@evomap/evolver-core 2.0.0-beta.2 → 2.0.0-beta.22

package/dist/algo/index.js

@@ -1,12 +1,15 @@
 export * from './geneHealth.js';
 export * from './exploration.js';
+export * from './ucb1.js';
 export * from './epigenetics.js';
 export * from './confidence.js';
+export * from './memoryGraph.js';
 export * from './capabilityCandidates.js';
 export * from './conversationSniffer.js';
 export * from './geneIntake.js';
 export * from './candidateAssembly.js';
 export * from './genePromotion.js';
+export * from './publishEligibility.js';
 export * from './bans.js';
 export * from './antiDistill.js';
 export * from './orchestrator.js';
@@ -16,4 +19,6 @@ export * from './solidify.js';
 export * from './evolutionEvent.js';
 export * from './cycleEngine.js';
 export * from './strategyPresets.js';
-export * from './cycleFailureClassifier.js';
+export * from './cycleFailureClassifier.js';
+export * from './kautoValidator.js';
+export * from './kautoProjection.js';

package/dist/algo/kautoProjection.d.ts

@@ -0,0 +1,41 @@
+import type { KautoVerdict } from './kautoValidator.js';
+/** The five coordinates of the K_auto projection key. Order is fixed for stable key encoding. */
+export declare const PROJECTION_COORDINATES: readonly ["version", "claim", "scope", "runtime", "verifier"];
+export type ProjectionCoordinate = (typeof PROJECTION_COORDINATES)[number];
+/** The append-only event type a revocation is recorded under on the authoritative root-event stream. */
+export declare const PROJECTION_REVOKED_EVENT_TYPE = "governance.projection.revoked";
+/** A reinstatement withdraws a prior revocation of the SAME (coordinate, value) pair (reversibility). */
+export declare const PROJECTION_REINSTATED_EVENT_TYPE = "governance.projection.reinstated";
+export interface ProjectionRevocationPayload {
+    /** Which coordinate axis the distrust applies to. */
+    coordinate: ProjectionCoordinate;
+    /** The resolved coordinate value being distrusted (e.g. a verifier profile id or a runtime name). */
+    value: string;
+    /** Auditable reason; recorded, never interpreted. */
+    reason?: string;
+}
+/** Minimal shape of a root event this reducer reads. Compatible with events/eventSchema RootEvent. */
+export interface ProjectionSourceEvent {
+    type: string;
+    payload?: unknown;
+}
+/** Canonical revoked-set key. A revocation is identified by its (coordinate, value) pair, never by asset id. */
+export declare function revocationKey(coordinate: ProjectionCoordinate, value: string): string;
+/**
+ * Reduce the authoritative root-event history to the CURRENT set of revoked (coordinate, value) pairs. Pure and
+ * order-preserving: a revocation adds its key; a matching reinstatement removes it; later events win. Recomputing
+ * this from the same events yields a byte-identical set (replay invariant), because the root-event stream — not a
+ * mutable table — is the single source of truth (mirrors ops/evolutionGraphProjection.ts).
+ */
+export declare function projectRevocations(events: readonly ProjectionSourceEvent[]): Set<string>;
+/**
+ * Whether a record's current projection touches any revoked coordinate value. Only records whose five coordinates
+ * are all machine-decidable (`verdict.inKauto`) HAVE a projection under T1, so an undecidable record is never
+ * governed by projection revocation here (it routes through the deployed advisory/exclusion paths instead) — and
+ * this function returns false for it. For a decidable record, revocation is coordinate-LOCAL: it is revoked iff
+ * some coordinate's resolved value equals a distrusted (coordinate, value) pair; a sibling that differs on that
+ * coordinate is not.
+ */
+export declare function isProjectionRevoked(verdict: KautoVerdict, revoked: ReadonlySet<string>): boolean;
+/** The specific revoked coordinate(s) a record's projection matched — for auditing WHY a projection was dropped. */
+export declare function revokedCoordinatesFor(verdict: KautoVerdict, revoked: ReadonlySet<string>): ProjectionCoordinate[];

package/dist/algo/kautoProjection.js

@@ -0,0 +1,95 @@
+// K_auto EvidenceProjection — coordinate-level partial revocation over the five-coordinate key.
+//
+// WHY THIS EXISTS. The paper's headline abstraction is that an experience asset's validity is a projection
+// over five coordinates — (asset version, claim, scope, runtime, verifier) — and that revocation is PARTIAL:
+// distrusting one verifier profile quarantines every projection whose verifier coordinate names it, while
+// leaving projections that differ on that coordinate (a sibling verifier, or a different runtime/scope)
+// untouched. `algo/kautoValidator.ts` decides five-coordinate MEMBERSHIP (is each coordinate machine-decidable),
+// but nothing consumed that verdict as a revocable projection: assembly collapsed it to a boolean `kautoMember`
+// used only as a soft +λ selection preference (`algo/geneSelection.ts`), and the only real exclusion path
+// (`algo/bans.ts`) keys on gene id × signal overlap, not on coordinates. This module realizes the missing
+// consumer: an append-only revocation event names a (coordinate, value) pair, and a pure reducer projects the
+// current revoked set from the authoritative root-event history so a selection guard can drop exactly the
+// records whose projection touches a revoked coordinate value — coordinate-locally, recomputably, reversibly.
+//
+// DEPLOYMENT BOUNDARY. This is the T1 (specified) projection-revocation mechanism, exercised by a controlled
+// experiment and an optional, default-OFF selection guard (`candidateAssembly` `opts.kautoProjection`). It does
+// not change the deployed T2 path (signal-scoped gene-level `bannedGenesFromFailures` + soft λ preference), which
+// stays byte-for-byte unchanged when the guard is absent.
+/** The five coordinates of the K_auto projection key. Order is fixed for stable key encoding. */
+export const PROJECTION_COORDINATES = ['version', 'claim', 'scope', 'runtime', 'verifier'];
+/** The append-only event type a revocation is recorded under on the authoritative root-event stream. */
+export const PROJECTION_REVOKED_EVENT_TYPE = 'governance.projection.revoked';
+/** A reinstatement withdraws a prior revocation of the SAME (coordinate, value) pair (reversibility). */
+export const PROJECTION_REINSTATED_EVENT_TYPE = 'governance.projection.reinstated';
+const isCoordinate = (v) => typeof v === 'string' && PROJECTION_COORDINATES.includes(v);
+/** Canonical revoked-set key. A revocation is identified by its (coordinate, value) pair, never by asset id. */
+export function revocationKey(coordinate, value) {
+    return `${coordinate}:${value}`;
+}
+function readRevocationPayload(payload) {
+    if (!payload || typeof payload !== 'object' || Array.isArray(payload))
+        return null;
+    const p = payload;
+    if (!isCoordinate(p['coordinate']))
+        return null;
+    const value = typeof p['value'] === 'string' ? p['value'].trim() : '';
+    if (!value)
+        return null;
+    const out = { coordinate: p['coordinate'], value };
+    if (typeof p['reason'] === 'string')
+        out.reason = p['reason'];
+    return out;
+}
+/**
+ * Reduce the authoritative root-event history to the CURRENT set of revoked (coordinate, value) pairs. Pure and
+ * order-preserving: a revocation adds its key; a matching reinstatement removes it; later events win. Recomputing
+ * this from the same events yields a byte-identical set (replay invariant), because the root-event stream — not a
+ * mutable table — is the single source of truth (mirrors ops/evolutionGraphProjection.ts).
+ */
+export function projectRevocations(events) {
+    const revoked = new Set();
+    for (const evt of events) {
+        if (evt.type === PROJECTION_REVOKED_EVENT_TYPE) {
+            const p = readRevocationPayload(evt.payload);
+            if (p)
+                revoked.add(revocationKey(p.coordinate, p.value));
+        }
+        else if (evt.type === PROJECTION_REINSTATED_EVENT_TYPE) {
+            const p = readRevocationPayload(evt.payload);
+            if (p)
+                revoked.delete(revocationKey(p.coordinate, p.value));
+        }
+    }
+    return revoked;
+}
+/**
+ * Whether a record's current projection touches any revoked coordinate value. Only records whose five coordinates
+ * are all machine-decidable (`verdict.inKauto`) HAVE a projection under T1, so an undecidable record is never
+ * governed by projection revocation here (it routes through the deployed advisory/exclusion paths instead) — and
+ * this function returns false for it. For a decidable record, revocation is coordinate-LOCAL: it is revoked iff
+ * some coordinate's resolved value equals a distrusted (coordinate, value) pair; a sibling that differs on that
+ * coordinate is not.
+ */
+export function isProjectionRevoked(verdict, revoked) {
+    if (!verdict.inKauto || revoked.size === 0)
+        return false;
+    for (const coordinate of PROJECTION_COORDINATES) {
+        const resolved = verdict.coordinates[coordinate].resolved;
+        if (resolved !== undefined && revoked.has(revocationKey(coordinate, resolved)))
+            return true;
+    }
+    return false;
+}
+/** The specific revoked coordinate(s) a record's projection matched — for auditing WHY a projection was dropped. */
+export function revokedCoordinatesFor(verdict, revoked) {
+    if (!verdict.inKauto || revoked.size === 0)
+        return [];
+    const hits = [];
+    for (const coordinate of PROJECTION_COORDINATES) {
+        const resolved = verdict.coordinates[coordinate].resolved;
+        if (resolved !== undefined && revoked.has(revocationKey(coordinate, resolved)))
+            hits.push(coordinate);
+    }
+    return hits;
+}

package/dist/algo/kautoValidator.d.ts

@@ -0,0 +1,68 @@
+import type { AssetRecord } from '../assetstore/provider.js';
+/** Why a coordinate could not be decided. `null` means it was decided. */
+export type UndecidableReason = string | null;
+export interface CoordinateVerdict {
+    decidable: boolean;
+    /** The resolved value when decidable, for auditing what the predicate actually accepted. */
+    resolved?: string;
+    reason: UndecidableReason;
+}
+export interface KautoVerdict {
+    inKauto: boolean;
+    coordinates: {
+        version: CoordinateVerdict;
+        claim: CoordinateVerdict;
+        scope: CoordinateVerdict;
+        runtime: CoordinateVerdict;
+        verifier: CoordinateVerdict;
+    };
+    /** Coordinate names that failed, most useful for aggregate reporting. */
+    blockedBy: string[];
+}
+export declare function decideVersion(rec: Readonly<Record<string, unknown>>): CoordinateVerdict;
+export declare const CLAIM_PREDICATES: readonly ["source_of_truth", "requires_service", "requires_tool", "forbids_action", "output_contract", "ordering_constraint", "environment_precondition"];
+export declare function decideClaim(rec: Readonly<Record<string, unknown>>): CoordinateVerdict;
+export declare function decideScope(rec: Readonly<Record<string, unknown>>): CoordinateVerdict;
+export interface RuntimeRegistry {
+    has(id: string): boolean;
+}
+export declare function decideRuntime(rec: Readonly<Record<string, unknown>>, registry?: RuntimeRegistry): CoordinateVerdict;
+export declare function decideVerifier(rec: Readonly<Record<string, unknown>>): CoordinateVerdict;
+/**
+ * Decide K_auto membership for one record. All five coordinates must be decidable; we evaluate every
+ * coordinate rather than short-circuiting, so aggregate reporting can attribute the shortfall.
+ */
+export declare function decideKauto(record: Readonly<Record<string, unknown>> | AssetRecord, opts?: {
+    runtimeRegistry?: RuntimeRegistry;
+}): KautoVerdict;
+/**
+ * The PRESENCE proxy the original production query implemented, kept so the two can be reported side by
+ * side and the gap between them quantified rather than asserted.
+ */
+export declare function decideKautoPresenceProxy(record: Readonly<Record<string, unknown>> | AssetRecord): boolean;
+export interface KautoStructuralVerdict {
+    /** True when the record STRUCTURALLY carries all five dedicated coordinates in canonical shape (regardless of
+     * whether their CONTENT clears the strict decidability bar). */
+    structurallyComplete: boolean;
+    coordinates: {
+        version: boolean;
+        claim: boolean;
+        scope: boolean;
+        runtime: boolean;
+        verifier: boolean;
+    };
+    /** Dedicated-coordinate names the writer did not emit in canonical shape. */
+    missing: string[];
+}
+/**
+ * The SECOND track of the dual-track report (user decision: 双轨并报). Where {@link decideKauto} answers "is each
+ * coordinate machine-DECIDABLE" (strict, closed-vocabulary bar), this answers the strictly weaker, writer-side
+ * question "did the producer EMIT the dedicated coordinate field at all, in its canonical minimal shape". The two
+ * are reported side by side so the paper can separate two failure modes that a single number conflates:
+ *   - the dedicated field is ABSENT (writer never emitted it) — the 0%-adoption problem this batch attacks; vs
+ *   - the dedicated field is PRESENT but its content is not yet strict (e.g. a scope signal that is not namespaced,
+ *     a claim predicate outside the closed vocabulary) — a content-quality gap, not an adoption gap.
+ * Structural presence NEVER implies decidability; it is deliberately permissive so the adoption-vs-quality gap is
+ * visible rather than hidden inside the single strict figure.
+ */
+export declare function decideKautoStructural(record: Readonly<Record<string, unknown>> | AssetRecord): KautoStructuralVerdict;

package/dist/algo/kautoValidator.js

@@ -0,0 +1,256 @@
+const str = (v) => (typeof v === 'string' ? v.trim() : '');
+const arr = (v) => (Array.isArray(v) ? v.filter((x) => typeof x === 'string') : []);
+// ---------------------------------------------------------------------------------------------------
+// Version. Needs an identifier that pins THIS asset's immutable version. A record-format version
+// (schema_version) is shared across the whole catalogue and cannot distinguish two versions of one asset,
+// so it does not satisfy the coordinate even though it is always present.
+// ---------------------------------------------------------------------------------------------------
+const VERSION_FIELDS = ['asset_version', 'assetVersion', 'version', 'content_hash', 'contentHash'];
+/** Content-addressed asset ids are immutable version pins (sha256 of canonical gene bytes). */
+const CONTENT_ADDRESSED_ASSET_ID = /^sha256:[a-f0-9]{64}$/i;
+export function decideVersion(rec) {
+    for (const f of VERSION_FIELDS) {
+        const v = str(rec[f]);
+        if (v)
+            return { decidable: true, resolved: `${f}=${v}`, reason: null };
+    }
+    // asset_id is the production content-address: intake always writes it, and it changes when any
+    // coordinate-bearing field changes. Accepting it closes the version coordinate without inventing a
+    // parallel asset_version field the gep-sdk schema does not yet declare.
+    const assetId = str(rec['asset_id']);
+    if (CONTENT_ADDRESSED_ASSET_ID.test(assetId)) {
+        return { decidable: true, resolved: `asset_id=${assetId}`, reason: null };
+    }
+    const schemaVersion = str(rec['schema_version']);
+    if (schemaVersion) {
+        return {
+            decidable: false,
+            reason: `only schema_version=${schemaVersion} is present; that is the record format version, shared across assets, and does not identify this asset's immutable version`,
+        };
+    }
+    return { decidable: false, reason: 'no asset version identifier present' };
+}
+// ---------------------------------------------------------------------------------------------------
+// Claim. The closed claim vocabulary is a set of typed claim PREDICATES about what an asset asserts,
+// distinct from `category`, which records the kind of intervention. A record carrying only `category` has
+// an intervention type but no machine-checkable claim, so claim-level conflict detection has nothing to
+// compare.
+// ---------------------------------------------------------------------------------------------------
+export const CLAIM_PREDICATES = Object.freeze([
+    'source_of_truth',
+    'requires_service',
+    'requires_tool',
+    'forbids_action',
+    'output_contract',
+    'ordering_constraint',
+    'environment_precondition',
+]);
+const CLAIM_FIELDS = ['claim', 'claims', 'claim_predicate', 'claimPredicate'];
+/** Extract candidate predicate STRINGS from a claim field value, accepting both the legacy string/string[] form
+ * and the gep-sdk 1.13.0 object form `{predicate, kind}` (single or array). Non-conforming entries are dropped. */
+function claimPredicateStrings(raw) {
+    const fromOne = (v) => {
+        if (typeof v === 'string')
+            return v;
+        if (v && typeof v === 'object' && !Array.isArray(v)) {
+            const p = v['predicate'];
+            return typeof p === 'string' ? p : null;
+        }
+        return null;
+    };
+    const items = Array.isArray(raw) ? raw : [raw];
+    return items.map(fromOne).filter((s) => typeof s === 'string' && s.trim().length > 0);
+}
+export function decideClaim(rec) {
+    const known = new Set(CLAIM_PREDICATES);
+    for (const f of CLAIM_FIELDS) {
+        const raw = rec[f];
+        if (raw === undefined || raw === null)
+            continue;
+        // A claim predicate names a closed-vocabulary term as its leading token — legacy `source_of_truth:...`
+        // strings and the gep-sdk `{predicate:'source_of_truth(...)'}` object form both reduce to the same token.
+        const candidates = claimPredicateStrings(raw);
+        const named = candidates.map((c) => str(c).split(/[:=(]/, 1)[0] ?? '').filter(Boolean);
+        const hit = named.find((n) => known.has(n));
+        if (hit)
+            return { decidable: true, resolved: hit, reason: null };
+        if (named.length > 0) {
+            return { decidable: false, reason: `claim predicate(s) ${named.join(', ')} are not in the closed claim vocabulary` };
+        }
+    }
+    const category = str(rec['category']);
+    if (category) {
+        return {
+            decidable: false,
+            reason: `only category=${category} is present; category is the intervention kind, not a claim predicate from the closed vocabulary`,
+        };
+    }
+    return { decidable: false, reason: 'no claim predicate present' };
+}
+// ---------------------------------------------------------------------------------------------------
+// Scope. Must parse in the closed constraint language, because scope containment has to be decidable for
+// set-inclusion precedence to work. We accept the forms the paper enumerates: identity sets, version
+// intervals, repository-lineage prefixes, capability-set containment, time intervals, enumerated sets, and
+// registered compatibility relations. A bare tag is an identity-set element ONLY when it is namespaced,
+// so that two tags from different producers cannot silently collide; an unqualified free-text tag is not
+// decidable against another producer's tag of the same name.
+// ---------------------------------------------------------------------------------------------------
+const SCOPE_TERM = /^(?:repo|lineage|pkg|lang|framework|capability|tool|model|time|env):[A-Za-z0-9._@/:-]+$/;
+const VERSION_INTERVAL = /^[A-Za-z0-9._-]+@(?:[><=^~]{1,2})?\d[\w.*-]*(?:\s*-\s*\d[\w.*-]*)?$/;
+/** Do all of `terms` parse in the closed constraint language? Shared by the dedicated `scope` field and the
+ * legacy `signals_match` proxy so the SAME containment-decidability bar governs both. */
+function decideScopeTerms(terms) {
+    if (terms.length === 0)
+        return { decidable: false, reason: 'signals_match is empty; no scope predicate' };
+    const parses = (t) => SCOPE_TERM.test(t) || VERSION_INTERVAL.test(t);
+    const undecidable = terms.filter((t) => {
+        // A hard facet gates on a term; the term itself must parse, so strip the marker and test what remains.
+        const bare = t.startsWith('required:') ? t.slice('required:'.length) : t;
+        return !parses(bare);
+    });
+    if (undecidable.length === 0) {
+        return { decidable: true, resolved: terms.join(','), reason: null };
+    }
+    return {
+        decidable: false,
+        reason: `${undecidable.length} of ${terms.length} scope term(s) do not parse in the closed constraint language (e.g. ${undecidable.slice(0, 3).join(', ')}); containment against another scope is therefore undecidable`,
+    };
+}
+export function decideScope(rec) {
+    // Dedicated coordinate first (gep-sdk 1.13.0 `scope: {signals, predicate?}`). Its `signals` list carries the
+    // scope terms; a `predicate` is metadata for the reader, not a substitute for parseable signals. When the
+    // dedicated field is present but its signals are empty we fall through to the proxy, so a malformed dedicated
+    // field never DEMOTES a record that the legacy path would have admitted.
+    const scope = rec['scope'];
+    if (scope && typeof scope === 'object' && !Array.isArray(scope)) {
+        const signals = arr(scope['signals']).map((t) => str(t)).filter(Boolean);
+        if (signals.length > 0)
+            return decideScopeTerms(signals);
+    }
+    const terms = arr(rec['signals_match']).map((t) => str(t)).filter(Boolean);
+    return decideScopeTerms(terms);
+}
+/** Apply the runtime bar to one resolved identity string, `src` naming where it came from for the reason text. */
+function decideRuntimeName(name, src, registry) {
+    if (!name)
+        return { decidable: false, reason: `no ${src} recorded` };
+    if (name.toLowerCase() === 'unknown') {
+        return { decidable: false, reason: `${src} is the \`unknown\` sentinel, which denotes a runtime that could not be detected` };
+    }
+    if (registry && !registry.has(name)) {
+        return { decidable: false, reason: `${src}=${name} does not resolve to a registered runtime profile` };
+    }
+    return { decidable: true, resolved: name, reason: null };
+}
+export function decideRuntime(rec, registry) {
+    // Dedicated coordinate first (gep-sdk 1.13.0 `runtime_profile: {runtime, env_class?}`). Same registry bar as
+    // the proxy. A present-but-empty runtime_profile falls through so it never demotes a record model_name admits.
+    const rp = rec['runtime_profile'];
+    if (rp && typeof rp === 'object' && !Array.isArray(rp)) {
+        const runtime = str(rp['runtime']);
+        if (runtime)
+            return decideRuntimeName(runtime, 'runtime_profile.runtime', registry);
+    }
+    return decideRuntimeName(str(rec['model_name']), 'model_name', registry);
+}
+// ---------------------------------------------------------------------------------------------------
+// Verifier. Must clear a minimum semantic bar: it has to exercise the asset's own claim, not merely prove
+// that an interpreter exists. We reject the known placeholder shapes rather than counting any non-empty
+// validation array. This is the coordinate where a permissive predicate would be most misleading, because
+// a nominal verifier is worse than an absent one: absence is honest.
+// ---------------------------------------------------------------------------------------------------
+const PLACEHOLDER_VERIFIER = /^(?:node|python3?|ruby|deno|bun|go|java|npm|pnpm|yarn)\s+(?:--?v(?:ersion)?|-V)\s*$/i;
+const TRIVIAL_VERIFIER = /^(?:true|:|echo\b.*|exit\s+0)\s*$/i;
+const isSubstantiveVerifier = (c) => !PLACEHOLDER_VERIFIER.test(c) && !TRIVIAL_VERIFIER.test(c);
+export function decideVerifier(rec) {
+    // Dedicated coordinate first (gep-sdk 1.13.0 `verifier_profile: {verifier, decision?}`). The verifier IDENTITY
+    // string must clear the SAME minimum semantic bar as a legacy validation command — a `node --version` identity
+    // is as hollow here as it is there. A present-but-empty verifier_profile falls through to the proxy.
+    const vp = rec['verifier_profile'];
+    if (vp && typeof vp === 'object' && !Array.isArray(vp)) {
+        const verifier = str(vp['verifier']);
+        if (verifier) {
+            if (isSubstantiveVerifier(verifier))
+                return { decidable: true, resolved: verifier, reason: null };
+            return {
+                decidable: false,
+                reason: `verifier_profile.verifier=${verifier} is a placeholder; it establishes that an interpreter exists, not that the asset's claim holds`,
+            };
+        }
+    }
+    const cmds = arr(rec['validation']).map((c) => str(c)).filter(Boolean);
+    if (cmds.length === 0)
+        return { decidable: false, reason: 'validation is empty; no verifier profile' };
+    const substantive = cmds.filter(isSubstantiveVerifier);
+    if (substantive.length === 0) {
+        return {
+            decidable: false,
+            reason: `all ${cmds.length} validation entr${cmds.length === 1 ? 'y is' : 'ies are'} placeholders (e.g. ${cmds[0]}); they establish that an interpreter exists, not that the asset's claim holds`,
+        };
+    }
+    return { decidable: true, resolved: substantive[0], reason: null };
+}
+/**
+ * Decide K_auto membership for one record. All five coordinates must be decidable; we evaluate every
+ * coordinate rather than short-circuiting, so aggregate reporting can attribute the shortfall.
+ */
+export function decideKauto(record, opts) {
+    const rec = record;
+    const coordinates = {
+        version: decideVersion(rec),
+        claim: decideClaim(rec),
+        scope: decideScope(rec),
+        runtime: decideRuntime(rec, opts?.runtimeRegistry),
+        verifier: decideVerifier(rec),
+    };
+    const blockedBy = Object.entries(coordinates).filter(([, v]) => !v.decidable).map(([k]) => k);
+    return { inKauto: blockedBy.length === 0, coordinates, blockedBy };
+}
+/**
+ * The PRESENCE proxy the original production query implemented, kept so the two can be reported side by
+ * side and the gap between them quantified rather than asserted.
+ */
+export function decideKautoPresenceProxy(record) {
+    const rec = record;
+    const CATEGORIES = new Set(['repair', 'optimize', 'innovate', 'explore']);
+    return Boolean(str(rec['schema_version'])
+        && CATEGORIES.has(str(rec['category']))
+        && arr(rec['signals_match']).length > 0
+        && str(rec['model_name'])
+        && arr(rec['validation']).length > 0);
+}
+/**
+ * The SECOND track of the dual-track report (user decision: 双轨并报). Where {@link decideKauto} answers "is each
+ * coordinate machine-DECIDABLE" (strict, closed-vocabulary bar), this answers the strictly weaker, writer-side
+ * question "did the producer EMIT the dedicated coordinate field at all, in its canonical minimal shape". The two
+ * are reported side by side so the paper can separate two failure modes that a single number conflates:
+ *   - the dedicated field is ABSENT (writer never emitted it) — the 0%-adoption problem this batch attacks; vs
+ *   - the dedicated field is PRESENT but its content is not yet strict (e.g. a scope signal that is not namespaced,
+ *     a claim predicate outside the closed vocabulary) — a content-quality gap, not an adoption gap.
+ * Structural presence NEVER implies decidability; it is deliberately permissive so the adoption-vs-quality gap is
+ * visible rather than hidden inside the single strict figure.
+ */
+export function decideKautoStructural(record) {
+    const rec = record;
+    // version has no separate dedicated shape — asset_version/content_hash IS the coordinate, so structural
+    // presence coincides with strict decidability here (there is no semantic bar beyond "an immutable id exists").
+    const version = decideVersion(rec).decidable;
+    // claim: `claims: [{predicate}]` with at least one non-empty predicate string (closed-vocabulary check is the
+    // strict track's job, not this one).
+    const claim = claimPredicateStrings(rec['claims']).length > 0;
+    // scope: `scope: {signals: [...]}` with at least one non-empty signal (parseability is the strict track's job).
+    const scopeRaw = rec['scope'];
+    const scope = Boolean(scopeRaw && typeof scopeRaw === 'object' && !Array.isArray(scopeRaw)
+        && arr(scopeRaw['signals']).map((t) => str(t)).filter(Boolean).length > 0);
+    // runtime: `runtime_profile: {runtime}` with a non-empty runtime string (registry/sentinel is the strict track).
+    const rpRaw = rec['runtime_profile'];
+    const runtime = Boolean(rpRaw && typeof rpRaw === 'object' && !Array.isArray(rpRaw)
+        && str(rpRaw['runtime']));
+    // verifier: `verifier_profile: {verifier}` with a non-empty verifier string (placeholder bar is the strict track).
+    const vpRaw = rec['verifier_profile'];
+    const verifier = Boolean(vpRaw && typeof vpRaw === 'object' && !Array.isArray(vpRaw)
+        && str(vpRaw['verifier']));
+    const coordinates = { version, claim, scope, runtime, verifier };
+    const missing = Object.entries(coordinates).filter(([, present]) => !present).map(([k]) => k);
+    return { structurallyComplete: missing.length === 0, coordinates, missing };
+}

package/dist/algo/memoryGraph.d.ts

@@ -0,0 +1,62 @@
+export type MemoryGraphOutcomeStatus = 'success' | 'failed';
+export interface MemoryGraphOutcomeRecord {
+    version: 2;
+    kind: 'outcome';
+    provenance: 'v2_local' | 'v1_import';
+    workspaceScope: string;
+    userScope: string;
+    signalFingerprint: string;
+    signals: readonly string[];
+    geneId: string;
+    status: MemoryGraphOutcomeStatus;
+    score: number;
+    at: string;
+    /** Stable local-source identity used to make one-time imports crash-retry safe. */
+    sourceFingerprint?: string;
+    successCount?: number;
+    failCount?: number;
+}
+export interface MemoryGraphGeneEvidence {
+    geneId: string;
+    boost: number;
+    expectedSuccess: number;
+    successCount: number;
+    failCount: number;
+    attempts: number;
+    similarity: number;
+    lastAt: string;
+}
+export interface MemoryGraphDiagnostics {
+    bytesRead: number;
+    recordsRead: number;
+    corruptLines: number;
+    oversizedLines: number;
+    scopeRejected: number;
+    provenanceRejected: number;
+    truncated: boolean;
+    recovery: 'healthy' | 'degraded' | 'recovered' | 'empty';
+    /** The graph was healthy enough to address, but another process held its maintenance lock. */
+    busy?: boolean;
+}
+export interface MemoryGraphAdvice {
+    genes: readonly MemoryGraphGeneEvidence[];
+    diagnostics: MemoryGraphDiagnostics;
+}
+export interface MemoryGraphQueryInput {
+    workspace: string;
+    signals: readonly string[];
+}
+export interface MemoryGraphRecordInput extends MemoryGraphQueryInput {
+    geneId: string;
+    status: MemoryGraphOutcomeStatus;
+    score: number;
+    at: string;
+}
+export interface MemoryGraphProvider {
+    query(input: MemoryGraphQueryInput): Promise<MemoryGraphAdvice> | MemoryGraphAdvice;
+    recordOutcome(input: MemoryGraphRecordInput): Promise<void> | void;
+}
+export declare function normalizeMemorySignals(signals: readonly string[]): string[];
+export declare function memorySignalFingerprint(signals: readonly string[]): string;
+export declare function safeMemoryGeneId(value: string): string;
+export declare function deriveMemoryGraphAdvice(records: readonly MemoryGraphOutcomeRecord[], signals: readonly string[], nowMs: number, diagnostics: MemoryGraphDiagnostics): MemoryGraphAdvice;

package/dist/algo/memoryGraph.js

@@ -0,0 +1,86 @@
+const MAX_SIGNALS = 32;
+const MAX_SIGNAL_CHARS = 120;
+const MAX_GENE_CHARS = 240;
+const MIN_SIMILARITY = 0.34;
+const HALF_LIFE_DAYS = 30;
+export function normalizeMemorySignals(signals) {
+    return [...new Set(signals
+            .filter((signal) => typeof signal === 'string')
+            .map((signal) => signal.trim().toLowerCase().slice(0, MAX_SIGNAL_CHARS))
+            .filter(Boolean))]
+        .sort()
+        .slice(0, MAX_SIGNALS);
+}
+export function memorySignalFingerprint(signals) {
+    return normalizeMemorySignals(signals).join('|') || '(none)';
+}
+export function safeMemoryGeneId(value) {
+    return value.trim().slice(0, MAX_GENE_CHARS);
+}
+export function deriveMemoryGraphAdvice(records, signals, nowMs, diagnostics) {
+    const currentSignals = normalizeMemorySignals(signals);
+    const aggregates = new Map();
+    for (const record of records) {
+        const similarity = jaccard(currentSignals, record.signals);
+        if (similarity < MIN_SIMILARITY)
+            continue;
+        const successCount = boundedCount(record.successCount ?? (record.status === 'success' ? 1 : 0));
+        const failCount = boundedCount(record.failCount ?? (record.status === 'failed' ? 1 : 0));
+        const total = successCount + failCount;
+        if (total === 0)
+            continue;
+        const decay = decayWeight(record.at, nowMs);
+        const weight = similarity * decay;
+        const current = aggregates.get(record.geneId) ?? { success: 0, fail: 0, weightedSimilarity: 0, weight: 0, lastAt: record.at };
+        current.success += successCount * weight;
+        current.fail += failCount * weight;
+        current.weightedSimilarity += similarity * total;
+        current.weight += total;
+        if (Date.parse(record.at) > Date.parse(current.lastAt))
+            current.lastAt = record.at;
+        aggregates.set(record.geneId, current);
+    }
+    const genes = [];
+    for (const [geneId, aggregate] of aggregates) {
+        const successCount = Math.round(aggregate.success);
+        const failCount = Math.round(aggregate.fail);
+        const attempts = successCount + failCount;
+        if (attempts === 0)
+            continue;
+        const expectedSuccess = (aggregate.success + 1) / (aggregate.success + aggregate.fail + 2);
+        const similarity = aggregate.weight > 0 ? Math.min(1, aggregate.weightedSimilarity / aggregate.weight) : 0;
+        const confidence = Math.min(1, Math.log2(attempts + 1) / 3);
+        const boost = clamp((expectedSuccess - 0.5) * 2 * similarity * confidence, -1, 1);
+        genes.push({ geneId, boost, expectedSuccess, successCount, failCount, attempts, similarity, lastAt: aggregate.lastAt });
+    }
+    genes.sort((left, right) => Math.abs(right.boost) - Math.abs(left.boost) || right.attempts - left.attempts || left.geneId.localeCompare(right.geneId));
+    return { genes: genes.slice(0, 64), diagnostics };
+}
+function boundedCount(value) {
+    if (!Number.isFinite(value) || value <= 0)
+        return 0;
+    return Math.min(1_000_000, Math.floor(value));
+}
+function jaccard(left, right) {
+    const a = new Set(normalizeMemorySignals(left));
+    const b = new Set(normalizeMemorySignals(right));
+    if (a.size === 0 && b.size === 0)
+        return 1;
+    if (a.size === 0 || b.size === 0)
+        return 0;
+    let intersection = 0;
+    for (const value of a)
+        if (b.has(value))
+            intersection += 1;
+    return intersection / (a.size + b.size - intersection);
+}
+function decayWeight(at, nowMs) {
+    const timestamp = Date.parse(at);
+    if (!Number.isFinite(timestamp))
+        return 0;
+    const ageDays = Math.max(0, nowMs - timestamp) / 86_400_000;
+    return Math.pow(0.5, ageDays / HALF_LIFE_DAYS);
+}
+function clamp(value, min, max) {
+    return Math.max(min, Math.min(max, value));
+}