@aiwg/cli 2026.10.6 → 2026.10.7

package/dist/src/cli/handlers/use.js

@@ -1,3 +1,4 @@
+import { ContextWriteJournal } from '../../smiths/context-pipeline/context-file-safety.js';
 import { trackTemporaryDirectory } from '../../utils/temporary-directory.js';
 /**
  * Use Command Handler
@@ -1675,6 +1676,11 @@ export async function countPiAgentFiles(target, agentsPath) {
 // and additive passes can describe the same destination more than once.
 let usePreviewActions;
 // Recursive framework/addon/provider passes share the boundary's resolved policy.
+async function generateDeploymentContextFiles(options) {
+    const result = await generateContextFiles(options);
+    useDeployment?.contextFiles.push(result);
+    return result;
+}
 let useDeployment;
 function useDeploymentArgs(args) {
     const forwarded = [...args];
@@ -2118,7 +2124,7 @@ async function generateGlobalProjectContext(opts) {
         skills: userPaths.skills,
         behaviors: userPaths.behaviors,
     });
-    await generateContextFiles({
+    await generateDeploymentContextFiles({
         provider: opts.provider,
         projectPath: opts.projectPath,
         sections,
@@ -2181,7 +2187,7 @@ async function ensurePostDeployPhases(opts) {
         behaviors: paths.behaviors,
     });
     try {
-        await generateContextFiles({
+        await generateDeploymentContextFiles({
             provider: opts.provider,
             projectPath: opts.projectPath,
             sections,
@@ -2194,8 +2200,8 @@ async function ensurePostDeployPhases(opts) {
             },
         });
     }
-    catch {
-        // The shared verifier reports context or provider-wiring failures.
+    catch (error) {
+        throw new Error(`Context generation failed: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
     }
 }
 async function deploySourceDirectory(opts) {
@@ -2544,11 +2550,40 @@ export class UseHandler {
         useDeployment = {
             version: previousDeployment?.version ?? resolveDeployVersion(ctx.frameworkRoot || await getFrameworkRoot()),
             skipContextFiles: previousDeployment?.skipContextFiles || ctx.args.includes('--no-context-files'),
+            contextFiles: previousDeployment?.contextFiles ?? [],
         };
+        const journal = previousDeployment ? undefined : new ContextWriteJournal();
         try {
-            return await this.executeDeployment(ctx);
+            let result;
+            try {
+                result = await this.executeDeployment(ctx);
+            }
+            catch (error) {
+                result = { exitCode: 1, message: error instanceof Error ? error.message : String(error) };
+            }
+            if (journal) {
+                const rollback = result.exitCode !== 0 ? journal.rollback() : undefined;
+                if (ctx.args.includes('--json')) {
+                    let structured;
+                    try {
+                        structured = JSON.parse(result.message || '{}');
+                    }
+                    catch {
+                        structured = { exitCode: result.exitCode, message: result.message };
+                    }
+                    structured.contextFiles = useDeployment.contextFiles;
+                    if (rollback)
+                        structured.contextRollback = rollback;
+                    result = { ...result, message: JSON.stringify(structured, null, 2), rawOutput: true };
+                }
+                else if (rollback?.conflicts.length) {
+                    result.message = [result.message, ...rollback.conflicts.map(conflict => `Context rollback conflict: ${conflict.path}: ${conflict.reason}`)].filter(Boolean).join('\n');
+                }
+            }
+            return result;
         }
         finally {
+            journal?.dispose();
             useDeployment = previousDeployment;
         }
     }
@@ -2639,6 +2674,9 @@ export class UseHandler {
         try {
             coreResult = await this.executeCore({ ...ctx, args: coreArgs });
         }
+        catch (error) {
+            coreResult = { exitCode: 1, message: error instanceof Error ? error.message : String(error) };
+        }
         finally {
             usePreviewActions = previousPreview;
             if (json || dryRun) {
@@ -2664,12 +2702,18 @@ export class UseHandler {
         else {
             if (coreResult.exitCode === 0 && !dryRun && !VALID_FRAMEWORKS.includes(requestedBundle)) {
                 for (const provider of providers) {
-                    await ensurePostDeployPhases({
-                        frameworkRoot,
-                        projectPath: projectDir,
-                        provider,
-                        args: remainingArgs,
-                    });
+                    try {
+                        await ensurePostDeployPhases({
+                            frameworkRoot,
+                            projectPath: projectDir,
+                            provider,
+                            args: remainingArgs,
+                        });
+                    }
+                    catch (error) {
+                        coreResult = { exitCode: 1, message: error instanceof Error ? error.message : String(error) };
+                        break;
+                    }
                 }
             }
             const providerResults = [];
@@ -4377,7 +4421,7 @@ export class UseHandler {
                     skills: paths.skills,
                     behaviors: paths.behaviors,
                 });
-                const ctxResult = await generateContextFiles({
+                const ctxResult = await generateDeploymentContextFiles({
                     provider: provider,
                     projectPath: target,
                     sections,
@@ -4431,10 +4475,8 @@ export class UseHandler {
                 }
             }
             catch (err) {
-                // Non-fatal: context-pipeline emission must not block deployment.
-                // Operator can re-run aiwg use to retry.
                 const msg = err instanceof Error ? err.message : String(err);
-                console.error(`Warning: context-pipeline emission failed: ${msg}`);
+                return { exitCode: 1, message: `Context generation failed: ${msg}` };
             }
         }
         span.end('use:complete', { framework });

package/dist/src/cli/prompt-utils.js

@@ -88,7 +88,16 @@ export function askWithTimeout(rl, prompt, parse, fallback, fallbackLabel, timeo
         const cleanup = () => {
             clearTimeout(timer);
             signal?.removeEventListener('abort', onAbort);
+            rl.removeListener('close', onClose);
         };
+        const onClose = () => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            resolve(fallback);
+        };
+        rl.on('close', onClose);
         if (signal?.aborted) {
             // Fire synchronously so the caller's try/catch sees the reject without
             // awaiting a tick.
@@ -112,6 +121,70 @@ export function askWithTimeout(rl, prompt, parse, fallback, fallbackLabel, timeo
 export async function askString(rl, prompt, fallback = '', signal) {
     return askWithTimeout(rl, prompt, (a) => a.trim(), fallback, fallback || '(empty)', promptTimeoutMs(), signal);
 }
+/** Collect a hidden paste through an empty line, with one overall prompt deadline. */
+export function askMultilineSecret(rl, signal) {
+    return new Promise((resolve, reject) => {
+        const lines = [];
+        let length = 0;
+        let settled = false;
+        const cleanup = () => {
+            clearTimeout(timer);
+            signal?.removeEventListener('abort', onAbort);
+            rl.removeListener('line', onLine);
+            rl.removeListener('close', onClose);
+            lines.length = 0;
+        };
+        const finish = (value) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            resolve(value);
+        };
+        const onLine = (line) => {
+            if (!line) {
+                finish(lines.join('\n'));
+                return;
+            }
+            length += line.length + (lines.length ? 1 : 0);
+            if (length > 16384) {
+                settled = true;
+                cleanup();
+                reject(new Error('Sensitive input exceeds 16384 characters.'));
+                return;
+            }
+            lines.push(line);
+        };
+        // A closed terminal or timeout discards incomplete input, never echoes it.
+        const onClose = () => finish('');
+        const onAbort = () => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            try {
+                rl.close();
+            }
+            catch { /* already closed */ }
+            reject(signal.reason ?? new Error('Aborted'));
+        };
+        const timeoutMs = promptTimeoutMs();
+        const timer = setTimeout(() => {
+            if (settled)
+                return;
+            ui.warn(`  No input completed within ${Math.round(timeoutMs / 1000)}s — discarding incomplete sensitive input`);
+            finish('');
+        }, timeoutMs);
+        timer.unref?.();
+        rl.on('line', onLine);
+        rl.on('close', onClose);
+        if (signal?.aborted) {
+            onAbort();
+            return;
+        }
+        signal?.addEventListener('abort', onAbort, { once: true });
+    });
+}
 /**
  * Prompt for a yes/no answer with timeout and default. Answers starting with
  * 'y' (case-insensitive) are considered yes; everything else is no. On

package/dist/src/config/gitignore.js

@@ -13,6 +13,7 @@ import * as path from 'path';
 import { execFile } from 'child_process';
 import { promisify } from 'util';
 import { boundedSpawnSync } from '../process/bounded-child-process.mjs';
+import { helperEnvironment, HELPER_ENV_ALLOWLIST } from '../process/cli-command.mjs';
 const execFileAsync = promisify(execFile);
 const GITIGNORE_PROBE_BASENAME = '.aiwg-ignore-probe';
 // ===========================
@@ -94,6 +95,7 @@ async function isGitWorktree(projectRoot) {
     try {
         const { stdout } = await execFileAsync('git', ['rev-parse', '--is-inside-work-tree'], {
             cwd: projectRoot,
+            env: helperEnvironment(process.env, [...HELPER_ENV_ALLOWLIST, 'GIT_DIR', 'GIT_WORK_TREE', 'GIT_COMMON_DIR']),
             windowsHide: true,
         });
         return stdout.trim() === 'true';
@@ -117,6 +119,7 @@ async function resolveCoveredPatterns(projectRoot, patterns, lines) {
         try {
             await execFileAsync('git', ['check-ignore', '--quiet', '--', probePath(pattern)], {
                 cwd: projectRoot,
+                env: helperEnvironment(process.env, [...HELPER_ENV_ALLOWLIST, 'GIT_DIR', 'GIT_WORK_TREE', 'GIT_COMMON_DIR']),
                 windowsHide: true,
             });
             return true;
@@ -239,6 +242,7 @@ export function dropGitignored(targetDir, files) {
         }
         const result = boundedSpawnSync('git', ['check-ignore', '-z', '--stdin'], 'quick', {
             cwd: targetDir,
+            env: helperEnvironment(process.env, [...HELPER_ENV_ALLOWLIST, 'GIT_DIR', 'GIT_WORK_TREE', 'GIT_COMMON_DIR']),
             input: `${files.join('\0')}\0`,
             encoding: 'utf8',
         });

package/dist/src/config/workspace.js

@@ -13,6 +13,7 @@ import { existsSync, statSync } from 'fs';
 import { homedir } from 'os';
 import { dirname, isAbsolute, relative, resolve } from 'path';
 import { promisify } from 'util';
+import { helperEnvironment } from '../process/cli-command.mjs';
 import { getConfigPath, readAiwgConfig, resolveDelivery, resolveRemoteProvider, resolveRemotes, } from './aiwg-config.js';
 const execFileAsync = promisify(execFile);
 function expandHome(value) {
@@ -96,7 +97,7 @@ async function readRemoteUrl(repoPath, remote) {
     if (remote.includes('://') || /^[^@/\s]+@[^:/\s]+:/.test(remote))
         return remote;
     try {
-        const { stdout } = await execFileAsync('git', ['-C', repoPath, 'remote', 'get-url', remote], { encoding: 'utf8' });
+        const { stdout } = await execFileAsync('git', ['-C', repoPath, 'remote', 'get-url', remote], { encoding: 'utf8', env: helperEnvironment() });
         return stdout.trim() || undefined;
     }
     catch {

package/dist/src/decision/adapters/jev.js

@@ -44,22 +44,15 @@ export class JevDecisionAdapter {
         this.region = options.region?.trim() ? options.region : null;
         this.observeResponseBody = options.observeResponseBody;
     }
-    /** Used only for non-2xx error bodies, where there is no separate successful parse to stay consistent with. */
-    observeResponse(body) {
-        if (!this.observeResponseBody)
-            return;
-        let parsed = {};
-        try {
-            parsed = asRecord(parseBoundedJson(body));
-        }
-        catch { /* Invalid answers still have bounded body evidence. */ }
-        let usage = emptyUsage();
+    /** An error response may still report billed usage and correlation metadata. */
+    parseErrorResponse(body) {
+        let parsed;
         try {
-            usage = normalizeUsage(parsed.usage);
+            parsed = parseBoundedJson(body);
         }
-        catch { /* Missing usage is unknown, including on auth errors. */ }
-        this.observeResponseBody(body, { actualModel: typeof parsed.model === 'string' && parsed.model ? parsed.model : null,
-            usage });
+        catch { /* Error classification does not require valid JSON. */ }
+        this.observeParsed(body, parsed);
+        return parsed;
     }
     /**
      * Derives the observer's model/usage from a value `parseBoundedJson` has already produced (or `undefined`
@@ -81,6 +74,15 @@ export class JevDecisionAdapter {
         catch { /* Missing usage is unknown, including on auth errors. */ }
         return { actualModel: typeof record.model === 'string' && record.model ? record.model : null, usage };
     }
+    responseMetadata(parsed, metadata) {
+        let body = {};
+        try {
+            body = asRecord(parsed);
+        }
+        catch { /* No body correlation metadata. */ }
+        const id = metadata.requestId ? null : safeRequestId(body.request_id ?? body.requestId);
+        return { ...metadata, ...this.observationMetadataOf(parsed), ...(id ? { requestId: id, requestIdSource: 'body' } : {}) };
+    }
     /** Observes exactly once, from the single parse attempt `parsed` already represents (successful or not). */
     observeParsed(body, parsed) {
         this.observeResponseBody?.(body, this.observationMetadataOf(parsed));
@@ -209,22 +211,7 @@ export class JevDecisionAdapter {
         if (!response.ok) {
             try {
                 const errorBody = await readBoundedBody(response, signal);
-                this.observeResponse(errorBody);
-                if (!metadata.requestId && response.headers.get('content-type')?.includes('json')) {
-                    let parsedError;
-                    try {
-                        parsedError = parseBoundedJson(errorBody);
-                    }
-                    catch {
-                        parsedError = null;
-                    }
-                    if (parsedError && typeof parsedError === 'object' && !Array.isArray(parsedError)) {
-                        const field = parsedError.request_id ?? parsedError.requestId;
-                        const safe = safeRequestId(field);
-                        if (safe)
-                            metadata = { ...metadata, requestId: safe, requestIdSource: 'body' };
-                    }
-                }
+                metadata = this.responseMetadata(this.parseErrorResponse(errorBody), metadata);
             }
             catch {
                 if (request.signal.aborted)
@@ -248,6 +235,7 @@ export class JevDecisionAdapter {
             finally {
                 this.observeParsed(encoded, parsed);
             }
+            metadata = this.responseMetadata(parsed, metadata);
             if (request.signal.aborted)
                 return externalInterruption(request, 'terminal-response', metadata);
             if (deadline.aborted)
@@ -353,7 +341,7 @@ export class JevDecisionAdapter {
         }
         if (!response.ok) {
             try {
-                this.observeResponse(await readBoundedBody(response, signal));
+                metadata = this.responseMetadata(this.parseErrorResponse(await readBoundedBody(response, signal)), metadata);
             }
             catch {
                 return batchFailure(requests, failure('invalid-output', metadata));
@@ -371,6 +359,7 @@ export class JevDecisionAdapter {
             finally {
                 this.observeParsed(encoded, parsed);
             }
+            metadata = this.responseMetadata(parsed, metadata);
             const normalized = normalizeBatchResponse(requests, parsed).map(answer => ({
                 questionId: answer.questionId,
                 observation: { ...answer.observation, ...metadata },

package/dist/src/decision/ask.js

@@ -495,6 +495,11 @@ export async function setupJev(input = {}, options = {}) {
         next: ['Run aiwg decision ask --question "<q>" --yes-no --json.'],
     };
     if (input.verify) {
+        // Verify the credential just saved, even when the shell still names an
+        // older token. Ordinary ask calls retain their environment precedence.
+        const verificationEnv = { ...environment };
+        delete verificationEnv.JEV_API_KEY;
+        delete verificationEnv.AIWG_DECISION_JEV_API_KEY;
         const verified = await askDecision({
             question: 'Is this Jev decision setup verification request well formed?',
             mode: { kind: 'yes-no' },
@@ -502,7 +507,7 @@ export async function setupJev(input = {}, options = {}) {
             timeoutMs: 15_000,
             passes: 1,
             escalationPasses: 1,
-        }, options);
+        }, { ...options, env: verificationEnv });
         result.verified = verified.status === 'answered';
         result.model = verified.model;
         result.usage = verified.usage;

package/dist/src/decision/benchmark.js

@@ -57,7 +57,7 @@ export function benchmarkComparison(capture, pricing) {
             return `| Jev, ${passes} pass${passes === 1 ? '' : 'es'} | ${display(t.input)} | n/a | ${display(t.output)} | ${display(t.input === null || t.output === null ? null : t.input + t.output)} | ${t.latency.toFixed(1)} | ${money(t.cost)} |`;
         }),
         `| ${capture.baselineLabel.replace(/[|\r\n]/g, ' ')} | ${display(baseline.input)} | ${display(baseline.cached)} | ${display(baseline.output)} | ${display(baseline.input === null || baseline.output === null ? null : baseline.input + baseline.output)} | ${baseline.latency.toFixed(1)} | ${money(baseline.cost)} |`, '',
-        capture.rows.some(r => r.baseline.cost || r.jev.some(s => s.cost)) ? 'Captured costs use sourced rates recorded per observation; unknown costs remain unknown.' : pricing ? `Rates: decision.ask.cost.* (${pricing.source ?? 'manual'}, checked ${pricing.checked_at ?? 'unknown'}).` : 'Costs unknown: no explicit decision.ask.cost.* rates.',
+        capture.rows.some(r => r.baseline.cost || r.jev.some(s => s.cost)) ? 'Captured costs use provider-reported USD or sourced rates recorded per observation; unknown costs remain unknown.' : pricing ? `Rates: decision.ask.cost.* (${pricing.source ?? 'manual'}, checked ${pricing.checked_at ?? 'unknown'}).` : 'Costs unknown: no explicit decision.ask.cost.* rates.',
         'Costs use reported usage and explicit pricing assumptions, not subscription invoices.',
         'Standalone baseline requests do not measure the marginal cost of an inline LLM decision.',
     ];
@@ -116,6 +116,9 @@ function validCost(sample) {
     if (sample.cost === undefined)
         return true;
     const cost = sample.cost;
+    if (cost?.source === 'provider-reported')
+        return fields(cost, ['usd', 'price', 'source'])
+            && cost.price === null && typeof cost.usd === 'number' && Number.isFinite(cost.usd) && cost.usd >= 0;
     return fields(cost, ['usd', 'price']) && (cost.price === null ? cost.usd === null
         : validPrice(cost.price) && cost.price.model === sample.model && cost.usd === tokenCost(sample.usage, cost.price));
 }
@@ -128,10 +131,18 @@ export async function collectBenchmark(dataset, options) {
         throw new Error('Positive maxUsd required for live collection.');
     if (!Number.isInteger(options.passes) || options.passes < 1 || options.passes > MAX_BENCHMARK_PASSES)
         throw new Error('passes must be 1..20.');
+    if (options.jevCapture && options.extendCapture)
+        throw new Error('Cannot combine Jev reuse and capture extension.');
     const cases = splitBenchmarkHoldout(dataset, options.holdout ?? 0.3, options.seed ?? '3291');
     const prior = options.extendCapture;
     if (prior)
         validateBenchmarkCapture(cases, prior);
+    const reused = options.jevCapture;
+    if (reused) {
+        validateBenchmarkCapture(cases, reused);
+        if (reused.rows.length !== cases.length || reused.rows.some(row => row.jev.length !== options.passes))
+            throw new Error('Reused Jev capture must contain every case with the same pass count.');
+    }
     if (typeof options.baselineLabel !== 'string' || !options.baselineLabel.trim() || options.baselineLabel.length > 200
         || prior && prior.baselineLabel !== options.baselineLabel)
         throw new Error('Invalid or changed baseline label.');
@@ -147,7 +158,7 @@ export async function collectBenchmark(dataset, options) {
         throw new Error('Extension cannot remove existing passes.');
     const planned = cases.reduce((sum, c) => {
         const row = rows.find(r => r.id === c.id);
-        return sum + (row ? 0 : 1) + Math.max(0, options.passes - (row?.jev.length ?? 0));
+        return sum + (row ? 0 : 1) + (reused ? 0 : Math.max(0, options.passes - (row?.jev.length ?? 0)));
     }, 0);
     if (planned > options.maxCalls)
         throw new Error(`Insufficient maxCalls: need ${planned}; no providers invoked.`);
@@ -177,7 +188,7 @@ export async function collectBenchmark(dataset, options) {
         return capture;
     }
     const environment = options.env ?? process.env;
-    if (!options.jev && planned > 0 && cases.some(c => (rows.find(r => r.id === c.id)?.jev.length ?? 0) < options.passes)
+    if (!reused && !options.jev && planned > 0 && cases.some(c => (rows.find(r => r.id === c.id)?.jev.length ?? 0) < options.passes)
         && !(environment.JEV_API_KEY?.trim() || environment.AIWG_DECISION_JEV_API_KEY?.trim()))
         throw new Error('Live benchmark requires JEV_API_KEY or AIWG_DECISION_JEV_API_KEY in the caller environment.');
     const jev = options.jev ?? (async (input) => {
@@ -201,8 +212,9 @@ export async function collectBenchmark(dataset, options) {
         if (!validObservation(sample) || !modeAnswer(c, sample))
             throw new Error(`Invalid provider observation: ${c.id}`);
         const price = (baseline ? options.baselinePrices ?? [] : jevPrices).find(p => p.model === sample.model) ?? null;
-        const usd = price ? tokenCost(sample.usage, price) : null;
-        sample.cost = { usd, price: structuredClone(price) };
+        sample.cost = result.cost?.source === 'provider-reported' && validCost(result)
+            ? structuredClone(result.cost) : { usd: price ? tokenCost(sample.usage, price) : null, price: structuredClone(price) };
+        const usd = sample.cost.usd;
         if (usd === null)
             stopReason = 'unknown-cost';
         else {
@@ -215,7 +227,8 @@ export async function collectBenchmark(dataset, options) {
     for (const c of cases) {
         let row = rows.find(r => r.id === c.id);
         if (!row) {
-            row = { id: c.id, baseline: await invoke(c, true), jev: [] };
+            row = { id: c.id, baseline: await invoke(c, true),
+                jev: structuredClone(reused?.rows.find(r => r.id === c.id).jev ?? []) };
             rows.push(row);
         }
         if (options.onCheckpoint)

package/dist/src/decision/qualification/gate-evidence.js

@@ -4,7 +4,7 @@ import { matchEvidenceDigest } from '../../gates/stats/index.js';
 import { CalibrationRegistry, calibrationArtifactDigest } from '../calibration/registry.js';
 import { validateCaseInventory } from './manifest.js';
 import { verifyQualificationSplits } from './quality.js';
-import { verifyDecisionStagedLoadRecord } from './load.js';
+import { DECISION_STAGED_LOAD_RESULT_VERSIONS, verifyDecisionStagedLoadRecord } from './load.js';
 import { validateReviewEvaluation } from '../review/validate.js';
 const range = (prefix, from, to) => Array.from({ length: to - from + 1 }, (_, index) => `${prefix}${String(from + index).padStart(2, '0')}`);
 export const DECISION_GATE_SUITES = {
@@ -34,7 +34,7 @@ export const DECISION_GATE_SUITES = {
 export const GATE_ARTIFACT_SCHEMAS = {
     'immutable-splits': 'decision-binary-benchmark-plan/v2',
     'calibration-qualified': 'decision-calibration-artifact/v1',
-    'load-manifest-qualified': 'decision-load-result/v1',
+    'load-manifest-qualified': 'decision-load-result/v2',
     'review-decision-recorded': 'decision-qualification-review/v1',
 };
 export const GATE_ARTIFACT_FLAGS = Object.keys(GATE_ARTIFACT_SCHEMAS);
@@ -127,7 +127,7 @@ function validCalibration(value, context) {
         && artifact.metrics.selectiveRisk <= artifact.profile.maximumSelectiveRisk;
 }
 function validLoadResult(value, context) {
-    if (!record(value) || value.schemaVersion !== GATE_ARTIFACT_SCHEMAS['load-manifest-qualified'])
+    if (!record(value) || !DECISION_STAGED_LOAD_RESULT_VERSIONS.includes(String(value.schemaVersion)))
         return false;
     // Legacy records remain readable, but only completed live v3 evidence bound to
     // this exact clean source revision can qualify the performance gate.
@@ -177,7 +177,9 @@ export function deriveGateEvidence(manifest, proof = {}) {
         const ref = manifest.gateArtifacts?.[flag];
         const versionOk = flag === 'immutable-splits'
             ? ref !== undefined && IMMUTABLE_SPLIT_VERSIONS.includes(ref.schemaVersion)
-            : ref !== undefined && ref.schemaVersion === GATE_ARTIFACT_SCHEMAS[flag];
+            : flag === 'load-manifest-qualified'
+                ? ref !== undefined && DECISION_STAGED_LOAD_RESULT_VERSIONS.includes(ref.schemaVersion)
+                : ref !== undefined && ref.schemaVersion === GATE_ARTIFACT_SCHEMAS[flag];
         flags[flag] = versionOk && ref !== undefined
             && typeof ref.artifact === 'string' && ref.artifact.length > 0 && sha256Pattern.test(ref.digest);
         if (flag === 'load-manifest-qualified') {

package/dist/src/decision/qualification/load-staged.js

@@ -4,7 +4,9 @@ import { JevDecisionAdapter, compileJevQuestion } from '../adapters/jev.js';
 import { DecisionAdmissionRegistry } from '../admission.js';
 import { CanonicalJsonByteEstimator } from '../context-plan.js';
 import { assertContextLiveSource } from '../context-live-qualification.js';
+import { tokenCost } from '../pricing.js';
 import { admissionControllerLoadDriver, decisionLoadArrivals, compareDecisionLoadBounds, decisionLoadManifestDigest, decisionLoadPolicy, runDecisionLoadHarness, } from './load.js';
+export const DECISION_STAGED_LOAD_RESULT_VERSIONS = ['decision-load-result/v1', 'decision-load-result/v2'];
 const finite = (value) => typeof value === 'number' && Number.isFinite(value) && value >= 0;
 const positive = (value) => finite(value) && value > 0;
 const exactCommit = (value) => /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(value);
@@ -289,7 +291,9 @@ export async function runDecisionStagedLoad(options) {
                 onObservation: (arrival, attempt, admission, observation) => {
                     const receipt = inFlight.get(`${arrival.ordinal}:${attempt}`);
                     Object.assign(receipt, { settledAtMs: clock.now(), admission: structuredClone(admission), status: observation.status, reason: observation.reason,
-                        usage: observation.usage, ...(observation.httpStatus === undefined ? {} : { httpStatus: observation.httpStatus }) });
+                        usage: observation.usage, ...(observation.httpStatus === undefined ? {} : { httpStatus: observation.httpStatus }),
+                        ...(observation.actualModel ? { servedModel: observation.actualModel } : {}),
+                        ...(observation.requestId ? { requestId: observation.requestId } : {}) });
                     inFlight.delete(`${arrival.ordinal}:${attempt}`);
                     guard.observe(arrival.providerId, observation, receipt.tokens, receipt.costUsd);
                 },
@@ -335,7 +339,7 @@ export async function runDecisionStagedLoad(options) {
         host: { hostname: hostname(), cpuClass: `${cpus().length} cores; ${cpus()[0]?.model ?? 'unknown'}`, memoryGiB: totalmem() / 2 ** 30,
             networkPath: options.networkPath, node: process.version, platform: process.platform, arch: process.arch },
         pricing: options.pricing, stages, receipts, samples, profileHistory: registry.profileHistory('load-harness'), breakerTransitions: transitions,
-        usage: guard.usage, stop: guard.stop, startedAtMs: start, elapsedMs: samples.at(-1)?.atMs ?? clock.now() - start });
+        reservedUsage: guard.usage, stop: guard.stop, startedAtMs: start, elapsedMs: samples.at(-1)?.atMs ?? clock.now() - start });
 }
 /** Token-bucket debit (burst plus refill), matching the admission controller's rate semantics. */
 function bucketDebit(receipts, capacity, periodMs, amount) {
@@ -400,9 +404,9 @@ export function compareDecisionStagedLoad(record) {
                 }
         }
     }
-    atMost('budget.maxUsd.stopAtFraction', m.budget.maxUsd * m.budget.stopAtFraction, record.usage.usd);
-    atMost('budget.maxCalls', m.budget.maxCalls, record.usage.calls);
-    atMost('budget.maxTokens', m.budget.maxTokens, record.usage.tokens);
+    atMost('budget.maxUsd.stopAtFraction', m.budget.maxUsd * m.budget.stopAtFraction, record.reservedUsage.usd);
+    atMost('budget.maxCalls', m.budget.maxCalls, record.reservedUsage.calls);
+    atMost('budget.maxTokens', m.budget.maxTokens, record.reservedUsage.tokens);
     atMost('budget.maxWallClockSeconds', m.budget.maxWallClockSeconds, record.elapsedMs / 1000);
     atMost('maximumSampleGapMs', m.bounds.maximumSampleGapMs, maximum(record.samples.slice(1).map((s, i) => s.atMs - record.samples[i].atMs)));
     const endingAt = record.startedAtMs + record.elapsedMs;
@@ -440,10 +444,29 @@ export function compareDecisionStagedLoad(record) {
     atMost('stop.maximumCrossPrincipalQuotaViolations', 0, violations);
     return out;
 }
+function reportedUsage(receipts, pricing) {
+    const sum = (values) => values.reduce((total, value) => total === null || value === null ? null : total + value, 0);
+    const inputs = receipts.map(r => r.usage.inputTokens);
+    const outputs = receipts.map(r => r.usage.outputTokens);
+    const totals = receipts.map(r => r.usage.inputTokens === null || r.usage.outputTokens === null ? null : r.usage.inputTokens + r.usage.outputTokens);
+    const inputTokens = sum(inputs);
+    const outputTokens = sum(outputs);
+    // The request is pinned to the priced model; an explicitly different served model has no applicable rate.
+    const costs = receipts.map(r => r.usage.inputTokens === null || r.usage.outputTokens === null
+        || (r.servedModel !== undefined && r.servedModel !== pricing.jev_model) ? null
+        : tokenCost(r.usage, { inputPerMillionUsd: pricing.jev_input_per_mtok, outputPerMillionUsd: pricing.jev_output_per_mtok }));
+    const knownSum = (values) => values.length > 0 && values.every(v => v === null)
+        ? null : sum(values.filter(v => v !== null));
+    return { calls: receipts.length, inputTokens, outputTokens, tokens: inputTokens === null || outputTokens === null ? null : inputTokens + outputTokens,
+        usd: sum(costs), incompleteCalls: costs.filter(cost => cost === null).length,
+        knownSubtotal: { inputTokens: knownSum(inputs), outputTokens: knownSum(outputs), tokens: knownSum(totals), usd: knownSum(costs) } };
+}
 export function decisionStagedLoadResultRecord(input) {
     const manifest = readDecisionLoadManifest(input.manifestBytes);
     validateDecisionLoadManifestV3(manifest);
-    const payload = { ...input, schemaVersion: 'decision-load-result/v1', kind: 'load-manifest-qualified',
+    validateDecisionLoadPricing(input.pricing, manifest.model);
+    const payload = { ...input, schemaVersion: 'decision-load-result/v2', kind: 'load-manifest-qualified',
+        reportedUsage: reportedUsage(input.receipts, input.pricing),
         manifest, manifestDigest: decisionLoadManifestDigest(input.manifestBytes) };
     for (const key of ['digest', 'comparisons', 'passed', 'queueWaitDistribution', 'retries'])
         delete payload[key];
@@ -461,7 +484,7 @@ export function decisionStagedLoadResultRecord(input) {
 export function verifyDecisionStagedLoadRecord(value, sourceCommit) {
     try {
         const r = value;
-        if (!r || r.schemaVersion !== 'decision-load-result/v1' || r.kind !== 'load-manifest-qualified' || r.mode !== 'staged-provider'
+        if (!r || !DECISION_STAGED_LOAD_RESULT_VERSIONS.includes(r.schemaVersion) || r.kind !== 'load-manifest-qualified' || r.mode !== 'staged-provider'
             || r.execution !== 'live' || r.dirty !== false || !exactCommit(r.sourceCommit) || (sourceCommit !== undefined && sourceCommit !== r.sourceCommit)
             || r.stop !== null || !r.passed || !finite(r.startedAtMs) || !r.host.networkPath || !r.host.cpuClass || !positive(r.host.memoryGiB))
             return false;
@@ -512,8 +535,17 @@ export function verifyDecisionStagedLoadRecord(value, sourceCommit) {
             || !positive(receipt.tokens) || !finite(receipt.costUsd) || !finite(receipt.admittedAtMs) || receipt.settledAtMs < receipt.admittedAtMs
             || receipt.admission.decision !== 'admit' || receipt.costUsd !== price(receipt.tokens, r.pricing)))
             return false;
-        if (r.usage.calls !== r.receipts.length || r.usage.tokens !== r.receipts.reduce((sum, receipt) => sum + receipt.tokens, 0)
-            || Math.abs(r.usage.usd - r.receipts.reduce((sum, receipt) => sum + receipt.costUsd, 0)) > 1e-9)
+        const reservedUsage = r.schemaVersion === 'decision-load-result/v1' ? r.usage : r.reservedUsage;
+        if (!reservedUsage || ![reservedUsage.calls, reservedUsage.tokens, reservedUsage.usd].every(finite)
+            || reservedUsage.calls !== r.receipts.length || reservedUsage.tokens !== r.receipts.reduce((sum, receipt) => sum + receipt.tokens, 0)
+            || Math.abs(reservedUsage.usd - r.receipts.reduce((sum, receipt) => sum + receipt.costUsd, 0)) > 1e-9)
+            return false;
+        if (r.schemaVersion === 'decision-load-result/v2' && r.receipts.some(receipt => !receipt.usage
+            || ![receipt.usage.inputTokens, receipt.usage.outputTokens].every(v => v === null || (Number.isSafeInteger(v) && v >= 0))
+            || (receipt.usage.inputTokens ?? 0) + (receipt.usage.outputTokens ?? 0) > receipt.tokens
+            || (receipt.usage.costUsd !== null && (!finite(receipt.usage.costUsd) || receipt.usage.costUsd > receipt.costUsd + 1e-12))
+            || (receipt.servedModel !== undefined && (typeof receipt.servedModel !== 'string' || !receipt.servedModel))
+            || (receipt.requestId !== undefined && (typeof receipt.requestId !== 'string' || !receipt.requestId))))
             return false;
         if (!r.samples.every((sample, index) => finite(sample.atMs) && finite(sample.residentMemoryMiB) && finite(sample.heapUsedMiB)
             && finite(sample.cpuPercentOneCore) && finite(sample.active) && finite(sample.queued) && (index === 0 ? sample.atMs === 0 : sample.atMs >= r.samples[index - 1].atMs
@@ -529,7 +561,12 @@ export function verifyDecisionStagedLoadRecord(value, sourceCommit) {
             || change?.kind !== 'change' || change.profileVersion !== manifest.profileVersion || change.digest !== profileDigest(manifest.workspace, manifest.providers)
             || rollback?.kind !== 'rollback' || rollback.profileVersion !== initial.profileVersion || rollback.digest !== initial.digest)
             return false;
-        const rebuilt = decisionStagedLoadResultRecord(r);
+        const rebuilt = decisionStagedLoadResultRecord({ ...r, reservedUsage });
+        if (r.schemaVersion === 'decision-load-result/v1') {
+            const { reservedUsage: _, reportedUsage: __, digest: ___, ...legacy } = rebuilt;
+            const legacyBody = { ...legacy, schemaVersion: r.schemaVersion };
+            return rebuilt.passed && canonicalJson({ ...legacyBody, digest: decisionLoadManifestDigest(canonicalJson(legacyBody)) }) === canonicalJson(r);
+        }
         return rebuilt.passed && canonicalJson(rebuilt) === canonicalJson(r);
     }
     catch {