audit-tools 0.55.5 → 0.55.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/audit/cli/auditStep.d.ts +15 -1
- package/dist/audit/cli/auditStep.d.ts.map +1 -1
- package/dist/audit/cli/auditStep.js +24 -11
- package/dist/audit/cli/auditStep.js.map +1 -1
- package/dist/audit/cli/cleanup.d.ts.map +1 -1
- package/dist/audit/cli/cleanup.js +26 -2
- package/dist/audit/cli/cleanup.js.map +1 -1
- package/dist/audit/cli/conceptualDispatch.d.ts +2 -0
- package/dist/audit/cli/conceptualDispatch.d.ts.map +1 -1
- package/dist/audit/cli/conceptualDispatch.js +29 -8
- package/dist/audit/cli/conceptualDispatch.js.map +1 -1
- package/dist/audit/cli/dispatch/hostHandoff.d.ts +37 -3
- package/dist/audit/cli/dispatch/hostHandoff.d.ts.map +1 -1
- package/dist/audit/cli/dispatch/hostHandoff.js +185 -16
- package/dist/audit/cli/dispatch/hostHandoff.js.map +1 -1
- package/dist/audit/cli/fanoutLanes.d.ts +30 -0
- package/dist/audit/cli/fanoutLanes.d.ts.map +1 -1
- package/dist/audit/cli/fanoutLanes.js +76 -8
- package/dist/audit/cli/fanoutLanes.js.map +1 -1
- package/dist/audit/cli/nextStepCommand.d.ts +3 -0
- package/dist/audit/cli/nextStepCommand.d.ts.map +1 -1
- package/dist/audit/cli/nextStepCommand.js +104 -66
- package/dist/audit/cli/nextStepCommand.js.map +1 -1
- package/dist/audit/cli/nextStepHelpers.d.ts +49 -14
- package/dist/audit/cli/nextStepHelpers.d.ts.map +1 -1
- package/dist/audit/cli/nextStepHelpers.js +164 -68
- package/dist/audit/cli/nextStepHelpers.js.map +1 -1
- package/dist/audit/cli/reviewRun.d.ts +4 -0
- package/dist/audit/cli/reviewRun.d.ts.map +1 -1
- package/dist/audit/cli/reviewRun.js +1 -1
- package/dist/audit/cli/reviewRun.js.map +1 -1
- package/dist/audit/cli/semanticReviewStep.d.ts +2 -0
- package/dist/audit/cli/semanticReviewStep.d.ts.map +1 -1
- package/dist/audit/cli/semanticReviewStep.js +5 -50
- package/dist/audit/cli/semanticReviewStep.js.map +1 -1
- package/dist/audit/cli/validateResultsCommand.d.ts.map +1 -1
- package/dist/audit/cli/validateResultsCommand.js +3 -1
- package/dist/audit/cli/validateResultsCommand.js.map +1 -1
- package/dist/audit/extractors/fsIntake.d.ts +13 -0
- package/dist/audit/extractors/fsIntake.d.ts.map +1 -1
- package/dist/audit/extractors/fsIntake.js +11 -1
- package/dist/audit/extractors/fsIntake.js.map +1 -1
- package/dist/audit/io/artifacts.d.ts +35 -9
- package/dist/audit/io/artifacts.d.ts.map +1 -1
- package/dist/audit/io/artifacts.js +84 -67
- package/dist/audit/io/artifacts.js.map +1 -1
- package/dist/audit/io/rollover.d.ts +18 -0
- package/dist/audit/io/rollover.d.ts.map +1 -0
- package/dist/audit/io/rollover.js +152 -0
- package/dist/audit/io/rollover.js.map +1 -0
- package/dist/audit/io/runSnapshot.d.ts +149 -0
- package/dist/audit/io/runSnapshot.d.ts.map +1 -0
- package/dist/audit/io/runSnapshot.js +710 -0
- package/dist/audit/io/runSnapshot.js.map +1 -0
- package/dist/audit/orchestrator/advanceTypes.d.ts +11 -0
- package/dist/audit/orchestrator/advanceTypes.d.ts.map +1 -1
- package/dist/audit/orchestrator/autoFixExecutor.d.ts +9 -0
- package/dist/audit/orchestrator/autoFixExecutor.d.ts.map +1 -1
- package/dist/audit/orchestrator/autoFixExecutor.js +22 -2
- package/dist/audit/orchestrator/autoFixExecutor.js.map +1 -1
- package/dist/audit/orchestrator/charterExtractionExecutor.d.ts.map +1 -1
- package/dist/audit/orchestrator/charterExtractionExecutor.js +18 -3
- package/dist/audit/orchestrator/charterExtractionExecutor.js.map +1 -1
- package/dist/audit/orchestrator/charterPackets.d.ts +11 -1
- package/dist/audit/orchestrator/charterPackets.d.ts.map +1 -1
- package/dist/audit/orchestrator/charterPackets.js +13 -0
- package/dist/audit/orchestrator/charterPackets.js.map +1 -1
- package/dist/audit/orchestrator/designReviewPrompt.d.ts +9 -0
- package/dist/audit/orchestrator/designReviewPrompt.d.ts.map +1 -1
- package/dist/audit/orchestrator/designReviewPrompt.js +69 -31
- package/dist/audit/orchestrator/designReviewPrompt.js.map +1 -1
- package/dist/audit/orchestrator/designReviewSnapshot.d.ts +1 -0
- package/dist/audit/orchestrator/designReviewSnapshot.d.ts.map +1 -1
- package/dist/audit/orchestrator/designReviewSnapshot.js +2 -1
- package/dist/audit/orchestrator/designReviewSnapshot.js.map +1 -1
- package/dist/audit/orchestrator/executorRunners.d.ts.map +1 -1
- package/dist/audit/orchestrator/executorRunners.js +13 -4
- package/dist/audit/orchestrator/executorRunners.js.map +1 -1
- package/dist/audit/orchestrator/intakeExecutors.d.ts +8 -1
- package/dist/audit/orchestrator/intakeExecutors.d.ts.map +1 -1
- package/dist/audit/orchestrator/intakeExecutors.js +13 -4
- package/dist/audit/orchestrator/intakeExecutors.js.map +1 -1
- package/dist/audit/orchestrator/obligationPolicy.d.ts.map +1 -1
- package/dist/audit/orchestrator/obligationPolicy.js +4 -1
- package/dist/audit/orchestrator/obligationPolicy.js.map +1 -1
- package/dist/audit/orchestrator/planningExecutors.d.ts +1 -1
- package/dist/audit/orchestrator/planningExecutors.d.ts.map +1 -1
- package/dist/audit/orchestrator/planningExecutors.js +40 -6
- package/dist/audit/orchestrator/planningExecutors.js.map +1 -1
- package/dist/audit/orchestrator/systemicChallengeExecutor.d.ts.map +1 -1
- package/dist/audit/orchestrator/systemicChallengeExecutor.js +4 -1
- package/dist/audit/orchestrator/systemicChallengeExecutor.js.map +1 -1
- package/dist/audit/orchestrator/taskBuilder.d.ts +20 -0
- package/dist/audit/orchestrator/taskBuilder.d.ts.map +1 -1
- package/dist/audit/orchestrator/taskBuilder.js +80 -18
- package/dist/audit/orchestrator/taskBuilder.js.map +1 -1
- package/dist/audit/systemic/reviewFileMap.d.ts +72 -21
- package/dist/audit/systemic/reviewFileMap.d.ts.map +1 -1
- package/dist/audit/systemic/reviewFileMap.js +96 -45
- package/dist/audit/systemic/reviewFileMap.js.map +1 -1
- package/dist/audit/systemic/secondOrderAdversaryPrompt.d.ts +7 -0
- package/dist/audit/systemic/secondOrderAdversaryPrompt.d.ts.map +1 -1
- package/dist/audit/systemic/secondOrderAdversaryPrompt.js +39 -8
- package/dist/audit/systemic/secondOrderAdversaryPrompt.js.map +1 -1
- package/dist/remediate/phases/close.d.ts.map +1 -1
- package/dist/remediate/phases/close.js +19 -4
- package/dist/remediate/phases/close.js.map +1 -1
- package/dist/remediate/phases/triage.d.ts +2 -1
- package/dist/remediate/phases/triage.d.ts.map +1 -1
- package/dist/remediate/phases/triage.js +46 -25
- package/dist/remediate/phases/triage.js.map +1 -1
- package/dist/remediate/phases/triageConformance.d.ts +14 -0
- package/dist/remediate/phases/triageConformance.d.ts.map +1 -0
- package/dist/remediate/phases/triageConformance.js +189 -0
- package/dist/remediate/phases/triageConformance.js.map +1 -0
- package/dist/remediate/state/decisionConsumption.d.ts +110 -0
- package/dist/remediate/state/decisionConsumption.d.ts.map +1 -0
- package/dist/remediate/state/decisionConsumption.js +122 -0
- package/dist/remediate/state/decisionConsumption.js.map +1 -0
- package/dist/remediate/state/store.d.ts +4 -0
- package/dist/remediate/state/store.d.ts.map +1 -1
- package/dist/remediate/state/store.js +16 -0
- package/dist/remediate/state/store.js.map +1 -1
- package/dist/remediate/steps/dispatch/contractConformanceReview.d.ts +9 -0
- package/dist/remediate/steps/dispatch/contractConformanceReview.d.ts.map +1 -1
- package/dist/remediate/steps/dispatch/contractConformanceReview.js +32 -14
- package/dist/remediate/steps/dispatch/contractConformanceReview.js.map +1 -1
- package/dist/remediate/steps/dispatch/hostHandoff.d.ts.map +1 -1
- package/dist/remediate/steps/dispatch/hostHandoff.js +4 -0
- package/dist/remediate/steps/dispatch/hostHandoff.js.map +1 -1
- package/dist/remediate/steps/gateCommands.d.ts.map +1 -1
- package/dist/remediate/steps/gateCommands.js +6 -52
- package/dist/remediate/steps/gateCommands.js.map +1 -1
- package/dist/remediate/steps/nextStep.d.ts +7 -0
- package/dist/remediate/steps/nextStep.d.ts.map +1 -1
- package/dist/remediate/steps/nextStep.js +56 -19
- package/dist/remediate/steps/nextStep.js.map +1 -1
- package/dist/shared/contentKey.d.ts +3 -2
- package/dist/shared/contentKey.d.ts.map +1 -1
- package/dist/shared/contentKey.js +3 -2
- package/dist/shared/contentKey.js.map +1 -1
- package/dist/shared/decompose/charterExtraction.d.ts +189 -1
- package/dist/shared/decompose/charterExtraction.d.ts.map +1 -1
- package/dist/shared/decompose/charterExtraction.js +17 -2
- package/dist/shared/decompose/charterExtraction.js.map +1 -1
- package/dist/shared/git.d.ts +30 -1
- package/dist/shared/git.d.ts.map +1 -1
- package/dist/shared/git.js +65 -6
- package/dist/shared/git.js.map +1 -1
- package/dist/shared/loopCorePaths.d.ts.map +1 -1
- package/dist/shared/loopCorePaths.js +2 -0
- package/dist/shared/loopCorePaths.js.map +1 -1
- package/dist/shared/prompts.d.ts +2 -0
- package/dist/shared/prompts.d.ts.map +1 -1
- package/dist/shared/prompts.js +8 -2
- package/dist/shared/prompts.js.map +1 -1
- package/dist/shared/submission/ingestReport.d.ts.map +1 -1
- package/dist/shared/submission/ingestReport.js +19 -1
- package/dist/shared/submission/ingestReport.js.map +1 -1
- package/dist/shared/types/charter.d.ts +9 -0
- package/dist/shared/types/charter.d.ts.map +1 -1
- package/dist/shared/types/charter.js +7 -0
- package/dist/shared/types/charter.js.map +1 -1
- package/docs/audit-pkg/contracts.md +6 -2
- package/docs/audit-pkg/operator-guide.md +13 -4
- package/package.json +2 -1
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
// sites-pinned: tests/audit/systemic-challenge.test.ts, tests/audit/review-file-map-context.test.ts
|
|
1
2
|
/**
|
|
2
3
|
* The VERIFIED CALL-SITE MAP a design-review round receives as a read-only,
|
|
3
4
|
* provenanced input.
|
|
@@ -13,32 +14,42 @@
|
|
|
13
14
|
* So the map is derived ONCE, by the tool, from artifacts the round did not
|
|
14
15
|
* produce either (the repository manifest and the dependency graph the audit
|
|
15
16
|
* pipeline already extracted), and handed over labelled as prior verified recon.
|
|
16
|
-
* It is a lane ASSET, not a submission:
|
|
17
|
-
* (`renderReviewFileMap`)
|
|
18
|
-
*
|
|
19
|
-
*
|
|
17
|
+
* It is a lane ASSET, not a submission: the complete render
|
|
18
|
+
* (`renderReviewFileMap`) reaches the round as a READ-ONLY context file the lane
|
|
19
|
+
* materializer writes and binds into the lane's review binding, so acceptance
|
|
20
|
+
* re-hashes it and refuses a submission made against an edited copy; the prompt
|
|
21
|
+
* carries only a summary and the file's path (`reviewFileMapContext`). The file
|
|
22
|
+
* is never on a path any lane's write scope covers, and no submission schema has
|
|
23
|
+
* a field for it — a round has no route by which to write back, because the
|
|
24
|
+
* only thing it hands over is its own findings. Updates
|
|
20
25
|
* go through a separate recon pass (the graph builder), which is the only thing
|
|
21
26
|
* that can change what the next round receives. Otherwise the map quietly
|
|
22
27
|
* absorbs one reviewer's assumption and reaches the next reviewer as fact.
|
|
23
28
|
*
|
|
29
|
+
* The map is SCOPED to what the reading round reviews — the files its own prompt
|
|
30
|
+
* names as under review, which only the consumer knows: every file in that scope
|
|
31
|
+
* gets an anchor carrying its COMPLETE caller and callee lists, and nothing outside
|
|
32
|
+
* it is anchored. There is no cap. An earlier version anchored the path-sorted
|
|
33
|
+
* FIRST 60 authored files and listed at most 25 call sites each — neither number
|
|
34
|
+
* measured — so on a repository with more connected files a round received recon
|
|
35
|
+
* for files that merely sort early and had to re-derive the map for the ones it
|
|
36
|
+
* was judging, the exact waste this artefact exists to remove. Whatever the map
|
|
37
|
+
* leaves out (in-scope files with no edge, files outside the scope) is STATED in
|
|
38
|
+
* the render: a silently thin map reads as a complete one.
|
|
39
|
+
*
|
|
24
40
|
* Deterministic and content-derived: every array is ordered by a stable key, so
|
|
25
|
-
* the file does not churn between emissions of an unchanged round.
|
|
26
|
-
* drops entries STATES the drop — a silently truncated map reads as a complete
|
|
27
|
-
* one, which is the failure mode this whole artefact exists to avoid.
|
|
41
|
+
* the file does not churn between emissions of an unchanged round.
|
|
28
42
|
*/
|
|
29
43
|
import { compareCodeUnits } from "audit-tools/shared";
|
|
30
|
-
/** How many call sites per anchor are listed before the drop is stated. */
|
|
31
|
-
const MAX_CALLERS_PER_ANCHOR = 25;
|
|
32
|
-
/** How many authored files are mapped before the drop is stated. */
|
|
33
|
-
const MAX_ANCHORS = 60;
|
|
34
44
|
/**
|
|
35
45
|
* Build the map from the dependency graph the audit already extracted. Edges are
|
|
36
46
|
* read in both directions per anchor — callers and callees — because the review
|
|
37
47
|
* questions this feeds ("what does this change ripple into") need both and a
|
|
38
|
-
* round that re-derives one direction has re-derived the whole thing.
|
|
48
|
+
* round that re-derives one direction has re-derived the whole thing. Anchors are
|
|
49
|
+
* exactly the files in `scope`; their callers and callees are whatever the graph
|
|
50
|
+
* records, in or out of scope.
|
|
39
51
|
*/
|
|
40
|
-
export function buildReviewFileMap(bundle,
|
|
41
|
-
const maxAnchors = options.maxAnchors ?? MAX_ANCHORS;
|
|
52
|
+
export function buildReviewFileMap(bundle, scope) {
|
|
42
53
|
const graphs = bundle.graph_bundle?.graphs;
|
|
43
54
|
const sources = [];
|
|
44
55
|
const outgoing = new Map();
|
|
@@ -67,28 +78,19 @@ export function buildReviewFileMap(bundle, options = {}) {
|
|
|
67
78
|
edgeCount += kindCount;
|
|
68
79
|
}
|
|
69
80
|
sources.sort(compareCodeUnits);
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
const authored = (bundle.repo_manifest?.files ?? [])
|
|
74
|
-
.map((file) => file.path)
|
|
75
|
-
.sort(compareCodeUnits);
|
|
81
|
+
const inScope = [...new Set(scope.files)].sort(compareCodeUnits);
|
|
82
|
+
const inScopeSet = new Set(inScope);
|
|
83
|
+
const outsideScope = (bundle.repo_manifest?.files ?? []).filter((file) => !inScopeSet.has(file.path)).length;
|
|
76
84
|
const anchors = [];
|
|
77
85
|
let filesWithoutEdges = 0;
|
|
78
|
-
for (const path of
|
|
86
|
+
for (const path of inScope) {
|
|
79
87
|
const callers = [...(incoming.get(path) ?? [])].sort(compareCodeUnits);
|
|
80
88
|
const callees = [...(outgoing.get(path) ?? [])].sort(compareCodeUnits);
|
|
81
89
|
if (callers.length === 0 && callees.length === 0) {
|
|
82
90
|
filesWithoutEdges += 1;
|
|
83
91
|
continue;
|
|
84
92
|
}
|
|
85
|
-
anchors.push({
|
|
86
|
-
path,
|
|
87
|
-
callers: callers.slice(0, MAX_CALLERS_PER_ANCHOR),
|
|
88
|
-
callers_omitted: Math.max(0, callers.length - MAX_CALLERS_PER_ANCHOR),
|
|
89
|
-
callees: callees.slice(0, MAX_CALLERS_PER_ANCHOR),
|
|
90
|
-
callees_omitted: Math.max(0, callees.length - MAX_CALLERS_PER_ANCHOR),
|
|
91
|
-
});
|
|
93
|
+
anchors.push({ path, callers, callees });
|
|
92
94
|
}
|
|
93
95
|
return {
|
|
94
96
|
provenance: {
|
|
@@ -97,8 +99,12 @@ export function buildReviewFileMap(bundle, options = {}) {
|
|
|
97
99
|
edge_count: edgeCount,
|
|
98
100
|
graph_present: graphs !== undefined,
|
|
99
101
|
},
|
|
100
|
-
|
|
101
|
-
|
|
102
|
+
scope: {
|
|
103
|
+
basis: scope.basis,
|
|
104
|
+
file_count: inScope.length,
|
|
105
|
+
outside_scope: outsideScope,
|
|
106
|
+
},
|
|
107
|
+
anchors,
|
|
102
108
|
files_without_edges: filesWithoutEdges,
|
|
103
109
|
};
|
|
104
110
|
}
|
|
@@ -130,7 +136,16 @@ export function renderReviewFileMap(map) {
|
|
|
130
136
|
? " — the dependency graph carried no edges."
|
|
131
137
|
: " — no dependency graph was available."),
|
|
132
138
|
"",
|
|
139
|
+
`Scope: ${map.scope.basis} — ${map.scope.file_count} file(s) under review. Every one the graph ` +
|
|
140
|
+
"connects is listed below with its COMPLETE caller and callee lists; nothing is capped.",
|
|
141
|
+
"",
|
|
133
142
|
];
|
|
143
|
+
if (map.scope.outside_scope > 0) {
|
|
144
|
+
lines.push(`${map.scope.outside_scope} other authored file(s) lie outside this scope and are not ` +
|
|
145
|
+
"anchored; they still appear as callers or callees wherever an edge reaches them. An " +
|
|
146
|
+
"unanchored file is outside this map, not unconnected — derive its call sites yourself " +
|
|
147
|
+
"if your review follows the code there.", "");
|
|
148
|
+
}
|
|
134
149
|
const noEdgeLine = (count) => `${count} authored file(s) carry no graph edge and are NOT listed — their absence is a gap ` +
|
|
135
150
|
"in this extraction, not a finding that nothing depends on them.";
|
|
136
151
|
if (map.anchors.length === 0) {
|
|
@@ -144,26 +159,62 @@ export function renderReviewFileMap(map) {
|
|
|
144
159
|
}
|
|
145
160
|
for (const anchor of map.anchors) {
|
|
146
161
|
lines.push(`- **${anchor.path}**`);
|
|
147
|
-
lines.push(` - referenced by: ${anchor.callers.join(", ") || "(none recorded)"}`
|
|
148
|
-
|
|
149
|
-
? ` — and ${anchor.callers_omitted} more not listed`
|
|
150
|
-
: ""));
|
|
151
|
-
lines.push(` - references: ${anchor.callees.join(", ") || "(none recorded)"}` +
|
|
152
|
-
(anchor.callees_omitted > 0
|
|
153
|
-
? ` — and ${anchor.callees_omitted} more not listed`
|
|
154
|
-
: ""));
|
|
155
|
-
}
|
|
156
|
-
if (map.anchors_omitted > 0) {
|
|
157
|
-
lines.push("", `⚠ ${map.anchors_omitted} further file(s) with call sites are NOT listed above (this map is ` +
|
|
158
|
-
"capped). Their absence is a cap, not a finding — do not report an unlisted file as having " +
|
|
159
|
-
"no connections.");
|
|
162
|
+
lines.push(` - referenced by: ${anchor.callers.join(", ") || "(none recorded)"}`);
|
|
163
|
+
lines.push(` - references: ${anchor.callees.join(", ") || "(none recorded)"}`);
|
|
160
164
|
}
|
|
161
165
|
if (map.files_without_edges > 0) {
|
|
162
|
-
//
|
|
163
|
-
// files the graph has no edge for at all. Both are drops, so both are stated.
|
|
166
|
+
// In-scope files the graph has no edge for at all: a drop, so it is stated.
|
|
164
167
|
lines.push("", `⚠ ${noEdgeLine(map.files_without_edges)}`);
|
|
165
168
|
}
|
|
166
169
|
lines.push("");
|
|
167
170
|
return lines;
|
|
168
171
|
}
|
|
172
|
+
/** The context file's name. Its directory is content-addressed by the lane materializer. */
|
|
173
|
+
const REVIEW_FILE_MAP_FILENAME = "review-call-site-map.md";
|
|
174
|
+
/**
|
|
175
|
+
* Split one map into the prompt summary and the read-only context file, so the
|
|
176
|
+
* two cannot come from different builds. The complete map is uncapped and can be
|
|
177
|
+
* large, so the prompt does not inline it: it states the provenance, the
|
|
178
|
+
* read-only rule and every count the map's own render states (scope, anchors,
|
|
179
|
+
* edge-less files, files outside the scope), and points at the file the lane
|
|
180
|
+
* materializer lists under its "Read-only context files" section.
|
|
181
|
+
*/
|
|
182
|
+
export function reviewFileMapContext(map) {
|
|
183
|
+
const noRecon = "so the map is NO RECON — an absent edge is not evidence that no caller exists";
|
|
184
|
+
const edges = map.provenance.sources.length > 0
|
|
185
|
+
? `from ${map.provenance.sources.join(", ")}`
|
|
186
|
+
: map.provenance.graph_present
|
|
187
|
+
? `the dependency graph carried no edges, ${noRecon}`
|
|
188
|
+
: `no dependency graph was available, ${noRecon}`;
|
|
189
|
+
const summaryLines = [
|
|
190
|
+
"### Verified call-site map (provenance: machine-derived prior recon — you did NOT author this)",
|
|
191
|
+
"",
|
|
192
|
+
"The audit tool derived a call-site map from the dependency graph and the repository manifest " +
|
|
193
|
+
`extracted earlier in this run and wrote it to the read-only file \`${REVIEW_FILE_MAP_FILENAME}\`, ` +
|
|
194
|
+
'whose full path is listed under "Read-only context files" at the end of this prompt. Read it ' +
|
|
195
|
+
"BEFORE re-deriving any call site: it is a factual input handed to you so this round spends its " +
|
|
196
|
+
"budget on judgment, and you are expected to TRUST it as a starting point, not to reproduce it.",
|
|
197
|
+
"",
|
|
198
|
+
"**You cannot write back to it.** The file is read-only and bound into this review, so a " +
|
|
199
|
+
"submission made against an edited copy is refused, and a correction reaches the next round " +
|
|
200
|
+
"only through a fresh extraction pass. If it disagrees with what you find in the source, say " +
|
|
201
|
+
"so explicitly in your finding — name the file and the symbol that contradicts the map. Your " +
|
|
202
|
+
"VERDICT remains entirely your own; only the recon is shared.",
|
|
203
|
+
"",
|
|
204
|
+
`Scope: ${map.scope.basis} — ${map.scope.file_count} file(s) under review; ` +
|
|
205
|
+
`${map.anchors.length} anchored with their complete caller and callee lists; ` +
|
|
206
|
+
`${map.files_without_edges} carry no graph edge; ` +
|
|
207
|
+
`${map.scope.outside_scope} other authored file(s) lie outside this scope and are not anchored.`,
|
|
208
|
+
`Edges consulted: ${map.provenance.edge_count} — ${edges}.`,
|
|
209
|
+
"",
|
|
210
|
+
];
|
|
211
|
+
return {
|
|
212
|
+
summaryLines,
|
|
213
|
+
contextFile: {
|
|
214
|
+
filename: REVIEW_FILE_MAP_FILENAME,
|
|
215
|
+
label: "Verified call-site map (tool-generated prior recon)",
|
|
216
|
+
text: renderReviewFileMap(map).join("\n"),
|
|
217
|
+
},
|
|
218
|
+
};
|
|
219
|
+
}
|
|
169
220
|
//# sourceMappingURL=reviewFileMap.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"reviewFileMap.js","sourceRoot":"","sources":["../../../src/audit/systemic/reviewFileMap.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"reviewFileMap.js","sourceRoot":"","sources":["../../../src/audit/systemic/reviewFileMap.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AA0DtD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAsB,EACtB,KAAyB;IAEzB,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC;IAC3C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAChD,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,SAAS;QACpC,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IACE,OAAO,IAAI,KAAK,QAAQ;gBACxB,IAAI,KAAK,IAAI;gBACb,OAAQ,IAA2B,CAAC,IAAI,KAAK,QAAQ;gBACrD,OAAQ,IAAyB,CAAC,EAAE,KAAK,QAAQ,EACjD,CAAC;gBACD,SAAS;YACX,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,IAAoC,CAAC;YAC1D,IAAI,IAAI,KAAK,EAAE;gBAAE,SAAS;YAC1B,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACrE,SAAS,IAAI,CAAC,CAAC;QACjB,CAAC;QACD,IAAI,SAAS,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,SAAS,WAAW,CAAC,CAAC;QAClE,SAAS,IAAI,SAAS,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAE/B,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,YAAY,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAC7D,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CACrC,CAAC,MAAM,CAAC;IAET,MAAM,OAAO,GAA0B,EAAE,CAAC;IAC1C,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjD,iBAAiB,IAAI,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO;QACL,UAAU,EAAE;YACV,MAAM,EAAE,MAAM;YACd,OAAO;YACP,UAAU,EAAE,SAAS;YACrB,aAAa,EAAE,MAAM,KAAK,SAAS;SACpC;QACD,KAAK,EAAE;YACL,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,OAAO,CAAC,MAAM;YAC1B,aAAa,EAAE,YAAY;SAC5B;QACD,OAAO;QACP,mBAAmB,EAAE,iBAAiB;KACvC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAkB;IACpD,MAAM,KAAK,GAAa;QACtB,gGAAgG;QAChG,EAAE;QACF,gGAAgG;YAC9F,+FAA+F;YAC/F,yFAAyF;YACzF,gEAAgE;QAClE,EAAE;QACF,4FAA4F;YAC1F,+FAA+F;YAC/F,8FAA8F;YAC9F,0FAA0F;YAC1F,4FAA4F;YAC5F,kBAAkB;QACpB,EAAE;QACF,oBAAoB,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE;YAC7C,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;gBAChC,CAAC,CAAC,WAAW,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBACjD,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa;oBAC5B,CAAC,CAAC,2CAA2C;oBAC7C,CAAC,CAAC,uCAAuC,CAAC;QAChD,EAAE;QACF,UAAU,GAAG,CAAC,KAAK,CAAC,KAAK,MAAM,GAAG,CAAC,KAAK,CAAC,UAAU,6CAA6C;YAC9F,wFAAwF;QAC1F,EAAE;KACH,CAAC;IACF,IAAI,GAAG,CAAC,KAAK,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CACR,GAAG,GAAG,CAAC,KAAK,CAAC,aAAa,6DAA6D;YACrF,sFAAsF;YACtF,wFAAwF;YACxF,wCAAwC,EAC1C,EAAE,CACH,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,KAAa,EAAU,EAAE,CAC3C,GAAG,KAAK,oFAAoF;QAC5F,iEAAiE,CAAC;IAEpE,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CACR,yFAAyF;YACvF,2FAA2F;YAC3F,qEAAqE,EACvE,EAAE,CACH,CAAC;QACF,IAAI,GAAG,CAAC,mBAAmB,GAAG,CAAC,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,iBAAiB,EAAE,CAAC,CAAC;QACnF,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,iBAAiB,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,GAAG,CAAC,mBAAmB,GAAG,CAAC,EAAE,CAAC;QAChC,4EAA4E;QAC5E,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,UAAU,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC;AACf,CAAC;AAiBD,4FAA4F;AAC5F,MAAM,wBAAwB,GAAG,yBAAyB,CAAC;AAE3D;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAkB;IACrD,MAAM,OAAO,GAAG,+EAA+E,CAAC;IAChG,MAAM,KAAK,GACT,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAC/B,CAAC,CAAC,QAAQ,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC7C,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa;YAC5B,CAAC,CAAC,0CAA0C,OAAO,EAAE;YACrD,CAAC,CAAC,sCAAsC,OAAO,EAAE,CAAC;IACxD,MAAM,YAAY,GAAG;QACnB,gGAAgG;QAChG,EAAE;QACF,+FAA+F;YAC7F,sEAAsE,wBAAwB,MAAM;YACpG,+FAA+F;YAC/F,iGAAiG;YACjG,gGAAgG;QAClG,EAAE;QACF,0FAA0F;YACxF,6FAA6F;YAC7F,8FAA8F;YAC9F,8FAA8F;YAC9F,8DAA8D;QAChE,EAAE;QACF,UAAU,GAAG,CAAC,KAAK,CAAC,KAAK,MAAM,GAAG,CAAC,KAAK,CAAC,UAAU,yBAAyB;YAC1E,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,yDAAyD;YAC9E,GAAG,GAAG,CAAC,mBAAmB,wBAAwB;YAClD,GAAG,GAAG,CAAC,KAAK,CAAC,aAAa,sEAAsE;QAClG,oBAAoB,GAAG,CAAC,UAAU,CAAC,UAAU,MAAM,KAAK,GAAG;QAC3D,EAAE;KACH,CAAC;IACF,OAAO;QACL,YAAY;QACZ,WAAW,EAAE;YACX,QAAQ,EAAE,wBAAwB;YAClC,KAAK,EAAE,qDAAqD;YAC5D,IAAI,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;SAC1C;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -1,5 +1,12 @@
|
|
|
1
1
|
import type { ArtifactBundle } from "../io/artifacts.js";
|
|
2
2
|
import type { AggregateMetricsDigest } from "./aggregateMetricsDigest.js";
|
|
3
|
+
import { type ReviewFileMapContext } from "./reviewFileMap.js";
|
|
4
|
+
/**
|
|
5
|
+
* The call-site map a systemic challenge round receives: the summary its prompt
|
|
6
|
+
* carries and the read-only context file its emission site passes to the lane
|
|
7
|
+
* materializer. The same build `renderSecondOrderAdversaryPrompt` summarizes.
|
|
8
|
+
*/
|
|
9
|
+
export declare function adversaryFileMapContext(bundle: ArtifactBundle): ReviewFileMapContext;
|
|
3
10
|
/**
|
|
4
11
|
* Render one systemic challenge round. `evidencePaths` are also granted in the
|
|
5
12
|
* host step's read set; the prompt names them so the adversary can inspect the
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"secondOrderAdversaryPrompt.d.ts","sourceRoot":"","sources":["../../../src/audit/systemic/secondOrderAdversaryPrompt.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;
|
|
1
|
+
{"version":3,"file":"secondOrderAdversaryPrompt.d.ts","sourceRoot":"","sources":["../../../src/audit/systemic/secondOrderAdversaryPrompt.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAK1E,OAAO,EAGL,KAAK,oBAAoB,EAG1B,MAAM,oBAAoB,CAAC;AAgD5B;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,cAAc,GAAG,oBAAoB,CAEpF;AAqKD;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,IAAI,EAAE;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,sBAAsB,CAAC;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,cAAc,CAAC;IACvB,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC,GAAG,MAAM,CA4JT"}
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
// sites-pinned: tests/audit/systemic-evidence-projection.test.ts, tests/shared/prompt-renders-its-contract.test.ts
|
|
1
|
+
// sites-pinned: tests/audit/systemic-evidence-projection.test.ts, tests/shared/prompt-renders-its-contract.test.ts, tests/shared/design-check-provenanced-input.test.ts, tests/audit/review-file-map-context.test.ts
|
|
2
2
|
// Phase E — SECOND-ORDER ADVERSARY prompt (host_delegation).
|
|
3
3
|
//
|
|
4
4
|
// The adversary is a SEPARATE agent and receives the evidence the earlier
|
|
@@ -7,7 +7,7 @@
|
|
|
7
7
|
// direct repository/source verification.
|
|
8
8
|
import { FindingConfidenceSchema, FindingSeveritySchema, LENSES, } from "audit-tools/shared";
|
|
9
9
|
import { summarizeCoveredThemes, } from "./coveredThemes.js";
|
|
10
|
-
import { buildReviewFileMap,
|
|
10
|
+
import { buildReviewFileMap, reviewFileMapContext, } from "./reviewFileMap.js";
|
|
11
11
|
function priorFindings(bundle) {
|
|
12
12
|
const candidates = [
|
|
13
13
|
...(bundle.design_assessment?.contract_findings ?? []),
|
|
@@ -24,6 +24,35 @@ function priorFindings(bundle) {
|
|
|
24
24
|
return true;
|
|
25
25
|
});
|
|
26
26
|
}
|
|
27
|
+
/**
|
|
28
|
+
* What this round is pointed at: the files the banked findings implicate and the
|
|
29
|
+
* files the charter register's goal nodes cover — the two places this prompt
|
|
30
|
+
* names repository files as under challenge. The call-site map anchors exactly
|
|
31
|
+
* these, completely, so the round does not re-derive their call sites.
|
|
32
|
+
*/
|
|
33
|
+
function adversaryReviewScope(bundle, bankedFindings) {
|
|
34
|
+
const findingFiles = bankedFindings.flatMap((finding) => finding.affected_files.map((entry) => entry.path));
|
|
35
|
+
const register = bundle.charter_register;
|
|
36
|
+
const charterFiles = register && register.status !== "omitted"
|
|
37
|
+
? register.lanes.flatMap((lane) => lane.nodes.flatMap((node) => node.files ?? []))
|
|
38
|
+
: [];
|
|
39
|
+
return {
|
|
40
|
+
files: [...findingFiles, ...charterFiles],
|
|
41
|
+
basis: "the files the banked findings implicate and the files the charter register's goal " +
|
|
42
|
+
"nodes cover (both projected below)",
|
|
43
|
+
};
|
|
44
|
+
}
|
|
45
|
+
function adversaryFileMap(bundle, bankedFindings) {
|
|
46
|
+
return buildReviewFileMap(bundle, adversaryReviewScope(bundle, bankedFindings));
|
|
47
|
+
}
|
|
48
|
+
/**
|
|
49
|
+
* The call-site map a systemic challenge round receives: the summary its prompt
|
|
50
|
+
* carries and the read-only context file its emission site passes to the lane
|
|
51
|
+
* materializer. The same build `renderSecondOrderAdversaryPrompt` summarizes.
|
|
52
|
+
*/
|
|
53
|
+
export function adversaryFileMapContext(bundle) {
|
|
54
|
+
return reviewFileMapContext(adversaryFileMap(bundle, priorFindings(bundle)));
|
|
55
|
+
}
|
|
27
56
|
function renderPriorFindings(findings) {
|
|
28
57
|
if (findings.length === 0)
|
|
29
58
|
return ["No prior findings were banked."];
|
|
@@ -162,9 +191,9 @@ function adversaryIdentityLines() {
|
|
|
162
191
|
* REFUSES a finding whose `affected_files` names nothing the run's repository
|
|
163
192
|
* manifest holds. A placeholder is therefore not merely unhelpful — copied
|
|
164
193
|
* verbatim it is a refused round. So the example takes its path from the
|
|
165
|
-
* call-site map this
|
|
194
|
+
* call-site map this round receives, falling back to the manifest the map
|
|
166
195
|
* itself derives from: a reader who copies the example cites a file the reader
|
|
167
|
-
* can also see named
|
|
196
|
+
* can also see named in the map file.
|
|
168
197
|
*/
|
|
169
198
|
function examplePath(bundle, fileMap) {
|
|
170
199
|
return (fileMap.anchors[0]?.path ??
|
|
@@ -182,7 +211,7 @@ export function renderSecondOrderAdversaryPrompt(opts) {
|
|
|
182
211
|
metricLines.push(`- Max fan-out (out-degree): ${opts.metrics.max_fan_out}`);
|
|
183
212
|
const bankedFindings = priorFindings(opts.bundle);
|
|
184
213
|
const evidencePaths = [...new Set(opts.evidencePaths)].sort();
|
|
185
|
-
const fileMap =
|
|
214
|
+
const fileMap = adversaryFileMap(opts.bundle, bankedFindings);
|
|
186
215
|
const exampleFilePath = examplePath(opts.bundle, fileMap);
|
|
187
216
|
return [
|
|
188
217
|
"# Design review — systemic improvement-seeking challenge (second-order adversary)",
|
|
@@ -208,7 +237,9 @@ export function renderSecondOrderAdversaryPrompt(opts) {
|
|
|
208
237
|
"",
|
|
209
238
|
"## Prior verified recon — read this BEFORE re-deriving anything",
|
|
210
239
|
"",
|
|
211
|
-
|
|
240
|
+
// The summary only: the complete map reaches the lane as a read-only context
|
|
241
|
+
// file its emission site binds (`adversaryFileMapContext`).
|
|
242
|
+
...reviewFileMapContext(fileMap).summaryLines,
|
|
212
243
|
"## Stated-purpose / goal / delta projection",
|
|
213
244
|
"",
|
|
214
245
|
"Treat a triangulated purpose as a lead. Preserve disagreement, and inspect the full artifact when the projection raises a question:",
|
|
@@ -236,7 +267,7 @@ export function renderSecondOrderAdversaryPrompt(opts) {
|
|
|
236
267
|
"",
|
|
237
268
|
"## Repository/source verification (required)",
|
|
238
269
|
"",
|
|
239
|
-
"Use the repository and the strongest structural tools available. The call-site map
|
|
270
|
+
"Use the repository and the strongest structural tools available. The call-site map file is " +
|
|
240
271
|
"your starting recon — verify the sites it names and the claims you build on them, rather " +
|
|
241
272
|
"than rebuilding it. For every proposed improvement, inspect exact source sites, trace " +
|
|
242
273
|
"relevant callers and callees in both directions, and verify the affected paths. Before any " +
|
|
@@ -264,7 +295,7 @@ export function renderSecondOrderAdversaryPrompt(opts) {
|
|
|
264
295
|
"## Grounding — every improvement names a real file (required)",
|
|
265
296
|
"",
|
|
266
297
|
"Each finding's `affected_files` must name at least one file THIS repository holds, written " +
|
|
267
|
-
"repo-relative and spelled as the call-site map
|
|
298
|
+
"repo-relative and spelled as the call-site map file spells it. A submission carrying an " +
|
|
268
299
|
"improvement that names no such file is REFUSED as a whole, and the refusal names the " +
|
|
269
300
|
"finding: correct the path and resubmit. An improvement pointing at nothing cannot be " +
|
|
270
301
|
"verified, dispatched, or remediated.",
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"secondOrderAdversaryPrompt.js","sourceRoot":"","sources":["../../../src/audit/systemic/secondOrderAdversaryPrompt.ts"],"names":[],"mappings":"AAAA,
|
|
1
|
+
{"version":3,"file":"secondOrderAdversaryPrompt.js","sourceRoot":"","sources":["../../../src/audit/systemic/secondOrderAdversaryPrompt.ts"],"names":[],"mappings":"AAAA,qNAAqN;AACrN,6DAA6D;AAC7D,EAAE;AACF,0EAA0E;AAC1E,gFAAgF;AAChF,+EAA+E;AAC/E,yCAAyC;AAEzC,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,MAAM,GACP,MAAM,oBAAoB,CAAC;AAK5B,OAAO,EACL,sBAAsB,GAEvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,oBAAoB,GAIrB,MAAM,oBAAoB,CAAC;AAE5B,SAAS,aAAa,CAAC,MAAsB;IAC3C,MAAM,UAAU,GAAG;QACjB,GAAG,CAAC,MAAM,CAAC,iBAAiB,EAAE,iBAAiB,IAAI,EAAE,CAAC;QACtD,GAAG,CAAC,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,IAAI,EAAE,CAAC;QACxD,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,QAAQ,IAAI,EAAE,CAAC;QAC5C,GAAG,CAAC,MAAM,CAAC,kBAAkB,EAAE,QAAQ,IAAI,EAAE,CAAC;KAC/C,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;QACnC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,IAAI,SAAS,OAAO,CAAC,QAAQ,SAAS,OAAO,CAAC,KAAK,EAAE,CAAC;QAC7E,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,MAAsB,EACtB,cAAkC;IAElC,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CACtD,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAClD,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACzC,MAAM,YAAY,GAChB,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;QACvC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC,CAAC,EAAE,CAAC;IACT,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,YAAY,EAAE,GAAG,YAAY,CAAC;QACzC,KAAK,EACH,oFAAoF;YACpF,oCAAoC;KACvC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAsB,EAAE,cAAkC;IAClF,OAAO,kBAAkB,CAAC,MAAM,EAAE,oBAAoB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAsB;IAC5D,OAAO,oBAAoB,CAAC,gBAAgB,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,mBAAmB,CAAC,QAA4B;IACvD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,gCAAgC,CAAC,CAAC;IACrE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,OAAO,OAAO,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,KAAK,OAAO,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,MAAM,OAAO,CAAC,OAAO,KAAK,KAAK,IAAI,UAAU,GAAG,CAAC;IACrI,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,MAA6B;IACxD,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,qFAAqF;SACtF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,OAAyC,EAAU,EAAE,CACnE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC;IACjF,OAAO;QACL,GAAG,MAAM,CAAC,aAAa,uCAAuC;QAC9D,EAAE;QACF,8BAA8B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;QACtD,kCAAkC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE;QAC9D,wCAAwC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE;QAC3E,EAAE;QACF,0FAA0F;YACxF,wFAAwF;YACxF,yFAAyF;YACzF,uCAAuC;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAsB;IACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACzC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/C,OAAO,CAAC,gDAAgD,CAAC,CAAC;IAC5D,CAAC;IACD,+EAA+E;IAC/E,kFAAkF;IAClF,MAAM,UAAU,GAAG;QACjB,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC5B,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,cAAc,EAAE,CAAC,CAAC,cAAc;gBAChC,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,UAAU,EAAE,CAAC,CAAC,UAAU;aACzB,CAAC,CAAC;YACH,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;SAC3D,CAAC,CAAC;QACH,eAAe,EAAE,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpD,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;YACtC,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC,CAAC;QACH,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5C,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;YACtC,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACnE,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO;SAC9B,CAAC,CAAC;QACH,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;KAC9C,CAAC;IACF,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAsB;IAChD,MAAM,YAAY,GAAG,MAAM,CAAC,8BAA8B,CAAC;IAC3D,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,CAAC,sDAAsD,CAAC,CAAC;IAClE,CAAC;IACD,OAAO;QACL,YAAY,YAAY,CAAC,QAAQ,IAAI;QACrC,EAAE;QACF,SAAS;QACT,IAAI,CAAC,SAAS,CACZ;YACE,YAAY,EAAE,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAC1D,WAAW,CAAC,IAAI,KAAK,OAAO;gBAC1B,CAAC,CAAC,EAAE,GAAG,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE;gBAC5C,CAAC,CAAC,WAAW,CAChB;YACD,sBAAsB,EAAE,YAAY,CAAC,sBAAsB;YAC3D,oBAAoB,EAAE,YAAY,CAAC,oBAAoB;YACvD,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,oEAAoE;YACpE,iBAAiB;YACjB,+BAA+B,EAC7B,YAAY,CAAC,+BAA+B;YAC9C,uCAAuC,EACrC,YAAY,CAAC,uCAAuC;SACvD,EACD,IAAI,EACJ,CAAC,CACF;QACD,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,sBAAsB;IAC7B,OAAO;QACL,uCAAuC;QACvC,EAAE;QACF,8FAA8F;YAC5F,6FAA6F;YAC7F,wEAAwE;QAC1E,EAAE;QACF,sFAAsF;YACpF,0FAA0F;YAC1F,6EAA6E;QAC/E,EAAE;KACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,WAAW,CAAC,MAAsB,EAAE,OAAsB;IACjE,OAAO,CACL,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI;QACxB,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI;QACtC,cAAc,CACf,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gCAAgC,CAAC,IAMhD;IACC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAC1C,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAChE,CAAC;IACF,WAAW,CAAC,IAAI,CAAC,+BAA+B,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5E,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9D,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC9D,MAAM,eAAe,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE1D,OAAO;QACL,mFAAmF;QACnF,EAAE;QACF,sEAAsE,IAAI,CAAC,KAAK,GAAG;QACnF,4BAA4B,cAAc,CAAC,MAAM,+EAA+E;QAChI,EAAE;QACF,GAAG,sBAAsB,EAAE;QAC3B,4DAA4D;QAC5D,EAAE;QACF,mHAAmH;QACnH,oEAAoE;QACpE,8CAA8C;QAC9C,yEAAyE;QACzE,wDAAwD;QACxD,0CAA0C;QAC1C,uEAAuE;QACvE,EAAE;QACF,4BAA4B;QAC5B,EAAE;QACF,uLAAuL;QACvL,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,IAAI,CAAC;QAC/C,EAAE;QACF,iEAAiE;QACjE,EAAE;QACF,6EAA6E;QAC7E,4DAA4D;QAC5D,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC,YAAY;QAC7C,6CAA6C;QAC7C,EAAE;QACF,qIAAqI;QACrI,GAAG,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC;QACvC,EAAE;QACF,2DAA2D;QAC3D,EAAE;QACF,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;QAClC,EAAE;QACF,2BAA2B;QAC3B,EAAE;QACF,GAAG,mBAAmB,CAAC,cAAc,CAAC;QACtC,EAAE;QACF,sDAAsD;QACtD,EAAE;QACF,GAAG,mBAAmB,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC;QAC9D,EAAE;QACF,6BAA6B;QAC7B,EAAE;QACF,6FAA6F;YAC3F,0FAA0F;YAC1F,6FAA6F;YAC7F,8FAA8F;YAC9F,wDAAwD;QAC1D,EAAE;QACF,8CAA8C;QAC9C,EAAE;QACF,6FAA6F;YAC3F,2FAA2F;YAC3F,wFAAwF;YACxF,6FAA6F;YAC7F,4FAA4F;YAC5F,6FAA6F;YAC7F,4FAA4F;YAC5F,6EAA6E;QAC/E,EAAE;QACF,wEAAwE;QACxE,EAAE;QACF,sDAAsD;QACtD,GAAG,WAAW;QACd,EAAE;QACF,iCAAiC;QACjC,EAAE;QACF,+FAA+F;YAC7F,2FAA2F;YAC3F,iBAAiB;QACnB,gGAAgG;YAC9F,6DAA6D;QAC/D,4FAA4F;YAC1F,0FAA0F;YAC1F,gEAAgE;QAClE,EAAE;QACF,+DAA+D;QAC/D,EAAE;QACF,6FAA6F;YAC3F,0FAA0F;YAC1F,uFAAuF;YACvF,uFAAuF;YACvF,sCAAsC;QACxC,EAAE;QACF,8BAA8B;QAC9B,EAAE;QACF,mBAAmB,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QAC9D,qBAAqB,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QAClE,eAAe,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QACnC,EAAE;QACF,+FAA+F;YAC7F,cAAc;QAChB,EAAE;QACF,mBAAmB;QACnB,EAAE;QACF,+FAA+F;YAC7F,wEAAwE;QAC1E,EAAE;QACF,6FAA6F;YAC3F,6FAA6F;YAC7F,8FAA8F;YAC9F,gEAAgE;QAClE,gGAAgG;YAC9F,2FAA2F;YAC3F,8FAA8F;YAC9F,sFAAsF;QACxF,EAAE;QACF,gBAAgB;QAChB,EAAE;QACF,gGAAgG;YAC9F,uEAAuE;QACzE,EAAE;QACF,WAAW;QACX,EAAE;QACF,mBAAmB,IAAI,CAAC,cAAc,qBAAqB;QAC3D,EAAE;QACF,SAAS;QACT,GAAG;QACH,kBAAkB;QAClB,8BAA8B;QAC9B,mCAAmC;QACnC,yCAAyC;QACzC,2BAA2B;QAC3B,2BAA2B;QAC3B,4BAA4B;QAC5B,qGAAqG;QACrG,uFAAuF;QACvF,oCAAoC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,KAAK;QACxE,MAAM;QACN,GAAG;QACH,KAAK;QACL,EAAE;QACF,gGAAgG;YAC9F,gEAAgE;QAClE,EAAE;QACF,SAAS;QACT,GAAG;QACH,mBAAmB;QACnB,4FAA4F;QAC5F,GAAG;QACH,KAAK;QACL,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"close.d.ts","sourceRoot":"","sources":["../../../src/remediate/phases/close.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgE,KAAK,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;
|
|
1
|
+
{"version":3,"file":"close.d.ts","sourceRoot":"","sources":["../../../src/remediate/phases/close.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgE,KAAK,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AAOpJ,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AA0B1D,OAAO,KAAK,EACV,eAAe,EAGf,yBAAyB,EACzB,SAAS,EACT,kBAAkB,EAGnB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,8BAA8B,CAAC;AAMtC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAKV,qBAAqB,EAItB,MAAM,mBAAmB,CAAC;AAgB3B,OAAO,EASL,KAAK,eAAe,EAEpB,KAAK,WAAW,EACjB,MAAM,0CAA0C,CAAC;AAMlD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AA0CnF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAC7B,OAAO,CAAC,WAAW,CAAC,CA6BtB;AAmCD;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,eAAe,CAAC,CA6B1B;AAuDD,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,gBAAgB,EACvB,aAAa,EAAE,aAAa,EAI5B,SAAS,GAAE,eAA0C,EAKrD,QAAQ,GAAE,WAAyB,EACnC,eAAe,GAAE,SAAS,qBAAqB,EAAO,GACrD,yBAAyB,CA8R3B;AAoDD;;;;;;;;GAQG;AACH,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CA6B5C;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,gBAAgB,EAAE,wCAAwC,CAAC;IAC3D,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IACzC,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,kGAAkG;IAClG,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,aAAa,EAAE,aAAa,GAAG,OAAO,CAK5E;AAgKD,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAAE,EAClB,YAAY,GAAE,MAAM,EAAO,GAC1B,OAAO,CAAC,gBAAgB,CAAC,CAyC3B;AAmHD;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,aAAa,CAAC,CAyGxB;AAGD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CA4D7B;AAoED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,gBAAgB,EACvB,UAAU,EAAE,MAAM,GACjB,OAAO,CAqCT;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,OAAO,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAsED,UAAU,mBAAmB;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CAClC;AACD,UAAU,oBAAoB;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AACD,UAAU,aAAa;IACrB,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;IACxC,aAAa,EAAE,oBAAoB,EAAE,CAAC;IACtC,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAChC,OAAO,EAAE,oBAAoB,EAAE,CAAC;CACjC;AAyED;;;GAGG;AACH,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,aAAa,EACtB,aAAa,EAAE,aAAa,EAC5B,SAAS,EAAE,OAAO,GAAG,SAAS,EAC9B,cAAc,EAAE,yBAAyB,EACzC,YAAY,EAAE,kBAAkB,EAChC,WAAW,GAAE,eAAe,EAAO,EACnC,YAAY,GAAE,wBAAoE,GACjF,MAAM,CA0PR;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,+BAA+B,CACnD,OAAO,EAAE,mBAAmB,EAC5B,aAAa,EAAE,gBAAgB,EAC/B,YAAY,EAAE,kBAAkB,EAChC,SAAS,EAAE,aAAa,EACxB,aAAa,EAAE,aAAa,EAC5B,SAAS,CAAC,EAAE,SAAS,EACrB,YAAY,GAAE,wBAAoE,EAClF,cAAc,GAAE,yBAAwF,GACvG,OAAO,CAAC,aAAa,CAAC,CAwIxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,mBAAmB,EAC5B,aAAa,EAAE,aAAa,EAC5B,YAAY,EAAE,kBAAkB,GAC/B,kBAAkB,CAwDpB;AAcD,wBAAsB,aAAa,CACjC,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,mBAAmB,EAC5B,SAAS,CAAC,EAAE,SAAS,GACpB,OAAO,CAAC,gBAAgB,CAAC,CA0Y3B"}
|
|
@@ -2,6 +2,7 @@ import { assertApprovedRuntimePlan, RemediationPlanAuthorityError } from "../con
|
|
|
2
2
|
import { executionPlanContextIssues } from "../contractPipeline/executionPlan.js";
|
|
3
3
|
import { contentSha256 } from "../../shared/submission/hostHandoffCore.js";
|
|
4
4
|
import { AcceptedConformanceReviewSchema, ContractReviewOutcomeSchema } from "../../shared/types/reviewIndependence.js";
|
|
5
|
+
import { archiveConformanceSubjects, assertSuccessfulConformance } from "./triageConformance.js";
|
|
5
6
|
import { readContractReviewOutcomes } from "./closeReviewProvenance.js";
|
|
6
7
|
import { dirname, extname, isAbsolute, join, relative } from "node:path";
|
|
7
8
|
import { readFileSync, existsSync } from "node:fs";
|
|
@@ -648,7 +649,9 @@ const AUDIT_TOOLS_EXCLUDE_PATTERN = /^\.audit-tools\//;
|
|
|
648
649
|
* `state.applied_edit_surface` is the ground truth: the union of files from each
|
|
649
650
|
* prompt-bound host result whose landed commit, ancestry, changed-file set,
|
|
650
651
|
* write scope, and required tests were mechanically corroborated by the
|
|
651
|
-
* provider-neutral host handoff ingestion boundary.
|
|
652
|
+
* provider-neutral host handoff ingestion boundary. Already-landed paths
|
|
653
|
+
* are attribution of committed bytes, never a grant to stage later dirt.
|
|
654
|
+
* The accepted per-item landing files fence those paths out below.
|
|
652
655
|
*
|
|
653
656
|
* RUN-START-DIRTY GUARD: a file that was ALREADY dirty when the run started
|
|
654
657
|
* (`state.run_start_dirty`, captured at the extracted-plan join site before any
|
|
@@ -673,8 +676,15 @@ const AUDIT_TOOLS_EXCLUDE_PATTERN = /^\.audit-tools\//;
|
|
|
673
676
|
function resolveEditSurfaceManifest(state) {
|
|
674
677
|
const files = new Set();
|
|
675
678
|
const runStartDirtyKeys = new Set((state.run_start_dirty ?? []).map(normalizeRepoPath));
|
|
679
|
+
// Accepted source changes already live in their corroborated commits. A
|
|
680
|
+
// later dirty version, even one restoring the original reviewed bytes, is
|
|
681
|
+
// not attributed by that commit. Preserve it as leftover rather than stage
|
|
682
|
+
// it again. This uses actual landed files, never the unit's write grant:
|
|
683
|
+
// other hand-applied paths retain the existing manifest behavior.
|
|
684
|
+
const landedKeys = new Set(Object.values(state.items ?? {}).flatMap(item => item.host_landed_commit ? (item.host_landed_files ?? []).map(normalizeRepoPath) : []));
|
|
676
685
|
const addUnlessPreexistingDirt = (path) => {
|
|
677
|
-
|
|
686
|
+
const key = normalizeRepoPath(path);
|
|
687
|
+
if (!runStartDirtyKeys.has(key) && !landedKeys.has(key))
|
|
678
688
|
files.add(path);
|
|
679
689
|
};
|
|
680
690
|
for (const path of state.applied_edit_surface ?? []) {
|
|
@@ -1661,16 +1671,19 @@ export async function cleanupTempBranchesAndArtifacts(options, completeState, co
|
|
|
1661
1671
|
// directory and say why, not to abort a close that has already written its
|
|
1662
1672
|
// report.
|
|
1663
1673
|
const { archiveFrictionRecords, outputDirFor } = await import("audit-tools/shared");
|
|
1674
|
+
let archiveFailure = "friction archive listing failed";
|
|
1664
1675
|
try {
|
|
1665
1676
|
await archiveFrictionRecords({
|
|
1666
1677
|
artifactsDir: options.artifactsDir,
|
|
1667
1678
|
destDir: outputDirFor(options.artifactsDir),
|
|
1668
1679
|
prefix: "remediation-friction",
|
|
1669
1680
|
});
|
|
1681
|
+
archiveFailure = "conformance evidence archive failed";
|
|
1682
|
+
await archiveConformanceSubjects(options.artifactsDir, outputDirFor(options.artifactsDir));
|
|
1670
1683
|
}
|
|
1671
1684
|
catch (error) {
|
|
1672
1685
|
const reason = error instanceof Error ? error.message : String(error);
|
|
1673
|
-
console.warn("
|
|
1686
|
+
console.warn("Close-out evidence could not be archived, so the artifacts " +
|
|
1674
1687
|
"directory is kept rather than deleted: " +
|
|
1675
1688
|
reason);
|
|
1676
1689
|
runLogger?.event({
|
|
@@ -1678,7 +1691,7 @@ export async function cleanupTempBranchesAndArtifacts(options, completeState, co
|
|
|
1678
1691
|
kind: "artifact_write",
|
|
1679
1692
|
obligation: "closing",
|
|
1680
1693
|
artifact: options.artifactsDir,
|
|
1681
|
-
note:
|
|
1694
|
+
note: `${archiveFailure} - artifacts dir preserved (records may exist and were NOT archived): ${reason}`,
|
|
1682
1695
|
});
|
|
1683
1696
|
return { artifacts_residue: options.artifactsDir };
|
|
1684
1697
|
}
|
|
@@ -1789,6 +1802,8 @@ export async function runClosePhase(state, options, runLogger) {
|
|
|
1789
1802
|
throw new Error("Cannot run close phase: missing plan, items, or closing_plan from state.");
|
|
1790
1803
|
}
|
|
1791
1804
|
// Check before preview, verification, state mutation, action execution or promotion.
|
|
1805
|
+
// sites-pinned: tests/remediate/host-handoff-corroboration-obligations.test.ts
|
|
1806
|
+
await assertSuccessfulConformance(options.root, options.artifactsDir, state);
|
|
1792
1807
|
await assertClosingPlanAuthority(state, options);
|
|
1793
1808
|
// CDC-19 (advisory): a planned finding with no corresponding item in
|
|
1794
1809
|
// state.items would be left uncounted by every module's INV-COVERAGE join
|