audit-tools 0.50.21 → 0.51.1

package/dist/remediate/steps/types.d.ts

@@ -2,7 +2,7 @@ export declare const REMEDIATION_STEP_CONTRACT_VERSION: "remediate-code-step/v1a
 export declare const REMEDIATION_HOST_WORKLOAD_CONTRACT_VERSION: "remediation-host-workload/v1alpha2";
 export declare const REMEDIATION_HOST_RESULT_CONTRACT_VERSION: "remediation-host-result/v1alpha2";
 export declare const REMEDIATION_HOST_DECISION_CONTRACT_VERSION: "remediation-host-decision/v1alpha1";
-export type RemediationStepKind = "confirm_intent" | "confirm_auto_discovered_input" | "confirm_resume_or_restart" | "locate_input" | "collect_starting_point" | "synthesize_intake" | "collect_intake_clarifications" | "contract_pipeline" | "collect_review_approval" | "collect_clarifications" | "dispatch_implement" | "phase_busy" | "collect_triage" | "close_run" | "present_report" | "input_conflict" | "unhandled_state" | "zero_documentable_findings" | "final_gate_red" | "blocked" | "fold_did_not_converge";
+export type RemediationStepKind = "confirm_intent" | "confirm_auto_discovered_input" | "confirm_resume_or_restart" | "locate_input" | "collect_starting_point" | "synthesize_intake" | "collect_intake_clarifications" | "contract_pipeline" | "collect_review_approval" | "collect_clarifications" | "dispatch_implement" | "phase_busy" | "collect_triage" | "close_run" | "present_report" | "input_conflict" | "unhandled_state" | "zero_documentable_findings" | "final_gate_red" | "blocked" | "fold_did_not_converge" | "extracted_plan_discarded";
 import type { StepStatus, AccessDeclaration } from "audit-tools/shared";
 export type { AccessDeclaration };
 export type RemediationStepStatus = StepStatus;

package/dist/remediate/steps/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/remediate/steps/types.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iCAAiC,EAC5C,8BAAuC,CAAC;AAc1C,eAAO,MAAM,0CAA0C,EACrD,oCAA6C,CAAC;AAEhD,eAAO,MAAM,wCAAwC,EACnD,kCAA2C,CAAC;AAE9C,eAAO,MAAM,0CAA0C,EACrD,oCAA6C,CAAC;AAEhD,MAAM,MAAM,mBAAmB,GAC3B,gBAAgB,GAChB,+BAA+B,GAC/B,2BAA2B,GAC3B,cAAc,GACd,wBAAwB,GACxB,mBAAmB,GACnB,+BAA+B,GAC/B,mBAAmB,GACnB,yBAAyB,GACzB,wBAAwB,GACxB,oBAAoB,GACpB,YAAY,GACZ,gBAAgB,GAChB,WAAW,GACX,gBAAgB,GAChB,gBAAgB,GAChB,iBAAiB,GACjB,4BAA4B,GAa5B,gBAAgB,GAIhB,SAAS,GAgBT,uBAAuB,CAAC;AAE5B,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAMxE,YAAY,EAAE,iBAAiB,EAAE,CAAC;AAElC,MAAM,MAAM,qBAAqB,GAAG,UAAU,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B,gBAAgB,EAAE,OAAO,iCAAiC,CAAC;IAC3D,SAAS,EAAE,mBAAmB,CAAC;IAC/B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,eAAO,MAAM,2CAA2C,EACtD,wCAAiD,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/remediate/steps/types.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iCAAiC,EAC5C,8BAAuC,CAAC;AAc1C,eAAO,MAAM,0CAA0C,EACrD,oCAA6C,CAAC;AAEhD,eAAO,MAAM,wCAAwC,EACnD,kCAA2C,CAAC;AAE9C,eAAO,MAAM,0CAA0C,EACrD,oCAA6C,CAAC;AAEhD,MAAM,MAAM,mBAAmB,GAC3B,gBAAgB,GAChB,+BAA+B,GAC/B,2BAA2B,GAC3B,cAAc,GACd,wBAAwB,GACxB,mBAAmB,GACnB,+BAA+B,GAC/B,mBAAmB,GACnB,yBAAyB,GACzB,wBAAwB,GACxB,oBAAoB,GACpB,YAAY,GACZ,gBAAgB,GAChB,WAAW,GACX,gBAAgB,GAChB,gBAAgB,GAChB,iBAAiB,GACjB,4BAA4B,GAa5B,gBAAgB,GAIhB,SAAS,GAgBT,uBAAuB,GAqBvB,0BAA0B,CAAC;AAE/B,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAMxE,YAAY,EAAE,iBAAiB,EAAE,CAAC;AAElC,MAAM,MAAM,qBAAqB,GAAG,UAAU,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B,gBAAgB,EAAE,OAAO,iCAAiC,CAAC;IAC3D,SAAS,EAAE,mBAAmB,CAAC;IAC/B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,eAAO,MAAM,2CAA2C,EACtD,wCAAiD,CAAC"}

package/dist/remediate/steps/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/remediate/steps/types.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iCAAiC,GAC5C,8BAAuC,CAAC;AAE1C,+EAA+E;AAC/E,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AACzE,+EAA+E;AAC/E,8EAA8E;AAC9E,yCAAyC;AAEzC,yEAAyE;AACzE,+EAA+E;AAC/E,+EAA+E;AAC/E,uEAAuE;AACvE,MAAM,CAAC,MAAM,0CAA0C,GACrD,oCAA6C,CAAC;AAEhD,MAAM,CAAC,MAAM,wCAAwC,GACnD,kCAA2C,CAAC;AAE9C,MAAM,CAAC,MAAM,0CAA0C,GACrD,oCAA6C,CAAC;AA+EhD,MAAM,CAAC,MAAM,2CAA2C,GACtD,wCAAiD,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/remediate/steps/types.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iCAAiC,GAC5C,8BAAuC,CAAC;AAE1C,+EAA+E;AAC/E,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AACzE,+EAA+E;AAC/E,8EAA8E;AAC9E,yCAAyC;AAEzC,yEAAyE;AACzE,+EAA+E;AAC/E,+EAA+E;AAC/E,uEAAuE;AACvE,MAAM,CAAC,MAAM,0CAA0C,GACrD,oCAA6C,CAAC;AAEhD,MAAM,CAAC,MAAM,wCAAwC,GACnD,kCAA2C,CAAC;AAE9C,MAAM,CAAC,MAAM,0CAA0C,GACrD,oCAA6C,CAAC;AAoGhD,MAAM,CAAC,MAAM,2CAA2C,GACtD,wCAAiD,CAAC"}

package/dist/remediate/validation/contractPipelineGates.d.ts

@@ -22,23 +22,6 @@ export declare function validateDesignSpecGates(designSpec: unknown, obligationL
  * validators already flag missing goal_ids). Issues are errors.
  */
 export declare function validateGoalIdConsistency(artifacts: Record<string, unknown>): ValidationIssue[];
-/**
- * ARC-86b18f1b-2: validate the implementation_dag against the obligation_ledger
- * and counterexample/judge artifacts for:
- *
- *   1. Referential integrity — every id referenced in `satisfies_obligations`,
- *      `verification_obligation_ids`, and `addresses_counterexamples` must exist
- *      in the obligation_ledger or as an accepted counterexample in the judge
- *      report (respectively).
- *
- *   2. Bidirectional coverage — every obligation in the ledger, and every
- *      accepted counterexample (per the judge report), must be addressed by at
- *      least one DAG node.
- *
- * All issues are errors. Accepts `undefined` payloads for missing artifacts —
- * referential checks are skipped when the target artifact is absent (the caller
- * is responsible for ensuring the artifacts exist before calling this gate).
- */
 export declare function validateImplementationDAGIntegrity(dagPayload: unknown, obligationLedgerPayload: unknown, counterexamplePayload: unknown, judgeReportPayload: unknown, waivedCounterexampleIds?: ReadonlySet<string>): ValidationIssue[];
 /**
  * Testable obligation kinds — THE single source of truth for whether an
@@ -94,23 +77,6 @@ export declare function isTestablePhaseObligation(kind: string): boolean;
 export declare function validatePairedObligations(obligationLedgerPayload: unknown, testValidatorPlanPayload: unknown): ValidationIssue[];
 /** Re-exported PairingVerdict so importers of this gate module can type the result. */
 export type { PairingVerdict };
-/**
- * OBL-CO-03 — evidence-threading gate (fail-closed).
- *
- * Evidence produced upstream must survive every downstream seam:
- *
- *  1. A contract_assessment_report finding with status "violated" must carry
- *     non-empty evidence — a violation asserted without evidence is unfalsifiable.
- *  2. Every judge-accepted counterexample must be threaded forward into the
- *     implementation_dag (a node must list it in addresses_counterexamples).
- *     This is the seam where adversarial evidence is most often dropped.
- *  3. Every DAG node that satisfies an obligation must carry obligation-derived
- *     evidence in its description (the node must not be an empty placeholder).
- *
- * Accepts `undefined` payloads — a check whose source artifact is absent is
- * skipped, except the counterexample-threading check, which is fail-closed when
- * accepted counterexamples exist but the DAG is missing.
- */
 export declare function validateEvidenceThreaded(assessmentReportPayload: unknown, judgeReportPayload: unknown, dagPayload: unknown, waivedCounterexampleIds?: ReadonlySet<string>): ValidationIssue[];
 /**
  * OBL-CO-04 — source_type-scoped digest-coverage gate (fail-closed for

package/dist/remediate/validation/contractPipelineGates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contractPipelineGates.d.ts","sourceRoot":"","sources":["../../../src/remediate/validation/contractPipelineGates.ts"],"names":[],"mappings":"AAiBA,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,OAAO,EAab,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACzF,OAAO,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAC;AAInF;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,OAAO,EACnB,gBAAgB,CAAC,EAAE,OAAO,GACzB,eAAe,EAAE,CAqMnB;AAGD;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,eAAe,EAAE,CAsBnB;AAID;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kCAAkC,CAChD,UAAU,EAAE,OAAO,EACnB,uBAAuB,EAAE,OAAO,EAChC,qBAAqB,EAAE,OAAO,EAC9B,kBAAkB,EAAE,OAAO,EAC3B,uBAAuB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAC5C,eAAe,EAAE,CAqInB;AAsBD;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,yBAAyB,EAAE,CAAC;AAErC;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAI/D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,yBAAyB,CACvC,uBAAuB,EAAE,OAAO,EAChC,wBAAwB,EAAE,OAAO,GAChC,eAAe,EAAE,CAkGnB;AAED,uFAAuF;AACvF,YAAY,EAAE,cAAc,EAAE,CAAC;AAE/B;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CACtC,uBAAuB,EAAE,OAAO,EAChC,kBAAkB,EAAE,OAAO,EAC3B,UAAU,EAAE,OAAO,EACnB,uBAAuB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAC5C,eAAe,EAAE,CAsFnB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,yBAAyB,EAAE,OAAO,EAClC,uBAAuB,EAAE,OAAO,GAC/B,eAAe,EAAE,CA+CnB;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAC9C,gBAAgB,EAAE,OAAO,EACzB,0BAA0B,EAAE,OAAO,GAClC,eAAe,EAAE,CAsInB;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAgB,gCAAgC,CAC9C,+BAA+B,EAAE,OAAO,EACxC,+BAA+B,EAAE,OAAO,GACvC,eAAe,EAAE,CAuEnB;AA6ED,mFAAmF;AACnF,MAAM,WAAW,+BAA+B;IAC9C,6DAA6D;IAC7D,YAAY,EAAE,OAAO,CAAC;IACtB,gFAAgF;IAChF,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAEtB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,GAC3B,GAAG,CAAC,MAAM,CAAC,CAOb;AAED;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAY5E;AA8DD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,iCAAiC,CACrD,QAAQ,EAAE,SAAS,OAAO,EAAE,EAC5B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,+BAA+B,CAAC,CAiF1C;AA2ED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,8BAA8B,CAClD,0BAA0B,EAAE,OAAO,EACnC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,eAAe,EAAE,CAAC,CAmF5B;AAiBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,mCAAmC,CACjD,sBAAsB,EAAE,OAAO,EAC/B,wBAAwB,EAAE,OAAO,GAChC,eAAe,EAAE,CA2CnB;AAgGD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,WAAW;IAC1B,6FAA6F;IAC7F,IAAI,EACA,oBAAoB,GACpB,mBAAmB,GACnB,iBAAiB,GACjB,2BAA2B,GAC3B,aAAa,GACb,8BAA8B,GAC9B,0BAA0B,GAC1B,gCAAgC,CAAC;IACrC,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,8CAA8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAwBD,kEAAkE;AAClE,MAAM,WAAW,+BAA+B;IAC9C;;iFAE6E;IAC7E,QAAQ,EAAE,WAAW,CAAC,4BAA4B,EAAE,OAAO,CAAC,CAAC;IAC7D;;2CAEuC;IACvC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;uBACmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb;;;;;sEAKkE;IAClE,uBAAuB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC/C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAsB,yCAAyC,CAC7D,MAAM,EAAE,+BAA+B,GACtC,OAAO,CAAC,WAAW,EAAE,CAAC,CA2ExB"}
+{"version":3,"file":"contractPipelineGates.d.ts","sourceRoot":"","sources":["../../../src/remediate/validation/contractPipelineGates.ts"],"names":[],"mappings":"AAiBA,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,OAAO,EAab,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACzF,OAAO,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAC;AAInF;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,OAAO,EACnB,gBAAgB,CAAC,EAAE,OAAO,GACzB,eAAe,EAAE,CAqMnB;AAGD;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,eAAe,EAAE,CAsBnB;AAqKD,wBAAgB,kCAAkC,CAChD,UAAU,EAAE,OAAO,EACnB,uBAAuB,EAAE,OAAO,EAChC,qBAAqB,EAAE,OAAO,EAC9B,kBAAkB,EAAE,OAAO,EAC3B,uBAAuB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAC5C,eAAe,EAAE,CA0BnB;AAsBD;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,yBAAyB,EAAE,CAAC;AAErC;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAI/D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,yBAAyB,CACvC,uBAAuB,EAAE,OAAO,EAChC,wBAAwB,EAAE,OAAO,GAChC,eAAe,EAAE,CAkGnB;AAED,uFAAuF;AACvF,YAAY,EAAE,cAAc,EAAE,CAAC;AA8G/B,wBAAgB,wBAAwB,CACtC,uBAAuB,EAAE,OAAO,EAChC,kBAAkB,EAAE,OAAO,EAC3B,UAAU,EAAE,OAAO,EACnB,uBAAuB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAC5C,eAAe,EAAE,CASnB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,yBAAyB,EAAE,OAAO,EAClC,uBAAuB,EAAE,OAAO,GAC/B,eAAe,EAAE,CA+CnB;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAC9C,gBAAgB,EAAE,OAAO,EACzB,0BAA0B,EAAE,OAAO,GAClC,eAAe,EAAE,CAsInB;AA8CD;;;;;;;;;;;;GAYG;AACH,wBAAgB,gCAAgC,CAC9C,+BAA+B,EAAE,OAAO,EACxC,+BAA+B,EAAE,OAAO,GACvC,eAAe,EAAE,CAuEnB;AA6ED,mFAAmF;AACnF,MAAM,WAAW,+BAA+B;IAC9C,6DAA6D;IAC7D,YAAY,EAAE,OAAO,CAAC;IACtB,gFAAgF;IAChF,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAEtB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,GAC3B,GAAG,CAAC,MAAM,CAAC,CAOb;AAED;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAY5E;AA8DD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,iCAAiC,CACrD,QAAQ,EAAE,SAAS,OAAO,EAAE,EAC5B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,+BAA+B,CAAC,CAiF1C;AA2ED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,8BAA8B,CAClD,0BAA0B,EAAE,OAAO,EACnC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,eAAe,EAAE,CAAC,CAmF5B;AAiBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,mCAAmC,CACjD,sBAAsB,EAAE,OAAO,EAC/B,wBAAwB,EAAE,OAAO,GAChC,eAAe,EAAE,CA2CnB;AAgGD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,WAAW;IAC1B,6FAA6F;IAC7F,IAAI,EACA,oBAAoB,GACpB,mBAAmB,GACnB,iBAAiB,GACjB,2BAA2B,GAC3B,aAAa,GACb,8BAA8B,GAC9B,0BAA0B,GAC1B,gCAAgC,CAAC;IACrC,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,8CAA8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAwBD,kEAAkE;AAClE,MAAM,WAAW,+BAA+B;IAC9C;;iFAE6E;IAC7E,QAAQ,EAAE,WAAW,CAAC,4BAA4B,EAAE,OAAO,CAAC,CAAC;IAC7D;;2CAEuC;IACvC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;uBACmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb;;;;;sEAKkE;IAClE,uBAAuB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC/C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAsB,yCAAyC,CAC7D,MAAM,EAAE,+BAA+B,GACtC,OAAO,CAAC,WAAW,EAAE,CAAC,CA2ExB"}

package/dist/remediate/validation/contractPipelineGates.js

@@ -225,87 +225,74 @@ export function validateGoalIdConsistency(artifacts) {
  * referential checks are skipped when the target artifact is absent (the caller
  * is responsible for ensuring the artifacts exist before calling this gate).
  */
-export function validateImplementationDAGIntegrity(dagPayload, obligationLedgerPayload, counterexamplePayload, judgeReportPayload, waivedCounterexampleIds) {
-    const issues = [];
-    if (!canEvaluateImplementationDagIntegrity(dagPayload))
-        return issues;
-    // Build reference sets from sibling artifacts.
-    const obligationIds = new Set();
-    if (isRecord(obligationLedgerPayload) && Array.isArray(obligationLedgerPayload.obligations)) {
-        for (const obl of obligationLedgerPayload.obligations) {
-            if (isRecord(obl) && typeof obl.id === "string" && obl.id.length > 0) {
-                obligationIds.add(obl.id);
+/**
+ * The non-empty string ids a sibling artifact declares, read defensively from an
+ * `unknown` payload shaped `{ [arrayKey]: [{ id }] }`.
+ *
+ * The obligation ledger and the counterexample artifact were each read by their
+ * own copy of this loop, identical but for the key they look under.
+ */
+function collectDeclaredIds(payload, arrayKey) {
+    const ids = new Set();
+    if (isRecord(payload) && Array.isArray(payload[arrayKey])) {
+        for (const entry of payload[arrayKey]) {
+            if (isRecord(entry) && typeof entry.id === "string" && entry.id.length > 0) {
+                ids.add(entry.id);
             }
         }
     }
-    const counterexampleIds = new Set();
-    if (isRecord(counterexamplePayload) && Array.isArray(counterexamplePayload.counterexamples)) {
-        for (const ce of counterexamplePayload.counterexamples) {
-            if (isRecord(ce) && typeof ce.id === "string" && ce.id.length > 0) {
-                counterexampleIds.add(ce.id);
-            }
+    return ids;
+}
+/**
+ * One node's obligation references, for one of the two fields that carry them.
+ * Both fields were checked by the same fifteen lines, differing only in the field
+ * name — which appears in the issue path AND in its message, so a copy that
+ * drifted would have misreported which field was wrong.
+ *
+ * ⚠ An EMPTY `obligationIds` means the ledger declared nothing, which is not the
+ * same as "this reference is unknown". In that case every referenced id counts as
+ * covered and NOTHING is reported — the gate refuses to invent a referential
+ * error against an artifact that stated no ids at all.
+ */
+function checkNodeObligationRefs(issues, node, nodeIndex, field, obligationIds, coveredObligationIds) {
+    const refs = node[field];
+    if (!Array.isArray(refs))
+        return;
+    for (const oblId of refs) {
+        if (typeof oblId !== "string")
+            continue;
+        if (obligationIds.size > 0 && !obligationIds.has(oblId)) {
+            pushValidationIssue(issues, `implementation_dag.nodes[${nodeIndex}].${field}`, `Node "${node.id}" references obligation "${oblId}" in ${field}, but no such obligation exists in the obligation_ledger.`);
+        }
+        else {
+            coveredObligationIds.add(oblId);
         }
     }
-    const acceptedCounterexampleIds = new Set();
-    if (isRecord(judgeReportPayload) && Array.isArray(judgeReportPayload.classifications)) {
-        for (const cls of judgeReportPayload.classifications) {
-            if (isRecord(cls) &&
-                cls.classification === "accepted" &&
-                typeof cls.counterexample_id === "string" &&
-                cls.counterexample_id.length > 0 &&
-                // A waived counterexample is resolved by a recorded owner decision —
-                // coverage must not be demanded for it (open-bugs.md:108).
-                !waivedCounterexampleIds?.has(cls.counterexample_id)) {
-                acceptedCounterexampleIds.add(cls.counterexample_id);
-            }
+}
+/** Report every declared id no node covered. An empty set reports nothing. */
+function reportUncovered(issues, declared, covered, message) {
+    for (const id of declared) {
+        if (!covered.has(id)) {
+            pushValidationIssue(issues, "implementation_dag.coverage", message(id));
         }
     }
-    // Track which obligations and accepted counterexamples are covered.
+}
+/**
+ * Phase 1 — referential integrity, node by node: every obligation and
+ * counterexample a node references must exist in the artifact that declares it.
+ *
+ * Returns the covered sets alongside the issues, because phase 2 asks the
+ * opposite question of the same walk and must not walk the nodes again.
+ */
+function validateDAGReferentialIntegrity(nodes, obligationIds, counterexampleIds, acceptedCounterexampleIds) {
+    const issues = [];
     const coveredObligationIds = new Set();
     const coveredCounterexampleIds = new Set();
-    const nodes = dagPayload.nodes;
     for (const [i, node] of nodes.entries()) {
         if (!isRecord(node))
             continue;
-        // 1a. Referential integrity: satisfies_obligations → obligation_ledger.
-        if (obligationIds.size > 0 && Array.isArray(node.satisfies_obligations)) {
-            for (const oblId of node.satisfies_obligations) {
-                if (typeof oblId !== "string")
-                    continue;
-                if (!obligationIds.has(oblId)) {
-                    pushValidationIssue(issues, `implementation_dag.nodes[${i}].satisfies_obligations`, `Node "${node.id}" references obligation "${oblId}" in satisfies_obligations, but no such obligation exists in the obligation_ledger.`);
-                }
-                else {
-                    coveredObligationIds.add(oblId);
-                }
-            }
-        }
-        else if (Array.isArray(node.satisfies_obligations)) {
-            for (const oblId of node.satisfies_obligations) {
-                if (typeof oblId === "string")
-                    coveredObligationIds.add(oblId);
-            }
-        }
-        // 1b. Referential integrity: verification_obligation_ids → obligation_ledger.
-        if (obligationIds.size > 0 && Array.isArray(node.verification_obligation_ids)) {
-            for (const oblId of node.verification_obligation_ids) {
-                if (typeof oblId !== "string")
-                    continue;
-                if (!obligationIds.has(oblId)) {
-                    pushValidationIssue(issues, `implementation_dag.nodes[${i}].verification_obligation_ids`, `Node "${node.id}" references obligation "${oblId}" in verification_obligation_ids, but no such obligation exists in the obligation_ledger.`);
-                }
-                else {
-                    coveredObligationIds.add(oblId);
-                }
-            }
-        }
-        else if (Array.isArray(node.verification_obligation_ids)) {
-            for (const oblId of node.verification_obligation_ids) {
-                if (typeof oblId === "string")
-                    coveredObligationIds.add(oblId);
-            }
-        }
-        // 1c. Referential integrity: addresses_counterexamples → counterexample artifact.
+        checkNodeObligationRefs(issues, node, i, "satisfies_obligations", obligationIds, coveredObligationIds);
+        checkNodeObligationRefs(issues, node, i, "verification_obligation_ids", obligationIds, coveredObligationIds);
         if (Array.isArray(node.addresses_counterexamples)) {
             for (const ceId of node.addresses_counterexamples) {
                 if (typeof ceId !== "string")
@@ -319,24 +306,31 @@ export function validateImplementationDAGIntegrity(dagPayload, obligationLedgerP
             }
         }
     }
-    // 2. Bidirectional coverage: every obligation must be covered.
-    if (obligationIds.size > 0) {
-        for (const oblId of obligationIds) {
-            if (!coveredObligationIds.has(oblId)) {
-                pushValidationIssue(issues, "implementation_dag.coverage", `Obligation "${oblId}" from the obligation_ledger is not addressed by any implementation_dag node (neither in satisfies_obligations nor verification_obligation_ids).`);
-            }
-        }
-    }
-    // 2b. Bidirectional coverage: every accepted counterexample must be covered.
-    if (acceptedCounterexampleIds.size > 0) {
-        for (const ceId of acceptedCounterexampleIds) {
-            if (!coveredCounterexampleIds.has(ceId)) {
-                pushValidationIssue(issues, "implementation_dag.coverage", `Judge-accepted counterexample "${ceId}" is not addressed by any implementation_dag node in addresses_counterexamples.`);
-            }
-        }
-    }
+    return { issues, coveredObligationIds, coveredCounterexampleIds };
+}
+/**
+ * Phase 2 — the other direction: every declared obligation and every accepted
+ * counterexample must be addressed by SOME node. Phase 1 asks whether each
+ * reference resolves; this asks whether each declaration was reached.
+ */
+function validateDAGCoverageGaps(obligationIds, acceptedCounterexampleIds, coveredObligationIds, coveredCounterexampleIds) {
+    const issues = [];
+    reportUncovered(issues, obligationIds, coveredObligationIds, (oblId) => `Obligation "${oblId}" from the obligation_ledger is not addressed by any implementation_dag node (neither in satisfies_obligations nor verification_obligation_ids).`);
+    reportUncovered(issues, acceptedCounterexampleIds, coveredCounterexampleIds, (ceId) => `Judge-accepted counterexample "${ceId}" is not addressed by any implementation_dag node in addresses_counterexamples.`);
     return issues;
 }
+export function validateImplementationDAGIntegrity(dagPayload, obligationLedgerPayload, counterexamplePayload, judgeReportPayload, waivedCounterexampleIds) {
+    if (!canEvaluateImplementationDagIntegrity(dagPayload))
+        return [];
+    const obligationIds = collectDeclaredIds(obligationLedgerPayload, "obligations");
+    const counterexampleIds = collectDeclaredIds(counterexamplePayload, "counterexamples");
+    const acceptedCounterexampleIds = collectUnwaivedAcceptedCounterexampleIds(judgeReportPayload, waivedCounterexampleIds);
+    const referential = validateDAGReferentialIntegrity(dagPayload.nodes, obligationIds, counterexampleIds, acceptedCounterexampleIds);
+    return [
+        ...referential.issues,
+        ...validateDAGCoverageGaps(obligationIds, acceptedCounterexampleIds, referential.coveredObligationIds, referential.coveredCounterexampleIds),
+    ];
+}
 // ── Contract-obligations gates (CP-BLOCK-N-contract-obligations) ───────────────
 //
 // The gates below enforce the auditor-agnostic robustness invariants for the
@@ -504,75 +498,85 @@ export function validatePairedObligations(obligationLedgerPayload, testValidator
  * skipped, except the counterexample-threading check, which is fail-closed when
  * accepted counterexamples exist but the DAG is missing.
  */
-export function validateEvidenceThreaded(assessmentReportPayload, judgeReportPayload, dagPayload, waivedCounterexampleIds) {
+/** The DAG's node array, or `[]` when the payload declares none. */
+function dagNodes(dagPayload) {
+    return isRecord(dagPayload) && Array.isArray(dagPayload.nodes)
+        ? dagPayload.nodes
+        : [];
+}
+/** Check 1: a finding that reports a violation must carry concrete evidence. */
+function validateViolatedFindingsEvidence(assessmentReportPayload) {
     const issues = [];
-    // 1. violated assessment findings must carry evidence.
-    if (isRecord(assessmentReportPayload) && Array.isArray(assessmentReportPayload.findings)) {
-        for (const [i, finding] of assessmentReportPayload.findings.entries()) {
-            if (!isRecord(finding))
-                continue;
-            if (finding.status !== "violated")
-                continue;
-            const evidence = Array.isArray(finding.evidence)
-                ? finding.evidence.filter((e) => typeof e === "string" && e.length > 0)
-                : [];
-            if (evidence.length === 0) {
-                pushValidationIssue(issues, `contract_assessment_report.findings[${i}].evidence`, `Assessment finding for obligation "${typeof finding.obligation_id === "string" ? finding.obligation_id : "?"}" is "violated" but carries no evidence — a violation must thread concrete evidence forward.`);
-            }
-        }
+    if (!isRecord(assessmentReportPayload) || !Array.isArray(assessmentReportPayload.findings)) {
+        return issues;
     }
-    // 2. accepted counterexamples must be threaded into the DAG. A waived
-    // counterexample is resolved by a recorded owner decision and is not
-    // demanded here (open-bugs.md:108).
-    const acceptedCounterexampleIds = new Set();
-    if (isRecord(judgeReportPayload) && Array.isArray(judgeReportPayload.classifications)) {
-        for (const cls of judgeReportPayload.classifications) {
-            if (isRecord(cls) &&
-                cls.classification === "accepted" &&
-                typeof cls.counterexample_id === "string" &&
-                cls.counterexample_id.length > 0 &&
-                !waivedCounterexampleIds?.has(cls.counterexample_id)) {
-                acceptedCounterexampleIds.add(cls.counterexample_id);
-            }
+    for (const [i, finding] of assessmentReportPayload.findings.entries()) {
+        if (!isRecord(finding))
+            continue;
+        if (finding.status !== "violated")
+            continue;
+        const evidence = Array.isArray(finding.evidence)
+            ? finding.evidence.filter((e) => typeof e === "string" && e.length > 0)
+            : [];
+        if (evidence.length === 0) {
+            pushValidationIssue(issues, `contract_assessment_report.findings[${i}].evidence`, `Assessment finding for obligation "${typeof finding.obligation_id === "string" ? finding.obligation_id : "?"}" is "violated" but carries no evidence — a violation must thread concrete evidence forward.`);
         }
     }
-    if (acceptedCounterexampleIds.size > 0) {
-        const threaded = new Set();
-        const nodes = isRecord(dagPayload) && Array.isArray(dagPayload.nodes)
-            ? dagPayload.nodes
-            : [];
-        for (const node of nodes) {
-            if (!isRecord(node) || !Array.isArray(node.addresses_counterexamples))
-                continue;
-            for (const ceId of node.addresses_counterexamples) {
-                if (typeof ceId === "string")
-                    threaded.add(ceId);
-            }
+    return issues;
+}
+/**
+ * Check 2: every judge-accepted counterexample must reach implementation.
+ *
+ * ⚠ FAIL-CLOSED, and the shape of the code is what makes it so. An ABSENT dag
+ * yields no nodes, so nothing is threaded, so every accepted id is reported.
+ * Accepted adversarial evidence with no DAG to reach is the failure this gate
+ * exists to catch — not a case to skip for want of a payload.
+ */
+function validateCounterexampleThreading(acceptedCounterexampleIds, dagPayload) {
+    const issues = [];
+    if (acceptedCounterexampleIds.size === 0)
+        return issues;
+    const threaded = new Set();
+    for (const node of dagNodes(dagPayload)) {
+        if (!isRecord(node) || !Array.isArray(node.addresses_counterexamples))
+            continue;
+        for (const ceId of node.addresses_counterexamples) {
+            if (typeof ceId === "string")
+                threaded.add(ceId);
         }
-        for (const ceId of acceptedCounterexampleIds) {
-            if (!threaded.has(ceId)) {
-                pushValidationIssue(issues, "implementation_dag.evidence_threading", `Judge-accepted counterexample "${ceId}" is not threaded into any implementation_dag node (addresses_counterexamples) — accepted adversarial evidence must reach implementation.`);
-            }
+    }
+    for (const ceId of acceptedCounterexampleIds) {
+        if (!threaded.has(ceId)) {
+            pushValidationIssue(issues, "implementation_dag.evidence_threading", `Judge-accepted counterexample "${ceId}" is not threaded into any implementation_dag node (addresses_counterexamples) — accepted adversarial evidence must reach implementation.`);
         }
     }
-    // 3. obligation-satisfying nodes must not be empty placeholders.
-    if (isRecord(dagPayload) && Array.isArray(dagPayload.nodes)) {
-        for (const [i, node] of dagPayload.nodes.entries()) {
-            if (!isRecord(node))
-                continue;
-            const satisfies = Array.isArray(node.satisfies_obligations)
-                ? node.satisfies_obligations.filter((o) => typeof o === "string")
-                : [];
-            if (satisfies.length === 0)
-                continue;
-            const description = typeof node.description === "string" ? node.description.trim() : "";
-            if (description.length === 0) {
-                pushValidationIssue(issues, `implementation_dag.nodes[${i}].description`, `Node "${typeof node.id === "string" ? node.id : "?"}" satisfies obligations but has an empty description — the evidence of what work satisfies the obligation must not be blank.`);
-            }
+    return issues;
+}
+/** Check 3: a node that claims to satisfy obligations must say what it does. */
+function validateSatisfyingNodeDescriptions(dagPayload) {
+    const issues = [];
+    for (const [i, node] of dagNodes(dagPayload).entries()) {
+        if (!isRecord(node))
+            continue;
+        const satisfies = Array.isArray(node.satisfies_obligations)
+            ? node.satisfies_obligations.filter((o) => typeof o === "string")
+            : [];
+        if (satisfies.length === 0)
+            continue;
+        const description = typeof node.description === "string" ? node.description.trim() : "";
+        if (description.length === 0) {
+            pushValidationIssue(issues, `implementation_dag.nodes[${i}].description`, `Node "${typeof node.id === "string" ? node.id : "?"}" satisfies obligations but has an empty description — the evidence of what work satisfies the obligation must not be blank.`);
         }
     }
     return issues;
 }
+export function validateEvidenceThreaded(assessmentReportPayload, judgeReportPayload, dagPayload, waivedCounterexampleIds) {
+    return [
+        ...validateViolatedFindingsEvidence(assessmentReportPayload),
+        ...validateCounterexampleThreading(collectUnwaivedAcceptedCounterexampleIds(judgeReportPayload, waivedCounterexampleIds), dagPayload),
+        ...validateSatisfyingNodeDescriptions(dagPayload),
+    ];
+}
 /**
  * OBL-CO-04 — source_type-scoped digest-coverage gate (fail-closed for
  * enumerable sources).
@@ -732,6 +736,40 @@ export function validateWorkBlockSeamPreparation(pathASeedPayload, moduleDecompo
 function escapeRegExp(value) {
     return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+/**
+ * The judge-accepted counterexample ids this pipeline still DEMANDS coverage
+ * for: accepted, non-empty, and not resolved by a recorded owner waiver.
+ *
+ * Two gates in this file need that set and each built it inline, character for
+ * character. Every conjunct is load-bearing, which is why they must not drift
+ * apart: the `length > 0` test keeps an empty id out of a demand nothing can
+ * satisfy, and the optional chaining on the waiver set is required because most
+ * callers omit the argument entirely.
+ *
+ * Deliberately NOT `acceptedCounterexampleIds` from `contractPipeline/derive.ts`,
+ * despite the name. That one returns a possibly-duplicated array, filters no
+ * waiver and admits the empty string — and importing its value here would close
+ * a module cycle, since `derive.ts` already imports `isTestablePhaseObligation`
+ * from this file.
+ *
+ * A waived counterexample is resolved by a recorded owner decision, so coverage
+ * is not demanded for it — see the waiver entry in `docs/backlog/open-bugs.md`.
+ */
+function collectUnwaivedAcceptedCounterexampleIds(judgeReportPayload, waivedCounterexampleIds) {
+    const accepted = new Set();
+    if (isRecord(judgeReportPayload) && Array.isArray(judgeReportPayload.classifications)) {
+        for (const cls of judgeReportPayload.classifications) {
+            if (isRecord(cls) &&
+                cls.classification === "accepted" &&
+                typeof cls.counterexample_id === "string" &&
+                cls.counterexample_id.length > 0 &&
+                !waivedCounterexampleIds?.has(cls.counterexample_id)) {
+                accepted.add(cls.counterexample_id);
+            }
+        }
+    }
+    return accepted;
+}
 /**
  * OBL-CO-12 / INV-CO-12 — reconciliation-derivation gate (fail-closed).
  *