@aiwg/cli 2026.9.20 → 2026.9.21

package/dist/src/decision/calibration/receipts.js

@@ -0,0 +1,130 @@
+import { createHash } from 'node:crypto';
+import { mkdir, open, readFile, readdir } from 'node:fs/promises';
+import { join } from 'node:path';
+export class CalibrationGovernanceReceiptError extends Error {
+}
+function canonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(',')}]`;
+    if (value && typeof value === 'object')
+        return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => `${JSON.stringify(key)}:${canonical(item)}`).join(',')}}`;
+    return JSON.stringify(value);
+}
+function digest(value) {
+    return `sha256:${createHash('sha256').update(canonical(value)).digest('hex')}`;
+}
+function validDigest(value) { return /^sha256:[0-9a-f]{64}$/.test(value); }
+function immutable(value) {
+    if (value && typeof value === 'object') {
+        for (const item of Object.values(value))
+            immutable(item);
+        Object.freeze(value);
+    }
+    return value;
+}
+function nonEmpty(value, name) {
+    if (!value.trim())
+        throw new CalibrationGovernanceReceiptError(`${name} must not be empty`);
+}
+export function calibrationGovernanceReceiptDigest(receipt) {
+    return digest(receipt);
+}
+export function createCalibrationGovernanceReceipt(draft) {
+    const payload = {
+        schemaVersion: 'decision-calibration-governance-receipt/v1', ...structuredClone(draft),
+    };
+    const receipt = { ...payload, digest: calibrationGovernanceReceiptDigest(payload) };
+    validateCalibrationGovernanceReceipt(receipt);
+    return immutable(receipt);
+}
+export function validateCalibrationGovernanceReceipt(receipt) {
+    if (receipt.schemaVersion !== 'decision-calibration-governance-receipt/v1')
+        throw new CalibrationGovernanceReceiptError('unsupported governance receipt schema');
+    for (const [name, value] of Object.entries({ receiptId: receipt.receiptId, alias: receipt.alias,
+        approvalReference: receipt.approvalReference, evaluationReportId: receipt.reviewedEvidence.evaluationIntegrityReport.id,
+        calibrationArtifactId: receipt.reviewedEvidence.calibrationArtifact.id }))
+        nonEmpty(value, name);
+    if (!Number.isSafeInteger(receipt.sequence) || receipt.sequence < 1)
+        throw new CalibrationGovernanceReceiptError('sequence must be a positive safe integer');
+    if (!Number.isSafeInteger(receipt.from.aliasRevision) || receipt.from.aliasRevision < 1
+        || !Number.isSafeInteger(receipt.to.aliasRevision) || receipt.to.aliasRevision < 1)
+        throw new CalibrationGovernanceReceiptError('alias revisions must be positive safe integers');
+    if ((receipt.kind === 'promotion' ? 'promote' : 'rollback') !== receipt.action)
+        throw new CalibrationGovernanceReceiptError('receipt kind and action must agree');
+    if (!receipt.reasons.length || receipt.reasons.some(reason => !reason.trim()))
+        throw new CalibrationGovernanceReceiptError('receipt reasons must be explicit');
+    if (!Number.isFinite(Date.parse(receipt.recordedAt)))
+        throw new CalibrationGovernanceReceiptError('recordedAt must be a valid date-time');
+    const digests = [receipt.from.identityDigest, receipt.to.identityDigest,
+        receipt.reviewedEvidence.evaluationIntegrityReport.digest, receipt.reviewedEvidence.calibrationArtifact.digest,
+        receipt.reviewedEvidence.compatibilityRelation?.digest, receipt.previousReceiptDigest, receipt.digest].filter((item) => item !== null && item !== undefined);
+    if (digests.some(item => !validDigest(item)))
+        throw new CalibrationGovernanceReceiptError('receipt digests must be lowercase sha256 values');
+    const { digest: claimed, ...payload } = receipt;
+    if (claimed !== calibrationGovernanceReceiptDigest(payload))
+        throw new CalibrationGovernanceReceiptError('governance receipt digest mismatch');
+}
+/** Append-only, fsync-backed receipt ledger. A competing sequence writer fails closed. */
+export class FileCalibrationGovernanceReceiptStore {
+    directory;
+    constructor(directory) {
+        this.directory = directory;
+    }
+    async readHistory() {
+        let names;
+        try {
+            names = await readdir(this.directory);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return [];
+            throw error;
+        }
+        const receiptNames = names.filter(name => /^\d{12}\.json$/.test(name)).sort();
+        const history = [];
+        for (const [index, name] of receiptNames.entries()) {
+            const receipt = JSON.parse(await readFile(join(this.directory, name), 'utf8'));
+            validateCalibrationGovernanceReceipt(receipt);
+            if (receipt.sequence !== index + 1 || name !== `${String(receipt.sequence).padStart(12, '0')}.json`)
+                throw new CalibrationGovernanceReceiptError('governance receipt sequence gap');
+            const previous = history.at(-1);
+            if (receipt.previousReceiptDigest !== (previous?.digest ?? null))
+                throw new CalibrationGovernanceReceiptError('governance receipt hash chain mismatch');
+            history.push(receipt);
+        }
+        return structuredClone(history);
+    }
+    async append(receipt) {
+        validateCalibrationGovernanceReceipt(receipt);
+        const history = await this.readHistory();
+        if (receipt.sequence !== history.length + 1 || receipt.previousReceiptDigest !== (history.at(-1)?.digest ?? null)) {
+            throw new CalibrationGovernanceReceiptError('receipt does not extend the current ledger head');
+        }
+        await mkdir(this.directory, { recursive: true, mode: 0o700 });
+        const target = join(this.directory, `${String(receipt.sequence).padStart(12, '0')}.json`);
+        let file;
+        try {
+            file = await open(target, 'wx', 0o600);
+        }
+        catch (error) {
+            if (error.code === 'EEXIST')
+                throw new CalibrationGovernanceReceiptError('receipt sequence was concurrently claimed');
+            throw error;
+        }
+        try {
+            await file.writeFile(`${JSON.stringify(receipt)}\n`);
+            await file.sync();
+        }
+        finally {
+            await file.close();
+        }
+        const directory = await open(this.directory, 'r');
+        try {
+            await directory.sync();
+        }
+        finally {
+            await directory.close();
+        }
+    }
+}
+//# sourceMappingURL=receipts.js.map

package/dist/src/decision/calibration/registry.js

@@ -0,0 +1,258 @@
+import { createHash } from 'node:crypto';
+export class CalibrationRegistryError extends Error {
+}
+function canonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(',')}]`;
+    if (value && typeof value === 'object')
+        return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => `${JSON.stringify(key)}:${canonical(item)}`).join(',')}}`;
+    return JSON.stringify(value);
+}
+export function calibrationIdentityDigest(identity) {
+    return `sha256:${createHash('sha256').update(canonical(identity)).digest('hex')}`;
+}
+export function calibrationArtifactDigest(artifact) {
+    return `sha256:${createHash('sha256').update(canonical(artifact)).digest('hex')}`;
+}
+function immutable(value) { return Object.freeze(structuredClone(value)); }
+function validDate(value) { const time = Date.parse(value); if (!Number.isFinite(time))
+    throw new CalibrationRegistryError(`invalid date: ${value}`); return time; }
+function nonEmpty(value, name) { if (!value.trim())
+    throw new CalibrationRegistryError(`${name} must not be empty`); }
+export class CalibrationRegistry {
+    artifacts = new Map();
+    artifactDigests = new Map();
+    relations = [];
+    aliases = new Map();
+    drift = [];
+    eligibility = new Map();
+    pins = new Map();
+    registerArtifact(input) {
+        validateArtifact(input);
+        const existing = this.artifacts.get(input.id);
+        if (existing && canonical(existing) !== canonical(input))
+            throw new CalibrationRegistryError(`artifact '${input.id}' is immutable`);
+        const digestOwner = this.artifactDigests.get(input.digest);
+        if (digestOwner && digestOwner !== input.id)
+            throw new CalibrationRegistryError(`artifact digest already belongs to '${digestOwner}'`);
+        const artifact = immutable(input);
+        this.artifacts.set(artifact.id, artifact);
+        this.artifactDigests.set(artifact.digest, artifact.id);
+        return structuredClone(artifact);
+    }
+    registerRelation(input) {
+        if (input.state === 'approved-compatible' && !input.approvalReference)
+            throw new CalibrationRegistryError('approved compatibility requires an approval reference');
+        validDate(input.effectiveAt);
+        if (input.expiresAt)
+            validDate(input.expiresAt);
+        if (this.relations.some(item => item.id === input.id && canonical(item) !== canonical(input)))
+            throw new CalibrationRegistryError(`relation '${input.id}' is immutable`);
+        if (!this.relations.some(item => item.id === input.id))
+            this.relations.push(immutable(input));
+        return structuredClone(input);
+    }
+    observeAlias(alias, identity, at) {
+        nonEmpty(alias, 'alias');
+        validDate(at);
+        const digest = calibrationIdentityDigest(identity);
+        const history = this.aliases.get(alias) ?? [];
+        const previous = history.at(-1);
+        if (previous?.actualIdentityDigest === digest && previous.kind !== 'retired')
+            return structuredClone(previous);
+        if (previous && previous.kind !== 'retired')
+            this.drift.push(immutable({
+                id: `${alias}:drift:${history.length + 1}`, alias, previousIdentityDigest: previous.actualIdentityDigest,
+                observedIdentityDigest: digest, previousActualModel: previous.actualModel, observedActualModel: identity.actualModel, detectedAt: at,
+            }));
+        const event = immutable({ revision: history.length + 1, alias, actualIdentityDigest: digest,
+            actualModel: identity.actualModel, recordedAt: at, kind: 'observed', promotionEligibilityId: null });
+        history.push(event);
+        this.aliases.set(alias, history);
+        return structuredClone(event);
+    }
+    recordPromotionEligibility(input) {
+        validateEligibility(input, this.aliases.get(input.alias) ?? []);
+        const existing = this.eligibility.get(input.id);
+        if (existing && canonical(existing) !== canonical(input))
+            throw new CalibrationRegistryError(`promotion eligibility '${input.id}' is immutable`);
+        const record = immutable(input);
+        this.eligibility.set(record.id, record);
+        return structuredClone(record);
+    }
+    promoteAlias(eligibilityId, at) {
+        const eligibility = this.eligibility.get(eligibilityId);
+        if (!eligibility?.eligible)
+            throw new CalibrationRegistryError('alias movement requires an eligible promotion record');
+        const history = this.aliases.get(eligibility.alias) ?? [];
+        const rollback = history.find(event => event.revision === eligibility.rollbackTarget.aliasRevision);
+        if (!rollback || rollback.actualIdentityDigest !== eligibility.rollbackTarget.identityDigest)
+            throw new CalibrationRegistryError('rollback target no longer matches immutable alias history');
+        const event = immutable({ revision: history.length + 1, alias: eligibility.alias,
+            actualIdentityDigest: eligibility.candidateIdentityDigest, actualModel: eligibility.candidateActualModel, recordedAt: new Date(validDate(at)).toISOString(),
+            kind: 'promoted', promotionEligibilityId: eligibility.id });
+        history.push(event);
+        this.aliases.set(event.alias, history);
+        return structuredClone(event);
+    }
+    rollbackAlias(alias, targetRevision, approvalReference, at) {
+        nonEmpty(approvalReference, 'rollback approval reference');
+        const history = this.aliases.get(alias) ?? [];
+        const target = history.find(event => event.revision === targetRevision);
+        if (!target)
+            throw new CalibrationRegistryError('rollback target must be an exact alias-history revision');
+        const event = immutable({ ...target, revision: history.length + 1, recordedAt: new Date(validDate(at)).toISOString(),
+            kind: 'rolled-back', promotionEligibilityId: `rollback-approval:${approvalReference}` });
+        history.push(event);
+        return structuredClone(event);
+    }
+    retireAlias(alias, approvalReference, at) {
+        nonEmpty(approvalReference, 'retirement approval reference');
+        const history = this.aliases.get(alias) ?? [];
+        const current = history.at(-1);
+        if (!current)
+            throw new CalibrationRegistryError(`unknown alias '${alias}'`);
+        const event = immutable({ ...current, revision: history.length + 1, recordedAt: new Date(validDate(at)).toISOString(),
+            kind: 'retired', promotionEligibilityId: `retirement-approval:${approvalReference}` });
+        history.push(event);
+        return structuredClone(event);
+    }
+    resolve(request, policy) {
+        const existing = this.pins.get(request.runId);
+        if (existing)
+            return structuredClone(existing);
+        validDate(request.at);
+        const actualDigest = calibrationIdentityDigest(request.actualIdentity);
+        const history = this.aliases.get(request.requestedAlias) ?? [];
+        const alias = history.at(-1) ?? null;
+        if (alias && alias.kind !== 'retired' && alias.actualIdentityDigest !== actualDigest)
+            this.observeAlias(request.requestedAlias, request.actualIdentity, request.at);
+        const artifact = request.calibrationArtifactId ? this.artifacts.get(request.calibrationArtifactId) : findExactArtifact(this.artifacts, actualDigest);
+        const artifactIdentity = artifact ? calibrationIdentityDigest(artifact.identity) : null;
+        let state = artifactIdentity === actualDigest ? 'exact' : 'unknown';
+        const relation = artifactIdentity ? this.relations.filter(item => item.fromIdentityDigest === artifactIdentity && item.toIdentityDigest === actualDigest
+            && validDate(item.effectiveAt) <= validDate(request.at) && (!item.expiresAt || validDate(item.expiresAt) > validDate(request.at))).at(-1) : undefined;
+        if (state !== 'exact' && relation)
+            state = relation.state;
+        const reasons = [];
+        if (!artifact)
+            reasons.push('calibration-missing');
+        const usable = artifact ? calibrationUsability(artifact, request.at) : [];
+        reasons.push(...usable);
+        if (alias?.kind === 'retired')
+            reasons.push('alias-retired');
+        if (alias && alias.actualIdentityDigest !== actualDigest)
+            reasons.push('alias-drift');
+        let action;
+        const unusable = !artifact || usable.length > 0 || alias?.kind === 'retired';
+        if (unusable)
+            action = policy.unusableCalibration;
+        else if (state === 'exact' || state === 'approved-compatible')
+            action = 'allow';
+        else if (state === 'shadow-required')
+            action = policy.shadowRequired;
+        else if (state === 'incompatible')
+            action = policy.incompatible;
+        else
+            action = policy.unknown;
+        const currentAlias = (this.aliases.get(request.requestedAlias) ?? []).at(-1) ?? alias;
+        const pin = immutable({ schemaVersion: 'decision-calibration-compatibility/v1', pinId: `${request.runId}:${actualDigest}`,
+            runId: request.runId, requestedAlias: request.requestedAlias, actualModel: request.actualIdentity.actualModel,
+            aliasRevision: currentAlias?.revision ?? null, artifactId: artifact?.id ?? null, artifactDigest: artifact?.digest ?? null,
+            state, action, reasons, decidedAt: request.at });
+        this.pins.set(request.runId, pin);
+        return structuredClone(pin);
+    }
+    evidence(pin, raw, calibrated) {
+        if (calibrated && (calibrated.calibrationArtifactId !== pin.artifactId || calibrated.calibrationArtifactDigest !== pin.artifactDigest)) {
+            throw new CalibrationRegistryError('calibrated evidence must cite the pinned calibration artifact');
+        }
+        return immutable({ raw, calibrated, compatibilityPin: pin });
+    }
+    aliasHistory(alias) { return structuredClone(this.aliases.get(alias) ?? []); }
+    driftEvents(alias) { return structuredClone(alias ? this.drift.filter(event => event.alias === alias) : this.drift); }
+    promotionHistory() { return structuredClone([...this.eligibility.values()]); }
+    artifactHistory() { return structuredClone([...this.artifacts.values()]); }
+    compatibilityHistory() { return structuredClone(this.relations); }
+}
+function findExactArtifact(artifacts, digest) {
+    return [...artifacts.values()].find(artifact => calibrationIdentityDigest(artifact.identity) === digest);
+}
+function calibrationUsability(artifact, at) {
+    const reasons = [];
+    if (artifact.approval.state !== 'approved' || !artifact.approval.reference)
+        reasons.push(`calibration-${artifact.approval.state}`);
+    if (artifact.metrics.totalSamples < artifact.profile.minimumTotalSamples)
+        reasons.push('insufficient-total-samples');
+    if (artifact.metrics.perSliceSamples < artifact.profile.minimumPerSliceSamples)
+        reasons.push('insufficient-slice-samples');
+    if (artifact.metrics.calibrationError > artifact.profile.maximumCalibrationError)
+        reasons.push('calibration-bound-exceeded');
+    if (artifact.metrics.selectiveRisk > artifact.profile.maximumSelectiveRisk)
+        reasons.push('selective-risk-bound-exceeded');
+    if (validDate(at) >= validDate(artifact.effectiveAt) + artifact.profile.expiresAfterDays * 86_400_000)
+        reasons.push('calibration-expired');
+    return reasons;
+}
+function validateArtifact(artifact) {
+    nonEmpty(artifact.id, 'artifact id');
+    validDate(artifact.effectiveAt);
+    if (artifact.schemaVersion !== 'decision-calibration-artifact/v1')
+        throw new CalibrationRegistryError('unsupported calibration artifact schema');
+    validateIdentity(artifact.identity);
+    const { digest, ...payload } = artifact;
+    if (digest !== calibrationArtifactDigest(payload))
+        throw new CalibrationRegistryError('calibration artifact digest does not match its immutable content');
+    if (!artifact.limitations.length)
+        throw new CalibrationRegistryError('calibration limitations must be explicit');
+    const profile = artifact.profile;
+    if (!Number.isInteger(profile.minimumTotalSamples) || profile.minimumTotalSamples < 1 || !Number.isInteger(profile.minimumPerSliceSamples) || profile.minimumPerSliceSamples < 1)
+        throw new CalibrationRegistryError('sample minima must be positive integers');
+    if (!(profile.confidenceInterval.level > 0 && profile.confidenceInterval.level < 1) || !profile.confidenceInterval.method)
+        throw new CalibrationRegistryError('confidence interval method and level must be pinned');
+    if (profile.maximumCalibrationError < 0 || profile.maximumCalibrationError > 1 || profile.maximumSelectiveRisk < 0 || profile.maximumSelectiveRisk > 1)
+        throw new CalibrationRegistryError('risk bounds must be in [0,1]');
+    if (!(profile.expiresAfterDays > 0))
+        throw new CalibrationRegistryError('expiry rule must be positive');
+    if (!Number.isInteger(artifact.metrics.totalSamples) || artifact.metrics.totalSamples < 0 || !Number.isInteger(artifact.metrics.perSliceSamples) || artifact.metrics.perSliceSamples < 0)
+        throw new CalibrationRegistryError('sample observations must be non-negative integers');
+    const intervals = Object.entries(artifact.metrics.confidenceIntervals);
+    if (!intervals.length)
+        throw new CalibrationRegistryError('at least one confidence interval is required');
+    for (const [name, interval] of intervals) {
+        nonEmpty(name, 'confidence interval name');
+        if (!Number.isFinite(interval.lower) || !Number.isFinite(interval.upper)
+            || interval.lower < 0 || interval.upper > 1 || interval.lower > interval.upper) {
+            throw new CalibrationRegistryError(`confidence interval '${name}' must have ordered finite bounds in [0,1]`);
+        }
+    }
+    if (artifact.approval.state === 'approved' && !artifact.approval.reference)
+        throw new CalibrationRegistryError('approved calibration requires an approval reference');
+    if (artifact.splitProvenance.holdoutAccessedAt && validDate(artifact.splitProvenance.holdoutAccessedAt) < validDate(artifact.effectiveAt))
+        throw new CalibrationRegistryError('profile must be preregistered before holdout access');
+}
+function validateIdentity(identity) {
+    for (const [name, value] of Object.entries({ provider: identity.provider, backend: identity.backend, actualModel: identity.actualModel,
+        primitive: identity.primitive, adapterVersion: identity.adapterVersion, datasetId: identity.dataset.id, sliceId: identity.slice.id,
+        calibratorId: identity.calibrator.id, calibratorVersion: identity.calibrator.version }))
+        nonEmpty(value, name);
+    for (const digest of [identity.definitionDigest, identity.dataset.hash, identity.slice.hash, identity.calibrator.parametersDigest]) {
+        if (!/^sha256:[0-9a-f]{64}$/.test(digest))
+            throw new CalibrationRegistryError('identity digests must be lowercase sha256 values');
+    }
+}
+function validateEligibility(record, history) {
+    nonEmpty(record.approvalReference, 'promotion approval reference');
+    nonEmpty(record.candidateActualModel, 'candidate actual model');
+    validDate(record.recordedAt);
+    if (!record.evaluationIntegrityReport.id || !record.evaluationIntegrityReport.digest)
+        throw new CalibrationRegistryError('promotion requires a pinned evaluation-integrity report');
+    const target = history.find(event => event.revision === record.rollbackTarget.aliasRevision);
+    if (!target || target.actualIdentityDigest !== record.rollbackTarget.identityDigest)
+        throw new CalibrationRegistryError('promotion requires an exact rollback target');
+    if (record.eligible && record.reasons.length)
+        throw new CalibrationRegistryError('eligible promotion records cannot contain denial reasons');
+    if (!record.eligible && !record.reasons.length)
+        throw new CalibrationRegistryError('ineligible promotion records must explain the denial');
+}
+//# sourceMappingURL=registry.js.map

package/dist/src/decision/calibration/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/decision/compile-cache/benchmark.js

@@ -0,0 +1,62 @@
+export function cacheBenchmarkReport(configurationDigest, warmupCalls, minimumBenefitTargetBps, confidenceInterval, samples) {
+    const disabledCount = samples.filter(value => value.mode === 'cache-disabled').length;
+    const enabledCount = samples.filter(value => value.mode === 'cache-enabled').length;
+    if (!disabledCount || disabledCount !== enabledCount || !Number.isSafeInteger(warmupCalls) || warmupCalls < 0 ||
+        !Number.isSafeInteger(minimumBenefitTargetBps) || minimumBenefitTargetBps < 0 || minimumBenefitTargetBps > 10_000 ||
+        samples.some(value => !Number.isFinite(value.preparationLatencyMs) || value.preparationLatencyMs < 0 ||
+            !Number.isSafeInteger(value.memoryBytes) || value.memoryBytes < 0 ||
+            !Number.isSafeInteger(value.storageBytes) || value.storageBytes < 0 ||
+            [value.inputTokens, value.outputTokens, value.cachedInputTokens].some(tokens => tokens != null && (!Number.isSafeInteger(tokens) || tokens < 0)) ||
+            (value.costUsd !== null && (!Number.isFinite(value.costUsd) || value.costUsd < 0)))) {
+        throw new Error('paired cache benchmark requires equal valid enabled and disabled samples');
+    }
+    return { schemaVersion: 'decision-cache-benchmark/v1', configurationDigest, warmupCalls,
+        measuredCalls: samples.length, minimumBenefitTargetBps, confidenceInterval,
+        disabled: summarize(samples.filter(value => value.mode === 'cache-disabled')),
+        enabled: summarize(samples.filter(value => value.mode === 'cache-enabled')) };
+}
+/**
+ * Enforce the preregistered minimum benefit as a pass/fail result. Only
+ * measured preparation latency is judged; unknown provider economics never
+ * contribute to a pass.
+ */
+export function evaluateCacheBenchmarkTarget(report) {
+    const baseline = report.disabled.averagePreparationLatencyMs;
+    const observedBenefitBps = baseline > 0
+        ? Math.round((baseline - report.enabled.averagePreparationLatencyMs) * 10_000 / baseline) : null;
+    return { metric: 'preparation-latency', targetBps: report.minimumBenefitTargetBps, observedBenefitBps,
+        outcome: observedBenefitBps === null ? 'unknown' : observedBenefitBps >= report.minimumBenefitTargetBps ? 'pass' : 'fail' };
+}
+/** Deterministic paired bootstrap interval; positive differences favor enabled caching. */
+export function pairedPreparationLatencyInterval(disabled, enabled, iterations = 233) {
+    if (disabled.length !== enabled.length || disabled.length < 2 ||
+        !Number.isSafeInteger(iterations) || iterations < 2 ||
+        [...disabled, ...enabled].some(value => !Number.isFinite(value) || value < 0)) {
+        throw new Error('paired latency interval requires equal non-negative measured samples');
+    }
+    const differences = disabled.map((value, index) => value - enabled[index]);
+    let seed = 0x2603;
+    const means = Array.from({ length: iterations }, () => {
+        let total = 0;
+        for (let index = 0; index < differences.length; index++) {
+            seed = (Math.imul(seed, 1664525) + 1013904223) >>> 0;
+            total += differences[seed % differences.length];
+        }
+        return total / differences.length;
+    }).sort((left, right) => left - right);
+    return `95% paired bootstrap CI [${means[Math.floor(iterations * 0.025)].toFixed(3)}, ${means[Math.ceil(iterations * 0.975) - 1].toFixed(3)}] ms`;
+}
+function summarize(samples) {
+    const average = (values) => values.reduce((sum, value) => sum + value, 0) / values.length;
+    const nullableAverage = (values) => values.some(value => value === null) ? null : average(values);
+    return { calls: samples.length, averagePreparationLatencyMs: average(samples.map(value => value.preparationLatencyMs)),
+        averageInputTokens: nullableAverage(samples.map(value => value.inputTokens)),
+        averageTotalTaskTokens: nullableAverage(samples.map(value => value.inputTokens === null || value.outputTokens == null ? null : value.inputTokens + value.outputTokens)),
+        averageCachedInputTokens: nullableAverage(samples.map(value => value.cachedInputTokens)),
+        averageCostUsd: nullableAverage(samples.map(value => value.costUsd)),
+        peakMemoryBytes: Math.max(...samples.map(value => value.memoryBytes)),
+        peakStorageBytes: Math.max(...samples.map(value => value.storageBytes)),
+        hitRateBps: Math.round(samples.filter(value => value.outcome === 'hit').length * 10_000 / samples.length),
+        invalidationRateBps: Math.round(samples.filter(value => value.invalidated).length * 10_000 / samples.length) };
+}
+//# sourceMappingURL=benchmark.js.map

package/dist/src/decision/compile-cache/compatibility.js

@@ -0,0 +1,65 @@
+import { canonicalJson } from '../../security/artifact-trust.js';
+import { providerPrefixKey } from './identity.js';
+const PREFIX_DIMENSIONS = [
+    'schemaVersion', 'orderedPrefixDigest', 'provider', 'backend', 'requestedModel', 'actualModel', 'apiRevision', 'policy',
+    'tenantId', 'workspaceId', 'dataClass', 'region', 'egressPolicyDigest',
+];
+const TRANSFERABLE = new Set(['requestedModel', 'actualModel', 'apiRevision', 'backend', 'policy']);
+/** Dimensions whose canonical values differ between two prefix identities. */
+export function changedPrefixDimensions(left, right) {
+    return PREFIX_DIMENSIONS.filter(dimension => canonicalJson(left[dimension]) !== canonicalJson(right[dimension]));
+}
+/**
+ * Decide whether a previously established provider prefix may be reused.
+ * TTL expiry always invalidates. Any identity change invalidates unless one
+ * unexpired pinned record names exactly this from/to pair and permits every
+ * changed dimension; scope, data class, region, egress, provider and the
+ * prefix bytes themselves can never transfer.
+ */
+export async function evaluateProviderPrefixReuse(input) {
+    const changed = changedPrefixDimensions(input.cached, input.next);
+    const decision = (reusable, reason) => ({ reusable, reason, changedDimensions: changed });
+    if (!Number.isSafeInteger(input.cachedAtEpochMs) || !Number.isSafeInteger(input.nowEpochMs)
+        || input.nowEpochMs < input.cachedAtEpochMs
+        || input.nowEpochMs - input.cachedAtEpochMs >= Math.min(input.cached.policy.ttlMs, input.next.policy.ttlMs)) {
+        return decision(false, 'ttl-expired');
+    }
+    if (!changed.length)
+        return decision(true, 'identical');
+    if (changed.some(dimension => !TRANSFERABLE.has(dimension)))
+        return decision(false, 'non-transferable-dimension');
+    const from = providerPrefixKey(input.cached);
+    const to = providerPrefixKey(input.next);
+    const candidates = (input.records ?? []).filter(record => record.schemaVersion === 'decision-provider-prefix-compatibility/v1'
+        && record.fromIdentityDigest === from && record.toIdentityDigest === to);
+    if (!candidates.length)
+        return decision(false, 'identity-changed');
+    const live = candidates.filter(record => Number.isSafeInteger(record.expiresAtEpochMs) && record.expiresAtEpochMs > input.nowEpochMs
+        && !!record.approvedBy);
+    if (!live.length)
+        return decision(false, 'record-expired');
+    const permitting = live.filter(record => changed.every(dimension => record.permits.includes(dimension)));
+    if (!permitting.length)
+        return decision(false, 'record-mismatch');
+    const modelMoved = changed.includes('requestedModel') || changed.includes('actualModel');
+    for (const record of permitting) {
+        if (!modelMoved)
+            return decision(true, 'pinned-compatibility');
+        const snapshot = record.aliasSnapshot;
+        if (!snapshot || snapshot.alias !== input.next.requestedModel || snapshot.validUntilEpochMs <= input.nowEpochMs
+            || input.next.actualModel === null || !snapshot.approvedActualModels.includes(input.next.actualModel)
+            || !input.verifyAliasSnapshot)
+            continue;
+        let verified = false;
+        try {
+            verified = await input.verifyAliasSnapshot(structuredClone(snapshot)) === true;
+        }
+        catch {
+            verified = false;
+        }
+        if (verified)
+            return decision(true, 'pinned-compatibility');
+    }
+    return decision(false, 'alias-snapshot-unverified');
+}
+//# sourceMappingURL=compatibility.js.map