dataassay 0.7.0__tar.gz

dataassay-0.7.0/.gitignore

@@ -0,0 +1,8 @@
+.venv/
+dist/
+build/
+*.egg-info/
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.ruff_cache/

dataassay-0.7.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 SoftSignal LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

dataassay-0.7.0/PKG-INFO

@@ -0,0 +1,208 @@
+Metadata-Version: 2.5
+Name: dataassay
+Version: 0.7.0
+Summary: Audit a tabular dataset: characterize it, test what can be tested, and say plainly what could not be.
+Project-URL: Homepage, https://getsoftsignal.com
+Author: SoftSignal LLC
+License-Expression: MIT
+License-File: LICENSE
+Keywords: audit,csv,data-quality,duckdb,parquet,profiling
+Classifier: Development Status :: 2 - Pre-Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Financial and Insurance Industry
+Classifier: Intended Audience :: Science/Research
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Scientific/Engineering :: Information Analysis
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Requires-Dist: duckdb>=1.0
+Provides-Extra: dev
+Requires-Dist: build>=1.2; extra == 'dev'
+Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Provides-Extra: llm
+Requires-Dist: anthropic>=0.40; extra == 'llm'
+Description-Content-Type: text/markdown
+
+# dataassay
+
+Audit a tabular dataset — locally.
+
+An assay characterizes a sample before it makes any claim about it. This tool
+works in the same order:
+
+1. **Characterize.** Establish what kind of thing each column is — its support,
+   cadence, panel shape, whether a standard deviation can be established at all.
+2. **Test.** Run only the checks that those properties make *valid*. A 3σ rule
+   on a heavy-tailed series is not a weak check; it is an invalid one.
+3. **Grade.** Rank what came back, and separate real defects from source-side
+   bookkeeping that merely looks like one.
+
+A check that could not be run is a deliverable. "Seasonality undetermined — only
+1.2 cycles of history" is something you need to know, and it appears in the
+report next to what did run.
+
+## Status
+
+**v0.7.0.** `assay audit --report out.html` writes a self-contained report and
+a flagged-items CSV. `assay profile` characterizes; `assay catalog` prints what
+the checks are; `assay init` writes a manifest and `assay declare` answers it;
+`assay interview` optionally asks a model to propose answers, sending metadata
+only.
+
+Validated against a corpus of known defects (see `VALIDATION.md`) and swept
+against 104 real CSVs from the pipeline it was built for, where the metric that
+matters is defects per file rather than findings per file.
+
+Thirteen checks, each earned by a real defect found in a production pipeline:
+constant/all-zero columns, mojibake, duplicate rows, duplicate grain, future
+dates, cadence gaps, file order, stale tails, flatline tails, saturation at a
+bound, negligible residue, level shifts, and schema drift.
+
+The observation date does not have to be a date column. Where it is spread
+across `year`, `month` and `dekad`, or across `year` and a label like
+`"END OF APR"`, it is assembled — otherwise five of the thirteen checks are
+withheld on a whole class of agricultural and government files.
+
+Precision is measured but never filed as a fault. A column where most values
+carry 15+ significant digits has been computed, not reported — that is
+provenance, and it belongs beside the column rather than in the findings.
+
+Every check declares the properties it needs and is refused when the profile
+has not established them. What was withheld and why travels beside the
+findings, because zero findings at 30% coverage and zero at 95% are different
+objects and one number cannot tell them apart.
+
+Findings carry a disposition — likely defect, worth a look, or the source doing
+its own bookkeeping — because most anomalies in real data are the source's own
+calendar, and a tool that cannot say so gets switched off within a week. They
+also carry the predicate that produced them, so any claim can be re-run without
+this code.
+
+Confidence is never an opaque score. Each input is named, and agreement between
+two independent checks on one column promotes it.
+
+## Install
+
+```
+pip install dataassay
+```
+
+## Use
+
+```
+assay audit data.parquet          # characterize, then check
+assay profile data.csv            # characterize only
+assay init data.csv               # write a manifest to answer its questions
+assay declare data.csv --time-axis d   # record an answer in it
+assay catalog                     # what the checks are and why
+assay audit data.csv --json       # the machine contract
+assay interview data.csv          # optional: ask a model (metadata only)
+```
+
+## Validation
+
+It was tested against 82 findings from a real pipeline audit, on the files as
+they stood *before* those findings were fixed, recovered from git — and on the
+same files afterwards. See [VALIDATION.md](VALIDATION.md), including the
+denominator (only ~30 of the 82 are visible in a data file at all) and the four
+families still out of reach.
+
+## The report
+
+One HTML file. No CDN, no external request, no dependency — charts are inline
+SVG drawn by hand, and the machine-readable findings are embedded in the page
+rather than written beside it, so the human artifact and the machine contract
+are the same bytes and cannot drift.
+
+Ordered the way it has to be read: provenance, then **coverage before the
+findings** (an empty findings list means nothing until you know how many checks
+ran), then the findings — each with its governing property, one chart, the
+composition of its confidence, and the predicate to re-run it without this code
+— then what each column was taken to be, where a wrong assumption of ours is
+visible, then every check including the ones that passed.
+
+Charts are theme-aware and never lean on colour alone: a flagged point carries
+a rule and a direct label, a flagged range is a band with one label, and any
+chart with two categories carries a legend.
+
+## The manifest
+
+`assay init` writes `<file>.assay.json`: what the tool detected, the questions
+it could not answer, and an empty `declared` block for you to fill in.
+
+The two blocks are kept apart on purpose. `detected` is regenerated every time
+and is only there for reference; `declared` is what a person says is true, and
+it always wins. So a value's provenance is never ambiguous — there is no
+guessing later whether a grain was inferred or confirmed, and the report can be
+honest about which checks rest on an assumption and which rest on an answer.
+
+Answering once is what makes the tool usable more than once. The next audit of
+the same dataset asks nothing, and it can run where there is nobody to ask at
+all — a pipeline, a server, CI. The conversation is just the most convenient
+way to author the file the first time.
+
+`assay declare` is how you answer without opening the file:
+
+```
+assay declare data.csv --time-axis observed_at
+assay declare data.csv --grain observed_at,site
+assay declare data.csv --skip high_null        # seen it, not answering
+assay declare data.csv --accept-proposed       # the model was right
+```
+
+Running a command is a person deciding, so `declared` keeps meaning what it
+says. Two things it refuses: a declaration naming a column the file does not
+have (that would gate checks on a fiction), and promoting anything out of
+`proposed` unless you pass `--accept-proposed` — the model never gets a quiet
+path into `declared`.
+
+A skipped question is not a hidden one. It moves out of the open list and into
+a section of its own, because a question nobody has looked at and a question
+someone has judged not worth answering are different states, and showing a
+decision as outstanding work is how a report teaches people to stop reading
+it.
+
+## The interview (optional)
+
+`assay interview` sends the **profile** — column names, types, counts,
+quantiles, and the questions the profiler could not settle — to a model, and
+writes what it proposes into the manifest.
+
+Three things make it safe to use on data you cannot upload.
+
+**It sends metadata, never rows.** You see exactly what would go, before it
+goes: a plain-language summary, then a confirmation. `--show-payload` prints the
+literal bytes and sends nothing. Two disclosures are admitted rather than
+hidden — column *names* have to go, and low-cardinality columns include their
+distinct values because a categorical column cannot be characterized without
+them. `--redact-values` strips the second.
+
+**Proposals never become answers.** They land in the manifest's `proposed`
+block, beside `declared`, and are never applied. You move across what you agree
+with. `declared` records that a person decided, and that is only worth
+something if it stays true.
+
+**The model does not choose which checks run.** It proposes property
+declarations; the engine gates the checks itself, deterministically, exactly as
+it does for a declaration you typed. Handing check selection to a language model
+would throw away the discipline the whole tool is built on.
+
+Credentials come from the environment only — never a file, never an argument,
+so a key cannot end up in your shell history or a commit.
+
+## Privacy
+
+Nothing is uploaded. The engine runs entirely in your process against your
+files, and has exactly one runtime dependency (`duckdb`, which has no
+transitive dependencies of its own). The LLM adapter is an optional extra
+(`pip install 'dataassay[llm]'`) and the only module in the package that opens a
+network connection — a test walks every other module's imports and fails if a
+network library appears in one.
+
+## License
+
+MIT © SoftSignal LLC

dataassay-0.7.0/README.md

@@ -0,0 +1,179 @@
+# dataassay
+
+Audit a tabular dataset — locally.
+
+An assay characterizes a sample before it makes any claim about it. This tool
+works in the same order:
+
+1. **Characterize.** Establish what kind of thing each column is — its support,
+   cadence, panel shape, whether a standard deviation can be established at all.
+2. **Test.** Run only the checks that those properties make *valid*. A 3σ rule
+   on a heavy-tailed series is not a weak check; it is an invalid one.
+3. **Grade.** Rank what came back, and separate real defects from source-side
+   bookkeeping that merely looks like one.
+
+A check that could not be run is a deliverable. "Seasonality undetermined — only
+1.2 cycles of history" is something you need to know, and it appears in the
+report next to what did run.
+
+## Status
+
+**v0.7.0.** `assay audit --report out.html` writes a self-contained report and
+a flagged-items CSV. `assay profile` characterizes; `assay catalog` prints what
+the checks are; `assay init` writes a manifest and `assay declare` answers it;
+`assay interview` optionally asks a model to propose answers, sending metadata
+only.
+
+Validated against a corpus of known defects (see `VALIDATION.md`) and swept
+against 104 real CSVs from the pipeline it was built for, where the metric that
+matters is defects per file rather than findings per file.
+
+Thirteen checks, each earned by a real defect found in a production pipeline:
+constant/all-zero columns, mojibake, duplicate rows, duplicate grain, future
+dates, cadence gaps, file order, stale tails, flatline tails, saturation at a
+bound, negligible residue, level shifts, and schema drift.
+
+The observation date does not have to be a date column. Where it is spread
+across `year`, `month` and `dekad`, or across `year` and a label like
+`"END OF APR"`, it is assembled — otherwise five of the thirteen checks are
+withheld on a whole class of agricultural and government files.
+
+Precision is measured but never filed as a fault. A column where most values
+carry 15+ significant digits has been computed, not reported — that is
+provenance, and it belongs beside the column rather than in the findings.
+
+Every check declares the properties it needs and is refused when the profile
+has not established them. What was withheld and why travels beside the
+findings, because zero findings at 30% coverage and zero at 95% are different
+objects and one number cannot tell them apart.
+
+Findings carry a disposition — likely defect, worth a look, or the source doing
+its own bookkeeping — because most anomalies in real data are the source's own
+calendar, and a tool that cannot say so gets switched off within a week. They
+also carry the predicate that produced them, so any claim can be re-run without
+this code.
+
+Confidence is never an opaque score. Each input is named, and agreement between
+two independent checks on one column promotes it.
+
+## Install
+
+```
+pip install dataassay
+```
+
+## Use
+
+```
+assay audit data.parquet          # characterize, then check
+assay profile data.csv            # characterize only
+assay init data.csv               # write a manifest to answer its questions
+assay declare data.csv --time-axis d   # record an answer in it
+assay catalog                     # what the checks are and why
+assay audit data.csv --json       # the machine contract
+assay interview data.csv          # optional: ask a model (metadata only)
+```
+
+## Validation
+
+It was tested against 82 findings from a real pipeline audit, on the files as
+they stood *before* those findings were fixed, recovered from git — and on the
+same files afterwards. See [VALIDATION.md](VALIDATION.md), including the
+denominator (only ~30 of the 82 are visible in a data file at all) and the four
+families still out of reach.
+
+## The report
+
+One HTML file. No CDN, no external request, no dependency — charts are inline
+SVG drawn by hand, and the machine-readable findings are embedded in the page
+rather than written beside it, so the human artifact and the machine contract
+are the same bytes and cannot drift.
+
+Ordered the way it has to be read: provenance, then **coverage before the
+findings** (an empty findings list means nothing until you know how many checks
+ran), then the findings — each with its governing property, one chart, the
+composition of its confidence, and the predicate to re-run it without this code
+— then what each column was taken to be, where a wrong assumption of ours is
+visible, then every check including the ones that passed.
+
+Charts are theme-aware and never lean on colour alone: a flagged point carries
+a rule and a direct label, a flagged range is a band with one label, and any
+chart with two categories carries a legend.
+
+## The manifest
+
+`assay init` writes `<file>.assay.json`: what the tool detected, the questions
+it could not answer, and an empty `declared` block for you to fill in.
+
+The two blocks are kept apart on purpose. `detected` is regenerated every time
+and is only there for reference; `declared` is what a person says is true, and
+it always wins. So a value's provenance is never ambiguous — there is no
+guessing later whether a grain was inferred or confirmed, and the report can be
+honest about which checks rest on an assumption and which rest on an answer.
+
+Answering once is what makes the tool usable more than once. The next audit of
+the same dataset asks nothing, and it can run where there is nobody to ask at
+all — a pipeline, a server, CI. The conversation is just the most convenient
+way to author the file the first time.
+
+`assay declare` is how you answer without opening the file:
+
+```
+assay declare data.csv --time-axis observed_at
+assay declare data.csv --grain observed_at,site
+assay declare data.csv --skip high_null        # seen it, not answering
+assay declare data.csv --accept-proposed       # the model was right
+```
+
+Running a command is a person deciding, so `declared` keeps meaning what it
+says. Two things it refuses: a declaration naming a column the file does not
+have (that would gate checks on a fiction), and promoting anything out of
+`proposed` unless you pass `--accept-proposed` — the model never gets a quiet
+path into `declared`.
+
+A skipped question is not a hidden one. It moves out of the open list and into
+a section of its own, because a question nobody has looked at and a question
+someone has judged not worth answering are different states, and showing a
+decision as outstanding work is how a report teaches people to stop reading
+it.
+
+## The interview (optional)
+
+`assay interview` sends the **profile** — column names, types, counts,
+quantiles, and the questions the profiler could not settle — to a model, and
+writes what it proposes into the manifest.
+
+Three things make it safe to use on data you cannot upload.
+
+**It sends metadata, never rows.** You see exactly what would go, before it
+goes: a plain-language summary, then a confirmation. `--show-payload` prints the
+literal bytes and sends nothing. Two disclosures are admitted rather than
+hidden — column *names* have to go, and low-cardinality columns include their
+distinct values because a categorical column cannot be characterized without
+them. `--redact-values` strips the second.
+
+**Proposals never become answers.** They land in the manifest's `proposed`
+block, beside `declared`, and are never applied. You move across what you agree
+with. `declared` records that a person decided, and that is only worth
+something if it stays true.
+
+**The model does not choose which checks run.** It proposes property
+declarations; the engine gates the checks itself, deterministically, exactly as
+it does for a declaration you typed. Handing check selection to a language model
+would throw away the discipline the whole tool is built on.
+
+Credentials come from the environment only — never a file, never an argument,
+so a key cannot end up in your shell history or a commit.
+
+## Privacy
+
+Nothing is uploaded. The engine runs entirely in your process against your
+files, and has exactly one runtime dependency (`duckdb`, which has no
+transitive dependencies of its own). The LLM adapter is an optional extra
+(`pip install 'dataassay[llm]'`) and the only module in the package that opens a
+network connection — a test walks every other module's imports and fails if a
+network library appears in one.
+
+## License
+
+MIT © SoftSignal LLC

dataassay-0.7.0/pyproject.toml

@@ -0,0 +1,62 @@
+[build-system]
+requires = ["hatchling>=1.27"]
+build-backend = "hatchling.build"
+
+[project]
+name = "dataassay"
+dynamic = ["version"]
+description = "Audit a tabular dataset: characterize it, test what can be tested, and say plainly what could not be."
+readme = "README.md"
+requires-python = ">=3.10"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [{ name = "SoftSignal LLC" }]
+keywords = ["data-quality", "audit", "profiling", "parquet", "csv", "duckdb"]
+classifiers = [
+    "Development Status :: 2 - Pre-Alpha",
+    "Environment :: Console",
+    "Intended Audience :: Science/Research",
+    "Intended Audience :: Financial and Insurance Industry",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Scientific/Engineering :: Information Analysis",
+    "Typing :: Typed",
+]
+
+# ONE runtime dependency, deliberately. duckdb has zero transitive deps and
+# ships prebuilt wheels everywhere. Anything added here is a support burden on
+# every machine this is ever installed on -- and the dependency tree is part of
+# the pitch to the buyer who will not upload their data in the first place.
+dependencies = ["duckdb>=1.0"]
+
+[project.optional-dependencies]
+llm = ["anthropic>=0.40"]   # The ONLY place a network dependency appears.
+dev = ["pytest>=8", "ruff>=0.6", "build>=1.2"]
+
+[project.scripts]
+assay = "dataassay.cli:main"
+
+[project.urls]
+Homepage = "https://getsoftsignal.com"
+
+[tool.hatch.version]
+path = "src/dataassay/__init__.py"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/dataassay"]
+
+[tool.hatch.build.targets.sdist]
+include = ["src/", "tests/", "README.md", "LICENSE"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+addopts = "-q"
+
+[tool.ruff]
+line-length = 100
+target-version = "py310"
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "UP", "B", "SIM"]

dataassay-0.7.0/src/dataassay/__init__.py

@@ -0,0 +1,11 @@
+"""dataassay — audit a tabular dataset.
+
+An assay characterizes a sample before it makes any claim about it. This tool
+works in that order too: establish what kind of thing each column is, run only
+the checks that property makes valid, and report what could NOT be checked as
+plainly as what failed.
+"""
+
+__version__ = "0.7.0"
+
+__all__ = ["__version__"]

dataassay-0.7.0/src/dataassay/__main__.py

@@ -0,0 +1,4 @@
+from dataassay.cli import main
+
+if __name__ == "__main__":
+    raise SystemExit(main())

dataassay-0.7.0/src/dataassay/audit.py

@@ -0,0 +1,166 @@
+"""Orchestration: profile, infer structure, gate the checks, rank what survives.
+
+Coverage is a first-class output, not a footnote. A reader cannot interpret an
+empty findings list without knowing how many checks ran, which were withheld,
+and which are waiting on an answer -- zero findings at 30% coverage and zero at
+95% are entirely different objects, and one number cannot tell them apart.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from pathlib import Path
+
+import duckdb
+
+from dataassay import manifest as manifest_mod
+from dataassay import structure as structure_mod
+from dataassay.checks.base import Confidence, Finding
+from dataassay.checks.registry import CATALOG, CATALOG_VERSION
+from dataassay.profile import Profile, build
+from dataassay.provenance import reader_for, source_expr
+from dataassay.structure import Structure
+
+
+@dataclass
+class Coverage:
+    ran: list[str] = field(default_factory=list)
+    withheld: list[tuple[str, str]] = field(default_factory=list)
+    blocked: list[tuple[str, str]] = field(default_factory=list)
+
+    @property
+    def total(self) -> int:
+        return len(self.ran) + len(self.withheld) + len(self.blocked)
+
+    def to_dict(self) -> dict:
+        return {
+            "checks_total": self.total,
+            "ran": self.ran,
+            "withheld": [{"check": c, "reason": r} for c, r in self.withheld],
+            "blocked": [{"check": c, "question": qn} for c, qn in self.blocked],
+        }
+
+
+@dataclass
+class Audit:
+    profile: Profile
+    structure: Structure
+    findings: list[Finding]
+    coverage: Coverage
+    catalog_version: str = CATALOG_VERSION
+    manifest_path: str | None = None
+    # Question codes a person has seen and deliberately declined to answer.
+    # An unanswered question and a declined one are different states and the
+    # report must not show them as the same thing: the first is work nobody has
+    # done yet, the second is a decision, and presenting a decision as an
+    # outstanding task is how a report trains people to ignore it.
+    skipped_questions: list[str] = field(default_factory=list)
+
+    @property
+    def open_questions(self) -> list:
+        return [q for q in self.profile.questions
+                if q.code not in set(self.skipped_questions)]
+
+    @property
+    def declined_questions(self) -> list:
+        return [q for q in self.profile.questions
+                if q.code in set(self.skipped_questions)]
+
+    def to_dict(self) -> dict:
+        d = self.profile.to_dict()
+        d |= {
+            "catalog_version": self.catalog_version,
+            "structure": self.structure.to_dict(),
+            "coverage": self.coverage.to_dict(),
+            "manifest": self.manifest_path,
+            "skipped_questions": self.skipped_questions,
+            "findings": [f.to_dict() for f in self.findings],
+        }
+        return d
+
+
+def _corroborate(findings: list[Finding]) -> list[Finding]:
+    """Promote findings that two independent checks agree on.
+
+    Agreement is the strongest confidence signal available, and the only one
+    that does not depend on trusting a single detector's threshold. A column
+    flagged by both a saturation check and a level-shift check is real in a way
+    that either alone is not.
+    """
+    by_column: dict[str, set[str]] = {}
+    for f in findings:
+        if f.column:
+            by_column.setdefault(f.column, set()).add(f.check_id)
+
+    out = []
+    for f in findings:
+        others = by_column.get(f.column or "", set()) - {f.check_id}
+        if others and f.confidence.level != "high":
+            f = Finding(
+                check_id=f.check_id,
+                column=f.column,
+                disposition=f.disposition,
+                summary=f.summary,
+                evidence=f.evidence,
+                predicate=f.predicate,
+                confidence=f.confidence.corroborated_by(", ".join(sorted(others))),
+                raw_values=f.raw_values,
+            )
+        out.append(f)
+    return out
+
+
+def run(
+    path: Path,
+    byte_cap: int | None = None,
+    manifest_path: Path | None = None,
+    use_manifest: bool = True,
+) -> Audit:
+    from dataassay.checks.base import CheckContext
+    from dataassay.rawscan import BYTE_CAP
+
+    reader = reader_for(path)
+    con = duckdb.connect(":memory:")
+    try:
+        profile = build(path, byte_cap=byte_cap or BYTE_CAP, con=con)
+        source = source_expr(reader, profile.provenance.read_mode)
+        params = [str(path)]
+        manifest = (
+            manifest_mod.discover(path, manifest_path) if use_manifest else None
+        )
+        struct = structure_mod.infer(
+            profile.columns, con, source, params, profile.provenance.row_count,
+            manifest=manifest,
+        )
+        ctx = CheckContext(
+            profile=profile, structure=struct, con=con, source=source,
+            params=params, manifest=manifest,
+        )
+
+        coverage = Coverage()
+        findings: list[Finding] = []
+        for check in CATALOG:
+            verdict = check.applies(ctx)
+            if not verdict.applicable:
+                if verdict.blocked:
+                    coverage.blocked.append((check.spec.id, verdict.reason))
+                else:
+                    coverage.withheld.append((check.spec.id, verdict.reason))
+                continue
+            coverage.ran.append(check.spec.id)
+            findings.extend(check.run(ctx))
+    finally:
+        con.close()
+
+    findings = _corroborate(findings)
+    findings.sort(key=lambda f: f.sort_key)
+    return Audit(
+        profile=profile, structure=struct, findings=findings, coverage=coverage,
+        manifest_path=(
+            str(manifest.source_path) if manifest and manifest.source_path else None
+        ),
+        skipped_questions=list(manifest.skipped) if manifest else [],
+    )
+
+
+__all__ = ["Audit", "Coverage", "Confidence", "run"]