mandrel 1.57.0

package/.agents/scripts/lib/epic-plan-ideation.js

@@ -0,0 +1,228 @@
+/**
+ * epic-plan-ideation.js — Phase 3/4 helpers for /epic-plan
+ *
+ * Phase 3: render an Epic body from a sharpened ideation one-pager
+ * using the canonical template at `.agents/templates/epic-from-idea.md`.
+ * Phase 4: open the GitHub Issue via an injected provider with the
+ * `type::epic` label only — no `state::draft` (the Epic carries only
+ * `type::epic` until PRD authoring writes `agent::review-spec`).
+ *
+ * The template is parsed from a string the caller has already loaded
+ * (typically via `fs.readFile`). The renderer is pure — no I/O — and
+ * the opener takes a tiny `createIssue` port so the test suite can
+ * mock the provider call without touching the GitHub HTTP client.
+ */
+
+import { TYPE_LABELS } from './label-constants.js';
+
+// Canonical section keys match the rendered template at
+// `.agents/templates/epic-from-idea.md`. The regex accepts both the
+// new canonical headings and the pre-canonical-headings ideation shape
+// so an in-flight one-pager parses cleanly during the transition. The
+// older `assumptions` key is accepted as input but is no longer a
+// canonical rendered section — it lands implicitly in `context` if the
+// one-pager carries one.
+const SECTION_RE = {
+  context:
+    /^##\s+(?:Context(?:\s+&\s+Problem)?|Background|Problem(?:\s+Statement)?)\s*$/im,
+  goal: /^##\s+(?:Goals?|Objectives?|(?:Recommended\s+)?Direction)\s*$/im,
+  nonGoals:
+    /^##\s+(?:Non[\s-]?Goals|Out\s+of\s+Scope|Not\s+Doing(?:\s+\(and\s+Why\))?)\s*$/im,
+  scope:
+    /^##\s+(?:MVP\s+|Proposed\s+)?Scope(?:\s+\([^)]+\))?\s*$|^##\s+Work\s+Breakdown\s*$/im,
+  acceptanceCriteria: /^##\s+(?:Acceptance(?:\s+Criteria)?|AC)\s*$/im,
+};
+
+const ORDER = ['context', 'goal', 'nonGoals', 'scope', 'acceptanceCriteria'];
+
+/**
+ * Extract the five canonical sections from an idea-refinement one-pager.
+ *
+ * @param {string} onePager - Markdown produced by Phase 3 of the
+ *   `idea-refinement` skill.
+ * @returns {{
+ *   title: string,
+ *   context: string,
+ *   goal: string,
+ *   nonGoals: string,
+ *   scope: string,
+ *   acceptanceCriteria: string,
+ * }}
+ */
+export function parseOnePager(onePager) {
+  if (!onePager || typeof onePager !== 'string') {
+    throw new Error('parseOnePager: onePager must be a non-empty string');
+  }
+
+  const titleMatch = onePager.match(/^#\s+(.+?)\s*$/m);
+  const title = titleMatch ? titleMatch[1].trim() : 'Untitled Epic';
+
+  // Build a map of section name -> [headingMatch.index, headingLength].
+  const positions = [];
+  for (const key of ORDER) {
+    const m = onePager.match(SECTION_RE[key]);
+    if (m && typeof m.index === 'number') {
+      positions.push({ key, start: m.index, headingLength: m[0].length });
+    }
+  }
+  positions.sort((a, b) => a.start - b.start);
+
+  const sections = {
+    context: '',
+    goal: '',
+    nonGoals: '',
+    scope: '',
+    acceptanceCriteria: '',
+  };
+
+  // Generic next-heading regex — slice up to the next `## ` heading,
+  // not just the next canonical one, so non-canonical sections the
+  // author included (e.g. "Open Questions") don't get folded into the
+  // preceding canonical section.
+  const NEXT_HEADING_RE = /^##\s+/m;
+  for (let i = 0; i < positions.length; i += 1) {
+    const cur = positions[i];
+    const sliceStart = cur.start + cur.headingLength;
+    const rest = onePager.slice(sliceStart);
+    const nextMatch = rest.match(NEXT_HEADING_RE);
+    const sliceEnd =
+      nextMatch && typeof nextMatch.index === 'number'
+        ? sliceStart + nextMatch.index
+        : onePager.length;
+    sections[cur.key] = onePager.slice(sliceStart, sliceEnd).trim();
+  }
+
+  return { title, ...sections };
+}
+
+/**
+ * Render the Epic body from a parsed one-pager and a template string.
+ * Substitutes `{{key}}` tokens for the matching section. Missing
+ * sections are rendered as `_(not specified)_` so the operator can spot
+ * gaps during the HITL review (Phase 3).
+ *
+ * @param {{
+ *   onePager: string,
+ *   template: string,
+ * }} args
+ * @returns {{ title: string, body: string }}
+ */
+export function renderEpicBody({ onePager, template }) {
+  if (!template || typeof template !== 'string') {
+    throw new Error('renderEpicBody: template must be a non-empty string');
+  }
+  const parsed = parseOnePager(onePager);
+
+  const body = template.replace(/\{\{(\w+)\}\}/g, (_, key) => {
+    if (key === 'title') return parsed.title;
+    const value = parsed[key];
+    return value && value.length > 0 ? value : '_(not specified)_';
+  });
+
+  return { title: parsed.title, body };
+}
+
+/**
+ * Open a new GitHub Issue for the Epic. The label set is exactly
+ * `[type::epic]` — no `state::*` label is added at creation time.
+ *
+ * The `createIssue` port matches the shape
+ * `({ title, body, labels }) => Promise<{ id, nodeId?, url? }>` so the
+ * unit test can pass an in-memory mock and assert on the captured
+ * payload. In production the port delegates to the ticketing provider's
+ * `createIssue` (GitHub: `TicketGateway.createIssue`), which adds the
+ * new issue to the configured Projects V2 board via the shared
+ * `addIssueToBoard` helper — idempotent, non-fatal, and a no-op when no
+ * project number is configured (Story #3822) — so the Epic lands on the
+ * board without relying on GitHub's "Auto-add to project" workflow. The
+ * created issue's GraphQL `node_id` is surfaced as `nodeId` on the
+ * returned envelope for observability and follow-up board operations.
+ *
+ * @param {{
+ *   onePager: string,
+ *   template: string,
+ *   createIssue: (payload: { title: string, body: string, labels: string[] }) => Promise<{ id: number, nodeId?: string, url?: string }>,
+ * }} args
+ * @returns {Promise<{ id: number, nodeId: string|null, title: string, body: string, labels: string[], url?: string, payload: { title: string, body: string, labels: string[] } }>}
+ */
+export async function openEpicFromOnePager({
+  onePager,
+  template,
+  createIssue,
+}) {
+  if (typeof createIssue !== 'function') {
+    throw new Error('openEpicFromOnePager: createIssue must be a function');
+  }
+  const { title, body } = renderEpicBody({ onePager, template });
+  const labels = [TYPE_LABELS.EPIC];
+  const payload = { title, body, labels };
+  const created = await createIssue(payload);
+  if (!created || typeof created.id !== 'number') {
+    throw new Error(
+      'openEpicFromOnePager: createIssue must return { id: number, nodeId?, url? }',
+    );
+  }
+  return {
+    id: created.id,
+    nodeId: created.nodeId ?? null,
+    title,
+    body,
+    labels,
+    url: created.url,
+    payload,
+  };
+}
+
+/**
+ * Update an existing Epic Issue's body from a sharpened one-pager. The
+ * single persistence path used by the Phase 6 Epic Clarity Gate.
+ *
+ * The `editIssue` port matches the shape
+ * `({ epicId, body }) => Promise<void|object>` so unit tests can pass an
+ * in-memory mock. Idempotent: when `currentBody` exactly matches the
+ * freshly rendered body, the port is **not** called and the function
+ * returns `{ changed: false }`.
+ *
+ * @param {{
+ *   epicId: number,
+ *   onePager: string,
+ *   template: string,
+ *   editIssue: (payload: { epicId: number, body: string }) => Promise<unknown>,
+ *   currentBody?: string|null,
+ * }} args
+ * @returns {Promise<{
+ *   epicId: number,
+ *   title: string,
+ *   body: string,
+ *   changed: boolean,
+ *   payload?: { epicId: number, body: string },
+ * }>}
+ */
+export async function updateEpicFromOnePager({
+  epicId,
+  onePager,
+  template,
+  editIssue,
+  currentBody = null,
+}) {
+  if (typeof editIssue !== 'function') {
+    throw new Error('updateEpicFromOnePager: editIssue must be a function');
+  }
+  if (!Number.isInteger(epicId) || epicId <= 0) {
+    throw new Error(
+      'updateEpicFromOnePager: epicId must be a positive integer',
+    );
+  }
+
+  const { title, body } = renderEpicBody({ onePager, template });
+
+  if (typeof currentBody === 'string' && currentBody === body) {
+    return { epicId, title, body, changed: false };
+  }
+
+  const payload = { epicId, body };
+  await editIssue(payload);
+  return { epicId, title, body, changed: true, payload };
+}
+
+export const __test = { ORDER, SECTION_RE };

package/.agents/scripts/lib/error-redactor.js

@@ -0,0 +1,125 @@
+/**
+ * Story #1651 (CWE-209): error-envelope redactor for CLI scripts.
+ *
+ * Rewrites absolute filesystem paths to repo-relative form, elides
+ * `$HOME` / `$USERPROFILE` segments outside the repo, and scrubs
+ * token-shaped substrings before error envelopes hit the public CI log.
+ *
+ * Pure and dependency-free so callers (tests, ad-hoc loggers, the
+ * runAsCli default handler) can reuse it without standing up the rest
+ * of the cli-utils harness.
+ */
+
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const REPO_ROOT_CACHE = { value: null };
+
+/**
+ * Resolve the repository root the redactor rewrites against. The
+ * heuristic walks up from this file's directory; consumers may override
+ * via the `repoRoot` option on `redactErrorMessage`. The result is
+ * memoised because the redactor runs in the hot path of error-printing.
+ *
+ * @returns {string}
+ */
+export function resolveRepoRoot() {
+  if (REPO_ROOT_CACHE.value) return REPO_ROOT_CACHE.value;
+  // This file: .agents/scripts/lib/error-redactor.js → repo root is 3 up.
+  const here = path.dirname(fileURLToPath(import.meta.url));
+  REPO_ROOT_CACHE.value = path.resolve(here, '..', '..', '..');
+  return REPO_ROOT_CACHE.value;
+}
+
+const TOKEN_SHAPED = /\b(?:gh[pousr]_[A-Za-z0-9_]{20,}|[A-Fa-f0-9]{32,})\b/g;
+
+/**
+ * Normalise both Windows-style and POSIX-style absolute paths in
+ * `message` to repo-relative form, elide `$HOME` / `$USERPROFILE`
+ * outside the repo, and scrub token-shaped substrings (`ghp_*`,
+ * `gho_*`, `ghs_*`, `ghu_*`, `ghr_*`, 32+ hex chars).
+ *
+ * @param {string|undefined} message
+ * @param {object} [options]
+ * @param {string} [options.repoRoot]  Override the auto-resolved repo root.
+ * @param {string} [options.home]      Override the home directory.
+ * @returns {string}
+ */
+export function redactErrorMessage(message, options = {}) {
+  if (typeof message !== 'string' || message.length === 0) {
+    return message ?? '';
+  }
+  const repoRoot = options.repoRoot ?? resolveRepoRoot();
+  const home =
+    options.home ?? process.env.HOME ?? process.env.USERPROFILE ?? null;
+
+  let out = message;
+
+  for (const variant of pathVariants(repoRoot)) {
+    out = out.split(`${variant}\\`).join('');
+    out = out.split(`${variant}/`).join('');
+    out = out.split(variant).join('<repo>');
+  }
+
+  if (home) {
+    for (const variant of pathVariants(home)) {
+      out = out.split(`${variant}\\`).join('~\\');
+      out = out.split(`${variant}/`).join('~/');
+      out = out.split(variant).join('~');
+    }
+  }
+
+  return out.replace(TOKEN_SHAPED, '[REDACTED]');
+}
+
+function pathVariants(p) {
+  if (!p) return [];
+  const back = p.replace(/\//g, '\\');
+  const forward = p.replace(/\\/g, '/');
+  return back === forward ? [back] : [back, forward];
+}
+
+/**
+ * Determine whether error-message redaction is enabled for this process.
+ *
+ * Precedence (any one is enough to opt in):
+ *   1. Explicit `--quiet-errors` flag in `argv`.
+ *   2. `AGENT_CLI_QUIET_ERRORS=1` (or `true`) in `env`.
+ *   3. `CI=true` (or any other truthy non-empty value) in `env`.
+ *
+ * Operator workstations stay verbose by default; CI runs (where logs
+ * are public on OSS forks) get redaction automatically.
+ *
+ * @param {string[]} [argv]      Defaults to `process.argv.slice(2)`.
+ * @param {NodeJS.ProcessEnv} [env]  Defaults to `process.env`.
+ * @returns {boolean}
+ */
+export function parseQuietErrorsFlag(argv, env) {
+  const _argv = argv ?? process.argv.slice(2);
+  const _env = env ?? process.env;
+  if (_argv.includes('--quiet-errors')) return true;
+  if (isTruthyEnv(_env.AGENT_CLI_QUIET_ERRORS)) return true;
+  if (isTruthyEnv(_env.CI)) return true;
+  return false;
+}
+
+function isTruthyEnv(value) {
+  if (!value) return false;
+  if (value === '0') return false;
+  if (value.toLowerCase() === 'false') return false;
+  return true;
+}
+
+/**
+ * Format a thrown error for stderr, applying redaction when
+ * `parseQuietErrorsFlag()` says we should. Extracted from `runAsCli` so
+ * the cli-utils default error handler stays a single expression and the
+ * redaction logic lives next to the redactor itself.
+ *
+ * @param {unknown} err
+ * @returns {string}
+ */
+export function formatCliError(err) {
+  const body = err?.stack ?? err?.message ?? err;
+  return parseQuietErrorsFlag() ? redactErrorMessage(body) : body;
+}

package/.agents/scripts/lib/errors/index.js

@@ -0,0 +1,67 @@
+/**
+ * lib/errors/ — canonical home for custom Error subclasses used by the
+ * orchestration SDK.
+ *
+ * Consumers import by class so tests can match on `instanceof` rather than
+ * message substrings.
+ */
+
+export class ConflictingTypeLabelsError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = 'ConflictingTypeLabelsError';
+  }
+}
+
+export class ValidationError extends Error {
+  constructor(message, details = {}) {
+    super(message);
+    this.name = 'ValidationError';
+    Object.assign(this, details);
+  }
+}
+
+/**
+ * Errors raised by the `gh` CLI bridge (currently the bootstrap preflight;
+ * later the `lib/gh-exec.js` shim outlined in Tech Spec #1350). Tests
+ * match on `instanceof` rather than message substrings so message text
+ * can evolve without churning the assertions.
+ */
+export class GhNotInstalledError extends Error {
+  constructor(message = 'gh CLI is not installed or not on PATH') {
+    super(message);
+    this.name = 'GhNotInstalledError';
+  }
+}
+
+export class GhAuthError extends Error {
+  constructor(message = 'gh CLI is installed but not authenticated') {
+    super(message);
+    this.name = 'GhAuthError';
+  }
+}
+
+export class GhVersionError extends Error {
+  constructor(message, details = {}) {
+    super(message);
+    this.name = 'GhVersionError';
+    Object.assign(this, details);
+  }
+}
+
+/**
+ * Raised when a framework runtime dependency (e.g. `ajv`) cannot be
+ * resolved from the consumer's `node_modules/`. Surfaces during the
+ * `/agents-bootstrap-github` preflight to redirect operators to
+ * `/agents-bootstrap-project`, which is the workflow responsible for
+ * merging and installing the framework's runtime deps. `missing` carries
+ * the package specifiers that failed to resolve so the CLI can render an
+ * actionable hint.
+ */
+export class MissingRuntimeDepsError extends Error {
+  constructor(message, details = {}) {
+    super(message);
+    this.name = 'MissingRuntimeDepsError';
+    Object.assign(this, details);
+  }
+}

package/.agents/scripts/lib/feedback-loop/audit-results-graduator.js

@@ -0,0 +1,230 @@
+/**
+ * audit-results-graduator.js — Auto-graduate non-blocking audit findings
+ * from the Epic's `audit-results` structured comment into routed GitHub
+ * follow-up issues. Story #2615 / Epic #2586.
+ *
+ * As of Story #3845 / Epic #3823 the spawn helper, the path/idempotency
+ * probes, the `gh issue create` filer, the toggle reader, and the
+ * route → probe → file walk all live in the shared
+ * [`graduator-core.js`](./graduator-core.js). This module is the thin
+ * audit-specific shell: it owns the audit finding parser (lens detection
+ * plus the 🔵→low / 🟢→suggestion severity mapping), the audit label /
+ * title / body shape, and the audit idempotency marker. Behaviour is
+ * identical to the pre-consolidation graduator.
+ *
+ *   - Read the `audit-results` structured comment off the Epic ticket
+ *     via the injected provider (`getTicketComments`).
+ *   - For each non-blocking finding (severity high/medium/low/suggestion
+ *     — i.e. anything that is NOT a 🔴 Critical Blocker), check that
+ *     the cited file still exists in the merged tree.
+ *   - Route by source classification (framework vs consumer) using
+ *     `classifyPathSource`. Cross-repo findings are recorded under
+ *     `skipped: 'cross-repo-deferred'` and the would-be `gh issue
+ *     create` invocation is logged — never shelled out across repos.
+ *   - File a follow-up issue with `gh issue create` carrying:
+ *       - `meta::audit-finding`
+ *       - `meta::framework-gap` or `meta::consumer-improvement`
+ *       - `audit-results::<severity>` (high|medium|low|suggestion)
+ *       - `domain::<lens-name>` (e.g. `domain::audit-security`)
+ *   - Embed an idempotency marker in each body:
+ *       <!-- audit-results-followup: epic-<id>-finding-<idx> -->
+ *     Before filing, probe via `gh search issues "<marker>"` and skip
+ *     findings whose marker is already present.
+ *   - Short-circuit when
+ *     `config.delivery.feedbackLoop.auditResultsAutoFile` is `false` —
+ *     return `{ filed: [], skipped: [{ reason: 'toggle-disabled' }],
+ *     errors: [] }`.
+ *   - NEVER throw. Every failure path is captured in `errors[]`.
+ */
+
+import {
+  graduate,
+  makeIsAutoFileEnabled,
+  probePathExists,
+} from './graduator-core.js';
+
+/**
+ * Resolve the toggle from the resolved agentrc config. Defaults to `true`
+ * — the feature is opt-out, not opt-in (mirrors codeReviewAutoFile).
+ *
+ * @param {object|undefined|null} config
+ * @returns {boolean}
+ */
+export const isAutoFileEnabled = makeIsAutoFileEnabled('auditResultsAutoFile');
+
+// Re-export the shared path probe so existing importers keep working.
+export { probePathExists };
+
+/**
+ * Severity → label mapping. Only non-blocking severities have a route;
+ * 🔴 Critical Blocker is explicitly filtered out upstream.
+ */
+const SEVERITY_LABEL = Object.freeze({
+  high: 'audit-results::high',
+  medium: 'audit-results::medium',
+  low: 'audit-results::low',
+  suggestion: 'audit-results::suggestion',
+});
+
+/**
+ * Map a classification source to its meta routing label.
+ *
+ * @param {string} source
+ * @returns {string}
+ */
+function metaSourceLabel(source) {
+  return source === 'framework'
+    ? 'meta::framework-gap'
+    : 'meta::consumer-improvement';
+}
+
+/**
+ * Build the idempotency marker for a given epicId / finding index. An
+ * HTML comment so it survives markdown rendering without leaking into
+ * the visible body, but stays indexable via `gh search`.
+ *
+ * @param {number} epicId
+ * @param {number} index — zero-based finding ordinal within the Epic.
+ * @returns {string}
+ */
+export function buildIdempotencyMarker(epicId, index) {
+  return `<!-- audit-results-followup: epic-${epicId}-finding-${index} -->`;
+}
+
+/**
+ * Parse the rendered audit-results markdown into a list of findings.
+ * The format produced by `epic-audit.md` Step 4 groups findings under
+ * `#### <lens-name>` headings; each finding line begins with a severity
+ * emoji and embeds the cited path inside backticks. 🔴 critical findings
+ * are filtered out (they're blocking — the Epic stops on those).
+ *
+ * Pure. Exported so the parser can be unit-tested in isolation.
+ *
+ * @param {string} body
+ * @returns {Array<{ severity: 'high'|'medium'|'low'|'suggestion', lens: string, path: string, summary: string, index: number }>}
+ */
+export function parseFindings(body) {
+  if (typeof body !== 'string' || body.length === 0) return [];
+  const findings = [];
+  const lines = body.split(/\r?\n/);
+  let idx = 0;
+  let lens = 'unknown';
+  for (const rawLine of lines) {
+    const trimmed = rawLine.trim();
+    if (trimmed.length === 0) continue;
+
+    // Detect a lens heading. We accept any heading-prefixed line that
+    // names a known audit family (`audit-*`).
+    const lensMatch = trimmed.match(/^#{2,6}\s+(audit-[a-z0-9-]+)/i);
+    if (lensMatch) {
+      lens = lensMatch[1];
+      continue;
+    }
+
+    let severity = null;
+    if (trimmed.startsWith('🔴')) {
+      // Critical Blocker — skip; never graduates.
+      continue;
+    }
+    if (trimmed.startsWith('🟠')) severity = 'high';
+    else if (trimmed.startsWith('🟡')) severity = 'medium';
+    else if (trimmed.startsWith('🟢')) severity = 'suggestion';
+    else if (trimmed.startsWith('🔵')) severity = 'low';
+    else continue;
+
+    const pathMatch = trimmed.match(/`([^`]+)`/);
+    if (!pathMatch) continue;
+    const path = pathMatch[1];
+
+    findings.push({
+      severity,
+      lens,
+      path,
+      summary: trimmed,
+      index: idx,
+    });
+    idx += 1;
+  }
+  return findings;
+}
+
+/**
+ * Auto-graduate non-blocking audit-results findings into routed
+ * follow-up issues. Never throws. Thin wrapper around the shared
+ * `graduate()` walk with the audit-specific behaviour bundle.
+ *
+ * @param {object} opts
+ * @param {number} opts.epicId
+ * @param {object} opts.provider — ticketing provider exposing
+ *   `getTicketComments(ticketId)`.
+ * @param {object} [opts.config] — resolved agentrc.
+ * @param {{owner: string, repo: string}} opts.currentRepo — repo the
+ *   listener is running inside; used for the cross-repo guard.
+ * @param {{owner: string, repo: string}} [opts.frameworkRepo] — where
+ *   framework-tagged findings route. Defaults to `currentRepo`.
+ * @param {string} [opts.gitRef='HEAD']
+ * @param {Function} [opts.classifier=classifyPathSource]
+ * @param {string} [opts.ghPath='gh']
+ * @param {Function} [opts.spawnImpl]
+ * @param {string} [opts.cwd]
+ * @param {{info?: Function, warn?: Function, debug?: Function}} [opts.logger]
+ * @returns {Promise<{
+ *   filed: Array<{ index: number, severity: string, lens: string, path: string, source: string, repo: string, url: string|null }>,
+ *   skipped: Array<{ index?: number, reason: string, path?: string, severity?: string, lens?: string }>,
+ *   errors: string[],
+ * }>}
+ */
+export async function graduateAuditResults(opts = {}) {
+  return graduate({
+    ...opts,
+    spec: {
+      fnName: 'graduateAuditResults',
+      isAutoFileEnabled,
+      commentMarker: '<!-- claude-managed: audit-results -->',
+      noCommentReason: 'no-audit-results-comment',
+      parseFindings,
+      buildIdempotencyMarker,
+      decorateRecord: (record, finding) => {
+        record.lens = finding.lens;
+        return record;
+      },
+      buildCrossRepoLog: ({ finding, routedRepo, source }) => {
+        const labels = [
+          'meta::audit-finding',
+          metaSourceLabel(source),
+          SEVERITY_LABEL[finding.severity],
+          `domain::${finding.lens}`,
+        ];
+        return `[audit-results-graduator] cross-repo skip (would file in ${routedRepo.owner}/${routedRepo.repo}): gh issue create --repo ${routedRepo.owner}/${routedRepo.repo} --title "Audit follow-up (${finding.lens}): ${finding.path}" --label "${labels.join(',')}"`;
+      },
+      buildFollowUp: ({ finding, source, epicId, idMarker }) => {
+        const title = `Audit follow-up (${finding.lens}): ${finding.path}`;
+        const body = [
+          idMarker,
+          '',
+          `Auto-filed from the Epic #${epicId} audit-results pass.`,
+          '',
+          `**Lens**: ${finding.lens}`,
+          `**Severity**: ${finding.severity}`,
+          `**Source**: ${source}`,
+          `**Path**: \`${finding.path}\``,
+          '',
+          '### Finding',
+          '',
+          finding.summary,
+          '',
+          `_See Epic #${epicId} for the full audit-results report._`,
+        ].join('\n');
+        const labels = [
+          'meta::audit-finding',
+          metaSourceLabel(source),
+          SEVERITY_LABEL[finding.severity],
+          `domain::${finding.lens}`,
+        ];
+        return { title, body, labels };
+      },
+    },
+  });
+}
+
+export default graduateAuditResults;