@aiwg/cli 2026.9.21 → 2026.10.0

package/dist/src/decision/heldout/contract.js

@@ -0,0 +1,309 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import Ajv2020 from 'ajv/dist/2020.js';
+import addFormats from 'ajv-formats';
+import { admitEntry, DEFAULT_ENTRY_LIMITS } from '../entry.js';
+import { sha256 } from '../compile-cache/identity.js';
+import { artifactPin, validateDefinition, validateDecisionDocument } from '../validate.js';
+import { contextLiveBinding, contextLiveRuleset, contextLiveTarget } from '../context-live-qualification.js';
+import { JEV_ENDPOINT, compileJevQuestion } from '../adapters/jev.js';
+import { projectDecisionState, partitionProjectedState } from '../projection.js';
+import { dagLiveReservationMicros } from '../graph-live-qualification.js';
+import { redactStructured, redactText } from '../../governance/redaction.js';
+import { heldoutCorpusSeed } from './generators.js';
+import { studyHeldoutGeneratorDigest as registeredHeldoutGeneratorDigest, reproducibleStudyHeldoutRow as reproducibleRegisteredHeldoutRow, D17_MULTIFACT_GENERATOR_ID, d17MultifactPublicSeed, usesD17MultifactGenerator } from './study-generators.js';
+import { D29_PAID_GENERATOR_IDS } from './d29-generator-ids.js';
+export { sha256 as heldoutDigest };
+export const HELDOUT_CAP_USD = Object.freeze({ D17: 8, D29: 6 });
+export const HELDOUT_PORTFOLIO_CAP_USD = 48;
+export const HELDOUT_ENV_GATE = 'AIWG_DECISION_HELDOUT_LIVE';
+const D29_PUBLIC_DEMO_SEEDS = new Set(['d29-study-v1', 'd29-study-v2', 'd29-study-v3', 'd29-study-v4', 'd29-study-v5', 'd29-study-v6', 'd29-study-v7', 'd29-study-v8']);
+// Canonical corpus digests, including the public version before the wording correction.
+// Slim corpus headers stay refused alongside the full corpora they pin: both are committed demo bytes.
+const D29_PUBLIC_DEMO_CORPORA = new Set([
+    'sha256:6bb4c5990c2d039841074bfb099e8c1ad5c6c40b5bd334817cb897bc320fd744',
+    'sha256:4a0833e7a82d3809cb3b9448af1fbe5eae0ebeb1ee4d8055ae67b9c24f05baca',
+    'sha256:505283a46217e158b39ba93f61e17c28c39c582cad857f7090f38e8844a6794a',
+    'sha256:35ecc8936b7a251d1c34cf630e9b09ed82eff0d05f96c901c01edfa0f9849934',
+    'sha256:372cb180f129938280751bf3db76e4f9bc142ef85e68f38370b88aeec5602963',
+    'sha256:5d09130d1327033dc00e7edb6e936fc3388036c3177aaef3ba20ae1a6ae38604',
+    'sha256:d5b722d175903aefe1b98c3db0c5310df35c0807eb8b7682ebd852f566e28ebc',
+    'sha256:53dea2a1008af107c1634c4d35c663fc18a9412a82a662141a50b0c8bbbdaf64',
+    'sha256:018912caaae0102593be0196fa86f0721edded8b2bed625b5a32b4df260b8a6e',
+    'sha256:6f5834c418810e5d89ce37185b13063ce0c8922220becbb43ae7253678d2da23',
+    'sha256:76186887d4753a8fd011b6abf438f467d19e3b11b15881522fc59d6f0c7cc7d6',
+    'sha256:65454a6a3c1dfd85b3c7e953d836309328a48442ec9ae931b9a907c8d91ff855',
+    // v8 per-generator pins: the same public v6/v7 corpora after the generator digest change.
+    'sha256:4635395bac1c4efc036729879a831d8fd827b8b00d5b3e704b614135123c6549',
+    'sha256:c4a0f5d2a4000091cb435e75a3caca48ae0f4478b03f24a619132ce8bec260de',
+    // Generator d29-synthetic/v8 public development corpus (seed d29-study-v8); refused preemptively.
+    'sha256:ecf148eaea5e7da9e65e481698e12b7d3ecbc431ded55e61cb2fb97a5f285dcf',
+]);
+const limits = { ...DEFAULT_ENTRY_LIMITS, serializedBytes: 32_000_000, properties: 1_000_000,
+    arrayLength: 20000, entries: 2_000_000, memoryBytes: 256_000_000 };
+const validators = new Map();
+export class HeldoutError extends Error {
+    category;
+    detail;
+    /** `detail` names where (for example a corpus row index), never row content. */
+    constructor(category, detail) {
+        super(`Held-out collector refused (${category})${detail ? ` at ${detail}` : ''}`);
+        this.category = category;
+        this.detail = detail;
+    }
+}
+export function checkHeldoutSchema(kind, value) {
+    admitEntry(value, limits);
+    let validate = validators.get(kind);
+    if (!validate) {
+        const here = dirname(fileURLToPath(import.meta.url));
+        const name = `Heldout${kind}.${kind === 'SpendHead' ? 'v2' : 'v1'}.schema.json`;
+        const root = [resolve(here, '../../../schemas/decision'), resolve(here, '../../../../schemas/decision')]
+            .find(path => existsSync(resolve(path, name)));
+        if (!root)
+            throw new HeldoutError('schema-unavailable');
+        const ajv = new Ajv2020({ strict: true });
+        addFormats(ajv);
+        for (const dependency of ['Corpus', 'Preregistration', 'Approval', 'Attempt']) {
+            if (kind === 'Frozen' || kind === 'Event')
+                ajv.addSchema(JSON.parse(readFileSync(resolve(root, `Heldout${dependency}.v1.schema.json`), 'utf8')));
+        }
+        validate = ajv.compile(JSON.parse(readFileSync(resolve(root, name), 'utf8')));
+        validators.set(kind, validate);
+    }
+    if (!validate(value))
+        throw new HeldoutError('schema');
+}
+export function validateHeldoutInputs(corpus, plan) {
+    checkHeldoutSchema('Corpus', corpus);
+    checkHeldoutSchema('Preregistration', plan);
+    // Every row pins its own generator family: the corpus digest must equal the
+    // single family digest all rows resolve to, so no row rides on another study's pin.
+    // Null means unknown, so an unregistered generator or mixed families fail closed.
+    const familyDigests = new Map();
+    const digestOf = (generatorId) => {
+        const cached = familyDigests.get(generatorId);
+        if (cached !== undefined)
+            return cached;
+        try {
+            const digest = registeredHeldoutGeneratorDigest(generatorId);
+            familyDigests.set(generatorId, digest);
+            return digest;
+        }
+        catch {
+            throw new HeldoutError('corpus-provenance');
+        }
+    };
+    let familyDigest = null;
+    for (const row of corpus.rows) {
+        const digest = digestOf(row.provenance.generatorId);
+        if (familyDigest === null)
+            familyDigest = digest;
+        else if (familyDigest !== digest)
+            throw new HeldoutError('corpus-provenance');
+    }
+    if (familyDigest === null || corpus.provenance.generatorDigest !== familyDigest
+        || corpus.provenance.seed !== heldoutCorpusSeed(corpus.rows)) {
+        throw new HeldoutError('corpus-provenance');
+    }
+    const ids = new Set(), families = new Map(), payloads = new Set();
+    const definitions = new Set(corpus.definitions.map(d => d.metadata.id));
+    corpus.definitions.forEach(validateDefinition);
+    if (definitions.size !== corpus.definitions.length || plan.study !== corpus.study || plan.corpusDigest !== sha256(corpus)
+        || plan.outputAndHiddenTokenAllowance >= plan.perRequestTokenBound)
+        throw new HeldoutError('input-pins');
+    for (const row of corpus.rows) {
+        if (!reproducibleRegisteredHeldoutRow(row))
+            throw new HeldoutError('generator-output');
+        if (ids.has(row.id) || families.has(row.familyId) && families.get(row.familyId) !== row.split
+            || payloads.has(sha256(row.input)) || new Set(row.requests.map(r => r.id)).size !== row.requests.length
+            || row.requests.some(r => !definitions.has(r.definitionId)) || !row.requests.length && row.localOutcome === null) {
+            throw new HeldoutError('membership');
+        }
+        ids.add(row.id);
+        families.set(row.familyId, row.split);
+        payloads.add(sha256(row.input));
+    }
+    // A recognizable secret is not synthetic text. Opaque private data still needs operator review.
+    if (redactStructured(corpus).sensitivity !== 'none')
+        throw new HeldoutError('credential-material');
+}
+export function heldoutExecution(corpus, plan, approval, request) {
+    const definition = corpus.definitions.find(d => d.metadata.id === request.definitionId);
+    const purpose = 'heldout-study', origin = new URL(JEV_ENDPOINT).origin;
+    const projection = { version: 'heldout-v1', provider: 'jev', model: approval.model, region: approval.region, origin,
+        purpose, allowIncompleteContext: false, maxSensitivity: 'public',
+        fields: [{ pointer: '/payload', output: 'payload', source: 'synthetic-corpus', subject: 'heldout-subject', trust: 'untrusted',
+                sensitivity: 'public', purpose, retentionClass: 'qualification', accessScopes: ['heldout-reviewer'], exportPolicy: 'denied',
+                deletionPolicy: 'erase', backupPolicy: 'not-persisted', allowedProviders: ['jev'], allowedModels: [approval.model],
+                allowedOrigins: [origin], allowedRegions: [approval.region] }] };
+    const ruleset = contextLiveRuleset(definition.metadata.id, ['q0'], [definition]);
+    const target = contextLiveTarget({ model: approval.model, secretServiceReference: approval.credentialRef }, '1.0.0', plan.requestTimeoutMs);
+    return { definition, projection, ruleset, binding: contextLiveBinding(ruleset, ['q0'], target, plan.requestTimeoutMs) };
+}
+export function heldoutExecutionDigest(corpus, plan, approval) {
+    return sha256(corpus.definitions.map(definition => {
+        const item = heldoutExecution(corpus, plan, approval, { id: 'pin', arm: 'pin', definitionId: definition.metadata.id });
+        return { definition: artifactPin(item.definition), ruleset: artifactPin(item.ruleset), binding: artifactPin(item.binding), projection: sha256(item.projection),
+            adapter: { id: 'jev', version: '1.0.0' } };
+    }));
+}
+export function validateHeldoutBundle(bundle, trustedApprovalDigest) {
+    admitEntry(bundle, limits);
+    if (Object.keys(bundle).sort().join(',') !== 'approval,corpus,preregistration')
+        throw new HeldoutError('bundle-fields');
+    const { corpus, preregistration: plan, approval: a } = bundle;
+    if (corpus?.study === 'D29') {
+        if (D29_PUBLIC_DEMO_CORPORA.has(sha256(corpus)))
+            throw new HeldoutError('public-demo-corpus');
+        if (D29_PUBLIC_DEMO_SEEDS.has(corpus.provenance?.seed))
+            throw new HeldoutError('public-demo-seed');
+        // A D29 bundle is paid-eligible only when every row comes from the current
+        // paid-eligible D29 generator. Older D29 generators (v1–v7) reproduce public
+        // development corpora only, and no other generator (lamp, D17) may be
+        // relabelled as D29.
+        const rows = Array.isArray(corpus.rows) ? corpus.rows : [];
+        if (!rows.length || rows.some(row => !D29_PAID_GENERATOR_IDS.includes(row?.provenance?.generatorId))) {
+            throw new HeldoutError('paid-generator');
+        }
+    }
+    if (usesD17MultifactGenerator(corpus?.rows)) {
+        // D17-MF (#2850): only its own generator, only D17, only a private seed, only the registered calibrator (artifact mode).
+        if (corpus.study !== 'D17' || corpus.rows.some(row => row?.provenance?.generatorId !== D17_MULTIFACT_GENERATOR_ID))
+            throw new HeldoutError('paid-generator');
+        if (d17MultifactPublicSeed(corpus.provenance?.seed))
+            throw new HeldoutError('public-demo-seed');
+        if (a?.calibration?.mode !== 'artifact')
+            throw new HeldoutError('calibration-scope');
+    }
+    validateHeldoutInputs(corpus, plan);
+    if (a?.priceBound?.outputUsdPerMTok !== 0)
+        throw new HeldoutError('free-output-required');
+    checkHeldoutSchema('Approval', a);
+    if (redactText(JSON.stringify([plan, a])).sensitivity !== 'none')
+        throw new HeldoutError('credential-material');
+    if (!plan.calibration.allowedModes.includes(a.calibration.mode)
+        || a.calibration.mode === 'uncalibrated-diagnostic' && plan.calibration.scope !== 'uncalibrated-diagnostic')
+        throw new HeldoutError('calibration-scope');
+    if (!heldoutRowsInScope(bundle).length)
+        throw new HeldoutError('calibration-phase-empty');
+    if (sha256(a) !== trustedApprovalDigest || a.study !== corpus.study || a.corpusDigest !== sha256(corpus)
+        || a.preregistrationDigest !== sha256(plan) || a.executionDigest !== heldoutExecutionDigest(corpus, plan, a)
+        || a.budget.usd > HELDOUT_CAP_USD[a.study] || a.priorStudySpendUsd >= HELDOUT_CAP_USD[a.study]
+        || a.priorPortfolioSpendUsd >= HELDOUT_PORTFOLIO_CAP_USD || a.region.toLowerCase() === 'unknown')
+        throw new HeldoutError('approval-pins');
+}
+/** Input-only pricing: Jev has no remote generation limit, so paid output is inadmissible. */
+export function heldoutReservationMicros(a, inputTokenBound) {
+    if (a.priceBound.outputUsdPerMTok !== 0)
+        throw new HeldoutError('free-output-required');
+    if (!Number.isSafeInteger(inputTokenBound) || inputTokenBound < 1)
+        throw new HeldoutError('input-bound');
+    return dagLiveReservationMicros({ ...a.priceBound, perRequestUsd: undefined }, inputTokenBound)
+        + Math.ceil(a.priceBound.perRequestUsd * 1_000_000);
+}
+export function heldoutReservationTokens(plan, inputTokenBound) {
+    return inputTokenBound + plan.outputAndHiddenTokenAllowance;
+}
+export function heldoutRowsInScope(bundle) {
+    const { calibration } = bundle.approval;
+    if (calibration.mode !== 'staged')
+        return bundle.corpus.rows;
+    const plan = bundle.preregistration.calibration;
+    if (plan.scope !== 'calibrated' || !plan.calibrationPhaseSplits?.length)
+        throw new HeldoutError('calibration-scope');
+    return bundle.corpus.rows.filter(row => calibration.phase === 'test' ? row.split === 'test'
+        : plan.calibrationPhaseSplits.includes(row.split));
+}
+export async function heldoutRequest(corpus, plan, approval, row, request) {
+    if (!heldoutRowsInScope({ corpus, preregistration: plan, approval }).some(item => item.id === row.id && sha256(item) === sha256(row))) {
+        throw new HeldoutError('calibration-phase-row');
+    }
+    return heldoutRequestSize(corpus, plan, approval, row, request);
+}
+/**
+ * The request a row would send and its preregistered size bound, for any row
+ * of the corpus whatever the current phase. Only sizing and planning call it
+ * directly; dispatch goes through heldoutRequest, which also checks the phase.
+ */
+export async function heldoutRequestSize(corpus, plan, approval, row, request) {
+    const execution = heldoutExecution(corpus, plan, approval, request);
+    const projected = await projectDecisionState(row.input, execution.projection);
+    const wire = { state: partitionProjectedState(projected.state, projected.evidence), model: approval.model,
+        questions: { q0: JSON.parse(compileJevQuestion(execution.definition).question) } };
+    // Provider-added input is covered by a preregistered allowance, not by a remote token limit.
+    const requestBytes = Buffer.byteLength(JSON.stringify(wire), 'utf8');
+    const inputTokenBound = requestBytes + (plan.providerOverheadTokens ?? 512);
+    if (inputTokenBound + plan.outputAndHiddenTokenAllowance > plan.perRequestTokenBound)
+        throw new HeldoutError('payload-bound');
+    if (redactStructured(projected.state).sensitivity !== 'none')
+        throw new HeldoutError('credential-material');
+    return { execution, requestDigest: sha256(wire), requestBytes, estimatedTokens: inputTokenBound };
+}
+/**
+ * Sizes every request of every corpus row, in every split, against the
+ * preregistered per-request bound and refuses (`payload-bound`, naming the row
+ * index) before any provider call. A staged run therefore learns at its
+ * calibration phase, before any spend, that a later phase could not dispatch.
+ */
+export async function assertHeldoutRequestBounds(corpus, plan, approval) {
+    for (const [index, row] of corpus.rows.entries())
+        for (const request of row.requests) {
+            try {
+                await heldoutRequestSize(corpus, plan, approval, row, request);
+            }
+            catch (error) {
+                if (error instanceof HeldoutError && error.category === 'payload-bound')
+                    throw new HeldoutError('payload-bound', `row ${index}`);
+                throw error;
+            }
+        }
+}
+export async function planHeldoutCollection(bundle, digest) {
+    validateHeldoutBundle(bundle, digest);
+    await assertHeldoutRequestBounds(bundle.corpus, bundle.preregistration, bundle.approval);
+    let maximumRequestEstimateTokens = 0, tokens = 0, usdMicros = 0;
+    const rows = heldoutRowsInScope(bundle);
+    for (const row of rows)
+        for (const request of row.requests) {
+            const planned = await heldoutRequest(bundle.corpus, bundle.preregistration, bundle.approval, row, request);
+            maximumRequestEstimateTokens = Math.max(maximumRequestEstimateTokens, planned.estimatedTokens);
+            const reservation = heldoutReservationMicros(bundle.approval, planned.estimatedTokens);
+            if (reservation > Math.floor(bundle.approval.budget.usd * 1_000_000))
+                throw new HeldoutError('approval-call-budget');
+            const attempts = 1 + bundle.preregistration.providerFailurePolicy.maxRetries;
+            tokens += attempts * heldoutReservationTokens(bundle.preregistration, planned.estimatedTokens);
+            usdMicros += attempts * reservation;
+        }
+    const attempts = rows.reduce((n, r) => n + r.requests.length, 0) * (1 + bundle.preregistration.providerFailurePolicy.maxRetries);
+    const a = bundle.approval;
+    return { calibration: structuredClone(a.calibration), rowsInScope: rows.map(row => row.id), providerCalls: 0, maximumAttempts: attempts, maximumRequestEstimateTokens, reservedTokens: tokens, reservedUsdMicros: usdMicros,
+        fitsBeforeStop: attempts <= Math.floor(a.budget.calls * 0.8) && tokens <= Math.floor(a.budget.tokens * 0.8)
+            && usdMicros <= Math.floor(Math.min(a.budget.usd, HELDOUT_CAP_USD[a.study] - a.priorStudySpendUsd, HELDOUT_PORTFOLIO_CAP_USD - a.priorPortfolioSpendUsd) * 800_000) };
+}
+/** An intentionally unapproved, unpriced form. Unknown attestations stay null, never fixture approvals. */
+export function heldoutApprovalTemplate(corpus, plan) {
+    validateHeldoutInputs(corpus, plan);
+    const attempts = corpus.rows.reduce((n, row) => n + row.requests.length, 0) * (1 + plan.providerFailurePolicy.maxRetries);
+    return { schemaVersion: 'decision-heldout-approval/v1', approved: false, study: corpus.study, runId: null,
+        reviewer: null, approvalReference: null, sourceCommit: null, exactHeadCi: null, stagingHost: 'titan', stagingWorkspace: null,
+        model: 'jev-1.13.0', servedModel: 'jev-1.13.0', region: null, credentialRef: null, credentialResolverDigest: null,
+        corpusDigest: sha256(corpus), preregistrationDigest: sha256(plan), executionDigest: null, calibration: plan.calibration.scope === 'uncalibrated-diagnostic'
+            ? { mode: 'uncalibrated-diagnostic' } : null,
+        providerTermsReference: null, priceBound: { inputUsdPerMTok: null, outputUsdPerMTok: null, perRequestUsd: null,
+            evidenceReferences: [], approvalReference: null }, budget: { calls: Math.max(1, Math.ceil(attempts / 0.8)),
+            tokens: Math.max(1, Math.ceil(attempts * (plan.perRequestTokenBound + plan.outputAndHiddenTokenAllowance) / 0.8)), usd: HELDOUT_CAP_USD[corpus.study] },
+        priorStudySpendUsd: null, priorPortfolioSpendUsd: null };
+}
+export function validateHeldoutAttempt(attempt) {
+    checkHeldoutSchema('Attempt', attempt);
+    if (attempt.result?.receipt) {
+        validateDecisionDocument(attempt.result.receipt);
+        if (attempt.result.receiptDigest !== sha256(attempt.result.receipt))
+            throw new HeldoutError('receipt-digest');
+    }
+    else if (attempt.result?.receiptDigest)
+        throw new HeldoutError('receipt-missing');
+}
+//# sourceMappingURL=contract.js.map

package/dist/src/decision/heldout/d29-generator-ids.js

@@ -0,0 +1,12 @@
+/**
+ * D29 generator identities. A leaf module with no imports, so every module in
+ * the generator / contract / registry import cycle can read these constants
+ * during evaluation regardless of which module is imported first.
+ */
+export const D29_V8_GENERATOR_ID = 'd29-synthetic/v8';
+export const D29_V8_SEED = 'd29-study-v8';
+/** Latest D29 generator: fresh private seeds always prepare with it. */
+export const D29_LATEST_GENERATOR_ID = D29_V8_GENERATOR_ID;
+/** Generators whose corpora may be approved for paid collection; older ids are public-replay-only. */
+export const D29_PAID_GENERATOR_IDS = Object.freeze([D29_V8_GENERATOR_ID]);
+//# sourceMappingURL=d29-generator-ids.js.map

package/dist/src/decision/heldout/d29-passage-baseline-v2.js

@@ -0,0 +1,93 @@
+import { readFileSync } from 'node:fs';
+import { sha256 } from '../compile-cache/identity.js';
+import { d29PassageBaseline } from './d29-passage-baseline.js';
+const identifier = '([A-Za-z0-9]+(?:-[A-Za-z0-9]+)*)';
+const attribute = '(port|protocol|region|owner team|major version)';
+const values = '([A-Za-z0-9-]+(?: and [A-Za-z0-9-]+)*)';
+const singleValued = new Set(['region', 'owner team', 'major version']);
+const forms = [
+    [new RegExp(`^Module ${identifier} (?:uses|has|runs|listens on|now uses) ${attribute} ${values}$`), 1, 2, 3, false, false],
+    [new RegExp(`^[Tt]he ${attribute} recorded for Module ${identifier} is ${values}$`), 2, 1, 3, false, false],
+    [new RegExp(`^Port ${values} is the port Module ${identifier} uses$`), 2, 0, 1, false, false],
+    [new RegExp(`^Module ${identifier} is configured for, and currently uses, ${attribute} ${values}$`), 1, 2, 3, false, false],
+    [new RegExp(`^Module ${identifier} (?:does not use|no longer uses|does not have|no longer has|does not run|no longer runs) ${attribute} ${values}$`), 1, 2, 3, false, true],
+    [new RegExp(`^Module ${identifier} uses a single ${attribute}, ${values}, with no alternatives$`), 1, 2, 3, true, false],
+    [new RegExp(`^For Module ${identifier}, the ${attribute} is restricted to ${values}$`), 1, 2, 3, true, false],
+    [new RegExp(`^Module ${identifier} uses exactly one ${attribute}: ${values}$`), 1, 2, 3, true, false],
+    [new RegExp(`^Module ${identifier} only uses ${attribute} ${values}$`), 1, 2, 3, true, false],
+    [new RegExp(`^Module ${identifier} uses ${attribute} ${values} and no other (?:port|protocol|region|owner team|major version)$`), 1, 2, 3, true, false],
+];
+function clauses(text) {
+    return text.split(/[.!?](?=\s|$|[)\]]|-->)|;|\r?\n|,?\s+(?:while|whereas|and)\s+(?=Module )/)
+        .map(clause => clause.replace(/^(?:-->|<!--|[\s>()\[\]])+/, '').replace(/(?:-->|[\s()\[\]])+$/, ''))
+        .filter(Boolean);
+}
+function statement(input) {
+    let text = input;
+    const tentative = /^(?:An unconfirmed report suggests that|The draft proposes that|It is possible that) /;
+    const scope = / (?:in staging|during the pilot|in the test environment)$/;
+    const history = /, according to the inventory (?:before the 2025 migration|until the previous release|as of the retired pilot)$/;
+    const qualified = tentative.test(text) || scope.test(text) || history.test(text)
+        || / (?:might use|reportedly uses|was planned to use) /.test(text);
+    text = text.replace(tentative, '').replace(scope, '').replace(history, '')
+        .replace(/ (?:might use|reportedly uses|was planned to use) /, ' uses ');
+    const noAlternatives = /, with no alternatives$/.test(text);
+    if (noAlternatives && !/ uses a single /.test(text))
+        text = text.replace(/, with no alternatives$/, '');
+    text = text.replace(new RegExp(`^(Module ${identifier}) (.*)$`), (_, prefix, _module, body) => {
+        const normalized = body.replace(/^now /, '').replace(/^is now /, 'is ')
+            .replace(/^is (?:not|no longer) owned by team /, 'does not use owner team ')
+            .replace(/^is owned by team /, 'uses owner team ')
+            .replace(/^is (?:not|no longer) deployed in region /, 'does not use region ')
+            .replace(/^is deployed in region /, 'uses region ')
+            .replace(/^(?:does not listen|no longer listens) on port /, 'does not use port ')
+            .replace(/^(?:does not communicate|no longer communicates) over protocol /, 'does not use protocol ')
+            .replace(/^listens only on port /, 'only uses port ')
+            .replace(/^communicates only over protocol /, 'only uses protocol ')
+            .replace(/^listens on port /, 'uses port ')
+            .replace(/^communicates over protocol /, 'uses protocol ');
+        return `${prefix} ${normalized}`;
+    });
+    for (const [pattern, moduleIndex, attributeIndex, valuesIndex, exclusive, negated] of forms) {
+        const match = pattern.exec(text);
+        if (match)
+            return { module: match[moduleIndex], attribute: attributeIndex ? match[attributeIndex] : 'port',
+                values: match[valuesIndex].split(' and '), exclusive: exclusive || noAlternatives, negated, qualified };
+    }
+    return null;
+}
+function statements(text) {
+    const result = [];
+    let previous = null;
+    for (const clause of clauses(text)) {
+        const continued = /^(?:it |now )/.test(clause) && previous
+            ? `Module ${previous} ${clause.replace(/^it /, '')}` : clause;
+        const fact = statement(continued);
+        if (fact) {
+            result.push(fact);
+            previous = fact.module;
+        }
+        else
+            previous = null;
+    }
+    return result;
+}
+/** Visible-text comparator with explicit missing-fact handling; screening-control attempts remain unclassified. */
+export function d29PassageBaselineV2(payload, hardPass) {
+    if (!hardPass || payload.kind !== 'citation')
+        return d29PassageBaseline(payload, hardPass);
+    const claimParts = clauses(payload.claim ?? ''), claim = claimParts.length === 1 ? statement(claimParts[0]) : null;
+    if (!claim || claim.negated || claim.qualified || claim.values.length !== 1)
+        return { route: 'REVIEW', support: 'unclear' };
+    const facts = statements(payload.source ?? '').filter(fact => fact.module === claim.module && fact.attribute === claim.attribute);
+    const current = facts.filter(fact => !fact.qualified);
+    const contradicts = current.some(fact => fact.negated ? fact.values.includes(claim.values[0])
+        : !fact.values.includes(claim.values[0]) && (fact.exclusive || singleValued.has(claim.attribute)));
+    const supports = current.some(fact => !fact.negated && fact.values.includes(claim.values[0]));
+    const support = contradicts ? 'contradicts' : supports ? 'supports' : facts.length ? 'unclear' : 'does-not-support';
+    return { route: support === 'supports' ? 'ADVISORY_READY' : 'REVIEW', support };
+}
+export function d29PassageBaselineV2Digest() {
+    return sha256(readFileSync(new URL(import.meta.url), 'utf8'));
+}
+//# sourceMappingURL=d29-passage-baseline-v2.js.map

package/dist/src/decision/heldout/d29-passage-baseline-v3.js

@@ -0,0 +1,100 @@
+import { readFileSync } from 'node:fs';
+import { sha256 } from '../compile-cache/identity.js';
+import { D29_TRAIN } from './d29-pools.js';
+/** The v3 comparator knows only TRAIN-pool wording: every verb, qualifier
+ * and criterion pattern below is derived from the imported TRAIN pools, so
+ * TEST-pool phrasing (novel verbs, periphrases, coreference) is
+ * parser-unseen by construction. Screening-control attempts stay unclassified. */
+const identifier = '([A-Za-z0-9]+(?:-[A-Za-z0-9]+)*)';
+const values = '([A-Za-z0-9-]+(?: and [A-Za-z0-9-]+)*)';
+const singleValued = new Set(['region', 'owner team', 'major version']);
+const escape = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+const patterns = [];
+for (const [name, verbs] of Object.entries(D29_TRAIN.verbs)) {
+    const attribute = name.replaceAll('-', ' ');
+    patterns.push({ pattern: new RegExp(`^Module ${identifier} ${escape(verbs.direct)} ${values}$`), attribute, exclusive: false, negated: false });
+    patterns.push({ pattern: new RegExp(`^Module ${identifier} ${escape(verbs.negated)} ${values}$`), attribute, exclusive: false, negated: true });
+    patterns.push({ pattern: new RegExp(`^Module ${identifier} ${escape(verbs.movedOut)} ${values}$`), attribute, exclusive: false, negated: true });
+}
+const scopedTails = D29_TRAIN.scoped.map(escape).join('|');
+const tentativeHeads = D29_TRAIN.tentative.map(escape).join('|');
+const temporalTails = D29_TRAIN.temporal.map(escape).join('|');
+const restricted = (attribute) => new RegExp(`^For Module ${identifier}, the ${escape(attribute)} is restricted to ${values}$`);
+function clauses(text) {
+    return text.split(/[.!?](?=\s|$|[)\]]|-->)|;|\r?\n|,?\s+(?:while|whereas|and)\s+(?=Module )/)
+        .map(clause => clause.replace(/^(?:-->|<!--|[\s>()\[\]])+/, '').replace(/(?:-->|[\s()\[\]])+$/, ''))
+        .filter(Boolean);
+}
+function statement(input) {
+    let text = input;
+    const tentative = new RegExp(`^(?:${tentativeHeads}) `);
+    const scope = new RegExp(` (?:${scopedTails})$`);
+    const history = new RegExp(`, according to the inventory (?:${temporalTails})$`);
+    const qualified = tentative.test(text) || scope.test(text) || history.test(text);
+    text = text.replace(tentative, '').replace(scope, '').replace(history, '');
+    const noAlternatives = /, with no alternatives$/.test(text);
+    if (noAlternatives)
+        text = text.replace(/, with no alternatives$/, '');
+    for (const attribute of Object.keys(D29_TRAIN.verbs).map(name => name.replaceAll('-', ' '))) {
+        const match = restricted(attribute).exec(text);
+        if (match)
+            return { module: match[1], attribute, values: match[2].split(' and '), exclusive: true, negated: false, qualified };
+    }
+    for (const { pattern, attribute, exclusive, negated } of patterns) {
+        const match = pattern.exec(text);
+        if (match)
+            return { module: match[1], attribute, values: match[2].split(' and '), exclusive: exclusive || noAlternatives, negated, qualified };
+    }
+    const paraphraseMatch = new RegExp(`^The (port|protocol|region|owner team|major version) ${escape(D29_TRAIN.paraphraseVerb)} for Module ${identifier} is ${values}$`).exec(text);
+    if (paraphraseMatch)
+        return { module: paraphraseMatch[2], attribute: paraphraseMatch[1], values: paraphraseMatch[3].split(' and '), exclusive: noAlternatives, negated: false, qualified };
+    return null;
+}
+function statements(text) {
+    const result = [];
+    let previous = null;
+    for (const clause of clauses(text)) {
+        // TRAIN wording has no pronominal coreference; only `now ...` continuations.
+        const continued = /^now /.test(clause) && previous ? `Module ${previous} ${clause.slice(4)}` : clause;
+        const fact = statement(continued);
+        if (fact) {
+            result.push(fact);
+            previous = fact.module;
+        }
+        else
+            previous = null;
+    }
+    return result;
+}
+function trainReadyForms(module, name) {
+    return new Set(['exact', 'verified', 'checklist'].map(mode => D29_TRAIN.criterion[mode](module, name, '2')));
+}
+/** Train-wording comparator; screening-control attempts remain unclassified. */
+export function d29PassageBaselineV3(payload, hardPass) {
+    if (!hardPass)
+        return { route: 'REVIEW', support: null };
+    if (payload.kind === 'phase-criterion') {
+        const match = new RegExp(`^Module ${identifier} requires independently verified (rollback coverage|security review sign-off|migration test coverage) for all components of the current release\\.$`).exec(payload.criterion ?? '');
+        if (!match)
+            return { route: 'REVIEW', support: null };
+        const [, module, name] = match;
+        const ready = clauses(payload.evidence ?? '').some(sentence => trainReadyForms(module, name).has(sentence));
+        return { route: ready ? 'ADVISORY_READY' : 'REVIEW', support: null };
+    }
+    if (payload.kind !== 'citation')
+        return { route: 'REVIEW', support: 'unclear' };
+    const claimParts = clauses(payload.claim ?? ''), claim = claimParts.length === 1 ? statement(claimParts[0]) : null;
+    if (!claim || claim.negated || claim.qualified || claim.values.length !== 1)
+        return { route: 'REVIEW', support: 'unclear' };
+    const facts = statements(payload.source ?? '').filter(fact => fact.module === claim.module && fact.attribute === claim.attribute);
+    const current = facts.filter(fact => !fact.qualified);
+    const contradicts = current.some(fact => fact.negated ? fact.values.includes(claim.values[0])
+        : !fact.values.includes(claim.values[0]) && (fact.exclusive || singleValued.has(claim.attribute)));
+    const supports = current.some(fact => !fact.negated && fact.values.includes(claim.values[0]));
+    const support = contradicts ? 'contradicts' : supports ? 'supports' : facts.length ? 'unclear' : 'does-not-support';
+    return { route: support === 'supports' ? 'ADVISORY_READY' : 'REVIEW', support };
+}
+export function d29PassageBaselineV3Digest() {
+    return sha256(readFileSync(new URL(import.meta.url), 'utf8'));
+}
+//# sourceMappingURL=d29-passage-baseline-v3.js.map

package/dist/src/decision/heldout/d29-passage-baseline.js

@@ -0,0 +1,66 @@
+import { readFileSync } from 'node:fs';
+import { sha256 } from '../compile-cache/identity.js';
+const identifier = '([A-Za-z0-9]+(?:-[A-Za-z0-9]+)*)';
+const attribute = '(port|protocol|region|owner team|major version)';
+const values = '([A-Za-z0-9-]+(?: and [A-Za-z0-9-]+)*)';
+const singleValued = new Set(['region', 'owner team', 'major version']);
+function sentences(text) {
+    return text.split(/[.!?](?=\s|$|[)\]]|-->)|;|\r?\n/)
+        .map(sentence => sentence.replace(/^(?:-->|<!--|[\s>()\[\]])+/, '').replace(/(?:-->|[\s()\[\]])+$/, ''))
+        .filter(Boolean);
+}
+function statement(text) {
+    const forms = [
+        [new RegExp(`^Module ${identifier} (?:uses|has|runs|listens on|now uses) ${attribute} ${values}$`), 1, 2, 3, false, false],
+        [new RegExp(`^The ${attribute} recorded for Module ${identifier} is ${values}$`), 2, 1, 3, false, false],
+        [new RegExp(`^Port ${values} is the port Module ${identifier} uses$`), 2, 0, 1, false, false],
+        [new RegExp(`^Module ${identifier} is configured for, and currently uses, ${attribute} ${values}$`), 1, 2, 3, false, false],
+        [new RegExp(`^Module ${identifier} (?:does not use|no longer uses|does not have|no longer has|does not run|no longer runs) ${attribute} ${values}$`), 1, 2, 3, false, true],
+        [new RegExp(`^Module ${identifier} uses a single ${attribute}, ${values}, with no alternatives$`), 1, 2, 3, true, false],
+        [new RegExp(`^For Module ${identifier}, the ${attribute} is restricted to ${values}$`), 1, 2, 3, true, false],
+        [new RegExp(`^Module ${identifier} uses exactly one ${attribute}: ${values}$`), 1, 2, 3, true, false],
+        [new RegExp(`^Module ${identifier} only uses ${attribute} ${values}$`), 1, 2, 3, true, false],
+        [new RegExp(`^Module ${identifier} uses ${attribute} ${values} and no other (?:port|protocol|region|owner team|major version)$`), 1, 2, 3, true, false],
+    ];
+    for (const [pattern, moduleIndex, attributeIndex, valuesIndex, exclusive, negated] of forms) {
+        const match = pattern.exec(text);
+        if (match)
+            return { module: match[moduleIndex], attribute: attributeIndex ? match[attributeIndex] : 'port',
+                values: match[valuesIndex].split(' and '), exclusive, negated };
+    }
+    return null;
+}
+function verifiedCriterion(criterion, evidence) {
+    const match = new RegExp(`^Module ${identifier} requires independently verified (rollback coverage|security review sign-off|migration test coverage) for all components of the current release\\.$`).exec(criterion);
+    if (!match)
+        return false;
+    const [, module, name] = match;
+    const accepted = new Set([
+        `Module ${module} has ${name} independently verified for all components of the current release`,
+        `An independent assessor verified ${name} for every component in the current release of Module ${module}`,
+        `The current release checklist for Module ${module} records independent verification of ${name} for all components`,
+    ]);
+    return sentences(evidence).some(sentence => accepted.has(sentence));
+}
+/** Deliberately naive visible-text comparator: context and screening-control attempts are not classified. */
+export function d29PassageBaseline(payload, hardPass) {
+    if (!hardPass)
+        return { route: 'REVIEW', support: null };
+    if (payload.kind === 'citation') {
+        const claimParts = sentences(payload.claim ?? ''), claim = claimParts.length === 1 ? statement(claimParts[0]) : null;
+        if (!claim || claim.negated || claim.values.length !== 1)
+            return { route: 'REVIEW', support: 'unclear' };
+        const facts = sentences(payload.source ?? '').map(statement).filter((fact) => fact !== null && fact.module === claim.module && fact.attribute === claim.attribute);
+        const contradicts = facts.some(fact => fact.negated ? fact.values.includes(claim.values[0])
+            : !fact.values.includes(claim.values[0]) && (fact.exclusive || singleValued.has(claim.attribute)));
+        const supports = facts.some(fact => !fact.negated && fact.values.includes(claim.values[0]));
+        const support = contradicts ? 'contradicts' : supports ? 'supports' : 'unclear';
+        return { route: support === 'supports' ? 'ADVISORY_READY' : 'REVIEW', support };
+    }
+    return { route: payload.kind === 'phase-criterion' && verifiedCriterion(payload.criterion ?? '', payload.evidence ?? '')
+            ? 'ADVISORY_READY' : 'REVIEW', support: null };
+}
+export function d29PassageBaselineDigest() {
+    return sha256(readFileSync(new URL(import.meta.url), 'utf8'));
+}
+//# sourceMappingURL=d29-passage-baseline.js.map