@aiwg/cli 2026.9.24 → 2026.10.0

package/dist/src/decision/qualification/capture.js

@@ -21,7 +21,7 @@ function errorText(error) {
  * captured too; run the qualification alone. Writes from child processes are
  * not captured and must be collected by the caller.
  */
-export async function captureQualificationLifetime(operation) {
+export async function captureQualificationLifetime(operation, options = {}) {
     const stdout = [];
     const stderr = [];
     const originalStdout = process.stdout.write;
@@ -29,6 +29,11 @@ export async function captureQualificationLifetime(operation) {
     const originalConsole = Object.fromEntries(CONSOLE_METHODS.map(name => [name, console[name]]));
     const tap = (sink, original) => function (chunk, ...rest) {
         sink.push(typeof chunk === 'string' ? chunk : chunk instanceof Uint8Array ? new TextDecoder().decode(chunk) : String(chunk));
+        if (options.suppressOutput) {
+            const callback = rest.find(value => typeof value === 'function');
+            callback?.();
+            return true;
+        }
         return original.call(this, chunk, ...rest);
     };
     process.stdout.write = tap(stdout, originalStdout);
@@ -36,7 +41,8 @@ export async function captureQualificationLifetime(operation) {
     for (const name of CONSOLE_METHODS) {
         console[name] = (...args) => {
             (STDERR_METHODS.has(name) ? stderr : stdout).push(`${format(...args)}\n`);
-            originalConsole[name].apply(console, args);
+            if (!options.suppressOutput)
+                originalConsole[name].apply(console, args);
         };
     }
     let result;

package/dist/src/decision/qualification/gate-evidence.js

@@ -1,5 +1,6 @@
 import { createHash } from 'node:crypto';
 import { canonicalJson } from '../../security/artifact-trust.js';
+import { matchEvidenceDigest } from '../../gates/stats/index.js';
 import { CalibrationRegistry, calibrationArtifactDigest } from '../calibration/registry.js';
 import { validateCaseInventory } from './manifest.js';
 import { verifyQualificationSplits } from './quality.js';
@@ -29,7 +30,7 @@ export const DECISION_GATE_SUITES = {
 };
 /** Flags backed by a checked, digest-pinned artifact copied into the run directory. */
 export const GATE_ARTIFACT_SCHEMAS = {
-    'immutable-splits': 'decision-binary-benchmark-plan/v1',
+    'immutable-splits': 'decision-binary-benchmark-plan/v2',
     'calibration-qualified': 'decision-calibration-artifact/v1',
     'load-manifest-qualified': 'decision-load-result/v1',
     'review-decision-recorded': 'decision-qualification-review/v1',
@@ -76,8 +77,14 @@ export function suiteSatisfied(manifest, suite) {
     }
     return (suite.evidenceIds ?? []).every(id => proven.has(id));
 }
+/** Split-plan versions with retained evidence: v1 is the pre-migration lineage (legacy allowlisted), v2 is canonical-only. */
+export const IMMUTABLE_SPLIT_VERSIONS = [
+    'decision-binary-benchmark-plan/v1',
+    'decision-binary-benchmark-plan/v2',
+];
 function validSplitPlan(value) {
-    if (!record(value) || value.schemaVersion !== GATE_ARTIFACT_SCHEMAS['immutable-splits'])
+    if (!record(value) || (value.schemaVersion !== 'decision-binary-benchmark-plan/v1'
+        && value.schemaVersion !== 'decision-binary-benchmark-plan/v2'))
         return false;
     const { digest, ...fields } = value;
     try {
@@ -86,7 +93,12 @@ function validSplitPlan(value) {
     catch {
         return false;
     }
-    return typeof digest === 'string' && sha256Pattern.test(digest) && digest === sha256(JSON.stringify(fields))
+    // Versioned legacy allowlist: pre-migration plans hashed JSON.stringify output.
+    // The v1 schema version is the pre-migration lineage, so it alone allowlists
+    // legacy; v2 verifies canonical-only even under an explicit allowlist.
+    const modes = value.schemaVersion === 'decision-binary-benchmark-plan/v1'
+        ? ['canonical', 'legacy'] : ['canonical'];
+    return typeof digest === 'string' && sha256Pattern.test(digest) && matchEvidenceDigest(fields, digest, [...modes]) !== null
         && sha256Pattern.test(String(fields.datasetDigest));
 }
 function validCalibration(value, context) {
@@ -164,7 +176,10 @@ export function deriveGateEvidence(manifest, proof = {}) {
         flags[name] = suiteSatisfied(manifest, suite);
     for (const flag of GATE_ARTIFACT_FLAGS) {
         const ref = manifest.gateArtifacts?.[flag];
-        flags[flag] = ref !== undefined && ref.schemaVersion === GATE_ARTIFACT_SCHEMAS[flag]
+        const versionOk = flag === 'immutable-splits'
+            ? ref !== undefined && IMMUTABLE_SPLIT_VERSIONS.includes(ref.schemaVersion)
+            : ref !== undefined && ref.schemaVersion === GATE_ARTIFACT_SCHEMAS[flag];
+        flags[flag] = versionOk && ref !== undefined
             && typeof ref.artifact === 'string' && ref.artifact.length > 0 && sha256Pattern.test(ref.digest);
     }
     return flags;

package/dist/src/decision/qualification/quality.js

@@ -1,7 +1,12 @@
-import { createHash } from 'node:crypto';
-const sha256 = (value) => `sha256:${createHash('sha256').update(JSON.stringify(value)).digest('hex')}`;
+import { wilson95 } from '../../gates/stats/binomial.js';
+import { canonicalSha256, matchEvidenceDigest, verifyQualificationSplits, } from '../../gates/stats/index.js';
+export { PairedDifferenceError, clopperPearsonInterval, freezeQualificationSplit, normalQuantile, pairedBinaryDifferenceInterval, pairedMeanDifferenceBootstrap, pairedNonInferiority, verifyQualificationSplits, wilsonScoreInterval, } from '../../gates/stats/index.js';
 /** Freeze thresholds and all three label sets before acquiring test predictions. */
 export function freezeBinaryBenchmarkPlan(splits, labels, limits) {
+    const fields = buildBinaryBenchmarkPlanFields(splits, labels, limits);
+    return { ...fields, digest: canonicalSha256(fields) };
+}
+function buildBinaryBenchmarkPlanFields(splits, labels, limits) {
     verifyQualificationSplits(splits);
     const ids = splits.flatMap(split => split.ids).sort();
     if (labels.length !== ids.length || new Set(labels.map(label => label.id)).size !== ids.length
@@ -12,24 +17,57 @@ export function freezeBinaryBenchmarkPlan(splits, labels, limits) {
             .some(value => !Number.isFinite(value) || value < 0 || value > 1)) {
         throw new Error('invalid preregistered benchmark plan');
     }
-    const fields = {
-        schemaVersion: 'decision-binary-benchmark-plan/v1',
+    return {
+        schemaVersion: 'decision-binary-benchmark-plan/v2',
         splits: ['tuning', 'calibration', 'test'].map(name => splits.find(split => split.name === name)),
-        datasetDigest: sha256([...labels].sort((a, b) => a.id.localeCompare(b.id))),
+        datasetDigest: canonicalSha256([...labels].sort((a, b) => a.id.localeCompare(b.id))),
         ...limits,
     };
-    return { ...fields, digest: sha256(fields) };
 }
-/** A separately anchored digest is required: a caller-created plan cannot attest its own preregistration. */
-export function evaluatePreregisteredBinaryBenchmark(plan, trustedPlanDigest, labels, samples) {
+/**
+ * Verifies a frozen plan digest without scoring. Canonical-only by default; pass
+ * `{ digestModes: ['canonical', 'legacy'] }` to allowlist the versioned legacy
+ * (`JSON.stringify`) digest for pre-migration v1 evidence. Fresh v2 records are
+ * canonical-only: a legacy digest on v2 fields never verifies, even under an
+ * explicit allowlist.
+ */
+export function verifyBinaryBenchmarkPlanDigest(plan, labels, options) {
     const { digest, ...fields } = plan;
-    if (digest !== trustedPlanDigest || digest !== sha256(fields)
-        || freezeBinaryBenchmarkPlan(plan.splits, labels, {
+    if (fields.schemaVersion !== 'decision-binary-benchmark-plan/v1'
+        && fields.schemaVersion !== 'decision-binary-benchmark-plan/v2')
+        return null;
+    let expected;
+    try {
+        expected = buildBinaryBenchmarkPlanFields(plan.splits, labels, {
             minimumOverallN: plan.minimumOverallN, minimumSliceN: plan.minimumSliceN,
             maximumSelectiveRisk: plan.maximumSelectiveRisk, maximumReviewRate: plan.maximumReviewRate,
             maximumBrier: plan.maximumBrier,
-        }).digest !== digest)
+        });
+    }
+    catch {
+        return null;
+    }
+    // Substantive fields must match; the version selects the digest lineage.
+    const { schemaVersion: _expectedVersion, ...expectedRest } = expected;
+    void _expectedVersion;
+    const { schemaVersion: _fieldsVersion, ...fieldsRest } = fields;
+    void _fieldsVersion;
+    if (canonicalSha256(expectedRest) !== canonicalSha256(fieldsRest))
+        return null;
+    // v1 respects the caller's allowlist (default canonical-only); v2 intersects
+    // it with canonical-only, so a legacy digest on v2 never verifies.
+    const modes = fields.schemaVersion === 'decision-binary-benchmark-plan/v1'
+        ? options?.digestModes
+        : (options?.digestModes ?? ['canonical']).filter(mode => mode === 'canonical');
+    return matchEvidenceDigest(fields, digest, modes);
+}
+/** A separately anchored digest is required: a caller-created plan cannot attest its own preregistration. */
+export function evaluatePreregisteredBinaryBenchmark(plan, trustedPlanDigest, labels, samples, options) {
+    const { digest } = plan;
+    if (digest !== trustedPlanDigest
+        || verifyBinaryBenchmarkPlanDigest(plan, labels, options) === null) {
         throw new Error('benchmark preregistration or dataset mismatch');
+    }
     const testLabels = new Map(labels.filter(label => plan.splits.find(split => split.name === 'test').ids.includes(label.id))
         .map(label => [label.id, label]));
     if (samples.some(sample => sample.label !== testLabels.get(sample.id)?.label || sample.slice !== testLabels.get(sample.id)?.slice)) {
@@ -53,38 +91,17 @@ export function evaluatePreregisteredBinaryBenchmark(plan, trustedPlanDigest, la
     return { decision: exceeded ? 'fail' : insufficient || metrics.overall.selectiveRisk === null ? 'insufficient-evidence'
             : 'pass', reasons, metrics };
 }
-function digestIds(ids) {
-    return `sha256:${createHash('sha256').update(JSON.stringify([...ids].sort())).digest('hex')}`;
-}
-/** Hash the exact membership set; duplicate, empty and overlapping IDs fail closed. */
-export function freezeQualificationSplit(name, ids) {
-    if (!ids.length || ids.some(id => !id.trim()) || new Set(ids).size !== ids.length) {
-        throw new Error('qualification split requires unique nonempty IDs');
-    }
-    return { name, ids: [...ids].sort(), digest: digestIds(ids) };
-}
-export function verifyQualificationSplits(splits) {
-    if (splits.length !== 3 || new Set(splits.map(split => split.name)).size !== 3
-        || splits.some(split => !['tuning', 'calibration', 'test'].includes(split.name))) {
-        throw new Error('qualification requires tuning, calibration and test splits');
-    }
-    const all = new Set();
-    for (const split of splits) {
-        if (!split.ids.length || split.ids.some(id => typeof id !== 'string' || !id.trim())
-            || new Set(split.ids).size !== split.ids.length || split.digest !== digestIds(split.ids)) {
-            throw new Error('qualification split digest or membership mismatch');
-        }
-        for (const id of split.ids) {
-            if (all.has(id))
-                throw new Error('qualification splits overlap');
-            all.add(id);
-        }
-    }
-}
 /** Refuses to score unregistered or non-held-out samples. */
 export function evaluateBinaryHeldout(splits, samples) {
+    return evaluateBinarySplit(splits, samples, 'test');
+}
+/** Descriptive fit diagnostics; calibration observations are never held-out test evidence. */
+export function evaluateBinaryCalibration(splits, samples) {
+    return evaluateBinarySplit(splits, samples, 'calibration');
+}
+function evaluateBinarySplit(splits, samples, name) {
     verifyQualificationSplits(splits);
-    const test = splits.find(split => split.name === 'test');
+    const test = splits.find(split => split.name === name);
     if (samples.length !== test.ids.length || new Set(samples.map(sample => sample.id)).size !== samples.length
         || samples.some(sample => !test.ids.includes(sample.id))) {
         throw new Error('held-out sample membership mismatch');
@@ -170,15 +187,6 @@ export function measurePairedMovement(pairs) {
     const [low, high] = wilson95(changedN, pairs.length);
     return { sampleN: pairs.length, changedN, changedRate: changedN / pairs.length, changedWilson95: [low, high] };
 }
-function wilson95(errors, n) {
-    // 95% normal quantile; finite-sample Wilson interval for binomial events.
-    const z = 1.959963984540054;
-    const rate = errors / n;
-    const denominator = 1 + z * z / n;
-    const center = (rate + z * z / (2 * n)) / denominator;
-    const margin = z * Math.sqrt(rate * (1 - rate) / n + z * z / (4 * n * n)) / denominator;
-    return [Math.max(0, center - margin), Math.min(1, center + margin)];
-}
 function scoreBinary(samples) {
     const n = samples.length;
     const errors = samples.filter(s => (s.probability >= 0.5 ? 1 : 0) !== s.label).length;

package/dist/src/decision/qualification/release.js

@@ -1,4 +1,58 @@
-import { createHash } from 'node:crypto';
+import { canonicalSha256, matchEvidenceDigest } from '../../gates/stats/index.js';
+/**
+ * #2037/#2048 integrity modes whose verified state has a trusted score source.
+ * Mirrors tools/eval buildIntegrityMetadata: each strict mode maps to exactly one source.
+ */
+export const VERIFIED_QUALIFICATION_INTEGRITY_SOURCES = Object.freeze({
+    fresh: 'fresh-workspace',
+    locked: 'locked-artifact-snapshot',
+    'full-locked': 'full-locked-workspace',
+});
+/**
+ * Allowlist check for promotable integrity metadata. Any malformed, unknown or
+ * unverified mode/state/score-source is a problem; an empty result is the only
+ * state that may PROMOTE. Callers still honour upstream HOLD/ROLLBACK separately.
+ */
+export function qualificationIntegrityAllowlistProblems(integrity) {
+    const value = integrity;
+    if (!value || typeof value !== 'object' || Array.isArray(value)
+        || !Number.isSafeInteger(value.sample_n) || value.sample_n < 0
+        || typeof value.integrity_mode !== 'string' || typeof value.integrity_state !== 'string'
+        || typeof value.trusted_score_source !== 'string'
+        || typeof value.fresh_workspace_required !== 'boolean' || typeof value.fresh_workspace_verified !== 'boolean'
+        || !Array.isArray(value.compromise_labels) || value.compromise_labels.some(label => typeof label !== 'string')
+        || !(value.weak_signal_reason === null || typeof value.weak_signal_reason === 'string')
+        || !('uncertainty' in value) || !('paired_baseline' in value)
+        || !value.release_gate || typeof value.release_gate !== 'object'
+        || !['PROMOTE', 'HOLD', 'ROLLBACK'].includes(value.release_gate.decision)
+        || !Array.isArray(value.release_gate.reasons)) {
+        return ['integrity-invalid'];
+    }
+    const problems = [];
+    const expectedSource = Object.hasOwn(VERIFIED_QUALIFICATION_INTEGRITY_SOURCES, value.integrity_mode)
+        ? VERIFIED_QUALIFICATION_INTEGRITY_SOURCES[value.integrity_mode] : undefined;
+    if (value.integrity_state !== 'verified')
+        problems.push('integrity-not-verified');
+    if (expectedSource === undefined)
+        problems.push('integrity-mode-not-allowlisted');
+    else if (value.trusted_score_source !== expectedSource)
+        problems.push('untrusted-score-source');
+    if (value.fresh_workspace_required && !value.fresh_workspace_verified)
+        problems.push('fresh-workspace-unverified');
+    if (value.uncertainty === null || value.uncertainty === undefined)
+        problems.push('uncertainty-missing');
+    if (value.paired_baseline === null || value.paired_baseline === undefined)
+        problems.push('paired-baseline-missing');
+    if (value.weak_signal_reason !== null)
+        problems.push('weak-signal');
+    if (value.compromise_labels.length > 0)
+        problems.push('compromised');
+    if (value.sample_n <= 0)
+        problems.push('insufficient-samples');
+    if (value.release_gate.decision !== 'PROMOTE')
+        problems.push(`upstream-integrity-${value.release_gate.decision.toLowerCase()}`);
+    return problems;
+}
 /** D30 compile/prefix cache, D03 receipt replay and D15 result cache evidence, each a verified evidence manifest. */
 export const QUALIFICATION_CACHE_LAYERS = ['compilePrefixCache', 'receiptReplay', 'resultCache'];
 const REQUIRED_PINS = [
@@ -83,7 +137,7 @@ export function buildQualificationReleaseRecord(executed, input) {
         || report.decision === 'ROLLBACK' || input.integrity.integrity_state === 'compromised' || input.integrity.compromise_labels.length > 0 ? 'ROLLBACK'
         : complete && releaseDecision === 'PROMOTE' ? 'PROMOTE' : 'HOLD';
     const fields = {
-        schemaVersion: 'decision-qualification-release/v1',
+        schemaVersion: 'decision-qualification-release/v2',
         runId: manifest.runId, sourceCommit: manifest.sourceCommit, dirty: manifest.dirty,
         environment: input.environment, commands: [...input.commands],
         pins: Object.fromEntries(Object.entries(pinned).sort(([a], [b]) => a.localeCompare(b))),
@@ -98,7 +152,26 @@ export function buildQualificationReleaseRecord(executed, input) {
             }])) : null,
         decision,
     };
-    return { ...fields, digest: `sha256:${createHash('sha256').update(JSON.stringify(fields)).digest('hex')}` };
+    return { ...fields, digest: canonicalSha256(fields) };
+}
+/**
+ * Verifies a release record digest without rebuilding it. Canonical-only by default;
+ * pass `{ digestModes: ['canonical', 'legacy'] }` to allowlist the versioned legacy
+ * (`JSON.stringify`) digest for pre-migration v1 evidence. Fresh v2 records are
+ * canonical-only: a legacy digest on v2 fields never verifies, even under an
+ * explicit allowlist. Returns the matching mode, or null when neither matches.
+ */
+export function verifyQualificationReleaseDigest(record, options) {
+    if (!record || typeof record !== 'object')
+        return null;
+    if (record.schemaVersion !== 'decision-qualification-release/v1'
+        && record.schemaVersion !== 'decision-qualification-release/v2')
+        return null;
+    const { digest, ...fields } = record;
+    const modes = record.schemaVersion === 'decision-qualification-release/v1'
+        ? options?.digestModes
+        : (options?.digestModes ?? ['canonical']).filter(mode => mode === 'canonical');
+    return matchEvidenceDigest(fields, digest, modes);
 }
 /** Deliberately excludes private callback details, stdout/stderr and raw captures. */
 export function qualificationReleaseSummary(record) {

package/dist/src/decision/qualification/runner.js

@@ -2,7 +2,7 @@ import { createHash } from 'node:crypto';
 import { lstat, mkdir, readFile, rename, writeFile } from 'node:fs/promises';
 import { dirname, resolve, sep } from 'node:path';
 import { evaluateQualification } from './gates.js';
-import { deriveGateEvidence, DERIVED_GATE_EVIDENCE, GATE_ARTIFACT_FLAGS, GATE_ARTIFACT_SCHEMAS, validateGateArtifact, } from './gate-evidence.js';
+import { deriveGateEvidence, DERIVED_GATE_EVIDENCE, GATE_ARTIFACT_FLAGS, GATE_ARTIFACT_SCHEMAS, IMMUTABLE_SPLIT_VERSIONS, validateGateArtifact, } from './gate-evidence.js';
 import { scanQualificationPrivacy } from './privacy.js';
 /** Named master-test-plan suites plus the M01-M11 amendment IDs. */
 export const QUALIFICATION_EVIDENCE_ID = /^(?:CON|POL|BCH|CTX|CNC|CAN|RTY|REC|SEC|PRV|CAL|DRF|CCP|M(?:0[1-9]|1[01]))-[A-Z0-9][A-Z0-9._-]*$/;
@@ -266,7 +266,10 @@ export async function verifyQualificationGateArtifacts(manifest, artifactRoot, m
             continue;
         }
         const parsed = parseJson(bytes);
-        if (ref.schemaVersion !== GATE_ARTIFACT_SCHEMAS[flag] || !validateGateArtifact(flag, parsed, context)) {
+        const versionOk = flag === 'immutable-splits'
+            ? IMMUTABLE_SPLIT_VERSIONS.includes(ref.schemaVersion)
+            : ref.schemaVersion === GATE_ARTIFACT_SCHEMAS[flag];
+        if (!versionOk || !validateGateArtifact(flag, parsed, context)) {
             results.push({ flag, verified: false, reason: 'invalid-artifact' });
             continue;
         }

package/dist/src/decision/routing/contract.js

@@ -0,0 +1,175 @@
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import Ajv2020 from 'ajv/dist/2020.js';
+import addFormats from 'ajv-formats';
+import { canonicalJson } from '../../security/artifact-trust.js';
+import { admitEntry } from '../entry.js';
+export class RoutingContractError extends Error {
+    layer;
+    details;
+    constructor(message, layer = 'semantic', details = []) {
+        super(message);
+        this.layer = layer;
+        this.details = details;
+        this.name = 'RoutingContractError';
+    }
+}
+export const ROUTING_SCHEMA_FILES = {
+    policy: 'DecisionRoutingPolicy.v1.schema.json',
+    task: 'DecisionRoutingTask.v1.schema.json',
+    receipt: 'DecisionRouteReceipt.v1.schema.json',
+    shadowReport: 'DecisionRoutingShadowReport.v1.schema.json',
+};
+/** Floors below which no preregistration is accepted (#2620 review: n=2 per arm is not evidence). */
+export const ROUTING_MINIMUM_OVERALL_N = 30;
+export const ROUTING_MINIMUM_SLICE_N = 10;
+let validators = null;
+function validator(kind) {
+    if (!validators) {
+        const here = dirname(fileURLToPath(import.meta.url));
+        const dir = [resolve(here, '../../../schemas/decision'), resolve(here, '../../../../schemas/decision')]
+            .find(path => existsSync(resolve(path, ROUTING_SCHEMA_FILES.policy)));
+        if (!dir)
+            throw new Error('Decision routing schema directory is unavailable');
+        const ajv = new Ajv2020({ strict: true, allErrors: true });
+        addFormats(ajv);
+        const compiled = new Map(Object.keys(ROUTING_SCHEMA_FILES).map(name => [
+            name,
+            ajv.compile(JSON.parse(readFileSync(resolve(dir, ROUTING_SCHEMA_FILES[name]), 'utf8'))),
+        ]));
+        compiled.set('jevEvidence', ajv.getSchema('https://aiwg.io/schemas/decision/DecisionRouteReceipt.v1.schema.json#/$defs/jevEvidence'));
+        compiled.set('preregistration', ajv.getSchema('https://aiwg.io/schemas/decision/DecisionRoutingShadowReport.v1.schema.json#/$defs/preregistration'));
+        compiled.set('observation', ajv.getSchema('https://aiwg.io/schemas/decision/DecisionRoutingShadowReport.v1.schema.json#/$defs/observation'));
+        validators = compiled;
+    }
+    return validators.get(kind);
+}
+export function routingDigest(value) {
+    return `sha256:${createHash('sha256').update(canonicalJson(value)).digest('hex')}`;
+}
+export function compareRoutingKeys(a, b) { return a < b ? -1 : a > b ? 1 : 0; }
+/** Deep-freezes a structured clone so no caller or callback can widen a trusted value in place. */
+export function frozenRoutingClone(value) {
+    const freeze = (item) => {
+        if (item && typeof item === 'object' && !Object.isFrozen(item)) {
+            Object.freeze(item);
+            for (const child of Object.values(item))
+                freeze(child);
+        }
+    };
+    const copy = structuredClone(value);
+    freeze(copy);
+    return copy;
+}
+export function checkRoutingSchema(kind, value) {
+    try {
+        admitEntry(value);
+    }
+    catch {
+        throw new RoutingContractError(`${kind} admission denied`, 'admission');
+    }
+    const check = validator(kind);
+    if (!check(value)) {
+        throw new RoutingContractError(`${kind} does not match its v1 schema`, 'schema', (check.errors ?? []).map(error => `${error.instancePath || '/'} ${error.message ?? 'invalid'}`));
+    }
+}
+function semantic(problems, message) {
+    if (problems.length)
+        throw new RoutingContractError(`${message}: ${problems[0]}`, 'semantic', problems);
+}
+/** Returns a deep-frozen copy; the digest covers candidates in canonical ID order, so it does not depend on input order. */
+export function validateRoutingPolicy(value) {
+    checkRoutingSchema('policy', value);
+    const input = value;
+    const policy = frozenRoutingClone({ ...input, candidates: [...input.candidates].sort((a, b) => compareRoutingKeys(a.id, b.id)) });
+    const problems = [];
+    const ids = new Set();
+    for (const candidate of policy.candidates) {
+        if (ids.has(candidate.id))
+            problems.push(`route ${candidate.id} is duplicated`);
+        ids.add(candidate.id);
+        if (candidate.operations.maxAttempts > policy.ceilings.maxAttempts)
+            problems.push(`route ${candidate.id} exceeds policy attempt ceiling`);
+        if (candidate.operations.deadlineMs > policy.ceilings.deadlineMs)
+            problems.push(`route ${candidate.id} exceeds policy deadline ceiling`);
+        if (candidate.operations.costMicrosPerAttempt !== null && candidate.operations.costMicrosPerAttempt > policy.ceilings.maxCostMicros) {
+            problems.push(`route ${candidate.id} exceeds policy cost ceiling`);
+        }
+    }
+    for (const routeId of [policy.defaultRouteId, policy.deterministicFallbackRouteId].filter(Boolean)) {
+        if (!ids.has(routeId))
+            problems.push(`configured route ${routeId} is not declared`);
+    }
+    if (Object.values(policy.utility).some(value => !Number.isFinite(value) || value < 0))
+        problems.push('utility weights must be finite non-negative numbers');
+    if (policy.ceilings.maxFallbacks >= policy.ceilings.maxAttempts)
+        problems.push('maxFallbacks must be below maxAttempts');
+    semantic(problems, 'routing policy rejected');
+    return { policy, digest: routingDigest(policy) };
+}
+/** Closed task schema plus semantic checks; unknown, missing or non-finite requirements fail closed. */
+export function validateRoutingTask(value) {
+    checkRoutingSchema('task', value);
+    return value;
+}
+/** Closed evidence schema plus finiteness; NaN and Infinity cannot pass a JSON schema number check reliably. */
+export function validateJevRoutingEvidence(value) {
+    checkRoutingSchema('jevEvidence', value);
+    const evidence = value;
+    const numbers = [evidence.taskComplexity, evidence.ambiguity, ...evidence.distributions.flatMap(item => [item.taskFit, item.reasoningNeed])];
+    if (!numbers.every(item => Number.isFinite(item) && item >= 0 && item <= 1)) {
+        throw new RoutingContractError('Jev routing evidence must be finite within [0, 1]', 'semantic');
+    }
+    return evidence;
+}
+/** Freeze the paired task set, slices and every promotion threshold before any holdout access. */
+export function freezeRoutingPreregistration(input) {
+    const fields = {
+        schemaVersion: 'decision-routing-preregistration/v1',
+        policy: input.policy,
+        baselineArm: input.baselineArm,
+        registeredAt: input.registeredAt,
+        tasks: [...(input.tasks ?? [])].map(item => ({ id: item.id, slice: item.slice })).sort((a, b) => compareRoutingKeys(a.id, b.id)),
+        thresholds: input.thresholds,
+    };
+    const value = { ...fields, digest: routingDigest(fields) };
+    checkPreregistration(value);
+    return value;
+}
+/** A separately anchored digest is required, as for evaluatePreregisteredBinaryBenchmark. */
+export function verifyRoutingPreregistration(value, trustedDigest) {
+    checkPreregistration(value);
+    const preregistration = value;
+    const { digest, ...fields } = preregistration;
+    if (digest !== trustedDigest || digest !== routingDigest(fields)) {
+        throw new RoutingContractError('routing preregistration does not match its trusted digest', 'semantic');
+    }
+    return preregistration;
+}
+function checkPreregistration(value) {
+    try {
+        checkRoutingSchema('preregistration', value);
+    }
+    catch (error) {
+        throw new RoutingContractError('routing preregistration rejected: invalid schema', 'schema', error instanceof RoutingContractError ? error.details : []);
+    }
+    const preregistration = value;
+    const problems = [];
+    const ids = preregistration.tasks.map(item => item.id);
+    if (new Set(ids).size !== ids.length)
+        problems.push('task IDs must be unique');
+    if (ids.some((id, index) => index > 0 && compareRoutingKeys(ids[index - 1], id) >= 0))
+        problems.push('tasks must be sorted by id');
+    const { thresholds } = preregistration;
+    if (thresholds.minimumOverallN < ROUTING_MINIMUM_OVERALL_N || thresholds.minimumSliceN < ROUTING_MINIMUM_SLICE_N)
+        problems.push('sample floors are below the pilot minimum');
+    if (ids.length < thresholds.minimumOverallN)
+        problems.push('fewer registered tasks than minimumOverallN');
+    if (!Number.isFinite(Date.parse(preregistration.registeredAt)))
+        problems.push('registeredAt is not a timestamp');
+    if (problems.length)
+        throw new RoutingContractError(`routing preregistration rejected: ${problems[0]}`, 'semantic', problems);
+}
+//# sourceMappingURL=contract.js.map

package/dist/src/decision/routing/index.js

@@ -0,0 +1,5 @@
+export * from './types.js';
+export * from './contract.js';
+export * from './runtime.js';
+export * from './report.js';
+//# sourceMappingURL=index.js.map