Add bounded audit all orchestration

README.md

@@ -71,6 +71,7 @@ cdidx references UserService --limit 20
 cdidx inspect QueryCommandRunner --outline-only
 cdidx map --compact --max-json-bytes 65536
 cdidx audit risky-code --format sarif --limit 20
+cdidx audit --all --format compact --total-limit 200
 cdidx doctor --json
 cdidx doctor --integrations --json
 cdidx validate
@@ -350,6 +351,7 @@ cdidx references UserService --limit 20
 cdidx inspect QueryCommandRunner --outline-only
 cdidx map --compact --max-json-bytes 65536
 cdidx audit risky-code --format sarif --limit 20
+cdidx audit --all --format compact --total-limit 200
 cdidx doctor --json
 cdidx doctor --integrations --json
 cdidx validate

TESTING_GUIDE.md

@@ -19,6 +19,7 @@ Use the full suite by default. Use targeted filters only while iterating locally
 
 ## Test Stack
 
+- Issue #5238 audit-all coverage belongs in `QueryCommandRunnerAuditAllIssue5238Tests.cs`, `DbReaderTests.cs`, `CliFlagSchemaTests.cs`, and `ConsoleUiTests.cs`. Keep authoritative registry ordering, shared filters and overlap attribution, per-query and global row limits, incremental JSON/NDJSON byte admission, real scoped cancellation with SQLite interruption, failure continuation, bounded recovery accounting, filter-preserving retry commands, interactive stderr progress isolation, freshness, allocation, help, and completion synchronized across both target frameworks.
 - Issue #5236 dry-run row-estimate coverage belongs in `IndexCommandRunnerDryRunTests.cs`. Keep new-database, unchanged rebuild, changed update followed by execution, unchanged skip, delete, checksum-rename purge, parse-unavailable transitions, and cross-file TypeScript augmentation rebuilds together. Across both target frameworks, assert independent delete, insert/upsert, total-operation, projected-final, and delta values/provenance, legacy-alias semantics and migration metadata, human/JSON naming parity, conservative `symbol_references` unknowns for augmentation rebuilds, and database/source non-mutation.
 - Issue #5233 projected-array coverage belongs in `JsonEnvelopeWrapperIssue4585Tests.cs`. Keep `search`, `symbols`, and `files` on the shared projection path, preserving bare-array roots, empty arrays, row and requested-field order, aliases, search limit aliases, exact UTF-8 byte-limit trimming, and complete versioned errors. The same focused fixture must retain unprojected array and NDJSON controls, object-mode precedence for compact/summary output across explicit stream selectors, envelope metadata shapes, typed unknown-field errors, rightmost repeated JSON selectors, and fail-fast structured errors for projected explicit NDJSON, supported or unsupported incompatible non-JSON formats, search aggregations, metadata-dependent selectors, stream-only controls, or diagnostics. Cursor-focused fixtures must opt into `--json-envelope` instead of relying on `--fields` to override an explicit array or stream selector.
 - Issue #5232 `goto` ambiguity coverage belongs in `QueryCommandRunnerIssue5232Tests.cs`. Keep zero, one, and many-match controls together; explicit-JSON and implicit human ambiguity modes must preserve stream placement, stable command/error/exit identity, authoritative totals and omitted counts, structured narrowing guidance, sanitized candidates, and both the 20-candidate and 16 KiB candidate budgets across both target frameworks.
@@ -1183,6 +1184,7 @@ dotnet test --filter "FullyQualifiedName~GitHelperTests"
 
 ## テストスタック
 
+- Issue #5238 の audit-all coverage は `QueryCommandRunnerAuditAllIssue5238Tests.cs`、`DbReaderTests.cs`、`CliFlagSchemaTests.cs`、`ConsoleUiTests.cs` が担当します。authoritative registry の順序、共通 filter と重複結果の帰属、query ごと / 全体の row 上限、JSON / NDJSON row の逐次 byte 受理、SQLite interrupt を伴う実際の scope 付き cancellation、failure 後の継続、上限と省略数を持つ recovery accounting、filter を保持する retry command、interactive な stderr progress の分離、freshness、allocation、help、completion を両 target framework で同期してください。
 - Issue #5236 の dry-run row estimate coverage は `IndexCommandRunnerDryRunTests.cs` が担当します。新規 database、未変更 rebuild、変更 update と後続 execution、未変更 skip、delete、checksum rename purge、parse 利用不能の transition、cross-file TypeScript augmentation rebuild を同じまとまりに維持してください。両 target framework で、独立した delete、insert/upsert、総 operation、予測最終件数、delta の値 / provenance、legacy alias の semantics と移行 metadata、human / JSON の命名 parity、augmentation rebuild 時の保守的な `symbol_references` unknown、checked arithmetic behavior、database / source の非変更を assertion します。
 - Issue #5233 の projected array coverage は `JsonEnvelopeWrapperIssue4585Tests.cs` が担当します。`search`、`symbols`、`files` を共有 projection path に保ち、bare array root、空配列、row と指定 field の順序、alias、search の limit alias、UTF-8 byte 上限の正確な末尾切り詰め、完全な version 付き error を維持してください。同じ focused fixture で、非投影の array / NDJSON control、明示 stream selector に対する compact / summary の object mode 優先、envelope の metadata shape、未知 field の型付き error、繰り返した JSON selector の右端優先、および投影付きの明示 NDJSON、対応済み・未対応の非互換な非 JSON format、search aggregation、metadata 依存 selector、stream 専用 control、diagnostic に対する部分出力前の構造化 error も固定します。cursor を対象にする fixture は、`--fields` による明示 array / stream selector の上書きに依存せず、`--json-envelope` を指定してください。
 - Issue #5232 の `goto` ambiguity coverage は `QueryCommandRunnerIssue5232Tests.cs` が担当します。0件・1件・複数件の control を同じ fixture に維持してください。両 target framework で、明示的 JSON と暗黙の human ambiguity mode の stream 配置、安定した command / error / exit identity、authoritative な総数と省略数、構造化 narrowing guidance、sanitization 済み candidate、20件と16 KiBの両 candidate budget を検証します。

USER_GUIDE.md

@@ -1505,6 +1505,7 @@ cdidx search --recipe risky-code/raw-diagnostic-echo --format sarif --limit 20
 cdidx search --recipe risky-code/raw-diagnostic-echo --format compact --cursor <next_cursor>
 cdidx search --recipe risky-code --results-only --search-fields path,line,query_name,recipe --json=ndjson --max-json-bytes 65536  # minimal audit rows
 cdidx search --recipe risky-code --format count --summary-only --max-json-bytes 20000  # compact recipe counts
+cdidx audit --all --format compact --total-limit 200  # bounded full-repository audit across every registered recipe
 cdidx search --named-query pack="dotnet pack" --named-query push="nuget push" --format compact  # named ad hoc batch with compact snippets
 cdidx search "catch (Exception" --group-by file --count --json    # rank broad audit hits by file
 cdidx search "JsonDocument.Parse" --group-by symbol --count --json # rank broad audit hits by enclosing symbol
@@ -1589,6 +1590,47 @@ guard filters, risk evidence, classifier metadata, and query-specific audit
 taxonomy metadata.
 Add `--query <filter>` to narrow discovery by recipe/query names, query text,
 labels, severity, path metadata, or descriptions.
+`cdidx audit --all` is the full-repository orchestration layer. It takes one
+snapshot from the same authoritative registry as `cdidx recipes --names`, sorts
+recipe names ordinally, and selects every registered entry exactly once,
+including composite recipes. It attempts those entries in order until a row,
+byte, cancellation, or deadline bound stops execution, and reports any
+unattempted entries as omitted. It does not recursively invoke the CLI, change any
+recipe matching rule, or deduplicate overlaps across recipes. Aggregate count
+fields are therefore explicitly sums of recipe/query observations, never a
+claim about unique source matches; every emitted row keeps its `recipe` and
+`query_name` attribution.
+
+The existing search filters, including `--lang`, `--path`, `--exclude-path`,
+`--exclude-tests`, `--audit-scope`, and `--source-only`, apply uniformly to each
+selected recipe. Add `--show-excluded` to retain each recipe's effective scope
+and bounded exclusion diagnostics in the aggregate output. `--limit` remains a per-query result limit. `--total-limit` is
+the global emitted-row cap; when omitted in row-producing all mode it defaults
+to 200. Count and `--summary-only` modes execute the selected queries with a
+bounded per-query observation window and emit no rows. JSON and compact
+summaries report selected, completed, failed, partial, and omitted recipe
+counts, bounded per-recipe/query status, authoritative or lower-bound count
+facts, aggregate and per-query index freshness, row/byte limits, registry
+diagnostics, and recovery commands for failed, partial, or omitted recipes. NDJSON
+emits attributed rows followed by the same terminal cross-recipe summary.
+Recovery metadata returns at most three commands and explicitly reports its
+limit, omitted command count, and truncation state. Each command preserves the
+active shared search filters so the individual retry reproduces the bounded run.
+
+Accumulation is bounded to 10,000 candidate rows per query, 512 returned query
+details, 32 returned errors, a five-minute deadline enforced within each query,
+and a 4 MiB JSON response when no explicit `--max-json-bytes` is supplied.
+Structured rows are admitted incrementally against that byte budget, and an
+active SQLite read is interrupted when its scoped deadline is cancelled.
+Interactive terminals show progress on stderr; use `--no-progress` to suppress
+it, and machine-readable stdout remains clean. A requested `--total-limit` truncation
+is a successful bounded result. Query failures do not discard successful
+sibling recipes: the run continues, records bounded errors, and returns partial
+exit code 11; `--allow-partial` accepts that incomplete result with exit code 0.
+Cancellation returns exit code 8 with the completed/omitted accounting retained.
+Use an individual `cdidx audit <recipe>` for SARIF, issue drafts, child-query
+cursoring, or recipe-specific aggregation. `cdidx recipes` and `cdidx batch`
+remain the lower-level discovery and explicit orchestration tools.
 Built-in recipe queries may also include `risk_evidence`, a short set of
 positive and negative evidence facets that explain why a hit is risky or likely
 bounded/safe. Recipe run JSON repeats those facets on each matching result so
@@ -5298,6 +5340,7 @@ cdidx search --recipe risky-code/raw-diagnostic-echo --format sarif --limit 20
 cdidx search --recipe risky-code/raw-diagnostic-echo --format compact --cursor <next_cursor>
 cdidx search --recipe risky-code --results-only --search-fields path,line,query_name,recipe --json=ndjson --max-json-bytes 65536  # 最小限の audit row
 cdidx search --recipe risky-code --format count --summary-only --max-json-bytes 20000  # compact な recipe count
+cdidx audit --all --format compact --total-limit 200  # 登録済み recipe 全体を上限付きで full-repository audit
 cdidx search --named-query pack="dotnet pack" --named-query push="nuget push" --format compact  # 名前付き ad hoc batch と compact snippet
 cdidx search "catch (Exception" --group-by file --count --json    # 広い audit hit を file 別にランク付け
 cdidx search "JsonDocument.Parse" --group-by symbol --count --json # 広い audit hit を enclosing symbol 別にランク付け
@@ -5367,6 +5410,42 @@ MCP `search` tool では同じ mode を camelCase 引数 `requireBefore`, `requi
 result level、正規化済みの repository-relative artifact URI を出力します。
 
 search audit recipe は、名前付き recipe を複数の curated search query に展開します。
+`cdidx audit --all` は full-repository audit 用の orchestration layer です。
+`cdidx recipes --names` と同じ authoritative registry の snapshot を1回取得し、recipe 名を
+ordinal 順に並べ、composite recipe を含む登録 entry をそれぞれ厳密に1回選択します。row / byte
+上限、cancellation、または deadline で停止するまで順番に実行を試み、未実行の entry は omitted
+として報告します。CLI を
+再帰的に呼び出したり、recipe の matching rule を変更したり、recipe 間で重複 match を
+deduplicate したりはしません。そのため aggregate count は unique source match 数ではなく、
+recipe/query ごとの observation の合計として明示され、出力 row はすべて `recipe` と
+`query_name` の帰属を保持します。
+
+`--lang`、`--path`、`--exclude-path`、`--exclude-tests`、`--audit-scope`、
+`--source-only` など既存の search filter は、選択したすべての recipe に同じように適用されます。
+`--show-excluded` を追加すると、各 recipe の effective scope と上限付き exclusion diagnostic を
+aggregate 出力に保持します。
+`--limit` は引き続き query ごとの result 上限です。`--total-limit` は emitted row 全体の上限で、
+row を出す all mode で省略した場合は 200 です。count と `--summary-only` は row を出さず、
+選択した query を query ごとの上限付き observation window で実行します。JSON / compact summary は
+selected / completed / failed / partial / omitted recipe 数、上限付きの recipe/query status、
+authoritative count または lower bound、aggregate および query ごとの index freshness、row/byte 上限、
+registry diagnostic、failed / partial / omitted recipe の recovery command を
+返します。NDJSON は帰属付き row の後に同じ cross-recipe terminal summary を出力します。
+recovery metadata は最大3件の command を返し、上限、省略 command 数、truncation 状態を
+明示します。各 command は有効な共通 search filter を保持するため、個別 retry でも上限付き実行を
+再現できます。
+
+accumulation は query ごとに最大 10,000 candidate row、返却する query detail は 512 件、error は
+32 件、各 query 内でも強制される実行 deadline は5分、明示的な `--max-json-bytes` がない JSON response は
+4 MiB に制限されます。structured row はこの byte budget に対して逐次受理され、scope 付き deadline が
+cancel されると実行中の SQLite read も interrupt されます。interactive terminal の progress は stderr
+へ出力され、`--no-progress` で抑止できます。機械可読な stdout は progress と混在しません。
+指定した `--total-limit` による truncation は正常な上限付き結果です。query failure が起きても
+成功済み sibling recipe は破棄せず、実行を継続して上限付き error を記録し、partial exit code 11
+を返します。`--allow-partial` を指定すると不完全な状態を維持したまま exit code 0 を許可します。
+cancellation は completed / omitted accounting を保持し、exit code 8 を返します。SARIF、issue draft、
+child-query cursor、recipe 固有 aggregation が必要な場合は個別の `cdidx audit <recipe>` を使ってください。
+`cdidx recipes` と `cdidx batch` は lower-level の discovery / 明示的 orchestration tool として維持されます。
 組み込み recipe には `risky-code`、`json-parse-apis`、`dotnet-risk-patterns`、
 `auth-token-audit`、`string-comparison-semantics`、`dogfood-risk-patterns`、
 `sqlite-query-policy-surfaces`、`unsupported-operation-boundaries`、`xml-parser-security`、

changelog.d/unreleased/5238.added.md

@@ -0,0 +1,25 @@
+---
+category: added
+issues:
+  - 5238
+affected:
+  - src/CodeIndex/Cli/QueryCommandRunner.AuditAll.cs
+  - src/CodeIndex/Cli/CliFlagSchema.cs
+  - src/CodeIndex/Cli/ConsoleUi.Progress.cs
+  - src/CodeIndex/Database/DbReader.cs
+  - src/CodeIndex/Database/DbSearchReader.cs
+  - README.md
+  - USER_GUIDE.md
+  - TESTING_GUIDE.md
+  - tests/CodeIndex.Tests/QueryCommandRunnerAuditAllIssue5238Tests.cs
+  - tests/CodeIndex.Tests/DbReaderTests.cs
+  - tests/CodeIndex.Tests/ConsoleUiTests.cs
+---
+
+## English
+
+- **`audit --all` now selects every registered audit recipe for bounded cross-recipe execution (#5238)** — Recipes are attempted in deterministic registry-name order with shared search filters and optional exclusion diagnostics until row, byte, cancellation, or deadline bounds stop the run. Output preserves recipe/query attribution, freshness, explicit non-unique overlap accounting, incremental JSON/NDJSON byte admission, SQLite interruption, stderr-only interactive progress, and bounded filter-preserving recovery commands with omission accounting.
+
+## 日本語
+
+- **`audit --all` で登録済みの全 audit recipe を選択し、上限付きで cross-recipe 実行できるようになりました (#5238)** — registry 名の決定的な順序で、row / byte 上限、cancellation、または deadline まで共通 search filter と任意の exclusion diagnostic を使って実行を試みます。recipe/query の帰属と freshness、重複を unique 数と誤認しない集計、JSON / NDJSON の逐次 byte 受理、SQLite interrupt、stderr 限定の interactive progress、省略件数付きで filter を保持する上限付き recovery command を提供します。