code-auditor-mcp 4.0.4 → 4.1.1

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "code-auditor",
       "source": "./plugin",
       "description": "Diff-scoped code quality auditing on every edit. Indexes your codebase, enforces invariants, and feeds violations back to the agent so fixes happen inline.",
-      "version": "4.0.4",
+      "version": "4.1.1",
       "author": {
         "name": "Ben Hammond"
       },

package/CHANGELOG.md

@@ -2,6 +2,138 @@
 
 All notable changes to the Code Auditor MCP project.
 
+## [4.1.1] — 2026-09-23
+
+### Report writes stop destroying files
+
+**4.1.0 and earlier overwrote `audit-report.json` in the audited project's root
+without asking; 4.1.1 writes to stdout unless `-o` is passed and refuses to
+clobber.** Anyone who ran a formatted audit in a repo with that filename should
+check their history.
+
+- `audit --format` no longer defaults its output path to `process.cwd()`: with no
+  `-o` it writes the report to stdout, and with `-o` it refuses to overwrite an
+  existing `audit-report.{ext}` unless `--overwrite` is passed.
+- `map -o <file>` gets the same guard — it no longer silently clobbers an
+  existing file.
+- A file-config-supplied `outputDirectory`/`outputDir` is refused outright
+  (`output-directory-refused`) rather than clamped into the project tree.
+- `outputFormats`/`outputDirectory` removed from the defaults and `print-config`
+  — they were advertised but never consumed for writes.
+- The MCP dev log (`mcp-server.log`) no longer keys off `NODE_ENV`/`DEBUG` (a
+  consumer dev shell could trip it) and no longer lands in `process.cwd()`; it
+  is opt-in via `--dev` and routed to the OS cache.
+- Consent flag unified: `--overwrite` is the spelling across `audit`, `map`, and
+  `generate-config` (`--force`/`--yes` remain as aliases).
+
+### Cross-file duplicate detection never worked — the dead load is gone
+
+Cross-file `dry/duplicate` detection was advertised as a "problems only visible
+between files" feature, but it **never fired**: the index stored the
+`statement_block` text while the DRY analyzer hashed the full function node, so
+the comparison could not match. The only thing the comparison ever did was load
+every function body into memory on every single-file `changed` run —
+O(whole-project) per save, for zero findings. The load is deleted (no schema
+change, no migration, no `dry_hash` column); `dry/duplicate` remains, and remains
+correct, as a **within-file** rule. A structural guard now asserts the scoped
+path issues no whole-table `functions` read, so the load can't quietly return.
+
+## [4.1.0] — 2026-09-23
+
+### Severity becomes a three-tier urgency ladder, not a permission knob
+
+The `warning`/`suggestion` vocabulary that leaked from the old linter semantics
+is gone. Every finding is now `critical`, `severe`, or `high` — three defect
+tiers with nothing below `high` — and the agent gate blocks **all three**. The
+old per-rule severity knobs (`gateSeverities`, `DEFAULT_BLOCKING_SEVERITIES`,
+`severityOverrides`, and path-profile severity capping) are deleted: a team that
+disagrees with a level scopes the finding out of the gate (`excludeFromGate`) or
+edits the rule, it never re-labels severity.
+
+- **102 live severity rules** re-assigned on the urgency axis — 11 `critical`, 37
+  `severe`, 54 `high` — one row per rule with rationale in
+  `specs/severity-assignment-ledger.md`, plus 4 off-ladder diagnostics.
+- `--fail-on` and `excludeFromGate` remain — they are *scope* controls, not level
+  controls.
+- Stale `warning`/`suggestion` literals swept from the shipped configs, README,
+  CONTRIBUTING, and the 78 corpus `expected.json` fixtures; a new
+  `examplesValidate.spec.ts` loads every shipped example through `loadConfig`, so
+  a stale value regresses to a red test rather than silently shipping.
+
+### Ten rules that could never fire are removed, not kept as standing no-ops
+
+A rule with no reachable emission site is a finding about the analyzer, not a
+rule to assign severity to. Six `api-contract` rules, the schema `file-error`,
+and three schema-validator aliases (`field-mismatch`, `constraint-mismatch`,
+`version-mismatch`) had exactly that shape — a legacy alias or a predicate
+reading a field no extractor ever populated — so they were deleted outright
+(registry entry, emitter, and ledger row). The ten IDs are tombstoned in
+`ruleAliases.ts` so a stale reference reports *why* each was removed. The
+`cannot-fire` class drops 10 → 0; `APIContractAnalyzer` is now a no-op returning
+`[]`, pending real endpoint/call extraction.
+
+### `missing-org-filter` fires where it should: hhra-org 0 → 9
+
+The rule was *applicable* on a DDL-declared multi-tenant corpus (hhra-org) yet
+*fired zero findings* — a false `clean` on a real tenant-isolation leak. Firing
+and applicability had drifted to two different tenancy predicates. Both now
+derive from a single `buildOrgFilterTierSet`, and the rule moved to Stage 4,
+where the DDL-discovered tenant columns live. hhra-org now reports 9
+`missing-org-filter` findings (was 0), and the exact `organization_id = $n`
+positional shape is pinned in a fixture so the long-form column case can't go
+vacuous again. Severity stays `critical` — no provenance tier (recorded, not
+assumed).
+
+### `unescaped-html-interpolation` stops trusting what a string *looks* like
+
+The rule used to fire on any template literal whose text contained an HTML tag —
+which flagged a react-analyzer violation *message* as stored XSS and missed 8
+real sinks. It now computes flow: `computeHtmlSinkTemplates` backward-propagates
+from genuine HTML sinks to find which template values actually reach one. The
+sink set is completed to include `setHTMLUnsafe`, Vue `v-html`, the jQuery/Hono
+`.html(x)` setter, and React `dangerouslySetInnerHTML`. The old text trigger's 77
+false positives across corpora are gone; the one real delta is `endless-guessing`
+0 → 3 (a Hono `c.html(…)` sink).
+
+### The self-audit gate actually enforces all three tiers now
+
+`verify:self`'s blocking predicate had drifted to `critical | severe` — a
+two-tier narrowing that let `high` findings through the ratchet (itself a second
+bug on top of the earlier `'warning'` fix). It now matches `BLOCKING_SEVERITIES`
+(`critical | severe | high`). Re-running surfaced 7 in-scope findings, resolved
+as 4 fixes (including splitting `computeHtmlSinkTemplates`' fused visitor into
+three single-purpose phases) and 3 correct-by-design `(file, rule)` scoped
+exemptions with written rationale — excluded *by scope*, never by re-labelling
+severity. The exemptions are now also self-policing: `verify:self` fails on any
+exemption whose `(file, rule)` pair no longer fires, so a suppression can't
+outlive the finding it suppressed (the `SKIP_RULES` failure mode).
+
+### Gate-liveness tests (Spec 62 R9)
+
+A gate that "passes" because it checks nothing is the same defect shape as
+`missing-org-filter` — a clean result from a check that isn't there. New
+`gate-liveness.test.ts` proves each gate's failure branch is live: `verify:self`'s
+predicate (extracted to `verify-self-core.mjs`), `verify:disk-space`,
+`verify:gate-budget`, and `assert_compatible` each exit non-zero against their
+own trigger, so a gate can no longer silently pass by checking nothing.
+
+### Registry ↔ ledger reconciliation
+
+The rule registry and the authenticity/severity ledgers are now reconciled
+bidirectionally — registry ids with no ledger row, ledger rows with no registry
+id, and the two unregistered-live emit sites are pinned by a membership test so
+the two books can't drift apart.
+
+### Release-rail changes
+
+- **`bench` removed from `verify:close`** — it is a measurement, not a gate. The
+  close gate is now `verify:disk-space && verify:types && verify:dist-fresh &&
+  test && test:integration && verify:gate-budget && verify:clean-install &&
+  verify:dist && verify:self`.
+- `verify:gate-budget` and `verify:disk-space` gained env overrides
+  (`VERIFY_GATE_BUDGET_MS`, `VERIFY_MIN_FREE_BYTES`) so their failure branches are
+  testable without a genuinely slow rule or a genuinely full disk.
+
 ## [4.0.4] — 2026-09-20
 
 ### Go analysis now works everywhere, not just Intel Macs

package/README.md

@@ -92,7 +92,7 @@ Code Auditor's built-in rules fall into two categories:
 | **Deterministic** | Structural fact — an engineer would act on every finding | `single-responsibility` (300-line functions), `solid/method-complexity` (cyclomatic complexity > 20), `solid/class-size` (40+ method classes), `dependency-inversion` (concrete imports where an interface exists) |
 | **Advisory** | Heuristic signal — may be wrong depending on domain | `sql-injection-risk` (AST-level string-pattern matching without type info), `missing-org-filter` (domain-specific — assumes SaaS tenant isolation), `unknown-table` (requires user-provided schema), `dry/duplicate` (token-identical blocks) |
 
-Deterministic rules ship at `critical` or `warning`. Advisory rules ship at `warning` or `suggestion`. Rules proven near-zero precision on a real corpus are **disabled by default** (`off`) — users opt in when the rule matches their domain.
+Deterministic rules ship at `critical` or `severe`. Advisory rules ship at `severe` or `high`. Rules proven near-zero precision on a real corpus are **disabled by default** (`off`) — users opt in when the rule matches their domain.
 
 ### Recalibration
 
@@ -103,9 +103,9 @@ Every disabled rule documents what corpus it *would* be useful on. Users can res
 ```json
 {
   "severityOverrides": {
-    "sql-injection-risk": "warning",
-    "missing-org-filter": "critical",
-    "loop-query": "warning"
+    "sql-injection-risk": "critical",
+    "missing-org-filter": "severe",
+    "loop-query": "severe"
   }
 }
 ```
@@ -195,7 +195,7 @@ code-audit search "mechanism:inline css:color"          # inline color declarati
 code-audit search "token:--color-primary"                # bypassing a design token
 ```
 
-**The React analyzer** also gains raw-element detection: if your project has a `Button` wrapper, raw `<button>` usages outside `Button`'s definition become warnings.
+**The React analyzer** also gains raw-element detection: if your project has a `Button` wrapper, raw `<button>` usages outside `Button`'s definition become severe findings.
 
 ## License
 

package/configs/hhra-compat.json

@@ -24,7 +24,7 @@
   ],
   
   "enabledAnalyzers": [
-    "component",
+    "react",
     "security",
     "solid",
     "dry",
@@ -138,7 +138,7 @@
   "outputFormats": ["html", "json"],
   "outputDirectory": "./audit-reports",
   
-  "minSeverity": "suggestion",
+  "minSeverity": "high",
   "failOnCritical": false,
   "verbose": false,
   "showProgress": true,

package/dist/analyzers/applicability.d.ts

@@ -13,6 +13,11 @@
  * UniversalSchemaAnalyzer.js → makeVisitorStatus), so a static analyzer import
  * here would create a pipeline↔analyzer cycle. The pipeline-side convention is
  * to reach analyzers only through dynamic import() (see pipelineAdapters.ts).
+ *
+ * The one exception is {@link orgFilterTiers}: a pure, dependency-free module
+ * that is the single source of truth for tenant-scoping tiers. Both this
+ * applicability predicate and the Stage-4 missing-org-filter reducer derive
+ * from it, so firing and applicability can never read different tier sets.
  */
 export interface RuleApplicability {
     applicable: boolean;
@@ -85,11 +90,12 @@ export interface UnreadStyleSourceInfo {
  *
  * @param ruleId The registry rule id.
  * @param dataAccessConfig The namespaced data-access config (may be undefined).
- * @param ddlColumns Aggregated DDL-declared columns from the schema reducer.
+ * @param ddlTableColumns Aggregated DDL-declared per-table columns from the
+ *   schema reducer (`Record<table, columns>`), folded corpus-wide.
  * @returns The rule's applicability verdict, or null when the rule declares no
  * applicability predicate and runs unconditionally.
  */
-export declare function evaluateRuleApplicability(ruleId: string, dataAccessConfig: Record<string, unknown> | undefined, ddlColumns: string[] | undefined): RuleApplicability | null;
+export declare function evaluateRuleApplicability(ruleId: string, dataAccessConfig: Record<string, unknown> | undefined, ddlTableColumns: Record<string, string[]> | undefined): RuleApplicability | null;
 /**
  * Spec 44 bucket 2 — rules that are structurally unreachable: their predicate
  * reads a field no extractor populates (or they are a legacy alias with no
@@ -101,6 +107,23 @@ export declare function evaluateRuleApplicability(ruleId: string, dataAccessConf
  * Each reason names the specific extractor and the specific field (or absence
  * of an emission site) so a reader can tell *why* it cannot fire. Remove an id
  * here when its extraction begins emitting it.
+ *
+ * As of 4.1.0 this map is empty: the ten `cannot-fire` rules (the six
+ * api-contract rules, `file-error`, and the three schema-validator aliases)
+ * were removed outright — registry entry, emission site, and ledger row — rather
+ * than kept as standing findings. The `cannot-fire` verdict remains part of the
+ * applicability vocabulary for when a future rule is genuinely unreachable, but
+ * no such rule currently exists.
+ *
+ * This map is NOT the only producer of the `cannot-fire` state: the static-config
+ * extractors (`lintConfigReader.ts`, `tailwindConfigLoader.ts`, and the
+ * styles-source visitor in `pipelineAdapters.ts`) emit a `CoverageDiagnostic`
+ * with `kind: 'cannot-fire'` when a project config cannot be read statically
+ * (Spec 61 R3.4). That diagnostic route is independent of this map, so emptying
+ * this map does not dead the `cannot-fire` state — the diagnostic route remains
+ * live (and is exercised by `spec61-exploits.spec.ts` fixture 8). The
+ * unresolvable dynamic-import path emits the sibling `unresolved-dynamic-import`
+ * kind, not `cannot-fire`.
  */
 export declare const CANNOT_FIRE_RULES: ReadonlyMap<string, string>;
 //# sourceMappingURL=applicability.d.ts.map

package/dist/analyzers/applicability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"applicability.d.ts","sourceRoot":"","sources":["../../src/analyzers/applicability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,eAAe,GAAG,aAAa,CAAC;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,mBAAmB,EAAE,aAAa,CAAC,MAAM,CAMrD,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,OAAO,EACjB,SAAS,EAAE,MAAM,GAChB,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAWhC;AAUD;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACrD,UAAU,EAAE,MAAM,EAAE,GAAG,SAAS,GAC/B,iBAAiB,GAAG,IAAI,CAS1B;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAiBxD,CAAC"}
+{"version":3,"file":"applicability.d.ts","sourceRoot":"","sources":["../../src/analyzers/applicability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAQH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,eAAe,GAAG,aAAa,CAAC;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,mBAAmB,EAAE,aAAa,CAAC,MAAM,CAMrD,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,OAAO,EACjB,SAAS,EAAE,MAAM,GAChB,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAWhC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACrD,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,SAAS,GACpD,iBAAiB,GAAG,IAAI,CAS1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,iBAAiB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAe,CAAC"}

package/dist/analyzers/applicability.js

@@ -13,7 +13,13 @@
  * UniversalSchemaAnalyzer.js → makeVisitorStatus), so a static analyzer import
  * here would create a pipeline↔analyzer cycle. The pipeline-side convention is
  * to reach analyzers only through dynamic import() (see pipelineAdapters.ts).
+ *
+ * The one exception is {@link orgFilterTiers}: a pure, dependency-free module
+ * that is the single source of truth for tenant-scoping tiers. Both this
+ * applicability predicate and the Stage-4 missing-org-filter reducer derive
+ * from it, so firing and applicability can never read different tier sets.
  */
+import { buildOrgFilterTierSet, hasDeclaredTenancy, } from './orgFilterTiers.js';
 /**
  * Spec 52 R3 — the whole-program rule class. These rules draw a global
  * conclusion ("table X is never read", "table Y is unknown", "no validator is
@@ -70,13 +76,6 @@ export function scopedWholeProgramApplicability(isScoped, fileCount) {
     }
     return map;
 }
-/**
- * Default tenant-scoping column names. The single source of truth is
- * DEFAULT_DATA_ACCESS_CONFIG.orgFilterColumns in UniversalDataAccessAnalyzer.js;
- * this is a local copy because importing that module here would create the cycle
- * described above. Keep in sync with that constant.
- */
-const DEFAULT_ORG_FILTER_COLUMNS = ['org_id', 'tenant_id', 'organization_id', 'workspace_id'];
 /**
  * Evaluate whether a rule is applicable to the current codebase, given inputs
  * the pipeline has already computed.
@@ -87,13 +86,14 @@ const DEFAULT_ORG_FILTER_COLUMNS = ['org_id', 'tenant_id', 'organization_id', 'w
  *
  * @param ruleId The registry rule id.
  * @param dataAccessConfig The namespaced data-access config (may be undefined).
- * @param ddlColumns Aggregated DDL-declared columns from the schema reducer.
+ * @param ddlTableColumns Aggregated DDL-declared per-table columns from the
+ *   schema reducer (`Record<table, columns>`), folded corpus-wide.
  * @returns The rule's applicability verdict, or null when the rule declares no
  * applicability predicate and runs unconditionally.
  */
-export function evaluateRuleApplicability(ruleId, dataAccessConfig, ddlColumns) {
+export function evaluateRuleApplicability(ruleId, dataAccessConfig, ddlTableColumns) {
     if (ruleId === 'missing-org-filter') {
-        return evaluateMissingOrgFilterApplicability(dataAccessConfig, ddlColumns);
+        return evaluateMissingOrgFilterApplicability(dataAccessConfig, ddlTableColumns);
     }
     const cannotFireReason = CANNOT_FIRE_RULES.get(ruleId);
     if (cannotFireReason !== undefined) {
@@ -112,50 +112,44 @@ export function evaluateRuleApplicability(ruleId, dataAccessConfig, ddlColumns)
  * Each reason names the specific extractor and the specific field (or absence
  * of an emission site) so a reader can tell *why* it cannot fire. Remove an id
  * here when its extraction begins emitting it.
+ *
+ * As of 4.1.0 this map is empty: the ten `cannot-fire` rules (the six
+ * api-contract rules, `file-error`, and the three schema-validator aliases)
+ * were removed outright — registry entry, emission site, and ledger row — rather
+ * than kept as standing findings. The `cannot-fire` verdict remains part of the
+ * applicability vocabulary for when a future rule is genuinely unreachable, but
+ * no such rule currently exists.
+ *
+ * This map is NOT the only producer of the `cannot-fire` state: the static-config
+ * extractors (`lintConfigReader.ts`, `tailwindConfigLoader.ts`, and the
+ * styles-source visitor in `pipelineAdapters.ts`) emit a `CoverageDiagnostic`
+ * with `kind: 'cannot-fire'` when a project config cannot be read statically
+ * (Spec 61 R3.4). That diagnostic route is independent of this map, so emptying
+ * this map does not dead the `cannot-fire` state — the diagnostic route remains
+ * live (and is exercised by `spec61-exploits.spec.ts` fixture 8). The
+ * unresolvable dynamic-import path emits the sibling `unresolved-dynamic-import`
+ * kind, not `cannot-fire`.
  */
-export const CANNOT_FIRE_RULES = new Map([
-    // api-contract — reads response/auth metadata that extractEndpoints /
-    // extractAPICalls never populate, or has no emission site at all.
-    ['api-type-mismatch', 'cannot fire — extractEndpoints/extractAPICalls never populate responseSchema/expectedResponseType/deprecated, the fields this rule reads'],
-    ['missing-endpoint', 'cannot fire — gated: extractMethodFrom*/extractPathFromGo derive method and URL from function names (name proxy), so any finding is fabricated'],
-    ['api-extra-field', 'cannot fire — no emission site: the analyzer has no code that produces this rule'],
-    ['api-missing-field', 'cannot fire — no emission site: the analyzer has no code that produces this rule'],
-    ['method-mismatch', 'cannot fire — gated: extractMethodFrom* derives the verb from function names (name proxy), so any finding is fabricated'],
-    ['auth-mismatch', 'cannot fire — extractEndpoints never sets `authentication`, the field this rule reads'],
-    // schema — file errors are routed to state.errors, never a file-error violation.
-    ['file-error', 'cannot fire — schema file errors are routed to state.errors, never emitted as a `file-error` violation'],
-    // schema-validator — legacy alias or reads constraints/version the extractor never assigns.
-    ['field-mismatch', 'cannot fire — legacy alias: the validator emits `schema-field-mismatch`, never `field-mismatch`'],
-    ['constraint-mismatch', 'cannot fire — extractSchemas never assigns `constraints` on fields, the input this rule reads'],
-    ['version-mismatch', 'cannot fire — extractSchemas never assigns `version` on schemas, the input this rule reads'],
-]);
+export const CANNOT_FIRE_RULES = new Map([]);
 /**
- * Spec 39/42 R3 — `missing-org-filter` is applicable when the project declares a
- * tenant-scoping column in one of three places: configured tenant tables by name,
- * a configured schema table, or the DDL-derived table catalog.
+ * Spec 39/42 R3 + Spec 62 Amendment B — `missing-org-filter` is applicable when
+ * the project declares tenancy in any tier. Applicability and firing read the
+ * SAME tier set, built once by {@link buildOrgFilterTierSet}:
+ *
+ *   Tier 1 (config-primary) — `orgFilterTables`, the explicit tenant-table list.
+ *   Tier 2 (schema-inference) — a configured schema table carrying a
+ *     tenant-scoping column (org_id/tenant_id/organization_id/workspace_id).
+ *   Tier 3 (DDL-discovery) — a table whose DDL columns carry a tenant-scoping
+ *     column. This tier was the Amendment B defect: applicability read it (3
+ *     tiers) while the firing predicate read only Tiers 1–2, so a DDL-declared
+ *     multi-tenant codebase un-suppressed the rule without ever making it fire —
+ *     reporting `clean` on a real leak. Both consumers now derive from one
+ *     function, so they cannot drift.
  */
-function evaluateMissingOrgFilterApplicability(dataAccessConfig, ddlColumns) {
-    // Tier 1 — user declared tenant-scoped tables by name (policy of record).
-    const orgFilterTables = dataAccessConfig?.orgFilterTables ?? [];
-    if (orgFilterTables.length > 0)
-        return { applicable: true };
-    const orgFilterColumns = dataAccessConfig?.orgFilterColumns ?? DEFAULT_ORG_FILTER_COLUMNS;
-    const schemas = dataAccessConfig?.schemas ?? [];
-    const tenantColumns = new Set(orgFilterColumns.map((c) => String(c).toLowerCase()));
-    // Tier 2 — a configured schema declares a table carrying a tenant-scoping column.
-    for (const schema of schemas) {
-        for (const table of schema.tables ?? []) {
-            for (const column of table.columns ?? []) {
-                if (tenantColumns.has(String(column.name).toLowerCase())) {
-                    return { applicable: true };
-                }
-            }
-        }
-    }
-    // Tier 3 — the table catalog (DDL-derived columns) carries a tenant-scoping column.
-    if (ddlColumns?.some((c) => tenantColumns.has(String(c).toLowerCase()))) {
+function evaluateMissingOrgFilterApplicability(dataAccessConfig, ddlTableColumns) {
+    const tierSet = buildOrgFilterTierSet(dataAccessConfig, ddlTableColumns);
+    if (hasDeclaredTenancy(tierSet))
         return { applicable: true };
-    }
     return {
         applicable: false,
         reason: 'no tenant-scoping column found in table catalog',

package/dist/analyzers/applicability.js.map

@@ -1 +1 @@
-{"version":3,"file":"applicability.js","sourceRoot":"","sources":["../../src/analyzers/applicability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAeH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA0B;IACxD,iCAAiC;IACjC,iCAAiC;IACjC,qCAAqC;IACrC,eAAe;IACf,uBAAuB;CACxB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAC7C,QAAiB,EACjB,SAAiB;IAEjB,MAAM,GAAG,GAAG,IAAI,GAAG,EAA6B,CAAC;IACjD,IAAI,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC;IAC1B,KAAK,MAAM,MAAM,IAAI,mBAAmB,EAAE,CAAC;QACzC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE;YACd,UAAU,EAAE,KAAK;YACjB,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,2DAA2D,SAAS,UAAU;SACvF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,0BAA0B,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC;AAc9F;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAc,EACd,gBAAqD,EACrD,UAAgC;IAEhC,IAAI,MAAM,KAAK,oBAAoB,EAAE,CAAC;QACpC,OAAO,qCAAqC,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAC9E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAgC,IAAI,GAAG,CAAC;IACpE,sEAAsE;IACtE,kEAAkE;IAClE,CAAC,mBAAmB,EAAE,0IAA0I,CAAC;IACjK,CAAC,kBAAkB,EAAE,gJAAgJ,CAAC;IACtK,CAAC,iBAAiB,EAAE,kFAAkF,CAAC;IACvG,CAAC,mBAAmB,EAAE,kFAAkF,CAAC;IACzG,CAAC,iBAAiB,EAAE,yHAAyH,CAAC;IAC9I,CAAC,eAAe,EAAE,uFAAuF,CAAC;IAE1G,iFAAiF;IACjF,CAAC,YAAY,EAAE,wGAAwG,CAAC;IAExH,4FAA4F;IAC5F,CAAC,gBAAgB,EAAE,iGAAiG,CAAC;IACrH,CAAC,qBAAqB,EAAE,+FAA+F,CAAC;IACxH,CAAC,kBAAkB,EAAE,4FAA4F,CAAC;CACnH,CAAC,CAAC;AAEH;;;;GAIG;AACH,SAAS,qCAAqC,CAC5C,gBAAqD,EACrD,UAAgC;IAEhC,0EAA0E;IAC1E,MAAM,eAAe,GAAc,gBAAgB,EAAE,eAAwC,IAAI,EAAE,CAAC;IACpG,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAE5D,MAAM,gBAAgB,GACnB,gBAAgB,EAAE,gBAAyC,IAAI,0BAA0B,CAAC;IAC7F,MAAM,OAAO,GACV,gBAAgB,EAAE,OAAe,IAAI,EAAE,CAAC;IAE3C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAEpF,kFAAkF;IAClF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACxC,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;gBACzC,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;oBACzD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,oFAAoF;IACpF,IAAI,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC9B,CAAC;IAED,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,MAAM,EAAE,iDAAiD;KAC1D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"applicability.js","sourceRoot":"","sources":["../../src/analyzers/applicability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,qBAAqB,EACrB,kBAAkB,GAEnB,MAAM,qBAAqB,CAAC;AAe7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA0B;IACxD,iCAAiC;IACjC,iCAAiC;IACjC,qCAAqC;IACrC,eAAe;IACf,uBAAuB;CACxB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAC7C,QAAiB,EACjB,SAAiB;IAEjB,MAAM,GAAG,GAAG,IAAI,GAAG,EAA6B,CAAC;IACjD,IAAI,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC;IAC1B,KAAK,MAAM,MAAM,IAAI,mBAAmB,EAAE,CAAC;QACzC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE;YACd,UAAU,EAAE,KAAK;YACjB,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,2DAA2D,SAAS,UAAU;SACvF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAcD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAc,EACd,gBAAqD,EACrD,eAAqD;IAErD,IAAI,MAAM,KAAK,oBAAoB,EAAE,CAAC;QACpC,OAAO,qCAAqC,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAC9E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAgC,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;AAE1E;;;;;;;;;;;;;;GAcG;AACH,SAAS,qCAAqC,CAC5C,gBAAqD,EACrD,eAAqD;IAErD,MAAM,OAAO,GAAG,qBAAqB,CAAC,gBAA+C,EAAE,eAAe,CAAC,CAAC;IACxG,IAAI,kBAAkB,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAE7D,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,MAAM,EAAE,iDAAiD;KAC1D,CAAC;AACJ,CAAC"}

package/dist/analyzers/cross-language/APIContractAnalyzer.d.ts

@@ -28,61 +28,30 @@ export interface APICall {
     errorHandling?: string[];
     timeout?: number;
 }
-export interface ContractViolation extends Violation {
-    rule: 'api-type-mismatch' | 'missing-endpoint' | 'api-extra-field' | 'api-missing-field' | 'method-mismatch' | 'auth-mismatch';
-    contractType: 'api-type-mismatch' | 'missing-endpoint' | 'api-extra-field' | 'api-missing-field' | 'method-mismatch' | 'auth-mismatch';
-    endpoint?: APIEndpoint;
-    call?: APICall;
-    expectedType?: string;
-    actualType?: string;
-    missingFields?: string[];
-    extraFields?: string[];
-}
 /**
  * Api contract analyzer.
+ *
+ * All six api-contract rules were removed in 4.1.0: each was `cannot-fire` (its
+ * extractor never populated the fields it read, or its computation was a name
+ * proxy). The rules were removed outright rather than kept as standing findings,
+ * so this analyzer is a no-op that returns no violations. The endpoint/call
+ * extraction below remains for when real contract extraction lands.
  */
 export declare class APIContractAnalyzer {
-    private endpoints;
-    private calls;
-    /**
-     * Analyze API contracts and find violations
-      * @param calls
-      * @param endpoints
-      * @returns
-     */
-    analyzeContracts(endpoints: APIEndpoint[], calls: APICall[]): Promise<ContractViolation[]>;
-    /**
-     * Find API calls that don't have matching endpoints
-     */
-    private findUnmatchedCalls;
-    /**
-     * Validate matched endpoint-call pairs for compatibility
-     */
-    private validateMatchedPairs;
-    /**
-     * Check for usage of deprecated APIs
-     */
-    private checkDeprecatedUsage;
-    /**
-     * Validate authentication requirements
-     */
-    private validateAuthentication;
-    /**
-     * Find matching endpoint for an API call
-     */
-    private findMatchingEndpoint;
-    /**
-     * Check if two API paths match (handling path parameters)
-     */
-    private pathsMatch;
-    /**
-     * Validate type compatibility between endpoint and call
-     */
-    private validateTypeCompatibility;
     /**
-     * Check if an API call includes authentication
+     * Detect mismatches between a project's declared API endpoints and the calls
+     * its clients make against them.
+     *
+     * A no-op as of 4.1.0: all six api-contract rules this method fed were removed
+     * (each was `cannot-fire`), so it always returns an empty list. Kept as the
+     * seam real contract extraction will plug into — the endpoint/call extraction
+     * below remains for that work.
+     *
+     * @param _endpoints The API endpoints extracted from the corpus.
+     * @param _calls The API calls extracted from the corpus.
+     * @returns An empty list (no contract rules are live).
      */
-    private callHasAuthentication;
+    analyzeContracts(_endpoints: APIEndpoint[], _calls: APICall[]): Promise<Violation[]>;
 }
 /**
  * Extract API endpoints from code entities

package/dist/analyzers/cross-language/APIContractAnalyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"APIContractAnalyzer.d.ts","sourceRoot":"","sources":["../../../src/analyzers/cross-language/APIContractAnalyzer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAA+B,UAAU,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACpG,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,UAAU,CAAC;IAC3B,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IAClD,IAAI,EAAE,mBAAmB,GAAG,kBAAkB,GAAG,iBAAiB,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,eAAe,CAAC;IAC/H,YAAY,EAAE,mBAAmB,GAAG,kBAAkB,GAAG,iBAAiB,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,eAAe,CAAC;IACvI,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;GAEG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,SAAS,CAAqB;IACtC,OAAO,CAAC,KAAK,CAAiB;IAE9B;;;;;OAKG;IACG,gBAAgB,CACpB,SAAS,EAAE,WAAW,EAAE,EACxB,KAAK,EAAE,OAAO,EAAE,GACf,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAqB/B;;OAEG;YACW,kBAAkB;IA6BhC;;OAEG;YACW,oBAAoB;IA2ClC;;OAEG;YACW,oBAAoB;IA6BlC;;OAEG;YACW,sBAAsB;IA+BpC;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAa5B;;OAEG;IACH,OAAO,CAAC,UAAU;IA6BlB;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAkCjC;;OAEG;IACH,OAAO,CAAC,qBAAqB;CAM9B;AAwBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,WAAW,EAAE,CAwB/D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAkB1D"}
+{"version":3,"file":"APIContractAnalyzer.d.ts","sourceRoot":"","sources":["../../../src/analyzers/cross-language/APIContractAnalyzer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,UAAU,CAAC;IAC3B,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,qBAAa,mBAAmB;IAC9B;;;;;;;;;;;;OAYG;IACG,gBAAgB,CACpB,UAAU,EAAE,WAAW,EAAE,EACzB,MAAM,EAAE,OAAO,EAAE,GAChB,OAAO,CAAC,SAAS,EAAE,CAAC;CAGxB;AAUD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,WAAW,EAAE,CAwB/D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAkB1D"}