@aiwg/cli 2026.10.5 → 2026.10.7

package/dist/src/decision/qualification/load.js

@@ -1,6 +1,8 @@
 import { createHash } from 'node:crypto';
 import { canonicalJson } from '../../security/artifact-trust.js';
 import { AdmissionError, DecisionAdmissionRegistry } from '../admission.js';
+import { verifyDecisionStagedLoadRecord } from './load-staged.js';
+export * from './load-staged.js';
 export function decisionLoadManifestDigest(bytes) {
     return `sha256:${createHash('sha256').update(bytes).digest('hex')}`;
 }
@@ -56,7 +58,7 @@ export function decisionLoadPolicy(manifest, workspaceId, principalId) {
     };
 }
 /** Drives each arrival straight through a registry-owned `DecisionAdmissionController`. */
-export function admissionControllerLoadDriver(manifest, clock, registry = new DecisionAdmissionRegistry()) {
+export function admissionControllerLoadDriver(manifest, clock, registry = new DecisionAdmissionRegistry(), hooks = {}) {
     const workspaceId = 'load-harness';
     for (const principal of manifest.principals)
         registry.register(decisionLoadPolicy(manifest, workspaceId, principal.id), clock.now);
@@ -68,32 +70,81 @@ export function admissionControllerLoadDriver(manifest, clock, registry = new De
             attempts += 1;
             let lease;
             try {
-                lease = await controller.acquire({ budgetId: `load-${arrival.ordinal}`, principalId: arrival.principalId,
+                const pendingLease = controller.acquire({ budgetId: `load-${arrival.ordinal}`, principalId: arrival.principalId,
                     workspaceId, providerId: arrival.providerId, signal,
-                    estimate: { tokens: arrival.tokens, attempts: 1, batchSize: 1, items: 1, costUsd: 0, retainedWork: 1 },
+                    estimate: { tokens: arrival.tokens, attempts: 1, batchSize: 1, items: 1, costUsd: hooks.estimateCost?.(arrival) ?? 0, retainedWork: 1 },
                     deadlineEpochMs: clock.now() + manifest.workspace.maxQueueWaitMs + arrival.serviceMs });
+                hooks.onStateChange?.();
+                lease = await pendingLease;
             }
             catch (error) {
-                if (!(error instanceof AdmissionError))
+                if (!(error instanceof AdmissionError)) {
+                    hooks.onDriverError?.();
+                    controller.releaseBudget(`load-${arrival.ordinal}`);
                     throw error;
+                }
                 controller.releaseBudget(`load-${arrival.ordinal}`);
                 return { attempts, outcome: error.evidence.reason === 'cancelled' ? 'cancelled' : 'shed',
                     admissionReason: error.evidence.reason, queueDelaysMs, settledAtMs: clock.now() };
             }
-            queueDelaysMs.push(lease.evidence.queueDelayMs);
-            const dispatched = await context.dispatch(arrival.serviceMs, signal);
-            const failed = arrival.failsFirstAttempt && retry === 0;
-            lease.release({ success: dispatched === 'completed' && !failed });
-            if (dispatched === 'aborted') {
-                controller.releaseBudget(`load-${arrival.ordinal}`);
-                return { attempts, outcome: 'cancelled', queueDelaysMs, settledAtMs: clock.now() };
+            try {
+                queueDelaysMs.push(lease.evidence.queueDelayMs);
+                if (signal.aborted || hooks.beforeDispatch?.(arrival, retry + 1) === false) {
+                    lease.release();
+                    controller.releaseBudget(`load-${arrival.ordinal}`);
+                    return { attempts: retry, outcome: 'cancelled', queueDelaysMs, settledAtMs: clock.now() };
+                }
+                hooks.onAdmission?.(arrival, retry + 1, lease.evidence);
+                let observation;
+                let dispatched;
+                try {
+                    if (hooks.backend) {
+                        observation = await hooks.backend(arrival, signal, context, retry + 1);
+                        dispatched = signal.aborted ? 'aborted' : 'completed';
+                    }
+                    else
+                        dispatched = await context.dispatch(arrival.serviceMs, signal);
+                }
+                catch {
+                    observation = { status: 'error', reason: 'executor-unavailable', actualModel: null, uncertainty: null,
+                        requestId: null, usage: { inputTokens: null, outputTokens: null, costUsd: null } };
+                    dispatched = signal.aborted ? 'aborted' : 'completed';
+                }
+                const failed = observation ? observation.status !== 'success' : arrival.failsFirstAttempt && retry === 0;
+                lease.release({ success: dispatched === 'completed' && !failed, ...(observation?.retryAfterMs === undefined ? {} : { retryAfterMs: observation.retryAfterMs }) });
+                if (observation)
+                    hooks.onObservation?.(arrival, retry + 1, lease.evidence, observation);
+                if (dispatched === 'aborted') {
+                    controller.releaseBudget(`load-${arrival.ordinal}`);
+                    return { attempts, outcome: 'cancelled', queueDelaysMs, settledAtMs: clock.now() };
+                }
+                if (!failed) {
+                    controller.releaseBudget(`load-${arrival.ordinal}`);
+                    return { attempts, outcome: 'completed', queueDelaysMs, settledAtMs: clock.now() };
+                }
+                if (observation && !['service-error', 'rate-limited', 'network-transient', 'timeout'].includes(observation.reason))
+                    break;
+                if (signal.aborted)
+                    break;
+                if (retry < manifest.arrivalModel.maxRetries) {
+                    await new Promise(done => {
+                        const finish = () => { clearTimeout(timer); signal.removeEventListener('abort', finish); done(); };
+                        const timer = setTimeout(finish, manifest.arrivalModel.retryBackoffMs);
+                        if (signal.aborted)
+                            finish();
+                        else
+                            signal.addEventListener('abort', finish, { once: true });
+                    });
+                }
             }
-            if (!failed) {
+            catch (error) {
+                hooks.onDriverError?.();
                 controller.releaseBudget(`load-${arrival.ordinal}`);
-                return { attempts, outcome: 'completed', queueDelaysMs, settledAtMs: clock.now() };
+                throw error;
             }
-            if (retry < manifest.arrivalModel.maxRetries) {
-                await new Promise(done => setTimeout(done, manifest.arrivalModel.retryBackoffMs));
+            finally {
+                lease.release();
+                hooks.onStateChange?.();
             }
         }
         controller.releaseBudget(`load-${arrival.ordinal}`);
@@ -145,28 +196,56 @@ export async function runDecisionLoadHarness(options) {
                 signal.addEventListener('abort', aborted, { once: true });
         }),
     };
+    const advance = async (ms) => {
+        if (!options.signal) {
+            await clock.advance(ms);
+            return;
+        }
+        const end = clock.now() + ms;
+        while (clock.now() < end && !options.signal.aborted)
+            await clock.advance(Math.min(1000, end - clock.now()));
+    };
     const outcomes = [];
     for (const arrival of arrivals) {
+        if (options.signal?.aborted)
+            break;
         const due = start + arrival.atMs - clock.now();
         if (due > 0)
-            await clock.advance(due);
+            await advance(due);
+        if (options.signal?.aborted)
+            break;
         const controller = new AbortController();
         const cancellation = { abortedAtMs: null };
+        let cancellationTimer;
         if (arrival.cancelAtMs !== null) {
-            setTimeout(() => { cancellation.abortedAtMs = clock.now(); controller.abort(); }, arrival.cancelAtMs - arrival.atMs);
+            cancellationTimer = setTimeout(() => { cancellation.abortedAtMs = clock.now(); controller.abort(); }, arrival.cancelAtMs - arrival.atMs);
         }
-        outcomes.push(driver(arrival, controller.signal, context)
-            .then(result => ({ arrival, result, abortedAtMs: cancellation.abortedAtMs })));
+        const combined = options.signal ? AbortSignal.any([controller.signal, options.signal]) : controller.signal;
+        const pending = driver(arrival, combined, context)
+            .then(result => ({ arrival, result, abortedAtMs: cancellation.abortedAtMs }))
+            .finally(() => clearTimeout(cancellationTimer));
+        // Observe rejection immediately; allSettled below retains it for the caller.
+        void pending.catch(() => { });
+        outcomes.push(pending);
         observe();
         if (arrival.ordinal % 500 === 0)
             sampleMemory();
     }
     let settled = false;
-    const all = Promise.all(outcomes).then(values => { settled = true; return values; });
+    const all = Promise.allSettled(outcomes).then(values => { settled = true; return values; });
     const drainStep = manifest.arrivalModel.serviceTimeMs.maximum + manifest.arrivalModel.retryBackoffMs;
     while (!settled)
         await clock.advance(drainStep);
-    const results = await all;
+    const settledResults = await all;
+    const failure = settledResults.find(result => result.status === 'rejected');
+    if (failure?.status === 'rejected')
+        throw failure.reason;
+    const results = settledResults.map(result => result.value);
+    if (options.fullWindow && !options.signal?.aborted) {
+        const windowMs = (options.windowSeconds ?? manifest.duration.loadSeconds + manifest.duration.spikeSeconds + manifest.duration.soakSeconds) * 1000;
+        if (start + windowMs > clock.now())
+            await advance(start + windowMs - clock.now());
+    }
     sampleMemory();
     const threadUsage = process.threadCpuUsage(cpuStart);
     const cpuMicros = threadUsage.user + threadUsage.system;
@@ -205,10 +284,10 @@ export async function runDecisionLoadHarness(options) {
     const ratio = (value, total) => total ? Number((value / total).toFixed(6)) : 1;
     return {
         observations: {
-            arrivals: arrivals.length, attempts, completed, failed, shed, cancelled,
+            arrivals: results.length, attempts, completed, failed, shed, cancelled,
             shedReasons: Object.fromEntries(Object.entries(shedReasons).sort(([left], [right]) => left.localeCompare(right))),
             maximumActiveCalls: maximumActive, maximumQueuedCalls: maximumQueued, maximumEligibleLaneWaitMs: laneWait,
-            retryAmplificationRatio: ratio(attempts, arrivals.length), maximumCancellationLatencyMs: cancellationLatency,
+            retryAmplificationRatio: ratio(attempts, results.length), maximumCancellationLatencyMs: cancellationLatency,
             quietPrincipalAdmissionRatio: ratio(admitted.quiet, submitted.quiet),
             noisyPrincipalAdmissionRatio: ratio(admitted.noisy, submitted.noisy),
             virtualDurationMs,
@@ -262,19 +341,16 @@ export function verifyDecisionLoadResultRecord(record, manifestDigest) {
     return record.schema === 'decision-load-result/v1' && record.manifest.digest === manifestDigest
         && digest === decisionLoadManifestDigest(canonicalJson(body));
 }
-/**
- * G5 evidence flags. Offline fake-provider records can prove the harness and
- * the admission path, but only a passing staged-provider record bound to its
- * manifest may set `load-manifest-qualified`.
- */
-export function decisionLoadEvidenceFlags(records, manifestDigest) {
-    const bound = records.filter(record => verifyDecisionLoadResultRecord(record, manifestDigest));
+/** Historical offline evidence stays separate from verified, exact-commit v3 G5 artifacts. */
+export function decisionLoadEvidenceFlags(records, manifestDigest, sourceCommit) {
+    const legacy = records.filter((record) => 'schema' in record);
+    const bound = legacy.filter(record => verifyDecisionLoadResultRecord(record, manifestDigest));
     const offline = bound.filter(record => record.mode === 'offline-fake-provider');
     return {
-        'load-manifest-offline-passed': offline.length > 0 && offline.length === records.filter(record => record.mode === 'offline-fake-provider').length
+        'load-manifest-offline-passed': offline.length > 0 && offline.length === legacy.filter(record => record.mode === 'offline-fake-provider').length
             && offline.every(record => record.passed),
-        'load-manifest-qualified': bound.some(record => record.mode === 'staged-provider' && record.passed)
-            && bound.length === records.length && bound.every(record => record.passed),
+        'load-manifest-qualified': records.length > 0 && records.every(record => 'schemaVersion' in record
+            && record.manifestDigest === manifestDigest && verifyDecisionStagedLoadRecord(record, sourceCommit)),
     };
 }
 //# sourceMappingURL=load.js.map

package/dist/src/decision/qualification/runner.js

@@ -1,13 +1,15 @@
 import { createHash } from 'node:crypto';
 import { lstat, mkdir, readFile, rename, writeFile } from 'node:fs/promises';
 import { dirname, resolve, sep } from 'node:path';
+import { DECISION_STAGED_LOAD_RESULT_VERSIONS } from './load.js';
 import { evaluateQualification } from './gates.js';
 import { deriveGateEvidence, DERIVED_GATE_EVIDENCE, GATE_ARTIFACT_FLAGS, GATE_ARTIFACT_SCHEMAS, IMMUTABLE_SPLIT_VERSIONS, validateGateArtifact, } from './gate-evidence.js';
 import { scanQualificationPrivacy } from './privacy.js';
 /** Named master-test-plan suites plus the M01-M11 amendment IDs. */
 export const QUALIFICATION_EVIDENCE_ID = /^(?:CON|POL|BCH|CTX|CNC|CAN|RTY|REC|SEC|PRV|CAL|DRF|CCP|M(?:0[1-9]|1[01]))-[A-Z0-9][A-Z0-9._-]*$/;
 const DEFAULT_TIMEOUT_MS = 30_000;
-const DEFAULT_MAX_ARTIFACT_BYTES = 256 * 1024;
+// Full staged-load receipt history and fixed-interval samples exceed 256 KiB.
+const DEFAULT_MAX_ARTIFACT_BYTES = 1024 * 1024;
 const DEFAULT_CONCURRENCY = 4;
 function boundedInteger(value, fallback, minimum, maximum) {
     if (value === undefined)
@@ -232,7 +234,7 @@ async function attachGateArtifacts(plan, evidence, maxBytes) {
         const temporary = `${target}.${process.pid}.${Date.now()}.tmp`;
         await writeFile(temporary, bytes, { flag: 'wx', mode: 0o600 });
         await rename(temporary, target);
-        refs[flag] = { artifact: relative, digest: digest(bytes), schemaVersion: GATE_ARTIFACT_SCHEMAS[flag] };
+        refs[flag] = { artifact: relative, digest: digest(bytes), schemaVersion: parsed.schemaVersion };
         context.accepted[flag] = parsed;
     }
     return refs;
@@ -268,8 +270,11 @@ export async function verifyQualificationGateArtifacts(manifest, artifactRoot, m
         const parsed = parseJson(bytes);
         const versionOk = flag === 'immutable-splits'
             ? IMMUTABLE_SPLIT_VERSIONS.includes(ref.schemaVersion)
-            : ref.schemaVersion === GATE_ARTIFACT_SCHEMAS[flag];
-        if (!versionOk || !validateGateArtifact(flag, parsed, context)) {
+            : flag === 'load-manifest-qualified'
+                ? DECISION_STAGED_LOAD_RESULT_VERSIONS.includes(ref.schemaVersion)
+                : ref.schemaVersion === GATE_ARTIFACT_SCHEMAS[flag];
+        if (!versionOk || (flag === 'load-manifest-qualified' && parsed?.schemaVersion !== ref.schemaVersion)
+            || !validateGateArtifact(flag, parsed, context)) {
             results.push({ flag, verified: false, reason: 'invalid-artifact' });
             continue;
         }
@@ -401,7 +406,9 @@ export async function evaluateExecutedQualification(manifest, artifactRoot, maxA
         && verification.every(item => item.verified && caseIds.has(item.caseId))
         && gateVerification.every(item => item.verified);
     return { manifest, verification, gateVerification,
-        report: evaluateQualification(hardened, undefined, { artifactsVerified }) };
+        report: evaluateQualification(hardened, undefined, {
+            artifactsVerified, loadArtifactVerified: gateVerified.has('load-manifest-qualified'),
+        }) };
 }
 /** Executes, persists, verifies, and evaluates in one promotion-capable pipeline. */
 export async function executeAndEvaluateQualification(plan) {

package/dist/src/decision/review/service.js

@@ -1,4 +1,4 @@
-import { assertReviewProjection, currentProposal, ReviewAccessError, ReviewConflictError, reviewDigest, reviewOperatorEventId } from './validate.js';
+import { assertReviewProjection, currentProposal, ReviewAccessError, ReviewConflictError, reviewDigest, reviewOperatorEventId, validateReviewEvaluation } from './validate.js';
 import { validateDecisionLifecyclePolicy } from '../lifecycle.js';
 /** Only an executor that can attest zero external effect may report definitive failure. */
 export class ReviewDefinitiveExecutionError extends Error {
@@ -233,7 +233,8 @@ export class DecisionReviewService {
             return this.append(review, 'claimed', scope.actor, rationale, 'claimed');
         }, true);
     }
-    async decide(scope, id, decision, rationale) {
+    async decide(scope, id, decision, rationale, evaluation) {
+        const recordedEvaluation = evaluation === undefined ? {} : { evaluation: structuredClone(evaluation) };
         return this.mutate(scope, id, 'decide', async (review) => {
             this.requireActive(review);
             const proposal = currentProposal(review);
@@ -243,10 +244,11 @@ export class DecisionReviewService {
                 throw new ReviewAccessError('Self-approval is denied');
             if (review.decisions.some(item => item.reviewer.id === scope.actor.id && item.proposalVersion === proposal.version))
                 throw new ReviewConflictError('Reviewer already decided this proposal');
-            const decisions = [...review.decisions, { reviewer: scope.actor, proposalVersion: proposal.version, decision, rationale, atEpochMs: this.now() }];
+            validateReviewEvaluation(recordedEvaluation.evaluation);
+            const decisions = [...review.decisions, { reviewer: scope.actor, proposalVersion: proposal.version, decision, rationale, atEpochMs: this.now(), ...recordedEvaluation }];
             const approvals = decisions.filter(item => item.proposalVersion === proposal.version && item.decision === 'approve').length;
             const status = decision === 'reject' ? 'rejected' : approvals >= review.quorum ? 'approved' : 'claimed';
-            return this.append({ ...review, decisions }, decision === 'approve' ? 'approved' : 'rejected', scope.actor, rationale, status, { quorumSatisfied: approvals >= review.quorum });
+            return this.append({ ...review, decisions }, decision === 'approve' ? 'approved' : 'rejected', scope.actor, rationale, status, { quorumSatisfied: approvals >= review.quorum, ...recordedEvaluation });
         });
     }
     edit(scope, id, action, rationale, newResumeToken) {

package/dist/src/decision/review/validate.js

@@ -15,6 +15,22 @@ export function reviewOperatorEventId(reviewId, sequence) {
 const digestPattern = /^sha256:[a-f0-9]{64}$/;
 const restrictedKey = /(?:password|credential|api.?key|secret|private.?reasoning|provider.?body|raw.?state|vault.?locator)/i;
 const restrictedValue = /(?:vault:\/\/|\b(?:sk-(?:test-)?[a-z0-9_-]{12,}|ghp_[a-z0-9]{12,})\b)/i;
+/** Optional review evidence remains strict when present, including imported records. */
+export function validateReviewEvaluation(value) {
+    if (value === undefined)
+        return;
+    const object = (item) => typeof item === 'object' && item !== null && !Array.isArray(item);
+    const text = (item) => typeof item === 'string' && item.trim().length > 0 && item.length <= 8192;
+    const fields = ['evaluatorModel', 'evaluatorVendor', 'evaluatorFamily', 'acceptanceCriteriaRef', 'reReviewOf'];
+    if (!object(value) || Object.keys(value).some(key => key !== 'disagreements' && !fields.includes(key))
+        || fields.some(key => value[key] !== undefined && !text(value[key])))
+        throw new ReviewIntegrityError('Invalid review evaluation');
+    if (value.disagreements !== undefined && (!Array.isArray(value.disagreements) || value.disagreements.some(item => !object(item) || Object.keys(item).some(key => !['claimRef', 'generatorPosition', 'evaluatorPosition', 'resolutionRef'].includes(key))
+        || !text(item.claimRef) || !text(item.generatorPosition) || !text(item.evaluatorPosition)
+        || (item.resolutionRef !== undefined && !text(item.resolutionRef)))))
+        throw new ReviewIntegrityError('Invalid review disagreements');
+    assertReviewProjection(value);
+}
 /** Enforce reference-only default review payloads; do not echo rejected material. */
 export function assertReviewProjection(value) {
     if (typeof value === 'string') {
@@ -67,7 +83,11 @@ export function validateReview(review) {
         if (proposal.version !== index + 1 || proposal.actionDigest !== reviewDigest(proposal.action))
             throw new ReviewIntegrityError('Invalid proposal lineage');
     });
-    review.decisions.forEach(decision => { assertReviewProjection(decision.reviewer); assertReviewProjection(decision.rationale); });
+    review.decisions.forEach(decision => {
+        assertReviewProjection(decision.reviewer);
+        assertReviewProjection(decision.rationale);
+        validateReviewEvaluation(decision.evaluation);
+    });
     review.events.forEach(event => { assertReviewProjection(event.actor); assertReviewProjection(event.rationale); });
     if (review.effectReceipt)
         assertReviewProjection(review.effectReceipt.result);
@@ -108,7 +128,8 @@ export function validateReview(review) {
                         throw new ReviewIntegrityError('Illegal decision');
                     const decision = review.decisions[decisionIndex++];
                     if (!decision || decision.proposalVersion !== version || decision.decision !== (event.type === 'approved' ? 'approve' : 'reject') ||
-                        canonicalJson(decision.reviewer) !== canonicalJson(event.actor) || decision.rationale !== event.rationale || decision.atEpochMs !== event.atEpochMs) {
+                        canonicalJson(decision.reviewer) !== canonicalJson(event.actor) || decision.rationale !== event.rationale || decision.atEpochMs !== event.atEpochMs ||
+                        canonicalJson(decision.evaluation ?? null) !== canonicalJson(event.data?.evaluation ?? null)) {
                         throw new ReviewIntegrityError('Decision event mismatch');
                     }
                     if (event.type === 'rejected')

package/dist/src/decision/savings.js

@@ -16,13 +16,18 @@ export function decisionSavingsWeights(ask) {
         output_tokens: ask?.savings?.output_tokens ?? 128,
     };
 }
-export function estimateDecisionSavings(inputTokens, answered, jevTokens, weights) {
+export function estimateDecisionSavings(inputTokens, answered, jevTokens, weights, usage) {
     const llmTokens = answered ? inputTokens + weights.reasoning_tokens + weights.output_tokens : 0;
+    const split = weights.jev_input_per_mtok !== undefined && weights.jev_output_per_mtok !== undefined
+        && usage?.inputTokens != null && (usage.outputTokens != null || weights.jev_output_per_mtok === 0);
+    const jevCost = split
+        ? (usage.inputTokens * weights.jev_input_per_mtok + (usage.outputTokens ?? 0) * weights.jev_output_per_mtok) / 1_000_000
+        : jevTokens * weights.jev_per_mtok / 1_000_000;
     return {
         llm_tokens_avoided: llmTokens,
         jev_tokens: jevTokens,
-        cost_weighted_net_usd: (llmTokens * weights.llm_per_mtok - jevTokens * weights.jev_per_mtok) / 1_000_000,
-        estimationMethod: { version: 'aiwg-decision-savings/v2', input_tokens: inputTokens, ...weights },
+        cost_weighted_net_usd: llmTokens * weights.llm_per_mtok / 1_000_000 - jevCost,
+        estimationMethod: { version: 'aiwg-decision-savings/v2', input_tokens: inputTokens, ...weights, source: weights.source ?? 'manual', jev_rate_basis: split ? 'split' : 'blended' },
     };
 }
 //# sourceMappingURL=savings.js.map