nexus-agents 2.145.0 → 2.146.0

package/dist/{chunk-5QACHQ47.js → chunk-256RUC4U.js}

@@ -18,7 +18,7 @@ import {
   DEFAULT_TASK_TTL_MS,
   DEFAULT_TOOL_RATE_LIMITS,
   clampTaskTtl
-} from "./chunk-4IELVEVP.js";
+} from "./chunk-XZ4QHFCD.js";
 import {
   executeExpert
 } from "./chunk-YJROHCFY.js";
@@ -41,24 +41,21 @@ import {
   toJobSummary,
   warnIfSimulatedOutsideTests,
   writeJobCancelled
-} from "./chunk-QKWS3REM.js";
+} from "./chunk-45QUEZNS.js";
 import {
   normalizeTopicToCanonical,
   synthesizeResearch
 } from "./chunk-SCPAYR65.js";
 import {
-  IssueTriage,
-  createAuditTrail,
-  createGraphAuditBridge,
-  emitPipelinePolicyEvent
-} from "./chunk-ZRRL3YB6.js";
+  IssueTriage
+} from "./chunk-I5T7GUM7.js";
 import {
   resolveEnvMode,
   sanitizeInput
 } from "./chunk-GEGV6DBO.js";
 import {
   withPrerequisite
-} from "./chunk-AREFLH3S.js";
+} from "./chunk-Y4NDNQYU.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -78,9 +75,15 @@ import {
   toolSuccess,
   toolSuccessStructured,
   withAccessPolicy,
+  withAuditTrail,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-J2KMYVWA.js";
+} from "./chunk-RII4VXHO.js";
+import {
+  createAuditTrail,
+  createGraphAuditBridge,
+  emitPipelinePolicyEvent
+} from "./chunk-RCQLUJY3.js";
 import {
   addResearchPaper,
   addSourceToRegistry,
@@ -32577,6 +32580,173 @@ function hashObjective(userObjective) {
   return createHash2("sha256").update(userObjective, "utf8").digest("hex").slice(0, 16);
 }
 
+// src/security/audit-bridge.ts
+var logger31 = createLogger({ component: "SecurityAuditBridge" });
+function systemActor(id, name) {
+  return name !== void 0 ? { type: "system", id, name } : { type: "system", id };
+}
+function userActor(username) {
+  return { type: "user", id: username };
+}
+function mapTrust(e) {
+  const severity = e.wasDowngraded ? "warning" : "info";
+  return {
+    category: "authorization",
+    severity,
+    outcome: "success",
+    action: "security.trust_classification",
+    actor: userActor(e.username),
+    description: e.reason,
+    metadata: {
+      assignedTier: e.assignedTier,
+      userRole: e.userRole,
+      isAllowlisted: e.isAllowlisted,
+      wasDowngraded: e.wasDowngraded,
+      component: e.component
+    }
+  };
+}
+function pipelinePolicyMetadata(e) {
+  return {
+    ...e.actionType !== void 0 ? { actionType: e.actionType } : {},
+    ...e.mode !== void 0 ? { mode: e.mode } : {},
+    ...e.ruleIds !== void 0 ? { ruleIds: e.ruleIds } : {},
+    ...e.stageType !== void 0 ? { stageType: e.stageType } : {},
+    ...e.recordKind !== void 0 ? { recordKind: e.recordKind } : {},
+    ...e.violationCount !== void 0 ? { violationCount: e.violationCount } : {}
+  };
+}
+function mapPolicyGate(e) {
+  const outcome = e.allowed ? "success" : "denied";
+  return {
+    category: "authorization",
+    severity: e.allowed ? "info" : "warning",
+    outcome,
+    action: "security.policy_gate",
+    actor: systemActor(e.component),
+    policyName: "security.policy_gate",
+    policyDecision: e.allowed ? "allow" : "deny",
+    ...e.violationRules.length > 0 ? { violationType: e.violationRules.join(",") } : {},
+    metadata: {
+      requiresApproval: e.requiresApproval,
+      inputTrustTier: e.inputTrustTier,
+      violationRules: e.violationRules,
+      ...pipelinePolicyMetadata(e)
+    }
+  };
+}
+function mapCorroboration(e) {
+  return {
+    category: "security",
+    severity: e.satisfied ? "info" : "warning",
+    outcome: e.satisfied ? "success" : "denied",
+    action: "security.corroboration",
+    actor: systemActor(e.component),
+    metadata: {
+      actionType: e.actionType,
+      sourceCount: e.sourceCount,
+      missingRequirements: e.missingRequirements
+    }
+  };
+}
+function mapReputation(e) {
+  return {
+    category: "security",
+    severity: e.isSuspicious ? "warning" : "info",
+    outcome: "success",
+    action: "security.reputation",
+    actor: userActor(e.username),
+    metadata: {
+      reputationScore: e.reputationScore,
+      isSuspicious: e.isSuspicious,
+      effectiveTier: e.effectiveTier,
+      signalCount: e.signalCount,
+      component: e.component
+    }
+  };
+}
+function mapSanitization(e) {
+  return {
+    category: "security",
+    severity: e.injectionFlagCount > 0 ? "warning" : "info",
+    outcome: "success",
+    action: "security.sanitization",
+    actor: systemActor(e.component, e.source),
+    metadata: {
+      source: e.source,
+      wasModified: e.wasModified,
+      strippedCount: e.strippedCount,
+      injectionFlagCount: e.injectionFlagCount,
+      strippedElements: e.strippedElements
+    }
+  };
+}
+function mapGraphExecution(e) {
+  return {
+    category: "system",
+    severity: "info",
+    outcome: "success",
+    action: "security.graph_execution",
+    actor: systemActor(e.component),
+    description: e.detail,
+    metadata: {
+      graphEvent: e.graphEvent,
+      ...e.nodeId !== void 0 ? { nodeId: e.nodeId } : {},
+      stepNumber: e.stepNumber
+    }
+  };
+}
+function mapClawGuard(e) {
+  return {
+    category: "authorization",
+    severity: "warning",
+    outcome: "success",
+    action: "security.clawguard_violation",
+    actor: systemActor(e.component),
+    metadata: {
+      toolName: e.toolName,
+      warning: e.warning,
+      policySource: e.policySource,
+      mode: e.mode,
+      requestId: e.requestId
+    }
+  };
+}
+function securityAuditEventToInput(event) {
+  switch (event.type) {
+    case "trust_classification":
+      return mapTrust(event);
+    case "policy_gate":
+      return mapPolicyGate(event);
+    case "corroboration":
+      return mapCorroboration(event);
+    case "reputation":
+      return mapReputation(event);
+    case "sanitization":
+      return mapSanitization(event);
+    case "graph_execution":
+      return mapGraphExecution(event);
+    case "clawguard_violation":
+      return mapClawGuard(event);
+  }
+}
+function createDurableAuditSink(auditLogger) {
+  return (event) => {
+    try {
+      auditLogger.log(securityAuditEventToInput(event));
+    } catch (error) {
+      logger31.warn("Failed to mirror security event to durable audit log", {
+        type: event.type,
+        error: getErrorMessage(error)
+      });
+    }
+  };
+}
+function createDurableAuditTrail(auditLogger) {
+  if (auditLogger === void 0) return void 0;
+  return createAuditTrail(createDurableAuditSink(auditLogger));
+}
+
 // src/context/structured-task-state.ts
 import * as fs4 from "fs";
 import * as path3 from "path";
@@ -32772,7 +32942,7 @@ var StructuredTaskLogEntrySchema = z54.discriminatedUnion("event", [
 ]);
 
 // src/context/structured-task-state.ts
-var logger31 = createLogger({ component: "structured-task-state" });
+var logger32 = createLogger({ component: "structured-task-state" });
 var TASKS_SUBDIR = "tasks";
 var FILE_MODE2 = 384;
 var DIR_MODE3 = 448;
@@ -32790,7 +32960,7 @@ function listTaskStateIds(customDir) {
   try {
     entries = fs4.readdirSync(dir);
   } catch (cause) {
-    logger31.warn("tasks directory unreadable", {
+    logger32.warn("tasks directory unreadable", {
       dir,
       error: cause instanceof Error ? cause.message : String(cause)
     });
@@ -32863,7 +33033,7 @@ function appendResult(taskId, result, ts, customDir) {
       maxBytes: TASK_RESULT_MAX_BYTES,
       note: "Result exceeded TASK_RESULT_MAX_BYTES \u2014 original dropped at write time."
     };
-    logger31.warn("Task result truncated at write", {
+    logger32.warn("Task result truncated at write", {
       taskId,
       bytes,
       max: TASK_RESULT_MAX_BYTES
@@ -32894,14 +33064,14 @@ function readTaskState(taskId, customDir) {
       if (validated.success) {
         entries.push(validated.data);
       } else {
-        logger31.warn("Skipping malformed task-state log entry", {
+        logger32.warn("Skipping malformed task-state log entry", {
           taskId,
           error: validated.error.message
         });
       }
     } catch (cause) {
       const msg = cause instanceof Error ? cause.message : String(cause);
-      logger31.warn("Skipping unparseable task-state log entry", { taskId, error: msg });
+      logger32.warn("Skipping unparseable task-state log entry", { taskId, error: msg });
     }
   }
   return reduceLogEntries(taskId, entries);
@@ -33376,6 +33546,7 @@ async function executeOrchestration(input, deps, opts = {}) {
   const definition = { type: "task", task };
   const hb = startHeartbeatTracking(`orchestrate-${taskId}`, logger58);
   const policy = await deriveOrchestratePolicy(input.task, deps, logger58, trustTier);
+  const auditTrail = createDurableAuditTrail(deps.auditLogger);
   try {
     return await runOrchestratorWithStateTracking({
       taskId,
@@ -33386,7 +33557,8 @@ async function executeOrchestration(input, deps, opts = {}) {
       decision,
       workflowRouter,
       startTime,
-      logger: logger58
+      logger: logger58,
+      ...auditTrail !== void 0 ? { auditTrail } : {}
     });
   } catch (error) {
     recordTaskStateBlocker(taskId, error instanceof Error ? error.message : String(error), logger58);
@@ -33397,9 +33569,13 @@ async function executeOrchestration(input, deps, opts = {}) {
   }
 }
 async function runOrchestratorWithStateTracking(params) {
-  const { taskId, taskInput, definition, orchestrator, policy, logger: logger58 } = params;
+  const { taskId, taskInput, definition, orchestrator, policy, logger: logger58, auditTrail } = params;
   recordTaskStateStage(taskId, "executing", logger58);
-  const result = await withAccessPolicy(policy, () => orchestrator.execute(definition, {}));
+  const runOrchestrator = () => orchestrator.execute(definition, {});
+  const result = await withAccessPolicy(
+    policy,
+    auditTrail !== void 0 ? () => withAuditTrail(auditTrail, runOrchestrator) : runOrchestrator
+  );
   if (!result.ok) {
     recordTaskStateBlocker(taskId, result.error.message, logger58);
     recordTaskStateStage(taskId, "failed", logger58);
@@ -36043,6 +36219,15 @@ async function classifyExpertResult(opts) {
     })
   };
 }
+async function executeExpertUnderPolicy(deps, expert, task, policyObjective) {
+  const policy = await deriveExpertAccessPolicy(policyObjective, deps.logger, void 0);
+  const auditTrail = createDurableAuditTrail(deps.auditLogger);
+  const runExpert2 = () => expert.execute(task);
+  return withAccessPolicy(
+    policy,
+    auditTrail !== void 0 ? () => withAuditTrail(auditTrail, runExpert2) : runExpert2
+  );
+}
 async function runExpertTask(deps, args, expert) {
   const { expertId } = args;
   const contextPrefix = await maybeFetchContextPrefix(args.task, deps.logger);
@@ -36068,8 +36253,7 @@ async function runExpertTask(deps, args, expert) {
       }, HEARTBEAT_TIMEOUTS.heartbeatIntervalMs);
       let result;
       try {
-        const policy = await deriveExpertAccessPolicy(policyObjective, deps.logger, void 0);
-        result = await withAccessPolicy(policy, () => expert.execute(task));
+        result = await executeExpertUnderPolicy(deps, expert, task, policyObjective);
       } finally {
         clearInterval(heartbeatTimer);
         monitor.endSession(sessionId);
@@ -39697,7 +39881,7 @@ function registerQueryTraceTool(server, deps) {
 import { z as z82 } from "zod";
 
 // src/mcp/jobs/task-state-source.ts
-var logger32 = createLogger({ component: "task-state-source" });
+var logger33 = createLogger({ component: "task-state-source" });
 var TOOL_NAME_BY_PREFIX = {
   orch: "orchestrate",
   // run_workflow mints `job-rw-<uuid>`; consensus_vote mints `job-vote-<uuid>`.
@@ -39779,7 +39963,7 @@ function resolveJobResult(jobId, customDir) {
   if (isTaskStateJobSource()) {
     const fromState = readJobResultFromTaskState(jobId, customDir);
     if (fromState !== null) {
-      logger32.debug("Resolved job result from task-state", { jobId, status: fromState.status });
+      logger33.debug("Resolved job result from task-state", { jobId, status: fromState.status });
       return fromState;
     }
   }
@@ -40921,7 +41105,7 @@ function createAuditLogger(config, storage, logger58, onPersistFailure) {
 }
 
 // src/pipeline/research-trigger.ts
-var logger33 = createLogger({ component: "research-trigger" });
+var logger34 = createLogger({ component: "research-trigger" });
 var DEFAULT_QUALITY_THRESHOLD = 7;
 var DEFAULT_MAX_TRIGGERS = 3;
 function parseDiscoveries(text) {
@@ -40960,7 +41144,7 @@ function checkForCapabilityGapTriggers(config = {}) {
     status: "pending"
   }));
   if (tasks.length > 0) {
-    logger33.info("Capability-gap triggers created", {
+    logger34.info("Capability-gap triggers created", {
       qualified: qualified.length,
       triggered: tasks.length
     });
@@ -40978,7 +41162,7 @@ async function checkForResearchTriggers(config = {}) {
       `Use research_discover to find recent papers and repos about "${topic}". For each result, include: title, quality score (1-10), and source URL.`
     );
     if (!result.success) {
-      logger33.debug("Research trigger: expert unavailable", { error: result.error });
+      logger34.debug("Research trigger: expert unavailable", { error: result.error });
       return [];
     }
     const discoveries = parseDiscoveries(result.text);
@@ -40994,7 +41178,7 @@ Assess this research for applicability to nexus-agents.`,
       status: "pending"
     }));
     if (tasks.length > 0) {
-      logger33.info("Research triggers created", {
+      logger34.info("Research triggers created", {
         total: discoveries.length,
         qualified: qualified.length,
         triggered: tasks.length
@@ -41002,7 +41186,7 @@ Assess this research for applicability to nexus-agents.`,
     }
     return tasks;
   } catch (error) {
-    logger33.debug("Research trigger failed gracefully", { error: String(error) });
+    logger34.debug("Research trigger failed gracefully", { error: String(error) });
     return [];
   }
 }
@@ -41026,7 +41210,7 @@ var PIPELINE_STATE_KEYS = {
 };
 
 // src/pipeline/pipeline-graph.ts
-var logger34 = createLogger({ component: "pipeline-graph" });
+var logger35 = createLogger({ component: "pipeline-graph" });
 function compilePipelineGraph(template, stages) {
   const missing = findMissingStages(template, stages);
   if (missing.length > 0) {
@@ -41043,10 +41227,10 @@ function compilePipelineGraph(template, stages) {
   const result = builder.compile();
   if (!result.ok) {
     const errMsg = formatCompileError(result.error);
-    logger34.warn("Pipeline graph compilation failed", { error: errMsg });
+    logger35.warn("Pipeline graph compilation failed", { error: errMsg });
     return { ok: false, error: errMsg };
   }
-  logger34.info("Pipeline graph compiled", {
+  logger35.info("Pipeline graph compiled", {
     template: template.id,
     stages: template.stages.length
   });
@@ -41123,7 +41307,7 @@ function registerLinearEdges(builder, stages) {
 }
 
 // src/pipeline/graph-pipeline-runner.ts
-var logger35 = createLogger({ component: "graph-pipeline-runner" });
+var logger36 = createLogger({ component: "graph-pipeline-runner" });
 var DEFAULT_MAX_STEPS2 = 20;
 async function runGraphPipeline(task, template, stages, options) {
   const startTime = getTimeProvider().now();
@@ -41142,7 +41326,7 @@ function compileEffectiveGraph(template, stages, options) {
   return { graph: compiled.graph };
 }
 async function executeAndReport(task, template, graph, options, startTime) {
-  logger35.info("Executing graph pipeline", {
+  logger36.info("Executing graph pipeline", {
     template: template.id,
     dryRun: options?.dryRun === true
   });
@@ -41248,7 +41432,7 @@ function listTemplateIds() {
 }
 
 // src/pipeline/adaptive-orchestrator.ts
-var logger36 = createLogger({ component: "adaptive-orchestrator" });
+var logger37 = createLogger({ component: "adaptive-orchestrator" });
 var PIPELINE_TYPE_KEYWORDS = {
   dev: [
     "implement",
@@ -41387,7 +41571,7 @@ async function tryIssueTriage(task) {
   try {
     const issueMatch = task.match(/github\.com\/([^/]+\/[^/]+)\/issues\/(\d+)/);
     if (issueMatch === null) return null;
-    const { createIssueTriage } = await import("./issue-triage-44OGWBDA.js");
+    const { createIssueTriage } = await import("./issue-triage-R7DMXIEN.js");
     const triage = createIssueTriage();
     const owner = issueMatch[1] ?? "";
     const num = issueMatch[2] ?? "";
@@ -41431,7 +41615,7 @@ async function classifyWithLLM(task) {
     const lower = result.text.toLowerCase().trim();
     for (const template of VALID_TEMPLATES) {
       if (lower.includes(template)) {
-        logger36.info("LLM classification refinement", { task: task.slice(0, 60), template });
+        logger37.info("LLM classification refinement", { task: task.slice(0, 60), template });
         return {
           pipelineType: template,
           complexity: "moderate",
@@ -41449,14 +41633,14 @@ async function classifyWithLLM(task) {
 async function runAdaptiveOrchestrator(task, options) {
   const sanitized = sanitizeInput(task, "collaborator", "pipeline");
   if (sanitized.strippedElements.length > 0) {
-    logger36.warn("Pipeline input sanitized", { stripped: sanitized.strippedElements.length });
+    logger37.warn("Pipeline input sanitized", { stripped: sanitized.strippedElements.length });
   }
   const cleanTask = sanitized.content;
   let classification = classifyTask(cleanTask);
   if (classification.confidence < LLM_REFINEMENT_THRESHOLD && options.templateId === void 0) {
     const enriched = await tryIssueTriage(cleanTask);
     if (enriched !== null) {
-      logger36.info("Classification enriched via issue_triage", {
+      logger37.info("Classification enriched via issue_triage", {
         original: classification.pipelineType,
         enriched: enriched.pipelineType
       });
@@ -41464,7 +41648,7 @@ async function runAdaptiveOrchestrator(task, options) {
     } else {
       const llmResult = await classifyWithLLM(cleanTask);
       if (llmResult !== null) {
-        logger36.info("Classification refined via LLM", {
+        logger37.info("Classification refined via LLM", {
           original: classification.pipelineType,
           refined: llmResult.pipelineType
         });
@@ -41475,7 +41659,7 @@ async function runAdaptiveOrchestrator(task, options) {
   const templateId = options.templateId ?? classification.pipelineType;
   const selectionMethod = options.templateId !== void 0 ? "explicit" : "auto-detected";
   const template = ensureRunnableTemplate(resolveTemplate(templateId), options.stages);
-  logger36.info("Adaptive orchestrator routing", {
+  logger37.info("Adaptive orchestrator routing", {
     templateId: template.id,
     selectionMethod,
     classification: classification.pipelineType,
@@ -41490,7 +41674,7 @@ function resolveTemplate(templateId) {
   const resolvedId = RETIRED_TEMPLATE_ALIASES[templateId] ?? templateId;
   const template = getTemplate(resolvedId);
   if (template !== void 0) return template;
-  logger36.warn("Unknown template, falling back to dev", { templateId });
+  logger37.warn("Unknown template, falling back to dev", { templateId });
   const fallback = PIPELINE_TEMPLATES.get("dev");
   if (fallback !== void 0) return fallback;
   return { id: "dev", name: "Development", stages: [] };
@@ -41502,7 +41686,7 @@ function ensureRunnableTemplate(template, stages) {
   for (const id of RUNNABLE_FALLBACK_TEMPLATES) {
     const candidate = PIPELINE_TEMPLATES.get(id);
     if (candidate !== void 0 && findMissingStages(candidate, stages).length === 0) {
-      logger36.warn("Selected template is not runnable in this registry \u2014 falling back", {
+      logger37.warn("Selected template is not runnable in this registry \u2014 falling back", {
         requested: template.id,
         missingStages: missing,
         fallback: id
@@ -41510,7 +41694,7 @@ function ensureRunnableTemplate(template, stages) {
       return candidate;
     }
   }
-  logger36.warn(
+  logger37.warn(
     "No runnable fallback template for this registry; compile will report missing stages",
     {
       requested: template.id,
@@ -41524,7 +41708,7 @@ function ensureRunnableTemplate(template, stages) {
 import * as fs7 from "fs";
 import * as path5 from "path";
 import { z as z86 } from "zod";
-var logger37 = createLogger({ component: "pipeline-checkpoint" });
+var logger38 = createLogger({ component: "pipeline-checkpoint" });
 var SESSION_ID_REGEX = /^[a-zA-Z0-9_-]{1,128}$/;
 function validateSessionId(sessionId) {
   return SESSION_ID_REGEX.test(sessionId);
@@ -41532,14 +41716,14 @@ function validateSessionId(sessionId) {
 function getCheckpointPath(sessionId, customDir) {
   const dirResult = ensureCheckpointDir(customDir);
   if (!dirResult.ok) {
-    logger37.warn("Checkpoint directory unavailable", { error: dirResult.error.message });
+    logger38.warn("Checkpoint directory unavailable", { error: dirResult.error.message });
     return null;
   }
   return path5.join(dirResult.value, `pipeline-${sessionId}.jsonl`);
 }
 function saveStageCheckpoint(sessionId, stage, data, customDir) {
   if (!validateSessionId(sessionId)) {
-    logger37.warn("Invalid session ID for checkpoint", { sessionId });
+    logger38.warn("Invalid session ID for checkpoint", { sessionId });
     return false;
   }
   const entry = {
@@ -41554,7 +41738,7 @@ function saveStageCheckpoint(sessionId, stage, data, customDir) {
     fs7.appendFileSync(filePath, JSON.stringify(entry) + "\n", { mode: 384 });
     return true;
   } catch (error) {
-    logger37.debug("Failed to save checkpoint", { stage, error: String(error) });
+    logger38.debug("Failed to save checkpoint", { stage, error: String(error) });
     return false;
   }
 }
@@ -41567,7 +41751,7 @@ function loadCheckpointState(sessionId, customDir) {
     const lines = content.trim().split("\n").filter(Boolean);
     return rebuildState(lines);
   } catch (error) {
-    logger37.debug("Failed to load checkpoints", { error: String(error) });
+    logger38.debug("Failed to load checkpoints", { error: String(error) });
     return null;
   }
 }
@@ -41624,7 +41808,7 @@ function rebuildState(lines) {
     applyEntry(state, result.data);
   }
   if (skippedCount > 0) {
-    logger37.warn("Skipped malformed checkpoint lines during state rebuild", {
+    logger38.warn("Skipped malformed checkpoint lines during state rebuild", {
       skippedCount,
       totalLines: lines.length,
       firstSkipReason,
@@ -41679,20 +41863,20 @@ function checkpointToResult(state) {
 }
 
 // src/orchestration/qa-loop.ts
-var logger38 = createLogger({ component: "qa-loop" });
+var logger39 = createLogger({ component: "qa-loop" });
 var DEFAULT_MAX_QA_ITERATIONS = 3;
 async function runQaLoop(implement, review, maxIterations = DEFAULT_MAX_QA_ITERATIONS) {
   let feedback;
   let lastOutput;
   let lastVerdict = "needs_work";
   for (let i = 1; i <= maxIterations; i++) {
-    logger38.info("QA loop iteration", { iteration: i, hasFeedback: feedback !== void 0 });
+    logger39.info("QA loop iteration", { iteration: i, hasFeedback: feedback !== void 0 });
     const output2 = await implement(feedback);
     lastOutput = output2;
     const reviewResult = await review(output2);
     lastVerdict = reviewResult.verdict;
     if (reviewResult.verdict === "pass") {
-      logger38.info("QA loop passed", { iteration: i });
+      logger39.info("QA loop passed", { iteration: i });
       return {
         output: output2,
         approved: true,
@@ -41701,14 +41885,14 @@ async function runQaLoop(implement, review, maxIterations = DEFAULT_MAX_QA_ITERA
         feedback: reviewResult.feedback
       };
     }
-    logger38.warn("QA loop rejected", {
+    logger39.warn("QA loop rejected", {
       iteration: i,
       verdict: reviewResult.verdict,
       issues: reviewResult.issues.length
     });
     feedback = reviewResult.feedback;
   }
-  logger38.warn("QA loop exhausted iterations", { maxIterations, lastVerdict });
+  logger39.warn("QA loop exhausted iterations", { maxIterations, lastVerdict });
   return {
     output: lastOutput,
     approved: false,
@@ -41718,151 +41902,6 @@ async function runQaLoop(implement, review, maxIterations = DEFAULT_MAX_QA_ITERA
   };
 }
 
-// src/security/audit-bridge.ts
-var logger39 = createLogger({ component: "SecurityAuditBridge" });
-function systemActor(id, name) {
-  return name !== void 0 ? { type: "system", id, name } : { type: "system", id };
-}
-function userActor(username) {
-  return { type: "user", id: username };
-}
-function mapTrust(e) {
-  const severity = e.wasDowngraded ? "warning" : "info";
-  return {
-    category: "authorization",
-    severity,
-    outcome: "success",
-    action: "security.trust_classification",
-    actor: userActor(e.username),
-    description: e.reason,
-    metadata: {
-      assignedTier: e.assignedTier,
-      userRole: e.userRole,
-      isAllowlisted: e.isAllowlisted,
-      wasDowngraded: e.wasDowngraded,
-      component: e.component
-    }
-  };
-}
-function pipelinePolicyMetadata(e) {
-  return {
-    ...e.actionType !== void 0 ? { actionType: e.actionType } : {},
-    ...e.mode !== void 0 ? { mode: e.mode } : {},
-    ...e.ruleIds !== void 0 ? { ruleIds: e.ruleIds } : {},
-    ...e.stageType !== void 0 ? { stageType: e.stageType } : {},
-    ...e.recordKind !== void 0 ? { recordKind: e.recordKind } : {},
-    ...e.violationCount !== void 0 ? { violationCount: e.violationCount } : {}
-  };
-}
-function mapPolicyGate(e) {
-  const outcome = e.allowed ? "success" : "denied";
-  return {
-    category: "authorization",
-    severity: e.allowed ? "info" : "warning",
-    outcome,
-    action: "security.policy_gate",
-    actor: systemActor(e.component),
-    policyName: "security.policy_gate",
-    policyDecision: e.allowed ? "allow" : "deny",
-    ...e.violationRules.length > 0 ? { violationType: e.violationRules.join(",") } : {},
-    metadata: {
-      requiresApproval: e.requiresApproval,
-      inputTrustTier: e.inputTrustTier,
-      violationRules: e.violationRules,
-      ...pipelinePolicyMetadata(e)
-    }
-  };
-}
-function mapCorroboration(e) {
-  return {
-    category: "security",
-    severity: e.satisfied ? "info" : "warning",
-    outcome: e.satisfied ? "success" : "denied",
-    action: "security.corroboration",
-    actor: systemActor(e.component),
-    metadata: {
-      actionType: e.actionType,
-      sourceCount: e.sourceCount,
-      missingRequirements: e.missingRequirements
-    }
-  };
-}
-function mapReputation(e) {
-  return {
-    category: "security",
-    severity: e.isSuspicious ? "warning" : "info",
-    outcome: "success",
-    action: "security.reputation",
-    actor: userActor(e.username),
-    metadata: {
-      reputationScore: e.reputationScore,
-      isSuspicious: e.isSuspicious,
-      effectiveTier: e.effectiveTier,
-      signalCount: e.signalCount,
-      component: e.component
-    }
-  };
-}
-function mapSanitization(e) {
-  return {
-    category: "security",
-    severity: e.injectionFlagCount > 0 ? "warning" : "info",
-    outcome: "success",
-    action: "security.sanitization",
-    actor: systemActor(e.component, e.source),
-    metadata: {
-      source: e.source,
-      wasModified: e.wasModified,
-      strippedCount: e.strippedCount,
-      injectionFlagCount: e.injectionFlagCount,
-      strippedElements: e.strippedElements
-    }
-  };
-}
-function mapGraphExecution(e) {
-  return {
-    category: "system",
-    severity: "info",
-    outcome: "success",
-    action: "security.graph_execution",
-    actor: systemActor(e.component),
-    description: e.detail,
-    metadata: {
-      graphEvent: e.graphEvent,
-      ...e.nodeId !== void 0 ? { nodeId: e.nodeId } : {},
-      stepNumber: e.stepNumber
-    }
-  };
-}
-function securityAuditEventToInput(event) {
-  switch (event.type) {
-    case "trust_classification":
-      return mapTrust(event);
-    case "policy_gate":
-      return mapPolicyGate(event);
-    case "corroboration":
-      return mapCorroboration(event);
-    case "reputation":
-      return mapReputation(event);
-    case "sanitization":
-      return mapSanitization(event);
-    case "graph_execution":
-      return mapGraphExecution(event);
-  }
-}
-function createDurableAuditSink(auditLogger) {
-  return (event) => {
-    try {
-      auditLogger.log(securityAuditEventToInput(event));
-    } catch (error) {
-      logger39.warn("Failed to mirror security event to durable audit log", {
-        type: event.type,
-        error: getErrorMessage(error)
-      });
-    }
-  };
-}
-
 // src/pipeline/dev-pipeline.ts
 var logger40 = createLogger({ component: "dev-pipeline" });
 function isApproved(result) {
@@ -43407,7 +43446,7 @@ ${contextBlock}`;
       const strategy = config.votingStrategy ?? "higher_order";
       await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
       try {
-        const { executeVoting } = await import("./consensus-vote-6V3JNRXI.js");
+        const { executeVoting } = await import("./consensus-vote-IBT3C5YC.js");
         const votingResult = await executeVoting(
           {
             proposal: buildVoteProposal(plan, research),
@@ -51024,6 +51063,7 @@ export {
   OrchestrationError,
   OrchestrationUnavailableError,
   createMockOrchestrator,
+  createDurableAuditSink,
   registerOrchestrateTool,
   MODEL_CAPABILITIES2 as MODEL_CAPABILITIES,
   DelegateInputSchema,
@@ -51136,7 +51176,6 @@ export {
   loadCheckpointState,
   cleanupCheckpoint2 as cleanupCheckpoint,
   checkpointToResult,
-  createDurableAuditSink,
   runDevPipeline,
   flushPipelineMemory,
   createAgentStages,
@@ -51189,4 +51228,4 @@ export {
   shutdownFeedbackSubscriber,
   createEventBusBridge
 };
-//# sourceMappingURL=chunk-5QACHQ47.js.map
+//# sourceMappingURL=chunk-256RUC4U.js.map