code-auditor-mcp 5.0.2 → 5.3.3

package/dist/config/defaults.d.ts

@@ -1,7 +1,7 @@
 /**
  * Default configurations for the code auditor
  */
-import { AuditConfig, PathProfile } from '../types.js';
+import { AuditConfig, ChurnConfig, PathProfile } from '../types.js';
 /**
  * Get default configuration
  *
@@ -22,6 +22,120 @@ export declare function getProjectTypeDefaults(projectType: string): Partial<Aud
  * @returns Environment-specific defaults, or an empty object when unknown.
  */
 export declare function getEnvironmentDefaults(env: string): Partial<AuditConfig>;
+/**
+ * The value-drift colour threshold — the single source of truth for the
+ * `styles.colorDeltaE` config key (Spec 70 colour directive, item 2). The phase
+ * rule (`src/phase/rules/styles.ts`) and the legacy analyzer
+ * (`src/analyzers/universal/UniversalStylesAnalyzer.ts`) both read this symbol;
+ * the literal must not be re-declared elsewhere.
+ *
+ * `1.0` is the CIEDE2000 (ΔE00) just-noticeable difference. The CIEDE2000
+ * formula (Sharma, Wu & Dalal 2005, "The CIEDE2000 color-difference formula:
+ * Implementation notes, supplementary test data, and mathematical observations",
+ * Color Research & Application 30(1):21–30, doi:10.1002/col.20070; standardised
+ * as CIE 142-2001 / ISO/CIE 11664-6) is normalised so ΔE00 = 1.0 is the
+ * threshold of human perception: pairs with ΔE00 < 1.0 are perceptually
+ * indistinguishable ("near-identical") — exactly the drift the rule flags. The
+ * metric changed ΔE76 → ΔE00 in Spec 70 colour directive item 4; the prior ΔE76
+ * default of 2.5 was "JND-adjacent" to the ~2.3 ΔE76 JND with no written
+ * citation and does not transfer, because the ΔE00 JND is 1.0, not 2.3.
+ */
+export declare const DEFAULT_COLOR_DELTA_E = 1;
+/**
+ * The validator-package vocabulary — the single source of truth for which npm
+ * packages mark an imported identifier as validator-provenanced. Consumed by
+ * three sites (Spec 21 R4 / R3 cross-domain validator-bypass):
+ *   - `buildProvenanceContext` (`src/analyzers/provenance.ts`) — the
+ *     `validatorProvenanced` map the schema/data-access analyzers and the
+ *     CLI `map` command read;
+ *   - the migrated `cross-domain/no-validator-reachable` rule
+ *     (`src/phase/rules/crossDomain.ts`);
+ *   - the legacy `CrossDomainAnalyzer` (kept for the Spec 68 parity guard).
+ *
+ * This replaced the hand-maintained `VALIDATOR_PACKAGES` `ReadonlySet` that
+ * lived in `provenance.ts` and did the job of the deleted `validatorPackageList`
+ * config key. The list must not be re-declared elsewhere: consumers read the
+ * config key and fall back to this symbol (the `DEFAULT_COLOR_DELTA_E` pattern).
+ */
+export declare const DEFAULT_VALIDATOR_PACKAGES: readonly string[];
+/**
+ * The git-churn lookback window — the single source of truth for the top-level
+ * `churn` config key (Spec 13 R1). The churn extractor
+ * (`src/churn/churnExtractor.ts`) reads `churnWindowMonths` from here instead of
+ * hardcoding `12`; the two extraction call sites (`deepSync` in
+ * `src/codeIndexDB.ts` and the CLI `hotspots` command in `src/cli.ts`) read the
+ * configured `churn` key and fall back to this symbol (the `DEFAULT_COLOR_DELTA_E`
+ * pattern). The literal must not be re-declared elsewhere.
+ *
+ * `12` months is the window `git log --since` scans for file/function churn.
+ */
+export declare const DEFAULT_CHURN_CONFIG: ChurnConfig;
+/**
+ * The health-score pass/fail floor — the single source of truth for the
+ * `audit.health` (`mcp.ts`) and `audit_health` (`mcp-tools-shared.ts`) MCP
+ * tools' `threshold` parameter default. `calculateHealthScore` returns a 0-100
+ * score; below this floor a codebase reports `needs-attention`. Read by both
+ * tool-definition `default` fields and both handler fallbacks; the literal must
+ * not be re-declared elsewhere (the `DEFAULT_COLOR_DELTA_E` pattern).
+ *
+ * `70` is the cut below which `audit.health` reports `needs-attention`.
+ */
+export declare const DEFAULT_HEALTH_SCORE_THRESHOLD = 70;
+/**
+ * Resolve the health-score floor for one call. Precedence: the MCP `threshold`
+ * argument, then the configured `thresholds.minHealthScore` (read from
+ * `.codeauditor.json` by `loadMinHealthScore`), then the single default above.
+ * This is the one place the fallback is computed, so both MCP surfaces move
+ * together when the default changes. The `||` (not `??`) mirrors the historical
+ * fallback: a `0` threshold (always-pass) was — and remains — indistinguishable
+ * from "unset".
+ *
+ * @param args the MCP tool arguments carrying an optional `threshold` override
+ * @param configMin the configured `thresholds.minHealthScore` floor (if any)
+ * @returns the resolved floor, never below the single default above
+ */
+export declare function resolveHealthThreshold(args?: {
+    threshold?: number;
+}, configMin?: number): number;
+/**
+ * The blocking gate's deterministic-work budget — the single source of truth for
+ * `gateBudgetResolutions()` (Directive J). The gate (`code-audit changed`) used to
+ * be budgeted in CPU time (`auditCpuMs` < 900 ms); CPU time is load-dependent, so
+ * the gate jittered under sustained load. Directive J re-expresses the budget over
+ * a deterministic quantity instead — the number of distinct receiver resolutions
+ * the phase pipeline performed (`receiverResolutions`, the `handleVerdictCache`
+ * size after the pass). A fixed file folds `identifyHandle` a fixed number of
+ * times regardless of machine load, so a regression moves this count
+ * deterministically, where CPU time only jittered.
+ *
+ * MEASURED against `src/analyzers/universal/UniversalSOLIDAnalyzer.ts`, never
+ * carried over: re-measured each re-baseline with the architectural reason
+ * recorded. The deterministic count is `handleVerdictCache.size` for that file:
+ * 77 on every warm run (5/5 runs, zero jitter). 100 = ~30% headroom over the
+ * measured 77, matching the headroom discipline of the two prior CPU re-baselines.
+ * The headroom is NOT for jitter (there is none) — it is room for legitimate
+ * single-site growth before the tripwire fires; a real regression moves the count
+ * by 2–5×, far past 100.
+ *
+ * Formerly `src/gateBudget.ts`; moved here (Directive J correction 3) to sit
+ * alongside the other defaults rather than in a one-constant module.
+ */
+export declare const DEFAULT_GATE_BUDGET_RESOLUTIONS = 100;
+/**
+ * The env override for the gate budget, or the default. The override accepts any
+ * integer ≥ 0 (0 is the liveness knob, not "unset"); a non-numeric or negative
+ * value falls back to the default rather than tripping the gate spuriously.
+ *
+ * This is the one place `CODE_AUDITOR_GATE_BUDGET_RESOLUTIONS` is read (the
+ * `env-tunable single-source` pattern): both `cli.ts:856` (the `gate work: …
+ * (budget N)` display line) and the `verify:gate-budget` verifier read this one
+ * resolved value — the verifier parses it out of the CLI line, so the CLI is the
+ * single source and the verifier can never drift from it.
+ *
+ * @returns the resolved gate budget — the non-negative numeric override when
+ *   set, otherwise {@link DEFAULT_GATE_BUDGET_RESOLUTIONS}.
+ */
+export declare function gateBudgetResolutions(): number;
 /**
  * Default analyzer configurations
  */
@@ -30,8 +144,6 @@ export declare const DEFAULT_ANALYZER_CONFIGS: {
         maxMethodsPerClass: number;
         maxLinesPerMethod: number;
         maxParametersPerMethod: number;
-        maxImportsPerFile: number;
-        maxComplexity: number;
         maxInterfaceMembers: number;
         maxMethodComplexity: number;
         classMethodsThreshold: number;
@@ -45,28 +157,14 @@ export declare const DEFAULT_ANALYZER_CONFIGS: {
         checkStrings: boolean;
         ignoreComments: boolean;
         ignoreWhitespace: boolean;
-        checkStructuralSimilarity: boolean;
         checkExpressionSimilarity: boolean;
         minShapeNames: number;
         divergence: {
             divergenceThreshold: number;
             divergenceRuns: number;
-            minPairSimilarity: number;
         };
     };
     dataAccess: {
-        databasePatterns: {
-            postgres: string[];
-            mysql: string[];
-            mongodb: string[];
-        };
-        securityPatterns: {
-            parameterizedQueries: string[];
-        };
-        performanceThresholds: {
-            maxJoins: number;
-            warnOnSelectStar: boolean;
-        };
         detection: {
             mode: "hybrid";
         };
@@ -88,7 +186,6 @@ export declare const DEFAULT_ANALYZER_CONFIGS: {
         enableTableUsageTracking: boolean;
         checkMissingReferences: boolean;
         checkNamingConventions: boolean;
-        detectUnusedTables: boolean;
         validateQueryPatterns: boolean;
         reportUnresolvedQueries: boolean;
         maxQueriesPerFunction: number;
@@ -100,7 +197,6 @@ export declare const DEFAULT_ANALYZER_CONFIGS: {
         detection: {
             mode: "hybrid";
         };
-        validatorPackageList: string[];
         tableSources: {
             kind: string;
             name: string;
@@ -133,6 +229,7 @@ export declare const DEFAULT_ANALYZER_CONFIGS: {
         };
         validatorBypass: {
             validators: never[];
+            validatorPackageList: readonly string[];
             modeShare: number;
             minCorpus: number;
             depth: number;
@@ -145,33 +242,30 @@ export declare const DEFAULT_ANALYZER_CONFIGS: {
     };
 };
 /**
- * Built-in path profiles shipped with the tool.
- *
- * "scripts-and-tests" excludes scripts, tests, and test fixtures from the
- * blocking gate (Spec 36 R4) — grounded in the Spec 11 triage numbers showing
- * these directories produce noise, not signal. Findings still report at their
- * real severity; the gate simply does not block on them. This replaced the
- * `severityCap` soften-in-place mechanism, which made findings invisible by
- * capping them to "suggestion".
- *
- * Disable entirely via `"builtin": false` in .codeauditor.json.
- * Replace a specific built-in via a user profile with the same name
- * and `"builtin": false`.
- */
-export declare const BUILTIN_PATH_PROFILES: PathProfile[];
-/**
- * Merge built-in path profiles with user-configured profiles.
+ * No built-in path profiles ship with the tool. The "scripts-and-tests" profile
+ * that excluded scripts, tests, and fixtures from the blocking gate (Spec 36 R4)
+ * is removed: a compiled-in glob list that marks `gateExcluded: true` is a
+ * hand-maintained exemption list baked into the binary — the same defect as a
+ * suppression file, just shipped instead of written per project. A script with a
+ * hardcoded connection string or a fixture with dynamic SQL gates like any other
+ * file; teams that want an opt-out declare it explicitly in their own
+ * `.codeauditor.json` as a user path profile.
  *
- * - `builtin: false` at top level → no built-ins
- * - User profile with `builtin: false` → replaces built-in of same name
- * - Otherwise: built-ins come first, user profiles appended after
- *   (later wins on conflict)
+ * There is therefore no built-in/user merge to perform, and the `builtin` config
+ * key that once selected a built-in profile is inert — it is still accepted (so
+ * a config that sets `builtin: false` validates and behaves as before) but it
+ * selects nothing, because there is nothing to select. The `BUILTIN_PATH_PROFILES`
+ * list and the built-in name-replacement machinery are deleted rather than left
+ * as an empty seam: an empty list invites the neighbouring reading "there are
+ * built-ins, there just happen to be zero today", when the truth is the
+ * mechanism itself is gone.
  *
- * @param userProfiles The user-configured path profiles to merge.
- * @param builtinEnabled Whether the built-in profiles are enabled (false disables all).
- * @returns The merged profile array, or undefined if no profiles active
+ * @param userProfiles The user-configured path profiles to pass through.
+ * @param _builtinEnabled Inert — no built-in profile ships; retained only so a
+ *   config that sets `builtin: false` validates and behaves as before.
+ * @returns The user profiles when non-empty, otherwise undefined.
  */
-export declare function mergePathProfiles(userProfiles: PathProfile[] | undefined, builtinEnabled: boolean | undefined): PathProfile[] | undefined;
+export declare function mergePathProfiles(userProfiles: PathProfile[] | undefined, _builtinEnabled: boolean | undefined): PathProfile[] | undefined;
 /**
  * Default code index configuration
  */

package/dist/config/defaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEvD;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAyC9C;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA8BhF;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAuBxE;AAED;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyMpC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qBAAqB,EAAE,WAAW,EAqB9C,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,WAAW,EAAE,GAAG,SAAS,EACvC,cAAc,EAAE,OAAO,GAAG,SAAS,GAClC,WAAW,EAAE,GAAG,SAAS,CAqB3B;AAED;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;CAQrC,CAAC"}
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEpE;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CA0C9C;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA8BhF;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAkBxE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,qBAAqB,IAAM,CAAC;AAEzC;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,0BAA0B,EAAE,SAAS,MAAM,EAUvD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAElC,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,8BAA8B,KAAK,CAAC;AAEjD;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EAC7B,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,CAER;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAEnD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,CAO9C;AAED;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkLpC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,WAAW,EAAE,GAAG,SAAS,EACvC,eAAe,EAAE,OAAO,GAAG,SAAS,GACnC,WAAW,EAAE,GAAG,SAAS,CAE3B;AAED;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;CAQrC,CAAC"}

package/dist/config/defaults.js

@@ -24,22 +24,23 @@ export function getDefaultConfig() {
             '**/*.test.{ts,tsx,js,jsx}',
             '**/*.spec.{ts,tsx,js,jsx}'
         ],
-        // Note: no `outputFormats`/`outputDirectory` default. Reports are written
-        // only to an explicit CLI `--output` path (or stdout); a config default here
-        // would advertise a key that `print-config` then shows and the loader then
-        // refuses/ignores. See configLoader.ts `output-directory-refused`.
+        // Note: no `outputDirectory` default. Reports are written only to an explicit
+        // CLI `--output` path (or stdout); a config default here would advertise a key
+        // that `print-config` then shows and the loader then refuses. See
+        // configLoader.ts `output-directory-refused`.
         minSeverity: 'high',
-        failOnCritical: false,
-        showProgress: true,
-        thresholds: {
-            maxCritical: 0,
-            maxSevere: 100,
-            minHealthScore: 75
-        },
+        // Spec 11 sweep follow-up — the health-score floor, single-sourced to
+        // DEFAULT_HEALTH_SCORE_THRESHOLD (referenced, not re-declared). The removed
+        // `maxSevere`/`maxCritical`/`maxHigh` siblings are gone for good.
+        thresholds: { minHealthScore: DEFAULT_HEALTH_SCORE_THRESHOLD },
         // Spec 54 R3 — severity is urgency, not permission. There is no
         // `severityOverrides` and no `gateSeverities`: every rule is assigned on the
         // urgency axis (critical/severe/high) and every finding blocks. Per-rule
         // severity tuning disappeared with the old vocabulary.
+        // Spec 13 R1 — churn lookback window. The single default lives in
+        // DEFAULT_CHURN_CONFIG above; referencing it here (not re-declaring) is what
+        // keeps `loadConfig` and `print-config` honest about the effective value.
+        churn: DEFAULT_CHURN_CONFIG,
         // Spec 50 R5 — daemon lifecycle. Never auto-start (a background process the
         // user did not ask for); idle-exit after 5 minutes so it does not linger.
         daemon: {
@@ -91,31 +92,157 @@ export function getProjectTypeDefaults(projectType) {
 export function getEnvironmentDefaults(env) {
     switch (env) {
         case 'ci':
-            return {
-                failOnCritical: true,
-                showProgress: false
-            };
+            return {};
         case 'development':
             return {
-                showProgress: true,
                 minSeverity: 'high'
             };
         case 'production':
             return {
-                minSeverity: 'severe',
-                failOnCritical: true
+                minSeverity: 'severe'
             };
         default:
             return {};
     }
 }
+/**
+ * The value-drift colour threshold — the single source of truth for the
+ * `styles.colorDeltaE` config key (Spec 70 colour directive, item 2). The phase
+ * rule (`src/phase/rules/styles.ts`) and the legacy analyzer
+ * (`src/analyzers/universal/UniversalStylesAnalyzer.ts`) both read this symbol;
+ * the literal must not be re-declared elsewhere.
+ *
+ * `1.0` is the CIEDE2000 (ΔE00) just-noticeable difference. The CIEDE2000
+ * formula (Sharma, Wu & Dalal 2005, "The CIEDE2000 color-difference formula:
+ * Implementation notes, supplementary test data, and mathematical observations",
+ * Color Research & Application 30(1):21–30, doi:10.1002/col.20070; standardised
+ * as CIE 142-2001 / ISO/CIE 11664-6) is normalised so ΔE00 = 1.0 is the
+ * threshold of human perception: pairs with ΔE00 < 1.0 are perceptually
+ * indistinguishable ("near-identical") — exactly the drift the rule flags. The
+ * metric changed ΔE76 → ΔE00 in Spec 70 colour directive item 4; the prior ΔE76
+ * default of 2.5 was "JND-adjacent" to the ~2.3 ΔE76 JND with no written
+ * citation and does not transfer, because the ΔE00 JND is 1.0, not 2.3.
+ */
+export const DEFAULT_COLOR_DELTA_E = 1.0;
+/**
+ * The validator-package vocabulary — the single source of truth for which npm
+ * packages mark an imported identifier as validator-provenanced. Consumed by
+ * three sites (Spec 21 R4 / R3 cross-domain validator-bypass):
+ *   - `buildProvenanceContext` (`src/analyzers/provenance.ts`) — the
+ *     `validatorProvenanced` map the schema/data-access analyzers and the
+ *     CLI `map` command read;
+ *   - the migrated `cross-domain/no-validator-reachable` rule
+ *     (`src/phase/rules/crossDomain.ts`);
+ *   - the legacy `CrossDomainAnalyzer` (kept for the Spec 68 parity guard).
+ *
+ * This replaced the hand-maintained `VALIDATOR_PACKAGES` `ReadonlySet` that
+ * lived in `provenance.ts` and did the job of the deleted `validatorPackageList`
+ * config key. The list must not be re-declared elsewhere: consumers read the
+ * config key and fall back to this symbol (the `DEFAULT_COLOR_DELTA_E` pattern).
+ */
+export const DEFAULT_VALIDATOR_PACKAGES = [
+    'zod',
+    'joi',
+    'ajv',
+    'valibot',
+    'yup',
+    'superstruct',
+    'arktype',
+    '@sinclair/typebox',
+    'class-validator',
+];
+/**
+ * The git-churn lookback window — the single source of truth for the top-level
+ * `churn` config key (Spec 13 R1). The churn extractor
+ * (`src/churn/churnExtractor.ts`) reads `churnWindowMonths` from here instead of
+ * hardcoding `12`; the two extraction call sites (`deepSync` in
+ * `src/codeIndexDB.ts` and the CLI `hotspots` command in `src/cli.ts`) read the
+ * configured `churn` key and fall back to this symbol (the `DEFAULT_COLOR_DELTA_E`
+ * pattern). The literal must not be re-declared elsewhere.
+ *
+ * `12` months is the window `git log --since` scans for file/function churn.
+ */
+export const DEFAULT_CHURN_CONFIG = {
+    churnWindowMonths: 12,
+};
+/**
+ * The health-score pass/fail floor — the single source of truth for the
+ * `audit.health` (`mcp.ts`) and `audit_health` (`mcp-tools-shared.ts`) MCP
+ * tools' `threshold` parameter default. `calculateHealthScore` returns a 0-100
+ * score; below this floor a codebase reports `needs-attention`. Read by both
+ * tool-definition `default` fields and both handler fallbacks; the literal must
+ * not be re-declared elsewhere (the `DEFAULT_COLOR_DELTA_E` pattern).
+ *
+ * `70` is the cut below which `audit.health` reports `needs-attention`.
+ */
+export const DEFAULT_HEALTH_SCORE_THRESHOLD = 70;
+/**
+ * Resolve the health-score floor for one call. Precedence: the MCP `threshold`
+ * argument, then the configured `thresholds.minHealthScore` (read from
+ * `.codeauditor.json` by `loadMinHealthScore`), then the single default above.
+ * This is the one place the fallback is computed, so both MCP surfaces move
+ * together when the default changes. The `||` (not `??`) mirrors the historical
+ * fallback: a `0` threshold (always-pass) was — and remains — indistinguishable
+ * from "unset".
+ *
+ * @param args the MCP tool arguments carrying an optional `threshold` override
+ * @param configMin the configured `thresholds.minHealthScore` floor (if any)
+ * @returns the resolved floor, never below the single default above
+ */
+export function resolveHealthThreshold(args, configMin) {
+    return args?.threshold || configMin || DEFAULT_HEALTH_SCORE_THRESHOLD;
+}
+/**
+ * The blocking gate's deterministic-work budget — the single source of truth for
+ * `gateBudgetResolutions()` (Directive J). The gate (`code-audit changed`) used to
+ * be budgeted in CPU time (`auditCpuMs` < 900 ms); CPU time is load-dependent, so
+ * the gate jittered under sustained load. Directive J re-expresses the budget over
+ * a deterministic quantity instead — the number of distinct receiver resolutions
+ * the phase pipeline performed (`receiverResolutions`, the `handleVerdictCache`
+ * size after the pass). A fixed file folds `identifyHandle` a fixed number of
+ * times regardless of machine load, so a regression moves this count
+ * deterministically, where CPU time only jittered.
+ *
+ * MEASURED against `src/analyzers/universal/UniversalSOLIDAnalyzer.ts`, never
+ * carried over: re-measured each re-baseline with the architectural reason
+ * recorded. The deterministic count is `handleVerdictCache.size` for that file:
+ * 77 on every warm run (5/5 runs, zero jitter). 100 = ~30% headroom over the
+ * measured 77, matching the headroom discipline of the two prior CPU re-baselines.
+ * The headroom is NOT for jitter (there is none) — it is room for legitimate
+ * single-site growth before the tripwire fires; a real regression moves the count
+ * by 2–5×, far past 100.
+ *
+ * Formerly `src/gateBudget.ts`; moved here (Directive J correction 3) to sit
+ * alongside the other defaults rather than in a one-constant module.
+ */
+export const DEFAULT_GATE_BUDGET_RESOLUTIONS = 100;
+/**
+ * The env override for the gate budget, or the default. The override accepts any
+ * integer ≥ 0 (0 is the liveness knob, not "unset"); a non-numeric or negative
+ * value falls back to the default rather than tripping the gate spuriously.
+ *
+ * This is the one place `CODE_AUDITOR_GATE_BUDGET_RESOLUTIONS` is read (the
+ * `env-tunable single-source` pattern): both `cli.ts:856` (the `gate work: …
+ * (budget N)` display line) and the `verify:gate-budget` verifier read this one
+ * resolved value — the verifier parses it out of the CLI line, so the CLI is the
+ * single source and the verifier can never drift from it.
+ *
+ * @returns the resolved gate budget — the non-negative numeric override when
+ *   set, otherwise {@link DEFAULT_GATE_BUDGET_RESOLUTIONS}.
+ */
+export function gateBudgetResolutions() {
+    const raw = process.env.CODE_AUDITOR_GATE_BUDGET_RESOLUTIONS;
+    if (raw !== undefined && raw !== '') {
+        const n = Number(raw);
+        if (Number.isFinite(n) && n >= 0)
+            return n;
+    }
+    return DEFAULT_GATE_BUDGET_RESOLUTIONS;
+}
 /**
  * Default analyzer configurations
  */
 export const DEFAULT_ANALYZER_CONFIGS = {
-    // Spec-17 R5: maxComplexity (old heuristic) deprecated; use maxMethodComplexity
-    // and classAggregateComplexity for true cyclomatic complexity.
-    //
     // AUTHORITATIVE source is DEFAULT_SOLID_CONFIG (UniversalSOLIDAnalyzer.ts) —
     // the pipeline and `--print-config` resolve from there (RUNTIME_DEFAULT_CONFIGS),
     // NOT from this copy. This namespace is exported from the library (`src/index.ts`)
@@ -126,8 +253,6 @@ export const DEFAULT_ANALYZER_CONFIGS = {
         maxMethodsPerClass: 20,
         maxLinesPerMethod: 200,
         maxParametersPerMethod: 6,
-        maxImportsPerFile: 5, // Spec 11 R3 sweep: 20 → 5 (precision-first)
-        maxComplexity: 10, // DEPRECATED — old heuristic
         maxInterfaceMembers: 25,
         // R5.1: Per-method cyclomatic complexity threshold (true McCC)
         maxMethodComplexity: 50,
@@ -156,7 +281,6 @@ export const DEFAULT_ANALYZER_CONFIGS = {
         checkStrings: false,
         ignoreComments: true,
         ignoreWhitespace: true,
-        checkStructuralSimilarity: false,
         checkExpressionSimilarity: true,
         minShapeNames: 4,
         // Spec 13 R5 — Diverging-clone detection. The pipeline reads this from the
@@ -165,22 +289,9 @@ export const DEFAULT_ANALYZER_CONFIGS = {
         divergence: {
             divergenceThreshold: 0.05,
             divergenceRuns: 2,
-            minPairSimilarity: 0.5,
         },
     },
     dataAccess: {
-        databasePatterns: {
-            postgres: ['pg', 'postgres', 'postgresql'],
-            mysql: ['mysql', 'mysql2'],
-            mongodb: ['mongodb', 'mongoose']
-        },
-        securityPatterns: {
-            parameterizedQueries: ['?', '$1', ':param'],
-        },
-        performanceThresholds: {
-            maxJoins: 5,
-            warnOnSelectStar: true
-        },
         // Spec 21 R3: shared detection mode — provenance-primary with name-fallback
         detection: {
             mode: 'hybrid',
@@ -230,7 +341,6 @@ export const DEFAULT_ANALYZER_CONFIGS = {
         enableTableUsageTracking: true,
         checkMissingReferences: true,
         checkNamingConventions: true,
-        detectUnusedTables: false,
         validateQueryPatterns: true,
         reportUnresolvedQueries: true,
         maxQueriesPerFunction: 1, // Spec 11 R3 sweep: 5 → 1 (precision-first)
@@ -243,11 +353,6 @@ export const DEFAULT_ANALYZER_CONFIGS = {
         detection: {
             mode: 'hybrid',
         },
-        // Spec 21 R4: validator package list for provenanced validator detection
-        validatorPackageList: [
-            'zod', 'joi', 'ajv', 'valibot', 'yup', 'superstruct', 'arktype',
-            '@sinclair/typebox', 'class-validator',
-        ],
         // Spec 29: Declarative table-source registry — Tier 2 (ORM detection).
         // Adding an ORM becomes a config entry, not code.
         tableSources: [
@@ -258,7 +363,7 @@ export const DEFAULT_ANALYZER_CONFIGS = {
     },
     // Spec 10 R3: style intelligence analyzer defaults
     styles: {
-        colorDeltaE: 2.5,
+        colorDeltaE: DEFAULT_COLOR_DELTA_E,
         scaleProperties: [
             'margin', 'margin-top', 'margin-right', 'margin-bottom', 'margin-left',
             'padding', 'padding-top', 'padding-right', 'padding-bottom', 'padding-left',
@@ -294,6 +399,9 @@ export const DEFAULT_ANALYZER_CONFIGS = {
         },
         validatorBypass: {
             validators: [],
+            // The package vocabulary for provenanced-validator detection (Spec 21 R4).
+            // Overridable via `analyzerConfigs["cross-domain"].validatorBypass.validatorPackageList`.
+            validatorPackageList: DEFAULT_VALIDATOR_PACKAGES,
             modeShare: 0.8,
             minCorpus: 20,
             depth: 3,
@@ -306,66 +414,31 @@ export const DEFAULT_ANALYZER_CONFIGS = {
     },
 };
 /**
- * Built-in path profiles shipped with the tool.
+ * No built-in path profiles ship with the tool. The "scripts-and-tests" profile
+ * that excluded scripts, tests, and fixtures from the blocking gate (Spec 36 R4)
+ * is removed: a compiled-in glob list that marks `gateExcluded: true` is a
+ * hand-maintained exemption list baked into the binary — the same defect as a
+ * suppression file, just shipped instead of written per project. A script with a
+ * hardcoded connection string or a fixture with dynamic SQL gates like any other
+ * file; teams that want an opt-out declare it explicitly in their own
+ * `.codeauditor.json` as a user path profile.
  *
- * "scripts-and-tests" excludes scripts, tests, and test fixtures from the
- * blocking gate (Spec 36 R4) — grounded in the Spec 11 triage numbers showing
- * these directories produce noise, not signal. Findings still report at their
- * real severity; the gate simply does not block on them. This replaced the
- * `severityCap` soften-in-place mechanism, which made findings invisible by
- * capping them to "suggestion".
+ * There is therefore no built-in/user merge to perform, and the `builtin` config
+ * key that once selected a built-in profile is inert — it is still accepted (so
+ * a config that sets `builtin: false` validates and behaves as before) but it
+ * selects nothing, because there is nothing to select. The `BUILTIN_PATH_PROFILES`
+ * list and the built-in name-replacement machinery are deleted rather than left
+ * as an empty seam: an empty list invites the neighbouring reading "there are
+ * built-ins, there just happen to be zero today", when the truth is the
+ * mechanism itself is gone.
  *
- * Disable entirely via `"builtin": false` in .codeauditor.json.
- * Replace a specific built-in via a user profile with the same name
- * and `"builtin": false`.
+ * @param userProfiles The user-configured path profiles to pass through.
+ * @param _builtinEnabled Inert — no built-in profile ships; retained only so a
+ *   config that sets `builtin: false` validates and behaves as before.
+ * @returns The user profiles when non-empty, otherwise undefined.
  */
-export const BUILTIN_PATH_PROFILES = [
-    {
-        name: 'scripts-and-tests',
-        paths: [
-            'scripts/**',
-            'tests/**',
-            'test/**',
-            '__tests__/**',
-            'fixtures/**',
-            // Type-test suites use their own directory and extension conventions.
-            // They exercise types, not behavior — a hardcoded connection string or
-            // dynamic SQL in a `.test-d.ts`/`.tst.ts` file is the file doing its job.
-            'test-tsd/**',
-            'test-tstyche/**',
-            '**/*.test-d.ts',
-            '**/*.tst.ts',
-            '*.test.*',
-            '*.spec.*',
-        ],
-        overrides: { excludeFromGate: true },
-    },
-];
-/**
- * Merge built-in path profiles with user-configured profiles.
- *
- * - `builtin: false` at top level → no built-ins
- * - User profile with `builtin: false` → replaces built-in of same name
- * - Otherwise: built-ins come first, user profiles appended after
- *   (later wins on conflict)
- *
- * @param userProfiles The user-configured path profiles to merge.
- * @param builtinEnabled Whether the built-in profiles are enabled (false disables all).
- * @returns The merged profile array, or undefined if no profiles active
- */
-export function mergePathProfiles(userProfiles, builtinEnabled) {
-    // builtin: false disables all built-in profiles
-    if (builtinEnabled === false) {
-        return userProfiles && userProfiles.length > 0 ? userProfiles : undefined;
-    }
-    if (!userProfiles || userProfiles.length === 0) {
-        // No user profiles — use built-ins only
-        return BUILTIN_PATH_PROFILES.length > 0 ? [...BUILTIN_PATH_PROFILES] : undefined;
-    }
-    // Merge: built-ins first, user profiles appended (later wins)
-    const userReplaced = new Set(userProfiles.filter((p) => p.builtin === false).map((p) => p.name));
-    const activeBuiltins = BUILTIN_PATH_PROFILES.filter((b) => !userReplaced.has(b.name));
-    return [...activeBuiltins, ...userProfiles];
+export function mergePathProfiles(userProfiles, _builtinEnabled) {
+    return userProfiles && userProfiles.length > 0 ? userProfiles : undefined;
 }
 /**
  * Default code index configuration