auditor-lambda 0.2.8 → 0.2.9

package/dist/orchestrator/flowPlanning.js

@@ -3,33 +3,58 @@ const DEFAULT_FLOW_LENS_PRIORITY = [
     "reliability",
     "correctness",
 ];
-export function buildFlowAwareTaskAugmentations(existingTasks, criticalFlows, _lineIndex) {
-    const seenTaskIds = new Set(existingTasks.map((task) => task.task_id));
-    // Signature: lens + sorted file list, so duplicate (flow, lens) combos across
-    // different flow groupings are still deduplicated.
-    const existingSignatures = new Set(existingTasks.map((t) => `${t.lens}|${[...t.file_paths].sort().join(",")}`));
-    const extraTasks = [];
+function lensPathKey(lens, path) {
+    return `${lens}:${path}`;
+}
+function flowLensPriority(lens) {
+    const index = DEFAULT_FLOW_LENS_PRIORITY.indexOf(lens);
+    return index >= 0 ? index : DEFAULT_FLOW_LENS_PRIORITY.length;
+}
+export function claimFlowReviewBlocks(criticalFlows, pendingByLens, assigned) {
+    const candidates = [];
     for (const flow of criticalFlows.flows) {
-        const desiredLenses = flow.concerns.filter((concern) => DEFAULT_FLOW_LENS_PRIORITY.includes(concern));
+        const flowPaths = [...new Set(flow.paths)].sort((a, b) => a.localeCompare(b));
+        const desiredLenses = flow.concerns
+            .filter((concern) => DEFAULT_FLOW_LENS_PRIORITY.includes(concern))
+            .sort((a, b) => flowLensPriority(a) - flowLensPriority(b));
         for (const lens of desiredLenses) {
-            // One task per (flow, lens) with all flow paths together so the agent
-            // can trace data across file boundaries in a single pass.
-            const taskId = `flow:${flow.id}:${lens}`;
-            const signature = `${lens}|${[...flow.paths].sort().join(",")}`;
-            if (seenTaskIds.has(taskId) || existingSignatures.has(signature)) {
+            const pendingPaths = pendingByLens.get(lens);
+            if (!pendingPaths || pendingPaths.size === 0) {
+                continue;
+            }
+            const filePaths = flowPaths.filter((path) => pendingPaths.has(path));
+            if (filePaths.length === 0) {
                 continue;
             }
-            extraTasks.push({
-                task_id: taskId,
-                unit_id: `flow:${flow.id}`,
-                pass_id: `flow-pass:${lens}`,
+            candidates.push({
+                flow_id: flow.id,
                 lens,
-                file_paths: [...flow.paths],
-                rationale: `Flow-aware audit for critical flow "${flow.id}" (${flow.paths.length} file${flow.paths.length === 1 ? "" : "s"}) under the ${lens} lens.`,
+                file_paths: filePaths,
             });
-            seenTaskIds.add(taskId);
-            existingSignatures.add(signature);
         }
     }
-    return extraTasks;
+    candidates.sort((a, b) => {
+        const sizeDelta = b.file_paths.length - a.file_paths.length;
+        if (sizeDelta !== 0)
+            return sizeDelta;
+        const lensDelta = flowLensPriority(a.lens) - flowLensPriority(b.lens);
+        if (lensDelta !== 0)
+            return lensDelta;
+        return a.flow_id.localeCompare(b.flow_id);
+    });
+    const blocks = [];
+    for (const candidate of candidates) {
+        const unclaimedPaths = candidate.file_paths.filter((path) => !assigned.has(lensPathKey(candidate.lens, path)));
+        if (unclaimedPaths.length === 0) {
+            continue;
+        }
+        for (const path of unclaimedPaths) {
+            assigned.add(lensPathKey(candidate.lens, path));
+        }
+        blocks.push({
+            ...candidate,
+            file_paths: unclaimedPaths,
+        });
+    }
+    return blocks;
 }

package/dist/orchestrator/flowRequeue.js

@@ -10,7 +10,17 @@ function isLens(value) {
         "tests",
         "operability",
         "config_deployment",
-    ].includes(value);
+    ].includes(String(value));
+}
+function getExternalSignalPaths(externalAnalyzerResults) {
+    const results = Array.isArray(externalAnalyzerResults?.results)
+        ? externalAnalyzerResults.results
+        : [];
+    return new Set(results
+        .map((item) => item && typeof item.path === "string" && item.path.length > 0
+        ? item.path
+        : null)
+        .filter((path) => path !== null));
 }
 function taskPriority(hasExternalSignal, lens) {
     if (hasExternalSignal &&
@@ -19,8 +29,8 @@ function taskPriority(hasExternalSignal, lens) {
     }
     return hasExternalSignal ? "medium" : "low";
 }
-function fileStillNeedsLens(coverageMatrix, path, lens) {
-    const record = coverageMatrix.files.find((file) => file.path === path);
+function fileStillNeedsLens(coverageByPath, path, lens) {
+    const record = coverageByPath.get(path);
     if (!record || record.audit_status === "excluded") {
         return false;
     }
@@ -28,21 +38,31 @@ function fileStillNeedsLens(coverageMatrix, path, lens) {
 }
 export function buildFlowRequeueTasks(criticalFlows, flowCoverage, coverageMatrix, externalAnalyzerResults) {
     const flowMap = new Map(criticalFlows.flows.map((flow) => [flow.id, flow]));
+    const coverageByPath = new Map(coverageMatrix.files.map((file) => [file.path, file]));
     const tasks = [];
     const seen = new Set();
-    const externalPaths = new Set((externalAnalyzerResults?.results ?? []).map((item) => item.path));
+    const externalPaths = getExternalSignalPaths(externalAnalyzerResults);
     for (const record of flowCoverage.flows) {
         const flow = flowMap.get(record.flow_id);
         if (!flow) {
             continue;
         }
-        const missingLenses = record.required_lenses.filter((lens) => !record.completed_lenses.includes(lens));
+        const requiredLenses = Array.isArray(record.required_lenses)
+            ? record.required_lenses.filter((lens) => typeof lens === "string")
+            : [];
+        const completedLenses = new Set(Array.isArray(record.completed_lenses)
+            ? record.completed_lenses.filter((lens) => typeof lens === "string")
+            : []);
+        const missingLenses = requiredLenses.filter((lens) => !completedLenses.has(lens));
+        const flowPaths = Array.isArray(flow.paths)
+            ? flow.paths.filter((path) => typeof path === "string")
+            : [];
         for (const lensName of missingLenses) {
             if (!isLens(lensName)) {
-                continue;
+                throw new Error(`buildFlowRequeueTasks encountered unsupported lens "${String(lensName)}" for flow ${record.flow_id}.`);
             }
-            for (const path of flow.paths) {
-                if (!fileStillNeedsLens(coverageMatrix, path, lensName)) {
+            for (const path of flowPaths) {
+                if (!fileStillNeedsLens(coverageByPath, path, lensName)) {
                     continue;
                 }
                 const signature = `${flow.id}|${lensName}|${path}`;

package/dist/orchestrator/internalExecutors.js

@@ -6,16 +6,16 @@ import { buildRiskRegister } from "../extractors/risk.js";
 import { buildSurfaceManifest } from "../extractors/surfaces.js";
 import { initializeCoverageFromPlan } from "./planning.js";
 import { buildFlowCoverage } from "./flowCoverage.js";
-import { buildFlowAwareTaskAugmentations } from "./flowPlanning.js";
 import { buildRequeuePayload } from "./requeueCommand.js";
 import { buildRuntimeValidationTasks, discoverRuntimeValidationCommand, mergeRuntimeValidationReport, } from "./runtimeValidation.js";
 import { buildAuditReportModel, renderAuditReportMarkdown, } from "../reporting/synthesis.js";
-import { buildChunkedAuditTasks, buildExternalSignalTasks, } from "./taskBuilder.js";
+import { buildChunkedAuditTasks, } from "./taskBuilder.js";
 import { buildUnitManifest } from "./unitBuilder.js";
 import { buildRepoManifestFromFs } from "../extractors/fsIntake.js";
 import { loadIgnoreFile } from "../extractors/ignore.js";
 import { ingestAuditResults, updateAuditTaskStatuses, } from "./resultIngestion.js";
 import { updateRuntimeValidationReport } from "./runtimeValidationUpdate.js";
+import { autoCompleteTrivialCoverage } from "./trivialAudit.js";
 async function runCommand(command, cwd) {
     return await new Promise((resolve) => {
         const child = spawn(command[0], command.slice(1), {
@@ -117,6 +117,7 @@ export async function runPlanningExecutor(bundle, root, lineIndex = {}) {
     }
     const externalAnalyzerResults = bundle.external_analyzer_results;
     const coverage = initializeCoverageFromPlan(bundle.repo_manifest, bundle.unit_manifest, bundle.file_disposition, externalAnalyzerResults);
+    const skippedTrivialPaths = autoCompleteTrivialCoverage(coverage, lineIndex, externalAnalyzerResults);
     const flowCoverage = buildFlowCoverage(bundle.critical_flows, coverage);
     const runtimeCommand = await discoverRuntimeValidationCommand(root);
     const runtimeValidationTasks = buildRuntimeValidationTasks({
@@ -128,12 +129,11 @@ export async function runPlanningExecutor(bundle, root, lineIndex = {}) {
     const runtimeValidationReport = runtimeValidationTasks.tasks.length > 0
         ? mergeRuntimeValidationReport(runtimeValidationTasks, bundle.runtime_validation_report)
         : undefined;
-    const baseTasks = buildChunkedAuditTasks(bundle.unit_manifest, lineIndex, {
+    const auditTasks = buildChunkedAuditTasks(coverage, lineIndex, {
         external_analyzer_results: externalAnalyzerResults,
+        critical_flows: bundle.critical_flows,
     });
-    const analyzerTasks = buildExternalSignalTasks(coverage, lineIndex, externalAnalyzerResults);
-    const flowTasks = buildFlowAwareTaskAugmentations([...baseTasks, ...analyzerTasks], bundle.critical_flows, lineIndex);
-    const auditTasks = [...baseTasks, ...analyzerTasks, ...flowTasks].map((task) => ({
+    const taggedAuditTasks = auditTasks.map((task) => ({
         ...task,
         status: task.status ?? "pending",
     }));
@@ -145,7 +145,7 @@ export async function runPlanningExecutor(bundle, root, lineIndex = {}) {
             flow_coverage: flowCoverage,
             runtime_validation_tasks: runtimeValidationTasks,
             runtime_validation_report: runtimeValidationReport,
-            audit_tasks: auditTasks,
+            audit_tasks: taggedAuditTasks,
             requeue_tasks: requeuePayload.tasks,
             audit_report: undefined,
         },
@@ -157,7 +157,10 @@ export async function runPlanningExecutor(bundle, root, lineIndex = {}) {
             "audit_tasks.json",
             "requeue_tasks.json",
         ],
-        progress_summary: `Built planning artifacts; generated ${auditTasks.length} tasks and ${requeuePayload.task_count} requeue tasks.` +
+        progress_summary: `Built planning artifacts; generated ${taggedAuditTasks.length} review blocks and ${requeuePayload.task_count} requeue tasks.` +
+            (skippedTrivialPaths.length > 0
+                ? ` Skipped ${skippedTrivialPaths.length} trivial path${skippedTrivialPaths.length === 1 ? "" : "s"} from semantic review.`
+                : "") +
             (runtimeCommand
                 ? ` Runtime validation will use: ${runtimeCommand.join(" ")}.`
                 : " No deterministic runtime validation command was discovered."),
@@ -265,6 +268,7 @@ export function runSynthesisExecutor(bundle, results) {
         criticalFlows: bundle.critical_flows,
         coverageMatrix: bundle.coverage_matrix,
         runtimeValidationReport: bundle.runtime_validation_report,
+        externalAnalyzerResults: bundle.external_analyzer_results,
     });
     return {
         updated: {

package/dist/orchestrator/planning.js

@@ -1,5 +1,6 @@
 import { applyUnitCoverage, createCoverageMatrix, markExcludedPath, } from "../coverage.js";
 import { isAuditExcludedStatus } from "../extractors/disposition.js";
+import { deriveRequiredLensesForPath } from "./unitBuilder.js";
 const CATEGORY_LENS_TABLE = [
     [["security", "secret"], ["security", "correctness"]],
     [["dependency", "vuln"], ["security", "config_deployment"]],
@@ -21,8 +22,17 @@ function applyAnalyzerCoverage(coverage, externalAnalyzerResults) {
     if (!externalAnalyzerResults) {
         return;
     }
-    for (const result of externalAnalyzerResults.results) {
-        const record = coverage.files.find((file) => file.path === result.path);
+    const coverageByPath = new Map(coverage.files.map((file) => [file.path, file]));
+    const results = Array.isArray(externalAnalyzerResults.results)
+        ? externalAnalyzerResults.results
+        : [];
+    for (const result of results) {
+        if (!result ||
+            typeof result.path !== "string" ||
+            typeof result.category !== "string") {
+            continue;
+        }
+        const record = coverageByPath.get(result.path);
         if (!record || record.audit_status === "excluded") {
             continue;
         }
@@ -44,9 +54,21 @@ export function initializeCoverageFromPlan(repoManifest, unitManifest, dispositi
             markExcludedPath(coverage, file.path, status);
         }
     }
+    const unitIdsByPath = new Map();
     for (const unit of unitManifest.units) {
         for (const path of unit.files) {
-            applyUnitCoverage(coverage, path, unit.unit_id, unit.required_lenses);
+            const existing = unitIdsByPath.get(path) ?? [];
+            if (!existing.includes(unit.unit_id)) {
+                existing.push(unit.unit_id);
+            }
+            unitIdsByPath.set(path, existing);
+        }
+    }
+    for (const file of repoManifest.files) {
+        const unitIds = unitIdsByPath.get(file.path) ?? [];
+        const requiredLenses = deriveRequiredLensesForPath(file.path);
+        for (const unitId of unitIds) {
+            applyUnitCoverage(coverage, file.path, unitId, requiredLenses);
         }
     }
     applyAnalyzerCoverage(coverage, externalAnalyzerResults);

package/dist/orchestrator/requeue.js

@@ -7,10 +7,20 @@ function taskPriority(hasExternalSignal, lens) {
     }
     return "low";
 }
+function getExternalSignalPaths(externalAnalyzerResults) {
+    const results = Array.isArray(externalAnalyzerResults?.results)
+        ? externalAnalyzerResults.results
+        : [];
+    return new Set(results
+        .map((item) => item && typeof item.path === "string" && item.path.length > 0
+        ? item.path
+        : null)
+        .filter((path) => path !== null));
+}
 export function buildRequeueTasks(matrix, externalAnalyzerResults) {
     const targets = buildRequeueTargets(matrix);
     const tasks = [];
-    const externalPaths = new Set((externalAnalyzerResults?.results ?? []).map((item) => item.path));
+    const externalPaths = getExternalSignalPaths(externalAnalyzerResults);
     for (const target of targets) {
         for (const lens of target.missing_lenses) {
             const hasExternalSignal = externalPaths.has(target.path);

package/dist/orchestrator/taskBuilder.d.ts

@@ -1,5 +1,6 @@
 import type { ExternalAnalyzerResults } from "../types/externalAnalyzer.js";
-import type { AuditTask, CoverageMatrix, Lens, UnitManifest } from "../types.js";
+import type { AuditTask, CoverageMatrix, Lens } from "../types.js";
+import type { CriticalFlowManifest } from "../types/flows.js";
 export interface UnitLineIndex {
     [path: string]: number;
 }
@@ -12,6 +13,7 @@ export interface BuildChunkedTaskOptions {
     file_split_threshold?: number;
     limit_lenses?: Lens[];
     external_analyzer_results?: ExternalAnalyzerResults;
+    critical_flows?: CriticalFlowManifest;
 }
-export declare function buildChunkedAuditTasks(unitManifest: UnitManifest, unitLineIndex: UnitLineIndex, options?: BuildChunkedTaskOptions): AuditTask[];
+export declare function buildChunkedAuditTasks(coverageMatrix: CoverageMatrix, unitLineIndex: UnitLineIndex, options?: BuildChunkedTaskOptions): AuditTask[];
 export declare function buildExternalSignalTasks(coverageMatrix: CoverageMatrix, _unitLineIndex: UnitLineIndex, externalAnalyzerResults?: ExternalAnalyzerResults): AuditTask[];

package/dist/orchestrator/taskBuilder.js

@@ -1,5 +1,12 @@
+import { claimFlowReviewBlocks } from "./flowPlanning.js";
 import { isTrivialAuditPath } from "./trivialAudit.js";
-function taskPriority(hasExternalSignal, lens) {
+import { LENS_ORDER } from "./unitBuilder.js";
+function taskPriority(hasExternalSignal, lens, isCriticalFlow = false) {
+    if (isCriticalFlow) {
+        return lens === "security" || lens === "reliability" || lens === "correctness"
+            ? "high"
+            : "medium";
+    }
     if (hasExternalSignal &&
         (lens === "security" || lens === "data_integrity" || lens === "reliability")) {
         return "high";
@@ -39,68 +46,161 @@ function pickAnalyzerLens(category) {
     return "correctness";
 }
 const DEFAULT_FILE_SPLIT_THRESHOLD = 3000;
-export function buildChunkedAuditTasks(unitManifest, unitLineIndex, options = {}) {
+function buildCoverageIndex(coverageMatrix) {
+    return new Map(coverageMatrix.files.map((file) => [file.path, file]));
+}
+function getExternalSignalPaths(externalAnalyzerResults) {
+    const results = Array.isArray(externalAnalyzerResults?.results)
+        ? externalAnalyzerResults.results
+        : [];
+    return new Set(results
+        .map((item) => item && typeof item.path === "string" && item.path.length > 0
+        ? item.path
+        : null)
+        .filter((path) => path !== null));
+}
+function getExternalSignalResults(externalAnalyzerResults) {
+    if (!Array.isArray(externalAnalyzerResults?.results)) {
+        return [];
+    }
+    return externalAnalyzerResults.results.filter((item) => Boolean(item) &&
+        typeof item.path === "string" &&
+        typeof item.category === "string" &&
+        typeof item.summary === "string" &&
+        typeof item.id === "string");
+}
+export function buildChunkedAuditTasks(coverageMatrix, unitLineIndex, options = {}) {
     const fileSplitThreshold = options.file_split_threshold ?? DEFAULT_FILE_SPLIT_THRESHOLD;
     const allowed = new Set(options.limit_lenses ?? []);
     const enforceLensFilter = allowed.size > 0;
     const tasks = [];
     const seen = new Set();
-    const externalPaths = new Set((options.external_analyzer_results?.results ?? []).map((item) => item.path));
-    for (const unit of unitManifest.units) {
-        const minimumLenses = ["correctness", "security"];
-        const lensesToRun = Array.isArray(unit.required_lenses) && unit.required_lenses.length >= 2
-            ? unit.required_lenses
-            : minimumLenses;
-        for (const lens of lensesToRun) {
+    const externalPaths = getExternalSignalPaths(options.external_analyzer_results);
+    const coverageByPath = new Map(coverageMatrix.files.map((file) => [file.path, file]));
+    const pendingByLens = new Map();
+    for (const file of coverageMatrix.files) {
+        if (file.audit_status === "excluded") {
+            continue;
+        }
+        for (const lens of file.required_lenses) {
+            if (file.completed_lenses.includes(lens)) {
+                continue;
+            }
             if (enforceLensFilter && !allowed.has(lens)) {
                 continue;
             }
-            const hasExternalSignal = unit.files.some((f) => externalPaths.has(f));
-            const priority = taskPriority(hasExternalSignal, lens);
-            const tags = hasExternalSignal ? ["external_analyzer_signal"] : [];
-            const candidateFiles = unit.files.filter((filePath) => !isTrivialAuditPath(filePath, unitLineIndex[filePath] ?? 0, externalPaths.has(filePath)));
-            // Split files that are individually too large to group; everything else
-            // goes into one task so the agent can reason across file boundaries.
-            const oversizedFiles = fileSplitThreshold > 0
-                ? candidateFiles.filter((f) => (unitLineIndex[f] ?? 0) > fileSplitThreshold)
-                : [];
-            const normalFiles = candidateFiles.filter((f) => !oversizedFiles.includes(f));
-            // One task for all normal-sized files in this unit under this lens.
-            if (normalFiles.length > 0) {
-                const id = `${unit.unit_id}:${lens}`;
-                if (!seen.has(id)) {
-                    seen.add(id);
-                    tasks.push({
-                        task_id: id,
-                        unit_id: unit.unit_id,
-                        pass_id: `pass:${lens}`,
-                        lens,
-                        file_paths: normalFiles,
-                        rationale: `Audit ${unit.unit_id} (${normalFiles.length} file${normalFiles.length === 1 ? "" : "s"}) under the ${lens} lens.${hasExternalSignal ? " External analyzer signals raise priority." : ""}`,
-                        priority,
-                        tags,
-                    });
-                }
+            if (isTrivialAuditPath(file.path, unitLineIndex[file.path] ?? 0, externalPaths.has(file.path))) {
+                continue;
             }
-            // Oversized files each get their own task so the agent isn't overwhelmed.
-            for (const filePath of oversizedFiles) {
-                const id = `${unit.unit_id}:${lens}:${filePath}`;
-                if (seen.has(id))
-                    continue;
-                seen.add(id);
-                const fileHasSignal = externalPaths.has(filePath);
+            const pending = pendingByLens.get(lens) ?? new Set();
+            pending.add(file.path);
+            pendingByLens.set(lens, pending);
+        }
+    }
+    function addTaskBlock(params) {
+        const oversizedFiles = fileSplitThreshold > 0
+            ? params.filePaths.filter((path) => (unitLineIndex[path] ?? 0) > fileSplitThreshold)
+            : [];
+        const oversizedSet = new Set(oversizedFiles);
+        const normalFiles = params.filePaths.filter((path) => !oversizedSet.has(path));
+        if (normalFiles.length > 0) {
+            const taskId = `${params.scopeId}:${params.lens}`;
+            if (!seen.has(taskId)) {
+                seen.add(taskId);
                 tasks.push({
-                    task_id: id,
-                    unit_id: unit.unit_id,
-                    pass_id: `pass:${lens}`,
-                    lens,
-                    file_paths: [filePath],
-                    rationale: `Audit ${filePath} (large file, split from unit) under the ${lens} lens.${fileHasSignal ? " External analyzer signals raise priority." : ""}`,
-                    priority: taskPriority(fileHasSignal, lens),
-                    tags: fileHasSignal ? ["external_analyzer_signal", "large_file"] : ["large_file"],
+                    task_id: taskId,
+                    unit_id: params.unitId,
+                    pass_id: params.passId,
+                    lens: params.lens,
+                    file_paths: normalFiles,
+                    rationale: params.rationale(normalFiles, false),
+                    priority: params.priority,
+                    tags: params.tags.length > 0 ? params.tags : undefined,
                 });
             }
         }
+        for (const filePath of oversizedFiles) {
+            const taskId = `${params.scopeId}:${params.lens}:${filePath}`;
+            if (seen.has(taskId)) {
+                continue;
+            }
+            seen.add(taskId);
+            tasks.push({
+                task_id: taskId,
+                unit_id: params.unitId,
+                pass_id: params.passId,
+                lens: params.lens,
+                file_paths: [filePath],
+                rationale: params.rationale([filePath], true),
+                priority: params.priority,
+                tags: params.tags.length > 0
+                    ? [...new Set([...params.tags, "large_file"])]
+                    : ["large_file"],
+            });
+        }
+    }
+    const assigned = new Set();
+    const flowBlocks = options.critical_flows
+        ? claimFlowReviewBlocks(options.critical_flows, pendingByLens, assigned)
+        : [];
+    for (const block of flowBlocks) {
+        const hasExternalSignal = block.file_paths.some((path) => externalPaths.has(path));
+        addTaskBlock({
+            scopeId: `flow:${block.flow_id}`,
+            unitId: `flow:${block.flow_id}`,
+            passId: `flow-pass:${block.lens}`,
+            lens: block.lens,
+            filePaths: block.file_paths,
+            priority: taskPriority(hasExternalSignal, block.lens, true),
+            tags: hasExternalSignal
+                ? ["critical_flow", `critical_flow:${block.flow_id}`, "external_analyzer_signal"]
+                : ["critical_flow", `critical_flow:${block.flow_id}`],
+            rationale: (filePaths, splitFromBlock) => splitFromBlock
+                ? `Audit ${filePaths[0]} (large file from critical flow ${block.flow_id}) under the ${block.lens} lens.${hasExternalSignal ? " External analyzer signals raise priority." : ""}`
+                : `Audit critical flow ${block.flow_id} (${filePaths.length} file${filePaths.length === 1 ? "" : "s"}) under the ${block.lens} lens.${hasExternalSignal ? " External analyzer signals raise priority." : ""}`,
+        });
+    }
+    const groupedRemainders = new Map();
+    for (const lens of LENS_ORDER) {
+        const pendingPaths = pendingByLens.get(lens);
+        if (!pendingPaths || pendingPaths.size === 0) {
+            continue;
+        }
+        for (const path of [...pendingPaths].sort((a, b) => a.localeCompare(b))) {
+            if (assigned.has(`${lens}:${path}`)) {
+                continue;
+            }
+            const record = coverageByPath.get(path);
+            const unitId = record?.unit_ids[0] ?? `review:${path.replace(/[^a-zA-Z0-9_-]/g, "-")}`;
+            const key = `${lens}|${unitId}`;
+            const current = groupedRemainders.get(key) ?? {
+                lens,
+                unitId,
+                filePaths: [],
+            };
+            current.filePaths.push(path);
+            groupedRemainders.set(key, current);
+        }
+    }
+    for (const block of [...groupedRemainders.values()].sort((a, b) => {
+        const lensDelta = LENS_ORDER.indexOf(a.lens) - LENS_ORDER.indexOf(b.lens);
+        if (lensDelta !== 0)
+            return lensDelta;
+        return a.unitId.localeCompare(b.unitId);
+    })) {
+        const hasExternalSignal = block.filePaths.some((path) => externalPaths.has(path));
+        addTaskBlock({
+            scopeId: block.unitId,
+            unitId: block.unitId,
+            passId: `pass:${block.lens}`,
+            lens: block.lens,
+            filePaths: block.filePaths,
+            priority: taskPriority(hasExternalSignal, block.lens),
+            tags: hasExternalSignal ? ["external_analyzer_signal"] : [],
+            rationale: (filePaths, splitFromBlock) => splitFromBlock
+                ? `Audit ${filePaths[0]} (large file split from ${block.unitId}) under the ${block.lens} lens.${hasExternalSignal ? " External analyzer signals raise priority." : ""}`
+                : `Audit ${block.unitId} (${filePaths.length} file${filePaths.length === 1 ? "" : "s"}) under the ${block.lens} lens.${hasExternalSignal ? " External analyzer signals raise priority." : ""}`,
+        });
     }
     return tasks.sort((a, b) => {
         const priorityDelta = priorityRank(b.priority) - priorityRank(a.priority);
@@ -119,12 +219,13 @@ export function buildExternalSignalTasks(coverageMatrix, _unitLineIndex, externa
     }
     const tasks = [];
     const seen = new Set();
-    for (const result of externalAnalyzerResults.results) {
+    const coverageByPath = buildCoverageIndex(coverageMatrix);
+    for (const result of getExternalSignalResults(externalAnalyzerResults)) {
         const safeCategory = sanitizeField(result.category, 80);
         const safePath = sanitizeField(result.path ?? "", 260);
         const safeSummary = sanitizeField(result.summary ?? "", 200);
         const lens = pickAnalyzerLens(safeCategory);
-        const coverage = coverageMatrix.files.find((file) => file.path === result.path);
+        const coverage = coverageByPath.get(result.path);
         if (!coverage || coverage.audit_status === "excluded") {
             continue;
         }

package/dist/orchestrator/unitBuilder.d.ts

@@ -1,3 +1,5 @@
-import type { RepoManifest, UnitManifest } from "../types.js";
+import type { Lens, RepoManifest, UnitManifest } from "../types.js";
 import type { FileDisposition } from "../types/disposition.js";
+export declare const LENS_ORDER: Lens[];
+export declare function deriveRequiredLensesForPath(path: string): Lens[];
 export declare function buildUnitManifest(repoManifest: RepoManifest, disposition?: FileDisposition): UnitManifest;

package/dist/orchestrator/unitBuilder.js

@@ -60,20 +60,30 @@ function inferUnitId(path, kind) {
     }
     return `${kind}-${path.replace(/[^a-zA-Z0-9_-]/g, "-")}`;
 }
+export const LENS_ORDER = [
+    "security",
+    "correctness",
+    "reliability",
+    "data_integrity",
+    "performance",
+    "operability",
+    "config_deployment",
+    "maintainability",
+    "tests",
+];
 function sortLenses(lenses) {
-    const order = [
-        "security",
-        "correctness",
-        "reliability",
-        "data_integrity",
-        "performance",
-        "operability",
-        "config_deployment",
-        "maintainability",
-        "tests",
-    ];
     const set = new Set(lenses);
-    return order.filter((lens) => set.has(lens));
+    return LENS_ORDER.filter((lens) => set.has(lens));
+}
+export function deriveRequiredLensesForPath(path) {
+    const assignment = bucketFile(path);
+    const required = new Set();
+    for (const bucket of assignment.buckets) {
+        for (const lens of LENS_MAP[bucket]) {
+            required.add(lens);
+        }
+    }
+    return sortLenses(required);
 }
 function inferCriticalFlows(files, requiredLenses) {
     const flows = new Set();
@@ -123,10 +133,8 @@ export function buildUnitManifest(repoManifest, disposition) {
         }
         const assignment = bucketFile(file.path);
         const required = new Set(existing.required_lenses);
-        for (const bucket of assignment.buckets) {
-            for (const lens of LENS_MAP[bucket]) {
-                required.add(lens);
-            }
+        for (const lens of deriveRequiredLensesForPath(file.path)) {
+            required.add(lens);
         }
         existing.required_lenses = sortLenses(required);
         const riskScore = new Set(assignment.buckets).size +

package/dist/prompts/renderWorkerPrompt.d.ts

@@ -1,2 +1,2 @@
-import type { WorkerTask } from "../types/workerSession.js";
+import { type WorkerTask } from "../types/workerSession.js";
 export declare function renderWorkerPrompt(task: WorkerTask): string;