audit-tools 0.52.5 → 0.54.0

package/dist/remediate/contractPipeline/derive.d.ts

@@ -1,173 +0,0 @@
-/**
- * Deterministic derivers for contract-pipeline artifacts.
- *
- * S1 of the contract-authoring determinism design
- * (`spec/contract-authoring-determinism-design.md`): the contract pipeline
- * historically had the LLM author every structured artifact and the backend
- * only validate it afterward. For the artifacts whose *structure* is a pure
- * function of an upstream artifact, that is wasted generation and a weak-model
- * failure surface ("emit a large, schema-conforming, internally-consistent JSON
- * artifact from scratch with correct ids and cross-refs"). This module owns
- * those derivations so the tool produces the structure and the model is left
- * only the irreducible judgment.
- *
- * `deriveObligationLedger` is the flagship: the obligation ledger is a 1:1
- * restructuring of the finalized module contracts — every module invariant and
- * failure mode becomes an obligation, and every module gets a
- * contract-conformance obligation — so no judgment is lost by generating it in
- * code. Construction goes through the shared `buildObligationLedger` so the
- * cycle check, version stamp, and envelope stay single-sourced with the rest of
- * the codebase (the non-negotiable "derivers and validators share one source —
- * no parallel logic").
- */
-import { type ObligationLedger } from "audit-tools/shared";
-import { isTestablePhaseObligation } from "../validation/contractPipelineGates.js";
-/** Options accepted by the derivers (created_at injected for deterministic tests). */
-export interface DeriveOptions {
-    /** Overrides the generated ISO-8601 timestamp (for deterministic snapshots). */
-    created_at?: string;
-}
-/**
- * Derive the obligation ledger deterministically from the finalized module
- * contracts. Pure function of its input (modulo the `created_at` stamp): the
- * same contracts always yield the same obligations in the same order, so the
- * artifact hash / staleness DAG stays well-behaved.
- *
- * Mapping (the inverse of the obligation-ledger consumers' expectations):
- *  - one **structural** obligation per module ("implement this module per its
- *    finalized contract") — guarantees the ledger is never empty and every
- *    module has something the implementation DAG must cover, without inventing
- *    a paired-test burden (structural is not a testable kind);
- *  - one **invariant** obligation per declared module invariant (testable);
- *  - one **behavioral** obligation per declared module failure mode (testable).
- *
- * `depends_on` is left empty: the validated module-contract shape declares no
- * inter-obligation ordering, so an honest derivation asserts none (and the
- * ledger is acyclic by construction — `buildObligationLedger` cannot throw).
- */
-export declare function deriveObligationLedger(finalizedModuleContracts: unknown, options?: DeriveOptions): ObligationLedger;
-export declare function deriveFinalizedModuleContracts(draftedModuleContracts: unknown, seamReconciliationReport: unknown, options?: DeriveOptions): {
-    contract_version: string;
-    goal_id: string;
-    module_contracts: unknown[];
-    created_at: string;
-};
-/**
- * Shared obligation-membership predicates — the single source for which
- * obligations each downstream scaffold covers.
- *
- * `isTestablePhaseObligation` (imported above) is now single-sourced in
- * `../validation/contractPipelineGates.ts` (MNT-e10b9d9b: this file's former
- * local TESTABLE_KINDS set and that file's TESTABLE_OBLIGATION_KINDS were
- * "kept in parity by hand" and had already diverged — fail-open here,
- * fail-closed there, on an identical unrecognized-kind input). Re-exported
- * here so every existing importer of derive.js keeps working unchanged.
- *
- * `isDagPhaseObligation`: every obligation is covered by the implementation DAG,
- * so this is always true. It exists so both scaffolds derive their membership
- * from a named predicate rather than an inline ad-hoc filter.
- */
-export { isTestablePhaseObligation };
-export declare function isDagPhaseObligation(_kind: string): boolean;
-export interface TestValidatorPlanScaffold {
-    test_specs: Array<{
-        obligation_id: string;
-        name: string;
-        kind: string;
-        /**
-         * The change's scope anchors (touched symbols / file) the negative assertion
-         * must name to pass the CE-006 negative-scoping gate. Derived here so the
-         * host sees them IN the skeleton instead of discovering them only after a
-         * write is rejected (D1). Advisory context — the host reads them, the gate
-         * enforces them; an empty array means no change-scope constraint applies.
-         */
-        scope_anchors: string[];
-        assertions: string[];
-    }>;
-}
-/**
- * A prior round's authored test spec, keyed by obligation_id, used to diff-carry
- * unchanged assertions across a re-emit (C3). Carries the identity signals
- * (`name` + `scope_anchors`) the carry decision is gated on plus the assertions.
- */
-export interface PriorTestSpec {
-    name: string;
-    scope_anchors: string[];
-    assertions: string[];
-}
-/**
- * Build the test-plan skeleton: one spec per *testable* (invariant/behavioral)
- * obligation, with `obligation_id`/`name`/`kind`/`scope_anchors` filled and
- * `assertions` left blank for the model. The model fills only the assertions
- * (each spec needs a paired positive + negative assertion per the OBL-CO-01
- * gate, and the negative must name one of `scope_anchors` per CE-006).
- *
- * C3 diff-carry: when `priorByObligation` carries a prior round's authored spec
- * for an obligation whose premise is UNCHANGED (same `name` + same
- * `scope_anchors`), its assertions are pre-filled instead of left blank, so an
- * unchanged obligation is not re-authored from scratch every repair round. A
- * changed premise (renamed/re-scoped obligation) carries nothing — the host
- * re-authors it (fail-safe toward re-author, never toward stale carry).
- */
-export declare function buildTestValidatorPlanScaffold(ledger: ObligationLedger | undefined, priorByObligation?: Record<string, PriorTestSpec>): TestValidatorPlanScaffold;
-export interface ImplementationDagScaffoldNode {
-    id: string;
-    title: string;
-    description: string;
-    satisfies_obligations: string[];
-    addresses_counterexamples: string[];
-    /**
-     * Advisory conceptual-critique item ids this node addresses (B3). The
-     * conceptual-design critique's `advisory`-severity items have no obligation or
-     * counterexample to attach to, so without a structural slot the host smuggles
-     * them into prose or test assertions. This carrier gives each one a first-class
-     * home: the host records which advisory items a node's implementation honours.
-     * Blank in the skeleton (the host fills it); advisory, so it is not gated.
-     */
-    addressed_critique_items: string[];
-    depends_on: string[];
-    verification_obligation_ids: string[];
-    targeted_commands: string[];
-    status: string;
-}
-/** An advisory conceptual-critique item the host should account for in the DAG. */
-export interface AdvisoryCritiqueItem {
-    id: string;
-    description: string;
-}
-/**
- * Advisory-severity items from a conceptual_design_critique payload (defensive
- * read). Blocking items drive the design-repair loop and are consumed there;
- * advisory items survive past the critique gate and need a structural home in
- * the implementation DAG — this surfaces them so the skeleton can list them (B3).
- */
-export declare function advisoryCritiqueItems(critique: unknown): AdvisoryCritiqueItem[];
-export interface ImplementationDagScaffold {
-    nodes: ImplementationDagScaffoldNode[];
-    edges: never[];
-}
-/** Accepted counterexample ids from a judge_report payload (defensive read). */
-export declare function acceptedCounterexampleIds(judgeReport: unknown): string[];
-/**
- * Build the implementation-DAG skeleton: ONE node per finalized *module*
- * (grouping all that module's obligations), blank title/description/
- * targeted_commands for the model, and accepted counterexamples attached so
- * coverage holds by construction. Grouping by module means a 1-module change
- * derives 1 node instead of N obligation-nodes the host then has to merge (B2);
- * obligations with no module home (counterexample/critique-sourced) fall back
- * to one node each. Advisory: the model fills the blanks and may further
- * merge/split nodes as long as coverage is preserved.
- *
- * `depends_on` is DERIVED, not left for the host: when `finalizedContracts` is
- * supplied, each module node depends on the nodes of the modules it needs first
- * (producer/consumer `artifact:<name>` matching over `inputs`/`outputs` — the
- * same module-dependency DAG `phase_cut` uses). This
- * makes cross-node ordering tool-enforced instead of a thing the host must
- * remember to hand-add. Edges are oriented by phase ordinal so the result is
- * acyclic by construction: only an edge to a strictly-earlier-phase module is
- * kept, which drops the back-edge of any dependency cycle (fail-toward-later,
- * mirroring `derivePhaseCut`). The `edges` array stays empty — node `depends_on`
- * is the ordering the block promotion reads.
- */
-export declare function buildImplementationDagScaffold(ledger: ObligationLedger | undefined, acceptedCeIds: string[], finalizedContracts?: unknown): ImplementationDagScaffold;
-//# sourceMappingURL=derive.d.ts.map

package/dist/remediate/contractPipeline/derive.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"derive.d.ts","sourceRoot":"","sources":["../../../src/remediate/contractPipeline/derive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAKL,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAe5B,OAAO,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAC;AAOnF,sFAAsF;AACtF,MAAM,WAAW,aAAa;IAC5B,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,sBAAsB,CACpC,wBAAwB,EAAE,OAAO,EACjC,OAAO,GAAE,aAAkB,GAC1B,gBAAgB,CA6DlB;AAiFD,wBAAgB,8BAA8B,CAC5C,sBAAsB,EAAE,OAAO,EAC/B,wBAAwB,EAAE,OAAO,EACjC,OAAO,GAAE,aAAkB,GAC1B;IACD,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,OAAO,EAAE,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;CACpB,CAsCA;AAaD;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,yBAAyB,EAAE,CAAC;AAErC,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE3D;AASD,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,KAAK,CAAC;QAChB,aAAa,EAAE,MAAM,CAAC;QACtB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb;;;;;;WAMG;QACH,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,UAAU,EAAE,MAAM,EAAE,CAAC;KACtB,CAAC,CAAC;CACJ;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAQD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,gBAAgB,GAAG,SAAS,EACpC,iBAAiB,GAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAM,GACpD,yBAAyB,CA6B3B;AAED,MAAM,WAAW,6BAA6B;IAC5C,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,yBAAyB,EAAE,MAAM,EAAE,CAAC;IACpC;;;;;;;OAOG;IACH,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,2BAA2B,EAAE,MAAM,EAAE,CAAC;IACtC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,OAAO,GAAG,oBAAoB,EAAE,CAW/E;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,6BAA6B,EAAE,CAAC;IACvC,KAAK,EAAE,KAAK,EAAE,CAAC;CAChB;AAED,gFAAgF;AAChF,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,OAAO,GAAG,MAAM,EAAE,CAgBxE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,gBAAgB,GAAG,SAAS,EACpC,aAAa,EAAE,MAAM,EAAE,EACvB,kBAAkB,CAAC,EAAE,OAAO,GAC3B,yBAAyB,CAwD3B"}

package/dist/remediate/contractPipeline/derive.js

@@ -1,477 +0,0 @@
-/**
- * Deterministic derivers for contract-pipeline artifacts.
- *
- * S1 of the contract-authoring determinism design
- * (`spec/contract-authoring-determinism-design.md`): the contract pipeline
- * historically had the LLM author every structured artifact and the backend
- * only validate it afterward. For the artifacts whose *structure* is a pure
- * function of an upstream artifact, that is wasted generation and a weak-model
- * failure surface ("emit a large, schema-conforming, internally-consistent JSON
- * artifact from scratch with correct ids and cross-refs"). This module owns
- * those derivations so the tool produces the structure and the model is left
- * only the irreducible judgment.
- *
- * `deriveObligationLedger` is the flagship: the obligation ledger is a 1:1
- * restructuring of the finalized module contracts — every module invariant and
- * failure mode becomes an obligation, and every module gets a
- * contract-conformance obligation — so no judgment is lost by generating it in
- * code. Construction goes through the shared `buildObligationLedger` so the
- * cycle check, version stamp, and envelope stay single-sourced with the rest of
- * the codebase (the non-negotiable "derivers and validators share one source —
- * no parallel logic").
- */
-import { buildObligationLedger, isRecord, mintUniqueId, } from "audit-tools/shared";
-import { buildBaselineSymbolCorpus, classifyObligationChange, obligationScopeAnchors, readObligationChangeClassification, } from "./changeClassification.js";
-import { derivePhaseCut, phaseCutModulesFromContracts } from "./phaseCut.js";
-import { coerceGoalId, obligationId } from "./idRegistry.js";
-import { COPIED_MODULE_CONTRACT_FIELDS, DERIVED_MODULE_CONTRACT_FIELDS, } from "./finalizedContractFields.js";
-import { CP_FINALIZED_MODULE_CONTRACTS_VERSION } from "../validation/contractPipeline.js";
-import { isTestablePhaseObligation } from "../validation/contractPipelineGates.js";
-/**
- * Derive the obligation ledger deterministically from the finalized module
- * contracts. Pure function of its input (modulo the `created_at` stamp): the
- * same contracts always yield the same obligations in the same order, so the
- * artifact hash / staleness DAG stays well-behaved.
- *
- * Mapping (the inverse of the obligation-ledger consumers' expectations):
- *  - one **structural** obligation per module ("implement this module per its
- *    finalized contract") — guarantees the ledger is never empty and every
- *    module has something the implementation DAG must cover, without inventing
- *    a paired-test burden (structural is not a testable kind);
- *  - one **invariant** obligation per declared module invariant (testable);
- *  - one **behavioral** obligation per declared module failure mode (testable).
- *
- * `depends_on` is left empty: the validated module-contract shape declares no
- * inter-obligation ordering, so an honest derivation asserts none (and the
- * ledger is acyclic by construction — `buildObligationLedger` cannot throw).
- */
-export function deriveObligationLedger(finalizedModuleContracts, options = {}) {
-    const finalized = readFinalizedContracts(finalizedModuleContracts);
-    const usedIds = new Set();
-    const obligations = [];
-    // DC-5: baseline corpus of pre-existing symbols, built once from the declared
-    // interface surface. A testable obligation that references a symbol in here is
-    // classified a behavior CHANGE (deterministic FIRST pass); otherwise an
-    // ADDITION. The verdict is recorded on each obligation so the paired-test gate
-    // is driven by data, not by render-only prose (CE-013).
-    const baselineSymbols = buildBaselineSymbolCorpus(finalizedModuleContracts);
-    for (const mod of finalized.module_contracts) {
-        // Contract-conformance obligation — represents the module even when it
-        // declares no invariants/failure modes (structural kind → not testable).
-        obligations.push({
-            id: mintUniqueId(usedIds, obligationId(mod.name, "contract")),
-            description: `Implement module "${mod.name}" per its finalized contract ` +
-                `(inputs: ${fmtList(mod.inputs)} → outputs: ${fmtList(mod.outputs)}; ` +
-                `validation boundary: ${mod.validation_boundary || "n/a"}).`,
-            kind: "structural",
-            depends_on: [],
-            status: "pending",
-            source: "design_spec",
-            module: mod.name,
-        });
-        mod.invariants.forEach((invariant, i) => {
-            obligations.push({
-                id: mintUniqueId(usedIds, obligationId(mod.name, `inv-${i + 1}`)),
-                description: invariant,
-                kind: "invariant",
-                depends_on: [],
-                status: "pending",
-                source: "design_spec",
-                module: mod.name,
-                change_classification: classifyObligationChange(invariant, baselineSymbols),
-            });
-        });
-        mod.failure_modes.forEach((failureMode, j) => {
-            obligations.push({
-                id: mintUniqueId(usedIds, obligationId(mod.name, `fail-${j + 1}`)),
-                description: `Handle failure mode: ${failureMode}`,
-                kind: "behavioral",
-                depends_on: [],
-                status: "pending",
-                source: "design_spec",
-                module: mod.name,
-                change_classification: classifyObligationChange(failureMode, baselineSymbols),
-            });
-        });
-    }
-    return buildObligationLedger({
-        goal_id: finalized.goal_id,
-        obligations,
-        created_at: options.created_at,
-    });
-}
-// ── Finalized module contracts (deterministic attach) ─────────────────────────
-//
-// `contract_finalization` is a mechanical merge, not fresh authoring: it takes
-// the drafted module contracts and the seam-reconciliation decisions and, per
-// module, carries the draft interface verbatim while attaching the
-// `agreed_interface` of every seam that touches the module as a `seam_adjustment`.
-// No source is re-read and no judgment is spent — the judgment already happened
-// upstream (the seam_reconciliation phase decided each mismatch's resolution).
-// Attaching each agreed interface verbatim guarantees the reconciliation-derivation
-// gate (INV-CO-12) passes, since its corpus is the union of every module's
-// inputs/outputs/invariants/side_effects/seam_adjustments/validation_boundary.
-//
-// `neighbor_needs` is DROPPED at finalization (open-bugs.md:106). It is the
-// drafting phase's seam-negotiation vocabulary — symmetric coordination prose
-// whose directions per-module agents routinely invert — and when it was
-// preserved and unioned into the dependency graph, prose overrode every
-// declared `artifact:<name>` token edge and manufactured cycles the
-// fail-toward-later tiering then mis-phased. Implementation ordering derives
-// from the producer/consumer token graph ALONE. A weaker draft that leaves
-// inputs/outputs token-free simply declares no ordering constraint; a seam
-// report referencing a module not in scope still surfaces at the downstream
-// design/reconciliation gate and routes to an LLM re-author of
-// `contract_finalization` — the only path that still needs judgment.
-/** The seam-reconciliation `agreed_interface`s that touch a given module name. */
-function seamAdjustmentsForModule(moduleName, seamReconciliationReport) {
-    const mismatches = isRecord(seamReconciliationReport) && Array.isArray(seamReconciliationReport.mismatches)
-        ? seamReconciliationReport.mismatches
-        : [];
-    const adjustments = [];
-    for (const mismatch of mismatches) {
-        if (!isRecord(mismatch))
-            continue;
-        if (mismatch.module_a !== moduleName && mismatch.module_b !== moduleName)
-            continue;
-        const resolution = isRecord(mismatch.resolution) ? mismatch.resolution : undefined;
-        const agreed = resolution && typeof resolution.agreed_interface === "string"
-            ? resolution.agreed_interface
-            : "";
-        if (agreed.length === 0)
-            continue;
-        const seamId = typeof mismatch.seam_id === "string" ? mismatch.seam_id : "";
-        adjustments.push(seamId ? `${seamId}: ${agreed}` : agreed);
-    }
-    return adjustments;
-}
-/**
- * Derive `finalized_module_contracts` deterministically from the drafted
- * `module_contracts` and the `seam_reconciliation_report`. Pure function of its
- * inputs (modulo the `created_at` stamp): the same drafts + seam report always
- * yield the same finalized contracts in draft order, so the artifact hash /
- * staleness DAG stays well-behaved.
- *
- * Each finalized entry copies the draft's interface fields verbatim (already
- * validated `string[]` / string shapes, so no coercion is needed) and DROPS
- * `neighbor_needs` (ordering derives from the artifact-token graph alone), then
- * sets `seam_adjustments` to the `agreed_interface`(s) of the seams that touch
- * the module. A draft entry that is not an object is passed through unchanged
- * (the downstream validator reports it).
- */
-/**
- * The producer for each DERIVED module-contract field, keyed by the SAME union
- * the field list is drawn from — so adding a derived field to the vocabulary
- * without a producer here is a compile error rather than a field that silently
- * finalizes as `undefined` and then fails validation on every module.
- */
-const DERIVED_MODULE_CONTRACT_VALUES = {
-    seam_adjustments: (moduleName, seamReconciliationReport) => seamAdjustmentsForModule(moduleName, seamReconciliationReport),
-};
-export function deriveFinalizedModuleContracts(draftedModuleContracts, seamReconciliationReport, options = {}) {
-    // Validated on the way IN, never read verbatim. `goal_id` is the identity
-    // joining every contract-pipeline artifact and the key the consistency gate
-    // compares, and the LLM is its only producer — so the previous
-    // `typeof === "string"` read admitted `""`, an unsubstituted
-    // `<stable-identifier>` placeholder, and a free-text sentence alike, and the
-    // join silently degraded to "no identity" instead of failing. The grammar
-    // lives in the id registry beside the other mints; see `GOAL_ID_PATTERN`.
-    const goalId = isRecord(draftedModuleContracts)
-        ? coerceGoalId(draftedModuleContracts.goal_id)
-        : "";
-    const drafts = isRecord(draftedModuleContracts) && Array.isArray(draftedModuleContracts.module_contracts)
-        ? draftedModuleContracts.module_contracts
-        : [];
-    const module_contracts = drafts.map((mod) => {
-        if (!isRecord(mod) || typeof mod.name !== "string")
-            return mod;
-        // COPIED first, DERIVED second, both drawn from the ONE field vocabulary
-        // (`finalizedContractFields.ts`). The literal this replaced was the third
-        // hand-written copy of the shape; a field added here and missed in the
-        // reader narrowed every downstream silently.
-        const finalized = Object.fromEntries(COPIED_MODULE_CONTRACT_FIELDS.map((field) => [field, mod[field]]));
-        for (const field of DERIVED_MODULE_CONTRACT_FIELDS) {
-            finalized[field] = DERIVED_MODULE_CONTRACT_VALUES[field](mod.name, seamReconciliationReport);
-        }
-        return finalized;
-    });
-    return {
-        contract_version: CP_FINALIZED_MODULE_CONTRACTS_VERSION,
-        goal_id: goalId,
-        module_contracts,
-        created_at: options.created_at ?? new Date().toISOString(),
-    };
-}
-// ── Scaffolds (S3): skeletons for the partially-derivable artifacts ────────────
-//
-// The test plan and implementation DAG have an irreducible judgment slot
-// (assertion text; node title/description/commands) so they cannot be derived
-// in full. Instead the tool derives their SKELETON — structure, ids, and
-// cross-references populated, only the judgment fields blank — and shows it to
-// the model so it fills just those slots and cannot drop, misname, or
-// mis-reference an obligation. These are NOT writable artifacts: the blank
-// fields fail validation by design (that is the point — the model must fill
-// them). They are rendered into the dispatch prompt as a pre-filled skeleton.
-/**
- * Shared obligation-membership predicates — the single source for which
- * obligations each downstream scaffold covers.
- *
- * `isTestablePhaseObligation` (imported above) is now single-sourced in
- * `../validation/contractPipelineGates.ts` (MNT-e10b9d9b: this file's former
- * local TESTABLE_KINDS set and that file's TESTABLE_OBLIGATION_KINDS were
- * "kept in parity by hand" and had already diverged — fail-open here,
- * fail-closed there, on an identical unrecognized-kind input). Re-exported
- * here so every existing importer of derive.js keeps working unchanged.
- *
- * `isDagPhaseObligation`: every obligation is covered by the implementation DAG,
- * so this is always true. It exists so both scaffolds derive their membership
- * from a named predicate rather than an inline ad-hoc filter.
- */
-export { isTestablePhaseObligation };
-export function isDagPhaseObligation(_kind) {
-    return true;
-}
-/** A short, stable test name from an obligation description. */
-function scaffoldName(obligation) {
-    const text = obligation.description.replace(/\s+/g, " ").trim();
-    if (!text)
-        return obligation.id;
-    return text.length > 64 ? `${text.slice(0, 61)}...` : text;
-}
-function sameStringSet(a, b) {
-    if (a.length !== b.length)
-        return false;
-    const setB = new Set(b);
-    return a.every((x) => setB.has(x));
-}
-/**
- * Build the test-plan skeleton: one spec per *testable* (invariant/behavioral)
- * obligation, with `obligation_id`/`name`/`kind`/`scope_anchors` filled and
- * `assertions` left blank for the model. The model fills only the assertions
- * (each spec needs a paired positive + negative assertion per the OBL-CO-01
- * gate, and the negative must name one of `scope_anchors` per CE-006).
- *
- * C3 diff-carry: when `priorByObligation` carries a prior round's authored spec
- * for an obligation whose premise is UNCHANGED (same `name` + same
- * `scope_anchors`), its assertions are pre-filled instead of left blank, so an
- * unchanged obligation is not re-authored from scratch every repair round. A
- * changed premise (renamed/re-scoped obligation) carries nothing — the host
- * re-authors it (fail-safe toward re-author, never toward stale carry).
- */
-export function buildTestValidatorPlanScaffold(ledger, priorByObligation = {}) {
-    const obligations = ledger?.obligations ?? [];
-    return {
-        test_specs: obligations
-            .filter((o) => isTestablePhaseObligation(o.kind))
-            .map((o) => {
-            const name = scaffoldName(o);
-            const scope_anchors = obligationScopeAnchors(o.id, o.description, readObligationChangeClassification(o));
-            const prior = priorByObligation[o.id];
-            const carried = prior &&
-                prior.name === name &&
-                sameStringSet(prior.scope_anchors, scope_anchors) &&
-                prior.assertions.length > 0
-                ? [...prior.assertions]
-                : [];
-            return {
-                obligation_id: o.id,
-                name,
-                kind: o.kind === "invariant" ? "invariant" : "unit",
-                scope_anchors,
-                assertions: carried,
-            };
-        }),
-    };
-}
-/**
- * Advisory-severity items from a conceptual_design_critique payload (defensive
- * read). Blocking items drive the design-repair loop and are consumed there;
- * advisory items survive past the critique gate and need a structural home in
- * the implementation DAG — this surfaces them so the skeleton can list them (B3).
- */
-export function advisoryCritiqueItems(critique) {
-    const items = isRecord(critique) && Array.isArray(critique.items) ? critique.items : [];
-    return items
-        .filter((item) => isRecord(item))
-        .filter((item) => item.severity === "advisory")
-        .map((item) => ({
-        id: typeof item.id === "string" ? item.id : "",
-        description: typeof item.description === "string" ? item.description : "",
-    }))
-        .filter((item) => item.id.length > 0);
-}
-/** Accepted counterexample ids from a judge_report payload (defensive read). */
-export function acceptedCounterexampleIds(judgeReport) {
-    const record = isRecord(judgeReport) ? judgeReport : {};
-    const classifications = Array.isArray(record.classifications)
-        ? record.classifications
-        : [];
-    const ids = [];
-    for (const cls of classifications) {
-        if (isRecord(cls) &&
-            cls.classification === "accepted" &&
-            typeof cls.counterexample_id === "string") {
-            ids.push(cls.counterexample_id);
-        }
-    }
-    return ids;
-}
-/**
- * Build the implementation-DAG skeleton: ONE node per finalized *module*
- * (grouping all that module's obligations), blank title/description/
- * targeted_commands for the model, and accepted counterexamples attached so
- * coverage holds by construction. Grouping by module means a 1-module change
- * derives 1 node instead of N obligation-nodes the host then has to merge (B2);
- * obligations with no module home (counterexample/critique-sourced) fall back
- * to one node each. Advisory: the model fills the blanks and may further
- * merge/split nodes as long as coverage is preserved.
- *
- * `depends_on` is DERIVED, not left for the host: when `finalizedContracts` is
- * supplied, each module node depends on the nodes of the modules it needs first
- * (producer/consumer `artifact:<name>` matching over `inputs`/`outputs` — the
- * same module-dependency DAG `phase_cut` uses). This
- * makes cross-node ordering tool-enforced instead of a thing the host must
- * remember to hand-add. Edges are oriented by phase ordinal so the result is
- * acyclic by construction: only an edge to a strictly-earlier-phase module is
- * kept, which drops the back-edge of any dependency cycle (fail-toward-later,
- * mirroring `derivePhaseCut`). The `edges` array stays empty — node `depends_on`
- * is the ordering the block promotion reads.
- */
-export function buildImplementationDagScaffold(ledger, acceptedCeIds, finalizedContracts) {
-    const obligations = (ledger?.obligations ?? []).filter((o) => isDagPhaseObligation(o.kind));
-    // Group by module in first-appearance order; obligations with no module key
-    // on their own id (one node each, preserving coverage).
-    const groups = [];
-    const groupIndex = new Map();
-    for (const o of obligations) {
-        const key = o.module ? `module:${o.module}` : `obligation:${o.id}`;
-        let idx = groupIndex.get(key);
-        if (idx === undefined) {
-            idx = groups.length;
-            groupIndex.set(key, idx);
-            groups.push({ key, obligations: [] });
-        }
-        groups[idx].obligations.push(o);
-    }
-    const nodes = groups.map((g, i) => {
-        const ids = g.obligations.map((o) => o.id);
-        return {
-            id: `CP-NODE-${i + 1}`,
-            title: "",
-            description: "",
-            satisfies_obligations: [...ids],
-            addresses_counterexamples: [],
-            addressed_critique_items: [],
-            depends_on: [],
-            verification_obligation_ids: [...ids],
-            targeted_commands: [],
-            status: "pending",
-        };
-    });
-    applyModuleDependencyEdges(nodes, groups, finalizedContracts);
-    if (acceptedCeIds.length > 0) {
-        if (nodes.length === 0) {
-            nodes.push({
-                id: "CP-NODE-1",
-                title: "",
-                description: "",
-                satisfies_obligations: [],
-                addresses_counterexamples: [...acceptedCeIds],
-                addressed_critique_items: [],
-                depends_on: [],
-                verification_obligation_ids: [],
-                targeted_commands: [],
-                status: "pending",
-            });
-        }
-        else {
-            nodes[0].addresses_counterexamples = [...acceptedCeIds];
-        }
-    }
-    return { nodes, edges: [] };
-}
-/**
- * Fill each module node's `depends_on` from the finalized contracts'
- * module-dependency DAG (producer/consumer artifact tokens alone), the
- * SAME source `phase_cut` uses so the node ordering and the phase barrier agree.
- * Only a group keyed on a real module can be a dependency target (obligation- and
- * counterexample-only nodes have no module home). Edges are oriented by phase
- * ordinal — kept only when the dependency module sits in a strictly-earlier phase
- * — so a dependency cycle contributes no back-edge and the result is acyclic by
- * construction. No-op when contracts are absent (existing behaviour: no edges).
- */
-function applyModuleDependencyEdges(nodes, groups, finalizedContracts) {
-    if (finalizedContracts === undefined || finalizedContracts === null)
-        return;
-    // module name → node id (1 node per module by construction).
-    const moduleToNodeId = new Map();
-    groups.forEach((g, i) => {
-        if (g.key.startsWith("module:")) {
-            moduleToNodeId.set(g.key.slice("module:".length), nodes[i].id);
-        }
-    });
-    if (moduleToNodeId.size === 0)
-        return;
-    const phaseModules = phaseCutModulesFromContracts(finalizedContracts);
-    const depsByModule = new Map(phaseModules.map((m) => [m.name, m.depends_on]));
-    const phaseOf = derivePhaseCut(phaseModules).module_phase;
-    const nodeById = new Map(nodes.map((n) => [n.id, n]));
-    for (const [moduleName, nodeId] of moduleToNodeId) {
-        const node = nodeById.get(nodeId);
-        if (!node)
-            continue;
-        const deps = new Set();
-        for (const depModule of depsByModule.get(moduleName) ?? []) {
-            const depNodeId = moduleToNodeId.get(depModule);
-            if (!depNodeId || depNodeId === nodeId)
-                continue;
-            if ((phaseOf[depModule] ?? 0) < (phaseOf[moduleName] ?? 0))
-                deps.add(depNodeId);
-        }
-        node.depends_on = [...deps].sort();
-    }
-}
-// ── Helpers ───────────────────────────────────────────────────────────────────
-function fmtList(items) {
-    return items.length > 0 ? items.join(", ") : "none";
-}
-function strArray(value) {
-    return Array.isArray(value)
-        ? value.filter((v) => typeof v === "string")
-        : [];
-}
-/**
- * The defensive coercion per COPIED field, keyed by the SAME union the field
- * list is drawn from — a field added to the vocabulary without a coercion here
- * is a compile error, not a field silently read as `undefined` at runtime.
- * `name` is the only non-array string; every other copied field is an array of
- * strings, with `validation_boundary` the one scalar outside `name`.
- */
-const COPIED_MODULE_CONTRACT_COERCIONS = {
-    name: (raw) => (typeof raw.name === "string" ? raw.name : "module"),
-    inputs: (raw) => strArray(raw.inputs),
-    outputs: (raw) => strArray(raw.outputs),
-    invariants: (raw) => strArray(raw.invariants),
-    side_effects: (raw) => strArray(raw.side_effects),
-    validation_boundary: (raw) => typeof raw.validation_boundary === "string" ? raw.validation_boundary : "",
-    failure_modes: (raw) => strArray(raw.failure_modes),
-};
-/** Defensive read of the validated finalized-module-contracts payload. */
-function readFinalizedContracts(payload) {
-    const record = isRecord(payload) ? payload : {};
-    // Same validation as the mint above: this reader is the OTHER half of the
-    // same join, so a value that could not be minted must not be read back as one.
-    const goalId = coerceGoalId(record.goal_id);
-    const rawModules = Array.isArray(record.module_contracts)
-        ? record.module_contracts
-        : [];
-    const module_contracts = rawModules.map((m) => {
-        const raw = isRecord(m) ? m : {};
-        return Object.fromEntries(COPIED_MODULE_CONTRACT_FIELDS.map((field) => [
-            field,
-            COPIED_MODULE_CONTRACT_COERCIONS[field](raw),
-        ]));
-    });
-    return { goal_id: goalId, module_contracts };
-}
-//# sourceMappingURL=derive.js.map