sneakoscope 7.3.0 → 7.6.0

package/dist/core/triwiki/context-graph/extractors/evidence/proofs.js

@@ -0,0 +1,266 @@
+import { lintWarning } from '../../contracts.js';
+import { contextGraphNodeId, shortDigest } from '../../ids.js';
+import { tryNormalizeGraphPath } from '../../paths.js';
+import { classifyTriWikiProofCardSchema, isReusableTriWikiProofCard } from '../../../triwiki-proof-card.js';
+import { boundedList, boundedText, safeText } from './redaction.js';
+import { EvidenceFragmentBuilder, PROOF_BANK_REL, RiskDomainRegistry, asRecord, asString, asStringList, readWorkspaceFile, statWorkspaceEntry, tokenEstimate } from './shared.js';
+import { discoverProofRecords } from './proof-index.js';
+const MAX_DERIVED_INPUTS = 12;
+const PLACEHOLDER_HASHES = new Set(['', 'unknown', 'legacy-missing', 'none', 'null']);
+const HASH_PINNED_INPUTS = [
+    { field: 'package_lock_hash', rel: 'package-lock.json' },
+    { field: 'release_gates_hash', rel: 'release-gates.v2.json' }
+];
+export function extractProofEvidence(builder, ctx, risks) {
+    const discovery = discoverProofRecords(ctx);
+    for (const skip of discovery.skipped)
+        builder.addSkip(skip);
+    for (const [rel, hash] of Object.entries(discovery.inputHashes))
+        builder.addInputHash(rel, hash);
+    if (discovery.mode === 'absent') {
+        builder.addIssue(lintWarning('extractor_skipped_input', 'TriWiki proof bank is absent; no proof evidence was extracted', {
+            path: PROOF_BANK_REL,
+            extractor: builder.fragment.extractor
+        }));
+        return { mode: discovery.mode, proofCount: 0, healthyCount: 0 };
+    }
+    if (discovery.mode === 'scan') {
+        builder.addIssue(lintWarning('extractor_skipped_input', 'proof index manifest is absent; fell back to a bounded proof-bank directory read', {
+            path: PROOF_BANK_REL,
+            extractor: builder.fragment.extractor
+        }));
+    }
+    let healthyCount = 0;
+    for (const record of discovery.records) {
+        const health = proofHealth(record, ctx, discovery.mode);
+        if (health.healthy)
+            healthyCount += 1;
+        const nodeId = addProofNode(builder, record, health, discovery.mode);
+        if (!nodeId)
+            continue;
+        linkSubject(builder, record, health, nodeId, discovery.mode);
+        linkDerivedInputs(builder, ctx, record, nodeId);
+        const domainId = risks.note(`proof-subject/${record.subjectType}`, record.subjectType === 'gate' || record.subjectType === 'gate-pack' ? 'high' : 'medium');
+        if (domainId) {
+            builder.addEdge({
+                from: nodeId,
+                to: domainId,
+                type: 'affected_by',
+                confidence: 'manifest',
+                provenancePath: record.rel,
+                provenanceHash: record.hash
+            });
+        }
+    }
+    return { mode: discovery.mode, proofCount: discovery.records.length, healthyCount };
+}
+function proofHealth(record, ctx, mode) {
+    const invalidated = record.invalidationReasons.length > 0 || record.reusable === false;
+    if (record.corrupt) {
+        return { healthy: false, expired: null, invalidated: true, schemaClass: 'invalid', result: 'unknown', reason: 'corrupt_proof_card' };
+    }
+    const expired = expiryState(record.expiresAt, ctx);
+    if (mode === 'index') {
+        const healthy = record.reusable === true && !invalidated && expired === false && record.cardPresent;
+        return {
+            healthy,
+            expired,
+            invalidated,
+            schemaClass: 'unread',
+            result: 'unknown',
+            reason: healthy
+                ? 'index_reusable'
+                : !record.cardPresent
+                    ? 'proof_card_missing'
+                    : invalidated
+                        ? 'invalidated'
+                        : expired === true
+                            ? 'expired'
+                            : 'not_reusable'
+        };
+    }
+    const card = record.card;
+    if (!card) {
+        return { healthy: false, expired, invalidated: true, schemaClass: 'invalid', result: 'unknown', reason: 'unreadable_proof_card' };
+    }
+    const schemaClass = classifyTriWikiProofCardSchema(card);
+    const result = asString(card.result) ?? 'unknown';
+    if (schemaClass !== 'current') {
+        return { healthy: false, expired, invalidated, schemaClass, result, reason: schemaClass };
+    }
+    if (ctx.now === null) {
+        return { healthy: false, expired: null, invalidated, schemaClass, result, reason: 'observed_at_unparseable' };
+    }
+    const reusable = isReusableTriWikiProofCard(card, ctx.now);
+    return {
+        healthy: reusable,
+        expired,
+        invalidated,
+        schemaClass,
+        result,
+        reason: reusable ? 'reusable' : invalidated ? 'invalidated' : expired === true ? 'expired' : `not_reusable:${result}`
+    };
+}
+function expiryState(expiresAt, ctx) {
+    if (!expiresAt)
+        return false;
+    const parsed = Date.parse(expiresAt);
+    if (!Number.isFinite(parsed))
+        return null;
+    if (ctx.now === null)
+        return null;
+    return parsed <= ctx.now.getTime();
+}
+function addProofNode(builder, record, health, mode) {
+    const id = contextGraphNodeId({ kind: 'proof', proofId: record.proofId });
+    const freshness = health.healthy
+        ? 'fresh'
+        : health.invalidated || health.expired === true || record.corrupt
+            ? 'stale'
+            : 'unknown';
+    const metadata = {
+        proof_id: boundedText(record.proofId, 80),
+        subject_type: boundedText(record.subjectType, 40),
+        subject_id: boundedText(record.subjectId, 120),
+        discovery: mode,
+        card_present: record.cardPresent,
+        corrupt: record.corrupt,
+        reusable: health.healthy,
+        declared_reusable: record.reusable === null ? null : record.reusable,
+        expired: health.expired,
+        schema_class: health.schemaClass,
+        result: boundedText(health.result, 40),
+        health_reason: boundedText(health.reason, 80),
+        invalidation_reason_count: record.invalidationReasons.length,
+        ...(record.invalidationReasons.length ? { invalidation_reasons: boundedList(record.invalidationReasons) } : {}),
+        ...(record.cacheKey ? { cache_key_digest: shortDigest(record.cacheKey) } : {}),
+        ...proofCardProjection(record)
+    };
+    const added = builder.addNode({
+        id,
+        kind: 'proof',
+        label: safeText(record.proofId, 80) || id,
+        path: record.rel,
+        contentHash: record.hash,
+        trust: health.healthy ? 0.9 : record.corrupt ? 0.05 : 0.15,
+        freshness,
+        risk: record.subjectType === 'gate' || record.subjectType === 'gate-pack' ? 'high' : 'medium',
+        tokenCost: tokenEstimate(record.proofId.length + record.subjectId.length, 96),
+        metadata
+    }, record.rel);
+    return added ? id : null;
+}
+function proofCardProjection(record) {
+    const card = record.card;
+    if (!card)
+        return {};
+    const raw = card;
+    const evidence = asRecord(raw.evidence);
+    const inputHash = asString(raw.input_hash);
+    const implementationHash = asString(raw.gate_impl_hash) ?? asString(raw.implementation_hash);
+    const toolVersions = asRecord(raw.tool_versions);
+    return {
+        evidence_key_count: evidence ? Object.keys(evidence).length : 0,
+        tool_version_count: toolVersions ? Object.keys(toolVersions).length : 0,
+        ...(inputHash && !PLACEHOLDER_HASHES.has(inputHash) ? { input_hash: inputHash.slice(0, 24) } : {}),
+        ...(implementationHash && !PLACEHOLDER_HASHES.has(implementationHash)
+            ? { implementation_hash: implementationHash.slice(0, 24) }
+            : {}),
+        ...(asString(raw.fixture_version) ? { fixture_version: boundedText(raw.fixture_version, 40) } : {})
+    };
+}
+function subjectNodeId(record) {
+    if (!record.subjectId || record.subjectId === 'unknown')
+        return null;
+    switch (record.subjectType) {
+        case 'gate':
+        case 'gate-pack':
+            return { id: contextGraphNodeId({ kind: 'gate', gateId: record.subjectId }), kind: 'gate' };
+        case 'module':
+            return { id: contextGraphNodeId({ kind: 'module', moduleId: record.subjectId }), kind: 'module' };
+        case 'pipeline':
+            return { id: contextGraphNodeId({ kind: 'pipeline', pipelineId: record.subjectId }), kind: 'pipeline' };
+        default:
+            return null;
+    }
+}
+function linkSubject(builder, record, health, proofNodeId, mode) {
+    const subject = subjectNodeId(record);
+    if (!subject)
+        return;
+    builder.addNode({
+        id: subject.id,
+        kind: subject.kind,
+        label: safeText(record.subjectId, 120) || subject.id,
+        trust: 0.7,
+        freshness: 'unknown',
+        risk: subject.kind === 'gate' ? 'high' : 'medium',
+        tokenCost: tokenEstimate(record.subjectId.length, 64),
+        metadata: { evidence_stub: true, subject_type: boundedText(record.subjectType, 40) }
+    }, record.rel);
+    if (health.healthy) {
+        builder.addEdge({
+            from: proofNodeId,
+            to: subject.id,
+            type: 'verified_by',
+            confidence: mode === 'index' ? 'manifest' : 'exact',
+            provenancePath: record.rel,
+            provenanceHash: record.hash
+        });
+        return;
+    }
+    builder.addEdge({
+        from: proofNodeId,
+        to: subject.id,
+        type: 'invalidates',
+        confidence: health.invalidated ? 'manifest' : 'observed',
+        provenancePath: record.rel,
+        provenanceHash: record.hash
+    });
+}
+function linkDerivedInputs(builder, ctx, record, proofNodeId) {
+    const raw = record.card;
+    const candidates = [];
+    if (raw) {
+        for (const pinned of HASH_PINNED_INPUTS) {
+            const hash = asString(raw[pinned.field]);
+            if (hash && !PLACEHOLDER_HASHES.has(hash))
+                candidates.push(pinned.rel);
+        }
+        candidates.push(...asStringList(raw.input_paths), ...asStringList(raw.source_paths));
+    }
+    const seen = new Set();
+    for (const candidate of candidates) {
+        if (seen.size >= MAX_DERIVED_INPUTS)
+            break;
+        const rel = tryNormalizeGraphPath(ctx.root, candidate);
+        if (!rel || seen.has(rel))
+            continue;
+        const stat = statWorkspaceEntry(ctx.root, rel);
+        if (!stat || !stat.isFile())
+            continue;
+        seen.add(rel);
+        const fileId = contextGraphNodeId({ kind: 'file', path: rel });
+        const read = readWorkspaceFile(ctx.root, rel, ctx.limits.maxFileBytes);
+        builder.addNode({
+            id: fileId,
+            kind: 'file',
+            label: safeText(rel, 120) || rel,
+            path: rel,
+            ...(read.ok ? { contentHash: read.value.hash } : {}),
+            trust: read.ok ? 0.9 : 0.4,
+            freshness: read.ok ? 'fresh' : 'unknown',
+            risk: 'low',
+            tokenCost: tokenEstimate(stat.size),
+            metadata: { evidence_stub: true, source_path: rel }
+        }, record.rel);
+        builder.addEdge({
+            from: proofNodeId,
+            to: fileId,
+            type: 'derived_from',
+            confidence: 'manifest',
+            provenancePath: record.rel,
+            provenanceHash: record.hash
+        });
+    }
+}

package/dist/core/triwiki/context-graph/extractors/evidence/redaction.js

@@ -0,0 +1,177 @@
+import { REDACTION_MARKER, containsPlaintextSecret, redactString } from '../../../../secret-redaction.js';
+import { lintError } from '../../contracts.js';
+import { isWorkspaceRelativePosixPath } from '../../paths.js';
+export const EVIDENCE_REDACTED_PATH = '[redacted-path]';
+export const EVIDENCE_MAX_META_STRING = 160;
+export const EVIDENCE_MAX_META_LIST = 12;
+const UNSAFE_PATH_PATTERNS = [
+    /(?:^|[\s"'(=:,])~\//,
+    /(?:^|[\s"'(=:,])\/(?:Users|home|root|var|etc|tmp|private|opt|usr|Volumes)\//i,
+    /(?:^|[\s"'(=:,])[A-Za-z]:[\\/]/,
+    /(?:^|[\s"'(=:,])\\\\[^\\/\s]+\\/,
+    /\.\.\//
+];
+export function looksLikeUnsafePath(value) {
+    return UNSAFE_PATH_PATTERNS.some((pattern) => pattern.test(value));
+}
+export function safeText(value, maxLength = EVIDENCE_MAX_META_STRING) {
+    if (value === null || value === undefined)
+        return '';
+    const raw = typeof value === 'string' ? value : String(value);
+    const collapsed = raw.replace(/[\r\n\t]+/g, ' ').replace(/\s{2,}/g, ' ').trim();
+    if (!collapsed)
+        return '';
+    const redacted = redactString(collapsed);
+    const guarded = looksLikeUnsafePath(redacted) ? EVIDENCE_REDACTED_PATH : redacted;
+    return guarded.length > maxLength ? `${guarded.slice(0, Math.max(1, maxLength - 1))}…` : guarded;
+}
+export function boundedText(value, maxLength = EVIDENCE_MAX_META_STRING) {
+    if (value === null || value === undefined)
+        return '';
+    const raw = typeof value === 'string' ? value : String(value);
+    const collapsed = raw.replace(/[\r\n\t]+/g, ' ').replace(/\s{2,}/g, ' ').trim();
+    if (!collapsed)
+        return '';
+    return collapsed.length > maxLength ? `${collapsed.slice(0, Math.max(1, maxLength - 1))}…` : collapsed;
+}
+export function boundedList(values, maxItems = EVIDENCE_MAX_META_LIST, maxLength = EVIDENCE_MAX_META_STRING) {
+    const out = [];
+    const seen = new Set();
+    for (const value of values) {
+        if (out.length >= maxItems)
+            break;
+        const text = boundedText(value, maxLength);
+        if (!text || seen.has(text))
+            continue;
+        seen.add(text);
+        out.push(text);
+    }
+    return out.sort((left, right) => (left < right ? -1 : left > right ? 1 : 0));
+}
+export function safeTextList(values, maxItems = EVIDENCE_MAX_META_LIST, maxLength = EVIDENCE_MAX_META_STRING) {
+    const out = [];
+    const seen = new Set();
+    for (const value of values) {
+        if (out.length >= maxItems)
+            break;
+        const text = safeText(value, maxLength);
+        if (!text || seen.has(text))
+            continue;
+        seen.add(text);
+        out.push(text);
+    }
+    return out.sort((left, right) => (left < right ? -1 : left > right ? 1 : 0));
+}
+function valueIsClean(value) {
+    if (typeof value === 'string')
+        return !containsPlaintextSecret(value);
+    if (Array.isArray(value))
+        return value.every((entry) => !containsPlaintextSecret(entry));
+    return true;
+}
+function sanitizeMetadataValue(value) {
+    if (typeof value === 'string') {
+        const next = safeText(value);
+        return { value: next, changed: next !== value };
+    }
+    if (Array.isArray(value)) {
+        const next = safeTextList(value);
+        const changed = next.length !== value.length || next.some((entry, index) => entry !== value[index]);
+        return { value: next, changed };
+    }
+    return { value, changed: false };
+}
+function guardNode(node, extractor) {
+    if (containsPlaintextSecret(node.id) || containsPlaintextSecret(node.label)) {
+        return {
+            node: null,
+            issue: lintError('secret_like_value', 'evidence node identity looks secret-like and was refused', {
+                nodeId: node.id.slice(0, 24),
+                extractor
+            })
+        };
+    }
+    if (node.path !== undefined && containsPlaintextSecret(node.path)) {
+        return {
+            node: null,
+            issue: lintError('secret_like_value', 'evidence node path looks secret-like and was refused', {
+                nodeId: node.id,
+                extractor
+            })
+        };
+    }
+    if (node.path !== undefined && !isWorkspaceRelativePosixPath(node.path)) {
+        return {
+            node: null,
+            issue: lintError('absolute_or_escaping_path', 'evidence node path is not workspace-relative and was refused', {
+                nodeId: node.id,
+                extractor
+            })
+        };
+    }
+    const metadata = {};
+    let redactedFields = 0;
+    for (const key of Object.keys(node.metadata).sort()) {
+        const raw = node.metadata[key];
+        if (raw === undefined)
+            continue;
+        const sanitized = sanitizeMetadataValue(raw);
+        if (!valueIsClean(sanitized.value)) {
+            return {
+                node: null,
+                issue: lintError('secret_like_value', `evidence node metadata "${key}" stayed secret-like after redaction`, {
+                    nodeId: node.id,
+                    extractor
+                })
+            };
+        }
+        if (sanitized.changed)
+            redactedFields += 1;
+        if (typeof sanitized.value === 'string' && !sanitized.value)
+            continue;
+        if (Array.isArray(sanitized.value) && !sanitized.value.length)
+            continue;
+        metadata[key] = sanitized.value;
+    }
+    if (redactedFields > 0) {
+        metadata.redacted = true;
+        metadata.redacted_field_count = redactedFields;
+        metadata.redaction_marker = REDACTION_MARKER;
+    }
+    return { node: { ...node, metadata }, issue: null };
+}
+function edgeIsSafe(edge, nodeIds) {
+    if (!nodeIds.has(edge.from) || !nodeIds.has(edge.to))
+        return false;
+    if (!edge.provenance.path || !isWorkspaceRelativePosixPath(edge.provenance.path))
+        return false;
+    if (containsPlaintextSecret(edge.provenance.path) || containsPlaintextSecret(edge.provenance.hash))
+        return false;
+    return true;
+}
+export function sanitizeEvidenceFragment(fragment) {
+    const issues = [...fragment.issues];
+    const nodes = [];
+    const keptIds = new Set();
+    for (const node of fragment.nodes) {
+        const guarded = guardNode(node, fragment.extractor);
+        if (guarded.issue)
+            issues.push(guarded.issue);
+        if (!guarded.node)
+            continue;
+        nodes.push(guarded.node);
+        keptIds.add(guarded.node.id);
+    }
+    const edges = fragment.edges.filter((edge) => edgeIsSafe(edge, keptIds));
+    const inputHashes = {};
+    for (const key of Object.keys(fragment.inputHashes).sort()) {
+        const value = fragment.inputHashes[key];
+        if (value === undefined)
+            continue;
+        if (!isWorkspaceRelativePosixPath(key) || containsPlaintextSecret(key))
+            continue;
+        inputHashes[key] = value;
+    }
+    const skipped = fragment.skipped.filter((entry) => isWorkspaceRelativePosixPath(entry.path) && !containsPlaintextSecret(entry.path) && !containsPlaintextSecret(entry.detail ?? ''));
+    return { ...fragment, nodes, edges, issues, skipped, inputHashes };
+}

package/dist/core/triwiki/context-graph/extractors/evidence/sources.js

@@ -0,0 +1,154 @@
+import { contextGraphNodeId, shortDigest } from '../../ids.js';
+import { safeText } from './redaction.js';
+import { CONTEXT_PACK_REL, EvidenceFragmentBuilder, asArray, asRecord, asString, readWorkspaceFile, statWorkspaceEntry, tokenEstimate } from './shared.js';
+const MAX_DIRECTORY_PROBE = 24;
+export function manifestHashes(pack) {
+    const out = new Map();
+    const provenance = asRecord(pack.provenance);
+    const manifest = provenance ? asRecord(provenance.source_manifest) : null;
+    for (const entry of asArray(manifest?.entries)) {
+        const row = asRecord(entry);
+        const rel = row ? asString(row.path) : null;
+        const hash = row ? asString(row.sha256) : null;
+        if (rel && hash)
+            out.set(rel, hash);
+    }
+    return out;
+}
+export function hasManifestPrefix(manifest, rel) {
+    const prefix = `${rel}/`;
+    for (const key of manifest.keys()) {
+        if (key.startsWith(prefix))
+            return true;
+    }
+    return false;
+}
+class SourceHasher {
+    ctx;
+    builder;
+    cache = new Map();
+    budget;
+    constructor(ctx, builder) {
+        this.ctx = ctx;
+        this.builder = builder;
+        this.budget = Math.max(0, ctx.limits.maxFiles);
+    }
+    hash(rel) {
+        const cached = this.cache.get(rel);
+        if (cached !== undefined)
+            return cached;
+        if (this.budget <= 0) {
+            this.builder.noteCap(CONTEXT_PACK_REL, 'source_hash_budget_exhausted');
+            this.cache.set(rel, null);
+            return null;
+        }
+        this.budget -= 1;
+        const read = readWorkspaceFile(this.ctx.root, rel, this.ctx.limits.maxFileBytes);
+        const value = read.ok ? read.value.hash : null;
+        if (!read.ok && read.skip.reason !== 'unreadable')
+            this.builder.addSkip(read.skip);
+        this.cache.set(rel, value);
+        return value;
+    }
+}
+export class EvidenceSourceGraph {
+    builder;
+    ctx;
+    manifest;
+    packHash;
+    hasher;
+    states = new Map();
+    constructor(builder, ctx, manifest, packHash) {
+        this.builder = builder;
+        this.ctx = ctx;
+        this.manifest = manifest;
+        this.packHash = packHash;
+        this.hasher = new SourceHasher(ctx, builder);
+    }
+    ensure(rel) {
+        const existing = this.states.get(rel);
+        if (existing)
+            return existing;
+        const id = contextGraphNodeId({ kind: 'source', sourceHash: shortDigest(`path:${rel}`) });
+        const stat = statWorkspaceEntry(this.ctx.root, rel);
+        const manifestHash = this.manifest.get(rel) ?? null;
+        const isDirectory = Boolean(stat?.isDirectory());
+        const diskHash = !stat || isDirectory ? null : this.hasher.hash(rel);
+        const freshness = this.freshness({ stat, isDirectory, manifestHash, diskHash, rel });
+        const metadata = {
+            source_path: rel,
+            entry_kind: isDirectory ? 'directory' : stat ? 'file' : 'missing',
+            manifest_hash_present: manifestHash !== null,
+            ...(manifestHash ? { manifest_hash: manifestHash.slice(0, 16) } : {}),
+            ...(diskHash ? { disk_hash: diskHash.slice(0, 16) } : {}),
+            ...(manifestHash && diskHash ? { hash_match: manifestHash === diskHash } : {})
+        };
+        this.builder.addNode({
+            id,
+            kind: 'source',
+            label: safeText(rel, 120) || rel,
+            path: rel,
+            ...(diskHash ? { contentHash: diskHash } : manifestHash ? { contentHash: manifestHash } : {}),
+            trust: freshness === 'fresh' ? 0.85 : freshness === 'stale' ? 0.3 : 0.5,
+            freshness,
+            risk: 'low',
+            tokenCost: tokenEstimate(rel.length, 64),
+            metadata
+        }, CONTEXT_PACK_REL);
+        if (!isDirectory && (diskHash || manifestHash))
+            this.linkBackingFile(id, rel, stat, diskHash, manifestHash);
+        const state = { id, freshness };
+        this.states.set(rel, state);
+        return state;
+    }
+    linkBackingFile(sourceId, rel, stat, diskHash, manifestHash) {
+        const fileId = contextGraphNodeId({ kind: 'file', path: rel });
+        this.builder.addNode({
+            id: fileId,
+            kind: 'file',
+            label: safeText(rel, 120) || rel,
+            path: rel,
+            ...(diskHash ? { contentHash: diskHash } : {}),
+            trust: diskHash ? 0.9 : 0.4,
+            freshness: diskHash ? 'fresh' : 'stale',
+            risk: 'low',
+            tokenCost: tokenEstimate(stat?.size ?? rel.length),
+            metadata: { evidence_stub: true, source_path: rel }
+        }, CONTEXT_PACK_REL);
+        this.builder.addEdge({
+            from: sourceId,
+            to: fileId,
+            type: 'derived_from',
+            confidence: diskHash ? 'exact' : 'manifest',
+            provenancePath: rel,
+            provenanceHash: diskHash ?? manifestHash ?? this.packHash
+        });
+    }
+    freshness(input) {
+        if (!input.stat)
+            return input.manifestHash || hasManifestPrefix(this.manifest, input.rel) ? 'stale' : 'unknown';
+        if (input.isDirectory)
+            return this.directoryFreshness(input.rel);
+        if (!input.manifestHash || !input.diskHash)
+            return 'unknown';
+        return input.diskHash === input.manifestHash ? 'fresh' : 'stale';
+    }
+    directoryFreshness(rel) {
+        const prefix = `${rel}/`;
+        const members = [...this.manifest.keys()]
+            .filter((key) => key.startsWith(prefix))
+            .sort()
+            .slice(0, MAX_DIRECTORY_PROBE);
+        if (!members.length)
+            return 'unknown';
+        for (const member of members) {
+            const expected = this.manifest.get(member);
+            const actual = this.hasher.hash(member);
+            if (!expected || !actual)
+                return 'unknown';
+            if (actual !== expected)
+                return 'stale';
+        }
+        return 'fresh';
+    }
+}

package/dist/core/triwiki/context-graph/extractors/index.js

@@ -0,0 +1,7 @@
+import { createCodeGraphExtractor } from './code/index.js';
+import { createEvidenceGraphExtractor } from './evidence/index.js';
+import { createTopologyGraphExtractor } from './topology/index.js';
+export function contextGraphExtractors() {
+    return [createCodeGraphExtractor(), createTopologyGraphExtractor(), createEvidenceGraphExtractor()];
+}
+export { createCodeGraphExtractor, createEvidenceGraphExtractor, createTopologyGraphExtractor };