audit-tools 0.52.5 → 0.54.0

package/dist/remediate/contractPipeline/artifactStore.d.ts

@@ -1,219 +0,0 @@
-import { type ContractReviewProvenance, type ContractReviewDeclaration } from "../../shared/types/reviewIndependence.js";
-import { CP_ARTIFACT_NAMES } from "./artifactNames.js";
-import type { ContractPipelineArtifactName } from "./artifactNames.js";
-export { CP_ARTIFACT_NAMES };
-export type { ContractPipelineArtifactName };
-export declare const DEPENDENCY_MAP: Record<ContractPipelineArtifactName, ContractPipelineArtifactName[]>;
-export interface ContractPipelineArtifactEnvelope {
-    artifact_name: ContractPipelineArtifactName;
-    review_provenance?: ContractReviewProvenance;
-    /**
-     * Identity of this exact emission: `hashContent(stableStringify(payload))`.
-     * KEY-ORDER INDEPENDENT — the same payload assembled in a different field
-     * order hashes identically (see `computeHash`).
-     *
-     * A stored header that disagrees with the payload it sits beside is CORRECTED
-     * IN MEMORY on read and NOT persisted: `readContractArtifact` recomputes,
-     * returns the recomputed value, and emits a
-     * `contract_artifact_content_hash_mismatch` warning naming both hashes. The
-     * file on disk keeps whatever it was written with, so this field is the
-     * identity of the payload AS READ, never a claim about the stored bytes.
-     */
-    content_hash: string;
-    /** Semantic-projection hashes of upstream dependency artifacts at write time. */
-    dependency_hashes: Partial<Record<ContractPipelineArtifactName, string>>;
-    payload: unknown;
-}
-/**
- * Canonical predicate for a stored content-hash envelope. Single-sourced here so
- * any consumer (the contract-pipeline ingest path, the `validate-artifact` CLI)
- * unwraps with identical structural rules and cannot drift. A plain payload that
- * happens to carry an `artifact_name` but no `content_hash` is NOT an envelope.
- *
- * The THREE-KEY test this used to be (`artifact_name` string, `content_hash`
- * string, `"payload" in value`) was a cast wearing a predicate's name: it admits
- * a bare payload that carries `await`-shaped fields, and — more to the point —
- * it does not check that `artifact_name` is one of the fifteen names the
- * dependency DAG and the semantic projection are keyed by. An envelope whose
- * `artifact_name` was misspelled passes `isEnvelope`, then reads a projection
- * table with an absent key. See {@link readContractArtifact}, which is where
- * that binding is now enforced.
- */
-export declare function isEnvelope(value: unknown): value is ContractPipelineArtifactEnvelope;
-/**
- * Stamp a tool-owned `created_at` onto a raw artifact payload when the host did
- * not provide one. The host has no clock — `created_at` is tool bookkeeping, not
- * a judgment field — so the tool stamps it at the point the payload enters the
- * tool (ingest + the `validate-artifact` self-check), and the host-facing
- * schemas no longer ask for it. A payload that already carries a string
- * `created_at` (e.g. a tool-derived artifact) is returned untouched. The stamp
- * is a universal non-semantic field (`semanticProjection` strips it), so adding
- * it never affects staleness. Non-object payloads pass through unchanged — their
- * own validator reports the shape error.
- */
-export declare function stampToolCreatedAt(payload: unknown, now: string): unknown;
-export declare function contractPipelineDir(artifactsDir: string): string;
-/**
- * Path to the optional Path-A seed file. Present only when the intake source
- * is a structured audit-findings report; absent for document/conversation runs.
- */
-export declare function pathASeedFilePath(artifactsDir: string): string;
-/**
- * Where a review artifact's diff-based re-review snapshot lives.
- *
- * Single-sourced here, beside the artifact path helpers, because the ARCHIVE
- * boundary has to reach it from a module that must not import the snapshot
- * module's own read/write surface. Kept as a filename rather than a computed
- * `join` in each caller so the two can never disagree about the directory.
- */
-export declare const REVIEW_SNAPSHOT_DIRNAME = "review-snapshots";
-export declare function reviewSnapshotDirPath(artifactsDir: string): string;
-export declare function reviewSnapshotFilePath(artifactsDir: string, name: ContractPipelineArtifactName): string;
-/**
- * Drop a review artifact's diff-based re-review snapshot.
- *
- * Called when the artifact's INPUT is destroyed — the ordinary re-emit after an
- * archive, and the promotion rejection that rolls a promoted plan back. The
- * snapshot holds the verdict a re-review would re-affirm, and its whole value
- * depends on being the LAST verdict for THAT input. Left in place across a
- * rewrite it becomes worse than absent: `captureReviewSnapshot` runs at INGEST,
- * which happens AFTER ingest's own staleness pass, so the archive pass inside
- * THIS invocation has already gone by — a snapshot surviving the intervening
- * call would be diffed against the NEW payload while claiming to be the prior
- * verdict, and the worker would be told to re-affirm a verdict about content it
- * never saw. With none present, `buildReReviewSection` renders no section and
- * the phase runs as an ordinary full review, which is correct.
- *
- * Deliberately NOT called for the `stale` archive: that path re-opens a
- * DOWNSTREAM artifact, which by construction has no snapshot of its own (its
- * producer never ran), so there is nothing there to drop and the call would be
- * noise in a hot loop.
- */
-export declare function dropReviewSnapshot(artifactsDir: string, name: ContractPipelineArtifactName): Promise<void>;
-/**
- * Canonical envelope path `<name>.json` — the TOOL-owned content-hash envelope.
- * Host code never reads or writes this; every tool-side consumer reaches it
- * through `readContractArtifact`.
- */
-export declare function contractArtifactFilePath(artifactsDir: string, name: ContractPipelineArtifactName): string;
-/**
- * Host input path `<name>.input.json` — the plain payload the host writes (and
- * reads for upstreams). The host never sees the tool's canonical envelope; the
- * tool reads this at ingest, validates, and derives the canonical `<name>.json`
- * envelope from it (D3). Keeping the two paths disjoint means the on-disk file
- * the host wrote is never mutated into an envelope in place.
- */
-export declare function contractInputFilePath(artifactsDir: string, name: ContractPipelineArtifactName): string;
-/**
- * Hash an artifact's semantic projection (order-independent, stamp-stripped).
- * Exported so the ingest idempotency guard can compare a freshly-read host input
- * against the canonical envelope without re-deriving a new (stamp-bearing)
- * content hash on every next-step.
- */
-export declare function payloadSemanticHash(name: ContractPipelineArtifactName, payload: unknown): string;
-/**
- * The semantic hash to compare a dependency against. ALWAYS recomputed from the
- * envelope's current `payload` — never read from a stored header field — so an
- * in-place edit to a payload (header untouched) reconverges staleness on the next
- * read. Cosmetic edits project to the same hash (see `semanticProjection`) and so
- * still do not re-stale downstreams (B3).
- */
-export declare function envelopeSemanticHash(envelope: ContractPipelineArtifactEnvelope): string;
-/** Write an artifact envelope. Creates parent directories as needed. */
-export declare function writeContractArtifact(artifactsDir: string, name: ContractPipelineArtifactName, payload: unknown, review?: ContractReviewDeclaration): Promise<ContractPipelineArtifactEnvelope>;
-/**
- * Write a TOOL-DERIVED artifact to BOTH path roles: the plain payload at the
- * host-input path `<name>.input.json` and the canonical envelope at
- * `<name>.json`.
- *
- * Why the input path too. Every host-facing artifact path the pipeline renders —
- * both where a role WRITES its output and where it READS its upstreams — is
- * `<name>.input.json` (D3: the host's world is entirely plain input files). An
- * artifact the TOOL derives (the obligation ledger, the finalized contracts, a
- * degenerate seam report, a no-cycles seam resolution, a merged shard aggregate)
- * used to land only in the canonical envelope, so any downstream prompt naming
- * it pointed a worker at a file that never existed. Materializing it here makes
- * that ENOENT class unrepresentable: the write map and the prompts' input map
- * are the same map.
- *
- * Deliberately NOT folded into `writeContractArtifact`: that one is also how
- * INGEST wraps a host-authored payload, and writing back there would mutate the
- * host's own input file in place — the exact separation D3 exists to keep. The
- * derived input file is idempotent for ingest: its semantic projection matches
- * the canonical envelope's, so the ingest idempotency guard skips it on every
- * later pass rather than re-deriving.
- */
-export declare function writeDerivedContractArtifact(artifactsDir: string, name: ContractPipelineArtifactName, payload: unknown): Promise<ContractPipelineArtifactEnvelope>;
-/**
- * Payload of a stored artifact whether or not it has been enveloped yet. A null
- * envelope (absent on disk) yields undefined; a bare payload that was written
- * without the envelope wrapper is returned as-is. Single-sourced here so every
- * consumer unwraps identically (cannot drift from `isEnvelope`).
- */
-export declare function envelopePayload(envelope: ContractPipelineArtifactEnvelope | null): unknown;
-/**
- * Read a stored artifact envelope, or null if absent.
- *
- * Three checks, all of them about IDENTITY — the file at `<name>.json` must BE
- * the artifact `<name>`, not merely a JSON document that was found there:
- *
- *  1. **Shape.** Parsed against {@link isEnvelope}, never cast. The previous
- *     body was `readOptionalJsonFile<ContractPipelineArtifactEnvelope>` — a
- *     generic TYPE PARAMETER, which is an assertion the compiler erases. A file
- *     containing `{"hello":1}` came back typed as an envelope, and every
- *     downstream `.artifact_name` / `.payload` read was an unchecked property
- *     access on `unknown`-shaped data.
- *  2. **Binding.** `artifact_name` must equal the name that was REQUESTED. The
- *     two are the same value by construction on the write path
- *     ({@link writeContractArtifact} passes one name to both), so a disagreement
- *     means the file was written by something else — a hand edit, a copy, a
- *     rename that missed the header. This is not cosmetic: `artifact_name` is
- *     the key into `DEPENDENCY_MAP` and `semanticProjection`, and a mismatched
- *     name silently reads another artifact's projection table. A mismatched
- *     envelope reads as ABSENT, so the caller's staleness DAG re-opens the
- *     producing phase rather than consuming bytes that cannot be trusted.
- *  3. **Content hash.** Recomputed from the payload and, when it disagrees with
- *     the recorded one, the envelope is returned with
- *     {@link ContractPipelineArtifactEnvelope.content_hash} rewritten to the
- *     RECOMPUTED value. The payload is authoritative — it is what every
- *     consumer reads and what `envelopeSemanticHash` projects — so a header
- *     that no longer describes its payload must not be allowed to keep
- *     speaking. Reading the payload but reporting the stale header's hash is
- *     exactly the failure `detectStaleArtifacts`'s recompute-on-read exists to
- *     prevent (see its note on in-place edits), and the hash is the identity
- *     the judge/critique repair ledger keys on (`judge_hash` /
- *     `critique_hash` in repairState.ts), so a drifted value would make
- *     "already repaired for this report" answer about the wrong report.
- *
- *     Deliberately NOT a null: treating a payload edit as an absent artifact
- *     would erase the distinction the caller needs (absent ⇒ re-emit the
- *     producer; edited ⇒ re-stale the downstreams), and it is a real thing
- *     hosts and tests do.
- *
- * A shape or binding refusal is silent-by-return (null), not a throw: every
- * caller already handles absent (that IS the fresh-run case), and throwing here
- * would turn one damaged file into a failed `next-step` rather than a re-emitted
- * phase.
- */
-export declare function readContractArtifact(artifactsDir: string, name: ContractPipelineArtifactName): Promise<ContractPipelineArtifactEnvelope | null>;
-export interface StalenessResult {
-    /** Names of artifacts that are stale (upstream changed) or missing (never written). */
-    stale: ContractPipelineArtifactName[];
-    /** Names of artifacts that are absent (file does not exist). */
-    absent: ContractPipelineArtifactName[];
-}
-/**
- * Detect stale artifacts by walking the dependency DAG transitively.
- * An artifact is stale when:
- * - A dependency artifact is absent/missing.
- * - A dependency artifact's current SEMANTIC-projection hash differs from what
- *   was recorded at write time in this artifact's envelope. Cosmetic upstream
- *   edits (reworded prose, regenerated timestamps, reordered keys) project to
- *   the same hash and do NOT mark downstreams stale (B3).
- *
- * Absent artifacts (never written) are reported under `absent`, not `stale`.
- */
-export declare function detectStaleArtifacts(artifactsDir: string): Promise<StalenessResult>;
-/** Returns true when the artifact file is present on disk. */
-export declare function contractArtifactExists(artifactsDir: string, name: ContractPipelineArtifactName): boolean;
-//# sourceMappingURL=artifactStore.d.ts.map

package/dist/remediate/contractPipeline/artifactStore.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"artifactStore.d.ts","sourceRoot":"","sources":["../../../src/remediate/contractPipeline/artifactStore.ts"],"names":[],"mappings":"AAEA,OAAO,EAAkC,KAAK,wBAAwB,EAAE,KAAK,yBAAyB,EAA2B,MAAM,0CAA0C,CAAC;AAyClL,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAC7B,YAAY,EAAE,4BAA4B,EAAE,CAAC;AAM7C,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,4BAA4B,EAAE,4BAA4B,EAAE,CAiC/F,CAAC;AAIF,MAAM,WAAW,gCAAgC;IAC/C,aAAa,EAAE,4BAA4B,CAAC;IAC5C,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;IAC7C;;;;;;;;;;;OAWG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,iBAAiB,EAAE,OAAO,CAAC,MAAM,CAAC,4BAA4B,EAAE,MAAM,CAAC,CAAC,CAAC;IACzE,OAAO,EAAE,OAAO,CAAC;CAClB;AA+CD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,gCAAgC,CAU3C;AAKD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAMzE;AAED,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,qBAAqB,CAAC;AAE1D,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,4BAA4B,GACjC,MAAM,CAER;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,4BAA4B,GACjC,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,4BAA4B,GACjC,MAAM,CAER;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,4BAA4B,GACjC,MAAM,CAER;AAqBD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,4BAA4B,EAClC,OAAO,EAAE,OAAO,GACf,MAAM,CAKR;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,gCAAgC,GACzC,MAAM,CAER;AAID,wEAAwE;AACxE,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,4BAA4B,EAClC,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,yBAAyB,GACjC,OAAO,CAAC,gCAAgC,CAAC,CAwB3C;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,4BAA4B,CAChD,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,4BAA4B,EAClC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,gCAAgC,CAAC,CAI3C;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,gCAAgC,GAAG,IAAI,GAChD,OAAO,CAGT;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,4BAA4B,GACjC,OAAO,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAqBlD;AAED,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,KAAK,EAAE,4BAA4B,EAAE,CAAC;IACtC,gEAAgE;IAChE,MAAM,EAAE,4BAA4B,EAAE,CAAC;CACxC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,eAAe,CAAC,CA6C1B;AAED,8DAA8D;AAC9D,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,4BAA4B,GACjC,OAAO,CAET"}

package/dist/remediate/contractPipeline/artifactStore.js

@@ -1,436 +0,0 @@
-// sites-pinned: tests/remediate/contract-pipeline-artifact-store.test.ts, tests/remediate/contract-review-independence.test.ts, tests/remediate/contract-pipeline.test.ts, tests/remediate/contract-pipeline-adversarial.test.ts
-import { propagateReachability } from "../../shared/graph/orderedReachability.js";
-import { ContractReviewProvenanceSchema, reviewIndependenceIssue } from "../../shared/types/reviewIndependence.js";
-/**
- * Typed read/write helpers for the contract-pipeline artifacts.
- *
- * Two distinct, non-overlapping path roles live under
- * `<artifactsDir>/intake/contract/` (D3):
- *
- * - **Host input** `<name>.input.json` — the authored submission. Ordinary roles
- *   write a raw payload; review roles write the bound review-submission envelope.
- * - **Canonical envelope** `<name>.json` — tool-owned validated domain payload,
- *   dependency hashes and accepted review provenance. Downstream roles read its
- *   `payload` field and never write this file.
- *
- * No host input is rewritten in place. Collapsed ordinary authoring sections
- * may read earlier raw inputs in the same round trip before ingestion; this
- * exception never admits an unvalidated review envelope as canonical data.
- *
- * Independence from StateStore is intentional: these helpers operate on the
- * contract-pipeline subdirectory only and do not touch the remediation
- * state machine.
- */
-import { existsSync } from "node:fs";
-import { mkdir, rm } from "node:fs/promises";
-import { join } from "node:path";
-import { hashContent, isRecord, readOptionalJsonFile, stableStringify, writeJsonFile, } from "audit-tools/shared";
-import { semanticProjection, stableStringifyProjection, } from "./semanticProjection.js";
-// ── Artifact names ────────────────────────────────────────────────────────────
-// Defined in ./artifactNames.js (below both this module and semanticProjection,
-// which needs the name type — declaring it here closed a type-only cycle).
-// Re-exported so existing importers are unchanged.
-import { CP_ARTIFACT_NAMES } from "./artifactNames.js";
-export { CP_ARTIFACT_NAMES };
-// ── Dependency DAG ────────────────────────────────────────────────────────────
-// An artifact is stale when any dependency it lists is missing or has a
-// different content hash than recorded at write time.
-export const DEPENDENCY_MAP = {
-    goal_spec: [],
-    context_bundle: ["goal_spec"],
-    module_decomposition: ["goal_spec", "context_bundle"],
-    module_contracts: ["goal_spec", "context_bundle", "module_decomposition"],
-    seam_reconciliation_report: ["module_decomposition", "module_contracts"],
-    finalized_module_contracts: ["module_contracts", "seam_reconciliation_report"],
-    conceptual_design_critique: ["goal_spec", "module_decomposition", "finalized_module_contracts"],
-    obligation_ledger: ["goal_spec", "finalized_module_contracts"],
-    cyclic_seam_resolution: ["obligation_ledger"],
-    test_validator_plan: ["goal_spec", "obligation_ledger"],
-    contract_assessment_report: ["goal_spec", "finalized_module_contracts", "obligation_ledger", "cyclic_seam_resolution", "test_validator_plan"],
-    counterexample: ["goal_spec", "finalized_module_contracts", "obligation_ledger", "cyclic_seam_resolution", "test_validator_plan", "contract_assessment_report"],
-    judge_report: ["goal_spec", "module_decomposition", "finalized_module_contracts", "obligation_ledger", "cyclic_seam_resolution", "test_validator_plan", "contract_assessment_report", "counterexample"],
-    implementation_dag: [
-        "goal_spec",
-        "context_bundle",
-        "finalized_module_contracts",
-        "obligation_ledger",
-        "cyclic_seam_resolution",
-        "test_validator_plan",
-        "contract_assessment_report",
-        "counterexample",
-        "judge_report",
-    ],
-    verification_report: [
-        "goal_spec",
-        "context_bundle",
-        "finalized_module_contracts",
-        "obligation_ledger",
-        "contract_assessment_report",
-        "implementation_dag",
-    ],
-};
-/**
- * Surface a `content_hash` header that no longer describes its payload.
- *
- * The correction itself is silent-by-design (the payload is authoritative and
- * the read still returns), but a disagreement between a stored header and the
- * bytes beside it is a FACT someone needs: it means the envelope was edited in
- * place, copied, or written by an older hash definition, and the recorded value
- * is the identity the judge/critique repair ledger keys on. A silent in-memory
- * rewrite turns that into a run that behaves correctly and explains nothing.
- *
- * Same shape as the repository's other structured warnings
- * (`file_integrity_io_error` in `utils/fileIntegrity.ts`,
- * `truncated_verification_file_list` in the audit side): one `level: "warn"`
- * JSON object per line on stderr, so a log reader that already parses these
- * needs no new case.
- */
-function reportContentHashMismatch(name, stored, recomputed) {
-    process.stderr.write(JSON.stringify({
-        level: "warn",
-        event: "contract_artifact_content_hash_mismatch",
-        artifact_name: name,
-        stored_content_hash: stored,
-        recomputed_content_hash: recomputed,
-        ts: new Date().toISOString(),
-    }) + "\n");
-}
-/** One dependency hash entry: a contract-pipeline artifact name → sha. */
-function isDependencyHashes(value) {
-    return (isRecord(value) &&
-        Object.entries(value).every(([key, hash]) => CP_ARTIFACT_NAMES.includes(key) &&
-            typeof hash === "string"));
-}
-/**
- * Canonical predicate for a stored content-hash envelope. Single-sourced here so
- * any consumer (the contract-pipeline ingest path, the `validate-artifact` CLI)
- * unwraps with identical structural rules and cannot drift. A plain payload that
- * happens to carry an `artifact_name` but no `content_hash` is NOT an envelope.
- *
- * The THREE-KEY test this used to be (`artifact_name` string, `content_hash`
- * string, `"payload" in value`) was a cast wearing a predicate's name: it admits
- * a bare payload that carries `await`-shaped fields, and — more to the point —
- * it does not check that `artifact_name` is one of the fifteen names the
- * dependency DAG and the semantic projection are keyed by. An envelope whose
- * `artifact_name` was misspelled passes `isEnvelope`, then reads a projection
- * table with an absent key. See {@link readContractArtifact}, which is where
- * that binding is now enforced.
- */
-export function isEnvelope(value) {
-    return (isRecord(value) &&
-        CP_ARTIFACT_NAMES.includes(value.artifact_name) &&
-        typeof value.content_hash === "string" &&
-        value.content_hash.length > 0 &&
-        "payload" in value &&
-        isDependencyHashes(value.dependency_hashes) &&
-        (value.review_provenance === undefined || ContractReviewProvenanceSchema.safeParse(value.review_provenance).success));
-}
-// ── Helpers ───────────────────────────────────────────────────────────────────
-/**
- * Stamp a tool-owned `created_at` onto a raw artifact payload when the host did
- * not provide one. The host has no clock — `created_at` is tool bookkeeping, not
- * a judgment field — so the tool stamps it at the point the payload enters the
- * tool (ingest + the `validate-artifact` self-check), and the host-facing
- * schemas no longer ask for it. A payload that already carries a string
- * `created_at` (e.g. a tool-derived artifact) is returned untouched. The stamp
- * is a universal non-semantic field (`semanticProjection` strips it), so adding
- * it never affects staleness. Non-object payloads pass through unchanged — their
- * own validator reports the shape error.
- */
-export function stampToolCreatedAt(payload, now) {
-    if (!isRecord(payload))
-        return payload;
-    if (typeof payload.created_at === "string" && payload.created_at.length > 0) {
-        return payload;
-    }
-    return { ...payload, created_at: now };
-}
-export function contractPipelineDir(artifactsDir) {
-    return join(artifactsDir, "intake", "contract");
-}
-/**
- * Path to the optional Path-A seed file. Present only when the intake source
- * is a structured audit-findings report; absent for document/conversation runs.
- */
-export function pathASeedFilePath(artifactsDir) {
-    return join(contractPipelineDir(artifactsDir), "path_a_seed.json");
-}
-/**
- * Where a review artifact's diff-based re-review snapshot lives.
- *
- * Single-sourced here, beside the artifact path helpers, because the ARCHIVE
- * boundary has to reach it from a module that must not import the snapshot
- * module's own read/write surface. Kept as a filename rather than a computed
- * `join` in each caller so the two can never disagree about the directory.
- */
-export const REVIEW_SNAPSHOT_DIRNAME = "review-snapshots";
-export function reviewSnapshotDirPath(artifactsDir) {
-    return join(contractPipelineDir(artifactsDir), REVIEW_SNAPSHOT_DIRNAME);
-}
-export function reviewSnapshotFilePath(artifactsDir, name) {
-    return join(reviewSnapshotDirPath(artifactsDir), `${name}.json`);
-}
-/**
- * Drop a review artifact's diff-based re-review snapshot.
- *
- * Called when the artifact's INPUT is destroyed — the ordinary re-emit after an
- * archive, and the promotion rejection that rolls a promoted plan back. The
- * snapshot holds the verdict a re-review would re-affirm, and its whole value
- * depends on being the LAST verdict for THAT input. Left in place across a
- * rewrite it becomes worse than absent: `captureReviewSnapshot` runs at INGEST,
- * which happens AFTER ingest's own staleness pass, so the archive pass inside
- * THIS invocation has already gone by — a snapshot surviving the intervening
- * call would be diffed against the NEW payload while claiming to be the prior
- * verdict, and the worker would be told to re-affirm a verdict about content it
- * never saw. With none present, `buildReReviewSection` renders no section and
- * the phase runs as an ordinary full review, which is correct.
- *
- * Deliberately NOT called for the `stale` archive: that path re-opens a
- * DOWNSTREAM artifact, which by construction has no snapshot of its own (its
- * producer never ran), so there is nothing there to drop and the call would be
- * noise in a hot loop.
- */
-export async function dropReviewSnapshot(artifactsDir, name) {
-    await rm(reviewSnapshotFilePath(artifactsDir, name), { force: true });
-}
-/**
- * Canonical envelope path `<name>.json` — the TOOL-owned content-hash envelope.
- * Host code never reads or writes this; every tool-side consumer reaches it
- * through `readContractArtifact`.
- */
-export function contractArtifactFilePath(artifactsDir, name) {
-    return join(contractPipelineDir(artifactsDir), `${name}.json`);
-}
-/**
- * Host input path `<name>.input.json` — the plain payload the host writes (and
- * reads for upstreams). The host never sees the tool's canonical envelope; the
- * tool reads this at ingest, validates, and derives the canonical `<name>.json`
- * envelope from it (D3). Keeping the two paths disjoint means the on-disk file
- * the host wrote is never mutated into an envelope in place.
- */
-export function contractInputFilePath(artifactsDir, name) {
-    return join(contractPipelineDir(artifactsDir), `${name}.input.json`);
-}
-/**
- * The content hash of a payload — the artifact's IDENTITY, and the value the
- * judge/critique repair ledger keys on.
- *
- * `stableStringify`, not `JSON.stringify`. The hash must depend on the payload's
- * CONTENT and on nothing else, and raw `JSON.stringify` makes it depend on KEY
- * INSERTION ORDER as well: the same contract assembled in a different field
- * order hashes differently. That was latent while the only reader of the header
- * was the writer's own round trip, but the moment a read RECOMPUTES and compares
- * (see {@link readContractArtifact}) it becomes a false tamper report on a file
- * nobody touched. The single deterministic serializer is the shared one
- * (INV-CK-2: "there must be exactly ONE such serializer — never write a second"),
- * so write and read agree by construction rather than by both happening to call
- * the same expression.
- */
-function computeHash(value) {
-    return hashContent(stableStringify(value), { length: 32 });
-}
-/**
- * Hash an artifact's semantic projection (order-independent, stamp-stripped).
- * Exported so the ingest idempotency guard can compare a freshly-read host input
- * against the canonical envelope without re-deriving a new (stamp-bearing)
- * content hash on every next-step.
- */
-export function payloadSemanticHash(name, payload) {
-    return hashContent(stableStringifyProjection(semanticProjection(name, payload)), { length: 32 });
-}
-/**
- * The semantic hash to compare a dependency against. ALWAYS recomputed from the
- * envelope's current `payload` — never read from a stored header field — so an
- * in-place edit to a payload (header untouched) reconverges staleness on the next
- * read. Cosmetic edits project to the same hash (see `semanticProjection`) and so
- * still do not re-stale downstreams (B3).
- */
-export function envelopeSemanticHash(envelope) {
-    return payloadSemanticHash(envelope.artifact_name, envelope.payload);
-}
-// ── Public API ────────────────────────────────────────────────────────────────
-/** Write an artifact envelope. Creates parent directories as needed. */
-export async function writeContractArtifact(artifactsDir, name, payload, review) {
-    await mkdir(contractPipelineDir(artifactsDir), { recursive: true });
-    const content_hash = computeHash(payload);
-    // Capture each dependency's SEMANTIC-projection hash at write time, so a later
-    // cosmetic edit to that dependency (same projection) does not re-stale this
-    // artifact — only a load-bearing change does (B3).
-    const dependency_hashes = {};
-    for (const dep of DEPENDENCY_MAP[name]) {
-        const depEnvelope = await readContractArtifact(artifactsDir, dep);
-        if (depEnvelope) {
-            dependency_hashes[dep] = envelopeSemanticHash(depEnvelope);
-        }
-    }
-    const envelope = {
-        artifact_name: name,
-        content_hash,
-        dependency_hashes,
-        payload,
-        ...(review ? { review_provenance: { ...review, reviewed_content_hash: content_hash } } : {}),
-    };
-    await writeJsonFile(contractArtifactFilePath(artifactsDir, name), envelope);
-    return envelope;
-}
-/**
- * Write a TOOL-DERIVED artifact to BOTH path roles: the plain payload at the
- * host-input path `<name>.input.json` and the canonical envelope at
- * `<name>.json`.
- *
- * Why the input path too. Every host-facing artifact path the pipeline renders —
- * both where a role WRITES its output and where it READS its upstreams — is
- * `<name>.input.json` (D3: the host's world is entirely plain input files). An
- * artifact the TOOL derives (the obligation ledger, the finalized contracts, a
- * degenerate seam report, a no-cycles seam resolution, a merged shard aggregate)
- * used to land only in the canonical envelope, so any downstream prompt naming
- * it pointed a worker at a file that never existed. Materializing it here makes
- * that ENOENT class unrepresentable: the write map and the prompts' input map
- * are the same map.
- *
- * Deliberately NOT folded into `writeContractArtifact`: that one is also how
- * INGEST wraps a host-authored payload, and writing back there would mutate the
- * host's own input file in place — the exact separation D3 exists to keep. The
- * derived input file is idempotent for ingest: its semantic projection matches
- * the canonical envelope's, so the ingest idempotency guard skips it on every
- * later pass rather than re-deriving.
- */
-export async function writeDerivedContractArtifact(artifactsDir, name, payload) {
-    await mkdir(contractPipelineDir(artifactsDir), { recursive: true });
-    await writeJsonFile(contractInputFilePath(artifactsDir, name), payload);
-    return writeContractArtifact(artifactsDir, name, payload);
-}
-/**
- * Payload of a stored artifact whether or not it has been enveloped yet. A null
- * envelope (absent on disk) yields undefined; a bare payload that was written
- * without the envelope wrapper is returned as-is. Single-sourced here so every
- * consumer unwraps identically (cannot drift from `isEnvelope`).
- */
-export function envelopePayload(envelope) {
-    if (!envelope)
-        return undefined;
-    return isEnvelope(envelope) ? envelope.payload : envelope;
-}
-/**
- * Read a stored artifact envelope, or null if absent.
- *
- * Three checks, all of them about IDENTITY — the file at `<name>.json` must BE
- * the artifact `<name>`, not merely a JSON document that was found there:
- *
- *  1. **Shape.** Parsed against {@link isEnvelope}, never cast. The previous
- *     body was `readOptionalJsonFile<ContractPipelineArtifactEnvelope>` — a
- *     generic TYPE PARAMETER, which is an assertion the compiler erases. A file
- *     containing `{"hello":1}` came back typed as an envelope, and every
- *     downstream `.artifact_name` / `.payload` read was an unchecked property
- *     access on `unknown`-shaped data.
- *  2. **Binding.** `artifact_name` must equal the name that was REQUESTED. The
- *     two are the same value by construction on the write path
- *     ({@link writeContractArtifact} passes one name to both), so a disagreement
- *     means the file was written by something else — a hand edit, a copy, a
- *     rename that missed the header. This is not cosmetic: `artifact_name` is
- *     the key into `DEPENDENCY_MAP` and `semanticProjection`, and a mismatched
- *     name silently reads another artifact's projection table. A mismatched
- *     envelope reads as ABSENT, so the caller's staleness DAG re-opens the
- *     producing phase rather than consuming bytes that cannot be trusted.
- *  3. **Content hash.** Recomputed from the payload and, when it disagrees with
- *     the recorded one, the envelope is returned with
- *     {@link ContractPipelineArtifactEnvelope.content_hash} rewritten to the
- *     RECOMPUTED value. The payload is authoritative — it is what every
- *     consumer reads and what `envelopeSemanticHash` projects — so a header
- *     that no longer describes its payload must not be allowed to keep
- *     speaking. Reading the payload but reporting the stale header's hash is
- *     exactly the failure `detectStaleArtifacts`'s recompute-on-read exists to
- *     prevent (see its note on in-place edits), and the hash is the identity
- *     the judge/critique repair ledger keys on (`judge_hash` /
- *     `critique_hash` in repairState.ts), so a drifted value would make
- *     "already repaired for this report" answer about the wrong report.
- *
- *     Deliberately NOT a null: treating a payload edit as an absent artifact
- *     would erase the distinction the caller needs (absent ⇒ re-emit the
- *     producer; edited ⇒ re-stale the downstreams), and it is a real thing
- *     hosts and tests do.
- *
- * A shape or binding refusal is silent-by-return (null), not a throw: every
- * caller already handles absent (that IS the fresh-run case), and throwing here
- * would turn one damaged file into a failed `next-step` rather than a re-emitted
- * phase.
- */
-export async function readContractArtifact(artifactsDir, name) {
-    const raw = await readOptionalJsonFile(contractArtifactFilePath(artifactsDir, name));
-    if (raw === undefined || raw === null)
-        return null;
-    if (!isEnvelope(raw))
-        return null;
-    if (raw.artifact_name !== name)
-        return null;
-    // Recompute through the SAME `computeHash` the writer used — one serializer
-    // for both directions (`stableStringify`, key-order independent), so a
-    // round-trip through disk always agrees and only a real payload edit fails.
-    // Re-deriving the expression here instead of calling the writer's would be a
-    // second copy of the hash definition, which is how a write and a read come to
-    // disagree about what "the same payload" means.
-    const actualHash = computeHash(raw.payload);
-    if (raw.review_provenance && (raw.review_provenance.reviewed_content_hash !== actualHash ||
-        reviewIndependenceIssue(raw.review_provenance.requirement, raw.review_provenance.review) !== null))
-        return null;
-    if (actualHash !== raw.content_hash) {
-        reportContentHashMismatch(name, raw.content_hash, actualHash);
-        return { ...raw, content_hash: actualHash };
-    }
-    return raw;
-}
-/**
- * Detect stale artifacts by walking the dependency DAG transitively.
- * An artifact is stale when:
- * - A dependency artifact is absent/missing.
- * - A dependency artifact's current SEMANTIC-projection hash differs from what
- *   was recorded at write time in this artifact's envelope. Cosmetic upstream
- *   edits (reworded prose, regenerated timestamps, reordered keys) project to
- *   the same hash and do NOT mark downstreams stale (B3).
- *
- * Absent artifacts (never written) are reported under `absent`, not `stale`.
- */
-export async function detectStaleArtifacts(artifactsDir) {
-    const stale = new Set();
-    const absent = new Set();
-    // Read all present envelopes up front to avoid repeated disk reads.
-    const envelopes = new Map();
-    for (const name of CP_ARTIFACT_NAMES) {
-        envelopes.set(name, await readContractArtifact(artifactsDir, name));
-    }
-    for (const name of CP_ARTIFACT_NAMES) {
-        const envelope = envelopes.get(name);
-        if (!envelope) {
-            absent.add(name);
-            continue;
-        }
-        // Check each immediate dependency.
-        for (const dep of DEPENDENCY_MAP[name]) {
-            const depEnvelope = envelopes.get(dep);
-            if (!depEnvelope) {
-                // Dependency is absent — downstream is stale.
-                stale.add(name);
-                break;
-            }
-            const recordedHash = (envelope.dependency_hashes ?? {})[dep];
-            if (recordedHash !== envelopeSemanticHash(depEnvelope)) {
-                stale.add(name);
-                break;
-            }
-        }
-    }
-    // Absence participates in reachability, but remains separate in the result.
-    // Preserve the old name-outer/dependency-inner edge order and Set insertion order.
-    const reached = new Set([...stale, ...absent]);
-    const edges = CP_ARTIFACT_NAMES.flatMap((name) => DEPENDENCY_MAP[name].map((dep) => [dep, name]));
-    propagateReachability(reached, edges, () => true);
-    return {
-        stale: [...reached].filter((name) => !absent.has(name)),
-        absent: [...absent],
-    };
-}
-/** Returns true when the artifact file is present on disk. */
-export function contractArtifactExists(artifactsDir, name) {
-    return existsSync(contractArtifactFilePath(artifactsDir, name));
-}
-//# sourceMappingURL=artifactStore.js.map