[runyourempire]

What

This is the Brief half of audit E8, the follow-up that recovery-lead cleared on #972.

#972 gave the Upgrade Plan's direct rows the command that moves a declared dependency while keeping how it is declared. The Brief's own direct rows still said a bare "bump minimist to >= 1.2.6". They now give the same command, read by the same rule from the project's own manifest (osv::direct_upgrade::direct_fix):

bump minimist to >= 1.2.6: run npm install "minimist@~1.2.6"

How

• FixPath::Bump gains fix: Option<String>. It holds either "run <command>" or a manifest edit (a workspace-inherited crate, a PyPI == pin). It is None whenever nothing can be named with certainty, including when the declaration doesn't admit the installed copy (feat(fix-path): direct upgrades name the command that keeps how they are declared (E8, C2); security placeholders hold for any advisory (L4); H2 vectors #972's S4 rule).
• fix is omitted from JSON when None, so serialized facts are unchanged for every other path.
• brief_facts_build adds with_direct_fix to the chain after with_refresh_command. It passes the copy's installed version, so the admits check runs.
• Every Bump { to } pattern becomes Bump { to, .. }: brief_facts, morning_audit, morning_floor_tests and evidence/stack_change.

A bug this would have caused, fixed here

security_signature hashes the fix path's Debug form for HIGH and CRITICAL facts. With fix included, every open act-now declared copy would have re-surfaced as "changed" once after upgrade, and again whenever a manifest's operator changed. That would be false news in the Brief.

A bump now renders as the pre-fix Bump { to: ".." }, so stored signatures still match. The test a_bumps_command_does_not_change_its_signature pins both the equality and the exact stored form.

File sizes

brief_facts.rs reached 1006 lines, over the 1000-line error.

• fix_clause and proven_clause (the wording) moved to brief_facts_clause.rs and are re-exported, so callers are unchanged. brief_facts.rs is now 907 lines.
• The direct-fix tests live in brief_facts_build_tests.rs. brief_facts_build.rs is 949 lines.

Checks

• cargo clippy --locked -- -D warnings: clean.
• brief_facts, morning_, osv:: and evidence::: 453 passed, on main 1a2e905 (feat(fix-path): direct upgrades name the command that keeps how they are declared (E8, C2); security placeholders hold for any advisory (L4); H2 vectors #972).
• New tests:
  • the command keeps the tilde;
  • a package that isn't declared stays a plain bump;
  • a declaration that doesn't admit the installed copy names nothing;
  • a refresh path is untouched;
  • the signature test above.
• No frontend consumer of FixPath exists: no TS type or binding.

🤖 Generated with Claude Code

https://claude.ai/code/session_015KSXWNneouUjTiVV3Rc3FH