[runyourempire]

What

These are the two W5a follow-ups to #974 (E4, not-covered), as agreed with recovery-lead.

1. A Maven-only project is no longer "ready"

osv::sync::auditable_ecosystems, which only readiness calls, now counts an ecosystem only when at least one auditable row carries an installed version.

• Why: the manifest scanner registers pom.xml and build.gradle dependencies with no version, and fix(advisories): unversioned matches are never grounded; uncovered ecosystems say so (audit A2/E4) #974 never matches a versionless dependency. Those rows still made "Maven" a required ecosystem, its sync succeeded, and readiness said Ready for a project in which nothing was checked.
• Maven-only: it now reads NoInventory, and fix(advisories): unversioned matches are never grounded; uncovered ecosystems say so (audit A2/E4) #974's not_covered names its pom.xml.
• npm + Maven: Ready for npm, with the Maven files named, not counted as covered.
• Unchanged:
  • The scanner keeps those rows for ACE context: detected tech, detected_projects and the context inventory.
  • The sync and the matcher are untouched (auditable_packages_by_ecosystem).
• Live DB (read-only): all 593 project_dependencies rows (manifest-sourced) have no version, and all 5,013 versioned rows are lockfile-backed npm/Rust in user_dependencies. The operator's own readiness does not change.

2. The Brief names what it did not check

BriefFacts carries #974's not-covered report, which is used three ways:

• Deterministic brief: the all-clear becomes "Nothing new touches the code 4DA checked today." It is followed by "Not checked: N dependency files 4DA does not read installed versions from: spring-petclinic/pom.xml (Maven), …". Up to three files are named, then "and N more". Unreadable lockfiles get their own sentence with the reason. The line is shown whenever any file was not covered, not only beside an all-clear.
• Narrated brief: honest_without_lockfiles rewrites the model's "Nothing new touches your code" the same way and appends the line. Running it twice changes nothing.
• Prompt: it starts with "NOT EVERYTHING WAS CHECKED: …". It tells the model the facts are authoritative for the files read only, and that any all-clear must say "the code 4DA checked". The old line claimed the facts were "authoritative and complete for security and upgrades".

Checks

• cargo clippy --locked -- -D warnings: clean.
• osv::, brief, briefing, digest, morning_ and evidence::: 789 passed.
• New tests:
  • a Maven-only project gives NoInventory with its pom.xml named;
  • npm + Maven gives Ready for npm with the Maven files named;
  • the scoped all-clear plus the not-checked line;
  • "and N more" and unreadable lockfiles;
  • a narrated all-clear is rewritten idempotently;
  • the prompt says not everything was checked;
  • with everything read, the brief is unchanged.
• Data verified by DB query (above). A visual check of the Brief text is pending the next operator-app run; I did not start the app.

🤖 Generated with Claude Code

https://claude.ai/code/session_015KSXWNneouUjTiVV3Rc3FH