@aiwg/cli 2026.9.19 → 2026.9.21

package/dist/src/decision/context-plan.js

@@ -0,0 +1,234 @@
+import { createHash } from 'node:crypto';
+import { canonicalJson } from '../security/artifact-trust.js';
+export class ContextPlanError extends Error {
+    reason;
+    details;
+    constructor(reason, message, details = {}) {
+        super(message);
+        this.reason = reason;
+        this.details = details;
+        this.name = 'ContextPlanError';
+    }
+}
+/** Conservative, deterministic fallback; it does not claim vendor-tokenizer equivalence. */
+export class CanonicalJsonByteEstimator {
+    version;
+    bytesPerToken;
+    id;
+    constructor(version = '1.0.0', bytesPerToken = 3) {
+        this.version = version;
+        this.bytesPerToken = bytesPerToken;
+        if (!Number.isSafeInteger(bytesPerToken) || bytesPerToken < 1) {
+            throw new ContextPlanError('invalid-profile', 'bytesPerToken must be a positive integer');
+        }
+        // A different byte/token ratio is a different estimator, even if its caller reuses a version.
+        this.id = bytesPerToken === 3 ? 'canonical-json-utf8-ceil' : `canonical-json-utf8-ceil-bpt${bytesPerToken}`;
+    }
+    estimate(value) {
+        const serializedBytes = Buffer.byteLength(canonicalJson(value), 'utf8');
+        return { serializedBytes, tokens: Math.ceil(serializedBytes / this.bytesPerToken) };
+    }
+}
+export function planDecisionContext(input, profile, estimator) {
+    validate(input, profile, estimator);
+    const effectiveAggregateTokens = effectiveLimit(profile.limits.aggregateTokens, profile.safetyMarginBps);
+    const effectiveLongestTokens = effectiveLimit(profile.limits.stateAndLongestQuestionTokens, profile.safetyMarginBps);
+    const state = checkedEstimate(estimator, input.authorizedState);
+    if (state.tokens + profile.requestEnvelopeTokens > effectiveAggregateTokens
+        || state.tokens + profile.requestEnvelopeTokens > effectiveLongestTokens) {
+        throw new ContextPlanError('oversized-state', 'authorized state cannot fit the effective provider limits', {
+            stateTokens: state.tokens, requestEnvelopeTokens: profile.requestEnvelopeTokens,
+            effectiveAggregateTokens, effectiveStateAndLongestQuestionTokens: effectiveLongestTokens,
+        });
+    }
+    const sorted = [...input.questions].sort((left, right) => left.id < right.id ? -1 : left.id > right.id ? 1 : 0);
+    const estimates = new Map(sorted.map(question => [question.id, checkedEstimate(estimator, question.entry)]));
+    for (const question of sorted) {
+        const tokens = estimates.get(question.id).tokens;
+        if (state.tokens + tokens + profile.requestEnvelopeTokens > effectiveLongestTokens
+            || state.tokens + tokens + profile.requestEnvelopeTokens > effectiveAggregateTokens) {
+            throw new ContextPlanError('oversized-question', `question '${question.id}' cannot fit with the authorized state`, {
+                questionId: question.id, questionTokens: tokens, stateTokens: state.tokens,
+                effectiveAggregateTokens, effectiveStateAndLongestQuestionTokens: effectiveLongestTokens,
+            });
+        }
+    }
+    const waves = dependencyWaves(sorted);
+    const allQuestionTokens = sorted.reduce((sum, question) => sum + estimates.get(question.id).tokens, 0);
+    const longestQuestionTokens = sorted.reduce((max, question) => Math.max(max, estimates.get(question.id).tokens), 0);
+    const rawAggregate = state.tokens + allQuestionTokens + profile.requestEnvelopeTokens;
+    const rawLongest = state.tokens + longestQuestionTokens + profile.requestEnvelopeTokens;
+    const stateDigest = digest(input.authorizedState);
+    const partitions = [];
+    for (const [wave, waveQuestions] of waves.entries()) {
+        const groups = new Map();
+        for (const question of waveQuestions) {
+            const key = question.compatibilityKey ?? 'default';
+            const group = groups.get(key) ?? [];
+            group.push(question);
+            groups.set(key, group);
+        }
+        for (const key of [...groups.keys()].sort()) {
+            const pending = groups.get(key);
+            let current = [];
+            let currentTokens = state.tokens + profile.requestEnvelopeTokens;
+            const flush = () => {
+                if (!current.length)
+                    return;
+                const questionTokens = Object.fromEntries(current.map(question => [question.id, estimates.get(question.id).tokens]));
+                const aggregateTokens = state.tokens + profile.requestEnvelopeTokens
+                    + Object.values(questionTokens).reduce((sum, tokens) => sum + tokens, 0);
+                const partitionLongest = Math.max(...Object.values(questionTokens));
+                const split = pending.length !== current.length;
+                const reason = wave > 0 ? 'dependency-wave' : split ? 'aggregate-limit-partition' : 'fits-original-group';
+                const questionIds = current.map(question => question.id);
+                partitions.push({
+                    id: `ctx-w${wave}-${key.replace(/[^A-Za-z0-9_.-]/g, '_')}-${String(partitions.length + 1).padStart(4, '0')}`,
+                    wave, compatibilityKey: key, subject: input.subject, stateDigest, questionIds,
+                    questionDigests: Object.fromEntries(current.map(question => [question.id, digest(question.entry)])),
+                    questionDependencies: Object.fromEntries(current.map(question => [
+                        question.id, [...new Set(question.dependsOn ?? [])].sort(),
+                    ])),
+                    estimate: { stateTokens: state.tokens, questionTokens, longestQuestionTokens: partitionLongest,
+                        aggregateTokens, stateAndLongestQuestionTokens: state.tokens + profile.requestEnvelopeTokens + partitionLongest },
+                    reason,
+                });
+                current = [];
+                currentTokens = state.tokens + profile.requestEnvelopeTokens;
+            };
+            for (const question of pending) {
+                const tokens = estimates.get(question.id).tokens;
+                if (current.length && currentTokens + tokens > effectiveAggregateTokens)
+                    flush();
+                current.push(question);
+                currentTokens += tokens;
+            }
+            flush();
+        }
+    }
+    const profileDigest = digest(profile);
+    const inputDigest = digest({ ...input, questions: sorted.map(question => question.dependsOn
+            ? { ...question, dependsOn: [...new Set(question.dependsOn)].sort() }
+            : { ...question }) });
+    const assumptionsDigest = digest({ profileDigest, estimator: { id: estimator.id, version: estimator.version } });
+    const withoutDigest = {
+        schemaVersion: 'decision-context-plan/v1', assumptionsDigest, inputDigest,
+        subject: input.subject, authorizationDigest: input.authorizationDigest,
+        incompleteContext: input.incompleteContext, automaticActionAllowed: !input.incompleteContext,
+        estimator: { id: estimator.id, version: estimator.version },
+        providerProfile: { id: profile.id, version: profile.version, digest: profileDigest },
+        limits: { documentedAggregateTokens: profile.limits.aggregateTokens,
+            documentedStateAndLongestQuestionTokens: profile.limits.stateAndLongestQuestionTokens,
+            safetyMarginBps: profile.safetyMarginBps, effectiveAggregateTokens,
+            effectiveStateAndLongestQuestionTokens: effectiveLongestTokens },
+        rawEstimate: { stateTokens: state.tokens, allQuestionTokens, longestQuestionTokens,
+            aggregateTokens: rawAggregate, stateAndLongestQuestionTokens: rawLongest },
+        partitions,
+    };
+    return { ...withoutDigest, planDigest: digest(withoutDigest) };
+}
+/** Replanning is intentional: a changed profile, estimator or authorized input invalidates the old plan. */
+export function assertContextPlanCurrent(plan, input, profile, estimator) {
+    const current = planDecisionContext(input, profile, estimator);
+    if (current.planDigest !== plan.planDigest) {
+        throw new ContextPlanError('stale-plan', 'context plan assumptions or authorized input changed', {
+            plannedDigest: plan.planDigest, currentDigest: current.planDigest,
+        });
+    }
+}
+/** Provider usage augments evidence and never mutates or recomputes the original plan. */
+export function recordContextActualUsage(plan, partitionId, actualInputTokens, questionId) {
+    const partition = plan.partitions.find(candidate => candidate.id === partitionId);
+    if (!partition)
+        throw new ContextPlanError('invalid-input', `unknown context partition '${partitionId}'`);
+    if (!Number.isSafeInteger(actualInputTokens) || actualInputTokens < 0) {
+        throw new ContextPlanError('invalid-input', 'actualInputTokens must be a non-negative safe integer');
+    }
+    const questionIds = questionId === undefined ? [...partition.questionIds]
+        : typeof questionId === 'string' ? [questionId] : [...questionId];
+    if (!questionIds.length || new Set(questionIds).size !== questionIds.length
+        || questionIds.some(id => !partition.questionIds.includes(id))) {
+        throw new ContextPlanError('invalid-input', 'usage questions must be unique members of the context partition');
+    }
+    questionIds.sort();
+    const selected = new Set(questionIds);
+    const estimatedInputTokens = partition.estimate.aggregateTokens
+        - Object.entries(partition.estimate.questionTokens)
+            .filter(([id]) => !selected.has(id))
+            .reduce((sum, [, tokens]) => sum + tokens, 0);
+    const estimationErrorTokens = actualInputTokens - estimatedInputTokens;
+    return {
+        schemaVersion: 'decision-context-usage/v1', planDigest: plan.planDigest, partitionId, questionIds,
+        estimator: { ...plan.estimator }, providerProfile: { id: plan.providerProfile.id, version: plan.providerProfile.version },
+        estimatedInputTokens, actualInputTokens, estimationErrorTokens,
+        estimationErrorBps: actualInputTokens === 0 ? null : Math.round(estimationErrorTokens * 10_000 / actualInputTokens),
+    };
+}
+function validate(input, profile, estimator) {
+    if (!input.subject || !input.questions.length || !/^sha256:[0-9a-f]{64}$/.test(input.authorizationDigest)) {
+        throw new ContextPlanError('invalid-input', 'subject, questions, and a SHA-256 authorization digest are required');
+    }
+    if (!profile.id || !profile.version || !profile.estimator.id || !profile.estimator.version
+        || !Number.isSafeInteger(profile.limits.aggregateTokens) || profile.limits.aggregateTokens <= 0
+        || !Number.isSafeInteger(profile.limits.stateAndLongestQuestionTokens) || profile.limits.stateAndLongestQuestionTokens <= 0
+        || !Number.isSafeInteger(profile.requestEnvelopeTokens) || profile.requestEnvelopeTokens < 0
+        || !Number.isInteger(profile.safetyMarginBps) || profile.safetyMarginBps < 0 || profile.safetyMarginBps >= 10_000) {
+        throw new ContextPlanError('invalid-profile', 'provider context profile is incomplete or has invalid limits');
+    }
+    if (profile.estimator.id !== estimator.id || profile.estimator.version !== estimator.version) {
+        throw new ContextPlanError('estimator-profile-mismatch', 'provider profile was qualified with another estimator version');
+    }
+    const ids = new Set();
+    for (const question of input.questions) {
+        if (!question.id || question.subject !== input.subject || ids.has(question.id)) {
+            throw new ContextPlanError('invalid-input', 'question IDs must be unique and every question must preserve the plan subject');
+        }
+        ids.add(question.id);
+    }
+}
+function dependencyWaves(questions) {
+    const byId = new Map(questions.map(question => [question.id, question]));
+    const depths = new Map();
+    const visiting = new Set();
+    const depth = (id) => {
+        const known = depths.get(id);
+        if (known !== undefined)
+            return known;
+        if (visiting.has(id))
+            throw new ContextPlanError('dependency-error', `question dependency cycle includes '${id}'`);
+        visiting.add(id);
+        const question = byId.get(id);
+        let value = 0;
+        for (const dependency of [...new Set(question.dependsOn ?? [])].sort()) {
+            if (!byId.has(dependency))
+                throw new ContextPlanError('dependency-error', `question '${id}' has unknown dependency '${dependency}'`);
+            if (dependency === id)
+                throw new ContextPlanError('dependency-error', `question '${id}' depends on itself`);
+            value = Math.max(value, depth(dependency) + 1);
+        }
+        visiting.delete(id);
+        depths.set(id, value);
+        return value;
+    };
+    for (const question of questions)
+        depth(question.id);
+    const waves = [];
+    for (const question of questions)
+        (waves[depth(question.id)] ??= []).push(question);
+    return waves;
+}
+function checkedEstimate(estimator, value) {
+    const result = estimator.estimate(value);
+    if (!result || !Number.isSafeInteger(result.tokens) || result.tokens < 0
+        || !Number.isSafeInteger(result.serializedBytes) || result.serializedBytes < 0) {
+        throw new ContextPlanError('invalid-profile', 'estimator returned invalid token or byte counts');
+    }
+    return result;
+}
+function effectiveLimit(limit, marginBps) {
+    return Math.floor(limit * (10_000 - marginBps) / 10_000);
+}
+function digest(value) {
+    return `sha256:${createHash('sha256').update(canonicalJson(value)).digest('hex')}`;
+}
+//# sourceMappingURL=context-plan.js.map

package/dist/src/decision/context-qualification.js

@@ -0,0 +1,60 @@
+import { createHash } from 'node:crypto';
+import { canonicalJson } from '../security/artifact-trust.js';
+import { ContextPlanError, planDecisionContext, } from './context-plan.js';
+/** Retains a body-free, immutable comparison. Reject split samples: usage is per request, not per group. */
+export function assertContextQualified(qualification, profile, estimator) {
+    const digest = `sha256:${createHash('sha256').update(canonicalJson(profile)).digest('hex')}`;
+    const cases = qualification?.cases;
+    if (qualification?.schemaVersion !== 'decision-context-qualification/v1'
+        || qualification.profile.digest !== digest || qualification.profile.id !== profile.id
+        || qualification.profile.version !== profile.version || qualification.estimator.id !== estimator.id
+        || qualification.estimator.version !== estimator.version || !qualification.qualifiedForEnforcement
+        || qualification.reason !== 'provider-comparisons-within-margin' || !Array.isArray(cases) || !cases.length
+        || new Set(cases.map(c => c.caseId)).size !== cases.length
+        || cases.some(c => c.source !== 'provider' || !Number.isSafeInteger(c.actualInputTokens)
+            || !Number.isSafeInteger(c.estimatedInputTokens) || c.actualInputTokens < 0 || c.estimatedInputTokens < 0
+            || c.errorTokens !== c.actualInputTokens - c.estimatedInputTokens
+            || c.undercountBps !== (c.actualInputTokens === 0 ? 0
+                : Math.max(0, Math.ceil(c.errorTokens * 10_000 / c.actualInputTokens))))
+        || qualification.worstUndercountBps !== Math.max(...cases.map(c => c.undercountBps))
+        || qualification.worstUndercountBps > profile.safetyMarginBps) {
+        throw new ContextPlanError('rollout-unqualified', 'context enforcement requires matching provider-backed qualification');
+    }
+}
+export function compareContextUsage(comparisons, profile, estimator) {
+    if (!comparisons.length || new Set(comparisons.map(c => c.caseId)).size !== comparisons.length) {
+        throw new ContextPlanError('invalid-input', 'qualification requires unique nonempty comparison cases');
+    }
+    const cases = comparisons.map(sample => {
+        if (!sample.caseId || !sample.usageRef || !['provider', 'synthetic'].includes(sample.source)
+            || !Number.isSafeInteger(sample.actualInputTokens) || sample.actualInputTokens < 0) {
+            throw new ContextPlanError('invalid-input', 'comparison requires an ID, usage reference and nonnegative provider usage');
+        }
+        const plan = planDecisionContext(sample.input, profile, estimator);
+        if (plan.partitions.length !== 1 || plan.partitions[0].questionIds.length !== sample.input.questions.length) {
+            throw new ContextPlanError('invalid-input', 'comparison must correspond to exactly one complete provider request');
+        }
+        const estimatedInputTokens = plan.partitions[0].estimate.aggregateTokens;
+        const errorTokens = sample.actualInputTokens - estimatedInputTokens;
+        return {
+            caseId: sample.caseId, source: sample.source, usageRef: sample.usageRef,
+            planDigest: plan.planDigest, estimatedInputTokens, actualInputTokens: sample.actualInputTokens,
+            errorTokens, undercountBps: sample.actualInputTokens === 0 ? 0
+                : Math.max(0, Math.ceil(errorTokens * 10_000 / sample.actualInputTokens)),
+        };
+    }).sort((a, b) => a.caseId.localeCompare(b.caseId, 'en'));
+    const worstUndercountBps = Math.max(...cases.map(c => c.undercountBps));
+    const providerOnly = cases.every(c => c.source === 'provider');
+    // If estimate is lower than actual by more than reserved margin, the effective limit may overflow.
+    const qualifiedForEnforcement = providerOnly && worstUndercountBps <= profile.safetyMarginBps;
+    return {
+        schemaVersion: 'decision-context-qualification/v1',
+        profile: { id: profile.id, version: profile.version,
+            digest: `sha256:${createHash('sha256').update(canonicalJson(profile)).digest('hex')}` },
+        estimator: { id: estimator.id, version: estimator.version }, cases, worstUndercountBps,
+        qualifiedForEnforcement,
+        reason: !providerOnly ? 'synthetic-only' : qualifiedForEnforcement
+            ? 'provider-comparisons-within-margin' : 'undercount-exceeds-margin',
+    };
+}
+//# sourceMappingURL=context-qualification.js.map

package/dist/src/decision/ensemble/aggregate.js

@@ -0,0 +1,215 @@
+import { admitEntry } from '../entry.js';
+import { compareEnsembleKeys, ensembleContractDigest, EnsembleContractError, validateEnsemblePolicy, } from './contract.js';
+/** Deterministic reference aggregation over already-recorded member results. It never dispatches.
+ * Member order does not matter: results are put in canonical (memberId, sampleIndex) order first,
+ * so every sum and tie-break runs in the same sequence for any permutation of the input. */
+export function aggregateEnsembleResults(policyInput, resultsInput, options = {}) {
+    const { policy, digest: policyDigest } = validateEnsemblePolicy(policyInput, options);
+    try {
+        admitEntry(resultsInput);
+    }
+    catch {
+        throw new EnsembleContractError('member results admission denied', 'admission');
+    }
+    const members = new Map(policy.members.map(member => [member.id, member]));
+    const results = [...resultsInput].sort((a, b) => compareEnsembleKeys(a.memberId, b.memberId) || a.sampleIndex - b.sampleIndex);
+    validateResults(policy, members, results);
+    const succeeded = results.filter(result => result.status === 'succeeded');
+    const n = succeeded.length;
+    const labels = labelSpace(policy);
+    const statistics = {
+        votes: null, meanProbability: null, meanDistribution: null, meanScore: null, medianScore: null, dispersion: null,
+    };
+    const { algorithm, tieRule } = policy.aggregation;
+    const { metric } = policy.disagreement;
+    let candidate = null;
+    let tie = false;
+    const votes = () => {
+        const counts = Object.fromEntries(labels.map(label => [label, 0]));
+        for (const result of succeeded)
+            counts[vote(policy, result)] += 1;
+        return counts;
+    };
+    const distributions = () => succeeded.map(result => distributionOf(policy, labels, result));
+    const meanOf = (items) => Object.fromEntries(labels.map(label => [label, n ? round(items.reduce((sum, item) => sum + item[label], 0) / n) : 0]));
+    const scores = () => succeeded.map(result => result.value);
+    const pick = (weights) => {
+        const top = Math.max(...labels.map(label => weights[label]));
+        const winners = labels.filter(label => weights[label] === top);
+        tie = winners.length > 1;
+        return n ? winners[0] : null;
+    };
+    if (algorithm === 'majority-v1' || metric === 'vote-share-v1' || metric === 'normalized-entropy-v1')
+        statistics.votes = votes();
+    if (policy.primitive === 'truth-probability' && (algorithm === 'mean-probability-v1' || metric === 'jensen-shannon-v1')) {
+        statistics.meanProbability = n ? round(succeeded.reduce((sum, result) => sum + result.value, 0) / n) : null;
+    }
+    if (policy.primitive === 'choice' && (algorithm === 'mean-probability-v1' || metric === 'jensen-shannon-v1'))
+        statistics.meanDistribution = meanOf(distributions());
+    if (policy.primitive === 'ordinal-score' && n) {
+        const values = scores();
+        const mean = values.reduce((sum, value) => sum + value, 0) / n;
+        statistics.meanScore = round(mean);
+        statistics.dispersion = round(Math.sqrt(values.reduce((sum, value) => sum + (value - mean) ** 2, 0) / n));
+        const sorted = [...values].sort((a, b) => a - b);
+        const middle = Math.floor(n / 2);
+        statistics.medianScore = round(n % 2 ? sorted[middle] : (sorted[middle - 1] + sorted[middle]) / 2);
+    }
+    if (algorithm === 'majority-v1')
+        candidate = pick(statistics.votes);
+    else if (algorithm === 'mean-probability-v1')
+        candidate = policy.primitive === 'choice' ? pick(statistics.meanDistribution) : statistics.meanProbability;
+    else if (algorithm === 'score-distribution-mean-v1')
+        candidate = statistics.meanScore;
+    else if (n) {
+        // score-median-v1: an even count with distinct middle values is a tie; the stable rule takes the lower value.
+        const sorted = scores().sort((a, b) => a - b);
+        const middle = Math.floor(n / 2);
+        tie = n % 2 === 0 && sorted[middle - 1] !== sorted[middle];
+        candidate = tie ? sorted[middle - 1] : statistics.medianScore;
+    }
+    const disagreementValue = n === 0 ? 1 : disagreement(policy, statistics, distributions, n);
+    const valueBps = Math.round(Math.min(1, Math.max(0, disagreementValue)) * 10_000);
+    const exceeded = valueBps > policy.disagreement.thresholdBps;
+    let disposition = 'accept';
+    let reason = 'aggregated';
+    if (n < policy.acceptance.minimumSuccessfulMembers) {
+        disposition = policy.acceptance.onInsufficientMembers;
+        reason = 'insufficient-members';
+    }
+    else if (tie && tieRule !== 'lowest-canonical-value') {
+        disposition = tieRule;
+        reason = 'tie';
+    }
+    else if (exceeded) {
+        disposition = policy.disagreement.onExceeded;
+        reason = 'disagreement-exceeded';
+    }
+    const contributing = succeeded.map(result => members.get(result.memberId));
+    const warnings = new Set();
+    if (results.some(result => result.status !== 'succeeded'))
+        warnings.add('member-failures-present');
+    if (contributing.some(member => !member.calibration))
+        warnings.add('uncalibrated-members');
+    if (n >= 2 && valueBps <= policy.acceptance.highAgreementWarningBps) {
+        warnings.add('high-agreement-not-correctness');
+        if (limitedIndependence(contributing))
+            warnings.add('shared-systematic-error-risk');
+    }
+    const payload = {
+        schemaVersion: 'decision-ensemble-aggregate/v1',
+        policy: { id: policy.id, version: policy.version, digest: policyDigest },
+        primitive: policy.primitive,
+        algorithm: { id: algorithm, version: versionOf(algorithm) },
+        semantics: 'stability-signal-not-correctness',
+        provenance: 'derived',
+        members: results.map(result => ({ memberId: result.memberId, sampleIndex: result.sampleIndex, status: result.status,
+            resultDigest: result.resultDigest, value: result.value })),
+        counts: { declared: results.length, succeeded: n, failed: results.filter(result => result.status === 'failed').length,
+            abstained: results.filter(result => result.status === 'abstained').length },
+        outcome: { disposition, value: disposition === 'accept' ? candidate : null, reason, tie, tieRule: tie ? tieRule : null },
+        statistics,
+        disagreement: { metric: { id: metric, version: versionOf(metric) }, valueBps, thresholdBps: policy.disagreement.thresholdBps, exceeded },
+        warnings: [...warnings].sort(compareEnsembleKeys),
+        correctnessGate: { status: 'not-satisfied', reason: 'agreement-is-not-correctness-evidence' },
+    };
+    return { ...payload, digest: ensembleContractDigest(payload) };
+}
+function validateResults(policy, members, results) {
+    const problems = [];
+    const seen = new Set();
+    const needsDistribution = policy.primitive === 'choice'
+        && (policy.aggregation.algorithm === 'mean-probability-v1' || policy.disagreement.metric === 'jensen-shannon-v1');
+    for (const result of results) {
+        const at = `result ${result.memberId}#${result.sampleIndex}`;
+        const member = members.get(result.memberId);
+        if (!member) {
+            problems.push(`${at} names an unknown member`);
+            continue;
+        }
+        if (!Number.isSafeInteger(result.sampleIndex) || result.sampleIndex < 0 || result.sampleIndex >= member.samples)
+            problems.push(`${at} is outside the planned samples`);
+        const key = `${result.memberId}\u0000${result.sampleIndex}`;
+        if (seen.has(key))
+            problems.push(`${at} is duplicated`);
+        seen.add(key);
+        if (!/^sha256:[0-9a-f]{64}$/.test(result.resultDigest))
+            problems.push(`${at} must pin its retained result lineage`);
+        if (!['succeeded', 'failed', 'abstained'].includes(result.status))
+            problems.push(`${at} has an unknown status`);
+        if (result.status !== 'succeeded') {
+            if (result.value !== null || result.distribution !== null)
+                problems.push(`${at} is not successful and cannot carry a value`);
+            continue;
+        }
+        if (result.uncertaintyProfile !== member.uncertaintyProfile)
+            problems.push(`${at} uncertainty profile does not match its member`);
+        const value = result.value;
+        if (policy.primitive === 'choice' && (typeof value !== 'string' || !policy.options.includes(value)))
+            problems.push(`${at} is not a declared choice option`);
+        if (policy.primitive === 'truth-probability' && (typeof value !== 'number' || !(value >= 0 && value <= 1)))
+            problems.push(`${at} is not a probability`);
+        if (policy.primitive === 'ordinal-score' && (typeof value !== 'number' || !(value >= 0 && value <= policy.levels - 1)))
+            problems.push(`${at} is outside the score levels`);
+        if (result.distribution !== null) {
+            const entries = Object.entries(result.distribution);
+            const allowed = policy.primitive === 'choice' ? policy.options : ['false', 'true'];
+            if (policy.primitive === 'ordinal-score' || entries.some(([label, p]) => !allowed.includes(label) || !(p >= 0 && p <= 1))
+                || Math.abs(entries.reduce((sum, [, p]) => sum + p, 0) - 1) > 1e-6)
+                problems.push(`${at} has an invalid distribution`);
+        }
+        else if (needsDistribution)
+            problems.push(`${at} needs a provider distribution for ${policy.aggregation.algorithm}/${policy.disagreement.metric}`);
+    }
+    const planned = policy.members.reduce((sum, member) => sum + member.samples, 0);
+    if (results.length !== planned)
+        problems.push(`every planned sample must be recorded, including failures (${results.length}/${planned})`);
+    if (problems.length)
+        throw new EnsembleContractError(`member results rejected: ${problems[0]}`, 'semantic', problems);
+}
+function labelSpace(policy) {
+    return policy.primitive === 'choice' ? [...policy.options].sort(compareEnsembleKeys) : policy.primitive === 'truth-probability' ? ['false', 'true'] : [];
+}
+/** Noul votes true at p >= 0.5; the threshold is part of majority-v1 and vote-share-v1. */
+function vote(policy, result) {
+    return policy.primitive === 'truth-probability' ? (result.value >= 0.5 ? 'true' : 'false') : result.value;
+}
+function distributionOf(policy, labels, result) {
+    if (policy.primitive === 'truth-probability') {
+        const p = result.value;
+        return { false: 1 - p, true: p };
+    }
+    return Object.fromEntries(labels.map(label => [label, result.distribution?.[label] ?? 0]));
+}
+function entropyBits(weights) {
+    return -weights.reduce((sum, p) => sum + (p > 0 ? p * Math.log2(p) : 0), 0);
+}
+function disagreement(policy, statistics, distributions, n) {
+    const metric = policy.disagreement.metric;
+    if (metric === 'vote-share-v1')
+        return 1 - Math.max(...Object.values(statistics.votes)) / n;
+    if (metric === 'normalized-entropy-v1') {
+        const counts = Object.values(statistics.votes);
+        return entropyBits(counts.map(count => count / n)) / Math.log2(counts.length);
+    }
+    if (metric === 'jensen-shannon-v1') {
+        const items = distributions();
+        const labels = Object.keys(items[0] ?? {});
+        const scale = Math.log2(Math.min(n, labels.length));
+        if (!(scale > 0))
+            return 0;
+        const mean = labels.map(label => items.reduce((sum, item) => sum + item[label], 0) / n);
+        const within = items.reduce((sum, item) => sum + entropyBits(labels.map(label => item[label])), 0) / n;
+        return (entropyBits(mean) - within) / scale;
+    }
+    // score-dispersion-v1: population standard deviation over its maximum, half the level span.
+    return (statistics.dispersion ?? 0) / ((policy.levels - 1) / 2);
+}
+function limitedIndependence(members) {
+    const identities = new Set(members.map(member => `${member.model.provider}\u0000${member.model.backend}\u0000${member.model.pinnedVersion}`));
+    return identities.size < 2 || members.every(member => member.memberType === 'repeated-sample' || member.memberType === 'prompt-adapter');
+}
+function versionOf(id) { return id.slice(id.lastIndexOf('-') + 1); }
+/** Removes binary floating-point noise from derived statistics; raw member values are retained unchanged. */
+function round(value) { return Math.round(value * 1e12) / 1e12; }
+//# sourceMappingURL=aggregate.js.map