audit-tools 0.50.21 → 0.51.1

package/docs/audit-pkg/operator-guide.md

@@ -42,10 +42,10 @@ Each `next-step` invocation writes:
 ```
 
 Follow only the returned prompt. A review handoff also writes a versioned host
-workload and result-map path under `.audit-tools/audit/`. Result ingestion checks
-the run id, work-item id, prompt digest, expected file coverage, and strict
-result schema before state advances. Replaying an already accepted result is a
-no-op.
+workload and result-map path under `.audit-tools/audit/`. Result ingestion binds
+every result to its run, work item and prompt and verifies it before state
+advances; the full check set is the generated block in
+[`contracts.md`](contracts.md). Replaying an already accepted result is a no-op.
 
 There are no provider, model, routing, quota, context-window, worker-command, or
 headless-launch settings in audit-tools. Parallelism and concrete execution
@@ -86,9 +86,12 @@ pair it cannot validate, records each removal so a repaired run stays
 distinguishable from a clean one, invalidates the persisted step contract, and
 the next `next-step` re-reads the bound result files for the dropped items.
 
-`audit-code cleanup` removes `.audit-tools/audit/` only when the persisted run
-is complete or not started. Active or blocked runs are refused unless the
-operator explicitly supplies `--force`. A directory with no `audit_state.json`
+`audit-code cleanup` removes `.audit-tools/audit/` only when nothing in the
+directory is still owed to the host: the persisted run is `not_started`, or it
+is `complete` and every artifact promotion archives is already one level up.
+Active or blocked runs are refused, and so is a complete run whose report is not
+fully promoted — that directory holds the only copy. All three refusals are
+waived by `--force`. A directory with no `audit_state.json`
 marker is refused whether or not `--force` is supplied: `--force` waives the
 evidence about a run's STATUS, never the evidence about its IDENTITY, and the
 verb will not delete a directory it cannot prove is an audit run. `--dry-run`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "audit-tools",
-  "version": "0.50.21",
+  "version": "0.51.1",
   "private": false,
   "license": "ISC",
   "description": "Provider-neutral code auditing and remediation workflows for arbitrary repositories.",
@@ -51,7 +51,7 @@
     "test": "npm run build && node scripts/shared/run-vitest-gate.mjs",
     "test:single": "npm run build && node scripts/shared/run-vitest-gate.mjs",
     "verify:guards": "node scripts/shared/run-vitest-gate.mjs --retry=2 --exclude \"**/audit-code-completion-*.test.ts\" --exclude \"**/audit-code-wrapper-*.test.ts\" --exclude \"**/audit/next-step-core-*.test.ts\" --exclude \"**/seam-host-only-next-step.test.ts\" --exclude \"**/*-e2e.test.*\" --exclude \"**/next-step-implement-dispatch.test.ts\" --exclude \"**/next-step-pipeline-dispatch.test.ts\"",
-    "verify:checks": "node scripts/shared/profile-run.mjs verify-checks check:control-bytes check:shared-primitives check:version-gates check:guard-reach check:ci-trigger-paths check:loop-core-patterns check:loop-core-closure check:constitutional-doc-paths check:runtime-artifact-names check:friction-categories check:executor-producers check:spec-mirrors check:cli-surface check:deadcode check:orphan-modules check:lint check:dup check:depgraph check:doc-manifest check:doc-links check:doc-code-citations check:gate-enumeration check:philosophy-brief check:readme-sample-report check:proposal-red-at check:handoff-roadmap check:backlog-index check:memory-citations check:backlog-budget check:backlog-status check:backlog-line-numbers check:tests build check:scripts verify:hosts verify:remediate-hosts pack:smoke smoke:packaged-audit-code smoke:packaged-remediate-code",
+    "verify:checks": "node scripts/shared/profile-run.mjs verify-checks check:control-bytes check:shared-primitives check:version-gates check:guard-reach check:ci-trigger-paths check:loop-core-patterns check:loop-core-closure check:constitutional-doc-paths check:runtime-artifact-names check:friction-categories check:executor-producers check:spec-mirrors check:cli-surface check:ingestion-checks check:deadcode check:orphan-modules check:lint check:dup check:depgraph check:doc-manifest check:doc-links check:doc-code-citations check:gate-enumeration check:philosophy-brief check:readme-sample-report check:proposal-red-at check:handoff-roadmap check:backlog-index check:memory-citations check:backlog-budget check:backlog-status check:backlog-line-numbers check:tests build check:scripts verify:hosts verify:remediate-hosts pack:smoke smoke:packaged-audit-code smoke:packaged-remediate-code",
     "verify:release": "npm run verify:checks && node scripts/shared/run-vitest-gate.mjs && npm run smoke:linked-audit-code && npm run smoke:linked-remediate-code",
     "check:control-bytes": "node scripts/check-control-bytes.mjs",
     "check:shared-primitives": "node scripts/check-shared-primitives.mjs",
@@ -102,6 +102,7 @@
     "check:executor-producers": "node scripts/shared/generate-executor-producers.mjs --check",
     "check:spec-mirrors": "node scripts/shared/generate-spec-mirrors.mjs --check",
     "check:cli-surface": "node scripts/shared/generate-cli-surface.mjs --check",
+    "check:ingestion-checks": "node scripts/shared/generate-ingestion-checks.mjs --check",
     "generate:shard-baseline": "node scripts/shared/generate-vitest-shard-baseline.mjs",
     "check:orphan-modules": "node scripts/check-orphan-modules.mjs",
     "check:loop-core-closure": "node scripts/check-loop-core-closure.mjs"

package/schemas/audit-code-v1alpha1.schema.json

@@ -47,7 +47,8 @@
                   "present",
                   "stale",
                   "blocked",
-                  "satisfied"
+                  "satisfied",
+                  "not_applicable"
                 ]
               },
               "reason": {

package/skills/audit-code/audit-code.prompt.md

@@ -48,9 +48,11 @@ confirm the host can inspect the structural graph/relationships and source
 structure required by the workload. This is a host capability check, not an
 audit-tools MCP/provider or lane-selection step. If capability is degraded but
 you proceed, record one reserved AgentReflection with task_id exactly
-`audit-capability-preflight`; use severity `high` or `critical` when material to
-claimed coverage, with concrete `tool_friction`, `ambiguities`, and `suggestions`
-details. A structurally incapable run must not be labelled comprehensive. Keep
+`audit-capability-preflight`. Every reflection requires all three of `task_id`,
+`instruction_clarity` (one of `clear`, `mostly_clear`, `ambiguous`, `unclear`)
+and `severity`; a line missing any of the three is discarded whole. Use severity
+`high` or `critical` when material to claimed coverage, with concrete
+`tool_friction`, `ambiguities`, and `suggestions` details. A structurally incapable run must not be labelled comprehensive. Keep
 the conversation-first flow and loader contract; do not add provider, routing,
 model, or machine-capability fields to audit-tools. Write the
 prompt-bound result artifacts exactly where requested and let the next backend

package/dist/remediate/state/closingActions.d.ts

@@ -1,3 +0,0 @@
-export declare const CLOSING_ACTIONS: readonly ["commit", "push", "open-pr", "publish", "tag", "none", "custom"];
-export type ClosingAction = (typeof CLOSING_ACTIONS)[number];
-//# sourceMappingURL=closingActions.d.ts.map

package/dist/remediate/state/closingActions.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"closingActions.d.ts","sourceRoot":"","sources":["../../../src/remediate/state/closingActions.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,4EAQlB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC"}

package/dist/remediate/state/closingActions.js

@@ -1,10 +0,0 @@
-export const CLOSING_ACTIONS = [
-    "commit",
-    "push",
-    "open-pr",
-    "publish",
-    "tag",
-    "none",
-    "custom",
-];
-//# sourceMappingURL=closingActions.js.map

package/dist/remediate/state/closingActions.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"closingActions.js","sourceRoot":"","sources":["../../../src/remediate/state/closingActions.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,QAAQ;IACR,MAAM;IACN,SAAS;IACT,SAAS;IACT,KAAK;IACL,MAAM;IACN,QAAQ;CACA,CAAC"}