progmune-runtime 2.1.5 → 3.2.0

package/dist/audit/formatters/terminal.js

@@ -0,0 +1,189 @@
+"use strict";
+/**
+ * Phase 9: Terminal Formatter
+ *
+ * Human-readable governance report with ANSI color coding.
+ * Pattern follows semantic-trace.ts rendering conventions.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatAsTerminal = formatAsTerminal;
+// ANSI color helpers (same palette as semantic-trace.ts)
+const C = {
+    reset: "\x1b[0m",
+    bold: "\x1b[1m",
+    dim: "\x1b[2m",
+    green: "\x1b[32m",
+    yellow: "\x1b[33m",
+    red: "\x1b[31m",
+    cyan: "\x1b[36m",
+    blue: "\x1b[34m",
+    magenta: "\x1b[35m",
+    white: "\x1b[37m",
+};
+const BOX_H = "─";
+const BOX_V = "│";
+const BOX_TL = "┌";
+const BOX_TR = "┐";
+const BOX_BL = "└";
+const BOX_BR = "┘";
+function bar(value, max, width = 20) {
+    const filled = Math.round((value / (max || 1)) * width);
+    return "█".repeat(filled) + "░".repeat(width - filled);
+}
+function percent(v) {
+    return `${(v * 100).toFixed(0)}%`;
+}
+function verdictColor(v) {
+    if (v === "PASS")
+        return C.green;
+    if (v === "WARN")
+        return C.yellow;
+    return C.red;
+}
+function severityColor(s) {
+    if (s === "critical")
+        return C.red;
+    if (s === "high")
+        return C.yellow;
+    if (s === "medium")
+        return C.cyan;
+    return C.dim;
+}
+function formatAsTerminal(report) {
+    const { metadata, sessions, ssv, plsb, provenance, antibodies, verdict, recommendations, business } = report;
+    const lines = [];
+    // ── Header ──
+    lines.push("");
+    lines.push(`${C.bold}${C.cyan}${BOX_TL}${BOX_H.repeat(58)}${BOX_TR}${C.reset}`);
+    lines.push(`${C.bold}${C.cyan}${BOX_V}${C.reset} ${C.bold}AI Code Governance Report${C.reset}${" ".repeat(30)}${C.bold}${C.cyan}${BOX_V}${C.reset}`);
+    lines.push(`${C.bold}${C.cyan}${BOX_V}${C.reset} ${C.dim}Progmune Runtime — AI Generated Software Governance${C.reset}${" ".repeat(3)}${C.bold}${C.cyan}${BOX_V}${C.reset}`);
+    lines.push(`${C.bold}${C.cyan}${BOX_BL}${BOX_H.repeat(58)}${BOX_BR}${C.reset}`);
+    lines.push("");
+    // ── Metadata ──
+    lines.push(`${C.bold}Metadata${C.reset}`);
+    lines.push(`  Generator:   ${metadata.generator} v${metadata.version}`);
+    lines.push(`  Timestamp:   ${metadata.timestamp}`);
+    lines.push(`  Project:     ${metadata.projectId}`);
+    lines.push("");
+    // ── Verdict ──
+    const vc = verdictColor(verdict);
+    lines.push(`${C.bold}Verdict:${C.reset} ${vc}${C.bold}${verdict}${C.reset}`);
+    lines.push("");
+    // ── Sessions ──
+    lines.push(`${C.bold}Sessions${C.reset}`);
+    lines.push(`  Total:       ${sessions.total}`);
+    lines.push(`  Verified:    ${C.green}${sessions.verified}${C.reset}`);
+    lines.push(`  Compromised: ${sessions.compromised > 0 ? C.red : C.green}${sessions.compromised}${C.reset}`);
+    if (sessions.total > 0) {
+        lines.push(`  Coverage:    ${bar(sessions.verified, sessions.total)} ${percent(sessions.verified / sessions.total)}`);
+    }
+    lines.push("");
+    // ── SSV ──
+    lines.push(`${C.bold}Semantic State Verification (SSV)${C.reset}`);
+    lines.push(`  Checks: ${ssv.totalChecks} total, ${C.green}${ssv.passed} passed${C.reset}, ${ssv.failed > 0 ? C.red : ""}${ssv.failed} failed${C.reset}`);
+    if (ssv.failed > 0) {
+        lines.push(`  ${C.red}⚠ Ledger inconsistencies detected${C.reset}`);
+    }
+    lines.push("");
+    // ── PLSB ──
+    lines.push(`${C.bold}Protocol Lifecycle Security Benchmark (PLSB)${C.reset}`);
+    lines.push(`  Version:     v${plsb.version}`);
+    lines.push(`  Entries:     ${plsb.totalEntries} (${plsb.verifiedEntries} verified)`);
+    lines.push(`  Coverage:    ${bar(plsb.coverage, 1)} ${percent(plsb.coverage)}`);
+    lines.push(`  Recall:      ${percent(plsb.recall)}`);
+    lines.push(`  Precision:   ${percent(plsb.precision)}`);
+    lines.push(`  Covered:     ${plsb.matchedCategories.length > 0 ? plsb.matchedCategories.join(", ") : C.dim + "(none)" + C.reset}`);
+    if (plsb.unmatchedCategories.length > 0) {
+        lines.push(`  Uncovered:   ${C.yellow}${plsb.unmatchedCategories.join(", ")}${C.reset}`);
+    }
+    lines.push("");
+    // ── Provenance ──
+    lines.push(`${C.bold}Provenance (Ledger Integrity)${C.reset}`);
+    lines.push(`  Fingerprints: ${provenance.totalFingerprints} total`);
+    lines.push(`  Verified:     ${C.green}${provenance.verified}${C.reset}`);
+    lines.push(`  Tampered:     ${provenance.tampered > 0 ? C.red : C.green}${provenance.tampered}${C.reset}`);
+    lines.push(`  Not Found:    ${provenance.notFound}`);
+    lines.push("");
+    // ── Antibodies ──
+    lines.push(`${C.bold}Immune System (Antibodies)${C.reset}`);
+    lines.push(`  Hits:         ${antibodies.totalHits}`);
+    lines.push(`  Fast-path:    ${antibodies.fastPathHits}`);
+    lines.push(`  LLM saved:    ${antibodies.llmCallsSaved} calls, ${antibodies.tokensSaved.toLocaleString()} tokens`);
+    if (antibodies.topSignatures.length > 0) {
+        lines.push(`  Top patterns: ${antibodies.topSignatures.slice(0, 3).join(", ")}`);
+    }
+    lines.push("");
+    // ── Session Details ──
+    if (sessions.details.length > 0 && sessions.details.length <= 10) {
+        lines.push(`${C.bold}Session Details${C.reset}`);
+        for (const d of sessions.details) {
+            const status = d.fingerprintTampered ? `${C.red}⚠ TAMPERED${C.reset}`
+                : d.consistencyPassed ? `${C.green}✓${C.reset}`
+                    : `${C.yellow}⚠ VIOLATIONS${C.reset}`;
+            lines.push(`  ${status} ${d.sessionId.slice(0, 24)}... | ${d.validTransitions}/${d.transitionCount} valid | intent: ${d.intent.slice(0, 40)}`);
+        }
+        lines.push("");
+    }
+    // ── Business Translation (Trust Report) ──
+    if (business) {
+        const biz = business;
+        lines.push(`${C.bold}╔══════════════════════════════════════════════════════╗${C.reset}`);
+        lines.push(`${C.bold}║${C.reset} ${C.bold}Governance Summary — 治理摘要${C.reset}                          ${C.bold}║${C.reset}`);
+        lines.push(`${C.bold}╚══════════════════════════════════════════════════════╝${C.reset}`);
+        lines.push("");
+        // Summary stats
+        lines.push(`${C.bold}Protected Against${C.reset}`);
+        lines.push(`  ${C.green}✓${C.reset} ${biz.summary.totalRisksMitigated} risk categories mitigated`);
+        lines.push(`  ${C.green}✓${C.reset} ${biz.summary.knowledgeDomainsCovered} business knowledge domains covered`);
+        lines.push(`  ${C.green}✓${C.reset} ${biz.summary.businessProtocolsIntact} business protocol edges verified`);
+        lines.push("");
+        // Risk table
+        lines.push(`${C.bold}Risk Protection${C.reset}`);
+        for (const r of biz.risks) {
+            const icon = r.status === "protected" ? `${C.green}🛡` : r.status === "partial" ? `${C.yellow}⚠` : `${C.red}✗`;
+            const statusLabel = r.status === "protected" ? "已防护" : r.status === "partial" ? "部分防护" : "未防护";
+            lines.push(`  ${icon} ${r.category}  [${statusLabel}]`);
+            lines.push(`    ${C.dim}${r.description}${C.reset}`);
+            lines.push(`    ${C.dim}协议覆盖: ${r.protocolsCovered} | 违规预防: ${r.violationsPrevented}${C.reset}`);
+        }
+        lines.push("");
+        // Knowledge Coverage
+        lines.push(`${C.bold}Knowledge Coverage — 业务知识覆盖${C.reset}`);
+        for (const k of biz.knowledgeCoverage) {
+            const icon = k.coverage === "full" ? C.green + "✓" : k.coverage === "partial" ? C.yellow + "◐" : C.red + "✗";
+            const label = k.coverage === "full" ? "完整覆盖" : k.coverage === "partial" ? "部分覆盖" : "未覆盖";
+            const entities = k.entities?.length ? ` (${k.entities.join(", ")})` : "";
+            lines.push(`  ${icon} ${k.domain}${entities} ${C.dim}[${label}]${C.reset}`);
+        }
+        lines.push("");
+        // Protocol Graph
+        if (biz.protocolGraph.length > 0) {
+            lines.push(`${C.bold}Business Protocol Graph — 业务协议图${C.reset}`);
+            lines.push(`  ${C.dim}All ${biz.summary.businessProtocolsIntact} edges verified — no AI-generated code violated business protocol edges${C.reset}`);
+            // Show first 8 edges in compact form
+            for (const e of biz.protocolGraph.slice(0, 8)) {
+                const check = e.verified ? C.green + "✓" : C.red + "✗";
+                lines.push(`  ${check} ${e.from} ${C.dim}→${C.reset} ${e.to} ${C.dim}${e.label}${C.reset}`);
+            }
+            if (biz.protocolGraph.length > 8) {
+                lines.push(`  ${C.dim}... and ${biz.protocolGraph.length - 8} more protocol edges${C.reset}`);
+            }
+            lines.push("");
+        }
+    }
+    // ── Recommendations ──
+    if (recommendations.length > 0) {
+        lines.push(`${C.bold}Recommendations${C.reset}`);
+        for (const r of recommendations) {
+            const sc = severityColor(r.severity);
+            lines.push(`  ${sc}[${r.severity.toUpperCase()}]${C.reset} ${r.message}`);
+            lines.push(`  ${C.dim}→ ${r.action}${C.reset}`);
+        }
+        lines.push("");
+    }
+    // ── Footer ──
+    lines.push(`${C.dim}${BOX_H.repeat(60)}${C.reset}`);
+    lines.push(`${C.dim}Report generated by Progmune Runtime — AI Generated Software Governance${C.reset}`);
+    lines.push("");
+    return lines.join("\n");
+}

package/dist/audit/index.js

@@ -0,0 +1,25 @@
+"use strict";
+/**
+ * Phase 9: Governance Audit Module
+ *
+ * Public API for AI Code Governance Reports.
+ * Re-exports the builder, types, and formatters.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectProjectType = exports.buildBusinessSummary = exports.getProtocolGraph = exports.getKnowledgeCoverage = exports.translateToBusinessRisks = exports.formatAsHTML = exports.formatAsMarkdown = exports.formatAsTerminal = exports.formatAsJSON = exports.buildGovernanceReport = void 0;
+var report_builder_1 = require("./report-builder");
+Object.defineProperty(exports, "buildGovernanceReport", { enumerable: true, get: function () { return report_builder_1.buildGovernanceReport; } });
+var json_1 = require("./formatters/json");
+Object.defineProperty(exports, "formatAsJSON", { enumerable: true, get: function () { return json_1.formatAsJSON; } });
+var terminal_1 = require("./formatters/terminal");
+Object.defineProperty(exports, "formatAsTerminal", { enumerable: true, get: function () { return terminal_1.formatAsTerminal; } });
+var markdown_1 = require("./formatters/markdown");
+Object.defineProperty(exports, "formatAsMarkdown", { enumerable: true, get: function () { return markdown_1.formatAsMarkdown; } });
+var html_1 = require("./formatters/html");
+Object.defineProperty(exports, "formatAsHTML", { enumerable: true, get: function () { return html_1.formatAsHTML; } });
+var business_translator_1 = require("./business-translator");
+Object.defineProperty(exports, "translateToBusinessRisks", { enumerable: true, get: function () { return business_translator_1.translateToBusinessRisks; } });
+Object.defineProperty(exports, "getKnowledgeCoverage", { enumerable: true, get: function () { return business_translator_1.getKnowledgeCoverage; } });
+Object.defineProperty(exports, "getProtocolGraph", { enumerable: true, get: function () { return business_translator_1.getProtocolGraph; } });
+Object.defineProperty(exports, "buildBusinessSummary", { enumerable: true, get: function () { return business_translator_1.buildBusinessSummary; } });
+Object.defineProperty(exports, "detectProjectType", { enumerable: true, get: function () { return business_translator_1.detectProjectType; } });

package/dist/audit/report-builder.js

@@ -0,0 +1,318 @@
+"use strict";
+/**
+ * Phase 9: Governance Report Builder
+ *
+ * Aggregates data from the corpus, fingerprints, PLSB benchmark,
+ * and immune system into a single GovernanceReport.
+ *
+ * Pure aggregation — no new verification logic.
+ * All data already exists in .progmune_corpus/ and benchmarks/.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildGovernanceReport = buildGovernanceReport;
+const crypto = __importStar(require("crypto"));
+// ── Main Entry Point ──
+function buildGovernanceReport(projectPath, options = {}) {
+    const metadata = buildMetadata(projectPath);
+    const sessions = buildSessions(options.sessionId);
+    const ssv = buildSSV(sessions, options);
+    const plsb = options.fast ? emptyPLSB() : buildPLSBFromBenchmark();
+    const provenance = buildProvenance();
+    const antibodies = buildAntibodies();
+    const business = buildBusinessSection(plsb, sessions, projectPath, options);
+    const recommendations = generateRecommendations(sessions, ssv, provenance, plsb);
+    const verdict = computeVerdict(sessions, ssv, provenance, recommendations);
+    return {
+        metadata,
+        sessions,
+        ssv,
+        plsb,
+        provenance,
+        antibodies,
+        verdict,
+        recommendations,
+        business, // Phase 10: Business Translation
+    };
+}
+// ── Metadata ──
+function buildMetadata(projectPath) {
+    return {
+        generator: "progmune-runtime",
+        version: "3.2.0",
+        timestamp: new Date().toISOString(),
+        projectId: crypto.createHash("sha256").update(projectPath).digest("hex").slice(0, 16),
+        validator: "SSG + Ledger + PLSB",
+    };
+}
+// ── Sessions ──
+function buildSessions(sessionId) {
+    const { getAllSessions } = require("../failure-corpus");
+    const sessions = getAllSessions();
+    let filtered = sessions;
+    if (sessionId) {
+        filtered = sessions.filter((s) => s.sessionId === sessionId || s.sessionId?.startsWith(sessionId));
+    }
+    const details = [];
+    for (const s of filtered) {
+        let trans = [];
+        // Collect transitions from attempts
+        for (const a of s.attempts || []) {
+            trans = trans.concat(a.transitions || []);
+        }
+        // Check ledger consistency
+        let consistencyPassed = false;
+        let violations = 0;
+        try {
+            const { checkLedgerConsistency } = require("../ssg-validator");
+            const { getNsInit } = require("../protocol-registry");
+            const result = checkLedgerConsistency(trans, getNsInit());
+            consistencyPassed = result.consistent;
+            violations = (result.violations || []).length;
+        }
+        catch { /* best-effort */ }
+        // Verify fingerprint
+        let fingerprintVerified = false;
+        let fingerprintTampered = false;
+        try {
+            const { verifyFingerprint } = require("../ledger-registry");
+            const fp = verifyFingerprint(s.sessionId, trans);
+            fingerprintVerified = fp.valid;
+            fingerprintTampered = fp.tampered;
+        }
+        catch { /* best-effort */ }
+        const validTrans = trans.filter((t) => t.valid !== false).length;
+        details.push({
+            sessionId: s.sessionId || "unknown",
+            intent: s.intent || "",
+            transitionCount: trans.length,
+            validTransitions: validTrans,
+            invalidTransitions: trans.length - validTrans,
+            fingerprintVerified,
+            fingerprintTampered,
+            consistencyPassed,
+            violations,
+        });
+    }
+    const verified = details.filter((d) => d.fingerprintVerified).length;
+    const compromised = details.filter((d) => d.fingerprintTampered).length;
+    return { total: filtered.length, verified, compromised, details };
+}
+// ── SSV (Semantic State Verification) ──
+function buildSSV(sessions, _options) {
+    let totalChecks = 0;
+    let passed = 0;
+    let failed = 0;
+    const byCategory = {};
+    const allViolations = [];
+    for (const d of sessions.details) {
+        totalChecks++;
+        if (d.consistencyPassed) {
+            passed++;
+        }
+        else {
+            failed++;
+        }
+        // Category is "ledger" — all violations are ledger consistency
+        const cat = "ledger";
+        if (!byCategory[cat])
+            byCategory[cat] = { total: 0, passed: 0, failed: 0 };
+        byCategory[cat].total++;
+        if (d.consistencyPassed) {
+            byCategory[cat].passed++;
+        }
+        else {
+            byCategory[cat].failed++;
+        }
+    }
+    return { totalChecks, passed, failed, byCategory, violations: allViolations };
+}
+// ── PLSB ──
+function buildPLSBFromBenchmark() {
+    try {
+        const { buildPLSB, PROTOCOL_WEAKNESS_TAXONOMY } = require("../plsb-benchmark");
+        const benchmark = buildPLSB();
+        const taxonomyIds = PROTOCOL_WEAKNESS_TAXONOMY.map((t) => t.id);
+        const matched = new Set(Object.keys(benchmark.metadata?.byPLS || {}));
+        const matchedCategories = taxonomyIds.filter((id) => matched.has(id));
+        const unmatchedCategories = taxonomyIds.filter((id) => !matched.has(id));
+        return {
+            version: benchmark.version || "1.0",
+            totalEntries: benchmark.metadata?.total || 0,
+            verifiedEntries: benchmark.metadata?.verified || 0,
+            coverage: matchedCategories.length / (taxonomyIds.length || 1),
+            recall: benchmark.metadata?.recall || 0,
+            precision: benchmark.metadata?.precision || 0,
+            matchedCategories,
+            unmatchedCategories,
+        };
+    }
+    catch {
+        return emptyPLSB();
+    }
+}
+function emptyPLSB() {
+    return {
+        version: "1.0",
+        totalEntries: 0,
+        verifiedEntries: 0,
+        coverage: 0,
+        recall: 0,
+        precision: 0,
+        matchedCategories: [],
+        unmatchedCategories: [],
+    };
+}
+// ── Provenance ──
+function buildProvenance() {
+    try {
+        const { verifyAllFingerprints } = require("../ledger-registry");
+        const summary = verifyAllFingerprints();
+        return {
+            totalFingerprints: summary.total || 0,
+            verified: summary.valid || 0,
+            tampered: summary.tampered || 0,
+            notFound: summary.notFound || 0,
+        };
+    }
+    catch {
+        return { totalFingerprints: 0, verified: 0, tampered: 0, notFound: 0 };
+    }
+}
+// ── Antibodies ──
+function buildAntibodies() {
+    try {
+        const { getAntibodyStats } = require("../failure-corpus");
+        const stats = getAntibodyStats();
+        return {
+            totalHits: stats.totalHits || 0,
+            fastPathHits: stats.fastPathHits || 0,
+            llmCallsSaved: stats.totalLLMCallsSaved || 0,
+            tokensSaved: stats.totalTokensSaved || 0,
+            topSignatures: (stats.topSignatures || []).slice(0, 5).map((s) => typeof s === "string" ? s : s.signature || "").filter(Boolean),
+            byLevel: stats.byLevel || {},
+        };
+    }
+    catch {
+        return {
+            totalHits: 0, fastPathHits: 0, llmCallsSaved: 0, tokensSaved: 0,
+            topSignatures: [], byLevel: {},
+        };
+    }
+}
+// ── Business Translation (Phase 10) ──
+function buildBusinessSection(plsb, sessions, _projectPath, options) {
+    if (options.business === false)
+        return undefined;
+    try {
+        const { translateToBusinessRisks, getKnowledgeCoverage, getProtocolGraph, buildBusinessSummary, detectProjectType } = require("./business-translator");
+        // Auto-detect project type for domain-specific knowledge
+        const detectedType = detectProjectType(_projectPath);
+        const violationsByCategory = {};
+        for (const d of sessions.details) {
+            if (d.violations > 0) {
+                // Categorize violations (simplified)
+                violationsByCategory["认证与授权"] = (violationsByCategory["认证与授权"] || 0) + d.violations;
+            }
+        }
+        const risks = translateToBusinessRisks(plsb.matchedCategories, plsb.unmatchedCategories, violationsByCategory);
+        const knowledge = getKnowledgeCoverage(detectedType);
+        const protocolGraph = getProtocolGraph(detectedType);
+        const summary = buildBusinessSummary(risks, knowledge, violationsByCategory, detectedType);
+        return { risks, knowledgeCoverage: knowledge, protocolGraph, summary };
+    }
+    catch (e) {
+        // Best-effort: if business translator fails, skip the section
+        return undefined;
+    }
+}
+// ── Recommendations ──
+function generateRecommendations(sessions, ssv, provenance, plsb) {
+    const recs = [];
+    if (provenance.tampered > 0) {
+        recs.push({
+            severity: "critical",
+            category: "provenance",
+            message: `${provenance.tampered} fingerprint(s) show tampered hashes.`,
+            action: `Run 'progmune_check' and review .progmune_corpus/fingerprints/ for tampered sessions.`,
+        });
+    }
+    if (ssv.failed > 0) {
+        recs.push({
+            severity: "critical",
+            category: "ssv",
+            message: `${ssv.failed} session(s) have ledger consistency violations.`,
+            action: `Run 'progmune_repair(sessionId="...")' to generate fix proposals for each failed session.`,
+        });
+    }
+    if (sessions.total > 0 && sessions.verified / sessions.total < 0.8) {
+        recs.push({
+            severity: "high",
+            category: "coverage",
+            message: `Only ${sessions.verified}/${sessions.total} sessions verified.`,
+            action: `Run 'npm run check' to register missing fingerprints.`,
+        });
+    }
+    if (provenance.notFound > 0) {
+        recs.push({
+            severity: "medium",
+            category: "provenance",
+            message: `${provenance.notFound} fingerprint(s) reference missing session files.`,
+            action: `Fingerprints without sessions can be manually reviewed or removed from .progmune_corpus/fingerprints/.`,
+        });
+    }
+    if (plsb.coverage < 0.7) {
+        recs.push({
+            severity: "medium",
+            category: "plsb",
+            message: `PLSB coverage is ${(plsb.coverage * 100).toFixed(0)}% — ${plsb.unmatchedCategories.length} categories uncovered: ${plsb.unmatchedCategories.join(", ")}.`,
+            action: `Add protocol rules for uncovered PLS categories to improve detection coverage.`,
+        });
+    }
+    return recs;
+}
+// ── Verdict ──
+function computeVerdict(sessions, ssv, provenance, recommendations) {
+    const hasCritical = recommendations.some((r) => r.severity === "critical");
+    if (provenance.tampered > 0)
+        return "FAIL";
+    if (ssv.failed > 0)
+        return "FAIL";
+    if (hasCritical)
+        return "FAIL";
+    if (sessions.total > 0 && sessions.verified / sessions.total < 0.8)
+        return "WARN";
+    return "PASS";
+}

package/dist/audit/types.js

@@ -0,0 +1,8 @@
+"use strict";
+/**
+ * Phase 9: Governance Report Types
+ *
+ * Structured data model for the AI Code Governance Report.
+ * Every field maps to data already present in .progmune_corpus/.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/audit.js

@@ -161,7 +161,7 @@ function formatAuditResult(result) {
             lines.push("");
         }
     }
-    catch { }
+    catch { /* audit step — best-effort */ }
     // Phase 7: Violation Analytics
     try {
         const repairDir = ".progmune_corpus/repairs";
@@ -176,7 +176,7 @@ function formatAuditResult(result) {
                         bySvl[r.violation] = (bySvl[r.violation] || 0) + 1;
                         byConstraint[r.constraint] = (byConstraint[r.constraint] || 0) + 1;
                     }
-                    catch { }
+                    catch { /* audit step — best-effort */ }
                 }
                 lines.push(`  Repairs recorded: ${repairs.length}`);
                 const svlSummary = Object.entries(bySvl).map(([k, v]) => `${k}: ${v}`).join(" | ");
@@ -189,7 +189,7 @@ function formatAuditResult(result) {
             }
         }
     }
-    catch { }
+    catch { /* audit step — best-effort */ }
     if (result.sessions.length > 0) {
         lines.push(`  Last generation: ${result.lastGeneration || "unknown"}`);
         lines.push(`  Unique sessions:  ${new Set(result.sessions.map(s => s.sessionId)).size}`);