sneakoscope 8.3.2 → 8.4.0

package/dist/core/triwiki/context-graph/architecture/findings.js

@@ -0,0 +1,173 @@
+import { byCodePoint } from './contracts.js';
+import { findingId, makeFinding } from './finding-factory.js';
+import { isAllowedLayerEdge, layerForModule } from './policy.js';
+import { buildModuleDependencyGraph, computeSccs, sccKey } from './metrics.js';
+import { mergeGraphWithTopology } from './topology-overlay.js';
+import { canonicalSsotAuthorityInventory } from '../../../safety/ssot-authority-inventory.js';
+import { analyzeSsotCollisions } from './ssot-analysis.js';
+export { findingId, makeFinding };
+const ANALYSIS_REQUIRED_KINDS = ['module'];
+const ANALYSIS_REQUIRED_EDGES = ['imports'];
+function severityFor(code, policy) {
+    return policy.blockingCodes.includes(code) ? 'blocking' : 'warning';
+}
+export function graphSufficiencyIssues(graph) {
+    const kinds = new Set(graph.nodes.map((node) => node.kind));
+    const edgeTypes = new Set(graph.edges.map((edge) => edge.type));
+    const missing = [];
+    for (const kind of ANALYSIS_REQUIRED_KINDS) {
+        if (!kinds.has(kind))
+            missing.push(`kind:${kind}`);
+    }
+    for (const type of ANALYSIS_REQUIRED_EDGES) {
+        if (!edgeTypes.has(type))
+            missing.push(`edge:${type}`);
+    }
+    if (!graph.nodes.length)
+        missing.push('nodes:empty');
+    return Object.freeze(missing.sort(byCodePoint));
+}
+function insufficientGraphFinding(policy, missing) {
+    return makeFinding({
+        code: 'insufficient_graph',
+        severity: severityFor('insufficient_graph', policy),
+        subjectIds: missing,
+        evidenceIds: missing,
+        ruleId: 'graph-sufficiency',
+        message: `Architecture graph lacks required kinds/edges for analysis: ${missing.join(', ')}`
+    });
+}
+export function detectNewAndExpandedCycles(input) {
+    const baselineKeys = new Map(input.baselineSccs.map((members) => [sccKey(members), members]));
+    const findings = [];
+    for (const members of input.afterSccs) {
+        const key = sccKey(members);
+        const prior = baselineKeys.get(key);
+        if (!prior) {
+            let expandedFrom = null;
+            for (const baseline of input.baselineSccs) {
+                if (baseline.every((id) => members.includes(id)) && members.length > baseline.length) {
+                    expandedFrom = baseline;
+                    break;
+                }
+            }
+            if (expandedFrom) {
+                findings.push(makeFinding({
+                    code: 'cycle_expansion',
+                    severity: severityFor('cycle_expansion', input.policy),
+                    subjectIds: members,
+                    evidenceIds: expandedFrom,
+                    ruleId: 'cycle-expansion',
+                    message: `Dependency cycle expanded from ${expandedFrom.length} to ${members.length} modules`
+                }));
+            }
+            else {
+                findings.push(makeFinding({
+                    code: 'new_cycle',
+                    severity: severityFor('new_cycle', input.policy),
+                    subjectIds: members,
+                    evidenceIds: members,
+                    ruleId: 'new-cycle',
+                    message: `New dependency cycle among ${members.length} modules`
+                }));
+            }
+        }
+    }
+    return findings.sort((left, right) => byCodePoint(left.id, right.id));
+}
+export function detectForbiddenDependencies(input) {
+    const findings = [];
+    for (const key of input.edgeKeys) {
+        const [from, to] = key.split('->');
+        if (!from || !to)
+            continue;
+        const fromLayer = layerForModule(input.policy, modulePathFromId(from));
+        const toLayer = layerForModule(input.policy, modulePathFromId(to));
+        if (!fromLayer || !toLayer)
+            continue;
+        if (!isAllowedLayerEdge(input.policy, fromLayer, toLayer)) {
+            findings.push(makeFinding({
+                code: 'forbidden_dependency',
+                severity: severityFor('forbidden_dependency', input.policy),
+                subjectIds: [from, to],
+                evidenceIds: [key],
+                ruleId: `${fromLayer}->${toLayer}`,
+                message: `Forbidden layer edge ${fromLayer} -> ${toLayer} via ${from} -> ${to}`
+            }));
+        }
+    }
+    return findings.sort((left, right) => byCodePoint(left.id, right.id));
+}
+function modulePathFromId(moduleId) {
+    return moduleId.startsWith('module:') ? moduleId.slice('module:'.length) : moduleId;
+}
+export function detectVerificationGaps(input) {
+    const protectedNodes = input.graph.nodes.filter((node) => node.risk === 'protected' || node.risk === 'high');
+    if (!protectedNodes.length)
+        return [];
+    const verifiedTargets = new Set();
+    for (const edge of input.graph.edges) {
+        if (edge.type === 'tests' || edge.type === 'verified_by' || edge.type === 'gated_by') {
+            verifiedTargets.add(edge.to);
+            verifiedTargets.add(edge.from);
+        }
+    }
+    const kinds = new Set(input.graph.nodes.map((node) => node.kind));
+    if (!kinds.has('test') && !kinds.has('gate') && !kinds.has('proof')) {
+        return [
+            makeFinding({
+                code: 'insufficient_graph',
+                severity: severityFor('insufficient_graph', input.policy),
+                subjectIds: ['kind:test', 'kind:gate', 'kind:proof'],
+                evidenceIds: protectedNodes.map((node) => node.id),
+                ruleId: 'verification-kinds',
+                message: 'Graph lacks test/gate/proof kinds required to evaluate verification gaps'
+            })
+        ];
+    }
+    const findings = [];
+    for (const node of protectedNodes) {
+        if (!verifiedTargets.has(node.id)) {
+            findings.push(makeFinding({
+                code: 'protected_verification_gap',
+                severity: severityFor('protected_verification_gap', input.policy),
+                subjectIds: [node.id],
+                evidenceIds: [node.id],
+                ruleId: 'protected-verification-gap',
+                message: `Protected/high-risk node ${node.id} has no tests/gate/evidence path`
+            }));
+        }
+    }
+    return findings.sort((left, right) => byCodePoint(left.id, right.id));
+}
+export function analyzeArchitectureFindings(input) {
+    const missing = graphSufficiencyIssues(input.bundle.graph);
+    if (missing.length) {
+        return Object.freeze([insufficientGraphFinding(input.policy, missing)]);
+    }
+    const merged = mergeGraphWithTopology(input.bundle.graph, input.bundle.topology);
+    const moduleGraph = buildModuleDependencyGraph(merged.nodes, merged.edges);
+    const afterSccs = computeSccs(moduleGraph);
+    const baselineSccs = input.baselineSccs ?? [];
+    const findings = [
+        ...detectNewAndExpandedCycles({
+            policy: input.policy,
+            baselineSccs,
+            afterSccs
+        }),
+        ...detectForbiddenDependencies({
+            policy: input.policy,
+            moduleIds: moduleGraph.moduleIds,
+            edgeKeys: moduleGraph.edgeKeys
+        }),
+        ...analyzeSsotCollisions({
+            policy: input.policy,
+            inventory: canonicalSsotAuthorityInventory()
+        }),
+        ...detectVerificationGaps({
+            policy: input.policy,
+            graph: input.bundle.graph
+        })
+    ];
+    return Object.freeze(findings.sort((left, right) => byCodePoint(left.id, right.id)));
+}

package/dist/core/triwiki/context-graph/architecture/fingerprint.js

@@ -0,0 +1,75 @@
+import { createHash } from 'node:crypto';
+import { canonicalJson } from '../../../json/canonical.js';
+import { sha256 } from '../../../fsx.js';
+import { byCodePoint } from './contracts.js';
+export function hashCanonical(value) {
+    return sha256(canonicalJson(value));
+}
+export function hashWithoutKeys(value, omit) {
+    const copy = {};
+    for (const key of Object.keys(value).sort(byCodePoint)) {
+        if (omit.includes(key))
+            continue;
+        copy[key] = value[key];
+    }
+    return hashCanonical(copy);
+}
+export function sealBaselinePayload(canonicalPayloadHash) {
+    return sha256(`sks.architecture-baseline.v1\n${canonicalPayloadHash}`);
+}
+export function buildWorktreeFingerprint(input) {
+    const paths = [...input.paths].sort((a, b) => byCodePoint(a.path, b.path));
+    const fingerprintHash = hashCanonical({
+        rootId: input.rootId,
+        head: input.head,
+        paths
+    });
+    const dirtyPaths = Object.freeze(paths.filter((entry) => entry.kind !== 'missing').map((entry) => entry.path));
+    return Object.freeze({
+        rootId: input.rootId,
+        head: input.head,
+        repositoryHead: input.head,
+        paths: Object.freeze(paths),
+        fingerprintHash,
+        hash: fingerprintHash,
+        dirtyPaths
+    });
+}
+export function emptyWorktreeFingerprint(rootId, head = null) {
+    return buildWorktreeFingerprint({ rootId, head, paths: [] });
+}
+export function shortHash(value, length = 12) {
+    return createHash('sha256').update(value).digest('hex').slice(0, length);
+}
+export function diffWorktreePaths(before, after) {
+    const beforeMap = new Map(before.map((entry) => [entry.path, entry]));
+    const afterMap = new Map(after.map((entry) => [entry.path, entry]));
+    const paths = new Set([...beforeMap.keys(), ...afterMap.keys()]);
+    const out = [];
+    for (const path of [...paths].sort(byCodePoint)) {
+        const left = beforeMap.get(path);
+        const right = afterMap.get(path);
+        if (!left && right) {
+            out.push({ path, change: 'added' });
+            continue;
+        }
+        if (left && !right) {
+            out.push({ path, change: 'removed' });
+            continue;
+        }
+        if (!left || !right)
+            continue;
+        if (left.kind !== right.kind) {
+            out.push({ path, change: 'type' });
+            continue;
+        }
+        if (left.sha256 !== right.sha256) {
+            out.push({ path, change: 'content' });
+            continue;
+        }
+        if (left.executable !== right.executable) {
+            out.push({ path, change: 'mode' });
+        }
+    }
+    return Object.freeze(out);
+}

package/dist/core/triwiki/context-graph/architecture/index.js

@@ -0,0 +1,15 @@
+export * from './contracts.js';
+export * from './policy.js';
+export * from './fingerprint.js';
+export * from './input-bundle.js';
+export * from './topology-overlay.js';
+export * from './voxel-context.js';
+export * from './slice.js';
+export * from './metrics.js';
+export * from './finding-factory.js';
+export * from './findings.js';
+export * from './ssot-analysis.js';
+export * from './baseline.js';
+export * from './delta.js';
+export * from './capsule.js';
+export * from './validation.js';

package/dist/core/triwiki/context-graph/architecture/input-bundle.js

@@ -0,0 +1,66 @@
+import { canonicalSsotAuthorityInventory } from '../../../safety/ssot-authority-inventory.js';
+import { ARCHITECTURE_ANALYZER_VERSION, ARCHITECTURE_INPUT_BUNDLE_SCHEMA, ARCHITECTURE_SERIALIZER_VERSION } from './contracts.js';
+import { emptyWorktreeFingerprint, hashCanonical, hashWithoutKeys } from './fingerprint.js';
+import { buildTopologyOverlayFromSnapshot, emptyTopologyOverlay, topologyOverlayHash } from './topology-overlay.js';
+import { emptyVoxelContext, voxelContextHash } from './voxel-context.js';
+export function policyContentHash(policy) {
+    return hashCanonical(policy);
+}
+export function buildArchitectureInputBundle(options) {
+    const topology = options.topologyMode === 'empty'
+        ? emptyTopologyOverlay()
+        : buildTopologyOverlayFromSnapshot(options.graph);
+    const ssotInventory = canonicalSsotAuthorityInventory().map((domain) => Object.freeze({ id: domain.id }));
+    const voxelContext = emptyVoxelContext(options.profile ?? 'global');
+    const worktree = options.worktree ?? emptyWorktreeFingerprint(options.rootId);
+    const policyHash = options.policyHash ?? policyContentHash(options.policy);
+    const generatedAt = options.generatedAt ?? '1970-01-01T00:00:00.000Z';
+    const partial = {
+        schema: ARCHITECTURE_INPUT_BUNDLE_SCHEMA,
+        rootId: options.rootId,
+        graph: options.graph,
+        graphHash: options.graph.snapshotHash,
+        topology,
+        topologyHash: topologyOverlayHash(topology),
+        ssotInventory: Object.freeze(ssotInventory),
+        ssotInventoryHash: hashCanonical(ssotInventory),
+        voxelContext,
+        voxelContextHash: voxelContextHash(voxelContext),
+        worktree,
+        policyHash,
+        analyzerVersion: ARCHITECTURE_ANALYZER_VERSION,
+        serializerVersion: ARCHITECTURE_SERIALIZER_VERSION,
+        generatedAt
+    };
+    const canonicalHash = hashWithoutKeys({
+        schema: partial.schema,
+        rootId: partial.rootId,
+        graphHash: partial.graphHash,
+        topologyHash: partial.topologyHash,
+        ssotInventoryHash: partial.ssotInventoryHash,
+        voxelContextHash: partial.voxelContextHash,
+        worktree: partial.worktree.fingerprintHash,
+        policyHash: partial.policyHash,
+        analyzerVersion: partial.analyzerVersion,
+        serializerVersion: partial.serializerVersion
+    }, []);
+    const bundle = Object.freeze({
+        ...partial,
+        canonicalHash
+    });
+    return bundle;
+}
+export function architectureInputBundleHash(bundle) {
+    return hashWithoutKeys({
+        schema: bundle.schema,
+        rootId: bundle.rootId,
+        graphHash: bundle.graphHash,
+        topologyHash: bundle.topologyHash,
+        ssotInventoryHash: bundle.ssotInventoryHash,
+        voxelContextHash: bundle.voxelContextHash,
+        worktree: bundle.worktree.fingerprintHash,
+        policyHash: bundle.policyHash,
+        analyzerVersion: bundle.analyzerVersion,
+        serializerVersion: bundle.serializerVersion
+    }, []);
+}

package/dist/core/triwiki/context-graph/architecture/metrics.js

@@ -0,0 +1,137 @@
+import { byCodePoint } from './contracts.js';
+import { mergeGraphWithTopology } from './topology-overlay.js';
+export function buildModuleDependencyGraph(nodes, edges) {
+    const modules = nodes.filter((node) => node.kind === 'module').map((node) => node.id).sort(byCodePoint);
+    const moduleSet = new Set(modules);
+    const fileToModule = new Map();
+    for (const edge of edges) {
+        if (edge.type !== 'contains')
+            continue;
+        if (moduleSet.has(edge.from))
+            fileToModule.set(edge.to, edge.from);
+    }
+    const resolve = (id) => {
+        if (moduleSet.has(id))
+            return id;
+        return fileToModule.get(id) ?? null;
+    };
+    const adj = new Map();
+    const rev = new Map();
+    for (const id of modules) {
+        adj.set(id, new Set());
+        rev.set(id, new Set());
+    }
+    const edgeKeys = new Set();
+    for (const edge of edges) {
+        if (edge.type !== 'imports' && edge.type !== 'reexports' && edge.type !== 'depends_on')
+            continue;
+        const from = resolve(edge.from);
+        const to = resolve(edge.to);
+        if (!from || !to || from === to)
+            continue;
+        adj.get(from)?.add(to);
+        rev.get(to)?.add(from);
+        edgeKeys.add(`${from}->${to}`);
+    }
+    return {
+        moduleIds: Object.freeze(modules),
+        adjacency: new Map([...adj.entries()].map(([key, value]) => [key, Object.freeze([...value].sort(byCodePoint))])),
+        reverse: new Map([...rev.entries()].map(([key, value]) => [key, Object.freeze([...value].sort(byCodePoint))])),
+        edgeKeys: Object.freeze([...edgeKeys].sort(byCodePoint))
+    };
+}
+export function computeSccs(graph) {
+    let index = 0;
+    const indices = new Map();
+    const lowlink = new Map();
+    const onStack = new Set();
+    const stack = [];
+    const sccs = [];
+    const strongConnect = (node) => {
+        indices.set(node, index);
+        lowlink.set(node, index);
+        index += 1;
+        stack.push(node);
+        onStack.add(node);
+        for (const next of graph.adjacency.get(node) ?? []) {
+            if (!indices.has(next)) {
+                strongConnect(next);
+                lowlink.set(node, Math.min(lowlink.get(node) ?? 0, lowlink.get(next) ?? 0));
+            }
+            else if (onStack.has(next)) {
+                lowlink.set(node, Math.min(lowlink.get(node) ?? 0, indices.get(next) ?? 0));
+            }
+        }
+        if (lowlink.get(node) === indices.get(node)) {
+            const component = [];
+            while (true) {
+                const item = stack.pop();
+                if (item === undefined)
+                    break;
+                onStack.delete(item);
+                component.push(item);
+                if (item === node)
+                    break;
+            }
+            component.sort(byCodePoint);
+            if (component.length >= 2)
+                sccs.push(component);
+        }
+    };
+    for (const node of graph.moduleIds) {
+        if (!indices.has(node))
+            strongConnect(node);
+    }
+    sccs.sort((left, right) => byCodePoint(left.join('\0'), right.join('\0')));
+    return Object.freeze(sccs.map((component) => Object.freeze(component)));
+}
+function percentile(sorted, p) {
+    if (!sorted.length)
+        return 0;
+    const rank = Math.min(sorted.length - 1, Math.max(0, Math.ceil(p * sorted.length) - 1));
+    return sorted[rank] ?? 0;
+}
+export function computeArchitectureMetrics(input) {
+    const merged = mergeGraphWithTopology(input.graph, input.topology ?? {
+        nodes: [],
+        edges: [],
+        sourceManifestHashes: {},
+        extractionErrors: []
+    });
+    const moduleGraph = buildModuleDependencyGraph(merged.nodes, merged.edges);
+    const sccs = computeSccs(moduleGraph);
+    const cyclic = new Set(sccs.flatMap((component) => component));
+    const fanOut = moduleGraph.moduleIds.map((id) => (moduleGraph.adjacency.get(id) ?? []).length).sort((a, b) => a - b);
+    const fanIn = moduleGraph.moduleIds.map((id) => (moduleGraph.reverse.get(id) ?? []).length).sort((a, b) => a - b);
+    const publicSurfaceCount = merged.nodes.filter((node) => node.kind === 'command' || node.kind === 'route' || node.kind === 'schema' ||
+        (typeof node.metadata.public === 'boolean' && node.metadata.public === true)).length;
+    return Object.freeze({
+        nodeCount: merged.nodes.length,
+        edgeCount: merged.edges.length,
+        moduleCount: moduleGraph.moduleIds.length,
+        publicSurfaceCount,
+        sccCount: sccs.length,
+        cyclicNodeCount: cyclic.size,
+        largestSccSize: sccs.reduce((max, component) => Math.max(max, component.length), 0),
+        maxFanIn: fanIn.length ? fanIn[fanIn.length - 1] : 0,
+        maxFanOut: fanOut.length ? fanOut[fanOut.length - 1] : 0,
+        p95FanIn: percentile(fanIn, 0.95),
+        p95FanOut: percentile(fanOut, 0.95),
+        layerViolationCount: input.layerViolationCount ?? 0,
+        ssotCollisionCount: input.ssotCollisionCount ?? 0,
+        authorityBypassCount: input.authorityBypassCount ?? 0,
+        protectedVerificationGapCount: input.protectedVerificationGapCount ?? 0,
+        passthroughChainCount: input.passthroughChainCount ?? 0,
+        duplicateFacadeCount: input.duplicateFacadeCount ?? 0,
+        orphanEntrypointCount: input.orphanEntrypointCount ?? 0,
+        averageArchitectureDepth: null,
+        maxArchitectureDepth: null,
+        changedPathAccounting: null,
+        projectionAccounting: null,
+        eligibleExtractionSuccess: null,
+        unknownDynamicRelationCount: input.unknownDynamicRelationCount ?? 0
+    });
+}
+export function sccKey(members) {
+    return [...members].sort(byCodePoint).join('|');
+}