mason-context 0.18.0 → 0.19.1

package/dist/mason-audit.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+if (!import.meta.url.endsWith("/mason-runtime.js")) await import("./mason-runtime.js").then(m => m.registerRuntime());
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __esm = (fn, res) => function __init() {
@@ -84,6 +85,26 @@ var init_paths = __esm({
   }
 });
 
+// src/audit/types.ts
+var types_exports = {};
+__export(types_exports, {
+  ALL_CHECKS: () => ALL_CHECKS
+});
+var ALL_CHECKS;
+var init_types = __esm({
+  "src/audit/types.ts"() {
+    "use strict";
+    ALL_CHECKS = [
+      "deleted-reference",
+      "new-module",
+      "stale-count",
+      "dead-command",
+      "deps-changed",
+      "decision-anchor-drift"
+    ];
+  }
+});
+
 // src/utils/files.ts
 import fs from "fs/promises";
 import { constants } from "fs";
@@ -123,6 +144,27 @@ async function loadProjectConfig(root) {
       }
       config[key] = value[key];
     }
+    if (value.audit !== void 0) {
+      const audit = value.audit;
+      if (!audit || typeof audit !== "object" || Array.isArray(audit)) throw new Error("Configuration audit must be an object");
+      const patterns = (raw2) => {
+        if (!Array.isArray(raw2) || raw2.length > 100 || !raw2.every((s) => typeof s === "string" && normalizeRepoPath(s) === s && !s.startsWith("!") && !/[\x00-\x1f]/.test(s))) {
+          throw new Error("Audit patterns must be at most 100 repository-relative globs without traversal or negation");
+        }
+        return raw2;
+      };
+      config.audit = {};
+      if (audit.include !== void 0) config.audit.include = patterns(audit.include);
+      if (audit.exclude !== void 0) {
+        if (!audit.exclude || typeof audit.exclude !== "object" || Array.isArray(audit.exclude)) throw new Error("audit.exclude must map check names to patterns");
+        const { ALL_CHECKS: ALL_CHECKS2 } = await Promise.resolve().then(() => (init_types(), types_exports));
+        config.audit.exclude = {};
+        for (const [check, globs] of Object.entries(audit.exclude)) {
+          if (!ALL_CHECKS2.includes(check)) throw new Error("Unknown audit check: " + check);
+          config.audit.exclude[check] = patterns(globs);
+        }
+      }
+    }
     return config;
   } catch (error) {
     if (error.code === "ENOENT") return {};
@@ -234,13 +276,192 @@ var init_storage = __esm({
   }
 });
 
-// src/utils/store-lock.ts
+// src/audit/inspection.ts
+import fg2 from "fast-glob";
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+import path4 from "path";
+function inspectionRead(root, key, read) {
+  const inspection = inspections.getStore();
+  if (!inspection || inspection.root !== path4.resolve(root)) return read();
+  if (!inspection.reads.has(key)) {
+    const pending = read();
+    inspection.reads.set(key, pending);
+    void pending.catch(() => {
+      if (inspection.reads.get(key) === pending) inspection.reads.delete(key);
+    });
+  }
+  return inspection.reads.get(key);
+}
+function inspectionGit(args, options) {
+  return inspectionRead(options.cwd, "git:" + JSON.stringify([args, options]), () => execGit(args, options));
+}
+async function auditGitPaths(root, kind) {
+  const custom = (await loadProjectConfig(root)).audit?.include ?? [];
+  const shared = inspections.getStore()?.root === path4.resolve(root) && !custom.length;
+  const expanded = fg2.generateTasks(custom).flatMap((task) => task.positive);
+  if (expanded.length > 1e3) throw new Error("Audit include patterns expand to more than 1,000 globs");
+  const documentSpecs = [...docSpecs, ...expanded.map((pattern) => `:(glob)${pattern}`)];
+  const specs = shared ? [...documentSpecs, ...sourceSpecs] : kind === "documents" ? documentSpecs : sourceSpecs;
+  const limit = kind === "documents" ? 16 * 1024 * 1024 : 32 * 1024 * 1024;
+  const { stdout } = await inspectionGit(
+    ["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...specs],
+    { cwd: root, maxBuffer: shared ? 48 * 1024 * 1024 : limit, timeout: 1e4 }
+  );
+  const paths = [...new Set(stdout.split("\0").filter(Boolean))].filter((file) => kind === "documents" ? custom.length > 0 || /^(readme|agents|claude)\.md$/i.test(path4.posix.basename(file)) : sourceSuffixes.has(file.slice(file.lastIndexOf("."))));
+  if (Buffer.byteLength(paths.join("\0")) > limit) throw new Error("Git " + kind + " inventory exceeds its bounded read limit.");
+  return paths.sort();
+}
+var inspections, sourceSpecs, docSpecs, sourceSuffixes;
+var init_inspection = __esm({
+  "src/audit/inspection.ts"() {
+    "use strict";
+    init_git_read();
+    init_files();
+    inspections = new AsyncLocalStorage2();
+    sourceSpecs = SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`);
+    docSpecs = [":(icase,glob)**/readme.md", ":(icase,glob)**/agents.md", ":(icase,glob)**/claude.md"];
+    sourceSuffixes = new Set(SOURCE_EXTENSIONS.map((extension) => "." + extension));
+  }
+});
+
+// src/audit/inputs.ts
 import fs3 from "fs/promises";
+import * as nativeFs from "fs";
+import path5 from "path";
+import fg3 from "fast-glob";
+async function auditInputPath(root, file) {
+  if (file === ".") return fs3.realpath(root);
+  try {
+    return await storePath(root, file);
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("Symlink")) {
+      throw new Error(`Audit input contains a symbolic link: ${file}. Its evidence could not be verified.`, { cause: error });
+    }
+    throw error;
+  }
+}
+async function readAuditInput(root, file) {
+  try {
+    const value = await readBoundedFile(await auditInputPath(root, file), 10 * 1024 * 1024);
+    if (value === null) throw new Error(`Unreadable or oversized audit input: ${file}`);
+    return value;
+  } catch (error) {
+    if (["ENOENT", "ENOTDIR"].includes(error.code ?? "")) return null;
+    throw error;
+  }
+}
+async function auditGlob(root, patterns, options) {
+  if (Array.isArray(patterns) && !patterns.length) return [];
+  const directories = /* @__PURE__ */ new Set();
+  const readdir2 = ((directory, opts, callback) => {
+    const relative = path5.relative(root, directory).split(path5.sep).join("/") || ".";
+    directories.add(relative);
+    if (directories.size > MAX_INPUTS) {
+      callback(new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} directories while inspecting ${relative}. Narrow this check's inputs.`));
+      return;
+    }
+    auditInputPath(root, relative).then(() => {
+      nativeFs.readdir(directory, opts, callback);
+    }, callback);
+  });
+  const lstat2 = ((file, callback) => {
+    const relative = path5.relative(root, file).split(path5.sep).join("/") || ".";
+    auditInputPath(root, relative).then(() => nativeFs.lstat(file, callback), callback);
+  });
+  const stream = fg3.stream(patterns, {
+    cwd: root,
+    ignore: options.ignore,
+    onlyFiles: false,
+    onlyDirectories: options.onlyDirectories,
+    objectMode: true,
+    followSymbolicLinks: options.followSymbolicLinks ?? true,
+    fs: { readdir: readdir2, lstat: lstat2 },
+    concurrency: 16
+  });
+  const matches = [];
+  try {
+    for await (const value of stream) {
+      const entry = value;
+      const file = entry.path;
+      if (options.select && !options.select(file)) continue;
+      await auditInputPath(root, file);
+      if (!options.onlyDirectories && !entry.dirent.isFile()) continue;
+      matches.push(file);
+      if (matches.length > MAX_INPUTS) {
+        const largest = [...matches.reduce((counts, item) => {
+          const dir = item.split("/")[0];
+          counts.set(dir, (counts.get(dir) ?? 0) + 1);
+          return counts;
+        }, /* @__PURE__ */ new Map())].sort((a, b) => b[1] - a[1]).slice(0, 3);
+        throw new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} relevant paths. Largest directories: ${largest.map(([dir, count3]) => `${dir} (${count3})`).join(", ")}. Narrow this check's inputs.`);
+      }
+    }
+  } finally {
+    stream.destroy();
+  }
+  return matches.sort();
+}
+async function gitSourcePaths(root) {
+  return auditGitPaths(root, "sources");
+}
+async function gitIgnoredPaths(root, files) {
+  if (!files.length) return /* @__PURE__ */ new Set();
+  const ignored = /* @__PURE__ */ new Set();
+  for (let offset = 0; offset < files.length; offset += 1e3) {
+    try {
+      const { stdout } = await execGit(["check-ignore", "-z", "--stdin"], {
+        cwd: root,
+        maxBuffer: 4 * 1024 * 1024,
+        timeout: 1e4,
+        input: files.slice(offset, offset + 1e3).join("\0") + "\0"
+      });
+      for (const file of stdout.split("\0").filter(Boolean)) ignored.add(file);
+    } catch (error) {
+      if (error.code !== 1) throw error;
+    }
+  }
+  return ignored;
+}
+var MAX_INPUTS;
+var init_inputs = __esm({
+  "src/audit/inputs.ts"() {
+    "use strict";
+    init_files();
+    init_storage();
+    init_git_read();
+    init_inspection();
+    MAX_INPUTS = 1e5;
+  }
+});
+
+// src/audit/policy.ts
+import fg4 from "fast-glob";
+async function includedCheckPaths(root, paths, exclude) {
+  if (!exclude.length) return new Set(paths);
+  const included = /* @__PURE__ */ new Set();
+  for (let offset = 0; offset < paths.length; offset += 256) {
+    for (const file of await auditGlob(root, paths.slice(offset, offset + 256).map((file2) => fg4.escapePath(file2)), {
+      ignore: exclude,
+      followSymbolicLinks: false,
+      label: "Audit check exclusions"
+    })) included.add(file);
+  }
+  return included;
+}
+var init_policy = __esm({
+  "src/audit/policy.ts"() {
+    "use strict";
+    init_inputs();
+  }
+});
+
+// src/utils/store-lock.ts
+import fs4 from "fs/promises";
 import os from "os";
 async function lockDiagnostic(file) {
   let reason;
   try {
-    const owner = JSON.parse(await fs3.readFile(file, "utf8"));
+    const owner = JSON.parse(await fs4.readFile(file, "utf8"));
     if (!owner || typeof owner.host !== "string" || !Number.isInteger(owner.pid) || owner.pid <= 0) {
       reason = "Lock owner data is incomplete or malformed.";
     } else if (owner.host !== os.hostname()) {
@@ -256,7 +477,7 @@ async function lockDiagnostic(file) {
   } catch (error) {
     reason = error instanceof SyntaxError ? "Lock owner data is incomplete or malformed." : "Lock owner data could not be read; the lock may have changed.";
   }
-  if (await fs3.lstat(file + ".reclaim").then(() => true, () => false)) {
+  if (await fs4.lstat(file + ".reclaim").then(() => true, () => false)) {
     reason += " A recovery guard also needs inspection: " + file + ".reclaim.";
   }
   return reason + " Retry if a writer is active. For manual recovery, stop all Mason writers for this checkout, confirm they have exited (including other hosts), then remove only confirmed abandoned lock and lock.reclaim files. See docs/reference.md#snapshot-repairs-and-verification.";
@@ -267,21 +488,21 @@ async function withStoreLock(root, directory, run, waitMs = 5e3, label = "Mason
   let handle;
   while (!handle) {
     try {
-      handle = await fs3.open(file, "wx", 384);
+      handle = await fs4.open(file, "wx", 384);
       try {
         await handle.writeFile(JSON.stringify({ pid: process.pid, host: os.hostname() }));
       } catch (error) {
         await handle.close().catch(() => {
         });
         handle = void 0;
-        await fs3.rm(file, { force: true }).catch(() => {
+        await fs4.rm(file, { force: true }).catch(() => {
         });
         throw error;
       }
     } catch (error) {
       if (error.code !== "EEXIST") throw error;
       try {
-        const owner = JSON.parse(await fs3.readFile(file, "utf8"));
+        const owner = JSON.parse(await fs4.readFile(file, "utf8"));
         if (owner.host === os.hostname() && Number.isInteger(owner.pid) && owner.pid > 0) {
           try {
             process.kill(owner.pid, 0);
@@ -290,13 +511,13 @@ async function withStoreLock(root, directory, run, waitMs = 5e3, label = "Mason
               const reclaim = file + ".reclaim";
               let guard;
               try {
-                guard = await fs3.open(reclaim, "wx", 384);
-                const current = JSON.parse(await fs3.readFile(file, "utf8"));
-                if (current.pid === owner.pid && current.host === owner.host) await fs3.unlink(file);
+                guard = await fs4.open(reclaim, "wx", 384);
+                const current = JSON.parse(await fs4.readFile(file, "utf8"));
+                if (current.pid === owner.pid && current.host === owner.host) await fs4.unlink(file);
               } finally {
                 if (guard) {
                   await guard.close();
-                  await fs3.rm(reclaim, { force: true });
+                  await fs4.rm(reclaim, { force: true });
                 }
               }
             }
@@ -312,7 +533,7 @@ async function withStoreLock(root, directory, run, waitMs = 5e3, label = "Mason
     return await run();
   } finally {
     await handle.close();
-    await fs3.unlink(file);
+    await fs4.unlink(file);
   }
 }
 var init_store_lock = __esm({
@@ -331,7 +552,7 @@ var init_lock = __esm({
 });
 
 // src/test-map.ts
-import path4 from "path";
+import path6 from "path";
 var init_test_map = __esm({
   "src/test-map.ts"() {
     "use strict";
@@ -340,7 +561,7 @@ var init_test_map = __esm({
 });
 
 // src/snapshot/snapshot.ts
-import path5 from "path";
+import path7 from "path";
 import { z } from "zod";
 async function getCurrentGitHash(rootDir) {
   try {
@@ -392,8 +613,8 @@ var init_snapshot = __esm({
 });
 
 // src/drift/drift.ts
-import fs4 from "fs/promises";
-import path6 from "path";
+import fs5 from "fs/promises";
+import path8 from "path";
 function parseChanges(output) {
   const fields = output.split("\0");
   const changes = [];
@@ -442,7 +663,7 @@ var init_drift = __esm({
 });
 
 // src/audit/commands.ts
-import path7 from "path";
+import path9 from "path";
 function splitCommands(line) {
   const parts = [];
   let quote = "", start = 0;
@@ -478,7 +699,7 @@ function commandClaims(line, lineNo, cwd, shell = false) {
     const cd = text2.match(/^cd\s+(.+)$/);
     if (cd) {
       const directory = literal(cd[1]);
-      cwd = directory === null || cwd === null || /\s/.test(directory) && !/^["']/.test(cd[1]) ? null : path7.posix.join(cwd ?? ".", directory);
+      cwd = directory === null || cwd === null || /\s/.test(directory) && !/^["']/.test(cd[1]) ? null : path9.posix.join(cwd ?? ".", directory);
       continue;
     }
     for (const match of text2.matchAll(COMMAND)) {
@@ -489,7 +710,7 @@ function commandClaims(line, lineNo, cwd, shell = false) {
       if (shell && match.index !== 0 || match[3].startsWith("-")) scopeUnknown = "Unsupported shell wrapper or options before the script.";
       if (selector) {
         const selected = literal(selector[1]);
-        directory = selected === null || cwd === null ? null : path7.posix.join(cwd ?? ".", selected);
+        directory = selected === null || cwd === null ? null : path9.posix.join(cwd ?? ".", selected);
       } else if (flags) scopeUnknown = "Unsupported package-manager options before run: " + flags;
       const tail = text2.slice(match.index + match[0].length).split(/\s--(?:\s|$)/)[0];
       if (/(?:^|\s)(?:--workspace(?:s)?|-w|--filter|-F|--prefix|--dir|-C|--if-present)(?:\s|=|$)/.test(tail)) {
@@ -519,7 +740,7 @@ var init_commands = __esm({
     COMMAND = new RegExp(`\\b(npm|pnpm|yarn)((?:[ \\t]+${TOKEN})*?)[ \\t]+run[ \\t]+([A-Za-z0-9:_.-]+)`, "g");
     literal = (value) => {
       const unquoted = value.replace(/^(["'])(.*)\1$/, "$2");
-      return /[$`*?\[\]{}~\\\x00-\x1f]/.test(unquoted) || path7.posix.isAbsolute(unquoted) ? null : unquoted;
+      return /[$`*?\[\]{}~\\\x00-\x1f]/.test(unquoted) || path9.posix.isAbsolute(unquoted) ? null : unquoted;
     };
   }
 });
@@ -824,49 +1045,6 @@ var init_claims = __esm({
   }
 });
 
-// src/audit/inspection.ts
-import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
-import path8 from "path";
-function inspectionRead(root, key, read) {
-  const inspection = inspections.getStore();
-  if (!inspection || inspection.root !== path8.resolve(root)) return read();
-  if (!inspection.reads.has(key)) {
-    const pending = read();
-    inspection.reads.set(key, pending);
-    void pending.catch(() => {
-      if (inspection.reads.get(key) === pending) inspection.reads.delete(key);
-    });
-  }
-  return inspection.reads.get(key);
-}
-function inspectionGit(args, options) {
-  return inspectionRead(options.cwd, "git:" + JSON.stringify([args, options]), () => execGit(args, options));
-}
-async function auditGitPaths(root, kind) {
-  const shared = inspections.getStore()?.root === path8.resolve(root);
-  const specs = shared ? [...docSpecs, ...sourceSpecs] : kind === "documents" ? docSpecs : sourceSpecs;
-  const limit = kind === "documents" ? 16 * 1024 * 1024 : 32 * 1024 * 1024;
-  const { stdout } = await inspectionGit(
-    ["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...specs],
-    { cwd: root, maxBuffer: shared ? 48 * 1024 * 1024 : limit, timeout: 1e4 }
-  );
-  const paths = [...new Set(stdout.split("\0").filter(Boolean))].filter((file) => kind === "documents" ? /^(readme|agents|claude)\.md$/i.test(path8.posix.basename(file)) : sourceSuffixes.has(file.slice(file.lastIndexOf("."))));
-  if (Buffer.byteLength(paths.join("\0")) > limit) throw new Error("Git " + kind + " inventory exceeds its bounded read limit.");
-  return paths.sort();
-}
-var inspections, sourceSpecs, docSpecs, sourceSuffixes;
-var init_inspection = __esm({
-  "src/audit/inspection.ts"() {
-    "use strict";
-    init_git_read();
-    init_files();
-    inspections = new AsyncLocalStorage2();
-    sourceSpecs = SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`);
-    docSpecs = [":(icase,glob)**/readme.md", ":(icase,glob)**/agents.md", ":(icase,glob)**/claude.md"];
-    sourceSuffixes = new Set(SOURCE_EXTENSIONS.map((extension) => "." + extension));
-  }
-});
-
 // src/audit/git.ts
 function parseCommitLine(line) {
   const parts = line.split("	");
@@ -952,120 +1130,10 @@ var init_git = __esm({
   }
 });
 
-// src/audit/inputs.ts
-import fs5 from "fs/promises";
-import * as nativeFs from "fs";
-import path9 from "path";
-import fg2 from "fast-glob";
-async function auditInputPath(root, file) {
-  if (file === ".") return fs5.realpath(root);
-  try {
-    return await storePath(root, file);
-  } catch (error) {
-    if (error instanceof Error && error.message.startsWith("Symlink")) {
-      throw new Error(`Audit input contains a symbolic link: ${file}. Its evidence could not be verified.`, { cause: error });
-    }
-    throw error;
-  }
-}
-async function readAuditInput(root, file) {
-  try {
-    const value = await readBoundedFile(await auditInputPath(root, file), 10 * 1024 * 1024);
-    if (value === null) throw new Error(`Unreadable or oversized audit input: ${file}`);
-    return value;
-  } catch (error) {
-    if (["ENOENT", "ENOTDIR"].includes(error.code ?? "")) return null;
-    throw error;
-  }
-}
-async function auditGlob(root, patterns, options) {
-  if (Array.isArray(patterns) && !patterns.length) return [];
-  const directories = /* @__PURE__ */ new Set();
-  const readdir2 = ((directory, opts, callback) => {
-    const relative = path9.relative(root, directory).split(path9.sep).join("/") || ".";
-    directories.add(relative);
-    if (directories.size > MAX_INPUTS) {
-      callback(new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} directories while inspecting ${relative}. Narrow this check's inputs.`));
-      return;
-    }
-    auditInputPath(root, relative).then(() => {
-      nativeFs.readdir(directory, opts, callback);
-    }, callback);
-  });
-  const lstat2 = ((file, callback) => {
-    const relative = path9.relative(root, file).split(path9.sep).join("/") || ".";
-    auditInputPath(root, relative).then(() => nativeFs.lstat(file, callback), callback);
-  });
-  const stream = fg2.stream(patterns, {
-    cwd: root,
-    ignore: options.ignore,
-    onlyFiles: false,
-    onlyDirectories: options.onlyDirectories,
-    objectMode: true,
-    followSymbolicLinks: options.followSymbolicLinks ?? true,
-    fs: { readdir: readdir2, lstat: lstat2 },
-    concurrency: 16
-  });
-  const matches = [];
-  try {
-    for await (const value of stream) {
-      const entry = value;
-      const file = entry.path;
-      if (options.select && !options.select(file)) continue;
-      await auditInputPath(root, file);
-      if (!options.onlyDirectories && !entry.dirent.isFile()) continue;
-      matches.push(file);
-      if (matches.length > MAX_INPUTS) {
-        const largest = [...matches.reduce((counts, item) => {
-          const dir = item.split("/")[0];
-          counts.set(dir, (counts.get(dir) ?? 0) + 1);
-          return counts;
-        }, /* @__PURE__ */ new Map())].sort((a, b) => b[1] - a[1]).slice(0, 3);
-        throw new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} relevant paths. Largest directories: ${largest.map(([dir, count3]) => `${dir} (${count3})`).join(", ")}. Narrow this check's inputs.`);
-      }
-    }
-  } finally {
-    stream.destroy();
-  }
-  return matches.sort();
-}
-async function gitSourcePaths(root) {
-  return auditGitPaths(root, "sources");
-}
-async function gitIgnoredPaths(root, files) {
-  if (!files.length) return /* @__PURE__ */ new Set();
-  const ignored = /* @__PURE__ */ new Set();
-  for (let offset = 0; offset < files.length; offset += 1e3) {
-    try {
-      const { stdout } = await execGit(["check-ignore", "-z", "--stdin"], {
-        cwd: root,
-        maxBuffer: 4 * 1024 * 1024,
-        timeout: 1e4,
-        input: files.slice(offset, offset + 1e3).join("\0") + "\0"
-      });
-      for (const file of stdout.split("\0").filter(Boolean)) ignored.add(file);
-    } catch (error) {
-      if (error.code !== 1) throw error;
-    }
-  }
-  return ignored;
-}
-var MAX_INPUTS;
-var init_inputs = __esm({
-  "src/audit/inputs.ts"() {
-    "use strict";
-    init_files();
-    init_storage();
-    init_git_read();
-    init_inspection();
-    MAX_INPUTS = 1e5;
-  }
-});
-
 // src/audit/docs.ts
 import fs6 from "fs/promises";
 import path10 from "path";
-import fg3 from "fast-glob";
+import fg5 from "fast-glob";
 async function dirtyDocs(resolvedRoot, files) {
   if (!files.length) return /* @__PURE__ */ new Set();
   try {
@@ -1117,7 +1185,7 @@ async function discoverDocPaths(root) {
   const paths = [];
   const unique = [...new Set(candidates)].sort();
   for (let offset = 0; offset < unique.length; offset += 256) {
-    paths.push(...await auditGlob(root, unique.slice(offset, offset + 256).map((p) => fg3.escapePath(p)), {
+    paths.push(...await auditGlob(root, unique.slice(offset, offset + 256).map((p) => fg5.escapePath(p)), {
       ignore: excluded,
       followSymbolicLinks: false,
       label: "Documentation discovery"
@@ -1147,6 +1215,7 @@ async function localDocPaths(root) {
   return paths;
 }
 function documentScope(file) {
+  if (!/^(readme|agents|claude)\.md$/i.test(path10.posix.basename(file))) return ".";
   const parent = path10.posix.dirname(file);
   return path10.posix.basename(parent).toLowerCase() === ".claude" ? path10.posix.dirname(parent) : parent;
 }
@@ -1168,7 +1237,7 @@ async function readDocs(resolvedRoot) {
         path: candidate,
         content,
         scope: documentScope(candidate),
-        kind: /^readme\.md$/i.test(path10.posix.basename(candidate)) ? "readme" : "instructions",
+        kind: /^readme\.md$/i.test(path10.posix.basename(candidate)) ? "readme" : /^(agents|claude)\.md$/i.test(path10.posix.basename(candidate)) ? "instructions" : "guide",
         lineCount: content.split("\n").length,
         lastCommit,
         dirty: dirty.has(candidate),
@@ -1197,22 +1266,6 @@ var init_docs = __esm({
   }
 });
 
-// src/audit/types.ts
-var ALL_CHECKS;
-var init_types = __esm({
-  "src/audit/types.ts"() {
-    "use strict";
-    ALL_CHECKS = [
-      "deleted-reference",
-      "new-module",
-      "stale-count",
-      "dead-command",
-      "deps-changed",
-      "decision-anchor-drift"
-    ];
-  }
-});
-
 // src/audit/scope.ts
 import fs7 from "fs/promises";
 import path11 from "path";
@@ -1323,7 +1376,7 @@ var init_deleted_reference = __esm({
 });
 
 // src/audit/checks/new-module.ts
-import fg4 from "fast-glob";
+import fg6 from "fast-glob";
 import fs8 from "fs/promises";
 import path13 from "path";
 function escapeRegExp(text2) {
@@ -1385,7 +1438,7 @@ async function collectModuleCandidates(root, combinedDocs) {
     const result = /* @__PURE__ */ new Map();
     for (const dir of parents) {
       const visible = new Set(byParent.get(dir).filter((candidate) => !ignored.has(candidate) || sources.some((file) => file.startsWith(candidate + "/"))));
-      result.set(dir, (await auditGlob(root, dir === "." ? "*" : `${fg4.escapePath(dir)}/*`, {
+      result.set(dir, (await auditGlob(root, dir === "." ? "*" : `${fg6.escapePath(dir)}/*`, {
         ignore,
         onlyDirectories: true,
         label: "Module directory discovery",
@@ -1398,7 +1451,7 @@ async function collectModuleCandidates(root, combinedDocs) {
     const files = sources.filter((file) => file.startsWith(dir + "/"));
     let count3 = 0;
     for (let offset = 0; offset < files.length; offset += 256) {
-      count3 += (await auditGlob(root, files.slice(offset, offset + 256).map((file) => fg4.escapePath(file)), {
+      count3 += (await auditGlob(root, files.slice(offset, offset + 256).map((file) => fg6.escapePath(file)), {
         ignore,
         followSymbolicLinks: false,
         label: `Source discovery in ${dir}`
@@ -1733,6 +1786,87 @@ var init_dead_command = __esm({
   }
 });
 
+// src/audit/dependency-claims.ts
+import path16 from "path";
+import { parse as parseToml } from "smol-toml";
+function dependencyText(content) {
+  return content.replace(/<!-- mason:start -->[\s\S]*?<!-- mason:end -->/g, (text2) => text2.replace(/[^\n]/g, " ")).replace(/<!--[\s\S]*?-->/g, (text2) => text2.replace(/[^\n]/g, " "));
+}
+function declarations(file, source) {
+  const result = /* @__PURE__ */ new Map();
+  if (!source) return result;
+  if (path16.posix.basename(file) === "package.json") {
+    const json = JSON.parse(source);
+    for (const section of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies", "engines"]) {
+      for (const [name, value] of Object.entries(json[section] ?? {})) {
+        if (typeof value === "string") result.set(name, [...result.has(name) ? [result.get(name)] : [], value].join("; "));
+      }
+    }
+  } else if (file.endsWith("libs.versions.toml")) {
+    const catalog = parseToml(source);
+    for (const section of ["libraries", "plugins"]) for (const [alias, entry] of Object.entries(catalog[section] ?? {})) {
+      if (typeof entry === "string") {
+        const parts = entry.split(":");
+        if (parts.length >= 3) result.set(parts.slice(0, -1).join(":"), parts.at(-1));
+      } else if (entry && typeof entry === "object") {
+        const name = entry.module ?? (entry.group && entry.name ? `${entry.group}:${entry.name}` : entry.id);
+        const version = typeof entry.version === "string" ? entry.version : catalog.versions?.[entry.version?.ref];
+        if (typeof name === "string") result.set(name, typeof version === "string" ? version : "unspecified");
+      }
+    }
+  } else if (/build\.gradle(?:\.kts)?$/.test(file)) {
+    for (const match of source.matchAll(/["']([\w.-]+:[\w.-]+):([^"'\s]+)["']/g)) result.set(match[1], match[2]);
+    for (const match of source.matchAll(/\bid\s*\(?\s*["']([\w.-]+)["']\s*\)?\s*version\s*["']([^"']+)["']/g)) result.set(match[1], match[2]);
+  }
+  return result;
+}
+async function matchDependencyChanges(root, from, head, files, content) {
+  const matches = [];
+  const lines = dependencyText(content).split("\n");
+  let incomplete = files.length > 64;
+  for (const file of files.slice(0, 64)) {
+    if (!/(?:^|\/)(?:package\.json|libs\.versions\.toml|build\.gradle(?:\.kts)?)$/.test(file)) {
+      incomplete = true;
+      continue;
+    }
+    try {
+      const read = async (revision) => {
+        const { stdout: entry } = await inspectionGit(["ls-tree", revision, "--", `:(literal)${file}`], { cwd: root, timeout: 1e4 });
+        if (!entry) return "";
+        if (!entry.startsWith("100644 ") && !entry.startsWith("100755 ")) throw new Error("Unsupported manifest mode");
+        return (await inspectionGit(["show", `${revision}:${file}`], { cwd: root, maxBuffer: 1024 * 1024, timeout: 1e4 })).stdout;
+      };
+      const [before, after] = await Promise.all([read(from), read(head)]);
+      const old = declarations(file, before), next = declarations(file, after);
+      for (const dependency of /* @__PURE__ */ new Set([...old.keys(), ...next.keys()])) {
+        if (old.get(dependency) === next.get(dependency)) continue;
+        const escaped = dependency.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        const mention = new RegExp(`(^|[^a-zA-Z0-9_@./-])${escaped}(?![a-zA-Z0-9_/-]|\\.[a-zA-Z0-9_])`, "i");
+        const line = lines.findIndex((text2) => mention.test(text2));
+        if (line < 0) continue;
+        matches.push({
+          dependency,
+          manifest: file,
+          before: old.get(dependency) ?? null,
+          after: next.get(dependency) ?? null,
+          line: line + 1,
+          excerpt: lines[line].trim().slice(0, 500)
+        });
+        if (matches.length >= 100) return { matches, incomplete: true };
+      }
+    } catch {
+      incomplete = true;
+    }
+  }
+  return { matches, incomplete };
+}
+var init_dependency_claims = __esm({
+  "src/audit/dependency-claims.ts"() {
+    "use strict";
+    init_inspection();
+  }
+});
+
 // src/audit/release-metadata.ts
 async function git(root, args) {
   return (await execGit(args, { cwd: root, timeout: 1e4, maxBuffer: 2 * 1024 * 1024 })).stdout;
@@ -1789,6 +1923,10 @@ var init_release_metadata = __esm({
 });
 
 // src/audit/checks/deps-changed.ts
+function hasDependencyContent(content) {
+  const text2 = content.replace(/<!-- mason:start -->[\s\S]*?<!-- mason:end -->/g, "").replace(/<!--[\s\S]*?-->/g, "");
+  return /\b(?:dependenc(?:y|ies)|librar(?:y|ies)|frameworks?|tech(?:nology)? stack|prerequisites|requirements)\b/i.test(text2) || /\b(?:package\.json|build\.gradle(?:\.kts)?|settings\.gradle(?:\.kts)?|libs\.versions\.toml|Cargo\.toml|go\.mod|pyproject\.toml|requirements\.txt|Gemfile|composer\.json)\b/i.test(text2) || /\b(?:node(?:\.js)?|npm|pnpm|yarn|bun|deno|python|ruby|rust|go|java|jdk|kotlin|gradle|swift|php|react|vue|angular|compose|ktor|room)\s*(?:version\s*)?[`*:=>~^v\s-]*\d+(?:\.\d+)*\b/i.test(text2) || /\b(?:npm|pnpm|yarn|pip3?|cargo|gem|composer)\s+(?:install|add|require)\b/i.test(text2);
+}
 function manifestPathspecs(doc) {
   const scope = documentScope(doc);
   if (scope === ".") return MANIFEST_PATHSPECS;
@@ -1808,12 +1946,17 @@ async function checkDepsChanged(ctx) {
       });
       continue;
     }
+    let content = doc.content;
     if (doc.dirty) {
-      result.skipped.push({
-        check: "deps-changed",
-        doc: doc.path,
-        reason: `${doc.path} has uncommitted edits \u2013 suppressed while in flight`
-      });
+      try {
+        content = (await inspectionGit(
+          ["show", `${doc.lastCommit.hash}:${doc.path}`],
+          { cwd: ctx.root, maxBuffer: 10 * 1024 * 1024, timeout: 1e4 }
+        )).stdout;
+      } catch {
+        result.skipped.push({ check: "deps-changed", doc: doc.path, reason: `${doc.path}: committed dependency content is unavailable` });
+        continue;
+      }
     }
     const range = await commitsTouchingSince(
       ctx.root,
@@ -1838,16 +1981,32 @@ async function checkDepsChanged(ctx) {
     range.commits = relevant;
     range.total = relevant.length;
     if (range.total === 0) continue;
-    const latest = range.commits[0];
+    const relevance = await matchDependencyChanges(
+      ctx.root,
+      doc.lastCommit.hash,
+      ctx.headHash,
+      [...new Set(range.commits.flatMap((commit) => commit.files))],
+      content
+    );
+    if (!relevance.matches.length && !hasDependencyContent(content)) continue;
+    const match = relevance.matches[0];
+    if (doc.dirty && match) result.skipped.push({
+      check: "deps-changed",
+      doc: doc.path,
+      reason: `${doc.path} has uncommitted edits \u2013 suppressed while in flight`
+    });
     (doc.dirty ? result.suppressedAdvisories : result.advisories).push({
       type: "deps-changed",
-      message: `dependency manifests touched by ${range.total} commit${range.total === 1 ? "" : "s"} since ${doc.path} was last committed (latest: ${latest.hash.slice(0, 7)} "${latest.subject}")`,
-      anchor: { doc: doc.path, line: null, excerpt: null },
+      ...match ? {} : { resolution: "informational" },
+      message: match ? `${match.dependency} changed from ${match.before ?? "absent"} to ${match.after ?? "removed"} in ${match.manifest}; review ${doc.path}:${match.line}: ${match.excerpt}${relevance.matches.length > 1 ? ` (${relevance.matches.length - 1} more matches in evidence)` : ""}` : `Dependency manifests changed after the document baseline ${doc.lastCommit.hash.slice(0, 7)} (${doc.lastCommit.date.slice(0, 10)}); no specific affected passage was established. Informational only.${relevance.incomplete ? " Some manifest declarations could not be matched." : ""}`,
+      anchor: { doc: doc.path, line: match?.line ?? null, excerpt: match?.excerpt ?? null },
       evidence: {
         kind: "doc-behind-manifests",
         docLastCommit: doc.lastCommit,
         manifestCommits: range.commits.slice(0, MANIFEST_COMMITS_CAP),
-        totalCommits: range.total
+        totalCommits: range.total,
+        matches: relevance.matches,
+        matchingIncomplete: relevance.incomplete
       }
     });
   }
@@ -1857,9 +2016,11 @@ var MANIFEST_COMMITS_CAP, MANIFEST_PATHSPECS;
 var init_deps_changed = __esm({
   "src/audit/checks/deps-changed.ts"() {
     "use strict";
+    init_dependency_claims();
     init_docs();
     init_release_metadata();
     init_git();
+    init_inspection();
     init_checks();
     MANIFEST_COMMITS_CAP = 10;
     MANIFEST_PATHSPECS = [
@@ -1880,7 +2041,7 @@ var init_deps_changed = __esm({
 });
 
 // src/context/lexical.ts
-import path16 from "path";
+import path17 from "path";
 var init_lexical = __esm({
   "src/context/lexical.ts"() {
     "use strict";
@@ -2041,7 +2202,7 @@ var init_provenance = __esm({
 
 // src/decisions/decisions.ts
 import fs9 from "fs/promises";
-import path17 from "path";
+import path18 from "path";
 import { createHash } from "crypto";
 import { z as z3 } from "zod";
 async function loadDecisionStore(rootDir) {
@@ -2092,9 +2253,9 @@ var init_decisions = __esm({
 });
 
 // src/decisions/drift.ts
-import path18 from "path";
+import path19 from "path";
 async function computeDecisionDrift(rootDir, decisions) {
-  const resolvedRoot = path18.resolve(rootDir);
+  const resolvedRoot = path19.resolve(rootDir);
   const store = decisions ? { records: decisions, diagnostics: [] } : await loadDecisionStore(resolvedRoot);
   const report = { historyAvailable: true, totalDecisions: store.records.length, staleDecisions: {}, freshness: {}, diagnostics: store.diagnostics };
   const [head, workingTree] = await Promise.all([getCurrentGitHash(resolvedRoot), getWorkingTree(resolvedRoot)]);
@@ -2290,7 +2451,9 @@ var init_findings = __esm({
         kind: z4.literal("doc-behind-manifests"),
         docLastCommit: commitSchema,
         manifestCommits: z4.array(commitSchema.extend({ files: z4.array(z4.string()) })),
-        totalCommits: count
+        totalCommits: count,
+        matches: z4.array(z4.object({ dependency: z4.string(), manifest: z4.string(), before: z4.string().nullable(), after: z4.string().nullable(), line: z4.number().int().positive(), excerpt: z4.string() })).optional(),
+        matchingIncomplete: z4.boolean().optional()
       }),
       z4.object({
         kind: z4.literal("decision-anchor"),
@@ -2306,7 +2469,7 @@ var init_findings = __esm({
       type: z4.enum(["deleted-reference", "new-module", "stale-count", "dead-command"]),
       confidence: z4.enum(["certain", "likely"])
     });
-    advisorySchema = findingSchema.extend({ type: checkSchema, resolution: z4.literal("recheck").optional() });
+    advisorySchema = findingSchema.extend({ type: checkSchema, resolution: z4.enum(["recheck", "informational"]).optional() });
     checkResultSchema = z4.object({
       issues: z4.array(issueSchema),
       advisories: z4.array(advisorySchema),
@@ -2368,7 +2531,7 @@ __export(repair_exports, {
   withRepairSession: () => withRepairSession
 });
 import fs10 from "fs/promises";
-import path19 from "path";
+import path20 from "path";
 import { randomUUID as randomUUID2 } from "crypto";
 import { z as z6 } from "zod";
 function recheckable(finding) {
@@ -2389,7 +2552,7 @@ async function docState(root) {
       docs.push([doc, null]);
     }
   }
-  return digest(docs);
+  return digest([docs, (await loadProjectConfig(root)).audit]);
 }
 async function stableAudit(root, checks, options = {}) {
   return profilePhase("repair.audit", () => readStableAudit(root, checks, options));
@@ -2458,8 +2621,8 @@ async function prepareOriginal(rootDir, checks, options, session) {
 }
 async function loadRepairBaseline(rootDir, baselinePath) {
   const root = await fs10.realpath(rootDir);
-  const declaredRoot = path19.resolve(rootDir);
-  const relative = path19.isAbsolute(baselinePath) ? path19.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
+  const declaredRoot = path20.resolve(rootDir);
+  const relative = path20.isAbsolute(baselinePath) ? path20.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
   const stored = baselineSchema.parse(await readStoreJson(root, relative));
   const { digest: savedDigest, ...payload } = stored;
   if (digest(payload) !== savedDigest) throw new Error("Repair baseline was modified; use the original baseline.");
@@ -2508,6 +2671,9 @@ async function verifyOriginal(rootDir, baselinePath, options, session) {
     if (now && ("confidence" in finding || "confidence" in now)) {
       return { ...base, status: "unresolved", reason: "The original check still reports this claim." };
     }
+    if (current.excludedChecks?.some((excluded) => excluded.check === finding.type && excluded.doc === finding.anchor.doc)) {
+      return { ...base, status: "resolved", reason: "Excluded by project audit policy; this is not a correctness assessment. Original evidence is retained." };
+    }
     const skipped = current.skippedChecks.filter((s) => s.check === finding.type && (!s.doc || s.doc === finding.anchor.doc));
     if (!current.checksRun?.includes(finding.type) || skipped.length) {
       return { ...base, status: "unverified", reason: skipped.map((s) => s.reason).join("; ") || "The original check did not run." };
@@ -2518,11 +2684,14 @@ async function verifyOriginal(rootDir, baselinePath, options, session) {
       if (review.status === "current") return { ...base, review, status: "resolved", reason: review.reason };
       return { ...base, review, status: "review-required", reason: review.reason };
     }
+    if (!("confidence" in finding) && finding.evidence.kind === "doc-behind-manifests" && !finding.evidence.matches?.length && (!now || !("confidence" in now) && now.resolution === "informational")) {
+      return { ...base, status: "resolved", reason: "Manifest recency alone establishes no affected passage. Retained as information; no assessment is required." };
+    }
     if (!("confidence" in finding) && (!recheckable(finding) || now)) {
       return {
         ...base,
         status: "review-required",
-        reason: "An audit cannot establish that this advisory was reviewed. Retain its original evidence and report a separate assessment; editing or committing the doc is not approval."
+        reason: (now ? "The current check still reports this advisory. " : finding.type === "deps-changed" ? "The current check no longer reports this condition; the historical advisory remains awaiting assessment. " : "The current check no longer reports the original finding; retained evidence still requires assessment. ") + "An audit cannot establish that this advisory was reviewed. Retain its original evidence and report a separate assessment; editing or committing the doc is not approval."
       };
     }
     return { ...base, status: "resolved", reason: "The original check ran and no longer reports this claim. Inspect the edit for semantic correctness." };
@@ -2546,7 +2715,7 @@ async function verifyOriginal(rootDir, baselinePath, options, session) {
   const reviewedIds = new Set(current?.advisoryReviews?.filter((review) => review.status === "current").map((review) => review.id));
   const counts = { resolved: 0, unresolved: 0, "review-required": 0, unverified: 0 };
   for (const f of findings) counts[f.status]++;
-  const incomplete = diagnostics.length > 0 || counts.unverified > 0 || counts["review-required"] > 0 || (current?.skippedChecks.length ?? 0) > 0 || newFindings.some((f) => !("confidence" in f) && !reviewedIds.has(findingId(f)));
+  const incomplete = diagnostics.length > 0 || counts.unverified > 0 || counts["review-required"] > 0 || (current?.skippedChecks.length ?? 0) > 0 || newFindings.some((f) => !("confidence" in f) && f.resolution !== "informational" && !reviewedIds.has(findingId(f)));
   const issuesRemain = counts.unresolved > 0 || newFindings.some((f) => "confidence" in f);
   return {
     version: 1,
@@ -2569,7 +2738,7 @@ function repairExitCode(report) {
 function formatRepairSummary(report) {
   return [
     "Repair verification: " + report.status + ". Baseline: " + report.baselinePath,
-    ...report.findings.map((f) => "  [" + f.status + "] " + f.original.type + " " + f.original.anchor.doc + ": " + f.original.message + "\n    " + f.reason + "\n    findingId: " + f.id),
+    ...report.findings.map((f) => "  [" + f.status + "] " + f.original.type + " " + f.original.anchor.doc + ": " + (f.current?.message ?? "Historical evidence at " + report.baselineHead.slice(0, 7) + ": " + f.original.message) + "\n    " + f.reason + "\n    findingId: " + f.id),
     ...report.newFindings.map((f) => "  [new] " + f.type + " " + f.anchor.doc + ": " + f.message),
     ...report.diagnostics.map((d) => "  [unverified] " + d),
     ...(report.currentAudit?.skippedChecks ?? []).map((s) => "  [skipped] " + s.check + ": " + s.reason),
@@ -2602,13 +2771,14 @@ var init_repair = __esm({
       docs: z6.array(z6.object({
         path: z6.string().refine((value) => normalizeRepoPath(value) === value),
         scope: z6.string().optional(),
-        kind: z6.enum(["instructions", "readme"]).optional(),
+        kind: z6.enum(["instructions", "readme", "guide"]).optional(),
         lastCommit: commitSchema.nullable(),
         dirty: z6.boolean(),
         lineCount: count2
       })).nonempty(),
       decisionsChecked: z6.boolean(),
       clean: z6.boolean(),
+      excludedChecks: z6.array(z6.object({ check: checkSchema, doc: z6.string() })).optional(),
       issues: z6.array(issueSchema),
       advisories: z6.array(advisorySchema),
       suppressedAdvisories: z6.array(advisorySchema).optional(),
@@ -2640,14 +2810,18 @@ async function readRecord(root, id) {
   if (raw === null) return null;
   const record = recordSchema.parse(raw);
   const { digest: stored, ...payload } = record;
-  if (record.id !== id || digest(payload) !== stored || record.events.some((event) => findingId(event.finding) !== id || event.evidence.fingerprint !== digest([event.evidence.scope, event.evidence.tree, event.evidence.lastScopeCommit, event.evidence.paths]))) {
+  if (record.id !== id || digest(payload) !== stored || record.events.some((event) => findingId(event.finding) !== id || (event.outcome === "dismissed" ? !event.reasonCode || event.finding.type !== "deps-changed" : !event.reviewer || !!event.reasonCode) || event.evidence.fingerprint !== evidenceFingerprint(event.evidence, event.reasonCode))) {
     throw new Error("Advisory review record is inconsistent or modified; inspect its history.");
   }
   return record;
 }
-function scopes(finding) {
+function evidenceFingerprint(evidence, reason) {
+  return digest([evidence.scope, evidence.tree, ...reason === "no-dependency-claims" ? [] : [evidence.lastScopeCommit], evidence.paths]);
+}
+function scopes(finding, reason) {
   const files = [finding.anchor.doc], e = finding.evidence;
   if (e.kind === "decision-anchor") throw new Error("Use review_decision for decision acceptance, reaffirmation or retirement.");
+  if (reason === "no-dependency-claims" && e.kind === "doc-behind-manifests") return [`:(literal)${finding.anchor.doc}`];
   if (e.kind === "doc-behind-manifests") return [`:(literal)${finding.anchor.doc}`, ...manifestPathspecs(finding.anchor.doc)];
   if (e.kind === "missing-path") files.push(...e.scope?.candidates ?? [e.resolvedPath ?? e.claimed]);
   else if (e.kind === "missing-script") files.push(...e.manifestsChecked, ...e.scope?.candidates ?? []);
@@ -2658,9 +2832,9 @@ function scopes(finding) {
     return `:(literal)${file}`;
   }).sort();
 }
-async function reviewEvidence(root, finding) {
+async function reviewEvidence(root, finding, reason) {
   if (normalizeRepoPath(finding.anchor.doc) !== finding.anchor.doc) throw new Error("Invalid advisory document path.");
-  const scope = scopes(finding);
+  const scope = scopes(finding, reason);
   const head = (await git2(root, "rev-parse", "HEAD")).trim();
   const tracked = (await git2(root, "ls-files", "--cached", "-z", "--", ...scope)).split("\0").filter(Boolean);
   if (tracked.length > 2e4) throw new Error("Advisory scope exceeds 20,000 tracked files.");
@@ -2686,7 +2860,7 @@ async function reviewEvidence(root, finding) {
       if (!tracked.includes(file) && await pathExists(root, file)) dirty = true;
     }
   }
-  const fingerprint = digest([scope, tree, lastScopeCommit, paths]);
+  const fingerprint = evidenceFingerprint({ head, scope, tree, lastScopeCommit, paths, fingerprint: "" }, reason);
   if ((await git2(root, "rev-parse", "HEAD")).trim() !== head) throw new Error("HEAD changed while collecting review evidence.");
   return {
     ...evidenceSchema2.parse({ head, scope, tree, lastScopeCommit, paths, fingerprint }),
@@ -2733,7 +2907,7 @@ async function assessAdvisory(root, finding, baselineHead) {
     const record = await readRecord(root, id);
     if (!record) return null;
     const event = record.events.at(-1);
-    const current = await reviewEvidence(root, event.finding);
+    const current = await reviewEvidence(root, event.finding, event.reasonCode);
     await git2(root, "merge-base", "--is-ancestor", event.evidence.head, current.head);
     const base = {
       id,
@@ -2743,7 +2917,7 @@ async function assessAdvisory(root, finding, baselineHead) {
       outcome: event.outcome,
       reviewedHead: event.evidence.head
     };
-    if (current.dirty || current.fingerprint !== event.evidence.fingerprint || digest(scopes(finding)) !== digest(event.evidence.scope)) return { ...base, status: "reopened", reason: "Relevant document or repository evidence changed after the assessment; prepare a new review." };
+    if (current.dirty || current.fingerprint !== event.evidence.fingerprint || digest(scopes(finding, event.reasonCode)) !== digest(event.evidence.scope)) return { ...base, status: "reopened", reason: "Relevant document or repository evidence changed after the assessment; prepare a new review." };
     return { ...base, status: event.outcome === "deferred" ? "deferred" : "current", reason: event.outcome === "deferred" ? "The review was deferred and remains outstanding." : "An explicit assessment covers the current committed scope. This does not approve an engineering decision or certify correctness." };
   } catch (error) {
     return { id, status: "unverified", reason: error instanceof Error ? error.message : String(error) };
@@ -2771,9 +2945,13 @@ async function reviewAdvisory(rootDir, input) {
     decisionId: finding.evidence.decisionId,
     hint: "Use review_decision to prepare evidence and record authorized acceptance, reaffirmation or retirement, then verify this original repair baseline. An advisory assessment cannot approve a decision."
   };
+  if (request.action === "dismiss") {
+    if (finding.type !== "deps-changed" || finding.evidence.kind !== "doc-behind-manifests") throw new Error("One-step dismissal is only available for dependency advisories.");
+    if (!request.reasonCode || !request.note) throw new Error("Dismissal requires reasonCode and note; it does not require a reviewer or prepared token.");
+  } else if (request.reasonCode) throw new Error("reasonCode is only used with dismiss.");
   const prepare = async () => {
     const record = await readRecord(root, request.findingId);
-    const evidence = await reviewEvidence(root, finding);
+    const evidence = await reviewEvidence(root, finding, request.reasonCode);
     await git2(root, "merge-base", "--is-ancestor", baseline.original.headHash, evidence.head);
     const token = digest({ baseline: baseline.original, finding, evidence, record });
     return { record, evidence, token };
@@ -2802,10 +2980,10 @@ async function reviewAdvisory(rootDir, input) {
       hint: "Inspect the original finding, scoped document and relevant code changes. Record addressed, inapplicable or deferred only when the user or cited project review authorizes that assessment. Supply the actual reviewer, reason in note and reviewToken. Relevant edits must be committed first. Deferral remains outstanding. Review identities are recorded assertions, not authenticated approvals."
     };
   }
-  if (!request.reviewer || !request.note || !request.reviewToken) throw new Error("Prepare first; recording an assessment requires reviewToken, reviewer and note.");
+  if (request.action !== "dismiss" && (!request.reviewer || !request.note || !request.reviewToken)) throw new Error("Prepare first; recording an assessment requires reviewToken, reviewer and note.");
   return withLock(root, ".mason/reports/advisory-review-locks/" + request.findingId, async () => {
     const state = await prepare();
-    if (state.token !== request.reviewToken) throw new Error("Review conflict: evidence or review history changed since preparation. Prepare and inspect a new review.");
+    if (request.action !== "dismiss" && state.token !== request.reviewToken) throw new Error("Review conflict: evidence or review history changed since preparation. Prepare and inspect a new review.");
     if (state.evidence.dirty) throw new Error("Commit relevant document and repository edits before recording the assessment. Unrelated local work may remain.");
     if ((state.record?.events.length ?? 0) >= 200) throw new Error("Review history limit reached; existing events were retained.");
     const { dirty, documentDigest, ...evidence } = state.evidence;
@@ -2813,7 +2991,8 @@ async function reviewAdvisory(rootDir, input) {
       at: (/* @__PURE__ */ new Date()).toISOString(),
       reviewer: request.reviewer,
       note: request.note,
-      outcome: request.action,
+      outcome: request.action === "dismiss" ? "dismissed" : request.action,
+      reasonCode: request.reasonCode,
       finding,
       evidence
     });
@@ -2824,11 +3003,11 @@ async function reviewAdvisory(rootDir, input) {
       status: "recorded",
       recordPath: recordPath(request.findingId),
       event,
-      hint: "Review and commit this assessment record through the normal project workflow, then verify the original repair baseline. Relevant changes reopen the assessment; deferral remains outstanding."
+      hint: request.action === "dismiss" ? "Dismissal saved and effective locally. Commit the record to share it. No-dependency-claims dismissals reopen on document content changes; unrelated-manifest-change dismissals reopen on scoped document or manifest changes. This does not approve a decision." : "Review and commit this assessment record through the normal project workflow, then verify the original repair baseline. Relevant changes reopen the assessment; deferral remains outstanding."
     };
   });
 }
-var git2, hashSchema, commitSchema2, evidenceSchema2, eventSchema2, recordSchema, reviewSummarySchema, advisoryReviewRequest, recordPath;
+var git2, hashSchema, commitSchema2, evidenceSchema2, dismissalReasonSchema, eventSchema2, recordSchema, reviewSummarySchema, advisoryReviewRequest, recordPath;
 var init_advisory_review = __esm({
   "src/audit/advisory-review.ts"() {
     "use strict";
@@ -2854,11 +3033,13 @@ var init_advisory_review = __esm({
       lastScopeCommit: commitSchema2,
       paths: z7.array(z7.object({ path: z7.string(), exists: z7.boolean() })).max(1e3)
     });
+    dismissalReasonSchema = z7.enum(["no-dependency-claims", "unrelated-manifest-change"]);
     eventSchema2 = z7.object({
       at: z7.string().datetime(),
-      reviewer: z7.string().trim().min(1).max(200),
+      reviewer: z7.string().trim().min(1).max(200).optional(),
       note: z7.string().trim().min(1).max(2500),
-      outcome: z7.enum(["addressed", "inapplicable", "deferred"]),
+      outcome: z7.enum(["addressed", "inapplicable", "deferred", "dismissed"]),
+      reasonCode: dismissalReasonSchema.optional(),
       finding: advisorySchema.refine((finding) => finding.evidence.kind !== "decision-anchor", "Decision findings use decision reviews"),
       evidence: evidenceSchema2
     });
@@ -2870,13 +3051,14 @@ var init_advisory_review = __esm({
       recordPath: z7.string().optional(),
       reviewer: z7.string().optional(),
       note: z7.string().optional(),
-      outcome: z7.enum(["addressed", "inapplicable", "deferred", "accepted", "reaffirmed", "retired"]).optional(),
+      outcome: z7.enum(["addressed", "inapplicable", "deferred", "accepted", "reaffirmed", "retired", "dismissed"]).optional(),
       reviewedHead: z7.string().optional()
     });
     advisoryReviewRequest = z7.object({
       baselinePath: z7.string().min(1),
       findingId: hashSchema,
-      action: z7.enum(["prepare", "addressed", "inapplicable", "deferred"]).default("prepare"),
+      action: z7.enum(["prepare", "addressed", "inapplicable", "deferred", "dismiss"]).default("prepare"),
+      reasonCode: dismissalReasonSchema.optional(),
       reviewer: eventSchema2.shape.reviewer.optional(),
       note: eventSchema2.shape.note.optional(),
       reviewToken: hashSchema.optional()
@@ -2887,12 +3069,12 @@ var init_advisory_review = __esm({
 
 // src/audit/audit.ts
 import fs12 from "fs/promises";
-import path20 from "path";
+import path21 from "path";
 async function computeAudit(rootDir, options = {}) {
   return profilePhase("audit.current", () => auditCurrent(rootDir, options));
 }
 async function auditCurrent(rootDir, options) {
-  const resolvedRoot = path20.resolve(rootDir);
+  const resolvedRoot = path21.resolve(rootDir);
   const [docs, headHash] = await Promise.all([discoverDocs(resolvedRoot), getCurrentGitHash(resolvedRoot)]);
   if (docs.length === 0) return null;
   const report = {
@@ -2926,7 +3108,7 @@ async function auditCurrent(rootDir, options) {
   }
   let decisionsPresent = false;
   try {
-    await fs12.access(path20.join(resolvedRoot, ".mason", "decisions"));
+    await fs12.access(path21.join(resolvedRoot, ".mason", "decisions"));
     decisionsPresent = true;
   } catch {
   }
@@ -2938,13 +3120,21 @@ async function auditCurrent(rootDir, options) {
     changesSinceDoc,
     decisionsPresent
   };
+  const policy = (await loadProjectConfig(resolvedRoot)).audit;
   const selected = options.checks ?? ALL_CHECKS;
   for (const name of ALL_CHECKS) {
     if (!selected.includes(name)) continue;
-    const { issues, advisories, suppressedAdvisories, skipped } = await (options.runCheck ? options.runCheck(name, ctx) : CHECKS[name](ctx));
+    const exclusions = policy?.exclude?.[name] ?? [];
+    const included = await includedCheckPaths(resolvedRoot, docs.map((doc) => doc.path), exclusions);
+    const excluded = docs.filter((doc) => !included.has(doc.path)).map((doc) => ({ check: name, doc: doc.path }));
+    if (excluded.length) (report.excludedChecks ??= []).push(...excluded);
+    const scoped = { ...ctx, docs: docs.filter((doc) => included.has(doc.path)) };
+    const { issues, advisories, suppressedAdvisories, skipped } = await (options.runCheck ? options.runCheck(name, scoped) : CHECKS[name](scoped));
     report.checksRun.push(name);
     report.issues.push(...issues);
-    report.advisories.push(...advisories);
+    const advisoryPaths = await includedCheckPaths(resolvedRoot, [...new Set(advisories.map((f) => f.anchor.doc))], exclusions);
+    report.advisories.push(...advisories.filter((f) => advisoryPaths.has(f.anchor.doc)));
+    for (const f of advisories) if (!advisoryPaths.has(f.anchor.doc)) (report.excludedChecks ??= []).push({ check: name, doc: f.anchor.doc });
     report.suppressedAdvisories.push(...suppressedAdvisories ?? []);
     report.skippedChecks.push(...skipped);
   }
@@ -2956,6 +3146,8 @@ async function auditCurrent(rootDir, options) {
 var init_audit = __esm({
   "src/audit/audit.ts"() {
     "use strict";
+    init_files();
+    init_policy();
     init_profile();
     init_drift();
     init_snapshot();
@@ -2971,11 +3163,11 @@ init_audit();
 init_types();
 init_repair();
 init_findings();
-import path22 from "path";
+import path23 from "path";
 
 // src/audit/advisory-cli.ts
 init_advisory_review();
-import path21 from "path";
+import path22 from "path";
 import { stripVTControlCharacters } from "util";
 var USAGE = `Usage: mason audit review --baseline <path> --finding <id> [options]
 
@@ -2983,13 +3175,15 @@ Prepare an advisory assessment against retained evidence (read-only by default).
   --dir <path>       Repository root (default: current directory)
   --baseline <path>  Original repair baseline
   --finding <id>     findingId from repair verification or automation
-  --outcome <value>  Record addressed, inapplicable, or deferred
+  --outcome <value>  Record addressed, inapplicable, deferred, or dismiss
+  --reason <code>   Dismiss: no-dependency-claims or unrelated-manifest-change
   --reviewer <name>  Actual authorized reviewer
   --note <reason>    Assessment reason
   --token <token>    reviewToken returned by preparation
   --json            Full evidence and review history
 
-Recording requires prior preparation and committed relevant edits. Review records
+Assessments require preparation and committed relevant edits. Dismiss requires only
+--reason and --note, with a committed document; no reviewer or token is needed. Review records
 belong in Git under .mason/reviews/advisories/. Deferral remains outstanding.
 Decision findings use review_decision; this command never approves decisions.
 Exit 0: prepared/recorded; 2: unavailable, conflict, or decision review required.`;
@@ -3007,21 +3201,22 @@ async function runAdvisoryCli(args, io = { out: (text2) => console.log(text2), e
         json = true;
         continue;
       }
-      if (!["--dir", "--baseline", "--finding", "--outcome", "--reviewer", "--note", "--token"].includes(flag) || flags[flag]) throw new Error("Unexpected or repeated argument: " + flag);
+      if (!["--dir", "--baseline", "--finding", "--outcome", "--reviewer", "--note", "--token", "--reason"].includes(flag) || flags[flag]) throw new Error("Unexpected or repeated argument: " + flag);
       const value = args[++i];
       if (!value || value.startsWith("--")) throw new Error(flag + " requires a value.");
       flags[flag] = value;
     }
-    if (!flags["--outcome"] && ["--reviewer", "--note", "--token"].some((key) => flags[key])) throw new Error("Use --outcome to record an assessment.");
+    if (!flags["--outcome"] && ["--reviewer", "--note", "--token", "--reason"].some((key) => flags[key])) throw new Error("Use --outcome to record an assessment.");
     const input = {
       baselinePath: flags["--baseline"],
       findingId: flags["--finding"],
       action: flags["--outcome"] ?? "prepare",
       reviewer: flags["--reviewer"],
       note: flags["--note"],
-      reviewToken: flags["--token"]
+      reviewToken: flags["--token"],
+      reasonCode: flags["--reason"]
     };
-    const result = await reviewAdvisory(path21.resolve(flags["--dir"] ?? process.cwd()), input);
+    const result = await reviewAdvisory(path22.resolve(flags["--dir"] ?? process.cwd()), input);
     if (json) io.out(JSON.stringify(result, null, 2));
     else {
       const lines = [`Advisory review: ${result.status}.`];
@@ -3133,8 +3328,8 @@ function issueLine(issue) {
 function formatAuditSummary(report) {
   const lines = [];
   const reviewed = new Set(report.advisoryReviews?.filter((review) => review.status === "current").map((review) => review.id));
-  const open = report.advisories.filter((finding) => !reviewed.has(findingId(finding)));
-  const suppressed = (report.suppressedAdvisories ?? []).filter((finding) => !reviewed.has(findingId(finding)));
+  const open = report.advisories.filter((finding) => finding.resolution !== "informational" && !reviewed.has(findingId(finding)));
+  const suppressed = (report.suppressedAdvisories ?? []).filter((finding) => finding.resolution !== "informational" && !reviewed.has(findingId(finding)));
   const reviewCount = open.length + suppressed.length;
   for (const doc of report.docs) {
     const docIssues = report.issues.filter((i) => i.anchor.doc === doc.path);
@@ -3152,6 +3347,9 @@ function formatAuditSummary(report) {
   for (const issue of report.issues) {
     if (!docPaths.has(issue.anchor.doc)) lines.push(issueLine(issue));
   }
+  const information = [...report.advisories, ...report.suppressedAdvisories ?? []].filter((f) => f.resolution === "informational");
+  if (information.length) lines.push(`${information.length} informational dependency notices; no review required (see --json).`);
+  if (report.excludedChecks?.length) lines.push(`${report.excludedChecks.length} document/check pairs excluded by project policy (see --json).`);
   if (open.length > 0) {
     lines.push("Advisories (do not affect the exit code):");
     for (const advisory of open) {
@@ -3205,7 +3403,7 @@ function formatFixPrompt(report, baselinePath) {
     "- new-module: review whether the directory needs documenting; an omission alone does not establish a defect. Preserve scope and describe only what you verified."
   );
   lines.push(
-    "- Historical ADVISORIES require a separate authorized assessment using review_advisory with the baselinePath and findingId from verification. Prepare and inspect evidence first; record addressed, inapplicable or deferred with the actual reviewer, note and reviewToken. Decision findings use review_decision. Candidates marked resolution: recheck can be rerun to see whether the condition remains; this does not establish semantic approval. Report what remains unknown."
+    "- Specific historical ADVISORIES require a separate authorized assessment using review_advisory with the baselinePath and findingId from verification. Prepare and inspect evidence first; record addressed, inapplicable or deferred with the actual reviewer, note and reviewToken. Dependency notices marked resolution: informational require no review. Dependency advisories may be dismissed with action: dismiss, reasonCode (no-dependency-claims or unrelated-manifest-change), and note, without a reviewer or token. Decision findings use review_decision. Candidates marked resolution: recheck can be rerun to see whether the condition remains; this does not establish semantic approval. Report what remains unknown."
   );
   lines.push("");
   lines.push("AUDIT REPORT (current context files and repository evidence, including local edits):");
@@ -3254,7 +3452,7 @@ async function runAuditCli(argv, io = {
     io.out(USAGE2);
     return 0;
   }
-  const rootDir = path22.resolve(args.dir);
+  const rootDir = path23.resolve(args.dir);
   if (args.baseline || args.prepareRepair) {
     try {
       if (args.baseline) {