audit-tools 0.52.0 → 0.52.1

package/dist/shared/validation/designFindingGrounding.js

@@ -45,15 +45,20 @@ export function groundDesignFinding(finding, knownPaths) {
  * can forget.
  *
  * The `lead_lineage` STRIP is unconditional for the same reason, and it is the
- * same "a separate call is a call someone forgets" argument: these lanes ingest
- * host-authored findings, and the array door (`consumeArraySubmission`) checks
- * only that the value IS an array — it does not parse through a schema that
- * omits the tool-owned verdicts the way the per-file worker contract does. So
- * without a strip here, a submission carrying `{producer: "host-forged", …}`
- * lands verbatim in `contract_findings` / `conceptual_findings` and thereafter
- * reads as a generation-bound deterministic lead: a claim wearing provenance it
- * never had. Dropping the field leaves the row what it actually is — an
- * unlineaged host finding, which the review prompt already calls out by count.
+ * same "a separate call is a call someone forgets" argument. Without it, a
+ * submission carrying `{producer: "host-forged", …}` lands verbatim in
+ * `contract_findings` / `conceptual_findings` and thereafter reads as a
+ * generation-bound deterministic lead: a claim wearing provenance it never had.
+ * Dropping the field leaves the row what it actually is — an unlineaged host
+ * finding, which the review prompt already calls out by count.
+ *
+ * ⚠ This strip no longer carries the DESIGN-REVIEW doors. Since 2026-09-17 the
+ * array door (`consumeArraySubmission`) parses each item with
+ * `SubmittedDesignFindingSchema` and REFUSES a supplied tool-owned verdict by
+ * name, which is strictly better than a silent strip. The strip stays because
+ * three callers never pass through that door — the charter clarification and
+ * charter fidelity executors, and the systemic challenge loop — and each of them
+ * ingests host-authored findings the same way.
  *
  * A host that legitimately re-emits a lead is unaffected in substance: the
  * provenance it could not have verified is exactly the part the tool refuses to
@@ -71,13 +76,28 @@ export function groundDesignFindings(findings, repoManifest) {
         ...finding,
         evidence_lane: "design-review-lane",
     }));
-    const files = repoManifest?.files ?? [];
-    if (files.length === 0)
+    const known = repoPathUniverse(repoManifest);
+    if (known.size === 0)
         return marked;
-    const known = new Set(files.map((f) => normalizeRepoPath(f.path)));
     return marked.map((finding) => ({
         ...finding,
         grounding: groundDesignFinding(finding, known),
     }));
 }
+/**
+ * The normalized path set a repo manifest describes — the ONE way a caller turns
+ * a manifest into the `knownPaths` {@link groundDesignFinding} tests against.
+ *
+ * It exists because a second caller built that set by hand and got it wrong:
+ * the recovery verb's own universe passed the manifest paths through verbatim,
+ * while this module has always run them through `normalizeRepoPath` (which
+ * lowercases and forward-slashes). Two sets, one membership test, and a
+ * disagreement visible only on win32 or on a capitalized path — so a submission
+ * one boundary accepted the next one could still call ungrounded.
+ */
+export function repoPathUniverse(repoManifest) {
+    return new Set((repoManifest?.files ?? [])
+        .map((file) => normalizeRepoPath(file?.path ?? ""))
+        .filter((path) => path.length > 0));
+}
 //# sourceMappingURL=designFindingGrounding.js.map

package/dist/shared/validation/designFindingGrounding.js.map

@@ -1 +1 @@
-{"version":3,"file":"designFindingGrounding.js","sourceRoot":"","sources":["../../../src/shared/validation/designFindingGrounding.ts"],"names":[],"mappings":"AAmBA,+EAA+E;AAC/E,qCAAqC;AACrC,OAAO,EACL,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAE/B;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAgB,EAChB,UAA+B;IAE/B,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;SACzC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;SAC5C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,8CAA8C;SACvD,CAAC;IACJ,CAAC;IACD,8EAA8E;IAC9E,yEAAyE;IACzE,0EAA0E;IAC1E,iDAAiD;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CACvB,CAAC,CAAC,EAAE,EAAE,CACJ,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACjB,4BAA4B,CAAC,CAAC,EAAE,UAAU,CAAC,KAAK,SAAS,CAC5D,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,mDAAmD,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC1F,CAAC;IACJ,CAAC;IACD,sCAAsC;IACtC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAmB,EACnB,YAA6D;IAE7D,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QACtE,GAAG,OAAO;QACV,aAAa,EAAE,oBAA6B;KAC7C,CAAC,CAAC,CAAC;IACJ,MAAM,KAAK,GAAG,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC9B,GAAG,OAAO;QACV,SAAS,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC;KAC/C,CAAC,CAAC,CAAC;AACN,CAAC"}
+{"version":3,"file":"designFindingGrounding.js","sourceRoot":"","sources":["../../../src/shared/validation/designFindingGrounding.ts"],"names":[],"mappings":"AAoBA,+EAA+E;AAC/E,qCAAqC;AACrC,OAAO,EACL,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAE/B;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAgB,EAChB,UAA+B;IAE/B,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;SACzC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;SAC5C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,8CAA8C;SACvD,CAAC;IACJ,CAAC;IACD,8EAA8E;IAC9E,yEAAyE;IACzE,0EAA0E;IAC1E,iDAAiD;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CACvB,CAAC,CAAC,EAAE,EAAE,CACJ,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACjB,4BAA4B,CAAC,CAAC,EAAE,UAAU,CAAC,KAAK,SAAS,CAC5D,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,mDAAmD,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC1F,CAAC;IACJ,CAAC;IACD,sCAAsC;IACtC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAmB,EACnB,YAA6D;IAE7D,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QACtE,GAAG,OAAO;QACV,aAAa,EAAE,oBAA6B;KAC7C,CAAC,CAAC,CAAC;IACJ,MAAM,KAAK,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACpC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC9B,GAAG,OAAO;QACV,SAAS,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC;KAC/C,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,YAA6D;IAE7D,OAAO,IAAI,GAAG,CACZ,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC;SACxB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;SAClD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CACrC,CAAC;AACJ,CAAC"}

package/docs/audit-pkg/contracts.md

@@ -75,12 +75,11 @@ advance the run.
 | `result_schema` | The bound result converts to the persisted `AuditResult` schema (`schemas/audit_result.schema.json`). | `audit` |
 | `result_validation` | The per-result content rules hold before acceptance (evidence present, line spans inside the file, line counts matching disk); warnings ride an advisory channel and never refuse. | `audit` |
 | `outcome_shape` | A decision result's `outcome` carries exactly the fields its status requires (`resolved_no_change` evidence, `blocked` failure reason, `needs_clarification` question). | `remediate` |
-| `write_scope` | `changed_files` is non-empty, sorted, unique and normalized, lies within the prompt-bound `allowed_files`, and equals the files the landed commit actually changed. | `remediate` |
-| `commit_evidence` | `commit_evidence` binds the workload baseline to a distinct landed commit; both exist, the baseline is an ancestor of the landed commit (waived only under a genuinely orphaned baseline in recovery), and the landed commit is reachable from HEAD. | `remediate` |
-| `test_evidence` | `test_evidence` carries exactly one passed entry per required test echoing the bound command, and the tool's own mechanical rerun of those tests passes. | `remediate` |
+| `landed_commit` | `landed_commit` is a full commit id that exists, is not the workload baseline, changes at least one file, descends from the baseline (waived only under a genuinely orphaned baseline in recovery), and is reachable from HEAD. | `remediate` |
+| `write_scope` | Every file the landed commit changed, as git reports it, lies within the prompt-bound `allowed_files`. | `remediate` |
+| `required_tests` | The tool's own rerun of every prompt-bound required test passes on the tree that holds the landed commit. | `remediate` |
 | `obligation_evidence` | `obligation_evidence` cites non-empty evidence for every prompt-bound obligation, none twice, and none the work item does not bind. | `remediate` |
-| `worktree_evidence` | `worktree_evidence` binds the workload baseline and the same changed-file list, and no landed file overlaps dirt that pre-dated the run. | `remediate` |
-| `landing_attestation` | `acceptance` and `merge` both attest a completed landing. | `remediate` |
+| `run_start_dirt` | No file the landed commit changed overlaps dirt that pre-dated the run. | `remediate` |
 | `no_change_corroboration` | A `resolved_no_change` claim is corroborated against git and the persisted write-scope binding; attestation-only acceptance is refused. | `remediate` |
 | `duplicate_result` | `result_id` has not already been accepted this run: a byte-identical replay is a no-op, a different body under an accepted id is refused. | `audit`, `remediate` |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "audit-tools",
-  "version": "0.52.0",
+  "version": "0.52.1",
   "private": false,
   "license": "ISC",
   "description": "Provider-neutral code auditing and remediation workflows for arbitrary repositories.",

package/schemas/audit_result.schema.json

@@ -132,6 +132,10 @@
                 "quoted_text": {
                   "type": "string"
                 },
+                "no_quotable_span": {
+                  "type": "string",
+                  "minLength": 1
+                },
                 "hash_at_plan_time": {
                   "type": "string"
                 }
@@ -371,6 +375,9 @@
             "type": "string"
           }
         },
+        "selection_rationale": {
+          "type": "string"
+        },
         "followup_tasks": {
           "type": "array",
           "items": {
@@ -415,6 +422,50 @@
                   "minimum": 0
                 }
               },
+              "coverage_policy": {
+                "type": "string",
+                "enum": [
+                  "complete",
+                  "selective"
+                ]
+              },
+              "file_metrics": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "path": {
+                      "type": "string"
+                    },
+                    "total_lines": {
+                      "type": "number"
+                    },
+                    "score": {
+                      "type": "number"
+                    },
+                    "signals": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      }
+                    },
+                    "prior_findings": {
+                      "type": "object",
+                      "additionalProperties": {
+                        "type": "number"
+                      }
+                    }
+                  },
+                  "required": [
+                    "path",
+                    "total_lines",
+                    "score",
+                    "signals",
+                    "prior_findings"
+                  ],
+                  "additionalProperties": false
+                }
+              },
               "line_ranges": {
                 "type": "array",
                 "items": {

package/schemas/audit_results.schema.json

@@ -134,6 +134,10 @@
                   "quoted_text": {
                     "type": "string"
                   },
+                  "no_quotable_span": {
+                    "type": "string",
+                    "minLength": 1
+                  },
                   "hash_at_plan_time": {
                     "type": "string"
                   }
@@ -373,6 +377,9 @@
               "type": "string"
             }
           },
+          "selection_rationale": {
+            "type": "string"
+          },
           "followup_tasks": {
             "type": "array",
             "items": {
@@ -417,6 +424,50 @@
                     "minimum": 0
                   }
                 },
+                "coverage_policy": {
+                  "type": "string",
+                  "enum": [
+                    "complete",
+                    "selective"
+                  ]
+                },
+                "file_metrics": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "path": {
+                        "type": "string"
+                      },
+                      "total_lines": {
+                        "type": "number"
+                      },
+                      "score": {
+                        "type": "number"
+                      },
+                      "signals": {
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        }
+                      },
+                      "prior_findings": {
+                        "type": "object",
+                        "additionalProperties": {
+                          "type": "number"
+                        }
+                      }
+                    },
+                    "required": [
+                      "path",
+                      "total_lines",
+                      "score",
+                      "signals",
+                      "prior_findings"
+                    ],
+                    "additionalProperties": false
+                  }
+                },
                 "line_ranges": {
                   "type": "array",
                   "items": {

package/schemas/audit_task.schema.json

@@ -43,6 +43,50 @@
         "minimum": 0
       }
     },
+    "coverage_policy": {
+      "type": "string",
+      "enum": [
+        "complete",
+        "selective"
+      ]
+    },
+    "file_metrics": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "path": {
+            "type": "string"
+          },
+          "total_lines": {
+            "type": "number"
+          },
+          "score": {
+            "type": "number"
+          },
+          "signals": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "prior_findings": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "number"
+            }
+          }
+        },
+        "required": [
+          "path",
+          "total_lines",
+          "score",
+          "signals",
+          "prior_findings"
+        ],
+        "additionalProperties": false
+      }
+    },
     "line_ranges": {
       "type": "array",
       "items": {

package/schemas/finding.schema.json

@@ -74,6 +74,10 @@
           "quoted_text": {
             "type": "string"
           },
+          "no_quotable_span": {
+            "type": "string",
+            "minLength": 1
+          },
           "hash_at_plan_time": {
             "type": "string"
           }