@aiwg/cli 2026.9.20 → 2026.9.24

package/dist/src/decision/patterns/artifacts.js

@@ -0,0 +1,173 @@
+import Ajv2020 from 'ajv/dist/2020.js';
+import { artifactDigest, validateBinding, validateDefinition, validateRuleset } from '../validate.js';
+import { PATTERN_SPECS } from './specs.js';
+const PREFIX = 'aiwg://decision-patterns/';
+const KINDS = new Set(['definition', 'input-schema', 'output-schema', 'candidate-policy', 'ruleset', 'offline-binding', 'live-binding-template', 'expected-receipt', 'readme']);
+const PATTERNS = new Set(Object.keys(PATTERN_SPECS));
+/** Logical credential for the recorded offline transport. It resolves to a fixed, non-secret marker. */
+export const OFFLINE_RECORDED_CREDENTIAL_REF = 'offline.recorded-fixture';
+export const OFFLINE_RECORDED_MODEL = 'offline:recorded-fixture';
+export const LIVE_TEMPLATE_MODEL = 'jev:explicit-opt-in-required';
+const objectSchema = (properties, required = []) => ({ $schema: 'https://json-schema.org/draft/2020-12/schema', type: 'object', properties, required, additionalProperties: false });
+const nested = (properties, required = []) => ({ type: 'object', properties, required, additionalProperties: false });
+const probability = { type: 'number', minimum: 0, maximum: 1 };
+const probabilities = { type: 'object', minProperties: 1, additionalProperties: probability };
+const pointer = { type: 'string', pattern: '^(/.*)?$' };
+/** Sanitized recorded Jev answers, keyed by ruleset alias. */
+function recordedAnswerSchema(evaluation) {
+    switch (evaluation.answer.kind) {
+        case 'choice': return nested({ type: { const: 'choice' }, choice: { type: 'string' }, probabilities, confidence: probability }, ['type', 'choice', 'probabilities', 'confidence']);
+        case 'ordinal-score': return nested({ type: { const: 'score' }, score: { type: 'number', minimum: 0 }, probabilities, legend: { type: 'object' }, confidence: probability }, ['type', 'score', 'probabilities', 'legend', 'confidence']);
+        case 'truth-probability': return nested({ type: { const: 'noul' }, noul: probability }, ['type', 'noul']);
+    }
+}
+function outputSchemaFor(id) {
+    const spec = PATTERN_SPECS[id];
+    return objectSchema({
+        answers: nested(Object.fromEntries(spec.evaluations.map(evaluation => [evaluation.alias, recordedAnswerSchema(evaluation)])), spec.evaluations.map(evaluation => evaluation.alias)),
+        usage: nested({ input_tokens: { type: 'integer', minimum: 0 }, output_tokens: { type: 'integer', minimum: 0 } }, ['input_tokens', 'output_tokens']),
+    }, ['answers']);
+}
+const decisionSource = { type: 'object', properties: { source: { const: 'decision' }, alias: { type: 'string', minLength: 1 } }, required: ['source', 'alias'], additionalProperties: false };
+const inputSource = { type: 'object', properties: { source: { const: 'input' }, pointer }, required: ['source', 'pointer'], additionalProperties: false };
+export const PATTERN_CANDIDATE_POLICY_SCHEMA = objectSchema({
+    schema: { const: 'decision-pattern-candidate-policy/v2' }, patternId: { type: 'string', enum: [...PATTERNS] }, patternVersion: { type: 'string', pattern: '^\\d+\\.\\d+\\.\\d+$' },
+    authority: { const: 'deterministic-code' }, authorizedCandidatesFrom: { type: 'string', minLength: 1 }, evidenceMayExpandCandidates: { const: false }, actionsExecute: { const: false },
+    deterministicDenyOverrides: { const: true }, unauthorizedEvidenceRoute: { enum: ['review', 'deny'] },
+    deterministicPolicyFrom: pointer,
+    candidateGate: nested({
+        candidateFrom: { oneOf: [decisionSource, inputSource] }, allowedFrom: pointer,
+        matchKeys: { type: 'array', minItems: 1, items: { type: 'string', minLength: 1 } }, requireAllowed: { type: 'object' },
+        labelKey: { type: 'string', minLength: 1 }, reason: { type: 'string', minLength: 1 },
+    }, ['candidateFrom', 'allowedFrom', 'reason']),
+    argumentGate: nested({ functionAlias: { type: 'string', minLength: 1 }, argumentsFrom: pointer, schemasFrom: pointer, reason: { type: 'string', minLength: 1 } }, ['functionAlias', 'argumentsFrom', 'schemasFrom', 'reason']),
+    batchSubjectsFrom: pointer,
+    replay: nested({ resumeCountFrom: pointer }, ['resumeCountFrom']),
+}, ['schema', 'patternId', 'patternVersion', 'authority', 'authorizedCandidatesFrom', 'evidenceMayExpandCandidates', 'actionsExecute', 'deterministicDenyOverrides', 'unauthorizedEvidenceRoute']);
+export function decisionPatternArtifactUri(id, version, kind, alias) {
+    return `${PREFIX}${id}/${version}/${kind}${alias ? `.${alias}` : ''}`;
+}
+/** Resolve an artifact entirely from the installed module, without checkout-relative paths or I/O. */
+export function resolveDecisionPatternArtifact(reference) {
+    if (!reference.startsWith(PREFIX))
+        throw new Error('Unsupported decision pattern artifact reference');
+    const parts = reference.slice(PREFIX.length).split('/');
+    if (parts.length !== 3)
+        throw new Error('Malformed decision pattern artifact reference');
+    const [patternId, patternVersion, rawKindWithAlias] = parts;
+    const [rawKind, alias, ...extra] = (rawKindWithAlias ?? '').split('.');
+    if (!PATTERNS.has(patternId) || !/^\d+\.\d+\.\d+$/.test(patternVersion ?? '') || !KINDS.has(rawKind) || extra.length)
+        throw new Error('Malformed decision pattern artifact reference');
+    const id = patternId;
+    const kind = rawKind;
+    if ((kind === 'definition') !== (alias !== undefined) || (alias !== undefined && !PATTERN_SPECS[id].evaluations.some(evaluation => evaluation.alias === alias))) {
+        throw new Error('Malformed decision pattern artifact reference');
+    }
+    return {
+        schema: 'decision-pattern-artifact/v1', patternId: id, patternVersion: patternVersion, kind, ...(alias ? { alias } : {}),
+        mediaType: kind === 'readme' ? 'text/markdown' : 'application/json', content: artifactContent(id, patternVersion, kind, alias),
+    };
+}
+const governedCache = new Map();
+/** Governed runtime artifacts for one pack, as consumed by `evaluateDecisionRuleset`. Callers receive a private copy. */
+export function governedPatternArtifacts(id, version) {
+    const key = `${id}@${version}`;
+    if (!governedCache.has(key))
+        governedCache.set(key, buildGovernedArtifacts(id, version));
+    return structuredClone(governedCache.get(key));
+}
+function buildGovernedArtifacts(id, version) {
+    const definitions = Object.fromEntries(PATTERN_SPECS[id].evaluations.map(evaluation => {
+        const definition = definitionFor(id, version, evaluation);
+        return [definition.metadata.id, definition];
+    }));
+    const ruleset = rulesetFor(id, version, definitions);
+    return { definitions, ruleset, offlineBinding: bindingFor(id, version, ruleset, false), liveBindingTemplate: bindingFor(id, version, ruleset, true) };
+}
+let validatePolicy;
+/** Validate pins, schemas and cross-artifact references using the production decision validators. */
+export function validateGovernedPatternArtifacts(id, version) {
+    const { definitions, ruleset, offlineBinding, liveBindingTemplate } = governedPatternArtifacts(id, version);
+    Object.values(definitions).forEach(validateDefinition);
+    validateRuleset(ruleset);
+    validateBinding(offlineBinding, ruleset);
+    validateBinding(liveBindingTemplate, ruleset);
+    validatePolicy ??= new Ajv2020({ strict: true, allErrors: true }).compile(PATTERN_CANDIDATE_POLICY_SCHEMA);
+    if (!validatePolicy(candidatePolicyFor(id, version)))
+        throw new Error('candidate policy is invalid');
+}
+export function patternInputSchema(id) { return structuredClone(PATTERN_SPECS[id].inputSchema); }
+export function patternOutputSchema(id) { return outputSchemaFor(id); }
+function artifactContent(id, version, kind, alias) {
+    const artifacts = governedPatternArtifacts(id, version);
+    switch (kind) {
+        case 'definition': return Object.values(artifacts.definitions).find(definition => definition.metadata.id === definitionId(id, alias));
+        case 'input-schema': return patternInputSchema(id);
+        case 'output-schema': return outputSchemaFor(id);
+        case 'candidate-policy': return candidatePolicyFor(id, version);
+        case 'ruleset': return artifacts.ruleset;
+        case 'offline-binding': return artifacts.offlineBinding;
+        case 'live-binding-template': return artifacts.liveBindingTemplate;
+        case 'expected-receipt': return { schema: 'decision-pattern-receipt/v2', pattern: { id, version }, executionMode: 'offline-recorded', evidenceOrigin: 'sanitized-recorded-fixture', runtime: { evaluator: 'evaluateDecisionRuleset', adapter: 'jev@1.0.0', transport: 'recorded-replay' }, action: { status: 'unexecuted' } };
+        case 'readme': return `# ${id}\n\nOffline fixtures replay sanitized recorded Jev answers through the production decision evaluator. Recorded evidence is illustrative, not qualification, universal calibration, permission, or proof of deterministic model behavior. Failures abstain or route to review. Disable ${id}@${version} from discovery and retain receipts.\n`;
+    }
+}
+const definitionId = (id, alias) => `pattern.${id}.${alias}`;
+function definitionFor(id, version, evaluation) {
+    return { apiVersion: 'decision.aiwg.io/v1alpha2', kind: 'DecisionDefinition', metadata: { id: definitionId(id, evaluation.alias), version, description: `Governed ${id} ${evaluation.alias} evidence definition` },
+        spec: { purpose: `Collect bounded advisory evidence for ${id}`, inputSchema: evaluation.inputSchema ?? PATTERN_SPECS[id].inputSchema, question: evaluation.question, answer: evaluation.answer, requiredCapabilities: [] } };
+}
+function rulesetFor(id, version, definitions) {
+    const spec = PATTERN_SPECS[id];
+    const outputSchema = objectSchema({ route: { enum: ['accept', 'review', 'deny'] }, reason: { type: 'string', minLength: 1 }, action: { const: 'unexecuted' } }, ['route', 'reason', 'action']);
+    const outcome = (value) => ({ route: value.route, reason: value.reason, action: 'unexecuted' });
+    return { apiVersion: 'decision.aiwg.io/v1alpha2', kind: 'DecisionRuleset', metadata: { id: `pattern.${id}.ruleset`, version, description: `Deterministic policy boundary for ${id}` },
+        spec: { purpose: `Keep ${id} evidence subordinate to deterministic authority`, inputSchema: spec.inputSchema,
+            evaluations: spec.evaluations.map(evaluation => {
+                const definition = definitions[definitionId(id, evaluation.alias)];
+                return { alias: evaluation.alias, decision: { id: definition.metadata.id, version, digest: artifactDigest(definition) }, inputPointer: evaluation.inputPointer };
+            }),
+            rules: spec.rules.map(rule => ({ id: rule.id, priority: rule.priority, when: rule.when, outcome: outcome(rule) })),
+            composition: 'first-match', conflict: 'review', defaultOutcome: outcome(spec.defaultOutcome), failureOutcome: outcome(spec.failureOutcome), outputSchema } };
+}
+/** Primitive-aware acceptance. A truth probability of 0.5 always falls to review, never to an accept band or severity label. */
+function acceptanceFor(profile) {
+    const review = { disposition: 'review' };
+    const base = { mode: 'primitive-policy', version: '1.0.0', precedence: 'first-match', calibration: 'advisory',
+        defaultRoute: review, missingEvidenceRoute: review, invalidEvidenceRoute: review, tieRoute: review };
+    if (profile === 'truth') {
+        return { ...base, compatibleUncertaintyProfiles: ['typesafe-truth-v1'], rules: [
+                { id: 'confident-true', primitive: 'truth-probability', all: [{ metric: 'yes-probability', op: 'gte', thresholdBps: 8000 }], route: { disposition: 'act' } },
+                { id: 'confident-false', primitive: 'truth-probability', all: [{ metric: 'yes-probability', op: 'lte', thresholdBps: 2000 }], route: { disposition: 'act' } },
+            ] };
+    }
+    if (profile === 'ordinal') {
+        return { ...base, compatibleUncertaintyProfiles: ['typesafe-distribution-v1'], rules: [
+                { id: 'concentrated', primitive: 'ordinal-score', all: [{ metric: 'dispersion', op: 'lte', thresholdBps: 2000 }], route: { disposition: 'act' } },
+            ] };
+    }
+    return { ...base, compatibleUncertaintyProfiles: ['typesafe-distribution-v1'], rules: [
+            { id: 'selected-confident', primitive: 'choice', all: [{ metric: 'selected-probability', op: 'gte', thresholdBps: 8000 }], route: { disposition: 'act' } },
+        ] };
+}
+function bindingFor(id, version, ruleset, live) {
+    const spec = PATTERN_SPECS[id];
+    const target = (evaluation) => ({
+        adapter: 'jev', adapterVersion: '1.0.0', model: live ? LIVE_TEMPLATE_MODEL : OFFLINE_RECORDED_MODEL,
+        credentialRef: live ? 'typesafe.jev.playground' : OFFLINE_RECORDED_CREDENTIAL_REF,
+        requiredCapabilities: [], acceptance: acceptanceFor(evaluation.acceptance), timeoutMs: live ? 15_000 : 5_000,
+        retry: { maxRetries: 0, initialDelayMs: 1, maxDelayMs: 1 },
+    });
+    return { apiVersion: 'decision.aiwg.io/v1alpha2', kind: 'DecisionBinding', metadata: { id: `pattern.${id}.${live ? 'live' : 'offline'}`, version, description: `${live ? 'Disabled opt-in live' : 'Recorded offline'} binding for ${id}` },
+        spec: { ruleset: { id: ruleset.metadata.id, version, digest: artifactDigest(ruleset) }, totalTimeoutMs: live ? 15_000 : 10_000, maxAttempts: spec.evaluations.length, concurrency: 1,
+            evaluations: Object.fromEntries(spec.evaluations.map(evaluation => [evaluation.alias, { targets: [target(evaluation)], fallbackOn: [] }])) } };
+}
+export function candidatePolicyFor(id, version) {
+    const spec = PATTERN_SPECS[id];
+    const gate = spec.gates.candidateGate;
+    return { schema: 'decision-pattern-candidate-policy/v2', patternId: id, patternVersion: version, authority: 'deterministic-code',
+        authorizedCandidatesFrom: gate?.allowedFrom ?? 'deterministic-policy', evidenceMayExpandCandidates: false, actionsExecute: false,
+        deterministicDenyOverrides: true, unauthorizedEvidenceRoute: spec.unauthorizedEvidenceRoute,
+        ...structuredClone(spec.gates) };
+}
+//# sourceMappingURL=artifacts.js.map

package/dist/src/decision/patterns/catalog.js

@@ -0,0 +1,108 @@
+import { decisionPatternArtifactUri } from './artifacts.js';
+import { PATTERN_SPECS } from './specs.js';
+const fixture = (id, input, recordedEvidence, route, reason) => ({
+    id, subjectId: `synthetic:${id}`, input, recordedEvidence, expected: { route, reason },
+});
+/** Sanitized recorded Jev Choice answer; the unselected mass is spread evenly. */
+export function recordedChoice(options, selected, probability) {
+    const rest = options.length > 1 ? (1 - probability) / (options.length - 1) : 0;
+    return { type: 'choice', choice: selected, probabilities: Object.fromEntries(options.map(option => [option, option === selected ? probability : rest])), confidence: probability };
+}
+/** Sanitized recorded Jev Noul (truth-probability) answer. */
+export function recordedNoul(probability) { return { type: 'noul', noul: probability }; }
+/** Sanitized recorded Jev Score answer; the score is the distribution's weighted mean. */
+export function recordedScore(levels, distribution, confidence = 0.8) {
+    return { type: 'score', score: distribution.reduce((sum, probability, index) => sum + probability * index, 0),
+        probabilities: Object.fromEntries(distribution.map((probability, index) => [String(index), probability])),
+        legend: Object.fromEntries(levels.map((level, index) => [String(index), level])), confidence };
+}
+const options = (id, alias) => {
+    const answer = PATTERN_SPECS[id].evaluations.find(evaluation => evaluation.alias === alias).answer;
+    return answer.kind === 'choice' ? answer.options.map(option => option.id) : [];
+};
+const choiceFor = (id, alias, selected, probability) => recordedChoice(options(id, alias), selected, probability);
+const answers = (value, usage) => ({ answers: value, ...(usage ? { usage } : {}) });
+const LEVELS = ['low', 'medium', 'high'];
+const lookupSchema = { lookup: { type: 'object', required: ['query'], properties: { query: { type: 'string' } }, additionalProperties: false } };
+const source = { locator: 'doc:1#p2', digest: `sha256:${'a'.repeat(64)}`, provenanceVerified: true };
+function pack(id, primitive, summary, fixtures, status = 'supported') {
+    const artifact = (kind) => decisionPatternArtifactUri(id, '1.0.0', kind);
+    const calls = PATTERN_SPECS[id].evaluations.length;
+    return {
+        schema: 'decision-pattern-pack/v1', id, version: '1.0.0', status, summary, primitive,
+        artifacts: {
+            definitions: PATTERN_SPECS[id].evaluations.map(evaluation => decisionPatternArtifactUri(id, '1.0.0', 'definition', evaluation.alias)),
+            inputSchema: artifact('input-schema'),
+            outputSchema: artifact('output-schema'), candidatePolicy: artifact('candidate-policy'),
+            ruleset: artifact('ruleset'), offlineBinding: artifact('offline-binding'),
+            ...(status !== 'unavailable' ? { liveBindingTemplate: artifact('live-binding-template') } : {}),
+            expectedReceipt: artifact('expected-receipt'), readme: artifact('readme'),
+        },
+        fixtures,
+        limitations: ['Recorded evidence is illustrative, not workload qualification or universal calibration.', 'Typed output does not guarantee semantic correctness.'],
+        failurePath: 'Abstain or route to review; never infer permission from model evidence.',
+        rollback: `Remove ${id}@1.0.0 from discovery or restore its pinned predecessor; retain receipts.`,
+        ...(status !== 'unavailable' ? { live: { syntheticOnly: true, credentialRef: 'typesafe:jev/playground', requiredEgressClass: 'synthetic-decision', limits: { maxCalls: calls, maxTokens: 1024 * calls, maxCostUsd: 0.02 * calls, allowUnknownCost: false, maxAttempts: 1, deadlineMs: 15_000 } } } : {}),
+    };
+}
+export const decisionPatternPacks = [
+    pack('intent-routing', 'choice', 'Route only among code-authorized capabilities, with none/review.', [
+        fixture('route-authorized', { authorizedCandidates: ['search', 'summarize'] }, answers({ route: choiceFor('intent-routing', 'route', 'search', 0.91) }), 'accept', 'authorized-candidate'),
+        fixture('route-unauthorized', { authorizedCandidates: ['summarize'] }, answers({ route: choiceFor('intent-routing', 'route', 'admin', 0.99) }), 'review', 'candidate-not-authorized'),
+        fixture('route-low-confidence', { authorizedCandidates: ['search', 'summarize'] }, answers({ route: choiceFor('intent-routing', 'route', 'search', 0.55) }), 'review', 'evidence-not-accepted'),
+    ]),
+    pack('rag-screen', 'composite', 'Advisory relevance, contradiction, and injection evidence.', [
+        fixture('rag-relevant', { sourceLocator: 'doc:rag#1' }, answers({ relevant: recordedNoul(0.95), contradiction: recordedNoul(0.03), injection: recordedNoul(0.02) }), 'accept', 'relevant-no-conflict'),
+        fixture('rag-contradiction', { sourceLocator: 'doc:rag#2' }, answers({ relevant: recordedNoul(0.9), contradiction: recordedNoul(0.92), injection: recordedNoul(0.02) }), 'review', 'source-contradiction'),
+        fixture('rag-injection', { sourceLocator: 'doc:rag#3' }, answers({ relevant: recordedNoul(0.9), contradiction: recordedNoul(0.05), injection: recordedNoul(0.97) }), 'deny', 'prompt-injection-detected'),
+        fixture('rag-policy-deny', { sourceLocator: 'doc:rag#4', deterministicPolicy: 'deny' }, answers({ relevant: recordedNoul(0.95), contradiction: recordedNoul(0.03), injection: recordedNoul(0.02) }), 'deny', 'deterministic-policy-deny'),
+    ]),
+    pack('citation-support', 'choice', 'Citation support with independent locator and provenance validation.', [
+        fixture('citation-valid', { sources: [source], citation: { locator: 'doc:1#p2', digest: source.digest } }, answers({ support: choiceFor('citation-support', 'support', 'supported', 0.93) }), 'accept', 'citation-supported'),
+        fixture('citation-fabricated', { sources: [source], citation: { locator: 'doc:9#p1', digest: `sha256:${'b'.repeat(64)}` } }, answers({ support: choiceFor('citation-support', 'support', 'supported', 0.97) }), 'review', 'citation-provenance-unverified'),
+    ]),
+    pack('guardrails', 'truth-probability', 'Model screening remains advisory beside deterministic input/output policy.', [
+        fixture('guardrail-conflict', { deterministicPolicy: 'deny' }, answers({ screen: recordedNoul(1) }), 'deny', 'deterministic-policy-deny'),
+        fixture('guardrail-permit', { deterministicPolicy: 'allow' }, answers({ screen: recordedNoul(0.93) }), 'accept', 'advisory-permit'),
+        fixture('guardrail-flagged', { deterministicPolicy: 'allow' }, answers({ screen: recordedNoul(0.04) }), 'deny', 'guardrail-flagged'),
+        // A Noul probability of exactly 0.5 is uncertainty, not a "medium" label or an accept.
+        fixture('guardrail-noul-midpoint', { deterministicPolicy: 'allow' }, answers({ screen: recordedNoul(0.5) }), 'review', 'evidence-not-accepted'),
+    ]),
+    pack('tool-risk-preflight', 'choice', 'Advisory tool-risk classification that cannot grant tool authority.', [
+        fixture('tool-deny-conflict', { deterministicPolicy: 'deny', authorizedTools: [] }, answers({ risk: choiceFor('tool-risk-preflight', 'risk', 'allow', 0.98) }), 'deny', 'deterministic-policy-deny'),
+        fixture('tool-advisory-allow', { deterministicPolicy: 'allow', authorizedTools: [] }, answers({ risk: choiceFor('tool-risk-preflight', 'risk', 'allow', 0.9) }), 'accept', 'advisory-allow'),
+        fixture('tool-advisory-deny', { deterministicPolicy: 'allow', authorizedTools: [] }, answers({ risk: choiceFor('tool-risk-preflight', 'risk', 'deny', 0.86) }), 'deny', 'advisory-deny'),
+    ]),
+    pack('bounded-classification', 'choice', 'Classification over a closed code-owned option set.', [
+        fixture('classification-unknown', { allowedOptions: ['bug', 'feature', 'none'] }, answers({ category: choiceFor('bounded-classification', 'category', 'sales', 0.9) }), 'review', 'candidate-not-authorized'),
+        fixture('classification-known', { allowedOptions: ['bug', 'feature', 'none'] }, answers({ category: choiceFor('bounded-classification', 'category', 'bug', 0.88) }), 'accept', 'authorized-candidate'),
+    ]),
+    pack('ordinal-scoring', 'ordinal-score', 'Ordinal score preserving legend, distribution, mean, and dispersion.', [
+        fixture('ordinal-full', { report: 'Synthetic outage report' }, answers({ severity: recordedScore(LEVELS, [0.2, 0.5, 0.3]) }), 'accept', 'distribution-preserved'),
+        fixture('ordinal-dispersed', { report: 'Synthetic ambiguous report' }, answers({ severity: recordedScore(LEVELS, [0.5, 0, 0.5]) }), 'review', 'evidence-not-accepted'),
+    ]),
+    pack('function-selection', 'choice', 'Choose but never execute a code-enumerated function with typed arguments.', [
+        fixture('function-valid', { legalFunctions: ['lookup'], argumentSchemas: lookupSchema, proposedArguments: { query: 'synthetic' } }, answers({ function: choiceFor('function-selection', 'function', 'lookup', 0.94) }), 'accept', 'authorized-function'),
+        fixture('function-unauthorized', { legalFunctions: ['lookup'], argumentSchemas: lookupSchema, proposedArguments: {} }, answers({ function: choiceFor('function-selection', 'function', 'deleteAll', 0.96) }), 'deny', 'function-not-authorized'),
+        fixture('function-invalid-arguments', { legalFunctions: ['lookup'], argumentSchemas: lookupSchema, proposedArguments: { query: 42 } }, answers({ function: choiceFor('function-selection', 'function', 'lookup', 0.94) }), 'deny', 'arguments-invalid'),
+    ]),
+    pack('same-subject-batch', 'composite', 'Heterogeneous questions sharing one explicit subject identity.', [
+        fixture('batch-one-subject', { subjects: { risk: 'case:1', route: 'case:1', urgent: 'case:1' }, record: { summary: 'Synthetic case 1' } }, answers({ risk: recordedScore(LEVELS, [0.7, 0.2, 0.1]), route: choiceFor('same-subject-batch', 'route', 'self-serve', 0.9), urgent: recordedNoul(0.1) }, { input_tokens: 20, output_tokens: 4 }), 'accept', 'same-subject-batch'),
+        fixture('batch-multi-subject', { subjects: { risk: 'case:1', route: 'case:2', urgent: 'case:1' }, record: { summary: 'Synthetic cases 1 and 2' } }, answers({ risk: recordedScore(LEVELS, [0.7, 0.2, 0.1]), route: choiceFor('same-subject-batch', 'route', 'self-serve', 0.9), urgent: recordedNoul(0.1) }, { input_tokens: 20, output_tokens: 4 }), 'deny', 'multi-subject-batch-rejected'),
+    ]),
+    pack('dependent-two-stage', 'composite', 'Conditional DAG example; unavailable until the governed DAG runtime is supported.', [], 'unavailable'),
+    pack('durable-review', 'composite', 'Experimental offline review/resume contract with idempotency-key evidence.', [
+        fixture('review-resume', { reviewRequired: true, invocationId: 'synthetic-review-1', resumeCount: 2 }, answers({ review: choiceFor('durable-review', 'review', 'route-to-reviewer', 0.9) }), 'review', 'durable-review-required'),
+    ], 'experimental'),
+    pack('candidate-selection', 'choice', 'Deterministic extraction followed by bounded evidence-based selection.', [
+        fixture('candidate-bounded', { extractedCandidates: ['alpha', 'beta'] }, answers({ candidate: choiceFor('candidate-selection', 'candidate', 'beta', 0.87) }), 'accept', 'authorized-candidate'),
+        fixture('candidate-not-extracted', { extractedCandidates: ['alpha', 'beta'] }, answers({ candidate: choiceFor('candidate-selection', 'candidate', 'gamma', 0.9) }), 'review', 'candidate-not-authorized'),
+    ]),
+];
+export function getDecisionPatternPack(id) {
+    const found = decisionPatternPacks.find(candidate => candidate.id === id);
+    if (!found)
+        throw new Error(`Unknown decision pattern: ${id}`);
+    return structuredClone(found);
+}
+//# sourceMappingURL=catalog.js.map

package/dist/src/decision/patterns/durable-review.js

@@ -0,0 +1,237 @@
+import { DecisionReviewService, FileDecisionReviewStore, PinnedReviewAuthorization, ReviewAccessError, ReviewConflictError, } from '../review/index.js';
+import { join } from 'node:path';
+/**
+ * Exercise the real durable review service and file store without credentials or
+ * network access. The caller owns `directory` and may inspect or remove it.
+ */
+export async function runOfflineDurableReviewFixture(directory) {
+    if (!directory)
+        throw new Error('A durable review fixture directory is required');
+    const integrityKey = new TextEncoder().encode('aiwg-offline-durable-review-fixture-key-v1');
+    const authorization = {
+        authorize: () => true,
+        eligible: ({ actor }) => actor.roles.includes('reviewer'),
+        eligibleApproval: (_scope, _review, _proposal, decision) => decision.reviewer.roles.includes('reviewer'),
+        authorizeAction: () => true,
+    };
+    const actor = { id: 'fixture-reviewer', roles: ['reviewer'], authorityContext: 'offline-fixture/v1' };
+    const requester = { id: 'fixture-requester', roles: ['requester'], authorityContext: 'offline-fixture/v1' };
+    const requesterScope = { tenantId: 'fixture-tenant', projectId: 'fixture-project', actor: requester };
+    const reviewerScope = { tenantId: 'fixture-tenant', projectId: 'fixture-project', actor };
+    const digest = `sha256:${'1'.repeat(64)}`;
+    let now = 1_000;
+    const store = () => new FileDecisionReviewStore(directory, integrityKey);
+    const first = new DecisionReviewService(store(), authorization, () => now);
+    await first.create(requesterScope, {
+        reviewId: 'durable-review-fixture',
+        sourceReceipt: { id: 'offline-receipt', digest },
+        evidencePins: [{ id: 'recorded-evidence', version: '1.0.0', digest }],
+        policyPins: [{ id: 'offline-policy', version: '1.0.0', digest }],
+        presentation: { summary: 'Synthetic offline durable review fixture' },
+        action: { kind: 'local-fixture', value: 'approved' },
+        rationale: 'Exercise durable review without external side effects',
+        riskTier: 'fixture', reasonCodes: ['durable-review-required'],
+        expiresAtEpochMs: 60_000, continuationId: 'fixture-continuation',
+        resumeToken: 'fixture-resume-token',
+    });
+    await first.decide(reviewerScope, 'durable-review-fixture', 'approve', 'fixture approval');
+    // Construct a new store and service to prove the continuation survives restart.
+    now += 1;
+    const restarted = new DecisionReviewService(store(), authorization, () => now);
+    let executorCalls = 0;
+    const execute = async (effectId) => {
+        executorCalls += 1;
+        return { local: true, effectId };
+    };
+    const receipt = await restarted.resume(reviewerScope, 'durable-review-fixture', 'fixture-resume-token', execute);
+    // Construct another service and replay resume. It must return the stored effect
+    // receipt without calling the executor a second time.
+    const replayed = await new DecisionReviewService(store(), authorization, () => now)
+        .resume(reviewerScope, 'durable-review-fixture', 'fixture-resume-token', execute);
+    if (executorCalls !== 1 || JSON.stringify(receipt) !== JSON.stringify(replayed)) {
+        throw new Error('Durable review fixture violated idempotent resume');
+    }
+    const persisted = await store().read('durable-review-fixture', 'fixture-tenant', 'fixture-project');
+    if (!persisted?.effectReceipt)
+        throw new Error('Durable review fixture receipt was not persisted');
+    return {
+        schema: 'decision-pattern-durable-review-fixture/v1', executionMode: 'offline-local',
+        networkAllowed: false, credentialRequired: false, store: 'file-decision-review-store',
+        restarted: true, reviewId: persisted.reviewId, effectId: receipt.effectId,
+        persistedRevision: persisted.revision, executorCalls: 1,
+        duplicateResumeReturnedReceipt: true,
+    };
+}
+/** Installed-package offline matrix: no network, credentials, or external executor. */
+export async function runOfflineReviewMatrixFixture(directory) {
+    if (!directory)
+        throw new Error('A durable review fixture directory is required');
+    const key = new TextEncoder().encode('aiwg-offline-review-matrix-fixture-key-v1');
+    const store = () => new FileDecisionReviewStore(join(directory, 'matrix'), key);
+    const requester = { tenantId: 'fixture-tenant', projectId: 'fixture-project',
+        actor: { id: 'requester', roles: ['requester'], authorityContext: 'fixture/v1' } };
+    const reviewer = { ...requester, actor: { id: 'reviewer', roles: ['reviewer'], authorityContext: 'fixture/v1' } };
+    const auth = { authorize: () => true, eligible: () => true, eligibleApproval: () => true, authorizeAction: () => true };
+    let now = 1_000;
+    const service = () => new DecisionReviewService(store(), auth, () => now);
+    const digest = `sha256:${'1'.repeat(64)}`;
+    const create = (id, reasonCode, expiry = 9_000) => service().create(requester, {
+        reviewId: id, sourceReceipt: { id: `source-${id}`, digest }, evidencePins: [{ id: 'evidence', version: '1', digest }],
+        policyPins: [{ id: 'policy', version: '1', digest }], reasonCodes: [reasonCode], riskTier: 'fixture',
+        presentation: { summary: 'Projected synthetic evidence' }, action: { kind: 'fixture', value: 'original' },
+        rationale: 'Requires review', expiresAtEpochMs: expiry, continuationId: `continue-${id}`, resumeToken: `resume-${id}`,
+        escalationAtEpochMs: 1_500,
+    });
+    await create('low-confidence', 'low-confidence');
+    await create('policy-conflict', 'policy-conflict');
+    const claimed = await service().claim(reviewer, 'low-confidence', 'claim');
+    const rejected = await service().decide(reviewer, 'policy-conflict', 'reject', 'conflict');
+    await create('edited', 'manual-edit');
+    const edited = await service().edit(reviewer, 'edited', { kind: 'fixture', value: 'amended' }, 'amend', 'resume-edited-v2');
+    await service().decide(reviewer, 'edited', 'approve', 'approve amendment');
+    let effects = 0;
+    const execute = async () => { effects += 1; return { delivered: true }; };
+    const completed = await service().resume(reviewer, 'edited', 'resume-edited-v2', execute);
+    const duplicate = await service().resume(reviewer, 'edited', 'resume-edited-v2', execute);
+    await create('expiry', 'deadline', 1_600);
+    await create('escalation', 'deadline');
+    now = 1_600;
+    const expired = await service().expireDue(reviewer, 'expiry');
+    const escalated = await service().escalate(reviewer, 'escalation', 'deadline');
+    let lateDenied = false;
+    try {
+        await service().decide(reviewer, 'expiry', 'approve', 'too late');
+    }
+    catch (error) {
+        if (!(error instanceof ReviewConflictError))
+            throw error;
+        lateDenied = true;
+    }
+    if (!lateDenied || effects !== 1 || completed.effectId !== duplicate.effectId)
+        throw new Error('Offline review matrix failed');
+    return { schema: 'decision-review-offline-matrix/v1', executionMode: 'offline-local',
+        networkAllowed: false, credentialRequired: false, restarted: true,
+        claimed: claimed.status, rejected: rejected.status, editedVersion: edited.proposals.at(-1).version,
+        expired: expired.status, escalated: escalated.status, lateDenied, executorCalls: effects,
+        duplicateResumeReturnedReceipt: true };
+}
+/**
+ * Installed-package G6 fixture with a non-permissive `PinnedReviewAuthorization`.
+ * Unauthenticated, self-approving, wrong-role, foreign-project, stale-token,
+ * revoked-action, replaced-policy and revoked-reviewer attempts run against the
+ * real file store. The executor counts calls per phase, so any unauthorized
+ * attempt that reaches it fails the fixture. One authorized resume after a
+ * restart then produces exactly one effect, and a duplicate returns its receipt.
+ */
+export async function runOfflineReviewAuthorizationFixture(directory) {
+    if (!directory)
+        throw new Error('A durable review fixture directory is required');
+    const key = new TextEncoder().encode('aiwg-offline-review-authorization-fixture-key-v1');
+    const store = () => new FileDecisionReviewStore(join(directory, 'authorization'), key);
+    const policy = {
+        id: 'fixture-review-policy', version: '1', tenantId: 'fixture-tenant', projectId: 'fixture-project',
+        requesterRoles: ['requester'], reviewerRoles: ['reviewer'], executorRoles: ['executor'],
+        auditorRoles: ['auditor'], operatorRoles: ['operator'], minimumQuorumByRisk: { low: 1 },
+        retentionWindowMsByRisk: { low: 60_000 },
+        separateRequesterReviewer: true, separateEditorReviewer: true, separateReviewerExecutor: true,
+    };
+    // Live identity authority fake: roles come from here, never from the caller's scope.
+    const directoryRoles = new Map([
+        ['requester', ['requester']], ['reviewer', ['reviewer']], ['executor', ['executor']],
+        ['dual-role', ['requester', 'reviewer']],
+    ]);
+    const revoked = new Set();
+    let authenticated = new Set(['requester', 'reviewer', 'executor', 'dual-role']);
+    let policyReplaced = false;
+    let actionPermitted = true;
+    let authorizationDigest = null;
+    const authority = {
+        authenticate: async (scope) => authenticated.has(scope.actor.id),
+        resolve: async (_tenant, _project, id) => directoryRoles.has(id)
+            ? { roles: revoked.has(id) ? [] : directoryRoles.get(id), active: true, compromised: false, conflictsWith: [], authorityContext: 'fixture/v1' }
+            : null,
+        currentPolicyDigest: async () => policyReplaced ? `sha256:${'0'.repeat(64)}` : authorizationDigest,
+    };
+    const authorization = new PinnedReviewAuthorization(policy, authority, async () => actionPermitted);
+    authorizationDigest = authorization.policyDigest;
+    let now = 1_000;
+    const service = () => new DecisionReviewService(store(), authorization, () => now);
+    // The caller claims every role; only the live authority's answer counts.
+    const scope = (id, projectId = policy.projectId) => ({ tenantId: policy.tenantId, projectId,
+        actor: { id, roles: ['requester', 'reviewer', 'executor', 'operator'], authorityContext: 'fixture/v1' } });
+    const digest = `sha256:${'1'.repeat(64)}`;
+    const reviewId = 'authorization-fixture';
+    const token = 'fixture-authorization-resume-token';
+    await service().create(scope('dual-role'), {
+        reviewId, sourceReceipt: { id: 'source-authorization', digest }, evidencePins: [{ id: 'evidence', version: '1', digest }],
+        policyPins: [{ id: policy.id, version: policy.version, digest: authorization.policyDigest }],
+        reasonCodes: ['high-risk-action'], riskTier: 'low', presentation: { summary: 'Projected synthetic evidence' },
+        action: { kind: 'fixture', value: 'guarded' }, rationale: 'Requires review', expiresAtEpochMs: 30_000,
+        retentionUntilEpochMs: now + policy.retentionWindowMsByRisk.low, continuationId: 'continue-authorization', resumeToken: token,
+    });
+    let unauthorizedEffects = 0;
+    let authorizedEffects = 0;
+    let authorizedPhase = false;
+    const execute = async (effectId) => {
+        if (authorizedPhase)
+            authorizedEffects += 1;
+        else
+            unauthorizedEffects += 1;
+        return { delivered: true, effectId };
+    };
+    const denied = [];
+    const expectDenied = async (caseId, attempt) => {
+        try {
+            await attempt();
+        }
+        catch (error) {
+            if (!(error instanceof ReviewAccessError) && !(error instanceof ReviewConflictError))
+                throw error;
+            denied.push(caseId);
+            return;
+        }
+        throw new Error(`Review authorization fixture allowed ${caseId}`);
+    };
+    // Before approval: nobody may resume, and the requester (dual-role) may not approve its own request.
+    await expectDenied('resume-before-approval', () => service().resume(scope('executor'), reviewId, token, execute));
+    await expectDenied('self-approval', () => service().decide(scope('dual-role'), reviewId, 'approve', 'self'));
+    authenticated = new Set(['requester', 'executor', 'dual-role']);
+    await expectDenied('unauthenticated-reviewer', () => service().decide(scope('reviewer'), reviewId, 'approve', 'forged'));
+    authenticated = new Set(['requester', 'reviewer', 'executor', 'dual-role']);
+    await expectDenied('requester-claim', () => service().claim(scope('requester'), reviewId, 'wrong role'));
+    await service().decide(scope('reviewer'), reviewId, 'approve', 'approved by independent reviewer');
+    // After approval: wrong role, foreign scope, unknown principal and stale token cannot resume.
+    await expectDenied('reviewer-as-executor', () => service().resume(scope('reviewer'), reviewId, token, execute));
+    await expectDenied('foreign-project-executor', () => service().resume(scope('executor', 'other-project'), reviewId, token, execute));
+    await expectDenied('unknown-principal', () => service().resume(scope('stranger'), reviewId, token, execute));
+    await expectDenied('stale-resume-token', () => service().resume(scope('executor'), reviewId, 'stale-token', execute));
+    // Authority changes after approval block execution. Revoked action or reviewer authority is
+    // recorded as authorization-denied without erasing the approval; a replaced policy pin makes
+    // the review unavailable to every caller.
+    actionPermitted = false;
+    await expectDenied('action-authorization-revoked', () => service().resume(scope('executor'), reviewId, token, execute));
+    actionPermitted = true;
+    policyReplaced = true;
+    await expectDenied('policy-replaced', () => service().resume(scope('executor'), reviewId, token, execute));
+    policyReplaced = false;
+    revoked.add('reviewer');
+    await expectDenied('reviewer-role-revoked', () => service().resume(scope('executor'), reviewId, token, execute));
+    revoked.delete('reviewer');
+    // Restart with a fresh store and service, then resume under current authority.
+    now += 1;
+    authorizedPhase = true;
+    const receipt = await service().resume(scope('executor'), reviewId, token, execute);
+    const duplicate = await service().resume(scope('executor'), reviewId, token, execute);
+    const persisted = await store().read(reviewId, policy.tenantId, policy.projectId);
+    const deniedEvents = persisted?.events.filter(event => event.type === 'authorization-denied').length ?? 0;
+    if (unauthorizedEffects !== 0 || authorizedEffects !== 1 || JSON.stringify(receipt) !== JSON.stringify(duplicate) ||
+        persisted?.status !== 'completed' || denied.length !== 11 || deniedEvents !== 2) {
+        throw new Error('Review authorization fixture recorded an unauthorized or duplicate effect');
+    }
+    return {
+        schema: 'decision-review-offline-authorization/v1', executionMode: 'offline-local', networkAllowed: false,
+        credentialRequired: false, authorization: 'pinned-review-authorization', restarted: true, deniedAttempts: denied,
+        unauthorizedEffects: 0, authorizedEffects: 1, authorizationDeniedEvents: deniedEvents, duplicateResumeReturnedReceipt: true,
+    };
+}
+//# sourceMappingURL=durable-review.js.map

package/dist/src/decision/patterns/index.js

@@ -0,0 +1,8 @@
+export * from './types.js';
+export * from './catalog.js';
+export * from './playground.js';
+export * from './artifacts.js';
+export * from './durable-review.js';
+export * from './recorded.js';
+export * from './specs.js';
+//# sourceMappingURL=index.js.map