@event4u/agent-config 14.12.0 → 14.13.0

package/src/scripts/_lib/evaluation_vector.ts

@@ -0,0 +1,283 @@
+/**
+ * The evaluation gate's record type: a metric VECTOR, never a weighted total.
+ *
+ * `road-to-governed-harness-evolution` Phase 4, steps 4.2 and 4.3.
+ *
+ * > *4.2 Report a metric vector, never a weighted total. Include an
+ * > `artifact-count delta` row — that is where the sprawl concern belongs,
+ * > inside the gate where it can prevent something.*
+ * > verify: **no code path computes a single scalar score.**
+ *
+ * > *4.3 Make the verdict hierarchy explicit. `paired_verdict` per metric
+ * > decides; `underpowered` is not a pass; a Pareto frontier may only order
+ * > candidates that are already non-dominated and never promotes.*
+ * > verify: **a fixture where the frontier prefers a candidate whose
+ * > `paired_verdict` is `underpowered` produces no promotion.**
+ *
+ * ## Why a scalar is the defect and not merely a simplification
+ *
+ * A weighted total is a claim that the metrics are commensurable and that the
+ * author knew the exchange rate. Neither is established here. Worse, the
+ * collapse is lossy in exactly the direction that matters: a candidate that
+ * regresses one metric and wins three can outscore one that wins all four, and
+ * the report shows one number where the disagreement was. The vector keeps the
+ * disagreement visible and forces {@link promotionVerdict} to state which row
+ * refused.
+ *
+ * So the shape carries the guarantee rather than a comment asking for it:
+ * {@link MetricVector} has no total field, no weight field, and nothing in this
+ * module takes a vector and returns a number.
+ * `tests/scripts/evaluation_vector.test.ts` scans every file in `src/scripts`
+ * that mentions `MetricVector` for that construct set, in both polarities.
+ *
+ * ## The artifact-count row is inside the gate, not beside it
+ *
+ * Sprawl reported next to a gate is a note; sprawl reported inside it can
+ * refuse. {@link buildVector} REFUSES a vector that omits the
+ * {@link ARTIFACT_COUNT_METRIC} row, so a candidate cannot reach
+ * {@link promotionVerdict} without its artifact delta having been measured, and
+ * {@link promotionVerdict} blocks on a delta above its ceiling.
+ *
+ * The default ceiling is **0** — a candidate may not grow the artifact count
+ * unless the caller says so. That is a conservative default rather than a
+ * measured one, and it is stated as such: a curator `ADD` is a legitimate
+ * positive delta, and the caller that knows it is an `ADD` passes the ceiling
+ * it means.
+ *
+ * ## Two row kinds, because two things are being measured
+ *
+ * A paired row carries a {@link PairedVerdict} — direction decided by the exact
+ * sign test, with `underpowered` deliberately not a kind of pass. A counted row
+ * carries an integer delta read off the candidate, with no trials behind it.
+ * Forcing the artifact delta through a paired verdict would invent trials that
+ * do not exist; giving a metric row a bare number would let a caller put an
+ * outcome there without evidence. Both shapes exist so neither lie is available.
+ */
+import type { PairedVerdict, PairedVerdictKind } from './paired_verdict.js';
+
+/** Which direction is better for a row. Read by {@link dominates}. */
+export type MetricDirection = 'higher-better' | 'lower-better';
+
+/** The counted row every vector must carry. Step 4.2 names it. */
+export const ARTIFACT_COUNT_METRIC = 'artifact-count-delta';
+
+export interface PairedRow {
+    kind: 'paired';
+    metric: string;
+    direction: MetricDirection;
+    verdict: PairedVerdict;
+}
+
+export interface CountedRow {
+    kind: 'counted';
+    metric: string;
+    direction: MetricDirection;
+    /** Signed delta against the baseline. No trials, no verdict, no inference. */
+    delta: number;
+}
+
+export type MetricRow = PairedRow | CountedRow;
+
+/**
+ * The evaluation record for one candidate.
+ *
+ * Deliberately absent: any field that would hold a summary number. Adding one
+ * is the failure this type exists to prevent, and the scanner test names it.
+ */
+export interface MetricVector {
+    candidate_id: string;
+    rows: readonly MetricRow[];
+}
+
+export class VectorShapeError extends Error {
+    constructor(message: string) {
+        super(message);
+        this.name = 'VectorShapeError';
+    }
+}
+
+/**
+ * Build a vector, refusing the three shapes that would make the gate lie:
+ * no rows at all, a duplicate metric name, or a missing artifact-count row.
+ */
+export function buildVector(candidate_id: string, rows: readonly MetricRow[]): MetricVector {
+    if (rows.length === 0) {
+        throw new VectorShapeError(`${candidate_id}: a vector with no rows measures nothing`);
+    }
+    const seen = new Set<string>();
+    for (const r of rows) {
+        if (seen.has(r.metric)) {
+            throw new VectorShapeError(`${candidate_id}: duplicate metric row '${r.metric}'`);
+        }
+        seen.add(r.metric);
+    }
+    if (!seen.has(ARTIFACT_COUNT_METRIC)) {
+        throw new VectorShapeError(
+            `${candidate_id}: missing the '${ARTIFACT_COUNT_METRIC}' row — the sprawl ` +
+                'measurement belongs inside the gate, so a vector without it cannot be evaluated',
+        );
+    }
+    return { candidate_id, rows: [...rows] };
+}
+
+/** The artifact-count row, or `null` on a vector that never went through {@link buildVector}. */
+export function artifactCountRow(v: MetricVector): CountedRow | null {
+    for (const r of v.rows) {
+        if (r.metric === ARTIFACT_COUNT_METRIC && r.kind === 'counted') {
+            return r;
+        }
+    }
+    return null;
+}
+
+/**
+ * Row-level ordering: `-1` when `a` is worse, `1` when better, `0` when the two
+ * carry no ordering against each other.
+ *
+ * A paired row orders by VERDICT KIND, never by magnitude — `magnitude_mean`
+ * exists for triage and decides nothing (`paired_verdict.ts` header). An
+ * `underpowered` row is incomparable with everything including itself: it is
+ * not a worse pass, it is an absence of evidence, so it can neither win a row
+ * nor lose one.
+ */
+/**
+ * Paired-verdict ordering. `underpowered` is `null` — incomparable in both
+ * directions, because an absent measurement is not a worse pass.
+ */
+const VERDICT_RANK: Record<PairedVerdictKind, number | null> = {
+    pass: 2,
+    'no-change': 1,
+    regression: 0,
+    underpowered: null,
+};
+
+export function compareRow(a: MetricRow, b: MetricRow): -1 | 0 | 1 {
+    if (a.metric !== b.metric) {
+        throw new VectorShapeError(`cannot compare '${a.metric}' against '${b.metric}'`);
+    }
+    if (a.kind === 'counted' && b.kind === 'counted') {
+        if (a.delta === b.delta) return 0;
+        const aBetter = a.direction === 'higher-better' ? a.delta > b.delta : a.delta < b.delta;
+        return aBetter ? 1 : -1;
+    }
+    if (a.kind === 'paired' && b.kind === 'paired') {
+        const ra = VERDICT_RANK[a.verdict.kind];
+        const rb = VERDICT_RANK[b.verdict.kind];
+        if (ra === null || rb === null) return 0;
+        if (ra === rb) return 0;
+        return ra > rb ? 1 : -1;
+    }
+    return 0;
+}
+
+/**
+ * Pareto domination: `a` dominates `b` when no row is worse and at least one is
+ * better. Vectors must carry the same metric names — comparing different metric
+ * sets is a shape error, not a tie.
+ */
+export function dominates(a: MetricVector, b: MetricVector): boolean {
+    const bRows = new Map(b.rows.map((r) => [r.metric, r]));
+    if (a.rows.length !== b.rows.length) {
+        throw new VectorShapeError(
+            `${a.candidate_id} and ${b.candidate_id} carry different metric sets`,
+        );
+    }
+    let strictlyBetter = false;
+    for (const ar of a.rows) {
+        const br = bRows.get(ar.metric);
+        if (br === undefined) {
+            throw new VectorShapeError(
+                `${a.candidate_id} and ${b.candidate_id} carry different metric sets`,
+            );
+        }
+        const c = compareRow(ar, br);
+        if (c < 0) return false;
+        if (c > 0) strictlyBetter = true;
+    }
+    return strictlyBetter;
+}
+
+/**
+ * The non-dominated set, in input order.
+ *
+ * ORDERING ONLY. This function promotes nothing and is not consulted by
+ * {@link promotionVerdict}; step 4.3's verify clause is precisely that a
+ * frontier preference cannot become a promotion. Membership here means "no
+ * other candidate beat this one on every row", which is a statement about the
+ * comparison set and not about whether the evidence concluded.
+ */
+export function paretoFrontier(vectors: readonly MetricVector[]): MetricVector[] {
+    return vectors.filter((v) => !vectors.some((o) => o !== v && dominates(o, v)));
+}
+
+export interface PromotionOptions {
+    /** Largest artifact-count delta this candidate class may carry. Default 0. */
+    artifactDeltaCeiling?: number;
+}
+
+export interface PromotionVerdict {
+    promote: boolean;
+    /** Every row that refused, by metric name. Empty iff `promote` is true. */
+    blocking: readonly string[];
+    /** One sentence a report can print verbatim. */
+    reason: string;
+}
+
+/**
+ * The ONLY promoter in this module, and the whole hierarchy in one place.
+ *
+ * Refuses on, in this order: a regression on any paired row; an `underpowered`
+ * paired row (not a pass — the remedy is more trials, not a promotion); an
+ * artifact-count delta above the ceiling; a vector with no paired row at all;
+ * and a vector where every paired row concluded `no-change`. The last is the
+ * one worth stating: `no-change` is a real verdict and it says the candidate
+ * did not help, so a vector of them is a decided absence of improvement rather
+ * than a clean sheet.
+ */
+export function promotionVerdict(v: MetricVector, opts: PromotionOptions = {}): PromotionVerdict {
+    const ceiling = opts.artifactDeltaCeiling ?? 0;
+    const blocking: string[] = [];
+    const notes: string[] = [];
+    let pairedRows = 0;
+    let passRows = 0;
+
+    for (const r of v.rows) {
+        if (r.kind === 'paired') {
+            pairedRows += 1;
+            if (r.verdict.kind === 'pass') passRows += 1;
+            if (r.verdict.kind === 'regression') {
+                blocking.push(r.metric);
+                notes.push(`${r.metric} regressed`);
+            } else if (r.verdict.kind === 'underpowered') {
+                blocking.push(r.metric);
+                notes.push(`${r.metric} is underpowered, which is not a pass`);
+            }
+        } else if (r.metric === ARTIFACT_COUNT_METRIC && r.delta > ceiling) {
+            blocking.push(r.metric);
+            notes.push(`artifact-count delta ${String(r.delta)} exceeds ceiling ${String(ceiling)}`);
+        }
+    }
+
+    if (pairedRows === 0) {
+        blocking.push('<no-paired-row>');
+        notes.push('no paired verdict in the vector, so no metric concluded');
+    } else if (passRows === 0 && blocking.length === 0) {
+        blocking.push('<no-pass-row>');
+        notes.push('every paired row concluded no-change, so nothing improved');
+    }
+
+    if (blocking.length > 0) {
+        return {
+            promote: false,
+            blocking,
+            reason: `${v.candidate_id} is not promotable: ${notes.join('; ')}`,
+        };
+    }
+    return {
+        promote: true,
+        blocking: [],
+        reason:
+            `${v.candidate_id} carries ${String(pairedRows)} paired row(s), ${String(passRows)} of them a pass, ` +
+            `none regressed or underpowered, artifact delta within ceiling ${String(ceiling)}`,
+    };
+}

package/src/scripts/_lib/evaluator_promotion.ts

@@ -0,0 +1,225 @@
+/**
+ * Evaluator promotion — a new evaluator earns its seat by cross-grading, or it
+ * does not get one.
+ *
+ * `road-to-governed-harness-evolution` Phase 4, step 4.7.
+ *
+ * > *Reuse the discrimination and hygiene machinery. `eval_publication`'s
+ * > `PlantedItem` for plants, `judge_hygiene` for order-swap. Add the
+ * > evaluator-promotion procedure the master omitted: an old and a new
+ * > evaluator must cross-grade frozen candidate sets, and evaluator promotion
+ * > itself requires discrimination plants.*
+ * > verify: **a planted candidate the control arm also satisfies is reported as
+ * > a discrimination deficit, not as a win; an evaluator change with no
+ * > cross-grade is refused.**
+ *
+ * ## Reuse, not reimplementation
+ *
+ * Risk 1 on this roadmap is a parallel rebuild of machinery that already
+ * exists, committed four times by the source proposals. So nothing here scores
+ * a plant, classifies an assertion, or decides a paired verdict:
+ * {@link reportPlants} delegates to `eval_publication.discriminationDeficit`
+ * and {@link assertEvaluatorPromotable} delegates to
+ * `judge_hygiene.auditAssertions`. What this module adds is the one thing
+ * neither has: the REFUSAL that turns an evaluator swap into a gated event.
+ *
+ * ## Why a satisfied plant can be a deficit rather than a win
+ *
+ * A plant exists to be recoverable only via the behaviour under test. If the
+ * control arm also satisfies it, then the item measured general competence and
+ * the treatment's success over it is not evidence about the treatment — the two
+ * arms scored the same for different-looking reasons. Counting it as a win is
+ * the exact inflation `eval_publication`'s header describes, so
+ * {@link reportPlants} moves it into `discrimination_deficits` and, critically,
+ * strips its `requires_artifact_behaviour` flag before handing the set to
+ * `discriminationDeficit` — otherwise a fixture set whose every discriminating
+ * plant turned out to be non-discriminating in practice would still pass the
+ * pre-run check on its declared intent.
+ *
+ * ## Order-swap is carried as a declared property, and refused when absent
+ *
+ * `judge_hygiene`'s header records that blinding and the order-swap are already
+ * met upstream by `check_quality_regression.evaluatePair`, which judges every
+ * pair in both orders and resolves a flip to `inconsistent`. This module does
+ * not re-implement that; it requires the cross-grade to DECLARE that it ran
+ * that way ({@link CrossGrade.order_swapped}) and refuses the promotion when it
+ * did not. That is an honest boundary: the property is asserted by the caller
+ * and checked here, not observed here.
+ */
+import { discriminationDeficit, type PlantedItem } from './eval_publication.js';
+import { auditAssertions, type AssertionObservation } from './judge_hygiene.js';
+
+/** One plant, and what each arm actually did with it. */
+export interface PlantOutcome {
+    item: PlantedItem;
+    treatment_satisfied: boolean;
+    control_satisfied: boolean;
+}
+
+export interface DiscriminationDeficitFinding {
+    id: string;
+    reason: string;
+}
+
+export interface PlantReport {
+    /** Plants the treatment satisfied and the control did not. The measurement. */
+    wins: readonly string[];
+    /** Plants the control also satisfied. Never wins, whatever the treatment did. */
+    discrimination_deficits: readonly DiscriminationDeficitFinding[];
+    /**
+     * The set-level verdict from `eval_publication.discriminationDeficit`, run
+     * over the EFFECTIVE set (observed, not declared). Non-null means the set
+     * cannot adjudicate at all.
+     */
+    set_deficit: string | null;
+}
+
+/** Classify every plant outcome. See the header for why a shared satisfaction is a deficit. */
+export function reportPlants(outcomes: readonly PlantOutcome[]): PlantReport {
+    const wins: string[] = [];
+    const deficits: DiscriminationDeficitFinding[] = [];
+    const effective: PlantedItem[] = [];
+
+    for (const o of outcomes) {
+        if (o.control_satisfied) {
+            deficits.push({
+                id: o.item.id,
+                reason:
+                    `the control arm also satisfied '${o.item.id}', so it measures general ` +
+                    'competence rather than the behaviour under test — a discrimination deficit, not a win',
+            });
+            effective.push({ id: o.item.id, requires_artifact_behaviour: false });
+            continue;
+        }
+        effective.push({ id: o.item.id, requires_artifact_behaviour: o.item.requires_artifact_behaviour });
+        if (o.treatment_satisfied && o.item.requires_artifact_behaviour) {
+            wins.push(o.item.id);
+        }
+    }
+
+    return {
+        wins,
+        discrimination_deficits: deficits,
+        set_deficit: discriminationDeficit(effective),
+    };
+}
+
+/** The frozen candidate set both evaluators must grade. Frozen means: named and enumerated. */
+export interface FrozenCandidateSet {
+    id: string;
+    candidate_ids: readonly string[];
+}
+
+export interface CrossGrade {
+    from_evaluator: string;
+    to_evaluator: string;
+    /** Must equal the change's frozen set id — a cross-grade of some other set proves nothing. */
+    frozen_set_id: string;
+    /** Candidate ids the OLD evaluator graded. */
+    graded_by_from: readonly string[];
+    /** Candidate ids the NEW evaluator graded. */
+    graded_by_to: readonly string[];
+    /**
+     * Declared by the caller: every pair was judged in both orders upstream
+     * (`check_quality_regression.evaluatePair`). See the header — asserted, not
+     * observed here.
+     */
+    order_swapped: boolean;
+    /** Rubric assertions used by the grading, audited via `judge_hygiene`. */
+    assertions: readonly AssertionObservation[];
+}
+
+export interface EvaluatorChange {
+    from: string;
+    to: string;
+    frozen_set: FrozenCandidateSet;
+    /** `null` is the case step 4.7 names: an evaluator change with no cross-grade. */
+    cross_grade: CrossGrade | null;
+    /** Discrimination plants. Evaluator promotion requires them, per step 4.7. */
+    plants: readonly PlantOutcome[];
+}
+
+export class EvaluatorPromotionRefused extends Error {
+    readonly reasons: readonly string[];
+    constructor(reasons: readonly string[]) {
+        super(`evaluator promotion refused: ${reasons.join('; ')}`);
+        this.name = 'EvaluatorPromotionRefused';
+        this.reasons = reasons;
+    }
+}
+
+function missing(required: readonly string[], graded: readonly string[]): string[] {
+    const seen = new Set(graded);
+    return required.filter((id) => !seen.has(id));
+}
+
+/**
+ * Throw {@link EvaluatorPromotionRefused} unless every condition holds.
+ *
+ * Fail-closed by construction: the function has no permissive path and no
+ * option object that could relax one. A caller who wants to promote an
+ * evaluator without a cross-grade has to delete this call, which is visible in
+ * a diff, rather than pass a flag, which is not.
+ */
+export function assertEvaluatorPromotable(change: EvaluatorChange): void {
+    const reasons: string[] = [];
+    const cg = change.cross_grade;
+
+    if (cg === null) {
+        reasons.push(
+            `no cross-grade between '${change.from}' and '${change.to}' — an evaluator change ` +
+                'without one has no evidence that the two agree on anything',
+        );
+    } else {
+        if (cg.frozen_set_id !== change.frozen_set.id) {
+            reasons.push(
+                `the cross-grade names frozen set '${cg.frozen_set_id}' but the change is over ` +
+                    `'${change.frozen_set.id}'`,
+            );
+        }
+        if (cg.from_evaluator !== change.from || cg.to_evaluator !== change.to) {
+            reasons.push(
+                `the cross-grade is between '${cg.from_evaluator}' and '${cg.to_evaluator}', ` +
+                    `not between '${change.from}' and '${change.to}'`,
+            );
+        }
+        const missFrom = missing(change.frozen_set.candidate_ids, cg.graded_by_from);
+        const missTo = missing(change.frozen_set.candidate_ids, cg.graded_by_to);
+        if (missFrom.length > 0) {
+            reasons.push(`'${change.from}' did not grade: ${missFrom.join(', ')}`);
+        }
+        if (missTo.length > 0) {
+            reasons.push(`'${change.to}' did not grade: ${missTo.join(', ')}`);
+        }
+        if (!cg.order_swapped) {
+            reasons.push('the cross-grade did not declare the order-swap, so a position bias is unexcluded');
+        }
+        const audit = auditAssertions(cg.assertions);
+        const alwaysPass = audit.findings.filter((f) => f.verdict === 'non-discriminating-always-pass');
+        if (alwaysPass.length > 0) {
+            reasons.push(
+                `${String(alwaysPass.length)} assertion(s) pass in both arms and narrow nothing: ` +
+                    alwaysPass.map((f) => f.id).join(', '),
+            );
+        }
+    }
+
+    if (change.plants.length === 0) {
+        reasons.push('evaluator promotion requires discrimination plants and this change carries none');
+    } else {
+        const report = reportPlants(change.plants);
+        if (report.set_deficit !== null) {
+            reasons.push(`plants cannot discriminate: ${report.set_deficit}`);
+        }
+        if (report.discrimination_deficits.length > 0) {
+            reasons.push(
+                `${String(report.discrimination_deficits.length)} plant(s) were also satisfied by the control arm: ` +
+                    report.discrimination_deficits.map((d) => d.id).join(', '),
+            );
+        }
+    }
+
+    if (reasons.length > 0) {
+        throw new EvaluatorPromotionRefused(reasons);
+    }
+}

package/src/scripts/_lib/evidence_basis.ts

@@ -0,0 +1,118 @@
+/**
+ * One evidence-basis vocabulary (`road-to-delivered-cost-truth` step 4.1).
+ *
+ * Every number this suite reports rests on something, and until now the tree
+ * said what on at least three incompatible partial scales:
+ *
+ *   `_lib/orchestration_record.ts`  `'measured' | 'estimated'`
+ *   `preamble_byte_census.ts`       `'measured_local_file' | 'residual'`
+ *   `_lib/value_ladder.ts`          `'measured' | 'estimated' | 'vendor-claim' | 'pending' | 'available'`
+ *
+ * They overlap, disagree on naming for the same idea, and none of them can
+ * express "a model judged this" — which several surfaces in this tree do report.
+ * This module is the reconciliation, and it is deliberately NOT a fourth
+ * vocabulary sitting beside the three: the migration of the first two ships in
+ * the same change, and the third is documented as an unmigrated variant with the
+ * reason, rather than left looking like an oversight.
+ *
+ * WHAT EACH VALUE RESTS ON — one sentence, which is the whole contract:
+ *
+ *   measured           an instrument in this repository produced it from real input
+ *   estimated          derived by arithmetic from measured values, not itself observed
+ *   inferred           concluded from structure or convention, with no measurement behind it
+ *   provider-reported  a third party stated it and we recorded it unverified
+ *   model-judged       a language model's assessment, reproducible only in distribution
+ *   unknown            nothing establishes it, and that is the honest answer
+ *
+ * `unknown` is a first-class value, not a failure code. A surface that cannot
+ * establish a basis says `unknown`; it does not pick the nearest optimistic one.
+ */
+
+export const EVIDENCE_BASES = [
+    'measured',
+    'estimated',
+    'inferred',
+    'provider-reported',
+    'model-judged',
+    'unknown',
+] as const;
+export type EvidenceBasis = (typeof EVIDENCE_BASES)[number];
+
+/** What each value rests on. Printed verbatim by surfaces that explain themselves. */
+export const EVIDENCE_BASIS_MEANING: Record<EvidenceBasis, string> = {
+    measured: 'an instrument in this repository produced it from real input',
+    estimated: 'derived by arithmetic from measured values, not itself observed',
+    inferred: 'concluded from structure or convention, with no measurement behind it',
+    'provider-reported': 'a third party stated it and we recorded it unverified',
+    'model-judged': "a language model's assessment, reproducible only in distribution",
+    unknown: 'nothing establishes it, and that is the honest answer',
+};
+
+export function isEvidenceBasis(v: unknown): v is EvidenceBasis {
+    return typeof v === 'string' && (EVIDENCE_BASES as readonly string[]).includes(v);
+}
+
+/**
+ * Ordering by how much a reader may lean on the value.
+ *
+ * Used for reporting, never for arithmetic: two figures on different bases do
+ * not become comparable by being ranked, and nothing here should be read as
+ * licence to average them.
+ */
+export const EVIDENCE_BASIS_STRENGTH: Record<EvidenceBasis, number> = {
+    measured: 5,
+    estimated: 4,
+    'provider-reported': 3,
+    inferred: 2,
+    'model-judged': 1,
+    unknown: 0,
+};
+
+/** The weakest basis in a set — what a derived figure may honestly claim. */
+export function weakestBasis(bases: readonly EvidenceBasis[]): EvidenceBasis {
+    if (bases.length === 0) return 'unknown';
+    return bases.reduce((a, b) => (EVIDENCE_BASIS_STRENGTH[b] < EVIDENCE_BASIS_STRENGTH[a] ? b : a));
+}
+
+// ---------------------------------------------------------------------------
+// Basis TAGS — a basis plus, where the basis is `estimated`, its method
+// ---------------------------------------------------------------------------
+
+/**
+ * `estimated` on its own is not a basis, it is a category.
+ *
+ * Two figures both marked `estimated` can differ by an order of magnitude in
+ * how much they should be trusted — one derived by arithmetic from measured
+ * inputs, one from a response-length heuristic — and a report that renders them
+ * identically has told the reader nothing they can act on. So wherever a figure
+ * is estimated, the METHOD travels with it.
+ *
+ * Every other basis is self-describing and takes no suffix: `measured` names
+ * the instrument by existing, `unknown` has no method by definition, and
+ * `model-judged` and `provider-reported` name their source in the value itself.
+ *
+ * road-to-experience-loop-broadening step 6.2.
+ */
+export type BasisTag = Exclude<EvidenceBasis, 'estimated'> | `estimated:${string}`;
+
+/**
+ * A bare `estimated` is REJECTED, and that is the whole point of the type.
+ * `estimated:` with nothing after it is rejected too — an empty method is the
+ * same omission wearing a colon.
+ */
+export function isBasisTag(v: unknown): v is BasisTag {
+    if (typeof v !== 'string') return false;
+    if (v === 'estimated') return false;
+    if (v.startsWith('estimated:')) return v.slice('estimated:'.length).trim().length > 0;
+    return isEvidenceBasis(v);
+}
+
+/** The basis half of a tag, for grouping and for rendering the meaning table. */
+export function basisOf(tag: BasisTag): EvidenceBasis {
+    return tag.startsWith('estimated:') ? 'estimated' : (tag as EvidenceBasis);
+}
+
+/** The method half, or `null` for every non-estimated basis. */
+export function methodOf(tag: BasisTag): string | null {
+    return tag.startsWith('estimated:') ? tag.slice('estimated:'.length) : null;
+}

package/src/scripts/_lib/exec_evidence.ts

@@ -60,6 +60,14 @@ export const ALLOWLIST_PREFIXES: readonly (readonly string[])[] = [
     // report exists. Read-only, deterministic, model-free, and already run in
     // CI (`rule-backstops.yml`) for its own reasons.
     ['check_enforcement_denominator'],
+    // road-to-source-silence Phase 5.3. The source-confidentiality gate's exit
+    // code IS the verdict for `claim:plaintext-source-attribution`: 0 means zero
+    // deny-pattern matches in tracked content AND in every tracked path, plus the
+    // attribution-shape block count at or below its ratchet baseline. An
+    // existence-check pointer would have gone stale the first time somebody added
+    // a name. Read-only, deterministic, model-free, and already run in CI for its
+    // own reasons — the same class as its neighbours here.
+    ['check_no_external_sources'],
     ['check_token_regression'],
     ['lint_agent_security'],
     ['measure_lexical_ranking'],