@forwardimpact/libharness 1.3.0 → 2.0.0

package/src/benchmark/hidden-tests.js

@@ -0,0 +1,180 @@
+/**
+ * Hidden-test engine — executes a task's `tests/` overlay against the
+ * post-run agent CWD: stage each file at its mirrored path, run each check
+ * with `node --test`, convert the exit status into one check row, and
+ * restore the tree so the judge sees the workdir exactly as the agent left
+ * it.
+ *
+ * Fault attribution is the engine's contract: a stage or spawn failure (the
+ * agent deleted the scaffold) is a *failing row* — agent fault; the engine
+ * itself throwing is grader fault, which the caller records as unhealthy so
+ * a crashed grader can never mint marks.
+ */
+
+import { dirname, join } from "node:path";
+
+import { buildHookEnv } from "./hook-env.js";
+
+// Fixed per-check budget. A wedged test process runs outside the agent
+// watchdog, so this bound is what keeps a hung hidden test from stalling the
+// cell; the timeout row keeps the failure visible.
+const CHECK_TIMEOUT_MS = 120_000;
+const STDERR_TAIL_CHARS = 500;
+
+/**
+ * Run the task's hidden test suite.
+ * @param {import("./task-family.js").Task} task
+ * @param {{cwd: string, port: number, runDir: string, familyDir?: string|null}} ctx
+ * @param {import("@forwardimpact/libutil/runtime").Runtime} runtime
+ * @param {{timeoutMs?: number}} [opts] - Test seam for the per-check timeout.
+ * @returns {Promise<{details: object[]}>}
+ */
+export async function runHiddenTests(task, ctx, runtime, opts = {}) {
+  if (!runtime) throw new Error("runtime is required");
+  if (!task.tests) return { details: [] };
+  const timeoutMs = opts.timeoutMs ?? CHECK_TIMEOUT_MS;
+  const fs = runtime.fs;
+  const details = [];
+  const supportStager = newStager();
+  try {
+    for (const file of task.tests.support) {
+      await stageFile(fs, ctx.cwd, supportStager, file);
+    }
+    for (const check of task.tests.checks) {
+      details.push(await runOneCheck(task, ctx, runtime, timeoutMs, check));
+    }
+  } finally {
+    await unstage(fs, supportStager);
+  }
+  return { details };
+}
+
+/**
+ * Stage one check, run it, and restore its staging — the check's own row is
+ * the only trace it leaves. A stage failure is the agent's fault (a deleted
+ * scaffold), so it becomes a failing row rather than a throw.
+ */
+async function runOneCheck(task, ctx, runtime, timeoutMs, check) {
+  const stager = newStager();
+  try {
+    try {
+      await stageFile(runtime.fs, ctx.cwd, stager, check);
+    } catch (e) {
+      return checkRow(check, false, `stage failed: ${e.message}`);
+    }
+    return await spawnCheck(task, ctx, runtime, timeoutMs, check);
+  } finally {
+    await unstage(runtime.fs, stager);
+  }
+}
+
+/**
+ * Spawn `node --test <staged path>` from the agent CWD under the hook env
+ * and map the exit status onto one row. The clock timer SIGKILLs a child
+ * that outlives the per-check budget; the row fails with a timeout message.
+ */
+async function spawnCheck(task, ctx, runtime, timeoutMs, check) {
+  const env = buildHookEnv(runtime.proc.env, {
+    cwd: ctx.cwd,
+    port: ctx.port,
+    taskId: task.id,
+    taskDir: task.paths.taskDir,
+    hooksDir: task.paths.hooks,
+    familyDir: ctx.familyDir,
+  });
+  // An inherited test-runner context makes the child `node --test` report
+  // exit 0 even when its tests fail — a failing check would mint a passing
+  // row whenever the harness itself runs under `node --test`.
+  delete env.NODE_TEST_CONTEXT;
+  const child = runtime.subprocess.spawn("node", ["--test", check.stagePath], {
+    cwd: ctx.cwd,
+    env,
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  let timedOut = false;
+  const timer = runtime.clock.setTimeout(() => {
+    timedOut = true;
+    child.kill("SIGKILL");
+  }, timeoutMs);
+  const drainStdout = (async () => {
+    for await (const _chunk of child.stdout) {
+      // discard
+    }
+  })();
+  let stderr = "";
+  for await (const chunk of child.stderr) stderr += chunk.toString();
+  await drainStdout;
+  const exit = await child.exitCode;
+  runtime.clock.clearTimeout(timer);
+
+  if (timedOut) {
+    return checkRow(check, false, `timed out after ${timeoutMs}ms`);
+  }
+  if (exit === 0) return checkRow(check, true);
+  const tail = stderr.trim().slice(-STDERR_TAIL_CHARS);
+  return checkRow(check, false, `exit ${exit}${tail ? `: ${tail}` : ""}`);
+}
+
+function checkRow(check, pass, message) {
+  return {
+    test: check.name,
+    pass,
+    ...(check.gate && { gate: true }),
+    ...(message && { message }),
+  };
+}
+
+function newStager() {
+  return { staged: [], backups: [], createdDirs: [] };
+}
+
+/**
+ * Copy the symlink-resolved source to its mirrored path under the agent CWD,
+ * backing up a collided file's bytes and tracking every directory created so
+ * `unstage` can put the tree back exactly.
+ */
+async function stageFile(fs, cwd, stager, { sourcePath, stagePath }) {
+  const target = join(cwd, stagePath);
+  let collided = null;
+  try {
+    collided = await fs.readFile(target);
+  } catch {
+    // no collision
+  }
+  if (collided !== null) stager.backups.push({ target, bytes: collided });
+  await ensureParents(fs, cwd, stager, dirname(target));
+  const resolved = await fs.realpath(sourcePath);
+  await fs.copyFile(resolved, target);
+  stager.staged.push(target);
+}
+
+async function ensureParents(fs, cwd, stager, dir) {
+  if (dir === cwd) return;
+  try {
+    await fs.access(dir);
+    return;
+  } catch {
+    // missing — create below
+  }
+  await ensureParents(fs, cwd, stager, dirname(dir));
+  await fs.mkdir(dir);
+  stager.createdDirs.push(dir);
+}
+
+/**
+ * Reverse the staging: staged copies out, collided bytes back, created
+ * directories removed (deepest first — a check's own artifacts inside a
+ * created directory go with it, since that directory did not exist when the
+ * agent finished).
+ */
+async function unstage(fs, stager) {
+  for (const target of stager.staged) {
+    await fs.rm(target, { force: true });
+  }
+  for (const backup of stager.backups) {
+    await fs.writeFile(backup.target, backup.bytes);
+  }
+  for (const dir of [...stager.createdDirs].reverse()) {
+    await fs.rm(dir, { recursive: true, force: true });
+  }
+}

package/src/benchmark/invariants.js

@@ -1,7 +1,10 @@
 /**
  * Invariants — runs `<task.paths.hooks>/invariants.sh` from the template path
- * against the post-run agent CWD. The exit code is authoritative for the
- * verdict; structured per-check rows arrive on fd 3 (`$RESULTS_FD=3`) as NDJSON.
+ * against the post-run agent CWD. A pure collector with no verdict of its
+ * own: structured per-check rows arrive on fd 3 (`$RESULTS_FD=3`) as NDJSON
+ * and grading happens downstream over the merged rows. The exit code is
+ * script health only — nonzero means the grader itself failed, never that a
+ * check failed.
  *
  * Subprocess access flows through `runtime.subprocess.spawn`; the fd-3 backing
  * store and the stderr log use the sync filesystem surface (`runtime.fsSync`) —
@@ -14,9 +17,9 @@ import { buildHookEnv } from "./hook-env.js";
 
 /**
  * @typedef {object} InvariantsResult
- * @property {"pass" | "fail"} verdict
  * @property {Array<object>} details
- * @property {number} exitCode
+ * @property {number} exitCode - Script health: nonzero means the hook itself
+ *   failed, never that a check failed.
  * @property {string} [stderr] - Trimmed script stderr, present only when the
  *   script wrote to stderr. Surfaces hook failures (e.g. a missing tool) that
  *   leave `details` empty, so they read distinctly from a real invariant miss.
@@ -32,7 +35,7 @@ import { buildHookEnv } from "./hook-env.js";
 export async function runInvariants(task, ctx, runtime) {
   if (!runtime) throw new Error("runtime is required");
   if (!task.paths.invariants) {
-    return { verdict: "pass", details: [], exitCode: 0 };
+    return { details: [], exitCode: 0 };
   }
   const fsSync = runtime.fsSync;
   const script = task.paths.invariants;
@@ -84,11 +87,7 @@ export async function runInvariants(task, ctx, runtime) {
   const details = [];
   parseFd3Buffer(raw, details);
   const exitCode = typeof code === "number" ? code : -1;
-  const result = {
-    verdict: exitCode === 0 ? "pass" : "fail",
-    details,
-    exitCode,
-  };
+  const result = { details, exitCode };
   const trimmedStderr = stderr.trim();
   if (trimmedStderr) result.stderr = trimmedStderr;
   return result;

package/src/benchmark/judge.js

@@ -9,7 +9,7 @@
  *   {{AGENT_INSTRUCTIONS}}  — contents of agent.task.md
  *   {{AGENT_PROFILE}}       — agent profile body (empty string if none)
  *   {{AGENT_TRACE_PATH}}    — path to agent.ndjson
- *   {{INVARIANTS_RESULT}}   — JSON invariants object
+ *   {{GRADE_RESULT}}        — JSON grade object plus the merged check rows
  *   {{SKILL_SET_HASH}}      — SHA-256 from apm.lock.yaml
  *   {{TASK_ID}}             — task name (directory under tasks/)
  *   {{TASK_DIR}}            — agent working directory path
@@ -40,22 +40,25 @@ import { sumTraceCost } from "../cost.js";
  */
 
 /**
- * Run the judge over a completed task run.
+ * Run the judge over a completed task run. The judge is a binary gate over
+ * the grade's validity, never a grade itself: `gradeResult` reaches the
+ * template as evidence, and the verdict stays pass/fail.
  * @param {import("./task-family.js").Task} task
  * @param {import("./workdir.js").Workdir} workdir
- * @param {import("./invariants.js").InvariantsResult} invariants
+ * @param {{verdict: string, gatesPass: boolean, score?: number, malformed?: number, rows: unknown[]}} gradeResult -
+ *   The normalized grade plus the merged, source-stamped check rows.
  * @param {{query: Function, model: string, judgeProfile?: string, profilesDir?: string, runtime: import("@forwardimpact/libutil/runtime").Runtime}} deps
  * @param {JudgeContext} [context]
  * @returns {Promise<JudgeVerdict>}
  */
-export async function runJudge(task, workdir, invariants, deps, context) {
+export async function runJudge(task, workdir, gradeResult, deps, context) {
   const runtime = deps.runtime;
   if (!runtime) throw new Error("runtime is required");
   const fs = runtime.fs;
   const template = await fs.readFile(task.paths.judge, "utf8");
-  const invariantsJson = JSON.stringify(invariants, null, 2);
+  const gradeJson = JSON.stringify(gradeResult, null, 2);
   const taskText = template
-    .replaceAll("{{INVARIANTS_RESULT}}", invariantsJson)
+    .replaceAll("{{GRADE_RESULT}}", gradeJson)
     .replaceAll("{{AGENT_TRACE_PATH}}", workdir.agentTracePath)
     .replaceAll("{{AGENT_INSTRUCTIONS}}", context?.agentInstructions ?? "")
     .replaceAll("{{AGENT_PROFILE}}", context?.agentProfile ?? "")

package/src/benchmark/report.js

@@ -15,12 +15,16 @@
 import { join } from "node:path";
 
 import { validateResultRecord } from "./result.js";
+import { mergeRows } from "./grade.js";
 
 /**
  * @typedef {object} RunDetail
  * @property {number} runIndex
  * @property {"pass"|"fail"} verdict
- * @property {{verdict: string, details: unknown[], exitCode: number}} [invariants]
+ * @property {{details: unknown[], exitCode: number}} [invariants]
+ * @property {{verdict: string, gatesPass: boolean, score?: number, malformed?: number}} [grade]
+ * @property {{details: unknown[], error?: string}} [hiddenTests]
+ * @property {number} [score] - Effective judge-zeroed score (scored tasks).
  * @property {{verdict: string, summary: string}} [judgeVerdict]
  * @property {number} costUsd
  * @property {number} turns
@@ -66,6 +70,7 @@ export async function aggregate({
     for (const k of kValues) passAtK[k] = passAtKValue(n, c, k);
 
     const task = { taskId, n, c, passAtK };
+    applyScoreFields(task, group, kValues);
 
     if (includeRuns) {
       if (!firstRecord) firstRecord = group[0];
@@ -102,6 +107,25 @@ export async function aggregate({
   return { tasks, totals };
 }
 
+/**
+ * Attach `meanScore` and `scoreAtK` to a scored task group. A group is
+ * scored iff any record carries an effective score; a score-less record in
+ * a scored group (a preflight failure never reached grading, or a binary
+ * run) contributes its verdict as the degenerate score — skipping it would
+ * inflate the mean exactly when the agent fails hardest. Binary groups gain
+ * neither field.
+ * @param {object} task - Mutated.
+ * @param {object[]} group
+ * @param {number[]} kValues
+ */
+function applyScoreFields(task, group, kValues) {
+  if (!group.some((r) => r.score !== undefined)) return;
+  const scores = group.map((r) => r.score ?? (r.verdict === "pass" ? 1 : 0));
+  task.meanScore = scores.reduce((a, b) => a + b, 0) / scores.length;
+  task.scoreAtK = {};
+  for (const k of kValues) task.scoreAtK[k] = scoreAtKValue(scores, k);
+}
+
 /**
  * Build a normalized per-run detail object and accumulate duration/turn
  * samples for median calculation. Extracted from `aggregate` to keep its
@@ -117,6 +141,9 @@ function buildRunDetail(r, acc) {
     runIndex: r.runIndex,
     verdict: r.verdict,
     ...(r.invariants && { invariants: r.invariants }),
+    ...(r.grade && { grade: r.grade }),
+    ...(r.hiddenTests && { hiddenTests: r.hiddenTests }),
+    ...(r.score !== undefined && { score: r.score }),
     ...(r.judgeVerdict && { judgeVerdict: r.judgeVerdict }),
     costUsd: r.costUsd ?? 0,
     turns: r.turns ?? 0,
@@ -143,12 +170,20 @@ export function renderTextReport(report, kValues) {
 }
 
 // ---------------------------------------------------------------------------
-// Compact report (legacy path)
+// Compact report — status line + pass@k table, no per-task detail. Selected by
+// `report --detail=compact` (aggregate without `includeRuns`); the per-shard
+// summary uses it so a sharded run stays short while the merge job renders the
+// full report over the combined ledger.
 // ---------------------------------------------------------------------------
 
 function renderCompactReport(report, kValues) {
+  const { totals } = report;
+  const passing = report.tasks.filter((t) => t.c > 0 && t.c === t.n).length;
+  const icon = statusIcon(passing === totals.tasks);
   const lines = [
-    renderPassAtKTable(report, kValues),
+    `${icon} **${passing}/${totals.tasks} tasks passing** | ${totals.runs} runs${totals.skipped ? ` | ${totals.skipped} skipped` : ""}`,
+    "",
+    renderPassAtKTable(report, kValues, hasScoredTask(report)),
     "",
     renderTotalsLine(report),
   ];
@@ -159,12 +194,18 @@ function renderCompactReport(report, kValues) {
 // Full report
 // ---------------------------------------------------------------------------
 
+/** Score columns render only when the report has at least one scored task. */
+function hasScoredTask(report) {
+  return report.tasks.some((t) => t.meanScore !== undefined);
+}
+
 function renderFullReport(report, kValues) {
+  const scored = hasScoredTask(report);
   const sections = [
     renderSummary(report),
     "## Pass@k",
     "",
-    renderPassAtKTable(report, kValues),
+    renderPassAtKTable(report, kValues, scored),
     "",
     renderTotalsLine(report),
     "",
@@ -173,7 +214,7 @@ function renderFullReport(report, kValues) {
 
   for (const task of report.tasks) {
     sections.push("");
-    sections.push(renderTaskDetail(task));
+    sections.push(renderTaskDetail(task, scored));
   }
 
   return sections.join("\n");
@@ -231,16 +272,27 @@ function renderSummary(report) {
 // Pass@k table (shared between compact and full)
 // ---------------------------------------------------------------------------
 
-function renderPassAtKTable(report, kValues) {
+function renderPassAtKTable(report, kValues, scored) {
   const header = ["taskId", "n", "c", ...kValues.map((k) => `pass@${k}`)];
+  if (scored) {
+    header.push("score", ...kValues.map((k) => `score@${k}`));
+  }
   const rows = [header, header.map(() => "---")];
   for (const t of report.tasks) {
-    rows.push([
+    const row = [
       t.taskId,
       String(t.n),
       String(t.c),
       ...kValues.map((k) => formatPassAt(t.passAtK[k])),
-    ]);
+    ];
+    if (scored) {
+      // Binary tasks render "—" in every score column.
+      row.push(
+        formatPassAt(t.meanScore ?? null),
+        ...kValues.map((k) => formatPassAt(t.scoreAtK?.[k] ?? null)),
+      );
+    }
+    rows.push(row);
   }
   return rows.map((r) => `| ${r.join(" | ")} |`).join("\n");
 }
@@ -253,7 +305,7 @@ function renderTotalsLine(report) {
 // Per-task detail
 // ---------------------------------------------------------------------------
 
-function renderTaskDetail(task) {
+function renderTaskDetail(task, scored) {
   const runs = task.runs ?? [];
   const icon = statusIcon(task.c === task.n);
   const singleRun = runs.length === 1;
@@ -264,9 +316,9 @@ function renderTaskDetail(task) {
     `${icon} **${task.c}/${task.n} runs passed**`,
   ];
 
-  lines.push("", renderRunsTable(runs));
+  lines.push("", renderRunsTable(runs, scored));
 
-  const checks = renderInvariantChecks(runs, singleRun);
+  const checks = renderChecks(runs, singleRun);
   if (checks) lines.push("", checks);
 
   const commentary = renderJudgeCommentary(runs, singleRun);
@@ -278,33 +330,32 @@ function renderTaskDetail(task) {
   return lines.join("\n");
 }
 
-function renderRunsTable(runs) {
+function renderRunsTable(runs, scored) {
   const header = [
     "Run",
     "Verdict",
-    "Invariants",
+    "Checks",
     "Judge",
+    ...(scored ? ["Score"] : []),
     "Cost",
     "Turns",
     "Duration",
   ];
   const rows = [header, header.map(() => "---")];
   for (const r of runs) {
-    const invariantsCell = r.preflightError
-      ? "preflight error"
-      : r.invariants
-        ? statusIcon(r.invariants.verdict === "pass")
-        : "—";
-    const judgeCell = r.preflightError
-      ? "—"
-      : r.judgeVerdict
-        ? statusIcon(r.judgeVerdict.verdict === "pass")
-        : "—";
+    // A preflight-failure record is the one grade-less branch in the schema.
+    const checksCell = r.grade ? statusIcon(r.grade.verdict === "pass") : "—";
+    const judgeCell = r.judgeVerdict
+      ? statusIcon(r.judgeVerdict.verdict === "pass")
+      : "—";
     rows.push([
       String(r.runIndex),
       statusIcon(r.verdict === "pass"),
-      invariantsCell,
+      checksCell,
       judgeCell,
+      ...(scored
+        ? [r.score !== undefined ? Number(r.score).toFixed(4) : "—"]
+        : []),
       formatCost(r.costUsd),
       String(r.turns),
       formatDuration(r.durationMs),
@@ -313,42 +364,45 @@ function renderRunsTable(runs) {
   return rows.map((r) => `| ${r.join(" | ")} |`).join("\n");
 }
 
-function renderInvariantChecks(runs, singleRun) {
-  const rows = collectInvariantRows(runs);
+function renderChecks(runs, singleRun) {
+  const { rows, hasHidden } = collectCheckRows(runs);
   if (!rows.length) return null;
 
-  const header = singleRun
-    ? ["Check", "Result", "Message"]
-    : ["Run", "Check", "Result", "Message"];
+  const header = singleRun ? ["Check"] : ["Run", "Check"];
+  if (hasHidden) header.push("Source");
+  header.push("Result", "Message");
   const lines = [
-    "#### Invariant Checks",
+    "#### Checks",
     "",
     `| ${header.join(" | ")} |`,
     `| ${header.map(() => "---").join(" | ")} |`,
   ];
   for (const row of rows) {
-    const cells = singleRun
-      ? [row.check, row.result, row.message]
-      : [String(row.run), row.check, row.result, row.message];
+    const cells = singleRun ? [row.check] : [String(row.run), row.check];
+    if (hasHidden) cells.push(row.source);
+    cells.push(row.result, row.message);
     lines.push(`| ${cells.join(" | ")} |`);
   }
   return lines.join("\n");
 }
 
-function collectInvariantRows(runs) {
-  const rows = [];
-  for (const r of runs) {
-    if (!r.invariants?.details?.length) continue;
-    for (const d of r.invariants.details) {
-      rows.push({
+/**
+ * Merge both producers' check rows per run. The Source column appears only
+ * when at least one row came from a hidden test suite.
+ */
+function collectCheckRows(runs) {
+  const rows = runs.flatMap((r) =>
+    mergeRows(r.invariants?.details ?? [], r.hiddenTests?.details ?? [])
+      .filter((d) => d !== null && typeof d === "object")
+      .map((d) => ({
         run: r.runIndex,
         check: escapeCell(String(d.test ?? "(unnamed)")),
+        source: d.source ?? "",
         result: statusIcon(d.pass),
         message: escapeCell(String(d.message ?? "")),
-      });
-    }
-  }
-  return rows;
+      })),
+  );
+  return { rows, hasHidden: rows.some((row) => row.source === "tests") };
 }
 
 function renderJudgeCommentary(runs, singleRun) {
@@ -370,23 +424,36 @@ function renderJudgeCommentary(runs, singleRun) {
 }
 
 function renderErrors(runs) {
-  const lines = [];
-  for (const r of runs) {
-    if (r.agentError) {
-      lines.push(
-        `- **Run ${r.runIndex}:** Agent error — "${escapeCell(r.agentError.message)}" (aborted: ${r.agentError.aborted})`,
-      );
-    }
-    if (r.preflightError) {
-      lines.push(
-        `- **Run ${r.runIndex}:** Preflight error — "${escapeCell(r.preflightError.message)}" (exit ${r.preflightError.exitCode})`,
-      );
-    }
-  }
+  const lines = runs.flatMap(runErrorLines);
   if (!lines.length) return null;
   return ["#### Errors", "", ...lines].join("\n");
 }
 
+function runErrorLines(r) {
+  const lines = [];
+  if (r.grade?.malformed) {
+    lines.push(
+      `- **Run ${r.runIndex}:** ⚠️ ${r.grade.malformed} malformed check row(s) — counted as failing`,
+    );
+  }
+  if (r.hiddenTests?.error) {
+    lines.push(
+      `- **Run ${r.runIndex}:** Hidden-test engine error — "${escapeCell(r.hiddenTests.error)}"`,
+    );
+  }
+  if (r.agentError) {
+    lines.push(
+      `- **Run ${r.runIndex}:** Agent error — "${escapeCell(r.agentError.message)}" (aborted: ${r.agentError.aborted})`,
+    );
+  }
+  if (r.preflightError) {
+    lines.push(
+      `- **Run ${r.runIndex}:** Preflight error — "${escapeCell(r.preflightError.message)}" (exit ${r.preflightError.exitCode})`,
+    );
+  }
+  return lines;
+}
+
 // ---------------------------------------------------------------------------
 // Formatting helpers
 // ---------------------------------------------------------------------------
@@ -591,6 +658,33 @@ function passAtKValue(n, c, k) {
   return Number(passing) / Number(total);
 }
 
+/**
+ * score@k — the expected **maximum** score over k runs drawn without
+ * replacement from the n recorded scores; the continuous analog of pass@k.
+ * With scores sorted ascending s₍₁₎…s₍ₙ₎:
+ *
+ *   score@k = Σ_{i=k..n} s₍ᵢ₎ · C(i−1, k−1) / C(n, k)
+ *
+ * Each term weights s₍ᵢ₎ by the probability it is the k-subset's maximum.
+ * Binary scores reduce exactly to the pass@k estimator (same BigInt binomial
+ * helper); `k > n` yields the same `{error}` value — one idiom.
+ * @param {number[]} scores - Effective per-record scores.
+ * @param {number} k
+ * @returns {number | {error: string}}
+ */
+function scoreAtKValue(scores, k) {
+  const n = scores.length;
+  if (k > n) return { error: "k > n" };
+  const sorted = [...scores].sort((a, b) => a - b);
+  const total = Number(binomial(BigInt(n), BigInt(k)));
+  let sum = 0;
+  for (let i = k; i <= n; i++) {
+    const weight = Number(binomial(BigInt(i - 1), BigInt(k - 1))) / total;
+    sum += sorted[i - 1] * weight;
+  }
+  return sum;
+}
+
 function binomial(n, k) {
   if (k < 0n || k > n) return 0n;
   if (k === 0n || k === n) return 1n;