sneakoscope 8.3.2 → 8.4.0

package/dist/core/safety/ssot-authority-inventory.js

@@ -0,0 +1,114 @@
+export const SKS_SSOT_AUTHORITY_INVENTORY = Object.freeze([
+    Object.freeze({
+        id: 'route_contract',
+        title: 'Route contract',
+        authorityKind: 'runtime_owner',
+        canonicalSources: Object.freeze([
+            'decision-contract.json, route prompt, and pipeline-plan.json'
+        ]),
+        allowedWriters: Object.freeze(['pipeline plan writer', 'request intake']),
+        allowedReaders: Object.freeze(['naruto', 'workers', 'stop gate']),
+        derivedArtifacts: Object.freeze([
+            'subagent-plan.json',
+            'subagent-events.jsonl',
+            'worker inboxes'
+        ]),
+        protected: true,
+        description: 'The sealed user objective, constraints, non-goals, and acceptance criteria define what code may be created.',
+        authority: 'The sealed user objective, constraints, non-goals, and acceptance criteria define what code may be created.',
+        rule: 'Do not implement behavior outside the sealed route contract; block with evidence if the requested path cannot be honored.'
+    }),
+    Object.freeze({
+        id: 'triwiki_context',
+        title: 'TriWiki context pack',
+        authorityKind: 'file',
+        canonicalSources: Object.freeze(['.sneakoscope/wiki/context-pack.json']),
+        allowedWriters: Object.freeze(['sks wiki pack', 'sks align run', 'triwiki refresh']),
+        allowedReaders: Object.freeze(['pipeline stages', 'naruto parent', 'honest mode']),
+        derivedArtifacts: Object.freeze([
+            'subagent-parent-summary.json',
+            'subagent-evidence.json',
+            'reflection.md'
+        ]),
+        protected: true,
+        description: 'TriWiki is the bounded mission context SSOT and must be refreshed or packed, then validated before risky handoffs and final claims.',
+        authority: 'TriWiki is the bounded mission context SSOT and must be refreshed or packed, then validated before risky handoffs and final claims.',
+        rule: 'Use the latest coordinate+voxel overlay pack; coordinate-only legacy packs are invalid for pipeline decisions.'
+    }),
+    Object.freeze({
+        id: 'runtime_source',
+        title: 'TypeScript runtime source',
+        authorityKind: 'file',
+        canonicalSources: Object.freeze(['src/**/*.ts']),
+        allowedWriters: Object.freeze(['implementation workers under sealed route']),
+        allowedReaders: Object.freeze(['build', 'tests', 'release gates']),
+        derivedArtifacts: Object.freeze(['dist/**', 'dist/bin/sks.js']),
+        protected: true,
+        description: 'TypeScript source is the runtime SSOT.',
+        authority: 'TypeScript source is the runtime SSOT.',
+        rule: 'Edit source, rebuild derived output, and rely on runtime:ts-source-of-truth plus runtime:dist-parity.'
+    }),
+    Object.freeze({
+        id: 'generated_outputs',
+        title: 'Generated outputs',
+        authorityKind: 'generated_projection',
+        canonicalSources: Object.freeze([
+            'source generators, build scripts, and schema definitions'
+        ]),
+        allowedWriters: Object.freeze(['generators', 'build scripts']),
+        allowedReaders: Object.freeze(['release', 'doctor', 'install']),
+        derivedArtifacts: Object.freeze([
+            'release-gates.v2.json',
+            'infra-harness-gates.json',
+            '.sneakoscope/reports/**',
+            'dist/build-manifest.json'
+        ]),
+        protected: true,
+        description: 'Generated files are derived from their generator or schema owner.',
+        authority: 'Generated files are derived from their generator or schema owner.',
+        rule: 'Regenerate derived artifacts instead of hand-editing them as independent truth.'
+    }),
+    Object.freeze({
+        id: 'stack_current_docs',
+        title: 'Stack current docs',
+        authorityKind: 'file',
+        canonicalSources: Object.freeze(['.sneakoscope/memory/q2_facts/stack-current-docs.md']),
+        allowedWriters: Object.freeze(['Context7 hydration', 'docs refresh']),
+        allowedReaders: Object.freeze(['implementation', 'research']),
+        derivedArtifacts: Object.freeze(['implementation notes', 'route evidence']),
+        protected: false,
+        description: 'Current vendor or Context7 docs override model-memory defaults when stack versions or APIs change.',
+        authority: 'Current vendor or Context7 docs override model-memory defaults when stack versions or APIs change.',
+        rule: 'Fetch and record current docs before relying on external package, SDK, API, MCP, or generated-doc behavior that may have changed.'
+    }),
+    Object.freeze({
+        id: 'release_gate_manifest',
+        title: 'Release gate manifest',
+        authorityKind: 'manifest',
+        canonicalSources: Object.freeze([
+            'src/core/release/gate-manifest.ts and src/scripts/release-parallel-check.ts'
+        ]),
+        allowedWriters: Object.freeze(['release maintainers via source edit']),
+        allowedReaders: Object.freeze(['release DAG', 'publish preflight']),
+        derivedArtifacts: Object.freeze([
+            '.sneakoscope/reports/release-gate-plan.json',
+            '.sneakoscope/reports/gate-policy-audit.json'
+        ]),
+        protected: true,
+        description: 'Release gate selection and publish-required status live in the manifest plus the release DAG.',
+        authority: 'Release gate selection and publish-required status live in the manifest plus the release DAG.',
+        rule: 'Publish-blocking guard gates must appear in the DAG, manifest, and package scripts.'
+    })
+]);
+export function canonicalSsotAuthorityInventory() {
+    return SKS_SSOT_AUTHORITY_INVENTORY;
+}
+export function inventoryAsSsotGuardSources() {
+    return SKS_SSOT_AUTHORITY_INVENTORY.map((domain) => ({
+        id: domain.id,
+        source: domain.canonicalSources.join(', '),
+        authority: domain.authority,
+        derived: [...domain.derivedArtifacts],
+        rule: domain.rule
+    }));
+}

package/dist/core/safety/ssot-guard.js

@@ -1,5 +1,6 @@
 import { nowIso } from '../fsx.js';
 import { isRecord } from '../json/records.js';
+import { inventoryAsSsotGuardSources } from './ssot-authority-inventory.js';
 export const SSOT_GUARD_SCHEMA = 'sks.ssot-guard.v1';
 export const SSOT_GUARD_ARTIFACT = 'ssot-guard.json';
 export function buildSsotGuard(input = {}) {
@@ -34,50 +35,7 @@ export function buildSsotGuard(input = {}) {
     };
 }
 export function canonicalSsotSources() {
-    return [
-        {
-            id: 'route_contract',
-            source: 'decision-contract.json, route prompt, and pipeline-plan.json',
-            authority: 'The sealed user objective, constraints, non-goals, and acceptance criteria define what code may be created.',
-            derived: ['subagent-plan.json', 'subagent-events.jsonl', 'worker inboxes'],
-            rule: 'Do not implement behavior outside the sealed route contract; block with evidence if the requested path cannot be honored.'
-        },
-        {
-            id: 'triwiki_context',
-            source: '.sneakoscope/wiki/context-pack.json',
-            authority: 'TriWiki is the bounded mission context SSOT and must be refreshed or packed, then validated before risky handoffs and final claims.',
-            derived: ['subagent-parent-summary.json', 'subagent-evidence.json', 'reflection.md'],
-            rule: 'Use the latest coordinate+voxel overlay pack; coordinate-only legacy packs are invalid for pipeline decisions.'
-        },
-        {
-            id: 'runtime_source',
-            source: 'src/**/*.ts',
-            authority: 'TypeScript source is the runtime SSOT.',
-            derived: ['dist/**', 'dist/bin/sks.js'],
-            rule: 'Edit source, rebuild derived output, and rely on runtime:ts-source-of-truth plus runtime:dist-parity.'
-        },
-        {
-            id: 'generated_outputs',
-            source: 'source generators, build scripts, and schema definitions',
-            authority: 'Generated files are derived from their generator or schema owner.',
-            derived: ['release-gates.v2.json', 'infra-harness-gates.json', '.sneakoscope/reports/**', 'dist/build-manifest.json'],
-            rule: 'Regenerate derived artifacts instead of hand-editing them as independent truth.'
-        },
-        {
-            id: 'stack_current_docs',
-            source: '.sneakoscope/memory/q2_facts/stack-current-docs.md',
-            authority: 'Current vendor or Context7 docs override model-memory defaults when stack versions or APIs change.',
-            derived: ['implementation notes', 'route evidence'],
-            rule: 'Fetch and record current docs before relying on external package, SDK, API, MCP, or generated-doc behavior that may have changed.'
-        },
-        {
-            id: 'release_gate_manifest',
-            source: 'src/core/release/gate-manifest.ts and src/scripts/release-parallel-check.ts',
-            authority: 'Release gate selection and publish-required status live in the manifest plus the release DAG.',
-            derived: ['.sneakoscope/reports/release-gate-plan.json', '.sneakoscope/reports/gate-policy-audit.json'],
-            rule: 'Publish-blocking guard gates must appear in the DAG, manifest, and package scripts.'
-        }
-    ];
+    return inventoryAsSsotGuardSources().map((row) => ({ ...row }));
 }
 export function validateSsotGuardArtifact(value) {
     const issues = [];

package/dist/core/triwiki/context-graph/architecture/baseline.js

@@ -0,0 +1,81 @@
+import { sha256 } from '../../../fsx.js';
+import { ARCHITECTURE_BASELINE_SCHEMA } from './contracts.js';
+import { hashCanonical } from './fingerprint.js';
+import { analyzeArchitectureFindings } from './findings.js';
+import { computeArchitectureMetrics, computeSccs, buildModuleDependencyGraph } from './metrics.js';
+import { mergeGraphWithTopology } from './topology-overlay.js';
+export function sealArchitectureBaseline(canonicalPayloadHash) {
+    return sha256(`${ARCHITECTURE_BASELINE_SCHEMA}\n${canonicalPayloadHash}`);
+}
+export function buildArchitectureBaseline(input) {
+    const merged = mergeGraphWithTopology(input.bundle.graph, input.bundle.topology);
+    const moduleGraph = buildModuleDependencyGraph(merged.nodes, merged.edges);
+    const sccs = computeSccs(moduleGraph);
+    const findings = input.findings ?? analyzeArchitectureFindings({
+        bundle: input.bundle,
+        policy: input.policy,
+        baselineSccs: []
+    });
+    const metrics = input.metrics ?? computeArchitectureMetrics({
+        graph: input.bundle.graph,
+        topology: input.bundle.topology,
+        layerViolationCount: findings.filter((finding) => finding.code === 'forbidden_dependency').length,
+        ssotCollisionCount: findings.filter((finding) => finding.code === 'ssot_collision').length,
+        authorityBypassCount: findings.filter((finding) => finding.code === 'authority_bypass').length,
+        protectedVerificationGapCount: findings.filter((finding) => finding.code === 'protected_verification_gap').length
+    });
+    const viewHashes = Object.freeze({ ...(input.viewHashes ?? {}) });
+    const payload = {
+        schema: ARCHITECTURE_BASELINE_SCHEMA,
+        missionId: input.missionId,
+        routeId: input.routeId,
+        taskProfile: input.taskProfile,
+        required: true,
+        capturedBeforeMutation: true,
+        repositoryHead: input.bundle.worktree.repositoryHead,
+        worktreeFingerprintHash: input.bundle.worktree.hash,
+        preexistingDirtyPaths: input.bundle.worktree.dirtyPaths,
+        graphHash: input.bundle.graphHash,
+        topologyHash: input.bundle.topologyHash,
+        ssotInventoryHash: input.bundle.ssotInventoryHash,
+        voxelContextHash: input.bundle.voxelContextHash,
+        policyHash: input.bundle.policyHash,
+        analyzerVersion: input.bundle.analyzerVersion,
+        serializerVersion: input.bundle.serializerVersion,
+        scope: input.scope,
+        metrics,
+        findings,
+        viewHashes,
+        sccKeys: sccs.map((members) => members.join('|'))
+    };
+    const canonicalPayloadHash = hashCanonical(payload);
+    const seal = sealArchitectureBaseline(canonicalPayloadHash);
+    return Object.freeze({
+        schema: ARCHITECTURE_BASELINE_SCHEMA,
+        missionId: input.missionId,
+        routeId: input.routeId,
+        taskProfile: input.taskProfile,
+        required: true,
+        capturedAt: input.capturedAt,
+        capturedBeforeMutation: true,
+        repositoryHead: input.bundle.worktree.repositoryHead,
+        worktreeFingerprintHash: input.bundle.worktree.hash,
+        preexistingDirtyPaths: Object.freeze([...input.bundle.worktree.dirtyPaths]),
+        graphHash: input.bundle.graphHash,
+        topologyHash: input.bundle.topologyHash,
+        ssotInventoryHash: input.bundle.ssotInventoryHash,
+        voxelContextHash: input.bundle.voxelContextHash,
+        policyHash: input.bundle.policyHash,
+        analyzerVersion: input.bundle.analyzerVersion,
+        serializerVersion: input.bundle.serializerVersion,
+        scope: input.scope,
+        metrics,
+        findings: Object.freeze([...findings]),
+        viewHashes,
+        canonicalPayloadHash,
+        seal
+    });
+}
+export function verifyArchitectureBaselineSeal(baseline) {
+    return baseline.seal === sealArchitectureBaseline(baseline.canonicalPayloadHash);
+}

package/dist/core/triwiki/context-graph/architecture/capsule.js

@@ -0,0 +1,34 @@
+import { byCodePoint } from './contracts.js';
+import { hashCanonical } from './fingerprint.js';
+export function renderArchitectureCapsule(input) {
+    const blocking = input.findings
+        .filter((finding) => finding.severity === 'blocking')
+        .sort((left, right) => byCodePoint(left.id, right.id));
+    const baselineShort = input.baseline ? input.baseline.seal.slice(0, 12) : 'none';
+    const lines = [
+        `schema=sks.architecture-capsule.v1`,
+        `profile=${input.profile}`,
+        `mission=${input.missionId}`,
+        `route=${input.routeId ?? 'unknown'}`,
+        `baseline=${baselineShort}`,
+        `modules=${input.metrics.moduleCount}`,
+        `scc=${input.metrics.sccCount}`,
+        `fan_in_max=${input.metrics.maxFanIn}`,
+        `fan_out_max=${input.metrics.maxFanOut}`,
+        `layer_violations=${input.metrics.layerViolationCount}`,
+        `ssot_collisions=${input.metrics.ssotCollisionCount}`,
+        `verification_gaps=${input.metrics.protectedVerificationGapCount}`,
+        `affected_gates=${(input.affectedGates ?? []).slice().sort(byCodePoint).join(',') || 'none'}`,
+        `blocking_findings=${blocking.map((finding) => `${finding.id}:${finding.code}`).join(',') || 'none'}`,
+        `seeds=${(input.seedPaths ?? []).slice().sort(byCodePoint).join(',') || 'none'}`,
+        `map=${input.mapArtifact ?? 'architecture-map-delta.mmd'}`
+    ];
+    const text = `${lines.join('\n')}\n`;
+    return Object.freeze({
+        schema: 'sks.architecture-capsule.v1',
+        text,
+        byteLength: Buffer.byteLength(text, 'utf8'),
+        profile: input.profile,
+        contentHash: hashCanonical(text)
+    });
+}

package/dist/core/triwiki/context-graph/architecture/contracts.js

@@ -0,0 +1,67 @@
+export const ARCHITECTURE_INPUT_BUNDLE_SCHEMA = 'sks.architecture-input-bundle.v1';
+export const ARCHITECTURE_BASELINE_SCHEMA = 'sks.architecture-baseline.v1';
+export const ARCHITECTURE_REVIEW_SCHEMA = 'sks.architecture-review.v1';
+export const ARCHITECTURE_MAP_MANIFEST_SCHEMA = 'sks.architecture-map-manifest.v1';
+export const ARCHITECTURE_MAP_POLICY_SCHEMA = 'sks.architecture-map-policy.v1';
+export const MERMAID_PROJECTION_SCHEMA = 'sks.mermaid-projection.v1';
+export const ARCHITECTURE_ANALYZER_VERSION = 'architecture-map-analyzer.v1';
+export const ARCHITECTURE_SERIALIZER_VERSION = 'mermaid-serializer.v1';
+export const ARCHITECTURE_MAP_DIR_REL = '.sneakoscope/wiki/architecture-map';
+export const ARCHITECTURE_MAP_POLICY_FILE = 'config/architecture-map-policy.v1.json';
+export const ARCHITECTURE_MAP_VIEW_IDS = Object.freeze([
+    'project-topology',
+    'module-dependency',
+    'public-surface',
+    'ssot-provenance',
+    'runtime-control',
+    'verification-coverage',
+    'risk-domains',
+    'change-impact',
+    'architecture-delta',
+    'ownership-workstream'
+]);
+export const GLOBAL_ARCHITECTURE_MAP_VIEW_IDS = Object.freeze([
+    'project-topology',
+    'module-dependency',
+    'public-surface',
+    'ssot-provenance',
+    'runtime-control',
+    'verification-coverage',
+    'risk-domains'
+]);
+export const ARCHITECTURE_FINDING_CODES = Object.freeze([
+    'baseline_missing',
+    'baseline_late',
+    'baseline_stale',
+    'baseline_tampered',
+    'graph_stale',
+    'map_parity_failure',
+    'unaccounted_changed_file',
+    'new_cycle',
+    'cycle_expansion',
+    'forbidden_dependency',
+    'layer_skip',
+    'ssot_collision',
+    'authority_bypass',
+    'protected_verification_gap',
+    'fan_out_regression',
+    'fan_in_unverified',
+    'passthrough_chain',
+    'redundant_parallel_path',
+    'duplicate_facade',
+    'orphan_entrypoint',
+    'unowned_high_risk',
+    'test_distance_increase',
+    'architecture_depth_increase',
+    'cross_workstream_write_overlap',
+    'unknown_dynamic_relation',
+    'insufficient_graph'
+]);
+export function byCodePoint(left, right) {
+    if (left < right)
+        return -1;
+    return left > right ? 1 : 0;
+}
+export function sortStrings(values) {
+    return [...values].sort(byCodePoint);
+}

package/dist/core/triwiki/context-graph/architecture/delta.js

@@ -0,0 +1,149 @@
+import { ARCHITECTURE_REVIEW_SCHEMA, byCodePoint } from './contracts.js';
+import { verifyArchitectureBaselineSeal } from './baseline.js';
+import { diffWorktreePaths, hashCanonical } from './fingerprint.js';
+import { analyzeArchitectureFindings } from './findings.js';
+import { computeArchitectureMetrics } from './metrics.js';
+export function metricDelta(before, after) {
+    return Object.freeze({
+        sccCountDelta: after.sccCount - before.sccCount,
+        cyclicNodeCountDelta: after.cyclicNodeCount - before.cyclicNodeCount,
+        layerViolationCountDelta: after.layerViolationCount - before.layerViolationCount,
+        ssotCollisionCountDelta: after.ssotCollisionCount - before.ssotCollisionCount,
+        protectedVerificationGapCountDelta: after.protectedVerificationGapCount - before.protectedVerificationGapCount
+    });
+}
+function partitionFindings(before, after) {
+    const beforeIds = new Set(before.map((finding) => finding.id));
+    const afterIds = new Set(after.map((finding) => finding.id));
+    const byId = (left, right) => byCodePoint(left.id, right.id);
+    return {
+        newFindings: after.filter((finding) => !beforeIds.has(finding.id)).sort(byId),
+        resolvedFindings: before.filter((finding) => !afterIds.has(finding.id)).sort(byId),
+        persistentFindings: after.filter((finding) => beforeIds.has(finding.id)).sort(byId)
+    };
+}
+function baselineSccsFromFindings(findings) {
+    return Object.freeze(findings
+        .filter((finding) => finding.code === 'new_cycle' || finding.code === 'cycle_expansion')
+        .map((finding) => finding.subjectIds));
+}
+function countCodes(findings, code) {
+    return findings.filter((finding) => finding.code === code).length;
+}
+export function buildArchitectureDelta(input) {
+    const afterFindings = analyzeArchitectureFindings({
+        bundle: input.afterBundle,
+        policy: input.policy,
+        baselineSccs: baselineSccsFromFindings(input.baseline.findings)
+    });
+    const partitioned = partitionFindings(input.baseline.findings, afterFindings);
+    const afterMetrics = computeArchitectureMetrics({
+        graph: input.afterBundle.graph,
+        topology: input.afterBundle.topology,
+        layerViolationCount: countCodes(afterFindings, 'forbidden_dependency'),
+        ssotCollisionCount: countCodes(afterFindings, 'ssot_collision'),
+        protectedVerificationGapCount: countCodes(afterFindings, 'protected_verification_gap')
+    });
+    return Object.freeze({
+        schema: 'sks.architecture-delta.v1',
+        missionId: input.missionId,
+        baselineSeal: input.baseline.seal,
+        addedNodeIds: Object.freeze([]),
+        removedNodeIds: Object.freeze([]),
+        addedEdgeIds: Object.freeze([]),
+        removedEdgeIds: Object.freeze([]),
+        newFindings: Object.freeze(partitioned.newFindings),
+        resolvedFindings: Object.freeze(partitioned.resolvedFindings),
+        metricDelta: metricDelta(input.baseline.metrics, afterMetrics)
+    });
+}
+export function buildArchitectureReview(input) {
+    const sealValid = verifyArchitectureBaselineSeal(input.baseline);
+    const changedPaths = [...diffWorktreePaths(input.baseline.preexistingDirtyPaths.map((path) => ({
+            path,
+            kind: 'file',
+            sha256: 'baseline',
+            size: 0,
+            executable: false
+        })), input.afterBundle.worktree.paths)];
+    const changedPathSet = new Set(changedPaths.map((entry) => entry.path));
+    const accounted = [...(input.accountedChangedPaths ?? [...changedPathSet])].sort(byCodePoint);
+    const accountedSet = new Set(accounted);
+    const unaccounted = [...changedPathSet].filter((path) => !accountedSet.has(path)).sort(byCodePoint);
+    const afterFindings = analyzeArchitectureFindings({
+        bundle: input.afterBundle,
+        policy: input.policy,
+        baselineSccs: baselineSccsFromFindings(input.baseline.findings)
+    });
+    const partitioned = partitionFindings(input.baseline.findings, afterFindings);
+    const afterMetrics = computeArchitectureMetrics({
+        graph: input.afterBundle.graph,
+        topology: input.afterBundle.topology,
+        layerViolationCount: countCodes(afterFindings, 'forbidden_dependency'),
+        ssotCollisionCount: countCodes(afterFindings, 'ssot_collision'),
+        authorityBypassCount: countCodes(afterFindings, 'authority_bypass'),
+        protectedVerificationGapCount: countCodes(afterFindings, 'protected_verification_gap')
+    });
+    const newBlocking = afterFindings
+        .filter((finding) => finding.severity === 'blocking' && finding.disposition === 'open')
+        .filter((finding) => !input.baseline.findings.some((prior) => prior.id === finding.id))
+        .map((finding) => finding.id)
+        .sort(byCodePoint);
+    const blockers = [];
+    if (!sealValid)
+        blockers.push('baseline_tampered');
+    if (input.baseline.policyHash !== input.afterBundle.policyHash ||
+        input.baseline.analyzerVersion !== input.afterBundle.analyzerVersion ||
+        input.baseline.serializerVersion !== input.afterBundle.serializerVersion) {
+        blockers.push('baseline_stale');
+    }
+    if (unaccounted.length)
+        blockers.push('unaccounted_changed_file');
+    if (newBlocking.length)
+        blockers.push('blocking_findings');
+    const verification = Object.freeze({
+        baselineValid: input.baseline.schema === 'sks.architecture-baseline.v1',
+        baselineTimely: input.baseline.capturedBeforeMutation === true,
+        baselineFresh: !blockers.includes('baseline_stale'),
+        sealValid,
+        changedPathAccounting: unaccounted.length === 0 ? 1 : 0,
+        projectionAccounting: 1,
+        blockers: Object.freeze([...blockers].sort(byCodePoint))
+    });
+    const blockingFindingIds = Object.freeze([...newBlocking, ...(unaccounted.length ? ['unaccounted_changed_file'] : [])].sort(byCodePoint));
+    const verdict = verification.baselineValid &&
+        verification.baselineTimely &&
+        verification.baselineFresh &&
+        verification.sealValid &&
+        verification.changedPathAccounting === 1 &&
+        newBlocking.length === 0 &&
+        unaccounted.length === 0
+        ? 'pass'
+        : 'block';
+    const payload = {
+        schema: ARCHITECTURE_REVIEW_SCHEMA,
+        missionId: input.missionId,
+        baselineSeal: input.baseline.seal,
+        baselineHash: input.baseline.canonicalPayloadHash,
+        afterInputHash: input.afterBundle.canonicalHash,
+        changedPaths,
+        accountedChangedPaths: accounted,
+        unaccountedChangedPaths: unaccounted,
+        beforeMetrics: input.baseline.metrics,
+        afterMetrics,
+        metricDelta: metricDelta(input.baseline.metrics, afterMetrics),
+        newFindings: partitioned.newFindings,
+        resolvedFindings: partitioned.resolvedFindings,
+        persistentFindings: partitioned.persistentFindings,
+        acceptedExceptions: [],
+        projectionAccounting: input.projectionAccounting ?? {},
+        verification,
+        verdict,
+        blockingFindingIds
+    };
+    return Object.freeze({
+        ...payload,
+        canonicalPayloadHash: hashCanonical(payload),
+        generatedAt: input.generatedAt
+    });
+}

package/dist/core/triwiki/context-graph/architecture/finding-factory.js

@@ -0,0 +1,28 @@
+import { sha256 } from '../../../fsx.js';
+import { sortStrings } from './contracts.js';
+const FINDING_SCHEMA = 'sks.architecture-finding.v1';
+export function findingId(input) {
+    const payload = [
+        FINDING_SCHEMA,
+        input.code,
+        ...sortStrings(input.subjectIds),
+        ...sortStrings(input.evidenceIds),
+        input.ruleId
+    ].join('\n');
+    return `af_${sha256(payload).slice(0, 24)}`;
+}
+export function makeFinding(input) {
+    const subjectIds = Object.freeze(sortStrings(input.subjectIds));
+    const evidenceIds = Object.freeze(sortStrings(input.evidenceIds ?? []));
+    const ruleId = input.ruleId ?? '';
+    return Object.freeze({
+        id: findingId({ code: input.code, subjectIds, evidenceIds, ruleId }),
+        code: input.code,
+        severity: input.severity,
+        subjectIds,
+        evidenceIds,
+        ruleId,
+        message: input.message,
+        disposition: 'open'
+    });
+}