Module audit_focus 

Weighted focus map (stage 4): the composite attention score per review unit plus the no-skip labels, confidence flags, and escape hatch. Public so the schema-emit binary can derive the FocusMap types. Weighted focus map (stage 4): a COMPOSITE attention score per review unit that ranks where scarce reviewer attention goes.

A 40-file diff becomes a handful of review-here pieces plus an enumerable not-prioritized remainder. The free tier RANKS but NEVER says “skip” (safe explicit-skip is paid, runtime-backed only); each unit carries a human reason; a per-unit confidence flag protects dynamically-wired / re-export-heavy code from a silent static-reachability de-prioritization; and the deprioritized escape-hatch list makes EVERY de-prioritized piece reachable.

The composite score (deterministic, no runtime input)

score = fan_io + security_taint + risk_zone + change_shape, an integer sum (no floats, matching the partition + order engine’s determinism posture) of four deterministic signals, each derived from data the brief already retains:

1. fan-in / fan-out (graph blast): from ModuleGraph::focus_file_facts.
2. security taint touch: a source -> sink taint trace touches the unit (reuse SecurityFinding.trace). Built as a pure function of a security- finding slice; the brief path carries an EMPTY slice today (security is the opt-in fallow security command, not the bare dead-code analysis), so this contributes 0 until a future epic threads a security pass. The seam is wired and tested; no taint engine runs here.
3. risk zone: boundary / public-API / security-sensitive.
4. change shape: new export / widened visibility / signature change (the coordination-gap proxy, ADR-001 syntactic).

The runtime seam (documented, NOT built)

FocusScore keeps the four component sub-scores on the wire so the paid runtime layer can multiply a runtime hot/cold weight into total WITHOUT recomputing the deterministic signals. The single // runtime seam marker sits at the point the components are summed. No runtime field, no runtime read, no runtime gate here: free mode is the complete surface.

Structs

BoundaryZoneFile

A boundary-zone signal for a unit: the unit’s file introduced a new cross-zone edge (it is the from_file of an introduced boundary edge).

FocusInputs

Everything the focus extractor needs, gathered from the assembled brief data. All path-spaces are root-relative + forward-slashed (the brief’s canonical space), so signal joins are byte-exact.

FocusMap

The weighted focus map: the ranked review-here units plus the FULL deprioritized escape-hatch list, so nothing is hidden.

FocusScore

The composite attention score, with the four deterministic component sub-scores kept on the wire so the runtime seam can re-weight total without recomputing the signals.

FocusUnit

One review unit on the focus map: its file, composite score, label, human reason, and any confidence flags.

Enums

ConfidenceFlag

A per-unit confidence flag. The EXACT panel-decided strings: a dynamically- wired or re-export-heavy unit carries one so its static-reachability signal is not trusted as complete (the anti-silent-de-prioritization guard). The flag NEVER lowers the score; it is advisory provenance.

FocusLabel

The focus label for a review unit. EXACTLY two variants: Skip is NOT representable, so the type system is the guarantee that free mode never emits a skip label (safe explicit-skip is paid, runtime-backed only). Mirrors the decision surface’s “cut category not representable” structural posture.

Functions

build_focus_map

Build the weighted focus map from the assembled brief inputs: score each unit, label it (review-here / not-prioritized, NEVER skip), attach the reason and confidence flags, then partition into the ranked review_here list and the FULL deprioritized escape-hatch list.