auditor-lambda 0.3.37 → 0.3.39

package/dist/cli.js

@@ -1,4 +1,4 @@
-import { mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
+import { mkdir, readFile, readdir, rename, rm, unlink, writeFile } from "node:fs/promises";
 import { createReadStream, existsSync } from "node:fs";
 import { Buffer } from "node:buffer";
 import { createHash } from "node:crypto";
@@ -22,6 +22,7 @@ import { buildAuditReportModel, renderAuditReportMarkdown, } from "./reporting/s
 import { deriveAuditState } from "./orchestrator/state.js";
 import { advanceAudit } from "./orchestrator/advance.js";
 import { decideNextStep } from "./orchestrator/nextStep.js";
+import { renderDesignReviewPrompt } from "./orchestrator/designReviewPrompt.js";
 import { createFreshSessionProvider, resolveFreshSessionProviderName, } from "./providers/index.js";
 import { appendRunLedgerEntry, loadRunLedger } from "./supervisor/runLedger.js";
 import { buildAuditCodeHandoff, writeAuditCodeHandoffArtifacts, } from "./supervisor/operatorHandoff.js";
@@ -32,7 +33,7 @@ import { buildReviewPackets, orderTasksForPacketReview, estimateTaskGroupTokens,
 import { buildFileAnchorSummary, } from "./orchestrator/fileAnchors.js";
 import { LOCAL_SUBPROCESS_PROVIDER_NAME } from "./providers/constants.js";
 import { runAuditCodeMcpServer } from "./mcp/server.js";
-import { scheduleWave, buildProviderModelKey, readQuotaState, recordWaveOutcome, resolveLimits, resolveHostActiveSubagentLimit, probeProvider, computeMaxSafeConcurrency, getQuotaStatePath, detectRateLimitError, computeCooldownUntil, runSlidingWindow, LearnedQuotaSource, CompositeQuotaSource, } from "./quota/index.js";
+import { scheduleWave, buildProviderModelKey, readQuotaState, recordWaveOutcome, resolveLimits, resolveHostActiveSubagentLimit, probeProvider, computeMaxSafeConcurrency, getQuotaStatePath, detectRateLimitError, computeCooldownUntil, runSlidingWindow, LearnedQuotaSource, CompositeQuotaSource, lookupDiscoveredLimits, updateDiscoveredLimits, mergeDiscoveredLimits, getHeaderExtractorForProvider, } from "./quota/index.js";
 const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const ADVANCE_AUDIT_CONTRACT_VERSION = "audit-code/v1alpha1";
 const WORKER_RESULT_CONTRACT_VERSION = "audit-code-worker-result/v1alpha1";
@@ -1038,6 +1039,32 @@ async function runDeterministicForNextStep(params) {
                     : join(params.artifactsDir, "audit-report.md"),
             };
         }
+        if (decision.selected_executor === "design_review") {
+            const findingsPath = join(params.artifactsDir, "incoming", "design-review-findings.json");
+            let reviewFindings;
+            try {
+                reviewFindings = await readJsonFile(findingsPath);
+            }
+            catch (error) {
+                if (!isFileMissingError(error))
+                    throw error;
+            }
+            if (reviewFindings && Array.isArray(reviewFindings)) {
+                const existing = bundle.design_assessment;
+                if (existing) {
+                    existing.review_findings = reviewFindings;
+                    existing.reviewed = true;
+                    await writeJsonFile(join(params.artifactsDir, "design_assessment.json"), existing);
+                    await unlink(findingsPath).catch(() => { });
+                    continue;
+                }
+            }
+            return {
+                kind: "design_review",
+                state,
+                bundle,
+            };
+        }
         if (decision.selected_executor === "agent") {
             return {
                 kind: "semantic_review",
@@ -1177,6 +1204,38 @@ async function cmdNextStep(argv) {
         console.log(JSON.stringify(step, null, 2));
         return;
     }
+    if (result.kind === "design_review") {
+        const designReviewResultsPath = join(artifactsDir, "incoming", "design-review-findings.json");
+        await mkdir(join(artifactsDir, "incoming"), { recursive: true });
+        const continueCommand = nextStepCommand(root, artifactsDir);
+        const prompt = renderDesignReviewPrompt(result.bundle);
+        const fullPrompt = [
+            prompt,
+            "## Results path",
+            "",
+            `Write the JSON array of findings to:`,
+            "",
+            `  ${designReviewResultsPath}`,
+            "",
+            `Then run: ${continueCommand}`,
+            "",
+        ].join("\n");
+        const step = await writeCurrentStep({
+            artifactsDir,
+            stepKind: "design_review",
+            status: "ready",
+            runId: null,
+            allowedCommands: [continueCommand],
+            stopCondition: "Write design review findings to the results path, then run next-step.",
+            repoRoot: root,
+            artifactPaths: {
+                design_review_results: designReviewResultsPath,
+            },
+            prompt: fullPrompt,
+        });
+        console.log(JSON.stringify(step, null, 2));
+        return;
+    }
     if (!hostCanDispatch) {
         const singleTaskPromptPath = join(artifactsDir, "dispatch", "current-single-task-prompt.md");
         const workerCommand = renderCommand(result.activeReviewRun.worker_command);
@@ -1426,6 +1485,18 @@ async function cmdRunToCompletion(argv) {
             const allCandidateTasks = buildPendingAuditTasks(bundle);
             const candidateGroups = chunkArray(allCandidateTasks.slice(0, parallelWorkers * agentBatchSize), agentBatchSize);
             const slotTokenEstimates = candidateGroups.map((g) => estimateTaskGroupTokens(g));
+            const providerLimits = await provider.queryLimits?.(hostModel)
+                .then((r) => r ? { ...r, source: "provider_query" } : null)
+                .catch(() => null)
+                ?? null;
+            const cachedLimits = await lookupDiscoveredLimits(providerModelKey).catch(() => null);
+            const discoveredLimits = mergeDiscoveredLimits(providerLimits, cachedLimits);
+            const halfLifeHours = sessionConfig.quota?.empirical_half_life_hours ?? 24;
+            const quotaSource = new CompositeQuotaSource([new LearnedQuotaSource(halfLifeHours)]);
+            const quotaSourceSnapshot = await quotaSource.queryCurrentUsage(providerModelKey).catch(() => null);
+            const hostConcurrencyLimit = resolveHostActiveSubagentLimit({
+                sessionConfig,
+            });
             const waveSchedule = scheduleWave({
                 providerName: resolveFreshSessionProviderName(getExplicitProvider(argv), sessionConfig),
                 sessionConfig,
@@ -1433,6 +1504,9 @@ async function cmdRunToCompletion(argv) {
                 requestedConcurrency: parallelWorkers,
                 estimatedSlotTokens: slotTokenEstimates,
                 quotaStateEntry,
+                hostConcurrencyLimit,
+                quotaSourceSnapshot,
+                discoveredLimits,
             });
             const waveSize = waveSchedule.wave_size;
             if (waveSchedule.cooldown_until) {
@@ -1615,6 +1689,27 @@ async function cmdRunToCompletion(argv) {
                     cooldown_until: rateLimitHit ? computeCooldownUntil(retryAfterMs) : null,
                 }, sessionConfig.quota?.empirical_half_life_hours ?? 24).catch(() => undefined);
             }
+            // Extract rate-limit headers from worker stderr (best-effort)
+            {
+                const extractor = getHeaderExtractorForProvider(provider.name);
+                for (const slot of workerSlots) {
+                    try {
+                        const stderr = await readFile(slot.paths.stderrPath, "utf8");
+                        const extracted = extractor.extract(stderr);
+                        if (extracted && (extracted.requests_per_minute != null || extracted.input_tokens_per_minute != null)) {
+                            await updateDiscoveredLimits(providerModelKey, {
+                                requests_per_minute: extracted.requests_per_minute,
+                                input_tokens_per_minute: extracted.input_tokens_per_minute,
+                                source: "header_extraction",
+                            });
+                            break; // one successful extraction is enough
+                        }
+                    }
+                    catch {
+                        // stderr file missing or unreadable — skip
+                    }
+                }
+            }
             if (batchErrors.length > 0) {
                 const bundleAfter = await loadArtifactBundle(artifactsDir);
                 const blockedState = buildBlockedAuditState({
@@ -2470,6 +2565,7 @@ async function prepareDispatchArtifacts(params) {
         explicitLimit: params.hostActiveSubagentLimit,
         sessionConfig,
     });
+    const dispatchCachedLimits = await lookupDiscoveredLimits(quotaProviderKey).catch(() => null);
     const waveSchedule = scheduleWave({
         providerName: quotaProviderName,
         sessionConfig,
@@ -2478,6 +2574,7 @@ async function prepareDispatchArtifacts(params) {
         estimatedSlotTokens: perPacketTokens,
         quotaStateEntry,
         hostConcurrencyLimit,
+        discoveredLimits: dispatchCachedLimits,
     });
     const dispatchQuota = {
         contract_version: "audit-code-dispatch-quota/v1alpha2",
@@ -3227,6 +3324,7 @@ async function cmdQuota(argv) {
     });
     const quotaSource = new CompositeQuotaSource([new LearnedQuotaSource(halfLifeHours)]);
     const quotaSourceSnapshot = await quotaSource.queryCurrentUsage(providerModelKey).catch(() => null);
+    const queryDiscoveredLimits = await lookupDiscoveredLimits(providerModelKey).catch(() => null);
     const waveSchedule = scheduleWave({
         providerName,
         sessionConfig,
@@ -3235,6 +3333,7 @@ async function cmdQuota(argv) {
         quotaStateEntry,
         hostConcurrencyLimit,
         quotaSourceSnapshot,
+        discoveredLimits: queryDiscoveredLimits,
     });
     console.log(JSON.stringify({
         provider: providerName,
@@ -3253,6 +3352,7 @@ async function cmdQuota(argv) {
             }
             : null,
         quota_source_snapshot: quotaSourceSnapshot,
+        discovered_limits: queryDiscoveredLimits,
         wave_schedule: waveSchedule,
         quota_state_path: getQuotaStatePath(),
     }, null, 2));

package/dist/extractors/designAssessment.d.ts

@@ -0,0 +1,11 @@
+import type { UnitManifest } from "../types.js";
+import type { DesignAssessment } from "../types/designAssessment.js";
+import type { GraphBundle } from "../types/graph.js";
+import type { CriticalFlowManifest } from "../types/flows.js";
+import type { RiskRegister } from "../types/risk.js";
+export declare function buildDesignAssessment(params: {
+    unitManifest: UnitManifest;
+    graphBundle: GraphBundle;
+    criticalFlows: CriticalFlowManifest;
+    riskRegister: RiskRegister;
+}): DesignAssessment;

package/dist/extractors/designAssessment.js

@@ -0,0 +1,254 @@
+let nextFindingId = 1;
+function findingId() {
+    return `DA-${String(nextFindingId++).padStart(3, "0")}`;
+}
+function allEdges(graphBundle) {
+    const edges = [];
+    for (const [key, value] of Object.entries(graphBundle.graphs)) {
+        if (key === "routes" || !Array.isArray(value))
+            continue;
+        for (const edge of value) {
+            if (edge && typeof edge.from === "string" && typeof edge.to === "string") {
+                edges.push(edge);
+            }
+        }
+    }
+    return edges;
+}
+function detectCycles(edges) {
+    const adjacency = new Map();
+    for (const edge of edges) {
+        if (!adjacency.has(edge.from))
+            adjacency.set(edge.from, new Set());
+        adjacency.get(edge.from).add(edge.to);
+    }
+    const cycles = [];
+    const visited = new Set();
+    const stack = new Set();
+    function dfs(node, path) {
+        if (stack.has(node)) {
+            const cycleStart = path.indexOf(node);
+            if (cycleStart >= 0) {
+                cycles.push(path.slice(cycleStart));
+            }
+            return;
+        }
+        if (visited.has(node))
+            return;
+        visited.add(node);
+        stack.add(node);
+        path.push(node);
+        for (const neighbor of adjacency.get(node) ?? []) {
+            dfs(neighbor, path);
+        }
+        path.pop();
+        stack.delete(node);
+    }
+    for (const node of adjacency.keys()) {
+        dfs(node, []);
+    }
+    return cycles;
+}
+function deduplicateCycles(cycles) {
+    const seen = new Set();
+    const unique = [];
+    for (const cycle of cycles) {
+        const normalized = [...cycle].sort().join("\0");
+        if (!seen.has(normalized)) {
+            seen.add(normalized);
+            unique.push(cycle);
+        }
+    }
+    return unique;
+}
+function detectCycleFindings(graphBundle) {
+    const edges = allEdges(graphBundle);
+    const cycles = deduplicateCycles(detectCycles(edges));
+    if (cycles.length === 0)
+        return [];
+    return cycles.slice(0, 10).map((cycle) => ({
+        id: findingId(),
+        title: `Dependency cycle: ${cycle.length} modules`,
+        category: "dependency_cycle",
+        severity: cycle.length > 4 ? "high" : "medium",
+        confidence: "high",
+        lens: "architecture",
+        summary: `Circular dependency among ${cycle.join(" → ")} → ${cycle[0]}. Cycles increase coupling, complicate testing, and can cause initialization-order bugs.`,
+        affected_files: cycle.map((path) => ({ path })),
+        systemic: true,
+    }));
+}
+function detectHubModules(graphBundle) {
+    const edges = allEdges(graphBundle);
+    const fanIn = new Map();
+    const fanOut = new Map();
+    for (const edge of edges) {
+        fanOut.set(edge.from, (fanOut.get(edge.from) ?? 0) + 1);
+        fanIn.set(edge.to, (fanIn.get(edge.to) ?? 0) + 1);
+    }
+    const allNodes = new Set([...fanIn.keys(), ...fanOut.keys()]);
+    const hubThreshold = Math.max(8, Math.ceil(allNodes.size * 0.15));
+    const findings = [];
+    for (const node of allNodes) {
+        const inCount = fanIn.get(node) ?? 0;
+        const outCount = fanOut.get(node) ?? 0;
+        if (inCount >= hubThreshold && outCount >= hubThreshold) {
+            findings.push({
+                id: findingId(),
+                title: `Hub module: ${node}`,
+                category: "hub_module",
+                severity: "medium",
+                confidence: "high",
+                lens: "architecture",
+                summary: `${node} has ${inCount} incoming and ${outCount} outgoing dependencies. Hub modules become change bottlenecks and make the dependency graph fragile.`,
+                affected_files: [{ path: node }],
+                systemic: true,
+            });
+        }
+    }
+    return findings;
+}
+function detectOrphanUnits(unitManifest, graphBundle) {
+    const edges = allEdges(graphBundle);
+    const connected = new Set();
+    for (const edge of edges) {
+        connected.add(edge.from);
+        connected.add(edge.to);
+    }
+    if (connected.size === 0)
+        return [];
+    const orphans = [];
+    for (const unit of unitManifest.units) {
+        const hasConnection = unit.files.some((file) => connected.has(file));
+        if (!hasConnection && unit.files.length > 0) {
+            orphans.push(unit.unit_id);
+        }
+    }
+    if (orphans.length === 0)
+        return [];
+    if (orphans.length > unitManifest.units.length * 0.5)
+        return [];
+    return [{
+            id: findingId(),
+            title: `${orphans.length} orphan unit(s) with no graph connections`,
+            category: "orphan_units",
+            severity: "low",
+            confidence: "medium",
+            lens: "architecture",
+            summary: `Units [${orphans.join(", ")}] have no import, call, or reference edges in the dependency graph. They may be dead code, or the graph extraction missed their connections.`,
+            affected_files: orphans.map((id) => {
+                const unit = unitManifest.units.find((u) => u.unit_id === id);
+                return { path: unit?.files[0] ?? id };
+            }),
+            systemic: true,
+        }];
+}
+function detectRiskConcentration(riskRegister, unitManifest) {
+    if (riskRegister.items.length < 4)
+        return [];
+    const sorted = [...riskRegister.items].sort((a, b) => b.risk_score - a.risk_score);
+    const topQuartileSize = Math.max(1, Math.ceil(sorted.length * 0.25));
+    const topQuartile = sorted.slice(0, topQuartileSize);
+    const totalRisk = sorted.reduce((sum, item) => sum + item.risk_score, 0);
+    const topRisk = topQuartile.reduce((sum, item) => sum + item.risk_score, 0);
+    if (totalRisk === 0)
+        return [];
+    const concentration = topRisk / totalRisk;
+    if (concentration < 0.6)
+        return [];
+    return [{
+            id: findingId(),
+            title: "Risk concentrated in top quartile of units",
+            category: "risk_concentration",
+            severity: concentration > 0.8 ? "high" : "medium",
+            confidence: "high",
+            lens: "architecture",
+            summary: `${Math.round(concentration * 100)}% of total risk score is concentrated in the top ${topQuartileSize} of ${sorted.length} units: ${topQuartile.map((i) => i.unit_id).join(", ")}. Consider decomposing high-risk units or adding isolation boundaries.`,
+            affected_files: topQuartile.flatMap((item) => {
+                const unit = unitManifest.units.find((u) => u.unit_id === item.unit_id);
+                return (unit?.files ?? [item.unit_id]).map((path) => ({ path }));
+            }),
+            systemic: true,
+        }];
+}
+function detectUnitSprawl(unitManifest) {
+    if (unitManifest.units.length < 3)
+        return [];
+    const fileCounts = unitManifest.units.map((u) => u.files.length);
+    const totalFiles = fileCounts.reduce((a, b) => a + b, 0);
+    const maxFiles = Math.max(...fileCounts);
+    const findings = [];
+    const dominantUnit = unitManifest.units.find((u) => u.files.length === maxFiles);
+    if (dominantUnit && maxFiles > totalFiles * 0.5 && totalFiles > 10) {
+        findings.push({
+            id: findingId(),
+            title: `Dominant unit: ${dominantUnit.unit_id}`,
+            category: "monolith_unit",
+            severity: "medium",
+            confidence: "medium",
+            lens: "architecture",
+            summary: `Unit ${dominantUnit.unit_id} contains ${maxFiles} of ${totalFiles} files (${Math.round((maxFiles / totalFiles) * 100)}%). A single unit this large suggests insufficient decomposition.`,
+            affected_files: dominantUnit.files.slice(0, 10).map((path) => ({ path })),
+            systemic: true,
+        });
+    }
+    if (unitManifest.units.length > 50) {
+        const smallUnits = unitManifest.units.filter((u) => u.files.length === 1);
+        if (smallUnits.length > unitManifest.units.length * 0.6) {
+            findings.push({
+                id: findingId(),
+                title: "Excessive single-file units",
+                category: "unit_fragmentation",
+                severity: "low",
+                confidence: "medium",
+                lens: "architecture",
+                summary: `${smallUnits.length} of ${unitManifest.units.length} units contain only a single file. This fragmentation may indicate that the unit grouping is too granular to reflect meaningful architectural boundaries.`,
+                affected_files: smallUnits.slice(0, 5).map((u) => ({ path: u.files[0] })),
+                systemic: true,
+            });
+        }
+    }
+    return findings;
+}
+function detectFlowGaps(criticalFlows, graphBundle) {
+    const edges = allEdges(graphBundle);
+    const connected = new Set();
+    for (const edge of edges) {
+        connected.add(edge.from);
+        connected.add(edge.to);
+    }
+    const findings = [];
+    for (const flow of criticalFlows.flows) {
+        const disconnected = flow.paths.filter((path) => !connected.has(path));
+        if (disconnected.length > 0 &&
+            disconnected.length > flow.paths.length * 0.5) {
+            findings.push({
+                id: findingId(),
+                title: `Critical flow "${flow.name}" has weak graph coverage`,
+                category: "flow_gap",
+                severity: "medium",
+                confidence: "low",
+                lens: "architecture",
+                summary: `${disconnected.length} of ${flow.paths.length} files in flow "${flow.name}" have no dependency graph edges. The flow's structural integrity cannot be verified through static analysis alone.`,
+                affected_files: disconnected.map((path) => ({ path })),
+                systemic: true,
+            });
+        }
+    }
+    return findings;
+}
+export function buildDesignAssessment(params) {
+    nextFindingId = 1;
+    const findings = [
+        ...detectCycleFindings(params.graphBundle),
+        ...detectHubModules(params.graphBundle),
+        ...detectOrphanUnits(params.unitManifest, params.graphBundle),
+        ...detectRiskConcentration(params.riskRegister, params.unitManifest),
+        ...detectUnitSprawl(params.unitManifest),
+        ...detectFlowGaps(params.criticalFlows, params.graphBundle),
+    ];
+    return {
+        generated_at: new Date().toISOString(),
+        findings,
+    };
+}

package/dist/io/artifacts.d.ts

@@ -11,6 +11,7 @@ import type { RiskRegister } from "../types/risk.js";
 import type { AuditPlanMetrics, ReviewPacket } from "../types/reviewPlanning.js";
 import type { RuntimeValidationReport, RuntimeValidationTaskManifest } from "../types/runtimeValidation.js";
 import type { SurfaceManifest } from "../types/surfaces.js";
+import type { DesignAssessment } from "../types/designAssessment.js";
 import type { ToolingManifest } from "../types/toolingManifest.js";
 type ArtifactPayloadMap = {
     repo_manifest: RepoManifest;
@@ -22,6 +23,7 @@ type ArtifactPayloadMap = {
     critical_flows: CriticalFlowManifest;
     flow_coverage: FlowCoverageManifest;
     risk_register: RiskRegister;
+    design_assessment: DesignAssessment;
     coverage_matrix: CoverageMatrix;
     runtime_validation_tasks: RuntimeValidationTaskManifest;
     runtime_validation_report: RuntimeValidationReport;
@@ -60,6 +62,7 @@ export declare const ARTIFACT_DEFINITIONS: {
     readonly critical_flows: ArtifactDefinition<"critical_flows">;
     readonly flow_coverage: ArtifactDefinition<"flow_coverage">;
     readonly risk_register: ArtifactDefinition<"risk_register">;
+    readonly design_assessment: ArtifactDefinition<"design_assessment">;
     readonly coverage_matrix: ArtifactDefinition<"coverage_matrix">;
     readonly runtime_validation_tasks: ArtifactDefinition<"runtime_validation_tasks">;
     readonly runtime_validation_report: ArtifactDefinition<"runtime_validation_report">;

package/dist/io/artifacts.js

@@ -36,6 +36,7 @@ export const ARTIFACT_DEFINITIONS = {
     critical_flows: jsonArtifact("critical_flows.json", "analysis"),
     flow_coverage: jsonArtifact("flow_coverage.json", "analysis"),
     risk_register: jsonArtifact("risk_register.json", "analysis"),
+    design_assessment: jsonArtifact("design_assessment.json", "analysis"),
     coverage_matrix: jsonArtifact("coverage_matrix.json", "execution"),
     runtime_validation_tasks: jsonArtifact("runtime_validation_tasks.json", "execution"),
     runtime_validation_report: jsonArtifact("runtime_validation_report.json", "execution"),

package/dist/orchestrator/advance.js

@@ -1,7 +1,7 @@
 import { decideNextStep } from "./nextStep.js";
 import { deriveAuditState } from "./state.js";
 import { computeArtifactMetadata } from "./artifactMetadata.js";
-import { runIntakeExecutor, runStructureExecutor, runPlanningExecutor, runResultIngestionExecutor, runRuntimeValidationExecutor, runRuntimeValidationUpdateExecutor, runSynthesisExecutor, runExternalAnalyzerImportExecutor, } from "./internalExecutors.js";
+import { runIntakeExecutor, runStructureExecutor, runPlanningExecutor, runResultIngestionExecutor, runRuntimeValidationExecutor, runRuntimeValidationUpdateExecutor, runSynthesisExecutor, runDesignAssessmentExecutor, runDesignReviewAutoComplete, runExternalAnalyzerImportExecutor, } from "./internalExecutors.js";
 import { runAutoFixExecutor } from "./autoFixExecutor.js";
 import { runSyntaxResolutionExecutor } from "./syntaxResolutionExecutor.js";
 function cloneState(state) {
@@ -53,6 +53,12 @@ export async function advanceAudit(bundle, options = {}) {
             case "structure_executor":
                 run = await runStructureExecutor(bundle, options.root);
                 break;
+            case "design_assessment_executor":
+                run = runDesignAssessmentExecutor(bundle);
+                break;
+            case "design_review":
+                run = runDesignReviewAutoComplete(bundle);
+                break;
             case "planning_executor":
                 if (!options.root)
                     throw new Error("advanceAudit planning_executor requires root");

package/dist/orchestrator/dependencyMap.js

@@ -37,6 +37,7 @@ export const ARTIFACT_DEPENDENCY_MAP = {
     ],
     "unit_manifest.json": [
         "risk_register.json",
+        "design_assessment.json",
         "coverage_matrix.json",
         "audit_tasks.json",
         "audit_plan_metrics.json",
@@ -54,6 +55,7 @@ export const ARTIFACT_DEPENDENCY_MAP = {
     "critical_flows.json": [
         "flow_coverage.json",
         "risk_register.json",
+        "design_assessment.json",
         "audit_tasks.json",
         "audit_plan_metrics.json",
         "review_packets.json",
@@ -62,6 +64,9 @@ export const ARTIFACT_DEPENDENCY_MAP = {
         "runtime_validation_report.json",
         "audit-report.md",
     ],
+    "design_assessment.json": [
+        "audit-report.md",
+    ],
     "external_analyzer_results.json": [
         "coverage_matrix.json",
         "flow_coverage.json",

package/dist/orchestrator/designReviewPrompt.d.ts

@@ -0,0 +1,2 @@
+import type { ArtifactBundle } from "../io/artifacts.js";
+export declare function renderDesignReviewPrompt(bundle: ArtifactBundle): string;