mandrel 2.60.0 → 2.62.0

package/.agents/scripts/lib/audit-advisories.js

@@ -1,195 +0,0 @@
-/**
- * audit-advisories.js — run `npm audit --json` and diff advisories across refs.
- *
- * The measuring half of `audit-attribution.js` next door. That module owns the
- * verdict vocabulary and how a verdict is worded; this one owns what a verdict
- * is computed FROM.
- *
- * The comparison is **per advisory**, not per exit code. Reading only "did the
- * base audit fail too" collapses the case a busy repository meets most: a base
- * that is already red for advisory A, and a diff that adds advisory B. That
- * answered `pre-existing` — a true statement about A, and a misleading one
- * about the branch, because the author was told their diff was innocent while
- * it was carrying B. Diffing advisory ids at or above `high` reports both facts
- * separately: B introduced, A pre-existing.
- *
- * The npm spawn is injectable (`.agents/rules/test-seams.md`), so the whole
- * projection is reachable without a registry round-trip.
- */
-
-import { spawnCapture } from './child-exec.js';
-
-/** The levels the required SCA step fails on, so the levels attribution reads. */
-const BLOCKING_SEVERITIES = new Set(['critical', 'high']);
-
-/**
- * The stable identity of one advisory in an `npm audit --json` report.
- *
- * `source` is the advisory's own numeric id and is what makes two runs
- * comparable; the URL and title are fallbacks for a registry that omits it. A
- * `via` entry that is a bare string names another package rather than an
- * advisory and is handled by the package-level fallback in
- * {@link extractBlockingAdvisories}.
- *
- * @param {object} via
- * @returns {string|null}
- */
-function advisoryIdOf(via) {
-  if (via?.source !== undefined && via.source !== null) {
-    return `advisory:${via.source}`;
-  }
-  if (typeof via?.url === 'string' && via.url.length > 0) return via.url;
-  if (typeof via?.title === 'string' && via.title.length > 0) {
-    return `title:${via.title}`;
-  }
-  return null;
-}
-
-/**
- * Project an `npm audit --json` report onto the set of advisories at or above
- * `high`, as `{ id, severity, title }` records sorted by id.
- *
- * A vulnerable package whose `via` list carries no advisory object at all — the
- * transitive case, where `via` is a list of package names — still contributes a
- * `package:<name>` entry. Dropping it would let a real blocking advisory go
- * uncounted, and an attribution that under-counts the head is one that reports
- * a genuine regression as `pre-existing`.
- *
- * @param {object|null} report — parsed `npm audit --json` output.
- * @returns {Array<{ id: string, severity: string, title: string }>}
- */
-export function extractBlockingAdvisories(report) {
-  const packages = report?.vulnerabilities;
-  if (!packages || typeof packages !== 'object') return [];
-  const found = new Map();
-  for (const [name, entry] of Object.entries(packages)) {
-    if (BLOCKING_SEVERITIES.has(String(entry?.severity ?? '').toLowerCase())) {
-      collectPackageAdvisories(name, entry, found);
-    }
-  }
-  return [...found.values()].sort((a, b) => a.id.localeCompare(b.id));
-}
-
-/**
- * Add one vulnerable package's blocking advisories to `found`, falling back to
- * a `package:<name>` entry when its `via` list names packages rather than
- * advisories.
- *
- * @param {string} name
- * @param {object} entry
- * @param {Map<string, object>} found
- */
-function collectPackageAdvisories(name, entry, found) {
-  const before = found.size;
-  for (const via of Array.isArray(entry?.via) ? entry.via : []) {
-    const severity = String(via?.severity ?? entry.severity).toLowerCase();
-    const id = BLOCKING_SEVERITIES.has(severity) ? advisoryIdOf(via) : null;
-    if (id && !found.has(id)) {
-      found.set(id, { id, severity, title: via?.title ?? name });
-    }
-  }
-  if (found.size === before) {
-    found.set(`package:${name}`, {
-      id: `package:${name}`,
-      severity: entry.severity,
-      title: name,
-    });
-  }
-}
-
-/**
- * Split the head's blocking advisories into the ones this diff **introduced**
- * (head minus base) and the ones the merge base already carried
- * (the intersection).
- *
- * A `null` base is the degraded read: nothing can be attributed, so neither
- * list is populated and the caller reports `unknown` rather than guessing.
- *
- * @param {{ head?: Array<object>, base?: Array<object>|null }} params
- * @returns {{ introduced: Array<object>, preExisting: Array<object> }}
- */
-export function diffAdvisories({ head = [], base = null }) {
-  if (!Array.isArray(base)) return { introduced: [], preExisting: [] };
-  const baseIds = new Set(base.map((a) => a.id));
-  return {
-    introduced: head.filter((a) => !baseIds.has(a.id)),
-    preExisting: head.filter((a) => baseIds.has(a.id)),
-  };
-}
-
-/**
- * Run `npm audit --json` over a dependency manifest pair and project it.
- *
- * `--package-lock-only` audits the committed lockfile without installing, so
- * the probe never touches the job's own `node_modules`: an attribution
- * mechanism that could disturb the tree it is reporting on would be a worse
- * defect than the one it explains. `--json` is what makes the two runs
- * comparable at all — the human report says which advisories exist, but only
- * as prose.
- *
- * @param {string} dir — directory holding package.json + package-lock.json.
- * @param {{ spawn?: Function }} [deps]
- * @returns {{ failed: boolean, advisories: Array<object> }}
- * @throws {Error} when npm could not evaluate the tree at all.
- */
-export function auditAdvisories(dir, { spawn = spawnCapture } = {}) {
-  const result = spawn(
-    'npm',
-    ['audit', '--json', '--audit-level=high', '--package-lock-only'],
-    { cwd: dir },
-  );
-  const report = parseAuditJson(result?.stdout);
-  // npm exits non-zero for "advisories found" and for "could not audit" alike.
-  // Only a real audit verdict carries a `vulnerabilities` map; anything else is
-  // a probe failure the caller must read as `unknown`.
-  if (!report) {
-    throw new Error(
-      `npm audit could not evaluate the tree: ${String(result?.stderr ?? '').slice(0, 200)}`,
-    );
-  }
-  const advisories = extractBlockingAdvisories(report);
-  return { failed: advisories.length > 0, advisories };
-}
-
-/**
- * Parse `npm audit --json` stdout, returning `null` for anything that is not a
- * real audit report. Never throws: a probe that crashed on its own output would
- * be the second failure mode this module exists to avoid.
- *
- * @param {unknown} stdout
- * @returns {object|null}
- */
-function parseAuditJson(stdout) {
-  try {
-    const parsed = JSON.parse(String(stdout ?? ''));
-    return parsed?.vulnerabilities ? parsed : null;
-  } catch (_) {
-    return null;
-  }
-}
-
-/**
- * Render the per-advisory detail lines that follow the verdict.
- *
- * Named lists, not counts: "3 introduced" sends the reader back to the raw
- * audit output, which is the trip attribution exists to save.
- *
- * @param {{ introduced?: Array<object>, preExisting?: Array<object> }} input
- * @returns {string[]}
- */
-export function renderAdvisoryDetail({ introduced = [], preExisting = [] }) {
-  const list = (advisories) =>
-    advisories.map((a) => `${a.id} (${a.severity})`).join(', ');
-  const lines = [];
-  if (introduced.length > 0) {
-    lines.push(
-      `Introduced by this diff (${introduced.length}): ${list(introduced)}.`,
-    );
-  }
-  if (preExisting.length > 0) {
-    lines.push(
-      `Already on the merge base (${preExisting.length}): ${list(preExisting)}. Those are not this branch's to fix.`,
-    );
-  }
-  return lines;
-}

package/.agents/scripts/lib/audit-attribution.js

@@ -1,134 +0,0 @@
-/**
- * audit-attribution.js — decide whose defect a red advisory check is.
- *
- * `npm audit` reports the advisories present in a dependency tree; it says
- * nothing about who introduced them. Advisories are published against
- * packages that are ALREADY installed, so `main` goes red between pull
- * requests without anybody's diff causing it, and the first PR opened
- * afterwards becomes the discovery mechanism — its author debugging a
- * supply-chain advisory from inside a failing log that has nothing to do
- * with their change.
- *
- * The nightly sweep (`.github/workflows/dependency-audit-cron.yml`) shrinks
- * how often that happens; it cannot make the failure legible when it does.
- * An advisory published after one night's sweep and before the next lands on
- * whoever opens a PR in between. This module supplies the missing sentence:
- * the same audit, evaluated against the pull request's merge base.
- *
- * It buys legibility, never permission — see `attributionExitCode`.
- *
- * The comparison is **per advisory**, not per exit code. Reading only "did the
- * base audit fail too" collapses the case a busy repository meets most: a base
- * that is already red for advisory A, and a diff that adds advisory B. That
- * answered `pre-existing` — a true statement about A, and a misleading one
- * about the branch, because the author was told their diff was innocent while
- * it was carrying B. Diffing advisory ids at or above `high` reports both
- * facts separately: B introduced, A pre-existing.
- */
-
-// The per-advisory machinery lives next door and is re-exported here, so this
-// module stays the one import an attribution consumer needs while the audit
-// runner, the projection and the diff keep their own file.
-export {
-  auditAdvisories,
-  diffAdvisories,
-  renderAdvisoryDetail,
-} from './audit-advisories.js';
-
-// The verdict vocabulary. Only `UNKNOWN` is exported: the CLI branches on it
-// to decide whether to audit the base at all, while the other two are read by
-// callers out of the rendered report rather than compared as symbols. Their
-// STRING values are the contract — they appear verbatim in the CI log — so
-// the tests assert those literals rather than re-importing the constants,
-// which would let a rename silently change what an operator reads.
-/** The pull request's own diff introduced the advisory. */
-const INTRODUCED = 'introduced-by-this-diff';
-/** The merge base carries it too; the diff is innocent. */
-const PRE_EXISTING = 'pre-existing';
-/** The probe could not reach a verdict. Never an accusation. */
-export const UNKNOWN = 'unknown';
-
-/**
- * Decide the verdict from the two audit outcomes.
- *
- * Pure — the caller owns running the audits. `baseAudit` is `null` when the
- * base could not be audited at all, which is the `unknown` path: an
- * attribution mechanism must never guess, because the guess it would make
- * (`introduced-by-this-diff`) is an accusation against the author reading it.
- *
- * `baseAudit.failed` is asked **per advisory** by the CLI: it passes
- * `{ failed: <the base already carries every advisory the head has> }`, so a
- * base that is red for its own advisory does not absolve a diff that added a
- * different one.
- *
- * @param {{ headFailed: boolean, baseAudit: { failed: boolean } | null }} input
- * @returns {string} one of INTRODUCED / PRE_EXISTING / UNKNOWN
- */
-export function deriveVerdict({ headFailed, baseAudit }) {
-  if (!headFailed) return UNKNOWN;
-  if (!baseAudit || typeof baseAudit.failed !== 'boolean') return UNKNOWN;
-  return baseAudit.failed ? PRE_EXISTING : INTRODUCED;
-}
-
-/**
- * The exit code a verdict earns.
- *
- * **Both real verdicts fail.** The advisory is genuine either way: a check
- * that passed on `pre-existing` would let advisories accumulate on `main`
- * unnoticed, which is the exact failure the nightly sweep exists to prevent.
- * Attribution changes what the log says, never whether the branch may land.
- *
- * `unknown` exits 0 — the probe degraded, and the required `npm audit` step
- * has already failed on its own account. A reporter that can turn a red into
- * a second, unrelated red is worse than no reporter.
- *
- * @param {string} verdict
- * @returns {number}
- */
-export function attributionExitCode(verdict) {
-  return verdict === UNKNOWN ? 0 : 1;
-}
-
-/**
- * Render the operator-facing report for a verdict.
- *
- * `trackingIssue` is the open `meta::dependency-advisory` issue number when
- * the nightly sweep has already filed one, or `null`. Naming it is the point
- * of the `pre-existing` branch: it turns "why is my unrelated PR red" into a
- * link to the issue that already owns the fix.
- *
- * @param {{ verdict: string, baseRef?: string, trackingIssue?: number|null, reason?: string|null }} input
- * @returns {string[]} lines, in emission order
- */
-export function renderAttribution({
-  verdict,
-  baseRef = null,
-  trackingIssue = null,
-  reason = null,
-}) {
-  const at = baseRef ? ` (merge base ${baseRef})` : '';
-  if (verdict === PRE_EXISTING) {
-    const lines = [
-      `::warning::Advisory attribution: PRE-EXISTING${at}. The same high-severity advisory is already present on the merge base, so this pull request's diff did not introduce it.`,
-      'This check still fails, and deliberately: the advisory is real, and letting it pass here would let advisories accumulate on `main` unnoticed.',
-      "Fix it as a standalone `fix(deps)` PR against `main` rather than spending this Story's scope on it. Check the `overrides` block in package.json first — a pinned floor one patch below the patched release is the usual cause.",
-    ];
-    if (trackingIssue != null) {
-      lines.splice(
-        1,
-        0,
-        `The nightly sweep already filed the tracking issue: #${trackingIssue}.`,
-      );
-    }
-    return lines;
-  }
-  if (verdict === INTRODUCED) {
-    return [
-      `::error::Advisory attribution: INTRODUCED BY THIS DIFF${at}. The merge base audits clean at the high-severity threshold, so a dependency change on this branch brought the advisory in.`,
-      "Read the advisory's own version range before accepting a fix: `npm audit fix --force` often proposes a needless semver-major when the parent package's declared range already admits a patched version.",
-    ];
-  }
-  return [
-    `::warning::Advisory attribution: UNKNOWN${at}${reason ? ` — ${reason}` : ''}. The audit result above stands on its own; this probe adds nothing to it.`,
-  ];
-}

package/.agents/scripts/lib/baselines/drift-detector.js

@@ -1,351 +0,0 @@
-// .agents/scripts/lib/baselines/drift-detector.js
-/**
- * drift-detector.js — full-scope baseline drift detection (Story #4776).
- *
- * Every enforcement site for the maintainability and CRAP baselines is
- * **diff-scoped**: close-validation, the pre-push hook and CI all compare
- * the files a branch touched against their committed rows. That is the
- * right per-PR trade — full-scope scoring on every push would be far too
- * expensive — but it has a structural blind spot. A file that is never
- * modified after its baseline row is written is never re-scored, so a
- * regression introduced *indirectly* (a dependency getting more complex, a
- * test deletion moving coverage underneath it) is invisible for as long as
- * nobody happens to touch that file.
- *
- * This module closes that hole with the check that is too expensive to run
- * per-PR and cheap enough to run on a schedule: re-score every target
- * directory in full, and report every row whose current score has moved
- * away from its baseline by more than the gate's tolerance — **in either
- * direction**. Drift, not regression: a row that silently improved is
- * equally strong evidence that the committed baseline no longer describes
- * the tree, and leaving it stale means the ratchet is anchored to a number
- * that no longer exists.
- *
- * Re-scoring routes through `refresh-service.resolveDefaultScorer` — the
- * same scorer that writes the baseline — so the detector cannot report two
- * implementations disagreeing with each other as drift in the tree.
- *
- * Pure-ish: the scorer and the baseline loader are both injectable, and the
- * module never writes anything, exits, or emits friction.
- *
- * The public surface is deliberately the three symbols the CLI actually
- * uses — `DRIFT_KINDS`, `detectBaselineDrift`, `formatDriftReport`. Every
- * internal helper below stays module-local and is exercised through them
- * (`detectBaselineDrift` forwards its `loadBaselineRows` / `scoreFullScope`
- * seams straight down). Exporting the helpers so tests could reach them
- * directly would ship five entry points nothing in production reaches —
- * exactly the orphaning this Story exists to stop.
- */
-
-import { getQuality } from '../config/quality.js';
-import { resolveConfig } from '../config-resolver.js';
-import { getKindModule } from './kernel.js';
-import { load as loadBaseline } from './reader.js';
-import { resolveDefaultScorer } from './refresh-service.js';
-
-/** The kinds whose rows carry a per-file/per-method score worth re-scoring. */
-export const DRIFT_KINDS = Object.freeze(['maintainability', 'crap']);
-
-/**
- * Per-kind identity, metric axis, and refresh remedy. `identity` must match
- * the granularity the kind's baseline rows are keyed at, or unchanged rows
- * masquerade as added/removed pairs.
- */
-const KIND_SPECS = Object.freeze({
-  maintainability: Object.freeze({
-    metric: 'mi',
-    identity: (row) => row.path,
-    label: (row) => row.path,
-    refreshCommand: 'npm run maintainability:update -- --full-scope',
-    defaultTolerance: 0.5,
-  }),
-  crap: Object.freeze({
-    metric: 'crap',
-    identity: (row) => `${row.path}::${row.method}@${row.startLine}`,
-    label: (row) => `${row.path}::${row.method} (line ${row.startLine})`,
-    refreshCommand: 'npm run crap:update -- --full-scope',
-    defaultTolerance: 0.001,
-  }),
-});
-
-/**
- * Resolve the absolute drift tolerance for a kind: an explicit override
- * wins, then the gate's configured `tolerance.value`, then the per-kind
- * default.
- *
- * @param {string} kind
- * @param {object|undefined} gate resolved `delivery.quality.gates.<kind>`
- * @param {number|null|undefined} override
- * @returns {number}
- */
-function resolveTolerance(kind, gate, override) {
-  if (typeof override === 'number' && Number.isFinite(override)) {
-    return Math.abs(override);
-  }
-  const configured = gate?.tolerance;
-  if (configured?.kind === 'absolute') {
-    const value = Number(configured.value);
-    if (Number.isFinite(value)) return Math.abs(value);
-  }
-  return KIND_SPECS[kind].defaultTolerance;
-}
-
-/**
- * Normalise a scorer's raw rows into the kind's canonical on-disk row
- * shape, so scored rows and baseline rows are directly comparable. The
- * per-kind `projectRow` is the same projection the writer applies, which is
- * what makes the two sides comparable at all (it also reconciles the CRAP
- * scorer's `file` key with the envelope's `path`).
- *
- * @param {string} kind
- * @param {Array<object>} rows
- * @returns {Array<object>}
- */
-function projectScoredRows(kind, rows) {
-  const mod = getKindModule(kind);
-  const out = [];
-  for (const row of rows ?? []) {
-    try {
-      out.push(mod.projectRow(row));
-    } catch {
-      // A row the writer itself would refuse is not evidence of drift.
-    }
-  }
-  return out;
-}
-
-/**
- * Diff two row sets by the kind's identity, classifying each key as
- * drifted / added / removed. Pure.
- *
- * @param {{ kind: string, baselineRows: Array<object>, currentRows: Array<object>, tolerance: number }} opts
- * @returns {{ drifted: Array<object>, added: Array<object>, removed: Array<object> }}
- */
-function diffRows({ kind, baselineRows, currentRows, tolerance }) {
-  const spec = KIND_SPECS[kind];
-  const baseByKey = new Map();
-  for (const row of baselineRows ?? []) baseByKey.set(spec.identity(row), row);
-
-  const drifted = [];
-  const added = [];
-  const seen = new Set();
-
-  for (const row of currentRows ?? []) {
-    const key = spec.identity(row);
-    seen.add(key);
-    const base = baseByKey.get(key);
-    if (!base) {
-      added.push({ key, label: spec.label(row), current: row[spec.metric] });
-      continue;
-    }
-    const before = Number(base[spec.metric] ?? 0);
-    const after = Number(row[spec.metric] ?? 0);
-    const delta = after - before;
-    if (Math.abs(delta) <= tolerance) continue;
-    drifted.push({
-      key,
-      label: spec.label(row),
-      baseline: before,
-      current: after,
-      delta,
-    });
-  }
-
-  const removed = [];
-  for (const [key, row] of baseByKey) {
-    if (seen.has(key)) continue;
-    removed.push({ key, label: spec.label(row), baseline: row[spec.metric] });
-  }
-
-  return { drifted, added, removed };
-}
-
-/**
- * Re-score one kind full-scope and diff the result against its committed
- * baseline.
- *
- * Returns `{ ok: true, skipped: '<reason>' }` when the kind cannot be
- * checked (gate disabled, no baseline on disk, no scorer registered, the
- * scorer produced nothing) — an unscorable kind is not drift, and a
- * scheduled job must not go red because coverage happened to be absent.
- *
- * @param {{
- *   kind: string,
- *   cwd?: string,
- *   quality?: object,
- *   tolerance?: number|null,
- *   loadBaselineRows?: (kind: string, cwd: string) => Array<object>|null,
- *   scoreFullScope?: (kind: string, cwd: string) => Promise<Array<object>|null>|Array<object>|null,
- * }} opts
- * @returns {Promise<object>}
- */
-async function detectKindDrift({
-  kind,
-  cwd = process.cwd(),
-  quality,
-  tolerance = null,
-  loadBaselineRows = defaultLoadBaselineRows,
-  scoreFullScope = defaultScoreFullScope,
-}) {
-  if (!Object.hasOwn(KIND_SPECS, kind)) {
-    throw new Error(
-      `[drift] unknown kind "${kind}"; expected one of ${DRIFT_KINDS.join(', ')}`,
-    );
-  }
-  const gate = quality?.[kind];
-  const spec = KIND_SPECS[kind];
-  const base = { kind, refreshCommand: spec.refreshCommand };
-  if (gate?.enabled === false) {
-    return { ...base, ok: true, skipped: 'gate-disabled' };
-  }
-
-  const baselineRows = loadBaselineRows(kind, cwd);
-  if (!Array.isArray(baselineRows) || baselineRows.length === 0) {
-    return { ...base, ok: true, skipped: 'no-baseline' };
-  }
-
-  const raw = await scoreFullScope(kind, cwd);
-  if (raw === null || raw === undefined) {
-    return { ...base, ok: true, skipped: 'no-scorer' };
-  }
-  const currentRows = projectScoredRows(kind, raw);
-  if (currentRows.length === 0) {
-    return { ...base, ok: true, skipped: 'no-scored-rows' };
-  }
-
-  const resolvedTolerance = resolveTolerance(kind, gate, tolerance);
-  const { drifted, added, removed } = diffRows({
-    kind,
-    baselineRows,
-    currentRows,
-    tolerance: resolvedTolerance,
-  });
-
-  return {
-    ...base,
-    ok: drifted.length === 0,
-    tolerance: resolvedTolerance,
-    scanned: currentRows.length,
-    baselineRows: baselineRows.length,
-    drifted,
-    added,
-    removed,
-  };
-}
-
-/**
- * Run the drift check across several kinds.
- *
- * @param {{ kinds?: string[], cwd?: string, tolerance?: number|null, quality?: object }} opts
- * @returns {Promise<{ ok: boolean, results: Array<object> }>}
- */
-export async function detectBaselineDrift({
-  kinds = DRIFT_KINDS,
-  cwd = process.cwd(),
-  tolerance = null,
-  quality,
-  ...seams
-} = {}) {
-  let resolvedQuality = quality;
-  if (!resolvedQuality) {
-    try {
-      resolvedQuality = getQuality(resolveConfig({ cwd })) ?? {};
-    } catch {
-      resolvedQuality = {};
-    }
-  }
-  const results = [];
-  for (const kind of kinds) {
-    results.push(
-      await detectKindDrift({
-        kind,
-        cwd,
-        tolerance,
-        quality: resolvedQuality,
-        ...seams,
-      }),
-    );
-  }
-  return { ok: results.every((r) => r.ok), results };
-}
-
-/**
- * Default baseline loader — reads and schema-validates the committed
- * envelope. Returns `null` when it cannot be read, which the caller maps to
- * the `no-baseline` skip.
- */
-function defaultLoadBaselineRows(kind, cwd) {
-  try {
-    return loadBaseline(kind, { cwd }).rows;
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Default full-scope scorer — the same scorer `refreshBaseline` uses, run
- * with `fullScope: true` so it walks every configured target directory
- * rather than a diff-derived file list.
- */
-async function defaultScoreFullScope(kind, cwd) {
-  const scorer = resolveDefaultScorer(kind, { cwd });
-  if (typeof scorer !== 'function') return null;
-  return await scorer(null, { fullScope: true, cwd });
-}
-
-/**
- * Render one kind's result as an operator-facing block: a per-row
- * before/after table plus the refresh remedy. Returns a string always —
- * a clean kind reports one line so a scheduled job's log shows it ran.
- *
- * @param {object} result
- * @returns {string}
- */
-function formatKindDrift(result) {
-  if (result.skipped) {
-    return `[drift] ⏭ ${result.kind}: skipped (${result.skipped})`;
-  }
-  if (result.ok) {
-    return `[drift] ✓ ${result.kind}: ${result.scanned} row(s) re-scored full-scope, no drift beyond ±${result.tolerance}`;
-  }
-  const width = Math.max(
-    12,
-    ...result.drifted.map((d) => String(d.label).length),
-  );
-  const lines = [
-    `[drift] ✖ ${result.kind}: ${result.drifted.length} row(s) drifted beyond ±${result.tolerance} (${result.scanned} re-scored, ${result.baselineRows} in baseline)`,
-    `  ${'ROW'.padEnd(width)}  ${'BASELINE'.padStart(10)}  ${'CURRENT'.padStart(10)}  ${'DELTA'.padStart(10)}`,
-  ];
-  for (const d of result.drifted) {
-    lines.push(
-      `  ${String(d.label).padEnd(width)}  ${d.baseline.toFixed(2).padStart(10)}  ${d.current
-        .toFixed(2)
-        .padStart(
-          10,
-        )}  ${(d.delta > 0 ? `+${d.delta.toFixed(2)}` : d.delta.toFixed(2)).padStart(10)}`,
-    );
-  }
-  if (result.added.length > 0 || result.removed.length > 0) {
-    lines.push(
-      `  (${result.added.length} row(s) absent from baseline, ${result.removed.length} baseline row(s) absent from the tree)`,
-    );
-  }
-  lines.push(
-    `  Remedy: run \`${result.refreshCommand}\` and commit the refreshed baseline with a \`baseline-refresh:\` tagged subject (non-empty body).`,
-  );
-  return lines.join('\n');
-}
-
-/**
- * Render the whole run.
- *
- * @param {{ ok: boolean, results: Array<object> }} run
- * @returns {string}
- */
-export function formatDriftReport(run) {
-  const body = run.results.map(formatKindDrift).join('\n');
-  const tail = run.ok
-    ? '[drift] ✅ No baseline drift detected.'
-    : '[drift] ❌ Baseline drift detected — the committed baselines no longer describe the tree.';
-  return `${body}\n${tail}`;
-}