sigmap 7.11.0 → 7.13.0

package/CHANGELOG.md

@@ -10,6 +10,24 @@ Format: [Semantic Versioning](https://semver.org/)
 
 ---
 
+## [7.13.0] — 2026-06-17
+
+Minor release — `sigmap create` (grounded codegen, Gap 2 — the pipeline capstone).
+
+### Added
+- **`sigmap create "<task>"` — orchestrate the 4-stage grounded-creation pipeline (#316):** the capstone of the grounded-codegen work. One command sequences the four guard stages — `scaffold` → `verify-plan` → `verify-ai-output` → `review-pr` — with `1/4`…`4/4` numbering and a single pass/fail summary. Each stage runs only when its input is present (`--name` → scaffold, `--plan` → verify-plan, `--answer` → verify-ai-output, the git diff → review-pr); a stage with no input is skipped and does not fail the run. New zero-dependency, bundle-safe `src/create/orchestrate.js` (`orchestrate`) delegates to the real stage modules — no logic duplication. CLI supports `--name`, `--plan`, `--answer`, `--staged`/`--base`, and `--json`, and exits non-zero when a ran stage fails. This completes the grounded-creation loop: every root cause (1–4) is closed and all four guard stages are now sequenced by one command.
+
+---
+
+## [7.12.0] — 2026-06-17
+
+Minor release — `sigmap review-pr` (grounded codegen, Gap 2 — last guard stage).
+
+### Added
+- **`sigmap review-pr` — diff audit for drift + side effects (#313):** the last guard stage of the `sigmap create` pipeline (IMPL.md §6 step 4). After a PR is opened, it audits the diff for **scope drift** (too many distinct top-level dirs), **god-node edits** (changed files with transitive dependents above a threshold, via the impact graph), **missing tests** (a changed source file with no matching changed test), and **security-sensitive files** (`.env*`, auth, secrets, `package.json`/lockfiles, `.github/workflows/**`, Dockerfiles, keys). New zero-dependency, bundle-safe `src/review/review-pr.js` (`reviewPr`); deletions are excluded from the source/security checks. CLI `review-pr [--base <ref>] [--staged] [--json]` collects the diff via shell-free git and exits non-zero when any finding is present (CI-gate). With this, all four create-pipeline guard stages exist (`scaffold` → `verify-plan` → `verify-ai-output` → `review-pr`); the `sigmap create` orchestrator remains the final follow-up.
+
+---
+
 ## [7.11.0] — 2026-06-17
 
 Minor release — `sigmap verify-plan` (grounded codegen, Gap 2).

package/gen-context.js

@@ -27,6 +27,206 @@ function __require(key) {
 // ── ./src/scaffold/propose ──
 // ── ./src/plan/verify-plan ──
 // ── ./src/cache/freshen ──
+// ── ./src/review/review-pr ──
+// ── ./src/create/orchestrate ──
+__factories["./src/create/orchestrate"] = function(module, exports) {
+  
+  /**
+   * create orchestrator (IMPL.md §6.2 — the capstone of the grounded-creation loop).
+   *
+   * Sequences the four guard stages — scaffold → verify-plan → verify-ai-output →
+   * review-pr — in one pass with `n/4` numbering and a single pass/fail summary.
+   * The agent does the LLM writing between stages; `create` runs the deterministic
+   * guards it owns. A stage runs only when its input is present (else it is
+   * skipped, which does not fail the run). Zero-dependency, bundle-safe; delegates
+   * to the real stage modules.
+   */
+
+  const { proposeScaffold } = __require('./src/scaffold/propose');
+  const { verifyPlan } = __require('./src/plan/verify-plan');
+  const { verify } = __require('./src/verify/hallucination-guard');
+  const { reviewPr } = __require('./src/review/review-pr');
+
+  const TOTAL = 4;
+
+  /**
+   * Run the create pipeline over whatever inputs are available.
+   * @param {object} ctx
+   * @param {string} [ctx.task] free-text task label (echoed back)
+   * @param {string} [ctx.name] module name → enables the scaffold stage
+   * @param {object} [ctx.conventions] an `extractConventions` result (for scaffold)
+   * @param {object} [ctx.scaffoldOpts] options forwarded to `proposeScaffold`
+   * @param {string} [ctx.plan] plan markdown → enables verify-plan
+   * @param {string} [ctx.answer] AI answer markdown → enables verify-ai-output
+   * @param {Array<{path:string,status:string}>} [ctx.changedFiles] → enables review-pr
+   * @param {string} cwd repo root
+   * @returns {{ task: string|null, steps: object[], summary: object }}
+   */
+  function orchestrate(ctx = {}, cwd) {
+    const steps = [];
+
+    // 1/4 — scaffold (needs a name + conventions)
+    if (ctx.name && ctx.conventions) {
+      const d = proposeScaffold(ctx.name, ctx.conventions, ctx.scaffoldOpts || {});
+      steps.push({ n: 1, total: TOTAL, name: 'scaffold', ran: true, ok: !!d.ok, skipped: false, detail: d });
+    } else {
+      steps.push({ n: 1, total: TOTAL, name: 'scaffold', ran: false, ok: null, skipped: true, reason: 'no --name' });
+    }
+
+    // 2/4 — verify-plan (needs a plan)
+    if (ctx.plan != null && String(ctx.plan).trim() !== '') {
+      const r = verifyPlan(ctx.plan, cwd);
+      steps.push({ n: 2, total: TOTAL, name: 'verify-plan', ran: true, ok: !!r.summary.ok, skipped: false, detail: r });
+    } else {
+      steps.push({ n: 2, total: TOTAL, name: 'verify-plan', ran: false, ok: null, skipped: true, reason: 'no --plan' });
+    }
+
+    // 3/4 — verify-ai-output (needs an answer)
+    if (ctx.answer != null && String(ctx.answer).trim() !== '') {
+      const r = verify(ctx.answer, cwd);
+      steps.push({ n: 3, total: TOTAL, name: 'verify-ai-output', ran: true, ok: r.summary.total === 0, skipped: false, detail: r });
+    } else {
+      steps.push({ n: 3, total: TOTAL, name: 'verify-ai-output', ran: false, ok: null, skipped: true, reason: 'no --answer' });
+    }
+
+    // 4/4 — review-pr (needs changed files)
+    if (Array.isArray(ctx.changedFiles) && ctx.changedFiles.length) {
+      const r = reviewPr(ctx.changedFiles, cwd);
+      steps.push({ n: 4, total: TOTAL, name: 'review-pr', ran: true, ok: !!r.summary.ok, skipped: false, detail: r });
+    } else {
+      steps.push({ n: 4, total: TOTAL, name: 'review-pr', ran: false, ok: null, skipped: true, reason: 'no changes' });
+    }
+
+    const ran = steps.filter((s) => s.ran);
+    const passed = ran.filter((s) => s.ok).length;
+    const failed = ran.length - passed;
+    return {
+      task: ctx.task || null,
+      steps,
+      summary: {
+        total: TOTAL,
+        ran: ran.length,
+        skipped: steps.length - ran.length,
+        passed,
+        failed,
+        ok: failed === 0,
+      },
+    };
+  }
+
+  module.exports = { orchestrate, TOTAL };
+  
+};
+
+__factories["./src/review/review-pr"] = function(module, exports) {
+  
+  /**
+   * review-pr (IMPL.md §6 step 4 — last guard stage of the `create` pipeline).
+   *
+   * Audits a diff for drift and side effects after a PR is opened: scope drift,
+   * edits to high-fan-in "god-node" files, source changes without matching tests,
+   * and changes to security-sensitive files. Pure (takes a changed-file list),
+   * zero-dependency, bundle-safe; reuses the impact graph for blast radius.
+   */
+
+  const path = require('path');
+  const { analyzeImpact } = __require('./src/graph/impact');
+
+  const SECURITY_PATTERNS = [
+    /(^|\/)\.env(\.|$)/i,
+    /(^|\/)(secrets?|credentials?)(\/|\.|$)/i,
+    /(^|\/)auth(\/|\.|-)/i,
+    /(^|\/)package(-lock)?\.json$/,
+    /(^|\/)(yarn\.lock|pnpm-lock\.yaml)$/,
+    /(^|\/)\.github\/workflows\//,
+    /(^|\/)Dockerfile/i,
+    /\.(pem|key|crt|p12)$/i,
+  ];
+
+  const SRC_EXTS = new Set(['.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs', '.py', '.go', '.rs', '.java', '.rb', '.php']);
+  const GOD_NODE_THRESHOLD = 15; // transitive dependents → high-fan-in "god node"
+  const SCOPE_DIR_THRESHOLD = 5; // distinct top-level dirs → scope drift
+
+  function isTestFile(p) {
+    return /\.(test|spec)\.[jt]sx?$|(^|\/)test_|_test\.(py|go)$|(^|\/)(tests?|__tests__|spec)\//.test(p);
+  }
+  function isSource(p) {
+    return SRC_EXTS.has(path.extname(p).toLowerCase()) && !isTestFile(p);
+  }
+
+  /**
+   * Audit a changed-file list.
+   * @param {Array<{path:string,status:string}>|string[]} changedFiles
+   * @param {string} cwd
+   * @param {object} [opts]
+   * @param {number} [opts.godNodeThreshold=15]
+   * @param {number} [opts.scopeThreshold=5]
+   * @returns {{ findings: object[], blast: object[], summary: object }}
+   */
+  function reviewPr(changedFiles, cwd, opts = {}) {
+    const godThreshold = opts.godNodeThreshold != null ? opts.godNodeThreshold : GOD_NODE_THRESHOLD;
+    const scopeThreshold = opts.scopeThreshold != null ? opts.scopeThreshold : SCOPE_DIR_THRESHOLD;
+    const files = (changedFiles || []).map((f) => (typeof f === 'string' ? { path: f, status: 'M' } : f));
+
+    const findings = [];
+    const paths = files.map((f) => f.path);
+    const live = files.filter((f) => f.status !== 'D');
+    const srcChanged = live.filter((f) => isSource(f.path)).map((f) => f.path);
+    const testChanged = paths.filter(isTestFile);
+
+    // 1. Missing tests: a changed source file with no matching changed test file.
+    for (const s of srcChanged) {
+      const stem = path.basename(s).replace(/\.[^.]+$/, '');
+      const covered = testChanged.some((t) => path.basename(t).includes(stem));
+      if (!covered) findings.push({ type: 'missing-tests', file: s, severity: 'warn' });
+    }
+
+    // 2. Security-sensitive files.
+    for (const f of live) {
+      if (SECURITY_PATTERNS.some((re) => re.test(f.path))) {
+        findings.push({ type: 'security-file', file: f.path, severity: 'warn' });
+      }
+    }
+
+    // 3. God-node edits (high blast radius).
+    const blast = [];
+    if (srcChanged.length) {
+      let impacts = [];
+      try { impacts = analyzeImpact(srcChanged, cwd, {}); } catch (_) { impacts = []; }
+      for (const { file, impact } of impacts) {
+        blast.push({ file, totalImpact: impact.totalImpact });
+        if (impact.totalImpact > godThreshold) {
+          findings.push({ type: 'god-node', file, count: impact.totalImpact, severity: 'warn' });
+        }
+      }
+      blast.sort((a, b) => b.totalImpact - a.totalImpact);
+    }
+
+    // 4. Scope drift: distinct top-level directories touched.
+    const dirs = [...new Set(paths.map((p) => (p.includes('/') ? p.split('/')[0] : '.')))];
+    if (dirs.length > scopeThreshold) {
+      findings.push({ type: 'scope-drift', dirs, count: dirs.length, threshold: scopeThreshold, severity: 'warn' });
+    }
+
+    const byType = findings.reduce((a, f) => { a[f.type] = (a[f.type] || 0) + 1; return a; }, {});
+    return {
+      findings,
+      blast,
+      summary: {
+        filesChanged: files.length,
+        sourceChanged: srcChanged.length,
+        testsChanged: testChanged.length,
+        findings: findings.length,
+        byType,
+        ok: findings.length === 0,
+      },
+    };
+  }
+
+  module.exports = { reviewPr, SECURITY_PATTERNS, GOD_NODE_THRESHOLD, SCOPE_DIR_THRESHOLD };
+  
+};
+
 __factories["./src/cache/freshen"] = function(module, exports) {
   
   /**
@@ -7259,7 +7459,7 @@ __factories["./src/mcp/server"] = function(module, exports) {
 
   const SERVER_INFO = {
     name: 'sigmap',
-    version: '7.11.0',
+    version: '7.13.0',
     description: 'SigMap MCP server — code signatures on demand',
   };
 
@@ -12937,7 +13137,7 @@ function __tryGit(args, opts = {}) {
   catch (_) { return ''; }
 }
 
-const VERSION = '7.11.0';
+const VERSION = '7.13.0';
 const MARKER = '\n\n## Auto-generated signatures\n<!-- Updated by gen-context.js -->\n';
 
 function requireSourceOrBundled(key) {
@@ -16389,6 +16589,125 @@ function main() {
     process.exit(1);
   }
 
+  // Gap 2 (step 4): `sigmap review-pr` — diff audit (scope drift, god-nodes,
+  // missing tests, security-sensitive files). Last guard stage of `create`.
+  if (args[0] === 'review-pr') {
+    const jsonOut = args.includes('--json');
+    const staged = args.includes('--staged');
+    const baseIdx = args.indexOf('--base');
+    const baseArg = baseIdx !== -1 && args[baseIdx + 1] && !args[baseIdx + 1].startsWith('--') ? args[baseIdx + 1] : null;
+
+    let nameStatus = '';
+    if (staged) {
+      nameStatus = __tryGit(['diff', '--cached', '--name-status'], { cwd });
+    } else {
+      let base = baseArg;
+      if (!base) {
+        for (const ref of ['main', 'develop']) {
+          if (__tryGit(['rev-parse', '--verify', '--quiet', ref], { cwd })) { base = ref; break; }
+        }
+      }
+      const mb = base ? (__tryGit(['merge-base', 'HEAD', base], { cwd }) || base) : 'HEAD~1';
+      nameStatus = __tryGit(['diff', '--name-status', `${mb}..HEAD`], { cwd });
+    }
+
+    const changedFiles = nameStatus.split('\n').filter(Boolean).map((line) => {
+      const parts = line.split('\t');
+      const status = parts[0][0]; // M/A/D/R…
+      const file = parts[parts.length - 1]; // rename → new path
+      return { path: file, status };
+    });
+
+    const { reviewPr } = requireSourceOrBundled('./src/review/review-pr');
+    const result = reviewPr(changedFiles, cwd, {});
+
+    if (jsonOut) {
+      process.stdout.write(JSON.stringify(result) + '\n');
+      process.exit(result.summary.ok ? 0 : 1);
+    }
+
+    const s = result.summary;
+    console.log(`[sigmap] review-pr — ${s.filesChanged} file(s) changed (${s.sourceChanged} source, ${s.testsChanged} test)`);
+    if (s.findings === 0) {
+      console.log('  ✓ no findings — scope, tests, blast radius, and sensitive files all clear');
+      process.exit(0);
+    }
+    const label = { 'missing-tests': 'missing tests', 'security-file': 'security file', 'god-node': 'god node', 'scope-drift': 'scope drift' };
+    for (const f of result.findings) {
+      if (f.type === 'missing-tests') console.log(`  ⚠ ${label[f.type]}: ${f.file} changed with no matching test`);
+      else if (f.type === 'security-file') console.log(`  ⚠ ${label[f.type]}: ${f.file}`);
+      else if (f.type === 'god-node') console.log(`  ⚠ ${label[f.type]}: ${f.file} → ${f.count} dependents`);
+      else if (f.type === 'scope-drift') console.log(`  ⚠ ${label[f.type]}: ${f.count} top-level dirs (${f.dirs.join(', ')})`);
+    }
+    console.log(`\n  ${s.findings} finding(s)`);
+    process.exit(1);
+  }
+
+  // Gap 2 (capstone): `sigmap create "<task>"` — orchestrate the 4 guard stages
+  // (scaffold → verify-plan → verify-ai-output → review-pr) with n/4 numbering.
+  if (args[0] === 'create') {
+    const jsonOut = args.includes('--json');
+    const task = args[1] && !args[1].startsWith('--') ? args[1] : null;
+    const flagVal = (flag) => { const i = args.indexOf(flag); return i !== -1 && args[i + 1] && !args[i + 1].startsWith('--') ? args[i + 1] : null; };
+    const nameArg = flagVal('--name');
+    const planFile = flagVal('--plan');
+    const answerFile = flagVal('--answer');
+    const staged = args.includes('--staged');
+    const baseArg = flagVal('--base');
+
+    const ctx = { task };
+
+    if (nameArg) {
+      ctx.name = nameArg;
+      try {
+        const { extractConventions } = requireSourceOrBundled('./src/conventions/extract');
+        ctx.conventions = extractConventions(cwd, buildFileList(cwd, config));
+      } catch (_) {}
+    }
+    for (const [flag, file, key] of [['--plan', planFile, 'plan'], ['--answer', answerFile, 'answer']]) {
+      if (!file) continue;
+      try { ctx[key] = fs.readFileSync(path.resolve(cwd, file), 'utf8'); }
+      catch (e) { console.error(`[sigmap] cannot read ${flag} file: ${e.message}`); process.exit(1); }
+    }
+
+    // review-pr inputs: changed files from git (same collection as review-pr).
+    let nameStatus = '';
+    if (staged) {
+      nameStatus = __tryGit(['diff', '--cached', '--name-status'], { cwd });
+    } else {
+      let base = baseArg;
+      if (!base) {
+        for (const ref of ['main', 'develop']) {
+          if (__tryGit(['rev-parse', '--verify', '--quiet', ref], { cwd })) { base = ref; break; }
+        }
+      }
+      const mb = base ? (__tryGit(['merge-base', 'HEAD', base], { cwd }) || base) : 'HEAD~1';
+      nameStatus = __tryGit(['diff', '--name-status', `${mb}..HEAD`], { cwd });
+    }
+    ctx.changedFiles = nameStatus.split('\n').filter(Boolean).map((line) => {
+      const parts = line.split('\t');
+      return { path: parts[parts.length - 1], status: parts[0][0] };
+    });
+
+    const { orchestrate } = requireSourceOrBundled('./src/create/orchestrate');
+    const result = orchestrate(ctx, cwd);
+
+    if (jsonOut) {
+      process.stdout.write(JSON.stringify(result) + '\n');
+      process.exit(result.summary.ok ? 0 : 1);
+    }
+
+    console.log(`[sigmap] create${result.task ? ` "${result.task}"` : ''} — grounded-creation pipeline`);
+    for (const st of result.steps) {
+      const mark = st.skipped ? '–' : (st.ok ? '✓' : '✗');
+      const status = st.skipped ? `skipped (${st.reason})` : (st.ok ? 'ok' : 'FAILED');
+      console.log(`  ${st.n}/${st.total} ${mark} ${st.name.padEnd(16)} ${status}`);
+    }
+    const su = result.summary;
+    console.log(`\n  ${su.ran}/${su.total} ran · ${su.passed} passed · ${su.failed} failed · ${su.skipped} skipped`);
+    process.exit(su.ok ? 0 : 1);
+  }
+
   // Feature 1: `sigmap explain <file>` — why a file is included or excluded
   if (args[0] === 'explain' || args.includes('--explain')) {
     const target = args[0] === 'explain'

package/llms-full.txt

@@ -9,7 +9,7 @@ the files relevant to the task — cutting tokens ~97% while keeping answers
 grounded. Deterministic, offline, no embeddings or vector database. Works with
 Claude, Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 7.11.0 | Benchmark: sigmap-v7.0-main (2026-06-14)
+# Version: 7.13.0 | Benchmark: sigmap-v7.0-main (2026-06-14)
 # Source: auto-generated from package.json, version.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 

package/llms.txt

@@ -9,7 +9,7 @@ the files relevant to the task — cutting tokens ~97% while keeping answers
 grounded. Deterministic, offline, no embeddings or vector database. Works with
 Claude, Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 7.11.0 | Benchmark: sigmap-v7.0-main (2026-06-14)
+# Version: 7.13.0 | Benchmark: sigmap-v7.0-main (2026-06-14)
 # Source: auto-generated from package.json, version.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap",
-  "version": "7.11.0",
+  "version": "7.13.0",
   "description": "97% token reduction for AI coding. Extracts function & class signatures with TF-IDF ranking to feed only the right files to Claude, Cursor, Copilot, Aider, Windsurf, local LLMs & MCP. Zero dependencies, runs offline via npx.",
   "main": "packages/core/index.js",
   "exports": {

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-cli",
-  "version": "7.11.0",
+  "version": "7.13.0",
   "description": "SigMap CLI wrapper — thin adapter for programmatic CLI invocation",
   "main": "index.js",
   "keywords": [

package/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-core",
-  "version": "7.11.0",
+  "version": "7.13.0",
   "description": "SigMap core library — zero-dependency code signature extraction, retrieval, and security scanning",
   "main": "index.js",
   "keywords": [

package/src/create/orchestrate.js

@@ -0,0 +1,86 @@
+'use strict';
+
+/**
+ * create orchestrator (IMPL.md §6.2 — the capstone of the grounded-creation loop).
+ *
+ * Sequences the four guard stages — scaffold → verify-plan → verify-ai-output →
+ * review-pr — in one pass with `n/4` numbering and a single pass/fail summary.
+ * The agent does the LLM writing between stages; `create` runs the deterministic
+ * guards it owns. A stage runs only when its input is present (else it is
+ * skipped, which does not fail the run). Zero-dependency, bundle-safe; delegates
+ * to the real stage modules.
+ */
+
+const { proposeScaffold } = require('../scaffold/propose');
+const { verifyPlan } = require('../plan/verify-plan');
+const { verify } = require('../verify/hallucination-guard');
+const { reviewPr } = require('../review/review-pr');
+
+const TOTAL = 4;
+
+/**
+ * Run the create pipeline over whatever inputs are available.
+ * @param {object} ctx
+ * @param {string} [ctx.task] free-text task label (echoed back)
+ * @param {string} [ctx.name] module name → enables the scaffold stage
+ * @param {object} [ctx.conventions] an `extractConventions` result (for scaffold)
+ * @param {object} [ctx.scaffoldOpts] options forwarded to `proposeScaffold`
+ * @param {string} [ctx.plan] plan markdown → enables verify-plan
+ * @param {string} [ctx.answer] AI answer markdown → enables verify-ai-output
+ * @param {Array<{path:string,status:string}>} [ctx.changedFiles] → enables review-pr
+ * @param {string} cwd repo root
+ * @returns {{ task: string|null, steps: object[], summary: object }}
+ */
+function orchestrate(ctx = {}, cwd) {
+  const steps = [];
+
+  // 1/4 — scaffold (needs a name + conventions)
+  if (ctx.name && ctx.conventions) {
+    const d = proposeScaffold(ctx.name, ctx.conventions, ctx.scaffoldOpts || {});
+    steps.push({ n: 1, total: TOTAL, name: 'scaffold', ran: true, ok: !!d.ok, skipped: false, detail: d });
+  } else {
+    steps.push({ n: 1, total: TOTAL, name: 'scaffold', ran: false, ok: null, skipped: true, reason: 'no --name' });
+  }
+
+  // 2/4 — verify-plan (needs a plan)
+  if (ctx.plan != null && String(ctx.plan).trim() !== '') {
+    const r = verifyPlan(ctx.plan, cwd);
+    steps.push({ n: 2, total: TOTAL, name: 'verify-plan', ran: true, ok: !!r.summary.ok, skipped: false, detail: r });
+  } else {
+    steps.push({ n: 2, total: TOTAL, name: 'verify-plan', ran: false, ok: null, skipped: true, reason: 'no --plan' });
+  }
+
+  // 3/4 — verify-ai-output (needs an answer)
+  if (ctx.answer != null && String(ctx.answer).trim() !== '') {
+    const r = verify(ctx.answer, cwd);
+    steps.push({ n: 3, total: TOTAL, name: 'verify-ai-output', ran: true, ok: r.summary.total === 0, skipped: false, detail: r });
+  } else {
+    steps.push({ n: 3, total: TOTAL, name: 'verify-ai-output', ran: false, ok: null, skipped: true, reason: 'no --answer' });
+  }
+
+  // 4/4 — review-pr (needs changed files)
+  if (Array.isArray(ctx.changedFiles) && ctx.changedFiles.length) {
+    const r = reviewPr(ctx.changedFiles, cwd);
+    steps.push({ n: 4, total: TOTAL, name: 'review-pr', ran: true, ok: !!r.summary.ok, skipped: false, detail: r });
+  } else {
+    steps.push({ n: 4, total: TOTAL, name: 'review-pr', ran: false, ok: null, skipped: true, reason: 'no changes' });
+  }
+
+  const ran = steps.filter((s) => s.ran);
+  const passed = ran.filter((s) => s.ok).length;
+  const failed = ran.length - passed;
+  return {
+    task: ctx.task || null,
+    steps,
+    summary: {
+      total: TOTAL,
+      ran: ran.length,
+      skipped: steps.length - ran.length,
+      passed,
+      failed,
+      ok: failed === 0,
+    },
+  };
+}
+
+module.exports = { orchestrate, TOTAL };

package/src/mcp/server.js

@@ -18,7 +18,7 @@ const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, exp
 
 const SERVER_INFO = {
   name: 'sigmap',
-  version: '7.11.0',
+  version: '7.13.0',
   description: 'SigMap MCP server — code signatures on demand',
 };
 

package/src/review/review-pr.js

@@ -0,0 +1,106 @@
+'use strict';
+
+/**
+ * review-pr (IMPL.md §6 step 4 — last guard stage of the `create` pipeline).
+ *
+ * Audits a diff for drift and side effects after a PR is opened: scope drift,
+ * edits to high-fan-in "god-node" files, source changes without matching tests,
+ * and changes to security-sensitive files. Pure (takes a changed-file list),
+ * zero-dependency, bundle-safe; reuses the impact graph for blast radius.
+ */
+
+const path = require('path');
+const { analyzeImpact } = require('../graph/impact');
+
+const SECURITY_PATTERNS = [
+  /(^|\/)\.env(\.|$)/i,
+  /(^|\/)(secrets?|credentials?)(\/|\.|$)/i,
+  /(^|\/)auth(\/|\.|-)/i,
+  /(^|\/)package(-lock)?\.json$/,
+  /(^|\/)(yarn\.lock|pnpm-lock\.yaml)$/,
+  /(^|\/)\.github\/workflows\//,
+  /(^|\/)Dockerfile/i,
+  /\.(pem|key|crt|p12)$/i,
+];
+
+const SRC_EXTS = new Set(['.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs', '.py', '.go', '.rs', '.java', '.rb', '.php']);
+const GOD_NODE_THRESHOLD = 15; // transitive dependents → high-fan-in "god node"
+const SCOPE_DIR_THRESHOLD = 5; // distinct top-level dirs → scope drift
+
+function isTestFile(p) {
+  return /\.(test|spec)\.[jt]sx?$|(^|\/)test_|_test\.(py|go)$|(^|\/)(tests?|__tests__|spec)\//.test(p);
+}
+function isSource(p) {
+  return SRC_EXTS.has(path.extname(p).toLowerCase()) && !isTestFile(p);
+}
+
+/**
+ * Audit a changed-file list.
+ * @param {Array<{path:string,status:string}>|string[]} changedFiles
+ * @param {string} cwd
+ * @param {object} [opts]
+ * @param {number} [opts.godNodeThreshold=15]
+ * @param {number} [opts.scopeThreshold=5]
+ * @returns {{ findings: object[], blast: object[], summary: object }}
+ */
+function reviewPr(changedFiles, cwd, opts = {}) {
+  const godThreshold = opts.godNodeThreshold != null ? opts.godNodeThreshold : GOD_NODE_THRESHOLD;
+  const scopeThreshold = opts.scopeThreshold != null ? opts.scopeThreshold : SCOPE_DIR_THRESHOLD;
+  const files = (changedFiles || []).map((f) => (typeof f === 'string' ? { path: f, status: 'M' } : f));
+
+  const findings = [];
+  const paths = files.map((f) => f.path);
+  const live = files.filter((f) => f.status !== 'D');
+  const srcChanged = live.filter((f) => isSource(f.path)).map((f) => f.path);
+  const testChanged = paths.filter(isTestFile);
+
+  // 1. Missing tests: a changed source file with no matching changed test file.
+  for (const s of srcChanged) {
+    const stem = path.basename(s).replace(/\.[^.]+$/, '');
+    const covered = testChanged.some((t) => path.basename(t).includes(stem));
+    if (!covered) findings.push({ type: 'missing-tests', file: s, severity: 'warn' });
+  }
+
+  // 2. Security-sensitive files.
+  for (const f of live) {
+    if (SECURITY_PATTERNS.some((re) => re.test(f.path))) {
+      findings.push({ type: 'security-file', file: f.path, severity: 'warn' });
+    }
+  }
+
+  // 3. God-node edits (high blast radius).
+  const blast = [];
+  if (srcChanged.length) {
+    let impacts = [];
+    try { impacts = analyzeImpact(srcChanged, cwd, {}); } catch (_) { impacts = []; }
+    for (const { file, impact } of impacts) {
+      blast.push({ file, totalImpact: impact.totalImpact });
+      if (impact.totalImpact > godThreshold) {
+        findings.push({ type: 'god-node', file, count: impact.totalImpact, severity: 'warn' });
+      }
+    }
+    blast.sort((a, b) => b.totalImpact - a.totalImpact);
+  }
+
+  // 4. Scope drift: distinct top-level directories touched.
+  const dirs = [...new Set(paths.map((p) => (p.includes('/') ? p.split('/')[0] : '.')))];
+  if (dirs.length > scopeThreshold) {
+    findings.push({ type: 'scope-drift', dirs, count: dirs.length, threshold: scopeThreshold, severity: 'warn' });
+  }
+
+  const byType = findings.reduce((a, f) => { a[f.type] = (a[f.type] || 0) + 1; return a; }, {});
+  return {
+    findings,
+    blast,
+    summary: {
+      filesChanged: files.length,
+      sourceChanged: srcChanged.length,
+      testsChanged: testChanged.length,
+      findings: findings.length,
+      byType,
+      ok: findings.length === 0,
+    },
+  };
+}
+
+module.exports = { reviewPr, SECURITY_PATTERNS, GOD_NODE_THRESHOLD, SCOPE_DIR_THRESHOLD };