feat(hierarchy): audit event + outbox machinery (M4-1b-i, contract 1 §5.2) (#1460)

packages/db/src/hierarchy-writer-coverage.test.ts

@@ -123,18 +123,20 @@
  *     tracked for M4-1b consideration); the counterfactual — flagging every
  *     bare identifier call — false-positives on essentially all callback
  *     code. Reviews of modules touching db handles carry this residual.
- *   - The scan perimeter is <root>/<pkg>/src for the three roots; production
- *     TS outside a src/ directory (e.g. packages/mosaic/framework/**) is not
- *     scanned (verified free of db/driver/execute references at review time).
- *     Files excluded from the scan — test files and out-of-src modules — are
- *     also invisible as import-graph CONDUITS: test files are emitted to
- *     dist, so a production module could launder a symbol or capability
- *     through a re-export in one. Importing a test module from production
- *     code is anomalous and review-visible; the blind spot is accepted as a
- *     residual, not closed.
+ *   - The scan perimeter is the full <root>/<pkg> tree for the three roots
+ *     (build output, tool caches, and dot-directories excluded), so
+ *     production TS outside src/ — package configs, e2e helpers,
+ *     packages/mosaic/framework/** — is scanned and conduit-visible
+ *     (widened from src/-only in M4-1b-i; the widened set was measured free
+ *     of every trigger token at the time). Files excluded from the scan —
+ *     test files — are still invisible as import-graph CONDUITS: test files
+ *     are emitted to dist, so a production module could launder a symbol or
+ *     capability through a re-export in one. Importing a test module from
+ *     production code is anomalous and review-visible; that blind spot is
+ *     accepted as a residual, not closed.
  *
  * The writer allowlist names hierarchy command/repository modules ONLY. It is
- * empty today: the hierarchy command family (M4-1b) has not landed, so no
+ * empty today: the hierarchy command family (M4-1b-ii) has not landed, so no
  * production module may write the class tables. The infrastructure register
  * holds legitimate non-hierarchy raw execution; registered modules are exempt
  * from prong (iii) only — prongs (i) and (ii) apply to them with no
@@ -179,7 +181,8 @@ const CLASS_TABLES = [
 
 /**
  * Writer allowlist (§6.3b): hierarchy command/repository modules only.
- * EMPTY until the hierarchy command family lands (M4-1b). Adding a module
+ * EMPTY until the hierarchy command family lands (M4-1b-ii; M4-1b-i ships
+ * only the audit/outbox machinery, which writes no class table). Adding a module
  * here is a contract-conformance decision reviewed under §5.1 — the module
  * must be part of the Gateway hierarchy command path, and it must not export
  * a function that executes caller-supplied SQL.
@@ -291,20 +294,23 @@ function isTestPath(rel: string): boolean {
   );
 }
 
+/** Directory names excluded from the walk: build output and tool caches only. */
+const EXCLUDED_DIRS = new Set(['node_modules', 'dist', 'build', 'coverage', 'test-results']);
+
 function collectSources(): string[] {
   const files: string[] = [];
   for (const root of SCAN_ROOTS) {
     const rootDir = join(REPO_ROOT, root);
     if (!existsSync(rootDir)) continue;
     for (const pkg of readdirSync(rootDir)) {
-      const srcDir = join(rootDir, pkg, 'src');
-      if (!existsSync(srcDir) || !statSync(srcDir).isDirectory()) continue;
+      const pkgDir = join(rootDir, pkg);
+      if (!statSync(pkgDir).isDirectory()) continue;
       const walk = (dir: string): void => {
         for (const entry of readdirSync(dir)) {
           const full = join(dir, entry);
           const st = statSync(full);
           if (st.isDirectory()) {
-            if (entry === 'node_modules' || entry === 'dist') continue;
+            if (EXCLUDED_DIRS.has(entry) || entry.startsWith('.')) continue;
             walk(full);
           } else if (EXTENSIONS.has(full.slice(full.lastIndexOf('.')))) {
             const rel = relative(REPO_ROOT, full).split(sep).join('/');
@@ -312,7 +318,7 @@ function collectSources(): string[] {
           }
         }
       };
-      walk(srcDir);
+      walk(pkgDir);
     }
   }
   return files.sort();