@aiwg/cli 2026.9.21 → 2026.10.0

package/dist/src/decision/ensemble/contract.js

@@ -295,7 +295,50 @@ export function validateEnsembleAggregate(value) {
     semantic(problems, 'ensemble aggregate rejected');
     return aggregate;
 }
-/** A D17 report may keep or tighten the upstream #2037/#2048 decision, never loosen it. */
+/** D17 findings derived from the carried #2037/#2048 integrity fields alone. */
+export function integrityMetadataFindings(integrity, minimumPairs) {
+    const findings = [];
+    if (integrity.integrity_state !== 'verified')
+        findings.push('integrity-not-verified');
+    if (integrity.integrity_mode === 'standard')
+        findings.push('integrity-mode-standard');
+    if (integrity.trusted_score_source === 'local-unverified')
+        findings.push('untrusted-score-source');
+    if (integrity.fresh_workspace_required && !integrity.fresh_workspace_verified)
+        findings.push('fresh-workspace-unverified');
+    if (integrity.uncertainty === null)
+        findings.push('uncertainty-missing');
+    if (integrity.paired_baseline === null)
+        findings.push('paired-baseline-missing');
+    if (integrity.weak_signal_reason !== null)
+        findings.push('weak-signal');
+    if (integrity.compromise_labels.length > 0)
+        findings.push('compromised');
+    if (integrity.sample_n < minimumPairs)
+        findings.push('insufficient-samples');
+    return findings;
+}
+/** The finding for one paired delta against its preregistered threshold, or null when it passes. */
+export function pairedDeltaFinding(threshold, item) {
+    if (!item)
+        return `paired-delta-missing:${threshold.metric}`;
+    if (item.delta === null || !Number.isFinite(item.delta))
+        return `paired-delta-unknown:${threshold.metric}`;
+    if (!Number.isSafeInteger(item.pairs) || item.pairs < threshold.minimumPairs)
+        return `paired-delta-insufficient:${threshold.metric}`;
+    if (threshold.comparison === 'delta-at-least' ? item.delta < threshold.bound : item.delta > threshold.bound)
+        return `paired-delta-failed:${threshold.metric}`;
+    return null;
+}
+/** Upstream ROLLBACK or any compromise gives ROLLBACK; upstream HOLD or any finding gives HOLD. */
+export function ensembleIntegrityDecision(integrity, findingCount) {
+    const upstream = integrity.release_gate.decision;
+    const compromised = integrity.integrity_state === 'compromised' || integrity.compromise_labels.length > 0;
+    return upstream === 'ROLLBACK' || compromised ? 'ROLLBACK' : upstream === 'HOLD' || findingCount > 0 ? 'HOLD' : 'PROMOTE';
+}
+/** A D17 report may keep or tighten the upstream #2037/#2048 decision, never loosen it. Every
+ * finding, passed flag and the decision are recomputed from the carried integrity fields and the
+ * preregistered thresholds; D09-derived findings need the record and are rechecked at promotion. */
 export function validateEnsembleIntegrityReport(value) {
     checkEnsembleSchema('integrityReport', value);
     const report = value;
@@ -307,6 +350,26 @@ export function validateEnsembleIntegrityReport(value) {
         problems.push(`D17 cannot upgrade ${report.upstreamDecision} to ${report.decision}`);
     if (report.decision === 'PROMOTE' && (report.findings.length > 0 || report.pairedDeltas.some(item => !item.passed)))
         problems.push('PROMOTE requires every D17 check to pass');
+    const metrics = report.pairedDeltas.map(item => item.metric);
+    if (canonicalJson(metrics) !== canonicalJson([...REQUIRED_PAIRED_METRICS].sort(compareEnsembleKeys)))
+        problems.push('paired deltas must list every required metric once in canonical order');
+    if (canonicalJson(report.findings) !== canonicalJson([...new Set(report.findings)].sort()))
+        problems.push('findings must be unique and sorted');
+    const expected = integrityMetadataFindings(report.integrity, Math.max(...report.pairedDeltas.map(item => item.minimumPairs)));
+    for (const item of report.pairedDeltas) {
+        const finding = pairedDeltaFinding(item, item);
+        if (item.passed !== (finding === null))
+            problems.push(`paired delta ${item.metric} passed flag does not match its threshold`);
+        // A missing observation is carried as delta null / pairs 0, so either label records the failure.
+        if (finding && !(finding === `paired-delta-unknown:${item.metric}` && report.findings.includes(`paired-delta-missing:${item.metric}`)))
+            expected.push(finding);
+    }
+    for (const finding of expected)
+        if (!report.findings.includes(finding))
+            problems.push(`finding ${finding} is missing`);
+    const decision = ensembleIntegrityDecision(report.integrity, report.findings.length);
+    if (report.decision !== decision)
+        problems.push(`decision ${report.decision} does not follow from its integrity and findings (${decision})`);
     if (digest !== ensembleContractDigest(payload))
         problems.push('integrity report digest does not match its content');
     semantic(problems, 'ensemble integrity report rejected');

package/dist/src/decision/ensemble/index.js

@@ -3,4 +3,5 @@ export * from './contract.js';
 export * from './aggregate.js';
 export * from './drift.js';
 export * from './report.js';
+export * from './runtime.js';
 //# sourceMappingURL=index.js.map

package/dist/src/decision/ensemble/report.js

@@ -1,4 +1,4 @@
-import { championChallengerEligibilityProblems, ensembleContractDigest, EnsembleContractError, validateChampionChallenger, validateEnsembleIntegrityReport, } from './contract.js';
+import { championChallengerEligibilityProblems, ensembleContractDigest, EnsembleContractError, ensembleIntegrityDecision, integrityMetadataFindings, pairedDeltaFinding, validateChampionChallenger, validateEnsembleIntegrityReport, } from './contract.js';
 /** Extends the eval-integrity report with paired champion/challenger evidence. D17 findings can
  * only hold or roll back: HOLD and ROLLBACK from the upstream gate are never upgraded. */
 export function buildEnsembleIntegrityReport(input) {
@@ -10,24 +10,8 @@ export function buildEnsembleIntegrityReport(input) {
     else
         for (const problem of championChallengerEligibilityProblems(record, input.eligibility))
             findings.add(`d09-${problem}`);
-    if (integrity.integrity_state !== 'verified')
-        findings.add('integrity-not-verified');
-    if (integrity.integrity_mode === 'standard')
-        findings.add('integrity-mode-standard');
-    if (integrity.trusted_score_source === 'local-unverified')
-        findings.add('untrusted-score-source');
-    if (integrity.fresh_workspace_required && !integrity.fresh_workspace_verified)
-        findings.add('fresh-workspace-unverified');
-    if (integrity.uncertainty === null)
-        findings.add('uncertainty-missing');
-    if (integrity.paired_baseline === null)
-        findings.add('paired-baseline-missing');
-    if (integrity.weak_signal_reason !== null)
-        findings.add('weak-signal');
-    if (integrity.compromise_labels.length > 0)
-        findings.add('compromised');
-    if (integrity.sample_n < Math.max(...record.pairedMetrics.map(item => item.minimumPairs)))
-        findings.add('insufficient-samples');
+    for (const finding of integrityMetadataFindings(integrity, Math.max(...record.pairedMetrics.map(item => item.minimumPairs))))
+        findings.add(finding);
     const observed = new Map();
     for (const item of input.pairedDeltas) {
         if (observed.has(item.metric))
@@ -36,31 +20,13 @@ export function buildEnsembleIntegrityReport(input) {
     }
     const pairedDeltas = record.pairedMetrics.map(threshold => {
         const item = observed.get(threshold.metric);
-        const delta = item?.delta ?? null;
-        const pairs = item?.pairs ?? 0;
-        let passed = true;
-        if (!item) {
-            findings.add(`paired-delta-missing:${threshold.metric}`);
-            passed = false;
-        }
-        else if (delta === null || !Number.isFinite(delta)) {
-            findings.add(`paired-delta-unknown:${threshold.metric}`);
-            passed = false;
-        }
-        else if (!Number.isSafeInteger(pairs) || pairs < threshold.minimumPairs) {
-            findings.add(`paired-delta-insufficient:${threshold.metric}`);
-            passed = false;
-        }
-        else if (threshold.comparison === 'delta-at-least' ? delta < threshold.bound : delta > threshold.bound) {
-            findings.add(`paired-delta-failed:${threshold.metric}`);
-            passed = false;
-        }
-        return { ...threshold, delta, pairs, passed };
+        const finding = pairedDeltaFinding(threshold, item);
+        if (finding)
+            findings.add(finding);
+        return { ...threshold, delta: item?.delta ?? null, pairs: item?.pairs ?? 0, passed: finding === null };
     }).sort((a, b) => a.metric < b.metric ? -1 : a.metric > b.metric ? 1 : 0);
     const upstreamDecision = integrity.release_gate.decision;
-    const compromised = integrity.integrity_state === 'compromised' || integrity.compromise_labels.length > 0;
-    const decision = upstreamDecision === 'ROLLBACK' || compromised ? 'ROLLBACK'
-        : upstreamDecision === 'HOLD' || findings.size > 0 ? 'HOLD' : 'PROMOTE';
+    const decision = ensembleIntegrityDecision(integrity, findings.size);
     const payload = {
         schemaVersion: 'decision-ensemble-integrity-report/v1',
         subject: { kind: 'champion-challenger', id: record.id, digest, eligibilityId: record.eligibilityId },