jules-orchestrator-kit 0.60.0 → 0.64.0

package/README.md

@@ -204,7 +204,7 @@ To maximize PR merge rates, dispatch tasks according to deterministic boundaries
 * **Fail-Closed Security & Secret Redaction:** Evaluates explicit Deny rules before Allow rules against canonicalized, case-folded paths. Redacts high-entropy keys and base64-encoded credentials (such as Kubernetes `Secret` manifests).
 * **Complexity & Cost Router:** Zero-dependency heuristic classifier (`src/router.mjs`) routing mechanical tasks to lightweight models while reserving primary models for complex refactors, with a `node --check` syntax-verification gate that transparently escalates a FAST-tier result to the primary provider if it left broken JS on disk.
 * **Terminal UI & Diagnostic Matrix (`agentctl doctor`):** Interactive terminal dashboard, task sidecar manager, and automated transactional self-repair.
-* **Verified Test Suite:** Tested with **957 unit tests across 134 suites passing in < 15.0s**.
+* **Verified Test Suite:** Tested with **1085 unit tests across 150 suites passing in < 15.0s**.
 
 <br/>
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jules-orchestrator-kit",
-  "version": "0.60.0",
+  "version": "0.64.0",
   "description": "Zero-dependency safety gatekeeper, test oracle generator, and multi-agent coordination protocol for autonomous coding agents — Google Jules, Claude Code, Codex and Gemini CLI.",
   "repository": {
     "type": "git",
@@ -55,7 +55,9 @@
     "jules:rules-lint": "node scripts/rules-lint.mjs",
     "jules:doc-sync": "node scripts/doc-sync-check.mjs",
     "release": "node scripts/release.mjs",
-    "lint": "eslint ."
+    "guard-reach": "node scripts/guard-reach-check.mjs",
+    "lint": "eslint .",
+    "package-integrity": "node scripts/package-integrity-check.mjs"
   },
   "engines": {
     "node": ">=20.0.0"

package/scripts/guard-reach-check.mjs

@@ -0,0 +1,226 @@
+#!/usr/bin/env node
+
+/**
+ * Activation coverage: proof that every blocking check can still be made red.
+ *
+ * A defect that turns a check off cannot be found by the check it turns off.
+ * That is not a hypothetical — `isTestFile` matched the substring `/test/`,
+ * which does not occur in `tests/test_calc.py`, so the entire tamper guard was
+ * silent for the standard pytest, Rust and RSpec layouts. Every mechanism that
+ * should have caught it was working exactly as designed:
+ *
+ *   - the unit suite sampled the same distribution the implementation was
+ *     written from, so its fixtures re-confirmed the dialect it already knew;
+ *   - the doc-sync gate compares counts and versions, and a guard that guards
+ *     nothing still contributes passing tests;
+ *   - the nine-way CI matrix varies OS and Node version — dimensions
+ *     orthogonal to the defect. Nine runs of `test/foo.test.js` never explore
+ *     `tests/test_calc.py`;
+ *   - cold review reads the code against its stated intent, and here the code
+ *     and the intent agreed. The eye supplies the leading slash;
+ *   - the release gate is a conjunction over those four, and a signal that
+ *     silently goes absent contributes `true`.
+ *
+ * The common property: `ok: true` from a check that examined nothing is
+ * byte-identical to `ok: true` from a check that examined everything. There is
+ * no denominator. This script supplies one.
+ *
+ * Three steps, all in-process, no dependencies, well under a second:
+ *
+ *   1. POLICY   — the hand-written witness table in src/guard-policy.mjs
+ *                 must hold. It is derived from what the tool advertises, never
+ *                 from the regexes that implement it.
+ *   2. CANARIES — every known-bad input must produce the finding it names. A
+ *                 canary that comes back clean is not a pass; it is proof that
+ *                 the rule stopped being reachable.
+ *   3. MUTANTS  — each hand-written mutant of the applicability predicate must
+ *                 kill at least one canary. A surviving mutant means no canary
+ *                 ever required the guard to activate, so the suite would stay
+ *                 green if it silently stopped looking.
+ *
+ * Usage: node scripts/guard-reach-check.mjs [--json]
+ * Exit codes: 0 = every guard reachable, 1 = a guard has gone silent.
+ */
+
+import { checkTestTampering, checkScope } from "../src/security.mjs";
+import { isTestPath } from "../src/test-paths.mjs";
+import { normalizeScope } from "../src/config.mjs";
+import { parseCollectedTests } from "../src/ops/test-collection.mjs";
+import {
+  TEST_PATH_CASES,
+  TAMPER_CANARIES,
+  PREDICATE_MUTANTS,
+  EMPTY_RUN_CANARIES,
+  SCOPE_CANARIES,
+  INNOCENT_EDITS,
+  UNREADABLE_DIALECTS,
+} from "../src/guard-policy.mjs";
+
+/**
+ * Build a unified diff for one canary.
+ *
+ * The context line carries the comment syntax of the file's own language.
+ * A `//` line in a `.py` fixture is not a comment, and a fixture that lies
+ * about the language under test measures the fixture rather than the guard —
+ * which is how two false results were once read as two defects.
+ */
+function canaryDiff(c) {
+  const ctx = c.context || "// context";
+  const lines = [`--- a/${c.file}`, `+++ b/${c.file}`, "@@ -1,20 +1,20 @@", ` ${ctx}`];
+  for (const l of c.removed) lines.push(`-${l}`);
+  for (const l of c.added) lines.push(`+${l}`);
+  lines.push(` ${ctx}`);
+  return lines.join("\n");
+}
+
+const failures = [];
+const checks = [];
+const add = (name, ok, detail) => {
+  checks.push({ name, ok, detail });
+  if (!ok) failures.push(`${name}: ${detail}`);
+};
+
+// --- 1. Policy contract -----------------------------------------------------
+{
+  const wrong = TEST_PATH_CASES.filter((c) => isTestPath(c.path) !== c.expected);
+  add(
+    "policy: test-path domain",
+    wrong.length === 0,
+    wrong.length
+      ? wrong.map((c) => `${c.path} → ${isTestPath(c.path)}, policy says ${c.expected} (${c.why})`).join("; ")
+      : `${TEST_PATH_CASES.length} witnesses hold`
+  );
+}
+
+{
+  const scope = normalizeScope({ deny: [], allow: [], protect: [] });
+  const wrong = [];
+  for (const c of SCOPE_CANARIES) {
+    const res = checkScope([c.path], scope);
+    const rule = res.ok ? "none" : res.violations[0].rule;
+    if (rule !== c.rule) wrong.push(`${c.path} → ${rule}, policy says ${c.rule} (${c.why})`);
+  }
+  add("policy: scope tiers", wrong.length === 0, wrong.length ? wrong.join("; ") : `${SCOPE_CANARIES.length} paths tiered as declared`);
+}
+
+{
+  const missed = EMPTY_RUN_CANARIES.filter((c) => parseCollectedTests(c.output, "").count !== 0);
+  add(
+    "policy: empty-run detection",
+    missed.length === 0,
+    missed.length ? `${missed.map((m) => m.id).join(", ")} report zero tests in a spelling the floor cannot read` : `${EMPTY_RUN_CANARIES.length} runners recognised`
+  );
+}
+
+// --- 2. Canaries ------------------------------------------------------------
+const canaryResults = new Map();
+{
+  const silent = [];
+  const noDenominator = [];
+  const noAssertions = [];
+  for (const c of TAMPER_CANARIES) {
+    const res = checkTestTampering(canaryDiff(c));
+    const hit = (res.violations || []).some((v) => v.type === c.expect);
+    canaryResults.set(c.id, hit);
+    if (!hit) silent.push(`${c.id} expected ${c.expect}, got ${JSON.stringify((res.violations || []).map((v) => v.type))}`);
+    // A finding with no denominator is the shape this script exists to reject.
+    if (hit && !(res.inputsSeen > 0)) noDenominator.push(c.id);
+    // Counting lines was not enough: a JUnit diff reported one input examined
+    // and a clean PASS while every assertion in it went unrecognised. A rule
+    // about assertions has to say how many assertions it actually read.
+    if (hit && c.expect !== "TEST_SKIP_INJECTION" && !(res.assertionsSeen > 0)) {
+      noAssertions.push(`${c.id} (${res.assertionsSeen} assertions parsed)`);
+    }
+  }
+  add("canaries: every tamper rule still fires", silent.length === 0, silent.length ? silent.join("; ") : `${TAMPER_CANARIES.length} canaries red as required`);
+  add("canaries: every finding carries a denominator", noDenominator.length === 0, noDenominator.length ? noDenominator.join(", ") : "inputsSeen > 0 on every hit");
+  add("canaries: assertion rules parsed an assertion", noAssertions.length === 0, noAssertions.length ? noAssertions.join(", ") : "assertionsSeen > 0 on every assertion finding");
+}
+
+// --- 3. The opposite failure: flagging what is innocent ---------------------
+{
+  const noisy = [];
+  for (const e of INNOCENT_EDITS) {
+    const res = checkTestTampering(canaryDiff(e));
+    const types = (res.violations || []).map((v) => v.type);
+    if (types.length > 0) noisy.push(`${e.id} → ${JSON.stringify(types)} (${e.why})`);
+  }
+  add(
+    "innocent edits stay silent",
+    noisy.length === 0,
+    noisy.length
+      ? noisy.join("; ")
+      : `${INNOCENT_EDITS.length} ordinary edits produce no finding`
+  );
+}
+
+{
+  const quiet = [];
+  for (const d of UNREADABLE_DIALECTS) {
+    const res = checkTestTampering(canaryDiff(d));
+    if (res.status !== "UNREADABLE") quiet.push(`${d.id} → ${res.status} (${d.why})`);
+  }
+  add(
+    "an unparsable dialect says so",
+    quiet.length === 0,
+    quiet.length
+      ? `${quiet.join("; ")} — coverage ending is fine, ending silently is not`
+      : `${UNREADABLE_DIALECTS.length} unsupported dialects reported, not passed`
+  );
+}
+
+// --- 4. Predicate mutants ---------------------------------------------------
+{
+  const survivors = [];
+  for (const mutant of PREDICATE_MUTANTS) {
+    let killed = false;
+    for (const c of TAMPER_CANARIES) {
+      // Only canaries the healthy predicate catches can kill a mutant.
+      if (!canaryResults.get(c.id)) continue;
+      const res = checkTestTampering(canaryDiff(c), { isTestPath: mutant.fn });
+      if (!(res.violations || []).some((v) => v.type === c.expect)) {
+        killed = true;
+        break;
+      }
+    }
+    if (!killed) survivors.push(`${mutant.id} (${mutant.why})`);
+  }
+  add(
+    "mutants: blinding the predicate breaks a canary",
+    survivors.length === 0,
+    survivors.length
+      ? `survived: ${survivors.join(", ")} — no canary required the guard to activate`
+      : `${PREDICATE_MUTANTS.length} mutants killed`
+  );
+}
+
+// --- Report -----------------------------------------------------------------
+const json = process.argv.includes("--json");
+const activated = [...canaryResults.values()].filter(Boolean).length;
+
+if (json) {
+  console.log(
+    JSON.stringify(
+      {
+        ok: failures.length === 0,
+        checks,
+        activationCoverage: { canaries: canaryResults.size, activated },
+      },
+      null,
+      2
+    )
+  );
+} else {
+  console.log("\n🎯 Guard Reach Check (activation coverage)");
+  console.log("-------------------------------------------------------");
+  for (const c of checks) console.log(`  ${c.ok ? "✅" : "❌"} ${c.name.padEnd(46)} ${c.detail}`);
+  console.log("-------------------------------------------------------");
+  console.log(`  canaries activated: ${activated}/${canaryResults.size}`);
+  console.log(
+    failures.length === 0
+      ? "✅ Every blocking guard can still be made red.\n"
+      : `\n❌ ${failures.length} guard(s) may have gone silent. A check that cannot be made red is not a check.\n`
+  );
+}
+
+process.exit(failures.length === 0 ? 0 : 1);

package/scripts/package-integrity-check.mjs

@@ -0,0 +1,251 @@
+#!/usr/bin/env node
+
+/**
+ * Does the package we publish actually work?
+ *
+ * Every test in this repository runs against the source tree, where every
+ * file is present by definition. What users install is a tarball built from
+ * the `files` list in package.json, and nothing checked that the two agreed.
+ *
+ * They did not. v0.63.0 shipped `scripts/guard-reach-check.mjs` — the check
+ * whose entire purpose is to prove no guard has silently gone missing —
+ * while leaving behind the policy contract it imports. Unpacked and run, it
+ * threw ERR_MODULE_NOT_FOUND. The CLI was fine, 1015 tests were green, nine
+ * CI cells passed, and the published artefact still had a hole in it,
+ * because every one of those signals was measured somewhere the file existed.
+ *
+ * This asks the packer what it would ship, and then resolves the import
+ * graph inside that answer.
+ *
+ * Usage: node scripts/package-integrity-check.mjs [--json]
+ * Exit codes: 0 = the tarball is self-contained, 1 = it is not.
+ */
+
+import { execFileSync } from "node:child_process";
+import { readFileSync, existsSync } from "node:fs";
+import { resolve, dirname, relative, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { IMPORT_EXTRACTION_CASES } from "../src/guard-policy.mjs";
+
+const root = fileURLToPath(new URL("..", import.meta.url));
+
+/**
+ * Mark every character that sits inside a string literal or a comment.
+ *
+ * Without this, an import quoted *inside* a fixture string reads as an
+ * import of the file itself — this check's first run reported six broken
+ * imports in the policy contract, all of them example text. A guard that
+ * cries wolf about its own fixtures gets switched off in a week.
+ *
+ * Approximate on purpose, and biased on purpose: a regex literal holding a
+ * quote can open a phantom string, so the counts reported below exist to
+ * make a mask that swallowed the file visible rather than silent.
+ */
+function stringMask(src) {
+  const mask = new Uint8Array(src.length);
+  let i = 0;
+  let quote = null;
+  let comment = null;
+  while (i < src.length) {
+    const c = src[i];
+    const d = src[i + 1];
+    if (comment === "line") {
+      if (c === "\n") comment = null;
+      else mask[i] = 1;
+      i++;
+      continue;
+    }
+    if (comment === "block") {
+      mask[i] = 1;
+      if (c === "*" && d === "/") {
+        mask[i + 1] = 1;
+        comment = null;
+        i += 2;
+        continue;
+      }
+      i++;
+      continue;
+    }
+    if (quote !== null) {
+      mask[i] = 1;
+      if (c === "\\") {
+        if (i + 1 < src.length) mask[i + 1] = 1;
+        i += 2;
+        continue;
+      }
+      if (c === quote) quote = null;
+      i++;
+      continue;
+    }
+    if (c === "/" && d === "/") { comment = "line"; mask[i] = 1; i++; continue; }
+    if (c === "/" && d === "*") { comment = "block"; mask[i] = 1; i++; continue; }
+    // A regex literal holding a quote — `/["']/` — opens a string that never
+    // closes, and everything after it is misread. This file's own subject
+    // matter is regexes full of quote characters, so the mask desynchronised
+    // and a `require("./calc")` written inside a comment was reported as a
+    // missing module. Deciding regex-versus-division on the previous token is
+    // the same approximation the diff scanner already makes.
+    if (c === "/") {
+      let k = i - 1;
+      while (k >= 0 && /\s/.test(src[k])) k--;
+      const prev = k >= 0 ? src[k] : "";
+      if (prev === "" || "(,=:[!&|?{};+-*%~^<>".includes(prev)) {
+        mask[i] = 1;
+        let j = i + 1;
+        let cls = false;
+        while (j < src.length) {
+          const e = src[j];
+          mask[j] = 1;
+          if (e === "\\") { if (j + 1 < src.length) mask[j + 1] = 1; j += 2; continue; }
+          if (e === "[") cls = true;
+          else if (e === "]") cls = false;
+          else if (e === "/" && !cls) { j++; break; }
+          else if (e === "\n") break;
+          j++;
+        }
+        i = j;
+        continue;
+      }
+    }
+    if (c === '"' || c === "'" || c === "`") { quote = c; mask[i] = 1; i++; continue; }
+    i++;
+  }
+  return mask;
+}
+
+/**
+ * Every module specifier in a source file.
+ *
+ * Deliberately newline-tolerant. A matcher bounded by `[^;\n]*?` cannot see
+ * a multi-line named import, which is exactly the import that was missing
+ * from the tarball, so the first version of this check certified the broken
+ * package as sound. The extraction cases in the policy contract exist to
+ * keep that from being a private mistake twice.
+ */
+export function extractSpecifiers(src, { skipQuoted = true } = {}) {
+  const mask = skipQuoted ? stringMask(src) : null;
+  const found = new Set();
+  const collect = (re) => {
+    for (const m of src.matchAll(re)) {
+      // What decides is the token immediately before the specifier — the
+      // `from`, or the `(` of a call. In a real import it is code; in a
+      // fixture it is the middle of a string. Testing the *keyword* instead
+      // was not enough: `export const CASES = [` at the top of a file
+      // matched lazily forward into the first `from "…"` inside an example,
+      // so a genuine keyword lent its authority to quoted text.
+      if (mask) {
+        let j = m.indices[1][0] - 2;
+        while (j >= 0 && /\s/.test(src[j])) j--;
+        if (j >= 0 && mask[j]) continue;
+      }
+      found.add(m[1]);
+    }
+  };
+  collect(/(?:^|[\s;}])(?:import|export)\s[\s\S]{0,500}?from\s*["']([^"']+)["']/gd);
+  collect(/(?:^|[\s;}])import\s*["']([^"']+)["']/gd);
+  collect(/\bimport\s*\(\s*["']([^"']+)["']/gd);
+  collect(/\brequire\s*\(\s*["']([^"']+)["']/gd);
+  return [...found];
+}
+
+/**
+ * Run every integrity check and return the result.
+ *
+ * Exported as a function rather than run on import: a module that checks the
+ * package must not exit the process of anything that merely imports it.
+ */
+export function checkPackageIntegrity() {
+  const failures = [];
+  const checks = [];
+  const add = (name, ok, detail) => {
+    checks.push({ name, ok, detail });
+    if (!ok) failures.push(`${name}: ${detail}`);
+  };
+
+  // --- 1. The extractor must be able to see what it claims to look for -------
+  {
+    const wrong = [];
+    for (const c of IMPORT_EXTRACTION_CASES) {
+      const got = extractSpecifiers(c.src).sort();
+      const want = [...c.expect].sort();
+      if (JSON.stringify(got) !== JSON.stringify(want)) {
+        wrong.push(`${c.id}: found ${JSON.stringify(got)}, contract says ${JSON.stringify(want)}`);
+      }
+    }
+    add("extractor: every import form is visible", wrong.length === 0, wrong.length ? wrong.join("; ") : `${IMPORT_EXTRACTION_CASES.length} forms found`);
+  }
+
+  // --- 2. Ask the packer what it would actually ship -------------------------
+  let shipped = new Set();
+  try {
+    const out = execFileSync("npm", ["pack", "--dry-run", "--json"], { cwd: root, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] });
+    shipped = new Set(JSON.parse(out)[0].files.map((f) => f.path.split(/[\\/]/).join("/")));
+  } catch (err) {
+    add("packer: `npm pack --dry-run` answers", false, err.message);
+  }
+  add("packer: the tarball is not empty", shipped.size > 0, `${shipped.size} files`);
+
+  // --- 3. Resolve the import graph inside the tarball ------------------------
+  {
+    const broken = [];
+    let resolved = 0;
+    let scanned = 0;
+
+    for (const file of shipped) {
+      if (!/\.(mjs|cjs|js)$/.test(file)) continue;
+      let src;
+      try {
+        src = readFileSync(resolve(root, file), "utf-8");
+      } catch {
+        continue;
+      }
+      scanned++;
+      for (const spec of extractSpecifiers(src)) {
+        if (!spec.startsWith(".")) continue; // bare and node: specifiers are not ours to resolve
+        resolved++;
+        const target = relative(root, resolve(dirname(resolve(root, file)), spec)).split(sep).join("/");
+        if (!shipped.has(target)) {
+          broken.push(`${file} imports ${spec} — ${target} is not in the tarball (on disk: ${existsSync(resolve(root, target)) ? "yes" : "no"})`);
+        }
+      }
+    }
+
+    add(
+      "tarball: every relative import resolves",
+      broken.length === 0,
+      broken.length ? broken.join("; ") : `${resolved} relative imports across ${scanned} shipped modules`
+    );
+    // A resolver that resolved nothing would report the same clean line.
+    add("tarball: the graph was actually walked", resolved > 0 && scanned > 0, `${scanned} modules, ${resolved} relative imports`);
+  }
+
+  // --- 4. Every advertised entry point has to be in the box ------------------
+  {
+    const pkg = JSON.parse(readFileSync(resolve(root, "package.json"), "utf-8"));
+    const entries = [...Object.values(pkg.bin || {}), pkg.main, pkg.module].filter(Boolean);
+    const missing = entries.map((e) => e.replace(/^\.\//, "")).filter((e) => !shipped.has(e));
+    add("entry points: every bin and main ships", missing.length === 0, missing.length ? missing.join(", ") : `${entries.length} entry points present`);
+  }
+
+  return { ok: failures.length === 0, checks, failures };
+}
+
+const isMain = process.argv[1] && process.argv[1].endsWith("package-integrity-check.mjs");
+if (isMain) {
+  const { ok, checks: rows, failures: bad } = checkPackageIntegrity();
+  if (process.argv.includes("--json")) {
+    console.log(JSON.stringify({ ok, checks: rows }, null, 2));
+  } else {
+    console.log("\n📦 Package Integrity Check (what we actually publish)");
+    console.log("-------------------------------------------------------");
+    for (const c of rows) console.log(`  ${c.ok ? "✅" : "❌"} ${c.name.padEnd(46)} ${c.detail}`);
+    console.log("-------------------------------------------------------");
+    console.log(
+      ok
+        ? "✅ The published package is self-contained.\n"
+        : `\n❌ ${bad.length} problem(s). The tarball is not what the source tree looks like.\n`
+    );
+  }
+  process.exit(ok ? 0 : 1);
+}

package/scripts/release.mjs

@@ -41,6 +41,39 @@ try {
   process.exit(1);
 }
 
+// 1a. Activation coverage (blocking).
+//
+// Step 1 proved the suite is green. Green is only evidence if the guards were
+// switched on: a check that silently stopped applying contributes passing
+// tests and a zero exit code exactly like one that ran. This asks the question
+// the suite cannot — can every blocking guard still be made red? — and it runs
+// before the doc-sync gate because a silent guard makes every later signal
+// meaningless.
+console.log("1a. Verifying every blocking guard can still be made red...");
+try {
+  execSync("node scripts/guard-reach-check.mjs", { cwd: root, stdio: "inherit" });
+  console.log("");
+} catch (_) {
+  console.error("\n❌ Release Aborted: a guard has gone silent. See the failing rows above.");
+  process.exit(1);
+}
+
+// Step 1a proved the guards work here. Here is not where users run them.
+//
+// Every signal so far was measured in the source tree, where every file
+// exists by construction. What ships is a tarball built from the `files`
+// list, and v0.63.0 published the guard-reach check without the policy
+// contract it imports — green suite, green matrix, green release, and a
+// module that threw ERR_MODULE_NOT_FOUND the moment anyone installed it.
+console.log("1a-2. Verifying the package we would publish is self-contained...");
+try {
+  execSync("node scripts/package-integrity-check.mjs", { cwd: root, stdio: "inherit" });
+  console.log("");
+} catch (_) {
+  console.error("\n❌ Release Aborted: the tarball is not what the source tree looks like.");
+  process.exit(1);
+}
+
 // 1b. Documentation / version consistency gate (blocking).
 console.log("1b. Verifying documentation is in sync with package.json & test suite...");
 {

package/src/assertions.mjs

@@ -561,12 +561,28 @@ export function assertTestIntegrity(config = {}, root = process.cwd()) {
   const res = checkTestTampering(diffStr, config);
   const diagnostics = (res.violations || []).map((v) => v.reason);
 
+  // A clean result from a guard that could not read the dialect is not a
+  // clean result, and it must not be reported as one. This does not fail the
+  // check — an unlisted assertion library is the user's normal, not their
+  // fault — but they get to know the guard is not covering them.
+  for (const u of res.unreadable || []) {
+    diagnostics.push(
+      `Test Tamper Guard: ${u.count} assertion-shaped line(s) in ${u.file} matched no known dialect, ` +
+        `so this file was not checked for tampering (e.g. ${JSON.stringify(u.samples[0])}). ` +
+        `The guard reports what it could not read rather than passing silently.`
+    );
+  }
+
   return {
     ok: res.ok,
     violations: res.violations || [],
     diagnostics,
     metrics: {
       violationCount: res.violations?.length || 0,
+      assertionsSeen: res.assertionsSeen ?? 0,
+      filesSeen: res.filesSeen ?? 0,
+      unreadableFiles: (res.unreadable || []).length,
+      status: res.status,
     },
   };
 }

package/src/config.mjs

@@ -54,6 +54,9 @@ const CI_DEFINITIONS = [
   "appveyor.yml",
   ".teamcity/**",
   ".githooks/**",
+  "buildspec.yml",
+  "**/buildspec.yml",
+  ".buildspec/**",
 ];
 
 export const BUILTIN_DENY = [
@@ -64,6 +67,24 @@ export const BUILTIN_DENY = [
   "**/*.key",
   "**/id_rsa*",
   ".agent/jules-queue/**",
+
+  // Shell that runs on `cd`, and credentials in plaintext. Same class as a CI
+  // definition: code or secrets that take effect before anyone reviews them.
+  "**/.envrc",
+  "**/.git-credentials",
+  "**/.aws/**",
+  "**/.ssh/**",
+  "**/.kube/**",
+  "**/kubeconfig*",
+  "**/.docker/config.json",
+  "**/*.p12",
+  "**/*.pfx",
+  "**/*.p8",
+  "**/id_ed25519*",
+  "**/credentials.json",
+  "**/service-account*.json",
+  "**/*.tfstate",
+  "**/*.tfstate.*",
   ...CI_DEFINITIONS,
 ];
 
@@ -110,6 +131,53 @@ export const BUILTIN_PROTECT = [
   "Dockerfile",
   "**/Dockerfile",
 
+  // Lockfiles decide which code actually *runs*. `package.json` was protected
+  // and `package-lock.json` was not, so an agent could change a resolved URL
+  // or an integrity hash — swapping the code that gets installed — without
+  // touching a single declared dependency, and the gate said nothing. The
+  // entropy scanner is deliberately blind to lockfiles too (they are full of
+  // hashes), so the change was invisible twice over. `BUILTIN_RESTRICTED` in
+  // risk.mjs already knew these mattered; only the risk tier consumed it,
+  // never checkScope.
+  "package-lock.json",
+  "**/package-lock.json",
+  "pnpm-lock.yaml",
+  "**/pnpm-lock.yaml",
+  "yarn.lock",
+  "**/yarn.lock",
+  "bun.lockb",
+  "bun.lock",
+  "Cargo.lock",
+  "**/Cargo.lock",
+  "go.sum",
+  "**/go.sum",
+  "poetry.lock",
+  "uv.lock",
+  "Pipfile.lock",
+  "Gemfile.lock",
+  "composer.lock",
+  "gradle.lockfile",
+  "npm-shrinkwrap.json",
+  "mix.lock",
+  "pubspec.lock",
+  "Podfile.lock",
+  "Package.resolved",
+  ".terraform.lock.hcl",
+
+  // Toolchain pins choose the compiler that runs the whole suite.
+  ".nvmrc",
+  ".tool-versions",
+  ".mise.toml",
+  "rust-toolchain",
+  "rust-toolchain.toml",
+  "**/gradle/wrapper/gradle-wrapper.properties",
+  "**/gradle/wrapper/gradle-wrapper.jar",
+
+  // Who has to approve a change, and what runs on every developer's machine.
+  "CODEOWNERS",
+  "docs/CODEOWNERS",
+  ".pre-commit-config.yaml",
+
   // Test-runner configuration decides which tests run and what counts as a
   // pass. Rewriting it is the cheapest way to make a suite green without
   // touching a single assertion — `--passWithNoTests`, an added ignore