of an audit artifacts directory, which the `cleanup`
+// verb has to PROVE a target carries before recursively deleting it
+// (CP-NODE-16). Both segments come from the single-sourced layout in
+// audit-tools/shared (src/shared/io/auditToolsPaths.ts): the dirname constant
+// directly, the area segment derived from the helper that builds it — so a
+// layout change moves this guard with it instead of silently disarming it.
+const AUDIT_AREA_DIRNAME = basename(auditArtifactsDir("."));
+// The supervisor state marker; audit-tools/shared exposes no constant for it yet
+// (the literal is spelled at every producer/consumer site), so it is named here.
+const AUDIT_STATE_FILENAME = "audit_state.json";
+/**
+ * Validate the cleanup TARGET itself — a purely structural check, independent
+ * of audit state, flags, and eligibility (CP-NODE-16). `--force` overrides the
+ * interactive/status confirmation inside cleanupStaleArtifactsDir; it must
+ * never override this: a mistyped or overly broad `--artifacts-dir` (`.`, a
+ * checkout root, a filesystem root) reaching a recursive rm is exactly the
+ * accident this verb has to make impossible.
+ *
+ * Two rules:
+ *   1. the path must BE an artifacts dir — `<X>/.audit-tools/audit`, never a
+ *      filesystem root — decided from the path shape alone, so it holds even
+ *      when the directory does not exist yet;
+ *   2. `--force` additionally requires the `audit_state.json` marker on disk:
+ *      force waives the STATUS evidence, never the IDENTITY evidence. Without
+ *      `--force` a missing marker changes nothing — the eligibility gate in
+ *      cleanupStaleArtifactsDir already refuses to delete, so the verb's
+ *      skipped / crashed-audit contract is untouched.
+ */
+export function validateCleanupTarget(artifactsDir) {
+    const resolved = resolve(artifactsDir);
+    if (resolved === parse(resolved).root) {
+        return {
+            ok: false,
+            reason: `refusing to delete ${resolved}: it is a filesystem root, not an ${AUDIT_TOOLS_DIRNAME}/${AUDIT_AREA_DIRNAME} artifacts directory`,
+        };
+    }
+    if (basename(resolved) !== AUDIT_AREA_DIRNAME ||
+        basename(dirname(resolved)) !== AUDIT_TOOLS_DIRNAME) {
+        return {
+            ok: false,
+            reason: `refusing to delete ${resolved}: not an ${AUDIT_TOOLS_DIRNAME}/${AUDIT_AREA_DIRNAME} artifacts directory — pass --artifacts-dir pointing at the audit artifacts dir`,
+        };
+    }
+    return { ok: true };
+}
+function emitRefusal(artifactsDir, reason, dryRun) {
+    console.log(JSON.stringify({
+        artifacts_dir: artifactsDir,
+        action: "refused",
+        reason,
+        dry_run: dryRun,
+    }, null, 2));
+    process.exitCode = 1;
+}
 export async function cmdCleanup(argv) {
     const artifactsDir = getArtifactsDir(argv);
     const dryRun = hasFlag(argv, "--dry-run");
     const force = hasFlag(argv, "--force");
+    // Target validation precedes EVERY recursive-delete path (CP-NODE-16):
+    // --force relaxes the status confirmation only, never the structural check.
+    const validation = validateCleanupTarget(artifactsDir);
+    if (!validation.ok) {
+        emitRefusal(artifactsDir, validation.reason, dryRun);
+        return;
+    }
+    const markerPath = resolve(artifactsDir, AUDIT_STATE_FILENAME);
+    if (force && !existsSync(markerPath)) {
+        emitRefusal(artifactsDir, `--force given, but ${markerPath} does not exist — the directory carries no audit_state.json marker, so it is not provably an audit artifacts dir; refusing to delete`, dryRun);
+        return;
+    }
     const result = await cleanupStaleArtifactsDir(artifactsDir, { force, dryRun });
     if (result.action === "skipped") {
         console.log(JSON.stringify({
             artifacts_dir: artifactsDir,
             action: "skipped",
-            reason: result.reason ?? "no audit_state.json found; artifacts may be from a crashed audit — use --force to delete anyway",
+            // Do NOT advise --force here. This fallback covers the
+            // status="unknown" branch — a directory with no audit_state.json
+            // marker — and that is the one case --force does NOT waive: the
+            // marker check above refuses a forced delete outright. Force waives
+            // the run's STATUS evidence, never its IDENTITY evidence.
+            reason: result.reason ??
+                "no audit_state.json found — the directory carries no audit-run marker, so it is not provably an audit artifacts dir; --force does not waive this (force waives run STATUS evidence, never IDENTITY evidence)",
             dry_run: dryRun,
         }, null, 2));
         process.exitCode = 1;

package/dist/audit/cli/cleanupCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"cleanupCommand.js","sourceRoot":"","sources":["../../../src/audit/cli/cleanupCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAExD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAc;IAC7C,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAEvC,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAE/E,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;YACE,aAAa,EAAE,YAAY;YAC3B,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,iGAAiG;YAC1H,OAAO,EAAE,MAAM;SAChB,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;QACE,aAAa,EAAE,YAAY;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM;KAChB,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"cleanupCommand.js","sourceRoot":"","sources":["../../../src/audit/cli/cleanupCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAExD,+EAA+E;AAC/E,oEAAoE;AACpE,qEAAqE;AACrE,8EAA8E;AAC9E,2EAA2E;AAC3E,2EAA2E;AAC3E,MAAM,kBAAkB,GAAG,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5D,iFAAiF;AACjF,iFAAiF;AACjF,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAMhD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,qBAAqB,CACnC,YAAoB;IAEpB,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAEvC,IAAI,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,sBAAsB,QAAQ,qCAAqC,mBAAmB,IAAI,kBAAkB,sBAAsB;SAC3I,CAAC;IACJ,CAAC;IAED,IACE,QAAQ,CAAC,QAAQ,CAAC,KAAK,kBAAkB;QACzC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,KAAK,mBAAmB,EACnD,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,sBAAsB,QAAQ,YAAY,mBAAmB,IAAI,kBAAkB,iFAAiF;SAC7K,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,WAAW,CAClB,YAAoB,EACpB,MAAc,EACd,MAAe;IAEf,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;QACE,aAAa,EAAE,YAAY;QAC3B,MAAM,EAAE,SAAS;QACjB,MAAM;QACN,OAAO,EAAE,MAAM;KAChB,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;IACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAc;IAC7C,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAEvC,uEAAuE;IACvE,4EAA4E;IAC5E,MAAM,UAAU,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,WAAW,CAAC,YAAY,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrD,OAAO;IACT,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;IAC/D,IAAI,KAAK,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,WAAW,CACT,YAAY,EACZ,sBAAsB,UAAU,sIAAsI,EACtK,MAAM,CACP,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAE/E,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;YACE,aAAa,EAAE,YAAY;YAC3B,MAAM,EAAE,SAAS;YACjB,uDAAuD;YACvD,iEAAiE;YACjE,gEAAgE;YAChE,oEAAoE;YACpE,0DAA0D;YAC1D,MAAM,EACJ,MAAM,CAAC,MAAM;gBACb,8MAA8M;YAChN,OAAO,EAAE,MAAM;SAChB,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;QACE,aAAa,EAAE,YAAY;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM;KAChB,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;AACJ,CAAC"}

package/dist/audit/cli/dispatch/hostHandoff.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hostHandoff.d.ts","sourceRoot":"","sources":["../../../../src/audit/cli/dispatch/hostHandoff.ts"],"names":[],"mappings":"AAGA,OAAO,EAiBL,KAAK,SAAS,EAEf,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAqB,KAAK,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAKrF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAEjF,QAAA,MAAM,yBAAyB,EAAG,8BAAuC,CAAC;AAC1E,QAAA,MAAM,2BAA2B,EAAG,gCAAyC,CAAC;AAO9E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;KACjC,CAAC;IACF,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;QAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;KACtC,CAAC;IACF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,yBAAyB,CAAC;IAC5D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,2BAA2B,CAAC;IAC9D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS,uBAAuB,EAAE,CAAC;CACtD;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,WAAW,EAAE,CAAC;IAClD,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,uBAAuB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpD;;;;;;;;;OASG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,EAAE,SAAS,0BAA0B,EAAE,CAAC;CACrE;AAyaD,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;CAC7B,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAmFpC;AAgcD,wBAAsB,sBAAsB,CAAC,MAAM,EAAE;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,CAAC;IAC1C;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,sDAAsD;IACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;CAC7B,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA6NlC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,wBAAwB;IACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,sDAAsD;IACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;CAC7B,GAAG,OAAO,CAAC;IAAE,QAAQ,CAAC,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAyEjE"}
+{"version":3,"file":"hostHandoff.d.ts","sourceRoot":"","sources":["../../../../src/audit/cli/dispatch/hostHandoff.ts"],"names":[],"mappings":"AAGA,OAAO,EA8BL,KAAK,SAAS,EAEf,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAqB,KAAK,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAKrF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAEjF,QAAA,MAAM,yBAAyB,EAAG,8BAAuC,CAAC;AAC1E,QAAA,MAAM,2BAA2B,EAAG,gCAAyC,CAAC;AAO9E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;KACjC,CAAC;IACF,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;QAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;KACtC,CAAC;IACF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,yBAAyB,CAAC;IAC5D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,2BAA2B,CAAC;IAC9D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS,uBAAuB,EAAE,CAAC;CACtD;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,WAAW,EAAE,CAAC;IAClD,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,uBAAuB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpD;;;;;;;;;OASG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,EAAE,SAAS,0BAA0B,EAAE,CAAC;CACrE;AA6XD,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;CAC7B,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAmFpC;AA8bD,wBAAsB,sBAAsB,CAAC,MAAM,EAAE;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,CAAC;IAC1C;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,sDAAsD;IACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;CAC7B,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA6NlC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,wBAAwB;IACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,sDAAsD;IACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;CAC7B,GAAG,OAAO,CAAC;IAAE,QAAQ,CAAC,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAyEjE"}

package/dist/audit/cli/dispatch/hostHandoff.js

@@ -1,6 +1,6 @@
 import { mkdir } from "node:fs/promises";
-import { join, resolve } from "node:path";
-import { createMemoizedSourceReader, appendSubmissionEvent, SUBMISSION_LEDGER_EVENT_CONTRACT_VERSION, assertSubmissionRunId, hashContent, isFileMissingError, readJsonFile, readSubmissionDocument, repoRelativePath, resolveContainedPath, stableStringify, submissionPathFor, verifyFindingGrounding, withFileLock, writeBlockedStepContract, writeJsonFile, } from "audit-tools/shared";
+import { join } from "node:path";
+import { createMemoizedSourceReader, appendSubmissionEvent, SUBMISSION_LEDGER_EVENT_CONTRACT_VERSION, bindingIdentity, compareCodeUnits, contentSha256, firstDuplicateIdentity, hasExactKeys, hostHandoffResultPath, isFileMissingError, isRecord, isSha256, parseAllWorkloadItems, parseWorkloadEnvelope, promptSha256, readJsonFile, readSubmissionDocument, repoRelativePath, requireNonEmptyString, resolveContainedPath, resolveHostHandoffPaths, resultMapIdentity, siblingLockPath, sameStrings, stableStringify, verifyFindingGrounding, withFileLock, writeBlockedStepContract, writeJsonFile, } from "audit-tools/shared";
 import { findingContractPromptLines } from "../../contracts/findingContractPrompt.js";
 import { WorkerFindingSchema } from "../../contracts/workerSchemas.js";
 import { AuditResultSchema } from "../../types.js";
@@ -10,40 +10,33 @@ const RESULT_MAP_CONTRACT_VERSION = "audit-host-result-map/v1alpha1";
 const RESULT_CONTRACT_VERSION = "audit-host-result/v1alpha1";
 const TASK_BINDINGS_CONTRACT_VERSION = "audit-host-task-bindings/v1alpha1";
 const ACCEPTED_RESULTS_CONTRACT_VERSION = "audit-host-accepted-results/v1alpha1";
-function compareCodeUnits(left, right) {
-    return left < right ? -1 : left > right ? 1 : 0;
-}
-function isRecord(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function hasExactKeys(value, expected) {
-    const actual = Object.keys(value).sort(compareCodeUnits);
-    return (actual.length === expected.length &&
-        actual.every((key, index) => key === [...expected].sort(compareCodeUnits)[index]));
-}
-function isSha256(value) {
-    return typeof value === "string" && /^[0-9a-f]{64}$/u.test(value);
-}
+/**
+ * The audit draw's boundary paths: the SHARED resolution (run-id grammar,
+ * containment, `runs/<id>`), plus the four files this boundary persists beyond
+ * the workload — the result map, the trusted task bindings, and the
+ * accepted-results pair with its one serializing lock.
+ */
 function resolveBoundaryPaths(params) {
-    assertSubmissionRunId(params.runId, "audit host run id");
-    const root = resolve(params.root);
-    const artifactsDir = resolveContainedPath(root, params.artifactsDir, "artifactsDir");
-    const runDir = resolveContainedPath(artifactsDir, join("runs", params.runId), "audit host run directory");
+    const core = resolveHostHandoffPaths({
+        ...params,
+        runDirSegments: [],
+        runIdLabel: "audit host run id",
+    });
     return {
-        root,
+        root: core.root,
         runId: params.runId,
-        artifactsDir,
-        runDir,
-        resultDir: join(runDir, "host-results"),
-        workloadPath: join(runDir, "host-workload.json"),
-        resultMapPath: join(runDir, "host-result-map.json"),
-        taskBindingsPath: join(runDir, "host-task-bindings.json"),
-        acceptedLedgerPath: join(runDir, "host-accepted-results-ledger.json"),
-        acceptedResultsPath: join(runDir, "host-accepted-results.json"),
+        artifactsDir: core.artifactsDir,
+        runDir: core.runDir,
+        resultDir: core.resultDir,
+        workloadPath: core.workloadPath,
+        resultMapPath: join(core.runDir, "host-result-map.json"),
+        taskBindingsPath: join(core.runDir, "host-task-bindings.json"),
+        acceptedLedgerPath: join(core.runDir, "host-accepted-results-ledger.json"),
+        acceptedResultsPath: join(core.runDir, "host-accepted-results.json"),
         // Named off the pair's own stem, so the lock is visibly the lock FOR those
         // two files rather than an independently-invented name. It is transient
         // infrastructure, not a run artifact anything cites.
-        acceptedLockPath: `${join(runDir, "host-accepted-results")}.lock`,
+        acceptedLockPath: siblingLockPath(join(core.runDir, "host-accepted-results")),
     };
 }
 /**
@@ -82,18 +75,11 @@ async function writeAcceptedResults(paths, ledger) {
 }
 /**
  * The bound path for one work item's submission — the SHARED rule, not a local
- * copy of it. The audit and remediate handoffs both derived
- * `<resultDir>/<sha256(id)>.json` in their own private helpers; a divergence
- * between the two would have been silent on both sides.
+ * copy of it. This and the remediate twin were byte-equivalent private helpers;
+ * a divergence between them would have been silent on both sides.
  */
 function resultPathFor(paths, workItemId) {
-    return submissionPathFor({ root: paths.root, submissionDir: paths.resultDir }, workItemId);
-}
-function requireNonEmptyString(value, label) {
-    if (typeof value !== "string" || value.length === 0) {
-        throw new Error(`${label} must be a non-empty string`);
-    }
-    return value;
+    return hostHandoffResultPath({ root: paths.root, artifactsDir: paths.artifactsDir, runDir: paths.runDir, resultDir: paths.resultDir, workloadPath: paths.workloadPath }, workItemId);
 }
 function normalizeTask(task, root) {
     if (!isRecord(task)) {
@@ -188,7 +174,7 @@ function buildWorkItem(paths, task) {
             token_estimate: task.token_estimate,
         },
         prompt: {
-            sha256: hashContent(promptText),
+            sha256: promptSha256(promptText),
             text: promptText,
         },
         scope: {
@@ -217,7 +203,7 @@ function validateAcceptedEntry(value) {
         typeof value.result_id === "string" &&
         isSha256(value.result_sha256) &&
         isRecord(value.result) &&
-        value.result_sha256 === hashContent(stableStringify(value.result)) &&
+        value.result_sha256 === contentSha256(value.result) &&
         value.result.work_item_id === value.work_item_id &&
         value.result.prompt_sha256 === value.prompt_sha256 &&
         value.result.result_id === value.result_id &&
@@ -248,19 +234,12 @@ async function loadAcceptedResults(path, runId) {
         !value.entries.every(validateAcceptedEntry)) {
         throw new Error(`Invalid accepted audit host results ledger: ${path}`);
     }
-    const identities = new Set();
-    for (const entry of value.entries) {
-        const identity = `${entry.work_item_id}\u0000${entry.prompt_sha256}`;
-        if (identities.has(identity)) {
-            throw new Error(`Duplicate accepted audit host result binding: ${entry.work_item_id}`);
-        }
-        identities.add(identity);
+    const duplicate = firstDuplicateIdentity(value.entries, bindingIdentity);
+    if (duplicate !== null) {
+        throw new Error(`Duplicate accepted audit host result binding: ${duplicate.work_item_id}`);
     }
     return value;
 }
-function bindingIdentity(entry) {
-    return `${entry.work_item_id}\u0000${entry.prompt_sha256}`;
-}
 export async function prepareAuditHostHandoff(params) {
     if (!Array.isArray(params.tasks)) {
         throw new Error("Audit host tasks must be an array");
@@ -356,7 +335,7 @@ function parseWorkItem(value) {
         !hasExactKeys(value.prompt, ["sha256", "text"]) ||
         !isSha256(value.prompt.sha256) ||
         typeof value.prompt.text !== "string" ||
-        hashContent(value.prompt.text) !== value.prompt.sha256 ||
+        promptSha256(value.prompt.text) !== value.prompt.sha256 ||
         !isRecord(value.scope) ||
         !hasExactKeys(value.scope, ["files", "unit_ids"]) ||
         !Array.isArray(value.scope.files) ||
@@ -368,15 +347,17 @@ function parseWorkItem(value) {
     return value;
 }
 function parseWorkload(value, runId) {
-    if (!isRecord(value) ||
-        !hasExactKeys(value, ["contract_version", "run_id", "work_items"]) ||
-        value.contract_version !== WORKLOAD_CONTRACT_VERSION ||
-        value.run_id !== runId ||
-        !Array.isArray(value.work_items)) {
+    // Envelope + all-items parsing is the CORE's scaffolding; the audit draw
+    // selects only its own contract version and item parser.
+    const envelope = parseWorkloadEnvelope(value, {
+        contractVersion: WORKLOAD_CONTRACT_VERSION,
+        runId,
+    });
+    if (!envelope.ok) {
         throw new Error("Invalid audit host workload");
     }
-    const workItems = value.work_items.map(parseWorkItem);
-    if (workItems.some((entry) => entry === null)) {
+    const workItems = parseAllWorkloadItems(envelope.rawItems, parseWorkItem);
+    if (workItems === null) {
         throw new Error("Invalid audit host work item");
     }
     return value;
@@ -457,25 +438,20 @@ function validateHandoffBinding(paths, workload, resultMap, taskBindings) {
             binding.lens !== item.lens ||
             item.scope.unit_ids.length !== 1 ||
             binding.unit_id !== item.scope.unit_ids[0] ||
-            Object.keys(binding.file_line_counts).sort(compareCodeUnits).join("\u0000") !==
-                [...item.scope.files].sort(compareCodeUnits).join("\u0000")) {
+            !sameStrings(Object.keys(binding.file_line_counts).sort(compareCodeUnits), [...item.scope.files].sort(compareCodeUnits))) {
             throw new Error(`Invalid audit host task binding: ${item.id}`);
         }
         items.set(item.id, item);
     }
-    if (resultMap.entries.length !== items.size) {
-        throw new Error("Audit host result map does not cover the workload exactly");
-    }
-    const mapped = new Set();
-    for (const entry of resultMap.entries) {
-        const item = items.get(entry.work_item_id);
-        if (item === undefined ||
-            mapped.has(entry.work_item_id) ||
-            entry.prompt_sha256 !== item.prompt.sha256 ||
-            entry.result_path !== item.result_path) {
-            throw new Error(`Invalid audit host result binding: ${entry.work_item_id}`);
-        }
-        mapped.add(entry.work_item_id);
+    // The result-map identity half is the CORE's check, with its failure
+    // CLASSIFIED: a coverage miss says the MAP is wrong; an identity miss names
+    // the entry whose prompt digest or bound path broke. Both of the audit
+    // draw's original refusals survive — they are not collapsed into one.
+    const identity = resultMapIdentity([...items.values()], resultMap.entries);
+    if (!identity.ok) {
+        throw new Error(identity.reason === "coverage"
+            ? "Audit host result map does not cover the workload exactly"
+            : `Invalid audit host result binding: ${identity.workItemId ?? "unknown"}`);
     }
     return items;
 }
@@ -787,7 +763,7 @@ export async function ingestAuditHostResults(params) {
             prompt_sha256: entry.prompt_sha256,
             result_path: entry.result_path,
             result_id: result.result_id,
-            result_sha256: hashContent(stableStringify(result)),
+            result_sha256: contentSha256(result),
             result,
             audit_result: converted.auditResult,
         });