@aiwg/cli 2026.10.3 → 2026.10.5

package/dist/src/decision/ask.js

@@ -1,8 +1,10 @@
+import { aggregateModalAnswers } from './ensemble/aggregate.js';
+import { readAiwgConfigCandidate } from '../config/aiwg-config.js';
 import { readFile } from 'node:fs/promises';
 import { JEV_ENDPOINT, JevDecisionAdapter } from './adapters/jev.js';
 import { evaluateDecisionRuleset } from './evaluate.js';
 import { artifactPin } from './validate.js';
-import { JEV_CREDENTIAL_REF, JEV_DEFAULT_REGION, lookupJevCredential, removeJevCredentialFile, resolveJevCredentialBytes, writeJevCredentialFile, } from './jev-credentials.js';
+import { JEV_CREDENTIAL_REF, JEV_DEFAULT_REGION, lookupJevCredential, removeJevCredentialFile, writeJevCredentialFile, } from './jev-credentials.js';
 const CONTEXT_LIMIT_BYTES = 32 * 1024;
 const MODEL = 'jev-latest';
 const PURPOSE = 'agent-bounded-decision';
@@ -39,9 +41,22 @@ export function validateDecisionAskInput(input) {
     if (!Number.isFinite(threshold) || threshold < 0 || threshold > 1) {
         usageError('invalid-threshold', '--threshold must be a probability from 0 to 1');
     }
+    for (const key of ['minAgreement', 'agreementConfidenceFloor']) {
+        const value = input[key];
+        if (value !== undefined && (typeof value !== 'number' || !Number.isFinite(value) || value < 0 || value > 1)) {
+            usageError('invalid-agreement-policy', `${key} must be a probability from 0 to 1`);
+        }
+    }
     const timeoutMs = input.timeoutMs ?? 15_000;
     if (!Number.isInteger(timeoutMs) || timeoutMs <= 0)
         usageError('invalid-timeout', '--timeout-ms must be a positive integer');
+    const passes = input.passes ?? DEFAULT_DECISION_PASSES;
+    const escalationPasses = input.escalationPasses ?? defaultEscalationPasses(passes);
+    if (!Number.isSafeInteger(passes) || passes <= 0)
+        usageError('invalid-passes', '--passes must be a positive safe integer');
+    if (!Number.isSafeInteger(escalationPasses) || escalationPasses < passes) {
+        usageError('invalid-escalation-passes', '--escalation-passes must be a positive safe integer >= passes');
+    }
     if (input.mode.kind === 'choices') {
         if (input.mode.choices.length < 2 || input.mode.choices.length > 255)
             usageError('invalid-choices', '--choices requires 2..255 ids');
@@ -239,66 +254,209 @@ function publicAnswer(mode, value, distribution) {
     }
     return typeof value === 'string' ? { answer: value } : { answer: null };
 }
+/** Product default: 5 passes, escalating to 10 when the first round is not decisive. */
+export const DEFAULT_DECISION_PASSES = 5;
+/** Escalation defaults to twice the initial pass count (5 -> 10, 10 -> 20). */
+export function defaultEscalationPasses(passes) {
+    return passes * 2;
+}
 export async function askDecision(input, options = {}) {
+    if (options.cwd) {
+        let config;
+        try {
+            config = await readAiwgConfigCandidate(options.cwd);
+        }
+        catch (error) {
+            usageError('invalid-config', error instanceof Error ? error.message : 'Invalid project config');
+        }
+        input = { ...input, passes: input.passes ?? config?.decision?.ask?.passes,
+            escalationPasses: input.escalationPasses ?? config?.decision?.ask?.escalation_passes,
+            minAgreement: input.minAgreement ?? config?.decision?.ask?.min_agreement,
+            agreementConfidenceFloor: input.agreementConfidenceFloor ?? config?.decision?.ask?.agreement_confidence_floor };
+    }
     validateDecisionAskInput(input);
     const started = options.now?.() ?? Date.now();
+    const wallStarted = Date.now();
+    const passesRequested = input.passes ?? DEFAULT_DECISION_PASSES;
+    const escalationPasses = input.escalationPasses ?? defaultEscalationPasses(passesRequested);
+    const threshold = input.threshold ?? 0.8;
+    const minAgreement = input.minAgreement;
+    const agreementConfidenceFloor = input.agreementConfidenceFloor ?? 0.55;
+    const timeoutMs = input.timeoutMs ?? 15_000;
+    const passes = [];
+    let escalated = false;
+    let earlyStop = null;
+    const labels = input.mode.kind === 'yes-no' ? ['false', 'true']
+        : input.mode.kind === 'choices' ? input.mode.choices.map(parseChoice).map(choice => choice.id)
+            : Array.from({ length: input.mode.high - input.mode.low + 1 }, (_, index) => String(input.mode.kind === 'scale' ? input.mode.low + index : index));
+    const aggregate = () => {
+        const successful = passes.filter(pass => pass.status === 'succeeded');
+        const modal = aggregateModalAnswers(labels, successful.map(pass => String(pass.answer)));
+        const confidences = successful.flatMap(pass => pass.confidence === null ? [] : [pass.confidence]);
+        return {
+            algorithm: 'majority-v1', semantics: 'stability-signal-not-correctness',
+            passesRequested, escalationPasses, passesRun: passes.length, escalated, earlyStop,
+            minAgreement: minAgreement ?? null, agreementConfidenceFloor,
+            // Failed/abstaining passes have no vote but remain in the denominator.
+            agreementRatio: passes.length ? Math.max(0, ...Object.values(modal.votes)) / passes.length : 0,
+            votes: modal.votes,
+            answer: modal.value === null ? null : input.mode.kind === 'yes-no' ? modal.value === 'true'
+                : input.mode.kind === 'scale' ? Number(modal.value) : modal.value,
+            confidenceSummary: { count: confidences.length, missing: passes.length - confidences.length,
+                mean: confidences.length ? confidences.reduce((sum, value) => sum + value, 0) / confidences.length : null,
+                min: confidences.length ? Math.min(...confidences) : null, max: confidences.length ? Math.max(...confidences) : null },
+            passes: [...passes],
+        };
+    };
+    // Sampling agreement is stability evidence, not calibrated correctness.
+    // Confidence acceptance retains the original requirement that every pass succeeds.
+    const answeredBy = (summary) => {
+        const successful = passes.filter(pass => pass.status === 'succeeded');
+        if (successful.length < passesRequested || summary.answer === null)
+            return null;
+        const mean = summary.confidenceSummary.mean;
+        if (successful.length === passes.length && !summary.confidenceSummary.missing
+            && summary.agreementRatio >= threshold && mean !== null && mean >= threshold)
+            return 'confidence';
+        if (minAgreement !== undefined && summary.agreementRatio >= minAgreement
+            && summary.confidenceSummary.count === successful.length && mean !== null
+            && mean + Number.EPSILON >= agreementConfidenceFloor)
+            return 'agreement';
+        return null;
+    };
+    const problem = (summary) => {
+        if (answeredBy(summary))
+            return null;
+        const failed = passes.find(pass => pass.status !== 'succeeded');
+        if (failed)
+            return failed.reason;
+        if (summary.agreementRatio < threshold)
+            return 'low-agreement';
+        return 'low-confidence';
+    };
+    const finish = (forcedReason) => {
+        const summary = aggregate();
+        const reason = forcedReason ?? problem(summary);
+        const latencyMs = Math.max(0, (options.now?.() ?? Date.now()) - started);
+        const model = passes.map(pass => pass.model).filter(model => model !== null).at(-1) ?? null;
+        const totalTokens = (key) => {
+            const values = passes.flatMap(pass => pass.usage?.[key] == null ? [] : [pass.usage[key]]);
+            return values.length ? values.reduce((sum, value) => sum + value, 0) : null;
+        };
+        const combinedUsage = passes.some(pass => pass.usage !== null)
+            ? { inputTokens: totalTokens('inputTokens'), outputTokens: totalTokens('outputTokens') } : null;
+        const result = reason ? fallback(reason, latencyMs) : {
+            schema: 'aiwg-decision-ask/v1', status: 'answered', answer: summary.answer,
+            confidence: summary.agreementRatio * summary.confidenceSummary.mean, fallback: null, reason: 'none',
+            model, usage: combinedUsage, latencyMs,
+            ...(input.mode.kind === 'yes-no' ? { probability: passes.reduce((sum, pass) => sum + (pass.probability ?? 0), 0)
+                    / passes.filter(pass => pass.status === 'succeeded').length } : {}),
+        };
+        return { ...result, model, usage: combinedUsage, aggregate: summary, answeredBy: reason ? null : answeredBy(summary) };
+    };
     let credential;
     try {
         credential = await lookupJevCredential(options);
     }
     catch {
-        return fallback('not-configured', 0);
+        return finish('not-configured');
     }
     if (!credential?.enabled || !credential.token)
-        return fallback('not-configured', 0);
-    const timeoutMs = input.timeoutMs ?? 15_000;
+        return finish('not-configured');
     const def = definition(input);
     const rules = ruleset(def);
-    const bind = binding(rules, def.spec.answer.kind, timeoutMs);
     const adapter = options.adapter ?? options.createAdapter?.({ region: credential.region, endpoint: credential.endpoint })
         ?? new JevDecisionAdapter({ region: credential.region, ...(credential.endpoint ? {
-                endpoint: credential.endpoint,
-                allowedOrigins: [new URL(credential.endpoint).origin],
+                endpoint: credential.endpoint, allowedOrigins: [new URL(credential.endpoint).origin],
             } : {}) });
-    let result;
-    try {
-        result = await (options.evaluate ?? evaluateDecisionRuleset)({
-            ruleset: rules,
-            binding: bind,
-            definitions: { [def.metadata.id]: def },
-            input: { message: contextMessage(input) },
-            runId: options.runId ?? 'aiwg-decision-ask',
-            invocationId: options.invocationId ?? `ask-${Date.now()}`,
-            adapters: { jev: adapter },
-            resolveCredential: options.resolveCredential ?? (logicalRef => resolveJevCredentialBytes(logicalRef, options)),
-            projection: { resolve: () => projectionPolicy(credential.region, credential.endpoint) },
+    const controller = new AbortController();
+    const remainingMs = () => timeoutMs - (Date.now() - wallStarted);
+    const timer = setTimeout(() => controller.abort(), Math.max(0, remainingMs()));
+    const invocationId = options.invocationId ?? `ask-${Date.now()}`;
+    const runPass = async (index) => {
+        const passStarted = Date.now();
+        let removeListener = () => { };
+        const interrupted = new Promise((_resolve, reject) => {
+            const abort = () => reject(new Error('ask deadline'));
+            if (controller.signal.aborted)
+                abort();
+            else {
+                controller.signal.addEventListener('abort', abort, { once: true });
+                removeListener = () => controller.signal.removeEventListener('abort', abort);
+            }
         });
+        try {
+            const result = await Promise.race([interrupted, (options.evaluate ?? evaluateDecisionRuleset)({
+                    ruleset: rules, binding: binding(rules, def.spec.answer.kind, Math.max(1, remainingMs())),
+                    definitions: { [def.metadata.id]: def }, input: { message: contextMessage(input) },
+                    runId: options.runId ?? 'aiwg-decision-ask', invocationId: `${invocationId}-pass-${index}`,
+                    signal: controller.signal, adapters: { jev: adapter },
+                    resolveCredential: options.resolveCredential ?? (() => Promise.resolve(new TextEncoder().encode(credential.token))),
+                    projection: { resolve: () => projectionPolicy(credential.region, credential.endpoint) },
+                })]);
+            const evaluation = result.spec.evaluations.answer;
+            const attempt = evaluation?.spec.attempts.at(-1);
+            const succeeded = evaluation?.spec.status === 'success';
+            return { index, status: succeeded ? 'succeeded' : evaluation?.spec.status === 'abstained' ? 'abstained' : 'failed',
+                reason: succeeded ? 'none' : evaluation?.spec.reason ?? result.spec.reason,
+                ...(succeeded ? publicAnswer(input.mode, evaluation.spec.value, evaluation.spec.uncertainty?.distribution) : { answer: null }),
+                confidence: succeeded ? confidenceFor(input.mode, evaluation) : null,
+                model: attempt?.actualModel ?? null, usage: usage(attempt?.usage), latencyMs: Date.now() - passStarted };
+        }
+        catch {
+            return { index, status: 'failed', reason: controller.signal.aborted ? 'timeout' : 'jev-error', answer: null,
+                confidence: null, model: null, usage: null, latencyMs: Date.now() - passStarted };
+        }
+        finally {
+            removeListener();
+        }
+    };
+    const certainFailure = (total) => {
+        const summary = aggregate();
+        const remaining = total - passes.length;
+        const bestVotes = Math.max(0, ...Object.values(summary.votes));
+        const successful = passes.filter(pass => pass.status === 'succeeded');
+        const confidenceSum = successful.reduce((sum, pass) => sum + (pass.confidence ?? 0), 0);
+        // Give every unspent pass a matching vote and perfect confidence. Stop only
+        // when even that best case cannot answer, allowing roundoff at the boundary.
+        const bestAgreement = (bestVotes + remaining) / total;
+        const knownConfidence = successful.every(pass => pass.confidence !== null);
+        const confidenceReachable = successful.length === passes.length && knownConfidence
+            && bestAgreement + 1e-12 >= threshold && (confidenceSum + remaining) / total + 1e-12 >= threshold;
+        const agreementReachable = minAgreement !== undefined && knownConfidence
+            && successful.length + remaining >= passesRequested
+            && bestAgreement + 1e-12 >= minAgreement
+            && (confidenceSum + remaining) / (successful.length + remaining) + 1e-12 >= agreementConfidenceFloor;
+        return !confidenceReachable && !agreementReachable;
+    };
+    try {
+        let target = passesRequested;
+        while (passes.length < target) {
+            if (controller.signal.aborted || remainingMs() <= 0) {
+                earlyStop = 'timeout';
+                return finish('timeout');
+            }
+            const offset = passes.length;
+            if (offset >= passesRequested)
+                escalated = true;
+            passes.push(...await Promise.all(Array.from({ length: Math.min(4, target - offset) }, (_, index) => runPass(offset + index))));
+            if (controller.signal.aborted || remainingMs() <= 0) {
+                earlyStop = 'timeout';
+                return finish('timeout');
+            }
+            if (passes.length >= passesRequested && problem(aggregate()) && escalationPasses > passesRequested) {
+                target = escalationPasses;
+            }
+            if (passes.length < target && (passes.length >= passesRequested || certainFailure(passesRequested)) && certainFailure(escalationPasses)) {
+                earlyStop = 'certain-failure';
+                return finish();
+            }
+        }
+        return finish();
     }
-    catch {
-        return fallback('jev-error', Math.max(0, (options.now?.() ?? Date.now()) - started));
+    finally {
+        clearTimeout(timer);
     }
-    const latencyMs = Math.max(0, (options.now?.() ?? Date.now()) - started);
-    const evaluation = result.spec.evaluations.answer;
-    const attempt = evaluation?.spec.attempts.at(-1);
-    if (!evaluation || evaluation.spec.status !== 'success')
-        return fallback(evaluation?.spec.reason ?? result.spec.reason, latencyMs, attempt);
-    const confidence = confidenceFor(input.mode, evaluation);
-    const threshold = input.threshold ?? 0.8;
-    if (confidence === null || confidence < threshold)
-        return fallback('low-confidence', latencyMs, attempt);
-    const answer = publicAnswer(input.mode, evaluation.spec.value, evaluation.spec.uncertainty?.distribution);
-    return {
-        schema: 'aiwg-decision-ask/v1',
-        status: 'answered',
-        answer: answer.answer,
-        confidence,
-        ...(answer.probability === undefined ? {} : { probability: answer.probability }),
-        fallback: null,
-        reason: 'none',
-        model: attempt?.actualModel ?? null,
-        usage: usage(attempt?.usage),
-        latencyMs,
-    };
 }
 export async function readDecisionContextFile(filePath) {
     const content = await readFile(filePath, 'utf8');
@@ -342,6 +500,8 @@ export async function setupJev(input = {}, options = {}) {
             mode: { kind: 'yes-no' },
             threshold: 0,
             timeoutMs: 15_000,
+            passes: 1,
+            escalationPasses: 1,
         }, options);
         result.verified = verified.status === 'answered';
         result.model = verified.model;

package/dist/src/decision/context-live-qualification.js

@@ -223,7 +223,7 @@ export function validateContextLiveApproval(approval, corpus) {
         throw new Error('TV-12 collection margin is below the preregistered maximum');
 }
 export async function assertContextLiveSource(root, expected) {
-    const git = (...args) => execFileSync('git', args, { cwd: root, encoding: 'utf8', timeout: 10_000 }).trim();
+    const git = (...args) => execFileSync('git', args, { cwd: root, encoding: 'utf8', timeout: 10_000, killSignal: 'SIGKILL' }).trim();
     if (git('rev-parse', 'HEAD') !== expected || git('status', '--porcelain', '--untracked-files=all'))
         throw new Error('TV-12 requires clean exact source commit');
 }
@@ -452,7 +452,7 @@ export async function collectContextLiveCase(item, corpus, approval, host, budge
 }
 /** `exact` (run evidence) requires the canonical root itself; `within` (prepared inputs) allows a descendant. */
 export async function assertContextArtifactRoot(sourceRoot, artifactRoot, mode = 'exact') {
-    const route = JSON.parse(execFileSync('aiwg', ['artifacts', 'path', '--json', '--check-write'], { cwd: sourceRoot, encoding: 'utf8', timeout: 10_000 }));
+    const route = JSON.parse(execFileSync('aiwg', ['artifacts', 'path', '--json', '--check-write'], { cwd: sourceRoot, encoding: 'utf8', timeout: 10_000, killSignal: 'SIGKILL' }));
     if (typeof route.artifact_root !== 'string')
         throw new Error('Canonical artifact root unavailable');
     const delta = relative(await realpath(route.artifact_root), await realpath(artifactRoot));

package/dist/src/decision/driver.js

@@ -1,12 +1,15 @@
+import { resolveDecisionEnablement } from '../config/decision-config.js';
 import { existsSync } from 'node:fs';
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { askDecision, setupJev, DecisionAskUsageError, readDecisionContextFile, validateDecisionAskInput, } from './ask.js';
-import { recordDecisionAsk, decisionLedgerHistory, decisionLedgerStats, resolveDecisionSessionId, parseDecisionLedgerSince, DecisionLedgerSinceError, DECISION_LEDGER_SCHEMA, ATTRIBUTION_FIELD_PATTERN, MAX_ATTRIBUTION_FIELD_LENGTH, MAX_RECORDED_CHOICE_IDS, MAX_RECORD_TEXT_BYTES, MAX_LEDGER_RECORD_BYTES, DECISION_LEDGER_RECORD_TIMEOUT_MS, DECISION_SAVINGS_REASONING_ALLOWANCE_TOKENS, DECISION_SAVINGS_ESTIMATION_METHOD, buildDecisionLedgerRecord, appendDecisionLedgerRecord, filterDecisionLedgerRecords, } from './ledger.js';
+import { recordDecisionAsk, decisionLedgerHistory, decisionLedgerStats, resolveDecisionSessionId, resolveDecisionSession, DECISION_SESSION_ENV_VARS, parseDecisionLedgerSince, DecisionLedgerSinceError, DECISION_LEDGER_SCHEMA, DECISION_LEDGER_SCHEMA_V1, ATTRIBUTION_FIELD_PATTERN, MAX_ATTRIBUTION_FIELD_LENGTH, MAX_RECORDED_CHOICE_IDS, MAX_RECORD_TEXT_BYTES, MAX_LEDGER_RECORD_BYTES, DECISION_LEDGER_RECORD_TIMEOUT_MS, DECISION_SAVINGS_REASONING_ALLOWANCE_TOKENS, DECISION_SAVINGS_ESTIMATION_METHOD, buildDecisionLedgerRecord, appendDecisionLedgerRecord, filterDecisionLedgerRecords, } from './ledger.js';
+export { DEFAULT_DECISION_SAVINGS_WEIGHTS, decisionSavingsWeights } from './savings.js';
 import { resolveActiveProvider } from '../cli/provider-resolution.js';
+export { appendDecisionOpportunity, buildDecisionOffloadSnapshot, decisionOffloadCategory, DECISION_OFFLOAD_CHECKPOINT_COVERAGE, DECISION_OFFLOAD_EXECUTABLE_COVERAGE, DECISION_OFFLOAD_SNAPSHOT_SCHEMA, DECISION_OPPORTUNITY_SCHEMA, runDecisionOffloadCheckpoint, } from './offload.js';
 import { assertDecisionEvaluateDispatcherConfig, decisionPatternPacks, getDecisionPatternPack, governedPatternArtifacts, listDecisionPatterns, patternInputSchema, patternOutputSchema, planLiveDecisionPattern, runOfflineDecisionPattern, validateAgainstSchema, validateDecisionDocument, validateDefinition, validateRuleset, } from './index.js';
-export { askDecision, setupJev, readDecisionContextFile, validateDecisionAskInput, DecisionAskUsageError, recordDecisionAsk, decisionLedgerHistory, decisionLedgerStats, resolveDecisionSessionId, parseDecisionLedgerSince, DecisionLedgerSinceError, DECISION_LEDGER_SCHEMA, ATTRIBUTION_FIELD_PATTERN, MAX_ATTRIBUTION_FIELD_LENGTH, MAX_RECORDED_CHOICE_IDS, MAX_RECORD_TEXT_BYTES, MAX_LEDGER_RECORD_BYTES, DECISION_LEDGER_RECORD_TIMEOUT_MS, DECISION_SAVINGS_REASONING_ALLOWANCE_TOKENS, DECISION_SAVINGS_ESTIMATION_METHOD, buildDecisionLedgerRecord, appendDecisionLedgerRecord, filterDecisionLedgerRecords, resolveActiveProvider, };
+export { askDecision, setupJev, readDecisionContextFile, validateDecisionAskInput, DecisionAskUsageError, recordDecisionAsk, decisionLedgerHistory, decisionLedgerStats, resolveDecisionSessionId, resolveDecisionSession, DECISION_SESSION_ENV_VARS, parseDecisionLedgerSince, DecisionLedgerSinceError, DECISION_LEDGER_SCHEMA, DECISION_LEDGER_SCHEMA_V1, ATTRIBUTION_FIELD_PATTERN, MAX_ATTRIBUTION_FIELD_LENGTH, MAX_RECORDED_CHOICE_IDS, MAX_RECORD_TEXT_BYTES, MAX_LEDGER_RECORD_BYTES, DECISION_LEDGER_RECORD_TIMEOUT_MS, DECISION_SAVINGS_REASONING_ALLOWANCE_TOKENS, DECISION_SAVINGS_ESTIMATION_METHOD, buildDecisionLedgerRecord, appendDecisionLedgerRecord, filterDecisionLedgerRecords, resolveActiveProvider, };
 const DECISION_ROOT = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
 const VALIDATION_TARGETS = ['request', 'definition', 'ruleset', 'binding'];
 const OFFLINE_ADAPTER = 'agentic/code/addons/decision-engine/examples/fixture-jev-adapter.mjs';
@@ -224,9 +227,11 @@ export function decisionCapabilities(options = {}) {
     const env = driverEnv(options);
     const profiles = parseMcpRequestProfiles(env.AIWG_DECISION_MCP_REQUESTS, options.cwd ?? process.cwd());
     const packs = decisionPatternPacks;
+    const enablement = resolveDecisionEnablement(options);
     return {
         schema: 'aiwg-decision-driver-capabilities/v1',
-        enabled: env.AIWG_DECISION_ENABLED === '1',
+        enabled: enablement.enabled,
+        enabledSource: enablement.source,
         offlineReady: true,
         primitives: [...new Set(packs.map(pack => pack.primitive))].sort(),
         patterns: {
@@ -238,19 +243,19 @@ export function decisionCapabilities(options = {}) {
         features: {
             patterns: ['list', 'show', 'offline-run', 'live-plan'],
             validation: [...VALIDATION_TARGETS],
-            evaluate: { requiresEnv: 'AIWG_DECISION_ENABLED=1', mcpRequiresOptIn: true, mcpProfiles: profiles.map(profile => profile.name) },
+            evaluate: { requiresEnablement: true, mcpRequiresOptIn: true, mcpProfiles: profiles.map(profile => profile.name) },
             setup: ['synthetic-classification'],
             experimental: packs.filter(pack => pack.status === 'experimental').map(pack => pack.id),
         },
         backend: {
-            configured: env.AIWG_DECISION_ENABLED === '1',
+            configured: enablement.enabled,
             probed: false,
             status: 'not-probed',
             note: 'Capabilities do not infer credential, network, dispatcher, or backend readiness.',
         },
         configuration: {
             env: {
-                AIWG_DECISION_ENABLED: env.AIWG_DECISION_ENABLED === '1' ? 'set' : 'unset',
+                AIWG_DECISION_ENABLED: ['0', '1'].includes(env.AIWG_DECISION_ENABLED ?? '') ? 'set' : 'unset',
                 AIWG_DECISION_MCP_REQUESTS: profiles.length ? 'configured' : 'unset',
             },
         },
@@ -323,7 +328,7 @@ export async function validateDecisionInput(target, filePath, options = {}) {
 export async function evaluateRequestPath(requestPath, options = {}, evaluateOptions = {}) {
     const env = driverEnv(options);
     const resolved = resolvePath(requestPath, options.cwd ?? process.cwd());
-    if (env.AIWG_DECISION_ENABLED !== '1') {
+    if (!resolveDecisionEnablement(options).enabled) {
         return { schema: 'aiwg-decision-evaluate/v1', status: 'denied', reason: 'explicit-enable-required', exitCode: 2, result: null };
     }
     const validation = await validateDecisionInput('request', resolved, options);
@@ -338,7 +343,7 @@ export async function evaluateRequestPath(requestPath, options = {}, evaluateOpt
         argv.push('--host-policy-module', resolvePath(evaluateOptions.hostPolicyModulePath, options.cwd ?? process.cwd()));
     const exitCode = await dispatcher.runDecisionEvaluate({
         argv,
-        env,
+        env: { ...env, AIWG_DECISION_ENABLED: '1' },
         runtime,
         stdout: { write(chunk) { stdout += String(chunk); return true; } },
         stderr: { write(chunk) { stderr += String(chunk); return true; } },

package/dist/src/decision/ensemble/aggregate.js

@@ -1,5 +1,19 @@
 import { admitEntry } from '../entry.js';
 import { compareEnsembleKeys, ensembleContractDigest, EnsembleContractError, validateEnsemblePolicy, } from './contract.js';
+/** Modal buckets, with the existing locale-independent canonical tie break. */
+export function aggregateModalAnswers(labels, answers) {
+    const ordered = [...labels].sort(compareEnsembleKeys);
+    const votes = Object.fromEntries(ordered.map(label => [label, 0]));
+    for (const answer of answers) {
+        if (!Object.hasOwn(votes, answer))
+            throw new EnsembleContractError('unknown modal answer', 'semantic');
+        votes[answer] += 1;
+    }
+    const top = Math.max(0, ...Object.values(votes));
+    const winners = ordered.filter(label => votes[label] === top);
+    return { value: answers.length ? winners[0] : null, votes, tie: winners.length > 1,
+        agreementRatio: answers.length ? top / answers.length : 0 };
+}
 /** Deterministic reference aggregation over already-recorded member results. It never dispatches.
  * Member order does not matter: results are put in canonical (memberId, sampleIndex) order first,
  * so every sum and tie-break runs in the same sequence for any permutation of the input. */
@@ -24,12 +38,8 @@ export function aggregateEnsembleResults(policyInput, resultsInput, options = {}
     const { metric } = policy.disagreement;
     let candidate = null;
     let tie = false;
-    const votes = () => {
-        const counts = Object.fromEntries(labels.map(label => [label, 0]));
-        for (const result of succeeded)
-            counts[vote(policy, result)] += 1;
-        return counts;
-    };
+    const modal = policy.primitive === 'ordinal-score' ? null
+        : aggregateModalAnswers(labels, succeeded.map(result => vote(policy, result)));
     const distributions = () => succeeded.map(result => distributionOf(policy, labels, result));
     const meanOf = (items) => Object.fromEntries(labels.map(label => [label, n ? round(items.reduce((sum, item) => sum + item[label], 0) / n) : 0]));
     const scores = () => succeeded.map(result => result.value);
@@ -40,7 +50,7 @@ export function aggregateEnsembleResults(policyInput, resultsInput, options = {}
         return n ? winners[0] : null;
     };
     if (algorithm === 'majority-v1' || metric === 'vote-share-v1' || metric === 'normalized-entropy-v1')
-        statistics.votes = votes();
+        statistics.votes = modal.votes;
     if (policy.primitive === 'truth-probability' && (algorithm === 'mean-probability-v1' || metric === 'jensen-shannon-v1')) {
         statistics.meanProbability = n ? round(succeeded.reduce((sum, result) => sum + result.value, 0) / n) : null;
     }
@@ -55,8 +65,10 @@ export function aggregateEnsembleResults(policyInput, resultsInput, options = {}
         const middle = Math.floor(n / 2);
         statistics.medianScore = round(n % 2 ? sorted[middle] : (sorted[middle - 1] + sorted[middle]) / 2);
     }
-    if (algorithm === 'majority-v1')
-        candidate = pick(statistics.votes);
+    if (algorithm === 'majority-v1') {
+        candidate = modal.value;
+        tie = modal.tie;
+    }
     else if (algorithm === 'mean-probability-v1')
         candidate = policy.primitive === 'choice' ? pick(statistics.meanDistribution) : statistics.meanProbability;
     else if (algorithm === 'score-distribution-mean-v1')
@@ -68,7 +80,8 @@ export function aggregateEnsembleResults(policyInput, resultsInput, options = {}
         tie = n % 2 === 0 && sorted[middle - 1] !== sorted[middle];
         candidate = tie ? sorted[middle - 1] : statistics.medianScore;
     }
-    const disagreementValue = n === 0 ? 1 : disagreement(policy, statistics, distributions, n);
+    const disagreementValue = n === 0 ? 1 : metric === 'vote-share-v1' ? 1 - modal.agreementRatio
+        : disagreement(policy, statistics, distributions, n);
     const valueBps = Math.round(Math.min(1, Math.max(0, disagreementValue)) * 10_000);
     const exceeded = valueBps > policy.disagreement.thresholdBps;
     let disposition = 'accept';

package/dist/src/decision/ensemble-study/multifact-study.js

@@ -249,9 +249,13 @@ function dispatchOrder(rows, seed) {
     return [...development, ...test];
 }
 export function prepareD17MultifactStudy(seed, moduleDigest, sourceDigests) {
-    if (!/^[a-z0-9][a-z0-9-]{0,31}$/.test(seed) || !/^sha256:[a-f0-9]{64}$/.test(moduleDigest)
+    if (typeof seed === 'string' && seed.length > 32)
+        refuse('seed-too-long');
+    if (typeof seed !== 'string' || !/^[a-z0-9][a-z0-9-]{0,31}$/.test(seed))
+        refuse('seed-invalid');
+    if (!/^sha256:[a-f0-9]{64}$/.test(moduleDigest)
         || !Object.keys(sourceDigests).length || Object.values(sourceDigests).some(v => !/^sha256:[a-f0-9]{64}$/.test(v)))
-        throw new Error('D17-MF source or seed pins');
+        refuse('source-pin-mismatch');
     const generated = [];
     const gold = { schemaVersion: 'decision-d17mf-gold/v1', labels: {}, worlds: {} };
     for (let index = 0; index < D17MF_ROWS; index++) {

package/dist/src/decision/entry.js

@@ -17,10 +17,7 @@ export class EntryAdmissionError extends Error {
     }
 }
 /**
- * Starts an admission-budget clock, feature-detecting
- * `process.threadCpuUsage()` once for this reading. `elapsedAdmissionMs`
- * below reads the *type* of what this returns rather than re-detecting the
- * feature, so one admission check always uses one clock end to end.
+ * Starts an admission-budget clock using per-thread CPU time.
  *
  * Per-thread CPU time measures only the work the admitting call itself did
  * on this thread, so it is immune both to host scheduling contention
@@ -29,22 +26,12 @@ export class EntryAdmissionError extends Error {
  * other threads' or background GC's CPU time landing on this same process
  * (which a process-wide `process.cpuUsage()` clock would still charge here
  * -- not a safe substitute for the same reason `performance.now()` was not).
- *
- * `process.threadCpuUsage()` was added in Node v22.19.0 (per the installed
- * `@types/node` `@since` annotation) and is absent on this project's
- * `engines.node` floor (`>=20.0.0` in package.json) and on Node
- * 22.0.0-22.18.x. On a runtime without it, this falls back to the
- * pre-#3047 monotonic wall-clock guard as an explicitly documented
- * compatibility fallback: it restores the original host-load sensitivity on
- * those older runtimes, it does not resolve it there.
  */
 export function admissionClockStart() {
-    return typeof process.threadCpuUsage === 'function' ? process.threadCpuUsage() : performance.now();
+    return process.threadCpuUsage();
 }
 /** Elapsed time since `start` (from `admissionClockStart`), in milliseconds. */
 export function elapsedAdmissionMs(start) {
-    if (typeof start === 'number')
-        return performance.now() - start;
     const diff = process.threadCpuUsage(start);
     return (diff.user + diff.system) / 1000;
 }

package/dist/src/decision/graph-live-qualification.js

@@ -796,7 +796,7 @@ export async function dagLivePriorSpend(artifactRoot) {
 export async function assertDagLiveArtifactRoot(sourceRoot, artifactRoot) {
     let route;
     try {
-        route = JSON.parse(execFileSync('aiwg', ['artifacts', 'path', '--json', '--check-write'], { cwd: sourceRoot, encoding: 'utf8', timeout: 30_000 }));
+        route = JSON.parse(execFileSync('aiwg', ['artifacts', 'path', '--json', '--check-write'], { cwd: sourceRoot, encoding: 'utf8', timeout: 30_000, killSignal: 'SIGKILL' }));
     }
     catch {
         throw new Error('D12 requires the canonical artifact root');

package/dist/src/decision/graph-run.js

@@ -99,6 +99,15 @@ export function finalizeDecisionGraphRun(graph, plan, report, records, ceilings
         report.realizedResources.nodeRuns !== flowRecords.length + approvedGates ||
         report.realizedResources.tokens !== flowRecords.reduce((sum, item) => sum + item.response.usage.tokens, 0) ||
         Math.abs(report.realizedResources.costUsd - flowRecords.reduce((sum, item) => sum + item.response.usage.costUsd, 0)) > 1e-9) {
+        // Admission or settlement can reject (for example after a wall-clock deadline)
+        // before the adapter emits an observation. Flow retains that failure in its
+        // trace; surface the cause instead of misdiagnosing it as lost evidence.
+        // Still reject the run: an unobserved invocation cannot produce a receipt.
+        const failure = report.status === 'failed' && report.trace.find(event => event.type === 'node-attempt-failed' && event.nodeId && !observed.has(event.nodeId) &&
+            graph.nodes.some(node => node.id === event.nodeId) &&
+            report.checkpoint.failed?.includes(event.nodeId) && typeof event.message === 'string');
+        if (failure)
+            throw new DecisionGraphError(`Flow graph node '${failure.nodeId}' failed before observation: ${failure.message}`);
         throw new DecisionGraphError('missing Flow graph observation');
     }
     const candidates = graph.terminals.filter(id => observed.get(id)?.status === 'ok');

package/dist/src/decision/heldout/collector.js

@@ -10,7 +10,7 @@ import { QUALIFICATION_PRIVACY_SURFACES, scanQualificationPrivacy } from '../qua
 import { executeQualificationPlan, verifyQualificationArtifacts, writeQualificationEvidenceManifest } from '../qualification/runner.js';
 import { qualificationIntegrityAllowlistProblems } from '../qualification/release.js';
 import { redactText } from '../../governance/redaction.js';
-import { heldoutDigest, heldoutRequest, heldoutReservationMicros, heldoutReservationTokens, HeldoutError, HELDOUT_ENV_GATE, heldoutRowsInScope, planHeldoutCollection, validateHeldoutBundle } from './contract.js';
+import { heldoutDigest, heldoutRequest, heldoutReservationMicros, heldoutReservationTokens, HeldoutError, HELDOUT_ENV_GATE, heldoutRowsInScope, heldoutResumeAttempts, heldoutPendingRequests, planHeldoutCollection, validateHeldoutBundle } from './contract.js';
 import { appendHeldoutSpend, appendHeldoutEvent, heldoutDirectory, heldoutEvidenceDigest, heldoutRunsRoot, readHeldoutFile, readHeldoutJournal, reconcileHeldoutBaseline, scanHeldoutSpend, writeHeldoutFile, validateHeldoutJournal, heldoutCollectionAllowance } from './journal.js';
 import { readHeldoutFrozen, sealHeldoutCalibrationPhase, validateHeldoutPhaseAccess } from './calibration.js';
 import { D17_MULTIFACT_CALIBRATION_NOT_AFTER, usesD17MultifactGenerator } from './study-generators.js';
@@ -70,13 +70,7 @@ export async function collectHeldoutStudy(options) {
             throw new HeldoutError('prior-stop');
         if (!offline && prior.runs.some(run => run.corpusDigest === a.corpusDigest && run.source === 'injected-transport'))
             throw new HeldoutError('injected-prior');
-        const old = prior.attempts.filter(attempt => attempt.study === a.study && attempt.corpusDigest === a.corpusDigest);
-        if (old.some(attempt => attempt.preregistrationDigest !== a.preregistrationDigest))
-            throw new HeldoutError('changed-preregistration');
-        const latest = new Map();
-        for (const attempt of old)
-            if (attempt.ordinal >= (latest.get(key(attempt))?.ordinal ?? 0))
-                latest.set(key(attempt), attempt);
+        const { old, latest } = heldoutResumeAttempts(bundle, prior.attempts);
         const now = options.now ?? Date.now, sleep = options.sleep ?? delay, started = now();
         // D17-MF (#2850) is scored only through the registered D17 member calibrator: a session whose whole dispatch window
         // (start plus the preregistered session limit) does not end before the calibrator expires never starts. A seed
@@ -127,20 +121,18 @@ export async function collectHeldoutStudy(options) {
             }
             if (failed.has(row.id) || overSlice(row.slice, row.split))
                 continue;
-            const remaining = row.requests.filter(request => latest.get(`${row.id}/${request.id}`)?.result?.disposition !== 'success');
+            const remaining = heldoutPendingRequests(row, plan, latest);
             if (!remaining.length)
                 continue;
             // Checkpoint before a subject/paired arms: enough time for every bounded attempt and interval.
-            const pairBound = remaining.length * (1 + plan.providerFailurePolicy.maxRetries) * (plan.requestTimeoutMs + plan.minDispatchIntervalMs);
+            const pairBound = remaining.reduce((n, request) => n + request.attempts, 0) * (plan.requestTimeoutMs + plan.minDispatchIntervalMs);
             if (now() - started + pairBound > plan.sessionLimitMs * 0.8) {
                 checkpoint = true;
                 break;
             }
-            for (const request of remaining) {
+            for (const { request, first } of remaining) {
                 if (reason || failed.has(row.id))
                     break;
-                const previous = latest.get(`${row.id}/${request.id}`);
-                const first = previous ? previous.ordinal + 1 : 1;
                 for (let ordinal = first; ordinal <= 1 + plan.providerFailurePolicy.maxRetries; ordinal++) {
                     if (options.signal?.aborted) {
                         reason = 'cancelled';