audit-test 0.2.2__tar.gz → 0.2.4__tar.gz

{audit_test-0.2.2/src/audit_test.egg-info → audit_test-0.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: audit-test
-Version: 0.2.2
+Version: 0.2.4
 Summary: Code and test verification orchestrator — interrogates code quality AND whether tests genuinely prove correctness
 License: CC BY-NC-ND 4.0
 Requires-Python: >=3.10
@@ -31,14 +31,6 @@ All in one shot. Zero config needed.
 pip install audit-test
 ```
 
-Three commands — all identical:
-
-```powershell
-audit-test high
-audit-code high
-audit-tests high
-```
-
 Or from source:
 
 ```powershell
@@ -49,10 +41,17 @@ pip install -e .
 
 ## Usage
 
+Three commands — all identical:
+
+```powershell
+audit-test
+audit-code
+audit-tests
+```
 Bare words or flags — both work:
 
 ```powershell
-audit-test                     # full audit (HIGH only)
+audit-test                     # full audit
 audit-test v                   # full audit, verbose
 audit-test f                   # fix: auto-format (lint+black)
 audit-test min                 # min: fast wiring + phd + quality
@@ -189,13 +188,14 @@ python run_all_audits.py       # orchestrate all five into one report
 
 ## The stack
 
-| Audit | Question it answers |
-|---|---|
-| wiring | **Is it connected?** Dead symbols, test-only code, config key drift |
-| phd | **Does it meet the bar?** Exception discipline, security patterns, state bugs |
-| runtime | **Will it hang or crash?** Unbounded loops, missing timeouts, secrets in logs |
-| suite | **Is the test suite healthy?** Runs pytest, classifies real vs pollution failures |
-| quality | **External gates + execution truth.** Black, ruff, mypy, CVE scan, coverage |
+| Audit | Question it answers | Full rules |
+|---|---|---|
+| wiring | **Is it connected?** Dead symbols, test-only code, config key drift | [docs/wiring.md](docs/wiring.md) |
+| phd | **Does it meet the bar?** Exception discipline, security patterns, state bugs | [docs/phd.md](docs/phd.md) — 37 rules |
+| runtime | **Will it hang or crash?** Unbounded loops, missing timeouts, secrets in logs | [docs/runtime.md](docs/runtime.md) — 13 checks |
+| suite | **Is the test suite healthy?** Runs pytest, classifies real vs pollution failures | [docs/suite.md](docs/suite.md) |
+| quality | **External gates + execution truth.** Black, ruff, mypy, CVE scan, coverage | [docs/quality.md](docs/quality.md) — Q0-Q8 |
+| integrations | **External tools.** semgrep, bandit, +14 native linters across 9 languages | [docs/integrations.md](docs/integrations.md) |
 
 ## Languages
 

{audit_test-0.2.2 → audit_test-0.2.4}/README.md

@@ -20,14 +20,6 @@ All in one shot. Zero config needed.
 pip install audit-test
 ```
 
-Three commands — all identical:
-
-```powershell
-audit-test high
-audit-code high
-audit-tests high
-```
-
 Or from source:
 
 ```powershell
@@ -38,10 +30,17 @@ pip install -e .
 
 ## Usage
 
+Three commands — all identical:
+
+```powershell
+audit-test
+audit-code
+audit-tests
+```
 Bare words or flags — both work:
 
 ```powershell
-audit-test                     # full audit (HIGH only)
+audit-test                     # full audit
 audit-test v                   # full audit, verbose
 audit-test f                   # fix: auto-format (lint+black)
 audit-test min                 # min: fast wiring + phd + quality
@@ -178,13 +177,14 @@ python run_all_audits.py       # orchestrate all five into one report
 
 ## The stack
 
-| Audit | Question it answers |
-|---|---|
-| wiring | **Is it connected?** Dead symbols, test-only code, config key drift |
-| phd | **Does it meet the bar?** Exception discipline, security patterns, state bugs |
-| runtime | **Will it hang or crash?** Unbounded loops, missing timeouts, secrets in logs |
-| suite | **Is the test suite healthy?** Runs pytest, classifies real vs pollution failures |
-| quality | **External gates + execution truth.** Black, ruff, mypy, CVE scan, coverage |
+| Audit | Question it answers | Full rules |
+|---|---|---|
+| wiring | **Is it connected?** Dead symbols, test-only code, config key drift | [docs/wiring.md](docs/wiring.md) |
+| phd | **Does it meet the bar?** Exception discipline, security patterns, state bugs | [docs/phd.md](docs/phd.md) — 37 rules |
+| runtime | **Will it hang or crash?** Unbounded loops, missing timeouts, secrets in logs | [docs/runtime.md](docs/runtime.md) — 13 checks |
+| suite | **Is the test suite healthy?** Runs pytest, classifies real vs pollution failures | [docs/suite.md](docs/suite.md) |
+| quality | **External gates + execution truth.** Black, ruff, mypy, CVE scan, coverage | [docs/quality.md](docs/quality.md) — Q0-Q8 |
+| integrations | **External tools.** semgrep, bandit, +14 native linters across 9 languages | [docs/integrations.md](docs/integrations.md) |
 
 ## Languages
 

{audit_test-0.2.2 → audit_test-0.2.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "audit-test"
-version = "0.2.2"
+version = "0.2.4"
 description = "Code and test verification orchestrator — interrogates code quality AND whether tests genuinely prove correctness"
 requires-python = ">=3.10"
 license = {text = "CC BY-NC-ND 4.0"}

{audit_test-0.2.2 → audit_test-0.2.4}/src/audit_code/__init__.py

@@ -1,3 +1,3 @@
 """audit-code: code and test verification orchestrator."""
 
-__version__ = "0.2.2"
+__version__ = "0.2.4"

{audit_test-0.2.2 → audit_test-0.2.4}/src/audit_code/audit_gate.py

@@ -54,7 +54,7 @@ from audit_code.audit_config import (
     SUITE_TIMEOUT,
 )
 from audit_code.audit_quality import _def_spans  # noqa: E402
-from audit_code.audit_shared import EXCLUDE_DIRS
+from audit_code.audit_shared import EXCLUDE_DIRS, force_utf8_streams
 
 ROOT = Path(__file__).resolve().parent.parent.parent
 # Allow --path override for audit-code wrapper
@@ -521,10 +521,7 @@ def _run_gates(
 
 
 def main():
-    try:
-        sys.stdout.reconfigure(encoding="utf-8", errors="replace")
-    except (AttributeError, OSError):
-        pass
+    force_utf8_streams()
     ap = argparse.ArgumentParser()
     ap.add_argument(
         "--path", default=None, help="project root (for audit-code wrapper)"

{audit_test-0.2.2 → audit_test-0.2.4}/src/audit_code/audit_quality.py

@@ -60,7 +60,7 @@ import tempfile
 from pathlib import Path
 
 from audit_code.audit_config import DOC_THRESHOLD_PCT, MIN_FLAG_BODY_LINES, TOOL_TIMEOUT
-from audit_code.audit_shared import EXCLUDE_DIRS
+from audit_code.audit_shared import EXCLUDE_DIRS, force_utf8_streams
 
 ROOT = Path(__file__).resolve().parent.parent.parent
 
@@ -523,10 +523,7 @@ def q_mutation(root: Path, counts: dict, enabled: bool):
 
 
 def main():
-    try:
-        sys.stdout.reconfigure(encoding="utf-8", errors="replace")
-    except (AttributeError, OSError):
-        pass
+    force_utf8_streams()
     ap = argparse.ArgumentParser()
     ap.add_argument("--path", default=str(ROOT), help="repo root to audit")
     ap.add_argument("--tests", default="tests", help="tests dir relative to root")

{audit_test-0.2.2 → audit_test-0.2.4}/src/audit_code/audit_shared.py

@@ -6,14 +6,85 @@ Reads .audit-test-ignore from the project root.  Supports named #only groups:
   slow=[src/quality.py] /mnt/c/other  | full quality sweep
   #only
 Format per line: name=[file,...] [/path] [| description]
+
+Also supports a project-level source-encoding declaration:
+  #encoding utf-8
+used by the `check` command to verify every file decodes under that codec.
 """
 
+import codecs
 import os
+import sys
 from collections import namedtuple
 from pathlib import Path
 
 Group = namedtuple("Group", "files path description")
 
+# Encoding a scanned project's source is expected to be in.  Overridable per
+# target via a `#encoding <name>` line in that project's .audit-test-ignore.
+DEFAULT_ENCODING = "utf-8"
+
+
+def normalize_encoding(raw: str) -> str:
+    """Validate and canonicalize an encoding name (e.g. 'UTF-16' -> 'utf-16').
+
+    Accepts spaces so multi-word CLI args like 'GB 18030' resolve to 'gb18030'.
+    Raises LookupError if the name is not a known codec.
+    """
+    candidate = raw.strip()
+    try:
+        return codecs.lookup(candidate).name
+    except LookupError:
+        return codecs.lookup(candidate.replace(" ", "")).name
+
+
+def configured_encoding(root: Path | None = None) -> str:
+    """Return the `#encoding` declared in <root>/.audit-test-ignore, else utf-8.
+
+    Read from the *target* project's ignore file (default cwd) so scanning an
+    external repo honours that repo's declared source encoding.
+    """
+    base = Path.cwd() if root is None else root
+    try:
+        for line in (base / ".audit-test-ignore").read_text(
+            encoding="utf-8"
+        ).splitlines():
+            s = line.strip()
+            if s.lower().startswith("#encoding"):
+                parts = s.split(None, 1)
+                if len(parts) > 1 and parts[1].strip():
+                    return parts[1].strip()
+    except OSError:
+        pass
+    return DEFAULT_ENCODING
+
+
+def force_utf8_streams() -> None:
+    """Make stdout AND stderr emit UTF-8 (replace on error), on every platform.
+
+    Windows consoles and pipes default to cp1252/cp437, which raise
+    UnicodeEncodeError on the audit's glyphs (🐇, ═, ✓, ✨).  macOS/Linux are
+    almost always UTF-8 already, so this is a harmless no-op there.  Guarded
+    because captured/replaced streams (pytest, StringIO) lack reconfigure().
+    """
+    for stream in (sys.stdout, sys.stderr):
+        try:
+            stream.reconfigure(encoding="utf-8", errors="replace")  # type: ignore[union-attr]
+        except (AttributeError, OSError):
+            pass
+
+
+# Environment additions that force a spawned Python worker to start with UTF-8
+# stdio regardless of the host locale — the child sets its pipe encoding at
+# interpreter startup, before any reconfigure() call can run.
+UTF8_ENV = {"PYTHONIOENCODING": "utf-8", "PYTHONUTF8": "1"}
+
+
+def utf8_subprocess_env(base: dict | None = None) -> dict:
+    """Return a copy of *base* (default os.environ) with UTF-8 stdio forced."""
+    return {**(os.environ if base is None else base), **UTF8_ENV}
+
+
 # ── Built-in defaults ────────────────────────────────────────────────────────
 
 _SKIP_DEFAULTS = {
@@ -53,25 +124,23 @@ def _parse_group(
 ) -> tuple[str, Group] | None:  # audit: ok (parse helper)
     """Parse 'fast=[main.py,cli.py] /x  | desc' into (name, Group)."""
     line = line.strip()
-    # description
+    # description (strip first so it can't corrupt the file-list terminator)
     desc = ""
     if "|" in line:
         line, desc = line.split("|", 1)
         desc = desc.strip()
-    # path override
-    path = default_path
-    if " /" in line:
-        line, path_part = line.rsplit(" /", 1)
-        path = path_part.strip()
     # name=[...]
     if "=[" not in line:
         return None
     name, rest = line.split("=[", 1)
     name = name.strip()
-    if not rest.endswith("]"):
+    # Everything up to the closing ']' is the file list; whatever follows is the
+    # optional path, kept verbatim so a leading '/' or Windows 'C:' survives.
+    if "]" not in rest:
         return None
-    files_str = rest[:-1]
+    files_str, after = rest.split("]", 1)
     files = [f.strip() for f in files_str.split(",") if f.strip()]
+    path = after.strip() or default_path
     return name, Group(tuple(files), path, desc)
 
 

{audit_test-0.2.2 → audit_test-0.2.4}/src/audit_code/audit_suite.py

@@ -51,6 +51,7 @@ from collections import Counter
 from pathlib import Path
 
 from audit_code.audit_config import FULL_SUITE_TIMEOUT, MAX_SOLO_RERUNS, SOLO_TIMEOUT
+from audit_code.audit_shared import force_utf8_streams
 
 ROOT = Path(__file__).resolve().parent.parent.parent
 TESTS_DIR = "tests"
@@ -221,10 +222,7 @@ def _s3_s5_report(out: str, r: dict, med: int, info: int) -> tuple[int, int]:
 
 
 def main():
-    try:
-        sys.stdout.reconfigure(encoding="utf-8", errors="replace")
-    except (AttributeError, OSError):
-        pass
+    force_utf8_streams()
     strict = "--strict" in sys.argv
     fast = "--fast" in sys.argv
     baseline = "--baseline" in sys.argv

{audit_test-0.2.2 → audit_test-0.2.4}/src/audit_code/cli.py

@@ -26,6 +26,8 @@ import sys
 from collections import namedtuple as _nt  # audit: ok (focus helpers)
 from pathlib import Path
 
+from audit_code import encoding_check
+from audit_code.audit_shared import force_utf8_streams, normalize_encoding
 from audit_code.config import load_project_config
 from audit_code.gate import run_gate as gate_main
 from audit_code.models import EXIT_FAIL, EXIT_PASS
@@ -351,11 +353,7 @@ def run_gate_cmd(args: argparse.Namespace) -> int:
 
 
 def _force_utf8_output() -> None:
-    for stream in (sys.stdout, sys.stderr):
-        try:
-            stream.reconfigure(encoding="utf-8", errors="replace")  # type: ignore[union-attr]
-        except (AttributeError, OSError):
-            pass
+    force_utf8_streams()
 
 
 # ── focus / ignore commands ──────────────────────────────────────────────────
@@ -409,12 +407,15 @@ def _parse_groups(lines: list[str]) -> tuple[dict[str, _Grp], str]:
         if "|" in s:
             s, desc = s.split("|", 1)
             desc = desc.strip()
-        if " /" in s:
-            s, path = s.rsplit(" /", 1)
-            path = path.strip()
-        if "=[" in s and s.endswith("]"):
+        if "=[" in s:
             name, rest = s.split("=[", 1)
-            files = tuple(f.strip() for f in rest[:-1].split(",") if f.strip())
+            # file list ends at the first ']'; the remainder is the path, kept
+            # verbatim so a leading '/' or Windows 'C:' survives.
+            if "]" not in rest:
+                continue
+            files_str, after = rest.split("]", 1)
+            files = tuple(f.strip() for f in files_str.split(",") if f.strip())
+            path = after.strip() or default
             groups[name.strip()] = _Grp(files, path, desc)
     return groups, default
 
@@ -439,10 +440,11 @@ def _rebuild_file(
         for name, g in sorted(groups.items()):
             line = f"{name}=[{', '.join(g.files)}]"
             if g.path and g.path != default_path:
-                sep = " " if g.path.startswith("/") or g.path.startswith("C:") else " /"
-                line += f"{sep}{g.path}"
+                # plain space separator; the parser takes everything after ']'
+                # as the path, so the value round-trips exactly as written.
+                line += f" {g.path}"
             if g.desc:
-                line += f"  | {g.desc}"
+                line += f" | {g.desc}"
             out.append(line)
         out.append("#only")
     return out
@@ -714,6 +716,59 @@ def _is_ignore_mode() -> bool:
     return "ignore" in sys.argv
 
 
+def _is_check_mode() -> bool:
+    for a in sys.argv[1:]:
+        if not a.startswith("-"):
+            return a == "check"
+    return False
+
+
+def _handle_check() -> None:
+    """`check [encoding...] [--path DIR]` — verify every file decodes as encoding.
+
+    Encoding may be several tokens ('GB 18030'); if omitted, the target's
+    #encoding (or utf-8) is used.  Path-like args or --path pick the project.
+    """
+    idx = sys.argv.index("check")
+    args = sys.argv[idx + 1 :]
+    if args and args[0] in ("help", "-h", "--help"):
+        print(
+            "check — verify every text file decodes under an encoding\n\n"
+            "  check                 use the project's #encoding (or utf-8)\n"
+            "  check <encoding>      e.g. utf-8 | ascii | UTF-16 | gb18030\n"
+            "  check <encoding> --path <dir>   check another project\n\n"
+            "Configure a project's expected encoding with a line in "
+            ".audit-test-ignore:\n  #encoding utf-8"
+        )
+        sys.exit(0)
+
+    root: str | None = None
+    enc_tokens: list[str] = []
+    i = 0
+    while i < len(args):
+        a = args[i]
+        if a in ("--path", "-p"):
+            root = args[i + 1] if i + 1 < len(args) else None
+            i += 2
+            continue
+        if a.startswith("/") or a.startswith("C:") or a.startswith("D:"):
+            root = a
+            i += 1
+            continue
+        enc_tokens.append(a)
+        i += 1
+
+    encoding = " ".join(enc_tokens) if enc_tokens else None
+    if encoding is not None:
+        try:
+            encoding = normalize_encoding(encoding)
+        except LookupError:
+            print(f"unknown encoding: {' '.join(enc_tokens)!r} — try utf-8, ascii, gb18030")
+            sys.exit(2)
+    target = find_target_root(root)
+    sys.exit(encoding_check.run(target, encoding))
+
+
 def main():
     _force_utf8_output()
     if _is_gate_mode():
@@ -722,6 +777,8 @@ def main():
         parser = build_gate_parser()
         args = parser.parse_args()
         sys.exit(run_gate_cmd(args))
+    elif _is_check_mode():
+        _handle_check()
     elif _is_focus_mode():
         _handle_focus()
     elif _is_ignore_mode():

{audit_test-0.2.2 → audit_test-0.2.4}/src/audit_code/deps.py

@@ -10,6 +10,7 @@ import subprocess
 import sys
 from pathlib import Path
 
+from audit_code.audit_shared import utf8_subprocess_env
 from audit_code.models import (
     AuditResult,
     AuditStatus,
@@ -33,6 +34,7 @@ def run(target_root: Path, print_only: bool = False) -> AuditResult:
             errors="replace",
             timeout=60,
             cwd=str(target_root),
+            env=utf8_subprocess_env(),
         )
     except subprocess.TimeoutExpired:
         return AuditResult(

audit_test-0.2.4/src/audit_code/encoding_check.py

@@ -0,0 +1,86 @@
+"""encoding_check.py — universal source-encoding gate.
+
+Verifies that every text file under a project decodes cleanly under a chosen
+codec (strict, no error replacement).  The codec is either passed explicitly
+(`audit-test check gb18030`) or read from the target project's
+`.audit-test-ignore` (`#encoding <name>`), defaulting to UTF-8.
+
+  check utf-8    -> every file must be valid UTF-8
+  check ascii    -> every file must be pure ASCII
+  check gb18030  -> every file must be valid GB 18030
+
+Binary files (detected by a NUL byte) are skipped so images/archives do not
+false-fail.  Skip/exclude and focus-group rules are honoured via should_audit.
+"""
+
+import os
+from pathlib import Path
+
+from audit_code.audit_shared import (
+    EXCLUDE_DIRS,
+    configured_encoding,
+    force_utf8_streams,
+    normalize_encoding,
+    should_audit,
+)
+
+# Only the first slice is sniffed for NUL bytes when classifying binary files.
+_BINARY_SNIFF_BYTES = 4096
+
+
+def _looks_binary(raw: bytes) -> bool:
+    return b"\x00" in raw[:_BINARY_SNIFF_BYTES]
+
+
+def scan(root: Path, encoding: str) -> tuple[list[tuple[Path, int, str]], int]:
+    """Return (failures, files_checked).
+
+    Each failure is (path, byte_offset, reason) for a file that does NOT decode
+    under *encoding*.
+    """
+    failures: list[tuple[Path, int, str]] = []
+    checked = 0
+    for dirpath, dirnames, filenames in os.walk(root):
+        dirnames[:] = [d for d in dirnames if d not in EXCLUDE_DIRS]
+        for fn in filenames:
+            p = Path(dirpath) / fn
+            if not should_audit(p):
+                continue
+            try:
+                raw = p.read_bytes()
+            except OSError:
+                continue
+            if _looks_binary(raw):
+                continue
+            checked += 1
+            try:
+                raw.decode(encoding)
+            except UnicodeDecodeError as e:
+                failures.append((p, e.start, e.reason))
+    return failures, checked
+
+
+def run(target_root: Path, encoding: str | None = None) -> int:
+    """Run the encoding check and print a report. Return an exit code (0 = clean)."""
+    force_utf8_streams()
+    root = target_root.resolve()
+    enc = normalize_encoding(encoding or configured_encoding(root))
+
+    failures, checked = scan(root, enc)
+
+    bar = "=" * 74
+    print(bar)
+    print(f"ENCODING [{enc}] — {len(failures)} file(s) not decodable / {checked} checked")
+    print(bar)
+    if not failures:
+        print(f"  all {checked} text file(s) are valid {enc}")
+        return 0
+    for path, offset, reason in failures[:50]:
+        try:
+            rel = path.relative_to(root)
+        except ValueError:
+            rel = path
+        print(f"  {rel}  byte {offset}: {reason}")
+    if len(failures) > 50:
+        print(f"  ... and {len(failures) - 50} more")
+    return 1

{audit_test-0.2.2 → audit_test-0.2.4}/src/audit_code/gate.py

@@ -12,6 +12,8 @@ import subprocess
 import sys
 from pathlib import Path
 
+from audit_code.audit_shared import utf8_subprocess_env
+
 _SCRIPT = Path(__file__).resolve().parent / "audit_gate.py"
 
 
@@ -48,5 +50,6 @@ def run_gate(
         capture_output=False,  # stream to terminal so user sees gate progress
         cwd=str(target_root),
         timeout=3600,
+        env=utf8_subprocess_env(),
     )
     return proc.returncode

{audit_test-0.2.2 → audit_test-0.2.4}/src/audit_code/phd.py

@@ -9,6 +9,7 @@ import subprocess
 import sys
 from pathlib import Path
 
+from audit_code.audit_shared import utf8_subprocess_env
 from audit_code.models import (
     AuditResult,
     AuditStatus,
@@ -41,6 +42,7 @@ def run(target_root: Path, severity: str | None = "HIGH") -> AuditResult:
             errors="replace",
             timeout=300,
             cwd=str(target_root),
+            env=utf8_subprocess_env(),
         )
     except subprocess.TimeoutExpired:
         return AuditResult(

{audit_test-0.2.2 → audit_test-0.2.4}/src/audit_code/quality.py

@@ -22,7 +22,7 @@ import sys
 import tempfile
 from pathlib import Path
 
-from audit_code.audit_shared import should_audit
+from audit_code.audit_shared import force_utf8_streams, should_audit
 from audit_code.config import (
     DOC_THRESHOLD_PCT,
     MIN_FLAG_BODY_LINES,
@@ -168,10 +168,7 @@ def run(  # needs fix (god function 550+ lines — decompose into sub-audits)
     if fix:
         fast = True
 
-    try:
-        sys.stdout.reconfigure(encoding="utf-8", errors="replace")  # type: ignore[union-attr]
-    except (AttributeError, OSError):
-        pass
+    force_utf8_streams()
 
     root = target_root.resolve()
     tests_dir = (root / tests).resolve()
@@ -471,12 +468,11 @@ def run(  # needs fix (god function 550+ lines — decompose into sub-audits)
         else:
             tmp = Path(tempfile.mkdtemp(prefix="audit_q5_"))
             json_file = tmp / "cov.json"
-            reuse = (
+            if (
                 shared_cov is not None
                 and shared_cov.exists()
                 and shared_cov.stat().st_size > 0
-            )
-            if reuse:
+            ):
                 # The suite audit already ran the whole suite under coverage;
                 # reuse its data instead of a second full test run.
                 data_file = shared_cov

{audit_test-0.2.2 → audit_test-0.2.4}/src/audit_code/run_all_audits.py

@@ -57,6 +57,9 @@ def run_one(script: str):
         encoding="utf-8",
         errors="replace",
         timeout=timeout,
+        # force the child interpreter to UTF-8 stdio on every OS (Windows pipes
+        # default to cp1252, which crashes on the audit's Unicode glyphs)
+        env={**os.environ, "PYTHONIOENCODING": "utf-8", "PYTHONUTF8": "1"},
     )
     out = proc.stdout or ""
     high = med = info = None

{audit_test-0.2.2 → audit_test-0.2.4}/src/audit_code/runner.py

@@ -11,7 +11,6 @@ Order:
 
 import shutil
 import subprocess
-import sys
 import tempfile
 import time
 from pathlib import Path
@@ -19,6 +18,7 @@ from pathlib import Path
 from audit_code import phd, quality, runtime, suite, wiring
 from audit_code.adapters import discover
 from audit_code.adapters.base import run_tool, which
+from audit_code.audit_shared import force_utf8_streams
 from audit_code.config import FULL_SUITE_TIMEOUT
 from audit_code.models import AuditResult, AuditStatus
 from audit_code.profiles import load as profile_load
@@ -56,11 +56,7 @@ def run_suite(
     # Status glyphs (✓ ✗ ☠) below crash a cp1252 stdout with UnicodeEncodeError.
     # The CLI forces UTF-8, but a direct/library caller may not — do it here too
     # so any entry into the runner is safe. Idempotent; guarded for capture bufs.
-    for _stream in (sys.stdout, sys.stderr):
-        try:
-            _stream.reconfigure(encoding="utf-8", errors="replace")  # type: ignore[union-attr]
-        except (AttributeError, OSError):
-            pass
+    force_utf8_streams()
 
     results: list[AuditResult] = []
     start = time.monotonic()
@@ -322,7 +318,7 @@ def _run_one_module(
             stderr=f"Module {module_name} has no run() function",
         )
 
-    kwargs = {}
+    kwargs: dict[str, object] = {}
     if module_name == "quality" and (mode == "min" or fast):
         kwargs["fast"] = True  # skip coverage
     if module_name == "quality" and fix:
@@ -332,7 +328,7 @@ def _run_one_module(
     if module_name == "suite" and shared_cov is not None:
         kwargs["cov_file"] = shared_cov  # instrument the one shared run
     if module_name == "phd":
-        kwargs["severity"] = severity  # type: ignore[assignment]
+        kwargs["severity"] = severity
 
     return run_fn(target_root, **kwargs)