auditor-lambda 0.2.1 → 0.2.3

package/dist/supervisor/operatorHandoff.js

@@ -1,6 +1,8 @@
 import { mkdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { writeJsonFile } from "../io/json.js";
+import { LOCAL_SUBPROCESS_PROVIDER_NAME } from "../providers/constants.js";
+export const CONFIG_ERROR_BLOCKER_PREFIX = "config-error:";
 function quoteShellPath(path) {
     return `"${path.replace(/"/g, '\\"')}"`;
 }
@@ -23,8 +25,8 @@ function buildSummary(status, providerName, fallbackSummary) {
         ? `Automatic work can continue under ${providerName}. Re-run the same wrapper or inspect the listed artifacts if you need operator context.`
         : "Automatic work can continue. Re-run the same wrapper or inspect the listed artifacts if you need operator context.";
 }
-function buildSuggestedInputs(artifactsDir, status) {
-    if (status !== "blocked") {
+function buildSuggestedInputs(artifactsDir, status, isConfigError) {
+    if (status !== "blocked" || isConfigError) {
         return [];
     }
     const incomingDir = join(artifactsDir, "incoming");
@@ -52,11 +54,14 @@ function buildSuggestedCommands(suggestedInputs, status) {
     }
     return suggestedInputs.map((item) => `audit-code ${item.flag} ${quoteShellPath(item.suggested_path)}`);
 }
-function buildInteractiveProviderHint(status, providerName, sessionConfigPath) {
+function buildInteractiveProviderHint(status, providerName, sessionConfigPath, isConfigError) {
     if (status !== "blocked") {
         return null;
     }
-    const providerLabel = providerName ?? "local-subprocess";
+    if (isConfigError) {
+        return `A project configuration issue is blocking the audit. Verify that --root points to the repository root containing a project file (package.json, go.mod, etc.), then run audit-code again.`;
+    }
+    const providerLabel = providerName ?? LOCAL_SUBPROCESS_PROVIDER_NAME;
     return `Current provider is ${providerLabel}. If you want the backend to continue through an interactive provider instead of importing results manually, set "provider" in ${sessionConfigPath} to "auto", "claude-code", "opencode", "subprocess-template", or "vscode-task", then run audit-code again from the repository root.`;
 }
 function renderMarkdown(handoff) {
@@ -109,6 +114,7 @@ function renderMarkdown(handoff) {
     return lines.join("\n");
 }
 export function buildAuditCodeHandoff(params) {
+    const isConfigError = params.isConfigError ?? false;
     const incomingDir = join(params.artifactsDir, "incoming");
     const artifactPaths = {
         incoming_dir: incomingDir,
@@ -123,7 +129,7 @@ export function buildAuditCodeHandoff(params) {
             ? join(params.artifactsDir, "runtime_validation_tasks.json")
             : null,
     };
-    const suggestedInputs = buildSuggestedInputs(params.artifactsDir, params.state.status);
+    const suggestedInputs = buildSuggestedInputs(params.artifactsDir, params.state.status, isConfigError);
     return {
         status: params.state.status,
         repo_root: params.root,
@@ -133,12 +139,18 @@ export function buildAuditCodeHandoff(params) {
         pending_obligations: buildPendingObligations(params.state),
         suggested_inputs: suggestedInputs,
         suggested_commands: buildSuggestedCommands(suggestedInputs, params.state.status),
-        interactive_provider_hint: buildInteractiveProviderHint(params.state.status, params.providerName ?? null, artifactPaths.session_config),
+        interactive_provider_hint: buildInteractiveProviderHint(params.state.status, params.providerName ?? null, artifactPaths.session_config, isConfigError),
         artifact_paths: artifactPaths,
     };
 }
 export async function writeAuditCodeHandoffArtifacts(handoff) {
-    await mkdir(handoff.artifact_paths.incoming_dir, { recursive: true });
-    await writeJsonFile(handoff.artifact_paths.operator_handoff_json, handoff);
-    await writeFile(handoff.artifact_paths.operator_handoff_markdown, renderMarkdown(handoff), "utf8");
+    try {
+        await mkdir(handoff.artifact_paths.incoming_dir, { recursive: true });
+        await writeJsonFile(handoff.artifact_paths.operator_handoff_json, handoff);
+        await writeFile(handoff.artifact_paths.operator_handoff_markdown, renderMarkdown(handoff), "utf8");
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`Failed to write operator handoff artifacts: ${message}`);
+    }
 }

package/dist/supervisor/runLedger.js

@@ -1,5 +1,4 @@
-import { rename, writeFile } from "node:fs/promises";
-import { readJsonFile } from "../io/json.js";
+import { isFileMissingError, readJsonFile, writeJsonFile } from "../io/json.js";
 function ledgerPath(artifactsDir) {
     return `${artifactsDir}/run-ledger.json`;
 }
@@ -7,15 +6,15 @@ export async function loadRunLedger(artifactsDir) {
     try {
         return await readJsonFile(ledgerPath(artifactsDir));
     }
-    catch {
-        return { runs: [] };
+    catch (error) {
+        if (isFileMissingError(error)) {
+            return { runs: [] };
+        }
+        throw error;
     }
 }
 export async function appendRunLedgerEntry(artifactsDir, entry) {
     const ledger = await loadRunLedger(artifactsDir);
     ledger.runs.push(entry);
-    const target = ledgerPath(artifactsDir);
-    const tmp = `${target}.tmp`;
-    await writeFile(tmp, JSON.stringify(ledger, null, 2) + "\n", "utf8");
-    await rename(tmp, target);
+    await writeJsonFile(ledgerPath(artifactsDir), ledger);
 }

package/dist/supervisor/sessionConfig.js

@@ -16,6 +16,7 @@ export async function loadSessionConfig(artifactsDir) {
     const configPath = getSessionConfigPath(artifactsDir);
     const rawConfig = await readOptionalJsonFile(configPath);
     if (rawConfig === undefined) {
+        process.stderr.write(`[session-config] no session-config.json found at ${configPath}; using empty defaults\n`);
         return {};
     }
     const issues = validateSessionConfig(rawConfig);

package/dist/types/flowCoverage.d.ts

@@ -3,7 +3,7 @@ export interface FlowCoverageRecord {
     paths: string[];
     required_lenses: string[];
     completed_lenses: string[];
-    status: string;
+    status: "pending" | "partial" | "complete";
     notes?: string[];
 }
 export interface FlowCoverageManifest {

package/dist/types/runLedger.d.ts

@@ -3,7 +3,7 @@ export interface RunLedgerEntry {
     provider: string;
     obligation_id: string | null;
     selected_executor: string | null;
-    status: string;
+    status: "completed" | "blocked" | "failed" | "no_progress";
     started_at: string;
     ended_at: string;
     result_path: string;

package/dist/types/runtimeValidation.d.ts

@@ -1,6 +1,7 @@
+export type RuntimeValidationKind = "unit-risk-check" | "critical-flow-check";
 export interface RuntimeValidationTask {
     id: string;
-    kind: string;
+    kind: RuntimeValidationKind;
     target_paths: string[];
     reason: string;
     priority: "high" | "medium" | "low";

package/dist/types/sessionConfig.d.ts

@@ -16,11 +16,6 @@ export interface VSCodeTaskConfig {
     command_template: string[];
     env?: Record<string, string>;
 }
-export interface ModelTiersConfig {
-    fast?: string;
-    balanced?: string;
-    capable?: string;
-}
 export interface SessionConfig {
     provider?: ProviderName;
     timeout_ms?: number;
@@ -31,5 +26,4 @@ export interface SessionConfig {
     vscode_task?: VSCodeTaskConfig;
     agent_task_batch_size?: number;
     parallel_workers?: number;
-    model_tiers?: ModelTiersConfig;
 }

package/dist/types/surfaces.d.ts

@@ -1,6 +1,7 @@
+export type SurfaceKind = "interface" | "background";
 export interface SurfaceRecord {
     id: string;
-    kind: string;
+    kind: SurfaceKind;
     entrypoint: string;
     exposure?: string;
     methods?: string[];

package/dist/types/workerSession.d.ts

@@ -12,4 +12,6 @@ export interface WorkerTask {
     runtime_updates_path?: string;
     external_analyzer_results_path?: string;
     skip_worker_command?: boolean;
+    timeout_ms?: number;
+    max_retries?: number;
 }

package/dist/types.d.ts

@@ -62,7 +62,6 @@ export interface AuditTask {
     rationale: string;
     priority?: "high" | "medium" | "low";
     tags?: string[];
-    model_hint?: "fast" | "balanced" | "capable";
 }
 export interface Finding {
     id: string;

package/dist/validation/sessionConfig.js

@@ -71,8 +71,7 @@ function validateAgentProviderSection(value, path, issues) {
         return;
     }
     if (value.command !== undefined) {
-        if (typeof value.command !== "string" ||
-            value.command.trim().length === 0) {
+        if (typeof value.command !== "string" || value.command.trim().length === 0) {
             pushIssue(issues, `${path}.command`, "command must be a non-empty string when provided.");
         }
     }
@@ -118,19 +117,6 @@ export function validateSessionConfig(value) {
     validateTemplateProviderSection(value.vscode_task, "vscode_task", issues, provider === "vscode-task");
     validateAgentProviderSection(value.claude_code, "claude_code", issues);
     validateAgentProviderSection(value.opencode, "opencode", issues);
-    if (value.model_tiers !== undefined) {
-        if (!isRecord(value.model_tiers)) {
-            pushIssue(issues, "model_tiers", "model_tiers must be a JSON object.");
-        }
-        else {
-            for (const tier of ["fast", "balanced", "capable"]) {
-                const v = value.model_tiers[tier];
-                if (v !== undefined && (typeof v !== "string" || v.trim().length === 0)) {
-                    pushIssue(issues, `model_tiers.${tier}`, `model_tiers.${tier} must be a non-empty string when provided.`);
-                }
-            }
-        }
-    }
     return issues;
 }
 export function validateConfiguredProviderEnvironment(sessionConfig, options = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auditor-lambda",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "private": false,
   "description": "Portable hybrid code-auditing framework for arbitrary repositories.",
   "type": "module",

package/schemas/audit-code-v1alpha1.schema.json

@@ -24,6 +24,7 @@
       "required": ["status", "obligations"],
       "properties": {
         "status": {
+          "type": "string",
           "enum": ["not_started", "active", "blocked", "complete"]
         },
         "last_executor": {
@@ -49,6 +50,7 @@
                 "type": "string"
               },
               "state": {
+                "type": "string",
                 "enum": ["missing", "present", "stale", "blocked", "satisfied"]
               },
               "reason": {
@@ -97,6 +99,7 @@
       ],
       "properties": {
         "status": {
+          "type": "string",
           "enum": ["not_started", "active", "blocked", "complete"]
         },
         "repo_root": {
@@ -125,6 +128,7 @@
             "required": ["flag", "suggested_path", "description"],
             "properties": {
               "flag": {
+                "type": "string",
                 "enum": [
                   "--results",
                   "--updates",

package/schemas/audit_result.schema.json

@@ -11,14 +11,20 @@
     "reviewed_ranges",
     "findings"
   ],
+  "$defs": {
+    "Finding": {
+      "$ref": "finding.schema.json"
+    }
+  },
   "properties": {
     "task_id": { "type": "string" },
     "unit_id": { "type": "string" },
     "pass_id": { "type": "string" },
-    "lens": { "type": "string", "enum": ["correctness", "architecture", "maintainability", "security", "reliability", "performance", "data_integrity", "tests", "operability", "config_deployment"] },
+    "lens": { "type": "string" },
     "agent_role": { "type": "string" },
     "reviewed_ranges": {
       "type": "array",
+      "minItems": 1,
       "items": {
         "type": "object",
         "required": ["path", "start", "end"],
@@ -32,7 +38,7 @@
     },
     "findings": {
       "type": "array",
-      "items": { "$ref": "finding.schema.json" }
+      "items": { "$ref": "#/$defs/Finding" }
     },
     "notes": {
       "type": "array",
@@ -44,5 +50,5 @@
       "items": { "type": "string" }
     }
   },
-  "additionalProperties": true
+  "additionalProperties": false
 }

package/schemas/audit_state.schema.json

@@ -28,9 +28,9 @@
           },
           "reason": { "type": "string" }
         },
-        "additionalProperties": true
+        "additionalProperties": false
       }
     }
   },
-  "additionalProperties": true
+  "additionalProperties": false
 }

package/schemas/audit_task.schema.json

@@ -15,7 +15,10 @@
     "task_id": { "type": "string" },
     "unit_id": { "type": "string" },
     "pass_id": { "type": "string" },
-    "lens": { "type": "string", "enum": ["correctness", "architecture", "maintainability", "security", "reliability", "performance", "data_integrity", "tests", "operability", "config_deployment"] },
+    "lens": {
+      "type": "string",
+      "enum": ["correctness", "architecture", "maintainability", "security", "reliability", "performance", "data_integrity", "tests", "operability", "config_deployment"]
+    },
     "file_paths": {
       "type": "array",
       "items": { "type": "string" }
@@ -43,7 +46,15 @@
       },
       "additionalProperties": true
     },
-    "rationale": { "type": "string" }
+    "rationale": { "type": "string" },
+    "priority": {
+      "type": "string",
+      "enum": ["high", "medium", "low"]
+    },
+    "tags": {
+      "type": "array",
+      "items": { "type": "string" }
+    }
   },
-  "additionalProperties": true
+  "additionalProperties": false
 }

package/schemas/blind_spot_register.schema.json

@@ -13,7 +13,17 @@
         "properties": {
           "id": { "type": "string" },
           "title": { "type": "string" },
-          "kind": { "type": "string" },
+          "kind": {
+            "type": "string",
+            "enum": [
+              "coverage-gap",
+              "trust-boundary",
+              "dynamic-behavior",
+              "operational-risk",
+              "documentation-drift",
+              "external-dependency"
+            ]
+          },
           "summary": { "type": "string" },
           "affected_paths": {
             "type": "array",
@@ -32,9 +42,9 @@
             "items": { "type": "string" }
           }
         },
-        "additionalProperties": true
+        "additionalProperties": false
       }
     }
   },
-  "additionalProperties": true
+  "additionalProperties": false
 }

package/schemas/coverage_matrix.schema.json

@@ -16,15 +16,27 @@
             "type": "array",
             "items": { "type": "string" }
           },
-          "classification_status": { "type": "string" },
-          "audit_status": { "type": "string" },
+          "classification_status": {
+            "type": "string",
+            "enum": ["unclassified", "classified", "excluded", "generated", "vendor", "binary", "doc_only"]
+          },
+          "audit_status": {
+            "type": "string",
+            "enum": ["pending", "partial", "complete", "excluded"]
+          },
           "required_lenses": {
             "type": "array",
-            "items": { "type": "string" }
+            "items": {
+              "type": "string",
+              "enum": ["correctness", "architecture", "maintainability", "security", "reliability", "performance", "data_integrity", "tests", "operability", "config_deployment"]
+            }
           },
           "completed_lenses": {
             "type": "array",
-            "items": { "type": "string" }
+            "items": {
+              "type": "string",
+              "enum": ["correctness", "architecture", "maintainability", "security", "reliability", "performance", "data_integrity", "tests", "operability", "config_deployment"]
+            }
           }
         },
         "additionalProperties": true

package/schemas/critical_flows.schema.json

@@ -15,15 +15,18 @@
           "name": { "type": "string" },
           "entrypoints": {
             "type": "array",
-            "items": { "type": "string" }
+            "items": { "type": "string" },
+            "minItems": 1
           },
           "paths": {
             "type": "array",
-            "items": { "type": "string" }
+            "items": { "type": "string" },
+            "minItems": 1
           },
           "concerns": {
             "type": "array",
-            "items": { "type": "string" }
+            "items": { "type": "string" },
+            "minItems": 1
           },
           "notes": {
             "type": "array",

package/schemas/external_analyzer_results.schema.json

@@ -14,8 +14,14 @@
         "required": ["id", "category", "severity", "path", "summary"],
         "properties": {
           "id": { "type": "string" },
-          "category": { "type": "string" },
-          "severity": { "type": "string" },
+          "category": {
+            "type": "string",
+            "description": "Free-form category string from the originating tool (e.g. 'security/injection', 'style/lint'). Mapped to audit lenses by analyzerCategoryToLenses."
+          },
+          "severity": {
+            "type": "string",
+            "enum": ["critical", "high", "medium", "low", "info"]
+          },
           "path": { "type": "string" },
           "line_start": { "type": "integer" },
           "line_end": { "type": "integer" },
@@ -23,9 +29,9 @@
           "rule": { "type": "string" },
           "raw": {}
         },
-        "additionalProperties": true
+        "additionalProperties": false
       }
     }
   },
-  "additionalProperties": true
+  "additionalProperties": false
 }

package/schemas/finding.schema.json

@@ -16,13 +16,41 @@
   "properties": {
     "id": { "type": "string" },
     "title": { "type": "string" },
-    "category": { "type": "string" },
+    "category": {
+      "type": "string",
+      "enum": [
+        "correctness",
+        "architecture",
+        "maintainability",
+        "security",
+        "reliability",
+        "performance",
+        "data_integrity",
+        "tests",
+        "operability",
+        "config_deployment"
+      ]
+    },
     "severity": {
       "type": "string",
       "enum": ["critical", "high", "medium", "low", "info"]
     },
     "confidence": { "type": "string", "enum": ["high", "medium", "low"] },
-    "lens": { "type": "string", "enum": ["correctness", "architecture", "maintainability", "security", "reliability", "performance", "data_integrity", "tests", "operability", "config_deployment"] },
+    "lens": {
+      "type": "string",
+      "enum": [
+        "correctness",
+        "architecture",
+        "maintainability",
+        "security",
+        "reliability",
+        "performance",
+        "data_integrity",
+        "tests",
+        "operability",
+        "config_deployment"
+      ]
+    },
     "summary": { "type": "string" },
     "affected_files": {
       "type": "array",
@@ -35,7 +63,7 @@
           "line_end": { "type": "integer" },
           "symbol": { "type": "string" }
         },
-        "additionalProperties": true
+        "additionalProperties": false
       }
     },
     "impact": { "type": "string" },

package/schemas/flow_coverage.schema.json

@@ -24,13 +24,22 @@
           },
           "required_lenses": {
             "type": "array",
-            "items": { "type": "string" }
+            "items": {
+              "type": "string",
+              "enum": ["correctness", "architecture", "maintainability", "security", "reliability", "performance", "data_integrity", "tests", "operability", "config_deployment"]
+            }
           },
           "completed_lenses": {
             "type": "array",
-            "items": { "type": "string" }
+            "items": {
+              "type": "string",
+              "enum": ["correctness", "architecture", "maintainability", "security", "reliability", "performance", "data_integrity", "tests", "operability", "config_deployment"]
+            }
+          },
+          "status": {
+            "type": "string",
+            "enum": ["pending", "partial", "complete"]
           },
-          "status": { "type": "string" },
           "notes": {
             "type": "array",
             "items": { "type": "string" }

package/schemas/graph_bundle.schema.json

@@ -16,9 +16,12 @@
             "properties": {
               "from": { "type": "string" },
               "to": { "type": "string" },
-              "kind": { "type": "string" }
+              "kind": {
+                "type": "string",
+                "description": "Import edge kind from the graph extractor (e.g. 'esm', 'commonjs', 'dynamic', 're-export')."
+              }
             },
-            "additionalProperties": true
+            "additionalProperties": false
           }
         },
         "calls": {
@@ -29,9 +32,12 @@
             "properties": {
               "from": { "type": "string" },
               "to": { "type": "string" },
-              "kind": { "type": "string" }
+              "kind": {
+                "type": "string",
+                "description": "Call edge kind from the graph extractor (e.g. 'sync', 'async', 'constructor', 'callback')."
+              }
             },
-            "additionalProperties": true
+            "additionalProperties": false
           }
         },
         "routes": {
@@ -44,12 +50,12 @@
               "handler": { "type": "string" },
               "method": { "type": "string" }
             },
-            "additionalProperties": true
+            "additionalProperties": false
           }
         }
       },
       "additionalProperties": true
     }
   },
-  "additionalProperties": true
+  "additionalProperties": false
 }

package/schemas/merged_findings.schema.json

@@ -4,11 +4,16 @@
   "title": "Merged Findings",
   "type": "object",
   "required": ["findings"],
+  "$defs": {
+    "Finding": {
+      "$ref": "finding.schema.json"
+    }
+  },
   "properties": {
     "findings": {
       "type": "array",
-      "items": { "$ref": "finding.schema.json" }
+      "items": { "$ref": "#/$defs/Finding" }
     }
   },
-  "additionalProperties": true
+  "additionalProperties": false
 }

package/schemas/risk_register.schema.json

@@ -12,7 +12,11 @@
         "required": ["unit_id", "risk_score", "signals"],
         "properties": {
           "unit_id": { "type": "string" },
-          "risk_score": { "type": "number" },
+          "risk_score": {
+            "type": "number",
+            "minimum": 0,
+            "maximum": 1
+          },
           "signals": {
             "type": "array",
             "items": { "type": "string" }

package/schemas/root_cause_clusters.schema.json

@@ -16,7 +16,8 @@
           "summary": { "type": "string" },
           "finding_ids": {
             "type": "array",
-            "items": { "type": "string" }
+            "items": { "type": "string" },
+            "minItems": 1
           }
         },
         "additionalProperties": true

package/schemas/runtime_validation_tasks.schema.json

@@ -12,7 +12,10 @@
         "required": ["id", "kind", "target_paths", "reason", "priority"],
         "properties": {
           "id": { "type": "string" },
-          "kind": { "type": "string" },
+          "kind": {
+            "type": "string",
+            "enum": ["unit-risk-check", "critical-flow-check"]
+          },
           "target_paths": {
             "type": "array",
             "items": { "type": "string" }