imprint-mcp 0.6.1 → 0.6.3

package/src/imprint/audit.ts

@@ -17,10 +17,15 @@ import { type ChildProcess, spawn } from 'node:child_process';
 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import { dirname, join as pathJoin } from 'node:path';
 import { z } from 'zod';
+import {
+  type AuthVerificationReceiptStatus,
+  readAuthVerificationReceiptStatus,
+} from './auth-compile-tools.ts';
 import { type ProviderName, preferredAgentModel } from './llm.ts';
 import { createLog } from './log.ts';
 import { imprintHomeDir } from './paths.ts';
-import { discoverTools } from './tool-loader.ts';
+import { type TeachState, loadTeachState } from './teach-state.ts';
+import { type ResolvedTool, discoverTools } from './tool-loader.ts';
 import { llmSpanAttributes, setSpanAttributes, totalPromptTokens, traced } from './tracing.ts';
 
 const log = createLog('audit');
@@ -94,6 +99,191 @@ interface AuditScore {
   verdict: 'pass' | 'fail' | 'inconclusive' | 'timeout';
 }
 
+interface ExpectedAuditTool {
+  name: string;
+  parameters: readonly string[];
+}
+
+interface MissingAuditedParameter {
+  tool: string;
+  name: string;
+}
+
+interface AuditEvaluation {
+  score: AuditScore;
+  missingTools: string[];
+  missingParameters: MissingAuditedParameter[];
+}
+
+interface SkippedInteractiveAuth {
+  name: string;
+  reason: string;
+  verificationStatus: AuthVerificationReceiptStatus['status'];
+  verificationReason: string;
+  verificationAction?: string;
+  verificationBackend?: string;
+  verificationTimestamp?: number;
+}
+
+interface AuditToolPartition {
+  eligible: ResolvedTool[];
+  nonInteractiveAuthNames: string[];
+  skippedInteractiveAuth: SkippedInteractiveAuth[];
+}
+
+interface DetectedButUnemittedTool {
+  name: string;
+  reason?: string;
+  lastCompletedStep?: string;
+}
+
+/** Report candidates from the latest retained recording that teach detected but
+ * did not emit. They are diagnostic metadata, not part of the audit score: the
+ * audit agent can only call emitted MCP tools. */
+export function detectedButUnemittedTools(
+  state: TeachState,
+  emittedToolNames: readonly string[],
+): DetectedButUnemittedTool[] {
+  const candidates = Object.values(state.workflows).filter((workflow) => workflow.candidate);
+  if (candidates.length === 0) return [];
+
+  const latest = candidates.reduce((current, workflow) =>
+    Date.parse(workflow.updatedAt) > Date.parse(current.updatedAt) ? workflow : current,
+  );
+  const emitted = new Set(emittedToolNames);
+  const byName = new Map<string, DetectedButUnemittedTool>();
+  for (const workflow of candidates) {
+    if (workflow.sessionPath !== latest.sessionPath || !workflow.candidate) continue;
+    const name = workflow.candidate.toolName;
+    // A same-named artifact may belong to an older successful teach. Only
+    // suppress the diagnostic when the latest recording itself reached emit
+    // successfully and the emitted artifact still exists.
+    if (emitted.has(name) && workflow.completedSteps.includes('emit') && !workflow.error) continue;
+    byName.set(name, {
+      name,
+      ...(workflow.error ? { reason: workflow.error.split('\n')[0] } : {}),
+      ...(workflow.completedSteps.at(-1)
+        ? { lastCompletedStep: workflow.completedSteps.at(-1) }
+        : {}),
+    });
+  }
+  return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+
+export function countDetectedToolNames(
+  emittedToolNames: readonly string[],
+  detectedButUnemitted: readonly DetectedButUnemittedTool[],
+): number {
+  return new Set([...emittedToolNames, ...detectedButUnemitted.map((candidate) => candidate.name)])
+    .size;
+}
+
+/** Partition generated tools for a headless audit. Authentication is eligible
+ * only when every declared action completes directly: any pause means a human
+ * continuation (OTP, CAPTCHA, device approval, email link, etc.) may be needed. */
+export function partitionAuditTools(tools: readonly ResolvedTool[]): AuditToolPartition {
+  const eligible: ResolvedTool[] = [];
+  const nonInteractiveAuthNames: string[] = [];
+  const skippedInteractiveAuth: SkippedInteractiveAuth[] = [];
+
+  for (const tool of tools) {
+    // authConfig is the authoritative capability marker for legacy workflows
+    // where the newer optional toolKind field may be absent.
+    const auth = tool.workflow.authConfig;
+    if (tool.workflow.toolKind === 'authenticate' && !auth) {
+      const receipt = readAuthVerificationReceiptStatus(tool.dir, tool.workflow);
+      skippedInteractiveAuth.push({
+        name: tool.workflow.toolName,
+        reason: 'authentication configuration is missing, so unattended completion is not proven',
+        verificationStatus: receipt.status,
+        verificationReason: receipt.reason,
+        ...(receipt.action ? { verificationAction: receipt.action } : {}),
+        ...(receipt.backend ? { verificationBackend: receipt.backend } : {}),
+        ...(receipt.timestamp ? { verificationTimestamp: receipt.timestamp } : {}),
+      });
+      continue;
+    }
+    const pauses = auth
+      ? Object.entries(auth.actions).filter(([, action]) => action.outcome.type === 'pause')
+      : [];
+    if (pauses.length === 0) {
+      eligible.push(tool);
+      if (auth) nonInteractiveAuthNames.push(tool.workflow.toolName);
+      continue;
+    }
+
+    const receipt = readAuthVerificationReceiptStatus(tool.dir, tool.workflow);
+    const pauseSummary = pauses
+      .map(([name, action]) =>
+        action.outcome.type === 'pause' ? `${name}: ${action.outcome.message}` : name,
+      )
+      .join('; ');
+    skippedInteractiveAuth.push({
+      name: tool.workflow.toolName,
+      reason: `requires human continuation (${pauseSummary})`,
+      verificationStatus: receipt.status,
+      verificationReason: receipt.reason,
+      ...(receipt.action ? { verificationAction: receipt.action } : {}),
+      ...(receipt.backend ? { verificationBackend: receipt.backend } : {}),
+      ...(receipt.timestamp ? { verificationTimestamp: receipt.timestamp } : {}),
+    });
+  }
+
+  return { eligible, nonInteractiveAuthNames, skippedInteractiveAuth };
+}
+
+/**
+ * Restrict an agent-authored report to the connected workflows before it is
+ * scored. Agent output is not a trusted inventory: it can repeat a tool or a
+ * parameter, or mention a tool that was never connected. Taking the first
+ * report for each expected name keeps the result deterministic and, more
+ * importantly, prevents repeated/unknown positive verdicts from inflating the
+ * acceptance score. Later duplicates remain available in the persisted raw
+ * report for diagnosis; they simply carry no grading weight.
+ */
+function normalizeAuditReport(
+  report: AuditReport,
+  expectedTools: readonly ExpectedAuditTool[],
+): AuditReport {
+  const firstToolByName = new Map<string, AuditReport['tools'][number]>();
+  for (const tool of report.tools) {
+    if (!firstToolByName.has(tool.name)) firstToolByName.set(tool.name, tool);
+  }
+
+  const normalizedTools: AuditReport['tools'] = [];
+  const seenExpectedTools = new Set<string>();
+  for (const expected of expectedTools) {
+    if (seenExpectedTools.has(expected.name)) continue;
+    seenExpectedTools.add(expected.name);
+
+    const reported = firstToolByName.get(expected.name);
+    if (!reported) continue;
+
+    const firstParameterByName = new Map<
+      string,
+      AuditReport['tools'][number]['parameters'][number]
+    >();
+    for (const parameter of reported.parameters) {
+      if (!firstParameterByName.has(parameter.name)) {
+        firstParameterByName.set(parameter.name, parameter);
+      }
+    }
+
+    const parameters: AuditReport['tools'][number]['parameters'] = [];
+    const seenExpectedParameters = new Set<string>();
+    for (const name of expected.parameters) {
+      if (seenExpectedParameters.has(name)) continue;
+      seenExpectedParameters.add(name);
+      const parameter = firstParameterByName.get(name);
+      if (parameter) parameters.push(parameter);
+    }
+
+    normalizedTools.push({ ...reported, parameters });
+  }
+
+  return { ...report, tools: normalizedTools };
+}
+
 /**
  * Pure, deterministic scoring over the model's verdicts.
  *
@@ -107,7 +297,7 @@ interface AuditScore {
  * - `score = 100 * correct / graded` (0 when nothing was gradeable).
  * - Verdict: no gradeable invocations → `inconclusive` (re-run / site blocked
  *   us, not a code fail). Otherwise `pass` requires both `score >= minScore`
- *   AND at least `max(2, gradeableTools)` gradeable invocations, where
+ *   AND at least one gradeable unit per gradeable tool, where
  *   `gradeableTools` is the number of tools that produced ≥1 gradeable
  *   invocation. Scaling the signal floor to *gradeable* tools (not all tools)
  *   means a tool the auditor can never exercise — e.g. one that needs an opaque
@@ -175,7 +365,7 @@ export function computeAuditScore(report: AuditReport, minScore: number): AuditS
   }
   const graded = correct + broken;
   const score = graded === 0 ? 0 : (100 * correct) / graded;
-  const minGraded = Math.max(2, gradeableTools);
+  const minGraded = Math.max(1, gradeableTools);
   let verdict: AuditScore['verdict'];
   if (graded === 0) {
     verdict = 'inconclusive';
@@ -223,6 +413,82 @@ export function ungradeableToolNames(report: AuditReport): string[] {
   return report.tools.filter((t) => !toolHasGradeableAuditSignal(t)).map((t) => t.name);
 }
 
+/** Connected tools for which the auditor reported no invocation attempt.
+ * Merely naming a tool (or reporting parameter verdicts) is not evidence that
+ * its core operation was called. This is distinct from an ungradeable tool: an
+ * explicit infra/bad_params invocation is useful attempt evidence, while zero
+ * invocation records gives us no evidence that the auditor called it at all. */
+export function missingAuditedToolNames(
+  report: AuditReport,
+  expectedToolNames: readonly string[],
+): string[] {
+  const attemptedNames = new Set(
+    report.tools.filter((tool) => tool.invocations.length > 0).map((tool) => tool.name),
+  );
+  return expectedToolNames.filter((name) => !attemptedNames.has(name));
+}
+
+/** Advertised workflow parameters absent from the auditor's final report.
+ * Every explicit parameter verdict counts as coverage, including `untestable`:
+ * the latter is an honest result, while omission provides no evidence that the
+ * auditor considered the parameter at all. */
+export function missingAuditedParameters(
+  report: AuditReport,
+  expectedTools: readonly ExpectedAuditTool[],
+): MissingAuditedParameter[] {
+  const reportedParameters = new Map<string, Set<string>>();
+  for (const tool of report.tools) {
+    const names = reportedParameters.get(tool.name) ?? new Set<string>();
+    for (const parameter of tool.parameters) names.add(parameter.name);
+    reportedParameters.set(tool.name, names);
+  }
+
+  const missing: MissingAuditedParameter[] = [];
+  for (const tool of expectedTools) {
+    const covered = reportedParameters.get(tool.name) ?? new Set<string>();
+    for (const name of tool.parameters) {
+      if (!covered.has(name)) missing.push({ tool: tool.name, name });
+    }
+  }
+  return missing;
+}
+
+/** Complete deterministic audit evaluation, including report coverage. A high
+ * score cannot pass when the auditor omitted a connected tool or advertised
+ * parameter; timeouts remain the highest-priority terminal verdict. */
+export function evaluateAuditReport(
+  report: AuditReport,
+  minScore: number,
+  expectedTools: readonly ExpectedAuditTool[],
+  timedOut = false,
+): AuditEvaluation {
+  const normalizedReport = normalizeAuditReport(report, expectedTools);
+  const rawScore = computeAuditScore(normalizedReport, minScore);
+  const missingTools = missingAuditedToolNames(
+    normalizedReport,
+    expectedTools.map((tool) => tool.name),
+  );
+  const missingParameters = missingAuditedParameters(normalizedReport, expectedTools);
+
+  let verdict = rawScore.verdict;
+  if (timedOut) {
+    verdict = 'timeout';
+  } else if (
+    rawScore.verdict === 'pass' &&
+    (!auditHasCorrectSignal(normalizedReport) ||
+      missingTools.length > 0 ||
+      missingParameters.length > 0)
+  ) {
+    verdict = 'inconclusive';
+  }
+
+  return {
+    score: { ...rawScore, verdict },
+    missingTools,
+    missingParameters,
+  };
+}
+
 /** Advertised parameters the auditor could not differentially test (opaque enum
  *  with no constructible value, or a state-changing/bot-defended tool). Surfaced
  *  so an unverifiable parameter is visible rather than silently passing. */
@@ -250,6 +516,21 @@ interface RunAuditOptions {
   json?: boolean;
 }
 
+export function buildAuditMcpEnvironment(assetRoot = imprintHomeDir()): Record<string, string> {
+  return {
+    // Codex MCP server `env` entries are an explicit environment, so relying on
+    // the audit driver's inherited IMPRINT_HOME can make an isolated audit
+    // silently fall back to ~/.imprint and expose stale tools.
+    IMPRINT_HOME: assetRoot,
+    IMPRINT_AUDIT_PACING_MS: '5000',
+    IMPRINT_AUDIT_TOOL_DEADLINE_MS: '120000',
+  };
+}
+
+export function buildAuditMcpCommandArgs(site: string, toolNames: readonly string[]): string[] {
+  return ['run', CLI_PATH, 'mcp-server', site, '--include-tools', toolNames.join(',')];
+}
+
 export async function runAudit(opts: RunAuditOptions): Promise<AuditScore> {
   return await traced(
     'audit.session',
@@ -260,13 +541,27 @@ export async function runAudit(opts: RunAuditOptions): Promise<AuditScore> {
     },
     async (span) => {
       const assetRoot = imprintHomeDir();
-      const tools = await discoverTools(assetRoot, opts.site, '[imprint audit]');
-      const toolCount = tools.length;
+      const discoveredTools = await discoverTools(assetRoot, opts.site, '[imprint audit]');
+      const toolCount = discoveredTools.length;
       if (toolCount === 0) {
         throw new Error(
           `No generated tool found for site "${opts.site}" — run \`imprint teach ${opts.site}\` first, then audit it.`,
         );
       }
+      const {
+        eligible: tools,
+        nonInteractiveAuthNames,
+        skippedInteractiveAuth,
+      } = partitionAuditTools(discoveredTools);
+      const auditedToolCount = tools.length;
+      const detectedButUnemitted = detectedButUnemittedTools(
+        loadTeachState(opts.site),
+        discoveredTools.map((tool) => tool.workflow.toolName),
+      );
+      const detectedToolCount = countDetectedToolNames(
+        discoveredTools.map((tool) => tool.workflow.toolName),
+        detectedButUnemitted,
+      );
 
       const provider = opts.provider ?? 'claude-cli';
       const model = opts.model ?? preferredAgentModel(provider);
@@ -278,14 +573,29 @@ export async function runAudit(opts: RunAuditOptions): Promise<AuditScore> {
         );
       }
 
-      const toolNames = tools.map((t) => t.workflow.toolName);
-      log(`auditing ${toolCount} tool(s) for site "${opts.site}": ${toolNames.join(', ')}`);
+      const nonInteractiveAuthSet = new Set(nonInteractiveAuthNames);
+      const expectedTools = tools.map((tool) => ({
+        name: tool.workflow.toolName,
+        parameters: nonInteractiveAuthSet.has(tool.workflow.toolName)
+          ? []
+          : tool.workflow.parameters.map((parameter) => parameter.name),
+      }));
+      const toolNames = expectedTools.map((tool) => tool.name);
+      log(
+        `auditing ${auditedToolCount}/${toolCount} eligible tool(s) for site "${opts.site}": ${toolNames.join(', ') || '(none)'}`,
+      );
+      for (const skipped of skippedInteractiveAuth) {
+        log(
+          `skipping interactive auth ${skipped.name}: ${skipped.reason}; receipt=${skipped.verificationStatus}`,
+        );
+      }
 
       // Parameters that shipped live-unverified at compile time (Fix D). Tell the
       // auditor to probe them especially — these are the most likely to be broken
       // (the compile-time differential could not confirm their effect).
       const unverifiedParams: Array<{ tool: string; params: string[] }> = [];
       for (const t of tools) {
+        if (nonInteractiveAuthSet.has(t.workflow.toolName)) continue;
         const params = (t.workflow.parameters ?? [])
           .filter((p) => p.verified === false)
           .map((p) => p.name);
@@ -309,18 +619,23 @@ export async function runAudit(opts: RunAuditOptions): Promise<AuditScore> {
         }
       }
 
-      const drive = await driveAudit({
-        site: opts.site,
-        provider,
-        model,
-        timeoutMs,
-        systemPromptPath,
-        toolNames,
-        unverifiedParams,
-        tokenDeps,
-      });
-
-      const rawScore = computeAuditScore(drive.report, opts.minScore);
+      const drive =
+        auditedToolCount === 0
+          ? emptyDriveAuditResult()
+          : await driveAudit({
+              site: opts.site,
+              provider,
+              model,
+              timeoutMs,
+              systemPromptPath,
+              toolNames,
+              nonInteractiveAuthNames,
+              unverifiedParams,
+              tokenDeps,
+            });
+      if (auditedToolCount === 0) {
+        log('all discovered tools require human-interactive authentication; auditor not spawned');
+      }
 
       // Cross-reference compile-time live verification with the audit grade.
       // The downgrade rule's purpose is to surface "flying blind" runs —
@@ -331,7 +646,7 @@ export async function runAudit(opts: RunAuditOptions): Promise<AuditScore> {
       //       chained tool was unreachable from auditor's connected set).
       //   v2: downgrade only if a flying-blind tool had infra invocations
       //       → still over-attributed transient page-state to defects.
-      //   v3 (current): downgrade only when the audit produced ZERO
+      //   v3: downgrade only when the audit produced ZERO
       //       `correct` invocations across ALL tools. If even one
       //       invocation graded correctly, that's positive evidence the
       //       framework + runtime work for at least that tool — the
@@ -339,21 +654,32 @@ export async function runAudit(opts: RunAuditOptions): Promise<AuditScore> {
       //       signal. Tools that couldn't be exercised still surface via
       //       `ungradeableTools` / `unverifiedAndUngradeable` for visibility
       //       without spoiling a verdict the score honestly earned.
+      //   v4: retain v3's treatment of tools explicitly reported as
+      //       blocked, but require every connected tool to appear in the final
+      //       report. An omitted tool has no audit evidence at all, so a report
+      //       covering only a successful subset is inconclusive rather than a
+      //       pass.
+      //   v5: likewise require an explicit verdict for every
+      //       advertised workflow parameter. `untestable` is valid coverage;
+      //       silently omitting a parameter is not.
+      //   v6 (current): a connected tool must have at least one invocation
+      //       record. Merely naming it in the report or discussing its
+      //       parameters is not evidence that its core operation was attempted;
+      //       infra and bad_params invocations still count as honest attempts.
       const ungradeableNames = ungradeableToolNames(drive.report);
+      const evaluation = evaluateAuditReport(
+        drive.report,
+        opts.minScore,
+        expectedTools,
+        drive.timedOut,
+      );
+      const { missingTools: missingToolNames, missingParameters } = evaluation;
       const untestableParamList = untestableParams(drive.report);
       const unverifiedAndUngradeable = tools
         .filter((t) => t.workflow.liveVerified === false)
         .map((t) => t.workflow.toolName)
         .filter((name) => ungradeableNames.includes(name));
-      const anyCorrectAcrossAudit = auditHasCorrectSignal(drive.report);
-      let verdict = rawScore.verdict;
-      // Timeout takes precedence over inconclusive downgrade.
-      if (drive.timedOut) {
-        verdict = 'timeout';
-      } else if (rawScore.verdict === 'pass' && !anyCorrectAcrossAudit) {
-        verdict = 'inconclusive';
-      }
-      const score: AuditScore = { ...rawScore, verdict };
+      const score = evaluation.score;
 
       // Persist the auditor transcript next to the report so a stuck/killed run
       // can be inspected after the fact.
@@ -390,8 +716,14 @@ export async function runAudit(opts: RunAuditOptions): Promise<AuditScore> {
         'imprint.audit.params_broken': score.paramsBroken,
         'imprint.audit.params_untestable': score.paramsUntestable,
         'imprint.audit.tool_count': toolCount,
+        'imprint.audit.audited_tool_count': auditedToolCount,
+        'imprint.audit.detected_tool_count': detectedToolCount,
+        'imprint.audit.detected_but_unemitted_count': detectedButUnemitted.length,
+        'imprint.audit.skipped_interactive_auth_count': skippedInteractiveAuth.length,
         'imprint.audit.verdict': score.verdict,
         'imprint.audit.unverified_and_ungradeable_count': unverifiedAndUngradeable.length,
+        'imprint.audit.missing_tool_count': missingToolNames.length,
+        'imprint.audit.missing_parameter_count': missingParameters.length,
         'imprint.audit.timed_out': drive.timedOut,
         'imprint.audit.turns': drive.turns,
         ...(drive.totalCostUsd != null ? { 'imprint.audit.cost_usd': drive.totalCostUsd } : {}),
@@ -413,7 +745,16 @@ export async function runAudit(opts: RunAuditOptions): Promise<AuditScore> {
         report: drive.report,
         site: opts.site,
         toolCount,
+        auditedToolCount,
+        detectedToolCount,
+        detectedButUnemittedTools: detectedButUnemitted,
+        skippedInteractiveAuth,
         ungradeableTools: ungradeableNames,
+        /** Connected tools without an invocation record. A partial audit
+         *  cannot pass merely because the auditor named an uncalled tool. */
+        missingTools: missingToolNames,
+        /** Advertised workflow parameters absent from the auditor's report. */
+        missingParameters,
         /** Advertised parameters the auditor could not differentially test. */
         untestableParams: untestableParamList,
         /** Tools that shipped without live verification at compile time AND
@@ -445,7 +786,13 @@ export async function runAudit(opts: RunAuditOptions): Promise<AuditScore> {
           transcriptPath,
           costUsd: drive.totalCostUsd,
           unverifiedAndUngradeable,
+          missingTools: missingToolNames,
+          missingParameters,
           report: drive.report,
+          auditedToolCount,
+          skippedInteractiveAuth,
+          detectedToolCount,
+          detectedButUnemittedTools: detectedButUnemitted,
         });
       }
 
@@ -484,6 +831,9 @@ interface DriveAuditOptions {
   timeoutMs: number;
   systemPromptPath: string;
   toolNames: string[];
+  /** Eligible password-only/direct-success auth tools. Interactive auth tools
+   * are filtered before the MCP session is created and never appear here. */
+  nonInteractiveAuthNames?: string[];
   /** Per-tool params that shipped live-unverified at compile time. */
   unverifiedParams: Array<{ tool: string; params: string[] }>;
   /** Producer→consumer token contracts (param.sourcedFrom) so the auditor chains. */
@@ -546,17 +896,18 @@ async function driveAuditWithClaude(opts: DriveAuditOptions): Promise<DriveAudit
   // with zero tools. The `imprint-audit-` prefix keeps the inline server unique.
   const serverName = `imprint-audit-${opts.site}`;
   const bunPath = process.execPath;
+  const mcpEnv = buildAuditMcpEnvironment();
   const mcpConfig = {
     mcpServers: {
       [serverName]: {
         command: bunPath,
-        args: ['run', CLI_PATH, 'mcp-server', opts.site],
+        args: buildAuditMcpCommandArgs(opts.site, opts.toolNames),
         // Pace every audit tool call: the auditor now differentially probes
         // bot-defended idempotent reads (search/calendar) instead of bailing
         // after one call, so a deliberate inter-call delay keeps the probing
         // steady enough that the per-IP anti-bot defense isn't tripped. Only
         // the audit sets this; production mcp-server runs unpaced.
-        env: { IMPRINT_AUDIT_PACING_MS: '5000', IMPRINT_AUDIT_TOOL_DEADLINE_MS: '120000' },
+        env: mcpEnv,
       },
     },
   };
@@ -652,7 +1003,8 @@ async function driveAuditWithClaude(opts: DriveAuditOptions): Promise<DriveAudit
 async function driveAuditWithCodex(opts: DriveAuditOptions): Promise<DriveAuditResult> {
   const serverName = `imprint-audit-${opts.site}`;
   const bunPath = process.execPath;
-  const mcpArgs = ['run', CLI_PATH, 'mcp-server', opts.site];
+  const mcpArgs = buildAuditMcpCommandArgs(opts.site, opts.toolNames);
+  const mcpEnv = buildAuditMcpEnvironment();
 
   const unverifiedNote = buildUnverifiedParamNote(opts.unverifiedParams);
   const initialPrompt = `<system_instructions>
@@ -685,9 +1037,11 @@ ${buildAuditInitialPrompt(opts, unverifiedNote)}`;
     '-c',
     `mcp_servers.${serverName}.tool_timeout_sec=300`,
     '-c',
-    `mcp_servers.${serverName}.env.IMPRINT_AUDIT_PACING_MS=${JSON.stringify('5000')}`,
+    `mcp_servers.${serverName}.env.IMPRINT_HOME=${JSON.stringify(mcpEnv.IMPRINT_HOME)}`,
+    '-c',
+    `mcp_servers.${serverName}.env.IMPRINT_AUDIT_PACING_MS=${JSON.stringify(mcpEnv.IMPRINT_AUDIT_PACING_MS)}`,
     '-c',
-    `mcp_servers.${serverName}.env.IMPRINT_AUDIT_TOOL_DEADLINE_MS=${JSON.stringify('120000')}`,
+    `mcp_servers.${serverName}.env.IMPRINT_AUDIT_TOOL_DEADLINE_MS=${JSON.stringify(mcpEnv.IMPRINT_AUDIT_TOOL_DEADLINE_MS)}`,
     '-c',
     'shell_environment_policy.inherit=all',
     '-',
@@ -701,8 +1055,7 @@ ${buildAuditInitialPrompt(opts, unverifiedNote)}`;
       cwd: REPO_ROOT,
       env: {
         ...process.env,
-        IMPRINT_AUDIT_PACING_MS: '5000',
-        IMPRINT_AUDIT_TOOL_DEADLINE_MS: '120000',
+        ...mcpEnv,
       },
       stdio: ['pipe', 'pipe', 'pipe'],
     });
@@ -758,6 +1111,10 @@ export function buildUnverifiedParamNote(
 }
 
 export function buildAuditInitialPrompt(opts: DriveAuditOptions, unverifiedNote: string): string {
+  const nonInteractiveAuthNames = opts.nonInteractiveAuthNames ?? [];
+  const authNote = nonInteractiveAuthNames.length
+    ? `\n\nThe following authentication tool(s) are eligible because every action completes without a human pause: ${nonInteractiveAuthNames.join(', ')}. Call each exactly once with one safe baseline. Never differentially probe or retry authentication actions. If any DATA tool returns AUTH_EXPIRED, classify that invocation as infra/inconclusive evidence; do not call an authentication tool in response.`
+    : '\n\nNo authentication tool is eligible in this audit. If a DATA tool returns AUTH_EXPIRED, classify that invocation as infra/inconclusive evidence; do not attempt to authenticate.';
   return `Audit every MCP tool connected to you for the site "${opts.site}".
 
 There are ${opts.toolNames.length} connected tool(s). For each one: read its description and input schema, invoke it with a realistic parameter set, judge the result, and classify each invocation as correct | tool_broken | infra | bad_params per your system prompt.
@@ -766,7 +1123,7 @@ Parameter coverage is mandatory for idempotent read tools. A cold cdp-replay/bro
 
 Promo/coupon/voucher/discount-code parameters require a known valid code to prove a visible effect. If neither the schema nor another tool output gives you a valid code, classify that parameter as untestable; do not invent a random code and call an unchanged response no_op.
 
-IMPORTANT: Call tools strictly sequentially — issue exactly one tool call, wait for its result, then issue the next. Never issue tool calls in parallel or batch them in one turn. Many target sites share an anti-bot defense across endpoints, so a parallel burst trips a site-wide rate-limit (HTTP 429) that then poisons every later call. If a call returns a 429 / rate-limit / anti-bot result, classify it \`infra\` and pause before the next call.${unverifiedNote}${buildTokenDepNote(opts.tokenDeps)}
+IMPORTANT: Call tools strictly sequentially — issue exactly one tool call, wait for its result, then issue the next. Never issue tool calls in parallel or batch them in one turn. Many target sites share an anti-bot defense across endpoints, so a parallel burst trips a site-wide rate-limit (HTTP 429) that then poisons every later call. If a call returns a 429 / rate-limit / anti-bot result, classify it \`infra\` and pause before the next call.${authNote}${unverifiedNote}${buildTokenDepNote(opts.tokenDeps)}
 
 When you are done, end your final message with exactly one fenced \`\`\`json block containing the full report and nothing after it.`;
 }
@@ -1209,7 +1566,13 @@ function printSummary(
     transcriptPath?: string;
     costUsd?: number | null;
     unverifiedAndUngradeable: string[];
+    missingTools: string[];
+    missingParameters: MissingAuditedParameter[];
     report: AuditReport;
+    auditedToolCount: number;
+    skippedInteractiveAuth: SkippedInteractiveAuth[];
+    detectedToolCount: number;
+    detectedButUnemittedTools: DetectedButUnemittedTool[];
   },
 ): void {
   const pct = score.graded === 0 ? 'n/a' : `${score.score.toFixed(1)}%`;
@@ -1223,8 +1586,18 @@ function printSummary(
   const invGraded = score.graded - paramsTested;
   const invTotal = invGraded + score.infra + score.badParams;
   console.log(
-    `[imprint]   graded ${score.graded} unit(s) = ${invGraded}/${invTotal} invocation(s) + ${paramsTested} parameter(s) across ${toolCount} tool(s) — excluded: ${score.infra} infra, ${score.badParams} bad_params, ${score.paramsUntestable} untestable param(s)`,
+    `[imprint]   graded ${score.graded} unit(s) = ${invGraded}/${invTotal} invocation(s) + ${paramsTested} parameter(s) across ${extra.auditedToolCount}/${toolCount} eligible tool(s) — excluded: ${score.infra} infra, ${score.badParams} bad_params, ${score.paramsUntestable} untestable param(s)`,
   );
+  for (const skipped of extra.skippedInteractiveAuth) {
+    console.log(
+      `[imprint]   skipped interactive auth ${skipped.name} — ${skipped.reason}; verification receipt: ${skipped.verificationStatus}`,
+    );
+  }
+  if (extra.detectedButUnemittedTools.length > 0) {
+    console.log(
+      `[imprint]   ${extra.detectedButUnemittedTools.length}/${extra.detectedToolCount} detected tool(s) were not emitted and are excluded from scoring: ${extra.detectedButUnemittedTools.map((tool) => tool.name).join(', ')}`,
+    );
+  }
   if (paramsTested + score.paramsUntestable > 0) {
     console.log(
       `[imprint]   parameters: ${score.paramsWorking}/${paramsTested} working — ${score.paramsNoOp} no-op, ${score.paramsBroken} broken, ${score.paramsUntestable} untestable`,
@@ -1255,12 +1628,30 @@ function printSummary(
       `[imprint]   ${extra.unverifiedAndUngradeable.length} tool(s) flying blind (no live verification at compile, no graded calls at audit): ${extra.unverifiedAndUngradeable.join(', ')}`,
     );
   }
+  if (extra.missingTools.length > 0) {
+    console.log(
+      `[imprint]   ${extra.missingTools.length} connected tool(s) have no invocation attempt in the auditor report: ${extra.missingTools.join(', ')}`,
+    );
+  }
+  if (extra.missingParameters.length > 0) {
+    console.log(
+      `[imprint]   ${extra.missingParameters.length} advertised parameter(s) missing from the auditor report: ${extra.missingParameters.map((parameter) => `${parameter.tool}.${parameter.name}`).join(', ')}`,
+    );
+  }
   if (score.verdict === 'timeout') {
     console.log(
       `[imprint]   audit was killed at the ${formatDeadline(extra.timeoutMs)} deadline before finishing — partial results only. Re-run with a longer --timeout, or inspect the transcript to see where it stalled.`,
     );
   } else if (score.verdict === 'inconclusive') {
-    if (extra.unverifiedAndUngradeable.length > 0) {
+    if (extra.missingTools.length > 0) {
+      console.log(
+        '[imprint]   verdict downgraded to inconclusive because the auditor did not record an invocation attempt for every connected tool.',
+      );
+    } else if (extra.missingParameters.length > 0) {
+      console.log(
+        '[imprint]   verdict downgraded to inconclusive because the auditor did not report every advertised parameter.',
+      );
+    } else if (extra.unverifiedAndUngradeable.length > 0) {
       console.log(
         '[imprint]   verdict downgraded to inconclusive because at least one tool has zero live signal anywhere.',
       );