mason-context 0.9.0 → 0.10.0

package/dist/mason-review.js

@@ -1,117 +1,559 @@
 #!/usr/bin/env node
 
 // src/review/cli.ts
-import path8 from "path";
+import path12 from "path";
+import { stripVTControlCharacters } from "util";
 
 // src/review/review.ts
 import fs5 from "fs/promises";
-import path7 from "path";
+import path11 from "path";
 import { execFile as execFile5 } from "child_process";
 import { promisify as promisify5 } from "util";
 
 // src/drift/drift.ts
 import fs3 from "fs/promises";
-import path4 from "path";
+import path6 from "path";
 import { execFile as execFile3 } from "child_process";
 import { promisify as promisify3 } from "util";
 
 // src/snapshot/snapshot.ts
-import fs2 from "fs/promises";
-import path3 from "path";
+import path5 from "path";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
-import fg3 from "fast-glob";
 
-// src/mcp/sampler.ts
+// src/utils/files.ts
 import fs from "fs/promises";
-import path from "path";
+import { constants } from "fs";
+import path2 from "path";
 import { execFile } from "child_process";
 import { promisify } from "util";
 import fg from "fast-glob";
+
+// src/utils/paths.ts
+import path from "path";
+function normalizeRepoPath(value) {
+  const slash = value.replace(/\\/g, "/");
+  if (!slash || slash.includes("\0") || path.posix.isAbsolute(slash) || /^[A-Za-z]:/.test(slash)) return null;
+  if (slash.split("/").includes("..")) return null;
+  const normalized = path.posix.normalize(slash).replace(/\/$/, "");
+  return normalized === "." ? null : normalized;
+}
+function isWithinRoot(root, candidate) {
+  const relative = path.relative(root, candidate);
+  return relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
+function anchorMatches(anchor, file) {
+  const a = normalizeRepoPath(anchor);
+  const f = normalizeRepoPath(file);
+  return a !== null && f !== null && (a === f || f.startsWith(`${a}/`));
+}
+function matchingPaths(anchors, files) {
+  return [...new Set(files)].filter((file) => anchors.some((anchor) => anchorMatches(anchor, file)));
+}
+
+// src/utils/files.ts
 var exec = promisify(execFile);
+var SOURCE_EXTENSIONS = ["ts", "tsx", "js", "jsx", "mts", "cts", "mjs", "cjs", "vue", "svelte", "kt", "kts", "java", "py", "go", "rs", "swift", "rb", "cs", "cpp", "c", "h", "hpp", "dart", "php"];
+var SOURCE_GLOB = `**/*.{${SOURCE_EXTENSIONS.join(",")}}`;
+var SOURCE_IGNORE = [
+  "**/node_modules/**",
+  "**/dist/**",
+  "**/build/**",
+  "**/.gradle/**",
+  "**/target/**",
+  "**/.git/**",
+  "**/.mason/**",
+  "**/vendor/**",
+  "**/__pycache__/**",
+  "**/venv/**",
+  "**/.venv/**",
+  "**/*.min.*",
+  "**/*.map",
+  "**/*.lock",
+  "**/generated/**",
+  "**/*.generated.*",
+  "**/R.java",
+  "**/BuildConfig.java",
+  "**/package-lock.json",
+  "**/yarn.lock",
+  "**/pnpm-lock.yaml"
+];
+var MAX_SOURCE_BYTES = 1024 * 1024;
+function isSensitiveFile(file) {
+  return file.split(/[\\/]/).some(
+    (part) => /^(?:\.env(?:\..*)?|id_rsa.*|id_ed25519.*)$|\.(?:pem|key|p12|pfx|jks|keystore)$|credentials\.|secret|^local\.properties$/i.test(part)
+  );
+}
+async function readBoundedFile(file, maxBytes) {
+  const handle = await fs.open(file, constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW);
+  try {
+    const stat = await handle.stat();
+    if (!stat.isFile() || stat.size > maxBytes) return null;
+    const buffer = Buffer.alloc(Math.min(maxBytes + 1, stat.size + 1));
+    let bytes = 0;
+    while (bytes < buffer.length) {
+      const result = await handle.read(buffer, bytes, buffer.length - bytes, null);
+      if (result.bytesRead === 0) break;
+      bytes += result.bytesRead;
+    }
+    return bytes === buffer.length ? null : buffer.subarray(0, bytes).toString("utf8");
+  } finally {
+    await handle.close();
+  }
+}
+async function loadProjectConfig(root) {
+  try {
+    const canonicalRoot = await fs.realpath(root);
+    const configPath = await fs.realpath(path2.join(root, ".mason/config.json"));
+    if (!isWithinRoot(canonicalRoot, configPath)) throw new Error("Project configuration resolves outside the repository");
+    const raw = await readBoundedFile(configPath, 64 * 1024);
+    if (raw === null) throw new Error("Project configuration is not a regular file or exceeds 64 KiB");
+    const value = JSON.parse(raw);
+    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Expected a configuration object");
+    const config = {};
+    for (const key of ["patterns", "alwaysInclude", "ignore"]) {
+      if (value[key] === void 0) continue;
+      if (!Array.isArray(value[key]) || !value[key].every((s) => typeof s === "string")) {
+        throw new Error(`Configuration ${key} must be an array of strings`);
+      }
+      config[key] = value[key];
+    }
+    return config;
+  } catch (error) {
+    if (error.code === "ENOENT") return {};
+    throw new Error(`Cannot apply project file policy: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+async function createFileAccess(rootDir) {
+  const root = path2.resolve(rootDir);
+  const canonicalRoot = await fs.realpath(root).catch(() => root);
+  const config = await loadProjectConfig(root);
+  const ignore = [...SOURCE_IGNORE, ...config.ignore ?? []];
+  let gitFiles = null;
+  try {
+    const { stdout } = await exec("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], { cwd: root, maxBuffer: 50 * 1024 * 1024 });
+    gitFiles = new Set(stdout.split("\0").filter(Boolean));
+  } catch {
+    let inGit = false;
+    try {
+      await exec("git", ["rev-parse", "--git-dir"], { cwd: root });
+      inGit = true;
+    } catch {
+    }
+    if (inGit) throw new Error("Cannot enumerate Git files safely");
+  }
+  async function resolve(file) {
+    const relative = normalizeRepoPath(file);
+    if (!relative || isSensitiveFile(relative) || gitFiles && !gitFiles.has(relative)) return null;
+    const candidate = path2.join(root, relative);
+    try {
+      const real = await fs.realpath(candidate);
+      if (!isWithinRoot(canonicalRoot, real) || isSensitiveFile(path2.relative(canonicalRoot, real))) return null;
+      const stat = await fs.stat(real);
+      if (!stat.isFile() || stat.size > MAX_SOURCE_BYTES) return null;
+      if (gitFiles && !gitFiles.has(path2.relative(canonicalRoot, real).split(path2.sep).join("/"))) return null;
+      return real;
+    } catch {
+      return null;
+    }
+  }
+  async function list(patterns = SOURCE_GLOB, options = {}) {
+    const found = await fg(patterns, { cwd: root, ignore, followSymbolicLinks: false, ...options });
+    const safe = await Promise.all(found.map(async (f) => await resolve(f) ? f : null));
+    return safe.filter((f) => f !== null).sort();
+  }
+  async function read(file) {
+    const relative = normalizeRepoPath(file);
+    if (!relative) return null;
+    const real = await resolve(relative);
+    if (!real) return null;
+    for (const rel of /* @__PURE__ */ new Set([relative, path2.relative(canonicalRoot, real).split(path2.sep).join("/")])) {
+      if (!(await fg(fg.escapePath(rel), { cwd: root, ignore, dot: true })).length) return null;
+    }
+    try {
+      const content = await readBoundedFile(real, MAX_SOURCE_BYTES);
+      return content === null ? null : { path: relative, content, totalLines: content.split("\n").length };
+    } catch {
+      return null;
+    }
+  }
+  return { root, config, list, read };
+}
+
+// src/utils/storage.ts
+import fs2 from "fs/promises";
+import path3 from "path";
+import { randomUUID } from "crypto";
+async function storePath(root, relative, createParents = false) {
+  const normalized = normalizeRepoPath(relative);
+  if (!normalized) throw new Error(`Invalid store path: ${relative}`);
+  let current = await fs2.realpath(root);
+  const parts = normalized.split("/");
+  for (let i = 0; i < parts.length; i++) {
+    current = path3.join(current, parts[i]);
+    let stat;
+    try {
+      stat = await fs2.lstat(current);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      if (createParents && i < parts.length - 1) {
+        try {
+          await fs2.mkdir(current);
+        } catch (mkdirError) {
+          if (mkdirError.code !== "EEXIST") throw mkdirError;
+        }
+        stat = await fs2.lstat(current);
+      }
+    }
+    if (stat?.isSymbolicLink()) throw new Error(`Symlink in store path: ${relative}`);
+  }
+  return current;
+}
+async function readStoreJson(root, relative) {
+  try {
+    const file = await storePath(root, relative);
+    const raw = await readBoundedFile(file, 10 * 1024 * 1024);
+    if (raw === null) throw new Error("file is not regular or exceeds 10 MiB");
+    const parsed = JSON.parse(raw);
+    if (parsed === null) throw new Error("expected a JSON object, received null");
+    return parsed;
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw new Error(`Invalid Mason store ${relative}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+
+// src/snapshot/snapshot.ts
+import { z } from "zod";
 
 // src/test-map.ts
-import path2 from "path";
-import fg2 from "fast-glob";
+import path4 from "path";
+async function buildTestMap(dir) {
+  const rootDir = path4.resolve(dir);
+  const access = await createFileAccess(rootDir);
+  const testPatterns = [
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/*Test.kt",
+    "**/*Test.java",
+    "**/*Tests.kt",
+    "**/*Tests.java",
+    "**/test_*.py",
+    "**/*_test.py",
+    "**/*_test.go",
+    "**/*Tests.swift",
+    "**/*Test.swift",
+    "**/*_test.rs"
+  ];
+  const testFiles = await access.list(testPatterns);
+  const sourceFiles = await access.list();
+  const sourceByBaseName = /* @__PURE__ */ new Map();
+  for (const file of sourceFiles) {
+    if (testFiles.includes(file)) continue;
+    const baseName = path4.basename(file).replace(/\.[^.]+$/, "");
+    const existing = sourceByBaseName.get(baseName) ?? [];
+    existing.push(file);
+    sourceByBaseName.set(baseName, existing);
+  }
+  const paired = [];
+  const unmatched = [];
+  for (const testFile of testFiles) {
+    const testBaseName = path4.basename(testFile).replace(/\.[^.]+$/, "");
+    const sourceName = testBaseName.replace(/Test$|Tests$|Spec$|\.test$|\.spec$/, "").replace(/^test_|_test$/, "");
+    if (!sourceName) {
+      unmatched.push(testFile);
+      continue;
+    }
+    const candidates = sourceByBaseName.get(sourceName);
+    if (candidates && candidates.length > 0) {
+      const testDir = path4.dirname(testFile);
+      const bestMatch = candidates.reduce((best, candidate) => {
+        const candidateDir = path4.dirname(candidate);
+        const bestDir = path4.dirname(best);
+        const candidateOverlap = commonSegments(testDir, candidateDir);
+        const bestOverlap = commonSegments(testDir, bestDir);
+        return candidateOverlap > bestOverlap ? candidate : best;
+      });
+      paired.push({
+        test: testFile,
+        source: bestMatch,
+        confidence: candidates.length === 1 ? "exact" : "best-guess"
+      });
+    } else {
+      unmatched.push(testFile);
+    }
+  }
+  return { totalTestFiles: testFiles.length, paired, unmatched };
+}
+function commonSegments(pathA, pathB) {
+  const segsA = pathA.split("/");
+  const segsB = pathB.split("/");
+  let count2 = 0;
+  for (let i = 0; i < Math.min(segsA.length, segsB.length); i++) {
+    if (segsA[i] === segsB[i]) count2++;
+    else break;
+  }
+  return count2;
+}
 
 // src/snapshot/snapshot.ts
 var exec2 = promisify2(execFile2);
+var repoPath = z.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
+var verificationFields = {
+  refreshedHash: z.string().optional(),
+  verifiedAt: z.string().optional(),
+  verifiedHash: z.string().optional(),
+  verificationFailed: z.boolean().optional(),
+  verificationNote: z.string().optional()
+};
+var featureSchema = z.object({
+  description: z.string(),
+  files: z.array(repoPath),
+  tests: z.array(repoPath).optional(),
+  type: z.enum(["capability", "infrastructure"]).optional(),
+  ...verificationFields
+}).passthrough();
+var flowSchema = z.object({ description: z.string(), chain: z.array(repoPath), ...verificationFields }).passthrough();
+var snapshotSchema = z.object({
+  version: z.literal(2),
+  createdAt: z.string(),
+  updatedAt: z.string(),
+  gitHash: z.string(),
+  features: z.record(featureSchema),
+  flows: z.record(flowSchema)
+}).passthrough();
+async function getCurrentGitHash(rootDir) {
+  try {
+    const { stdout } = await exec2("git", ["rev-parse", "HEAD"], {
+      cwd: rootDir
+    });
+    return stdout.trim();
+  } catch {
+    return "unknown";
+  }
+}
 
 // src/drift/drift.ts
 var exec3 = promisify3(execFile3);
-async function getChangesWithStatus(resolvedRoot, fromHash) {
-  if (!fromHash || fromHash === "unknown") return null;
+function parseChanges(output) {
+  const fields = output.split("\0");
+  const changes = [];
+  for (let i = 0; i < fields.length && fields[i]; ) {
+    const code = fields[i++];
+    const first = fields[i++];
+    if (!first) break;
+    const second = /^[RC]/.test(code) ? fields[i++] : void 0;
+    const change = second ? code.startsWith("R") ? { status: "renamed", path: second, previousPath: first } : { status: "added", path: second } : { status: code === "A" ? "added" : code === "D" ? "deleted" : "modified", path: first };
+    if (change.path.startsWith(".mason/") && (!change.previousPath || change.previousPath.startsWith(".mason/"))) continue;
+    changes.push(change);
+  }
+  return changes;
+}
+function touchedPaths(changes) {
+  return [...new Set(changes.flatMap((c) => c.previousPath ? [c.previousPath, c.path] : [c.path]))].sort();
+}
+async function getChangesWithStatus(resolvedRoot, fromHash, toHash = "HEAD") {
+  if (!fromHash || fromHash === "unknown" || fromHash.startsWith("-") || !toHash || toHash === "unknown" || toHash.startsWith("-")) return null;
   try {
-    const { stdout } = await exec3(
-      "git",
-      ["diff", "--name-status", "-M", fromHash, "HEAD"],
-      { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }
-    );
-    const changes = [];
-    for (const line of stdout.split("\n")) {
-      if (!line.trim()) continue;
-      const parts = line.split("	");
-      if (parts.some((p) => p.startsWith(".mason/"))) continue;
-      const code = parts[0];
-      if (code.startsWith("R") && parts.length >= 3) {
-        changes.push({
-          status: "renamed",
-          path: parts[2],
-          previousPath: parts[1]
-        });
-      } else if (code.startsWith("C") && parts.length >= 3) {
-        changes.push({ status: "added", path: parts[2] });
-      } else if (code === "A" && parts.length >= 2) {
-        changes.push({ status: "added", path: parts[1] });
-      } else if (code === "D" && parts.length >= 2) {
-        changes.push({ status: "deleted", path: parts[1] });
-      } else if (parts.length >= 2) {
-        changes.push({ status: "modified", path: parts[1] });
-      }
-    }
-    return changes;
+    const { stdout } = await exec3("git", ["diff", "--name-status", "-z", "-M", fromHash, toHash, "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 });
+    return parseChanges(stdout);
   } catch {
     return null;
   }
 }
+async function getWorkingTree(resolvedRoot) {
+  try {
+    const [diff, untracked] = await Promise.all([
+      exec3("git", ["diff", "--name-status", "-z", "-M", "HEAD", "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }),
+      exec3("git", ["ls-files", "-z", "--others", "--exclude-standard"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 })
+    ]);
+    const untrackedFiles = untracked.stdout.split("\0").filter((f) => f && !f.startsWith(".mason/"));
+    return { available: true, changedFiles: [.../* @__PURE__ */ new Set([...touchedPaths(parseChanges(diff.stdout)), ...untrackedFiles])].sort(), untrackedFiles };
+  } catch {
+    return { available: false, changedFiles: [], untrackedFiles: [] };
+  }
+}
+
+// src/decisions/provenance.ts
+import { z as z2 } from "zod";
+var text = (max) => z2.string().trim().min(1).max(max);
+var decisionSourceSchema = z2.object({
+  kind: z2.enum(["pull_request", "issue", "incident", "discussion", "document", "other"]),
+  reference: text(1e3),
+  note: text(500).optional()
+}).strict();
+var attributionSchema = z2.object({
+  owner: text(200).nullable().optional(),
+  sources: z2.array(decisionSourceSchema).max(20).optional(),
+  actor: text(200).optional()
+});
+var contentSchema = z2.object({
+  title: z2.string().min(1),
+  body: z2.string().min(1),
+  category: z2.enum(["decision", "gotcha", "deprecation", "convention"]),
+  files: z2.array(z2.string().refine((f) => normalizeRepoPath(f) !== null)),
+  owner: text(200).optional(),
+  sources: z2.array(decisionSourceSchema).max(20)
+});
+var approvalSchema = z2.enum(["unreviewed", "proposed", "accepted"]);
+var statusSchema = z2.enum(["active", "superseded", "retired"]);
+var reviewEvidenceSchema = z2.object({
+  baseHash: z2.string(),
+  headHash: z2.string(),
+  historyAvailable: z2.boolean(),
+  changedFiles: z2.array(z2.string()),
+  localChanges: z2.array(z2.string())
+});
+var eventSchema = z2.object({
+  kind: z2.enum(["imported", "created", "revised", "accepted", "reaffirmed", "retired", "superseded"]),
+  at: z2.string().datetime(),
+  actor: text(200).optional(),
+  note: text(1500).optional(),
+  revision: z2.number().int().positive(),
+  content: contentSchema,
+  approval: approvalSchema,
+  status: statusSchema,
+  refreshedHash: z2.string(),
+  evidence: reviewEvidenceSchema.optional()
+});
+var legacySchema = z2.object({
+  version: z2.literal(1),
+  id: z2.string().regex(/^[a-zA-Z0-9_-]+$/),
+  title: z2.string().min(1),
+  body: z2.string().min(1),
+  category: contentSchema.shape.category,
+  files: contentSchema.shape.files,
+  createdAt: z2.string(),
+  updatedAt: z2.string(),
+  refreshedHash: z2.string(),
+  status: z2.enum(["active", "superseded"]),
+  supersededBy: z2.string().optional()
+}).passthrough();
+var currentSchema = legacySchema.extend({
+  version: z2.literal(2),
+  status: statusSchema,
+  approval: approvalSchema,
+  revision: z2.number().int().positive(),
+  owner: text(200).optional(),
+  sources: z2.array(decisionSourceSchema).max(20),
+  history: z2.array(eventSchema).min(1)
+}).superRefine((record, ctx) => {
+  const invalid = (message2) => ctx.addIssue({ code: "custom", message: message2 });
+  const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+  let previous;
+  for (const event of record.history) {
+    if (!previous) {
+      if (!["created", "imported"].includes(event.kind) || event.revision !== 1) invalid("History must begin with creation or legacy import at revision 1");
+      if (event.approval !== (event.kind === "created" ? "proposed" : "unreviewed")) invalid("Initial records cannot claim acceptance");
+    } else {
+      if (["created", "imported"].includes(event.kind)) invalid("History cannot restart");
+      if (previous.status !== "active") invalid("Archived decisions cannot be changed");
+      if (event.revision !== previous.revision + (event.kind === "revised" ? 1 : 0)) invalid("Invalid revision sequence");
+      if (event.kind !== "revised" && !same(event.content, previous.content)) invalid("A review cannot silently revise decision content");
+      if (event.kind === "reaffirmed" && previous.approval !== "accepted") invalid("Only accepted decisions can be reaffirmed");
+      if (event.kind === "accepted" && previous.approval === "accepted") invalid("Use reaffirmation for an accepted decision");
+      const approval = event.kind === "revised" ? "proposed" : ["accepted", "reaffirmed"].includes(event.kind) ? "accepted" : previous.approval;
+      if (event.approval !== approval) invalid("Approval disagrees with review history");
+      if (!["accepted", "reaffirmed"].includes(event.kind) && event.refreshedHash !== previous.refreshedHash) invalid("Only a review can refresh the evidence baseline");
+    }
+    if (event.kind !== "imported" && event.status !== (event.kind === "retired" ? "retired" : event.kind === "superseded" ? "superseded" : "active")) invalid("Lifecycle disagrees with history");
+    if (["accepted", "reaffirmed", "retired"].includes(event.kind) && (!event.actor || !event.note || !event.evidence)) invalid("Reviews require a named reviewer, reason, and code evidence");
+    if (["accepted", "reaffirmed"].includes(event.kind)) {
+      if (!event.content.owner || !event.content.sources.length) invalid("Accepted decisions require an owner and source");
+      if (!event.evidence || !/^[a-f0-9]{40,64}$/.test(event.evidence.headHash) || event.refreshedHash !== event.evidence.headHash || event.evidence.localChanges.length) invalid("Acceptance requires a committed evidence baseline");
+    }
+    previous = event;
+  }
+  if (!previous || !same(previous.content, decisionContent(record)) || previous.approval !== record.approval || previous.status !== record.status || previous.revision !== record.revision || previous.refreshedHash !== record.refreshedHash) invalid("Decision does not match the final history event");
+});
+var decisionSchema = z2.union([legacySchema, currentSchema]);
+function decisionContent(record) {
+  return {
+    title: record.title,
+    body: record.body,
+    category: record.category,
+    files: record.files,
+    ...typeof record.owner === "string" ? { owner: record.owner } : {},
+    sources: Array.isArray(record.sources) ? record.sources : []
+  };
+}
+function decisionApproval(record) {
+  return record.version === 1 ? "unreviewed" : record.approval;
+}
+function decisionProvenance(record, freshness = "unknown") {
+  const approval = decisionApproval(record);
+  const review = record.version === 2 ? [...record.history].reverse().find((e) => ["accepted", "reaffirmed"].includes(e.kind) && e.revision === record.revision) : void 0;
+  return {
+    approval,
+    revision: record.version === 2 ? record.revision : 0,
+    owner: record.version === 2 ? record.owner ?? null : null,
+    sources: record.version === 2 ? record.sources : [],
+    guidance: record.status !== "active" ? "historical" : approval === "accepted" ? "constraint" : approval === "proposed" ? "proposal" : "unreviewed",
+    reviewRequired: record.status === "active" && (approval !== "accepted" || freshness !== "current"),
+    lastReview: review ? { reviewer: review.actor, at: review.at, note: review.note, gitHash: review.refreshedHash } : null
+  };
+}
 
 // src/decisions/decisions.ts
 import fs4 from "fs/promises";
-import path6 from "path";
+import path8 from "path";
 import { createHash } from "crypto";
 
 // src/context/lexical.ts
-import path5 from "path";
+import path7 from "path";
 
 // src/decisions/decisions.ts
-function decisionsDir(rootDir) {
-  return path6.join(rootDir, ".mason", "decisions");
-}
-async function loadDecisions(rootDir) {
+async function loadDecisionStore(rootDir) {
+  const records = [];
+  const diagnostics = [];
   let entries;
   try {
-    entries = await fs4.readdir(decisionsDir(rootDir));
-  } catch {
-    return [];
+    entries = await fs4.readdir(await storePath(rootDir, ".mason/decisions"));
+  } catch (error) {
+    if (error.code !== "ENOENT") diagnostics.push({ path: ".mason/decisions", message: String(error) });
+    return { records, diagnostics };
   }
-  const records = [];
-  for (const entry of entries) {
+  for (const entry of entries.sort()) {
     if (!entry.endsWith(".json")) continue;
+    const relative = `.mason/decisions/${entry}`;
     try {
-      const raw = await fs4.readFile(
-        path6.join(decisionsDir(rootDir), entry),
-        "utf-8"
-      );
-      const parsed = JSON.parse(raw);
-      if (parsed.version !== 1 || !parsed.id || !parsed.title || !parsed.body) {
-        continue;
-      }
-      records.push(parsed);
-    } catch {
+      const record = decisionSchema.parse(await readStoreJson(rootDir, relative));
+      if (entry !== `${record.id}.json`) throw new Error("Record id does not match its filename");
+      records.push(record);
+    } catch (error) {
+      diagnostics.push({ path: relative, message: error instanceof Error ? error.message : String(error) });
+    }
+  }
+  return { records, diagnostics };
+}
+
+// src/decisions/drift.ts
+import path9 from "path";
+async function computeDecisionDrift(rootDir, decisions) {
+  const resolvedRoot = path9.resolve(rootDir);
+  const store = decisions ? { records: decisions, diagnostics: [] } : await loadDecisionStore(resolvedRoot);
+  const report = { historyAvailable: true, totalDecisions: store.records.length, staleDecisions: {}, freshness: {}, diagnostics: store.diagnostics };
+  const [head, workingTree] = await Promise.all([getCurrentGitHash(resolvedRoot), getWorkingTree(resolvedRoot)]);
+  const changesByHash = /* @__PURE__ */ new Map();
+  for (const record of store.records) {
+    if (record.status !== "active") continue;
+    if (record.files.length === 0) {
+      report.freshness[record.id] = "unknown";
       continue;
     }
+    let touched = changesByHash.get(record.refreshedHash);
+    if (touched === void 0) {
+      const changes = record.refreshedHash === head && head !== "unknown" ? [] : await getChangesWithStatus(resolvedRoot, record.refreshedHash);
+      touched = changes === null ? null : touchedPaths(changes);
+      changesByHash.set(record.refreshedHash, touched);
+    }
+    if (touched === null) report.historyAvailable = false;
+    const hits = touched ? matchingPaths(record.files, touched) : [];
+    if (hits.length) report.staleDecisions[record.id] = hits;
+    const localHits = matchingPaths(record.files, workingTree.changedFiles);
+    report.freshness[record.id] = touched === null || !workingTree.available ? "unknown" : hits.length || localHits.length ? "changed" : "current";
   }
-  return records.sort((a, b) => a.id.localeCompare(b.id));
+  return report;
 }
 
 // src/review/cochange.ts
@@ -125,6 +567,8 @@ var MIN_COCHANGE_RATE = 0.6;
 var MAX_COMMIT_FILES = 30;
 async function buildMatrix(resolvedRoot) {
   try {
+    const { stdout: shallow } = await exec4("git", ["rev-parse", "--is-shallow-repository"], { cwd: resolvedRoot });
+    if (shallow.trim() === "true") return null;
     const { stdout } = await exec4(
       "git",
       ["log", `-n${HISTORY_COMMITS}`, "--format=%x01", "--name-only", "-M"],
@@ -132,7 +576,7 @@ async function buildMatrix(resolvedRoot) {
     );
     const commitsByFile = /* @__PURE__ */ new Map();
     const blocks = stdout.split("
");
-    let index = 0;
+    let index2 = 0;
     for (const block of blocks) {
       const files = block.split("\n").map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith(".mason/"));
       if (files.length === 0 || files.length > MAX_COMMIT_FILES) continue;
@@ -142,19 +586,19 @@ async function buildMatrix(resolvedRoot) {
           set = /* @__PURE__ */ new Set();
           commitsByFile.set(file, set);
         }
-        set.add(index);
+        set.add(index2);
       }
-      index++;
+      index2++;
     }
-    return { commitsByFile, totalCommits: index };
+    return { commitsByFile, totalCommits: index2 };
   } catch {
     return null;
   }
 }
-async function findMissingPartners(resolvedRoot, changedFiles, existsOnDisk) {
+async function findMissingPartners(resolvedRoot, changedFiles, existsOnDisk, allChangedFiles = changedFiles) {
   const matrix = await buildMatrix(resolvedRoot);
   if (!matrix) return null;
-  const changedSet = new Set(changedFiles);
+  const changedSet = new Set(allChangedFiles);
   const findings = [];
   for (const changedFile of changedFiles) {
     const fileCommits = matrix.commitsByFile.get(changedFile);
@@ -182,12 +626,397 @@ async function findMissingPartners(resolvedRoot, changedFiles, existsOnDisk) {
   return findings;
 }
 
+// src/review/evidence.ts
+import path10 from "path";
+import { z as z5 } from "zod";
+
+// src/review/evidence/vitest.ts
+import { z as z3 } from "zod";
+
+// src/review/evidence/paths.ts
+function evidencePath(value, sourceRoot, uri = false) {
+  if (value.length > 4e3) return null;
+  let file = value;
+  try {
+    if (uri) {
+      if (file.startsWith("file:")) {
+        const url = new URL(file);
+        if (url.hostname && url.hostname !== "localhost") return null;
+        file = decodeURIComponent(url.pathname).replace(/^\/([A-Za-z]:\/)/, "$1");
+      } else {
+        if (/^[a-z][a-z0-9+.-]*:/i.test(file)) return null;
+        file = decodeURIComponent(file);
+      }
+    }
+  } catch {
+    return null;
+  }
+  file = file.replace(/\\/g, "/");
+  const root = sourceRoot.replace(/\\/g, "/").replace(/\/+$/, "");
+  if (file.startsWith("/") || /^[A-Za-z]:/.test(file)) {
+    if (!file.startsWith(root + "/")) return null;
+    file = file.slice(root.length + 1);
+  }
+  return normalizeRepoPath(file);
+}
+
+// src/review/evidence/types.ts
+var MAX_FINDINGS = 200;
+function messagePreview(message2) {
+  return { message: message2.slice(0, 4e3), ...message2.length > 4e3 ? { truncated: true } : {} };
+}
+
+// src/review/evidence/vitest.ts
+var count = z3.number().int().nonnegative();
+var schema = z3.object({
+  success: z3.boolean(),
+  numTotalTests: count,
+  numPassedTests: count,
+  numFailedTests: count,
+  numPendingTests: count,
+  numTodoTests: count,
+  numFailedTestSuites: count,
+  testResults: z3.array(z3.object({
+    name: z3.string().min(1),
+    status: z3.enum(["passed", "failed"]),
+    message: z3.string().optional(),
+    assertionResults: z3.array(z3.object({
+      fullName: z3.string(),
+      status: z3.enum(["passed", "failed", "pending", "skipped", "todo", "disabled"]),
+      failureMessages: z3.array(z3.string()).nullable().optional(),
+      location: z3.object({ line: count, column: count }).nullable().optional()
+    }))
+  }))
+});
+function parseVitest(raw, sourceRoot) {
+  const report = schema.parse(raw);
+  const findings = [], diagnostics = [];
+  let passed = 0, failed = 0, skipped = 0;
+  for (const [index2, suite] of report.testResults.entries()) {
+    const file = evidencePath(suite.name, sourceRoot);
+    if (!file) diagnostics.push(`Test path is outside the declared checkout or invalid: ${suite.name}`);
+    let suiteFailures = 0;
+    for (const [testIndex, test] of suite.assertionResults.entries()) {
+      if (test.status === "passed") passed++;
+      else if (test.status === "failed") {
+        failed++;
+        suiteFailures++;
+        findings.push({
+          id: `${index2}:${testIndex}`,
+          ...messagePreview([test.fullName, ...test.failureMessages ?? []].join("\n")),
+          severity: "error",
+          state: "active",
+          locations: file ? [{ file, ...test.location ? { line: test.location.line, column: test.location.column } : {} }] : []
+        });
+      } else skipped++;
+    }
+    if (suite.status === "failed" && !suiteFailures) {
+      findings.push({ id: `${index2}:suite`, ...messagePreview(suite.message || `Test suite failed: ${suite.name}`), severity: "error", state: "active", locations: file ? [{ file }] : [] });
+    }
+  }
+  if (passed !== report.numPassedTests || failed !== report.numFailedTests || skipped !== report.numPendingTests + report.numTodoTests || passed + failed + skipped !== report.numTotalTests) {
+    throw new Error("Vitest summary counts disagree with its assertion results");
+  }
+  const hasFailures = failed > 0 || report.numFailedTestSuites > 0 || report.testResults.some((s) => s.status === "failed");
+  if (report.success && hasFailures) throw new Error("Vitest success conflicts with failed tests or suites");
+  const outcome = hasFailures || !report.success ? "failed" : !report.numTotalTests ? "unavailable" : !passed ? "skipped" : "passed";
+  if (!report.numTotalTests) diagnostics.push("No tests executed; an empty report is not passing test evidence.");
+  if (skipped) diagnostics.push(`${skipped} tests were skipped, pending, disabled, or todo.`);
+  return {
+    outcome,
+    findings,
+    counts: { total: report.numTotalTests, passed, failed, skipped, failedSuites: report.numFailedTestSuites },
+    incomplete: skipped > 0 || diagnostics.length > 0,
+    diagnostics
+  };
+}
+
+// src/review/evidence/sarif.ts
+import { z as z4 } from "zod";
+var index = z4.number().int().nonnegative();
+var artifact = z4.object({ uri: z4.string().optional(), uriBaseId: z4.string().optional(), index: index.optional() });
+var message = z4.object({ text: z4.string().optional(), markdown: z4.string().optional(), id: z4.string().optional(), arguments: z4.array(z4.string()).optional() });
+var level = z4.enum(["error", "warning", "note", "none"]);
+var location = z4.object({ physicalLocation: z4.object({ artifactLocation: artifact.optional(), region: z4.object({ startLine: index.optional(), startColumn: index.optional() }).optional() }).optional() });
+var schema2 = z4.object({
+  version: z4.literal("2.1.0"),
+  runs: z4.array(z4.object({
+    tool: z4.object({ driver: z4.object({ name: z4.string().min(1), rules: z4.array(z4.object({ id: z4.string(), defaultConfiguration: z4.object({ level: level.optional() }).optional(), messageStrings: z4.record(message).optional() })).optional(), globalMessageStrings: z4.record(message).optional() }) }),
+    invocations: z4.array(z4.object({ executionSuccessful: z4.boolean(), commandLine: z4.string().optional(), toolExecutionNotifications: z4.array(z4.object({ level: level.optional(), message })).optional() })).optional(),
+    versionControlProvenance: z4.array(z4.object({ revisionId: z4.string().optional() })).optional(),
+    originalUriBaseIds: z4.record(artifact).optional(),
+    artifacts: z4.array(z4.object({ location: artifact.optional() })).optional(),
+    results: z4.array(z4.object({
+      ruleId: z4.string().optional(),
+      ruleIndex: index.optional(),
+      message,
+      level: level.optional(),
+      kind: z4.enum(["fail", "pass", "open", "informational", "notApplicable", "review"]).optional(),
+      baselineState: z4.enum(["new", "unchanged", "updated", "absent"]).optional(),
+      suppressions: z4.array(z4.object({ kind: z4.enum(["inSource", "external"]), status: z4.enum(["accepted", "underReview", "rejected"]).optional() })).nullable().optional(),
+      locations: z4.array(location).optional(),
+      relatedLocations: z4.array(location).optional()
+    })).optional()
+  }))
+});
+function parseSarif(raw, sourceRoot) {
+  const report = schema2.parse(raw), findings = [], diagnostics = [];
+  let active = 0, suppressed = 0, absent = 0, unresolved = 0;
+  let executed = report.runs.length > 0, executionFailed = false;
+  const reportedCommits = [], reportedCommands = [], reportedTools = [];
+  for (const [runIndex, run] of report.runs.entries()) {
+    reportedTools.push(run.tool.driver.name);
+    reportedCommits.push(...(run.versionControlProvenance ?? []).flatMap((v) => v.revisionId ? [v.revisionId] : []));
+    if (!run.invocations?.length) executed = false;
+    for (const invocation of run.invocations ?? []) {
+      if (invocation.commandLine) reportedCommands.push(invocation.commandLine);
+      if (!invocation.executionSuccessful) executionFailed = true;
+      for (const notification of invocation.toolExecutionNotifications ?? []) {
+        diagnostics.push(notification.message.text ?? notification.message.markdown ?? "SARIF tool execution notification");
+        if (notification.level === "error") executionFailed = true;
+      }
+    }
+    if (!run.results) {
+      diagnostics.push(`Run ${runIndex} omits results; analysis output is unavailable.`);
+      executed = false;
+    }
+    const resolve = (ref, seen = /* @__PURE__ */ new Set()) => {
+      if (!ref.uri && ref.index !== void 0) {
+        const key = `artifact:${ref.index}`;
+        if (seen.has(key)) return null;
+        const entry = run.artifacts?.[ref.index]?.location;
+        return entry ? resolve(entry, /* @__PURE__ */ new Set([...seen, key])) : null;
+      }
+      if (!ref.uri) return null;
+      if (!ref.uriBaseId) return ref.uri;
+      if (seen.has(ref.uriBaseId)) return null;
+      const base = run.originalUriBaseIds?.[ref.uriBaseId];
+      if (!base) return null;
+      const prefix = resolve(base, /* @__PURE__ */ new Set([...seen, ref.uriBaseId]));
+      if (!prefix) return null;
+      return /^[a-z][a-z0-9+.-]*:/i.test(ref.uri) ? ref.uri : prefix + ref.uri;
+    };
+    for (const [resultIndex, result] of (run.results ?? []).entries()) {
+      const kind = result.kind ?? "fail";
+      const isSuppressed = result.suppressions?.some((s) => s.status === "accepted");
+      if (result.suppressions?.some((s) => !s.status || s.status === "underReview")) {
+        diagnostics.push(`Suppression state unresolved for result ${runIndex}:${resultIndex}.`);
+        unresolved++;
+      }
+      const state = result.baselineState === "absent" ? "absent" : isSuppressed ? "suppressed" : kind === "fail" ? "active" : "informational";
+      if (state === "active") active++;
+      if (state === "absent") absent++;
+      if (state === "suppressed") suppressed++;
+      if (["open", "review"].includes(kind) && state === "informational") {
+        unresolved++;
+        diagnostics.push(`Result ${runIndex}:${resultIndex} needs further analysis or review.`);
+      }
+      if (kind === "pass" || kind === "notApplicable") continue;
+      const rule = result.ruleIndex !== void 0 ? run.tool.driver.rules?.[result.ruleIndex] : run.tool.driver.rules?.find((rule2) => rule2.id === result.ruleId);
+      const template = result.message.id ? rule?.messageStrings?.[result.message.id] ?? run.tool.driver.globalMessageStrings?.[result.message.id] : void 0;
+      const rawMessage = result.message.text ?? result.message.markdown ?? template?.text ?? template?.markdown;
+      if (!rawMessage) diagnostics.push(`Message cannot be resolved for result ${runIndex}:${resultIndex}.`);
+      const rendered = (rawMessage ?? `Unresolved SARIF message ${result.message.id ?? ""}`).replace(/\{(\d+)\}/g, (match, n) => result.message.arguments?.[Number(n)] ?? match);
+      const locations = [];
+      for (const entry of [...result.locations ?? [], ...result.relatedLocations ?? []]) {
+        const ref = entry.physicalLocation?.artifactLocation;
+        const uri = ref ? resolve(ref) : null;
+        const file = uri ? evidencePath(uri, sourceRoot, true) : null;
+        if (file) locations.push({ file, line: entry.physicalLocation?.region?.startLine, column: entry.physicalLocation?.region?.startColumn });
+        else diagnostics.push(`Unresolved or out-of-checkout location for result ${runIndex}:${resultIndex}.`);
+      }
+      const severity = result.level ?? rule?.defaultConfiguration?.level ?? (kind === "fail" ? "warning" : "none");
+      findings.push({ id: `${runIndex}:${resultIndex}`, ruleId: result.ruleId ?? rule?.id, ...messagePreview(rendered), severity: severity === "none" ? "note" : severity, state, locations });
+    }
+  }
+  if (!report.runs.length) diagnostics.push("SARIF contains no analysis runs.");
+  if (executionFailed) diagnostics.push("The SARIF tool reported an unsuccessful analysis invocation.");
+  return {
+    outcome: executionFailed || !report.runs.length || report.runs.some((r) => !r.results) ? "unavailable" : active ? "failed" : "passed",
+    findings,
+    counts: { active, suppressed, absent, unresolved },
+    incomplete: diagnostics.length > 0,
+    diagnostics,
+    reportedCommits,
+    reportedCommands,
+    reportedTools,
+    executed: executed && !executionFailed
+  };
+}
+
+// src/review/evidence.ts
+var checkSchema = z5.object({
+  id: z5.string().min(1).max(100),
+  kind: z5.enum(["tests", "static-analysis", "security", "complexity", "duplication"]),
+  tool: z5.string().min(1).max(200),
+  command: z5.string().min(1).max(2e3),
+  commit: z5.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).nullable().optional(),
+  workingTreeClean: z5.boolean().optional(),
+  source: z5.string().max(2e3).optional(),
+  sourceRoot: z5.string().min(1).max(4e3).optional(),
+  status: z5.enum(["completed", "skipped", "unavailable"]).default("completed"),
+  reason: z5.string().min(1).max(2e3).optional(),
+  exitCode: z5.number().int().nullable().optional(),
+  report: z5.object({ format: z5.enum(["vitest-json", "sarif"]), path: z5.string().min(1).max(4e3) }).optional()
+});
+function relativeArtifact(root, file) {
+  const relative = path10.isAbsolute(file) ? path10.relative(root, file) : file;
+  const normalized = normalizeRepoPath(relative);
+  if (!normalized) throw new Error(`Evidence artifact must be inside the repository: ${file}`);
+  return normalized;
+}
+function linkFinding(finding, changed, pairs, decisions, freshness) {
+  const located = [...new Set(finding.locations.map((l) => l.file))];
+  const paired = pairs.filter((pair) => located.includes(pair.test));
+  const relatedChangedFiles = located.filter((file) => changed.has(file)).map((file) => ({ file, relationship: "direct" }));
+  for (const pair of paired) {
+    if (changed.has(pair.source) && !relatedChangedFiles.some((f) => f.file === pair.source)) relatedChangedFiles.push({ file: pair.source, relationship: "paired-test", confidence: pair.confidence });
+  }
+  const allFiles = [.../* @__PURE__ */ new Set([...located, ...paired.map((pair) => pair.source)])];
+  const acceptedDecisions = decisions.filter((d) => d.status === "active" && decisionApproval(d) === "accepted").map((d) => ({ d, viaFiles: matchingPaths(d.files, allFiles) })).filter((match) => match.viaFiles.length).map(({ d, viaFiles }) => {
+    const state = freshness[d.id] ?? "unknown", provenance = decisionProvenance(d, state);
+    return { id: d.id, title: d.title, owner: provenance.owner, freshness: state, reviewRequired: provenance.reviewRequired, viaFiles };
+  });
+  return { ...finding, relatedChangedFiles, acceptedDecisions: acceptedDecisions.slice(0, 5), totalAcceptedDecisions: acceptedDecisions.length };
+}
+async function collectReviewEvidence(root, manifests, changedFiles, decisions, decisionFreshness = {}, reviewedHead) {
+  const [headHash, workingTree] = await Promise.all([reviewedHead ?? getCurrentGitHash(root), getWorkingTree(root)]);
+  const output = {
+    version: 1,
+    scope: "committed",
+    headHash,
+    status: "unavailable",
+    checks: [],
+    diagnostics: [],
+    workingTree,
+    summary: { passed: 0, failed: 0, skipped: 0, unavailable: 0, stale: 0, unknown: 0 },
+    hint: "Evidence describes the recorded check runs for a commit, not uncommitted edits or complete test coverage. Commands and CI provenance are imported assertions, not authenticated execution. File and test-pair associations identify relevant decisions; they do not prove a decision was violated. Missing checks must be declared in the manifest to be reported."
+  };
+  const seen = /* @__PURE__ */ new Set(), changed = new Set(changedFiles);
+  let pairs;
+  if (manifests.length > 10) output.diagnostics.push("Only the first 10 evidence manifests were imported.");
+  for (const supplied of manifests.slice(0, 10)) {
+    let manifest, raw;
+    try {
+      manifest = relativeArtifact(root, supplied);
+      raw = z5.object({ version: z5.literal(1), checks: z5.array(z5.unknown()) }).parse(await readStoreJson(root, manifest));
+    } catch (error) {
+      output.diagnostics.push(`${supplied}: ${String(error)}`);
+      continue;
+    }
+    if (!raw.checks.length) output.diagnostics.push(`${manifest}: no checks declared.`);
+    for (const [index2, item] of raw.checks.entries()) {
+      if (output.checks.length >= 50) {
+        output.diagnostics.push("Only the first 50 checks were imported.");
+        break;
+      }
+      const input = checkSchema.safeParse(item);
+      if (!input.success) {
+        output.diagnostics.push(`${manifest} check ${index2}: ${input.error.message}`);
+        continue;
+      }
+      const check = input.data;
+      if (seen.has(check.id)) {
+        output.diagnostics.push(`Duplicate check id ${check.id}; give different runs distinct ids.`);
+        continue;
+      }
+      seen.add(check.id);
+      const result = {
+        id: check.id,
+        kind: check.kind,
+        tool: check.tool,
+        command: check.command,
+        commit: check.commit?.toLowerCase() ?? null,
+        workingTreeClean: check.workingTreeClean ?? null,
+        source: check.source ?? null,
+        manifest,
+        report: check.report ?? null,
+        outcome: "unavailable",
+        freshness: "unknown",
+        findings: [],
+        totalFindings: 0,
+        counts: {},
+        incomplete: false,
+        diagnostics: [],
+        truncated: false
+      };
+      output.checks.push(result);
+      if (check.workingTreeClean !== true) result.diagnostics.push("The check's working tree was dirty or not recorded; its results cannot be attributed to the claimed commit alone.");
+      else if (result.commit && headHash !== "unknown") result.freshness = result.commit === headHash.toLowerCase() ? "current" : "stale";
+      else result.diagnostics.push("The tested commit or reviewed HEAD is unknown.");
+      if (check.status !== "completed") {
+        result.outcome = check.status;
+        result.diagnostics.push(check.reason ?? "No reason was recorded for this skipped or unavailable check.");
+        continue;
+      }
+      try {
+        if (!check.report) throw new Error("Completed check has no report artifact.");
+        if (check.kind === "tests" !== (check.report.format === "vitest-json")) throw new Error("Test checks require vitest-json; analysis checks require sarif.");
+        const file = relativeArtifact(root, check.report.path);
+        const report = await readStoreJson(root, file);
+        if (report === null) throw new Error(`Report artifact is missing: ${file}`);
+        const sourceRoot = check.sourceRoot ?? root;
+        if (!path10.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
+        const parsed = check.report.format === "vitest-json" ? parseVitest(report, sourceRoot) : parseSarif(report, sourceRoot);
+        result.outcome = parsed.outcome;
+        result.counts = parsed.counts;
+        result.incomplete = parsed.incomplete;
+        result.diagnostics.push(...parsed.diagnostics);
+        result.reportedCommands = parsed.reportedCommands;
+        result.reportedTools = parsed.reportedTools;
+        if (parsed.reportedCommits?.some((commit) => !result.commit || commit.toLowerCase() !== result.commit)) {
+          result.freshness = "unknown";
+          result.incomplete = true;
+          result.diagnostics.push("Report revision metadata conflicts with, or cannot be tied to, the manifest's tested commit.");
+        }
+        if (check.exitCode == null && !parsed.executed) {
+          result.incomplete = true;
+          result.diagnostics.push("Neither an exit code nor successful analysis invocation was recorded; completion cannot be confirmed.");
+        }
+        if (check.exitCode != null && check.exitCode !== 0 && result.outcome === "passed") {
+          result.outcome = "failed";
+          result.diagnostics.push(`Check command exited ${check.exitCode} despite a report with no active failures.`);
+        }
+        if (check.report.format === "vitest-json" && pairs === void 0) {
+          try {
+            pairs = (await buildTestMap(root)).paired;
+          } catch (error) {
+            pairs = [];
+            output.diagnostics.push(`Test pairing unavailable: ${String(error)}`);
+          }
+        }
+        result.totalFindings = parsed.findings.length;
+        const testPairs = check.kind === "tests" ? pairs ?? [] : [];
+        const relevant = /* @__PURE__ */ new Set([...changed, ...testPairs.filter((p) => changed.has(p.source)).map((p) => p.test)]);
+        const touchesChange = (f) => f.locations.some((l) => relevant.has(l.file));
+        parsed.findings.sort((a, b) => Number(b.state === "active") - Number(a.state === "active") || Number(touchesChange(b)) - Number(touchesChange(a)));
+        result.findings = parsed.findings.slice(0, MAX_FINDINGS).map((f) => linkFinding(f, changed, testPairs, decisions, decisionFreshness));
+        result.truncated = parsed.findings.length > MAX_FINDINGS || result.findings.some((f) => f.truncated || f.totalAcceptedDecisions > f.acceptedDecisions.length);
+      } catch (error) {
+        result.outcome = "unavailable";
+        result.incomplete = true;
+        result.diagnostics.push(String(error));
+      }
+    }
+  }
+  if (!output.checks.length) output.diagnostics.push("No readable checks were imported.");
+  for (const check of output.checks) {
+    output.summary[check.outcome]++;
+    if (check.freshness !== "current") output.summary[check.freshness]++;
+  }
+  if (output.checks.some((c) => c.outcome === "failed" && c.freshness === "current")) output.status = "failed";
+  else if (!output.checks.length || output.checks.every((c) => c.outcome === "unavailable")) output.status = "unavailable";
+  else if (output.diagnostics.length || output.checks.some((c) => c.outcome !== "passed" || c.freshness !== "current" || c.incomplete)) output.status = "incomplete";
+  else output.status = "passed";
+  return output;
+}
+
 // src/review/review.ts
 var exec5 = promisify5(execFile5);
 var MAX_ANALYZED_FILES = 50;
-async function resolveMergeBase(resolvedRoot, base) {
+async function resolveMergeBase(resolvedRoot, base, head) {
   try {
-    const { stdout } = await exec5("git", ["merge-base", base, "HEAD"], {
+    const { stdout } = await exec5("git", ["merge-base", base, head], {
       cwd: resolvedRoot
     });
     return stdout.trim() || null;
@@ -208,24 +1037,17 @@ async function defaultBase(resolvedRoot) {
   return null;
 }
 function anchorsTouched(record, changedFiles) {
-  return changedFiles.filter(
-    (file) => record.files.some((anchor) => {
-      const a = anchor.replace(/\/+$/, "");
-      return a === file || file.startsWith(`${a}/`);
-    })
-  );
+  return matchingPaths(record.files, changedFiles);
 }
-async function computeReview(rootDir, base) {
-  const resolvedRoot = path7.resolve(rootDir);
-  const mergeBase = await resolveMergeBase(resolvedRoot, base);
+async function computeReview(rootDir, base, options = {}) {
+  const resolvedRoot = path11.resolve(rootDir);
+  const head = await getCurrentGitHash(resolvedRoot);
+  if (head === "unknown") return null;
+  const mergeBase = await resolveMergeBase(resolvedRoot, base, head);
   if (!mergeBase) return null;
-  const changes = await getChangesWithStatus(resolvedRoot, mergeBase);
+  const changes = await getChangesWithStatus(resolvedRoot, mergeBase, head);
   if (changes === null) return null;
-  const changedFiles = [
-    ...new Set(
-      changes.filter((c) => c.status !== "deleted").map((c) => c.path)
-    )
-  ].sort();
+  const changedFiles = touchedPaths(changes);
   const report = {
     version: 1,
     root: resolvedRoot,
@@ -237,7 +1059,27 @@ async function computeReview(rootDir, base) {
     historyAvailable: true,
     truncated: false
   };
-  if (changedFiles.length === 0) return report;
+  const store = await loadDecisionStore(resolvedRoot);
+  report.diagnostics = store.diagnostics;
+  const decisionDrift = await computeDecisionDrift(resolvedRoot, store.records);
+  if (options.evidence !== void 0) {
+    report.evidence = await collectReviewEvidence(resolvedRoot, options.evidence, changedFiles, store.records, decisionDrift.freshness, head);
+    if (store.diagnostics.length) {
+      report.evidence.diagnostics.push("Invalid decision records make knowledge associations incomplete; consult review diagnostics.");
+      if (report.evidence.status === "passed") report.evidence.status = "incomplete";
+    }
+  }
+  const finalize = async () => {
+    if (report.evidence && await getCurrentGitHash(resolvedRoot) !== head) {
+      report.evidence.diagnostics.push("HEAD changed during the review; rerun to obtain consistent change and knowledge associations.");
+      for (const check of report.evidence.checks) check.freshness = "unknown";
+      report.evidence.summary.stale = 0;
+      report.evidence.summary.unknown = report.evidence.checks.length;
+      if (report.evidence.status !== "unavailable") report.evidence.status = "incomplete";
+    }
+    return report;
+  };
+  if (changedFiles.length === 0) return finalize();
   let analyzed = changedFiles;
   if (changedFiles.length > MAX_ANALYZED_FILES) {
     analyzed = changedFiles.slice(0, MAX_ANALYZED_FILES);
@@ -248,38 +1090,41 @@ async function computeReview(rootDir, base) {
     analyzed,
     async (relPath) => {
       try {
-        await fs5.access(path7.join(resolvedRoot, relPath));
+        await fs5.access(path11.join(resolvedRoot, relPath));
         return true;
       } catch {
         return false;
       }
-    }
+    },
+    changedFiles
   );
   if (partners === null) {
     report.historyAvailable = false;
   } else {
     report.missingPartners = partners;
   }
-  const decisions = await loadDecisions(resolvedRoot);
+  const decisions = store.records;
   for (const record of decisions) {
     if (record.status !== "active" || record.files.length === 0) continue;
     const touched = anchorsTouched(record, changedFiles);
     if (touched.length > 0) {
       report.touchedDecisions.push({
+        ...decisionProvenance(record, decisionDrift.freshness?.[record.id] ?? "unknown"),
         id: record.id,
         title: record.title,
         body: record.body,
         category: record.category,
         anchors: record.files,
+        freshness: decisionDrift.freshness?.[record.id] ?? "unknown",
         touchedFiles: touched
       });
     }
   }
-  return report;
+  return finalize();
 }
 
 // src/review/cli.ts
-var USAGE = `Usage: mason-review [--dir <path>] [--base <ref>] [--json]
+var USAGE = `Usage: mason-review [--dir <path>] [--base <ref>] [--json] [--evidence <manifest>] [--require-evidence]
 
 Reviews the current branch's diff against what git history and the Mason
 decision store know:
@@ -294,18 +1139,26 @@ Options:
   --base <ref>   Base ref to diff against via merge-base (default: origin/HEAD,
                  origin/main, origin/master, or main \u2013 first that resolves)
   --json         Full report as JSON (additive-only schema)
+  --evidence <manifest>  Import a CI evidence manifest (repeatable; paths inside --dir)
+  --require-evidence    Require current, complete passing evidence; needs --evidence
   --help         Show this help
 
 Exit codes:
   0  no missing co-change partners (touched decisions alone do not fail)
   1  missing co-change partners found
-  2  error (base unresolvable, not a git repository, bad arguments)`;
+  2  error (base unresolvable, not a git repository, bad arguments)
+
+Evidence is advisory unless --require-evidence is set. With that flag, current
+failed checks also exit 1; missing, skipped, stale, or incomplete evidence exits 2.
+No check command from an imported report is executed.`;
 function parseArgs(argv) {
   const parsed = {
     dir: process.cwd(),
     base: void 0,
     json: false,
-    help: false
+    help: false,
+    evidence: [],
+    requireEvidence: false
   };
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
@@ -321,19 +1174,52 @@ function parseArgs(argv) {
       const value = argv[++i];
       if (!value) throw new Error("--base requires a ref argument");
       parsed.base = value;
+    } else if (arg === "--evidence") {
+      const value = argv[++i];
+      if (!value || value.startsWith("--")) throw new Error("--evidence requires a manifest path");
+      parsed.evidence.push(value);
+    } else if (arg === "--require-evidence") {
+      parsed.requireEvidence = true;
     } else if (!arg.startsWith("-") && parsed.dir === process.cwd()) {
       parsed.dir = arg;
     } else {
       throw new Error(`Unknown argument: ${arg}`);
     }
   }
+  if (parsed.requireEvidence && !parsed.evidence.length) throw new Error("--require-evidence requires at least one --evidence manifest");
   return parsed;
 }
+var display = (value, limit = 500) => stripVTControlCharacters(value).replace(/[\r\n\t]/g, " ").slice(0, limit);
+function evidenceSummary(report) {
+  const evidence = report.evidence;
+  if (!evidence) return [];
+  const lines = [`Imported CI evidence: ${evidence.status} (commit ${evidence.headHash.slice(0, 12)}; committed scope).`];
+  for (const diagnostic of evidence.diagnostics) lines.push(`  Evidence unavailable: ${display(diagnostic)}`);
+  for (const check of evidence.checks) {
+    lines.push(`  [${check.kind}] ${display(check.id)}: ${check.outcome}, ${check.freshness} (${display(check.tool)})`);
+    lines.push(`    command: ${display(check.command)}; tested commit: ${check.commit ?? "unknown"}`);
+    lines.push(`    source: ${display(check.source ?? check.manifest)}; report: ${display(check.report?.path ?? "none")}`);
+    if (Object.keys(check.counts).length) lines.push(`    counts: ${JSON.stringify(check.counts)}`);
+    for (const diagnostic of check.diagnostics.slice(0, 5)) lines.push(`    note: ${display(diagnostic)}`);
+    for (const finding of check.findings.slice(0, 10)) {
+      const locations = finding.locations.map((l) => `${l.file}${l.line ? `:${l.line}` : ""}`).join(", ") || "no resolved file location";
+      lines.push(`    [${finding.state}/${finding.severity}] ${display(finding.ruleId ?? finding.id)} ${display(locations)}: ${display(finding.message)}`);
+      if (finding.relatedChangedFiles.length) lines.push(`      changed files: ${finding.relatedChangedFiles.map((f) => `${display(f.file)} (${f.relationship}${f.confidence ? `, ${f.confidence}` : ""})`).join(", ")}`);
+      for (const decision of finding.acceptedDecisions) lines.push(`      related accepted decision: ${display(decision.id)}; owner ${display(decision.owner ?? "unknown")}; freshness ${decision.freshness}${decision.reviewRequired ? "; needs review" : ""}`);
+    }
+    if (check.totalFindings > 10 || check.truncated || check.diagnostics.length > 5) lines.push(`    Output abbreviated (${check.totalFindings} findings); inspect --json and the original artifact for full evidence.`);
+  }
+  if (!evidence.workingTree.available) lines.push("  Working-tree state unavailable; imported evidence only describes the recorded commit.");
+  else if (evidence.workingTree.changedFiles.length) lines.push(`  ${evidence.workingTree.changedFiles.length} uncommitted paths are outside this evidence's scope.`);
+  lines.push("  Related decisions are associations, not proven violations. Passing imported checks do not establish complete coverage.");
+  return lines;
+}
 function formatReviewSummary(report) {
   const lines = [];
   lines.push(
     `Diff vs ${report.base} (merge-base ${report.mergeBase.slice(0, 7)}): ${report.changedFiles.length} changed file${report.changedFiles.length === 1 ? "" : "s"}.`
   );
+  for (const diagnostic of report.diagnostics ?? []) lines.push(`Invalid decision record ${diagnostic.path}: ${diagnostic.message}`);
   if (report.truncated) {
     lines.push(
       `Large diff \u2013 co-change analysis limited to the first ${50} files.`
@@ -353,16 +1239,19 @@ function formatReviewSummary(report) {
     }
   }
   if (report.touchedDecisions.length > 0) {
-    lines.push("Recorded decisions touched by this diff (constraints \u2013 verify the diff respects them):");
+    lines.push("Recorded decisions touched by this diff (check approval and freshness before relying on them):");
     for (const d of report.touchedDecisions) {
       lines.push(
-        `  [decision] ${d.title} (${d.category}; via ${d.touchedFiles.join(", ")})`
+        `  [decision] ${d.title} (${d.category}; ${d.approval ?? "unreviewed"}; owner ${d.owner ?? "unknown"}; freshness ${d.freshness ?? "unknown"}; via ${d.touchedFiles.join(", ")})`
       );
+      if (d.sources?.length) lines.push(`    sources: ${d.sources.map((s) => s.reference).join(", ")}`);
+      if (d.lastReview) lines.push(`    last review: ${d.lastReview.reviewer} at ${d.lastReview.gitHash.slice(0, 7)}`);
     }
   }
   lines.push(
     report.missingPartners.length === 0 ? "No missing co-change partners." : `${report.missingPartners.length} possible omission${report.missingPartners.length === 1 ? "" : "s"}.`
   );
+  lines.push(...evidenceSummary(report));
   return lines.join("\n");
 }
 async function runReviewCli(argv, io = {
@@ -383,7 +1272,7 @@ async function runReviewCli(argv, io = {
     io.out(USAGE);
     return 0;
   }
-  const rootDir = path8.resolve(args.dir);
+  const rootDir = path12.resolve(args.dir);
   const base = args.base ?? await defaultBase(rootDir);
   if (!base) {
     io.err(
@@ -391,7 +1280,7 @@ async function runReviewCli(argv, io = {
     );
     return 2;
   }
-  const report = await computeReview(rootDir, base);
+  const report = await computeReview(rootDir, base, args.evidence.length ? { evidence: args.evidence } : {});
   if (!report) {
     io.err(
       `Could not resolve a merge base between ${base} and HEAD in ${rootDir} \u2013 not a git repository, unknown ref, or unrelated histories.`
@@ -402,7 +1291,9 @@ async function runReviewCli(argv, io = {
     io.out(JSON.stringify(report, null, 2));
   } else {
     io.out(formatReviewSummary(report));
+    if (args.evidence.length && !args.requireEvidence) io.out("Imported evidence is advisory for exit codes; use --require-evidence to require current passing checks.");
   }
+  if (args.requireEvidence && report.evidence?.status !== "passed") return report.evidence?.status === "failed" ? 1 : 2;
   return report.missingPartners.length > 0 ? 1 : 0;
 }