@descryy/core 0.3.0 → 0.5.0

package/dist/governance/budget.d.ts

@@ -1,35 +1,8 @@
-/**
- * The hard per-run budget — §41 rule 16, `ai-layer-plan.md` §11 (Phase 4,
- * P17/P18). `ai-governance-spec.md` §8 names this explicitly as *not* its
- * document's job: *"a property of the harness (Phase 4, P17/P18), not of a
- * per-finding gate... Full spec: Phase 4 (P17), not this document."* This
- * module is that property.
- *
- * *"Enforced by the runtime harness, not by the AI's own judgment of when to
- * stop"* (`descry-ai-layer.md`, "Execution budget"). A cap the model can
- * reason its way past is not a cap (§41 rule 16's own words) — so, same as
- * G1–G4, this is a pure function the pipeline calls, never a prompt
- * instruction.
- *
- * ## Four caps, two scopes
- *
- * `ai-layer-plan.md` §11 names four: *"max turns per investigation · max
- * cost per run · max concurrent open hypotheses · max tool calls per
- * hypothesis."* Two are per-run (cost, concurrency); two are per-hypothesis
- * (turns, tool calls) and are checked against every currently-open
- * hypothesis independently — one hypothesis running long does not budget-fail
- * a sibling that has spent nothing.
- *
- * ## The default values
- *
- * `documents/architecture/investigation-budget-spec.md` (P17) is where these
- * are ruled and justified; this module imports them from there in spirit —
- * they are declared once, here, because the spec document is prose and this
- * is the value the harness actually reads. A caller may always supply its
- * own {@link InvestigationBudget}; the exported default is a starting point,
- * tuned from data, the same convention `CLAUDE.md` already applies to node
- * budgets.
- */
+/** Hard per-run budget — §41 rule 16, ai-layer-plan §11 P17/P18. Enforced
+ *  by the harness as a pure function (same as G1-G4), never the model's own
+ *  judgment of when to stop. Four caps, two scopes: per-run (cost,
+ *  concurrency) and per-hypothesis (turns, tool calls — checked against each
+ *  open hypothesis independently). Defaults are a tuning starting point (P17). */
 /** The four caps, `ai-layer-plan.md` §11's own names. */
 export interface InvestigationBudget {
     /** Loop iterations spent investigating one hypothesis before it is forced to a terminal state. */
@@ -41,11 +14,8 @@ export interface InvestigationBudget {
     /** Total spend for the whole run, in USD. */
     readonly costCeilingPerRunUsd: number;
 }
-/**
- * P17's ruled starting values — `documents/architecture/investigation-budget-spec.md`.
- * Not a measurement; a starting point to tune from real runs, same as the
- * node budgets `CLAUDE.md` already treats this way.
- */
+/** P17's starting values (`investigation-budget-spec.md`) — not a
+ *  measurement, tuned from real runs like `CLAUDE.md`'s node budgets. */
 export declare const DEFAULT_INVESTIGATION_BUDGET: InvestigationBudget;
 /** Usage accumulated for one open hypothesis. */
 export interface HypothesisBudgetUsage {
@@ -73,17 +43,11 @@ export interface BudgetCheckResult {
     /** Every cap currently exceeded — empty when `withinBudget`. More than one may fire at once. */
     readonly exceeded: readonly BudgetCapExceeded[];
 }
-/**
- * Check `usage` against `budget`. Never throws — this is a check, not an
- * execution of the thing it is checking, same posture as G1–G4.
- */
+/** Checks `usage` against `budget`. Never throws — a check, not an
+ *  execution of the thing being checked (same posture as G1–G4). */
 export declare function checkRunBudget(budget: InvestigationBudget, usage: RunBudgetUsage): BudgetCheckResult;
-/**
- * Whether a specific hypothesis has reached its per-hypothesis round limit —
- * the input `../../ir/src/hypothesis.ts`'s `deriveHypothesisState` needs for
- * its `roundLimitReached` field. A thin, named convenience over
- * {@link checkRunBudget} so a caller does not have to re-derive "does this
- * one hypothesis's own cap show up in `exceeded`" by hand.
- */
+/** Whether one hypothesis hit its round limit — feeds
+ *  `hypothesis.ts`'s `deriveHypothesisState.roundLimitReached`. Thin
+ *  convenience over {@link checkRunBudget}. */
 export declare function hypothesisRoundLimitReached(budget: InvestigationBudget, usage: HypothesisBudgetUsage): boolean;
 //# sourceMappingURL=budget.d.ts.map

package/dist/governance/budget.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"budget.d.ts","sourceRoot":"","sources":["../../src/governance/budget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,yDAAyD;AACzD,MAAM,WAAW,mBAAmB;IAClC,kGAAkG;IAClG,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,sDAAsD;IACtD,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC;IAC3C,8EAA8E;IAC9E,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAC;IAC7C,6CAA6C;IAC7C,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AAED;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,EAAE,mBAK1C,CAAC;AAEF,iDAAiD;AACjD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,6GAA6G;IAC7G,QAAQ,CAAC,cAAc,EAAE,SAAS,qBAAqB,EAAE,CAAC;CAC3D;AAED,eAAO,MAAM,gBAAgB,2HAKnB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sFAAsF;IACtF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,gGAAgG;IAChG,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACjD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,mBAAmB,EAAE,KAAK,EAAE,cAAc,GAAG,iBAAiB,CAuCpG;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,mBAAmB,EAC3B,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAKT"}
+{"version":3,"file":"budget.d.ts","sourceRoot":"","sources":["../../src/governance/budget.ts"],"names":[],"mappings":"AAAA;;;;kFAIkF;AAElF,yDAAyD;AACzD,MAAM,WAAW,mBAAmB;IAClC,kGAAkG;IAClG,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,sDAAsD;IACtD,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC;IAC3C,8EAA8E;IAC9E,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAC;IAC7C,6CAA6C;IAC7C,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AAED;yEACyE;AACzE,eAAO,MAAM,4BAA4B,EAAE,mBAK1C,CAAC;AAEF,iDAAiD;AACjD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,6GAA6G;IAC7G,QAAQ,CAAC,cAAc,EAAE,SAAS,qBAAqB,EAAE,CAAC;CAC3D;AAED,eAAO,MAAM,gBAAgB,2HAKnB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sFAAsF;IACtF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,gGAAgG;IAChG,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACjD;AAED;oEACoE;AACpE,wBAAgB,cAAc,CAAC,MAAM,EAAE,mBAAmB,EAAE,KAAK,EAAE,cAAc,GAAG,iBAAiB,CAuCpG;AAED;;+CAE+C;AAC/C,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,mBAAmB,EAC3B,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAKT"}

package/dist/governance/budget.js

@@ -1,40 +1,10 @@
-/**
- * The hard per-run budget — §41 rule 16, `ai-layer-plan.md` §11 (Phase 4,
- * P17/P18). `ai-governance-spec.md` §8 names this explicitly as *not* its
- * document's job: *"a property of the harness (Phase 4, P17/P18), not of a
- * per-finding gate... Full spec: Phase 4 (P17), not this document."* This
- * module is that property.
- *
- * *"Enforced by the runtime harness, not by the AI's own judgment of when to
- * stop"* (`descry-ai-layer.md`, "Execution budget"). A cap the model can
- * reason its way past is not a cap (§41 rule 16's own words) — so, same as
- * G1–G4, this is a pure function the pipeline calls, never a prompt
- * instruction.
- *
- * ## Four caps, two scopes
- *
- * `ai-layer-plan.md` §11 names four: *"max turns per investigation · max
- * cost per run · max concurrent open hypotheses · max tool calls per
- * hypothesis."* Two are per-run (cost, concurrency); two are per-hypothesis
- * (turns, tool calls) and are checked against every currently-open
- * hypothesis independently — one hypothesis running long does not budget-fail
- * a sibling that has spent nothing.
- *
- * ## The default values
- *
- * `documents/architecture/investigation-budget-spec.md` (P17) is where these
- * are ruled and justified; this module imports them from there in spirit —
- * they are declared once, here, because the spec document is prose and this
- * is the value the harness actually reads. A caller may always supply its
- * own {@link InvestigationBudget}; the exported default is a starting point,
- * tuned from data, the same convention `CLAUDE.md` already applies to node
- * budgets.
- */
-/**
- * P17's ruled starting values — `documents/architecture/investigation-budget-spec.md`.
- * Not a measurement; a starting point to tune from real runs, same as the
- * node budgets `CLAUDE.md` already treats this way.
- */
+/** Hard per-run budget — §41 rule 16, ai-layer-plan §11 P17/P18. Enforced
+ *  by the harness as a pure function (same as G1-G4), never the model's own
+ *  judgment of when to stop. Four caps, two scopes: per-run (cost,
+ *  concurrency) and per-hypothesis (turns, tool calls — checked against each
+ *  open hypothesis independently). Defaults are a tuning starting point (P17). */
+/** P17's starting values (`investigation-budget-spec.md`) — not a
+ *  measurement, tuned from real runs like `CLAUDE.md`'s node budgets. */
 export const DEFAULT_INVESTIGATION_BUDGET = {
     maxTurnsPerInvestigation: 8,
     maxToolCallsPerHypothesis: 6,
@@ -47,10 +17,8 @@ export const BUDGET_CAP_NAMES = [
     "maxConcurrentOpenHypotheses",
     "costCeilingPerRunUsd",
 ];
-/**
- * Check `usage` against `budget`. Never throws — this is a check, not an
- * execution of the thing it is checking, same posture as G1–G4.
- */
+/** Checks `usage` against `budget`. Never throws — a check, not an
+ *  execution of the thing being checked (same posture as G1–G4). */
 export function checkRunBudget(budget, usage) {
     const exceeded = [];
     if (usage.costSpentUsd > budget.costCeilingPerRunUsd) {
@@ -87,13 +55,9 @@ export function checkRunBudget(budget, usage) {
     }
     return { withinBudget: exceeded.length === 0, exceeded };
 }
-/**
- * Whether a specific hypothesis has reached its per-hypothesis round limit —
- * the input `../../ir/src/hypothesis.ts`'s `deriveHypothesisState` needs for
- * its `roundLimitReached` field. A thin, named convenience over
- * {@link checkRunBudget} so a caller does not have to re-derive "does this
- * one hypothesis's own cap show up in `exceeded`" by hand.
- */
+/** Whether one hypothesis hit its round limit — feeds
+ *  `hypothesis.ts`'s `deriveHypothesisState.roundLimitReached`. Thin
+ *  convenience over {@link checkRunBudget}. */
 export function hypothesisRoundLimitReached(budget, usage) {
     return (usage.turnsSpent > budget.maxTurnsPerInvestigation ||
         usage.toolCallsSpent > budget.maxToolCallsPerHypothesis);

package/dist/governance/budget.js.map

@@ -1 +1 @@
-{"version":3,"file":"budget.js","sourceRoot":"","sources":["../../src/governance/budget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAcH;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAwB;IAC/D,wBAAwB,EAAE,CAAC;IAC3B,yBAAyB,EAAE,CAAC;IAC5B,2BAA2B,EAAE,CAAC;IAC9B,oBAAoB,EAAE,GAAG;CAC1B,CAAC;AAgBF,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,0BAA0B;IAC1B,2BAA2B;IAC3B,6BAA6B;IAC7B,sBAAsB;CACd,CAAC;AAkBX;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAA2B,EAAE,KAAqB;IAC/E,MAAM,QAAQ,GAAwB,EAAE,CAAC;IAEzC,IAAI,KAAK,CAAC,YAAY,GAAG,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC;YACZ,GAAG,EAAE,sBAAsB;YAC3B,KAAK,EAAE,MAAM,CAAC,oBAAoB;YAClC,MAAM,EAAE,KAAK,CAAC,YAAY;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,MAAM,CAAC,2BAA2B,EAAE,CAAC;QACrE,QAAQ,CAAC,IAAI,CAAC;YACZ,GAAG,EAAE,6BAA6B;YAClC,KAAK,EAAE,MAAM,CAAC,2BAA2B;YACzC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,MAAM;SACpC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QAC9C,IAAI,UAAU,CAAC,UAAU,GAAG,MAAM,CAAC,wBAAwB,EAAE,CAAC;YAC5D,QAAQ,CAAC,IAAI,CAAC;gBACZ,GAAG,EAAE,0BAA0B;gBAC/B,KAAK,EAAE,MAAM,CAAC,wBAAwB;gBACtC,MAAM,EAAE,UAAU,CAAC,UAAU;gBAC7B,YAAY,EAAE,UAAU,CAAC,YAAY;aACtC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,UAAU,CAAC,cAAc,GAAG,MAAM,CAAC,yBAAyB,EAAE,CAAC;YACjE,QAAQ,CAAC,IAAI,CAAC;gBACZ,GAAG,EAAE,2BAA2B;gBAChC,KAAK,EAAE,MAAM,CAAC,yBAAyB;gBACvC,MAAM,EAAE,UAAU,CAAC,cAAc;gBACjC,YAAY,EAAE,UAAU,CAAC,YAAY;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAA2B,EAC3B,KAA4B;IAE5B,OAAO,CACL,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,wBAAwB;QAClD,KAAK,CAAC,cAAc,GAAG,MAAM,CAAC,yBAAyB,CACxD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"budget.js","sourceRoot":"","sources":["../../src/governance/budget.ts"],"names":[],"mappings":"AAAA;;;;kFAIkF;AAclF;yEACyE;AACzE,MAAM,CAAC,MAAM,4BAA4B,GAAwB;IAC/D,wBAAwB,EAAE,CAAC;IAC3B,yBAAyB,EAAE,CAAC;IAC5B,2BAA2B,EAAE,CAAC;IAC9B,oBAAoB,EAAE,GAAG;CAC1B,CAAC;AAgBF,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,0BAA0B;IAC1B,2BAA2B;IAC3B,6BAA6B;IAC7B,sBAAsB;CACd,CAAC;AAkBX;oEACoE;AACpE,MAAM,UAAU,cAAc,CAAC,MAA2B,EAAE,KAAqB;IAC/E,MAAM,QAAQ,GAAwB,EAAE,CAAC;IAEzC,IAAI,KAAK,CAAC,YAAY,GAAG,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC;YACZ,GAAG,EAAE,sBAAsB;YAC3B,KAAK,EAAE,MAAM,CAAC,oBAAoB;YAClC,MAAM,EAAE,KAAK,CAAC,YAAY;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,MAAM,CAAC,2BAA2B,EAAE,CAAC;QACrE,QAAQ,CAAC,IAAI,CAAC;YACZ,GAAG,EAAE,6BAA6B;YAClC,KAAK,EAAE,MAAM,CAAC,2BAA2B;YACzC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,MAAM;SACpC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QAC9C,IAAI,UAAU,CAAC,UAAU,GAAG,MAAM,CAAC,wBAAwB,EAAE,CAAC;YAC5D,QAAQ,CAAC,IAAI,CAAC;gBACZ,GAAG,EAAE,0BAA0B;gBAC/B,KAAK,EAAE,MAAM,CAAC,wBAAwB;gBACtC,MAAM,EAAE,UAAU,CAAC,UAAU;gBAC7B,YAAY,EAAE,UAAU,CAAC,YAAY;aACtC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,UAAU,CAAC,cAAc,GAAG,MAAM,CAAC,yBAAyB,EAAE,CAAC;YACjE,QAAQ,CAAC,IAAI,CAAC;gBACZ,GAAG,EAAE,2BAA2B;gBAChC,KAAK,EAAE,MAAM,CAAC,yBAAyB;gBACvC,MAAM,EAAE,UAAU,CAAC,cAAc;gBACjC,YAAY,EAAE,UAAU,CAAC,YAAY;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;AAC3D,CAAC;AAED;;+CAE+C;AAC/C,MAAM,UAAU,2BAA2B,CACzC,MAA2B,EAC3B,KAA4B;IAE5B,OAAO,CACL,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,wBAAwB;QAClD,KAAK,CAAC,cAAc,GAAG,MAAM,CAAC,yBAAyB,CACxD,CAAC;AACJ,CAAC"}

package/dist/governance/candidate-boundary.d.ts

@@ -1,30 +1,6 @@
 /**
- * G2 — the candidate boundary (`ai-governance-spec.md` §3, `ai-layer-plan.md` §5).
- *
- * **The plan (stage 6) may only contain items from the deterministic
- * candidate set stages 3–5 produced.** Stage 5 (risk prioritization) is
- * itself deterministic — "scores in, ordering out. Does not invent
- * candidates" (`ai-layer-plan.md` §1) — so a plan item naming a node outside
- * that set could only have been invented by stage 6's own model slot, and is
- * rejected outright rather than down-ranked.
- *
- * Same shape as G1, one stage later, and built as the same kind of pure
- * function: `ai-governance-spec.md` §10 — "candidate-set membership checking
- * on the plan... no new tool surface, no new IR type." A candidate set is a
- * set of node ids; this module does not care how stages 3–5 produced it.
- *
- * ## Reject the item, not the plan
- *
- * `ai-governance-spec.md` §3's own negative control: "a plan naming a target
- * outside the candidate set. G2 must reject the item, not the whole plan —
- * the rest of the plan proceeds if the remaining items are valid." So the
- * result partitions the plan rather than failing it wholesale.
- *
- * `PlanItem` is deliberately the smallest shape G2 needs — one node id.
- * Phase 3's real plan item will carry more (a rationale, a priority, a test
- * strategy); the generic parameter lets a caller pass its real type through
- * unchanged and get it back in `accepted`/`rejected`, rather than this
- * module owning a plan-item type the pipeline would then have to conform to.
+ * G2, the candidate boundary (ai-governance-spec.md §3, ai-layer-plan.md §5): the stage-6 plan may only contain items from the deterministic candidate set stages 3-5 produced.
+ * A plan item naming an outside node can only have been invented by stage 6's model slot, rejected outright — the item, not the whole plan (§3's negative control). `PlanItem` is just a node id; the generic parameter passes a caller's real type through unchanged.
  */
 /** The smallest shape G2 needs from a plan item: what node it targets. */
 export interface PlanItem {
@@ -39,11 +15,7 @@ export interface CandidateBoundaryResult<T extends PlanItem> {
     readonly accepted: readonly T[];
     readonly rejected: readonly RejectedPlanItem<T>[];
 }
-/**
- * Check every item in `plan` against `candidateNodeIds` — the deterministic
- * set stages 3–5 produced. An item whose `targetNodeId` is not in that set
- * is rejected with a reason; the rest of the plan is unaffected. Never
- * throws — this is a check, not an execution of the thing it is checking.
- */
+/** Check every plan item against candidateNodeIds; an item outside the set
+ *  is rejected with a reason, the rest unaffected. Never throws. */
 export declare function checkCandidateBoundary<T extends PlanItem>(plan: readonly T[], candidateNodeIds: ReadonlySet<string>): CandidateBoundaryResult<T>;
 //# sourceMappingURL=candidate-boundary.d.ts.map

package/dist/governance/candidate-boundary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"candidate-boundary.d.ts","sourceRoot":"","sources":["../../src/governance/candidate-boundary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,0EAA0E;AAC1E,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC,SAAS,QAAQ;IAClD,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjB,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,uBAAuB,CAAC,CAAC,SAAS,QAAQ;IACzD,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;CACnD;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,SAAS,QAAQ,EACvD,IAAI,EAAE,SAAS,CAAC,EAAE,EAClB,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,GACpC,uBAAuB,CAAC,CAAC,CAAC,CAgB5B"}
+{"version":3,"file":"candidate-boundary.d.ts","sourceRoot":"","sources":["../../src/governance/candidate-boundary.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,0EAA0E;AAC1E,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC,SAAS,QAAQ;IAClD,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjB,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,uBAAuB,CAAC,CAAC,SAAS,QAAQ;IACzD,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;CACnD;AAED;oEACoE;AACpE,wBAAgB,sBAAsB,CAAC,CAAC,SAAS,QAAQ,EACvD,IAAI,EAAE,SAAS,CAAC,EAAE,EAClB,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,GACpC,uBAAuB,CAAC,CAAC,CAAC,CAgB5B"}

package/dist/governance/candidate-boundary.js

@@ -1,37 +1,9 @@
 /**
- * G2 — the candidate boundary (`ai-governance-spec.md` §3, `ai-layer-plan.md` §5).
- *
- * **The plan (stage 6) may only contain items from the deterministic
- * candidate set stages 3–5 produced.** Stage 5 (risk prioritization) is
- * itself deterministic — "scores in, ordering out. Does not invent
- * candidates" (`ai-layer-plan.md` §1) — so a plan item naming a node outside
- * that set could only have been invented by stage 6's own model slot, and is
- * rejected outright rather than down-ranked.
- *
- * Same shape as G1, one stage later, and built as the same kind of pure
- * function: `ai-governance-spec.md` §10 — "candidate-set membership checking
- * on the plan... no new tool surface, no new IR type." A candidate set is a
- * set of node ids; this module does not care how stages 3–5 produced it.
- *
- * ## Reject the item, not the plan
- *
- * `ai-governance-spec.md` §3's own negative control: "a plan naming a target
- * outside the candidate set. G2 must reject the item, not the whole plan —
- * the rest of the plan proceeds if the remaining items are valid." So the
- * result partitions the plan rather than failing it wholesale.
- *
- * `PlanItem` is deliberately the smallest shape G2 needs — one node id.
- * Phase 3's real plan item will carry more (a rationale, a priority, a test
- * strategy); the generic parameter lets a caller pass its real type through
- * unchanged and get it back in `accepted`/`rejected`, rather than this
- * module owning a plan-item type the pipeline would then have to conform to.
- */
-/**
- * Check every item in `plan` against `candidateNodeIds` — the deterministic
- * set stages 3–5 produced. An item whose `targetNodeId` is not in that set
- * is rejected with a reason; the rest of the plan is unaffected. Never
- * throws — this is a check, not an execution of the thing it is checking.
+ * G2, the candidate boundary (ai-governance-spec.md §3, ai-layer-plan.md §5): the stage-6 plan may only contain items from the deterministic candidate set stages 3-5 produced.
+ * A plan item naming an outside node can only have been invented by stage 6's model slot, rejected outright — the item, not the whole plan (§3's negative control). `PlanItem` is just a node id; the generic parameter passes a caller's real type through unchanged.
  */
+/** Check every plan item against candidateNodeIds; an item outside the set
+ *  is rejected with a reason, the rest unaffected. Never throws. */
 export function checkCandidateBoundary(plan, candidateNodeIds) {
     const accepted = [];
     const rejected = [];

package/dist/governance/candidate-boundary.js.map

@@ -1 +1 @@
-{"version":3,"file":"candidate-boundary.js","sourceRoot":"","sources":["../../src/governance/candidate-boundary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAkBH;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAkB,EAClB,gBAAqC;IAErC,MAAM,QAAQ,GAAQ,EAAE,CAAC;IACzB,MAAM,QAAQ,GAA0B,EAAE,CAAC;IAE3C,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5C,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI;gBACJ,MAAM,EAAE,eAAe,IAAI,CAAC,YAAY,kDAAkD;aAC3F,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC"}
+{"version":3,"file":"candidate-boundary.js","sourceRoot":"","sources":["../../src/governance/candidate-boundary.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAkBH;oEACoE;AACpE,MAAM,UAAU,sBAAsB,CACpC,IAAkB,EAClB,gBAAqC;IAErC,MAAM,QAAQ,GAAQ,EAAE,CAAC;IACzB,MAAM,QAAQ,GAA0B,EAAE,CAAC;IAE3C,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5C,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI;gBACJ,MAAM,EAAE,eAAe,IAAI,CAAC,YAAY,kDAAkD;aAC3F,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC"}

package/dist/governance/escalation.d.ts

@@ -1,43 +1,8 @@
-/**
- * Escalation — §41 rule 17, `ai-layer-plan.md` §11 (Phase 4, P17/P18).
- *
- * *"AI must escalate to the developer rather than keep investigating
- * when..."* — three conditions named in the architecture (budget exhausted,
- * a hypothesis stuck past its round limit, unresolved graph/runtime
- * contradiction), widened to five in the plan's own §11: *"budget exhausted
- * with hypotheses open · unresolved contradictory evidence · a fact only a
- * human holds · an action gate reached · every hypothesis refuted with the
- * anomaly unexplained."*
- *
- * Same shape as {@link "./budget.ts"} and G1–G4: a pure function over
- * caller-supplied facts, evaluated outside the model, never a prompt telling
- * the model when to stop. `ai-layer-plan.md` §0's own words, one layer up:
- * *"a rule the model can reason its way past is not a rule."*
- *
- * ## Four of five inputs are not computed here
- *
- * Only the budget trigger is derivable from `./budget.ts`'s own output.
- * The other four name conditions this module has no way to detect on its
- * own, and deliberately does not try to:
- *
- * - **Unresolved contradictory evidence** — §10's graph-vs-runtime
- *   contradiction machinery (P21) is what detects a contradiction at all;
- *   this module only reacts to the caller having found one.
- * - **A fact only a human holds** — inherits the `questions` MCP tool /
- *   `ConfirmedFact` machinery (`packages/core/src/query/refusal-questions.ts`,
- *   `confirmed-facts.ts`) already built for a different stage. Whether an
- *   open, unanswered question exists is that machinery's own state, not
- *   something recomputed here.
- * - **An action gate reached** — G5 (`ai-tool-contract.md` §7's two-call
- *   handshake) already governs whether a write may proceed; this module
- *   just names the fact of having reached it as one more reason to stop and
- *   hand control back.
- * - **Every hypothesis refuted, anomaly unexplained** — depends on every
- *   open hypothesis's terminal state (`../../ir/src/hypothesis.ts`) plus a
- *   judgement that no other explanation covers the original anomaly. The
- *   "no other explanation" half is not a fact this module can derive from a
- *   list of rejected hypotheses alone, so it stays a caller-supplied flag.
- */
+/** Escalation — §41 rule 17, ai-layer-plan §11 P17/P18. Pure function over
+ *  caller-supplied facts (like `budget.ts`/G1-G4) — never a prompt telling
+ *  the model when to stop. Five triggers: budget exhausted w/ open
+ *  hypotheses (only one computed here); unresolved contradiction; a fact
+ *  only a human holds; an action gate reached; every hypothesis refuted, anomaly unexplained. */
 export declare const ESCALATION_TRIGGERS: readonly ["budget-exhausted-with-hypotheses-open", "unresolved-contradictory-evidence", "fact-only-a-human-holds", "action-gate-reached", "every-hypothesis-refuted-unexplained"];
 export type EscalationTrigger = (typeof ESCALATION_TRIGGERS)[number];
 export interface EscalationCheckInput {
@@ -54,10 +19,7 @@ export interface EscalationCheckInput {
     /** Caller-supplied: every hypothesis this run opened has reached `rejected`, and the anomaly that started the investigation still has no confirmed or supported explanation. */
     readonly allHypothesesRejectedAnomalyUnexplained: boolean;
 }
-/**
- * Check `input` against all five triggers. Never throws — a check, not an
- * execution of the thing it is checking. More than one trigger may fire in
- * the same call; an empty result means the loop may keep running.
- */
+/** Checks `input` against all five triggers. Never throws — more than one
+ *  may fire at once; empty means the loop may keep running. */
 export declare function checkEscalation(input: EscalationCheckInput): readonly EscalationTrigger[];
 //# sourceMappingURL=escalation.d.ts.map

package/dist/governance/escalation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"escalation.d.ts","sourceRoot":"","sources":["../../src/governance/escalation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,eAAO,MAAM,mBAAmB,mLAMtB,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAErE,MAAM,WAAW,oBAAoB;IACnC,yEAAyE;IACzE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,wGAAwG;IACxG,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,2IAA2I;IAC3I,QAAQ,CAAC,0BAA0B,EAAE,OAAO,CAAC;IAC7C,uIAAuI;IACvI,QAAQ,CAAC,0BAA0B,EAAE,OAAO,CAAC;IAC7C,4GAA4G;IAC5G,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,gLAAgL;IAChL,QAAQ,CAAC,uCAAuC,EAAE,OAAO,CAAC;CAC3D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,SAAS,iBAAiB,EAAE,CAoBzF"}
+{"version":3,"file":"escalation.d.ts","sourceRoot":"","sources":["../../src/governance/escalation.ts"],"names":[],"mappings":"AAAA;;;;iGAIiG;AAEjG,eAAO,MAAM,mBAAmB,mLAMtB,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAErE,MAAM,WAAW,oBAAoB;IACnC,yEAAyE;IACzE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,wGAAwG;IACxG,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,2IAA2I;IAC3I,QAAQ,CAAC,0BAA0B,EAAE,OAAO,CAAC;IAC7C,uIAAuI;IACvI,QAAQ,CAAC,0BAA0B,EAAE,OAAO,CAAC;IAC7C,4GAA4G;IAC5G,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,gLAAgL;IAChL,QAAQ,CAAC,uCAAuC,EAAE,OAAO,CAAC;CAC3D;AAED;+DAC+D;AAC/D,wBAAgB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,SAAS,iBAAiB,EAAE,CAoBzF"}

package/dist/governance/escalation.js

@@ -1,43 +1,8 @@
-/**
- * Escalation — §41 rule 17, `ai-layer-plan.md` §11 (Phase 4, P17/P18).
- *
- * *"AI must escalate to the developer rather than keep investigating
- * when..."* — three conditions named in the architecture (budget exhausted,
- * a hypothesis stuck past its round limit, unresolved graph/runtime
- * contradiction), widened to five in the plan's own §11: *"budget exhausted
- * with hypotheses open · unresolved contradictory evidence · a fact only a
- * human holds · an action gate reached · every hypothesis refuted with the
- * anomaly unexplained."*
- *
- * Same shape as {@link "./budget.ts"} and G1–G4: a pure function over
- * caller-supplied facts, evaluated outside the model, never a prompt telling
- * the model when to stop. `ai-layer-plan.md` §0's own words, one layer up:
- * *"a rule the model can reason its way past is not a rule."*
- *
- * ## Four of five inputs are not computed here
- *
- * Only the budget trigger is derivable from `./budget.ts`'s own output.
- * The other four name conditions this module has no way to detect on its
- * own, and deliberately does not try to:
- *
- * - **Unresolved contradictory evidence** — §10's graph-vs-runtime
- *   contradiction machinery (P21) is what detects a contradiction at all;
- *   this module only reacts to the caller having found one.
- * - **A fact only a human holds** — inherits the `questions` MCP tool /
- *   `ConfirmedFact` machinery (`packages/core/src/query/refusal-questions.ts`,
- *   `confirmed-facts.ts`) already built for a different stage. Whether an
- *   open, unanswered question exists is that machinery's own state, not
- *   something recomputed here.
- * - **An action gate reached** — G5 (`ai-tool-contract.md` §7's two-call
- *   handshake) already governs whether a write may proceed; this module
- *   just names the fact of having reached it as one more reason to stop and
- *   hand control back.
- * - **Every hypothesis refuted, anomaly unexplained** — depends on every
- *   open hypothesis's terminal state (`../../ir/src/hypothesis.ts`) plus a
- *   judgement that no other explanation covers the original anomaly. The
- *   "no other explanation" half is not a fact this module can derive from a
- *   list of rejected hypotheses alone, so it stays a caller-supplied flag.
- */
+/** Escalation — §41 rule 17, ai-layer-plan §11 P17/P18. Pure function over
+ *  caller-supplied facts (like `budget.ts`/G1-G4) — never a prompt telling
+ *  the model when to stop. Five triggers: budget exhausted w/ open
+ *  hypotheses (only one computed here); unresolved contradiction; a fact
+ *  only a human holds; an action gate reached; every hypothesis refuted, anomaly unexplained. */
 export const ESCALATION_TRIGGERS = [
     "budget-exhausted-with-hypotheses-open",
     "unresolved-contradictory-evidence",
@@ -45,11 +10,8 @@ export const ESCALATION_TRIGGERS = [
     "action-gate-reached",
     "every-hypothesis-refuted-unexplained",
 ];
-/**
- * Check `input` against all five triggers. Never throws — a check, not an
- * execution of the thing it is checking. More than one trigger may fire in
- * the same call; an empty result means the loop may keep running.
- */
+/** Checks `input` against all five triggers. Never throws — more than one
+ *  may fire at once; empty means the loop may keep running. */
 export function checkEscalation(input) {
     const triggers = [];
     if (input.budgetExceeded && input.openHypothesesCount > 0) {

package/dist/governance/escalation.js.map

@@ -1 +1 @@
-{"version":3,"file":"escalation.js","sourceRoot":"","sources":["../../src/governance/escalation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,uCAAuC;IACvC,mCAAmC;IACnC,yBAAyB;IACzB,qBAAqB;IACrB,sCAAsC;CAC9B,CAAC;AAmBX;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAA2B;IACzD,MAAM,QAAQ,GAAwB,EAAE,CAAC;IAEzC,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,mBAAmB,GAAG,CAAC,EAAE,CAAC;QAC1D,QAAQ,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,0BAA0B,EAAE,CAAC;QACrC,QAAQ,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,KAAK,CAAC,0BAA0B,EAAE,CAAC;QACrC,QAAQ,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,KAAK,CAAC,uCAAuC,EAAE,CAAC;QAClD,QAAQ,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"escalation.js","sourceRoot":"","sources":["../../src/governance/escalation.ts"],"names":[],"mappings":"AAAA;;;;iGAIiG;AAEjG,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,uCAAuC;IACvC,mCAAmC;IACnC,yBAAyB;IACzB,qBAAqB;IACrB,sCAAsC;CAC9B,CAAC;AAmBX;+DAC+D;AAC/D,MAAM,UAAU,eAAe,CAAC,KAA2B;IACzD,MAAM,QAAQ,GAAwB,EAAE,CAAC;IAEzC,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,mBAAmB,GAAG,CAAC,EAAE,CAAC;QAC1D,QAAQ,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,0BAA0B,EAAE,CAAC;QACrC,QAAQ,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,KAAK,CAAC,0BAA0B,EAAE,CAAC;QACrC,QAAQ,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,KAAK,CAAC,uCAAuC,EAAE,CAAC;QAClD,QAAQ,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/governance/fact-boundary.d.ts

@@ -1,49 +1,11 @@
-/**
- * G1 — the fact boundary (`ai-governance-spec.md` §2, `ai-layer-plan.md` §5).
- *
- * **No fact enters the model's context unless a tool produced it. No fact
- * leaves a model slot unless it references something a tool returned.**
- *
- * This is the first of the two gates P9 builds (`ai-governance-spec.md` §10):
- * "citation-checking on every slot output... a pure function over
- * already-recorded tool calls... no new tool surface, no new IR type."
- *
- * ## Why a citation is `{ seq }`, not `{ runId, seq }`
- *
- * `recorded_calls`'s primary key is `(run_id, seq)` (`../recording/schema.ts`),
- * and the gate is defined as checking a claim "against **this run's own**
- * recorded tool calls" — the run is the boundary, not a parameter a slot
- * output gets to name. `checkFactBoundary` takes the `RecordedRun` it is
- * checking against and a citation carries only `seq`. A citation naming a
- * call from a different run does not fail because the run id mismatches —
- * it fails because no call with that `seq` exists in *this* run's own
- * ordered list, which is the same failure as a fabricated seq and needs no
- * separate case (negative control 7, `ai-layer-plan.md` §9 layer 5).
- *
- * ## Why a whole claim is rejected on any unresolved citation
- *
- * A claim with two citations, one real and one fabricated, is not "half
- * true." §41.1 (never invent graph facts) does not have a partial-credit
- * form, so one bad citation invalidates the claim it was attached to, not
- * just itself — the same posture `ai-tool-contract.md`'s invariants take
- * toward a payload that "looks complete."
- *
- * ## Path is a key array, not a string
- *
- * `data.callers[0]` is a plausible citation shape, but parsing that string
- * back into a traversal is a small grammar this gate does not need to own.
- * `readonly (string | number)[]` says the same thing with no parser and no
- * ambiguity about what `[0]` means against an object vs. an array.
- */
+/** G1 fact boundary (`ai-governance-spec.md` §2, `ai-layer-plan.md` §5): no fact enters or leaves
+ *  a model slot without a tool citation. Citation is `{seq}`, not `{runId,seq}` — the run itself
+ *  is the boundary. One unresolved citation rejects the whole claim (§41.1: no partial credit). */
 import type { RecordedRun } from "../recording/reader.ts";
 /** One segment of a citation path: an object key or an array index. */
 export type CitationPathSegment = string | number;
-/**
- * A pointer at one fact a tool call actually returned, within the run being
- * checked. `seq` names the call (`recorded_calls.seq`); `path`, when given,
- * narrows the citation to a field within that call's `result` rather than
- * the whole envelope. Omitted `path` cites the whole result.
- */
+/** A pointer at one fact a tool call returned, within the run being checked. `seq` names the
+ *  call; `path`, when given, narrows to a field in that call's `result`. Omitted `path` cites the whole result. */
 export interface Citation {
     readonly seq: number;
     readonly path?: readonly CitationPathSegment[];
@@ -67,11 +29,7 @@ export interface FactBoundaryResult {
     readonly accepted: readonly FactualClaim[];
     readonly rejected: readonly RejectedClaim[];
 }
-/**
- * Check every claim in `output` against `run`'s own recorded calls. A claim
- * with no citations, or with any citation that does not resolve, is
- * rejected with its reasons; everything else is accepted. Never throws —
- * this is a check, not an execution of the thing it is checking.
- */
+/** Checks every claim in `output` against `run`'s own recorded calls. Uncited or unresolved
+ *  citations reject the claim with reasons; everything else is accepted. Never throws — a check, not an execution. */
 export declare function checkFactBoundary(output: SlotOutput, run: RecordedRun): FactBoundaryResult;
 //# sourceMappingURL=fact-boundary.d.ts.map

package/dist/governance/fact-boundary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fact-boundary.d.ts","sourceRoot":"","sources":["../../src/governance/fact-boundary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAgB,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAExE,uEAAuE;AACvE,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,MAAM,CAAC;AAElD;;;;;GAKG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAChD;AAED,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gGAAgG;IAChG,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,CAAC;CACzC;AAED,kGAAkG;AAClG,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;CAC7C;AA2BD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,GAAG,kBAAkB,CAwB1F"}
+{"version":3,"file":"fact-boundary.d.ts","sourceRoot":"","sources":["../../src/governance/fact-boundary.ts"],"names":[],"mappings":"AAAA;;mGAEmG;AAEnG,OAAO,KAAK,EAAgB,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAExE,uEAAuE;AACvE,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,MAAM,CAAC;AAElD;mHACmH;AACnH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAChD;AAED,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gGAAgG;IAChG,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,CAAC;CACzC;AAED,kGAAkG;AAClG,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;CAC7C;AA2BD;sHACsH;AACtH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,GAAG,kBAAkB,CAwB1F"}

package/dist/governance/fact-boundary.js

@@ -1,40 +1,6 @@
-/**
- * G1 — the fact boundary (`ai-governance-spec.md` §2, `ai-layer-plan.md` §5).
- *
- * **No fact enters the model's context unless a tool produced it. No fact
- * leaves a model slot unless it references something a tool returned.**
- *
- * This is the first of the two gates P9 builds (`ai-governance-spec.md` §10):
- * "citation-checking on every slot output... a pure function over
- * already-recorded tool calls... no new tool surface, no new IR type."
- *
- * ## Why a citation is `{ seq }`, not `{ runId, seq }`
- *
- * `recorded_calls`'s primary key is `(run_id, seq)` (`../recording/schema.ts`),
- * and the gate is defined as checking a claim "against **this run's own**
- * recorded tool calls" — the run is the boundary, not a parameter a slot
- * output gets to name. `checkFactBoundary` takes the `RecordedRun` it is
- * checking against and a citation carries only `seq`. A citation naming a
- * call from a different run does not fail because the run id mismatches —
- * it fails because no call with that `seq` exists in *this* run's own
- * ordered list, which is the same failure as a fabricated seq and needs no
- * separate case (negative control 7, `ai-layer-plan.md` §9 layer 5).
- *
- * ## Why a whole claim is rejected on any unresolved citation
- *
- * A claim with two citations, one real and one fabricated, is not "half
- * true." §41.1 (never invent graph facts) does not have a partial-credit
- * form, so one bad citation invalidates the claim it was attached to, not
- * just itself — the same posture `ai-tool-contract.md`'s invariants take
- * toward a payload that "looks complete."
- *
- * ## Path is a key array, not a string
- *
- * `data.callers[0]` is a plausible citation shape, but parsing that string
- * back into a traversal is a small grammar this gate does not need to own.
- * `readonly (string | number)[]` says the same thing with no parser and no
- * ambiguity about what `[0]` means against an object vs. an array.
- */
+/** G1 fact boundary (`ai-governance-spec.md` §2, `ai-layer-plan.md` §5): no fact enters or leaves
+ *  a model slot without a tool citation. Citation is `{seq}`, not `{runId,seq}` — the run itself
+ *  is the boundary. One unresolved citation rejects the whole claim (§41.1: no partial credit). */
 function resolvesWithin(value, path) {
     let cursor = value;
     for (const key of path) {
@@ -61,12 +27,8 @@ function checkCitation(citation, callsBySeq) {
     }
     return null;
 }
-/**
- * Check every claim in `output` against `run`'s own recorded calls. A claim
- * with no citations, or with any citation that does not resolve, is
- * rejected with its reasons; everything else is accepted. Never throws —
- * this is a check, not an execution of the thing it is checking.
- */
+/** Checks every claim in `output` against `run`'s own recorded calls. Uncited or unresolved
+ *  citations reject the claim with reasons; everything else is accepted. Never throws — a check, not an execution. */
 export function checkFactBoundary(output, run) {
     const callsBySeq = new Map(run.calls.map((call) => [call.seq, call]));
     const accepted = [];

package/dist/governance/fact-boundary.js.map

@@ -1 +1 @@
-{"version":3,"file":"fact-boundary.js","sourceRoot":"","sources":["../../src/governance/fact-boundary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAyCH,SAAS,cAAc,CAAC,KAAc,EAAE,IAAoC;IAC1E,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAChE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,IAAI,MAAM,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;QACzG,CAAC;aAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;YACvC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,GAAI,MAA+C,CAAC,GAAG,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,QAAkB,EAAE,UAA6C;IACtF,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,gBAAgB,QAAQ,CAAC,GAAG,oDAAoD,CAAC;IAC1F,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/E,OAAO,gBAAgB,QAAQ,CAAC,GAAG,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,6CAA6C,CAAC;IACzH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAkB,EAAE,GAAgB;IACpE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAEtE,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAC;YAClE,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS;aAC5B,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;aACtD,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;QAEzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC"}
+{"version":3,"file":"fact-boundary.js","sourceRoot":"","sources":["../../src/governance/fact-boundary.ts"],"names":[],"mappings":"AAAA;;mGAEmG;AAqCnG,SAAS,cAAc,CAAC,KAAc,EAAE,IAAoC;IAC1E,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAChE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,IAAI,MAAM,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;QACzG,CAAC;aAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;YACvC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,GAAI,MAA+C,CAAC,GAAG,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,QAAkB,EAAE,UAA6C;IACtF,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,gBAAgB,QAAQ,CAAC,GAAG,oDAAoD,CAAC;IAC1F,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/E,OAAO,gBAAgB,QAAQ,CAAC,GAAG,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,6CAA6C,CAAC;IACzH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;sHACsH;AACtH,MAAM,UAAU,iBAAiB,CAAC,MAAkB,EAAE,GAAgB;IACpE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAEtE,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAC;YAClE,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS;aAC5B,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;aACtD,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;QAEzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC"}