mandrel 2.4.0 → 2.5.0

package/.agents/workflows/audit-to-stories.md

@@ -210,10 +210,37 @@ workflow owns **no** parallel dedup or footer-parsing code: the
 fingerprint, footer round-trip, and routing all live in that one shared
 module.
 
+Dedup runs in **two stages** when a provider resolves (Story #4626): a
+meaning-first **semantic candidate** pass (`searchCandidates`, wired to
+[`lib/findings/semantic-issue-search.js`](../scripts/lib/findings/semantic-issue-search.js))
+runs FIRST and widens the net across open + closed issues; the exact
+**fingerprint / semantic-key** confirmation runs SECOND. A finding whose title
+was reworded but whose *location* is unchanged still confirms against the Issue
+that already tracks that location, because the audit filers stamp a
+location-based `audit-semantic-keys` footer alongside the `audit-fingerprints`
+footer. Close-time filings from the
+[`audit-results-graduator`](../scripts/lib/feedback-loop/audit-results-graduator.js)
+carry the same canonical `audit-fingerprints` footer, so a sweep recognizes a
+graduator-filed issue and never re-files it.
+
 When no provider is available (e.g. air-gapped dev environment), pass
 `--no-provider` to the `--scan` step — every group is classified
 `create` and the operator is informed that dedupe was skipped.
 
+### Cross-run ledger
+
+The `--scan` classifications only see *live* issues. To decay findings across
+runs — recognizing re-detections, suppressing deliberately-rejected findings,
+and flagging genuine regressions — the sweep folds each scan onto a committed
+**ledger** (`baselines/audit-ledger.json`, the arch-cycles-baseline envelope
+shape). Each entry is keyed by the finding's fingerprint plus a location-based
+`semanticKey` and carries a lifecycle `status`
+(`new | filed | fixed | accepted-risk | regressed`). A finding whose tracking
+Issue was closed as `not_planned` becomes `accepted-risk` and is **suppressed**
+on every later scan; a `fixed` finding that re-appears becomes `regressed`. The
+ledger is written by the unattended `--auto` sweep and by any `--scan --ledger`
+run; the plain `--scan` path leaves it untouched.
+
 ## Phase 7 — Summary & cleanup
 
 Persist `temp/audits/audit-to-stories-$(date +%Y%m%dT%H%M%S).md`
@@ -253,11 +280,23 @@ When the single-plan path ran, link the Story (or plan-run) the chained
 To run an unattended maintenance sweep, `/schedule` a nightly (or weekly)
 job that (1) runs the relevant `audit-*` lens workflows full-scope — no
 `--paths`, no change-set filter, so the whole target-set union is audited —
-writing their `temp/audits/audit-*-results.md` reports, then (2) invokes
-`/audit-to-stories` over those results to dedupe and route the findings.
-The host scheduler owns the cadence; this workflow owns the routing. (This
-paragraph folds in the `loops/nightly-audit.md` starter unit retired in
-issue 4482.)
+writing their `temp/audits/audit-*-results.md` reports, then (2) invokes the
+CLI's **`--auto` mode** over those results:
+
+```bash
+node .agents/scripts/audit-to-stories.js --auto [--dry-run] \
+  [--glob "temp/audits/audit-*-results.md"] [--severity <floor>]
+```
+
+`--auto` runs with **no interactive gates**: it resolves the severity floor
+from `delivery.auditToStories.severityFloor` (default `high`, overridable with
+`--severity`), applies the two-stage dedup, reconciles the cross-run ledger,
+and prints a run-summary JSON (create / skip-open / skip-reoccurring /
+suppressed-by-ledger tallies, plus the re-detected open Issue numbers an
+operator may want a "re-detected" comment on). `--dry-run` performs zero GitHub
+writes and skips the ledger write, emitting only the summary. The host
+scheduler owns the cadence; this workflow owns the routing. (This paragraph
+folds in the `loops/nightly-audit.md` starter unit retired in issue 4482.)
 
 ## See also
 

package/.agents/workflows/audit-ux-ui.md

@@ -42,21 +42,54 @@ before this section existed.
   proceed with the full codebase-wide scan defined in the remaining
   steps.
 
-## Step 1: Visual Consistency Check
+## Step 0: Discover the design-system SSOT (run first)
+
+**You cannot audit "adherence to the design system" until you have located the
+design system.** There is no universal baseline — a hardcoded `#3b82f6` is a
+defect only when the project defines that colour as a token. Before any
+detection, locate the consumer's design-system sources of truth and read what
+they define:
+
+- **Design tokens / theme:** a `tailwind.config.{js,ts}`, CSS custom properties
+  (`:root { --color-*, --space-* }`), a `theme/`, `tokens/`, or `design-system/`
+  directory, or a `styled-system` / CSS-in-JS theme object.
+- **Component library:** the shared component directory (`components/ui/**`,
+  a published design-system package) that raw elements are expected to defer to.
+- **Documented conventions:** `docs/style-guide.md` (and `docs/web-routes.md`
+  when routing copy is in scope) — the human-authored rules the mechanical
+  detectors below cannot infer.
+
+Record the token names, the component roster, and the style-guide rules. Every
+finding downstream is measured against *this discovered baseline*, not a generic
+ideal. If **no** design-system SSOT exists, say so and downgrade findings to
+"no baseline defined — recommend establishing tokens/components first".
+
+## Step 1: Mechanical detector battery, then LLM triage
 
 > Apply [`helpers/parallel-tooling.md`](helpers/parallel-tooling.md) when batching the scan below — independent reads belong in one turn, long shells run via `run_in_background` + `Monitor`.
 
-Scan frontend components for:
-
-- **Hardcoded Values:** Identify "magic" hex codes, font sizes, or spacing
-  values that bypass the CSS variables/design tokens.
-- **Component Re-implementation:** Find places where custom HTML/CSS is used
-  instead of the standard component library (e.g., custom button instead of
-  `<Button />`).
-- **Interactive States:** Verify that all clickable elements have hover, focus,
-  and active states.
-- **Typography:** Ensure font families and weights are used consistently
-  according to the hierarchy.
+Run the **mechanical detectors first** (cheap, deterministic greps that surface
+candidates), then apply **LLM triage** to each candidate against the Step 0
+baseline — a mechanical hit is a *candidate*, not automatically a finding.
+
+- **Hardcoded Values:** grep for raw `#hex` / `rgb()` colour literals and raw
+  `px` font-size / spacing literals **outside** the token/theme files. Each hit
+  is a candidate bypass of a defined token.
+- **Component Re-implementation:** census raw HTML elements (`<button>`,
+  `<input>`, `<select>`, `<a>` styled as a button) versus the design-system
+  component that should replace them; a high raw-vs-component ratio is the
+  signal.
+- **Inline-style census:** count inline `style=` / `style={{…}}` usages that
+  encode spacing, colour, or typography a token should own.
+- **Interactive States:** scan for `:hover` (or `hover:` utilities) without a
+  matching `:focus-visible` / `focus-visible:` — a hover state with no keyboard
+  focus state is a candidate accessibility-of-interaction gap.
+- **Typography:** flag font families / weights used outside the type scale.
+
+> **Detector output is candidates.** Triage each with the discovered baseline
+> before promoting it to a finding — a `px` value inside a token definition file,
+> or a raw `<button>` inside the design-system's own `Button` implementation, is
+> expected, not a defect.
 
 ## Step 2: UX Best Practices
 
@@ -66,14 +99,23 @@ Scan frontend components for:
    frustrating?
 3. **Loading States:** Are there skeletons or spinners for async operations?
 4. **Responsiveness:** Check layouts at mobile, tablet, and desktop breakpoints.
-5. **Accessibility (UX-focused):** Focus on tab order, touch target sizes, and
-   color contrast.
+5. **Accessibility (UX-focused):** Focus on tab order, touch-target sizes, and
+   whether interaction colours come from a sanctioned token. **WCAG conformance
+   is out of scope here** — semantic structure, ARIA correctness,
+   keyboard/focus operability, form labelling, media alternatives, and the WCAG
+   contrast-ratio verdict are owned by [`/audit-accessibility`](audit-accessibility.md).
+   This lens keeps token/component design-system adherence; defer every WCAG
+   success-criterion judgement to the accessibility lens so the two never
+   double-report.
 
 ## Step 3: Output Requirements
 
 Generate and save a highly structured Markdown audit report to
 `{{auditOutputDir}}/audit-ux-ui-results.md`, using the exact template below.
 
+> Grade every finding's severity on the shared
+> [`Critical | High | Medium | Low` scale](helpers/audit-severity-scale.md).
+
 ```markdown
 # UX/UI & Design System Audit report
 
@@ -85,15 +127,17 @@ tokens/components.]
 ## Detailed Findings
 
 [For every inconsistency or UX improvement identified, use the following strict
-structure:]
+structure. Lead each title with the primary file the finding lives in:]
 
-### [Short Title of the Issue]
+### `path/to/primary-file.ext` — [Short title of the issue]
 
 - **Dimension:** [e.g., Visual Consistency | UX Best Practices | Accessibility]
-- **Impact:** [High | Medium | Low]
+- **Impact:** [Critical | High | Medium | Low]
+- **Location:** `path/to/primary-file.ext:line`
 - **Current State:** [What is currently implemented and why it is sub-optimal]
 - **Recommendation & Rationale:** [The specific UI/UX change and how it improves
   premium feel or usability]
+- **Acceptance signal:** [the command or observable that proves this finding is remediated — e.g. the token now applied in the rendered component, or a re-run of this lens]
 - **Agent Prompt:**
   `[A copy-pasteable, highly specific prompt to execute this UI change independently]`
 
@@ -107,3 +151,13 @@ structure:]
 
 This is a **read-only** audit. Provide the critique and implementation
 suggestions, but do not modify styles or components.
+
+## Self-cross-check (mandatory — filter false positives before you finalize)
+
+Before you write the report artifact from the previous step, run the shared
+adversarial self-cross-check over your Detailed Findings — see
+[`helpers/audit-self-check.md`](helpers/audit-self-check.md). It defines the
+per-finding evidence bar, the exclusion list, and the final re-open-and-drop
+pass whose `kept <k> / dropped <d>` counts you record in the Executive
+Summary, so the sequential single-pass path filters unverified findings just as
+the orchestrated path's adversarial reviewer does.

package/.agents/workflows/helpers/audit-dual-path.md

@@ -0,0 +1,59 @@
+# Audit lens execution strategy (dual-path)
+
+> **Single source for the dual-path preamble (Story #4625).** Every lens whose
+> `## Execution strategy (dual-path)` section points here shares this exact
+> contract. Read `audit-<lens>` and
+> `.claude/workflows/audit-<lens>.workflow.js` below as this lens's own name.
+
+A lens that references this helper runs along one of two execution paths. Both
+emit the **identical** report contract (the lens's Output Requirements step);
+downstream consumers (`audit-to-stories`) are agnostic to which path produced
+it.
+
+- **Orchestrated (dynamic-workflow) path.** When Claude Code's
+  [dynamic workflows](https://code.claude.com/docs/en/workflows) are
+  available, the saved project workflow
+  `.claude/workflows/audit-<lens>.workflow.js` fans the lens's dimensions out
+  as parallel read-only subagents, runs an **adversarial cross-check** stage
+  (an independent agent reviews each dimension's findings and drops false
+  positives before they enter the report), then synthesises the report. The
+  orchestrator derives its per-dimension prompts from the *lens* markdown at
+  run time — the lens stays the single source of truth; the script does not
+  fork a second copy of the spec.
+- **Sequential (single-pass) path.** When dynamic workflows are unavailable,
+  follow the lens's Steps turn-by-turn exactly as before. This is the default
+  fallback and changes nothing about the existing behaviour.
+
+**Strategy selection** is computed by
+[`lib/dynamic-workflow/capability.js`](../../scripts/lib/dynamic-workflow/capability.js)
+(`selectAuditStrategy`). The orchestrated path is chosen only when the runtime
+is Claude Code, `disableWorkflows` is not set (settings.json **or**
+`CLAUDE_CODE_DISABLE_WORKFLOWS`), and the Claude Code version meets the
+research-preview floor (`>= 2.1.154`). Any other runtime, a disabled setting,
+or an older version degrades gracefully to the sequential path.
+
+> **Capability degradation, not a contract shim.** This dual path is **not**
+> covered by the No-Shim / hard-cutover rule in
+> [`git-conventions.md`](../../rules/git-conventions.md). That rule forbids
+> running two shapes of the *same contract* side by side. Here there is **one**
+> report contract; only the *execution strategy* is selected from a runtime
+> capability — the same pattern the protocol already endorses for live-docs
+> fallback in [`instructions.md` §1.C/§1.D](../../instructions.md). The full
+> capability-degradation rationale lives in the
+> [`capability.js`](../../scripts/lib/dynamic-workflow/capability.js) module
+> docstring; the orchestrated-run evidence and per-lens cost/precision gate
+> verdicts live in [`docs/roadmap.md`](../../../docs/roadmap.md) (Part 3 —
+> Dynamic-Workflow Orchestration).
+
+**Forcing a path (for testing).** Set `MANDREL_AUDIT_STRATEGY=sequential` to
+verify the fallback path with the feature notionally disabled, or
+`MANDREL_AUDIT_STRATEGY=orchestrated` to pin the dynamic path. To exercise the
+real disable signals instead, set `CLAUDE_CODE_DISABLE_WORKFLOWS=1` (env) or
+`disableWorkflows: true` in `.claude/settings.json` and re-run the lens — both
+degrade to the sequential path.
+
+> **Read-only on both paths.** The lens is read-only (see its Constraint). The
+> orchestrated subagents run in `acceptEdits` and inherit the session tool
+> allowlist, but the workflow script grants the analysis agents only
+> read/search tools (`Read`, `Grep`, `Glob`) — no write/edit/shell-mutation
+> tools. The single write in an orchestrated run is the final report artifact.

package/.agents/workflows/helpers/audit-self-check.md

@@ -0,0 +1,70 @@
+# Audit finding self-cross-check (shared)
+
+> **Single source of truth for the sequential-path false-positive guard
+> (Story #4627).** Every non-retired audit lens references this file and runs
+> this pass over its Detailed Findings before finalizing its report. The
+> orchestrated dynamic-workflow path already fans out an independent
+> adversarial reviewer; this pass gives the **sequential single-pass** path —
+> the one consumer runs take, where the npm payload ships no per-lens
+> `*.workflow.js` — the same false-positive filter, so a lens cannot report an
+> unverified finding just because it ran single-pass.
+
+You are your own adversarial reviewer. After you have drafted the Detailed
+Findings but **before** you write the report artifact, re-open every finding
+and hold it to the bar below. This pass is **read-only** — it filters and
+tightens the findings you already have; it never invents new ones.
+
+## Per-finding evidence bar (keep or drop)
+
+Keep a finding only when **all** of the following hold. Drop it otherwise.
+
+- **Grounded location** — it names a concrete `path:line` (or a concrete
+  symbol / config key) that you have actually read, not a hypothetical or a
+  "somewhere in the codebase" claim.
+- **Reproducible evidence** — the problem is backed by an observable: a tool
+  reading (a baseline row, a complexity/MI/duplication number, a failing
+  command), a quoted code snippet, or a specific standard it violates. A
+  finding whose entire basis is "this looks wrong" does not clear the bar.
+- **In-scope** — when a change-set scope filter was supplied (the `Scope`
+  block resolved to a file list), the finding lives in that scope or a direct
+  dependency the lens explicitly reasons across. A finding outside the scope
+  filter is dropped, not reported.
+- **Actionable** — the recommendation is specific enough to execute. Drop
+  vague exhortations ("improve error handling generally") that carry no
+  concrete change.
+
+## Exclusion list (never a finding)
+
+Treat the following as **out of scope by construction** and drop any finding
+that rests on one of them:
+
+- **Sanctioned test seams** — exports consumed only by tests, and other
+  patterns the `test-seams` rule blesses. Never a production defect.
+- **Entry points & public API surface** — CLI mains, `bin/` scripts, declared
+  `exports` / `bin` / `main`, and barrel contracts consumed out-of-tree. A
+  zero in-repo consumer count is not death.
+- **Dynamic / framework reachability** — symbols reached via `import()`,
+  string-keyed dispatch, decorators, lifecycle listeners, or convention-loaded
+  plugin directories. Invisible to static analysis, not dead.
+- **Intentional, documented deviations** — a pattern an in-tree comment, ADR,
+  or config explicitly sanctions. Cite it and drop the finding.
+- **Style-only nits already enforced by a formatter/linter** — do not
+  re-litigate what the committed tooling already governs.
+
+## Final re-open-and-drop pass (mandatory)
+
+1. Walk your Detailed Findings once more, applying the bar and the exclusion
+   list above. Remove every finding that fails.
+2. Count what you kept (`k`) and what you dropped (`d`).
+3. Record the outcome in the report's **Executive Summary** as a single line:
+
+   ```text
+   Self-cross-check: kept <k> / dropped <d>.
+   ```
+
+   When `d > 0`, name the dropped findings (title + the bar/exclusion reason)
+   in one short list under that line, so the filtering is auditable and never
+   silent.
+
+A lens that keeps every finding still records `dropped 0` — the line's absence
+is itself a defect (it means the pass did not run).

package/.agents/workflows/helpers/audit-severity-scale.md

@@ -0,0 +1,19 @@
+# Audit finding severity scale (shared)
+
+> **Single source of truth for the `Severity` axis (Story #4625).** Every audit
+> lens report references this file so the four levels — and the parser that
+> ranks them — never drift per lens.
+
+Every finding grades its severity (labelled `Severity` or `Impact` on a given
+lens) on this ordered scale. `parse-audit-md.js` recognizes every level, and a
+surviving **Critical** finding halts the delivery gate
+(`lib/audit-suite/findings.js#hasSurvivingCritical`).
+
+- **Critical** — an active, exploitable, or data-losing defect that must be
+  fixed before the change can ship (e.g. a leaked secret, an auth bypass, a
+  guaranteed production outage or data-loss path).
+- **High** — a serious correctness, security, or maintainability risk that
+  should be fixed promptly, but does not by itself block the release.
+- **Medium** — a real problem worth scheduling; contained blast radius, or a
+  reasonable workaround exists.
+- **Low** — minor or cosmetic; fix opportunistically.

package/.agents/workflows/helpers/deliver-story.md

@@ -132,6 +132,31 @@ Operator/agent responsibilities while in the worktree:
    read it before you write and self-check as you author. When absent,
    lens-aware coverage still runs maker-blind at Story-scope review inside
    the close subprocess.
+
+   **Producing `checklistPath` at dispatch (Story #4627).** The dispatch that
+   spawns this worker threads `checklistPath` the same way it threads
+   `docsDigestPath`. Before the spawn, compute the payload from the Story's
+   predicted footprint (its `changes[]` / `references[]` path entries) with
+   `buildDispatchChecklist` and write it to the run temp dir:
+
+   ```bash
+   node --input-type=module -e '
+     import { buildDispatchChecklist } from "<main-repo>/.agents/scripts/lib/audit-suite/index.js";
+     import { parse } from "<main-repo>/.agents/scripts/lib/story-body/story-body.js";
+     // storyBody is the fetched Story issue body.
+     const { changes, references } = parse(process.env.STORY_BODY);
+     const { checklistPath } = buildDispatchChecklist({
+       storyId: <storyId>, changes, references, runTempDir: "temp/run-<id>",
+     });
+     console.log(checklistPath ?? "");
+   '
+   ```
+
+   A non-empty `checklistPath` is threaded into this worker's prompt; an empty
+   footprint match prints nothing and the worker runs with no write-time
+   checklist (the maker-blind close-scope pass still covers it). The builder is
+   a pure function of the footprint and the on-disk checklists —
+   `buildDispatchChecklist` (`lib/audit-suite/dispatch-checklist.js`).
 2. Implement the changes. When the body has a `## Slicing` / Delivery
    Slicing table, walk rows as **intra-session checkpoints** (commit +
    flip each row when done) — never as sibling tickets.

package/docs/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to this project will be documented in this file.
 
+## [2.5.0](https://github.com/dsj1984/mandrel/compare/mandrel-v2.4.0...mandrel-v2.5.0) (2026-07-19)
+
+
+### Added
+
+* audit findings contract: parse-visible templates, unified severity, deterministic identity, CI conformance gate ([#4625](https://github.com/dsj1984/mandrel/issues/4625)) ([#4635](https://github.com/dsj1984/mandrel/issues/4635)) ([63a4f63](https://github.com/dsj1984/mandrel/commit/63a4f639a5626467c5eb6bbb5ef1944fa431782d))
+* **audit:** activate dormant shift-left tiers — lens delivery, checklist dispatch, self-check guard (refs [#4627](https://github.com/dsj1984/mandrel/issues/4627)) ([#4639](https://github.com/dsj1984/mandrel/issues/4639)) ([3d3b1ee](https://github.com/dsj1984/mandrel/commit/3d3b1ee1493117d11f1e1d000239fbc823c8ac64))
+* **audit:** add audit-data-model lens with persistence-layer applicability probe (refs [#4633](https://github.com/dsj1984/mandrel/issues/4633)) ([#4644](https://github.com/dsj1984/mandrel/issues/4644)) ([c584293](https://github.com/dsj1984/mandrel/commit/c58429323b4cdde8d6aaf2358d71963c85bb7a0a))
+* **audit:** implement advertised dependency checks, reachability-triaged vulns, and supply-chain scoped mode (refs [#4632](https://github.com/dsj1984/mandrel/issues/4632)) ([#4643](https://github.com/dsj1984/mandrel/issues/4643)) ([47f18f6](https://github.com/dsj1984/mandrel/commit/47f18f68fca3c86904ebf77b2558522f21e6b4d2))
+* **audit:** replace audit-lighthouse with WCAG audit-accessibility lens (refs [#4634](https://github.com/dsj1984/mandrel/issues/4634)) ([#4645](https://github.com/dsj1984/mandrel/issues/4645)) ([800c69e](https://github.com/dsj1984/mandrel/commit/800c69e96701f321619febe12a4b2f9f30fd35d7))
+* **audit:** rework audit-performance — measure-first, repo profiling, concurrency dimension (refs [#4631](https://github.com/dsj1984/mandrel/issues/4631)) ([#4642](https://github.com/dsj1984/mandrel/issues/4642)) ([ed5fd9a](https://github.com/dsj1984/mandrel/commit/ed5fd9a39b9fc4b9442484822e17553380ddccc8))
+* **audit:** tool-first detection for ops/security lenses + SRE rewrite (refs [#4629](https://github.com/dsj1984/mandrel/issues/4629)) ([#4640](https://github.com/dsj1984/mandrel/issues/4640)) ([13d0439](https://github.com/dsj1984/mandrel/commit/13d0439b0a6adb6235cf305a16ee5abce61c919d))
+* **audit:** tool-first detection for the code-quality lenses (refs [#4628](https://github.com/dsj1984/mandrel/issues/4628)) ([#4637](https://github.com/dsj1984/mandrel/issues/4637)) ([858f793](https://github.com/dsj1984/mandrel/commit/858f793f4d24a6b6059dc97da2067337a6937713))
+* **audit:** tool-first detection for the seo, ux-ui, and navigability web lenses (refs [#4630](https://github.com/dsj1984/mandrel/issues/4630)) ([#4641](https://github.com/dsj1984/mandrel/issues/4641)) ([3885d22](https://github.com/dsj1984/mandrel/commit/3885d227087311de3a28bdaa4e882c69915b0a00))
+* cross-run audit findings ledger, dedup repair, and unattended /audit-to-stories ([#4626](https://github.com/dsj1984/mandrel/issues/4626)) ([#4638](https://github.com/dsj1984/mandrel/issues/4638)) ([d8ecc2d](https://github.com/dsj1984/mandrel/commit/d8ecc2dbc23840f9ca071ce858c93a65506dfc14))
+
 ## [2.4.0](https://github.com/dsj1984/mandrel/compare/mandrel-v2.3.0...mandrel-v2.4.0) (2026-07-17)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mandrel",
-  "version": "2.4.0",
+  "version": "2.5.0",
   "description": "Claude Code-first opinionated workflow framework: instructions, skills, rules, and SDLC workflows that govern AI coding assistants.",
   "files": [
     ".agents/",

package/.agents/audit-checklists/lighthouse.md

@@ -1,15 +0,0 @@
-<!-- GENERATED FILE — do not edit by hand.
-     Source of truth: .agents/workflows/audit-lighthouse.md
-     Regenerate: node .agents/scripts/generate-lens-checklists.js
-     Drift is gated by: npm run docs:check
--->
-
-# Lighthouse Audit & Analysis — authoring checklist
-
-> Run a Lighthouse audit (Performance / Accessibility / Best Practices / SEO) and produce a structured findings report
-
-Self-check your change against this lens's concerns before you ship:
-
-- [ ] Opportunities
-- [ ] Diagnostics
-- [ ] Failed audits

package/.agents/schemas/audit-results.schema.json

@@ -1,69 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "title": "AuditResults",
-  "description": "Standardized output format for the audit orchestration suite",
-  "type": "object",
-  "required": ["summary", "results"],
-  "additionalProperties": false,
-  "properties": {
-    "summary": {
-      "type": "object",
-      "required": [
-        "auditsRun",
-        "totalFindings",
-        "critical",
-        "high",
-        "medium",
-        "low"
-      ],
-      "additionalProperties": false,
-      "properties": {
-        "auditsRun": {
-          "type": "array",
-          "items": { "type": "string" }
-        },
-        "totalFindings": { "type": "integer", "minimum": 0 },
-        "critical": { "type": "integer", "minimum": 0 },
-        "high": { "type": "integer", "minimum": 0 },
-        "medium": { "type": "integer", "minimum": 0 },
-        "low": { "type": "integer", "minimum": 0 }
-      }
-    },
-    "results": {
-      "type": "array",
-      "items": {
-        "type": "object",
-        "required": [
-          "auditId",
-          "checkId",
-          "severity",
-          "message",
-          "location",
-          "recommendation"
-        ],
-        "additionalProperties": false,
-        "properties": {
-          "auditId": { "type": "string" },
-          "checkId": { "type": "string" },
-          "fixId": { "type": "string" },
-          "severity": {
-            "type": "string",
-            "enum": ["Critical", "High", "Medium", "Low", "Info"]
-          },
-          "message": { "type": "string" },
-          "location": {
-            "type": "object",
-            "required": ["file"],
-            "additionalProperties": false,
-            "properties": {
-              "file": { "type": "string" },
-              "line": { "type": "integer" },
-              "column": { "type": "integer" }
-            }
-          },
-          "recommendation": { "type": "string" }
-        }
-      }
-    }
-  }
-}