audit-tools 0.45.0 → 0.48.0

package/dist/audit/orchestrator/intentInterpreter.d.ts

@@ -4,10 +4,14 @@
  * Bridges the audit-tools/shared clause interpreter to the pinned
  * FreeFormIntentInterpretation seam contract (N-X06).
  *
- * INV-S04: the verbatim free_form_intent string MUST NOT appear in any output
- * field. All fields are derived signals only.
+ * INV-S04: the WHOLE verbatim free_form_intent string is never emitted, and
+ * worker/dispatch prompt material never carries it in any form. Individual
+ * clause substrings DO ride derived fields (clause text, checkpoint
+ * questions, the remediate sidecar, run-log notes) — that is inside the
+ * charge's plan/prompt/workload scope, and the guarded boundary is the
+ * worker-facing prompt surface, not every derived field.
  */
-import type { FreeFormIntentInterpretation, IntentCheckpoint } from "audit-tools/shared";
+import type { ConstraintClauseRecord, FreeFormIntentInterpretation, IntentCheckpoint } from "audit-tools/shared";
 /**
  * Interpret a free-form intent string into the versioned seam contract shape.
  *
@@ -17,21 +21,14 @@ import type { FreeFormIntentInterpretation, IntentCheckpoint } from "audit-tools
  * @param freeFormIntent - Raw free_form_intent from IntentCheckpoint (may be empty).
  */
 export declare function interpretFreeFormIntentForAudit(freeFormIntent: string): FreeFormIntentInterpretation;
-/** A blocking checkpoint question that the host has not yet answered. */
-export interface UnresolvedConstraintClause {
-    /**
-     * Stable clause identity — the resolution key (CE-004). A `constraint_clauses`
-     * entry resolves this clause when its `clause_id` matches, NOT when its
-     * rendered `checkpoint_question` matches (two distinct clauses can render to
-     * the same question). The host recorder threads this back so the
-     * answer is keyed on identity.
-     */
-    clause_id: string;
-    /** The original unencodable clause text. */
-    text: string;
-    /** The blocking question that must be answered before planning proceeds. */
-    checkpoint_question: string;
-}
+/**
+ * A blocking checkpoint question that the host has not yet answered.
+ * Alias of the shared {@link ConstraintClauseRecord}: the identity-keyed
+ * resolution semantics (CE-004) live in audit-tools/shared
+ * (`intent/constraintClauses.ts`) so remediate's sidecar consumer and this
+ * gate cannot drift.
+ */
+export type UnresolvedConstraintClause = ConstraintClauseRecord;
 /**
  * Compute the blocking checkpoint questions raised by an intent checkpoint's
  * `free_form_intent` that the host has NOT yet resolved.

package/dist/audit/orchestrator/intentInterpreter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"intentInterpreter.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/intentInterpreter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EACV,4BAA4B,EAE5B,gBAAgB,EACjB,MAAM,oBAAoB,CAAC;AAsB5B;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAC7C,cAAc,EAAE,MAAM,GACrB,4BAA4B,CAyB9B;AAMD,yEAAyE;AACzE,MAAM,WAAW,0BAA0B;IACzC;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,gBAAgB,GAAG,SAAS,GACvC,0BAA0B,EAAE,CAoC9B"}
+{"version":3,"file":"intentInterpreter.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/intentInterpreter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,OAAO,KAAK,EACV,sBAAsB,EACtB,4BAA4B,EAE5B,gBAAgB,EACjB,MAAM,oBAAoB,CAAC;AAsB5B;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAC7C,cAAc,EAAE,MAAM,GACrB,4BAA4B,CAyB9B;AAMD;;;;;;GAMG;AACH,MAAM,MAAM,0BAA0B,GAAG,sBAAsB,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,gBAAgB,GAAG,SAAS,GACvC,0BAA0B,EAAE,CAoB9B"}

package/dist/audit/orchestrator/intentInterpreter.js

@@ -4,10 +4,14 @@
  * Bridges the audit-tools/shared clause interpreter to the pinned
  * FreeFormIntentInterpretation seam contract (N-X06).
  *
- * INV-S04: the verbatim free_form_intent string MUST NOT appear in any output
- * field. All fields are derived signals only.
+ * INV-S04: the WHOLE verbatim free_form_intent string is never emitted, and
+ * worker/dispatch prompt material never carries it in any form. Individual
+ * clause substrings DO ride derived fields (clause text, checkpoint
+ * questions, the remediate sidecar, run-log notes) — that is inside the
+ * charge's plan/prompt/workload scope, and the guarded boundary is the
+ * worker-facing prompt surface, not every derived field.
  */
-import { interpretIntent, FREE_FORM_INTENT_INTERPRETATION_VERSION, } from "audit-tools/shared";
+import { interpretIntent, unresolvedFromClauses, FREE_FORM_INTENT_INTERPRETATION_VERSION, } from "audit-tools/shared";
 // ---------------------------------------------------------------------------
 // Internal helpers
 // ---------------------------------------------------------------------------
@@ -85,36 +89,18 @@ export function unresolvedConstraintClauses(checkpoint) {
     const result = interpretIntent(freeForm);
     if (!result.has_unencodable)
         return [];
-    // A clause is answered when an entry with a non-empty host_answer matches it
-    // by clause identity (preferred) or, for legacy entries lacking a clause_id,
-    // by the rendered checkpoint_question.
-    const answeredIds = new Set();
-    const answeredQuestions = new Set();
-    for (const c of checkpoint?.constraint_clauses ?? []) {
-        if (typeof c.host_answer !== "string" || c.host_answer.trim().length === 0) {
-            continue;
-        }
-        if (typeof c.clause_id === "string" && c.clause_id.length > 0) {
-            answeredIds.add(c.clause_id);
-        }
-        else {
-            answeredQuestions.add(c.checkpoint_question);
-        }
-    }
-    const unresolved = [];
+    const records = [];
     for (const clause of result.clauses) {
         if (clause.encodable || !clause.checkpoint_question)
             continue;
-        if (answeredIds.has(clause.clause_id))
-            continue;
-        if (answeredQuestions.has(clause.checkpoint_question))
-            continue;
-        unresolved.push({
+        records.push({
             clause_id: clause.clause_id,
             text: clause.text,
             checkpoint_question: clause.checkpoint_question,
         });
     }
-    return unresolved;
+    // Identity-keyed resolution (CE-004) is the shared core — one matcher for
+    // this gate and remediate's sidecar consumer.
+    return unresolvedFromClauses(records, checkpoint);
 }
 //# sourceMappingURL=intentInterpreter.js.map

package/dist/audit/orchestrator/intentInterpreter.js.map

@@ -1 +1 @@
-{"version":3,"file":"intentInterpreter.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/intentInterpreter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,eAAe,EACf,uCAAuC,GACxC,MAAM,oBAAoB,CAAC;AAQ5B,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,MAAM,cAAc,GAAG,yCAAyC,CAAC;AAEjE,gFAAgF;AAChF,SAAS,WAAW,CAAC,MAAc;IACjC,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAClC,oFAAoF;IACpF,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACzC,OAAO,KAAyB,CAAC;AACnC,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,+BAA+B,CAC7C,cAAsB;IAEtB,MAAM,MAAM,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;IAE/C,MAAM,eAAe,GAAoB,EAAE,CAAC;IAE5C,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,UAAU;YAAE,SAAS;QACtD,MAAM,KAAK,GAAkB;YAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI;YAC5B,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM;SACjC,CAAC;QACF,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACvC,IAAI,IAAI;gBAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QAC9B,CAAC;QACD,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO;QACL,cAAc,EAAE,uCAAuC;QACvD,eAAe;QACf,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,eAAe,EAAE,MAAM,CAAC,eAAe;KACxC,CAAC;AACJ,CAAC;AAsBD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,2BAA2B,CACzC,UAAwC;IAExC,MAAM,QAAQ,GAAG,UAAU,EAAE,gBAAgB,IAAI,EAAE,CAAC;IACpD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAEhC,+EAA+E;IAC/E,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,eAAe;QAAE,OAAO,EAAE,CAAC;IAEvC,6EAA6E;IAC7E,6EAA6E;IAC7E,uCAAuC;IACvC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,kBAAkB,IAAI,EAAE,EAAE,CAAC;QACrD,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3E,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9D,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAiC,EAAE,CAAC;IACpD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,mBAAmB;YAAE,SAAS;QAC9D,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC;YAAE,SAAS;QAChD,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC;YAAE,SAAS;QAChE,UAAU,CAAC,IAAI,CAAC;YACd,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;SAChD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}
+{"version":3,"file":"intentInterpreter.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/intentInterpreter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,uCAAuC,GACxC,MAAM,oBAAoB,CAAC;AAS5B,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,MAAM,cAAc,GAAG,yCAAyC,CAAC;AAEjE,gFAAgF;AAChF,SAAS,WAAW,CAAC,MAAc;IACjC,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAClC,oFAAoF;IACpF,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACzC,OAAO,KAAyB,CAAC;AACnC,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,+BAA+B,CAC7C,cAAsB;IAEtB,MAAM,MAAM,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;IAE/C,MAAM,eAAe,GAAoB,EAAE,CAAC;IAE5C,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,UAAU;YAAE,SAAS;QACtD,MAAM,KAAK,GAAkB;YAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI;YAC5B,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM;SACjC,CAAC;QACF,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACvC,IAAI,IAAI;gBAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QAC9B,CAAC;QACD,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO;QACL,cAAc,EAAE,uCAAuC;QACvD,eAAe;QACf,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,eAAe,EAAE,MAAM,CAAC,eAAe;KACxC,CAAC;AACJ,CAAC;AAeD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,2BAA2B,CACzC,UAAwC;IAExC,MAAM,QAAQ,GAAG,UAAU,EAAE,gBAAgB,IAAI,EAAE,CAAC;IACpD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAEhC,+EAA+E;IAC/E,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,eAAe;QAAE,OAAO,EAAE,CAAC;IAEvC,MAAM,OAAO,GAA6B,EAAE,CAAC;IAC7C,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,mBAAmB;YAAE,SAAS;QAC9D,OAAO,CAAC,IAAI,CAAC;YACX,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;SAChD,CAAC,CAAC;IACL,CAAC;IACD,0EAA0E;IAC1E,8CAA8C;IAC9C,OAAO,qBAAqB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACpD,CAAC"}

package/dist/audit/orchestrator/localCommands.d.ts

@@ -1,16 +1,39 @@
+import { type AnalyzerConsentDecisions } from "audit-tools/shared";
 export interface LocalCommandCandidate {
     command: string;
     args: string[];
     display?: string;
+    /**
+     * Explicit registry key for admission, for an arm whose argv cannot yield
+     * its real tool (`python -m black`, `uvx black`, `pipx run black`). Absent
+     * ⇒ the key derives from the full argv ({@link localToolIdFor}).
+     */
+    toolId?: string;
 }
 export interface LocalCommandResult {
     candidate: LocalCommandCandidate;
     exitCode: number | null;
     stdout: string;
     stderr: string;
+    /** The refusal reason when a recorded operator decline vetoed the candidate. */
+    declinedReason?: string;
     error?: Error;
 }
 export declare function __resolveFromPathForTests(command: string): string | null;
-export declare function runFirstAvailableCommand(root: string, candidates: LocalCommandCandidate[]): LocalCommandResult | null;
+/**
+ * Run the first resolvable, ADMITTED candidate. Admission is the shared
+ * decline-first veto ({@link admitLocalSpawn}): a recorded operator `declined`
+ * for this tool id refuses the spawn OUTRIGHT — the remaining candidates are
+ * still walked (a decline names ONE tool, not every formatter), so `prettier`
+ * being declined does not silently route formatting to `black`. The returned
+ * record carries `declinedReason` when a candidate was refused for that reason.
+ *
+ * Spawns go through the SHARED exec boundary (`runTracked`): argv-only, the
+ * control-env scrub applied, windowsHide forced — never a direct
+ * `node:child_process` call with the unscrubbed parent environment.
+ */
+export declare function runFirstAvailableCommand(root: string, candidates: LocalCommandCandidate[], options?: {
+    analyzerConsent?: AnalyzerConsentDecisions;
+}): LocalCommandResult | null;
 export declare function resolveNodeTool(root: string, relativePath: string, args: string[], display: string): LocalCommandCandidate[];
 //# sourceMappingURL=localCommands.d.ts.map

package/dist/audit/orchestrator/localCommands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"localCommands.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/localCommands.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,qBAAqB,CAAC;IACjC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAaD,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAExE;AA4ED,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,qBAAqB,EAAE,GAClC,kBAAkB,GAAG,IAAI,CAgC3B;AAED,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE,MAAM,GACd,qBAAqB,EAAE,CAWzB"}
+{"version":3,"file":"localCommands.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/localCommands.ts"],"names":[],"mappings":"AAEA,OAAO,EAIL,KAAK,wBAAwB,EAC9B,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,qBAAqB,CAAC;IACjC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAaD,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAExE;AA4ED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,qBAAqB,EAAE,EACnC,OAAO,GAAE;IAAE,eAAe,CAAC,EAAE,wBAAwB,CAAA;CAAO,GAC3D,kBAAkB,GAAG,IAAI,CA6D3B;AAED,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE,MAAM,GACd,qBAAqB,EAAE,CAWzB"}

package/dist/audit/orchestrator/localCommands.js

@@ -1,7 +1,6 @@
 import { existsSync } from "node:fs";
-import { spawnSync } from "node:child_process";
 import { delimiter, extname, isAbsolute, join } from "node:path";
-import { resolveExecArgv } from "audit-tools/shared";
+import { admitLocalSpawn, resolveExecArgv, runTracked, } from "audit-tools/shared";
 function toSpawnTuple(candidate) {
     // Shared resolver applies the single Windows `.cmd`/`.bat` wrapping impl.
     // The candidate command is already PATH-resolved (absolute path or
@@ -69,18 +68,42 @@ function resolveCandidate(root, candidate) {
     }
     return null;
 }
-export function runFirstAvailableCommand(root, candidates) {
+/**
+ * Run the first resolvable, ADMITTED candidate. Admission is the shared
+ * decline-first veto ({@link admitLocalSpawn}): a recorded operator `declined`
+ * for this tool id refuses the spawn OUTRIGHT — the remaining candidates are
+ * still walked (a decline names ONE tool, not every formatter), so `prettier`
+ * being declined does not silently route formatting to `black`. The returned
+ * record carries `declinedReason` when a candidate was refused for that reason.
+ *
+ * Spawns go through the SHARED exec boundary (`runTracked`): argv-only, the
+ * control-env scrub applied, windowsHide forced — never a direct
+ * `node:child_process` call with the unscrubbed parent environment.
+ */
+export function runFirstAvailableCommand(root, candidates, options = {}) {
+    let lastDecline;
     for (const candidate of candidates) {
+        // Decline-first admission, BEFORE resolution and before anything spawns. A
+        // recorded refusal is a veto for THIS tool wherever its executable resolves
+        // from — including the repo-local `node <script>` arm (the script is the
+        // key, never `node`). It runs ahead of resolution because whether the binary
+        // happens to be INSTALLED says nothing about whether the operator refused
+        // it: resolving first meant an absent tool reported `not_resolved` and the
+        // recorded decline was never consulted, so one policy read two ways on two
+        // machines.
+        const denied = admitLocalSpawn([candidate.command, ...candidate.args], options.analyzerConsent, candidate.toolId);
+        if (denied) {
+            lastDecline = denied;
+            continue;
+        }
         const resolved = resolveCandidate(root, candidate);
         if (!resolved) {
             continue;
         }
         const spawnTarget = toSpawnTuple(resolved);
-        const result = spawnSync(spawnTarget.command, spawnTarget.args, {
+        const result = runTracked([spawnTarget.command, ...spawnTarget.args], {
             cwd: root,
-            env: process.env,
             encoding: "utf8",
-            windowsHide: true,
             stdio: "pipe",
         });
         return {
@@ -89,14 +112,26 @@ export function runFirstAvailableCommand(root, candidates) {
                 display: candidate.display ?? [candidate.command, ...candidate.args].join(" "),
             },
             exitCode: result.status,
-            stdout: result.stdout ?? "",
-            stderr: result.stderr ?? "",
+            stdout: result.stdout,
+            stderr: result.stderr,
             error: result.error
                 ? new Error(result.error.message, { cause: result.error })
                 : undefined,
         };
     }
-    return null;
+    return lastDecline
+        ? {
+            candidate: {
+                command: "",
+                args: [],
+                display: "(all candidates declined or unresolved)",
+            },
+            exitCode: null,
+            stdout: "",
+            stderr: "",
+            declinedReason: lastDecline,
+        }
+        : null;
 }
 export function resolveNodeTool(root, relativePath, args, display) {
     const localToolPath = join(root, relativePath);

package/dist/audit/orchestrator/localCommands.js.map

@@ -1 +1 @@
-{"version":3,"file":"localCommands.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/localCommands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAgBrD,SAAS,YAAY,CAAC,SAAgC;IAIpD,0EAA0E;IAC1E,mEAAmE;IACnE,sEAAsE;IACtE,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IACE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrB,UAAU,CAAC,OAAO,CAAC,EACnB,CAAC;QACD,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,SAAS;SAC1B,KAAK,CAAC,SAAS,CAAC;SAChB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvC,MAAM,UAAU,GACd,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC1B,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,qBAAqB,CAAC;aAC3C,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aACtC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;aAC/B,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAEX,0EAA0E;IAC1E,6EAA6E;IAC7E,oEAAoE;IACpE,MAAM,mBAAmB,GACvB,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;QAC3D,CAAC,CAAC,CAAC,GAAG,UAAU,EAAE,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAEX,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;YACtC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC;YACpD,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC9B,OAAO,aAAa,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CACvB,IAAY,EACZ,SAAgC;IAEhC,IAAI,SAAS,CAAC,OAAO,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,YAAY,GAAG,eAAe,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO;YACL,GAAG,SAAS;YACZ,OAAO,EAAE,YAAY;SACtB,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,GAAG,SAAS;YACZ,OAAO,EAAE,aAAa;SACvB,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,IAAY,EACZ,UAAmC;IAEnC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,SAAS;QACX,CAAC;QAED,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,EAAE;YAC9D,GAAG,EAAE,IAAI;YACT,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,QAAQ,EAAE,MAAM;YAChB,WAAW,EAAE,IAAI;YACjB,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;QAEH,OAAO;YACL,SAAS,EAAE;gBACT,GAAG,QAAQ;gBACX,OAAO,EACL,SAAS,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;aACxE;YACD,QAAQ,EAAE,MAAM,CAAC,MAAM;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;gBACjB,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;gBAC1D,CAAC,CAAC,SAAS;SACd,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,YAAoB,EACpB,IAAc,EACd,OAAe;IAEf,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC/C,MAAM,UAAU,GAA4B,EAAE,CAAC;IAC/C,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9B,UAAU,CAAC,IAAI,CAAC;YACd,OAAO,EAAE,OAAO,CAAC,QAAQ;YACzB,IAAI,EAAE,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC;YAC9B,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}
+{"version":3,"file":"localCommands.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/localCommands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EACL,eAAe,EACf,eAAe,EACf,UAAU,GAEX,MAAM,oBAAoB,CAAC;AAwB5B,SAAS,YAAY,CAAC,SAAgC;IAIpD,0EAA0E;IAC1E,mEAAmE;IACnE,sEAAsE;IACtE,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IACE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrB,UAAU,CAAC,OAAO,CAAC,EACnB,CAAC;QACD,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,SAAS;SAC1B,KAAK,CAAC,SAAS,CAAC;SAChB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvC,MAAM,UAAU,GACd,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC1B,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,qBAAqB,CAAC;aAC3C,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aACtC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;aAC/B,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAEX,0EAA0E;IAC1E,6EAA6E;IAC7E,oEAAoE;IACpE,MAAM,mBAAmB,GACvB,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;QAC3D,CAAC,CAAC,CAAC,GAAG,UAAU,EAAE,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAEX,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;YACtC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC;YACpD,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC9B,OAAO,aAAa,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CACvB,IAAY,EACZ,SAAgC;IAEhC,IAAI,SAAS,CAAC,OAAO,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,YAAY,GAAG,eAAe,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO;YACL,GAAG,SAAS;YACZ,OAAO,EAAE,YAAY;SACtB,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,GAAG,SAAS;YACZ,OAAO,EAAE,aAAa;SACvB,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAY,EACZ,UAAmC,EACnC,UAA0D,EAAE;IAE5D,IAAI,WAA+B,CAAC;IACpC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,2EAA2E;QAC3E,4EAA4E;QAC5E,yEAAyE;QACzE,6EAA6E;QAC7E,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,YAAY;QACZ,MAAM,MAAM,GAAG,eAAe,CAC5B,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,EACtC,OAAO,CAAC,eAAe,EACvB,SAAS,CAAC,MAAM,CACjB,CAAC;QACF,IAAI,MAAM,EAAE,CAAC;YACX,WAAW,GAAG,MAAM,CAAC;YACrB,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,SAAS;QACX,CAAC;QAED,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE;YACpE,GAAG,EAAE,IAAI;YACT,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;QAEH,OAAO;YACL,SAAS,EAAE;gBACT,GAAG,QAAQ;gBACX,OAAO,EACL,SAAS,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;aACxE;YACD,QAAQ,EAAE,MAAM,CAAC,MAAM;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACjB,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;gBAC1D,CAAC,CAAC,SAAS;SACd,CAAC;IACJ,CAAC;IAED,OAAO,WAAW;QAChB,CAAC,CAAC;YACE,SAAS,EAAE;gBACT,OAAO,EAAE,EAAE;gBACX,IAAI,EAAE,EAAE;gBACR,OAAO,EAAE,yCAAyC;aACnD;YACD,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,cAAc,EAAE,WAAW;SAC5B;QACH,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,YAAoB,EACpB,IAAc,EACd,OAAe;IAEf,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC/C,MAAM,UAAU,GAA4B,EAAE,CAAC;IAC/C,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9B,UAAU,CAAC,IAAI,CAAC;YACd,OAAO,EAAE,OAAO,CAAC,QAAQ;YACzB,IAAI,EAAE,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC;YAC9B,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/audit/orchestrator/nextStep.d.ts

@@ -26,6 +26,19 @@ export interface DecideNextStepOptions {
     emitStaleness?: boolean;
 }
 export declare function decideNextStep(bundle: ArtifactBundle, options?: DecideNextStepOptions): NextStepDecision;
+/**
+ * The audit friction record's own key. Audit keeps ONE friction record per artifacts
+ * dir — its step envelopes carry no per-run id — so the key is a fixed literal rather
+ * than a minted run id. Single-sourced here beside the close-out that reads it, so the
+ * capture seams, the close-out, the run-linkage writers, and the operator handoff's
+ * `friction_record` path cannot spell it differently. Two source sites still write the
+ * derived record path out as a literal, each because a mechanical reader requires one
+ * there: `friction_capture_executor`'s `artifacts_written` (executorRunners.ts), read
+ * structurally by the write-site extractor, and the same executor's
+ * `produces[].artifact` in EXECUTOR_REGISTRY (executors.ts), whose producer generator
+ * refuses any non-string-literal initializer. DECL-10 pins BOTH against this constant.
+ */
+export declare const AUDIT_FRICTION_RUN_ID = "run";
 /**
  * Terminal friction-TRIAGE close-out for audit. Folded into the `present_report`
  * terminal step (not a separate executor) so it fires at exactly the right moment.

package/dist/audit/orchestrator/nextStep.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nextStep.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/nextStep.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAI1E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,UAAU,CAAC;IAClB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,6BAA6B,CAAC;AAEzE,eAAO,MAAM,QAAQ,EAAE,MAAM,EAuC5B,CAAC;AAkCF,wBAAgB,cAAc,CAC5B,WAAW,EAAE,eAAe,EAAE,GAC7B,eAAe,GAAG,SAAS,CAE7B;AAED,oCAAoC;AACpC,MAAM,WAAW,qBAAqB;IACpC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,wBAAgB,cAAc,CAC5B,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,qBAA0B,GAClC,gBAAgB,CAqClB;AAED;;;;;;GAMG;AACH,wBAAsB,2BAA2B,CAC/C,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,sBAAsB,CAAC,CAEjC"}
+{"version":3,"file":"nextStep.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/nextStep.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAI1E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,UAAU,CAAC;IAClB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,6BAA6B,CAAC;AAEzE,eAAO,MAAM,QAAQ,EAAE,MAAM,EAuC5B,CAAC;AAkCF,wBAAgB,cAAc,CAC5B,WAAW,EAAE,eAAe,EAAE,GAC7B,eAAe,GAAG,SAAS,CAE7B;AAED,oCAAoC;AACpC,MAAM,WAAW,qBAAqB;IACpC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,wBAAgB,cAAc,CAC5B,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,qBAA0B,GAClC,gBAAgB,CAqClB;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAE3C;;;;;;GAMG;AACH,wBAAsB,2BAA2B,CAC/C,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,sBAAsB,CAAC,CAEjC"}

package/dist/audit/orchestrator/nextStep.js

@@ -110,6 +110,19 @@ export function decideNextStep(bundle, options = {}) {
             : `No executor found for obligation ${next.id}; EXECUTOR_REGISTRY has no entry for this obligation ID. This is a configuration gap — the obligation was selected but cannot be dispatched.`,
     };
 }
+/**
+ * The audit friction record's own key. Audit keeps ONE friction record per artifacts
+ * dir — its step envelopes carry no per-run id — so the key is a fixed literal rather
+ * than a minted run id. Single-sourced here beside the close-out that reads it, so the
+ * capture seams, the close-out, the run-linkage writers, and the operator handoff's
+ * `friction_record` path cannot spell it differently. Two source sites still write the
+ * derived record path out as a literal, each because a mechanical reader requires one
+ * there: `friction_capture_executor`'s `artifacts_written` (executorRunners.ts), read
+ * structurally by the write-site extractor, and the same executor's
+ * `produces[].artifact` in EXECUTOR_REGISTRY (executors.ts), whose producer generator
+ * refuses any non-string-literal initializer. DECL-10 pins BOTH against this constant.
+ */
+export const AUDIT_FRICTION_RUN_ID = "run";
 /**
  * Terminal friction-TRIAGE close-out for audit. Folded into the `present_report`
  * terminal step (not a separate executor) so it fires at exactly the right moment.

package/dist/audit/orchestrator/nextStep.js.map

@@ -1 +1 @@
-{"version":3,"file":"nextStep.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/nextStep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EACL,oBAAoB,GAErB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAS9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,0BAA0B,CAAC;AAEzE,MAAM,CAAC,MAAM,QAAQ,GAAa;IAChC,eAAe;IACf,kBAAkB;IAClB,oBAAoB;IACpB,iBAAiB;IACjB,4BAA4B;IAC5B,qBAAqB;IACrB,gCAAgC;IAChC,0BAA0B;IAC1B,2BAA2B;IAC3B,iCAAiC;IACjC,yEAAyE;IACzE,2EAA2E;IAC3E,wEAAwE;IACxE,uCAAuC;IACvC,qBAAqB;IACrB,2BAA2B;IAC3B,4EAA4E;IAC5E,6EAA6E;IAC7E,oEAAoE;IACpE,4BAA4B;IAC5B,4BAA4B;IAC5B,uBAAuB;IACvB,kCAAkC;IAClC,oCAAoC;IACpC,+BAA+B;IAC/B,4BAA4B;IAC5B,oBAAoB;IACpB,uBAAuB;IACvB,wBAAwB;IACxB,4BAA4B;IAC5B,mBAAmB;IACnB,6BAA6B;IAC7B,gFAAgF;IAChF,kFAAkF;IAClF,+EAA+E;IAC/E,yEAAyE;IACzE,mFAAmF;IACnF,8BAA8B;CAC/B,CAAC;AAEF;;;;;;;GAOG;AACH,SAAS,oCAAoC;IAC3C,KAAK,MAAM,YAAY,IAAI,QAAQ,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CACnD,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,YAAY,CAAC,CAC/C,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,6DAA6D,YAAY,4GAA4G,CACtL,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,qDAAqD,YAAY,qCAAqC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,sDAAsD,CAC/L,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,oCAAoC,EAAE,CAAC;AAEvC,2EAA2E;AAC3E,8EAA8E;AAC9E,+EAA+E;AAC/E,sDAAsD;AACtD,MAAM,UAAU,cAAc,CAC5B,WAA8B;IAE9B,OAAO,6BAA6B,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AAC9D,CAAC;AAaD,MAAM,UAAU,cAAc,CAC5B,MAAsB,EACtB,UAAiC,EAAE;IAEnC,4EAA4E;IAC5E,kEAAkE;IAClE,IAAI,MAAM,CAAC,WAAW,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QAC9C,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,WAAW;YACzB,mBAAmB,EAAE,IAAI;YACzB,iBAAiB,EAAE,IAAI;YACvB,MAAM,EAAE,gDAAgD;SACzD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,EAAE;QACrC,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;KAC7C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAE/C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,KAAK;YACL,mBAAmB,EAAE,IAAI;YACzB,iBAAiB,EAAE,IAAI;YACvB,MAAM,EACJ,KAAK,CAAC,MAAM,KAAK,UAAU;gBACzB,CAAC,CAAC,gDAAgD;gBAClD,CAAC,CAAC,6CAA6C;SACpD,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrD,OAAO;QACL,KAAK;QACL,mBAAmB,EAAE,IAAI,CAAC,EAAE;QAC5B,iBAAiB,EAAE,QAAQ,EAAE,EAAE,IAAI,IAAI;QACvC,MAAM,EAAE,QAAQ;YACd,CAAC,CAAC,mDAAmD,IAAI,CAAC,EAAE,GAAG;YAC/D,CAAC,CAAC,oCAAoC,IAAI,CAAC,EAAE,8IAA8I;KAC9L,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,YAAoB,EACpB,KAAa;IAEb,OAAO,oBAAoB,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;AACjE,CAAC"}
+{"version":3,"file":"nextStep.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/nextStep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EACL,oBAAoB,GAErB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAS9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,0BAA0B,CAAC;AAEzE,MAAM,CAAC,MAAM,QAAQ,GAAa;IAChC,eAAe;IACf,kBAAkB;IAClB,oBAAoB;IACpB,iBAAiB;IACjB,4BAA4B;IAC5B,qBAAqB;IACrB,gCAAgC;IAChC,0BAA0B;IAC1B,2BAA2B;IAC3B,iCAAiC;IACjC,yEAAyE;IACzE,2EAA2E;IAC3E,wEAAwE;IACxE,uCAAuC;IACvC,qBAAqB;IACrB,2BAA2B;IAC3B,4EAA4E;IAC5E,6EAA6E;IAC7E,oEAAoE;IACpE,4BAA4B;IAC5B,4BAA4B;IAC5B,uBAAuB;IACvB,kCAAkC;IAClC,oCAAoC;IACpC,+BAA+B;IAC/B,4BAA4B;IAC5B,oBAAoB;IACpB,uBAAuB;IACvB,wBAAwB;IACxB,4BAA4B;IAC5B,mBAAmB;IACnB,6BAA6B;IAC7B,gFAAgF;IAChF,kFAAkF;IAClF,+EAA+E;IAC/E,yEAAyE;IACzE,mFAAmF;IACnF,8BAA8B;CAC/B,CAAC;AAEF;;;;;;;GAOG;AACH,SAAS,oCAAoC;IAC3C,KAAK,MAAM,YAAY,IAAI,QAAQ,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CACnD,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,YAAY,CAAC,CAC/C,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,6DAA6D,YAAY,4GAA4G,CACtL,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,qDAAqD,YAAY,qCAAqC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,sDAAsD,CAC/L,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,oCAAoC,EAAE,CAAC;AAEvC,2EAA2E;AAC3E,8EAA8E;AAC9E,+EAA+E;AAC/E,sDAAsD;AACtD,MAAM,UAAU,cAAc,CAC5B,WAA8B;IAE9B,OAAO,6BAA6B,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AAC9D,CAAC;AAaD,MAAM,UAAU,cAAc,CAC5B,MAAsB,EACtB,UAAiC,EAAE;IAEnC,4EAA4E;IAC5E,kEAAkE;IAClE,IAAI,MAAM,CAAC,WAAW,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QAC9C,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,WAAW;YACzB,mBAAmB,EAAE,IAAI;YACzB,iBAAiB,EAAE,IAAI;YACvB,MAAM,EAAE,gDAAgD;SACzD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,EAAE;QACrC,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;KAC7C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAE/C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,KAAK;YACL,mBAAmB,EAAE,IAAI;YACzB,iBAAiB,EAAE,IAAI;YACvB,MAAM,EACJ,KAAK,CAAC,MAAM,KAAK,UAAU;gBACzB,CAAC,CAAC,gDAAgD;gBAClD,CAAC,CAAC,6CAA6C;SACpD,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrD,OAAO;QACL,KAAK;QACL,mBAAmB,EAAE,IAAI,CAAC,EAAE;QAC5B,iBAAiB,EAAE,QAAQ,EAAE,EAAE,IAAI,IAAI;QACvC,MAAM,EAAE,QAAQ;YACd,CAAC,CAAC,mDAAmD,IAAI,CAAC,EAAE,GAAG;YAC/D,CAAC,CAAC,oCAAoC,IAAI,CAAC,EAAE,8IAA8I;KAC9L,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,YAAoB,EACpB,KAAa;IAEb,OAAO,oBAAoB,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;AACjE,CAAC"}

package/dist/audit/orchestrator/requeueCommand.d.ts

@@ -24,8 +24,8 @@ export declare function buildRequeuePayload(matrix: CoverageMatrix, criticalFlow
         inputs?: Record<string, string> | undefined;
         line_ranges?: {
             path: string;
-            start: number;
             end: number;
+            start: number;
         }[] | undefined;
         priority?: "high" | "low" | "medium" | undefined;
         risk_estimate?: number | undefined;

package/dist/audit/orchestrator/runtimeCommand.d.ts

@@ -1,4 +1,35 @@
-export declare function runCommand(command: string[], cwd: string): Promise<{
+/**
+ * The bounded wait every runtime-validation command runs under.
+ *
+ * Stated ONCE and exported so no call site writes its own number: a bound
+ * hard-coded per caller is how two callers end up disagreeing about how long
+ * "too long" is, and the drain's progress guarantee then depends on which one
+ * you happened to read. Generous, because a validation command is host-authored
+ * and may legitimately be a whole suite — what matters is that it is FINITE.
+ */
+export declare const RUNTIME_COMMAND_TIMEOUT_MS: number;
+/**
+ * Terminate a timed-out child, INCLUDING anything it spawned.
+ *
+ * On win32 this runner wraps package-manager shims in `cmd.exe /d /s /c` (see
+ * `resolveRuntimeValidationSpawnCommand`), so the process we hold a handle to is
+ * the shell, not the tool: `child.kill()` reaps the wrapper and leaves the npm →
+ * node grandchildren running, which is the orphan case the bound exists to
+ * prevent. `taskkill /T` walks the tree instead. Everywhere else the executable
+ * is spawned DIRECTLY — no wrapper, so no tree of our making — and the signal
+ * pair is the whole story. A command that itself forks a daemon on POSIX is
+ * beyond what this can promise without a process group, and is left stated
+ * rather than silently assumed.
+ *
+ * `platform` is a parameter so both branches are reachable from a test on either
+ * OS; the taskkill spawn failing (absent, denied) falls back to SIGKILL rather
+ * than leaving the child alive.
+ */
+export declare function killRuntimeCommandTree(child: {
+    pid?: number;
+    kill: (signal?: NodeJS.Signals) => boolean;
+}, platform?: NodeJS.Platform): void;
+export declare function runCommand(command: string[], cwd: string, timeoutMs?: number): Promise<{
     status: "confirmed" | "not_confirmed" | "inconclusive";
     summary: string;
     evidence: string[];

package/dist/audit/orchestrator/runtimeCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtimeCommand.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/runtimeCommand.ts"],"names":[],"mappings":"AAqBA,wBAAsB,UAAU,CAC9B,OAAO,EAAE,MAAM,EAAE,EACjB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IACT,MAAM,EAAE,WAAW,GAAG,eAAe,GAAG,cAAc,CAAC;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC,CAuED;AAED,wBAAgB,oCAAoC,CAClD,OAAO,EAAE,MAAM,EAAE,EACjB,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,YAAY,SAAmC,GAC9C;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAkDrC"}
+{"version":3,"file":"runtimeCommand.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/runtimeCommand.ts"],"names":[],"mappings":"AAqBA;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,QAAkB,CAAC;AAQ1D;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,OAAO,KAAK,OAAO,CAAA;CAAE,EACnE,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,IAAI,CAYN;AAED,wBAAsB,UAAU,CAC9B,OAAO,EAAE,MAAM,EAAE,EACjB,GAAG,EAAE,MAAM,EACX,SAAS,GAAE,MAAmC,GAC7C,OAAO,CAAC;IACT,MAAM,EAAE,WAAW,GAAG,eAAe,GAAG,cAAc,CAAC;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC,CA+GD;AAED,wBAAgB,oCAAoC,CAClD,OAAO,EAAE,MAAM,EAAE,EACjB,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,YAAY,SAAmC,GAC9C;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAkDrC"}

package/dist/audit/orchestrator/runtimeCommand.js

@@ -13,7 +13,52 @@ import { quoteForShellInterpreterCmd, stripAuditToolsControlEnv, } from "audit-t
 // This strips the host-signaling env vars so a runtime-validation command sees a
 // clean environment — a suite that branches on CLAUDECODE would otherwise be graded
 // against the host's interactive-session state, marking healthy code "not_confirmed".
-export async function runCommand(command, cwd) {
+/**
+ * The bounded wait every runtime-validation command runs under.
+ *
+ * Stated ONCE and exported so no call site writes its own number: a bound
+ * hard-coded per caller is how two callers end up disagreeing about how long
+ * "too long" is, and the drain's progress guarantee then depends on which one
+ * you happened to read. Generous, because a validation command is host-authored
+ * and may legitimately be a whole suite — what matters is that it is FINITE.
+ */
+export const RUNTIME_COMMAND_TIMEOUT_MS = 10 * 60 * 1_000;
+/**
+ * Grace between the polite stop and the unignorable one. SIGTERM is a request a
+ * child may ignore; without the escalation the "bound" would be advisory.
+ */
+const KILL_ESCALATION_GRACE_MS = 2_000;
+/**
+ * Terminate a timed-out child, INCLUDING anything it spawned.
+ *
+ * On win32 this runner wraps package-manager shims in `cmd.exe /d /s /c` (see
+ * `resolveRuntimeValidationSpawnCommand`), so the process we hold a handle to is
+ * the shell, not the tool: `child.kill()` reaps the wrapper and leaves the npm →
+ * node grandchildren running, which is the orphan case the bound exists to
+ * prevent. `taskkill /T` walks the tree instead. Everywhere else the executable
+ * is spawned DIRECTLY — no wrapper, so no tree of our making — and the signal
+ * pair is the whole story. A command that itself forks a daemon on POSIX is
+ * beyond what this can promise without a process group, and is left stated
+ * rather than silently assumed.
+ *
+ * `platform` is a parameter so both branches are reachable from a test on either
+ * OS; the taskkill spawn failing (absent, denied) falls back to SIGKILL rather
+ * than leaving the child alive.
+ */
+export function killRuntimeCommandTree(child, platform = process.platform) {
+    if (platform === "win32" && child.pid !== undefined) {
+        const reaper = spawn("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
+            stdio: "ignore",
+            windowsHide: true,
+        });
+        reaper.on("error", () => {
+            child.kill("SIGKILL");
+        });
+        return;
+    }
+    child.kill("SIGTERM");
+}
+export async function runCommand(command, cwd, timeoutMs = RUNTIME_COMMAND_TIMEOUT_MS) {
     // COR-4a8d9779: fast-fail before spawn so an empty command array produces a
     // descriptive error instead of an ENOENT from spawn("", ...).
     if (command.length === 0 || !command[0]) {
@@ -42,7 +87,38 @@ export async function runCommand(command, cwd) {
         });
         let exitCode = null;
         let exitSignal = null;
+        // Set when THIS runner's bound fired, so `close` can report a timeout rather
+        // than reporting the kill it caused as an ordinary signal death.
+        let timedOut = false;
+        let escalation = null;
+        const deadline = timeoutMs > 0
+            ? setTimeout(() => {
+                timedOut = true;
+                killRuntimeCommandTree(child);
+                // SIGTERM is a request; a child that installs a handler and ignores
+                // it would never emit `close`, and the bound would be a bound in
+                // name only. `unref` so a child that does exit promptly never holds
+                // the event loop open waiting for this.
+                escalation = setTimeout(() => {
+                    child.kill("SIGKILL");
+                }, KILL_ESCALATION_GRACE_MS);
+                escalation.unref?.();
+            }, timeoutMs)
+            : null;
+        /**
+         * Clear BOTH timers on every resolution path. A deadline left armed after an
+         * early exit is a leaked handle that can hold the process open past the work
+         * it was watching — the reason this is one function rather than a line
+         * repeated in each branch.
+         */
+        const clearTimers = () => {
+            if (deadline)
+                clearTimeout(deadline);
+            if (escalation)
+                clearTimeout(escalation);
+        };
         child.on("error", (error) => {
+            clearTimers();
             const output = `${stdout}\n${stderr}`.trim();
             const lines = output.length > 0 ? output.split(/\r?\n/) : [];
             const truncated = lines.length > 10;
@@ -60,15 +136,26 @@ export async function runCommand(command, cwd) {
             exitSignal = signal;
         });
         child.on("close", () => {
+            clearTimers();
             const output = `${stdout}\n${stderr}`.trim();
             const lines = output.length > 0 ? output.split(/\r?\n/) : [];
             const truncated = lines.length > 10;
             const evidence = truncated
                 ? [`[... truncated: showing last 10 of ${lines.length} lines ...]`, ...lines.slice(-10)]
                 : lines;
-            const succeeded = exitCode === 0;
+            const succeeded = exitCode === 0 && !timedOut;
             let summary;
-            if (succeeded) {
+            if (timedOut) {
+                // NAMED as a timeout, ahead of the exit-code branches: the child died of
+                // the kill this runner sent, so its code/signal describe our own bound,
+                // not the command's verdict. Reporting "terminated by SIGKILL" here
+                // would attribute the runner's action to the code under validation, and
+                // a caller triaging the failure could not tell a hang from a crash.
+                summary =
+                    `Deterministic runtime command timed out after ${String(timeoutMs)}ms and was killed: ` +
+                        `${displayCommand}`;
+            }
+            else if (succeeded) {
                 summary = `Deterministic runtime command succeeded: ${displayCommand}`;
             }
             else if (exitCode !== null) {

package/dist/audit/orchestrator/runtimeCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtimeCommand.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/runtimeCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAE5B,6EAA6E;AAC7E,0EAA0E;AAC1E,+EAA+E;AAC/E,6EAA6E;AAC7E,iBAAiB;AACjB,EAAE;AACF,8EAA8E;AAC9E,2DAA2D;AAE3D,2EAA2E;AAC3E,6EAA6E;AAC7E,iFAAiF;AACjF,oFAAoF;AACpF,sFAAsF;AAEtF,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAiB,EACjB,GAAW;IAMX,4EAA4E;IAC5E,8DAA8D;IAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,OAAO,EAAE,6DAA6D;YACtE,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,oCAAoC,CAAC,OAAO,CAAC,CAAC;IACnE,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACnC,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,EAAE;YAC3D,GAAG;YACH,GAAG,EAAE,yBAAyB,EAAE;YAChC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAChC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAChC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,IAAI,UAAU,GAA0B,IAAI,CAAC;QAC7C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,MAAM,MAAM,GAAG,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,SAAS;gBACxB,CAAC,CAAC,CAAC,sCAAsC,KAAK,CAAC,MAAM,aAAa,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxF,CAAC,CAAC,KAAK,CAAC;YACV,OAAO,CAAC;gBACN,MAAM,EAAE,cAAc;gBACtB,OAAO,EAAE,qBAAqB,cAAc,KAAK,KAAK,CAAC,OAAO,EAAE;gBAChE,QAAQ;aACT,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAChC,QAAQ,GAAG,IAAI,CAAC;YAChB,UAAU,GAAG,MAAM,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACrB,MAAM,MAAM,GAAG,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,SAAS;gBACxB,CAAC,CAAC,CAAC,sCAAsC,KAAK,CAAC,MAAM,aAAa,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxF,CAAC,CAAC,KAAK,CAAC;YACV,MAAM,SAAS,GAAG,QAAQ,KAAK,CAAC,CAAC;YACjC,IAAI,OAAe,CAAC;YACpB,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,GAAG,4CAA4C,cAAc,EAAE,CAAC;YACzE,CAAC;iBAAM,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC7B,OAAO,GAAG,uDAAuD,QAAQ,KAAK,cAAc,EAAE,CAAC;YACjG,CAAC;iBAAM,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;gBAC/B,OAAO,GAAG,sDAAsD,UAAU,KAAK,cAAc,EAAE,CAAC;YAClG,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,6DAA6D,cAAc,EAAE,CAAC;YAC1F,CAAC;YACD,OAAO,CAAC;gBACN,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe;gBACjD,OAAO;gBACP,QAAQ;aACT,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,OAAiB,EACjB,WAA4B,OAAO,CAAC,QAAQ,EAC5C,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS;IAE/C,MAAM,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC;IACtC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE,MAAM;YACZ,UAAU;YACV,QAAQ;YACR,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC7B,CAAC,GAAG,IAAI,CACV,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;IACD,8EAA8E;IAC9E,kFAAkF;IAClF,mFAAmF;IACnF,iFAAiF;IACjF,yBAAyB;IACzB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC;IAC/D,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3E,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE,SAAS;YACf,UAAU;YACV,aAAa,EAAE,YAAY;YAC3B,QAAQ;YACR,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC7B,CAAC,GAAG,IAAI,CACV,CAAC;QACF,OAAO;YACL,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;SAC7E,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;QACb,IAAI,EAAE,wBAAwB;QAC9B,IAAI,EAAE,MAAM;QACZ,UAAU;QACV,QAAQ;QACR,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC7B,CAAC,GAAG,IAAI,CACV,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC"}
+{"version":3,"file":"runtimeCommand.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/runtimeCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAE5B,6EAA6E;AAC7E,0EAA0E;AAC1E,+EAA+E;AAC/E,6EAA6E;AAC7E,iBAAiB;AACjB,EAAE;AACF,8EAA8E;AAC9E,2DAA2D;AAE3D,2EAA2E;AAC3E,6EAA6E;AAC7E,iFAAiF;AACjF,oFAAoF;AACpF,sFAAsF;AAEtF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AAE1D;;;GAGG;AACH,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAEvC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAmE,EACnE,WAA4B,OAAO,CAAC,QAAQ;IAE5C,IAAI,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;YACxE,KAAK,EAAE,QAAQ;YACf,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACtB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAiB,EACjB,GAAW,EACX,YAAoB,0BAA0B;IAM9C,4EAA4E;IAC5E,8DAA8D;IAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,OAAO,EAAE,6DAA6D;YACtE,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,oCAAoC,CAAC,OAAO,CAAC,CAAC;IACnE,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACnC,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,EAAE;YAC3D,GAAG;YACH,GAAG,EAAE,yBAAyB,EAAE;YAChC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAChC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAChC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,IAAI,UAAU,GAA0B,IAAI,CAAC;QAC7C,6EAA6E;QAC7E,iEAAiE;QACjE,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,UAAU,GAA0B,IAAI,CAAC;QAC7C,MAAM,QAAQ,GACZ,SAAS,GAAG,CAAC;YACX,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE;gBACd,QAAQ,GAAG,IAAI,CAAC;gBAChB,sBAAsB,CAAC,KAAK,CAAC,CAAC;gBAC9B,oEAAoE;gBACpE,iEAAiE;gBACjE,oEAAoE;gBACpE,wCAAwC;gBACxC,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC3B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACxB,CAAC,EAAE,wBAAwB,CAAC,CAAC;gBAC7B,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC;YACvB,CAAC,EAAE,SAAS,CAAC;YACf,CAAC,CAAC,IAAI,CAAC;QACX;;;;;WAKG;QACH,MAAM,WAAW,GAAG,GAAS,EAAE;YAC7B,IAAI,QAAQ;gBAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,UAAU;gBAAE,YAAY,CAAC,UAAU,CAAC,CAAC;QAC3C,CAAC,CAAC;QACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,WAAW,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,SAAS;gBACxB,CAAC,CAAC,CAAC,sCAAsC,KAAK,CAAC,MAAM,aAAa,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxF,CAAC,CAAC,KAAK,CAAC;YACV,OAAO,CAAC;gBACN,MAAM,EAAE,cAAc;gBACtB,OAAO,EAAE,qBAAqB,cAAc,KAAK,KAAK,CAAC,OAAO,EAAE;gBAChE,QAAQ;aACT,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAChC,QAAQ,GAAG,IAAI,CAAC;YAChB,UAAU,GAAG,MAAM,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACrB,WAAW,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,SAAS;gBACxB,CAAC,CAAC,CAAC,sCAAsC,KAAK,CAAC,MAAM,aAAa,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxF,CAAC,CAAC,KAAK,CAAC;YACV,MAAM,SAAS,GAAG,QAAQ,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC9C,IAAI,OAAe,CAAC;YACpB,IAAI,QAAQ,EAAE,CAAC;gBACb,yEAAyE;gBACzE,wEAAwE;gBACxE,oEAAoE;gBACpE,wEAAwE;gBACxE,oEAAoE;gBACpE,OAAO;oBACL,iDAAiD,MAAM,CAAC,SAAS,CAAC,qBAAqB;wBACvF,GAAG,cAAc,EAAE,CAAC;YACxB,CAAC;iBAAM,IAAI,SAAS,EAAE,CAAC;gBACrB,OAAO,GAAG,4CAA4C,cAAc,EAAE,CAAC;YACzE,CAAC;iBAAM,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC7B,OAAO,GAAG,uDAAuD,QAAQ,KAAK,cAAc,EAAE,CAAC;YACjG,CAAC;iBAAM,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;gBAC/B,OAAO,GAAG,sDAAsD,UAAU,KAAK,cAAc,EAAE,CAAC;YAClG,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,6DAA6D,cAAc,EAAE,CAAC;YAC1F,CAAC;YACD,OAAO,CAAC;gBACN,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe;gBACjD,OAAO;gBACP,QAAQ;aACT,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,OAAiB,EACjB,WAA4B,OAAO,CAAC,QAAQ,EAC5C,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS;IAE/C,MAAM,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC;IACtC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE,MAAM;YACZ,UAAU;YACV,QAAQ;YACR,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC7B,CAAC,GAAG,IAAI,CACV,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;IACD,8EAA8E;IAC9E,kFAAkF;IAClF,mFAAmF;IACnF,iFAAiF;IACjF,yBAAyB;IACzB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC;IAC/D,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3E,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE,SAAS;YACf,UAAU;YACV,aAAa,EAAE,YAAY;YAC3B,QAAQ;YACR,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC7B,CAAC,GAAG,IAAI,CACV,CAAC;QACF,OAAO;YACL,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;SAC7E,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;QACb,IAAI,EAAE,wBAAwB;QAC9B,IAAI,EAAE,MAAM;QACZ,UAAU;QACV,QAAQ;QACR,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC7B,CAAC,GAAG,IAAI,CACV,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC"}

package/dist/audit/orchestrator/structureExecutors.js

@@ -54,7 +54,7 @@ export async function runStructureExecutor(bundle, root) {
     // co_change bucket as defense-in-depth).
     const graphSignals = deriveGraphSignals(graphBundle);
     const baseRiskRegister = buildRiskRegister(unitManifest, criticalFlows, externalAnalyzerResults, graphSignals);
-    // F6 — git-history mining. A deterministic, language-neutral extraction source
+    // Git-history mining. A deterministic, language-neutral extraction source
     // (degrades to empty without a root / git): co-change coupling the dependency
     // graph misses, churn + authorship-breadth risk signals, and the churn ×
     // complexity compound (the real risk concentration). Merged through the shared

package/dist/audit/orchestrator/structureExecutors.js.map

@@ -1 +1 @@
-{"version":3,"file":"structureExecutors.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/structureExecutors.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,8BAA8B,GAE/B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,2BAA2B,EAAE,MAAM,6CAA6C,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAGnE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAsB,EACtB,IAAa;IAEb,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,uBAAuB,GAAG,MAAM,CAAC,yBAAyB,CAAC;IACjE,MAAM,WAAW,GACf,MAAM,CAAC,gBAAgB;QACvB,oBAAoB,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnE,MAAM,YAAY,GAAG,iBAAiB,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAC1E,+EAA+E;IAC/E,+EAA+E;IAC/E,uEAAuE;IACvE,gFAAgF;IAChF,MAAM,aAAa,GAA+B,EAAE,CAAC;IACrD,MAAM,WAAW,GAAG,IAAI;QACtB,CAAC,CAAC,MAAM,sBAAsB,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE;YACpE,uBAAuB;YACvB,cAAc,EAAE,MAAM,CAAC,gBAAgB;YACvC,aAAa;SACd,CAAC;QACJ,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW,EAAE;YAClD,uBAAuB;YACvB,cAAc,EAAE,MAAM,CAAC,gBAAgB;YACvC,aAAa;SACd,CAAC,CAAC;IACP,MAAM,eAAe,GAAG,oBAAoB,CAC1C,MAAM,CAAC,aAAa,EACpB,WAAW,EACX,EAAE,WAAW,EAAE,CAChB,CAAC;IACF,0EAA0E;IAC1E,2EAA2E;IAC3E,gFAAgF;IAChF,wEAAwE;IACxE,gFAAgF;IAChF,gFAAgF;IAChF,2EAA2E;IAC3E,oEAAoE;IACpE,MAAM,kBAAkB,GAAG,yBAAyB,CAClD,MAAM,CAAC,aAAa,EACpB,eAAe,EACf,WAAW,CACZ,CAAC;IACF,MAAM,aAAa,GAAG,MAAM,CAAC,sBAAsB;QACjD,CAAC,CAAC,yBAAyB,CAAC,kBAAkB,EAAE,MAAM,CAAC,sBAAsB,CAAC;QAC9E,CAAC,CAAC,kBAAkB,CAAC;IACvB,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,yCAAyC;IACzC,MAAM,YAAY,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACrD,MAAM,gBAAgB,GAAG,iBAAiB,CACxC,YAAY,EACZ,aAAa,EACb,uBAAuB,EACvB,YAAY,CACb,CAAC;IAEF,+EAA+E;IAC/E,8EAA8E;IAC9E,yEAAyE;IACzE,+EAA+E;IAC/E,yEAAyE;IACzE,EAAE;IACF,gFAAgF;IAChF,+EAA+E;IAC/E,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,cAAc,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,MAAM,kBAAkB,GAAG,wBAAwB,CACjD,MAAM,CAAC,aAAa,EACpB,WAAW,CACZ,CAAC;IACF,MAAM,eAAe,GACnB,IAAI,KAAK,SAAS;QAClB,kBAAkB,CAAC;YACjB,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,kBAAkB;YAC5B,aAAa,EAAE,sBAAsB,CAAC,MAAM,CAAC,iBAAiB,CAAC;YAC/D,gBAAgB,EAAE,MAAM,CAAC,WAAW,KAAK,SAAS;SACnD,CAAC,CAAC;IACL,MAAM,UAAU,GACd,eAAe,IAAI,MAAM,CAAC,WAAW;QACnC,CAAC,CAAC,MAAM,CAAC,WAAW;QACpB,CAAC,CAAC,IAAI;YACJ,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC;YACjE,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IACrD,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,MAAM,kBAAkB,GACtB,cAAc,KAAK,IAAI;QACrB,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,kBAAkB,EAAE;QACzD,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,aAAa,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,iBAAiB,GAAG,8BAA8B,CACpD,WAAW,EACX,aAAa,EACb,EAAE,QAAQ,EAAE,sBAAsB,EAAE,CACrC,CAAC;IACF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,iBAAiB,GAAG;YAClB,GAAG,iBAAiB;YACpB,cAAc,EAAE;gBACd,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;aACzE,CAAC,IAAI,EAAE;SACT,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,uBAAuB,CAC1C,wBAAwB,CACtB,gBAAgB,EAChB,qBAAqB,CAAC,UAAU,EAAE,YAAY,CAAC,CAChD,CACF,CAAC;IAEF,OAAO;QACL,OAAO,EAAE;YACP,GAAG,MAAM;YACT,gBAAgB,EAAE,WAAW;YAC7B,aAAa,EAAE,YAAY;YAC3B,gBAAgB,EAAE,eAAe;YACjC,YAAY,EAAE,iBAAiB;YAC/B,cAAc,EAAE,aAAa;YAC7B,aAAa,EAAE,YAAY;YAC3B,WAAW,EAAE,UAAU;YACvB,gBAAgB,EAAE,aAAa,CAAC,KAAK,IAAI,MAAM,CAAC,gBAAgB;YAChE,iBAAiB,EAAE,kBAAkB;gBACnC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;gBACtE,CAAC,CAAC,MAAM,CAAC,iBAAiB;SAC7B;QACD,iBAAiB,EAAE;YACjB,uBAAuB;YACvB,oBAAoB;YACpB,uBAAuB;YACvB,mBAAmB;YACnB,qBAAqB;YACrB,oBAAoB;YACpB,kBAAkB;SACnB;QACD,gBAAgB,EACd,iCAAiC,YAAY,CAAC,KAAK,CAAC,MAAM,cAAc,aAAa,CAAC,KAAK,CAAC,MAAM,kBAAkB;YACpH,CAAC,aAAa,CAAC,iBAAiB;gBAC9B,CAAC,CAAC,sEAAsE;gBACxE,CAAC,CAAC,EAAE,CAAC;KACV,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,MAAsB;IAEtB,IACE,CAAC,MAAM,CAAC,aAAa;QACrB,CAAC,MAAM,CAAC,YAAY;QACpB,CAAC,MAAM,CAAC,cAAc;QACtB,CAAC,MAAM,CAAC,aAAa,EACrB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;QAC7C,YAAY,EAAE,MAAM,CAAC,aAAa;QAClC,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,aAAa,EAAE,MAAM,CAAC,cAAc;QACpC,YAAY,EAAE,MAAM,CAAC,aAAa;KACnC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAC1C,IAAI,QAAQ,EAAE,CAAC;QACb,8EAA8E;QAC9E,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YAC/B,gBAAgB,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC1C,gBAAgB,CAAC,iBAAiB,GAAG,QAAQ,CAAC,iBAAiB,IAAI,EAAE,CAAC;QACxE,CAAC;QACD,IAAI,QAAQ,CAAC,mBAAmB,EAAE,CAAC;YACjC,gBAAgB,CAAC,mBAAmB,GAAG,IAAI,CAAC;YAC5C,gBAAgB,CAAC,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,IAAI,EAAE,CAAC;QAC5E,CAAC;QACD,8EAA8E;QAC9E,IAAI,QAAQ,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC;YACtF,gBAAgB,CAAC,QAAQ,GAAG,IAAI,CAAC;YACjC,gBAAgB,CAAC,eAAe,GAAG,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC;QACpE,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE;YACP,GAAG,MAAM;YACT,iBAAiB,EAAE,gBAAgB;SACpC;QACD,iBAAiB,EAAE,CAAC,wBAAwB,CAAC;QAC7C,gBAAgB,EAAE,+BAA+B,gBAAgB,CAAC,QAAQ,CAAC,MAAM,yBAAyB;KAC3G,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,MAAsB,EACtB,IAAa;IAEb,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,2BAA2B,CAAC;QACtD,IAAI;QACJ,YAAY,EAAE,MAAM,CAAC,aAAa;QAClC,WAAW,EAAE,MAAM,CAAC,gBAAgB;QACpC,WAAW,EAAE,MAAM,CAAC,YAAY;KACjC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE;YACP,GAAG,MAAM;YACT,uBAAuB,EAAE,aAAa;SACvC;QACD,iBAAiB,EAAE,CAAC,8BAA8B,CAAC;QACnD,gBAAgB,EACd,qCAAqC,aAAa,CAAC,SAAS,CAAC,MAAM,eAAe;YAClF,GAAG,aAAa,CAAC,SAAS,CAAC,MAAM,sBAAsB;YACvD,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,yCAAyC;YACzE,GAAG,aAAa,CAAC,kBAAkB,SAAS;KAC/C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAsB,EACtB,IAAa;IAEb,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC;QACvC,IAAI;QACJ,WAAW,EAAE,MAAM,CAAC,gBAAgB;KACrC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE;YACP,GAAG,MAAM;YACT,WAAW,EAAE,UAAU;SACxB;QACD,iBAAiB,EAAE,CAAC,kBAAkB,CAAC;QACvC,gBAAgB,EAAE,yBAAyB,UAAU,CAAC,IAAI,CAAC,MAAM,mBAC/D,UAAU,CAAC,aAAa,EAAE,MAAM;YAC9B,CAAC,CAAC,KAAK,UAAU,CAAC,aAAa,CAAC,MAAM,iBAAiB;YACvD,CAAC,CAAC,EACN,GAAG;KACJ,CAAC;AACJ,CAAC"}
+{"version":3,"file":"structureExecutors.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/structureExecutors.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,8BAA8B,GAE/B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,2BAA2B,EAAE,MAAM,6CAA6C,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAGnE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAsB,EACtB,IAAa;IAEb,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,uBAAuB,GAAG,MAAM,CAAC,yBAAyB,CAAC;IACjE,MAAM,WAAW,GACf,MAAM,CAAC,gBAAgB;QACvB,oBAAoB,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnE,MAAM,YAAY,GAAG,iBAAiB,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAC1E,+EAA+E;IAC/E,+EAA+E;IAC/E,uEAAuE;IACvE,gFAAgF;IAChF,MAAM,aAAa,GAA+B,EAAE,CAAC;IACrD,MAAM,WAAW,GAAG,IAAI;QACtB,CAAC,CAAC,MAAM,sBAAsB,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE;YACpE,uBAAuB;YACvB,cAAc,EAAE,MAAM,CAAC,gBAAgB;YACvC,aAAa;SACd,CAAC;QACJ,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW,EAAE;YAClD,uBAAuB;YACvB,cAAc,EAAE,MAAM,CAAC,gBAAgB;YACvC,aAAa;SACd,CAAC,CAAC;IACP,MAAM,eAAe,GAAG,oBAAoB,CAC1C,MAAM,CAAC,aAAa,EACpB,WAAW,EACX,EAAE,WAAW,EAAE,CAChB,CAAC;IACF,0EAA0E;IAC1E,2EAA2E;IAC3E,gFAAgF;IAChF,wEAAwE;IACxE,gFAAgF;IAChF,gFAAgF;IAChF,2EAA2E;IAC3E,oEAAoE;IACpE,MAAM,kBAAkB,GAAG,yBAAyB,CAClD,MAAM,CAAC,aAAa,EACpB,eAAe,EACf,WAAW,CACZ,CAAC;IACF,MAAM,aAAa,GAAG,MAAM,CAAC,sBAAsB;QACjD,CAAC,CAAC,yBAAyB,CAAC,kBAAkB,EAAE,MAAM,CAAC,sBAAsB,CAAC;QAC9E,CAAC,CAAC,kBAAkB,CAAC;IACvB,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,yCAAyC;IACzC,MAAM,YAAY,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACrD,MAAM,gBAAgB,GAAG,iBAAiB,CACxC,YAAY,EACZ,aAAa,EACb,uBAAuB,EACvB,YAAY,CACb,CAAC;IAEF,0EAA0E;IAC1E,8EAA8E;IAC9E,yEAAyE;IACzE,+EAA+E;IAC/E,yEAAyE;IACzE,EAAE;IACF,gFAAgF;IAChF,+EAA+E;IAC/E,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,cAAc,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,MAAM,kBAAkB,GAAG,wBAAwB,CACjD,MAAM,CAAC,aAAa,EACpB,WAAW,CACZ,CAAC;IACF,MAAM,eAAe,GACnB,IAAI,KAAK,SAAS;QAClB,kBAAkB,CAAC;YACjB,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,kBAAkB;YAC5B,aAAa,EAAE,sBAAsB,CAAC,MAAM,CAAC,iBAAiB,CAAC;YAC/D,gBAAgB,EAAE,MAAM,CAAC,WAAW,KAAK,SAAS;SACnD,CAAC,CAAC;IACL,MAAM,UAAU,GACd,eAAe,IAAI,MAAM,CAAC,WAAW;QACnC,CAAC,CAAC,MAAM,CAAC,WAAW;QACpB,CAAC,CAAC,IAAI;YACJ,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC;YACjE,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IACrD,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,MAAM,kBAAkB,GACtB,cAAc,KAAK,IAAI;QACrB,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,kBAAkB,EAAE;QACzD,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,aAAa,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,iBAAiB,GAAG,8BAA8B,CACpD,WAAW,EACX,aAAa,EACb,EAAE,QAAQ,EAAE,sBAAsB,EAAE,CACrC,CAAC;IACF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,iBAAiB,GAAG;YAClB,GAAG,iBAAiB;YACpB,cAAc,EAAE;gBACd,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;aACzE,CAAC,IAAI,EAAE;SACT,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,uBAAuB,CAC1C,wBAAwB,CACtB,gBAAgB,EAChB,qBAAqB,CAAC,UAAU,EAAE,YAAY,CAAC,CAChD,CACF,CAAC;IAEF,OAAO;QACL,OAAO,EAAE;YACP,GAAG,MAAM;YACT,gBAAgB,EAAE,WAAW;YAC7B,aAAa,EAAE,YAAY;YAC3B,gBAAgB,EAAE,eAAe;YACjC,YAAY,EAAE,iBAAiB;YAC/B,cAAc,EAAE,aAAa;YAC7B,aAAa,EAAE,YAAY;YAC3B,WAAW,EAAE,UAAU;YACvB,gBAAgB,EAAE,aAAa,CAAC,KAAK,IAAI,MAAM,CAAC,gBAAgB;YAChE,iBAAiB,EAAE,kBAAkB;gBACnC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;gBACtE,CAAC,CAAC,MAAM,CAAC,iBAAiB;SAC7B;QACD,iBAAiB,EAAE;YACjB,uBAAuB;YACvB,oBAAoB;YACpB,uBAAuB;YACvB,mBAAmB;YACnB,qBAAqB;YACrB,oBAAoB;YACpB,kBAAkB;SACnB;QACD,gBAAgB,EACd,iCAAiC,YAAY,CAAC,KAAK,CAAC,MAAM,cAAc,aAAa,CAAC,KAAK,CAAC,MAAM,kBAAkB;YACpH,CAAC,aAAa,CAAC,iBAAiB;gBAC9B,CAAC,CAAC,sEAAsE;gBACxE,CAAC,CAAC,EAAE,CAAC;KACV,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,MAAsB;IAEtB,IACE,CAAC,MAAM,CAAC,aAAa;QACrB,CAAC,MAAM,CAAC,YAAY;QACpB,CAAC,MAAM,CAAC,cAAc;QACtB,CAAC,MAAM,CAAC,aAAa,EACrB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;QAC7C,YAAY,EAAE,MAAM,CAAC,aAAa;QAClC,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,aAAa,EAAE,MAAM,CAAC,cAAc;QACpC,YAAY,EAAE,MAAM,CAAC,aAAa;KACnC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAC1C,IAAI,QAAQ,EAAE,CAAC;QACb,8EAA8E;QAC9E,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YAC/B,gBAAgB,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC1C,gBAAgB,CAAC,iBAAiB,GAAG,QAAQ,CAAC,iBAAiB,IAAI,EAAE,CAAC;QACxE,CAAC;QACD,IAAI,QAAQ,CAAC,mBAAmB,EAAE,CAAC;YACjC,gBAAgB,CAAC,mBAAmB,GAAG,IAAI,CAAC;YAC5C,gBAAgB,CAAC,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,IAAI,EAAE,CAAC;QAC5E,CAAC;QACD,8EAA8E;QAC9E,IAAI,QAAQ,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC;YACtF,gBAAgB,CAAC,QAAQ,GAAG,IAAI,CAAC;YACjC,gBAAgB,CAAC,eAAe,GAAG,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC;QACpE,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE;YACP,GAAG,MAAM;YACT,iBAAiB,EAAE,gBAAgB;SACpC;QACD,iBAAiB,EAAE,CAAC,wBAAwB,CAAC;QAC7C,gBAAgB,EAAE,+BAA+B,gBAAgB,CAAC,QAAQ,CAAC,MAAM,yBAAyB;KAC3G,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,MAAsB,EACtB,IAAa;IAEb,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,2BAA2B,CAAC;QACtD,IAAI;QACJ,YAAY,EAAE,MAAM,CAAC,aAAa;QAClC,WAAW,EAAE,MAAM,CAAC,gBAAgB;QACpC,WAAW,EAAE,MAAM,CAAC,YAAY;KACjC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE;YACP,GAAG,MAAM;YACT,uBAAuB,EAAE,aAAa;SACvC;QACD,iBAAiB,EAAE,CAAC,8BAA8B,CAAC;QACnD,gBAAgB,EACd,qCAAqC,aAAa,CAAC,SAAS,CAAC,MAAM,eAAe;YAClF,GAAG,aAAa,CAAC,SAAS,CAAC,MAAM,sBAAsB;YACvD,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,yCAAyC;YACzE,GAAG,aAAa,CAAC,kBAAkB,SAAS;KAC/C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAsB,EACtB,IAAa;IAEb,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC;QACvC,IAAI;QACJ,WAAW,EAAE,MAAM,CAAC,gBAAgB;KACrC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE;YACP,GAAG,MAAM;YACT,WAAW,EAAE,UAAU;SACxB;QACD,iBAAiB,EAAE,CAAC,kBAAkB,CAAC;QACvC,gBAAgB,EAAE,yBAAyB,UAAU,CAAC,IAAI,CAAC,MAAM,mBAC/D,UAAU,CAAC,aAAa,EAAE,MAAM;YAC9B,CAAC,CAAC,KAAK,UAAU,CAAC,aAAa,CAAC,MAAM,iBAAiB;YACvD,CAAC,CAAC,EACN,GAAG;KACJ,CAAC;AACJ,CAAC"}