audit-tools 0.51.7 → 0.51.9

package/dist/audit/types/systemicChallenge.d.ts

@@ -1,6 +1,7 @@
 import type { Finding } from "../types.js";
 import type { Ceiling } from "audit-tools/shared";
 import type { AggregateMetricsDigest } from "../systemic/metricsDigestTypes.js";
+import type { SystemicCoveredThemes } from "../systemic/coveredThemes.js";
 /**
  * The `systemic_challenge.json` artifact — Phase E of the conceptual design-review:
  * the SYSTEMIC IMPROVEMENT-SEEKING CHALLENGE LOOP. A second-order adversary (a
@@ -77,19 +78,54 @@ export interface SystemicChallengeRegister {
      */
     folded_submission_hashes?: string[];
     /**
-     * True once the required number of CONSECUTIVE rounds surfaced nothing new
-     * (the loop terminated) — see `convergence_rule` for the applied count.
+     * True once the loop has ENDED — whatever ended it. The register's own
+     * satisfaction signal (`state.ts`, `obligationPolicy.ts`): a register that has
+     * not ended keeps the obligation unmet and the next round is dispatched.
+     *
+     * ⚠ It does NOT mean "converged on a dry signal", and it never did — an
+     * omitted register (shallow ceiling) has been `converged: true` since the loop
+     * landed. `stop_reason` states WHICH ending this was; a reader that needs to
+     * know whether the adversary actually ran dry must read that, not this.
      */
     converged: boolean;
     /**
-     * The convergence rule the enforcement half applied: the loop terminates
-     * only after `quiet_rounds_required` CONSECUTIVE dry rounds (owner decision
-     * 2026-08-28 — one dry round let a single duplicate submission terminate the
-     * adversary loop permanently). Optional because registers written before the
-     * rule existed do not carry it; every current writer records it.
+     * WHY the loop ended. `converged` says it ended; this says how, so a ceiling
+     * stop or a host-forced stop can never be read as an exhaustion the loop did
+     * not demonstrate (the no-ceiling entry: the loop's only exit was a dry signal
+     * the host may have had to fabricate). Optional — registers written before
+     * this existed carry only `converged`.
+     */
+    stop_reason?: "converged" | "round_ceiling" | "host_forced";
+    /**
+     * What the banked improvements already cover, summarized — the variation bar's
+     * factual half, handed to the next round so it can name the axis it departs
+     * on. Absent on an omitted register (nothing was ever banked).
+     */
+    covered_themes?: SystemicCoveredThemes;
+    /**
+     * The PREMISE this loop is running against: a digest of the upstream artifacts
+     * (charter register / conceptual adjudication / intent checkpoint / repo
+     * manifest — the same four the dependency map names) as they stood when the
+     * loop opened.
+     *
+     * It binds the loop to its premise rather than to the artifacts directory. A
+     * re-emission within a run sees the same token and carries its rounds forward;
+     * a run whose premise differs starts a FRESH loop, so a round counter and a
+     * banked set cannot silently carry across runs — the LEAD the re-dogfood
+     * recorded (round 10, 11 improvements, none of them this run's).
+     */
+    round_token?: string;
+    /**
+     * The convergence rule the enforcement half applied: the loop terminates after
+     * `quiet_rounds_required` CONSECUTIVE dry rounds (owner decision 2026-08-28 —
+     * one dry round let a single duplicate submission terminate the adversary loop
+     * permanently), and in any case at `round_ceiling` rounds. Optional because
+     * registers written before the rule existed do not carry it; every current
+     * writer records it.
      */
     convergence_rule?: {
         quiet_rounds_required: number;
+        round_ceiling?: number;
     };
     /** Every distinct improvement finding surfaced, carrying its TRUE lens. */
     findings: Finding[];

package/dist/audit/types/systemicChallenge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"systemicChallenge.d.ts","sourceRoot":"","sources":["../../../src/audit/types/systemicChallenge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAEhF;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,WAAW,sBAAsB;IACrC,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;OAIG;IACH,GAAG,EAAE,OAAO,CAAC;CACd;AAED,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,MAAM,EAAE,oBAAoB,CAAC;IAC7B;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB;;;;OAIG;IACH,OAAO,CAAC,EAAE,sBAAsB,CAAC;IACjC,qDAAqD;IACrD,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACjC;;;;;;;;;OASG;IACH,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;IACpC;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE;QAAE,qBAAqB,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,2EAA2E;IAC3E,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,mFAAmF;IACnF,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B"}
+{"version":3,"file":"systemicChallenge.d.ts","sourceRoot":"","sources":["../../../src/audit/types/systemicChallenge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAChF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,WAAW,sBAAsB;IACrC,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;OAIG;IACH,GAAG,EAAE,OAAO,CAAC;CACd;AAED,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,MAAM,EAAE,oBAAoB,CAAC;IAC7B;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB;;;;OAIG;IACH,OAAO,CAAC,EAAE,sBAAsB,CAAC;IACjC,qDAAqD;IACrD,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACjC;;;;;;;;;OASG;IACH,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;IACpC;;;;;;;;;OASG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,WAAW,GAAG,eAAe,GAAG,aAAa,CAAC;IAC5D;;;;OAIG;IACH,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE;QAAE,qBAAqB,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7E,2EAA2E;IAC3E,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,mFAAmF;IACnF,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B"}

package/dist/audit/types.d.ts

@@ -11,8 +11,8 @@ export interface LensDefinition {
     default_enabled: boolean;
 }
 /** Single source of truth for all lens metadata. Adding or renaming a lens
- * requires a single edit here; `ALL_LENSES`, `ENABLED_LENSES`, and
- * `LENS_ORDER` (in auditTaskUtils) are all derived from this registry. */
+ * requires a single edit here; `ALL_LENSES` (below) and `LENS_ORDER` (in
+ * auditTaskUtils) are both derived from this registry. */
 export declare const LENS_REGISTRY: readonly LensDefinition[];
 /** Canonical list of every valid {@link Lens}. Derived from {@link LENS_REGISTRY}
  * — import {@link isLens} / `ALL_LENSES` instead of hand-copying lens lists into
@@ -79,6 +79,22 @@ export declare const RepoManifestSchema: z.ZodObject<{
         hash?: string | undefined;
         exclusion_reason?: string | undefined;
     }>, "many">;
+    /**
+     * Content key of the git INDEX state for this manifest's candidate paths —
+     * the tracked intersection, sorted and hashed. Set by the live probe
+     * (`scopeIndexBaseline.ts`) on every advance, like `tooling_manifest.json`'s
+     * environment probe, so an index-only move (a file staged or unstaged with no
+     * content edit) moves the manifest's content hash and re-stales
+     * `file_disposition.json` through the EXISTING declared edge.
+     *
+     * It lives on the manifest rather than as its own artifact deliberately: the
+     * index is an input the manifest's own reader (`buildFileDisposition`) is
+     * already downstream of, so the edge needs no addition to the staleness DAG —
+     * `spec/audit/dependency-map.md` is untouched. Absent when git could not be
+     * read (no root / no work tree / git absent): absence is "no index claim",
+     * never a claim that the index is empty.
+     */
+    scope_index_key: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     files: {
         path: string;
@@ -94,6 +110,7 @@ export declare const RepoManifestSchema: z.ZodObject<{
         root?: string | undefined;
         default_branch?: string | undefined;
     };
+    scope_index_key?: string | undefined;
 }, {
     files: {
         path: string;
@@ -109,6 +126,7 @@ export declare const RepoManifestSchema: z.ZodObject<{
         root?: string | undefined;
         default_branch?: string | undefined;
     };
+    scope_index_key?: string | undefined;
 }>;
 export type RepoManifest = z.infer<typeof RepoManifestSchema>;
 export declare const AuditUnitSchema: z.ZodObject<{
@@ -524,6 +542,7 @@ export declare const AuditResultSchema: z.ZodObject<{
         title: z.ZodString;
         category: z.ZodString;
         severity: z.ZodEnum<["critical", "high", "medium", "low", "info"]>;
+        severity_downgraded_from: z.ZodOptional<z.ZodEnum<["critical", "high", "medium", "low", "info"]>>;
         confidence: z.ZodEnum<["high", "medium", "low"]>;
         lens: z.ZodString;
         summary: z.ZodString;
@@ -582,6 +601,7 @@ export declare const AuditResultSchema: z.ZodObject<{
             status: "grounded" | "ungrounded" | "refuted";
             reason?: string | undefined;
         }>>;
+        evidence_lane: z.ZodOptional<z.ZodEnum<["per-file-lane", "design-review-lane"]>>;
         verification_status: z.ZodOptional<z.ZodEnum<["judge_confirmed", "asserted", "refuted_at_head"]>>;
         executable_anchor: z.ZodOptional<z.ZodObject<{
             command: z.ZodArray<z.ZodString, "many">;
@@ -666,6 +686,19 @@ export declare const AuditResultSchema: z.ZodObject<{
             snippet_hash: string;
             rule?: string | undefined;
         }>>;
+        lead_lineage: z.ZodOptional<z.ZodObject<{
+            producer: z.ZodString;
+            source_hash: z.ZodString;
+            confirmation: z.ZodLiteral<"lead">;
+        }, "strict", z.ZodTypeAny, {
+            producer: string;
+            source_hash: string;
+            confirmation: "lead";
+        }, {
+            producer: string;
+            source_hash: string;
+            confirmation: "lead";
+        }>>;
     }, "strip", z.ZodTypeAny, {
         id: string;
         confidence: "high" | "low" | "medium";
@@ -682,6 +715,7 @@ export declare const AuditResultSchema: z.ZodObject<{
             quoted_text?: string | undefined;
             hash_at_plan_time?: string | undefined;
         }[];
+        severity_downgraded_from?: "high" | "low" | "critical" | "medium" | "info" | undefined;
         impact?: string | undefined;
         likelihood?: string | undefined;
         evidence?: string[] | undefined;
@@ -695,6 +729,7 @@ export declare const AuditResultSchema: z.ZodObject<{
             status: "grounded" | "ungrounded" | "refuted";
             reason?: string | undefined;
         } | undefined;
+        evidence_lane?: "per-file-lane" | "design-review-lane" | undefined;
         verification_status?: "judge_confirmed" | "asserted" | "refuted_at_head" | undefined;
         executable_anchor?: {
             command: string[];
@@ -721,6 +756,11 @@ export declare const AuditResultSchema: z.ZodObject<{
             snippet_hash: string;
             rule?: string | undefined;
         } | undefined;
+        lead_lineage?: {
+            producer: string;
+            source_hash: string;
+            confirmation: "lead";
+        } | undefined;
     }, {
         id: string;
         confidence: "high" | "low" | "medium";
@@ -737,6 +777,7 @@ export declare const AuditResultSchema: z.ZodObject<{
             quoted_text?: string | undefined;
             hash_at_plan_time?: string | undefined;
         }[];
+        severity_downgraded_from?: "high" | "low" | "critical" | "medium" | "info" | undefined;
         impact?: string | undefined;
         likelihood?: string | undefined;
         evidence?: string[] | undefined;
@@ -750,6 +791,7 @@ export declare const AuditResultSchema: z.ZodObject<{
             status: "grounded" | "ungrounded" | "refuted";
             reason?: string | undefined;
         } | undefined;
+        evidence_lane?: "per-file-lane" | "design-review-lane" | undefined;
         verification_status?: "judge_confirmed" | "asserted" | "refuted_at_head" | undefined;
         executable_anchor?: {
             command: string[];
@@ -776,6 +818,11 @@ export declare const AuditResultSchema: z.ZodObject<{
             snippet_hash: string;
             rule?: string | undefined;
         } | undefined;
+        lead_lineage?: {
+            producer: string;
+            source_hash: string;
+            confirmation: "lead";
+        } | undefined;
     }>, "many">;
     /**
      * Worker-authored affirmation that an EMPTY `findings` array is a reviewed
@@ -966,6 +1013,7 @@ export declare const AuditResultSchema: z.ZodObject<{
             quoted_text?: string | undefined;
             hash_at_plan_time?: string | undefined;
         }[];
+        severity_downgraded_from?: "high" | "low" | "critical" | "medium" | "info" | undefined;
         impact?: string | undefined;
         likelihood?: string | undefined;
         evidence?: string[] | undefined;
@@ -979,6 +1027,7 @@ export declare const AuditResultSchema: z.ZodObject<{
             status: "grounded" | "ungrounded" | "refuted";
             reason?: string | undefined;
         } | undefined;
+        evidence_lane?: "per-file-lane" | "design-review-lane" | undefined;
         verification_status?: "judge_confirmed" | "asserted" | "refuted_at_head" | undefined;
         executable_anchor?: {
             command: string[];
@@ -1005,6 +1054,11 @@ export declare const AuditResultSchema: z.ZodObject<{
             snippet_hash: string;
             rule?: string | undefined;
         } | undefined;
+        lead_lineage?: {
+            producer: string;
+            source_hash: string;
+            confirmation: "lead";
+        } | undefined;
     }[];
     lens: string;
     task_id: string;
@@ -1016,6 +1070,10 @@ export declare const AuditResultSchema: z.ZodObject<{
     notes?: string[] | undefined;
     run_id?: string | undefined;
     attempt?: number | undefined;
+    followup_tasks?: string[] | undefined;
+    agent_role?: string | undefined;
+    reviewed_clean?: boolean | undefined;
+    requires_followup?: boolean | undefined;
     verification?: {
         verified: boolean;
         needs_followup: boolean;
@@ -1045,10 +1103,6 @@ export declare const AuditResultSchema: z.ZodObject<{
             completion_reason?: string | undefined;
         }[] | undefined;
     } | undefined;
-    followup_tasks?: string[] | undefined;
-    agent_role?: string | undefined;
-    reviewed_clean?: boolean | undefined;
-    requires_followup?: boolean | undefined;
     submitted_at?: string | undefined;
     instance_id?: string | undefined;
     identity_key?: string | undefined;
@@ -1072,6 +1126,7 @@ export declare const AuditResultSchema: z.ZodObject<{
             quoted_text?: string | undefined;
             hash_at_plan_time?: string | undefined;
         }[];
+        severity_downgraded_from?: "high" | "low" | "critical" | "medium" | "info" | undefined;
         impact?: string | undefined;
         likelihood?: string | undefined;
         evidence?: string[] | undefined;
@@ -1085,6 +1140,7 @@ export declare const AuditResultSchema: z.ZodObject<{
             status: "grounded" | "ungrounded" | "refuted";
             reason?: string | undefined;
         } | undefined;
+        evidence_lane?: "per-file-lane" | "design-review-lane" | undefined;
         verification_status?: "judge_confirmed" | "asserted" | "refuted_at_head" | undefined;
         executable_anchor?: {
             command: string[];
@@ -1111,6 +1167,11 @@ export declare const AuditResultSchema: z.ZodObject<{
             snippet_hash: string;
             rule?: string | undefined;
         } | undefined;
+        lead_lineage?: {
+            producer: string;
+            source_hash: string;
+            confirmation: "lead";
+        } | undefined;
     }[];
     lens: string;
     task_id: string;
@@ -1122,6 +1183,10 @@ export declare const AuditResultSchema: z.ZodObject<{
     notes?: string[] | undefined;
     run_id?: string | undefined;
     attempt?: number | undefined;
+    followup_tasks?: string[] | undefined;
+    agent_role?: string | undefined;
+    reviewed_clean?: boolean | undefined;
+    requires_followup?: boolean | undefined;
     verification?: {
         verified: boolean;
         needs_followup: boolean;
@@ -1151,10 +1216,6 @@ export declare const AuditResultSchema: z.ZodObject<{
             completion_reason?: string | undefined;
         }[] | undefined;
     } | undefined;
-    followup_tasks?: string[] | undefined;
-    agent_role?: string | undefined;
-    reviewed_clean?: boolean | undefined;
-    requires_followup?: boolean | undefined;
     submitted_at?: string | undefined;
     instance_id?: string | undefined;
     identity_key?: string | undefined;

package/dist/audit/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGnE,MAAM,MAAM,IAAI,GACZ,aAAa,GACb,cAAc,GACd,iBAAiB,GACjB,UAAU,GACV,aAAa,GACb,aAAa,GACb,gBAAgB,GAChB,OAAO,GACP,aAAa,GACb,mBAAmB,GACnB,eAAe,CAAC;AAEpB;qEACqE;AACrE,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,IAAI,CAAC;IACT,YAAY,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED;;0EAE0E;AAC1E,eAAO,MAAM,aAAa,EAAE,SAAS,cAAc,EAYlD,CAAC;AAEF;;;wCAGwC;AACxC,eAAO,MAAM,UAAU,EAAE,SAAS,IAAI,EAAmC,CAAC;AAE1E,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,IAAI,CAIpD;AAED,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;EAO3B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQ7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;EAUjB,CAAC;AACZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAE7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;yEAOyE;AACzE,eAAO,MAAM,0BAA0B,qKAWrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;EAOnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAE/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;IAmB1B;;;;;;OAMG;;IAEH;;;;;OAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMH,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAMxD,MAAM,MAAM,OAAO,GAAG,aAAa,CAAC;AAEpC,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA5BlC;;;;;;WAMG;;QAEH;;;;;WAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBH,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAgB5B;;;;;;;;;;;OAWG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAhEH;;;;;;eAMG;;YAEH;;;;;eAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6EH,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGnE,MAAM,MAAM,IAAI,GACZ,aAAa,GACb,cAAc,GACd,iBAAiB,GACjB,UAAU,GACV,aAAa,GACb,aAAa,GACb,gBAAgB,GAChB,OAAO,GACP,aAAa,GACb,mBAAmB,GACnB,eAAe,CAAC;AAEpB;qEACqE;AACrE,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,IAAI,CAAC;IACT,YAAY,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED;;0DAE0D;AAC1D,eAAO,MAAM,aAAa,EAAE,SAAS,cAAc,EAYlD,CAAC;AAEF;;;wCAGwC;AACxC,eAAO,MAAM,UAAU,EAAE,SAAS,IAAI,EAAmC,CAAC;AAE1E,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,IAAI,CAIpD;AAED,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;EAO3B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAQ7B;;;;;;;;;;;;;;OAcG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEH,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;EAUjB,CAAC;AACZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAE7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;yEAOyE;AACzE,eAAO,MAAM,0BAA0B,qKAWrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;EAOnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAE/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;IAmB1B;;;;;;OAMG;;IAEH;;;;;OAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMH,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAMxD,MAAM,MAAM,OAAO,GAAG,aAAa,CAAC;AAOpC,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAjClC;;;;;;WAMG;;QAEH;;;;;WAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2BH,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAgB5B;;;;;;;;;;;OAWG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YArEH;;;;;;eAMG;;YAEH;;;;;eAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkFH,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/audit/types.js

@@ -1,8 +1,8 @@
 import { z } from "zod";
 import { FindingSchema } from "audit-tools/shared";
 /** Single source of truth for all lens metadata. Adding or renaming a lens
- * requires a single edit here; `ALL_LENSES`, `ENABLED_LENSES`, and
- * `LENS_ORDER` (in auditTaskUtils) are all derived from this registry. */
+ * requires a single edit here; `ALL_LENSES` (below) and `LENS_ORDER` (in
+ * auditTaskUtils) are both derived from this registry. */
 export const LENS_REGISTRY = [
     { id: "security", display_name: "Security", order_weight: 10, default_enabled: true },
     { id: "correctness", display_name: "Correctness", order_weight: 20, default_enabled: true },
@@ -40,6 +40,22 @@ export const RepoManifestSchema = z.object({
     }),
     generated_at: z.string(),
     files: z.array(FileRecordSchema),
+    /**
+     * Content key of the git INDEX state for this manifest's candidate paths —
+     * the tracked intersection, sorted and hashed. Set by the live probe
+     * (`scopeIndexBaseline.ts`) on every advance, like `tooling_manifest.json`'s
+     * environment probe, so an index-only move (a file staged or unstaged with no
+     * content edit) moves the manifest's content hash and re-stales
+     * `file_disposition.json` through the EXISTING declared edge.
+     *
+     * It lives on the manifest rather than as its own artifact deliberately: the
+     * index is an input the manifest's own reader (`buildFileDisposition`) is
+     * already downstream of, so the edge needs no addition to the staleness DAG —
+     * `spec/audit/dependency-map.md` is untouched. Absent when git could not be
+     * read (no root / no work tree / git absent): absence is "no index claim",
+     * never a claim that the index is empty.
+     */
+    scope_index_key: z.string().optional(),
 });
 export const AuditUnitSchema = z
     .object({
@@ -123,6 +139,11 @@ export const AuditTaskSchema = z.object({
     completed_at: z.string().optional(),
     completion_reason: z.string().optional(),
 });
+// contract-construction-sites: exempt — AuditVerification is authored by the HOST:
+// it answers the verification work item, and the tool only VALIDATES what arrives
+// (`validateOneAuditResult`). No producer in this repo constructs one, so there is
+// no site to mark — the absence is the design, not an oversight. The schema's own
+// required fields are still reconciled against the rendered worker schema.
 export const AuditVerificationSchema = z.object({
     verified: z.boolean(),
     needs_followup: z.boolean(),

package/dist/audit/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAyBnD;;0EAE0E;AAC1E,MAAM,CAAC,MAAM,aAAa,GAA8B;IACtD,EAAE,EAAE,EAAE,UAAU,EAAY,YAAY,EAAE,UAAU,EAAY,YAAY,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;IACzG,EAAE,EAAE,EAAE,aAAa,EAAS,YAAY,EAAE,aAAa,EAAS,YAAY,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;IACzG,EAAE,EAAE,EAAE,aAAa,EAAS,YAAY,EAAE,aAAa,EAAS,YAAY,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;IACzG,EAAE,EAAE,EAAE,gBAAgB,EAAM,YAAY,EAAE,gBAAgB,EAAM,YAAY,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;IACzG,EAAE,EAAE,EAAE,aAAa,EAAS,YAAY,EAAE,aAAa,EAAS,YAAY,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;IACzG,EAAE,EAAE,EAAE,cAAc,EAAQ,YAAY,EAAE,cAAc,EAAQ,YAAY,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;IACzG,EAAE,EAAE,EAAE,aAAa,EAAS,YAAY,EAAE,aAAa,EAAS,YAAY,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;IACzG,EAAE,EAAE,EAAE,mBAAmB,EAAG,YAAY,EAAE,qBAAqB,EAAC,YAAY,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;IACzG,EAAE,EAAE,EAAE,eAAe,EAAO,YAAY,EAAE,eAAe,EAAO,YAAY,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;IACzG,EAAE,EAAE,EAAE,iBAAiB,EAAK,YAAY,EAAE,iBAAiB,EAAK,YAAY,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE;IAC1G,EAAE,EAAE,EAAE,OAAO,EAAe,YAAY,EAAE,OAAO,EAAe,YAAY,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE;CAC3G,CAAC;AAEF;;;wCAGwC;AACxC,MAAM,CAAC,MAAM,UAAU,GAAoB,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAE1E,MAAM,UAAU,MAAM,CAAC,KAAc;IACnC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ,IAAK,UAAgC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC/E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACtC,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;CACjC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC/C,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;CAChC,CAAC,CAAC;AAWH;;;;;;;yEAOyE;AACzE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC;IAC/C,cAAc;IACd,YAAY;IACZ,UAAU;IACV,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,oBAAoB;IACpB,kBAAkB;IAClB,qBAAqB;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,qBAAqB,EAAE,0BAA0B;IACjD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACtC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;CACzC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/B,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7D,WAAW,EAAE,CAAC;SACX,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;KAChB,CAAC,CACH;SACA,QAAQ,EAAE;IACb,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD;;;;;;OAMG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC;;;;;OAKG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AASH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACjD,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,aAAa,EAAE,CAAC,CAAC,KAAK,CACpB,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;KACxB,CAAC,CACH;IACD,0EAA0E;IAC1E,qEAAqE;IACrE,mEAAmE;IACnE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IAChC;;;;;;;;;;;OAWG;IACH,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACtC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACzC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,YAAY,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAChD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,8EAA8E;IAC9E,8EAA8E;IAC9E,uEAAuE;IACvE,qEAAqE;IACrE,2EAA2E;IAC3E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,8EAA8E;IAC9E,8EAA8E;IAC9E,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,gFAAgF;IAChF,2EAA2E;IAC3E,8EAA8E;IAC9E,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAyBnD;;0DAE0D;AAC1D,MAAM,CAAC,MAAM,aAAa,GAA8B;IACtD,EAAE,EAAE,EAAE,UAAU,EAAY,YAAY,EAAE,UAAU,EAAY,YAAY,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;IACzG,EAAE,EAAE,EAAE,aAAa,EAAS,YAAY,EAAE,aAAa,EAAS,YAAY,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;IACzG,EAAE,EAAE,EAAE,aAAa,EAAS,YAAY,EAAE,aAAa,EAAS,YAAY,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;IACzG,EAAE,EAAE,EAAE,gBAAgB,EAAM,YAAY,EAAE,gBAAgB,EAAM,YAAY,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;IACzG,EAAE,EAAE,EAAE,aAAa,EAAS,YAAY,EAAE,aAAa,EAAS,YAAY,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;IACzG,EAAE,EAAE,EAAE,cAAc,EAAQ,YAAY,EAAE,cAAc,EAAQ,YAAY,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;IACzG,EAAE,EAAE,EAAE,aAAa,EAAS,YAAY,EAAE,aAAa,EAAS,YAAY,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;IACzG,EAAE,EAAE,EAAE,mBAAmB,EAAG,YAAY,EAAE,qBAAqB,EAAC,YAAY,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;IACzG,EAAE,EAAE,EAAE,eAAe,EAAO,YAAY,EAAE,eAAe,EAAO,YAAY,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;IACzG,EAAE,EAAE,EAAE,iBAAiB,EAAK,YAAY,EAAE,iBAAiB,EAAK,YAAY,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE;IAC1G,EAAE,EAAE,EAAE,OAAO,EAAe,YAAY,EAAE,OAAO,EAAe,YAAY,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE;CAC3G,CAAC;AAEF;;;wCAGwC;AACxC,MAAM,CAAC,MAAM,UAAU,GAAoB,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAE1E,MAAM,UAAU,MAAM,CAAC,KAAc;IACnC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ,IAAK,UAAgC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC/E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACtC,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAChC;;;;;;;;;;;;;;OAcG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC/C,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;CAChC,CAAC,CAAC;AAWH;;;;;;;yEAOyE;AACzE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC;IAC/C,cAAc;IACd,YAAY;IACZ,UAAU;IACV,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,oBAAoB;IACpB,kBAAkB;IAClB,qBAAqB;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,qBAAqB,EAAE,0BAA0B;IACjD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACtC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;CACzC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/B,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7D,WAAW,EAAE,CAAC;SACX,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;KAChB,CAAC,CACH;SACA,QAAQ,EAAE;IACb,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD;;;;;;OAMG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC;;;;;OAKG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AASH,mFAAmF;AACnF,kFAAkF;AAClF,mFAAmF;AACnF,kFAAkF;AAClF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACjD,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,aAAa,EAAE,CAAC,CAAC,KAAK,CACpB,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;KACxB,CAAC,CACH;IACD,0EAA0E;IAC1E,qEAAqE;IACrE,mEAAmE;IACnE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IAChC;;;;;;;;;;;OAWG;IACH,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACtC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACzC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,YAAY,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAChD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,8EAA8E;IAC9E,8EAA8E;IAC9E,uEAAuE;IACvE,qEAAqE;IACrE,2EAA2E;IAC3E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,8EAA8E;IAC9E,8EAA8E;IAC9E,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,gFAAgF;IAChF,2EAA2E;IAC3E,8EAA8E;IAC9E,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC"}

package/dist/audit/validation/auditResults.d.ts

@@ -51,6 +51,36 @@ export declare function isSignificantLineCountDivergence(got: number, expected:
  * `"."`, so callers can keep testing `length > 0` for "no usable path".
  */
 export declare function normalizeCoveragePath(path: string): string;
+/**
+ * THE ONE CONTAINMENT RULE for a follow-up task's `file_paths` — the allowed
+ * set, built from the path sources BOTH doors have.
+ *
+ * Two doors judge this property: the host-result boundary admits a steward
+ * submission's `verification` (`verificationContractFailure`,
+ * `src/audit/cli/dispatch/hostHandoff.ts`) and the batch validator rejects a
+ * result that reaches `validateAuditResults` (`validateVerification` here). They
+ * were built separately — one from the binding's `file_line_counts` keys plus
+ * the submitted envelope's `file_coverage`, the other from the RESULT's coverage
+ * plus `options.boundaryPaths` — and agreed only because no production caller
+ * passes `boundaryPaths`. That is agreement by the accidental absence of an
+ * input, so both now build their set through this function and agree by
+ * construction.
+ *
+ * The `boundary` argument is the per-door extra: the packet/unit boundary at the
+ * batch door, nothing at the host door. An empty or absent one adds nothing, so
+ * the gate stays at the path sources the caller actually supplied.
+ *
+ * Paths are normalized here and nowhere else on this rule, so the two doors join
+ * on the one key space even when a caller passes raw spellings.
+ */
+export declare function verificationAllowedPaths(params: {
+    /** Coverage paths of the submitted/received result. */
+    readonly coveragePaths?: Iterable<string>;
+    /** The work item's own file set (the binding's keys, or the task's files). */
+    readonly assignedPaths?: Iterable<string>;
+    /** Packet/unit boundary files — widens, never narrows. */
+    readonly boundaryPaths?: Iterable<string>;
+}): Set<string>;
 export interface AuditResultIssue extends ValidationIssue {
     result_index: number;
     task_id: string;

package/dist/audit/validation/auditResults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auditResults.d.ts","sourceRoot":"","sources":["../../../src/audit/validation/auditResults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAW,MAAM,aAAa,CAAC;AAEtD,OAAO,EASL,KAAK,eAAe,EACrB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,SAAS,CAAC;AAEhD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;EAgBrB,CAAC;AAEX,8EAA8E;AAC9E,wBAAgB,eAAe,CAC7B,EAAE,EAAE,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAC5C,MAAM,CAIR;AAkBD;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAKvF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,MAAM,WAAW,gBAAiB,SAAQ,eAAe;IACvD,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,aAAa,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,0BAA0B;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAs3BD;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,OAAO,EACf,KAAK,EAAE,SAAS,EAAE,EAClB,OAAO,GAAE,0BAA+B,GACvC,gBAAgB,EAAE,CAmBpB;AA0DD,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,SAAS,EAAE,EAClB,OAAO,GAAE,0BAA+B,GACvC,gBAAgB,EAAE,CA+BpB;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAQ1E"}
+{"version":3,"file":"auditResults.d.ts","sourceRoot":"","sources":["../../../src/audit/validation/auditResults.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAW,MAAM,aAAa,CAAC;AAOtD,OAAO,EASL,KAAK,eAAe,EACrB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,SAAS,CAAC;AAEhD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;EAgBrB,CAAC;AAEX,8EAA8E;AAC9E,wBAAgB,eAAe,CAC7B,EAAE,EAAE,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAC5C,MAAM,CAIR;AAkBD;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAKvF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,uDAAuD;IACvD,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1C,8EAA8E;IAC9E,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1C,0DAA0D;IAC1D,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CAC3C,GAAG,GAAG,CAAC,MAAM,CAAC,CAWd;AAED,MAAM,WAAW,gBAAiB,SAAQ,eAAe;IACvD,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,aAAa,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,0BAA0B;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAo3BD;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,OAAO,EACf,KAAK,EAAE,SAAS,EAAE,EAClB,OAAO,GAAE,0BAA+B,GACvC,gBAAgB,EAAE,CAmBpB;AA0DD,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,SAAS,EAAE,EAClB,OAAO,GAAE,0BAA+B,GACvC,gBAAgB,EAAE,CA+BpB;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAQ1E"}

package/dist/audit/validation/auditResults.js

@@ -1,4 +1,9 @@
 import { isUnmeasuredLineCount } from "../cli/lineIndex.js";
+// The lane token is single-sourced where the steward lane is MINTED. A local
+// literal here would be a second spelling of a token this validator gates on
+// and `isLensVerificationTask` filters on — two copies that agree only until
+// one is renamed.
+import { LENS_VERIFICATION_TAG } from "../orchestrator/selectiveDeepening/shared.js";
 import { describeValue, findingLocationLineIssues, formatValidationIssues, isRecord, normalizeGraphPath, VALID_LENSES, VALID_SEVERITIES, VALID_CONFIDENCES, } from "audit-tools/shared";
 /**
  * THE one statement of each finding/result rule that is NOT expressible as a
@@ -84,6 +89,45 @@ export function normalizeCoveragePath(path) {
     const trimmed = path.trim();
     return trimmed.length === 0 ? "" : normalizeGraphPath(trimmed);
 }
+/**
+ * THE ONE CONTAINMENT RULE for a follow-up task's `file_paths` — the allowed
+ * set, built from the path sources BOTH doors have.
+ *
+ * Two doors judge this property: the host-result boundary admits a steward
+ * submission's `verification` (`verificationContractFailure`,
+ * `src/audit/cli/dispatch/hostHandoff.ts`) and the batch validator rejects a
+ * result that reaches `validateAuditResults` (`validateVerification` here). They
+ * were built separately — one from the binding's `file_line_counts` keys plus
+ * the submitted envelope's `file_coverage`, the other from the RESULT's coverage
+ * plus `options.boundaryPaths` — and agreed only because no production caller
+ * passes `boundaryPaths`. That is agreement by the accidental absence of an
+ * input, so both now build their set through this function and agree by
+ * construction.
+ *
+ * The `boundary` argument is the per-door extra: the packet/unit boundary at the
+ * batch door, nothing at the host door. An empty or absent one adds nothing, so
+ * the gate stays at the path sources the caller actually supplied.
+ *
+ * Paths are normalized here and nowhere else on this rule, so the two doors join
+ * on the one key space even when a caller passes raw spellings.
+ */
+export function verificationAllowedPaths(params) {
+    const allowed = new Set();
+    const add = (path) => {
+        if (typeof path !== "string")
+            return;
+        const normalized = normalizeCoveragePath(path);
+        if (normalized.length > 0)
+            allowed.add(normalized);
+    };
+    for (const path of params.assignedPaths ?? [])
+        add(path);
+    for (const path of params.coveragePaths ?? [])
+        add(path);
+    for (const path of params.boundaryPaths ?? [])
+        add(path);
+    return allowed;
+}
 const REQUIRED_FINDING_FIELDS = [
     "id",
     "title",
@@ -97,7 +141,6 @@ const REQUIRED_FINDING_FIELDS = [
 // vocabulary (`audit-tools/shared`); previously each was re-defined here and
 // drifted from the shared Lens / FindingSeverity / FindingConfidence types.
 const VALID_PRIORITIES = new Set(["high", "medium", "low"]);
-const LENS_VERIFICATION_TAG = "lens_verification";
 function pushIssue(issues, params) {
     issues.push({
         ...params,
@@ -439,13 +482,12 @@ function validateVerification(value, result, task, coverage, normBoundary, taskI
         return;
     }
     // Followup tasks may target any file within the packet/unit boundary, not just
-    // the assigned files surfaced in this result's coverage. Widen the allowed set
-    // with the boundary (fail-closed: an empty boundary adds nothing, leaving the
-    // gate at the per-result coverage paths).
-    const allowedPaths = new Set([
-        ...coverage.map((entry) => entry.path),
-        ...normBoundary,
-    ]);
+    // the assigned files surfaced in this result's coverage. Built through the ONE
+    // containment rule the host door also uses, so the two cannot diverge.
+    const allowedPaths = verificationAllowedPaths({
+        coveragePaths: coverage.map((entry) => entry.path),
+        boundaryPaths: normBoundary,
+    });
     for (let index = 0; index < value.followup_tasks.length; index++) {
         validateVerificationFollowupTask(value.followup_tasks[index], `verification.followup_tasks[${index}]`, taskId, resultIndex, result.lens, allowedPaths, issues);
     }