audit-tools 0.51.7 → 0.51.9

package/scripts/shared/host-asset-plan.mjs

@@ -0,0 +1,176 @@
+// The host-asset install plan — ONE declaration, two installers.
+//
+// WHY THIS EXISTS (backlog 2026-08-27, "Three governance vocabularies are copied
+// per consumer"). `scripts/audit/postinstall.mjs` and
+// `scripts/remediate/postinstall.mjs` each built their own install list, their
+// own OpenCode command entry and their own `installAntigravityPlugin` call
+// around the SAME shared installer (`install-host-assets.mjs`). Every one of
+// those was near-identical code differing only by a tool token, so a change to
+// the shared install shape had to be made twice and the two could silently
+// drift — the V3 residual entry's migration gap is one instance of that split,
+// not its cause.
+//
+// Now the per-tool differences are ROWS here and the installers execute the
+// plan. What stays per-tool is only what is genuinely per-tool POLICY: the
+// OpenCode permission tables (what each workflow may touch) and the two prompt
+// renderers. Everything structural — which hosts are served, what each target
+// path is, which source file feeds it, what the command entry says — is derived
+// from the row.
+//
+// PRE-BUILD: the postinstalls run under plain node from a possibly-never-built
+// checkout, so this module imports nothing from `audit-tools/shared`.
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+/** The package root, from this file's location (`scripts/shared/`). */
+export const PKG_ROOT = dirname(dirname(dirname(fileURLToPath(import.meta.url))));
+
+/**
+ * @typedef {object} HostAssetPlan
+ * @property {string} tool            the bin name / tool token (`audit-code`)
+ * @property {string} skillDir        `skills/<dir>` under the package root
+ * @property {string} promptFile      the canonical prompt body's filename
+ * @property {string} commandFile     filename installed as the Claude command
+ * @property {string} description     one line for the host's command menu
+ * @property {string} agentName       the OpenCode agent the command delegates to
+ * @property {string} agentDescription one line for that agent
+ * @property {string|'packageVersion'} pluginVersion the Antigravity plugin
+ *   version — a literal where the plugin has its own version, or the string
+ *   'packageVersion' where it tracks the package
+ * @property {boolean} stripFrontmatter whether the Claude command carries the
+ *   prompt's body only (remediate-code) or the file verbatim (audit-code)
+ * @property {'trim'|'trimStart'} templateTrim how the OpenCode command template
+ *   is trimmed. The two tools genuinely differ here — audit-code's template is a
+ *   standalone `.txt` whose trailing newline must go, remediate-code's is an
+ *   extracted markdown body where trailing content is significant — so the
+ *   difference is a declared row rather than a behaviour invented per installer
+ */
+
+/** @type {Record<string, HostAssetPlan>} */
+export const HOST_ASSET_PLANS = {
+  "audit-code": {
+    tool: "audit-code",
+    skillDir: "audit-code",
+    promptFile: "audit-code.prompt.md",
+    commandFile: "audit-code.md",
+    description: "Autonomous local loop code auditing",
+    agentName: "auditor",
+    agentDescription: "Read-heavy audit orchestration agent for the /audit-code workflow.",
+    pluginVersion: "1.0.0",
+    stripFrontmatter: false,
+    templateTrim: "trim",
+  },
+  "remediate-code": {
+    tool: "remediate-code",
+    skillDir: "remediate-code",
+    promptFile: "remediate-code.prompt.md",
+    commandFile: "remediate-code.md",
+    description: "Conversation-first code remediation",
+    agentName: "remediator",
+    agentDescription: "Bounded remediation orchestration agent for the /remediate-code workflow.",
+    pluginVersion: "packageVersion",
+    stripFrontmatter: true,
+    templateTrim: "trimStart",
+  },
+};
+
+/**
+ * The source files a plan reads, all under the package root.
+ * @param {HostAssetPlan} plan
+ */
+export function planSources(plan) {
+  const dir = join(PKG_ROOT, "skills", plan.skillDir);
+  return {
+    prompt: join(dir, plan.promptFile),
+    skill: join(dir, "SKILL.md"),
+    codexUiMetadata: join(dir, "agents", "openai.yaml"),
+  };
+}
+
+/**
+ * The install targets every plan serves, in install order. Each is derived —
+ * a row never names a path, so the two tools cannot disagree about WHERE a host
+ * asset lands, only about what it contains.
+ *
+ * @param {HostAssetPlan} plan
+ * @param {{homeDir?: string, promptContent: Buffer|string, skillContent: Buffer|string,
+ *          codexUiMetadataContent?: Buffer|string}} content
+ * @returns {{label: string, path: string, sourcePath: string, content: Buffer|string}[]}
+ */
+export function planInstalls(plan, { homeDir = homedir(), promptContent, skillContent, codexUiMetadataContent }) {
+  const sources = planSources(plan);
+  const codexDir = join(homeDir, ".codex", "skills", plan.skillDir);
+  const installs = [
+    {
+      label: "Claude command",
+      path: join(homeDir, ".claude", "commands", plan.commandFile),
+      sourcePath: sources.prompt,
+      content: promptContent,
+    },
+    {
+      label: "Codex skill",
+      path: join(codexDir, "SKILL.md"),
+      sourcePath: sources.skill,
+      content: skillContent,
+    },
+    {
+      label: "Codex prompt",
+      path: join(codexDir, plan.promptFile),
+      sourcePath: sources.prompt,
+      content: promptContent,
+    },
+  ];
+  if (codexUiMetadataContent !== undefined) {
+    installs.push({
+      label: "Codex skill UI metadata",
+      path: join(codexDir, "agents", "openai.yaml"),
+      sourcePath: sources.codexUiMetadata,
+      content: codexUiMetadataContent,
+    });
+  }
+  return installs;
+}
+
+/** The OpenCode global config path — one location, both tools. */
+export function planOpenCodeConfigPath({ homeDir = homedir() } = {}) {
+  return join(homeDir, ".config", "opencode", "opencode.json");
+}
+
+/**
+ * The OpenCode command entry a plan contributes to the merged global config.
+ *
+ * The trim rule is the plan's, not this function's: audit-code's template is a
+ * standalone `.txt` (trailing newline must go), remediate-code's is a markdown
+ * body extracted from the prompt (trailing content is significant). Unifying
+ * them here would be a silent edit to one tool's deployed config.
+ *
+ * @param {HostAssetPlan} plan
+ * @param {string} commandTemplate the rendered command content
+ */
+export function planOpenCodeCommand(plan, commandTemplate) {
+  return {
+    template: plan.templateTrim === "trimStart" ? commandTemplate.trimStart() : commandTemplate.trim(),
+    description: plan.description,
+    agent: plan.agentName,
+    subtask: false,
+  };
+}
+
+/**
+ * The Claude Desktop plugin directory — the one host served by path convention
+ * rather than by a config file.
+ * @param {HostAssetPlan} plan
+ * @param {{homeDir?: string}} [options]
+ */
+export function planClaudePluginDir(plan, { homeDir = homedir() } = {}) {
+  return join(
+    homeDir,
+    ".claude",
+    "plugins",
+    "marketplaces",
+    "claude-plugins-official",
+    "external_plugins",
+    plan.tool,
+  );
+}

package/scripts/shared/install-host-assets.mjs

@@ -85,7 +85,8 @@ export async function resolveSharedOpenCodePermissions() {
       typeof shared.mergeOpenCodeAgentPermissionRule === "function" &&
       typeof shared.mergeOpenCodeGlobalPermissionRule === "function" &&
       typeof shared.migrateOpenCodeGlobalExternalDirectory === "function" &&
-      typeof shared.withoutOpenCodeWildcard === "function"
+      typeof shared.withoutOpenCodeWildcard === "function" &&
+      typeof shared.orderOpenCodePermissionRule === "function"
     ) {
       return shared;
     }
@@ -184,6 +185,48 @@ export function installAntigravityPlugin(
   }
 }
 
+/**
+ * Install the Claude Desktop plugin (manifest + command + skill) so the tool
+ * appears in the slash-command menu. Claude Desktop reads external plugins from
+ * `~/.claude/plugins/marketplaces/claude-plugins-official/external_plugins/`.
+ *
+ * One step, one succeeded/failed count — matching the installers' pre-extraction
+ * behaviour. `pluginDir` is derived by the PLAN (host-asset-plan.mjs), never
+ * spelled here, so the two tools cannot disagree about where it lands.
+ *
+ * @param {{toolName: string, pluginDir: string, manifest: object,
+ *          commandContent: Buffer|string, skillContent: Buffer|string}} options
+ * @param {{succeeded: number, failed: number}} counts
+ */
+export function installClaudeDesktopPlugin(
+  { toolName, pluginDir, manifest, commandContent, skillContent },
+  counts,
+) {
+  const manifestPath = join(pluginDir, ".claude-plugin", "plugin.json");
+  const commandPath = join(pluginDir, "commands", `${toolName}.md`);
+  const skillPath = join(pluginDir, "skills", toolName, "SKILL.md");
+  try {
+    const manifestAction = writeGeneratedFile(
+      manifestPath,
+      Buffer.from(JSON.stringify(manifest, null, 2) + "\n"),
+    );
+    console.log(`${toolName}: ${manifestAction} Claude Desktop plugin manifest at ${manifestPath}`);
+
+    const commandAction = writeGeneratedFile(commandPath, commandContent);
+    console.log(`${toolName}: ${commandAction} Claude Desktop plugin command at ${commandPath}`);
+
+    const skillAction = writeGeneratedFile(skillPath, skillContent);
+    console.log(`${toolName}: ${skillAction} Claude Desktop plugin skill at ${skillPath}`);
+
+    console.log(`${toolName}: restart Claude Desktop for /${toolName} to appear in the slash-command menu`);
+    counts.succeeded++;
+  } catch (err) {
+    console.warn(`${toolName}: could not install Claude Desktop plugin (${/** @type {any} */ (err).message})`);
+    console.warn(`  Plugin directory: ${pluginDir}`);
+    counts.failed++;
+  }
+}
+
 /** Log the final summary line and set a non-zero exit code on any failure. */
 export function finishPostinstall(toolName, counts, startTime) {
   console.log(

package/scripts/shared/primitives.mjs

@@ -0,0 +1,89 @@
+// The governance tree's twin of the shared single-source primitives.
+//
+// WHY THIS EXISTS (ceremony review 2026-08-29, F1; forward-tracks). The
+// repository's own single-source gate — `check:shared-primitives` — scanned
+// `git ls-files 'src/**/*.ts'` only, so the enforcement layer was the ONE tree
+// exempt from the rule it enforced. Widening its reach (this change) makes the
+// governance tree obey the same rules, and these are the primitives it then
+// needs.
+//
+// WHY NOT IMPORT `audit-tools/shared`. The scripts, hooks and wrappers here are
+// PRE-BUILD: `tsconfig.scripts.json` typechecks them but nothing compiles them,
+// and the pre-commit gate, the write-time advisories and the closeout renderer
+// all run in checkouts that may never have been built. Importing
+// `audit-tools/shared` resolves `dist/` and dies with ERR_MODULE_NOT_FOUND. So
+// these are PORTABLE TWINS of the src homes, not copies of convenience:
+//
+//   compareCodeUnits  ↔ src/shared/compareCodeUnits.ts
+//   hashContent       ↔ src/shared/hash.ts
+//   resolveWithinRoot ↔ src/shared/io/pathContainment.ts
+//
+// The gate's rule tables list BOTH homes, so a re-roll anywhere in either tree
+// is red. Change one and change the other — the rules treat them as one home in
+// two files, which is what makes the divergence impossible to miss.
+import { createHash } from "node:crypto";
+import { isAbsolute, relative, resolve, sep } from "node:path";
+
+/**
+ * Code-unit lexical comparator — the ONE ordering primitive for every sort
+ * whose result is persisted, hashed, or compared across hosts. ICU collation is
+ * banned in both trees (see check:shared-primitives' `intl-collator` and
+ * `locale-compare` rules for the two spellings): it varies with the host
+ * locale, so a persisted array ordered by it hashes differently per machine —
+ * the phantom-staleness class. The banned names are not repeated here because
+ * this file is itself inside the scan.
+ */
+export function compareCodeUnits(left, right) {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+
+/**
+ * Compute a hex digest of `content` (a string or raw bytes). Returns the full
+ * digest by default, or the leading `length` characters when `length` is given
+ * — callers that want a truncated digest pass it EXPLICITLY, so no call site
+ * carries a bare `.slice(0, N)` literal on a hash result.
+ *
+ * `options.algorithm` defaults to sha256. It exists for the ids whose values are
+ * ALREADY PERSISTED: the nightly `subject_key` and scope-ledger `item_hash` are
+ * sha1 and are written into a tracked artifact, so "upgrade the algorithm" is a
+ * rewrite of every id in that file, not a cleanup. Naming the algorithm here
+ * routes those sites through the one home without churning persisted state.
+ */
+export function hashContent(content, options = {}) {
+  const { algorithm = "sha256" } = options;
+  const digest =
+    typeof content === "string"
+      ? createHash(algorithm).update(content, "utf8").digest("hex")
+      : createHash(algorithm).update(content).digest("hex");
+
+  const { length } = options;
+  if (length === undefined) return digest;
+  if (!Number.isInteger(length) || length <= 0) {
+    throw new Error(`hashContent: length must be a positive integer, got ${String(length)}`);
+  }
+  return digest.slice(0, length);
+}
+
+/**
+ * Resolve `candidate` against `root` and return the absolute path only when it
+ * stays inside that root; otherwise `null`.
+ *
+ * The escape test is SEGMENT-accurate (`".."` or a `"../"`-prefixed relative
+ * path), not a bare `startsWith("..")`: a real entry named `..cache` sits inside
+ * the root and the prefix test wrongly rejected it. `isAbsolute(rel)` catches
+ * the win32 case where the two sides share no common base at all (different
+ * drives / UNC roots), where `relative()` returns an absolute path and a
+ * `startsWith("..")` test therefore reads "contained".
+ *
+ * `options.allowRoot` (default `true`) decides whether the root itself counts.
+ */
+export function resolveWithinRoot(root, candidate, options = {}) {
+  if (typeof candidate !== "string" || candidate.length === 0) return null;
+  const rootPath = resolve(root);
+  const absolutePath = resolve(rootPath, candidate);
+  const rel = relative(rootPath, absolutePath);
+  if (isAbsolute(rel)) return null;
+  if (rel === "") return options.allowRoot === false ? null : absolutePath;
+  if (rel === ".." || rel.startsWith(`..${sep}`) || rel.startsWith("../")) return null;
+  return absolutePath;
+}

package/skills/audit-code/SKILL.md

@@ -43,10 +43,10 @@ node audit-code.mjs ensure --quiet
 node audit-code.mjs next-step
 ```
 
-The target-directory rule has one home — *Preserve user arguments* in the
-`/audit-code` loader prompt, whose absolute path `audit-code prompt-path` prints.
-Follow it as written there. Do not add provider, model, quota, routing, or launch
-flags.
+The target-directory rule has one full statement in
+`skills/audit-code/audit-code.prompt.md` (whose absolute path `audit-code
+prompt-path` prints); follow it as written there. Do not add provider, model,
+quota, routing, or launch flags.
 
 Read the returned JSON only far enough to find `prompt_path`, then read and
 follow only that prompt. Do not inspect workload, result, schema, or state files

package/skills/audit-code/audit-code.prompt.md

@@ -21,14 +21,14 @@ repository root.
 
 Preserve user arguments:
 
-- run `audit-code` from inside the target repository; every command resolves
-  that repository's root from the working directory on its own, so normal usage
-  passes no `--root`
-- pass the user-supplied target directory with `--root <path>` only when running
-  from outside that repository
+- run from inside the target repository; every command resolves that repository's
+  root from the working directory on its own, so normal usage passes no `--root`.
+  Pass the user-supplied target directory with `--root <path>` only when running
+  from outside that repository.
 
-This is the one full statement of the target-directory rule; the `audit-code`
-skill points here instead of restating it.
+This target-directory rule is one shared fragment, rendered into this body and
+the `remediate-code` loader body in the same words; both skills point here
+instead of restating it.
 
 Ask for exactly one step:
 
@@ -51,8 +51,8 @@ source-only review for a comprehensive request. A user-chosen quick/shallow audi
 may proceed with the stated limitation and the reflection required below.
 
 Read the returned JSON only far enough to find `prompt_path`, then read and
-follow only that prompt. Do not inspect workload, result, schema, command
-catalog, or state files unless the current prompt directs you to them.
+follow only that prompt. Do not inspect workload, result, schema, or state files
+unless the current prompt directs you to them.
 
 When the prompt emits semantic review items, assign them with the host's native
 subagent facilities when available. Do not send provider, model, quota,
@@ -60,7 +60,11 @@ context-window, routing, or launch configuration to audit-tools. If the user has
 chosen a degraded quick/shallow run, record one reserved AgentReflection with task_id exactly
 `audit-capability-preflight`. Every reflection requires all three of `task_id`,
 `instruction_clarity` (one of `clear`, `mostly_clear`, `ambiguous`, `unclear`)
-and `severity`; a line missing any of the three is discarded whole. Use severity
+and `severity`; a line missing any of the three is discarded whole. Append each
+reflection as one JSON object per line to the run's agent-reflection file, whose
+path the step contract supplies as `artifact_paths.agent_feedback` — never
+reproduce that filename from memory, because a wrongly named file is read as
+"no reflections" rather than reported. Use severity
 `high` or `critical` when material to claimed coverage, with concrete
 `tool_friction`, `ambiguities`, and `suggestions` details. A structurally incapable run must not be labelled comprehensive. Keep
 the conversation-first flow and loader contract; do not add provider, routing,

package/skills/remediate-code/SKILL.md

@@ -36,13 +36,17 @@ remediate-code ensure --quiet
 remediate-code next-step
 ```
 
-Pass a supplied path with `--input`. Pass conversational guidance using the
-loader's temporary guidance file and `--guidance-file`. Do not add capability,
-provider, model, quota, context-window, or concurrency flags.
+The target-directory rule and the `--input` / `--guidance-file` rule each have
+one full statement in `skills/remediate-code/remediate-code.prompt.md`; follow
+them as written there.
+
+Do not add capability, provider, model, quota, context-window, or concurrency
+flags.
 
 Read the returned JSON only far enough to find `prompt_path`, then read and
-follow only that prompt. When it says to continue, call `next-step` again. Stop
-when it says to stop.
+follow only that prompt. Do not inspect workload, result, schema, or state files
+unless the current prompt directs you to them. When it says to continue, call
+`next-step` again. Stop when it says to stop.
 
 When developing audit-tools itself, prefer `node remediate-code.mjs`. Use
 `remediate-code install` for repair or forced asset refresh.

package/skills/remediate-code/remediate-code.prompt.md

@@ -17,9 +17,16 @@ remediate-code ensure --quiet
 
 Preserve user arguments:
 
-- pass an existing path with `--input <path>`
-- write conversational feedback to a temporary file and pass it with
-  `--guidance-file <path>`
+- run from inside the target repository; every command resolves that repository's
+  root from the working directory on its own, so normal usage passes no `--root`.
+  Pass the user-supplied target directory with `--root <path>` only when running
+  from outside that repository.
+- pass an existing path with `--input <path>`; write conversational feedback to a
+  temporary file and pass it with `--guidance-file <path>`.
+
+The target-directory rule above is one shared fragment, rendered into this body
+and the `audit-code` loader body in the same words; both skills point at the
+loader bodies instead of restating it.
 
 Then ask for exactly one step:
 
@@ -29,7 +36,7 @@ remediate-code next-step
 
 Read the returned JSON only far enough to find `prompt_path`, then read and
 follow only that prompt. Do not inspect workload, result, schema, or state files
-unless the prompt directs you to them.
+unless the current prompt directs you to them.
 
 When the prompt emits implementation items, assign them using the host's native
 subagent facilities when available. Do not send provider, model, quota,

package/wrapper/audit-code-wrapper-build.mjs

@@ -1,8 +1,9 @@
 import { open, stat, unlink } from 'node:fs/promises';
 import { spawn } from 'node:child_process';
-import { dirname, isAbsolute, join, relative } from 'node:path';
+import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { fileExists, newestMtimeMs } from './audit-code-wrapper-io.mjs';
+import { resolveWithinRoot } from '../scripts/shared/primitives.mjs';
 
 const repoRoot = join(dirname(fileURLToPath(import.meta.url)), '..');
 const distEntry = join(repoRoot, 'dist', 'audit', 'index.js');
@@ -151,8 +152,10 @@ export function assertWorkspaceInstalled({ checkoutRoot, sharedManifestPath }) {
     );
   }
 
-  const relToCheckout = relative(checkoutRoot, sharedManifestPath);
-  if (relToCheckout.startsWith('..') || isAbsolute(relToCheckout)) {
+  // The containment decision, through the shared primitive: a manifest on
+  // another win32 drive / UNC root makes `relative()` return an ABSOLUTE path,
+  // where the bare prefix test read "contained".
+  if (resolveWithinRoot(checkoutRoot, sharedManifestPath) === null) {
     throw new Error(
       `audit-tools/shared resolved to ${sharedManifestPath}, outside this ` +
         `checkout (${checkoutRoot}). node_modules was never installed here — ` +

package/dist/audit/cli/charterDeltaPrompt.d.ts

@@ -1,18 +0,0 @@
-import type { ArtifactBundle } from "../io/artifacts.js";
-/**
- * Render the charter-DELTA host prompt (Phase C.2). The host here is the
- * INDEPENDENT delta-miner — the triangulation engine: it did NOT author the
- * charters below (three blind channel lanes did, each fed only its own
- * evidence), so it is the first reader to see all channels together. It mines
- * the real GAPS between channels within each subsystem, distills a TRIANGULATED
- * TELOS per subsystem (a unified opinion the owner reacts to — a lead, never a
- * reconciliation; the deltas stay the primary product), builds the goal DAG
- * across subsystems, and — at the deepest ceiling only — may nominate a True
- * charter. The tool supplies the ENFORCEMENT half at ingest (the routing table,
- * the Phase-A gates, the deepest-rung consent check); the miner never picks
- * routing.
- */
-export declare function renderCharterDeltaPrompt(bundle: ArtifactBundle, opts: {
-    submissionPath: string;
-}): string;
-//# sourceMappingURL=charterDeltaPrompt.d.ts.map

package/dist/audit/cli/charterDeltaPrompt.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"charterDeltaPrompt.d.ts","sourceRoot":"","sources":["../../../src/audit/cli/charterDeltaPrompt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,GAC/B,MAAM,CAkJR"}

package/dist/audit/cli/charterDeltaPrompt.js

@@ -1,150 +0,0 @@
-/**
- * Render the charter-DELTA host prompt (Phase C.2). The host here is the
- * INDEPENDENT delta-miner — the triangulation engine: it did NOT author the
- * charters below (three blind channel lanes did, each fed only its own
- * evidence), so it is the first reader to see all channels together. It mines
- * the real GAPS between channels within each subsystem, distills a TRIANGULATED
- * TELOS per subsystem (a unified opinion the owner reacts to — a lead, never a
- * reconciliation; the deltas stay the primary product), builds the goal DAG
- * across subsystems, and — at the deepest ceiling only — may nominate a True
- * charter. The tool supplies the ENFORCEMENT half at ingest (the routing table,
- * the Phase-A gates, the deepest-rung consent check); the miner never picks
- * routing.
- */
-export function renderCharterDeltaPrompt(bundle, opts) {
-    const register = bundle.charter_register;
-    const subsystems = register?.subsystems ?? [];
-    const deepest = register?.ceiling.rung === "deepest";
-    const subsystemBlocks = subsystems.length
-        ? subsystems.flatMap((sub) => {
-            const memberPreview = sub.members.slice(0, 12).join(", ");
-            const more = sub.members.length > 12
-                ? ` (+${sub.members.length - 12} more)`
-                : "";
-            const charterLines = sub.charters.length
-                ? sub.charters.map((c) => `  - **${c.kind}** (confidence: ${c.confidence}) — ${c.purpose}`)
-                : ["  - (no surviving charters)"];
-            const teleologyLines = Object.entries(sub.teleologies ?? {}).flatMap(([kind, nodes]) => (nodes ?? []).map((n) => `  - teleology (${kind}, L${n.premise_height}, ${n.files.length} file(s)) — ${n.purpose}`));
-            return [
-                `- **${sub.node_id}** — ${sub.members.length} file(s): ${memberPreview}${more}`,
-                ...charterLines,
-                ...teleologyLines,
-            ];
-        })
-        : [
-            "- (no subsystems carry charters — submit `{ \"subsystems\": [], \"no_deltas\": true }`)",
-        ];
-    return [
-        "# Design review — charter delta-mining + triangulation (conceptual, teleological)",
-        "",
-        "You are the **independent delta-miner**. You did NOT author the charters below",
-        "— three blind lanes did, each fed ONLY its own evidence channel (stated =",
-        "testimony from docs/comments; structural = intent frozen into the code's",
-        "organization; revealed = behavior from comment-stripped bodies). You are the",
-        "first reader to hold all channels together. For each subsystem:",
-        "",
-        "1. Mine the real **GAPS between channels** (a genuine divergence, not every",
-        "   pair). Each channel pair has one meaning: stated↔revealed = the code does",
-        "   not do what the testimony says; structural↔revealed = the implementation",
-        "   betrays the organization's promise; stated↔structural = doc rot / naming",
-        "   drift.",
-        "2. Distill a **triangulated telos** — your unified best estimate of what the",
-        "   subsystem is FOR, weighing all channels. This is an OPINION the owner",
-        "   reacts to, never a replacement for the channels: the deltas stay the",
-        "   product, and where channels disagree, say so through deltas rather than",
-        "   papering over the disagreement in the telos.",
-        "",
-        "Across the whole set, build the **goal_graph** (nodes/edges) linking the",
-        "subsystems' purposes. Give each delta a `pair` (two charter kinds) + a",
-        "`summary` of the gap. The tool ROUTES deltas (you do not): doc rot → the",
-        "remediator; stated↔revealed drift → the remediator; structural↔revealed",
-        "betrayal → a clarification; anything↔true → the human. A shaky charter",
-        "downgrades its deltas to the human channel automatically.",
-        "",
-        ...(deepest
-            ? [
-                "## True nominations (deepest ceiling — authorized for this run)",
-                "",
-                "Downstream of your triangulation, you MAY nominate a **true** charter",
-                'for a subsystem: the *shining city* ideal the user may be unaware of.',
-                "NOMINATABLE, NEVER ASSERTED — it MUST name a concrete alternative AND a",
-                'concrete cost the user seems to pay unaware ("Quicken exists; you\'re',
-                'rebuilding a worse one") or it is dropped as slop. Framed as a',
-                "provocation, never a verdict. Nominate only if certain.",
-                "",
-            ]
-            : [
-                "This run's ceiling does NOT authorize True nominations — do not emit",
-                "`true_nominations` (they would be refused at ingest).",
-                "",
-            ]),
-        "## Anti-slop discipline (do NOT emit)",
-        "- No **manufactured** deltas — a `pair` whose two charters genuinely agree is not",
-        "  a gap; skip it. Only surface a real divergence.",
-        "- No delta against a charter kind a subsystem does not have below.",
-        "- No **averaged** teloses — a triangulated telos that just splices the three",
-        "  purposes together is slop; commit to your best estimate and let the deltas",
-        "  carry the disagreement.",
-        "- Only mine the subsystems listed — they are the assembled charter set, nothing",
-        "  more. Do not add a `node_id` that is not below.",
-        "",
-        "## Assembled charters + teleologies (from the blind channel lanes)",
-        ...subsystemBlocks,
-        "",
-        "## Output",
-        `Write your submission as JSON to \`${opts.submissionPath}\` with this shape:`,
-        "",
-        "```json",
-        "{",
-        '  "subsystems": [',
-        "    {",
-        '      "node_id": "<one of the subsystems above>",',
-        '      "deltas": [{ "pair": ["stated", "revealed"], "summary": "<the gap>" }]',
-        "    }",
-        "  ],",
-        '  "triangulated": [',
-        '    { "node_id": "<subsystem>", "telos": "<your unified best-estimate purpose>", "confidence": "high|medium|low" }',
-        "  ],",
-        ...(deepest
-            ? [
-                '  "true_nominations": [',
-                '    { "node_id": "<subsystem>", "purpose": "<the nominated ideal>", "nominated_alternative": "...", "nominated_cost": "...", "confidence": "high|medium|low" }',
-                "  ],",
-            ]
-            : []),
-        '  "goal_graph": {',
-        '    "nodes": [',
-        '      { "node_id": "auth", "premise_height": 0, "statement": "keep sessions trustworthy" },',
-        '      { "node_id": "token-store", "premise_height": 1, "statement": "persist tokens durably" }',
-        "    ],",
-        '    "edges": [{ "from": "token-store", "to": "auth" }]',
-        "  }",
-        "}",
-        "```",
-        "",
-        "Emit ONE `triangulated` entry per subsystem you examined (even a subsystem",
-        "with no deltas has a telos — agreement across channels is high-confidence",
-        "evidence for it).",
-        "",
-        "**If you genuinely found NO deltas anywhere**, affirm it explicitly:",
-        "`\"no_deltas\": true` on the submission (an empty submission WITHOUT the",
-        "affirmation is refused — a silent empty result is indistinguishable from a",
-        "miner that never ran). Never set `no_deltas` alongside deltas; the",
-        "affirmation is about DELTAS only, so your `triangulated` entries still ride",
-        "a `no_deltas` submission.",
-        "",
-        "**goal_graph schema (validated — use these exact fields, no others):**",
-        "- `nodes[]`: each is `{ node_id, premise_height, statement }`. `node_id` is a",
-        "  short slug (a subsystem above, or a purpose you name); `premise_height` is an",
-        "  INTEGER ≥ 0 where 0 = the root telos and larger = closer to a leaf mechanism",
-        "  (emergent depth — there is no fixed L0/L1/L2 enum); `statement` is the",
-        "  purpose in one telos sentence (never code/model/provider literals).",
-        "- `edges[]`: each is strictly `{ from, to }` — no `kind`/`label`/`reason`",
-        "  field. **Every edge means `from` SERVES `to`** (the child purpose advances",
-        "  the parent). It is a DAG, not a tree — a node may serve multiple parents.",
-        "- Do NOT use `{id,label}` nodes or `{from,to,kind}` edges — those hard-fail the",
-        "  validator.",
-        "",
-    ].join("\n");
-}
-//# sourceMappingURL=charterDeltaPrompt.js.map

package/dist/audit/cli/charterDeltaPrompt.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"charterDeltaPrompt.js","sourceRoot":"","sources":["../../../src/audit/cli/charterDeltaPrompt.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAsB,EACtB,IAAgC;IAEhC,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACzC,MAAM,UAAU,GAAG,QAAQ,EAAE,UAAU,IAAI,EAAE,CAAC;IAC9C,MAAM,OAAO,GAAG,QAAQ,EAAE,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC;IAErD,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM;QACvC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;YACzB,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1D,MAAM,IAAI,GACR,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE;gBACrB,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE,QAAQ;gBACvC,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM;gBACtC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CACd,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC,UAAU,OAAO,CAAC,CAAC,OAAO,EAAE,CACxE;gBACH,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC;YACpC,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,OAAO,CAClE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAChB,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CACf,CAAC,CAAC,EAAE,EAAE,CACJ,kBAAkB,IAAI,MAAM,CAAC,CAAC,cAAc,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,eAAe,CAAC,CAAC,OAAO,EAAE,CAC5F,CACJ,CAAC;YACF,OAAO;gBACL,OAAO,GAAG,CAAC,OAAO,QAAQ,GAAG,CAAC,OAAO,CAAC,MAAM,aAAa,aAAa,GAAG,IAAI,EAAE;gBAC/E,GAAG,YAAY;gBACf,GAAG,cAAc;aAClB,CAAC;QACJ,CAAC,CAAC;QACJ,CAAC,CAAC;YACE,yFAAyF;SAC1F,CAAC;IAEN,OAAO;QACL,mFAAmF;QACnF,EAAE;QACF,gFAAgF;QAChF,2EAA2E;QAC3E,0EAA0E;QAC1E,8EAA8E;QAC9E,iEAAiE;QACjE,EAAE;QACF,6EAA6E;QAC7E,8EAA8E;QAC9E,6EAA6E;QAC7E,6EAA6E;QAC7E,WAAW;QACX,8EAA8E;QAC9E,0EAA0E;QAC1E,yEAAyE;QACzE,4EAA4E;QAC5E,iDAAiD;QACjD,EAAE;QACF,0EAA0E;QAC1E,wEAAwE;QACxE,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,2DAA2D;QAC3D,EAAE;QACF,GAAG,CAAC,OAAO;YACT,CAAC,CAAC;gBACE,iEAAiE;gBACjE,EAAE;gBACF,uEAAuE;gBACvE,uEAAuE;gBACvE,yEAAyE;gBACzE,uEAAuE;gBACvE,gEAAgE;gBAChE,yDAAyD;gBACzD,EAAE;aACH;YACH,CAAC,CAAC;gBACE,sEAAsE;gBACtE,uDAAuD;gBACvD,EAAE;aACH,CAAC;QACN,uCAAuC;QACvC,mFAAmF;QACnF,mDAAmD;QACnD,oEAAoE;QACpE,8EAA8E;QAC9E,8EAA8E;QAC9E,2BAA2B;QAC3B,iFAAiF;QACjF,mDAAmD;QACnD,EAAE;QACF,oEAAoE;QACpE,GAAG,eAAe;QAClB,EAAE;QACF,WAAW;QACX,sCAAsC,IAAI,CAAC,cAAc,qBAAqB;QAC9E,EAAE;QACF,SAAS;QACT,GAAG;QACH,mBAAmB;QACnB,OAAO;QACP,mDAAmD;QACnD,8EAA8E;QAC9E,OAAO;QACP,MAAM;QACN,qBAAqB;QACrB,oHAAoH;QACpH,MAAM;QACN,GAAG,CAAC,OAAO;YACT,CAAC,CAAC;gBACE,yBAAyB;gBACzB,gKAAgK;gBAChK,MAAM;aACP;YACH,CAAC,CAAC,EAAE,CAAC;QACP,mBAAmB;QACnB,gBAAgB;QAChB,6FAA6F;QAC7F,gGAAgG;QAChG,QAAQ;QACR,wDAAwD;QACxD,KAAK;QACL,GAAG;QACH,KAAK;QACL,EAAE;QACF,4EAA4E;QAC5E,2EAA2E;QAC3E,mBAAmB;QACnB,EAAE;QACF,sEAAsE;QACtE,0EAA0E;QAC1E,4EAA4E;QAC5E,oEAAoE;QACpE,6EAA6E;QAC7E,2BAA2B;QAC3B,EAAE;QACF,wEAAwE;QACxE,+EAA+E;QAC/E,iFAAiF;QACjF,gFAAgF;QAChF,0EAA0E;QAC1E,uEAAuE;QACvE,2EAA2E;QAC3E,8EAA8E;QAC9E,6EAA6E;QAC7E,iFAAiF;QACjF,cAAc;QACd,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}