sneakoscope 8.3.2 → 8.6.0

package/dist/core/triwiki/context-graph/architecture/baseline.js

@@ -0,0 +1,81 @@
+import { sha256 } from '../../../fsx.js';
+import { ARCHITECTURE_BASELINE_SCHEMA } from './contracts.js';
+import { hashCanonical } from './fingerprint.js';
+import { analyzeArchitectureFindings } from './findings.js';
+import { computeArchitectureMetrics, computeSccs, buildModuleDependencyGraph } from './metrics.js';
+import { mergeGraphWithTopology } from './topology-overlay.js';
+export function sealArchitectureBaseline(canonicalPayloadHash) {
+    return sha256(`${ARCHITECTURE_BASELINE_SCHEMA}\n${canonicalPayloadHash}`);
+}
+export function buildArchitectureBaseline(input) {
+    const merged = mergeGraphWithTopology(input.bundle.graph, input.bundle.topology);
+    const moduleGraph = buildModuleDependencyGraph(merged.nodes, merged.edges);
+    const sccs = computeSccs(moduleGraph);
+    const findings = input.findings ?? analyzeArchitectureFindings({
+        bundle: input.bundle,
+        policy: input.policy,
+        baselineSccs: []
+    });
+    const metrics = input.metrics ?? computeArchitectureMetrics({
+        graph: input.bundle.graph,
+        topology: input.bundle.topology,
+        layerViolationCount: findings.filter((finding) => finding.code === 'forbidden_dependency').length,
+        ssotCollisionCount: findings.filter((finding) => finding.code === 'ssot_collision').length,
+        authorityBypassCount: findings.filter((finding) => finding.code === 'authority_bypass').length,
+        protectedVerificationGapCount: findings.filter((finding) => finding.code === 'protected_verification_gap').length
+    });
+    const viewHashes = Object.freeze({ ...(input.viewHashes ?? {}) });
+    const payload = {
+        schema: ARCHITECTURE_BASELINE_SCHEMA,
+        missionId: input.missionId,
+        routeId: input.routeId,
+        taskProfile: input.taskProfile,
+        required: true,
+        capturedBeforeMutation: true,
+        repositoryHead: input.bundle.worktree.repositoryHead,
+        worktreeFingerprintHash: input.bundle.worktree.hash,
+        preexistingDirtyPaths: input.bundle.worktree.dirtyPaths,
+        graphHash: input.bundle.graphHash,
+        topologyHash: input.bundle.topologyHash,
+        ssotInventoryHash: input.bundle.ssotInventoryHash,
+        voxelContextHash: input.bundle.voxelContextHash,
+        policyHash: input.bundle.policyHash,
+        analyzerVersion: input.bundle.analyzerVersion,
+        serializerVersion: input.bundle.serializerVersion,
+        scope: input.scope,
+        metrics,
+        findings,
+        viewHashes,
+        sccKeys: sccs.map((members) => members.join('|'))
+    };
+    const canonicalPayloadHash = hashCanonical(payload);
+    const seal = sealArchitectureBaseline(canonicalPayloadHash);
+    return Object.freeze({
+        schema: ARCHITECTURE_BASELINE_SCHEMA,
+        missionId: input.missionId,
+        routeId: input.routeId,
+        taskProfile: input.taskProfile,
+        required: true,
+        capturedAt: input.capturedAt,
+        capturedBeforeMutation: true,
+        repositoryHead: input.bundle.worktree.repositoryHead,
+        worktreeFingerprintHash: input.bundle.worktree.hash,
+        preexistingDirtyPaths: Object.freeze([...input.bundle.worktree.dirtyPaths]),
+        graphHash: input.bundle.graphHash,
+        topologyHash: input.bundle.topologyHash,
+        ssotInventoryHash: input.bundle.ssotInventoryHash,
+        voxelContextHash: input.bundle.voxelContextHash,
+        policyHash: input.bundle.policyHash,
+        analyzerVersion: input.bundle.analyzerVersion,
+        serializerVersion: input.bundle.serializerVersion,
+        scope: input.scope,
+        metrics,
+        findings: Object.freeze([...findings]),
+        viewHashes,
+        canonicalPayloadHash,
+        seal
+    });
+}
+export function verifyArchitectureBaselineSeal(baseline) {
+    return baseline.seal === sealArchitectureBaseline(baseline.canonicalPayloadHash);
+}

package/dist/core/triwiki/context-graph/architecture/capsule.js

@@ -0,0 +1,34 @@
+import { byCodePoint } from './contracts.js';
+import { hashCanonical } from './fingerprint.js';
+export function renderArchitectureCapsule(input) {
+    const blocking = input.findings
+        .filter((finding) => finding.severity === 'blocking')
+        .sort((left, right) => byCodePoint(left.id, right.id));
+    const baselineShort = input.baseline ? input.baseline.seal.slice(0, 12) : 'none';
+    const lines = [
+        `schema=sks.architecture-capsule.v1`,
+        `profile=${input.profile}`,
+        `mission=${input.missionId}`,
+        `route=${input.routeId ?? 'unknown'}`,
+        `baseline=${baselineShort}`,
+        `modules=${input.metrics.moduleCount}`,
+        `scc=${input.metrics.sccCount}`,
+        `fan_in_max=${input.metrics.maxFanIn}`,
+        `fan_out_max=${input.metrics.maxFanOut}`,
+        `layer_violations=${input.metrics.layerViolationCount}`,
+        `ssot_collisions=${input.metrics.ssotCollisionCount}`,
+        `verification_gaps=${input.metrics.protectedVerificationGapCount}`,
+        `affected_gates=${(input.affectedGates ?? []).slice().sort(byCodePoint).join(',') || 'none'}`,
+        `blocking_findings=${blocking.map((finding) => `${finding.id}:${finding.code}`).join(',') || 'none'}`,
+        `seeds=${(input.seedPaths ?? []).slice().sort(byCodePoint).join(',') || 'none'}`,
+        `map=${input.mapArtifact ?? 'architecture-map-delta.mmd'}`
+    ];
+    const text = `${lines.join('\n')}\n`;
+    return Object.freeze({
+        schema: 'sks.architecture-capsule.v1',
+        text,
+        byteLength: Buffer.byteLength(text, 'utf8'),
+        profile: input.profile,
+        contentHash: hashCanonical(text)
+    });
+}

package/dist/core/triwiki/context-graph/architecture/contracts.js

@@ -0,0 +1,67 @@
+export const ARCHITECTURE_INPUT_BUNDLE_SCHEMA = 'sks.architecture-input-bundle.v1';
+export const ARCHITECTURE_BASELINE_SCHEMA = 'sks.architecture-baseline.v1';
+export const ARCHITECTURE_REVIEW_SCHEMA = 'sks.architecture-review.v1';
+export const ARCHITECTURE_MAP_MANIFEST_SCHEMA = 'sks.architecture-map-manifest.v1';
+export const ARCHITECTURE_MAP_POLICY_SCHEMA = 'sks.architecture-map-policy.v1';
+export const MERMAID_PROJECTION_SCHEMA = 'sks.mermaid-projection.v1';
+export const ARCHITECTURE_ANALYZER_VERSION = 'architecture-map-analyzer.v1';
+export const ARCHITECTURE_SERIALIZER_VERSION = 'mermaid-serializer.v1';
+export const ARCHITECTURE_MAP_DIR_REL = '.sneakoscope/wiki/architecture-map';
+export const ARCHITECTURE_MAP_POLICY_FILE = 'config/architecture-map-policy.v1.json';
+export const ARCHITECTURE_MAP_VIEW_IDS = Object.freeze([
+    'project-topology',
+    'module-dependency',
+    'public-surface',
+    'ssot-provenance',
+    'runtime-control',
+    'verification-coverage',
+    'risk-domains',
+    'change-impact',
+    'architecture-delta',
+    'ownership-workstream'
+]);
+export const GLOBAL_ARCHITECTURE_MAP_VIEW_IDS = Object.freeze([
+    'project-topology',
+    'module-dependency',
+    'public-surface',
+    'ssot-provenance',
+    'runtime-control',
+    'verification-coverage',
+    'risk-domains'
+]);
+export const ARCHITECTURE_FINDING_CODES = Object.freeze([
+    'baseline_missing',
+    'baseline_late',
+    'baseline_stale',
+    'baseline_tampered',
+    'graph_stale',
+    'map_parity_failure',
+    'unaccounted_changed_file',
+    'new_cycle',
+    'cycle_expansion',
+    'forbidden_dependency',
+    'layer_skip',
+    'ssot_collision',
+    'authority_bypass',
+    'protected_verification_gap',
+    'fan_out_regression',
+    'fan_in_unverified',
+    'passthrough_chain',
+    'redundant_parallel_path',
+    'duplicate_facade',
+    'orphan_entrypoint',
+    'unowned_high_risk',
+    'test_distance_increase',
+    'architecture_depth_increase',
+    'cross_workstream_write_overlap',
+    'unknown_dynamic_relation',
+    'insufficient_graph'
+]);
+export function byCodePoint(left, right) {
+    if (left < right)
+        return -1;
+    return left > right ? 1 : 0;
+}
+export function sortStrings(values) {
+    return [...values].sort(byCodePoint);
+}

package/dist/core/triwiki/context-graph/architecture/delta.js

@@ -0,0 +1,149 @@
+import { ARCHITECTURE_REVIEW_SCHEMA, byCodePoint } from './contracts.js';
+import { verifyArchitectureBaselineSeal } from './baseline.js';
+import { diffWorktreePaths, hashCanonical } from './fingerprint.js';
+import { analyzeArchitectureFindings } from './findings.js';
+import { computeArchitectureMetrics } from './metrics.js';
+export function metricDelta(before, after) {
+    return Object.freeze({
+        sccCountDelta: after.sccCount - before.sccCount,
+        cyclicNodeCountDelta: after.cyclicNodeCount - before.cyclicNodeCount,
+        layerViolationCountDelta: after.layerViolationCount - before.layerViolationCount,
+        ssotCollisionCountDelta: after.ssotCollisionCount - before.ssotCollisionCount,
+        protectedVerificationGapCountDelta: after.protectedVerificationGapCount - before.protectedVerificationGapCount
+    });
+}
+function partitionFindings(before, after) {
+    const beforeIds = new Set(before.map((finding) => finding.id));
+    const afterIds = new Set(after.map((finding) => finding.id));
+    const byId = (left, right) => byCodePoint(left.id, right.id);
+    return {
+        newFindings: after.filter((finding) => !beforeIds.has(finding.id)).sort(byId),
+        resolvedFindings: before.filter((finding) => !afterIds.has(finding.id)).sort(byId),
+        persistentFindings: after.filter((finding) => beforeIds.has(finding.id)).sort(byId)
+    };
+}
+function baselineSccsFromFindings(findings) {
+    return Object.freeze(findings
+        .filter((finding) => finding.code === 'new_cycle' || finding.code === 'cycle_expansion')
+        .map((finding) => finding.subjectIds));
+}
+function countCodes(findings, code) {
+    return findings.filter((finding) => finding.code === code).length;
+}
+export function buildArchitectureDelta(input) {
+    const afterFindings = analyzeArchitectureFindings({
+        bundle: input.afterBundle,
+        policy: input.policy,
+        baselineSccs: baselineSccsFromFindings(input.baseline.findings)
+    });
+    const partitioned = partitionFindings(input.baseline.findings, afterFindings);
+    const afterMetrics = computeArchitectureMetrics({
+        graph: input.afterBundle.graph,
+        topology: input.afterBundle.topology,
+        layerViolationCount: countCodes(afterFindings, 'forbidden_dependency'),
+        ssotCollisionCount: countCodes(afterFindings, 'ssot_collision'),
+        protectedVerificationGapCount: countCodes(afterFindings, 'protected_verification_gap')
+    });
+    return Object.freeze({
+        schema: 'sks.architecture-delta.v1',
+        missionId: input.missionId,
+        baselineSeal: input.baseline.seal,
+        addedNodeIds: Object.freeze([]),
+        removedNodeIds: Object.freeze([]),
+        addedEdgeIds: Object.freeze([]),
+        removedEdgeIds: Object.freeze([]),
+        newFindings: Object.freeze(partitioned.newFindings),
+        resolvedFindings: Object.freeze(partitioned.resolvedFindings),
+        metricDelta: metricDelta(input.baseline.metrics, afterMetrics)
+    });
+}
+export function buildArchitectureReview(input) {
+    const sealValid = verifyArchitectureBaselineSeal(input.baseline);
+    const changedPaths = [...diffWorktreePaths(input.baseline.preexistingDirtyPaths.map((path) => ({
+            path,
+            kind: 'file',
+            sha256: 'baseline',
+            size: 0,
+            executable: false
+        })), input.afterBundle.worktree.paths)];
+    const changedPathSet = new Set(changedPaths.map((entry) => entry.path));
+    const accounted = [...(input.accountedChangedPaths ?? [...changedPathSet])].sort(byCodePoint);
+    const accountedSet = new Set(accounted);
+    const unaccounted = [...changedPathSet].filter((path) => !accountedSet.has(path)).sort(byCodePoint);
+    const afterFindings = analyzeArchitectureFindings({
+        bundle: input.afterBundle,
+        policy: input.policy,
+        baselineSccs: baselineSccsFromFindings(input.baseline.findings)
+    });
+    const partitioned = partitionFindings(input.baseline.findings, afterFindings);
+    const afterMetrics = computeArchitectureMetrics({
+        graph: input.afterBundle.graph,
+        topology: input.afterBundle.topology,
+        layerViolationCount: countCodes(afterFindings, 'forbidden_dependency'),
+        ssotCollisionCount: countCodes(afterFindings, 'ssot_collision'),
+        authorityBypassCount: countCodes(afterFindings, 'authority_bypass'),
+        protectedVerificationGapCount: countCodes(afterFindings, 'protected_verification_gap')
+    });
+    const newBlocking = afterFindings
+        .filter((finding) => finding.severity === 'blocking' && finding.disposition === 'open')
+        .filter((finding) => !input.baseline.findings.some((prior) => prior.id === finding.id))
+        .map((finding) => finding.id)
+        .sort(byCodePoint);
+    const blockers = [];
+    if (!sealValid)
+        blockers.push('baseline_tampered');
+    if (input.baseline.policyHash !== input.afterBundle.policyHash ||
+        input.baseline.analyzerVersion !== input.afterBundle.analyzerVersion ||
+        input.baseline.serializerVersion !== input.afterBundle.serializerVersion) {
+        blockers.push('baseline_stale');
+    }
+    if (unaccounted.length)
+        blockers.push('unaccounted_changed_file');
+    if (newBlocking.length)
+        blockers.push('blocking_findings');
+    const verification = Object.freeze({
+        baselineValid: input.baseline.schema === 'sks.architecture-baseline.v1',
+        baselineTimely: input.baseline.capturedBeforeMutation === true,
+        baselineFresh: !blockers.includes('baseline_stale'),
+        sealValid,
+        changedPathAccounting: unaccounted.length === 0 ? 1 : 0,
+        projectionAccounting: 1,
+        blockers: Object.freeze([...blockers].sort(byCodePoint))
+    });
+    const blockingFindingIds = Object.freeze([...newBlocking, ...(unaccounted.length ? ['unaccounted_changed_file'] : [])].sort(byCodePoint));
+    const verdict = verification.baselineValid &&
+        verification.baselineTimely &&
+        verification.baselineFresh &&
+        verification.sealValid &&
+        verification.changedPathAccounting === 1 &&
+        newBlocking.length === 0 &&
+        unaccounted.length === 0
+        ? 'pass'
+        : 'block';
+    const payload = {
+        schema: ARCHITECTURE_REVIEW_SCHEMA,
+        missionId: input.missionId,
+        baselineSeal: input.baseline.seal,
+        baselineHash: input.baseline.canonicalPayloadHash,
+        afterInputHash: input.afterBundle.canonicalHash,
+        changedPaths,
+        accountedChangedPaths: accounted,
+        unaccountedChangedPaths: unaccounted,
+        beforeMetrics: input.baseline.metrics,
+        afterMetrics,
+        metricDelta: metricDelta(input.baseline.metrics, afterMetrics),
+        newFindings: partitioned.newFindings,
+        resolvedFindings: partitioned.resolvedFindings,
+        persistentFindings: partitioned.persistentFindings,
+        acceptedExceptions: [],
+        projectionAccounting: input.projectionAccounting ?? {},
+        verification,
+        verdict,
+        blockingFindingIds
+    };
+    return Object.freeze({
+        ...payload,
+        canonicalPayloadHash: hashCanonical(payload),
+        generatedAt: input.generatedAt
+    });
+}

package/dist/core/triwiki/context-graph/architecture/finding-factory.js

@@ -0,0 +1,28 @@
+import { sha256 } from '../../../fsx.js';
+import { sortStrings } from './contracts.js';
+const FINDING_SCHEMA = 'sks.architecture-finding.v1';
+export function findingId(input) {
+    const payload = [
+        FINDING_SCHEMA,
+        input.code,
+        ...sortStrings(input.subjectIds),
+        ...sortStrings(input.evidenceIds),
+        input.ruleId
+    ].join('\n');
+    return `af_${sha256(payload).slice(0, 24)}`;
+}
+export function makeFinding(input) {
+    const subjectIds = Object.freeze(sortStrings(input.subjectIds));
+    const evidenceIds = Object.freeze(sortStrings(input.evidenceIds ?? []));
+    const ruleId = input.ruleId ?? '';
+    return Object.freeze({
+        id: findingId({ code: input.code, subjectIds, evidenceIds, ruleId }),
+        code: input.code,
+        severity: input.severity,
+        subjectIds,
+        evidenceIds,
+        ruleId,
+        message: input.message,
+        disposition: 'open'
+    });
+}

package/dist/core/triwiki/context-graph/architecture/findings.js

@@ -0,0 +1,173 @@
+import { byCodePoint } from './contracts.js';
+import { findingId, makeFinding } from './finding-factory.js';
+import { isAllowedLayerEdge, layerForModule } from './policy.js';
+import { buildModuleDependencyGraph, computeSccs, sccKey } from './metrics.js';
+import { mergeGraphWithTopology } from './topology-overlay.js';
+import { canonicalSsotAuthorityInventory } from '../../../safety/ssot-authority-inventory.js';
+import { analyzeSsotCollisions } from './ssot-analysis.js';
+export { findingId, makeFinding };
+const ANALYSIS_REQUIRED_KINDS = ['module'];
+const ANALYSIS_REQUIRED_EDGES = ['imports'];
+function severityFor(code, policy) {
+    return policy.blockingCodes.includes(code) ? 'blocking' : 'warning';
+}
+export function graphSufficiencyIssues(graph) {
+    const kinds = new Set(graph.nodes.map((node) => node.kind));
+    const edgeTypes = new Set(graph.edges.map((edge) => edge.type));
+    const missing = [];
+    for (const kind of ANALYSIS_REQUIRED_KINDS) {
+        if (!kinds.has(kind))
+            missing.push(`kind:${kind}`);
+    }
+    for (const type of ANALYSIS_REQUIRED_EDGES) {
+        if (!edgeTypes.has(type))
+            missing.push(`edge:${type}`);
+    }
+    if (!graph.nodes.length)
+        missing.push('nodes:empty');
+    return Object.freeze(missing.sort(byCodePoint));
+}
+function insufficientGraphFinding(policy, missing) {
+    return makeFinding({
+        code: 'insufficient_graph',
+        severity: severityFor('insufficient_graph', policy),
+        subjectIds: missing,
+        evidenceIds: missing,
+        ruleId: 'graph-sufficiency',
+        message: `Architecture graph lacks required kinds/edges for analysis: ${missing.join(', ')}`
+    });
+}
+export function detectNewAndExpandedCycles(input) {
+    const baselineKeys = new Map(input.baselineSccs.map((members) => [sccKey(members), members]));
+    const findings = [];
+    for (const members of input.afterSccs) {
+        const key = sccKey(members);
+        const prior = baselineKeys.get(key);
+        if (!prior) {
+            let expandedFrom = null;
+            for (const baseline of input.baselineSccs) {
+                if (baseline.every((id) => members.includes(id)) && members.length > baseline.length) {
+                    expandedFrom = baseline;
+                    break;
+                }
+            }
+            if (expandedFrom) {
+                findings.push(makeFinding({
+                    code: 'cycle_expansion',
+                    severity: severityFor('cycle_expansion', input.policy),
+                    subjectIds: members,
+                    evidenceIds: expandedFrom,
+                    ruleId: 'cycle-expansion',
+                    message: `Dependency cycle expanded from ${expandedFrom.length} to ${members.length} modules`
+                }));
+            }
+            else {
+                findings.push(makeFinding({
+                    code: 'new_cycle',
+                    severity: severityFor('new_cycle', input.policy),
+                    subjectIds: members,
+                    evidenceIds: members,
+                    ruleId: 'new-cycle',
+                    message: `New dependency cycle among ${members.length} modules`
+                }));
+            }
+        }
+    }
+    return findings.sort((left, right) => byCodePoint(left.id, right.id));
+}
+export function detectForbiddenDependencies(input) {
+    const findings = [];
+    for (const key of input.edgeKeys) {
+        const [from, to] = key.split('->');
+        if (!from || !to)
+            continue;
+        const fromLayer = layerForModule(input.policy, modulePathFromId(from));
+        const toLayer = layerForModule(input.policy, modulePathFromId(to));
+        if (!fromLayer || !toLayer)
+            continue;
+        if (!isAllowedLayerEdge(input.policy, fromLayer, toLayer)) {
+            findings.push(makeFinding({
+                code: 'forbidden_dependency',
+                severity: severityFor('forbidden_dependency', input.policy),
+                subjectIds: [from, to],
+                evidenceIds: [key],
+                ruleId: `${fromLayer}->${toLayer}`,
+                message: `Forbidden layer edge ${fromLayer} -> ${toLayer} via ${from} -> ${to}`
+            }));
+        }
+    }
+    return findings.sort((left, right) => byCodePoint(left.id, right.id));
+}
+function modulePathFromId(moduleId) {
+    return moduleId.startsWith('module:') ? moduleId.slice('module:'.length) : moduleId;
+}
+export function detectVerificationGaps(input) {
+    const protectedNodes = input.graph.nodes.filter((node) => node.risk === 'protected' || node.risk === 'high');
+    if (!protectedNodes.length)
+        return [];
+    const verifiedTargets = new Set();
+    for (const edge of input.graph.edges) {
+        if (edge.type === 'tests' || edge.type === 'verified_by' || edge.type === 'gated_by') {
+            verifiedTargets.add(edge.to);
+            verifiedTargets.add(edge.from);
+        }
+    }
+    const kinds = new Set(input.graph.nodes.map((node) => node.kind));
+    if (!kinds.has('test') && !kinds.has('gate') && !kinds.has('proof')) {
+        return [
+            makeFinding({
+                code: 'insufficient_graph',
+                severity: severityFor('insufficient_graph', input.policy),
+                subjectIds: ['kind:test', 'kind:gate', 'kind:proof'],
+                evidenceIds: protectedNodes.map((node) => node.id),
+                ruleId: 'verification-kinds',
+                message: 'Graph lacks test/gate/proof kinds required to evaluate verification gaps'
+            })
+        ];
+    }
+    const findings = [];
+    for (const node of protectedNodes) {
+        if (!verifiedTargets.has(node.id)) {
+            findings.push(makeFinding({
+                code: 'protected_verification_gap',
+                severity: severityFor('protected_verification_gap', input.policy),
+                subjectIds: [node.id],
+                evidenceIds: [node.id],
+                ruleId: 'protected-verification-gap',
+                message: `Protected/high-risk node ${node.id} has no tests/gate/evidence path`
+            }));
+        }
+    }
+    return findings.sort((left, right) => byCodePoint(left.id, right.id));
+}
+export function analyzeArchitectureFindings(input) {
+    const missing = graphSufficiencyIssues(input.bundle.graph);
+    if (missing.length) {
+        return Object.freeze([insufficientGraphFinding(input.policy, missing)]);
+    }
+    const merged = mergeGraphWithTopology(input.bundle.graph, input.bundle.topology);
+    const moduleGraph = buildModuleDependencyGraph(merged.nodes, merged.edges);
+    const afterSccs = computeSccs(moduleGraph);
+    const baselineSccs = input.baselineSccs ?? [];
+    const findings = [
+        ...detectNewAndExpandedCycles({
+            policy: input.policy,
+            baselineSccs,
+            afterSccs
+        }),
+        ...detectForbiddenDependencies({
+            policy: input.policy,
+            moduleIds: moduleGraph.moduleIds,
+            edgeKeys: moduleGraph.edgeKeys
+        }),
+        ...analyzeSsotCollisions({
+            policy: input.policy,
+            inventory: canonicalSsotAuthorityInventory()
+        }),
+        ...detectVerificationGaps({
+            policy: input.policy,
+            graph: input.bundle.graph
+        })
+    ];
+    return Object.freeze(findings.sort((left, right) => byCodePoint(left.id, right.id)));
+}

package/dist/core/triwiki/context-graph/architecture/fingerprint.js

@@ -0,0 +1,75 @@
+import { createHash } from 'node:crypto';
+import { canonicalJson } from '../../../json/canonical.js';
+import { sha256 } from '../../../fsx.js';
+import { byCodePoint } from './contracts.js';
+export function hashCanonical(value) {
+    return sha256(canonicalJson(value));
+}
+export function hashWithoutKeys(value, omit) {
+    const copy = {};
+    for (const key of Object.keys(value).sort(byCodePoint)) {
+        if (omit.includes(key))
+            continue;
+        copy[key] = value[key];
+    }
+    return hashCanonical(copy);
+}
+export function sealBaselinePayload(canonicalPayloadHash) {
+    return sha256(`sks.architecture-baseline.v1\n${canonicalPayloadHash}`);
+}
+export function buildWorktreeFingerprint(input) {
+    const paths = [...input.paths].sort((a, b) => byCodePoint(a.path, b.path));
+    const fingerprintHash = hashCanonical({
+        rootId: input.rootId,
+        head: input.head,
+        paths
+    });
+    const dirtyPaths = Object.freeze(paths.filter((entry) => entry.kind !== 'missing').map((entry) => entry.path));
+    return Object.freeze({
+        rootId: input.rootId,
+        head: input.head,
+        repositoryHead: input.head,
+        paths: Object.freeze(paths),
+        fingerprintHash,
+        hash: fingerprintHash,
+        dirtyPaths
+    });
+}
+export function emptyWorktreeFingerprint(rootId, head = null) {
+    return buildWorktreeFingerprint({ rootId, head, paths: [] });
+}
+export function shortHash(value, length = 12) {
+    return createHash('sha256').update(value).digest('hex').slice(0, length);
+}
+export function diffWorktreePaths(before, after) {
+    const beforeMap = new Map(before.map((entry) => [entry.path, entry]));
+    const afterMap = new Map(after.map((entry) => [entry.path, entry]));
+    const paths = new Set([...beforeMap.keys(), ...afterMap.keys()]);
+    const out = [];
+    for (const path of [...paths].sort(byCodePoint)) {
+        const left = beforeMap.get(path);
+        const right = afterMap.get(path);
+        if (!left && right) {
+            out.push({ path, change: 'added' });
+            continue;
+        }
+        if (left && !right) {
+            out.push({ path, change: 'removed' });
+            continue;
+        }
+        if (!left || !right)
+            continue;
+        if (left.kind !== right.kind) {
+            out.push({ path, change: 'type' });
+            continue;
+        }
+        if (left.sha256 !== right.sha256) {
+            out.push({ path, change: 'content' });
+            continue;
+        }
+        if (left.executable !== right.executable) {
+            out.push({ path, change: 'mode' });
+        }
+    }
+    return Object.freeze(out);
+}

package/dist/core/triwiki/context-graph/architecture/index.js

@@ -0,0 +1,15 @@
+export * from './contracts.js';
+export * from './policy.js';
+export * from './fingerprint.js';
+export * from './input-bundle.js';
+export * from './topology-overlay.js';
+export * from './voxel-context.js';
+export * from './slice.js';
+export * from './metrics.js';
+export * from './finding-factory.js';
+export * from './findings.js';
+export * from './ssot-analysis.js';
+export * from './baseline.js';
+export * from './delta.js';
+export * from './capsule.js';
+export * from './validation.js';