docguard-cli 0.40.4 → 0.41.0

package/cli/evidence/python-literal.mjs

@@ -0,0 +1,304 @@
+/**
+ * Bounded, non-executable Python container-literal inspection.
+ * Counts syntactic top-level entries without importing Python or project code.
+ * @implements docguard.evidence-scoped-verification#FR-002
+ * @implements docguard.adoption-workflow-integrity#FR-011
+ */
+
+export const PYTHON_LITERAL_LIMITS = Object.freeze({
+  sourceCharacters: 1_048_576,
+  tokens: 100_000,
+  nesting: 64,
+  entries: 20_000,
+});
+
+export const PYTHON_SYMBOL_RE = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
+
+const OPEN_TO_CLOSE = new Map([['[', ']'], ['(', ')'], ['{', '}']]);
+const CLOSE_TO_OPEN = new Map([...OPEN_TO_CLOSE].map(([open, close]) => [close, open]));
+const ASSIGNMENT_OPERATORS = new Set(['=', '+=', '-=', '*=', '/=', '//=', '%=', '@=', '&=', '|=', '^=', '>>=', '<<=', '**=']);
+const STRING_PREFIX = /^[rRuUbBfF]$/;
+
+const result = (status, reasonCode, message, extra = {}) => ({ status, reasonCode, message, ...extra });
+
+function stringStart(source, index) {
+  if (source[index] === "'" || source[index] === '"') return { quoteIndex: index };
+  if (index > 0 && /[A-Za-z0-9_]/.test(source[index - 1])) return null;
+  let cursor = index;
+  while (cursor < source.length && cursor - index < 3 && STRING_PREFIX.test(source[cursor])) cursor++;
+  if (cursor === index || (source[cursor] !== "'" && source[cursor] !== '"')) return null;
+  return { quoteIndex: cursor };
+}
+
+function consumeString(source, start) {
+  const found = stringStart(source, start);
+  if (!found) return null;
+  const quote = source[found.quoteIndex];
+  const triple = source.slice(found.quoteIndex, found.quoteIndex + 3) === quote.repeat(3);
+  let cursor = found.quoteIndex + (triple ? 3 : 1);
+  while (cursor < source.length) {
+    if (triple && source.slice(cursor, cursor + 3) === quote.repeat(3)) return cursor + 3;
+    if (!triple && source[cursor] === quote) return cursor + 1;
+    if (source[cursor] === '\\') {
+      cursor += Math.min(2, source.length - cursor);
+      continue;
+    }
+    if (!triple && (source[cursor] === '\n' || source[cursor] === '\r')) return -1;
+    cursor++;
+  }
+  return -1;
+}
+
+function operatorAt(source, index) {
+  for (const width of [3, 2]) {
+    const candidate = source.slice(index, index + width);
+    if (ASSIGNMENT_OPERATORS.has(candidate) || ['**', '//', ':=', '==', '!=', '<=', '>=', '<<', '>>', '->'].includes(candidate)) {
+      return candidate;
+    }
+  }
+  return source[index];
+}
+
+function tokenize(source) {
+  if (typeof source !== 'string') return result('inconclusive', 'python-source-not-text', 'Python source is not text.');
+  if (source.length > PYTHON_LITERAL_LIMITS.sourceCharacters) {
+    return result('inconclusive', 'python-source-budget', `Python source exceeds the ${PYTHON_LITERAL_LIMITS.sourceCharacters}-character parser budget.`);
+  }
+
+  const tokens = [];
+  const brackets = [];
+  let cursor = 0;
+  let statement = 0;
+  let logicalStart = true;
+  let lineIndent = 0;
+  let atLineStart = true;
+
+  const push = (value, type = 'operator') => {
+    if (tokens.length >= PYTHON_LITERAL_LIMITS.tokens) throw new Error('python-token-budget');
+    tokens.push({ value, type, statement, statementStart: logicalStart && lineIndent === 0 && brackets.length === 0 });
+    logicalStart = false;
+  };
+
+  try {
+    while (cursor < source.length) {
+      const char = source[cursor];
+      if (cursor === 0 && char === '\uFEFF') {
+        cursor++;
+        continue;
+      }
+      if (char === ' ' || char === '\t' || char === '\f') {
+        if (atLineStart) lineIndent++;
+        cursor++;
+        continue;
+      }
+      if (char === '\r' || char === '\n') {
+        if (char === '\r' && source[cursor + 1] === '\n') cursor++;
+        cursor++;
+        atLineStart = true;
+        lineIndent = 0;
+        if (brackets.length === 0) {
+          statement++;
+          logicalStart = true;
+        }
+        continue;
+      }
+      atLineStart = false;
+      if (char === '#') {
+        while (cursor < source.length && source[cursor] !== '\n' && source[cursor] !== '\r') cursor++;
+        continue;
+      }
+      if (char === '\\' && (source[cursor + 1] === '\n' || source[cursor + 1] === '\r')) {
+        cursor++;
+        if (source[cursor] === '\r' && source[cursor + 1] === '\n') cursor++;
+        cursor++;
+        atLineStart = true;
+        lineIndent = 0;
+        continue;
+      }
+      const stringEnd = consumeString(source, cursor);
+      if (stringEnd !== null) {
+        if (stringEnd < 0) return result('inconclusive', 'python-unterminated-string', 'Python source contains an unterminated string.');
+        push('<string>', 'atom');
+        cursor = stringEnd;
+        continue;
+      }
+      if (/[A-Za-z_]/.test(char)) {
+        let end = cursor + 1;
+        while (end < source.length && /[A-Za-z0-9_]/.test(source[end])) end++;
+        push(source.slice(cursor, end), 'name');
+        cursor = end;
+        continue;
+      }
+      if (OPEN_TO_CLOSE.has(char)) {
+        push(char, 'punctuation');
+        brackets.push(char);
+        if (brackets.length > PYTHON_LITERAL_LIMITS.nesting) throw new Error('python-nesting-budget');
+        cursor++;
+        continue;
+      }
+      if (CLOSE_TO_OPEN.has(char)) {
+        if (brackets.pop() !== CLOSE_TO_OPEN.get(char)) return result('inconclusive', 'python-unbalanced-brackets', 'Python source contains unbalanced brackets.');
+        push(char, 'punctuation');
+        cursor++;
+        continue;
+      }
+      if (char === ';' && brackets.length === 0) {
+        statement++;
+        logicalStart = true;
+        cursor++;
+        continue;
+      }
+      if (char === ',' || char === ':') {
+        push(char, 'punctuation');
+        cursor++;
+        continue;
+      }
+      if (/[-+*/%@&|^<>=!~.]/.test(char)) {
+        const operator = operatorAt(source, cursor);
+        push(operator);
+        cursor += operator.length;
+        continue;
+      }
+      let end = cursor + 1;
+      while (end < source.length && !/[\s#'"A-Za-z_\[\](){};,:\\\-+*/%@&|^<>=!~.]/.test(source[end])) end++;
+      push(source.slice(cursor, end), 'atom');
+      cursor = end;
+    }
+  } catch (error) {
+    if (error.message === 'python-token-budget') {
+      return result('inconclusive', error.message, `Python source exceeds the ${PYTHON_LITERAL_LIMITS.tokens}-token parser budget.`);
+    }
+    if (error.message === 'python-nesting-budget') {
+      return result('unsupported', error.message, `Python literal exceeds the ${PYTHON_LITERAL_LIMITS.nesting}-level nesting budget.`);
+    }
+    throw error;
+  }
+  if (brackets.length) return result('inconclusive', 'python-unbalanced-brackets', 'Python source contains unbalanced brackets.');
+  return result('ok', 'python-tokenized', 'Python source tokenized.', { tokens });
+}
+
+function assignmentOperatorIndex(tokens) {
+  const stack = [];
+  for (let index = 1; index < tokens.length; index++) {
+    const token = tokens[index].value;
+    if (OPEN_TO_CLOSE.has(token)) stack.push(token);
+    else if (CLOSE_TO_OPEN.has(token)) stack.pop();
+    else if (stack.length === 0 && ASSIGNMENT_OPERATORS.has(token)) return index;
+  }
+  return -1;
+}
+
+function countEntries(tokens, opener) {
+  if (!tokens.length) return result('ok', 'python-literal-counted', 'Python container literal counted.', { value: 0 });
+  const stack = [];
+  let entries = 0;
+  let segmentHasToken = false;
+  let segmentStartsWithUnpack = false;
+  let sawTopLevelComma = false;
+
+  for (const token of tokens) {
+    const value = token.value;
+    if (OPEN_TO_CLOSE.has(value)) {
+      stack.push(value);
+      segmentHasToken = true;
+      continue;
+    }
+    if (CLOSE_TO_OPEN.has(value)) {
+      if (stack.pop() !== CLOSE_TO_OPEN.get(value)) return result('inconclusive', 'python-unbalanced-literal', 'Python literal contains unbalanced brackets.');
+      segmentHasToken = true;
+      continue;
+    }
+    if (stack.length > 0) {
+      segmentHasToken = true;
+      continue;
+    }
+    if (value === 'for' || value === 'lambda') {
+      return result('unsupported', 'python-dynamic-literal', 'Python comprehensions and lambda expressions are unsupported evidence sources.');
+    }
+    if (!segmentHasToken && (value === '*' || value === '**')) segmentStartsWithUnpack = true;
+    if (segmentStartsWithUnpack) return result('unsupported', 'python-unpacked-literal', 'Python literal unpacking is unsupported evidence syntax.');
+    if (value === ',') {
+      if (!segmentHasToken) return result('inconclusive', 'python-empty-literal-entry', 'Python literal contains an empty entry.');
+      entries++;
+      if (entries > PYTHON_LITERAL_LIMITS.entries) {
+        return result('unsupported', 'python-entry-budget', `Python literal exceeds the ${PYTHON_LITERAL_LIMITS.entries}-entry budget.`);
+      }
+      segmentHasToken = false;
+      segmentStartsWithUnpack = false;
+      sawTopLevelComma = true;
+      continue;
+    }
+    segmentHasToken = true;
+  }
+  if (stack.length) return result('inconclusive', 'python-unbalanced-literal', 'Python literal contains unbalanced brackets.');
+  if (segmentHasToken) entries++;
+  if (opener === '(' && entries > 0 && !sawTopLevelComma) {
+    return result('unsupported', 'python-not-tuple-literal', 'Parenthesized Python expressions require a trailing comma to be tuple evidence.');
+  }
+  if (entries > PYTHON_LITERAL_LIMITS.entries) {
+    return result('unsupported', 'python-entry-budget', `Python literal exceeds the ${PYTHON_LITERAL_LIMITS.entries}-entry budget.`);
+  }
+  return result('ok', 'python-literal-counted', 'Python container literal counted.', { value: entries });
+}
+
+function inspectAssignment(tokens) {
+  const operatorIndex = assignmentOperatorIndex(tokens);
+  if (operatorIndex < 0) return null;
+  if (tokens[operatorIndex].value !== '=') {
+    return result('unsupported', 'python-augmented-assignment', 'Python evidence symbol uses an unsupported assignment operator.');
+  }
+  const left = tokens.slice(1, operatorIndex);
+  if (left.length && (left[0].value !== ':' || left.length === 1)) {
+    return result('unsupported', 'python-assignment-target', 'Python evidence must assign directly to one module-level symbol.');
+  }
+  const right = tokens.slice(operatorIndex + 1);
+  const opener = right[0]?.value;
+  if (!OPEN_TO_CLOSE.has(opener)) {
+    return result('unsupported', 'python-nonliteral-assignment', 'Python evidence symbol must be assigned a list, tuple, set, or dictionary literal.');
+  }
+  const stack = [];
+  let closingIndex = -1;
+  for (let index = 0; index < right.length; index++) {
+    const value = right[index].value;
+    if (OPEN_TO_CLOSE.has(value)) stack.push(value);
+    else if (CLOSE_TO_OPEN.has(value)) {
+      if (stack.pop() !== CLOSE_TO_OPEN.get(value)) return result('inconclusive', 'python-unbalanced-literal', 'Python literal contains unbalanced brackets.');
+      if (stack.length === 0) {
+        closingIndex = index;
+        break;
+      }
+    }
+  }
+  if (closingIndex < 0) return result('inconclusive', 'python-unbalanced-literal', 'Python literal is not closed.');
+  if (closingIndex !== right.length - 1) {
+    return result('unsupported', 'python-trailing-expression', 'Python evidence literal has a chained, conditional, or concatenated expression.');
+  }
+  return countEntries(right.slice(1, closingIndex), opener);
+}
+
+/** Count entries in one uniquely assigned module-level Python container literal. */
+export function countPythonLiteralEntries(source, symbol) {
+  if (!PYTHON_SYMBOL_RE.test(symbol || '')) {
+    return result('unsupported', 'python-symbol-unsupported', 'Python evidence symbol must be an ASCII identifier containing at most 128 characters.');
+  }
+  const scanned = tokenize(source);
+  if (scanned.status !== 'ok') return scanned;
+  const statements = new Map();
+  for (const token of scanned.tokens) {
+    if (!statements.has(token.statement)) statements.set(token.statement, []);
+    statements.get(token.statement).push(token);
+  }
+  const assignments = [];
+  for (const tokens of statements.values()) {
+    if (!tokens[0]?.statementStart || tokens[0].type !== 'name' || tokens[0].value !== symbol) continue;
+    const inspected = inspectAssignment(tokens);
+    if (inspected) assignments.push(inspected);
+  }
+  if (assignments.length === 0) {
+    return result('inconclusive', 'python-symbol-unassigned', `Python symbol ${symbol} has no supported module-level assignment.`);
+  }
+  if (assignments.length !== 1) {
+    return result('inconclusive', 'python-symbol-ambiguous', `Python symbol ${symbol} has multiple module-level assignments.`);
+  }
+  return assignments[0];
+}

package/cli/findings.mjs

@@ -17,6 +17,7 @@
  * hand-built results and render exactly as before. Nothing regresses.
  *
  * Zero npm dependencies — pure Node.js built-ins.
+ * @implements docguard.adoption-workflow-integrity#FR-002
  *
  * @typedef {Object} Suggestion
  * @property {'fix'|'suppress'|'review'|'report'} kind
@@ -597,8 +598,8 @@ export const CODES = {
   },
   API004: {
     validator: 'apiSurface',
-    title: 'Documented endpoint not found in code',
-    help: 'docs-canonical/API-REFERENCE.md documents an endpoint absent from the actual surface. Spec-confirmed absences are errors and `docguard fix --write` removes them; code-scan-only absences are low-confidence warnings ([code-scan — verify]) — verify before pruning.',
+    title: 'Documented endpoint missing from authoritative contract',
+    help: 'docs-canonical/API-REFERENCE.md documents an endpoint absent from the authoritative OpenAPI contract. The contract mismatch is certain; route presence or absence is separate, low-confidence evidence. Reconcile intent, contract, implementation, and documentation manually. DocGuard never deletes an endpoint from negative route-scan evidence.',
     suppress: null,
   },
   API005: {
@@ -729,6 +730,19 @@ export const CODES = {
 export function mkFinding(f) {
   const severity = f.severity === 'error' ? 'error' : 'warn';
   const confidence = f.confidence === 'low' ? 'low' : 'high';
+  const rawSuggestion = f.suggestion;
+  const suggestion = rawSuggestion && typeof rawSuggestion === 'object'
+    && typeof rawSuggestion.text === 'string' && rawSuggestion.text.trim()
+    ? {
+        kind: ['fix', 'suppress', 'review', 'report'].includes(rawSuggestion.kind)
+          ? rawSuggestion.kind : 'review',
+        text: rawSuggestion.text.trim(),
+        ...(typeof rawSuggestion.command === 'string' && rawSuggestion.command.trim()
+          ? { command: rawSuggestion.command.trim() } : {}),
+        ...(typeof rawSuggestion.pragma === 'string' && rawSuggestion.pragma.trim()
+          ? { pragma: rawSuggestion.pragma.trim() } : {}),
+      }
+    : null;
   return {
     code: f.code || null,
     validator: f.validator || null,
@@ -736,7 +750,7 @@ export function mkFinding(f) {
     confidence,
     message: f.message || '',
     location: f.location || null,
-    suggestion: f.suggestion || null,
+    suggestion,
     reportable: f.reportable === true || confidence === 'low',
     redactedContext: f.redactedContext || null,
   };

package/cli/scanners/instruction-audit.mjs

@@ -28,11 +28,13 @@
  * against its source would flag every rule as a duplicate.
  *
  * Zero npm dependencies — pure Node.js built-ins.
+ * @implements docguard.adoption-workflow-integrity#FR-005
  */
 
-import { existsSync, readFileSync, readdirSync } from 'node:fs';
-import { resolve, join, dirname } from 'node:path';
+import { readFileSync, readdirSync, lstatSync, realpathSync } from 'node:fs';
+import { resolve, join, dirname, relative, isAbsolute, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { buildIgnoreFilter, loadDocguardIgnore, DEFAULT_IGNORE_DIRS, relPosix } from '../shared-ignore.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
@@ -44,6 +46,7 @@ const SIGNAL_RE = /\b(must|never|always|do not|don't|should|require[sd]?|forbid|
 
 const MAX_RULES = 400;
 const MAX_TASKS = 40;
+const MAX_POINTER_ENTRIES = 20_000;
 
 // ── Normalization ───────────────────────────────────────────────────────────
 
@@ -111,7 +114,7 @@ export function extractInstructionRules(projectDir) {
 
 const PATH_EXTS = 'md|mjs|cjs|js|ts|tsx|jsx|json|ya?ml|py|sh|toml|txt|rs|go|css|html';
 // Backticked token: no spaces, lexes as a relative path with a known extension.
-const PATH_LIKE_RE = new RegExp(`^[\\w.-][\\w./-]*\\.(?:${PATH_EXTS})$`, 'i');
+const PATH_LIKE_RE = new RegExp(`\\.(?:${PATH_EXTS})$`, 'i');
 // Bare (unbackticked) token: requires a directory separator for precision.
 const BARE_PATH_RE = new RegExp(`(?:^|[\\s("'])([\\w.-]+\\/[\\w./-]+\\.(?:${PATH_EXTS}))\\b`, 'gi');
 const BACKTICK_RE = /`([^`]+)`/g;
@@ -123,7 +126,11 @@ function pathCandidates(text) {
   BACKTICK_RE.lastIndex = 0;
   let m;
   while ((m = BACKTICK_RE.exec(text)) !== null) {
-    const tok = m[1].replace(/[#:].*$/, '').trim();
+    // Remove only a Markdown anchor or numeric line suffix. Preserve drive
+    // colons, backslashes, traversal, and absolute prefixes so the caller can
+    // report them as unsafe instead of silently dropping the evidence.
+    const tok = m[1].replace(/#.*$/, '').replace(/:\d+$/, '').trim();
+    if (/^https?:\/\//i.test(tok)) continue;
     if (!tok.includes(' ') && PATH_LIKE_RE.test(tok)) found.add(tok);
   }
   BARE_PATH_RE.lastIndex = 0;
@@ -131,6 +138,59 @@ function pathCandidates(text) {
   return [...found];
 }
 
+function safePointerPath(path) {
+  if (typeof path !== 'string' || !path || isAbsolute(path) || /[\\:\0]/.test(path)) return false;
+  return !path.split('/').some(part => part === '..' || part.toLowerCase() === '.local' || /^\.env(?:\.|$)/i.test(part));
+}
+
+function exactRegularFile(projectDir, path) {
+  if (!safePointerPath(path)) return false;
+  let root;
+  try { root = realpathSync(projectDir); } catch { return false; }
+  let cursor = root;
+  try {
+    for (const part of path.split('/').filter(Boolean)) {
+      cursor = resolve(cursor, part);
+      if (lstatSync(cursor).isSymbolicLink()) return false;
+    }
+    const rel = relative(root, realpathSync(cursor));
+    return !isAbsolute(rel) && rel !== '..' && !rel.startsWith(`..${sep}`) && lstatSync(cursor).isFile();
+  } catch { return false; }
+}
+
+function basenameIndex(projectDir, wanted, config = {}) {
+  const matches = new Map([...wanted].map(name => [name, []]));
+  if (wanted.size === 0) return { matches, complete: true, visited: 0, reason: null };
+  const ignored = buildIgnoreFilter([...(config.ignore || []), ...loadDocguardIgnore(projectDir)]);
+  let root;
+  try { root = realpathSync(projectDir); }
+  catch { return { matches, complete: false, visited: 0, reason: 'repository-unavailable' }; }
+  let visited = 0;
+  let complete = true;
+  let reason = null;
+  const walk = dir => {
+    let entries;
+    try { entries = readdirSync(dir, { withFileTypes: true }); }
+    catch { complete = false; reason ||= 'unreadable-directory'; return; }
+    for (const entry of entries) {
+      if (++visited > MAX_POINTER_ENTRIES) { complete = false; reason = 'entry-budget'; return; }
+      if (DEFAULT_IGNORE_DIRS.has(entry.name) || entry.name === '.local' || /^\.env(?:\.|$)/i.test(entry.name)) continue;
+      const full = resolve(dir, entry.name);
+      const rel = relPosix(root, full);
+      if (ignored(rel)) continue;
+      let stat;
+      try { stat = lstatSync(full); }
+      catch { complete = false; reason ||= 'unreadable-entry'; continue; }
+      if (stat.isSymbolicLink()) continue;
+      if (stat.isDirectory()) { walk(full); if (reason === 'entry-budget') return; }
+      else if (stat.isFile() && matches.has(entry.name)) matches.get(entry.name).push(rel);
+    }
+  };
+  walk(root);
+  for (const paths of matches.values()) paths.sort();
+  return { matches, complete, visited, reason };
+}
+
 /**
  * Known docguard subcommands: cli/commands/*.mjs basenames + permanent
  * aliases. Read from disk at runtime so the list can't drift from the code.
@@ -150,7 +210,7 @@ function knownDocguardCommands() {
  * The findings string logic can prove — no LLM involved.
  * @returns {{ duplicates, negations, stalePointers, staleCommands }}
  */
-export function findDeterministicFindings(rules, projectDir) {
+export function findDeterministicFindings(rules, projectDir, config = {}) {
   // duplicates: exact-normalized matches, within or across files.
   const byNorm = new Map();
   for (const r of rules) {
@@ -187,16 +247,30 @@ export function findDeterministicFindings(rules, projectDir) {
 
   // stale pointers: referenced file paths that don't exist in the repo.
   const stalePointers = [];
+  const ambiguousPointers = [];
+  const unsafePointers = [];
+  const resolvedPointers = [];
   const seenPtr = new Set();
-  for (const r of rules) {
-    for (const p of pathCandidates(r.text)) {
+  const candidates = rules.flatMap(r => pathCandidates(r.text).map(path => ({ rule: r, path })));
+  const bareNames = new Set(candidates.filter(item => !item.path.includes('/') && safePointerPath(item.path)).map(item => item.path));
+  const index = basenameIndex(projectDir, bareNames, config);
+  for (const { rule: r, path: p } of candidates) {
       const key = `${r.file}:${r.line}:${p}`;
       if (seenPtr.has(key)) continue;
       seenPtr.add(key);
-      if (!existsSync(resolve(projectDir, p))) {
+      const finding = { file: r.file, line: r.line, section: r.section, text: r.text, path: p };
+      if (!safePointerPath(p)) {
+        unsafePointers.push({ ...finding, reason: 'unsafe-relative-path' });
+      } else if (exactRegularFile(projectDir, p)) {
+        resolvedPointers.push({ ...finding, resolvedPath: p, resolution: 'exact' });
+      } else if (!p.includes('/')) {
+        const matches = index.matches.get(p) || [];
+        if (matches.length === 1) resolvedPointers.push({ ...finding, resolvedPath: matches[0], resolution: 'unique-basename' });
+        else if (matches.length > 1) ambiguousPointers.push({ ...finding, matches: matches.slice(0, 10), matchCount: matches.length });
+        else if (index.complete) stalePointers.push(finding);
+      } else {
         stalePointers.push({ file: r.file, line: r.line, section: r.section, text: r.text, path: p });
       }
-    }
   }
 
   // stale commands: `docguard <cmd>` (backticked — an invocation, not prose)
@@ -222,7 +296,10 @@ export function findDeterministicFindings(rules, projectDir) {
     }
   }
 
-  return { duplicates, negations, stalePointers, staleCommands };
+  return {
+    duplicates, negations, stalePointers, ambiguousPointers, unsafePointers, resolvedPointers, staleCommands,
+    pointerCoverage: { status: index.complete ? 'complete' : 'partial', visited: index.visited, reason: index.reason },
+  };
 }
 
 // ── LLM tasks (topical-cluster pairs) ───────────────────────────────────────
@@ -314,7 +391,7 @@ export function buildInstructionAuditTasks(rules) {
  */
 export function auditInstructions(projectDir, config = {}) {
   const rules = extractInstructionRules(projectDir);
-  const deterministic = findDeterministicFindings(rules, projectDir);
+  const deterministic = findDeterministicFindings(rules, projectDir, config);
   const tasks = buildInstructionAuditTasks(rules);
   return { rules, deterministic, tasks };
 }