@aiwg/cli 2026.10.1 → 2026.10.4

package/dist/src/decision/heldout/collector.js

@@ -10,7 +10,7 @@ import { QUALIFICATION_PRIVACY_SURFACES, scanQualificationPrivacy } from '../qua
 import { executeQualificationPlan, verifyQualificationArtifacts, writeQualificationEvidenceManifest } from '../qualification/runner.js';
 import { qualificationIntegrityAllowlistProblems } from '../qualification/release.js';
 import { redactText } from '../../governance/redaction.js';
-import { heldoutDigest, heldoutRequest, heldoutReservationMicros, heldoutReservationTokens, HeldoutError, HELDOUT_ENV_GATE, heldoutRowsInScope, planHeldoutCollection, validateHeldoutBundle } from './contract.js';
+import { heldoutDigest, heldoutRequest, heldoutReservationMicros, heldoutReservationTokens, HeldoutError, HELDOUT_ENV_GATE, heldoutRowsInScope, heldoutResumeAttempts, heldoutPendingRequests, planHeldoutCollection, validateHeldoutBundle } from './contract.js';
 import { appendHeldoutSpend, appendHeldoutEvent, heldoutDirectory, heldoutEvidenceDigest, heldoutRunsRoot, readHeldoutFile, readHeldoutJournal, reconcileHeldoutBaseline, scanHeldoutSpend, writeHeldoutFile, validateHeldoutJournal, heldoutCollectionAllowance } from './journal.js';
 import { readHeldoutFrozen, sealHeldoutCalibrationPhase, validateHeldoutPhaseAccess } from './calibration.js';
 import { D17_MULTIFACT_CALIBRATION_NOT_AFTER, usesD17MultifactGenerator } from './study-generators.js';
@@ -70,13 +70,7 @@ export async function collectHeldoutStudy(options) {
             throw new HeldoutError('prior-stop');
         if (!offline && prior.runs.some(run => run.corpusDigest === a.corpusDigest && run.source === 'injected-transport'))
             throw new HeldoutError('injected-prior');
-        const old = prior.attempts.filter(attempt => attempt.study === a.study && attempt.corpusDigest === a.corpusDigest);
-        if (old.some(attempt => attempt.preregistrationDigest !== a.preregistrationDigest))
-            throw new HeldoutError('changed-preregistration');
-        const latest = new Map();
-        for (const attempt of old)
-            if (attempt.ordinal >= (latest.get(key(attempt))?.ordinal ?? 0))
-                latest.set(key(attempt), attempt);
+        const { old, latest } = heldoutResumeAttempts(bundle, prior.attempts);
         const now = options.now ?? Date.now, sleep = options.sleep ?? delay, started = now();
         // D17-MF (#2850) is scored only through the registered D17 member calibrator: a session whose whole dispatch window
         // (start plus the preregistered session limit) does not end before the calibrator expires never starts. A seed
@@ -127,20 +121,18 @@ export async function collectHeldoutStudy(options) {
             }
             if (failed.has(row.id) || overSlice(row.slice, row.split))
                 continue;
-            const remaining = row.requests.filter(request => latest.get(`${row.id}/${request.id}`)?.result?.disposition !== 'success');
+            const remaining = heldoutPendingRequests(row, plan, latest);
             if (!remaining.length)
                 continue;
             // Checkpoint before a subject/paired arms: enough time for every bounded attempt and interval.
-            const pairBound = remaining.length * (1 + plan.providerFailurePolicy.maxRetries) * (plan.requestTimeoutMs + plan.minDispatchIntervalMs);
+            const pairBound = remaining.reduce((n, request) => n + request.attempts, 0) * (plan.requestTimeoutMs + plan.minDispatchIntervalMs);
             if (now() - started + pairBound > plan.sessionLimitMs * 0.8) {
                 checkpoint = true;
                 break;
             }
-            for (const request of remaining) {
+            for (const { request, first } of remaining) {
                 if (reason || failed.has(row.id))
                     break;
-                const previous = latest.get(`${row.id}/${request.id}`);
-                const first = previous ? previous.ordinal + 1 : 1;
                 for (let ordinal = first; ordinal <= 1 + plan.providerFailurePolicy.maxRetries; ordinal++) {
                     if (options.signal?.aborted) {
                         reason = 'cancelled';
@@ -250,6 +242,12 @@ export async function collectHeldoutStudy(options) {
                     // No raw provider exceptions, model IDs or request IDs cross this boundary when a secret matches.
                     const raw = observation;
                     const metadata = wireMetadata;
+                    // `metadata` is `jev.ts`'s observer, reading model/usage off the exact same single parse that
+                    // produced `raw` (never a second, independent parse of the same bytes -- see jev.ts `observeParsed`).
+                    // The two can therefore no longer disagree on a successful response; preferring `metadata` here
+                    // only matters when `raw` is a failure (e.g. an otherwise-parseable but invalid answer), so the
+                    // model/usage bound checks below still see the wire-observed values jev.ts's `failure()` does not
+                    // carry.
                     const observed = raw && metadata ? { ...raw, actualModel: metadata.actualModel, usage: metadata.usage } : raw;
                     const completed = receipt;
                     const captures = QUALIFICATION_PRIVACY_SURFACES.map(surface => ({ surface,
@@ -275,7 +273,10 @@ export async function collectHeldoutStudy(options) {
                     else if (observed?.usage.costUsd !== null && observed?.usage.costUsd !== undefined && observed.usage.costUsd * 1_000_000 > reserveMicros)
                         outcome = 'price-bound';
                     else if (observed?.status === 'success') {
-                        if (observed.actualModel !== a.servedModel)
+                        // A null model is unknown, not a mismatch: it must complete neither as 'ok' nor as 'served-model'.
+                        if (observed.actualModel === null)
+                            outcome = 'model-unknown';
+                        else if (observed.actualModel !== a.servedModel)
                             outcome = 'served-model';
                         else if (observed.usage.inputTokens === null || observed.usage.outputTokens === null)
                             outcome = 'usage-unknown';

package/dist/src/decision/heldout/contract.js

@@ -260,26 +260,49 @@ export async function assertHeldoutRequestBounds(corpus, plan, approval) {
             }
         }
 }
-export async function planHeldoutCollection(bundle, digest) {
+/** Prior observations are reusable only within the same study, corpus and preregistration. */
+export function heldoutResumeAttempts(bundle, prior) {
+    const a = bundle.approval;
+    const old = prior.filter(attempt => attempt.study === a.study && attempt.corpusDigest === a.corpusDigest);
+    if (old.some(attempt => attempt.preregistrationDigest !== a.preregistrationDigest))
+        throw new HeldoutError('changed-preregistration');
+    const latest = new Map();
+    for (const attempt of old) {
+        const key = `${attempt.rowId}/${attempt.requestId}`, previous = latest.get(key);
+        if (previous?.result?.disposition !== 'success' && (attempt.result?.disposition === 'success'
+            || attempt.ordinal >= (previous?.ordinal ?? 0)))
+            latest.set(key, attempt);
+    }
+    return { old, latest };
+}
+/** The collector and dry-run reserve only unfinished requests, with their unspent retry allowance. */
+export function heldoutPendingRequests(row, plan, latest) {
+    return row.requests.flatMap(request => {
+        const previous = latest.get(`${row.id}/${request.id}`);
+        const first = (previous?.ordinal ?? 0) + 1, attempts = 2 + plan.providerFailurePolicy.maxRetries - first;
+        return previous?.result?.disposition === 'success' || attempts <= 0 ? [] : [{ request, first, attempts }];
+    });
+}
+export async function planHeldoutCollection(bundle, digest, prior = []) {
     validateHeldoutBundle(bundle, digest);
     await assertHeldoutRequestBounds(bundle.corpus, bundle.preregistration, bundle.approval);
-    let maximumRequestEstimateTokens = 0, tokens = 0, usdMicros = 0;
+    const { latest } = heldoutResumeAttempts(bundle, prior);
+    let maximumRequestEstimateTokens = 0, tokens = 0, usdMicros = 0, maximumAttempts = 0;
     const rows = heldoutRowsInScope(bundle);
     for (const row of rows)
-        for (const request of row.requests) {
+        for (const { request, attempts } of heldoutPendingRequests(row, bundle.preregistration, latest)) {
             const planned = await heldoutRequest(bundle.corpus, bundle.preregistration, bundle.approval, row, request);
             maximumRequestEstimateTokens = Math.max(maximumRequestEstimateTokens, planned.estimatedTokens);
             const reservation = heldoutReservationMicros(bundle.approval, planned.estimatedTokens);
             if (reservation > Math.floor(bundle.approval.budget.usd * 1_000_000))
                 throw new HeldoutError('approval-call-budget');
-            const attempts = 1 + bundle.preregistration.providerFailurePolicy.maxRetries;
+            maximumAttempts += attempts;
             tokens += attempts * heldoutReservationTokens(bundle.preregistration, planned.estimatedTokens);
             usdMicros += attempts * reservation;
         }
-    const attempts = rows.reduce((n, r) => n + r.requests.length, 0) * (1 + bundle.preregistration.providerFailurePolicy.maxRetries);
     const a = bundle.approval;
-    return { calibration: structuredClone(a.calibration), rowsInScope: rows.map(row => row.id), providerCalls: 0, maximumAttempts: attempts, maximumRequestEstimateTokens, reservedTokens: tokens, reservedUsdMicros: usdMicros,
-        fitsBeforeStop: attempts <= Math.floor(a.budget.calls * 0.8) && tokens <= Math.floor(a.budget.tokens * 0.8)
+    return { calibration: structuredClone(a.calibration), rowsInScope: rows.map(row => row.id), providerCalls: 0, maximumAttempts, maximumRequestEstimateTokens, reservedTokens: tokens, reservedUsdMicros: usdMicros,
+        fitsBeforeStop: maximumAttempts <= Math.floor(a.budget.calls * 0.8) && tokens <= Math.floor(a.budget.tokens * 0.8)
             && usdMicros <= Math.floor(Math.min(a.budget.usd, HELDOUT_CAP_USD[a.study] - a.priorStudySpendUsd, HELDOUT_PORTFOLIO_CAP_USD - a.priorPortfolioSpendUsd) * 800_000) };
 }
 /** An intentionally unapproved, unpriced form. Unknown attestations stay null, never fixture approvals. */

package/dist/src/decision/index.js

@@ -54,6 +54,7 @@ export * from './issue-triage/index.js';
 export * from './routing/index.js';
 export * from './interop.js';
 export * from './ask.js';
+export * from './ledger.js';
 export * from './jev-credentials.js';
 export { collectHeldoutStudy, scoreHeldoutStudy } from './heldout/collector.js';
 export { heldoutDigest, heldoutExecutionDigest, planHeldoutCollection, validateHeldoutBundle, heldoutRowsInScope } from './heldout/contract.js';

package/dist/src/decision/interop.js

@@ -38,7 +38,8 @@ const FORBIDDEN_CONTROL_FIELDS = new Set([
     'calibration', 'executor', 'backend', 'acceptance', 'artifactPin', 'actionAuthorization',
 ]);
 const SENSITIVE_LOG_KEY = /(?:raw|body|secret|token|credential|private|locator|state|authorization|password|key)/iu;
-const SENSITIVE_LOG_VALUE = /(?:bearer\s+\S+|secret|token|file:\/\/|\/home\/|private|[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,})/iu;
+const SENSITIVE_LOG_VALUE = /(?:bearer\s+\S+|secret|token|file:\/\/|\/home\/|private)/iu;
+const MAX_LOG_VALUE_LENGTH = 65_536;
 const SUPPORTED_DMN_ELEMENTS = new Set(['definitions', 'decision', 'informationRequirement', 'requiredDecision', 'decisionTable', 'input', 'inputExpression', 'output', 'rule', 'inputEntry', 'outputEntry', 'text']);
 export function decisionInteropDefaultBounds(overrides = {}) {
     return { ...DEFAULT_BOUNDS, ...overrides };
@@ -580,7 +581,11 @@ function sanitizeJson(value, path, redaction) {
                 redaction.removed.push(`${path}.${key}`);
                 continue;
             }
-            result[key] = sanitizeJson(child, `${path}.${key}`, redaction);
+            // Keep ordinary objects while preserving __proto__ as an own JSON data key.
+            Object.defineProperty(result, key, {
+                value: sanitizeJson(child, `${path}.${key}`, redaction),
+                enumerable: true, writable: true, configurable: true,
+            });
         }
         return result;
     }
@@ -595,10 +600,16 @@ function projectOpaInput(input, allowlist, redaction) {
     for (const pointer of allowlist) {
         if (!pointer.startsWith('/'))
             throw new DecisionInteropError('opa-input-projection', 'OPA input projection allowlist entries must be JSON Pointers');
+        const path = pointer.slice(1).split('/').map(part => part.replace(/~1/gu, '/').replace(/~0/gu, '~'));
+        // Only __proto__ is forbidden in pointers; constructor/prototype are valid data keys.
+        // Own-property traversal and data-property writes keep ordinary projection objects safe.
+        if (path.some(segment => segment === '__proto__')) {
+            throw new DecisionInteropError('opa-input-projection', 'OPA input projection cannot contain __proto__ segments');
+        }
         const resolved = resolveJsonPointer(input, pointer);
         if (!resolved.found)
             continue;
-        setProjectedValue(output, pointer.slice(1).split('/').map(part => part.replace(/~1/gu, '/').replace(/~0/gu, '~')), sanitizeJson(resolved.value, `$.input${pointer}`, redaction));
+        setProjectedValue(output, path, sanitizeJson(resolved.value, `$.input${pointer}`, redaction));
     }
     return output;
 }
@@ -606,17 +617,58 @@ function setProjectedValue(target, path, value) {
     let cursor = target;
     path.forEach((segment, index) => {
         if (index === path.length - 1) {
-            cursor[segment] = value;
+            Object.defineProperty(cursor, segment, {
+                value, enumerable: true, writable: true, configurable: true,
+            });
             return;
         }
-        const existing = cursor[segment];
-        if (!existing || typeof existing !== 'object' || Array.isArray(existing))
-            cursor[segment] = {};
+        const existing = Object.hasOwn(cursor, segment) ? cursor[segment] : undefined;
+        if (!existing || typeof existing !== 'object' || Array.isArray(existing)) {
+            Object.defineProperty(cursor, segment, {
+                value: {}, enumerable: true, writable: true, configurable: true,
+            });
+        }
         cursor = cursor[segment];
     });
 }
 function isSensitiveValue(value) {
-    return typeof value === 'string' && SENSITIVE_LOG_VALUE.test(value);
+    if (typeof value !== 'string')
+        return false;
+    // Redact oversized values in full so a sensitive suffix cannot escape inspection.
+    if (value.length > MAX_LOG_VALUE_LENGTH)
+        return true;
+    if (SENSITIVE_LOG_VALUE.test(value))
+        return true;
+    let localLength = 0;
+    let domainLength = -1;
+    let suffixLength = -1;
+    for (const character of value) {
+        const letter = /[A-Z]/iu.test(character);
+        if (character === '@') {
+            domainLength = localLength > 0 ? 0 : -1;
+            suffixLength = -1;
+        }
+        else if (domainLength >= 0) {
+            if (/[A-Z0-9.-]/iu.test(character)) {
+                if (character === '.')
+                    suffixLength = domainLength > 0 ? 0 : -1;
+                else if (letter && suffixLength >= 0) {
+                    suffixLength++;
+                    if (suffixLength >= 2)
+                        return true;
+                }
+                else
+                    suffixLength = -1;
+                domainLength++;
+            }
+            else {
+                domainLength = -1;
+                suffixLength = -1;
+            }
+        }
+        localLength = /[A-Z0-9._%+-]/iu.test(character) ? localLength + 1 : 0;
+    }
+    return false;
 }
 function assertUnique(values, label) {
     const seen = new Set();

package/dist/src/decision/jev-credentials.js

@@ -1,3 +1,4 @@
+import { resolveDecisionEnablement } from '../config/decision-config.js';
 import { constants } from 'node:fs';
 import { access, chmod, mkdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
 import os from 'node:os';
@@ -64,7 +65,8 @@ export async function lookupJevCredential(options = {}) {
     const forced = environment.AIWG_DECISION_ENABLED;
     const envToken = environment.JEV_API_KEY?.trim() || environment.AIWG_DECISION_JEV_API_KEY?.trim();
     const fileRecord = envToken && (forced === '0' || forced === '1') ? null : await readCredentialFile(options);
-    const enabled = forced === '0' ? false : forced === '1' ? true : fileRecord?.enabled === true;
+    const enablement = resolveDecisionEnablement(options);
+    const enabled = enablement.source === 'default' ? fileRecord?.enabled === true : enablement.enabled;
     if (envToken)
         return {
             source: 'env',
@@ -78,6 +80,18 @@ export async function lookupJevCredential(options = {}) {
         return null;
     return { source: 'file', token: fileRecord.token, region: fileRecord.region, ...(fileRecord.endpoint ? { endpoint: fileRecord.endpoint } : {}), enabled };
 }
+/** Offline metadata-only inspection. Never probes Jev and never returns credential bytes. */
+export async function inspectJevCredential(options = {}) {
+    try {
+        const credential = await lookupJevCredential(options);
+        if (!credential)
+            return { configured: false, enabled: false, source: 'none' };
+        return { configured: true, enabled: credential.enabled, source: credential.source };
+    }
+    catch {
+        return { configured: null, enabled: null, source: 'unknown' };
+    }
+}
 export async function resolveJevCredentialBytes(logicalRef, options = {}) {
     if (logicalRef !== JEV_CREDENTIAL_REF)
         throw new JevCredentialError('configuration');