@aiwg/cli 2026.9.20 → 2026.9.24

package/dist/src/decision/portable-secrets.js

@@ -0,0 +1,53 @@
+import { canonicalJson } from '../security/artifact-trust.js';
+/**
+ * Shared detector for secret material in portable decision artifacts
+ * (receipts, batch receipts, result-cache entries).
+ *
+ * Detection runs over the canonical JSON serialization so that keys and
+ * string values are both inspected, matching the projection policy guard.
+ * Rules are deliberately conservative to avoid rejecting legitimate data:
+ *
+ * - bearer values: `Bearer <token>` where the token is at least 16 token
+ *   characters (plain prose such as "bearer of news" does not match);
+ * - PEM private keys: any `-----BEGIN ... PRIVATE KEY-----` armor header;
+ * - private locators: `vault://` and `secret://` URIs, and string values that
+ *   begin with a Vault KV-v2 data path (`secret/data/...` or `kv/data/...`);
+ * - secret-derived hashes: keys such as `secretHash`, `tokenSha256Hash`,
+ *   `apiKeyHash`, `credentialDigestHash`;
+ * - embedded secret values: keys named exactly `secret`, `credential`,
+ *   `token`, `apiKey`/`api_key`/`api-key`, or those names suffixed with
+ *   `Value` or `Header`.
+ *
+ * Logical credential references (`credentialRef`, e.g. `typesafe.jev.x`) are
+ * intentionally allowed: bindings carry them and batch target identities embed
+ * them. A reference whose value is itself a vault/secret locator still fails
+ * through the locator rule.
+ */
+const RULES = [
+    /\bbearer\s+[a-z0-9._~+/-]{16,}=*/i,
+    /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/,
+    /(?:vault|secret):\/\//i,
+    /"(?:secret|kv)\/data\/[^"\s]/i,
+    // Key rules also match keys inside JSON embedded in a string value (escaped quotes).
+    /\\?"(?:secret|credential|token|api[_-]?key)[^"\\]*hash\\?"\s*:/i,
+    /\\?"(?:secret|credential|token|api[_-]?key)(?:Value|Header)?\\?"\s*:/i,
+];
+function serialize(value) {
+    try {
+        return canonicalJson(value);
+    }
+    catch {
+        return JSON.stringify(value) ?? '';
+    }
+}
+export function containsPortableSecretMaterial(value) {
+    const serialized = serialize(value);
+    return RULES.some(rule => rule.test(serialized));
+}
+/** Throws `makeError(message)`; the message never echoes the offending material. */
+export function assertNoPortableSecretMaterial(value, name, makeError) {
+    if (containsPortableSecretMaterial(value)) {
+        throw makeError(`${name} contains forbidden credential or private-locator material`);
+    }
+}
+//# sourceMappingURL=portable-secrets.js.map

package/dist/src/decision/projection.js

@@ -0,0 +1,210 @@
+import { canonicalJson } from '../security/artifact-trust.js';
+import { resolveJsonPointer } from './validate.js';
+/** Ordered data classes; a field above the policy ceiling is denied egress. */
+export const DECISION_SENSITIVITY_ORDER = ['public', 'internal', 'confidential', 'restricted'];
+const DEFAULT_MAX_SENSITIVITY = 'confidential';
+export class DecisionProjectionError extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.reason = reason;
+        this.name = 'DecisionProjectionError';
+    }
+}
+/**
+ * Deterministically creates the only state object an adapter may receive.
+ * Callers must run this before credential resolution or transport dispatch.
+ */
+export async function projectDecisionState(input, policy, options = {}) {
+    validateProjectionPolicy(policy);
+    const incompleteContext = options.incompleteContext === true;
+    if (incompleteContext && !policy.allowIncompleteContext) {
+        throw new DecisionProjectionError('data-boundary-denied', 'incomplete material context is not authorized by projection policy');
+    }
+    const state = {};
+    const included = [];
+    let subject;
+    for (const field of [...policy.fields].sort((a, b) => a.output.localeCompare(b.output))) {
+        const resolved = resolveJsonPointer(input, field.pointer);
+        if (!resolved.found)
+            throw new DecisionProjectionError('invalid-input', 'required projection field is missing');
+        state[field.output] = structuredClone(resolved.value);
+        subject ??= field.subject;
+        included.push({
+            pointer: field.pointer, output: field.output, source: field.source, trust: field.trust,
+            sensitivity: field.sensitivity, retentionClass: field.retentionClass,
+            accessScopes: [...field.accessScopes], exportPolicy: field.exportPolicy,
+            deletionPolicy: field.deletionPolicy, backupPolicy: field.backupPolicy,
+        });
+    }
+    const canonical = canonicalJson(state);
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(canonical));
+    return {
+        state,
+        evidence: {
+            policyVersion: policy.version,
+            subject: subject,
+            included,
+            incompleteContext,
+            automaticActionAllowed: !incompleteContext,
+            projectedDigest: `sha256:${Buffer.from(digest).toString('hex')}`,
+        },
+    };
+}
+/**
+ * Enforces the projection boundary before any credential lookup or transport.
+ * The credential resolver receives no state, and dispatch receives only the
+ * minimized projection rather than the ambient input object.
+ */
+export async function dispatchProjectedDecisionState(input, policy, handlers, options = {}) {
+    const projected = await projectDecisionState(input, policy, options);
+    const credential = await handlers.resolveCredential();
+    return handlers.dispatch({
+        state: Object.freeze(projected.state),
+        evidence: Object.freeze(projected.evidence),
+        credential,
+    });
+}
+export function validateProjectionPolicy(policy) {
+    if (!policy || typeof policy !== 'object' || Array.isArray(policy)) {
+        throw new DecisionProjectionError('invalid-policy', 'projection policy must be an object');
+    }
+    rejectUnknownKeys(policy, ['version', 'provider', 'model', 'origin', 'region', 'purpose', 'allowIncompleteContext', 'maxSensitivity', 'fields'], 'projection policy');
+    if (![policy.version, policy.provider, policy.model, policy.origin, policy.region, policy.purpose]
+        .every(value => typeof value === 'string' && value.trim().length > 0)
+        || typeof policy.allowIncompleteContext !== 'boolean' || !Array.isArray(policy.fields)) {
+        throw new DecisionProjectionError('invalid-policy', 'projection policy identity and fields are invalid');
+    }
+    // Scan the whole portable control object, not just individual field entries.
+    // Destination and identity strings are portable too and must never carry secrets.
+    rejectPortableSecretMaterial(policy, 'projection policy');
+    let normalizedOrigin;
+    try {
+        normalizedOrigin = new URL(policy.origin);
+    }
+    catch {
+        throw new DecisionProjectionError('invalid-policy', 'projection origin must be an absolute HTTPS URL');
+    }
+    if (normalizedOrigin.protocol !== 'https:' || normalizedOrigin.username || normalizedOrigin.password) {
+        throw new DecisionProjectionError('invalid-policy', 'projection origin must be credential-free HTTPS');
+    }
+    if (policy.maxSensitivity !== undefined && !DECISION_SENSITIVITY_ORDER.includes(policy.maxSensitivity)) {
+        throw new DecisionProjectionError('invalid-policy', 'projection sensitivity ceiling is invalid');
+    }
+    // Region is a host-declared deployment attribute; an unknown region is never authorized.
+    if (policy.region.trim().toLowerCase() === 'unknown') {
+        throw new DecisionProjectionError('data-boundary-denied', 'projection region is unknown');
+    }
+    const ceiling = DECISION_SENSITIVITY_ORDER.indexOf(policy.maxSensitivity ?? DEFAULT_MAX_SENSITIVITY);
+    if (!policy.fields.length)
+        throw new DecisionProjectionError('invalid-policy', 'projection policy must allow at least one field');
+    const outputs = new Set();
+    let subject;
+    for (const field of policy.fields) {
+        if (!field || typeof field !== 'object' || Array.isArray(field)) {
+            throw new DecisionProjectionError('invalid-policy', 'projection field must be an object');
+        }
+        rejectUnknownKeys(field, [
+            'pointer', 'output', 'source', 'subject', 'trust', 'sensitivity', 'purpose', 'retentionClass',
+            'accessScopes', 'exportPolicy', 'deletionPolicy', 'backupPolicy', 'allowedProviders',
+            'allowedModels', 'allowedOrigins', 'allowedRegions',
+        ], 'projection field');
+        if (typeof field.pointer !== 'string' || !field.pointer.startsWith('/')
+            || typeof field.output !== 'string' || !/^[A-Za-z][A-Za-z0-9_.-]*$/.test(field.output)) {
+            throw new DecisionProjectionError('invalid-policy', 'projection fields require JSON pointers and portable output names');
+        }
+        if (outputs.has(field.output))
+            throw new DecisionProjectionError('invalid-policy', 'duplicate projection output');
+        outputs.add(field.output);
+        subject ??= field.subject;
+        if (!field.subject || field.subject !== subject) {
+            throw new DecisionProjectionError('invalid-policy', 'one projection may contain exactly one stable subject');
+        }
+        if (![field.source, field.subject, field.purpose, field.retentionClass]
+            .every(value => typeof value === 'string' && value.trim().length > 0)
+            || ![field.accessScopes, field.allowedProviders, field.allowedModels, field.allowedOrigins, field.allowedRegions]
+                .every(value => Array.isArray(value) && value.length > 0
+                && value.every(item => typeof item === 'string' && item.trim().length > 0))) {
+            throw new DecisionProjectionError('invalid-policy', 'projection field lacks provenance or lifecycle metadata');
+        }
+        const normalizedAllowedOrigins = field.allowedOrigins.map(origin => normalizeAuthorizedOrigin(origin));
+        if (field.purpose !== policy.purpose || !field.allowedProviders?.includes(policy.provider)
+            || !field.allowedModels?.includes(policy.model) || !normalizedAllowedOrigins?.includes(normalizedOrigin.origin)
+            || !field.allowedRegions?.includes(policy.region)) {
+            throw new DecisionProjectionError('data-boundary-denied', 'projection field is not authorized for the selected destination');
+        }
+        if (!field.source || !field.retentionClass || !field.allowedProviders.length || !field.allowedModels.length
+            || !field.allowedOrigins.length || !field.allowedRegions.length || !field.accessScopes?.length
+            || !['verified', 'untrusted'].includes(field.trust)
+            || !['public', 'internal', 'confidential', 'restricted'].includes(field.sensitivity)
+            || !['denied', 'sanitized'].includes(field.exportPolicy)
+            || !['erase', 'tombstone'].includes(field.deletionPolicy)
+            || !['expire-with-primary', 'not-persisted'].includes(field.backupPolicy)) {
+            throw new DecisionProjectionError('invalid-policy', 'projection field lacks provenance or lifecycle metadata');
+        }
+        // Data-class rules: a field above the destination ceiling never egresses, and
+        // restricted material may not be exported or outlive its primary record.
+        if (DECISION_SENSITIVITY_ORDER.indexOf(field.sensitivity) > ceiling) {
+            throw new DecisionProjectionError('data-boundary-denied', 'projection field exceeds the destination sensitivity ceiling');
+        }
+        if (field.sensitivity === 'restricted' && (field.exportPolicy !== 'denied' || field.backupPolicy !== 'not-persisted')) {
+            throw new DecisionProjectionError('invalid-policy', 'restricted projection fields must deny export and persistence');
+        }
+        rejectPortableSecretMaterial(field, 'projection field');
+    }
+}
+/**
+ * Partitions projected state by host-declared trust so adapters can keep
+ * verified evidence structurally separate from untrusted content. Delimiters
+ * are not relied on: the partition is a distinct object key.
+ */
+export function partitionProjectedState(state, evidence) {
+    const verified = {};
+    const untrusted = {};
+    const values = state && typeof state === 'object' && !Array.isArray(state) ? state : {};
+    for (const field of evidence.included) {
+        if (!Object.hasOwn(values, field.output))
+            continue;
+        (field.trust === 'verified' ? verified : untrusted)[field.output] = values[field.output];
+    }
+    return { verified, untrusted };
+}
+/** Normalizes a projection or adapter origin for exact endpoint binding. */
+export function normalizeProjectionOrigin(origin) {
+    try {
+        return new URL(origin).origin;
+    }
+    catch {
+        throw new DecisionProjectionError('invalid-policy', 'projection origin must be an absolute HTTPS URL');
+    }
+}
+function normalizeAuthorizedOrigin(origin) {
+    let parsed;
+    try {
+        parsed = new URL(origin);
+    }
+    catch {
+        throw new DecisionProjectionError('invalid-policy', 'allowed origins must be absolute HTTPS origins');
+    }
+    if (parsed.protocol !== 'https:' || parsed.username || parsed.password || parsed.pathname !== '/'
+        || parsed.search || parsed.hash) {
+        throw new DecisionProjectionError('invalid-policy', 'allowed origins must be credential-free HTTPS origins');
+    }
+    return parsed.origin;
+}
+function rejectUnknownKeys(value, allowed, name) {
+    const unknown = Object.keys(value).filter(key => !allowed.includes(key));
+    if (unknown.length)
+        throw new DecisionProjectionError('invalid-policy', `${name} contains unsupported control fields`);
+}
+function rejectPortableSecretMaterial(value, name) {
+    const serialized = canonicalJson(value);
+    if (/bearer\s+[a-z0-9._~+/=-]+/i.test(serialized)
+        || /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/.test(serialized)
+        || /(?:vault|secret):\/\//i.test(serialized)
+        || /"(?:secret|credential|token|api[_-]?key)[^"]*hash"\s*:/i.test(serialized)
+        || /"(?:secret|credential|token|api[_-]?key)(?:Ref|Value|Header)?"\s*:/i.test(serialized)) {
+        throw new DecisionProjectionError('invalid-policy', `${name} contains forbidden credential or private-locator material`);
+    }
+}
+//# sourceMappingURL=projection.js.map

package/dist/src/decision/qualification/capture.js

@@ -0,0 +1,67 @@
+import { format } from 'node:util';
+const CONSOLE_METHODS = ['log', 'info', 'debug', 'warn', 'error', 'trace'];
+const STDERR_METHODS = new Set(['warn', 'error', 'trace']);
+function errorText(error) {
+    if (error instanceof Error) {
+        const cause = error.cause === undefined ? '' : `\ncause: ${errorText(error.cause)}`;
+        return `${error.name}: ${error.message}\n${error.stack ?? ''}${cause}`;
+    }
+    try {
+        return JSON.stringify(error) ?? String(error);
+    }
+    catch {
+        return String(error);
+    }
+}
+/**
+ * Captures what the process emits while `operation` runs: stream writes to
+ * stdout/stderr, console output (which test runners may route around the
+ * streams), and the text of a thrown error. Output still reaches the original
+ * sinks. Captures are process-wide, so concurrent work in the same process is
+ * captured too; run the qualification alone. Writes from child processes are
+ * not captured and must be collected by the caller.
+ */
+export async function captureQualificationLifetime(operation) {
+    const stdout = [];
+    const stderr = [];
+    const originalStdout = process.stdout.write;
+    const originalStderr = process.stderr.write;
+    const originalConsole = Object.fromEntries(CONSOLE_METHODS.map(name => [name, console[name]]));
+    const tap = (sink, original) => function (chunk, ...rest) {
+        sink.push(typeof chunk === 'string' ? chunk : chunk instanceof Uint8Array ? new TextDecoder().decode(chunk) : String(chunk));
+        return original.call(this, chunk, ...rest);
+    };
+    process.stdout.write = tap(stdout, originalStdout);
+    process.stderr.write = tap(stderr, originalStderr);
+    for (const name of CONSOLE_METHODS) {
+        console[name] = (...args) => {
+            (STDERR_METHODS.has(name) ? stderr : stdout).push(`${format(...args)}\n`);
+            originalConsole[name].apply(console, args);
+        };
+    }
+    let result;
+    let thrown = '';
+    let threw = false;
+    try {
+        result = await operation();
+    }
+    catch (error) {
+        threw = true;
+        thrown = errorText(error);
+    }
+    finally {
+        process.stdout.write = originalStdout;
+        process.stderr.write = originalStderr;
+        for (const name of CONSOLE_METHODS)
+            console[name] = originalConsole[name];
+    }
+    return {
+        ...(threw ? {} : { result }), threw,
+        captures: [
+            { surface: 'stdout', content: stdout.join('') },
+            { surface: 'stderr', content: stderr.join('') },
+            { surface: 'thrown-error', content: thrown },
+        ],
+    };
+}
+//# sourceMappingURL=capture.js.map

package/dist/src/decision/qualification/drift.js

@@ -0,0 +1,68 @@
+import { measurePairedMovement } from './quality.js';
+// Smoothing keeps PSI finite for categories that appear in only one sample.
+// It is a reporting convention, not a statistical test.
+const PSI_EPSILON = 1e-4;
+function validPlan(plan) {
+    return Number.isSafeInteger(plan.minimumN) && plan.minimumN >= 1
+        && Number.isFinite(plan.maximumTotalVariation) && plan.maximumTotalVariation >= 0 && plan.maximumTotalVariation <= 1
+        && Number.isFinite(plan.maximumPopulationStability) && plan.maximumPopulationStability >= 0;
+}
+function proportions(values, categories) {
+    const counts = new Map();
+    for (const value of values)
+        counts.set(value, (counts.get(value) ?? 0) + 1);
+    return Object.fromEntries(categories.map(category => [category, (counts.get(category) ?? 0) / values.length]));
+}
+/**
+ * Compares two categorical samples: model outputs for output drift, or input
+ * slice membership for population drift. Too few observations are
+ * `insufficient-evidence`, never `stable`.
+ */
+export function measureCategoricalDrift(reference, candidate, plan) {
+    if (!validPlan(plan) || [...reference, ...candidate].some(value => typeof value !== 'string' || !value.trim())) {
+        throw new Error('categorical drift requires a valid plan and nonempty categorical values');
+    }
+    const categories = [...new Set([...reference, ...candidate])].sort();
+    const insufficient = reference.length < plan.minimumN || candidate.length < plan.minimumN;
+    const left = reference.length ? proportions(reference, categories) : {};
+    const right = candidate.length ? proportions(candidate, categories) : {};
+    let totalVariation = 0;
+    let populationStability = 0;
+    if (!insufficient) {
+        for (const category of categories) {
+            const p = left[category];
+            const q = right[category];
+            totalVariation += Math.abs(p - q) / 2;
+            const ps = Math.max(p, PSI_EPSILON);
+            const qs = Math.max(q, PSI_EPSILON);
+            populationStability += (qs - ps) * Math.log(qs / ps);
+        }
+    }
+    const reasons = [];
+    if (insufficient)
+        reasons.push('insufficient-samples');
+    if (!insufficient && totalVariation > plan.maximumTotalVariation)
+        reasons.push('total-variation');
+    if (!insufficient && populationStability > plan.maximumPopulationStability)
+        reasons.push('population-stability');
+    return {
+        schemaVersion: 'decision-categorical-drift/v1', referenceN: reference.length, candidateN: candidate.length,
+        categories, reference: left, candidate: right, totalVariation, populationStability,
+        decision: insufficient ? 'insufficient-evidence' : reasons.length ? 'drift' : 'stable', reasons,
+    };
+}
+/**
+ * Repeated-run label movement against a preregistered bound. Stable only when
+ * the whole 95% interval is within the bound; drift only when it is entirely
+ * above; otherwise the sample cannot decide.
+ */
+export function measureLabelStability(pairs, maximumChangedRate) {
+    if (!Number.isFinite(maximumChangedRate) || maximumChangedRate < 0 || maximumChangedRate > 1) {
+        throw new Error('label stability requires a changed-rate bound in [0, 1]');
+    }
+    const movement = measurePairedMovement(pairs);
+    const [low, high] = movement.changedWilson95;
+    return { ...movement, maximumChangedRate,
+        decision: high <= maximumChangedRate ? 'stable' : low > maximumChangedRate ? 'drift' : 'insufficient-evidence' };
+}
+//# sourceMappingURL=drift.js.map

package/dist/src/decision/qualification/gate-evidence.js

@@ -0,0 +1,172 @@
+import { createHash } from 'node:crypto';
+import { canonicalJson } from '../../security/artifact-trust.js';
+import { CalibrationRegistry, calibrationArtifactDigest } from '../calibration/registry.js';
+import { validateCaseInventory } from './manifest.js';
+import { verifyQualificationSplits } from './quality.js';
+const range = (prefix, from, to) => Array.from({ length: to - from + 1 }, (_, index) => `${prefix}${String(from + index).padStart(2, '0')}`);
+export const DECISION_GATE_SUITES = {
+    'contract-suite-complete': { gate: 'G0', caseIds: ['C36'], evidenceIds: [
+            'CON-SCHEMA-01', 'CON-REJECT-01', 'CON-PIN-01', 'CON-VERSION-01', 'CON-CONVERT-01', 'CON-RESULT-01',
+        ] },
+    'runtime-suite-complete': { gate: 'G1', caseIds: [
+            ...range('C', 1, 12), ...range('C', 19, 23), 'C25', 'C26', 'C31', 'C35', 'C40', 'C41',
+            'TV01', 'TV02', 'TV03', 'TV04', 'TV05', 'TV06', 'TV07', 'TV08', 'TV09', 'TV11', 'TV12', 'TV18', 'TV22', 'TV23',
+        ], evidenceIds: ['BCH-INVALID-ANSWER-01', 'CTX-64K-01', 'CTX-32K-01', 'CTX-QUALIFY-01'] },
+    'security-suite-complete': { gate: 'G2', caseIds: [
+            'C29', 'C30', 'C32', 'C34', 'C36', 'C39', 'TV19', 'TV21', 'TV24', 'TV25',
+        ], evidenceIds: ['SEC-ADV-OVERRIDE-01', 'SEC-ADV-AUTHORITY-01', 'SEC-ADV-DELIMITER-01', 'SEC-ADV-FAKE-SYSTEM-01',
+            'SEC-EGRESS-01', 'SEC-RESPONSE-01', 'SEC-REQUEST-ID-01'],
+        amendments: ['M01', 'M02', 'M04', 'M05', 'M06', 'M07', 'M08', 'M09'] },
+    'fault-suite-complete': { gate: 'G4', caseIds: [
+            ...range('C', 13, 18), 'C24', 'C27', 'C28', 'C33', 'C37', 'C38', 'C42', 'TV13', 'TV14', 'TV15', 'TV16', 'TV17',
+        ], evidenceIds: ['RTY-STATUS-01', 'RTY-HEADER-01', 'RTY-DEADLINE-01', 'CAN-CALLER-01', 'CAN-DISPATCHED-01',
+            'CNC-ORDER-01', 'CNC-FAIR-01', 'CNC-QUEUE-01', 'CNC-CANCEL-01', 'CNC-RETRY-OWNER-01'],
+        amendments: ['M03', 'M10', 'M11'] },
+    'drift-suite-complete': { gate: 'G4', caseIds: ['TV10', 'TV20'], evidenceIds: [
+            'DRF-ALIAS-01', 'DRF-SHADOW-01', 'DRF-ACTIVE-PIN-01', 'DRF-PROMOTE-01', 'DRF-ROLLBACK-01', 'DRF-RETIRE-01',
+            'DRF-OUTPUT-01', 'DRF-POPULATION-01', 'DRF-LABEL-01', 'DRF-INSUFFICIENT-01',
+        ] },
+};
+/** Flags backed by a checked, digest-pinned artifact copied into the run directory. */
+export const GATE_ARTIFACT_SCHEMAS = {
+    'immutable-splits': 'decision-binary-benchmark-plan/v1',
+    'calibration-qualified': 'decision-calibration-artifact/v1',
+    'load-manifest-qualified': 'decision-load-result/v1',
+    'review-decision-recorded': 'decision-qualification-review/v1',
+};
+export const GATE_ARTIFACT_FLAGS = Object.keys(GATE_ARTIFACT_SCHEMAS);
+/** Every name that the caller cannot assert through an evidence-check callback. */
+export const DERIVED_GATE_EVIDENCE = [
+    'case-inventory-complete', ...Object.keys(DECISION_GATE_SUITES), 'evidence-hashes-verified',
+    'privacy-scan-clean', ...GATE_ARTIFACT_FLAGS,
+];
+const sha256Pattern = /^sha256:[0-9a-f]{64}$/;
+const sha256 = (value) => `sha256:${createHash('sha256').update(value).digest('hex')}`;
+const record = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const validDate = (value) => typeof value === 'string' && Number.isFinite(Date.parse(value));
+/**
+ * Deterministic digest of the run's case outcomes and named evidence. Artifact
+ * digests are excluded (they bind durations), so a reviewer can sign the
+ * outcome set that the run must reproduce.
+ */
+export function qualificationOutcomesDigest(manifest) {
+    const outcomes = [...manifest.evidence].sort((a, b) => a.caseId.localeCompare(b.caseId)).map(item => ({
+        caseId: item.caseId, executable: item.executable, outcome: item.outcome,
+        testEvidenceIds: [...(item.testEvidenceIds ?? [])].sort(),
+    }));
+    return sha256(canonicalJson({ runId: manifest.runId, sourceCommit: manifest.sourceCommit, outcomes }));
+}
+export function loadManifestDigest(manifest) {
+    return sha256(canonicalJson(manifest));
+}
+/** True only when every suite case has executable, digest-bound, passing evidence and named IDs are proven. */
+export function suiteSatisfied(manifest, suite) {
+    const byCase = new Map();
+    for (const item of manifest.evidence)
+        byCase.set(item.caseId, [...(byCase.get(item.caseId) ?? []), item]);
+    const proven = new Set();
+    for (const caseId of suite.caseIds) {
+        const items = byCase.get(caseId) ?? [];
+        const item = items[0];
+        if (items.length !== 1 || !item || !item.executable || item.outcome !== 'pass' || !item.artifact
+            || !item.digest || !sha256Pattern.test(item.digest))
+            return false;
+        for (const id of item.testEvidenceIds ?? [])
+            proven.add(id);
+    }
+    return (suite.evidenceIds ?? []).every(id => proven.has(id));
+}
+function validSplitPlan(value) {
+    if (!record(value) || value.schemaVersion !== GATE_ARTIFACT_SCHEMAS['immutable-splits'])
+        return false;
+    const { digest, ...fields } = value;
+    try {
+        verifyQualificationSplits(fields.splits);
+    }
+    catch {
+        return false;
+    }
+    return typeof digest === 'string' && sha256Pattern.test(digest) && digest === sha256(JSON.stringify(fields))
+        && sha256Pattern.test(String(fields.datasetDigest));
+}
+function validCalibration(value, context) {
+    if (!record(value) || value.schemaVersion !== GATE_ARTIFACT_SCHEMAS['calibration-qualified'])
+        return false;
+    const artifact = value;
+    const plan = context.accepted['immutable-splits'];
+    try {
+        new CalibrationRegistry().registerArtifact(artifact);
+    }
+    catch {
+        return false;
+    }
+    const { digest, ...payload } = artifact;
+    const at = Date.parse(context.manifest.generatedAt);
+    const effective = Date.parse(artifact.effectiveAt);
+    const expires = effective + artifact.profile.expiresAfterDays * 86_400_000;
+    return digest === calibrationArtifactDigest(payload) && artifact.approval.state === 'approved'
+        && plan !== undefined && artifact.splitProvenance.hash === plan.digest
+        && Number.isFinite(at) && effective <= at && at < expires
+        && artifact.metrics.totalSamples >= artifact.profile.minimumTotalSamples
+        && artifact.metrics.perSliceSamples >= artifact.profile.minimumPerSliceSamples
+        && artifact.metrics.calibrationError <= artifact.profile.maximumCalibrationError
+        && artifact.metrics.selectiveRisk <= artifact.profile.maximumSelectiveRisk;
+}
+function validLoadResult(value) {
+    if (!record(value) || value.schemaVersion !== GATE_ARTIFACT_SCHEMAS['load-manifest-qualified'])
+        return false;
+    const result = value;
+    if (!record(result.manifest) || result.manifest.schema !== 'decision-load-manifest/v1' || !record(result.manifest.bounds)
+        || !record(result.observations) || !validDate(result.recordedAt) || result.mode !== result.manifest.mode)
+        return false;
+    let digest;
+    try {
+        digest = loadManifestDigest(result.manifest);
+    }
+    catch {
+        return false;
+    }
+    const bounds = Object.entries(result.manifest.bounds);
+    return digest === result.manifestDigest && bounds.length > 0
+        && Object.keys(result.observations).length === bounds.length
+        && bounds.every(([name, limit]) => {
+            const observed = result.observations[name];
+            return Number.isFinite(limit) && limit >= 0 && typeof observed === 'number' && Number.isFinite(observed)
+                && observed >= 0 && observed <= limit;
+        });
+}
+function validReview(value, context) {
+    if (!record(value) || value.schemaVersion !== GATE_ARTIFACT_SCHEMAS['review-decision-recorded'])
+        return false;
+    const review = value;
+    return review.runId === context.manifest.runId && review.sourceCommit === context.manifest.sourceCommit
+        && typeof review.reviewer === 'string' && review.reviewer.trim().length > 0 && review.decision === 'approve'
+        && validDate(review.recordedAt) && review.outcomesDigest === qualificationOutcomesDigest(context.manifest);
+}
+/** Validates a parsed gate artifact against its schema, self-digest and the run it is attached to. */
+export function validateGateArtifact(flag, value, context) {
+    switch (flag) {
+        case 'immutable-splits': return validSplitPlan(value);
+        case 'calibration-qualified': return validCalibration(value, context);
+        case 'load-manifest-qualified': return validLoadResult(value);
+        case 'review-decision-recorded': return validReview(value, context);
+        default: return false;
+    }
+}
+/** Computes every derived gate flag from the manifest; caller-supplied values for these names are ignored. */
+export function deriveGateEvidence(manifest, proof = {}) {
+    const flags = {
+        'case-inventory-complete': validateCaseInventory(manifest.cases).length === 0,
+        'evidence-hashes-verified': proof.artifactsVerified === true,
+        'privacy-scan-clean': manifest.evidenceFlags['privacy-scan-clean'] === true,
+    };
+    for (const [name, suite] of Object.entries(DECISION_GATE_SUITES))
+        flags[name] = suiteSatisfied(manifest, suite);
+    for (const flag of GATE_ARTIFACT_FLAGS) {
+        const ref = manifest.gateArtifacts?.[flag];
+        flags[flag] = ref !== undefined && ref.schemaVersion === GATE_ARTIFACT_SCHEMAS[flag]
+            && typeof ref.artifact === 'string' && ref.artifact.length > 0 && sha256Pattern.test(ref.digest);
+    }
+    return flags;
+}
+//# sourceMappingURL=gate-evidence.js.map

package/dist/src/decision/qualification/gates.js

@@ -0,0 +1,83 @@
+import { expectedQualificationCaseIds, validateCaseInventory } from './manifest.js';
+import { deriveGateEvidence, DERIVED_GATE_EVIDENCE } from './gate-evidence.js';
+// Negative evidence always overrides a positive suite result. A release reviewer
+// cannot waive these conditions by supplying passing evidence checks.
+const BLOCKING_FINDINGS = {
+    G1: ['p0-correctness-failed', 'execution-uncertain'],
+    G2: ['privacy-denied'],
+    G3: ['calibration-data-missing'],
+    G6: ['p0-correctness-failed', 'execution-uncertain', 'privacy-denied', 'calibration-data-missing'],
+};
+export const DECISION_RELEASE_GATES = [
+    { id: 'G0', title: 'contract and conformance', mandatory: true, requiredCaseIds: [], requiredEvidence: ['case-inventory-complete', 'contract-suite-complete'] },
+    { id: 'G1', title: 'runtime and adapter correctness', mandatory: true, requiredCaseIds: [], requiredEvidence: ['runtime-suite-complete'] },
+    { id: 'G2', title: 'privacy and security', mandatory: true, requiredCaseIds: [], requiredEvidence: ['privacy-scan-clean', 'security-suite-complete'] },
+    { id: 'G3', title: 'calibration and held-out quality', mandatory: true, requiredCaseIds: [], requiredEvidence: ['immutable-splits', 'calibration-qualified'] },
+    { id: 'G4', title: 'operational resilience', mandatory: true, requiredCaseIds: [], requiredEvidence: ['fault-suite-complete', 'drift-suite-complete'] },
+    { id: 'G5', title: 'performance and resource bounds', mandatory: true, requiredCaseIds: [], requiredEvidence: ['load-manifest-qualified'] },
+    { id: 'G6', title: 'release evidence and review', mandatory: true, requiredCaseIds: [], requiredEvidence: ['evidence-hashes-verified', 'review-decision-recorded'] },
+];
+function evaluateGate(definition, manifest, derived) {
+    const evidenceByCase = new Map(manifest.evidence.map(item => [item.caseId, item]));
+    const requiredCases = definition.id === 'G0'
+        ? expectedQualificationCaseIds()
+        : definition.requiredCaseIds;
+    const missing = [];
+    const failed = [];
+    if (definition.id === 'G0') {
+        missing.push(...validateCaseInventory(manifest.cases).map(error => `inventory:${error}`));
+        const seen = new Set();
+        const known = new Set(expectedQualificationCaseIds());
+        for (const item of manifest.evidence) {
+            if (seen.has(item.caseId))
+                failed.push(`duplicate-evidence:${item.caseId}`);
+            if (!known.has(item.caseId))
+                failed.push(`unknown-evidence:${item.caseId}`);
+            seen.add(item.caseId);
+        }
+    }
+    for (const caseId of requiredCases) {
+        const evidence = evidenceByCase.get(caseId);
+        if (!evidence || !evidence.executable || !evidence.artifact || !evidence.digest
+            || !/^sha256:[a-f0-9]{64}$/.test(evidence.digest)) {
+            missing.push(`case:${caseId}`);
+        }
+        else if (evidence.outcome !== 'pass') {
+            failed.push(`case:${caseId}:${evidence.outcome}`);
+        }
+    }
+    // Derived names are recomputed from recorded evidence; a caller-set flag of
+    // the same name is ignored rather than trusted.
+    const derivedNames = new Set(DERIVED_GATE_EVIDENCE);
+    for (const key of definition.requiredEvidence) {
+        const value = derivedNames.has(key) ? derived[key] : manifest.evidenceFlags[key];
+        if (value !== true)
+            missing.push(`evidence:${key}`);
+    }
+    for (const key of BLOCKING_FINDINGS[definition.id] ?? []) {
+        if (manifest.evidenceFlags[key] === true)
+            failed.push(`finding:${key}`);
+    }
+    // Mandatory gates never turn absent evidence into a skip/pass. Skip is reserved
+    // for future explicitly optional gates.
+    const status = missing.length || failed.length ? (definition.mandatory ? 'fail' : 'skip') : 'pass';
+    return { id: definition.id, title: definition.title, status, missing: missing.sort(), failed: failed.sort() };
+}
+/**
+ * Structural evaluator. Suite, inventory and artifact-backed flags are derived
+ * from the manifest; `evidence-hashes-verified` is only true when the
+ * executable pipeline passes a proof after re-reading every artifact.
+ */
+export function evaluateQualification(manifest, definitions = DECISION_RELEASE_GATES, proof = {}) {
+    const derived = deriveGateEvidence(manifest, proof);
+    const gates = definitions.map(definition => evaluateGate(definition, manifest, derived));
+    const mandatoryFailed = gates.some((gate, index) => definitions[index]?.mandatory && gate.status !== 'pass');
+    return {
+        schemaVersion: 'decision-qualification-report/v1',
+        runId: manifest.runId,
+        generatedAt: manifest.generatedAt,
+        decision: mandatoryFailed ? 'HOLD' : 'PROMOTE',
+        gates,
+    };
+}
+//# sourceMappingURL=gates.js.map