@aiwg/cli 2026.10.5 → 2026.10.7

package/dist/src/writing/voice-evaluation.js

@@ -1,5 +1,6 @@
 import { createHash } from 'node:crypto';
 import { z } from 'zod';
+import { integer, dateTime } from '../schema/zod-validation.mjs';
 const id = z.string().min(1).max(120);
 const nonempty = z.string().min(1);
 const sha = z.string().regex(/^[a-f0-9]{64}$/);
@@ -10,18 +11,18 @@ export const EVALUATION_CONDITIONS = Array.from({ length: 8 }, (_, n) => ({
     rules: Boolean(n & 4), voiceDescription: Boolean(n & 2), exemplars: Boolean(n & 1),
 }));
 export const EVALUATION_DIMENSIONS = ['factual-fidelity', 'author-authenticity', 'reader-suitability', 'effort', 'within-author-preservation', 'between-author-diversity'];
-const model = z.object({ id, family: nonempty, provider: nonempty, snapshot: nonempty, decoding: z.record(z.string(), z.union([z.string(), z.number().finite(), z.boolean(), z.null()])), promptSha256: sha }).strict();
-const document = z.object({ id, authorId: id, topic: nonempty, split: z.enum(['development', 'enrollment', 'heldout']), text: nonempty, sha256: sha }).strict();
-export const evaluationManifestSchema = z.object({
+const model = z.strictObject({ id, family: nonempty, provider: nonempty, snapshot: nonempty, decoding: z.record(z.string(), z.union([z.string(), z.number().finite(), z.boolean(), z.null()])), promptSha256: sha });
+const document = z.strictObject({ id, authorId: id, topic: nonempty, split: z.enum(['development', 'enrollment', 'heldout']), text: nonempty, sha256: sha });
+export const evaluationManifestSchema = z.strictObject({
     schemaVersion: z.literal(1), id,
     developmentAuthorIds: z.array(id), finalAuthorIds: z.array(id), documents: z.array(document),
-    duplicatePolicy: z.object({ metric: z.literal('normalized-word-trigram-jaccard-v1'), threshold: z.number().gt(0).lte(1), justification: nonempty }).strict(),
-    controls: z.array(z.object({ kind: z.enum(['same-author-different-topic', 'different-author-same-topic']), leftDocumentId: id, rightDocumentId: id }).strict()),
+    duplicatePolicy: z.strictObject({ metric: z.literal('normalized-word-trigram-jaccard-v1'), threshold: z.number().gt(0).lte(1), justification: nonempty }),
+    controls: z.array(z.strictObject({ kind: z.enum(['same-author-different-topic', 'different-author-same-topic']), leftDocumentId: id, rightDocumentId: id })),
     models: z.array(model), extractionModelIds: z.array(id),
-    judges: z.array(z.object({ id, modelId: id, role: z.literal('reader').default('reader'), independentCalibrationSha256: sha, selfPreferenceAuditSha256: sha }).strict()),
-    humanJudges: z.array(z.object({ id, role: z.enum(['author', 'reader']), authorId: id.optional() }).strict()).default([]),
-    voluntaryStrata: z.array(z.object({ authorId: id, suppliedByAuthor: z.literal(true), language: nonempty.optional(), proficiency: nonempty.optional() }).strict()),
-}).strict();
+    judges: z.array(z.strictObject({ id, modelId: id, role: z.literal('reader').default('reader'), independentCalibrationSha256: sha, selfPreferenceAuditSha256: sha })),
+    humanJudges: z.array(z.strictObject({ id, role: z.enum(['author', 'reader']), authorId: id.optional() })).prefault([]),
+    voluntaryStrata: z.array(z.strictObject({ authorId: id, suppliedByAuthor: z.literal(true), language: nonempty.optional(), proficiency: nonempty.optional() })),
+});
 const unique = (items) => new Set(items).size === items.length;
 const words = (text) => text.normalize('NFKC').toLowerCase().match(/[\p{L}\p{M}\p{N}]+/gu) ?? [];
 function shingles(text) {
@@ -80,15 +81,15 @@ export function parseEvaluationManifest(value) {
         throw new Error('Unknown voluntary stratum author');
     return m;
 }
-const preregistrationSchema = z.object({
+const preregistrationSchema = z.strictObject({
     schemaVersion: z.literal(1), id, manifestSha256: sha,
-    pilot: z.object({ artifactSha256: sha, completedAt: z.string().datetime(), authorIds: z.array(id).min(1), findings: nonempty }).strict(),
-    registeredAt: z.string().datetime(), finalDataNotAccessed: z.literal(true),
-    plannedAuthors: z.number().int().min(2), sampleSizeJustification: nonempty,
-    thresholds: z.array(z.object({ dimension: z.enum(EVALUATION_DIMENSIONS), value: z.number().finite(), direction: z.enum(['at-least', 'at-most']), justification: nonempty }).strict()).min(1),
+    pilot: z.strictObject({ artifactSha256: sha, completedAt: dateTime(), authorIds: z.array(id).min(1), findings: nonempty }),
+    registeredAt: dateTime(), finalDataNotAccessed: z.literal(true),
+    plannedAuthors: integer().min(2), sampleSizeJustification: nonempty,
+    thresholds: z.array(z.strictObject({ dimension: z.enum(EVALUATION_DIMENSIONS), value: z.number().finite(), direction: z.enum(['at-least', 'at-most']), justification: nonempty })).min(1),
     primaryOutcomes: z.array(z.enum(EVALUATION_DIMENSIONS)).min(1), analysisPlan: nonempty,
-    selectorPoliciesSha256: sha, budget: z.object({ limit: z.number().int().positive(), tokenizerId: nonempty, tokenizerVersion: nonempty }).strict(),
-}).strict();
+    selectorPoliciesSha256: sha, budget: z.strictObject({ limit: integer().positive(), tokenizerId: nonempty, tokenizerVersion: nonempty }),
+});
 /** Records caller declarations; hashes/timestamps do not attest that a pilot occurred or final data stayed unseen. */
 export function preregisterEvaluation(manifest, value) {
     const m = parseEvaluationManifest(manifest);
@@ -103,13 +104,13 @@ export function preregisterEvaluation(manifest, value) {
         throw new Error('Duplicate preregistered outcomes');
     return p;
 }
-const stimulusSchema = z.object({ id, taskId: id, authorId: id, heldoutDocumentId: id, text: nonempty, sha256: sha, budgetUsed: z.number().int().nonnegative(), tokenizerId: nonempty, tokenizerVersion: nonempty, conditionId: z.enum(['r0v0e0', 'r0v0e1', 'r0v1e0', 'r0v1e1', 'r1v0e0', 'r1v0e1', 'r1v1e0', 'r1v1e1']), workflow: z.enum(EVALUATION_WORKFLOWS), modelId: id.nullable(), genre: nonempty, lengthBand: nonempty, editingStrength: nonempty }).strict();
+const stimulusSchema = z.strictObject({ id, taskId: id, authorId: id, heldoutDocumentId: id, text: nonempty, sha256: sha, budgetUsed: integer().nonnegative(), tokenizerId: nonempty, tokenizerVersion: nonempty, conditionId: z.enum(['r0v0e0', 'r0v0e1', 'r0v1e0', 'r0v1e1', 'r1v0e0', 'r1v0e1', 'r1v1e0', 'r1v1e1']), workflow: z.enum(EVALUATION_WORKFLOWS), modelId: id.nullable(), genre: nonempty, lengthBand: nonempty, editingStrength: nonempty });
 /** Latin-square rotations plus reversed blocks. Balance is exact only for complete 2N-judge blocks per role. */
 export function createBlindEvaluationPackets(stimuliInput, judges, seed) {
     const stimuli = z.array(stimulusSchema).min(2).parse(stimuliInput);
     if (stimuli.some(s => evaluationHash(s.text) !== s.sha256))
         throw new Error('Stimulus integrity mismatch');
-    z.array(z.object({ id, role: z.enum(['author', 'reader']) }).strict()).min(1).parse(judges);
+    z.array(z.strictObject({ id, role: z.enum(['author', 'reader']) })).min(1).parse(judges);
     if (!seed || !unique(stimuli.map(s => s.id)) || !unique(judges.map(j => j.id)))
         throw new Error('Seed and unique stimulus/judge IDs required');
     if (new Set(stimuli.map(s => `${s.authorId}\0${s.taskId}\0${s.heldoutDocumentId}`)).size !== 1)
@@ -150,7 +151,7 @@ function validateManifestStimuli(m, input) {
     return stimuli;
 }
 function ingestRatings(ratings, context) {
-    const parsed = z.array(z.object({ stimulusId: id, authorId: id, judgeId: id, role: z.enum(['author', 'reader']), dimension: z.enum(EVALUATION_DIMENSIONS), value: z.number().finite().nullable(), missingReason: nonempty.optional(), tie: z.boolean() }).strict()).parse(ratings);
+    const parsed = z.array(z.strictObject({ stimulusId: id, authorId: id, judgeId: id, role: z.enum(['author', 'reader']), dimension: z.enum(EVALUATION_DIMENSIONS), value: z.number().finite().nullable(), missingReason: nonempty.optional(), tie: z.boolean() })).parse(ratings);
     if (!unique(parsed.map(r => JSON.stringify([r.stimulusId, r.judgeId, r.role, r.dimension]))))
         throw new Error('Duplicate rating observations');
     if (parsed.some(r => r.value === null && (!r.missingReason || r.tie) || r.value !== null && r.missingReason !== undefined))
@@ -172,7 +173,7 @@ function ingestRatings(ratings, context) {
         if (validate(r).authorId !== r.authorId)
             throw new Error('Rating/stimulus author mismatch');
     if (context.assignments !== undefined) {
-        const assignments = z.array(z.object({ stimulusId: id, judgeId: id, role: z.enum(['author', 'reader']), dimension: z.enum(EVALUATION_DIMENSIONS) }).strict()).parse(context.assignments);
+        const assignments = z.array(z.strictObject({ stimulusId: id, judgeId: id, role: z.enum(['author', 'reader']), dimension: z.enum(EVALUATION_DIMENSIONS) })).parse(context.assignments);
         if (!unique(assignments.map(key)))
             throw new Error('Duplicate rating assignments');
         for (const assignment of assignments)
@@ -205,7 +206,7 @@ function random(seed) {
 }
 /** Equal-weight author means, then author-cluster percentile bootstrap; no independent-text pseudo-replication. */
 export function bootstrapAuthorMeans(rows, options) {
-    z.array(z.object({ authorId: id, value: z.number().finite().nullable() }).strict()).parse(rows);
+    z.array(z.strictObject({ authorId: id, value: z.number().finite().nullable() })).parse(rows);
     if (!options.seed || !Number.isSafeInteger(options.iterations) || options.iterations < 2 || !Number.isFinite(options.confidence) || options.confidence <= 0 || options.confidence >= 1)
         throw new Error('Invalid bootstrap options');
     const authors = [...new Set(rows.map(r => r.authorId))].sort();
@@ -227,9 +228,9 @@ export function bootstrapAuthorMeans(rows, options) {
 }
 /** Outcomes must already share a preregistered decision rule; never compare arbitrary raw scales. */
 export function reportMetricDisagreement(rows, calibration) {
-    z.object({ humanReferenceSha256: sha, independentOfFinalData: z.literal(true), decisionRule: nonempty }).strict().parse(calibration);
+    z.strictObject({ humanReferenceSha256: sha, independentOfFinalData: z.literal(true), decisionRule: nonempty }).parse(calibration);
     const outcome = z.enum(['pass', 'fail', 'tie']).nullable();
-    z.array(z.object({ itemId: id, human: outcome, metric: outcome }).strict()).parse(rows);
+    z.array(z.strictObject({ itemId: id, human: outcome, metric: outcome })).parse(rows);
     if (!unique(rows.map(r => r.itemId)))
         throw new Error('Duplicate metric comparison IDs');
     const paired = rows.filter(r => r.human !== null && r.metric !== null);

package/dist/src/writing/writer-migration.js

@@ -2,6 +2,7 @@ import { createHash, randomUUID } from 'node:crypto';
 import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
 import { isAbsolute, resolve, join } from 'node:path';
 import { z } from 'zod';
+import { integer, dateTime } from '../schema/zod-validation.mjs';
 import { importLegacyWriterProfile } from './writer-profile-legacy.js';
 import { parseWriterProfile } from './writer-profile.js';
 import { WriterProfileStore } from './writer-profile-store.js';
@@ -19,38 +20,38 @@ function canonicalize(value) {
     }
     return value;
 }
-const requestSchema = z.object({
+const requestSchema = z.strictObject({
     cwd: z.string().min(1),
     sourcePath: z.string().min(1),
     format: z.enum(['yaml', 'json']),
     scope: z.enum(['project', 'user']).default('project'),
     userConfigDir: z.string().min(1).optional(),
-    profile: z.object({
+    profile: z.strictObject({
         id: profileId,
         name: z.string().min(1).max(200),
         version: z.string().regex(/^\d+\.\d+\.\d+$/).default('1.0.0'),
-        provenance: z.object({ source: z.string().min(1).max(2000), license: z.string().min(1).max(200) }).strict(),
-    }).strict(),
-}).strict();
-const planSchema = z.object({
+        provenance: z.strictObject({ source: z.string().min(1).max(2000), license: z.string().min(1).max(200) }),
+    }),
+});
+const planSchema = z.strictObject({
     schemaVersion: z.literal('aiwg.writer-migration-plan.v1'),
     id: z.string().regex(/^wm-[a-f0-9]{24}$/),
     planSha256: digest,
-    createdAt: z.string().datetime(),
+    createdAt: dateTime(),
     dryRun: z.literal(true),
     cwd: z.string().min(1),
-    source: z.object({ path: z.string().min(1), format: z.enum(['yaml', 'json']), sha256: digest, bytes: z.number().int().nonnegative(), legacyKind: z.string().min(1).max(80) }).strict(),
-    target: z.object({
+    source: z.strictObject({ path: z.string().min(1), format: z.enum(['yaml', 'json']), sha256: digest, bytes: integer().nonnegative(), legacyKind: z.string().min(1).max(80) }),
+    target: z.strictObject({
         scope: z.enum(['project', 'user']),
         profileId,
         userConfigDir: z.string().min(1).optional(),
-        existingProfile: z.object({ revision: z.number().int().positive(), sha256: digest }).strict().nullable(),
+        existingProfile: z.strictObject({ revision: integer().positive(), sha256: digest }).nullable(),
         activatesProfile: z.literal(false),
-    }).strict(),
+    }),
     actions: z.array(z.string().min(1).max(200)).min(1),
     warnings: z.array(z.string().min(1).max(400)),
-    profileTemplate: z.unknown(),
-}).strict();
+    profileTemplate: z.unknown().optional(),
+});
 function planDigest(plan) {
     return hash(JSON.stringify(canonicalize(plan)));
 }

package/dist/src/writing/writer-profile.js

@@ -1,11 +1,12 @@
 import { createHash } from 'node:crypto';
 import { z } from 'zod';
+import { integer } from '../schema/zod-validation.mjs';
 import { redactText } from '../governance/redaction.js';
 import { validateLegacyWriterProfile } from './writer-profile-legacy.js';
 const hash = (text) => createHash('sha256').update(text).digest('hex');
 const id = z.string().min(1).max(120).regex(/^[a-zA-Z0-9][a-zA-Z0-9._:-]*$/);
-const provenance = z.object({ source: z.string().min(1).max(2000), license: z.string().min(1).max(200) }).strict();
-const evidence = z.object({ sampleId: id, start: z.number().int().nonnegative(), end: z.number().int().positive() }).strict();
+const provenance = z.strictObject({ source: z.string().min(1).max(2000), license: z.string().min(1).max(200) });
+const evidence = z.strictObject({ sampleId: id, start: integer().nonnegative(), end: integer().positive() });
 /** Closed expression controls exclude identity, personality and generated signature phrases. */
 export const writerPreferenceValues = {
     dialect: ['unspecified', 'en-US', 'en-GB', 'en-AU', 'en-CA', 'fr-FR', 'fr-CA'],
@@ -22,29 +23,29 @@ export const writerPreferenceValues = {
     structure: ['prose', 'lists', 'contextual'],
 };
 const preferenceKey = z.enum(Object.keys(writerPreferenceValues));
-const preference = z.object({
+const preference = z.strictObject({
     id, key: preferenceKey, value: z.string(), origin: z.enum(['explicit', 'inferred']),
-    confidence: z.enum(['low', 'moderate', 'high']), evidence: z.array(evidence).default([]),
+    confidence: z.enum(['low', 'moderate', 'high']), evidence: z.array(evidence).prefault([]),
     task: z.string().max(120).optional(), status: z.enum(['accepted', 'rejected']).default('accepted'),
-}).strict();
-const override = z.object({ key: preferenceKey, action: z.enum(['set', 'reject', 'reset']), value: z.string().optional(), task: z.string().max(120).optional() }).strict();
-const sample = z.object({
+});
+const override = z.strictObject({ key: preferenceKey, action: z.enum(['set', 'reject', 'reset']), value: z.string().optional(), task: z.string().max(120).optional() });
+const sample = z.strictObject({
     id, text: z.string().max(1_000_000).optional(), sha256: z.string().regex(/^[a-f0-9]{64}$/), approved: z.boolean(),
     status: z.enum(['active', 'revoked']), provenance,
-    rights: z.object({ useForVoice: z.boolean(), shareText: z.boolean() }).strict(),
+    rights: z.strictObject({ useForVoice: z.boolean(), shareText: z.boolean() }),
     sensitivity: z.enum(['public', 'private', 'secret']),
-}).strict();
-export const legacyProfileAttachmentSchema = z.object({
+});
+export const legacyProfileAttachmentSchema = z.strictObject({
     format: z.enum(['yaml', 'json']),
     kind: z.enum(['addon-template', 'python-generated', 'python-analyzed', 'python-blended', 'ts-analyzer', 'ts-calibration']),
-    raw: z.string(), sha256: z.string().regex(/^[a-f0-9]{64}$/), payload: z.unknown(),
-}).strict();
-export const writerProfileSchema = z.object({
-    schemaVersion: z.literal(1), revision: z.number().int().positive().default(1), metadataSharingApproved: z.boolean().default(false), id: z.string().regex(/^[a-z0-9][a-z0-9.-]{0,79}$/).refine(v => !v.includes('..')), version: z.string().regex(/^\d+\.\d+\.\d+$/), name: z.string().min(1).max(200), provenance,
-    samples: z.array(sample), preferences: z.array(preference), overrides: z.array(override).default([]),
-    counterexamples: z.array(evidence).default([]), legacy: legacyProfileAttachmentSchema.optional(),
-    cacheEpoch: z.number().int().nonnegative().default(0),
-}).strict().superRefine((p, ctx) => {
+    raw: z.string(), sha256: z.string().regex(/^[a-f0-9]{64}$/), payload: z.unknown().optional(),
+});
+export const writerProfileSchema = z.strictObject({
+    schemaVersion: z.literal(1), revision: integer().positive().default(1), metadataSharingApproved: z.boolean().default(false), id: z.string().regex(/^[a-z0-9][a-z0-9.-]{0,79}$/).refine(v => !v.includes('..')), version: z.string().regex(/^\d+\.\d+\.\d+$/), name: z.string().min(1).max(200), provenance,
+    samples: z.array(sample), preferences: z.array(preference), overrides: z.array(override).prefault([]),
+    counterexamples: z.array(evidence).prefault([]), legacy: legacyProfileAttachmentSchema.optional(),
+    cacheEpoch: integer().nonnegative().default(0),
+}).superRefine((p, ctx) => {
     const problem = (message) => ctx.addIssue({ code: z.ZodIssueCode.custom, message });
     if (new Set(p.samples.map(s => s.id)).size !== p.samples.length)
         problem('Duplicate sample IDs');

package/dist/src/writing/writing-brief.js

@@ -1,36 +1,37 @@
 import { createHash } from 'node:crypto';
 import { z } from 'zod';
+import { integer } from '../schema/zod-validation.mjs';
 const id = z.string().min(1).max(120).regex(/^[a-zA-Z0-9][a-zA-Z0-9._:-]*$/);
 const digest = z.string().regex(/^[a-f0-9]{64}$/);
 const text = z.string().min(1);
-const span = { start: z.number().int().nonnegative(), end: z.number().int().nonnegative() };
-const evidence = z.object({ inputId: id, ...span }).strict();
-const input = z.object({
+const span = { start: integer().nonnegative(), end: integer().nonnegative() };
+const evidence = z.strictObject({ inputId: id, ...span });
+const input = z.strictObject({
     id, kind: z.enum(['source', 'author-notes', 'existing-draft']), text,
-    sha256: digest, provenance: z.object({ source: text, version: text }).strict(),
+    sha256: digest, provenance: z.strictObject({ source: text, version: text }),
     authorApproved: z.boolean(),
-}).strict();
-const proposition = z.object({
+});
+const proposition = z.strictObject({
     id, text, evidenceStrength: z.enum(['verified', 'reported', 'preliminary', 'experimental', 'unverified']),
     evidence: z.array(evidence).min(1), qualifiers: z.array(text),
-}).strict();
-const authorClaim = z.object({
+});
+const authorClaim = z.strictObject({
     id, kind: z.enum(['experience', 'opinion', 'intent', 'rationale']), text,
     evidence: z.array(evidence).min(1),
-}).strict();
-const correction = z.object({
+});
+const correction = z.strictObject({
     id, ...span, expected: z.string(), replacement: z.string(), reason: text,
     authorAuthorized: z.literal(true),
-}).strict();
-export const writingBriefSchema = z.object({
+});
+export const writingBriefSchema = z.strictObject({
     schemaVersion: z.literal(1), id,
     operation: z.enum(['draft-from-notes', 'edit-existing', 'proofread-only', 'continue-author-text']),
-    reader: z.object({ task: z.string(), audience: text, requirements: z.array(text) }).strict(),
+    reader: z.strictObject({ task: z.string(), audience: text, requirements: z.array(text) }),
     intendedAction: z.string(), exclusions: z.array(text), inputs: z.array(input),
     propositions: z.array(proposition), limitations: z.array(proposition), authorClaims: z.array(authorClaim),
     sourceInputId: id.optional(),
-    permissions: z.object({ rephrase: z.boolean(), reorder: z.boolean(), addContent: z.boolean(), corrections: z.array(correction) }).strict(),
-}).strict();
+    permissions: z.strictObject({ rephrase: z.boolean(), reorder: z.boolean(), addContent: z.boolean(), corrections: z.array(correction) }),
+});
 export const writingBriefHash = (value) => createHash('sha256').update(value, 'utf8').digest('hex');
 function boundary(source, offset) {
     return offset >= 0 && offset <= source.length
@@ -101,7 +102,7 @@ export function parseWritingBrief(value) {
 /** Parameterization changes presentation targets only, never the brief or confidence. */
 export function prepareWritingBrief(value, target) {
     const b = parseWritingBrief(value);
-    const selection = z.object({ profileId: id, channel: z.enum(['article', 'social', 'email', 'engineering', 'conversation']) }).strict().safeParse(target);
+    const selection = z.strictObject({ profileId: id, channel: z.enum(['article', 'social', 'email', 'engineering', 'conversation']) }).safeParse(target);
     if (!selection.success)
         throw new Error('Invalid writing brief target; input text is omitted.');
     return { brief: structuredClone(b), target: selection.data, briefDigest: writingBriefHash(JSON.stringify(b)),
@@ -114,7 +115,7 @@ export function validateBriefClaims(value, proposed) {
     if (!check.valid)
         return check;
     const b = parseWritingBrief(value);
-    const proposal = z.array(z.object({ kind: z.enum(['proposition', 'experience', 'opinion', 'intent', 'rationale']), text, groundedIn: z.array(id) }).strict()).safeParse(proposed);
+    const proposal = z.array(z.strictObject({ kind: z.enum(['proposition', 'experience', 'opinion', 'intent', 'rationale']), text, groundedIn: z.array(id) })).safeParse(proposed);
     if (!proposal.success)
         return { valid: false, diagnostics: [{ code: 'schema', message: 'Invalid proposed claim shape; input text is omitted.' }] };
     const claims = [...b.propositions.map(p => ({ ...p, kind: 'proposition' })), ...b.limitations.map(p => ({ ...p, kind: 'proposition' })), ...b.authorClaims];

package/dist/src/writing/writing-receipt.js

@@ -2,12 +2,13 @@ import { createHash, randomUUID } from 'node:crypto';
 import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { z } from 'zod';
+import { integer, dateTime } from '../schema/zod-validation.mjs';
 import { redactStructured } from '../governance/redaction.js';
 import { resolveProjectAiwgDirForWrite } from '../config/project-artifacts.js';
 const sha = z.string().regex(/^[a-f0-9]{64}$/);
 const id = z.string().min(1).max(120).regex(/^[a-zA-Z0-9][a-zA-Z0-9._:-]*$/);
 const stableId = z.string().min(1).max(120).regex(/^[a-z0-9][a-z0-9.-]*$/).refine(value => !value.includes('..'));
-const isoDate = z.string().datetime();
+const isoDate = dateTime();
 const hash = (text) => createHash('sha256').update(text, 'utf8').digest('hex');
 function canonicalize(value) {
     if (Array.isArray(value))
@@ -28,105 +29,105 @@ function rejectSensitiveReceipt(value) {
     if (redacted.sensitivity !== 'none')
         throw new Error('Writing receipt contains a known secret or credential field');
 }
-const budgetSchema = z.object({
-    limit: z.number().int().nonnegative(),
-    used: z.number().int().nonnegative(),
+const budgetSchema = z.strictObject({
+    limit: integer().nonnegative(),
+    used: integer().nonnegative(),
     unit: z.enum(['tokens', 'utf8-bytes', 'characters']),
     measurement: z.enum(['exact', 'upper-bound', 'estimated']),
     tokenizerId: z.string().min(1).max(120),
     tokenizerVersion: z.string().min(1).max(120),
-}).strict().refine(value => value.used <= value.limit, 'Budget use cannot exceed limit');
-const operationConfigSchema = z.object({
+}).refine(value => value.used <= value.limit, 'Budget use cannot exceed limit');
+const operationConfigSchema = z.strictObject({
     action: z.enum(['plan', 'proofread', 'draft', 'edit', 'continue']),
-    correctionIds: z.array(id).default([]),
+    correctionIds: z.array(id).prefault([]),
     channel: z.enum(['article', 'social', 'email', 'engineering', 'conversation']).optional(),
     configSha256: sha.optional(),
-}).strict();
-const receiptInputBaseSchema = z.object({
+});
+const receiptInputBaseSchema = z.strictObject({
     schemaVersion: z.literal('aiwg.writing-receipt.v1').default('aiwg.writing-receipt.v1'),
     id: stableId.optional(),
     createdAt: isoDate.default(() => new Date().toISOString()),
     operation: z.enum(['draft-from-notes', 'edit-existing', 'proofread-only', 'continue-author-text']),
-    profile: z.object({
+    profile: z.strictObject({
         id: stableId,
         version: z.string().regex(/^\d+\.\d+\.\d+$/),
-        revision: z.number().int().positive(),
-        cacheEpoch: z.number().int().nonnegative(),
+        revision: integer().positive(),
+        cacheEpoch: integer().nonnegative(),
         compiledModeSha256: sha.optional(),
         fallback: z.boolean(),
-    }).strict(),
-    examples: z.object({
+    }),
+    examples: z.strictObject({
         receiptSha256: sha.optional(),
         cacheKey: sha.optional(),
-        selections: z.array(z.object({ sampleId: id, sha256: sha }).strict()).default([]),
+        selections: z.array(z.strictObject({ sampleId: id, sha256: sha })).prefault([]),
         budget: budgetSchema.optional(),
         fallback: z.boolean().default(false),
-    }).strict().optional(),
-    modes: z.array(z.object({
+    }).optional(),
+    modes: z.array(z.strictObject({
         id: stableId,
         version: z.string().min(1).max(120),
         profileSha256: sha.optional(),
-    }).strict()).default([]),
-    state: z.object({
-        selected: z.array(stableId).default([]),
-        delivered: z.array(stableId).default([]),
-        applied: z.array(stableId).default([]),
-        validated: z.array(stableId).default([]),
+    })).prefault([]),
+    state: z.strictObject({
+        selected: z.array(stableId).prefault([]),
+        delivered: z.array(stableId).prefault([]),
+        applied: z.array(stableId).prefault([]),
+        validated: z.array(stableId).prefault([]),
         deliveredTo: z.enum(['local-transform-callback', 'none']),
         fallback: z.enum(['none', 'unaltered']),
-    }).strict().optional(),
-    modelPrompt: z.object({
+    }).optional(),
+    modelPrompt: z.strictObject({
         execution: z.enum(['none', 'local-callback', 'hosted']).default('none'),
         provider: z.string().min(1).max(120).optional(),
         model: z.string().min(1).max(120).optional(),
         promptSha256: sha,
         templateSha256: sha.optional(),
-        decoding: z.object({
+        decoding: z.strictObject({
             temperature: z.number().finite().min(0).max(2).optional(),
             topP: z.number().finite().min(0).max(1).optional(),
-            maxOutputTokens: z.number().int().positive().optional(),
-            seed: z.number().int().optional(),
+            maxOutputTokens: integer().positive().optional(),
+            seed: integer().optional(),
             stopSha256: sha.optional(),
-        }).strict().optional(),
+        }).optional(),
         promptConfigSha256: sha.optional(),
-        hostedVersion: z.object({
+        hostedVersion: z.strictObject({
             attested: z.literal(false),
             reason: z.literal('Hosted provider prompt/version cannot be attested from this local receipt.'),
-        }).strict().optional(),
-    }).strict(),
-    inputs: z.array(z.object({
+        }).optional(),
+    }),
+    inputs: z.array(z.strictObject({
         id,
         role: z.enum(['source', 'author-notes', 'existing-draft', 'brief', 'configuration']),
         sha256: sha,
-    }).strict()).min(1),
+    })).min(1),
     operationConfig: operationConfigSchema.optional(),
-    output: z.object({
+    output: z.strictObject({
         sha256: sha,
         path: z.string().min(1).max(2000).optional(),
-    }).strict().optional(),
+    }).optional(),
     budget: budgetSchema,
-    fallback: z.object({
+    fallback: z.strictObject({
         applied: z.boolean(),
         reason: z.string().min(1).max(400).optional(),
-    }).strict(),
-    validators: z.array(z.object({
+    }),
+    validators: z.array(z.strictObject({
         id,
         version: z.string().min(1).max(120),
         sha256: sha.optional(),
         outcome: z.enum(['pass', 'fail', 'uncertain', 'not-run']),
-    }).strict()).default([]),
-    evaluation: z.array(z.object({
+    })).prefault([]),
+    evaluation: z.array(z.strictObject({
         id,
         method: z.string().min(1).max(120),
         sha256: sha,
         outcome: z.enum(['pass', 'fail', 'uncertain', 'not-established']),
-    }).strict()).default([]),
-    authorAcceptance: z.object({
+    })).prefault([]),
+    authorAcceptance: z.strictObject({
         status: z.enum(['accepted', 'pending', 'rejected', 'not-required']),
         acceptedAt: isoDate.optional(),
         acceptedBy: z.string().min(1).max(120).optional(),
-    }).strict(),
-}).strict();
+    }),
+});
 const enforceReceiptRules = (value, ctx) => {
     if (new Set(value.inputs.map(input => input.id)).size !== value.inputs.length) {
         ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'Input IDs must be unique' });
@@ -176,7 +177,7 @@ const enforceReceiptRules = (value, ctx) => {
     }
 };
 const receiptInputSchema = receiptInputBaseSchema.superRefine(enforceReceiptRules);
-export const writingReceiptSchema = receiptInputBaseSchema.extend({ id: stableId, operationConfig: operationConfigSchema, receiptSha256: sha }).strict().superRefine(enforceReceiptRules);
+export const writingReceiptSchema = receiptInputBaseSchema.extend({ id: stableId, operationConfig: operationConfigSchema, receiptSha256: sha }).superRefine(enforceReceiptRules);
 export function createWritingReceipt(input) {
     const parsed = receiptInputSchema.parse(input);
     const defaultAction = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwg/cli",
-  "version": "2026.10.5",
+  "version": "2026.10.7",
   "description": "Lightweight AIWG CLI for signed, versioned web-backed resources.",
   "type": "module",
   "license": "MIT",
@@ -27,6 +27,9 @@
     "THIRD_PARTY_NOTICES.md",
     "bin/",
     "agentic/code/providers/",
+    "agentic/code/addons/composition-engine/lib/runtime.mjs",
+    "agentic/code/addons/composition-engine/lib/validator.mjs",
+    "agentic/code/addons/composition-engine/schemas/flow-graph.schema.json",
     "schemas/security/",
     "schemas/decision/",
     "schemas/dataset/",
@@ -115,7 +118,7 @@
     "semver": "^7.8.5",
     "toml-eslint-parser": "0.10.0",
     "yaml": "^2.9.0",
-    "zod": "^3.25.0"
+    "zod": "^4.6.6"
   },
   "optionalDependencies": {
     "@hono/node-server": "2.0.11",

package/schemas/decision/DecisionReview.schema.json

@@ -17,12 +17,89 @@
     "lifecycle": { "type": "object", "additionalProperties": false, "required": ["legalHold"], "properties": { "legalHold": { "type": "boolean" }, "tombstonedAtEpochMs": { "type": "integer", "minimum": 0 }, "tombstoneReason": { "type": "string" } } }
   },
   "$defs": {
+    "evaluation": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Observed evaluator provenance and evidence. Agreement does not establish independent errors or proof.",
+      "properties": {
+        "evaluatorModel": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 8192,
+          "pattern": "\\S"
+        },
+        "evaluatorVendor": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 8192,
+          "pattern": "\\S"
+        },
+        "evaluatorFamily": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 8192,
+          "pattern": "\\S",
+          "description": "Observed model family; unknown remains unknown. CLI names are not model families."
+        },
+        "acceptanceCriteriaRef": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 8192,
+          "pattern": "\\S"
+        },
+        "reReviewOf": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 8192,
+          "pattern": "\\S",
+          "description": "Reference to the previous review/decision, recorded on a re-review after material fixes."
+        },
+        "disagreements": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "claimRef",
+              "generatorPosition",
+              "evaluatorPosition"
+            ],
+            "properties": {
+              "claimRef": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 8192,
+                "pattern": "\\S"
+              },
+              "generatorPosition": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 8192,
+                "pattern": "\\S"
+              },
+              "evaluatorPosition": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 8192,
+                "pattern": "\\S"
+              },
+              "resolutionRef": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 8192,
+                "pattern": "\\S"
+              }
+            }
+          }
+        }
+      }
+    },
     "digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
     "actor": { "type": "object", "additionalProperties": false, "required": ["id", "roles", "authorityContext"], "properties": { "id": { "type": "string", "minLength": 1 }, "roles": { "type": "array", "items": { "type": "string" } }, "authorityContext": { "type": "string" } } },
     "pin": { "type": "object", "additionalProperties": false, "required": ["id", "version", "digest"], "properties": { "id": { "type": "string" }, "version": { "type": "string" }, "digest": { "$ref": "#/$defs/digest" } } },
     "sourceReceipt": { "type": "object", "additionalProperties": false, "required": ["id", "digest"], "properties": { "id": { "type": "string" }, "digest": { "$ref": "#/$defs/digest" } } },
     "proposal": { "type": "object", "additionalProperties": false, "required": ["version", "action", "actionDigest", "createdAtEpochMs", "editor", "rationale"], "properties": { "version": { "type": "integer", "minimum": 1 }, "action": {}, "actionDigest": { "$ref": "#/$defs/digest" }, "createdAtEpochMs": { "type": "integer" }, "editor": { "$ref": "#/$defs/actor" }, "rationale": { "type": "string" } } },
-    "decision": { "type": "object", "additionalProperties": false, "required": ["reviewer", "proposalVersion", "decision", "rationale", "atEpochMs"], "properties": { "reviewer": { "$ref": "#/$defs/actor" }, "proposalVersion": { "type": "integer" }, "decision": { "enum": ["approve", "reject"] }, "rationale": { "type": "string" }, "atEpochMs": { "type": "integer" } } },
+    "decision": { "type": "object", "additionalProperties": false, "required": ["reviewer", "proposalVersion", "decision", "rationale", "atEpochMs"], "properties": { "reviewer": { "$ref": "#/$defs/actor" }, "proposalVersion": { "type": "integer" }, "decision": { "enum": ["approve", "reject"] }, "rationale": { "type": "string" }, "atEpochMs": { "type": "integer" }, "evaluation": { "$ref": "#/$defs/evaluation" } } },
     "event": { "type": "object", "additionalProperties": false, "required": ["sequence", "type", "atEpochMs", "actor", "proposalVersion", "rationale"], "properties": { "sequence": { "type": "integer" }, "type": { "enum": ["created", "claimed", "approved", "rejected", "edited", "expired", "escalated", "canceled", "resumed", "execution-completed", "execution-failed", "legal-hold-placed", "legal-hold-released", "tombstoned", "authorization-denied", "sensitive-view-accessed"] }, "atEpochMs": { "type": "integer" }, "actor": { "$ref": "#/$defs/actor" }, "proposalVersion": { "type": "integer" }, "rationale": { "type": "string" }, "operatorDecisionEventId": { "type": "string", "minLength": 1 }, "data": { "type": "object" } } },
     "effect": { "type": "object", "additionalProperties": false, "required": ["effectId", "continuationId", "proposalVersion", "completedAtEpochMs", "result"], "properties": { "effectId": { "type": "string" }, "continuationId": { "type": "string" }, "proposalVersion": { "type": "integer" }, "completedAtEpochMs": { "type": "integer" }, "result": {} } }
   }

package/schemas/mission-v1.schema.json

@@ -1643,6 +1643,9 @@
       "type": "object",
       "additionalProperties": false,
       "properties": {
+        "isolation": {
+          "enum": ["systemd-unit", "native-sandbox"]
+        },
         "version": {
           "const": 1
         },