docgrity 0.1.2 → 0.1.3

package/action/examples/docgrity.yml

@@ -1,61 +0,0 @@
-# Example workflow: copy into your repo as .github/workflows/docgrity.yml
-name: Docgrity docs scan
-
-on:
-  schedule:
-    - cron: '0 6 * * 1' # weekly, Monday 06:00 UTC
-  pull_request:
-    paths: ['**/*.md']
-  workflow_dispatch: {}
-
-permissions:
-  contents: read
-  issues: write   # only needed when create_issues: true
-  models: read    # GitHub Models (default provider, free)
-  pages: write    # only needed for the Pages report job below
-  id-token: write # only needed for the Pages report job below
-
-jobs:
-  scan:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0 # full history so potential owners resolve via git log
-
-      - name: Docgrity scan
-        id: docgrity
-        uses: ujjavala/docgrity-vscode/action@main
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          provider: github-models      # or gemini/openai/anthropic + api_key
-          # api_key: ${{ secrets.DOCGRITY_API_KEY }}
-          create_issues: ${{ github.event_name == 'schedule' }} # opt-in: only weekly runs raise issues
-          max_new_issues: 5
-
-      - name: Upload report artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: docgrity-report
-          path: docgrity-report/
-
-  # Optional: publish the report to GitHub Pages (visibility follows repo access).
-  publish-report:
-    needs: scan
-    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-latest
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-    steps:
-      - uses: actions/download-artifact@v4
-        with:
-          name: docgrity-report
-          path: site
-      - uses: actions/configure-pages@v5
-      - uses: actions/upload-pages-artifact@v3
-        with:
-          path: site
-      - id: deployment
-        uses: actions/deploy-pages@v4

package/action/package.json

@@ -1,38 +0,0 @@
-{
-  "name": "docgrity",
-  "version": "0.1.2",
-  "description": "Docgrity doc-integrity scans for CI and local use: contradictions, duplicates and open questions across repository markdown docs. Read-only CLI — generates an HTML report; never posts anything.",
-  "type": "module",
-  "bin": { "docgrity": "bin/docgrity.js" },
-  "files": [
-    "bin/",
-    "src/",
-    "action.yml",
-    "README.md",
-    "LICENSE"
-  ],
-  "engines": { "node": ">=20" },
-  "scripts": {
-    "scan": "node bin/docgrity.js scan",
-    "test": "node --test \"test/*.test.mjs\""
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/ujjavala/docgrity-vscode.git",
-    "directory": "action"
-  },
-  "homepage": "https://ujjavala.github.io/docgrity-vscode-site/",
-  "bugs": "https://github.com/ujjavala/docgrity-vscode/issues",
-  "keywords": [
-    "documentation",
-    "markdown",
-    "lint",
-    "contradiction",
-    "duplicate",
-    "llm",
-    "cli",
-    "github-action"
-  ],
-  "author": "ujjavala",
-  "license": "MIT"
-}

package/action/test/corpus.test.mjs

@@ -1,59 +0,0 @@
-/** corpus.js tests — md-only collection, TF-IDF pairing, owner inference. */
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { mkdtemp, mkdir, writeFile, rm } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import path from 'node:path';
-import { collectCorpus, selectCandidatePairs, githubRepoSlug } from '../src/corpus.js';
-
-const doc = (relPath, text) => ({ relPath, text, hash: relPath });
-
-test('selectCandidatePairs pairs similar docs, ignores unrelated ones', () => {
-  const a = doc('a.md', 'deployment guide for the payments service using canary rollout and grafana dashboards '.repeat(4));
-  const b = doc('b.md', 'release process for the payments service with canary rollout watched in grafana '.repeat(4));
-  const c = doc('c.md', 'chocolate cake recipe flour sugar eggs butter vanilla oven baking whisk frosting '.repeat(4));
-  const pairs = selectCandidatePairs([a, b, c]);
-  assert.ok(pairs.some((p) => p.a.relPath === 'a.md' && p.b.relPath === 'b.md'), 'similar docs must pair');
-  assert.ok(!pairs.some((p) => p.a.relPath === 'c.md' || p.b.relPath === 'c.md'), 'unrelated doc must not pair');
-});
-
-test('selectCandidatePairs strips code blocks before comparing', () => {
-  const code = '```\nconst deploy = canary(grafana, rollout, payments, service);\n```';
-  const a = doc('a.md', `${code} completely unrelated prose about gardening tulips soil watering sunlight`.repeat(3));
-  const b = doc('b.md', `${code} astronomy telescope galaxy nebula orbit planets observation stars`.repeat(3));
-  const pairs = selectCandidatePairs([a, b]);
-  assert.equal(pairs.length, 0, 'shared code blocks alone must not create a pair');
-});
-
-test('selectCandidatePairs respects maxPairs cap', () => {
-  const docs = Array.from({ length: 6 }, (_, i) =>
-    doc(`d${i}.md`, 'payments service deployment canary rollout grafana monitoring alerts '.repeat(4))
-  );
-  assert.ok(selectCandidatePairs(docs, 3).length <= 3);
-});
-
-test('collectCorpus: markdown only, skips ignored dirs and trivial files', async () => {
-  const root = await mkdtemp(path.join(tmpdir(), 'docgrity-'));
-  try {
-    const big = 'This document is long enough to be included in the corpus. '.repeat(3);
-    await writeFile(path.join(root, 'keep.md'), big);
-    await writeFile(path.join(root, 'skip.txt'), big);
-    await writeFile(path.join(root, 'tiny.md'), 'too short');
-    await mkdir(path.join(root, 'node_modules'), { recursive: true });
-    await writeFile(path.join(root, 'node_modules', 'dep.md'), big);
-    const docs = await collectCorpus(root);
-    assert.deepEqual(docs.map((d) => d.relPath), ['keep.md']);
-    assert.match(docs[0].hash, /^[0-9a-f]{64}$/);
-  } finally {
-    await rm(root, { recursive: true, force: true });
-  }
-});
-
-test('githubRepoSlug returns undefined outside a git repo', async () => {
-  const root = await mkdtemp(path.join(tmpdir(), 'docgrity-'));
-  try {
-    assert.equal(await githubRepoSlug(root), undefined);
-  } finally {
-    await rm(root, { recursive: true, force: true });
-  }
-});

package/action/test/issues.test.mjs

@@ -1,89 +0,0 @@
-/** issues.js tests — dedupe by fingerprint, close resolved, cap creation.
- * GitHub API is mocked via global fetch; the LLM client is a stub. */
-import { test, beforeEach } from 'node:test';
-import assert from 'node:assert/strict';
-import { syncIssues } from '../src/issues.js';
-
-const SLUG = 'me/repo';
-const MARKER = (fp) => `<!-- docgrity:fingerprint:${fp} -->`;
-
-const stubClient = {
-  model: 'stub',
-  async complete() {
-    return JSON.stringify({ title: 'Drafted title', body: 'Drafted body' });
-  },
-};
-
-const finding = (fp, over = {}) => ({
-  fingerprint: fp,
-  type: 'duplicate',
-  severity: 'MEDIUM',
-  confidence: 0.8,
-  summary: 'dup',
-  evidence: [{ sourceLabel: 'a.md', excerpt: 'x' }],
-  files: ['a.md'],
-  potentialOwners: [],
-  model: 'stub',
-  promptVersion: 'v1',
-  ...over,
-});
-
-let calls;
-let openIssues;
-
-beforeEach(() => {
-  calls = [];
-  openIssues = [];
-  let nextNumber = 100;
-  globalThis.fetch = async (url, init = {}) => {
-    const method = init.method ?? 'GET';
-    const u = new URL(url);
-    calls.push({ method, path: u.pathname, body: init.body ? JSON.parse(init.body) : null });
-    assert.match(init.headers.Authorization, /^Bearer /, 'token must be a bearer header');
-    if (method === 'GET') return { ok: true, status: 200, json: async () => openIssues };
-    if (method === 'POST' && u.pathname.endsWith('/issues')) {
-      const n = nextNumber++;
-      return { ok: true, status: 201, json: async () => ({ number: n, html_url: `https://github.com/${SLUG}/issues/${n}` }) };
-    }
-    return { ok: true, status: 200, json: async () => ({}) };
-  };
-});
-
-test('creates issues for new findings with fingerprint marker and labels', async () => {
-  const f = finding('aaaaaaaaaaaaaaaa');
-  const result = await syncIssues({ client: stubClient, token: 't', slug: SLUG, findings: [f] });
-  assert.equal(result.created.length, 1);
-  const create = calls.find((c) => c.method === 'POST' && c.path === `/repos/${SLUG}/issues`);
-  assert.ok(create.body.body.includes(MARKER('aaaaaaaaaaaaaaaa')), 'marker must be embedded');
-  assert.deepEqual(create.body.labels, ['docgrity', 'docgrity:duplicate']);
-  assert.ok(f.issueUrl, 'finding gets its issue url');
-});
-
-test('dedupes: existing fingerprint means no new issue', async () => {
-  openIssues = [{ number: 7, html_url: 'u', body: `text ${MARKER('bbbbbbbbbbbbbbbb')}` }];
-  const result = await syncIssues({
-    client: stubClient,
-    token: 't',
-    slug: SLUG,
-    findings: [finding('bbbbbbbbbbbbbbbb')],
-  });
-  assert.equal(result.created.length, 0);
-  assert.equal(result.unchanged, 1);
-  assert.ok(!calls.some((c) => c.method === 'POST' && c.path === `/repos/${SLUG}/issues`));
-});
-
-test('closes issues whose finding is resolved', async () => {
-  openIssues = [{ number: 9, html_url: 'u', body: MARKER('cccccccccccccccc') }];
-  const result = await syncIssues({ client: stubClient, token: 't', slug: SLUG, findings: [] });
-  assert.deepEqual(result.closed, [9]);
-  const patch = calls.find((c) => c.method === 'PATCH');
-  assert.deepEqual(patch.body, { state: 'closed' });
-  assert.ok(calls.some((c) => c.path.endsWith('/9/comments')), 'closing comment posted');
-});
-
-test('caps new issues per run', async () => {
-  const findings = ['1111111111111111', '2222222222222222', '3333333333333333'].map(finding);
-  const result = await syncIssues({ client: stubClient, token: 't', slug: SLUG, findings, maxNewIssues: 2 });
-  assert.equal(result.created.length, 2);
-  assert.equal(result.skipped, 1);
-});

package/action/test/report.test.mjs

@@ -1,76 +0,0 @@
-/** report.js tests — dashboard rendering, XSS escaping, empty state. */
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { renderReport, renderSummaryMarkdown } from '../src/report.js';
-
-const stats = { docs: 5, pairs: 9, scannedAt: '2026-09-05T00:00:00Z' };
-
-const finding = (over = {}) => ({
-  fingerprint: 'abcd1234abcd1234',
-  type: 'contradiction',
-  severity: 'HIGH',
-  confidence: 0.91,
-  summary: 'Docs disagree on rate limits',
-  detail: { conflicting_claims: ['100 rpm', '1000 rpm'] },
-  evidence: [{ sourceLabel: 'a.md', excerpt: 'limited to 100 requests' }],
-  files: ['a.md', 'b.md'],
-  potentialOwners: ['alice'],
-  model: 'gemini:test',
-  promptVersion: 'v1',
-  createdAt: '2026-09-05T00:00:00Z',
-  ...over,
-});
-
-test('renderReport shows stat cards with correct counts', () => {
-  const html = renderReport({
-    findings: [finding(), finding({ type: 'duplicate', fingerprint: 'ffff0000ffff0000' })],
-    stats,
-  });
-  assert.match(html, /Open findings/);
-  assert.match(html, /<div class="num">2<\/div>/); // total
-  assert.match(html, /Duplicates/);
-  assert.match(html, /Contradictions/);
-  assert.match(html, /Open questions/);
-  assert.match(html, /class="ic/); // icons present
-});
-
-test('renderReport escapes HTML everywhere (XSS guard)', () => {
-  const html = renderReport({
-    findings: [
-      finding({
-        summary: '<script>alert(1)</script>',
-        files: ['<img src=x onerror=1>.md'],
-        evidence: [{ sourceLabel: '"><svg>', excerpt: '<iframe>' }],
-        potentialOwners: ['<b>owner</b>'],
-        detail: { conflicting_claims: ['<script>x</script>'] },
-      }),
-    ],
-    stats,
-  });
-  assert.ok(!html.includes('<script>alert(1)</script>'));
-  assert.ok(!html.includes('<img src=x'));
-  assert.ok(!html.includes('<iframe>'));
-  assert.ok(!html.includes('<b>owner</b>'));
-  assert.ok(html.includes('&lt;script&gt;alert(1)&lt;/script&gt;'));
-});
-
-test('renderReport links files only when repoSlug present', () => {
-  const withSlug = renderReport({ findings: [finding()], stats, repoSlug: 'me/repo', branch: 'main' });
-  assert.match(withSlug, /https:\/\/github\.com\/me\/repo\/blob\/main\/a\.md/);
-  const noSlug = renderReport({ findings: [finding()], stats });
-  assert.ok(!noSlug.includes('github.com/me/repo'));
-});
-
-test('renderReport shows friendly empty state', () => {
-  const html = renderReport({ findings: [], stats });
-  assert.match(html, /No findings/);
-  assert.match(html, /class="empty"/);
-});
-
-test('renderSummaryMarkdown escapes pipes and lists findings', () => {
-  const md = renderSummaryMarkdown({ findings: [finding({ summary: 'a | b' })], stats });
-  assert.match(md, /a \\\| b/);
-  assert.match(md, /\| contradiction \| HIGH \| 91% \|/);
-  const empty = renderSummaryMarkdown({ findings: [], stats });
-  assert.match(empty, /No findings/);
-});

package/media/icon.svg

@@ -1,5 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round">
-  <path d="M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z"/>
-  <path d="M14 2v6h6"/>
-  <path d="M9 15l2 2 4-4"/>
-</svg>

package/samples/api-limits.md

@@ -1,23 +0,0 @@
-# API Rate Limits
-
-Rate limiting policy for the public payments API.
-
-## Limits
-
-Every API key is limited to **100 requests per minute**. Requests beyond the
-limit receive HTTP `429 Too Many Requests` with a `Retry-After` header.
-
-Burst traffic is not tolerated: the limiter uses a fixed one-minute window
-with no burst allowance.
-
-## Authentication
-
-All API requests must authenticate with the `X-Api-Key` header. Bearer tokens
-are **not supported** on the public API — they are reserved for internal
-service-to-service calls.
-
-## Webhooks
-
-Webhook deliveries are retried up to 3 times with exponential backoff. After
-the third failure the webhook endpoint is disabled and the account owner is
-emailed.

package/samples/architecture-notes.md

@@ -1,28 +0,0 @@
-# Architecture Notes — Payments Service
-
-Working notes from the March architecture review. Several decisions are still
-open and need owners.
-
-## Data store
-
-We currently use Postgres for the ledger. TBD: do we shard by merchant ID or
-by region? The sharding decision blocks the multi-region rollout and nobody
-has been assigned to make the call.
-
-## Event bus
-
-Kafka vs SQS is still an open question. Kafka gives us replay but SQS is what
-the platform team supports. Who decides this? Unclear — the platform team says
-it is a product decision, product says it is a platform decision.
-
-## Idempotency
-
-TODO: we have not defined what the idempotency key format should be for the
-new refunds endpoint. The old endpoint used UUIDv4 but there was a proposal to
-switch to ULIDs — no conclusion was reached in the review.
-
-## PCI scope
-
-It remains unresolved whether the new tokenisation proxy takes the webhook
-relay out of PCI scope. Awaiting a ruling from the compliance team (asked in
-January, no response yet).

package/samples/deployment-guide.md

@@ -1,23 +0,0 @@
-# Deployment Guide
-
-This document explains how to deploy the payments service to production.
-
-## Prerequisites
-
-- Node.js 22 installed locally
-- Access to the `prod-deployers` GitHub team
-- The `PAYMENTS_DEPLOY_KEY` secret configured in your environment
-
-## Steps
-
-1. Create a release branch from `main` named `release/vX.Y.Z`.
-2. Run the full test suite: `npm test -- --coverage`.
-3. Bump the version in `package.json` and update `CHANGELOG.md`.
-4. Tag the release: `git tag vX.Y.Z && git push --tags`.
-5. Trigger the deploy workflow from the Actions tab, selecting the tag.
-6. Watch the canary rollout in Grafana for 15 minutes before promoting to 100%.
-
-## Rollback
-
-If error rates exceed 1% during canary, run the `rollback` workflow with the
-previous tag. Rollbacks complete in under 5 minutes.

package/samples/integration-guide.md

@@ -1,21 +0,0 @@
-# Partner Integration Guide
-
-A quick-start guide for partners integrating with the public payments API.
-
-## Getting started
-
-Request an API key from the developer portal. Every API key allows
-**1000 requests per minute**, and the rate limiter supports short bursts of
-up to 2000 requests thanks to a sliding-window algorithm with burst credit.
-
-## Authentication
-
-Authenticate every request by sending your key as a Bearer token in the
-`Authorization` header: `Authorization: Bearer <api-key>`. This is the only
-supported authentication method for the public payments API.
-
-## Webhooks
-
-Webhook deliveries are retried up to 10 times over 24 hours. Endpoints are
-never disabled automatically — failed deliveries simply expire after the
-final retry.

package/samples/release-process.md

@@ -1,23 +0,0 @@
-# Release Process
-
-How to release the payments service to production.
-
-## Before you start
-
-- Node.js 22 installed locally
-- Membership of the `prod-deployers` GitHub team
-- The `PAYMENTS_DEPLOY_KEY` secret configured in your environment
-
-## Process
-
-1. Create a release branch from `main` named `release/vX.Y.Z`.
-2. Run the full test suite with coverage: `npm test -- --coverage`.
-3. Bump the version in `package.json` and update `CHANGELOG.md`.
-4. Tag the release: `git tag vX.Y.Z && git push --tags`.
-5. Trigger the deploy workflow from the GitHub Actions tab, selecting the tag.
-6. Watch the canary rollout in Grafana for 15 minutes before promoting to 100%.
-
-## Rolling back
-
-If error rates exceed 1% during the canary phase, run the `rollback` workflow
-with the previous tag. A rollback completes in under 5 minutes.

package/src/agents/assess.ts

@@ -1,187 +0,0 @@
-/**
- * LLM access — all requests go through vscode.lm (the user's own Copilot
- * subscription). Typed JSON only: every response is extracted and validated
- * in code; invalid output is rejected, never partially trusted.
- */
-import * as vscode from 'vscode';
-import { PROMPTS } from './prompts';
-import type { Doc } from '../scanner/corpus';
-import { log } from '../log';
-import {
-  extractJson,
-  num,
-  str,
-  validateEvidence,
-  SEVERITIES,
-} from '../core/json';
-
-export type { Evidence } from '../core/json';
-
-export interface OpenQuestion {
-  question: string;
-  excerpt: string;
-  confidence: number;
-  severity: string;
-}
-
-async function pickModel(): Promise<vscode.LanguageModelChat> {
-  // Models rotate; select at call time. Vendor/family are configurable so any
-  // vscode.lm provider works — Copilot, or local models (e.g. Ollama/llama via
-  // Copilot's "Manage models" BYOK, or a local-provider extension's vendor).
-  const cfg = vscode.workspace.getConfiguration('docgrity');
-  const vendor = cfg.get<string>('model.vendor', 'copilot');
-  const family = cfg.get<string>('model.family', '');
-
-  if (family) {
-    const preferred = await vscode.lm.selectChatModels({ vendor, family });
-    if (preferred.length > 0) return preferred[0];
-  }
-  const any = await vscode.lm.selectChatModels(vendor ? { vendor } : {});
-  if (any.length === 0) {
-    throw new Error(
-      `No language model available for vendor "${vendor || 'any'}". Sign in to GitHub Copilot, ` +
-        'or set docgrity.model.vendor/family to a locally provided model (e.g. Ollama).'
-    );
-  }
-  log.debug(`Model selected: ${any[0].id} (vendor=${vendor || 'any'}, no family match)`);
-  return any[0];
-}
-
-export async function completeJson<T>(opts: {
-  system: string;
-  prompt: string;
-  validate: (raw: any) => T;
-  token: vscode.CancellationToken;
-}): Promise<{ output: T; model: string }> {
-  const model = await pickModel();
-  const messages = [
-    vscode.LanguageModelChatMessage.Assistant(opts.system),
-    vscode.LanguageModelChatMessage.User(opts.prompt),
-  ];
-  const started = Date.now();
-  const response = await model.sendRequest(messages, {}, opts.token);
-  let text = '';
-  for await (const chunk of response.text) text += chunk;
-  try {
-    const output = opts.validate(extractJson(text));
-    log.trace(`LLM response validated (model=${model.id}, ${Date.now() - started}ms)`);
-    return { output, model: model.id };
-  } catch (err) {
-    log.warn(`LLM response rejected (model=${model.id}): ${(err as Error).message}`);
-    throw err;
-  }
-}
-
-function pairPrompt(a: Doc, b: Doc): string {
-  return `PAGE A — "${a.relPath}":\n${a.text.slice(0, 8000)}\n\n---\n\nPAGE B — "${b.relPath}":\n${b.text.slice(0, 8000)}`;
-}
-
-function validateDuplicate(o: any) {
-  return {
-    is_duplicate: Boolean(o.is_duplicate),
-    confidence: num(o.confidence),
-    summary: str(o.summary).slice(0, 2000),
-    recommended_action: str(o.recommended_action || 'REVIEW'),
-    evidence: validateEvidence(o.evidence),
-  };
-}
-
-function validateContradiction(o: any) {
-  return {
-    is_contradiction: Boolean(o.is_contradiction),
-    confidence: num(o.confidence),
-    severity: SEVERITIES.has(o.severity) ? (o.severity as string) : 'MEDIUM',
-    summary: str(o.summary).slice(0, 2000),
-    conflicting_claims: (Array.isArray(o.conflicting_claims) ? o.conflicting_claims : []).map(
-      (c: unknown) => str(c).slice(0, 500)
-    ),
-    evidence: validateEvidence(o.evidence),
-  };
-}
-
-/**
- * Combined duplicate + contradiction assessment in a single LLM call — the
- * model reads the same two documents once instead of twice, halving pair
- * latency and token cost with the same rules and output contracts.
- */
-export async function assessPair(a: Doc, b: Doc, token: vscode.CancellationToken) {
-  const p = PROMPTS.pair;
-  const { output, model } = await completeJson({
-    system: p.system,
-    prompt: pairPrompt(a, b),
-    token,
-    validate: (o) => ({
-      duplicate: validateDuplicate(o.duplicate ?? {}),
-      contradiction: validateContradiction(o.contradiction ?? {}),
-    }),
-  });
-  return { output, model, promptVersion: p.version };
-}
-
-export async function assessDuplicate(a: Doc, b: Doc, token: vscode.CancellationToken) {
-  const p = PROMPTS.duplicate;
-  const { output, model } = await completeJson({
-    system: p.system,
-    prompt: pairPrompt(a, b),
-    token,
-    validate: validateDuplicate,
-  });
-  return { output, model, promptVersion: p.version };
-}
-
-export async function assessContradiction(a: Doc, b: Doc, token: vscode.CancellationToken) {
-  const p = PROMPTS.contradiction;
-  const { output, model } = await completeJson({
-    system: p.system,
-    prompt: pairPrompt(a, b),
-    token,
-    validate: validateContradiction,
-  });
-  return { output, model, promptVersion: p.version };
-}
-
-export async function assessOpenQuestions(doc: Doc, token: vscode.CancellationToken) {
-  const p = PROMPTS.open_question;
-  const { output, model } = await completeJson({
-    system: p.system,
-    prompt: `Document path: ${doc.relPath}\n\nDocument content:\n${doc.text.slice(0, 12000)}`,
-    token,
-    validate: (o) => ({
-      questions: (Array.isArray(o.questions) ? o.questions : [])
-        .map(
-          (q: any): OpenQuestion => ({
-            question: str(q.question).slice(0, 500),
-            excerpt: str(q.excerpt).slice(0, 1000),
-            confidence: num(q.confidence),
-            severity: SEVERITIES.has(q.severity) ? (q.severity as string) : 'MEDIUM',
-          })
-        )
-        .filter((q: OpenQuestion) => q.question && q.excerpt),
-    }),
-  });
-  return { output, model, promptVersion: p.version };
-}
-
-export async function draftIssue(
-  finding: {
-    type: string;
-    summary: string;
-    evidence: { sourceLabel: string; excerpt: string }[];
-    potentialOwners: string[];
-  },
-  token: vscode.CancellationToken
-): Promise<{ title: string; body: string }> {
-  const p = PROMPTS.issue;
-  const { output } = await completeJson({
-    system: p.system,
-    prompt: `Finding type: ${finding.type}\nSummary: ${finding.summary}\nEvidence:\n${finding.evidence
-      .map((e) => `- [${e.sourceLabel}] "${e.excerpt}"`)
-      .join('\n')}\nPotential owners: ${finding.potentialOwners.join(', ') || 'unknown'}`,
-    token,
-    validate: (o) => ({
-      title: str(o.title).slice(0, 200) || 'Docgrity finding',
-      body: str(o.body).slice(0, 20000),
-    }),
-  });
-  return output;
-}