The JSON report uses schemaVersion: 6 and has exactly these top-level fields:
schemaVersion: report contract versionprovenance: lock identity, selected exact SHA, target, host, and backendsourceRoles: bounded semantic source-role resolution status, required flag, candidate and inspected counts, validated capabilities, deterministic selection reasons, and selected exact-tree pathsapplicationInventory: option entries and an honest completeness statementmoduleInventory: native option entries and completeness statementlocal: redacted evaluated native and Nix-generated override key/type shapes, or an unavailable reasoncomparison: catalog paths present or absent in the evaluated shapes plus all classified application paths and application/module mismatches; it does not claim which values were explicitly assigned by local sourcecompleteness: explicit overall, local-comparison, and inventory statusrequests: GitHub API and code-search request countslimits: unresolved and completeness qualifications
Source roles are resolved, unresolved-no-candidate,
candidates-found-none-validated, ambiguous-multiple-authoritative, or
extractor-unsupported. Required foundational gaps stop inventory construction;
optional gaps remain visible here and reduce the stated completeness in limits.
Resolution enumerates the pinned commit tree once (with bounded subtree traversal
if GitHub reports a truncated recursive tree), validates preferred paths by
content signature, and otherwise reads only a bounded, deterministically ranked
set of semantic candidates. Tests, generated files, translations, examples, and
compatibility copies are excluded from fallback selection.
Application entries include path, default and observed default shape where
available, source-established expected shape, confidence, conditions, migration
status, and exact-SHA evidence. A default alone is not treated as an accepted
type contract. Module
entries include path, type, default, example, description, mapping, and evidence.
With --latest, each inventory also contains latestComparison with the exact
latest SHA and added, removed, and changed paths; pinned inventory evidence stays
authoritative.
The machine-readable contract is audit.schema.json. Both
JSON and Markdown reports are created with mode 0600.