audit-tools 0.52.4 → 0.53.0

package/dist/remediate/contractPipeline/changeClassification.js

@@ -1,446 +0,0 @@
-// sites-pinned: tests/remediate/change-classification-backtracking.test.ts, tests/remediate/dc5.test.ts, tests/audit/scanner-linear-boundaries.test.ts
-// <!-- comment-symbol-exempt: names deliberately-retired symbols; this block records that history -->
-/**
- * DC-5 — obligation change-vs-addition classification + paired/scoped negative
- * test-spec gate (single source).
- *
- * Two latent failure modes this module closes:
- *
- *   CE-013 (render-only misclassification): the paired-obligation gate used to
- *     force EVERY testable obligation to carry a positive+negative pair, with no
- *     notion of whether the obligation changes prior behavior or adds new
- *     behavior. A pure addition has no behavior to regress, so pairing it is
- *     burden without signal — and, worse, the "classification" lived only in the
- *     prompt prose (render-only), never as a recorded, checkable verdict. This
- *     module classifies each obligation *deterministically first* (does it touch
- *     a symbol/file that already exists?) and records the verdict on the ledger,
- *     so an LLM may confirm/override but the result is never silent.
- *
- *   CE-006 (unscoped repo-wide-grep negative): a behavior-CHANGE obligation's
- *     negative half could be satisfied by an assertion that greps the whole repo
- *     ("no file anywhere contains X") — which rots immediately and proves nothing
- *     about the changed symbol. The negative must be SCOPED to the changed
- *     symbol/file. The scope check is a structural PREDICATE over the assertion
- *     (it must name an anchor AND must not be an unscoped global scan), not a
- *     keyword match — keyword matching alone is exactly what let the unscoped
- *     negative through.
- *
- * Single-source invariant (mirrors `derive.ts`): the deriver, the test-plan
- * derivation gate (`validatePairedObligations`), and the `mergeImplementResults`
- * verify gate ALL classify and pair through the helpers here. No parallel logic.
- */
-import { isRecord } from "audit-tools/shared";
-// ── Symbol extraction ─────────────────────────────────────────────────────────
-/**
- * Identifier-like tokens (camelCase / snake_case / dotted / path-ish) that name a
- * code symbol or file. Length >= 3 so single letters and noise are ignored.
- * Used both to pull candidate symbols out of an obligation description and to
- * build the baseline corpus of pre-existing symbols.
- */
-const SYMBOL_TOKEN_PATTERN = /[A-Za-z_$][A-Za-z0-9_$./-]{2,}/g;
-/** Common English words that look identifier-ish but never name a symbol. */
-const SYMBOL_STOPWORDS = new Set([
-    "the", "and", "for", "with", "that", "this", "must", "not", "its", "via",
-    "per", "into", "when", "then", "than", "from", "module", "function", "value",
-    "input", "output", "inputs", "outputs", "should", "shall", "handle", "failure",
-    "mode", "implement", "contract", "boundary", "validation", "every", "each",
-    "obligation", "behavior", "behaviour", "existing", "new", "add", "change",
-]);
-/** Extract candidate symbol/file tokens from free text (lowercased, de-noised). */
-export function extractSymbolTokens(text) {
-    if (typeof text !== "string" || text.length === 0)
-        return [];
-    const out = new Set();
-    for (const raw of text.match(SYMBOL_TOKEN_PATTERN) ?? []) {
-        let start = 0;
-        let end = raw.length;
-        while (start < end && "./-".includes(raw[start]))
-            start++;
-        while (end > start && "./-".includes(raw[end - 1]))
-            end--;
-        const token = raw.slice(start, end).toLowerCase();
-        if (token.length < 3)
-            continue;
-        if (SYMBOL_STOPWORDS.has(token))
-            continue;
-        // <!-- comment-symbol-exempt: names deliberately-retired symbols; this block records that history -->
-        // A token must carry a "code-ish" shape — a case hump, an underscore, a dot,
-        // a slash, or a digit — so a plain prose word ("rejects") is not mistaken for
-        // a symbol while `writeRecord`, `flush_buffer`, `src/a.ts`, `O_1` are kept.
-        if (/[A-Z]/.test(raw.slice(1)) || /[_./\-0-9]/.test(token)) {
-            out.add(token);
-        }
-    }
-    return [...out];
-}
-/**
- * Build the baseline corpus of pre-existing symbol/file tokens from the finalized
- * module contracts. A symbol present here already exists, so an obligation that
- * references it is *changing* existing behavior rather than adding new behavior.
- *
- * The corpus is drawn from the declared interface surface (inputs / outputs /
- * side_effects / validation_boundary) plus each module name — the things the
- * contract says already exist at the seam.
- */
-export function buildBaselineSymbolCorpus(finalizedModuleContracts) {
-    const corpus = new Set();
-    const record = isRecord(finalizedModuleContracts) ? finalizedModuleContracts : {};
-    const modules = Array.isArray(record.module_contracts) ? record.module_contracts : [];
-    for (const mod of modules) {
-        if (!isRecord(mod))
-            continue;
-        if (typeof mod.name === "string") {
-            for (const t of extractSymbolTokens(mod.name))
-                corpus.add(t);
-        }
-        for (const field of ["inputs", "outputs", "side_effects"]) {
-            if (!Array.isArray(mod[field]))
-                continue;
-            for (const entry of mod[field]) {
-                if (typeof entry !== "string")
-                    continue;
-                for (const t of extractSymbolTokens(entry))
-                    corpus.add(t);
-            }
-        }
-        if (typeof mod.validation_boundary === "string") {
-            for (const t of extractSymbolTokens(mod.validation_boundary))
-                corpus.add(t);
-        }
-    }
-    return corpus;
-}
-// ── Deterministic classification (FIRST pass) ──────────────────────────────────
-// <!-- comment-symbol-exempt: names deliberately-retired symbols; this block records that history -->
-/**
- * Classify one obligation change-vs-addition deterministically.
- *
- * Heuristic: the obligation *touches an existing symbol* when any symbol token in
- * its description is present in the baseline corpus of pre-existing symbols. Such
- * an obligation is a behavior CHANGE; otherwise it is a pure ADDITION.
- *
- * The matched tokens become `touched_symbols` — the scope anchors a paired
- * negative assertion must name. This is the deterministic FIRST pass; an LLM may
- * confirm or override it via `applyLlmConfirmation`, and the override is recorded.
- */
-export function classifyObligationChange(description, baselineSymbols) {
-    const tokens = extractSymbolTokens(description);
-    const touched = tokens.filter((t) => baselineSymbols.has(t));
-    if (touched.length > 0) {
-        return {
-            change_kind: "change",
-            touched_symbols: touched,
-            determined_by: "touches_existing_symbol",
-        };
-    }
-    return {
-        change_kind: "addition",
-        touched_symbols: [],
-        determined_by: "no_existing_symbol",
-    };
-}
-// ── Anti-rot scope predicate (CE-006) ──────────────────────────────────────────
-/**
- * Markers of an UNSCOPED, repo-wide negative assertion — a grep/scan over the
- * whole tree that names no specific symbol and rots the moment any unrelated file
- * matches. Presence of one of these (without an offsetting scope anchor) is what
- * the predicate rejects. This is a STRUCTURAL signal about the assertion's shape,
- * distinct from polarity keywords.
- */
-const UNSCOPED_GLOBAL_SCAN_PATTERN = /\b(?:repo[\s-]?wide|whole\s+repo|entire\s+(?:repo|codebase|tree)|across\s+the\s+(?:repo|codebase|tree)|any\s+file|no\s+file\s+(?:anywhere|in\s+the\s+repo)|anywhere\s+in\s+the\s+(?:repo|codebase|tree)|grep\s+(?:the\s+)?(?:repo|codebase|tree))\b/i;
-/**
- * Negation cues that, in the SAME clause immediately before a global-scan phrase,
- * mark it as DESCRIPTIVE contrast ("scoped to X, *not* an unscoped repo-wide
- * check") rather than the assertion's actual action. Flagging the literal words
- * "repo-wide" regardless of negation is exactly what forced hosts to euphemise a
- * legitimately-scoped negative — the CE-006 false-positive. Only an AFFIRMATIVE
- * scan (the scan is the check) disqualifies scoping.
- */
-const SCAN_NEGATION_CUE = /\b(?:not|never|no\s+longer|rather\s+than|instead\s+of|without|avoids?|avoiding|isn'?t|aren'?t|doesn'?t|don'?t|won'?t)\b/i;
-/**
- * True when the assertion uses a global-scan phrase AFFIRMATIVELY — the scan is
- * the check it performs, not a contrast clause describing what it deliberately
- * avoids. Each scan match is judged by its own clause (text back to the nearest
- * `. ; , — --` boundary): a negation cue in that clause makes the mention
- * descriptive and non-disqualifying; an unqualified scan disqualifies. This is a
- * structural read of the assertion's action, not a bare keyword veto on the words.
- */
-function usesAffirmativeGlobalScan(assertion) {
-    // Scan clause boundaries and negation cues once. Repeated mentions in one
-    // clause share its first negation offset rather than rescanning prefixes.
-    const events = new RegExp(`${SCAN_NEGATION_CUE.source}|[.;,]|—|--`, "gi");
-    const scans = new RegExp(UNSCOPED_GLOBAL_SCAN_PATTERN.source, "gi");
-    let event = events.exec(assertion);
-    let negated = false;
-    for (const match of assertion.matchAll(scans)) {
-        while (event && event.index < match.index) {
-            negated = !/^(?:[.;,]|—|--)$/.test(event[0]);
-            event = events.exec(assertion);
-        }
-        if (!negated)
-            return true;
-    }
-    return false;
-}
-/** Match a scope anchor as a whole word/path fragment inside an assertion. */
-function assertionNamesAnchor(assertion, anchor) {
-    if (anchor.length < 3)
-        return false;
-    const escaped = anchor.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    // Word/path boundary: the anchor is not glued to surrounding identifier chars.
-    return new RegExp(`(?<![A-Za-z0-9_$])${escaped}(?![A-Za-z0-9_$])`, "i").test(assertion);
-}
-/**
- * A negative assertion for a behavior-CHANGE obligation is SCOPED when it names
- * at least one of the change's anchors (the touched symbol/file) AND does not
- * perform an affirmative unscoped repo-wide scan. Naming an anchor is necessary
- * but not sufficient: an assertion that both names the symbol and says "grep the
- * whole repo" is still rejected, because the scan, not the symbol, is what it
- * actually checks. A merely DESCRIPTIVE mention of a global scan ("scoped to X,
- * not an unscoped repo-wide check") does NOT disqualify — the veto reads the
- * assertion's action, not the literal words, so a host need not euphemise (CE-006).
- *
- * Returns true when the assertion is acceptably scoped to the change.
- */
-export function negativeAssertionIsScoped(assertion, anchors) {
-    if (typeof assertion !== "string" || assertion.length === 0)
-        return false;
-    if (usesAffirmativeGlobalScan(assertion))
-        return false;
-    return anchors.some((a) => assertionNamesAnchor(assertion, a));
-}
-// ── Polarity detection (shared with the legacy keyword gate) ───────────────────
-/** Phrases that mark a negative/failure assertion (paired-obligation half). */
-export const NEGATIVE_ASSERTION_PATTERN = /\b(rejects?|rejected|throws?|errors?|fails?|failure|invalid|disallows?|forbidden|refuses?|must not|does not|should not|cannot|never|negative|missing|absent|empty)\b/i;
-/** Phrases that mark a positive/satisfied assertion (paired-obligation half). */
-export const POSITIVE_ASSERTION_PATTERN = /\b(accept|accepted|allow|allowed|succeed|succeeds|returns?|produces?|valid|present|satisfies|satisfied|passes?|emits?|writes?|equal|equals|matches?)\b/i;
-/**
- * Multi-segment identifier tokens (obligation ids `OBL-AUTH-fail-session`, kebab/
- * snake symbols, dotted/sliced paths `src/x/plan.ts`, `a::b`). A keyword regex
- * `\b`-boundary still fires on a polarity word delimited by `-`/`_`/`.`/`/`/`:`
- * inside such a token (e.g. `fail` in `OBL-AUTH-fail-session`), flipping a positive
- * assertion that merely *cites* an id. These carry no prose polarity, so mask them
- * before keyword classification. A run must have at least one internal delimiter to
- * qualify — ordinary prose words (no internal `-_./:`)  are left untouched, as are
- * multiword phrases like "does not" (space-separated, not a single token).
- *
- * SCANNED, NOT MATCHED — and the reason is a measured quadratic, not taste. The
- * obvious regex here is `[A-Za-z0-9]+(?:[-_/.:]+[A-Za-z0-9]+)+`, and on a long
- * UNBROKEN alphanumeric run it is Θ(n²): the engine starts at every position and
- * each start consumes the rest of the run before the (absent) delimiter fails the
- * whole match, so a 16,000-char run took 3.36 SECONDS (measured on the `word-run`
- * family: 44/186/741/3360ms across 2k/4k/8k/16k, a clean 4×-per-doubling). An
- * assertion arrives from a host-authored test plan with no length bound, so the
- * input class is reachable.
- *
- * Restructuring the regex does NOT fix it: the failure is the per-start-position
- * rescan, so a possessive/atomic leading run only replaces an O(n) giveback with
- * an O(n) take, and a lookahead made of the same character class still has to
- * scan the run to fail. A single forward pass over a two-character-class grammar
- * is the linear form, and the grammar is tiny and fully ours. Same replacement
- * semantics as the regex it replaces, pinned by
- * `tests/remediate/change-classification-backtracking.test.ts`.
- */
-function isAsciiAlphanumeric(code) {
-    return ((code >= 48 && code <= 57) || // 0-9
-        (code >= 65 && code <= 90) || // A-Z
-        (code >= 97 && code <= 122) // a-z
-    );
-}
-/** The token's internal delimiters: `-`, `_`, `/`, `.`, `:`. */
-function isIdentifierDelimiter(code) {
-    return (code === 45 || // -
-        code === 95 || // _
-        code === 47 || // /
-        code === 46 || // .
-        code === 58 //   :
-    );
-}
-/**
- * Blank out identifier tokens so their embedded words don't leak polarity.
- *
- * One left-to-right pass, O(n) — and the pass must SKIP, not step, on failure.
- * The regex's token is `alnum+ (delimiter+ alnum+)+`: it starts and ends on an
- * alphanumeric and contains at least one delimiter that is FOLLOWED by an
- * alphanumeric. So a maximal run of `alnum|delimiter` that holds no such
- * delimiter-then-alphanumeric pair cannot contain a token starting anywhere
- * inside it, and the scan jumps past the whole run in one step. Emitting the
- * leading character and re-entering would rescan the rest of the run at every
- * position — the same quadratic the regex had, merely relocated.
- *
- * On a match the replacement ends at the LAST alphanumeric of the run, leaving
- * any trailing delimiters in place, which is exactly where the regex's greedy
- * match ended.
- */
-function stripIdentifierTokens(assertion) {
-    const out = [];
-    const length = assertion.length;
-    let index = 0;
-    while (index < length) {
-        if (!isAsciiAlphanumeric(assertion.charCodeAt(index))) {
-            out.push(assertion[index]);
-            index += 1;
-            continue;
-        }
-        // Extend over the maximal alphanumeric/delimiter run, tracking whether a
-        // delimiter has been followed by an alphanumeric (the qualifying shape).
-        let cursor = index;
-        let lastAlphanumeric = index;
-        let sawDelimiter = false;
-        let qualifies = false;
-        while (cursor < length) {
-            const current = assertion.charCodeAt(cursor);
-            if (isAsciiAlphanumeric(current)) {
-                if (sawDelimiter)
-                    qualifies = true;
-                lastAlphanumeric = cursor;
-                cursor += 1;
-                continue;
-            }
-            if (isIdentifierDelimiter(current)) {
-                sawDelimiter = true;
-                cursor += 1;
-                continue;
-            }
-            break;
-        }
-        if (qualifies) {
-            out.push(" ");
-            index = lastAlphanumeric + 1;
-            continue;
-        }
-        // No token can begin inside this run — copy it through verbatim and resume
-        // after it.
-        out.push(assertion.slice(index, cursor));
-        index = cursor;
-    }
-    return out.join("");
-}
-/**
- * Classify one assertion's polarity. An explicit `POSITIVE:` / `NEGATIVE:` label
- * is authoritative and skips the keyword fallback (so "POSITIVE: must not exceed
- * N" counts only as positive). Unlabeled assertions fall through to the keyword
- * regexes, which may match both polarities — run against an identifier-masked copy
- * so a polarity word embedded in a cited id (e.g. `fail` in `OBL-AUTH-fail-session`)
- * doesn't misclassify the assertion.
- */
-export function assertionPolarity(assertion) {
-    const label = /^\s*(POSITIVE|NEGATIVE)\s*:/i.exec(assertion);
-    if (label) {
-        return label[1].toUpperCase() === "POSITIVE" ? "positive" : "negative";
-    }
-    const prose = stripIdentifierTokens(assertion);
-    const neg = NEGATIVE_ASSERTION_PATTERN.test(prose);
-    const pos = POSITIVE_ASSERTION_PATTERN.test(prose);
-    if (neg && pos)
-        return "both";
-    if (neg)
-        return "negative";
-    if (pos)
-        return "positive";
-    return "none";
-}
-/**
- * Evaluate the paired positive+scoped-negative requirement for a behavior-CHANGE
- * obligation. `anchors` are the change's scope anchors (touched symbols/file).
- *
- * - A positive half is any assertion with positive polarity.
- * - A negative half counts ONLY when it is scoped to the change (CE-006): an
- *   unscoped repo-wide negative does not satisfy the negative requirement.
- *   `negativeUnscoped` is reported when the sole negative(s) failed scoping, so
- *   the diagnostic distinguishes "no negative at all" from "negative not scoped".
- */
-export function evaluatePairing(assertions, anchors) {
-    let hasPositive = false;
-    let hasScopedNegative = false;
-    let hasAnyNegative = false;
-    for (const assertion of assertions) {
-        if (typeof assertion !== "string")
-            continue;
-        const polarity = assertionPolarity(assertion);
-        if (polarity === "positive" || polarity === "both")
-            hasPositive = true;
-        if (polarity === "negative" || polarity === "both") {
-            hasAnyNegative = true;
-            if (negativeAssertionIsScoped(assertion, anchors))
-                hasScopedNegative = true;
-        }
-    }
-    return {
-        ok: hasPositive && hasScopedNegative,
-        hasPositive,
-        hasNegative: hasScopedNegative,
-        negativeUnscoped: hasAnyNegative && !hasScopedNegative,
-    };
-}
-// ── Defensive read + anchor derivation (used by the gates) ─────────────────────
-/**
- * Read an obligation's `change_classification` from a raw, untrusted payload.
- * Returns the narrowed classification, or `undefined` only when the field is
- * genuinely ABSENT — a truly unclassified obligation (e.g. a structural one), which
- * the gates already treat as a CHANGE (fail-closed) at the consumer.
- *
- * A classification that is PRESENT but CORRUPT (not a record, or an unrecognized
- * `change_kind`) is read as a fail-closed CHANGE rather than `undefined` (INV-IR-4):
- * a dropped or garbled classification can never relax the paired-test requirement
- * and can never let incremental item-scoping (contract-incremental-reconvergence)
- * carry a changed item forward as if it were an unchanged addition.
- */
-export function readObligationChangeClassification(obligation) {
-    if (!isRecord(obligation))
-        return undefined;
-    // Distinguish "absent" (no field → undefined, consumers stay fail-closed) from
-    // "present but corrupt" (field exists → an explicit fail-closed CHANGE verdict).
-    if (!("change_classification" in obligation))
-        return undefined;
-    const cls = obligation.change_classification;
-    const failClosedChange = (touched_symbols) => ({
-        change_kind: "change",
-        touched_symbols,
-        determined_by: "touches_existing_symbol",
-    });
-    if (!isRecord(cls))
-        return failClosedChange([]);
-    if (cls.change_kind !== "change" && cls.change_kind !== "addition") {
-        const touched = Array.isArray(cls.touched_symbols)
-            ? cls.touched_symbols.filter((t) => typeof t === "string")
-            : [];
-        return failClosedChange(touched);
-    }
-    const touched = Array.isArray(cls.touched_symbols)
-        ? cls.touched_symbols.filter((t) => typeof t === "string")
-        : [];
-    const determinedBy = cls.determined_by === "touches_existing_symbol" ||
-        cls.determined_by === "no_existing_symbol" ||
-        cls.determined_by === "llm_confirmed" ||
-        cls.determined_by === "llm_override"
-        ? cls.determined_by
-        : "touches_existing_symbol";
-    return {
-        change_kind: cls.change_kind,
-        touched_symbols: touched,
-        determined_by: determinedBy,
-        ...(typeof cls.rationale === "string" ? { rationale: cls.rationale } : {}),
-    };
-}
-/**
- * The scope anchors a paired negative must name for one obligation. Prefers the
- * classification's recorded `touched_symbols`; falls back to the obligation id
- * plus any symbol tokens in its description when the classification carries none
- * (e.g. an unclassified obligation treated as a fail-closed change). Always
- * non-empty when the id is a real id, so a fail-closed change still has a concrete
- * anchor to scope against rather than vacuously accepting any negative.
- */
-export function obligationScopeAnchors(obligationId, description, classification) {
-    if (classification && classification.touched_symbols.length > 0) {
-        return classification.touched_symbols;
-    }
-    const anchors = new Set();
-    if (typeof obligationId === "string" && obligationId.length >= 3) {
-        anchors.add(obligationId.toLowerCase());
-    }
-    for (const t of extractSymbolTokens(description))
-        anchors.add(t);
-    return [...anchors];
-}
-//# sourceMappingURL=changeClassification.js.map

package/dist/remediate/contractPipeline/changeClassification.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"changeClassification.js","sourceRoot":"","sources":["../../../src/remediate/contractPipeline/changeClassification.ts"],"names":[],"mappings":"AAAA,uJAAuJ;AACvJ,sGAAsG;AACtG;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,QAAQ,EAAuC,MAAM,oBAAoB,CAAC;AAEnF,iFAAiF;AAEjF;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,iCAAiC,CAAC;AAE/D,6EAA6E;AAC7E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;IACxE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO;IAC5E,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS;IAC9E,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM;IAC1E,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ;CAC1E,CAAC,CAAC;AAEH,mFAAmF;AACnF,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;QACrB,OAAO,KAAK,GAAG,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAE,CAAC;YAAE,KAAK,EAAE,CAAC;QAC3D,OAAO,GAAG,GAAG,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAE,CAAC;YAAE,GAAG,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAClD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAC/B,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QAC1C,sGAAsG;QACtG,6EAA6E;QAC7E,8EAA8E;QAC9E,4EAA4E;QAC5E,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CAAC,wBAAiC;IACzE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QAC7B,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,cAAc,CAAU,EAAE,CAAC;YACnE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAAE,SAAS;YACzC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,KAAK,CAAc,EAAE,CAAC;gBAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ;oBAAE,SAAS;gBACxC,KAAK,MAAM,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,mBAAmB,KAAK,QAAQ,EAAE,CAAC;YAChD,KAAK,MAAM,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,mBAAmB,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kFAAkF;AAElF,sGAAsG;AACtG;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CACtC,WAAmB,EACnB,eAA4B;IAE5B,MAAM,MAAM,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,WAAW,EAAE,QAAQ;YACrB,eAAe,EAAE,OAAO;YACxB,aAAa,EAAE,yBAAyB;SACzC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,WAAW,EAAE,UAAU;QACvB,eAAe,EAAE,EAAE;QACnB,aAAa,EAAE,oBAAoB;KACpC,CAAC;AACJ,CAAC;AAED,kFAAkF;AAElF;;;;;;GAMG;AACH,MAAM,4BAA4B,GAChC,sPAAsP,CAAC;AAEzP;;;;;;;GAOG;AACH,MAAM,iBAAiB,GACrB,0HAA0H,CAAC;AAE7H;;;;;;;GAOG;AACH,SAAS,yBAAyB,CAAC,SAAiB;IAClD,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,GAAG,iBAAiB,CAAC,MAAM,aAAa,EAAE,IAAI,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,4BAA4B,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpE,IAAI,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,KAAK,IAAI,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAM,EAAE,CAAC;YAC3C,OAAO,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7C,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;IAC5B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,SAAS,oBAAoB,CAAC,SAAiB,EAAE,MAAc;IAC7D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC9D,+EAA+E;IAC/E,OAAO,IAAI,MAAM,CAAC,qBAAqB,OAAO,mBAAmB,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AAC1F,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,yBAAyB,CACvC,SAAiB,EACjB,OAA0B;IAE1B,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,yBAAyB,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,kFAAkF;AAElF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,0BAA0B,GACrC,uKAAuK,CAAC;AAE1K,iFAAiF;AACjF,MAAM,CAAC,MAAM,0BAA0B,GACrC,yJAAyJ,CAAC;AAK5J;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,SAAS,mBAAmB,CAAC,IAAY;IACvC,OAAO,CACL,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,IAAI,MAAM;QACpC,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,IAAI,MAAM;QACpC,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC,MAAM;KACnC,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,SAAS,qBAAqB,CAAC,IAAY;IACzC,OAAO,CACL,IAAI,KAAK,EAAE,IAAI,IAAI;QACnB,IAAI,KAAK,EAAE,IAAI,IAAI;QACnB,IAAI,KAAK,EAAE,IAAI,IAAI;QACnB,IAAI,KAAK,EAAE,IAAI,IAAI;QACnB,IAAI,KAAK,EAAE,CAAC,MAAM;KACnB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,qBAAqB,CAAC,SAAiB;IAC9C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAE,CAAC,CAAC;YAC5B,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,gBAAgB,GAAG,KAAK,CAAC;QAC7B,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,OAAO,MAAM,GAAG,MAAM,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,IAAI,YAAY;oBAAE,SAAS,GAAG,IAAI,CAAC;gBACnC,gBAAgB,GAAG,MAAM,CAAC;gBAC1B,MAAM,IAAI,CAAC,CAAC;gBACZ,SAAS;YACX,CAAC;YACD,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnC,YAAY,GAAG,IAAI,CAAC;gBACpB,MAAM,IAAI,CAAC,CAAC;gBACZ,SAAS;YACX,CAAC;YACD,MAAM;QACR,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACd,KAAK,GAAG,gBAAgB,GAAG,CAAC,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,2EAA2E;QAC3E,YAAY;QACZ,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QACzC,KAAK,GAAG,MAAM,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,MAAM,KAAK,GAAG,8BAA8B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7D,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;IACzE,CAAC;IACD,MAAM,KAAK,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,GAAG,IAAI,GAAG;QAAE,OAAO,MAAM,CAAC;IAC9B,IAAI,GAAG;QAAE,OAAO,UAAU,CAAC;IAC3B,IAAI,GAAG;QAAE,OAAO,UAAU,CAAC;IAC3B,OAAO,MAAM,CAAC;AAChB,CAAC;AAmBD;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,UAA6B,EAC7B,OAA0B;IAE1B,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,SAAS;QAC5C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,MAAM;YAAE,WAAW,GAAG,IAAI,CAAC;QACvE,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACnD,cAAc,GAAG,IAAI,CAAC;YACtB,IAAI,yBAAyB,CAAC,SAAS,EAAE,OAAO,CAAC;gBAAE,iBAAiB,GAAG,IAAI,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,OAAO;QACL,EAAE,EAAE,WAAW,IAAI,iBAAiB;QACpC,WAAW;QACX,WAAW,EAAE,iBAAiB;QAC9B,gBAAgB,EAAE,cAAc,IAAI,CAAC,iBAAiB;KACvD,CAAC;AACJ,CAAC;AAED,kFAAkF;AAElF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kCAAkC,CAChD,UAAmB;IAEnB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,+EAA+E;IAC/E,iFAAiF;IACjF,IAAI,CAAC,CAAC,uBAAuB,IAAI,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,MAAM,GAAG,GAAG,UAAU,CAAC,qBAAqB,CAAC;IAC7C,MAAM,gBAAgB,GAAG,CAAC,eAAyB,EAAkC,EAAE,CAAC,CAAC;QACvF,WAAW,EAAE,QAAQ;QACrB,eAAe;QACf,aAAa,EAAE,yBAAyB;KACzC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAChD,IAAI,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACnE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;YAChD,CAAC,CAAE,GAAG,CAAC,eAA6B,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACtF,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAChD,CAAC,CAAE,GAAG,CAAC,eAA6B,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACtF,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,YAAY,GAChB,GAAG,CAAC,aAAa,KAAK,yBAAyB;QAC/C,GAAG,CAAC,aAAa,KAAK,oBAAoB;QAC1C,GAAG,CAAC,aAAa,KAAK,eAAe;QACrC,GAAG,CAAC,aAAa,KAAK,cAAc;QAClC,CAAC,CAAC,GAAG,CAAC,aAAa;QACnB,CAAC,CAAC,yBAAyB,CAAC;IAChC,OAAO;QACL,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,eAAe,EAAE,OAAO;QACxB,aAAa,EAAE,YAAY;QAC3B,GAAG,CAAC,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,YAAoB,EACpB,WAAmB,EACnB,cAA0D;IAE1D,IAAI,cAAc,IAAI,cAAc,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChE,OAAO,cAAc,CAAC,eAAe,CAAC;IACxC,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACjE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,mBAAmB,CAAC,WAAW,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC"}

package/dist/remediate/contractPipeline/contractReviewBinding.d.ts

@@ -1,28 +0,0 @@
-import { type ReviewRequirement, type ReviewSubmissionFailureCode, type ContractReviewDeclaration } from "../../shared/types/reviewIndependence.js";
-import { type ContractPipelineArtifactName } from "./artifactStore.js";
-export declare function contractReviewBindingPath(artifactsDir: string, name: ContractPipelineArtifactName): string;
-/** Tool-owned expectation, separate from the worker's declared review envelope. */
-export declare function bindContractReviewPrompt(params: {
-    artifactsDir: string;
-    artifact: ContractPipelineArtifactName;
-    role: string;
-    emissionId: string;
-    requirement: ReviewRequirement;
-    prompt: string;
-}): Promise<string>;
-export declare function validateContractReviewInput(params: {
-    artifactsDir: string;
-    artifact: ContractPipelineArtifactName;
-    role: string;
-    requirement: ReviewRequirement;
-    raw: unknown;
-}): Promise<{
-    ok: true;
-    payload: unknown;
-    provenance?: ContractReviewDeclaration;
-} | {
-    ok: false;
-    issue: string;
-    code: ReviewSubmissionFailureCode | "dependency_stale";
-}>;
-//# sourceMappingURL=contractReviewBinding.d.ts.map

package/dist/remediate/contractPipeline/contractReviewBinding.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"contractReviewBinding.d.ts","sourceRoot":"","sources":["../../../src/remediate/contractPipeline/contractReviewBinding.ts"],"names":[],"mappings":"AAQA,OAAO,EAA0D,KAAK,iBAAiB,EAAE,KAAK,2BAA2B,EAAE,KAAK,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AAC5M,OAAO,EAA6D,KAAK,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAalI,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,GAAG,MAAM,CAE1G;AAOD,mFAAmF;AACnF,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,4BAA4B,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAC3E,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;CACpE,GAAG,OAAO,CAAC,MAAM,CAAC,CAyBlB;AAED,wBAAsB,2BAA2B,CAAC,MAAM,EAAE;IACxD,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,4BAA4B,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAC3E,WAAW,EAAE,iBAAiB,CAAC;IAAC,GAAG,EAAE,OAAO,CAAC;CAC9C,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,yBAAyB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,2BAA2B,GAAG,kBAAkB,CAAA;CAAE,CAAC,CAgBzK"}

package/dist/remediate/contractPipeline/contractReviewBinding.js

@@ -1,75 +0,0 @@
-// sites-pinned: tests/remediate/contract-review-independence.test.ts, tests/remediate/contract-pipeline-adversarial.test.ts
-import { join } from "node:path";
-import { z } from "zod";
-import { bindWorkerPrompt } from "../../shared/submission/workerPromptBinding.js";
-import { writeJsonFile } from "../../shared/io/json.js";
-import { readSubmissionDocument } from "../../shared/submission/submissionClassifier.js";
-import { hashContent } from "../../shared/hash.js";
-import { stableStringify } from "../../shared/stableStringify.js";
-import { ReviewRequirementSchema, parseReviewSubmissionEnvelope } from "../../shared/types/reviewIndependence.js";
-import { DEPENDENCY_MAP, contractPipelineDir, readContractArtifact } from "./artifactStore.js";
-const BindingSchema = z.object({
-    contract_version: z.literal("contract-review-binding/v1"),
-    artifact_name: z.string(),
-    role: z.string(),
-    emission_id: z.string(),
-    requirement: ReviewRequirementSchema,
-    prompt_sha256: z.string().regex(/^[0-9a-f]{64}$/u),
-    source_prompt_sha256: z.string().regex(/^[0-9a-f]{64}$/u),
-    dependency_hashes: z.record(z.string(), z.string().nullable()),
-}).strict();
-export function contractReviewBindingPath(artifactsDir, name) {
-    return join(contractPipelineDir(artifactsDir), `${name}.review-binding.json`);
-}
-async function dependencyHashes(artifactsDir, name) {
-    const pairs = await Promise.all(DEPENDENCY_MAP[name].map(async (dep) => [dep, (await readContractArtifact(artifactsDir, dep))?.content_hash ?? null]));
-    return Object.fromEntries(pairs);
-}
-/** Tool-owned expectation, separate from the worker's declared review envelope. */
-export async function bindContractReviewPrompt(params) {
-    if (params.requirement === "ordinary")
-        return params.prompt;
-    const dependencies = await dependencyHashes(params.artifactsDir, params.artifact);
-    const sourcePromptHash = hashContent(params.prompt);
-    const priorRead = await readSubmissionDocument(contractReviewBindingPath(params.artifactsDir, params.artifact));
-    const prior = BindingSchema.safeParse(priorRead.kind === "value" ? priorRead.value : undefined);
-    const sameTask = prior.success && prior.data.artifact_name === params.artifact && prior.data.role === params.role &&
-        prior.data.requirement === params.requirement && prior.data.source_prompt_sha256 === sourcePromptHash &&
-        stableStringify(prior.data.dependency_hashes) === stableStringify(dependencies);
-    const emissionId = sameTask ? prior.data.emission_id : params.emissionId;
-    const context = { artifact_name: params.artifact, role: params.role, emission_id: emissionId, requirement: params.requirement, dependency_hashes: dependencies };
-    const body = `${params.prompt}\n\n## Bound review submission\n\nThe domain schema above is the inner result. Submit the complete review envelope below to the named output path, not a raw artifact.\nReview context: ${stableStringify(context)}`;
-    const bound = bindWorkerPrompt(body, prompt_sha256 => [
-        "```json",
-        JSON.stringify({ contract_version: "review-submission/v1", prompt_sha256,
-            review: { mode: params.requirement === "degraded_allowed" ? "degraded" : "independent", reason: "<how the review context meets the required policy>" },
-            result: { "<artifact fields>": "<complete domain object using the schema above>" },
-        }, null, 2),
-        "```",
-        "If the required review context is unavailable, declare mode unavailable with the reason. Do not silently replace required independent review with self-review.",
-    ].join("\n"));
-    await writeJsonFile(contractReviewBindingPath(params.artifactsDir, params.artifact), {
-        contract_version: "contract-review-binding/v1", ...context, prompt_sha256: bound.sha256, source_prompt_sha256: sourcePromptHash,
-    });
-    return bound.text;
-}
-export async function validateContractReviewInput(params) {
-    if (params.requirement === "ordinary")
-        return { ok: true, payload: params.raw };
-    const read = await readSubmissionDocument(contractReviewBindingPath(params.artifactsDir, params.artifact));
-    const parsed = BindingSchema.safeParse(read.kind === "value" ? read.value : undefined);
-    if (!parsed.success || parsed.data.artifact_name !== params.artifact || parsed.data.role !== params.role || parsed.data.requirement !== params.requirement) {
-        return { ok: false, code: "binding_missing", issue: "This required review has no current tool-issued role/policy binding. Re-emit the role and use its bound review-submission/v1 envelope." };
-    }
-    const binding = parsed.data;
-    if (stableStringify(binding.dependency_hashes) !== stableStringify(await dependencyHashes(params.artifactsDir, params.artifact))) {
-        return { ok: false, code: "dependency_stale", issue: "The inputs reviewed by this submission have changed. Re-emit the review against the current dependency content before accepting it." };
-    }
-    const submission = parseReviewSubmissionEnvelope(params.raw, { requirement: params.requirement, promptSha256: binding.prompt_sha256 });
-    if (!submission.ok)
-        return submission;
-    return { ok: true, payload: submission.result, provenance: {
-            requirement: params.requirement, prompt_sha256: binding.prompt_sha256, review: submission.review,
-        } };
-}
-//# sourceMappingURL=contractReviewBinding.js.map

package/dist/remediate/contractPipeline/contractReviewBinding.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"contractReviewBinding.js","sourceRoot":"","sources":["../../../src/remediate/contractPipeline/contractReviewBinding.ts"],"names":[],"mappings":"AAAA,4HAA4H;AAC5H,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,6BAA6B,EAA4F,MAAM,0CAA0C,CAAC;AAC5M,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,oBAAoB,EAAqC,MAAM,oBAAoB,CAAC;AAElI,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC;IACzD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,uBAAuB;IACpC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC;IAClD,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC;IACzD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;CAC/D,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,UAAU,yBAAyB,CAAC,YAAoB,EAAE,IAAkC;IAChG,OAAO,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,EAAE,GAAG,IAAI,sBAAsB,CAAC,CAAC;AAChF,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,YAAoB,EAAE,IAAkC;IACtF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,EAAC,GAAG,EAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,oBAAoB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,EAAE,YAAY,IAAI,IAAI,CAAU,CAAC,CAAC,CAAC;IAC9J,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,MAG9C;IACC,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC;IAC5D,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClF,MAAM,gBAAgB,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,yBAAyB,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChH,MAAM,KAAK,GAAG,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChG,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,aAAa,KAAK,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;QAC/G,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,CAAC,oBAAoB,KAAK,gBAAgB;QACrG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,eAAe,CAAC,YAAY,CAAC,CAAC;IAClF,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;IACzE,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,iBAAiB,EAAE,YAAY,EAAE,CAAC;IACjK,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,MAAM,2LAA2L,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;IACnP,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC;QACpD,SAAS;QACT,IAAI,CAAC,SAAS,CAAC,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,aAAa;YACtE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,KAAK,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,oDAAoD,EAAE;YACtJ,MAAM,EAAE,EAAE,mBAAmB,EAAE,iDAAiD,EAAE;SACnF,EAAE,IAAI,EAAE,CAAC,CAAC;QACX,KAAK;QACL,gKAAgK;KACjK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACd,MAAM,aAAa,CAAC,yBAAyB,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;QACnF,gBAAgB,EAAE,4BAA4B,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,KAAK,CAAC,MAAM,EAAE,oBAAoB,EAAE,gBAAgB;KAChI,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,MAGjD;IACC,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;IAChF,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,yBAAyB,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3G,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACvF,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;QAC3J,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,wIAAwI,EAAE,CAAC;IACjM,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC;IAC5B,IAAI,eAAe,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,eAAe,CAAC,MAAM,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACjI,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,qIAAqI,EAAE,CAAC;IAC/L,CAAC;IACD,MAAM,UAAU,GAAG,6BAA6B,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACvI,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC;IACtC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE;YACzD,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,UAAU,CAAC,MAAO;SAClG,EAAE,CAAC;AACN,CAAC"}

package/dist/remediate/contractPipeline/counterexampleFingerprint.d.ts

@@ -1,27 +0,0 @@
-/**
- * Content fingerprint for a counterexample.
- *
- * The judge↔repair convergence gate ({@link evaluateJudgeGate} in
- * `../steps/contractPipeline.js`) must detect genuine re-occurrence of the
- * same unrepaired defect across independent adversarial rounds. The
- * reviewer-supplied counterexample `id` is free text (see
- * `Counterexample.id` in `audit-tools/shared`'s obligations types) and is NOT
- * a stable cross-round identity: two independent critic rounds each commonly
- * label their genuinely-distinct top counterexample "CE-001" (the prompt
- * schema's own example value). Keying convergence on the raw id string then
- * misreads "two different CEs that happen to share a label" as "the same CE
- * re-accepted after a repair" and falsely escalates a stall while a real new
- * defect is being correctly repaired.
- *
- * This fingerprint keys on CONTENT instead: the tool-constrained
- * `violated_obligation_ids` vocabulary (sorted, normalized) paired with the
- * normalized `claim` prose, falling back to the normalized claim alone when
- * no obligations are cited. Mirrors the derivation style of
- * `src/shared/findingIdentitySignature.ts` (tiered stable fields, aggressive
- * title normalization, truncated content hash) rather than introducing a
- * second identity convention.
- */
-import { type Counterexample } from "audit-tools/shared";
-/** Deterministic, content-derived identity for a counterexample. */
-export declare function counterexampleFingerprint(ce: Counterexample): string;
-//# sourceMappingURL=counterexampleFingerprint.d.ts.map

package/dist/remediate/contractPipeline/counterexampleFingerprint.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"counterexampleFingerprint.d.ts","sourceRoot":"","sources":["../../../src/remediate/contractPipeline/counterexampleFingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEtF,oEAAoE;AACpE,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,cAAc,GAAG,MAAM,CAWpE"}