audit-tools 0.52.3 → 0.52.5

package/dist/remediate/steps/dispatch/requiredTests.js

@@ -0,0 +1,262 @@
+// sites-pinned: tests/remediate/host-handoff-corroboration.test.ts, tests/remediate/phase-triage.test.ts
+import { remediationRequiredTestLogsDir } from "../../../shared/io/auditToolsPaths.js";
+import { randomUUID } from "node:crypto";
+import { join } from "node:path";
+import { parseCommandString, runTrackedAsync, writeJsonFile } from "audit-tools/shared";
+/**
+ * Per-command deadline. A required test is host-authored and may legitimately be
+ * a full suite, so the bound is generous; what changed is that hitting it is now
+ * a NAMED outcome instead of an unlabelled failure string.
+ */
+const REQUIRED_TEST_TIMEOUT_MS = 10 * 60 * 1_000;
+/**
+ * Captured output is bounded and TAIL-biased: a failing suite's verdict is at
+ * the end, and an unbounded capture would put a whole test log into state and
+ * into every rendered issue.
+ */
+const CAPTURED_OUTPUT_LIMIT = 1_200;
+/**
+ * The bound on the MESSAGE a required-test failure produces.
+ *
+ * `CAPTURED_OUTPUT_LIMIT` bounds one STREAM; the message is a different thing —
+ * `requiredTestIssue` joins every failing command, and a work item may bind any
+ * number of them, so the rendered message grew with the number of failures. A
+ * message is a HOST-FACING delivery (it is rendered into the step prompt an
+ * operator reads), so its size cannot be a function of how many commands
+ * happened to fail.
+ *
+ * The bound TRUNCATES the excerpt and says so; it never drops the verdict. What
+ * survives at the front is the part that identifies the failure — the command
+ * and its outcome — and the marker tells the operator the rest was elided and
+ * where to look instead.
+ */
+export const REQUIRED_TEST_MESSAGE_LIMIT = 8_000;
+/** The marker that names an elided excerpt, so truncation is never silent. */
+const REQUIRED_TEST_TRUNCATION_MARKER = "… [excerpt truncated — captured logs are in .audit-tools/remediation/required-test-logs]";
+/**
+ * The spawn's raw capture buffer. Exceeding it does not truncate — node KILLS
+ * the child — so the cap is a named constant the `output_overflow` message can
+ * quote, rather than a literal buried in the spawn options.
+ */
+const REQUIRED_TEST_MAX_BUFFER_BYTES = 8 * 1_024 * 1_024;
+function tail(value) {
+    const text = value ?? "";
+    return text.length <= CAPTURED_OUTPUT_LIMIT
+        ? text
+        : `…${text.slice(text.length - CAPTURED_OUTPUT_LIMIT)}`;
+}
+/**
+ * Render one classified failure for a host-facing issue message.
+ *
+ * `output_overflow` says the verdict is UNKNOWN, not that the tests were fine: a
+ * child killed at the buffer cap may have been heading for exit 0 or exit 3, and
+ * the runner cannot tell which. Either way the item is refused — the honest
+ * report is "we could not find out", and it fails closed.
+ *
+ * A signal-killed child renders the SIGNAL, not `exit null`: `exit_code` is null
+ * for every non-exit outcome, so printing it there described nothing.
+ */
+function describeRequiredTestFailure(failure) {
+    const head = failure.outcome === "timed_out"
+        ? `${failure.command} (timed out)`
+        : failure.outcome === "output_overflow"
+            ? `${failure.command} (killed after exceeding the ${String(REQUIRED_TEST_MAX_BUFFER_BYTES)}-byte ` +
+                "output buffer — the run ended at the capture cap, so whether the tests pass is UNKNOWN)"
+            : failure.outcome === "spawn_error"
+                ? `${failure.command} (could not be started)`
+                : failure.exit_code === null
+                    ? `${failure.command} (terminated by ${failure.signal ?? "an unreported signal"})`
+                    : `${failure.command} (exit ${String(failure.exit_code)})`;
+    const captured = [failure.stdout, failure.stderr]
+        .filter((stream) => stream.trim().length > 0)
+        .join("\n");
+    const excerpt = captured.length > 0 ? `${head}: ${captured}` : head;
+    const truncated = failure.stdout.startsWith("…") || failure.stderr.startsWith("…");
+    return failure.output_log
+        ? `${excerpt} [${truncated ? "excerpt truncated; " : ""}captured output: ${failure.output_log}]`
+        : excerpt;
+}
+/**
+ * Length-prefixed so the root/command boundary is unambiguous for any path, and
+ * printable so the source stays text (a raw separator byte would make the file
+ * binary to git and invisible to grep). The root is part of the key because a
+ * verdict is a fact about one command in one working tree, and nothing
+ * guarantees a single process only ever ingests for one root.
+ */
+export function requiredTestVerdictKey(root, command) {
+    return `${String(root.length)}:${root}:${command}`;
+}
+/**
+ * The ONE place a required-test command is spawned.
+ *
+ * `timeoutMs` is a parameter so the deadline is exercisable: a hang is a
+ * first-class outcome of this function, and an outcome that can only be reached
+ * by waiting ten real minutes is an outcome nothing ever tests.
+ */
+export async function runRequiredTest(root, command, timeoutMs = REQUIRED_TEST_TIMEOUT_MS) {
+    // AWAITED, never `spawnSync`: ingestion runs with the remediation state lock
+    // held, and a synchronous child blocks the event loop for the whole suite —
+    // starving the lock's mtime heartbeat until a LIVE lock is classified stale
+    // and stolen mid-ingest.
+    //
+    // argv + `shell: false`, never a shell string. A required test is a workload
+    // command that already cleared the declared-shape gate at the producer, so
+    // splitting it is unambiguous, and dropping the shell removes the last place
+    // an ingest hands a declared string to `sh`/`cmd.exe`. `resolveExecArgv`
+    // inside the runner is what keeps the npm/npx shims resolvable on win32.
+    const result = await runTrackedAsync(parseCommandString(command), {
+        cwd: root,
+        // Captured, not discarded: without it a red ingest reports that something
+        // failed and nothing about why.
+        encoding: "utf8",
+        maxBuffer: REQUIRED_TEST_MAX_BUFFER_BYTES,
+        timeout: timeoutMs,
+        windowsHide: true,
+    });
+    if (!result.error && result.status === 0 && result.signal == null)
+        return null;
+    const output_log = join(remediationRequiredTestLogsDir(root), `${randomUUID()}.json`);
+    // Persist everything the bounded runner captured BEFORE deriving prompt excerpts.
+    await writeJsonFile(output_log, {
+        command, stdout: result.stdout ?? "", stderr: result.stderr ?? "",
+        status: result.status, signal: result.signal ?? null,
+        overflow_limit_bytes: REQUIRED_TEST_MAX_BUFFER_BYTES, error: result.error?.message ?? null,
+    });
+    const stdout = tail(result.stdout);
+    const stderr = tail(result.stderr);
+    // The ERROR CODE discriminates, never `signal`. node kills an over-deadline
+    // child AND an over-`maxBuffer` child, and an external `kill` sets `signal`
+    // too — so `signal !== null` was true for three unrelated facts and reported
+    // all of them as a hang, including a command killed purely for printing more
+    // than the buffer holds.
+    //
+    // ASSUMPTION, stated: a deadline miss reports `ETIMEDOUT`. Verified on win32;
+    // it is node's documented contract, not a platform quirk this code confirmed
+    // everywhere. On a platform that killed a child at the deadline WITHOUT that
+    // code, the case degrades to `spawn_error` — a less specific refusal, still a
+    // refusal, so the fail direction holds and only the label is lost.
+    const code = result.error?.code;
+    if (code === "ETIMEDOUT") {
+        return { command, output_log, outcome: "timed_out", exit_code: null, stdout, stderr };
+    }
+    if (code === "ENOBUFS") {
+        return {
+            command,
+            output_log,
+            outcome: "output_overflow",
+            exit_code: null,
+            stdout,
+            stderr,
+        };
+    }
+    if (result.error) {
+        return {
+            command,
+            output_log,
+            outcome: "spawn_error",
+            exit_code: null,
+            stdout,
+            stderr: stderr.length > 0 ? stderr : result.error.message,
+        };
+    }
+    // Killed by something outside this runner (an operator `kill`, an OOM reaper).
+    // Reported as FAILED with the signal named: the command did not complete, and
+    // calling it a deadline miss would attribute it to a bound this runner set.
+    //
+    // POSIX-ONLY IN PRACTICE, and UNTESTED for that reason: Windows has no signal
+    // delivery to report here — a killed child surfaces as an ordinary non-zero
+    // `status` with `signal` null — so this branch is unreachable on the platform
+    // this repo runs its suites on, and no test exercises it. It is kept because
+    // the runner is OS-agnostic by contract, not because it has been observed.
+    if (result.signal !== null && result.signal !== undefined) {
+        return {
+            command,
+            output_log,
+            outcome: "failed",
+            exit_code: null,
+            stdout,
+            stderr,
+            signal: result.signal,
+        };
+    }
+    if (result.status !== 0) {
+        return {
+            command,
+            output_log,
+            outcome: "failed",
+            exit_code: result.status,
+            stdout,
+            stderr,
+        };
+    }
+    return null;
+}
+export async function rerunRequiredTests(root, commands, 
+/** `null` on the normal lane — see {@link RemediationRequiredTestVerdicts}. */
+verdicts) {
+    const failures = [];
+    for (const command of commands) {
+        if (verdicts) {
+            const verdict = verdicts.get(requiredTestVerdictKey(root, command));
+            if (verdict === undefined) {
+                failures.push({
+                    command,
+                    outcome: "spawn_error",
+                    exit_code: null,
+                    stdout: "",
+                    stderr: "no pre-computed verdict — refusing to spawn a test while the state lock is held",
+                });
+            }
+            else if (verdict !== null) {
+                failures.push(verdict);
+            }
+            continue;
+        }
+        const failure = await runRequiredTest(root, command);
+        if (failure !== null)
+            failures.push(failure);
+    }
+    return failures;
+}
+/**
+ * The classified issue for a set of required-test failures. An ENVIRONMENT fact
+ * anywhere in the set wins over a red sibling, timeout first: a hung or
+ * buffer-killed suite is the fact that explains the ingest, and burying it under
+ * a sibling's exit code is exactly the conflation the code split exists to end.
+ * Only a set where every failure is a genuine non-zero exit reads as
+ * `required_test_failed`.
+ */
+export function requiredTestIssue(workItem, failures) {
+    // Bounded at the point the message is BUILT, not left to the caller: the
+    // failure count is a property of the work item's bound commands, so bounding
+    // anywhere downstream would still have carried an unbounded string through
+    // state and into the ledger. See REQUIRED_TEST_MESSAGE_LIMIT.
+    const body = `mechanical required-test rerun failed: ${failures
+        .map(describeRequiredTestFailure)
+        .join("; ")}`;
+    return {
+        code: failures.some((failure) => failure.outcome === "timed_out")
+            ? "required_test_timed_out"
+            : failures.some((failure) => failure.outcome === "output_overflow")
+                ? "required_test_output_overflow"
+                : "required_test_failed",
+        check: "required_tests",
+        work_item_id: workItem.id,
+        result_path: workItem.result_path,
+        message: boundRequiredTestMessage(body),
+    };
+}
+/**
+ * Truncate a required-test failure message to {@link REQUIRED_TEST_MESSAGE_LIMIT},
+ * marking the elision. The head is kept because it is what identifies the
+ * failure — the command and its classified outcome — and the marker replaces
+ * the tail rather than being appended past the cap, so the result is bounded by
+ * construction.
+ */
+function boundRequiredTestMessage(message) {
+    if (message.length <= REQUIRED_TEST_MESSAGE_LIMIT)
+        return message;
+    const room = REQUIRED_TEST_MESSAGE_LIMIT - REQUIRED_TEST_TRUNCATION_MARKER.length;
+    return `${message.slice(0, room)}${REQUIRED_TEST_TRUNCATION_MARKER}`;
+}
+//# sourceMappingURL=requiredTests.js.map

package/dist/remediate/steps/dispatch/requiredTests.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requiredTests.js","sourceRoot":"","sources":["../../../../src/remediate/steps/dispatch/requiredTests.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,OAAO,EAAE,8BAA8B,EAAE,MAAM,uCAAuC,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAwCxF;;;;GAIG;AACH,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AAEjD;;;;GAIG;AACH,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAEpC;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAEjD,8EAA8E;AAC9E,MAAM,+BAA+B,GACnC,0FAA0F,CAAC;AAE7F;;;;GAIG;AACH,MAAM,8BAA8B,GAAG,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC;AAEzD,SAAS,IAAI,CAAC,KAAyB;IACrC,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;IACzB,OAAO,IAAI,CAAC,MAAM,IAAI,qBAAqB;QACzC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,qBAAqB,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,2BAA2B,CAAC,OAA4B;IAC/D,MAAM,IAAI,GACR,OAAO,CAAC,OAAO,KAAK,WAAW;QAC7B,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,cAAc;QAClC,CAAC,CAAC,OAAO,CAAC,OAAO,KAAK,iBAAiB;YACrC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,gCAAgC,MAAM,CAAC,8BAA8B,CAAC,QAAQ;gBAChG,yFAAyF;YAC3F,CAAC,CAAC,OAAO,CAAC,OAAO,KAAK,aAAa;gBACjC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,yBAAyB;gBAC7C,CAAC,CAAC,OAAO,CAAC,SAAS,KAAK,IAAI;oBAC1B,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,mBAAmB,OAAO,CAAC,MAAM,IAAI,sBAAsB,GAAG;oBAClF,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,UAAU,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC;IACrE,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC;SAC9C,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;SAC5C,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACnF,OAAO,OAAO,CAAC,UAAU;QACvB,CAAC,CAAC,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,oBAAoB,OAAO,CAAC,UAAU,GAAG;QAChG,CAAC,CAAC,OAAO,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,OAAe;IAClE,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,OAAO,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAY,EACZ,OAAe,EACf,YAAoB,wBAAwB;IAE5C,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,yBAAyB;IACzB,EAAE;IACF,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE;QAChE,GAAG,EAAE,IAAI;QACT,0EAA0E;QAC1E,gCAAgC;QAChC,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,8BAA8B;QACzC,OAAO,EAAE,SAAS;QAClB,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/E,MAAM,UAAU,GAAG,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,EAAE,GAAG,UAAU,EAAE,OAAO,CAAC,CAAC;IACtF,kFAAkF;IAClF,MAAM,aAAa,CAAC,UAAU,EAAE;QAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QACjE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;QACpD,oBAAoB,EAAE,8BAA8B,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,IAAI;KAC3F,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,yBAAyB;IACzB,EAAE;IACF,8EAA8E;IAC9E,6EAA6E;IAC7E,6EAA6E;IAC7E,8EAA8E;IAC9E,mEAAmE;IACnE,MAAM,IAAI,GAAI,MAAM,CAAC,KAA2C,EAAE,IAAI,CAAC;IACvE,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO;YACL,OAAO;YACP,UAAU;YACV,OAAO,EAAE,iBAAiB;YAC1B,SAAS,EAAE,IAAI;YACf,MAAM;YACN,MAAM;SACP,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO;YACL,OAAO;YACP,UAAU;YACV,OAAO,EAAE,aAAa;YACtB,SAAS,EAAE,IAAI;YACf,MAAM;YACN,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO;SAC1D,CAAC;IACJ,CAAC;IACD,+EAA+E;IAC/E,8EAA8E;IAC9E,4EAA4E;IAC5E,EAAE;IACF,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,6EAA6E;IAC7E,2EAA2E;IAC3E,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1D,OAAO;YACL,OAAO;YACP,UAAU;YACV,OAAO,EAAE,QAAQ;YACjB,SAAS,EAAE,IAAI;YACf,MAAM;YACN,MAAM;YACN,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,OAAO;YACP,UAAU;YACV,OAAO,EAAE,QAAQ;YACjB,SAAS,EAAE,MAAM,CAAC,MAAM;YACxB,MAAM;YACN,MAAM;SACP,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY,EACZ,QAA2B;AAC3B,+EAA+E;AAC/E,QAAgD;IAEhD,MAAM,QAAQ,GAA0B,EAAE,CAAC;IAC3C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YACpE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,QAAQ,CAAC,IAAI,CAAC;oBACZ,OAAO;oBACP,OAAO,EAAE,aAAa;oBACtB,SAAS,EAAE,IAAI;oBACf,MAAM,EAAE,EAAE;oBACV,MAAM,EACJ,iFAAiF;iBACpF,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACrD,IAAI,OAAO,KAAK,IAAI;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAiC,EACjC,QAAwC;IAExC,yEAAyE;IACzE,6EAA6E;IAC7E,2EAA2E;IAC3E,8DAA8D;IAC9D,MAAM,IAAI,GAAG,0CAA0C,QAAQ;SAC5D,GAAG,CAAC,2BAA2B,CAAC;SAChC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAChB,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,WAAW,CAAC;YAC/D,CAAC,CAAC,yBAAyB;YAC3B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,iBAAiB,CAAC;gBACjE,CAAC,CAAC,+BAA+B;gBACjC,CAAC,CAAC,sBAAsB;QAC5B,KAAK,EAAE,gBAAgB;QACvB,YAAY,EAAE,QAAQ,CAAC,EAAE;QACzB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,OAAO,EAAE,wBAAwB,CAAC,IAAI,CAAC;KACxC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,wBAAwB,CAAC,OAAe;IAC/C,IAAI,OAAO,CAAC,MAAM,IAAI,2BAA2B;QAAE,OAAO,OAAO,CAAC;IAClE,MAAM,IAAI,GAAG,2BAA2B,GAAG,+BAA+B,CAAC,MAAM,CAAC;IAClF,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,+BAA+B,EAAE,CAAC;AACvE,CAAC"}

package/dist/remediate/steps/finalGate.d.ts

@@ -60,10 +60,8 @@ export interface ToolOwnedFinalGateResult {
      */
     outcome: Exclude<FinalGateOutcomeKind, "disabled">;
     /**
-     * True when the audit-tools-specific suite did not apply (target is not the
-     * audit-tools monorepo). The gate then does not block; it is a declared scope,
-     * not a vacuous pass. Kept alongside {@link outcome} as the boolean draw of
-     * the same fact for the branches that only need "did anything run".
+     * True when no command could be derived. This is a blocking non-verdict;
+     * the operator must supply a command or leave the run paused.
      */
     scoped_out: boolean;
     /**
@@ -112,11 +110,12 @@ export declare const RUNTIME_RESIDUAL_DECLARATION: ToolOwnedFinalGateResult["run
  * header; the host's session variables reach the child unchanged).
  * The first failing command short-circuits the floor (a broken build makes the
  * later layers meaningless). A `runner` may be injected for tests. When the
- * audit-tools suite does not apply (non-monorepo target), the gate is
- * `scoped_out` (does not block) rather than vacuously passing.
+ * target declares no executable gates, it returns a non-verdict that blocks
+ * for an explicit operator command rather than vacuously passing.
  */
 export declare function runToolOwnedFinalGate(root: string, opts?: {
     runner?: GateRunner;
+    testCommand?: string[];
 }): Promise<ToolOwnedFinalGateResult>;
 /**
  * Where the failing gate run is recorded, relative to the artifacts dir. The
@@ -166,6 +165,7 @@ export interface FinalGateVerdictRecord {
     outcome: Exclude<FinalGateOutcomeKind, "disabled">;
     /** The per-command results the red record is rebuilt from. */
     results: FinalGateCommandResult[];
+    binding?: string;
     recorded_at: string;
 }
 /**
@@ -183,7 +183,7 @@ export declare function finalGateVerdictPath(artifactsDir: string): string;
  * a cache miss costs a gate run, a false hit certifies a tree nobody checked.
  * Never throws.
  */
-export declare function readFinalGateVerdict(artifactsDir: string, scope: string, tree: string | null): Promise<FinalGateVerdictRecord | undefined>;
+export declare function readFinalGateVerdict(artifactsDir: string, scope: string, tree: string | null, binding?: string): Promise<FinalGateVerdictRecord | undefined>;
 /**
  * Record a gate verdict against the tree it was reached on. Overwrites.
  *
@@ -198,6 +198,7 @@ export declare function writeFinalGateVerdict(artifactsDir: string, verdict: {
     scoped_out: boolean;
     outcome: Exclude<FinalGateOutcomeKind, "disabled">;
     results: FinalGateCommandResult[];
+    binding?: string;
 }): Promise<string>;
 /**
  * The ONE gate-outcome record. Every gate family that runs this floor writes

package/dist/remediate/steps/finalGate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"finalGate.d.ts","sourceRoot":"","sources":["../../../src/remediate/steps/finalGate.ts"],"names":[],"mappings":"AAqDA,OAAO,EAEL,KAAK,oBAAoB,IAAI,0BAA0B,EACxD,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAEL,oBAAoB,EACpB,0BAA0B,EAC1B,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EAC1B,MAAM,mBAAmB,CAAC;AAM3B,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,CAAC;AAC5D,YAAY,EAAE,oBAAoB,EAAE,CAAC;AAErC,sDAAsD;AACtD,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,KAAK,EAAE,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,OAAO,CAAC;IAChB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;AAE9D,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAClC;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;IACnD;;;;;OAKG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,gBAAgB,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CAC3D;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,UAAU,GAAG,CACvB,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,MAAM,EACX,UAAU,CAAC,EAAE,MAAM,KAEjB;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAkBzE;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,EAAE,wBAAwB,CAAC,kBAAkB,CAOnF,CAAC;AAEJ;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,UAAU,CAAA;CAAO,GACjC,OAAO,CAAC,wBAAwB,CAAC,CAqFnC;AAOD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,4CAA4C,CAAC;IAC7D,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,wEAAwE;IACxE,MAAM,EAAE,OAAO,CAAC;IAChB,4DAA4D;IAC5D,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;IACnD,8DAA8D;IAC9D,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAClC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,IAAI,GAClB,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAW7C;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE;IACP,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;IACnD,OAAO,EAAE,sBAAsB,EAAE,CAAC;CACnC,GACA,OAAO,CAAC,MAAM,CAAC,CAmBjB;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,4CAA4C,CAAC;IAC7D,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,oBAAoB,CAAC;IAC9B,gFAAgF;IAChF,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB,mEAAmE;IACnE,YAAY,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,wBAAsB,2BAA2B,CAC/C,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE;IACP,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,oBAAoB,CAAC;IAC9B,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACA,OAAO,CAAC,MAAM,CAAC,CAcjB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,oCAAoC,CAAC;IACrD,kFAAkF;IAClF,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,oBAAoB,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAC3C,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,sBAAsB,GAAG,SAAS,EAC1C,gBAAgB,CAAC,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,GAC/D,OAAO,CAAC,MAAM,CAAC,CA+BjB"}
+{"version":3,"file":"finalGate.d.ts","sourceRoot":"","sources":["../../../src/remediate/steps/finalGate.ts"],"names":[],"mappings":"AAsDA,OAAO,EAEL,KAAK,oBAAoB,IAAI,0BAA0B,EACxD,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAEL,oBAAoB,EACpB,0BAA0B,EAC1B,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EAC1B,MAAM,mBAAmB,CAAC;AAM3B,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,CAAC;AAC5D,YAAY,EAAE,oBAAoB,EAAE,CAAC;AAErC,sDAAsD;AACtD,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,KAAK,EAAE,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,OAAO,CAAC;IAChB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;AAE9D,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAClC;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;IACnD;;;OAGG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,gBAAgB,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CAC3D;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,UAAU,GAAG,CACvB,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,MAAM,EACX,UAAU,CAAC,EAAE,MAAM,KAEjB;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAkBzE;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,EAAE,wBAAwB,CAAC,kBAAkB,CAOnF,CAAC;AAEJ;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,UAAU,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GACzD,OAAO,CAAC,wBAAwB,CAAC,CAoFnC;AAOD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,4CAA4C,CAAC;IAC7D,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,wEAAwE;IACxE,MAAM,EAAE,OAAO,CAAC;IAChB,4DAA4D;IAC5D,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;IACnD,8DAA8D;IAC9D,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,IAAI,EACnB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAY7C;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE;IACP,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;IACnD,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GACA,OAAO,CAAC,MAAM,CAAC,CAoBjB;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,4CAA4C,CAAC;IAC7D,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,oBAAoB,CAAC;IAC9B,gFAAgF;IAChF,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB,mEAAmE;IACnE,YAAY,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,wBAAsB,2BAA2B,CAC/C,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE;IACP,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,oBAAoB,CAAC;IAC9B,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACA,OAAO,CAAC,MAAM,CAAC,CAcjB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,oCAAoC,CAAC;IACrD,kFAAkF;IAClF,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,oBAAoB,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAC3C,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,sBAAsB,GAAG,SAAS,EAC1C,gBAAgB,CAAC,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,GAC/D,OAAO,CAAC,MAAM,CAAC,CA+BjB"}

package/dist/remediate/steps/finalGate.js

@@ -1,3 +1,4 @@
+// sites-pinned: tests/remediate/arbitrary-repository-gates.test.ts, tests/remediate/final-gate-red-pause.test.ts, tests/remediate/final-gate-extraction-equivalence.test.ts
 // ---------------------------------------------------------------------------
 // Tool-owned final completion gate (INV-RS-10)
 // ---------------------------------------------------------------------------
@@ -88,20 +89,19 @@ export const RUNTIME_RESIDUAL_DECLARATION = {
  * header; the host's session variables reach the child unchanged).
  * The first failing command short-circuits the floor (a broken build makes the
  * later layers meaningless). A `runner` may be injected for tests. When the
- * audit-tools suite does not apply (non-monorepo target), the gate is
- * `scoped_out` (does not block) rather than vacuously passing.
+ * target declares no executable gates, it returns a non-verdict that blocks
+ * for an explicit operator command rather than vacuously passing.
  */
 export async function runToolOwnedFinalGate(root, opts = {}) {
-    const runtime_residual = RUNTIME_RESIDUAL_DECLARATION;
-    const commands = toolOwnedFinalGateCommands(root);
+    const runtime_residual = isAuditToolsMonorepo(root)
+        ? RUNTIME_RESIDUAL_DECLARATION
+        : { surface: "verification roles not declared by the target repository", commands: [] };
+    const commands = toolOwnedFinalGateCommands(root, opts.testCommand);
     if (commands.length === 0) {
-        // Audit-tools-specific suite does not apply here — declared scope, not a
-        // vacuous pass (it never substitutes for a real gate on the audit-tools repo).
-        // `passed: true` keeps it NON-BLOCKING, which is the declared design; the
-        // `outcome` beside it is what stops that non-blocking value from being
-        // recorded as if a floor had run green.
+        // No declared command is not a verdict. The consumer emits an operator
+        // decision and preserves the run, rather than treating zero checks as green.
         return {
-            passed: true,
+            passed: false,
             results: [],
             outcome: "scoped_out",
             scoped_out: true,
@@ -211,7 +211,7 @@ export function finalGateVerdictPath(artifactsDir) {
  * a cache miss costs a gate run, a false hit certifies a tree nobody checked.
  * Never throws.
  */
-export async function readFinalGateVerdict(artifactsDir, scope, tree) {
+export async function readFinalGateVerdict(artifactsDir, scope, tree, binding) {
     if (tree === null)
         return undefined;
     const raw = await readOptionalJsonFile(finalGateVerdictPath(artifactsDir)).catch(() => undefined);
@@ -220,6 +220,8 @@ export async function readFinalGateVerdict(artifactsDir, scope, tree) {
         return undefined;
     if (record.scope !== scope)
         return undefined;
+    if (binding !== undefined && (record.binding !== binding || record.scoped_out))
+        return undefined;
     if (record.tree === null || record.tree !== tree)
         return undefined;
     if (!Array.isArray(record.results))
@@ -243,6 +245,7 @@ export async function writeFinalGateVerdict(artifactsDir, verdict) {
         scoped_out: verdict.scoped_out,
         outcome: verdict.outcome,
         results: verdict.results,
+        binding: verdict.binding,
         recorded_at: new Date().toISOString(),
     };
     try {

package/dist/remediate/steps/finalGate.js.map

@@ -1 +1 @@
-{"version":3,"file":"finalGate.js","sourceRoot":"","sources":["../../../src/remediate/steps/finalGate.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,+CAA+C;AAC/C,8EAA8E;AAC9E,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,uEAAuE;AACvE,EAAE;AACF,wEAAwE;AACxE,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,gFAAgF;AAChF,gDAAgD;AAChD,EAAE;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,iFAAiF;AACjF,iFAAiF;AACjF,iEAAiE;AACjE,gFAAgF;AAChF,kFAAkF;AAClF,gFAAgF;AAChF,2CAA2C;AAC3C,EAAE;AACF,oFAAoF;AACpF,oFAAoF;AACpF,mEAAmE;AACnE,iFAAiF;AACjF,+BAA+B;AAC/B,sGAAsG;AACtG,0CAA0C;AAC1C,EAAE;AACF,oEAAoE;AACpE,+EAA+E;AAC/E,+EAA+E;AAC/E,iFAAiF;AACjF,4EAA4E;AAC5E,gDAAgD;AAEhD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,8BAA8B,EAC9B,oBAAoB,EACpB,aAAa,EACb,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,iFAAiF;AACjF,gFAAgF;AAChF,wEAAwE;AACxE,OAAO,EACL,kBAAkB,GAEnB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,GAI3B,MAAM,mBAAmB,CAAC;AAE3B,mFAAmF;AACnF,gFAAgF;AAChF,8EAA8E;AAC9E,oFAAoF;AACpF,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,CAAC;AAiG5D;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAErC,SAAS,UAAU,CAAC,KAAyB;IAC3C,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;IACzB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,OAAO,IAAI,CAAC,MAAM,IAAI,sBAAsB;QAC1C,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,sBAAsB,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GACvC;IACE,OAAO,EAAE,8CAA8C;IACvD,QAAQ,EAAE;QACR,mCAAmC;QACnC,uCAAuC;KACxC;CACF,CAAC;AAEJ;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAY,EACZ,OAAgC,EAAE;IAElC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;IAEtD,MAAM,QAAQ,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,yEAAyE;QACzE,+EAA+E;QAC/E,0EAA0E;QAC1E,uEAAuE;QACvE,wCAAwC;QACxC,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,YAAY;YACrB,UAAU,EAAE,IAAI;YAChB,gBAAgB;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,IAAI,CAAC,MAAM;QACX,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE;YAC/B,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;YAChC,4EAA4E;YAC5E,2DAA2D;YAC3D,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAC/D,uEAAuE;YACvE,sEAAsE;YACtE,wDAAwD;YACxD,EAAE;YACF,oEAAoE;YACpE,8EAA8E;YAC9E,6EAA6E;YAC7E,0EAA0E;YAC1E,2EAA2E;YAC3E,2EAA2E;YAC3E,yEAAyE;YACzE,0EAA0E;YAC1E,uBAAuB;YACvB,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,EAAE;gBACvD,GAAG,EAAE,YAAY;gBACjB,sEAAsE;gBACtE,yEAAyE;gBACzE,OAAO,EAAE,SAAS;aACnB,CAAC,CAAC;YACH,0EAA0E;YAC1E,wEAAwE;YACxE,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC;QACJ,CAAC,CAAC,CAAC;IAEL,MAAM,OAAO,GAA6B,EAAE,CAAC;IAC7C,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACnF,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,CAAC;QAC/B,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,SAAS;YACjB,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;YAChE,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;SACjE,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,GAAG,KAAK,CAAC;YACf,MAAM,CAAC,gEAAgE;QACzE,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM;QACN,OAAO;QACP,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,KAAK;QACjB,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,yBAAyB,GAAG,iBAAiB,CAAC;AACpD,MAAM,2BAA2B,GAAG,yBAAyB,CAAC;AAC9D,MAAM,2BAA2B,GAAG,yBAAyB,CAAC;AAC9D,MAAM,0BAA0B,GAAG,4CAA4C,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,YAAoB;IACtD,OAAO,IAAI,CAAC,YAAY,EAAE,yBAAyB,CAAC,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,OAAO,IAAI,CAAC,YAAY,EAAE,2BAA2B,CAAC,CAAC;AACzD,CAAC;AAuCD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,OAAO,IAAI,CAAC,YAAY,EAAE,2BAA2B,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB,EACpB,KAAa,EACb,IAAmB;IAEnB,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,GAAG,GAAG,MAAM,oBAAoB,CACpC,oBAAoB,CAAC,YAAY,CAAC,CACnC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,8BAA8B,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IAC/E,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC9D,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7C,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACnE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACrD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,YAAoB,EACpB,OAOC;IAED,MAAM,IAAI,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAChD,MAAM,MAAM,GAA2B;QACrC,cAAc,EAAE,0BAA0B;QAC1C,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,0EAA0E;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AA8BD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,YAAoB,EACpB,OAMC;IAED,MAAM,IAAI,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,MAAM,GAA2B;QACrC,cAAc,EAAE,4CAA4C;QAC5D,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QACnC,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC5C,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACnE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;IACF,MAAM,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC;AAkCD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,YAAoB,EACpB,KAAa,EACb,MAA0C,EAC1C,gBAAgE;IAEhE,MAAM,IAAI,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;IAC/C,IAAI,WAA2C,CAAC;IAChD,IAAI,gBAAgB,IAAI,MAAM,EAAE,CAAC;QAC/B,2EAA2E;QAC3E,0EAA0E;QAC1E,2EAA2E;QAC3E,6CAA6C;QAC7C,WAAW,GAAG,MAAM,gBAAgB,CAAC;YACnC,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,KAAK,EAAE,gBAAgB,CAAC,KAAK;YAC7B,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,IAAI,EAAE,KAAK,MAAM,CAAC,WAAW,IAAI,EAAE,EAAE;SACnE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,MAAM,GAAuB;QACjC,cAAc,EAAE,oCAAoC;QACpD,KAAK;QACL,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,wBAAwB;QAC1E,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,IAAI;QACpC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,IAAI;QAC5B,GAAG,CAAC,MAAM,EAAE,WAAW,KAAK,SAAS;YACnC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;QACxC,GAAG,CAAC,MAAM,EAAE,WAAW,KAAK,SAAS;YACnC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;QACxC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;KACtD,CAAC;IACF,MAAM,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"finalGate.js","sourceRoot":"","sources":["../../../src/remediate/steps/finalGate.ts"],"names":[],"mappings":"AAAA,4KAA4K;AAC5K,8EAA8E;AAC9E,+CAA+C;AAC/C,8EAA8E;AAC9E,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,uEAAuE;AACvE,EAAE;AACF,wEAAwE;AACxE,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,gFAAgF;AAChF,gDAAgD;AAChD,EAAE;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,iFAAiF;AACjF,iFAAiF;AACjF,iEAAiE;AACjE,gFAAgF;AAChF,kFAAkF;AAClF,gFAAgF;AAChF,2CAA2C;AAC3C,EAAE;AACF,oFAAoF;AACpF,oFAAoF;AACpF,mEAAmE;AACnE,iFAAiF;AACjF,+BAA+B;AAC/B,sGAAsG;AACtG,0CAA0C;AAC1C,EAAE;AACF,oEAAoE;AACpE,+EAA+E;AAC/E,+EAA+E;AAC/E,iFAAiF;AACjF,4EAA4E;AAC5E,gDAAgD;AAEhD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,8BAA8B,EAC9B,oBAAoB,EACpB,aAAa,EACb,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,iFAAiF;AACjF,gFAAgF;AAChF,wEAAwE;AACxE,OAAO,EACL,kBAAkB,GAEnB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,GAI3B,MAAM,mBAAmB,CAAC;AAE3B,mFAAmF;AACnF,gFAAgF;AAChF,8EAA8E;AAC9E,oFAAoF;AACpF,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,CAAC;AA+F5D;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAErC,SAAS,UAAU,CAAC,KAAyB;IAC3C,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;IACzB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,OAAO,IAAI,CAAC,MAAM,IAAI,sBAAsB;QAC1C,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,sBAAsB,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GACvC;IACE,OAAO,EAAE,8CAA8C;IACvD,QAAQ,EAAE;QACR,mCAAmC;QACnC,uCAAuC;KACxC;CACF,CAAC;AAEJ;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAY,EACZ,OAAwD,EAAE;IAE1D,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,IAAI,CAAC;QACjD,CAAC,CAAC,4BAA4B;QAC9B,CAAC,CAAC,EAAE,OAAO,EAAE,0DAA0D,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAE1F,MAAM,QAAQ,GAAG,0BAA0B,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACpE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,uEAAuE;QACvE,6EAA6E;QAC7E,OAAO;YACL,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,YAAY;YACrB,UAAU,EAAE,IAAI;YAChB,gBAAgB;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,IAAI,CAAC,MAAM;QACX,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE;YAC/B,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;YAChC,4EAA4E;YAC5E,2DAA2D;YAC3D,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAC/D,uEAAuE;YACvE,sEAAsE;YACtE,wDAAwD;YACxD,EAAE;YACF,oEAAoE;YACpE,8EAA8E;YAC9E,6EAA6E;YAC7E,0EAA0E;YAC1E,2EAA2E;YAC3E,2EAA2E;YAC3E,yEAAyE;YACzE,0EAA0E;YAC1E,uBAAuB;YACvB,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,EAAE;gBACvD,GAAG,EAAE,YAAY;gBACjB,sEAAsE;gBACtE,yEAAyE;gBACzE,OAAO,EAAE,SAAS;aACnB,CAAC,CAAC;YACH,0EAA0E;YAC1E,wEAAwE;YACxE,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC;QACJ,CAAC,CAAC,CAAC;IAEL,MAAM,OAAO,GAA6B,EAAE,CAAC;IAC7C,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACnF,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,CAAC;QAC/B,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,SAAS;YACjB,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;YAChE,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;SACjE,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,GAAG,KAAK,CAAC;YACf,MAAM,CAAC,gEAAgE;QACzE,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM;QACN,OAAO;QACP,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,KAAK;QACjB,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,yBAAyB,GAAG,iBAAiB,CAAC;AACpD,MAAM,2BAA2B,GAAG,yBAAyB,CAAC;AAC9D,MAAM,2BAA2B,GAAG,yBAAyB,CAAC;AAC9D,MAAM,0BAA0B,GAAG,4CAA4C,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,YAAoB;IACtD,OAAO,IAAI,CAAC,YAAY,EAAE,yBAAyB,CAAC,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,OAAO,IAAI,CAAC,YAAY,EAAE,2BAA2B,CAAC,CAAC;AACzD,CAAC;AAwCD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,OAAO,IAAI,CAAC,YAAY,EAAE,2BAA2B,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB,EACpB,KAAa,EACb,IAAmB,EACnB,OAAgB;IAEhB,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,GAAG,GAAG,MAAM,oBAAoB,CACpC,oBAAoB,CAAC,YAAY,CAAC,CACnC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,8BAA8B,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IAC/E,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC9D,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7C,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,MAAM,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IACjG,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACnE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACrD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,YAAoB,EACpB,OAQC;IAED,MAAM,IAAI,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAChD,MAAM,MAAM,GAA2B;QACrC,cAAc,EAAE,0BAA0B;QAC1C,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,0EAA0E;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AA8BD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,YAAoB,EACpB,OAMC;IAED,MAAM,IAAI,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,MAAM,GAA2B;QACrC,cAAc,EAAE,4CAA4C;QAC5D,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QACnC,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC5C,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACnE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;IACF,MAAM,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC;AAkCD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,YAAoB,EACpB,KAAa,EACb,MAA0C,EAC1C,gBAAgE;IAEhE,MAAM,IAAI,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;IAC/C,IAAI,WAA2C,CAAC;IAChD,IAAI,gBAAgB,IAAI,MAAM,EAAE,CAAC;QAC/B,2EAA2E;QAC3E,0EAA0E;QAC1E,2EAA2E;QAC3E,6CAA6C;QAC7C,WAAW,GAAG,MAAM,gBAAgB,CAAC;YACnC,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,KAAK,EAAE,gBAAgB,CAAC,KAAK;YAC7B,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,IAAI,EAAE,KAAK,MAAM,CAAC,WAAW,IAAI,EAAE,EAAE;SACnE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,MAAM,GAAuB;QACjC,cAAc,EAAE,oCAAoC;QACpD,KAAK;QACL,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,wBAAwB;QAC1E,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,IAAI;QACpC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,IAAI;QAC5B,GAAG,CAAC,MAAM,EAAE,WAAW,KAAK,SAAS;YACnC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;QACxC,GAAG,CAAC,MAAM,EAAE,WAAW,KAAK,SAAS;YACnC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;QACxC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;KACtD,CAAC;IACF,MAAM,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/remediate/steps/frictionCloseout.d.ts

@@ -0,0 +1,34 @@
+import { type FrictionTriageDecision } from "audit-tools/shared";
+import type { RemediationState } from "../state/store.js";
+import type { RemediationStep } from "./types.js";
+/**
+ * The BLOCKING friction close-out step for a run whose walk is still owed.
+ *
+ * Emitted from `handleClosing` BEFORE the close touches disk, so the record the
+ * host is told to write (`triage.recordPath`) is the plan-keyed one this very
+ * decision just materialized — and so the run's identity in that path is the
+ * plan id, not a fallback. The step is a `closing`-phase gate: `next-step`
+ * re-decides the same walk on the next call, and only a disposed walk lets the
+ * close proceed.
+ */
+export declare function buildFrictionWalkStep(root: string, artifactsDir: string, state: RemediationState, triage: FrictionTriageDecision): Promise<RemediationStep>;
+export declare function presentReportStep(root: string, artifactsDir: string, state: RemediationState | null): Promise<RemediationStep>;
+/**
+ * The terminal friction-TRIAGE close-out for the remediate half. Thin delegation to
+ * the single-sourced `decideFrictionTriage` (`audit-tools/shared`) — the exact analog
+ * of audit-code's `decideAuditFrictionCloseout`, so the triage shape, disposition
+ * vocabulary, blocking semantics, and close-out logic cannot drift between the two
+ * halves. Drops the former false-green (an empty up-front record no longer satisfies):
+ * the blocking triage stays unsatisfied ("dispose") until every captured mechanical
+ * event AND every surfaced agent-feedback reflection carries a disposition; an empty
+ * set (zero events AND zero reflections) is trivially "disposed". Keyed only off
+ * `(artifactsDir, runId)`; never coupled to any repo's backlog doc.
+ *
+ * A state with NO plan id can name no run, and since the decision MATERIALIZES
+ * the record it keys, guessing a key there would mint one. It returns `null`
+ * instead — "there is no run here to close out", which is the truthful answer
+ * for a state whose plan is gone. Callers that hold the run's plan get a
+ * decision; callers past the run boundary get nothing to render.
+ */
+export declare function decideRemediateFrictionCloseout(artifactsDir: string, state: RemediationState | null): Promise<FrictionTriageDecision | null>;
+//# sourceMappingURL=frictionCloseout.d.ts.map

package/dist/remediate/steps/frictionCloseout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frictionCloseout.d.ts","sourceRoot":"","sources":["../../../src/remediate/steps/frictionCloseout.ts"],"names":[],"mappings":"AAEA,OAAO,EAAkD,KAAK,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACjH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAG1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,gBAAgB,EACvB,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,eAAe,CAAC,CAa1B;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAC7B,OAAO,CAAC,eAAe,CAAC,CA4D1B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,+BAA+B,CACnD,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAC7B,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAIxC"}

package/dist/remediate/steps/frictionCloseout.js

@@ -0,0 +1,113 @@
+// sites-pinned: tests/remediate/friction-capture-closeout.test.ts
+import { dirname, join } from "node:path";
+import { decideFrictionTriage, buildFrictionTriageBlock } from "audit-tools/shared";
+import { stateRunId, requireStateRunId } from "../state/runIdentity.js";
+import { writeCurrentStep } from "./stepWriter.js";
+/**
+ * The BLOCKING friction close-out step for a run whose walk is still owed.
+ *
+ * Emitted from `handleClosing` BEFORE the close touches disk, so the record the
+ * host is told to write (`triage.recordPath`) is the plan-keyed one this very
+ * decision just materialized — and so the run's identity in that path is the
+ * plan id, not a fallback. The step is a `closing`-phase gate: `next-step`
+ * re-decides the same walk on the next call, and only a disposed walk lets the
+ * close proceed.
+ */
+export async function buildFrictionWalkStep(root, artifactsDir, state, triage) {
+    return writeCurrentStep({
+        stepKind: "close_run",
+        status: "ready",
+        runId: requireStateRunId(state),
+        repoRoot: root,
+        artifactsDir,
+        prompt: `# Remediation Run Friction Triage\n\nComplete the friction close-out walk before the run may close.\n${buildFrictionTriageBlock(triage)}`,
+        allowedCommands: [],
+        stopCondition: "Complete friction triage (write dispositions and open_observations), then call next-step again.",
+        artifactPaths: { friction_record: triage.recordPath },
+    });
+}
+export async function presentReportStep(root, artifactsDir, state) {
+    const reportPath = join(dirname(artifactsDir), "remediation-report.md");
+    // Terminal friction-TRIAGE close-out, folded into present_report (single-sourced in
+    // `audit-tools/shared`). MANDATORY + BLOCKING: stays "dispose" until every mechanical
+    // event + reflection is disposed AND ≥1 open observation written. Never trivially
+    // satisfied by an empty event set — the host must actively confirm the friction state.
+    //
+    // NO FRICTION RECORD IS EVER MINTED HERE. The decision was made — and the
+    // record, under the run's plan-keyed path, was walked — before the close
+    // archived it: `handleClosing` consults `decideRemediateFrictionCloseout`
+    // against the LIVE state and short-circuits the close until the walk is
+    // disposed. So ON THE GREEN PATH — the close ran to `complete`, archived the
+    // run and removed the artifacts dir — the walk was already completed when the
+    // close started, the plan-keyed record left with the other deliverables, and
+    // all that is left is to RENDER the already-recorded walk for the host.
+    //
+    // NOT-GREEN IS THE OTHER HALF, and it is not "mint nothing": a close that
+    // returned a non-`complete` state PRESERVES the artifacts dir, so the record
+    // this step decides remains where the run wrote it — the caller reaches here
+    // with the saved state still carrying its plan id, `decideFrictionTriage`
+    // materializes (or re-reads) that same plan-keyed file, and the walk is
+    // rendered from the record that is still in place.
+    //
+    // It is decided — and so materialized — ONLY when the state names a run. The
+    // guard is the plan id, not the artifacts dir: the dir is not evidence of
+    // anything here, since `decideNextStepLoop` mkdirs it unconditionally on entry,
+    // `RunLogger.event` mkdirs it again for `run.log.jsonl`, and `writeJsonFile`
+    // mkdirs any parent it is handed. So a dir-existence test is true on every
+    // path, including a run whose state the close deleted. Guarding on the dir was
+    // the 2026-08-24 defect: the decider ran with a null state, took a fallback
+    // key, and because `decideFrictionTriage` MATERIALIZES the record it is given,
+    // minted a fresh EMPTY record inside the directory the close had just deleted —
+    // re-blocking the run on the record it had created. `stateRunId` now answers
+    // `null` for a planless state and this call therefore decides nothing.
+    //
+    // A `complete` state reaching here is a run that never ran the close walk (a
+    // re-delivery of an already-complete run, whose plan the state still carries),
+    // so the walk is genuinely still owed and deciding it here is correct — it
+    // renders as the blocking step. Only a planless state renders nothing.
+    const triage = await decideRemediateFrictionCloseout(artifactsDir, state);
+    const frictionBlock = triage ? buildFrictionTriageBlock(triage) : "";
+    const isBlocked = triage?.action === "dispose";
+    return writeCurrentStep({
+        stepKind: "present_report",
+        status: isBlocked ? "ready" : "complete",
+        runId: stateRunId(state),
+        repoRoot: root,
+        artifactsDir,
+        prompt: isBlocked
+            ? `# Remediation Run Friction Triage\n\nComplete friction triage before presenting the report.\n${frictionBlock}`
+            : `# Present Remediation Report\n\nRead \`${reportPath}\` and summarize the remediation outcome.\nMention resolved, ignored, and deemed-inappropriate counts plus the closing action.\n${frictionBlock}`,
+        allowedCommands: [],
+        stopCondition: isBlocked
+            ? "Complete friction triage (write dispositions and open_observations), then call next-step again."
+            : "Present the remediation report summary and stop.",
+        artifactPaths: {
+            final_report: reportPath,
+            ...(triage ? { friction_record: triage.recordPath } : {}),
+        },
+    });
+}
+/**
+ * The terminal friction-TRIAGE close-out for the remediate half. Thin delegation to
+ * the single-sourced `decideFrictionTriage` (`audit-tools/shared`) — the exact analog
+ * of audit-code's `decideAuditFrictionCloseout`, so the triage shape, disposition
+ * vocabulary, blocking semantics, and close-out logic cannot drift between the two
+ * halves. Drops the former false-green (an empty up-front record no longer satisfies):
+ * the blocking triage stays unsatisfied ("dispose") until every captured mechanical
+ * event AND every surfaced agent-feedback reflection carries a disposition; an empty
+ * set (zero events AND zero reflections) is trivially "disposed". Keyed only off
+ * `(artifactsDir, runId)`; never coupled to any repo's backlog doc.
+ *
+ * A state with NO plan id can name no run, and since the decision MATERIALIZES
+ * the record it keys, guessing a key there would mint one. It returns `null`
+ * instead — "there is no run here to close out", which is the truthful answer
+ * for a state whose plan is gone. Callers that hold the run's plan get a
+ * decision; callers past the run boundary get nothing to render.
+ */
+export async function decideRemediateFrictionCloseout(artifactsDir, state) {
+    const runId = stateRunId(state);
+    if (!runId)
+        return null;
+    return decideFrictionTriage(artifactsDir, runId, "remediate-code");
+}
+//# sourceMappingURL=frictionCloseout.js.map

package/dist/remediate/steps/frictionCloseout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frictionCloseout.js","sourceRoot":"","sources":["../../../src/remediate/steps/frictionCloseout.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAA+B,MAAM,oBAAoB,CAAC;AAEjH,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAGnD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAY,EACZ,YAAoB,EACpB,KAAuB,EACvB,MAA8B;IAE9B,OAAO,gBAAgB,CAAC;QACtB,QAAQ,EAAE,WAAW;QACrB,MAAM,EAAE,OAAO;QACf,KAAK,EAAE,iBAAiB,CAAC,KAAK,CAAC;QAC/B,QAAQ,EAAE,IAAI;QACd,YAAY;QACZ,MAAM,EAAE,wGAAwG,wBAAwB,CAAC,MAAM,CAAC,EAAE;QAClJ,eAAe,EAAE,EAAE;QACnB,aAAa,EACX,iGAAiG;QACnG,aAAa,EAAE,EAAE,eAAe,EAAE,MAAM,CAAC,UAAU,EAAE;KACtD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAY,EACZ,YAAoB,EACpB,KAA8B;IAE9B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC,CAAC;IACxE,oFAAoF;IACpF,sFAAsF;IACtF,kFAAkF;IAClF,uFAAuF;IACvF,EAAE;IACF,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,wEAAwE;IACxE,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,wEAAwE;IACxE,EAAE;IACF,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,0EAA0E;IAC1E,wEAAwE;IACxE,mDAAmD;IACnD,EAAE;IACF,6EAA6E;IAC7E,0EAA0E;IAC1E,gFAAgF;IAChF,6EAA6E;IAC7E,2EAA2E;IAC3E,+EAA+E;IAC/E,4EAA4E;IAC5E,+EAA+E;IAC/E,gFAAgF;IAChF,6EAA6E;IAC7E,uEAAuE;IACvE,EAAE;IACF,6EAA6E;IAC7E,+EAA+E;IAC/E,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAC1E,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,MAAM,SAAS,GAAG,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC;IAC/C,OAAO,gBAAgB,CAAC;QACtB,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU;QACxC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC;QACxB,QAAQ,EAAE,IAAI;QACd,YAAY;QACZ,MAAM,EAAE,SAAS;YACf,CAAC,CAAC,gGAAgG,aAAa,EAAE;YACjH,CAAC,CAAC,0CAA0C,UAAU,mIAAmI,aAAa,EAAE;QAC1M,eAAe,EAAE,EAAE;QACnB,aAAa,EAAE,SAAS;YACtB,CAAC,CAAC,iGAAiG;YACnG,CAAC,CAAC,kDAAkD;QACtD,aAAa,EAAE;YACb,YAAY,EAAE,UAAU;YACxB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,YAAoB,EACpB,KAA8B;IAE9B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,oBAAoB,CAAC,YAAY,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;AACrE,CAAC"}

package/dist/remediate/steps/gateCommands.d.ts

@@ -6,7 +6,7 @@ export interface FinalGateCommandSpec {
     /** The package this command's unit suite targets (single-flight key), if any. */
     package_dir?: string;
     /** Which layer of the floor this belongs to. */
-    layer: "build" | "check" | "unit";
+    layer: "build" | "check" | "lint" | "unit";
 }
 /**
  * Whether `root` is the audit-tools monorepo — the repo the tool-owned final
@@ -192,13 +192,11 @@ export declare function carriesEnvironmentVerdict(attribution: GateRedAttributio
  */
 export declare function renderGateAttribution(attribution: GateRedAttribution | undefined): string;
 /**
- * The tool-owned final-gate command list (INV-RS-10) for the audit-tools
- * monorepo. Pure and deterministic so tests can assert: it is non-vacuous
- * (always > 0 build + check + unit commands) for the audit-tools structure,
- * never references `plan.test_command`, every UNIT command is build-free, and no
- * package's unit suite appears twice (single-flight — CE-001). Returns `[]` when
- * `root` is not the audit-tools monorepo (the audit-tools-specific suite is
- * inapplicable there — see `runToolOwnedFinalGate`).
+ * Repository-declared verification in build/typecheck/lint/test order. The
+ * audit-tools profile retains its build-free unit floor. An explicit test
+ * command replaces only the generic test role, never the other checks.
  */
-export declare function toolOwnedFinalGateCommands(root: string): FinalGateCommandSpec[];
+export declare function toolOwnedFinalGateCommands(root: string, testCommand?: string[]): FinalGateCommandSpec[];
+/** Cache identity includes declarations even when the worktree probe cannot see ignored files. */
+export declare function finalGateBinding(root: string, testCommand?: string[]): string;
 //# sourceMappingURL=gateCommands.d.ts.map