audit-tools 0.51.6 → 0.51.9

package/dist/shared/types/contractPipeline/obligations.js.map

@@ -1 +1 @@
-{"version":3,"file":"obligations.js","sourceRoot":"","sources":["../../../../src/shared/types/contractPipeline/obligations.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,gFAAgF;AAEhF,MAAM,CAAC,MAAM,2CAA2C,GACtD,6DAAsE,CAAC;AAEzE,MAAM,CAAC,MAAM,6CAA6C,GACxD,+DAAwE,CAAC;AAE3E,MAAM,CAAC,MAAM,oDAAoD,GAC/D,sEAA+E,CAAC;AAElF,MAAM,CAAC,MAAM,wCAAwC,GACnD,0DAAmE,CAAC;AAEtE,MAAM,CAAC,MAAM,sCAAsC,GACjD,wDAAiE,CAAC"}
+{"version":3,"file":"obligations.js","sourceRoot":"","sources":["../../../../src/shared/types/contractPipeline/obligations.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,gFAAgF;AAEhF,MAAM,CAAC,MAAM,2CAA2C,GACtD,6DAAsE,CAAC;AAEzE,MAAM,CAAC,MAAM,6CAA6C,GACxD,+DAAwE,CAAC;AAE3E,MAAM,CAAC,MAAM,oDAAoD,GAC/D,sEAA+E,CAAC;AAElF,MAAM,CAAC,MAAM,wCAAwC,GACnD,0DAAmE,CAAC;AAEtE,MAAM,CAAC,MAAM,sCAAsC,GACjD,wDAAiE,CAAC;AAuLpE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,4BAA4B;IAC5B,mBAAmB;IACnB,4BAA4B;IAC5B,gBAAgB;IAChB,aAAa;CACL,CAAC;AAEX;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,aAAa,CAAU,CAAC;AAEvE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,uBAAuB,CAAC,MAAM,CAC3E,CAAC,MAAM,EAAE,EAAE,CACT,CAAE,8BAAoD,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC1E,CAAC"}

package/dist/shared/types/contractPipeline.d.ts

@@ -29,6 +29,7 @@ export { CONTRACT_PIPELINE_DESIGN_SPEC_VERSION, CONTRACT_PIPELINE_CONCEPTUAL_DES
 export type { DesignSpecInvariant, DesignSpecModule, DesignSpecSideEffect, DesignSpecExternalDependency, DesignSpecTrustBoundary, DesignSpec, DesignCritiqueItem, ConceptualDesignCritique, } from "./contractPipeline/design.js";
 export { CONTRACT_PIPELINE_OBLIGATION_LEDGER_VERSION, CONTRACT_PIPELINE_TEST_VALIDATOR_PLAN_VERSION, CONTRACT_PIPELINE_CONTRACT_ASSESSMENT_REPORT_VERSION, CONTRACT_PIPELINE_COUNTEREXAMPLE_VERSION, CONTRACT_PIPELINE_JUDGE_REPORT_VERSION, } from "./contractPipeline/obligations.js";
 export type { ObligationChangeClassification, ObligationEntry, ObligationLedger, TestSpec, TestValidatorPlan, ContractAssessmentFinding, ContractAssessmentReport, Counterexample, CounterexampleReport, CounterexampleClassification, JudgedCounterexample, JudgeRepairTarget, JudgeRepairDirective, JudgeReport, } from "./contractPipeline/obligations.js";
+export { CONTRACT_REPAIR_TARGETS, CONTRACT_REPAIR_TARGETS_LEGACY, CONTRACT_REPAIR_TARGETS_OFFERED, } from "./contractPipeline/obligations.js";
 export { CONTRACT_PIPELINE_IMPLEMENTATION_DAG_VERSION } from "./contractPipeline/implementation.js";
 import type { ImplementationDAGNode as BaseImplementationDAGNode, ImplementationDAG as BaseImplementationDAG } from "./contractPipeline/implementation.js";
 export type { ImplementationDAGEdge } from "./contractPipeline/implementation.js";

package/dist/shared/types/contractPipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contractPipeline.d.ts","sourceRoot":"","sources":["../../../src/shared/types/contractPipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EACL,mCAAmC,EACnC,wCAAwC,GACzC,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,QAAQ,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAE9F,OAAO,EACL,qCAAqC,EACrC,oDAAoD,GACrD,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,4BAA4B,EAC5B,uBAAuB,EACvB,UAAU,EACV,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,2CAA2C,EAC3C,6CAA6C,EAC7C,oDAAoD,EACpD,wCAAwC,EACxC,sCAAsC,GACvC,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,8BAA8B,EAC9B,eAAe,EACf,gBAAgB,EAChB,QAAQ,EACR,iBAAiB,EACjB,yBAAyB,EACzB,wBAAwB,EACxB,cAAc,EACd,oBAAoB,EACpB,4BAA4B,EAC5B,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,WAAW,GACZ,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,4CAA4C,EAAE,MAAM,sCAAsC,CAAC;AACpG,OAAO,KAAK,EACV,qBAAqB,IAAI,yBAAyB,EAClD,iBAAiB,IAAI,qBAAqB,EAC3C,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAElF;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG,yBAAyB,GAAG;IAC9D,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,qBAAqB,EAAE,OAAO,CAAC,GAAG;IACrE,KAAK,EAAE,qBAAqB,EAAE,CAAC;CAChC,CAAC;AAEF,OAAO,EACL,6CAA6C,EAC7C,0CAA0C,GAC3C,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EACV,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,QAAQ,EACR,SAAS,EACT,qBAAqB,GACtB,MAAM,oCAAoC,CAAC"}
+{"version":3,"file":"contractPipeline.d.ts","sourceRoot":"","sources":["../../../src/shared/types/contractPipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EACL,mCAAmC,EACnC,wCAAwC,GACzC,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,QAAQ,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAE9F,OAAO,EACL,qCAAqC,EACrC,oDAAoD,GACrD,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,4BAA4B,EAC5B,uBAAuB,EACvB,UAAU,EACV,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,2CAA2C,EAC3C,6CAA6C,EAC7C,oDAAoD,EACpD,wCAAwC,EACxC,sCAAsC,GACvC,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,8BAA8B,EAC9B,eAAe,EACf,gBAAgB,EAChB,QAAQ,EACR,iBAAiB,EACjB,yBAAyB,EACzB,wBAAwB,EACxB,cAAc,EACd,oBAAoB,EACpB,4BAA4B,EAC5B,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,WAAW,GACZ,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,uBAAuB,EACvB,8BAA8B,EAC9B,+BAA+B,GAChC,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,4CAA4C,EAAE,MAAM,sCAAsC,CAAC;AACpG,OAAO,KAAK,EACV,qBAAqB,IAAI,yBAAyB,EAClD,iBAAiB,IAAI,qBAAqB,EAC3C,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAElF;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG,yBAAyB,GAAG;IAC9D,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,qBAAqB,EAAE,OAAO,CAAC,GAAG;IACrE,KAAK,EAAE,qBAAqB,EAAE,CAAC;CAChC,CAAC;AAEF,OAAO,EACL,6CAA6C,EAC7C,0CAA0C,GAC3C,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EACV,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,QAAQ,EACR,SAAS,EACT,qBAAqB,GACtB,MAAM,oCAAoC,CAAC"}

package/dist/shared/types/contractPipeline.js

@@ -26,6 +26,7 @@
 export { CONTRACT_PIPELINE_GOAL_SPEC_VERSION, CONTRACT_PIPELINE_CONTEXT_BUNDLE_VERSION, } from "./contractPipeline/goal.js";
 export { CONTRACT_PIPELINE_DESIGN_SPEC_VERSION, CONTRACT_PIPELINE_CONCEPTUAL_DESIGN_CRITIQUE_VERSION, } from "./contractPipeline/design.js";
 export { CONTRACT_PIPELINE_OBLIGATION_LEDGER_VERSION, CONTRACT_PIPELINE_TEST_VALIDATOR_PLAN_VERSION, CONTRACT_PIPELINE_CONTRACT_ASSESSMENT_REPORT_VERSION, CONTRACT_PIPELINE_COUNTEREXAMPLE_VERSION, CONTRACT_PIPELINE_JUDGE_REPORT_VERSION, } from "./contractPipeline/obligations.js";
+export { CONTRACT_REPAIR_TARGETS, CONTRACT_REPAIR_TARGETS_LEGACY, CONTRACT_REPAIR_TARGETS_OFFERED, } from "./contractPipeline/obligations.js";
 export { CONTRACT_PIPELINE_IMPLEMENTATION_DAG_VERSION } from "./contractPipeline/implementation.js";
 export { CONTRACT_PIPELINE_VERIFICATION_REPORT_VERSION, CONTRACT_PIPELINE_SEAM_NEGOTIATION_VERSION, } from "./contractPipeline/verification.js";
 //# sourceMappingURL=contractPipeline.js.map

package/dist/shared/types/contractPipeline.js.map

@@ -1 +1 @@
-{"version":3,"file":"contractPipeline.js","sourceRoot":"","sources":["../../../src/shared/types/contractPipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EACL,mCAAmC,EACnC,wCAAwC,GACzC,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,qCAAqC,EACrC,oDAAoD,GACrD,MAAM,8BAA8B,CAAC;AAYtC,OAAO,EACL,2CAA2C,EAC3C,6CAA6C,EAC7C,oDAAoD,EACpD,wCAAwC,EACxC,sCAAsC,GACvC,MAAM,mCAAmC,CAAC;AAkB3C,OAAO,EAAE,4CAA4C,EAAE,MAAM,sCAAsC,CAAC;AAmBpG,OAAO,EACL,6CAA6C,EAC7C,0CAA0C,GAC3C,MAAM,oCAAoC,CAAC"}
+{"version":3,"file":"contractPipeline.js","sourceRoot":"","sources":["../../../src/shared/types/contractPipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EACL,mCAAmC,EACnC,wCAAwC,GACzC,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,qCAAqC,EACrC,oDAAoD,GACrD,MAAM,8BAA8B,CAAC;AAYtC,OAAO,EACL,2CAA2C,EAC3C,6CAA6C,EAC7C,oDAAoD,EACpD,wCAAwC,EACxC,sCAAsC,GACvC,MAAM,mCAAmC,CAAC;AAiB3C,OAAO,EACL,uBAAuB,EACvB,8BAA8B,EAC9B,+BAA+B,GAChC,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,4CAA4C,EAAE,MAAM,sCAAsC,CAAC;AAmBpG,OAAO,EACL,6CAA6C,EAC7C,0CAA0C,GAC3C,MAAM,oCAAoC,CAAC"}

package/dist/shared/types/contractPropertyShapes.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The property shapes a construction-site walker must decide. Zod's own
+ * vocabulary, mirrored as data — the `inner`/`key`/`value`/`shape` members carry
+ * a nested shape, and `allowsUndefined` is `ZodType.isOptional()`.
+ */
+export interface ContractPropertyShape {
+    /** `ZodObject` */
+    readonly kind: "object" | "array" | "record" | "other";
+    /** The declared target, e.g. `"FindingSchema"`. */
+    readonly typeName?: string;
+    /** `true` when the schema accepts `undefined` (`isOptional()`). */
+    readonly allowsUndefined?: boolean;
+    readonly inner?: ContractPropertyShape;
+    readonly key?: ContractPropertyShape;
+    readonly value?: ContractPropertyShape;
+    readonly shape?: Readonly<Record<string, ContractPropertyShape>>;
+}
+/** One validated contract type: its canonical schema, and what that schema's fields are. */
+export interface ContractTypeShape {
+    /** The type this contract declares, as it appears in a construction-site marker. */
+    readonly type: string;
+    /**
+     * The canonical schema a construction site must go through. This is the
+     * CONSTRUCTION SITE the derivation starts from — not a typecheck assertion: a
+     * cast silences a typecheck, and a cast is exactly how a producer would keep
+     * missing a field the contract added.
+     */
+    readonly schema: string;
+    /** The schema's own `shape`, for the comparison below. */
+    readonly properties: Readonly<Record<string, ContractPropertyShape>>;
+}
+/** The registry. One row per validated contract type; nothing else is derived by hand. */
+export declare const CONTRACT_PROPERTY_SHAPES: readonly ContractTypeShape[];
+//# sourceMappingURL=contractPropertyShapes.d.ts.map

package/dist/shared/types/contractPropertyShapes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contractPropertyShapes.d.ts","sourceRoot":"","sources":["../../../src/shared/types/contractPropertyShapes.ts"],"names":[],"mappings":"AA0CA;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,kBAAkB;IAClB,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;IACvD,mDAAmD;IACnD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC;CAClE;AAED,4FAA4F;AAC5F,MAAM,WAAW,iBAAiB;IAChC,oFAAoF;IACpF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC;CACtE;AAwND,0FAA0F;AAC1F,eAAO,MAAM,wBAAwB,EAAE,SAAS,iBAAiB,EAehE,CAAC"}

package/dist/shared/types/contractPropertyShapes.js

@@ -0,0 +1,255 @@
+// The CONTRACT-TYPE registry — every validated contract type, paired with the
+// zod schema whose field set IS the contract.
+//
+// WHY THIS EXISTS. "Which files construct `AuditResult`?" was answerable only by
+// reading the tests, so the answer tracked where TESTS live rather than where the
+// contract is consumed: adding a field to a type swept `tests/**`, missed the
+// producers under `scripts/`, and failed release CI ([[lap-green-must-match-ci-evidence]]).
+// A per-type gate written by hand for `AuditResult` closed that one instance and
+// left the class open — the next contract type had the same hole, and nothing
+// said so.
+//
+// WHAT IT HOLDS. One row per validated contract type: the schema a producer must
+// go through to CONSTRUCT one, and the property shapes the gate compares that
+// schema's rendered JSON Schema against. Rows are CONTRACT-TYPED, never
+// author-supplied — a new contract lands here, and the reconciliation the gate
+// performs follows from the row rather than from anyone remembering to add a
+// check.
+//
+// WHY THE SHAPES ARE HERE AND NOT `z.infer`red. This module is imported through
+// the package subpath (`audit-tools/shared`), which resolves through `dist/`, and
+// the gate that reads it runs from `verify:checks` and from the pre-commit
+// skeleton in a tree that may have no `dist/` at all. `zod` is a runtime
+// dependency of the package, so importing zod here would put the gate behind a
+// build — exactly the dependency the pre-commit legs are built to avoid. Zod's
+// own type vocabulary is mirrored below as plain data instead, and
+// `tests/shared/contract-construction-sites.test.ts` drives the real `ZodObject`
+// values through the same walker, so the shapes cannot drift from the schemas
+// they describe without a test going red.
+//
+// ADDING A CONTRACT TYPE: add the row, name the producer in that type's module
+// (see `CONTRACT_SCHEMA_PRODUCERS` in `src/audit/contracts/workerSchemas.ts` for
+// the shape), and mark each construction site in the source with the marker the
+// gate derives from — `// construction-site: <type>` for a site inside a
+// producer, and `// contract-construction-sites: exempt — <why>` for a site that
+// deliberately has none. The gate reads `git grep` over the tracked tree, never a
+// list in this file.
+/** Shorthand: a property that is an object with its own shape, optionally itself optional. */
+const object = (shape, allowsUndefined = false) => ({ kind: "object", shape, allowsUndefined });
+/** Shorthand: a property that is an object shared by several properties. */
+const shaped = (typeName, shape) => ({
+    kind: "object",
+    typeName,
+    shape,
+});
+/** Shorthand: an array whose items carry a shape, optionally itself optional. */
+const arrayOf = (inner, allowsUndefined = false) => ({
+    kind: "array",
+    inner,
+    allowsUndefined,
+});
+/** Shorthand: a string, or a string the contract also allows to be absent. */
+const str = (allowsUndefined = false) => ({ kind: "other", allowsUndefined });
+// The shared contracts a finding carries, walked as their own types as well.
+// Each shape mirrors its zod declaration exactly — a `true` here means the zod
+// field carries `.optional()`, nothing else.
+const FINDING_LOCATION_SHAPE = {
+    path: str(),
+    line_start: str(true),
+    line_end: str(true),
+    symbol: str(true),
+    quoted_text: str(true),
+    hash_at_plan_time: str(true),
+};
+/**
+ * `AnchorExpectationSchema` is a discriminated union on `kind`, not an object —
+ * its variants are `{kind:"exit_zero"}`, `{kind:"exit_nonzero"}`,
+ * `{kind:"output_includes", text}` and `{kind:"output_excludes", text}`. It is
+ * walked as its own type with the fields all four variants share; `text` is
+ * present only on two of them, so it is optional here.
+ */
+const ANCHOR_EXPECTATION_SHAPE = { kind: str(), text: str(true) };
+const EXECUTABLE_ANCHOR_SHAPE = {
+    command: arrayOf(str()),
+    confirm_if: object(ANCHOR_EXPECTATION_SHAPE),
+    claim: str(true),
+};
+const ANALYZER_LEAD_PROVENANCE_SHAPE = {
+    analyzer_id: str(),
+    rule: str(true),
+    path: str(),
+    snippet_hash: str(),
+};
+const FINDING_GROUNDING_SHAPE = { status: str(), reason: str(true) };
+const CONTENT_COHERENCE_TRACE_SHAPE = {
+    normalized_items: arrayOf(object({})),
+    components: arrayOf(arrayOf(str())),
+};
+const COVERAGE_FILE_RECORD_SHAPE = { path: str(), total_lines: str(), reviewed_lines: str(true) };
+const AUDIT_VERIFICATION_SHAPE = {
+    verified: str(),
+    needs_followup: str(),
+    concerns: arrayOf(str()),
+    coverage_concerns: arrayOf(str()),
+    confidence_concerns: arrayOf(str()),
+    followup_tasks: arrayOf(object({})),
+};
+/**
+ * The canonical Finding contract (`FindingSchema`, src/shared/types/finding.ts).
+ * The auditor narrows `lens` to its `Lens` union; the remediator consumes the
+ * field as a plain string — both go through this one shape.
+ */
+const FINDING_SHAPE = {
+    id: str(),
+    title: str(),
+    category: str(),
+    severity: str(),
+    severity_downgraded_from: str(true),
+    confidence: str(),
+    lens: str(),
+    summary: str(),
+    affected_files: arrayOf(shaped("FindingLocationSchema", FINDING_LOCATION_SHAPE)),
+    impact: str(true),
+    likelihood: str(true),
+    // Optional on the base contract; the per-file WORKER contract requires it
+    // (`.min(1)`). That asymmetry is the one `FindingEvidenceLaneSchema` documents
+    // — a consumer that tests `evidence` tests a field half its inputs were never
+    // asked for — and it is a declared `requiredOverride` on the schema pairing.
+    evidence: arrayOf(str(), true),
+    reproduction: arrayOf(str(), true),
+    systemic: str(true),
+    related_findings: arrayOf(str(), true),
+    theme_id: str(true),
+    blast_radius: str(true),
+    evidence_grounded: str(true),
+    grounding: object(FINDING_GROUNDING_SHAPE, true),
+    evidence_lane: str(true),
+    verification_status: str(true),
+    executable_anchor: object(EXECUTABLE_ANCHOR_SHAPE, true),
+    contract_goal_id: str(true),
+    contract_obligation_ids: arrayOf(str(), true),
+    verification_obligation_ids: arrayOf(str(), true),
+    targeted_commands: arrayOf(str(), true),
+    analyzer_provenance: object(ANALYZER_LEAD_PROVENANCE_SHAPE, true),
+    lead_lineage: object({ producer: str(), source_hash: str() }, true),
+};
+// Each nested contract a finding carries, walked as its own type as well. Each
+// shape mirrors its zod declaration exactly: a `true` argument means the zod
+// field carries `.optional()`, and nothing else does.
+const FINDING_LOCATION_TYPE = {
+    type: "FindingLocation",
+    schema: "FindingLocationObjectSchema",
+    properties: FINDING_LOCATION_SHAPE,
+};
+const EXECUTABLE_ANCHOR_TYPE = {
+    type: "ExecutableAnchor",
+    schema: "ExecutableAnchorSchema",
+    properties: EXECUTABLE_ANCHOR_SHAPE,
+};
+const ANALYZER_LEAD_PROVENANCE_TYPE = {
+    type: "AnalyzerLeadProvenance",
+    schema: "AnalyzerLeadProvenanceSchema",
+    properties: ANALYZER_LEAD_PROVENANCE_SHAPE,
+};
+const FINDING_GROUNDING_TYPE = {
+    type: "FindingGrounding",
+    schema: "FindingGroundingSchema",
+    properties: FINDING_GROUNDING_SHAPE,
+};
+const CONTENT_COHERENCE_TRACE_TYPE = {
+    type: "ContentCoherenceTrace",
+    schema: "ContentCoherenceTraceSchema",
+    properties: CONTENT_COHERENCE_TRACE_SHAPE,
+};
+// The worker contract's own nested types (src/audit/types.ts).
+const AUDIT_VERIFICATION_TYPE = {
+    type: "AuditVerification",
+    schema: "AuditVerificationSchema",
+    properties: AUDIT_VERIFICATION_SHAPE,
+};
+const COVERAGE_FILE_RECORD_TYPE = {
+    type: "CoverageFileRecord",
+    schema: "CoverageFileRecordSchema",
+    properties: COVERAGE_FILE_RECORD_SHAPE,
+};
+const AUDIT_TASK_TYPE = {
+    type: "AuditTask",
+    schema: "AuditTaskSchema",
+    properties: {
+        task_id: str(),
+        unit_id: str(),
+        pass_id: str(),
+        lens: str(),
+        file_paths: arrayOf(str()),
+        // All four are `.optional()` in `AuditTaskSchema`; the row said required.
+        // Found by the widened optionality half (D5) — the row was never checked
+        // against its own schema before, because the test skipped `AuditTask`.
+        file_line_counts: { kind: "record", value: str(), allowsUndefined: true },
+        line_ranges: arrayOf(object({ path: str(), start: str(), end: str() }), true),
+        inputs: { kind: "record", value: str(), allowsUndefined: true },
+        rationale: str(),
+        priority: str(true),
+        token_estimate: str(true),
+        risk_estimate: str(true),
+        tags: arrayOf(str(), true),
+        status: str(true),
+        completed_at: str(true),
+        completion_reason: str(true),
+    },
+};
+const AUDIT_RESULT_TYPE = {
+    type: "AuditResult",
+    schema: "AuditResultSchema",
+    properties: {
+        task_id: str(),
+        unit_id: str(),
+        pass_id: str(),
+        lens: str(),
+        agent_role: str(true),
+        // `WorkerAuditResultSchema` strengthens this to a non-empty array.
+        file_coverage: arrayOf(source("CoverageFileRecordSchema")),
+        findings: arrayOf(source("FindingSchema")),
+        reviewed_clean: str(true),
+        // `notes` and `followup_tasks` are optional in the contract, and the row said
+        // required — exactly the drift the optionality half of the registry suite
+        // exists to catch, found the moment that half stopped checking `Finding`
+        // alone (D5).
+        notes: arrayOf(str(), true),
+        requires_followup: str(true),
+        followup_tasks: arrayOf(str(), true),
+        verification: { ...source("AuditVerificationSchema"), allowsUndefined: true },
+        run_id: str(true),
+        submitted_at: str(true),
+        instance_id: str(true),
+        identity_key: str(true),
+        idempotency_key: str(true),
+        emit_source: str(true),
+        attempt: str(true),
+    },
+};
+/**
+ * A property whose shape is another ROW of this registry — resolved by the
+ * walker, so the contract graph is followed rather than restated. `typeName` is
+ * the schema name; the walker looks it up below.
+ */
+function source(schemaName) {
+    return { kind: "object", typeName: schemaName };
+}
+/** The registry. One row per validated contract type; nothing else is derived by hand. */
+export const CONTRACT_PROPERTY_SHAPES = [
+    {
+        type: "Finding",
+        schema: "FindingSchema",
+        properties: FINDING_SHAPE,
+    },
+    FINDING_LOCATION_TYPE,
+    EXECUTABLE_ANCHOR_TYPE,
+    ANALYZER_LEAD_PROVENANCE_TYPE,
+    FINDING_GROUNDING_TYPE,
+    CONTENT_COHERENCE_TRACE_TYPE,
+    AUDIT_RESULT_TYPE,
+    AUDIT_TASK_TYPE,
+    AUDIT_VERIFICATION_TYPE,
+    COVERAGE_FILE_RECORD_TYPE,
+];
+//# sourceMappingURL=contractPropertyShapes.js.map

package/dist/shared/types/contractPropertyShapes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contractPropertyShapes.js","sourceRoot":"","sources":["../../../src/shared/types/contractPropertyShapes.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,8CAA8C;AAC9C,EAAE;AACF,iFAAiF;AACjF,kFAAkF;AAClF,8EAA8E;AAC9E,4FAA4F;AAC5F,iFAAiF;AACjF,8EAA8E;AAC9E,WAAW;AACX,EAAE;AACF,iFAAiF;AACjF,8EAA8E;AAC9E,wEAAwE;AACxE,+EAA+E;AAC/E,6EAA6E;AAC7E,SAAS;AACT,EAAE;AACF,gFAAgF;AAChF,kFAAkF;AAClF,2EAA2E;AAC3E,yEAAyE;AACzE,+EAA+E;AAC/E,+EAA+E;AAC/E,mEAAmE;AACnE,iFAAiF;AACjF,8EAA8E;AAC9E,0CAA0C;AAC1C,EAAE;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,gFAAgF;AAChF,yEAAyE;AACzE,iFAAiF;AACjF,kFAAkF;AAClF,qBAAqB;AAwCrB,8FAA8F;AAC9F,MAAM,MAAM,GAAG,CACb,KAA4C,EAC5C,eAAe,GAAG,KAAK,EACA,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;AAEzE,4EAA4E;AAC5E,MAAM,MAAM,GAAG,CAAC,QAAgB,EAAE,KAA4C,EAAyB,EAAE,CAAC,CAAC;IACzG,IAAI,EAAE,QAAQ;IACd,QAAQ;IACR,KAAK;CACN,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,OAAO,GAAG,CAAC,KAA4B,EAAE,eAAe,GAAG,KAAK,EAAyB,EAAE,CAAC,CAAC;IACjG,IAAI,EAAE,OAAO;IACb,KAAK;IACL,eAAe;CAChB,CAAC,CAAC;AAEH,8EAA8E;AAC9E,MAAM,GAAG,GAAG,CAAC,eAAe,GAAG,KAAK,EAAyB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;AAErG,6EAA6E;AAC7E,+EAA+E;AAC/E,6CAA6C;AAC7C,MAAM,sBAAsB,GAAG;IAC7B,IAAI,EAAE,GAAG,EAAE;IACX,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC;IACrB,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC;IACnB,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC;IACjB,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC;IACtB,iBAAiB,EAAE,GAAG,CAAC,IAAI,CAAC;CAC7B,CAAC;AACF;;;;;;GAMG;AACH,MAAM,wBAAwB,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;AAClE,MAAM,uBAAuB,GAAG;IAC9B,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC,wBAAwB,CAAC;IAC5C,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC;CACjB,CAAC;AACF,MAAM,8BAA8B,GAAG;IACrC,WAAW,EAAE,GAAG,EAAE;IAClB,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC;IACf,IAAI,EAAE,GAAG,EAAE;IACX,YAAY,EAAE,GAAG,EAAE;CACpB,CAAC;AACF,MAAM,uBAAuB,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;AACrE,MAAM,6BAA6B,GAAG;IACpC,gBAAgB,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACrC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;CACpC,CAAC;AACF,MAAM,0BAA0B,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;AAClG,MAAM,wBAAwB,GAAG;IAC/B,QAAQ,EAAE,GAAG,EAAE;IACf,cAAc,EAAE,GAAG,EAAE;IACrB,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;IACxB,iBAAiB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;IACjC,mBAAmB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;IACnC,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;CACpC,CAAC;AAEF;;;;GAIG;AACH,MAAM,aAAa,GAA0C;IAC3D,EAAE,EAAE,GAAG,EAAE;IACT,KAAK,EAAE,GAAG,EAAE;IACZ,QAAQ,EAAE,GAAG,EAAE;IACf,QAAQ,EAAE,GAAG,EAAE;IACf,wBAAwB,EAAE,GAAG,CAAC,IAAI,CAAC;IACnC,UAAU,EAAE,GAAG,EAAE;IACjB,IAAI,EAAE,GAAG,EAAE;IACX,OAAO,EAAE,GAAG,EAAE;IACd,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,uBAAuB,EAAE,sBAAsB,CAAC,CAAC;IAChF,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC;IACjB,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC;IACrB,0EAA0E;IAC1E,+EAA+E;IAC/E,8EAA8E;IAC9E,6EAA6E;IAC7E,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC;IAC9B,YAAY,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC;IAClC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC;IACnB,gBAAgB,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC;IACtC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC;IACnB,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC;IACvB,iBAAiB,EAAE,GAAG,CAAC,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC,uBAAuB,EAAE,IAAI,CAAC;IAChD,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC;IACxB,mBAAmB,EAAE,GAAG,CAAC,IAAI,CAAC;IAC9B,iBAAiB,EAAE,MAAM,CAAC,uBAAuB,EAAE,IAAI,CAAC;IACxD,gBAAgB,EAAE,GAAG,CAAC,IAAI,CAAC;IAC3B,uBAAuB,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC;IAC7C,2BAA2B,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC;IACjD,iBAAiB,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC;IACvC,mBAAmB,EAAE,MAAM,CAAC,8BAA8B,EAAE,IAAI,CAAC;IACjE,YAAY,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC;CACpE,CAAC;AAEF,+EAA+E;AAC/E,6EAA6E;AAC7E,sDAAsD;AACtD,MAAM,qBAAqB,GAAsB;IAC/C,IAAI,EAAE,iBAAiB;IACvB,MAAM,EAAE,6BAA6B;IACrC,UAAU,EAAE,sBAAsB;CACnC,CAAC;AACF,MAAM,sBAAsB,GAAsB;IAChD,IAAI,EAAE,kBAAkB;IACxB,MAAM,EAAE,wBAAwB;IAChC,UAAU,EAAE,uBAAuB;CACpC,CAAC;AACF,MAAM,6BAA6B,GAAsB;IACvD,IAAI,EAAE,wBAAwB;IAC9B,MAAM,EAAE,8BAA8B;IACtC,UAAU,EAAE,8BAA8B;CAC3C,CAAC;AACF,MAAM,sBAAsB,GAAsB;IAChD,IAAI,EAAE,kBAAkB;IACxB,MAAM,EAAE,wBAAwB;IAChC,UAAU,EAAE,uBAAuB;CACpC,CAAC;AACF,MAAM,4BAA4B,GAAsB;IACtD,IAAI,EAAE,uBAAuB;IAC7B,MAAM,EAAE,6BAA6B;IACrC,UAAU,EAAE,6BAA6B;CAC1C,CAAC;AAEF,+DAA+D;AAC/D,MAAM,uBAAuB,GAAsB;IACjD,IAAI,EAAE,mBAAmB;IACzB,MAAM,EAAE,yBAAyB;IACjC,UAAU,EAAE,wBAAwB;CACrC,CAAC;AACF,MAAM,yBAAyB,GAAsB;IACnD,IAAI,EAAE,oBAAoB;IAC1B,MAAM,EAAE,0BAA0B;IAClC,UAAU,EAAE,0BAA0B;CACvC,CAAC;AACF,MAAM,eAAe,GAAsB;IACzC,IAAI,EAAE,WAAW;IACjB,MAAM,EAAE,iBAAiB;IACzB,UAAU,EAAE;QACV,OAAO,EAAE,GAAG,EAAE;QACd,OAAO,EAAE,GAAG,EAAE;QACd,OAAO,EAAE,GAAG,EAAE;QACd,IAAI,EAAE,GAAG,EAAE;QACX,UAAU,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,0EAA0E;QAC1E,yEAAyE;QACzE,uEAAuE;QACvE,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;QACzE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC;QAC7E,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;QAC/D,SAAS,EAAE,GAAG,EAAE;QAChB,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC;QACnB,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC;QACzB,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC;QACxB,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC;QAC1B,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC;QACjB,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC;QACvB,iBAAiB,EAAE,GAAG,CAAC,IAAI,CAAC;KAC7B;CACF,CAAC;AAEF,MAAM,iBAAiB,GAAsB;IAC3C,IAAI,EAAE,aAAa;IACnB,MAAM,EAAE,mBAAmB;IAC3B,UAAU,EAAE;QACV,OAAO,EAAE,GAAG,EAAE;QACd,OAAO,EAAE,GAAG,EAAE;QACd,OAAO,EAAE,GAAG,EAAE;QACd,IAAI,EAAE,GAAG,EAAE;QACX,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC;QACrB,mEAAmE;QACnE,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC;QAC1D,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC1C,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC;QACzB,8EAA8E;QAC9E,0EAA0E;QAC1E,yEAAyE;QACzE,cAAc;QACd,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC;QAC3B,iBAAiB,EAAE,GAAG,CAAC,IAAI,CAAC;QAC5B,cAAc,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC;QACpC,YAAY,EAAE,EAAE,GAAG,MAAM,CAAC,yBAAyB,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE;QAC7E,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC;QACjB,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC;QACvB,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC;QACtB,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC;QACvB,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC;QAC1B,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC;QACtB,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC;KACnB;CACF,CAAC;AAEF;;;;GAIG;AACH,SAAS,MAAM,CAAC,UAAkB;IAChC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AAClD,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,MAAM,wBAAwB,GAAiC;IACpE;QACE,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,eAAe;QACvB,UAAU,EAAE,aAAa;KAC1B;IACD,qBAAqB;IACrB,sBAAsB;IACtB,6BAA6B;IAC7B,sBAAsB;IACtB,4BAA4B;IAC5B,iBAAiB;IACjB,eAAe;IACf,uBAAuB;IACvB,yBAAyB;CAC1B,CAAC"}