auditor-lambda 0.3.40 → 0.3.41

package/dist/cli.js

@@ -1,8 +1,6 @@
-import { mkdir, readFile, readdir, rename, rm, unlink, writeFile } from "node:fs/promises";
-import { createReadStream, existsSync } from "node:fs";
-import { Buffer } from "node:buffer";
-import { createHash } from "node:crypto";
-import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { mkdir, readFile, readdir, rename, rm, unlink } from "node:fs/promises";
+import { homedir } from "node:os";
+import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { buildRepoManifest } from "./extractors/fileInventory.js";
 import { buildFileDisposition } from "./extractors/disposition.js";
@@ -13,14 +11,14 @@ import { buildFlowCoverage } from "./orchestrator/flowCoverage.js";
 import { buildRuntimeValidationTasks, } from "./orchestrator/runtimeValidation.js";
 import { initializeCoverageFromPlan } from "./orchestrator/planning.js";
 import { loadArtifactBundle, writeCoreArtifacts, promoteFinalAuditReport, } from "./io/artifacts.js";
-import { isFileMissingError, readJsonFile, writeJsonFile } from "./io/json.js";
+import { isFileMissingError, readJsonFile, writeJsonFile, prefixValidationIssues } from "@audit-tools/shared";
 import { validateArtifactBundle } from "./validation/artifacts.js";
 import { validateAuditResults, formatAuditResultIssues, } from "./validation/auditResults.js";
-import { prefixValidationIssues } from "./validation/basic.js";
 import { validateConfiguredProviderEnvironment, validateSessionConfig, } from "./validation/sessionConfig.js";
 import { buildAuditReportModel, renderAuditReportMarkdown, } from "./reporting/synthesis.js";
 import { deriveAuditState } from "./orchestrator/state.js";
 import { advanceAudit } from "./orchestrator/advance.js";
+import { checkFileIntegrity } from "./orchestrator/fileIntegrity.js";
 import { decideNextStep } from "./orchestrator/nextStep.js";
 import { renderDesignReviewPrompt } from "./orchestrator/designReviewPrompt.js";
 import { createFreshSessionProvider, resolveFreshSessionProviderName, } from "./providers/index.js";
@@ -29,228 +27,26 @@ import { buildAuditCodeHandoff, writeAuditCodeHandoffArtifacts, } from "./superv
 import { getSessionConfigPath, loadSessionConfig, readSessionConfigFile, } from "./supervisor/sessionConfig.js";
 import { clearDispatchFiles, buildRunId, ensureSupervisorDirs, getRunPaths, writeDispatchBatchFiles, writeWorkerTaskFiles, } from "./io/runArtifacts.js";
 import { renderWorkerPrompt } from "./prompts/renderWorkerPrompt.js";
-import { buildReviewPackets, orderTasksForPacketReview, estimateTaskGroupTokens, } from "./orchestrator/reviewPackets.js";
-import { buildFileAnchorSummary, } from "./orchestrator/fileAnchors.js";
+import { estimateTaskGroupTokens, } from "./orchestrator/reviewPackets.js";
 import { LOCAL_SUBPROCESS_PROVIDER_NAME } from "./providers/constants.js";
 import { runAuditCodeMcpServer } from "./mcp/server.js";
-import { scheduleWave, buildProviderModelKey, readQuotaState, recordWaveOutcome, resolveLimits, resolveHostActiveSubagentLimit, probeProvider, computeMaxSafeConcurrency, getQuotaStatePath, detectRateLimitError, computeCooldownUntil, runSlidingWindow, LearnedQuotaSource, CompositeQuotaSource, lookupDiscoveredLimits, updateDiscoveredLimits, mergeDiscoveredLimits, getHeaderExtractorForProvider, } from "./quota/index.js";
+import { scheduleWave, buildProviderModelKey, readQuotaState, recordWaveOutcome, resolveLimits, resolveHostActiveSubagentLimit, probeProvider, computeMaxSafeConcurrency, getQuotaStatePath, detectRateLimitError, computeCooldownUntil, runSlidingWindow, LearnedQuotaSource, CompositeQuotaSource, lookupDiscoveredLimits, updateDiscoveredLimits, mergeDiscoveredLimits, getHeaderExtractorForProvider, setQuotaStateDir, } from "./quota/index.js";
+// Re-exports from extracted modules
+export { resolveHostDispatchCapability, DIRECT_CLI_DEFAULTS, getFlag, hasFlag, getOptionalBooleanFlag, getArtifactsDir, getRootDir, getBatchResultsDir, getMaxRuns, getAgentBatchSize, getParallelWorkers, getTimeoutMs, chunkArray, getUiMode, looksLikeCliFlag, countLines, warnIfNotGitRepo, } from "./cli/args.js";
+import { DIRECT_CLI_DEFAULTS, getFlag, hasFlag, getOptionalBooleanFlag, fromBase64Url, renderCommand, summarizeLaunchExit, taskResultPath, readStdinText, getArtifactsDir, getRootDir, warnIfNotGitRepo, getBatchResultsDir, getMaxRuns, getAgentBatchSize, getParallelWorkers, getTimeoutMs, getExplicitProvider, getHostModel, getHostMaxActiveSubagents, getQuotaProbeMode, resolveRunProviderName, chunkArray, getUiMode, looksLikeCliFlag, resolveHostDispatchCapability, countLines, listBatchResultFiles, } from "./cli/args.js";
+import { nextStepCommand, mergeAndIngestCommand, renderDispatchReviewPrompt, renderSingleTaskFallbackStepPrompt, renderPresentReportPrompt, renderBlockedStepPrompt, } from "./cli/prompts.js";
+import { writeCurrentStep, } from "./cli/steps.js";
+import { WORKER_RESULT_CONTRACT_VERSION, buildWorkerResult, persistWorkerRunArtifacts, isWorkerResult, buildWorkerFailureBlocker, formatAuditResultValidationError, } from "./cli/workerResult.js";
+import { DISPATCH_RESULT_MAP_FILENAME, ACTIVE_DISPATCH_FILENAME, resolveRunScopedArg, loadDispatchResultMap, entriesByTaskId, buildPendingAuditTasks, prepareDispatchArtifacts, } from "./cli/dispatch.js";
+import { readWaveManifest, writeWaveManifest, removeWaveManifest, buildWaveSlotEntry, } from "./cli/waveManifest.js";
 const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const ADVANCE_AUDIT_CONTRACT_VERSION = "audit-code/v1alpha1";
-const WORKER_RESULT_CONTRACT_VERSION = "audit-code-worker-result/v1alpha1";
-const STEP_CONTRACT_VERSION = "audit-code-step/v1alpha1";
-const LARGE_FILE_PACKET_TARGET_LINES = 2500;
-const SMALL_MODEL_HINT_MAX_LINES = 500;
-const SMALL_MODEL_HINT_MAX_ESTIMATED_TOKENS = 3000;
-const DEEP_MODEL_HINT_MIN_ESTIMATED_TOKENS = 9000;
-const DIRECT_CLI_DEFAULTS = {
-    rootDir: ".",
-    artifactsDir: ".artifacts",
-    maxRuns: 1000,
-    agentBatchSize: 6,
-    parallelWorkers: 1,
-    timeoutMs: 30 * 60 * 1000, // 30 minutes
-    uiMode: "headless",
-};
-// Keep the sample-run payload explicit so the demo command is deterministic.
 const SAMPLE_REPO_FILES = [
     { path: "src/api/auth.ts", size_bytes: 1240, hash: "abc123" },
     { path: "src/lib/session.ts", size_bytes: 980, hash: "def456" },
     { path: "infra/deploy.yml", size_bytes: 420, hash: "ghi789" },
     { path: "docs/notes.md", size_bytes: 300, hash: "doc111" },
 ];
-function isLongFlagToken(value) {
-    return typeof value === "string" && value.startsWith("--");
-}
-// Read a long-form CLI flag while treating a following flag token as "missing".
-function getFlag(argv, name, fallback) {
-    const index = argv.indexOf(name);
-    if (index < 0)
-        return fallback;
-    const candidate = argv[index + 1];
-    if (!candidate || isLongFlagToken(candidate))
-        return fallback;
-    return candidate;
-}
-// Boolean flags only care whether the token is present at all.
-function hasFlag(argv, name) {
-    return argv.includes(name);
-}
-function getOptionalBooleanFlag(argv, name) {
-    const raw = getFlag(argv, name);
-    if (raw === undefined) {
-        return undefined;
-    }
-    if (raw === "true") {
-        return true;
-    }
-    if (raw === "false") {
-        return false;
-    }
-    throw new Error(`${name} must be either true or false.`);
-}
-function optionalBooleanEnv(value) {
-    if (value === "true")
-        return true;
-    if (value === "false")
-        return false;
-    return undefined;
-}
-export function resolveHostDispatchCapability(options) {
-    if (options.explicit !== undefined) {
-        return options.explicit;
-    }
-    if (options.sessionConfig.host_can_dispatch_subagents !== undefined) {
-        return options.sessionConfig.host_can_dispatch_subagents;
-    }
-    return optionalBooleanEnv((options.env ?? process.env).AUDIT_CODE_HOST_CAN_DISPATCH) ?? true;
-}
-function toBase64Url(value) {
-    return Buffer.from(value, "utf8").toString("base64url");
-}
-function fromBase64Url(value) {
-    return Buffer.from(value, "base64url").toString("utf8");
-}
-function digestId(value) {
-    return createHash("sha256").update(value).digest("hex").slice(0, 12);
-}
-function safeArtifactStem(value) {
-    const sanitized = value
-        .replace(/[^a-zA-Z0-9_-]+/g, "_")
-        .replace(/^_+|_+$/g, "")
-        .slice(0, 80);
-    return sanitized.length > 0 ? sanitized : "artifact";
-}
-function artifactNameForId(value, extension) {
-    return `${safeArtifactStem(value)}_${digestId(value)}.${extension}`;
-}
-function quoteCommandArg(value) {
-    return /[\s"]/u.test(value) ? `"${value.replace(/"/g, '\\"')}"` : value;
-}
-function renderCommand(argv) {
-    return argv.map((item) => quoteCommandArg(item)).join(" ");
-}
-function summarizeLaunchExit(result) {
-    if (result.accepted !== false && !result.error) {
-        return null;
-    }
-    const parts = [
-        result.signal
-            ? `signal ${result.signal}`
-            : `exit code ${result.exitCode ?? "unknown"}`,
-        result.command ? `command: ${result.command}` : null,
-        result.stdoutPath ? `stdout: ${result.stdoutPath}` : null,
-        result.stderrPath ? `stderr: ${result.stderrPath}` : null,
-        result.error ?? null,
-    ].filter((part) => Boolean(part));
-    return parts.join("; ");
-}
-function taskResultPath(taskResultsDir, taskId) {
-    return join(taskResultsDir, artifactNameForId(taskId, "json"));
-}
-function packetPromptPath(taskResultsDir, packetId) {
-    return join(taskResultsDir, artifactNameForId(packetId, "prompt.md"));
-}
-async function readStdinText() {
-    if (process.stdin.isTTY) {
-        return "";
-    }
-    return await new Promise((resolveInput, reject) => {
-        let input = "";
-        process.stdin.setEncoding("utf8");
-        process.stdin.on("data", (chunk) => {
-            input += chunk;
-        });
-        process.stdin.on("end", () => resolveInput(input));
-        process.stdin.on("error", reject);
-    });
-}
-function resolveFlagPath(argv, name, fallback) {
-    return resolve(getFlag(argv, name, fallback));
-}
-function normalizePositiveInteger(value) {
-    if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) {
-        return undefined;
-    }
-    return Math.floor(value);
-}
-function parsePositiveIntegerFlag(argv, name) {
-    const raw = getFlag(argv, name);
-    if (raw === undefined) {
-        return undefined;
-    }
-    return normalizePositiveInteger(Number(raw));
-}
-function getArtifactsDir(argv) {
-    return resolveFlagPath(argv, "--artifacts-dir", DIRECT_CLI_DEFAULTS.artifactsDir);
-}
-function getRootDir(argv) {
-    return resolveFlagPath(argv, "--root", DIRECT_CLI_DEFAULTS.rootDir);
-}
-function warnIfNotGitRepo(root) {
-    const gitEntry = join(root, ".git");
-    if (!existsSync(gitEntry)) {
-        console.warn(`Warning: target directory '${root}' does not appear to be a git repository. Diff-based signals will be unavailable.`);
-    }
-}
-function getBatchResultsDir(argv) {
-    const value = getFlag(argv, "--batch-results");
-    return value ? resolve(value) : undefined;
-}
-function getMaxRuns(argv) {
-    return parsePositiveIntegerFlag(argv, "--max-runs") ?? DIRECT_CLI_DEFAULTS.maxRuns;
-}
-function getAgentBatchSize(argv, sessionConfig) {
-    return (parsePositiveIntegerFlag(argv, "--agent-batch-size") ??
-        normalizePositiveInteger(sessionConfig.agent_task_batch_size) ??
-        DIRECT_CLI_DEFAULTS.agentBatchSize);
-}
-function getParallelWorkers(argv, sessionConfig) {
-    return (parsePositiveIntegerFlag(argv, "--parallel") ??
-        normalizePositiveInteger(sessionConfig.parallel_workers) ??
-        DIRECT_CLI_DEFAULTS.parallelWorkers);
-}
-function getTimeoutMs(argv, sessionConfig) {
-    return (parsePositiveIntegerFlag(argv, "--timeout") ??
-        normalizePositiveInteger(sessionConfig.timeout_ms) ??
-        DIRECT_CLI_DEFAULTS.timeoutMs);
-}
-function getExplicitProvider(argv) {
-    return getFlag(argv, "--provider");
-}
-function getHostModel(argv) {
-    return getFlag(argv, "--host-model") ?? null;
-}
-function getHostMaxActiveSubagents(argv) {
-    return parsePositiveIntegerFlag(argv, "--host-max-active-subagents") ?? null;
-}
-function getQuotaProbeMode(argv, sessionConfig) {
-    const raw = getFlag(argv, "--quota-probe") ?? sessionConfig.quota?.probe ?? "auto";
-    if (raw === "auto" || raw === "never" || raw === "force")
-        return raw;
-    return "auto";
-}
-function resolveRunProviderName(argv, sessionConfig) {
-    return resolveFreshSessionProviderName(getExplicitProvider(argv), sessionConfig);
-}
-function chunkArray(arr, size) {
-    const chunkSize = normalizePositiveInteger(size);
-    if (chunkSize === undefined) {
-        throw new Error("chunkArray size must be a positive integer.");
-    }
-    const chunks = [];
-    for (let i = 0; i < arr.length; i += chunkSize) {
-        chunks.push(arr.slice(i, i + chunkSize));
-    }
-    return chunks;
-}
-function getUiMode(argv, fallback = DIRECT_CLI_DEFAULTS.uiMode) {
-    const raw = getFlag(argv, "--ui");
-    if (raw === "visible")
-        return "visible";
-    if (raw === "headless")
-        return "headless";
-    return fallback;
-}
 function buildEnvelope(params) {
     return {
         contract_version: ADVANCE_AUDIT_CONTRACT_VERSION,
@@ -312,30 +108,6 @@ function buildBlockedAuditState(params) {
             : item),
     };
 }
-async function countLines(path) {
-    return new Promise((resolve, reject) => {
-        let lines = 0;
-        let byteCount = 0;
-        let lastByte = -1;
-        const stream = createReadStream(path);
-        stream.on("data", (chunk) => {
-            const buffer = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
-            byteCount += buffer.length;
-            for (let i = 0; i < buffer.length; ++i) {
-                if (buffer[i] === 10)
-                    lines++;
-                lastByte = buffer[i];
-            }
-        });
-        stream.on("end", () => {
-            if (byteCount === 0)
-                return resolve(0);
-            // Files not ending with \n have one final line not counted above
-            resolve(lastByte !== 10 ? lines + 1 : lines);
-        });
-        stream.on("error", reject);
-    });
-}
 async function buildLineIndex(root, repoManifest) {
     const entries = [];
     const batchSize = 25;
@@ -368,26 +140,6 @@ async function buildLineIndexForPaths(root, paths) {
     }));
     return Object.fromEntries(entries);
 }
-async function listBatchResultFiles(batchDir) {
-    const entries = await readdir(batchDir, { withFileTypes: true });
-    const files = entries
-        .filter((entry) => entry.isFile() && entry.name.toLowerCase().endsWith(".json"))
-        .map((entry) => join(batchDir, entry.name))
-        .sort((a, b) => a.localeCompare(b));
-    if (files.length === 0) {
-        throw new Error(`No JSON audit result files found in ${batchDir}.`);
-    }
-    return files;
-}
-function buildPendingAuditTasks(bundle) {
-    const completedTaskIds = new Set((bundle.audit_results ?? []).map((result) => result.task_id));
-    const pendingTasks = (bundle.audit_tasks ?? []).filter((task) => task.status !== "complete" && !completedTaskIds.has(task.task_id));
-    const lineIndex = Object.fromEntries(pendingTasks.flatMap((task) => Object.entries(task.file_line_counts ?? {})));
-    return orderTasksForPacketReview(pendingTasks, {
-        graphBundle: bundle.graph_bundle,
-        lineIndex,
-    });
-}
 async function addFileLineCountHints(root, tasks) {
     const lineIndex = await buildLineIndexForPaths(root, tasks.flatMap((task) => task.file_paths));
     return tasks.map((task) => ({
@@ -477,6 +229,11 @@ async function ensureSemanticReviewRun(params) {
     const pendingTasks = await addFileLineCountHints(params.root, buildPendingAuditTasks(params.bundle));
     const pendingTasksPath = join(paths.runDir, "pending-audit-tasks.json");
     const auditResultsPath = join(paths.runDir, "audit-results.json");
+    const taskReadPaths = new Set();
+    for (const pt of pendingTasks) {
+        for (const fp of pt.file_paths)
+            taskReadPaths.add(fp);
+    }
     const task = {
         contract_version: "audit-code-worker/v1alpha1",
         run_id: runId,
@@ -496,6 +253,10 @@ async function ensureSemanticReviewRun(params) {
         pending_audit_tasks_path: pendingTasksPath,
         timeout_ms: params.timeoutMs,
         max_retries: 0,
+        access: {
+            read_paths: [...taskReadPaths],
+            write_paths: [auditResultsPath, paths.resultPath],
+        },
     };
     const prompt = renderWorkerPrompt(task);
     await writeWorkerTaskFiles(task, prompt, paths, params.artifactsDir, pendingTasks);
@@ -519,174 +280,6 @@ async function ensureSemanticReviewRun(params) {
     });
     return { state: blockedState, bundle: blockedBundle, activeReviewRun };
 }
-function nextStepCommand(root, artifactsDir, extraArgs = []) {
-    return renderCommand([
-        "audit-code",
-        "next-step",
-        "--root",
-        root,
-        "--artifacts-dir",
-        artifactsDir,
-        ...extraArgs,
-    ]);
-}
-function mergeAndIngestCommand(artifactsDir, runId) {
-    return renderCommand([
-        "audit-code",
-        "merge-and-ingest",
-        "--run-id",
-        runId,
-        "--artifacts-dir",
-        artifactsDir,
-    ]);
-}
-function renderDispatchReviewPrompt(params) {
-    const mergeCommand = mergeAndIngestCommand(params.artifactsDir, params.activeReviewRun.run_id);
-    const continueCommand = nextStepCommand(params.root, params.artifactsDir);
-    const modelLine = params.hostCanSelectSubagentModel
-        ? "When launching each subagent, map `entry.model_hint.tier` (`small`, `standard`, `deep`) to an available host model without asking the user for model names."
-        : "Ignore `entry.model_hint`; this host did not report per-subagent model selection.";
-    const toolsLine = params.hostCanRestrictSubagentTools
-        ? "Restrict review subagents to read/search plus the packet submit command named in their prompt. Do not give them source edit/write tools."
-        : "Do not ask the user about per-subagent tool restrictions; this host did not report a callable restriction facility.";
-    const dispatchDataLines = params.dispatchQuotaPath
-        ? [
-            "Read these generated files unless the current tool response already included equivalent `dispatch_plan_entries` and `dispatch_quota` fields:",
-            "",
-            `  Dispatch plan:  ${params.dispatchPlanPath}`,
-            `  Dispatch quota: ${params.dispatchQuotaPath}`,
-            "",
-            "Use the `wave_size` from the quota data. If `cooldown_until` is non-null, wait until that timestamp before starting the first wave.",
-            "",
-            "`host_concurrency_limit` records any detected hard host cap that contributed to `wave_size`.",
-            "",
-            "For each wave: use the `task` tool (or equivalent subagent dispatch) to launch up to `wave_size` subagents in parallel (one per entry), wait for all to finish, then start the next wave.",
-        ]
-        : [
-            "Read this generated dispatch plan unless the current tool response already included equivalent `dispatch_plan_entries`:",
-            "",
-            `  ${params.dispatchPlanPath}`,
-            "",
-            "Launch one subagent for each entry in the plan.",
-        ];
-    return [
-        "# audit-code dispatch review",
-        "",
-        ...dispatchDataLines,
-        "",
-        "Pass each `entry.prompt_path` literally to its subagent; do not load packet prompt files into this orchestrator context.",
-        "",
-        "Subagent prompt shape:",
-        "",
-        '  Read and follow the audit instructions in: <entry.prompt_path>',
-        "",
-        modelLine,
-        toolsLine,
-        "",
-        "Each subagent must submit its packet through the submit command printed in its packet prompt and stop after successful submission.",
-        "",
-        "**After all waves complete:**",
-        "",
-        "Run exactly:",
-        "",
-        `  ${mergeCommand}`,
-        "",
-        "If merge-and-ingest fails, stop and report the exact command and error output. Do not manually merge results or edit audit state.",
-        "",
-        "If merge-and-ingest succeeds, run:",
-        "",
-        `  ${continueCommand}`,
-        "",
-        "Read and follow only the new step prompt path returned by that command.",
-        "",
-    ].join("\n");
-}
-function renderSingleTaskFallbackStepPrompt(params) {
-    return [
-        "# audit-code single-task fallback step",
-        "",
-        "Use this step only because the host reported no callable subagent facility.",
-        "",
-        "Read and follow exactly this generated single-task prompt:",
-        "",
-        `  ${params.singleTaskPromptPath}`,
-        "",
-        "Complete exactly one AuditResult for the task named there, write the JSON array to the prompt's audit_results_path, run the exact worker_command from that prompt, then stop.",
-        "",
-        "Do not run dispatch commands, do not prepare packets, do not run next-step again in this turn, and do not read a report after the worker command.",
-        "",
-        "The only backend command allowed after writing the result is:",
-        "",
-        `  ${renderCommand(params.activeReviewRun.worker_command)}`,
-        "",
-    ].join("\n");
-}
-function renderPresentReportPrompt(finalReportPath) {
-    return [
-        "# audit-code present report",
-        "",
-        "The deterministic audit is complete.",
-        "",
-        "Read the final audit report from the `audit-code://report/current` MCP resource (or from the file at:",
-        `  ${finalReportPath}`,
-        "if a Read tool is available).",
-        "",
-        "Present the completed audit with work blocks first.",
-        "",
-        "Do not run the orchestrator again for this completed audit.",
-        "",
-    ].join("\n");
-}
-function renderBlockedStepPrompt(reason) {
-    return [
-        "# audit-code blocked",
-        "",
-        "The audit cannot continue automatically from this step.",
-        "",
-        "Report this blocker verbatim and stop:",
-        "",
-        reason,
-        "",
-    ].join("\n");
-}
-async function writeCurrentStep(params) {
-    const stepsDir = join(params.artifactsDir, "steps");
-    await mkdir(stepsDir, { recursive: true });
-    const promptPath = join(stepsDir, "current-prompt.md");
-    const stepPath = join(stepsDir, "current-step.json");
-    await writeFile(promptPath, params.prompt, "utf8");
-    const step = {
-        contract_version: STEP_CONTRACT_VERSION,
-        step_kind: params.stepKind,
-        prompt_path: promptPath,
-        status: params.status,
-        run_id: params.runId,
-        allowed_commands: params.allowedCommands,
-        stop_condition: params.stopCondition,
-        repo_root: params.repoRoot,
-        artifacts_dir: params.artifactsDir,
-        artifact_paths: {
-            current_step: stepPath,
-            current_prompt: promptPath,
-            ...params.artifactPaths,
-        },
-    };
-    await writeJsonFile(stepPath, step);
-    return step;
-}
-function formatAuditResultValidationError(issues) {
-    return (`audit-results validation failed with ${issues.length} error(s):\n` +
-        formatAuditResultIssues(issues));
-}
-function buildWorkerFailureBlocker(workerResult) {
-    const details = workerResult.errors.filter((error) => error.trim().length > 0);
-    return details.length > 0
-        ? `${workerResult.summary} ${details.join(" ")}`
-        : workerResult.summary;
-}
-function looksLikeCliFlag(value) {
-    return isLongFlagToken(value);
-}
 export const cliTestUtils = {
     defaults: DIRECT_CLI_DEFAULTS,
     getFlag,
@@ -757,6 +350,7 @@ async function runAuditStep(options) {
         runtimeValidationUpdates,
         externalAnalyzerResults,
         preferredExecutor: options.preferredExecutor,
+        opentoken: options.opentoken,
     });
     await writeCoreArtifacts(options.artifactsDir, result.updated_bundle);
     const archivedPendingResults = await maybeArchiveLegacyPendingResults(options.auditResultsPath);
@@ -805,29 +399,6 @@ async function ingestBatchAuditResults(options) {
         next_likely_step: state.status === "complete" ? null : decision.selected_obligation,
     };
 }
-function buildWorkerResult(params) {
-    return {
-        contract_version: WORKER_RESULT_CONTRACT_VERSION,
-        run_id: params.runId,
-        obligation_id: params.obligationId,
-        status: params.status,
-        progress_made: params.progressMade,
-        selected_executor: params.selectedExecutor,
-        artifacts_written: params.artifactsWritten,
-        summary: params.summary,
-        next_likely_step: params.nextLikelyStep,
-        errors: params.errors,
-    };
-}
-async function persistWorkerRunArtifacts(paths, workerResult, executionMode) {
-    await writeJsonFile(paths.resultPath, workerResult);
-    await writeJsonFile(paths.statusPath, {
-        run_id: workerResult.run_id,
-        status: workerResult.status,
-        execution_mode: executionMode,
-        result_path: paths.resultPath,
-    });
-}
 async function persistConfigErrorHandoff(params) {
     const bundle = await loadArtifactBundle(params.artifactsDir);
     const blockedState = buildBlockedAuditState({
@@ -850,12 +421,6 @@ async function persistConfigErrorHandoff(params) {
     });
     await writeAuditCodeHandoffArtifacts(handoff);
 }
-function isWorkerResult(value) {
-    return (typeof value === "object" &&
-        value !== null &&
-        value.contract_version ===
-            WORKER_RESULT_CONTRACT_VERSION);
-}
 export async function runSample(argv = process.argv) {
     const repoManifest = buildRepoManifest("sample-repo", SAMPLE_REPO_FILES);
     const disposition = buildFileDisposition(repoManifest);
@@ -990,6 +555,7 @@ async function cmdAdvanceAudit(argv) {
         auditResultsPath: getFlag(argv, "--results"),
         runtimeUpdatesPath: getFlag(argv, "--updates"),
         externalAnalyzerPath,
+        opentoken: sessionConfig.opentoken?.enabled,
     });
     if (result.selected_executor !== "agent") {
         await clearDispatchFiles(artifactsDir);
@@ -1039,6 +605,22 @@ async function runDeterministicForNextStep(params) {
                     : join(params.artifactsDir, "audit-report.md"),
             };
         }
+        if (index === 0 && bundle.repo_manifest) {
+            const pendingTasks = buildPendingAuditTasks(bundle);
+            const taskFiles = new Set();
+            for (const task of pendingTasks) {
+                for (const fp of Object.keys(task.file_line_counts ?? {}))
+                    taskFiles.add(fp);
+            }
+            if (taskFiles.size > 0) {
+                const integrity = await checkFileIntegrity(params.root, bundle.repo_manifest, [...taskFiles]);
+                if (!integrity.is_clean) {
+                    console.log(`File integrity check: ${integrity.changed_files.length} changed, ${integrity.missing_files.length} missing — re-running intake.`);
+                    await advanceAudit(bundle, { root: params.root, preferredExecutor: "intake_executor", opentoken: params.opentoken });
+                    continue;
+                }
+            }
+        }
         if (decision.selected_executor === "design_review") {
             const findingsPath = join(params.artifactsDir, "incoming", "design-review-findings.json");
             let reviewFindings;
@@ -1095,11 +677,42 @@ async function runDeterministicForNextStep(params) {
                 reason: lastSummary || decision.reason,
             };
         }
-        const result = await runAuditStep({
-            root: params.root,
-            artifactsDir: params.artifactsDir,
-        });
+        let result;
+        try {
+            result = await runAuditStep({
+                root: params.root,
+                artifactsDir: params.artifactsDir,
+                opentoken: params.opentoken,
+            });
+        }
+        catch (error) {
+            const current = await loadArtifactBundle(params.artifactsDir);
+            const currentState = deriveAuditState(current);
+            currentState.last_executor = decision.selected_executor ?? undefined;
+            currentState.last_obligation = decision.selected_obligation ?? undefined;
+            await writeCoreArtifacts(params.artifactsDir, { ...current, audit_state: currentState });
+            await writeJsonFile(join(params.artifactsDir, "steps", "deterministic-progress.json"), {
+                iteration: index + 1,
+                max_runs: params.maxRuns,
+                last_executor: decision.selected_executor,
+                last_obligation: decision.selected_obligation,
+                prior_summary: lastSummary || null,
+                error: error instanceof Error ? error.message : String(error),
+                timestamp: new Date().toISOString(),
+            });
+            const detail = error instanceof Error ? error.message : String(error);
+            throw new Error(`Deterministic executor ${decision.selected_executor} failed on obligation ${decision.selected_obligation} (iteration ${index + 1}/${params.maxRuns}, prior progress: ${lastSummary || "none"}): ${detail}`, { cause: error instanceof Error ? error : undefined });
+        }
         lastSummary = result.progress_summary;
+        await writeJsonFile(join(params.artifactsDir, "steps", "deterministic-progress.json"), {
+            iteration: index + 1,
+            max_runs: params.maxRuns,
+            last_executor: result.selected_executor,
+            last_obligation: decision.selected_obligation,
+            progress_made: result.progress_made,
+            summary: result.progress_summary,
+            timestamp: new Date().toISOString(),
+        });
         if (result.selected_executor !== "agent") {
             await clearDispatchFiles(params.artifactsDir);
         }
@@ -1169,6 +782,7 @@ async function cmdNextStep(argv) {
         selfCliPath: resolve(argv[1] ?? process.argv[1] ?? ""),
         timeoutMs: getTimeoutMs(argv, sessionConfig),
         maxRuns: getMaxRuns(argv),
+        opentoken: sessionConfig.opentoken?.enabled,
     });
     if (result.kind === "complete") {
         const step = await writeCurrentStep({
@@ -1258,11 +872,16 @@ async function cmdNextStep(argv) {
                 singleTaskPromptPath,
                 activeReviewRun: result.activeReviewRun,
             }),
+            access: {
+                read_paths: [singleTaskPromptPath],
+                write_paths: [result.activeReviewRun.audit_results_path],
+            },
         });
         console.log(JSON.stringify(step, null, 2));
         return;
     }
     const dispatch = await prepareDispatchArtifacts({
+        packageRoot,
         runId: result.activeReviewRun.run_id,
         artifactsDir,
         root,
@@ -1299,6 +918,13 @@ async function cmdNextStep(argv) {
             hostCanRestrictSubagentTools,
             hostCanSelectSubagentModel,
         }),
+        access: {
+            read_paths: [
+                dispatch.dispatch_plan_path,
+                ...(dispatch.dispatch_quota_path ? [dispatch.dispatch_quota_path] : []),
+            ],
+            write_paths: [],
+        },
     });
     console.log(JSON.stringify(step, null, 2));
 }
@@ -1349,6 +975,38 @@ async function cmdRunToCompletion(argv) {
     while (runCount < maxRuns) {
         const bundle = await loadArtifactBundle(artifactsDir);
         const decision = decideNextStep(bundle);
+        // Resume interrupted parallel wave: ingest any results that workers
+        // wrote before the previous process exited.
+        const priorWave = await readWaveManifest(artifactsDir);
+        if (priorWave) {
+            process.stderr.write(`[audit-code] Recovering interrupted wave (${priorWave.slots.length} slot(s), obligation ${priorWave.obligation_id}).\n`);
+            let recoveredProgress = false;
+            for (const entry of priorWave.slots) {
+                try {
+                    const results = await readJsonFile(entry.audit_results_path);
+                    if (!results || results.length === 0)
+                        continue;
+                    const stepResult = await runAuditStep({
+                        root,
+                        artifactsDir,
+                        preferredExecutor: "result_ingestion_executor",
+                        auditResultsPath: entry.audit_results_path,
+                    });
+                    if (stepResult.progress_made) {
+                        recoveredProgress = true;
+                        anyProgress = true;
+                        for (const a of stepResult.artifacts_written)
+                            artifactsWritten.add(a);
+                    }
+                }
+                catch {
+                    process.stderr.write(`[audit-code] Skipping unreadable results for ${entry.run_id}.\n`);
+                }
+            }
+            await removeWaveManifest(artifactsDir);
+            if (recoveredProgress)
+                continue;
+        }
         if (decision.selected_executor === "agent" &&
             bundle.audit_tasks?.some((t) => t.tags?.includes("selective_deepening") &&
                 t.status !== "complete") &&
@@ -1402,6 +1060,11 @@ async function cmdRunToCompletion(argv) {
             const blockPendingTasks = await addFileLineCountHints(root, buildPendingAuditTasks(bundle));
             const blockPendingTasksPath = join(blockPaths.runDir, "pending-audit-tasks.json");
             const blockAuditResultsPath = join(blockPaths.runDir, "audit-results.json");
+            const blockReadPaths = new Set();
+            for (const pt of blockPendingTasks) {
+                for (const fp of pt.file_paths)
+                    blockReadPaths.add(fp);
+            }
             const blockTask = {
                 contract_version: "audit-code-worker/v1alpha1",
                 run_id: blockRunId,
@@ -1421,6 +1084,10 @@ async function cmdRunToCompletion(argv) {
                 pending_audit_tasks_path: blockPendingTasksPath,
                 timeout_ms: timeoutMs,
                 max_retries: 0,
+                access: {
+                    read_paths: [...blockReadPaths],
+                    write_paths: [blockAuditResultsPath, blockPaths.resultPath],
+                },
             };
             const blockPrompt = renderWorkerPrompt(blockTask);
             await writeWorkerTaskFiles(blockTask, blockPrompt, blockPaths, artifactsDir, blockPendingTasks);
@@ -1526,6 +1193,11 @@ async function cmdRunToCompletion(argv) {
                 const slotPaths = getRunPaths(artifactsDir, slotRunId);
                 const slotAuditResultsPath = join(slotPaths.runDir, "audit-results.json");
                 const slotPendingTasksPath = join(slotPaths.runDir, "pending-audit-tasks.json");
+                const slotReadPaths = new Set();
+                for (const t of group) {
+                    for (const fp of t.file_paths)
+                        slotReadPaths.add(fp);
+                }
                 const slotTask = {
                     contract_version: "audit-code-worker/v1alpha1",
                     run_id: slotRunId,
@@ -1540,6 +1212,10 @@ async function cmdRunToCompletion(argv) {
                     worker_command_mode: "deferred",
                     timeout_ms: timeoutMs,
                     max_retries: 0,
+                    access: {
+                        read_paths: [...slotReadPaths],
+                        write_paths: [slotAuditResultsPath, slotPaths.resultPath],
+                    },
                 };
                 const slotPrompt = renderWorkerPrompt(slotTask);
                 await writeWorkerTaskFiles(slotTask, slotPrompt, slotPaths, artifactsDir, group, { updateDispatch: false });
@@ -1556,6 +1232,12 @@ async function cmdRunToCompletion(argv) {
                 pending_audit_tasks_path: slot.pendingTasksPath,
             })), workerSlots.flatMap((slot) => slot.group));
             const parallelStartedAt = new Date().toISOString();
+            await writeWaveManifest(artifactsDir, {
+                obligation_id: obligationId ?? "unknown",
+                started_at: parallelStartedAt,
+                pid: process.pid,
+                slots: workerSlots.map(buildWaveSlotEntry),
+            });
             const { results: launchResults } = await runSlidingWindow(workerSlots.map((slot) => () => provider.launch({
                 repoRoot: root,
                 runId: slot.runId,
@@ -1710,6 +1392,7 @@ async function cmdRunToCompletion(argv) {
                     }
                 }
             }
+            await removeWaveManifest(artifactsDir);
             if (batchErrors.length > 0) {
                 const bundleAfter = await loadArtifactBundle(artifactsDir);
                 const blockedState = buildBlockedAuditState({
@@ -1884,6 +1567,13 @@ async function cmdRunToCompletion(argv) {
         const providerAuditResultsPath = preferredExecutor === "agent"
             ? join(paths.runDir, "audit-results.json")
             : auditResultsPath;
+        const providerReadPaths = new Set();
+        if (pendingAuditTasks) {
+            for (const pt of pendingAuditTasks) {
+                for (const fp of pt.file_paths)
+                    providerReadPaths.add(fp);
+            }
+        }
         const task = {
             contract_version: "audit-code-worker/v1alpha1",
             run_id: runId,
@@ -1905,6 +1595,10 @@ async function cmdRunToCompletion(argv) {
             external_analyzer_results_path: externalAnalyzerPath,
             timeout_ms: timeoutMs,
             max_retries: 0,
+            access: providerReadPaths.size > 0 ? {
+                read_paths: [...providerReadPaths],
+                write_paths: [providerAuditResultsPath ?? paths.resultPath, paths.resultPath],
+            } : undefined,
         };
         const prompt = renderWorkerPrompt(task);
         await writeWorkerTaskFiles(task, prompt, paths, artifactsDir, pendingAuditTasks);
@@ -2141,520 +1835,12 @@ async function cmdWorkerRun(argv) {
         process.exitCode = 1;
     }
 }
-const DISPATCH_RESULT_MAP_FILENAME = "dispatch-result-map.json";
-const ACTIVE_DISPATCH_FILENAME = "active-dispatch.json";
-function dispatchResultMapPath(runDir) {
-    return join(runDir, DISPATCH_RESULT_MAP_FILENAME);
-}
-function resolveRunScopedArg(argv, rawFlag, b64Flag) {
-    const raw = getFlag(argv, rawFlag);
-    const encoded = getFlag(argv, b64Flag);
-    return raw ?? (encoded ? fromBase64Url(encoded) : undefined);
-}
-async function loadDispatchResultMap(runDir) {
-    try {
-        return await readJsonFile(dispatchResultMapPath(runDir));
-    }
-    catch (error) {
-        if (!isFileMissingError(error)) {
-            throw error;
-        }
-        return null;
-    }
-}
-function entriesByTaskId(entries) {
-    return new Map(entries.map((entry) => [entry.task_id, entry]));
-}
-function isIsolatedLargeFilePacket(packet) {
-    return (packet.file_paths.length === 1 &&
-        packet.total_lines > LARGE_FILE_PACKET_TARGET_LINES);
-}
-function buildDispatchComplexity(packet, largeFileMode) {
-    return {
-        priority: packet.priority,
-        task_count: packet.task_ids.length,
-        file_count: packet.file_paths.length,
-        total_lines: packet.total_lines,
-        estimated_tokens: packet.estimated_tokens,
-        lenses: packet.lenses,
-        tags: packet.tags ?? [],
-        large_file_mode: largeFileMode,
-    };
-}
-function buildDispatchModelHint(complexity) {
-    const deepReasons = [];
-    if (complexity.priority === "high")
-        deepReasons.push("high_priority");
-    if (complexity.large_file_mode)
-        deepReasons.push("isolated_large_file");
-    if (complexity.estimated_tokens >= DEEP_MODEL_HINT_MIN_ESTIMATED_TOKENS) {
-        deepReasons.push("high_estimated_tokens");
-    }
-    if (complexity.tags.some((tag) => tag === "critical_flow" || tag.startsWith("critical_flow:"))) {
-        deepReasons.push("critical_flow");
-    }
-    if (complexity.tags.some((tag) => tag === "external_analyzer_signal" || tag.startsWith("external_tool:"))) {
-        deepReasons.push("external_analyzer_signal");
-    }
-    if (complexity.tags.includes("lens_verification")) {
-        deepReasons.push("lens_verification");
-    }
-    if (deepReasons.length > 0) {
-        return { tier: "deep", reasons: deepReasons };
-    }
-    const sensitiveLenses = new Set(["security", "data_integrity", "reliability"]);
-    const hasSensitiveLens = complexity.lenses.some((lens) => sensitiveLenses.has(lens));
-    if (complexity.priority === "low" &&
-        complexity.total_lines <= SMALL_MODEL_HINT_MAX_LINES &&
-        complexity.estimated_tokens <= SMALL_MODEL_HINT_MAX_ESTIMATED_TOKENS &&
-        !hasSensitiveLens &&
-        complexity.tags.length === 0) {
-        return { tier: "small", reasons: ["small_low_priority_packet"] };
-    }
-    const reasons = [];
-    if (complexity.priority === "medium")
-        reasons.push("medium_priority");
-    if (hasSensitiveLens)
-        reasons.push("sensitive_lens");
-    if (complexity.total_lines > SMALL_MODEL_HINT_MAX_LINES) {
-        reasons.push("moderate_size");
-    }
-    return {
-        tier: "standard",
-        reasons: reasons.length > 0 ? reasons : ["default_review_packet"],
-    };
-}
-function withinRoot(root, path) {
-    const rootPath = resolve(root);
-    const absolutePath = resolve(rootPath, path);
-    const relativePath = relative(rootPath, absolutePath);
-    if (relativePath.startsWith("..") || isAbsolute(relativePath)) {
-        throw new Error(`Path '${path}' escapes repository root '${rootPath}'.`);
-    }
-    return absolutePath;
-}
-function renderAnchorPreview(summary, anchorPath) {
-    const preview = summary.anchors.slice(0, 24).map((anchor) => {
-        const location = anchor.line ? `${summary.path}:${anchor.line}` : summary.path;
-        const detail = anchor.detail ? ` - ${anchor.detail}` : "";
-        return `- ${location} [${anchor.kind}] ${anchor.name}${detail}`;
-    });
-    return [
-        "## Large File Review Mode",
-        "This packet is intentionally isolated because it covers one large file.",
-        "Use targeted reads/searches within this file, guided by the mechanical anchors.",
-        "Do not read unrelated files unless a finding cannot be evidenced without a direct boundary check.",
-        `Anchor file: ${anchorPath}`,
-        `Anchor counts: symbols=${summary.counts.symbols}, routes=${summary.counts.routes}, keywords=${summary.counts.keywords}, graph_edges=${summary.counts.graph_edges}, analyzer_signals=${summary.counts.analyzer_signals}, omitted=${summary.omitted_anchor_count}`,
-        "Anchor preview:",
-        ...(preview.length > 0 ? preview : ["- no anchors extracted beyond file boundaries"]),
-        "",
-    ];
-}
-function formatPacketConfidence(value) {
-    return typeof value === "number" && Number.isFinite(value)
-        ? value.toFixed(2)
-        : "n/a";
-}
-function renderPacketGraphContext(packet) {
-    const hasContext = (packet.entrypoints?.length ?? 0) > 0 ||
-        (packet.key_edges?.length ?? 0) > 0 ||
-        (packet.boundary_files?.length ?? 0) > 0 ||
-        packet.quality !== undefined;
-    if (!hasContext) {
-        return [];
-    }
-    const lines = ["## Packet graph context"];
-    if (packet.entrypoints?.length) {
-        lines.push("Entrypoints:");
-        lines.push(...packet.entrypoints.map((entrypoint) => `- ${entrypoint}`));
-    }
-    if (packet.key_edges?.length) {
-        lines.push("Key internal edges:");
-        lines.push(...packet.key_edges.map((edge) => {
-            const kind = edge.kind ? ` [${edge.kind}]` : "";
-            const reason = edge.reason ? ` - ${edge.reason}` : "";
-            return `- ${edge.from} -> ${edge.to}${kind} confidence=${formatPacketConfidence(edge.confidence)}${reason}`;
-        }));
-    }
-    if (packet.boundary_files?.length) {
-        lines.push("Boundary files to check only when evidence crosses the packet:");
-        lines.push(...packet.boundary_files.map((path) => `- ${path}`));
-    }
-    if (packet.quality) {
-        lines.push(`Quality: cohesion=${packet.quality.cohesion_score}, internal_edges=${packet.quality.internal_edge_count}, boundary_edges=${packet.quality.boundary_edge_count}, unexplained_files=${packet.quality.unexplained_file_count}`);
-    }
-    lines.push("");
-    return lines;
-}
-async function prepareDispatchArtifacts(params) {
-    const runId = params.runId;
-    const artifactsDir = params.artifactsDir;
-    const runDir = join(artifactsDir, "runs", runId);
-    const taskResultsDir = join(runDir, "task-results");
-    const dispatchPlanPath = join(runDir, "dispatch-plan.json");
-    let reviewRoot = params.root;
-    try {
-        const workerTask = await readJsonFile(join(runDir, "task.json"));
-        reviewRoot ??= workerTask.repo_root;
-    }
-    catch (error) {
-        if (!isFileMissingError(error)) {
-            throw error;
-        }
-    }
-    const bundle = await loadArtifactBundle(artifactsDir);
-    const tasksPath = join(runDir, "pending-audit-tasks.json");
-    const tasks = await readJsonFile(tasksPath).catch((error) => {
-        if (isFileMissingError(error))
-            return buildPendingAuditTasks(bundle);
-        throw error;
-    });
-    const sessionConfig = params.sessionConfig ?? (await loadSessionConfig(artifactsDir).catch(() => ({})));
-    const lensDefsPath = join(packageRoot, "dispatch", "lens-definitions.json");
-    const lensDefs = await readJsonFile(lensDefsPath);
-    await mkdir(taskResultsDir, { recursive: true });
-    // On resume: skip tasks whose result files already exist from a prior dispatch.
-    const priorResultTaskIds = new Set();
-    for (const task of tasks) {
-        if (existsSync(taskResultPath(taskResultsDir, task.task_id))) {
-            priorResultTaskIds.add(task.task_id);
-        }
-    }
-    const dispatchTasks = priorResultTaskIds.size > 0
-        ? tasks.filter((task) => !priorResultTaskIds.has(task.task_id))
-        : tasks;
-    const lineIndex = Object.fromEntries(dispatchTasks.flatMap((task) => Object.entries(task.file_line_counts ?? {})));
-    const orderedTasks = orderTasksForPacketReview(dispatchTasks, {
-        graphBundle: bundle.graph_bundle,
-        lineIndex,
-    });
-    const packets = buildReviewPackets(orderedTasks, {
-        graphBundle: bundle.graph_bundle,
-        lineIndex,
-    });
-    const tasksById = new Map(orderedTasks.map((task) => [task.task_id, task]));
-    const resultPathByTaskId = new Map(orderedTasks.map((task) => [
-        task.task_id,
-        taskResultPath(taskResultsDir, task.task_id),
-    ]));
-    const resultPathSet = new Set(resultPathByTaskId.values());
-    if (resultPathSet.size !== resultPathByTaskId.size) {
-        throw new Error("prepare-dispatch generated duplicate result paths; task ids must be uniquely addressable.");
-    }
-    const plan = [];
-    const resultMapEntries = [];
-    for (const task of tasks) {
-        if (priorResultTaskIds.has(task.task_id)) {
-            resultMapEntries.push({
-                packet_id: "__prior_dispatch__",
-                task_id: task.task_id,
-                result_path: taskResultPath(taskResultsDir, task.task_id),
-            });
-        }
-    }
-    let largestPacketId = null;
-    let largestLines = 0;
-    let largestEstimatedTokens = 0;
-    const warnings = [];
-    for (const packet of packets) {
-        const promptPath = packetPromptPath(taskResultsDir, packet.packet_id);
-        const packetTasks = packet.task_ids
-            .map((taskId) => tasksById.get(taskId))
-            .filter((task) => task !== undefined);
-        if (packet.total_lines > largestLines) {
-            largestLines = packet.total_lines;
-            largestEstimatedTokens = packet.estimated_tokens;
-            largestPacketId = packet.packet_id;
-        }
-        const largeFileMode = isIsolatedLargeFilePacket(packet);
-        if (packet.total_lines > LARGE_FILE_PACKET_TARGET_LINES && !largeFileMode) {
-            warnings.push({
-                code: "large_packet",
-                message: `large packet ${packet.packet_id} (~${packet.total_lines} lines) may hit quota limits`,
-            });
-        }
-        for (const task of packetTasks) {
-            if (!lensDefs[task.lens]) {
-                warnings.push({
-                    code: "missing_lens_definition",
-                    message: `no lens definition for '${task.lens}' (task ${task.task_id})`,
-                });
-            }
-        }
-        const fileList = packet.file_paths.map((path) => {
-            const lines = packet.file_line_counts[path] ?? 0;
-            return `- ${path} (${lines} lines)`;
-        }).join("\n");
-        let anchorPath = null;
-        let anchorSummary = null;
-        if (largeFileMode) {
-            const filePath = packet.file_paths[0];
-            if (!reviewRoot) {
-                warnings.push({
-                    code: "large_file_anchor_unavailable",
-                    message: `large single-file packet ${packet.packet_id} has no repo root available for anchor extraction`,
-                });
-            }
-            else {
-                try {
-                    const totalLines = packet.file_line_counts[filePath] ?? packet.total_lines;
-                    const content = await readFile(withinRoot(reviewRoot, filePath), "utf8");
-                    anchorSummary = buildFileAnchorSummary({
-                        path: filePath,
-                        content,
-                        totalLines,
-                        graphBundle: bundle.graph_bundle,
-                        externalAnalyzerResults: bundle.external_analyzer_results,
-                    });
-                    anchorPath = join(taskResultsDir, artifactNameForId(packet.packet_id, "anchors.json"));
-                    await writeJsonFile(anchorPath, anchorSummary);
-                }
-                catch (error) {
-                    warnings.push({
-                        code: "large_file_anchor_failed",
-                        message: `large single-file packet ${packet.packet_id} could not be anchored mechanically: ` +
-                            (error instanceof Error ? error.message : String(error)),
-                    });
-                }
-            }
-        }
-        const largeFileSection = anchorSummary && anchorPath
-            ? renderAnchorPreview(anchorSummary, anchorPath)
-            : largeFileMode
-                ? [
-                    "## Large File Review Mode",
-                    "This packet is intentionally isolated because it covers one large file.",
-                    "Use targeted reads/searches within this file only.",
-                    "No mechanical anchor file was available, so rely on targeted symbol and keyword searches before reading broad ranges.",
-                    "",
-                ]
-                : [];
-        const taskSections = packetTasks.flatMap((task) => {
-            const lensDef = lensDefs[task.lens];
-            const inputLines = task.inputs
-                ? Object.entries(task.inputs)
-                    .sort(([a], [b]) => a.localeCompare(b))
-                    .map(([key, value]) => `input.${key}: ${value}`)
-                : [];
-            const isLensVerification = task.tags?.includes("lens_verification") ?? false;
-            const coverageTemplate = task.file_paths.map((path) => ({
-                path,
-                total_lines: task.file_line_counts?.[path] ?? lineIndex[path] ?? 0,
-            }));
-            return [
-                `### ${task.task_id}`,
-                `unit_id: ${task.unit_id}`,
-                `pass_id: ${task.pass_id}`,
-                `lens: ${task.lens}`,
-                ...(task.tags?.length ? [`tags: ${task.tags.join(", ")}`] : []),
-                ...inputLines,
-                `rationale: ${task.rationale}`,
-                "",
-                `Lens guidance: ${lensDef?.description ?? task.lens}`,
-                `Do NOT report: ${lensDef?.do_not_report ?? "N/A"}`,
-                ...(isLensVerification
-                    ? [
-                        "",
-                        "Lens verification mode: review the prior result summary in the rationale and use only targeted source checks.",
-                        "Do not redo every packet and do not write direct findings for this task.",
-                        "Return findings: [] plus verification metadata. Include followup_tasks only for bounded, specific re-review packets.",
-                    ]
-                    : []),
-                "",
-                "file_coverage (copy exactly into your AuditResult for this task):",
-                "```json",
-                JSON.stringify(coverageTemplate),
-                "```",
-                "",
-            ];
-        });
-        const submitCommand = `"${process.execPath}" "${join(packageRoot, "audit-code.mjs")}" submit-packet ` +
-            `--run-id-b64 ${toBase64Url(runId)} ` +
-            `--packet-id-b64 ${toBase64Url(packet.packet_id)} ` +
-            `--artifacts-dir-b64 ${toBase64Url(artifactsDir)}`;
-        const complexity = buildDispatchComplexity(packet, largeFileMode);
-        for (const task of packetTasks) {
-            resultMapEntries.push({
-                packet_id: packet.packet_id,
-                task_id: task.task_id,
-                result_path: resultPathByTaskId.get(task.task_id),
-            });
-        }
-        const prompt = [
-            "You are a code auditor. Review this packet once, then submit exactly one result per listed task.",
-            "",
-            "## Packet",
-            `packet_id: ${packet.packet_id}`,
-            `task_count: ${packet.task_ids.length}`,
-            `lenses: ${packet.lenses.join(", ")}`,
-            `estimated_tokens: ${packet.estimated_tokens}`,
-            "",
-            "## Files to read",
-            largeFileMode
-                ? "Use targeted Read/Grep calls. Paths are repo-relative from the current working directory."
-                : "Use your Read tool. Paths are repo-relative from the current working directory.",
-            "Prefer host Read/Grep tools. On native Windows, do not use Unix pipelines like `grep ... | head`; if shell search is unavoidable, use `Select-String` as a fallback.",
-            fileList,
-            "",
-            ...renderPacketGraphContext(packet),
-            ...largeFileSection,
-            "## Tasks",
-            ...taskSections,
-            "## Output",
-            "Do not write files directly. Do not use a Write tool, create temp files, edit source files,",
-            "remediate findings, create extra task results, or run unrelated audits.",
-            "Produce one JSON array containing exactly one AuditResult object for each listed task.",
-            "",
-            "Required AuditResult fields:",
-            "  task_id       copy from the task metadata",
-            "  unit_id       copy from the task metadata",
-            "  pass_id       copy from the task metadata",
-            "  lens          copy from the task metadata",
-            "  file_coverage [{path, total_lines}] - copy the exact template from each task section above",
-            "  findings      [] or array of finding objects",
-            "",
-            "Lens verification tasks:",
-            "  tasks tagged lens_verification must use findings: [] and include verification:",
-            "  {verified: boolean, needs_followup: boolean, concerns?: string[],",
-            "   coverage_concerns?: string[], confidence_concerns?: string[],",
-            "   followup_tasks?: AuditTask[]}.",
-            "  Follow-up AuditTask suggestions must stay bounded to files in this packet and use the same lens.",
-            "",
-            "Each finding object:",
-            "  id            unique ID, e.g. \"COR-001\"",
-            "  title         short title",
-            "  category      specific finding category, such as missing-validation or command-execution",
-            "  severity      critical|high|medium|low|info",
-            "  confidence    high|medium|low",
-            "  lens          must match the task lens exactly",
-            "  summary       1-2 sentence description",
-            "  affected_files  [{path, line_start?, line_end?, symbol?}] - objects, not strings; min 1 entry",
-            "  evidence     [\"path/to/file.ts:42 - description of what you see there\"] - min 1 entry",
-            "",
-            "Constraints:",
-            "1. line_end must not exceed the file's actual line count.",
-            "2. affected_files entries are objects with a path key, not plain strings.",
-            "3. Only reference files from the packet unless a finding genuinely crosses a boundary.",
-            "4. findings: [] is correct when you find nothing genuine.",
-            "",
-            "## Submit",
-            "Pipe the JSON array on stdin to this command:",
-            `  ${submitCommand}`,
-            "",
-            "The command validates and writes the packet-owned result files. Exit 0 means accepted.",
-            "Non-zero: read the errors, fix the JSON, and run the same submit command again. Retry up to 3 times.",
-            "",
-            "## Final response",
-            `After the submit command succeeds, reply exactly: valid: ${packet.packet_id}, findings=<total finding count>`,
-        ].join("\n");
-        await writeFile(promptPath, prompt, "utf8");
-        plan.push({
-            packet_id: packet.packet_id,
-            description: `Audit ${packet.file_paths.length} file(s), ${packet.task_ids.length} task(s), ${packet.lenses.length} lens(es) (~${packet.total_lines} lines)` +
-                (largeFileMode ? " [isolated large-file mode]" : ""),
-            prompt_path: promptPath,
-            complexity,
-            model_hint: buildDispatchModelHint(complexity),
-        });
-    }
-    await writeJsonFile(dispatchPlanPath, plan);
-    await writeJsonFile(dispatchResultMapPath(runDir), {
-        contract_version: "audit-code-dispatch-results/v1alpha1",
-        run_id: runId,
-        entries: resultMapEntries,
-    });
-    // Compute and write dispatch-quota.json
-    const hostModel = params.hostModel ?? null;
-    const perPacketTokens = plan.map((p) => p.complexity.estimated_tokens);
-    const quotaProviderName = resolveFreshSessionProviderName(undefined, sessionConfig);
-    const quotaProviderKey = buildProviderModelKey(quotaProviderName, hostModel);
-    const quotaState = await readQuotaState().catch(() => ({ version: 2, entries: {} }));
-    const quotaStateEntry = quotaState.entries[quotaProviderKey] ?? null;
-    const hostConcurrencyLimit = resolveHostActiveSubagentLimit({
-        explicitLimit: params.hostActiveSubagentLimit,
-        sessionConfig,
-    });
-    const dispatchCachedLimits = await lookupDiscoveredLimits(quotaProviderKey).catch(() => null);
-    const waveSchedule = scheduleWave({
-        providerName: quotaProviderName,
-        sessionConfig,
-        hostModel,
-        requestedConcurrency: sessionConfig.parallel_workers ?? plan.length,
-        estimatedSlotTokens: perPacketTokens,
-        quotaStateEntry,
-        hostConcurrencyLimit,
-        discoveredLimits: dispatchCachedLimits,
-    });
-    const dispatchQuota = {
-        contract_version: "audit-code-dispatch-quota/v1alpha2",
-        run_id: runId,
-        model: hostModel,
-        resolved_limits: waveSchedule.resolved_limits,
-        confidence: waveSchedule.confidence,
-        source: waveSchedule.source,
-        host_concurrency_limit: waveSchedule.host_concurrency_limit,
-        wave_size: waveSchedule.wave_size,
-        estimated_wave_tokens: waveSchedule.estimated_wave_tokens,
-        cooldown_until: waveSchedule.cooldown_until,
-        quota_source_snapshot: waveSchedule.quota_source_snapshot ?? null,
-        backoff_state: null,
-    };
-    const dispatchQuotaPath = join(runDir, "dispatch-quota.json");
-    await writeJsonFile(dispatchQuotaPath, dispatchQuota);
-    // Warn about packets that exceed the context budget only when we have reliable limit
-    // information (confidence medium/high). Low-confidence limits are conservative defaults
-    // and would produce misleading warnings since the real context window is unknown.
-    if (waveSchedule.confidence !== "low") {
-        const contextBudget = waveSchedule.resolved_limits.context_tokens - waveSchedule.resolved_limits.output_tokens;
-        for (const p of plan) {
-            if (p.complexity.estimated_tokens > contextBudget) {
-                warnings.push({
-                    code: "oversized_packet",
-                    message: `Packet ${p.packet_id} estimated tokens (${p.complexity.estimated_tokens}) exceed ` +
-                        `context budget (${contextBudget}). This packet may fail at dispatch. ` +
-                        `Set quota.default_context_tokens or quota.models in session-config.json to override.`,
-                });
-            }
-        }
-    }
-    const warningsPath = warnings.length > 0
-        ? join(runDir, "dispatch-warnings.json")
-        : null;
-    if (warningsPath) {
-        await writeJsonFile(warningsPath, warnings);
-    }
-    const activeDispatch = {
-        run_id: runId,
-        created_at: new Date().toISOString(),
-        packet_count: plan.length,
-        task_count: orderedTasks.length,
-        status: "active",
-    };
-    await writeJsonFile(join(artifactsDir, ACTIVE_DISPATCH_FILENAME), activeDispatch);
-    return {
-        run_id: runId,
-        dispatch_plan_path: dispatchPlanPath,
-        dispatch_quota_path: dispatchQuotaPath,
-        packet_count: plan.length,
-        task_count: orderedTasks.length,
-        skipped_task_count: priorResultTaskIds.size,
-        largest_packet: largestPacketId
-            ? {
-                packet_id: largestPacketId,
-                total_lines: largestLines,
-                estimated_tokens: largestEstimatedTokens,
-            }
-            : null,
-        warning_count: warnings.length,
-        dispatch_warnings_path: warningsPath,
-    };
-}
 async function cmdPrepareDispatch(argv) {
     const runId = getFlag(argv, "--run-id");
     if (!runId)
         throw new Error("prepare-dispatch requires --run-id <run_id>");
     const result = await prepareDispatchArtifacts({
+        packageRoot,
         runId,
         artifactsDir: getArtifactsDir(argv),
         root: getFlag(argv, "--root") ? getRootDir(argv) : undefined,
@@ -3551,6 +2737,7 @@ async function cmdDispatchStatus(argv) {
     }, null, 2));
 }
 async function main(argv) {
+    setQuotaStateDir(join(homedir(), ".audit-code"));
     const command = argv[2] ?? "sample-run";
     switch (command) {
         case "sample-run":