@aiwg/cli 2026.9.24 → 2026.10.1

package/dist/src/decision/sensitivity/comparative.js

@@ -0,0 +1,154 @@
+import { pairedBinaryDifferenceInterval, wilsonScoreInterval } from '../qualification/quality.js';
+import { qualificationIntegrityAllowlistProblems } from '../qualification/release.js';
+import { checkSensitivitySchema, sensitivityDigest, validateSensitivityReport } from './contract.js';
+export const REPLAY_SLICES = ['threshold-boundary', 'priority-loss', 'unchanged-control', 'unreplayable'];
+const DIGEST = /^sha256:[0-9a-f]{64}$/;
+const bpsUpper = (events, n, levelBps) => n ? Math.ceil(wilsonScoreInterval({ events, n, levelBps })[1] * 10_000) : null;
+export function validateComparativeReplayPreregistration(value) {
+    checkSensitivitySchema('comparativePlan', value);
+    if (value.minimumTestRoots < value.minimumSliceRoots * REPLAY_SLICES.length) {
+        throw new Error('comparative replay slice support exceeds total minimum');
+    }
+    const { digest, ...payload } = value;
+    if (sensitivityDigest(payload) !== digest)
+        throw new Error('comparative replay preregistration digest mismatch');
+}
+/** Rebuild from trusted preregistration, stored reports and independently authored gold. */
+export function buildComparativeReplayReport(input) {
+    const plan = input.preregistration;
+    validateComparativeReplayPreregistration(plan);
+    if (plan.digest !== input.trustedPreregistrationDigest)
+        throw new Error('untrusted comparative replay preregistration');
+    checkSensitivitySchema('comparativeIntegrity', input.integrity);
+    if (!DIGEST.test(input.trustedIntegrityDigest) || sensitivityDigest(input.integrity) !== input.trustedIntegrityDigest) {
+        throw new Error('untrusted eval-integrity metadata');
+    }
+    if (!Number.isFinite(Date.parse(input.accessedAt)) || Date.parse(input.accessedAt) <= Date.parse(plan.frozenAt)) {
+        throw new Error('test access must follow preregistration freeze');
+    }
+    checkSensitivitySchema('comparativeMembers', input.members);
+    if (sensitivityDigest(input.members) !== plan.splitDigest
+        || sensitivityDigest(input.members.map(({ id, payloadDigest }) => ({ id, payloadDigest }))) !== plan.corpusDigest) {
+        throw new Error('frozen comparative replay membership mismatch');
+    }
+    const members = new Map(input.members.map(member => [member.id, member]));
+    if (members.size !== input.members.length || input.roots.length !== input.members.length) {
+        throw new Error('incomplete or duplicate comparative replay membership');
+    }
+    const gold = input.roots.map(({ id, gold }) => ({ id, gold })).sort((a, b) => a.id.localeCompare(b.id));
+    checkSensitivitySchema('comparativeGold', gold);
+    if (sensitivityDigest(gold) !== plan.goldDigest)
+        throw new Error('frozen comparative replay gold mismatch');
+    const findings = new Set();
+    const ids = new Set();
+    const sources = new Set();
+    const rows = [];
+    let backendCalls = 0;
+    let tokens = 0;
+    let costMicros = 0;
+    let exactReproduction = true;
+    for (const root of input.roots) {
+        if (!root.id || ids.has(root.id) || !REPLAY_SLICES.includes(root.slice) || !DIGEST.test(root.sourceResultDigest)) {
+            throw new Error('invalid or duplicate comparative replay root');
+        }
+        ids.add(root.id);
+        if (sources.has(root.sourceResultDigest))
+            throw new Error('duplicate source scenario');
+        sources.add(root.sourceResultDigest);
+        const member = members.get(root.id);
+        if (!member || member.slice !== root.slice || member.split !== root.split
+            || member.sourceResultDigest !== root.sourceResultDigest)
+            throw new Error('comparative replay root membership mismatch');
+        const report = validateSensitivityReport(root.report);
+        if (report.digest !== root.trustedReportDigest || report.analysisKind !== 'policy-replay'
+            || report.plan.digest !== member.planDigest || report.status !== 'completed' || report.rows.length !== 1 || report.baseline.resultRef.digest !== root.sourceResultDigest) {
+            findings.add(`report-invalid:${root.id}`);
+        }
+        if (report.privacy.redaction !== 'hash-values' || report.privacy.summaryPrecisionBps < 100
+            || report.rows.some(row => !['reused-stored-evidence', 'deduplicated-control', 'unreplayable'].includes(row.inference)
+                || row.freshInvocationId !== null || row.counterfactualReceipt !== null
+                || row.sourceReceipt.digest !== root.sourceResultDigest
+                || row.resourceUse.backendCalls !== 0 || row.resourceUse.tokens !== 0 || row.resourceUse.costMicros !== 0)) {
+            findings.add(`not-zero-call-policy-replay:${root.id}`);
+        }
+        if (root.reproductionDigest !== report.digest)
+            exactReproduction = false;
+        backendCalls += report.budget.backendCalls;
+        tokens += report.budget.tokens;
+        costMicros += report.budget.costMicros;
+        const row = report.rows[0];
+        const predictedUnreplayable = row?.inference === 'unreplayable';
+        const falseNoChange = root.gold.unreplayable && !predictedUnreplayable;
+        const correct = !!row && report.status === 'completed'
+            && predictedUnreplayable === root.gold.unreplayable
+            && row.deltas.status === root.gold.status
+            && row.deltas.outcomeChanged === root.gold.outcomeChanged
+            && row.deltas.acceptanceChanged === root.gold.acceptanceChanged
+            && row.deltas.ruleChanged === root.gold.ruleChanged;
+        rows.push({ id: root.id, slice: root.slice, split: root.split, reportDigest: report.digest, correct, falseNoChange });
+    }
+    rows.sort((a, b) => a.id.localeCompare(b.id));
+    const testRows = rows.filter(row => row.split === 'test');
+    const errors = testRows.filter(row => !row.correct).length;
+    const falseNoChange = testRows.filter(row => row.falseNoChange).length;
+    const pairedLowerBps = testRows.length ? pairedBinaryDifferenceInterval({ counts: { both: testRows.length - errors,
+            candidateOnly: 0, baselineOnly: errors, neither: 0 }, levelBps: plan.levelBps, method: plan.pairedMethod }).lowerBps : null;
+    const errorUpperBps = bpsUpper(errors, testRows.length, plan.levelBps);
+    const slices = Object.fromEntries(REPLAY_SLICES.map(slice => {
+        const items = testRows.filter(row => row.slice === slice);
+        const sliceErrors = items.filter(row => !row.correct).length;
+        return [slice, { roots: items.length, errors: sliceErrors, errorUpperBps: bpsUpper(sliceErrors, items.length, plan.levelBps) }];
+    }));
+    if (testRows.length < plan.minimumTestRoots)
+        findings.add('test-support-insufficient');
+    if (errors > 0)
+        findings.add('diagnostic-errors');
+    if (falseNoChange > 0)
+        findings.add('false-no-change');
+    if (pairedLowerBps === null || pairedLowerBps < plan.nonInferiorityMarginBps)
+        findings.add('non-inferiority-failed');
+    if (errorUpperBps === null || errorUpperBps > plan.maxErrorUpperBps)
+        findings.add('error-bound-failed');
+    for (const slice of REPLAY_SLICES) {
+        const metric = slices[slice];
+        if (metric.roots < plan.minimumSliceRoots || metric.errors > 0
+            || metric.errorUpperBps === null || metric.errorUpperBps > plan.maxSliceErrorUpperBps)
+            findings.add(`slice-failed:${slice}`);
+    }
+    if (backendCalls > plan.maxBackendCalls || tokens > plan.maxTokens || costMicros > plan.maxCostMicros)
+        findings.add('zero-call-budget-violated');
+    if (!exactReproduction)
+        findings.add('reproduction-mismatch');
+    const diagnosticDecision = findings.size === 0 ? 'pass' : 'fail';
+    for (const problem of qualificationIntegrityAllowlistProblems(input.integrity))
+        findings.add(problem);
+    if (input.integrity.sample_n !== testRows.length)
+        findings.add('integrity-sample-mismatch');
+    if (input.reviewerAuditDigest !== null)
+        throw new Error('operator review ingestion is not implemented');
+    findings.add('reviewer-audit-pending');
+    const upstreamDecision = input.integrity.release_gate.decision;
+    const decision = upstreamDecision === 'ROLLBACK' || input.integrity.integrity_state === 'compromised'
+        || input.integrity.compromise_labels.length > 0 ? 'ROLLBACK'
+        : upstreamDecision === 'HOLD' || findings.size > 0 ? 'HOLD' : 'PROMOTE';
+    const payload = {
+        schemaVersion: 'decision-comparative-replay-report/v1', mode: 'shadow',
+        semantics: 'associative-sensitivity-not-causal', actionAuthorization: 'not-authorized',
+        preregistrationDigest: plan.digest, corpusDigest: plan.corpusDigest, goldDigest: plan.goldDigest,
+        splitDigest: plan.splitDigest, accessedAt: input.accessedAt, integrity: input.integrity,
+        integrityDigest: input.trustedIntegrityDigest, roots: rows,
+        metrics: { testRoots: testRows.length, errors, falseNoChange, pairedLowerBps, errorUpperBps,
+            slices, backendCalls, tokens, costMicros, exactReproduction },
+        diagnosticDecision, reviewStatus: 'pending', findings: [...findings].sort(), upstreamDecision, decision,
+    };
+    const report = { ...payload, digest: sensitivityDigest(payload) };
+    checkSensitivitySchema('comparativeReport', report);
+    return report;
+}
+export function validateComparativeReplayReport(report, input) {
+    checkSensitivitySchema('comparativeReport', report);
+    const expected = buildComparativeReplayReport(input);
+    if (sensitivityDigest(report) !== sensitivityDigest(expected))
+        throw new Error('comparative replay report differs from bound inputs');
+}
+//# sourceMappingURL=comparative.js.map

package/dist/src/decision/sensitivity/contract.js

@@ -0,0 +1,218 @@
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import Ajv2020 from 'ajv/dist/2020.js';
+import addFormats from 'ajv-formats';
+import { canonicalJson } from '../../security/artifact-trust.js';
+import { admitEntry, DEFAULT_ENTRY_LIMITS } from '../entry.js';
+export class SensitivityContractError extends Error {
+    layer;
+    details;
+    constructor(message, layer = 'semantic', details = []) {
+        super(message);
+        this.layer = layer;
+        this.details = details;
+        this.name = 'SensitivityContractError';
+    }
+}
+export const SENSITIVITY_SCHEMA_FILES = {
+    plan: 'DecisionSensitivityPlan.v1.schema.json',
+    report: 'DecisionSensitivityReport.v1.schema.json',
+    comparativePlan: 'DecisionComparativeReplayPreregistration.v1.schema.json',
+    comparativeReport: 'DecisionComparativeReplayReport.v1.schema.json',
+    comparativeMembers: 'DecisionComparativeReplayMembers.v1.schema.json',
+    comparativeGold: 'DecisionComparativeReplayGold.v1.schema.json',
+    comparativeIntegrity: 'DecisionComparativeReplayIntegrity.v1.schema.json',
+};
+let validators = null;
+function schemaValidator(kind) {
+    if (!validators) {
+        const here = dirname(fileURLToPath(import.meta.url));
+        const dir = [resolve(here, '../../../schemas/decision'), resolve(here, '../../../../schemas/decision')]
+            .find(path => existsSync(resolve(path, SENSITIVITY_SCHEMA_FILES.plan)));
+        if (!dir)
+            throw new Error('Decision sensitivity schema directory is unavailable');
+        const ajv = new Ajv2020({ strict: true, allErrors: true });
+        addFormats(ajv);
+        validators = new Map(Object.keys(SENSITIVITY_SCHEMA_FILES).map(name => [
+            name,
+            ajv.compile(JSON.parse(readFileSync(resolve(dir, SENSITIVITY_SCHEMA_FILES[name]), 'utf8'))),
+        ]));
+    }
+    return validators.get(kind);
+}
+export function checkSensitivitySchema(kind, value) {
+    try {
+        admitEntry(value, kind.startsWith('comparative')
+            ? { ...DEFAULT_ENTRY_LIMITS, serializedBytes: 2_097_152, properties: 32_768, entries: 65_536, memoryBytes: 16_777_216 }
+            : DEFAULT_ENTRY_LIMITS);
+    }
+    catch {
+        throw new SensitivityContractError(`${kind} admission denied`, 'admission');
+    }
+    const check = schemaValidator(kind);
+    if (!check(value)) {
+        throw new SensitivityContractError(`${kind} does not match its v1 schema`, 'schema', (check.errors ?? []).map(error => `${error.instancePath || '/'} ${error.message ?? 'invalid'}`));
+    }
+}
+export function sensitivityDigest(value) {
+    return `sha256:${createHash('sha256').update(canonicalJson(value)).digest('hex')}`;
+}
+export function validateSensitivityPlan(value) {
+    checkSensitivitySchema('plan', value);
+    const plan = value;
+    const problems = [];
+    if (plan.mode !== 'disabled' && plan.mode !== 'shadow')
+        problems.push('sensitivity mode must be disabled or shadow');
+    if (plan.sourceSubject.tenantId !== plan.tenantId || plan.sourceSubject.workspaceId !== plan.workspaceId
+        || plan.sourceSubject.projectId !== plan.projectId)
+        problems.push('source subject must be in the plan tenant/workspace/project');
+    if (Date.parse(plan.authorization.expiresAt) <= Date.parse(plan.authorization.approvedAt))
+        problems.push('authorization expiry must follow approval');
+    if (plan.variants.length > plan.budgets.maxVariants)
+        problems.push('variant count exceeds maxVariants');
+    if (plan.baselineStability.enabled && plan.baselineStability.repeats > plan.budgets.maxBackendCalls) {
+        problems.push('baseline stability repeats exceed backend-call budget');
+    }
+    if (plan.analysisKind === 'policy-replay' && plan.baselineStability.enabled && plan.baselineStability.repeats > 0) {
+        problems.push('baseline stability repeats require input reevaluation');
+    }
+    if (plan.analysisKind === 'policy-replay' && plan.budgets.maxBackendCalls !== 0) {
+        problems.push('policy replay must reserve zero backend calls');
+    }
+    if (plan.analysisKind === 'input-reevaluation' && plan.privacy.egress !== 'no-external-egress') {
+        problems.push('input reevaluation must use no-external-egress in the offline analyzer');
+    }
+    const allowed = new Set(plan.allowedPaths);
+    const domains = new Map(plan.pathDomains.map(domain => [domain.path, domain]));
+    for (const path of plan.allowedPaths) {
+        if (!domains.has(path))
+            problems.push(`allowed path ${path} has no D10-approved value domain`);
+        if (hasForbiddenPointerSegment(path))
+            problems.push(`allowed path ${path} contains a prohibited pointer segment`);
+        if (forbiddenAuthorityPath(path))
+            problems.push(`path ${path} can alter model, credential, executor, permission or legal authority`);
+        if (plan.analysisKind === 'policy-replay' && !policyReplayPath(path))
+            problems.push(`policy replay path ${path} is not deterministic policy`);
+        if (plan.analysisKind === 'input-reevaluation' && !path.startsWith('/input/'))
+            problems.push(`input reevaluation path ${path} must be under /input`);
+    }
+    const ids = new Set();
+    const precisionPaths = new Map();
+    for (const variant of plan.variants) {
+        if (ids.has(variant.id))
+            problems.push(`variant ${variant.id} is duplicated`);
+        if (/^baseline-/i.test(variant.id))
+            problems.push(`variant ${variant.id} uses a reserved baseline identifier`);
+        ids.add(variant.id);
+        for (const change of variant.changes) {
+            if (!allowed.has(change.path))
+                problems.push(`variant ${variant.id} changes undeclared path ${change.path}`);
+            if (hasForbiddenPointerSegment(change.path))
+                problems.push(`variant ${variant.id} uses prohibited pointer segment at ${change.path}`);
+            if (looksExecutable(change.value))
+                problems.push(`variant ${variant.id} contains executable or locator-like value at ${change.path}`);
+            if (plan.analysisKind === 'policy-replay' && changesTargetIdentity(change.value)) {
+                problems.push(`variant ${variant.id} would change target identity at ${change.path}`);
+            }
+            const domain = domains.get(change.path);
+            if (domain && !domain.values.some(value => canonicalJson(value) === canonicalJson(change.value))) {
+                problems.push(`variant ${variant.id} value is outside the approved domain for ${change.path}`);
+            }
+            const action = actionValue(change.value);
+            if (action && !plan.authorization.authorizedActions.includes(action))
+                problems.push(`variant ${variant.id} names unauthorized action ${action}`);
+            const label = labelValue(change.value);
+            if (label && !plan.authorization.authorizedLabels.includes(label))
+                problems.push(`variant ${variant.id} names unauthorized label ${label}`);
+            if (typeof change.value === 'number') {
+                const list = precisionPaths.get(change.path) ?? [];
+                list.push(change.value);
+                precisionPaths.set(change.path, list);
+                const bps = Math.round(change.value);
+                if (Math.abs(change.value - bps) > 0 || bps % plan.privacy.summaryPrecisionBps !== 0) {
+                    problems.push(`variant ${variant.id} uses precision finer than the report policy at ${change.path}`);
+                }
+            }
+        }
+    }
+    if (plan.probeControl.prohibitMembershipQueries) {
+        for (const path of plan.allowedPaths) {
+            if (/member|membership|exists|subject|user|account/i.test(path))
+                problems.push(`membership-style path ${path} is prohibited`);
+        }
+    }
+    if (plan.privacy.differencing === 'deny') {
+        for (const [path, values] of precisionPaths) {
+            const unique = [...new Set(values)].sort((a, b) => a - b);
+            if (unique.length > 2)
+                problems.push(`path ${path} looks like repeated threshold probing`);
+        }
+    }
+    if (problems.length)
+        throw new SensitivityContractError(`sensitivity plan rejected: ${problems[0]}`, 'semantic', problems);
+    return plan;
+}
+export function validateSensitivityReport(value) {
+    checkSensitivitySchema('report', value);
+    const report = value;
+    const { digest, ...payload } = report;
+    const problems = [];
+    if (sensitivityDigest(payload) !== digest)
+        problems.push('report digest does not match its content');
+    if (report.actionAuthorization !== 'not-authorized')
+        problems.push('sensitivity report cannot authorize actions');
+    if (report.semantics !== 'associative-sensitivity-not-causal')
+        problems.push('sensitivity report cannot claim causal explanation');
+    if (report.rows.some(row => row.inference === 'new-invocation' && !row.freshInvocationId))
+        problems.push('new invocations must name a fresh invocation ID');
+    if (report.rows.some(row => row.changes.some(change => rawValueLeak(change)))) {
+        problems.push('report changes must not contain raw values');
+    }
+    if (problems.length)
+        throw new SensitivityContractError(`sensitivity report rejected: ${problems[0]}`, 'semantic', problems);
+    return report;
+}
+// Binding changes are limited to acceptance policy and fallback routing below a single target;
+// replacing a target, the target list or a whole evaluation could swap the executor.
+function policyReplayPath(path) {
+    return path.startsWith('/ruleset/spec/rules/') || path === '/ruleset/spec/defaultOutcome'
+        || path === '/ruleset/spec/failureOutcome' || path === '/ruleset/spec/conflict'
+        || /^\/binding\/spec\/evaluations\/[^/]+\/(?:targets\/\d+\/acceptance|fallbackOn)(?:\/.*)?$/.test(path);
+}
+function forbiddenAuthorityPath(path) {
+    return /(?:^|\/)(model|requestedModel|credentialRef|credential|executor|permission|permissions|legalCandidates|subagent|adapter|adapterVersion)(?:$|\/)/i.test(path);
+}
+const TARGET_IDENTITY_KEYS = new Set(['adapter', 'adapterVersion', 'model', 'requestedModel', 'subagent', 'credentialRef']);
+function changesTargetIdentity(value) {
+    if (Array.isArray(value))
+        return value.some(changesTargetIdentity);
+    if (value && typeof value === 'object') {
+        return Object.entries(value).some(([key, item]) => TARGET_IDENTITY_KEYS.has(key) || changesTargetIdentity(item));
+    }
+    return false;
+}
+function hasForbiddenPointerSegment(path) {
+    return path.split('/').slice(1).map(part => part.replace(/~1/g, '/').replace(/~0/g, '~'))
+        .some(part => part === '__proto__' || part === 'constructor' || part === 'prototype');
+}
+function looksExecutable(value) {
+    if (typeof value === 'string')
+        return /(?:\$\{|=>|function\s*\(|require\s*\(|process\.env|https?:\/\/|bearer\s+|-----BEGIN|vault:|secret:)/i.test(value);
+    if (Array.isArray(value))
+        return value.some(looksExecutable);
+    if (value && typeof value === 'object')
+        return Object.entries(value).some(([key, item]) => /credential|secret|token|password|privateKey/i.test(key) || looksExecutable(item));
+    return false;
+}
+function actionValue(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) && typeof value.action === 'string' ? value.action : null;
+}
+function labelValue(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) && typeof value.label === 'string' ? value.label : null;
+}
+function rawValueLeak(value) {
+    return Object.hasOwn(value, 'value') || Object.hasOwn(value, 'raw') || Object.hasOwn(value, 'state') || Object.hasOwn(value, 'prompt');
+}
+//# sourceMappingURL=contract.js.map

package/dist/src/decision/sensitivity/index.js

@@ -0,0 +1,5 @@
+export * from './types.js';
+export * from './contract.js';
+export * from './runtime.js';
+export * from './comparative.js';
+//# sourceMappingURL=index.js.map