@aiwg/cli 2026.9.21 → 2026.10.0

package/dist/src/gates/floors.js

@@ -0,0 +1,255 @@
+import { validateGateDocument } from './schema.js';
+import { splitPackId } from './registry.js';
+const OUTCOME_RANK = { PROMOTE: 0, HOLD: 1, ROLLBACK: 2 };
+const OUTCOMES = ['PROMOTE', 'HOLD', 'ROLLBACK'];
+const VERSION_PATTERN = /^\d+\.\d+\.\d+$/;
+const DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/;
+/**
+ * Operator default floor (ADR section 12): every decision study observes the
+ * eval-integrity ceiling. This is a reference to the shipped
+ * `aiwg:decision-engine/integrity-ceiling` pack — the single source of truth
+ * — applied at expansion time (`expandFloorPacks`), never an inline copy.
+ * The default is suppressed only by a configured floor gate with id
+ * `integrity-ceiling` that is an all-scoped `upstream-ceiling` gate
+ * tightening the shipped gate (floor flag included).
+ */
+export const INTEGRITY_CEILING_FLOOR_PACK_ID = 'aiwg:decision-engine/integrity-ceiling';
+export const INTEGRITY_CEILING_FLOOR_PACK_VERSION = '1.0.0';
+/**
+ * A binding ceiling satisfies the configured per-study ceiling when it is at
+ * least as strict. An absent configured ceiling is always satisfied.
+ */
+export function projectCeilingSatisfied(declared, configured) {
+    if (configured === undefined)
+        return true;
+    return OUTCOME_RANK[declared ?? 'PROMOTE'] >= OUTCOME_RANK[configured];
+}
+/**
+ * Resolves the effective project floors: the configured entries, verbatim.
+ * The operator default integrity-ceiling floor is NOT injected here — it is
+ * applied at expansion time (`expandFloorPacks`) from the shipped
+ * `aiwg:decision-engine/integrity-ceiling` pack, where the registry can prove
+ * (via `assertGateTightens`) whether a configured floor genuinely tightens
+ * it. A same-id gate that is not an all-scoped `upstream-ceiling` tightening
+ * never suppresses the default; it is flagged by `validateGatesConfig` and
+ * fails closed at resolution.
+ */
+export function resolveProjectFloors(gates) {
+    assertCeilingDefaults(gates?.ceilings);
+    return {
+        floors: [...(gates?.floors ?? [])],
+        ceilings: { ...(gates?.ceilings ?? {}) },
+        ...(gates?.providers === undefined ? {} : { providers: [...gates.providers] }),
+    };
+}
+/**
+ * The star-ceiling rule (R1/C6), enforced wherever ceilings are consumed —
+ * `resolveProjectFloors` and binding resolution — not only by
+ * `validateGatesConfig`: any per-study ceiling requires a valid `'*'`
+ * default, and no per-study ceiling may loosen it. Throws on violation.
+ */
+export function assertCeilingDefaults(ceilings) {
+    if (ceilings === undefined)
+        return;
+    if (!ceilings || typeof ceilings !== 'object' || Array.isArray(ceilings)) {
+        throw new Error('gates.ceilings: must be an object mapping study ids to outcome ceilings');
+    }
+    const star = ceilings['*'];
+    const starValid = typeof star === 'string' && OUTCOMES.includes(star);
+    for (const [study, ceiling] of Object.entries(ceilings)) {
+        if (typeof ceiling !== 'string' || !OUTCOMES.includes(ceiling)) {
+            throw new Error(`gates.ceilings.${study}: must be PROMOTE, HOLD or ROLLBACK`);
+        }
+        if (study === '*')
+            continue;
+        if (!starValid)
+            throw new Error(`gates.ceilings: per-study ceilings require the project-wide '*' default ceiling`);
+        if (OUTCOME_RANK[ceiling] < OUTCOME_RANK[star]) {
+            throw new Error(`gates.ceilings.${study}: must tighten the project default ceiling ${String(star)}, not loosen it`);
+        }
+    }
+}
+const isRecord = (value) => Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+/**
+ * Validates the `gates` section of `.aiwg/aiwg.config`, returning human-readable
+ * error strings (empty = valid). Follows the hand-rolled aiwg.config convention
+ * (`validateIndexConfig`, `validateExternalLinks`): unknown fields, non-literal
+ * shapes and unparseable pins fail closed here, before any binding resolves.
+ * Inline floor packs are validated against the closed GatePack schema, and
+ * their ids must use the `project:` namespace; pack references may point at
+ * any registered pack (typically an `aiwg:` pack such as the integrity-ceiling
+ * pack, or a `project:` pack).
+ */
+export function validateGatesConfig(gates) {
+    if (gates === undefined || gates === null)
+        return [];
+    if (!isRecord(gates))
+        return ['gates: must be an object'];
+    const errors = [];
+    for (const field of Object.keys(gates)) {
+        if (field !== 'floors' && field !== 'ceilings' && field !== 'providers') {
+            errors.push(`gates.${field}: unknown field`);
+        }
+    }
+    if (gates.floors !== undefined) {
+        if (!Array.isArray(gates.floors)) {
+            errors.push('gates.floors: must be an array');
+        }
+        else {
+            gates.floors.forEach((entry, index) => {
+                errors.push(...validateFloorSource(entry, `gates.floors[${index}]`));
+            });
+        }
+    }
+    if (gates.ceilings !== undefined) {
+        if (!isRecord(gates.ceilings)) {
+            errors.push('gates.ceilings: must be an object mapping study ids to outcome ceilings');
+        }
+        else {
+            for (const [study, ceiling] of Object.entries(gates.ceilings)) {
+                if (!study.trim())
+                    errors.push('gates.ceilings: study id must be a non-empty string');
+                else if (typeof ceiling !== 'string' || !OUTCOMES.includes(ceiling)) {
+                    errors.push(`gates.ceilings.${study}: must be PROMOTE, HOLD or ROLLBACK`);
+                }
+            }
+            const star = gates.ceilings['*'];
+            const studies = Object.entries(gates.ceilings).filter(([study]) => study !== '*');
+            // A per-study ceiling without the project-wide default is a rename
+            // escape: `study-a-v2` would silently inherit no ceiling. Require '*'.
+            if (studies.length > 0 && !(typeof star === 'string' && OUTCOMES.includes(star))) {
+                errors.push(`gates.ceilings: per-study ceilings require the project-wide '*' default ceiling`);
+            }
+            if (typeof star === 'string' && OUTCOMES.includes(star)) {
+                for (const [study, ceiling] of Object.entries(gates.ceilings)) {
+                    if (study !== '*' && typeof ceiling === 'string'
+                        && OUTCOMES.includes(ceiling)
+                        && OUTCOME_RANK[ceiling] < OUTCOME_RANK[star]) {
+                        errors.push(`gates.ceilings.${study}: must tighten the project default ceiling ${star}, not loosen it`);
+                    }
+                }
+            }
+        }
+    }
+    if (gates.providers !== undefined) {
+        if (!Array.isArray(gates.providers)) {
+            errors.push('gates.providers: must be an array');
+        }
+        else {
+            const seen = new Set();
+            gates.providers.forEach((entry, index) => {
+                errors.push(...validateProviderAllowlistEntry(entry, `gates.providers[${index}]`, seen));
+            });
+        }
+    }
+    return errors;
+}
+function validateProviderAllowlistEntry(entry, where, seen) {
+    if (!isRecord(entry))
+        return [`${where}: must be an object`];
+    const errors = [];
+    for (const field of Object.keys(entry)) {
+        if (field !== 'bundleId' && field !== 'providerId' && field !== 'codeDigest'
+            && field !== 'reviewer' && field !== 'reviewedAt') {
+            errors.push(`${where}.${field}: unknown field`);
+        }
+    }
+    if (typeof entry.bundleId !== 'string' || !entry.bundleId.trim()) {
+        errors.push(`${where}.bundleId: required, must be a non-empty string`);
+    }
+    if (typeof entry.providerId !== 'string' || !entry.providerId.trim()) {
+        errors.push(`${where}.providerId: required, must be a non-empty string`);
+    }
+    if (typeof entry.codeDigest !== 'string' || !DIGEST_PATTERN.test(entry.codeDigest)) {
+        errors.push(`${where}.codeDigest: required, must be a sha256 digest`);
+    }
+    if (typeof entry.reviewer !== 'string' || !entry.reviewer.trim() || entry.reviewer.length > 128) {
+        errors.push(`${where}.reviewer: required, must be a non-empty string`);
+    }
+    if (typeof entry.reviewedAt !== 'string' || !Number.isFinite(Date.parse(entry.reviewedAt))) {
+        errors.push(`${where}.reviewedAt: required, must be a date-time`);
+    }
+    if (typeof entry.bundleId === 'string' && typeof entry.providerId === 'string') {
+        const key = `${entry.bundleId}\0${entry.providerId}`;
+        if (seen.has(key))
+            errors.push(`${where}: duplicate allowlist entry for ${entry.bundleId} ${entry.providerId}`);
+        else
+            seen.add(key);
+    }
+    return errors;
+}
+function validateFloorSource(entry, where) {
+    if (!isRecord(entry))
+        return [`${where}: must be an object with exactly one of 'pack' or 'packRef'`];
+    const keys = Object.keys(entry);
+    const unknown = keys.filter(key => key !== 'pack' && key !== 'packRef');
+    if (unknown.length)
+        return [`${where}.${unknown[0]}: unknown field`];
+    if (entry.pack !== undefined && entry.packRef !== undefined) {
+        return [`${where}: must set exactly one of 'pack' or 'packRef'`];
+    }
+    if (entry.pack !== undefined)
+        return validateInlineFloorPack(entry.pack, where);
+    if (entry.packRef !== undefined)
+        return validateFloorPackRef(entry.packRef, where);
+    return [`${where}: must set exactly one of 'pack' or 'packRef'`];
+}
+function validateInlineFloorPack(pack, where) {
+    let parsed;
+    try {
+        parsed = validateGateDocument(pack);
+    }
+    catch (error) {
+        return [`${where}.pack: ${error instanceof Error ? error.message : 'invalid gate pack'}`];
+    }
+    if (parsed.kind !== 'GatePack')
+        return [`${where}.pack: floor pack must have kind GatePack`];
+    try {
+        const { namespace } = splitPackId(parsed.metadata.id);
+        if (namespace !== 'project') {
+            return [`${where}.pack: floor pack id must use the project: namespace (got '${parsed.metadata.id}')`];
+        }
+    }
+    catch (error) {
+        return [`${where}.pack: ${error instanceof Error ? error.message : 'invalid pack id'}`];
+    }
+    const errors = [];
+    for (const gate of parsed.spec.gates) {
+        if (gate.id === 'integrity-ceiling'
+            && (gate.kind !== 'upstream-ceiling' || gate.scope.mode !== 'all')) {
+            errors.push(`${where}.pack: floor gate 'integrity-ceiling' must be an all-scoped upstream-ceiling gate`
+                + ` to govern the default ceiling (a weaker same-id gate never suppresses it;`
+                + ` full tightening against the shipped pack is enforced at resolution)`);
+        }
+    }
+    return errors;
+}
+function validateFloorPackRef(packRef, where) {
+    if (!isRecord(packRef))
+        return [`${where}.packRef: must be an object`];
+    const errors = [];
+    for (const field of Object.keys(packRef)) {
+        if (field !== 'id' && field !== 'version' && field !== 'digest') {
+            errors.push(`${where}.packRef.${field}: unknown field`);
+        }
+    }
+    if (typeof packRef.id !== 'string' || !packRef.id) {
+        errors.push(`${where}.packRef.id: required, must be a non-empty string`);
+    }
+    else {
+        try {
+            splitPackId(packRef.id);
+        }
+        catch (error) {
+            errors.push(`${where}.packRef.id: ${error instanceof Error ? error.message : 'invalid pack id'}`);
+        }
+    }
+    if (typeof packRef.version !== 'string' || !VERSION_PATTERN.test(packRef.version)) {
+        errors.push(`${where}.packRef.version: required, must be a semantic version (X.Y.Z)`);
+    }
+    if (typeof packRef.digest !== 'string' || !DIGEST_PATTERN.test(packRef.digest)) {
+        errors.push(`${where}.packRef.digest: required, must be a sha256 digest`);
+    }
+    return errors;
+}
+//# sourceMappingURL=floors.js.map

package/dist/src/gates/index.js

@@ -0,0 +1,17 @@
+/**
+ * Gates capability phase 1 core (epic #2824): declarative gate packs, a pure deterministic
+ * evaluator and digest-bound reports. Experimental and default-off: nothing in the
+ * decision runtime imports this module, so existing behavior is unchanged.
+ */
+export { GATES_API_VERSION, qualifyGateParameter } from './types.js';
+export { GateSchemaError, validateGateDocument } from './schema.js';
+export { GateRegistryError, GATE_NAMESPACES, splitPackId, validateResolvedPack, resolveThresholdDefault, assertGateTightens, applyGateExtends, composeGatePack, resolveGateBinding, expandFloorPacks, enforceProjectFloors, authoredGatePacksOf, gateProvidersOf, GateRegistry, } from './registry.js';
+export { INTEGRITY_CEILING_FLOOR_PACK_ID, INTEGRITY_CEILING_FLOOR_PACK_VERSION, assertCeilingDefaults, projectCeilingSatisfied, resolveProjectFloors, validateGatesConfig, } from './floors.js';
+export { GateEvaluationError, maxOutcome, gateStatusOutcome, sealUpstream, sealGateHoldout, evaluateGates, } from './evaluate.js';
+export { validateGateReport } from './report.js';
+export { createCoreProviderRegistry, evidenceProvider, pairedProvider, proportionProvider, scalarProvider, screeningProvider } from './providers/index.js';
+export { MetricProviderRegistry } from './providers/index.js';
+export { GATE_PACKS_DIR, GATE_PACK_MAX_BYTES, isGatePackFile, listGatePackFiles, readBundleGatePacksDeclaration, loadGatePackFile, originForPackDir, registerBundleGatePacks, resolveGatePacksDir, discoverShippedGatePacks, } from './discovery.js';
+export { buildGatesRegistry, validateGateFile, loadHoldoutFile, loadUpstreamFile, evaluateGatesFromFiles, installedAiwgRoot, listGatePacks, loadProjectFloorsForEvaluate, showGatePack, packsReferencedByRule, } from './driver.js';
+export { GateProviderError, computeProviderCodeDigest, deriveIsolatedSeed, loadGateBundleProviders, invokeBundleProvider, providerBindingPin, runIsolatedProvider, runIsolatedProviderSync, sealProviderSection, snapshotProviderDir, isLoaderIssuedProvider, isolationLaunchPlan, isolationSandboxStatus, parseIsolatedFrame, probeIsolationSandbox, isBundleProvidersEnabled, GATE_PROVIDER_MAX_FILE_BYTES, GATE_PROVIDER_MAX_FILES, GATE_PROVIDER_MAX_TOTAL_BYTES, GATE_PROVIDER_DEFAULT_TIMEOUT_MS, GATE_PROVIDER_MAX_TIMEOUT_MS, GATE_PROVIDER_DEFAULT_MAX_RECORDS, GATE_PROVIDER_MAX_OUTPUT_BYTES, } from './providers/loader.js';
+//# sourceMappingURL=index.js.map

package/dist/src/gates/providers/evidence.js

@@ -0,0 +1,38 @@
+import { providerSourceDigest, requireRecords } from './types.js';
+/** Sorted, de-duplicated attestations shared by the evidence providers. */
+export function collectAttestations(rows, label) {
+    const seen = new Set();
+    const available = [];
+    for (const row of rows) {
+        if (!row || typeof row.id !== 'string' || !row.id.trim() || typeof row.passed !== 'boolean'
+            || (row.expiresAt !== undefined && row.expiresAt !== null && typeof row.expiresAt !== 'string')
+            || seen.has(row.id)) {
+            throw new Error(`${label} records require unique nonempty ids, a boolean passed and an optional expiry`);
+        }
+        seen.add(row.id);
+        available.push({ id: row.id, passed: row.passed, ...(row.expiresAt === undefined ? {} : { expiresAt: row.expiresAt }) });
+    }
+    return [...available].sort((a, b) => a.id.localeCompare(b.id));
+}
+/**
+ * Core evidence provider: required-evidence attestations are caller-asserted records
+ * evaluated against the binding clock. Powers `evidence` gates. The provider reports
+ * presence, pass state and expiry; the gate decides.
+ */
+export const evidenceProvider = {
+    id: 'test.evidence/v1',
+    version: '1.0.0',
+    description: 'Caller-asserted evidence attestations with pass state and expiry.',
+    metrics: {
+        'attestations': { kind: 'evidence', description: 'Evidence attestations by id.' },
+    },
+    sourceDigest: providerSourceDigest({ id: 'test.evidence/v1', version: '1.0.0',
+        metrics: { 'attestations': { kind: 'evidence' } } }),
+    compute(records) {
+        const rows = requireRecords(records, 'evidence');
+        const pooled = { available: collectAttestations(rows, 'evidence') };
+        return { version: '1.0.0', sourceDigest: evidenceProvider.sourceDigest,
+            metrics: { 'attestations': { bySlice: {}, pooled } } };
+    },
+};
+//# sourceMappingURL=evidence.js.map

package/dist/src/gates/providers/index.js

@@ -0,0 +1,21 @@
+import { evidenceProvider } from './evidence.js';
+import { pairedProvider } from './paired.js';
+import { proportionProvider } from './proportion.js';
+import { MetricProviderRegistry } from './registry.js';
+import { scalarProvider } from './scalar.js';
+import { screeningProvider } from './screening.js';
+export { MetricProviderRegistry } from './registry.js';
+export { evidenceProvider } from './evidence.js';
+export { pairedProvider } from './paired.js';
+export { proportionProvider } from './proportion.js';
+export { scalarProvider } from './scalar.js';
+export { screeningProvider } from './screening.js';
+/** Core providers registered for v1alpha1 offline evaluation. */
+export function createCoreProviderRegistry() {
+    const registry = new MetricProviderRegistry();
+    const providers = [proportionProvider, pairedProvider, scalarProvider, evidenceProvider, screeningProvider];
+    for (const provider of providers)
+        registry.register(provider);
+    return registry;
+}
+//# sourceMappingURL=index.js.map