@holdyourvoice/hyv 3.6.1 → 4.0.1

package/dist/stage1-evaluation.test.js

@@ -1,184 +0,0 @@
-import assert from 'node:assert/strict';
-import { createHash } from 'node:crypto';
-import test from 'node:test';
-import { EvaluationContractError, commitProtocol, freezeBlind, recordCheckpointDisposition, recordRating, reduceEvaluation, sealRatings, sha256Canonical, validateRuns, } from './stage1-evaluation.js';
-const hex = (character) => character.repeat(64);
-function protocol(mode = 'development-calibration') {
-    const providerDisclosureDigest = hex('f');
-    const reviewerDisclosureDigest = hex('8');
-    const derivedRetentionDigest = hex('9');
-    const caseIdentity = { caseId: 'case-1', caseDigest: hex('3'), provenanceDigest: hex('6'), providerDisclosureDigest, reviewerDisclosureDigest, derivedRetentionDigest };
-    const nonce = 'AAAAAAAAAAAAAAAAAAAAAA';
-    return {
-        kind: 'hyv-stage1-preregistration', version: '1', mode,
-        baseline: { packageVersion: '3.2.0', sourceCommit: '4e6269121d551c008a34db73077e1e4fea41b3f9' },
-        stage1: { sourceCommit: '550ea24f652291dca13757fdbd2f0fa0b5e3f621' },
-        benchmark: { manifestDigest: hex('1'), partitionDigest: hex('2'), partition: mode === 'locked-human' ? 'locked-test' : 'calibration', synthetic: mode !== 'locked-human' },
-        cases: [{ ...caseIdentity, rightsDigest: sha256Canonical(caseIdentity) }],
-        intentToTreat: { expectedAssignments: 2, expectedReviewers: 1 },
-        execution: { provider: 'provider-neutral', model: 'pinned-model', modelRevision: 'immutable-revision-1', settingsDigest: hex('a'), taskContractDigest: hex('b'), rulesetDigest: hex('c'), rubricDigest: hex('d') },
-        randomization: { algorithm: 'sha256-counter-v1', commitment: sha256Canonical({ algorithm: 'sha256-counter-v1', nonce, labels: { A: 'stage1', B: 'baseline' } }) },
-        reviewerRosterDigest: hex('5'),
-        analysis: { statistic: 'paired-preference-rate', decisionRule: 'preference-or-correction-with-workflow-non-regression', margin: 0.05, minimumCases: 1, minimumRatings: 1, missingRatingPolicy: 'count-as-non-preference', tiePolicy: 'count-as-half', retryPolicy: 'no-retry', routingPolicy: 'precommitted-blind-routing' },
-        rights: { providerDisclosureDigest, reviewerDisclosureDigest, derivedRetentionDigest },
-        releaseAuditContractDigest: hex('7'),
-        registeredAt: '2026-08-13T00:00:00Z',
-        measures: ['writer_preference', 'correction_versus_confirm', 'workflow_completion', 'workflow_abandonment'],
-        gates: ['semantic', 'copy_spec', 'hygiene', 'preservation', 'cli_mcp_parity', 'backward_compatibility'],
-    };
-}
-function rating(state, evidenceClass = 'synthetic-dry-run', previous = []) {
-    const reviewerId = 'reviewer-1';
-    const identityKey = sha256Canonical({ reviewerId });
-    const core = {
-        kind: 'hyv-stage1-reviewer-record', version: '1', evidenceClass,
-        protocolDigest: state.committed.protocolDigest, candidateDigest: state.candidateDigest, packetDigest: state.packet.packetDigest,
-        reviewerId, identityKey, recordId: sha256Canonical({ protocolDigest: state.committed.protocolDigest, packetDigest: state.packet.packetDigest, identityKey, caseId: 'case-1' }),
-        sequence: previous.length + 1, previousRecordDigest: previous.length ? previous.at(-1).recordDigest : null,
-        caseId: 'case-1', preferredLabel: 'A', correctionVersusConfirm: { A: 'confirm', B: 'correction' }, workflow: 'completed',
-    };
-    return { ...core, recordDigest: sha256Canonical(core), attestation: null };
-}
-function setup(mode = 'development-calibration') {
-    const committed = commitProtocol(protocol(mode));
-    const candidateDigest = sha256Canonical({ baseline: committed.baseline, stage1: committed.stage1 });
-    const runs = ['baseline', 'stage1'].map((arm, ordinal) => ({
-        kind: 'hyv-stage1-run-record', version: '1', evidenceClass: mode === 'locked-human' ? 'human' : 'synthetic-dry-run',
-        protocolDigest: committed.protocolDigest, candidateDigest, assignmentId: `assignment-${arm}`,
-        participantId: 'participant-1', caseId: 'case-1', caseDigest: hex('3'), rightsDigest: committed.cases[0].rightsDigest, arm,
-        ordinal: ordinal + 1, latencyMs: 10, inputTokens: 5, outputTokens: 5, costMicrousd: 1,
-        occurredAt: `2026-08-13T00:00:0${ordinal}Z`,
-        outcome: 'completed', outputDigest: createHash('sha256').update(arm === 'baseline' ? 'candidate B text' : 'candidate A text').digest('hex'),
-        hardGates: { semantic: true, copySpec: true, hygiene: true, preservation: true, cliMcpParity: true, backwardCompatibility: true },
-    }));
-    const mapping = { kind: 'hyv-stage1-blind-mapping', version: '1', nonce: 'AAAAAAAAAAAAAAAAAAAAAA', labels: { A: 'stage1', B: 'baseline' }, custodianId: 'dry-run-custodian', unblindingAccess: ['dry-run-custodian'], attestation: null };
-    const frozen = freezeBlind(committed, runs, mapping, [{ caseId: 'case-1', A: 'candidate A text', B: 'candidate B text' }]);
-    return { committed, candidateDigest, runs, mapping, ...frozen };
-}
-test('canonical preregistration digest is stable and identities are immutable', () => {
-    assert.equal(sha256Canonical({ b: 2, a: 1 }), sha256Canonical({ a: 1, b: 2 }));
-    const committed = commitProtocol(protocol());
-    assert.match(committed.protocolDigest, /^[a-f0-9]{64}$/);
-    assert.throws(() => commitProtocol({ ...protocol(), stage1: { sourceCommit: hex('a') } }), (error) => error instanceof EvaluationContractError && error.code === 'stage1_identity_mismatch');
-    assert.throws(() => commitProtocol({ ...protocol(), extra: true }), (error) => error instanceof EvaluationContractError && error.code === 'unexpected_field');
-    assert.throws(() => commitProtocol({ ...protocol('locked-human'), benchmark: { ...protocol('locked-human').benchmark, partition: 'calibration' } }), (error) => error instanceof EvaluationContractError && error.code === 'benchmark_partition_mismatch');
-});
-test('run validation binds every digest and reconciles the intent-to-treat denominator', () => {
-    const state = setup();
-    assert.equal(validateRuns(state.committed, state.runs).denominator, 2);
-    assert.throws(() => validateRuns(state.committed, state.runs.slice(1)), (error) => error instanceof EvaluationContractError && error.code === 'itt_denominator_mismatch');
-    assert.throws(() => validateRuns(state.committed, [{ ...state.runs[0], rightsDigest: hex('9') }, state.runs[1]]), (error) => error instanceof EvaluationContractError && error.code === 'rights_digest_mismatch');
-    const { outputDigest: _outputDigest, hardGates: _hardGates, ...failed } = state.runs[0];
-    assert.equal(validateRuns(state.committed, [{ ...failed, outcome: 'timeout' }, state.runs[1]]).timeouts, 1);
-});
-test('preregistration and paired assignments reject the reviewed integrity attacks', () => {
-    const base = protocol();
-    assert.throws(() => commitProtocol({ ...base, registeredAt: '1' }), (error) => error instanceof EvaluationContractError && error.code === 'registered_at_invalid');
-    assert.throws(() => commitProtocol({ ...base, registeredAt: '2026-02-31T00:00:00Z' }), (error) => error instanceof EvaluationContractError && error.code === 'registered_at_invalid');
-    assert.throws(() => commitProtocol({ ...base, cases: [{ ...base.cases[0], rightsDigest: hex('4') }] }), (error) => error instanceof EvaluationContractError && error.code === 'case_rights_digest_mismatch');
-    const state = setup();
-    assert.throws(() => validateRuns(state.committed, [state.runs[0], { ...state.runs[1], ordinal: 1 }]), (error) => error instanceof EvaluationContractError && error.code === 'ordinal_sequence_invalid');
-    assert.throws(() => validateRuns(state.committed, [state.runs[0], { ...state.runs[1], participantId: 'participant-2' }]), (error) => error instanceof EvaluationContractError && error.code === 'paired_participant_mismatch');
-    assert.throws(() => freezeBlind(state.committed, state.runs, { ...state.mapping, nonce: 'short' }, [{ caseId: 'case-1', A: 'candidate A text', B: 'candidate B text' }]), (error) => error instanceof EvaluationContractError && error.code === 'randomization_nonce_invalid');
-    assert.throws(() => freezeBlind(state.committed, state.runs, { ...state.mapping, unblindingAccess: [] }, [{ caseId: 'case-1', A: 'candidate A text', B: 'candidate B text' }]), (error) => error instanceof EvaluationContractError && error.code === 'unblinding_access_invalid');
-});
-test('blind packet rejects label leaks and mapping swaps', () => {
-    const state = setup();
-    const { attestation: _attestation, ...mappingCore } = state.mapping;
-    assert.equal(state.packet.mappingDigest, sha256Canonical(mappingCore));
-    assert.throws(() => freezeBlind(state.committed, state.runs, state.mapping, [{ caseId: 'case-1', A: 'stage1 output', B: 'safe' }]), (error) => error instanceof EvaluationContractError && error.code === 'blind_label_leak');
-    assert.throws(() => sealRatings(state.packet, { ...state.mapping, labels: { A: 'baseline', B: 'stage1' } }, []), (error) => error instanceof EvaluationContractError && error.code === 'mapping_digest_mismatch');
-});
-test('reviewer log is append-only and rejects duplicate or conflicting ratings', () => {
-    const state = setup();
-    const record = rating(state);
-    const records = recordRating(state.packet, [], record);
-    assert.equal(records.length, 1);
-    assert.throws(() => recordRating(state.packet, records, record), (error) => error instanceof EvaluationContractError && error.code === 'reviewer_chain_invalid' || error instanceof EvaluationContractError && error.code === 'duplicate_reviewer_record');
-    const changedCore = { ...record, preferredLabel: 'B', sequence: 2, previousRecordDigest: record.recordDigest, recordDigest: undefined, attestation: undefined };
-    delete changedCore.recordDigest;
-    delete changedCore.attestation;
-    assert.throws(() => recordRating(state.packet, records, { ...changedCore, recordDigest: sha256Canonical(changedCore), attestation: null }), (error) => error instanceof EvaluationContractError && error.code === 'conflicting_reviewer_record');
-});
-test('development/calibration reduction is always blocked and non-promotable', () => {
-    const state = setup();
-    const records = recordRating(state.packet, [], rating(state));
-    const seal = sealRatings(state.packet, state.mapping, records);
-    const auditCore = { kind: 'hyv-release-audit', version: '1', candidateCommit: state.committed.stage1.sourceCommit, protocolDigest: state.committed.protocolDigest, contractDigest: state.committed.releaseAuditContractDigest, passed: true };
-    const releaseAudit = { ...auditCore, digest: sha256Canonical(auditCore) };
-    const report = reduceEvaluation(state.committed, state.runs, state.packet, state.mapping, records, seal, releaseAudit);
-    assert.equal(report.decision, 'BLOCKED');
-    assert.equal(report.promotable, false);
-    assert.ok(report.blockers.includes('synthetic_fixture_evidence'));
-    assert.ok(report.blockers.includes('locked_human_evidence_required'));
-    assert.ok(report.blockers.includes('human_writer_evidence_deferred'));
-});
-test('locked-human evidence rejects missing external signatures and release-audit drift', () => {
-    const state = setup('locked-human');
-    const unsigned = rating(state, 'human');
-    assert.throws(() => recordRating(state.packet, [], unsigned), (error) => error instanceof EvaluationContractError && error.code === 'human_attestation_required');
-    const signed = { ...unsigned, attestation: { kind: 'external-verification-receipt', version: '1', verified: true, artifactDigest: unsigned.recordDigest, trustStoreDigest: hex('a'), keyId: 'human-key-1', purpose: 'stage1-blind-review', protocolDigest: state.committed.protocolDigest, packetDigest: state.packet.packetDigest, nonce: 'nonce-1', issuedAt: '2026-08-13T00:00:00Z', expiresAt: '2026-08-14T00:00:00Z', verifiedAt: '2026-08-13T00:01:00Z' } };
-    const records = recordRating(state.packet, [], signed);
-    const seal = sealRatings(state.packet, state.mapping, records);
-    assert.throws(() => reduceEvaluation(state.committed, state.runs, state.packet, state.mapping, records, seal, { kind: 'hyv-release-audit', version: '1', candidateCommit: hex('8'), protocolDigest: state.committed.protocolDigest, contractDigest: state.committed.releaseAuditContractDigest, passed: true, digest: hex('7') }), (error) => error instanceof EvaluationContractError && error.code === 'release_audit_digest_mismatch');
-});
-test('forged locked-human JSON cannot pass or proceed while human evidence is deferred', () => {
-    const state = setup();
-    const records = recordRating(state.packet, [], rating(state));
-    const seal = sealRatings(state.packet, state.mapping, records);
-    const auditCore = { kind: 'hyv-release-audit', version: '1', candidateCommit: state.committed.stage1.sourceCommit, protocolDigest: state.committed.protocolDigest, contractDigest: state.committed.releaseAuditContractDigest, passed: true };
-    const report = reduceEvaluation(state.committed, state.runs, state.packet, state.mapping, records, seal, { ...auditCore, digest: sha256Canonical(auditCore) });
-    const fake = { ...report, decision: 'PASS', promotable: true, blockers: [] };
-    const { reportDigest: _old, ...core } = fake;
-    const forged = { ...core, reportDigest: sha256Canonical(core) };
-    assert.throws(() => recordCheckpointDisposition(forged, 'PROCEED_TO_MAR_363', {}), (error) => error instanceof EvaluationContractError && error.code === 'report_must_be_blocked');
-    assert.throws(() => recordCheckpointDisposition(forged, 'STOP', {}), (error) => error instanceof EvaluationContractError && error.code === 'report_must_be_blocked');
-    assert.throws(() => recordCheckpointDisposition(forged, 'REPEAT_PROTOCOL', {}), (error) => error instanceof EvaluationContractError && error.code === 'report_must_be_blocked');
-    const emptyNestedCore = { ...report, intentToTreat: {}, metrics: {}, reportDigest: undefined };
-    delete emptyNestedCore.reportDigest;
-    const emptyNested = { ...emptyNestedCore, reportDigest: sha256Canonical(emptyNestedCore) };
-    assert.throws(() => recordCheckpointDisposition(emptyNested, 'STOP', {}), (error) => error instanceof EvaluationContractError && error.code === 'missing_field');
-});
-test('a failed arm is committed as non-reviewable and remains in the ITT report', () => {
-    const state = setup();
-    const { outputDigest: _output, hardGates: _gates, ...stage1Failure } = state.runs[1];
-    const runs = [state.runs[0], { ...stage1Failure, outcome: 'timeout' }];
-    const { packet } = freezeBlind(state.committed, runs, state.mapping, [], [{ caseId: 'case-1', baselineOutcome: 'completed', stage1Outcome: 'timeout' }]);
-    assert.equal(packet.reviewableCount, 0);
-    assert.equal(packet.nonReviewableCount, 1);
-    const abandonedCore = { ...rating({ ...state, packet }), workflow: 'abandoned', preferredLabel: undefined, correctionVersusConfirm: undefined, recordDigest: undefined, attestation: undefined };
-    delete abandonedCore.preferredLabel;
-    delete abandonedCore.correctionVersusConfirm;
-    delete abandonedCore.recordDigest;
-    delete abandonedCore.attestation;
-    const abandoned = { ...abandonedCore, recordDigest: sha256Canonical(abandonedCore), attestation: null };
-    const ratings = recordRating(packet, [], abandoned);
-    const seal = sealRatings(packet, state.mapping, ratings);
-    const auditCore = { kind: 'hyv-release-audit', version: '1', candidateCommit: state.committed.stage1.sourceCommit, protocolDigest: state.committed.protocolDigest, contractDigest: state.committed.releaseAuditContractDigest, passed: true };
-    const report = reduceEvaluation(state.committed, runs, packet, state.mapping, ratings, seal, { ...auditCore, digest: sha256Canonical(auditCore) });
-    assert.equal(report.decision, 'BLOCKED');
-    assert.equal(report.metrics.preference.denominator, 1);
-    assert.equal(report.metrics.preference.numerator, 0);
-    assert.equal(report.metrics.abandonment.numerator, 1);
-    assert.equal(report.metrics.correctionVersusConfirm.stage1.corrections, 0);
-    assert.equal(report.metrics.correctionVersusConfirm.baseline.corrections, 0);
-    assert.equal(report.metrics.providerRuns.timeouts, 1);
-});
-test('failed hard gates never enter blind review and packet counts reconcile at reduction', () => {
-    const state = setup();
-    const runs = [state.runs[0], { ...state.runs[1], hardGates: { ...state.runs[1].hardGates, semantic: false } }];
-    const { packet } = freezeBlind(state.committed, runs, state.mapping, [], [{ caseId: 'case-1', baselineOutcome: 'completed', stage1Outcome: 'hard-gate-failed' }]);
-    assert.equal(packet.reviewableCount, 0);
-    const abandonedCore = { ...rating({ ...state, packet }), workflow: 'abandoned', preferredLabel: undefined, correctionVersusConfirm: undefined, recordDigest: undefined, attestation: undefined };
-    delete abandonedCore.preferredLabel;
-    delete abandonedCore.correctionVersusConfirm;
-    delete abandonedCore.recordDigest;
-    delete abandonedCore.attestation;
-    const ratings = recordRating(packet, [], { ...abandonedCore, recordDigest: sha256Canonical(abandonedCore), attestation: null });
-    const seal = sealRatings(packet, state.mapping, ratings);
-    const auditCore = { kind: 'hyv-release-audit', version: '1', candidateCommit: state.committed.stage1.sourceCommit, protocolDigest: state.committed.protocolDigest, contractDigest: state.committed.releaseAuditContractDigest, passed: true };
-    const forgedPacketCore = { ...packet, reviewableCount: 1, nonReviewableCount: 0, packetDigest: undefined };
-    delete forgedPacketCore.packetDigest;
-    const forgedPacket = { ...forgedPacketCore, packetDigest: sha256Canonical(forgedPacketCore) };
-    assert.throws(() => reduceEvaluation(state.committed, runs, forgedPacket, state.mapping, ratings, seal, { ...auditCore, digest: sha256Canonical(auditCore) }), (error) => error instanceof EvaluationContractError && error.code === 'blind_packet_count_mismatch');
-});

package/dist/stage1-human-packet.test.js

@@ -1,102 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { existsSync, mkdtempSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, symlinkSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import test from 'node:test';
-import { BASELINE_COMMIT, STAGE1_COMMIT } from './stage1-evaluation.js';
-function gitObjectExists(commit) {
-    try {
-        execFileSync('git', ['cat-file', '-t', commit], { stdio: 'pipe' });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function packetFiles(root) {
-    return readdirSync(root, { withFileTypes: true }).flatMap((entry) => {
-        const path = join(root, entry.name);
-        return entry.isDirectory() ? packetFiles(path) : [path];
-    });
-}
-test('Stage 1 human packet executes outside the repository and remains blocked without ratings', () => {
-    const parent = mkdtempSync(join(tmpdir(), 'hyv-stage1-human-packet-test-'));
-    const outputRoot = join(parent, 'packet');
-    try {
-        const output = JSON.parse(execFileSync(process.execPath, ['scripts/run-stage1-human-packet.mjs', '--out', outputRoot], { encoding: 'utf8' }));
-        assert.equal(output.kind, 'hyv-stage1-operator-kit');
-        assert.equal(output.writerEvidence, false);
-        assert.equal(output.kitEmitted, true);
-        assert.equal(output.decision, 'BLOCKED');
-        assert.equal(output.promotable, false);
-        assert.ok(output.blockers.includes('human_writer_evidence_deferred'));
-        assert.ok(output.blockers.includes('locked_human_evidence_required'));
-        assert.equal(output.blockers.includes('stage1_commit_uncheckoutable'), !gitObjectExists(STAGE1_COMMIT));
-        assert.ok(output.blockers.includes('receipts_unverified'));
-        assert.equal(existsSync(join(outputRoot, 'ratings.ndjson')), false);
-        for (const file of packetFiles(outputRoot)) {
-            assert.doesNotMatch(readFileSync(file, 'utf8'), /"evidenceClass"\s*:\s*"human"/);
-        }
-        const status = JSON.parse(readFileSync(join(outputRoot, 'status.json'), 'utf8'));
-        assert.equal(status.kind, 'hyv-stage1-operator-kit');
-        assert.equal(status.writerEvidence, false);
-        assert.equal(status.decision, output.decision);
-        assert.equal(status.promotable, output.promotable);
-        assert.deepEqual(status.blockers, output.blockers);
-    }
-    finally {
-        rmSync(parent, { recursive: true, force: true });
-    }
-});
-test('Stage 1 human packet reports locked commit checkoutability', () => {
-    const parent = mkdtempSync(join(tmpdir(), 'hyv-stage1-human-identities-test-'));
-    const outputRoot = join(parent, 'packet');
-    try {
-        execFileSync(process.execPath, ['scripts/run-stage1-human-packet.mjs', '--out', outputRoot], { stdio: 'pipe' });
-        const identities = JSON.parse(readFileSync(join(outputRoot, 'IDENTITIES.json'), 'utf8'));
-        assert.equal(identities.baselineCheckoutable, gitObjectExists(BASELINE_COMMIT));
-        assert.equal(identities.stage1CommitCheckoutable, gitObjectExists(STAGE1_COMMIT));
-        assert.equal(identities.exactHeadBindingSatisfied, identities.stage1CommitCheckoutable);
-        assert.equal(identities.captureAuthorized, false);
-        const operator = readFileSync(join(outputRoot, 'OPERATOR.md'), 'utf8');
-        assert.match(operator, /Do not capture paired Stage 1 arm output until/);
-        assert.match(operator, /verificationStatus: unverified/);
-        const rating = JSON.parse(readFileSync(join(outputRoot, 'examples', 'rating.json'), 'utf8'));
-        assert.equal(rating.verificationStatus, 'unverified');
-    }
-    finally {
-        rmSync(parent, { recursive: true, force: true });
-    }
-});
-test('Stage 1 human packet refuses a relative output path', () => {
-    assert.throws(() => execFileSync(process.execPath, ['scripts/run-stage1-human-packet.mjs', '--out', 'stage1-human-output'], { stdio: 'pipe' }), /Human packet output must use an absolute path/);
-});
-test('Stage 1 human packet refuses repository output', () => {
-    assert.throws(() => execFileSync(process.execPath, ['scripts/run-stage1-human-packet.mjs', '--out', join(process.cwd(), 'stage1-human-output')], { stdio: 'pipe' }), /Human packet output must stay outside the repository and every worktree/);
-});
-test('Stage 1 human packet refuses every linked worktree and the primary clone', () => {
-    const porcelain = execFileSync('git', ['worktree', 'list', '--porcelain'], { encoding: 'utf8' });
-    const trees = porcelain.split('\n').flatMap((line) => (line.startsWith('worktree ') ? [realpathSync(line.slice('worktree '.length))] : []));
-    const gitCommonDir = realpathSync(execFileSync('git', ['rev-parse', '--git-common-dir'], { encoding: 'utf8' }).trim());
-    trees.push(dirname(gitCommonDir));
-    for (const root of new Set(trees)) {
-        assert.throws(() => execFileSync(process.execPath, ['scripts/run-stage1-human-packet.mjs', '--out', join(root, 'stage1-human-output')], { stdio: 'pipe' }), /Human packet output must stay outside the repository and every worktree/);
-    }
-});
-test('Stage 1 human packet refuses a symlinked ancestor into the repository', () => {
-    const parent = mkdtempSync(join(tmpdir(), 'hyv-stage1-human-symlink-test-'));
-    const repositoryTarget = join(process.cwd(), 'stage1-human-symlink-target');
-    mkdirSync(repositoryTarget);
-    symlinkSync(repositoryTarget, join(parent, 'redirect'));
-    try {
-        assert.throws(() => execFileSync(process.execPath, ['scripts/run-stage1-human-packet.mjs', '--out', join(parent, 'redirect', 'packet')], { stdio: 'pipe' }), /Human packet output must stay outside the repository and every worktree/);
-    }
-    finally {
-        rmSync(parent, { recursive: true, force: true });
-        rmSync(repositoryTarget, { recursive: true, force: true });
-    }
-});
-test('Stage 1 human packet refuses fabricated human ratings', () => {
-    assert.throws(() => execFileSync(process.execPath, ['scripts/run-stage1-human-packet.mjs', '--fabricate-human-ratings'], { stdio: 'pipe' }), /Human evidence cannot be fabricated/);
-});

package/dist/stage1-schema-contract.test.js

@@ -1,95 +0,0 @@
-import assert from 'node:assert/strict';
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import test from 'node:test';
-const schemaRoot = join(process.cwd(), 'benchmarks/schema');
-const schemaNames = [
-    'protocol-manifest.v1',
-    'run-event.v1',
-    'blind-packet.v1',
-    'blind-mapping.v1',
-    'reviewer-record.v1',
-    'ratings-seal.v1',
-    'aggregate-report.v1',
-    'checkpoint-disposition.v1',
-];
-function loadSchema(name) {
-    return JSON.parse(readFileSync(join(schemaRoot, `${name}.schema.json`), 'utf8'));
-}
-function assertWireKeys(name, keys) {
-    const schema = loadSchema(name);
-    const optionalKeys = name === 'run-event.v1'
-        ? ['outputDigest', 'hardGates']
-        : name === 'reviewer-record.v1' ? ['preferredLabel', 'correctionVersusConfirm'] : [];
-    assert.deepEqual(Object.keys(schema.properties).sort(), [...keys].sort(), `${name} wire keys drifted from the evaluator`);
-    assert.deepEqual([...schema.required].sort(), [...keys.filter((key) => !optionalKeys.includes(key))].sort(), `${name} required keys drifted from the evaluator`);
-}
-test('Stage 1 evidence schemas are strict Draft 2020-12 contracts', () => {
-    for (const name of schemaNames) {
-        const schema = loadSchema(name);
-        assert.equal(schema.$schema, 'https://json-schema.org/draft/2020-12/schema');
-        assert.equal(schema.$id, `https://holdyourvoice.dev/schemas/${name}.schema.json`);
-        assert.equal(schema.type, 'object');
-        assert.equal(schema.additionalProperties, false);
-        assert.ok(Array.isArray(schema.required) && schema.required.length > 0);
-    }
-});
-test('protocol and evidence schemas bind immutable identities and the complete digest chain', () => {
-    const protocol = loadSchema('protocol-manifest.v1');
-    assert.equal(protocol.properties.baseline.properties.sourceCommit.const, '4e6269121d551c008a34db73077e1e4fea41b3f9');
-    assert.equal(protocol.properties.stage1.properties.sourceCommit.const, '550ea24f652291dca13757fdbd2f0fa0b5e3f621');
-    for (const field of ['kind', 'version', 'mode', 'benchmark', 'cases', 'execution', 'reviewerRosterDigest', 'analysis', 'rights', 'releaseAuditContractDigest', 'protocolDigest']) {
-        assert.ok(protocol.required.includes(field), `protocol must require ${field}`);
-    }
-    const run = loadSchema('run-event.v1');
-    for (const field of ['protocolDigest', 'candidateDigest', 'caseDigest', 'rightsDigest', 'ordinal', 'latencyMs', 'inputTokens', 'outputTokens', 'costMicrousd'])
-        assert.ok(run.required.includes(field));
-    assert.ok(run.oneOf[0].required.includes('outputDigest'), 'completed runs must bind the output digest');
-    assert.match(JSON.stringify(run.oneOf[1].not), /outputDigest/, 'failed runs must not fabricate an output digest');
-    const packet = loadSchema('blind-packet.v1');
-    for (const field of ['protocolDigest', 'candidateDigest', 'runsDigest', 'packetDigest', 'mappingDigest', 'contentDigest', 'nonReviewableDigest', 'reviewableCount', 'nonReviewableCount'])
-        assert.ok(packet.required.includes(field));
-    const reviewer = loadSchema('reviewer-record.v1');
-    for (const field of ['protocolDigest', 'candidateDigest', 'packetDigest', 'reviewerId', 'identityKey', 'recordId', 'sequence', 'previousRecordDigest', 'recordDigest', 'caseId', 'attestation'])
-        assert.ok(reviewer.required.includes(field));
-    assert.equal(reviewer.properties.sourceText, undefined);
-    assert.equal(reviewer.properties.correctionText, undefined);
-    const seal = loadSchema('ratings-seal.v1');
-    for (const field of ['protocolDigest', 'candidateDigest', 'packetDigest', 'mappingDigest', 'ratingsDigest', 'sealDigest'])
-        assert.ok(seal.required.includes(field));
-    const report = loadSchema('aggregate-report.v1');
-    for (const field of ['protocolDigest', 'candidateDigest', 'runsDigest', 'packetDigest', 'mappingDigest', 'sealDigest', 'releaseAuditDigest', 'intentToTreat', 'metrics'])
-        assert.ok(report.required.includes(field));
-});
-test('deferred-human artifacts cannot claim pass, promotion, or MAR-363 progression', () => {
-    const report = loadSchema('aggregate-report.v1');
-    assert.equal(report.properties.decision.const, 'BLOCKED');
-    assert.equal(report.properties.promotable.const, false);
-    assert.equal(report.properties.blockers.contains.const, 'human_writer_evidence_deferred');
-    const disposition = loadSchema('checkpoint-disposition.v1');
-    assert.deepEqual(disposition.properties.disposition.enum, ['STOP', 'REPEAT_PROTOCOL']);
-    assert.equal(disposition.properties.releaseApproved, undefined, 'checkpoint disposition is not a release approval');
-});
-test('schema wire keys match evaluator artifacts exactly', () => {
-    assertWireKeys('protocol-manifest.v1', ['kind', 'version', 'mode', 'baseline', 'stage1', 'benchmark', 'cases', 'intentToTreat', 'execution', 'randomization', 'reviewerRosterDigest', 'analysis', 'rights', 'releaseAuditContractDigest', 'registeredAt', 'measures', 'gates', 'protocolDigest']);
-    assertWireKeys('run-event.v1', ['kind', 'version', 'evidenceClass', 'protocolDigest', 'candidateDigest', 'assignmentId', 'participantId', 'caseId', 'caseDigest', 'rightsDigest', 'arm', 'ordinal', 'latencyMs', 'inputTokens', 'outputTokens', 'costMicrousd', 'occurredAt', 'outcome', 'outputDigest', 'hardGates']);
-    assertWireKeys('blind-packet.v1', ['kind', 'version', 'protocolDigest', 'candidateDigest', 'runsDigest', 'mappingDigest', 'contentDigest', 'nonReviewableDigest', 'reviewableCount', 'nonReviewableCount', 'encryptedAtRest', 'approvedStorage', 'packetDigest']);
-    assertWireKeys('blind-mapping.v1', ['kind', 'version', 'nonce', 'labels', 'custodianId', 'unblindingAccess', 'attestation']);
-    assertWireKeys('reviewer-record.v1', ['kind', 'version', 'evidenceClass', 'protocolDigest', 'candidateDigest', 'packetDigest', 'reviewerId', 'identityKey', 'recordId', 'sequence', 'previousRecordDigest', 'recordDigest', 'caseId', 'preferredLabel', 'correctionVersusConfirm', 'workflow', 'attestation']);
-    assertWireKeys('ratings-seal.v1', ['kind', 'version', 'protocolDigest', 'candidateDigest', 'packetDigest', 'mappingDigest', 'ratingsDigest', 'recordCount', 'sealDigest']);
-    assertWireKeys('aggregate-report.v1', ['kind', 'version', 'protocolDigest', 'candidateDigest', 'runsDigest', 'packetDigest', 'mappingDigest', 'sealDigest', 'releaseAuditDigest', 'intentToTreat', 'metrics', 'decision', 'promotable', 'blockers', 'reportDigest']);
-    assertWireKeys('checkpoint-disposition.v1', ['kind', 'version', 'protocolDigest', 'packetDigest', 'releaseAuditDigest', 'reportDigest', 'disposition', 'attestation', 'dispositionDigest']);
-});
-test('nested protocol and report contracts match the repaired runtime', () => {
-    const protocol = loadSchema('protocol-manifest.v1');
-    assert.deepEqual([...protocol.properties.cases.items.required].sort(), ['caseId', 'caseDigest', 'provenanceDigest', 'rightsDigest', 'providerDisclosureDigest', 'reviewerDisclosureDigest', 'derivedRetentionDigest'].sort());
-    assert.deepEqual([...protocol.properties.execution.required].sort(), ['provider', 'model', 'modelRevision', 'settingsDigest', 'taskContractDigest', 'rulesetDigest', 'rubricDigest'].sort());
-    const reviewer = loadSchema('reviewer-record.v1');
-    assert.deepEqual([...reviewer.properties.correctionVersusConfirm.required].sort(), ['A', 'B']);
-    assert.ok(!reviewer.required.includes('preferredLabel'));
-    assert.ok(!reviewer.required.includes('correctionVersusConfirm'));
-    assert.match(JSON.stringify(reviewer.allOf), /abandoned.*preferredLabel.*correctionVersusConfirm/);
-    const report = loadSchema('aggregate-report.v1');
-    assert.deepEqual([...report.properties.intentToTreat.required].sort(), ['denominator', 'completed', 'hardFailures', 'timeouts', 'abandonments', 'runsDigest', 'expectedRatings', 'observedRatings', 'missingRatings', 'reconciled'].sort());
-    assert.deepEqual([...report.properties.metrics.required].sort(), ['preference', 'correctionVersusConfirm', 'completion', 'abandonment', 'providerRuns'].sort());
-});

package/dist/stage2-human-packet.test.js

@@ -1,81 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { existsSync, mkdtempSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, symlinkSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import test from 'node:test';
-function packetFiles(root) {
-    return readdirSync(root, { withFileTypes: true }).flatMap((entry) => {
-        const path = join(root, entry.name);
-        return entry.isDirectory() ? packetFiles(path) : [path];
-    });
-}
-test('Stage 2 human packet executes outside the repository and remains blocked without ratings', () => {
-    const parent = mkdtempSync(join(tmpdir(), 'hyv-stage2-human-packet-test-'));
-    const outputRoot = join(parent, 'packet');
-    try {
-        const output = JSON.parse(execFileSync(process.execPath, ['scripts/run-stage2-human-packet.mjs', '--out', outputRoot], { encoding: 'utf8' }));
-        assert.equal(output.kind, 'hyv-stage2-operator-kit');
-        assert.equal(output.writerEvidence, false);
-        assert.equal(output.kitEmitted, true);
-        assert.equal(output.decision, 'BLOCKED');
-        assert.equal(output.promotable, false);
-        assert.ok(output.blockers.includes('stage2_adoption_evidence_deferred'));
-        assert.ok(output.blockers.includes('stage1_checkpoint_unpassed'));
-        assert.ok(output.blockers.includes('rebuild_release_claim_blocked'));
-        assert.equal(existsSync(join(outputRoot, 'ratings.ndjson')), false);
-        for (const file of packetFiles(outputRoot)) {
-            assert.doesNotMatch(readFileSync(file, 'utf8'), /"evidenceClass"\s*:\s*"human"/);
-        }
-        const status = JSON.parse(readFileSync(join(outputRoot, 'status.json'), 'utf8'));
-        assert.equal(status.kind, 'hyv-stage2-operator-kit');
-        assert.equal(status.decision, 'BLOCKED');
-        assert.equal(status.promotable, false);
-        assert.deepEqual(status.blockers, output.blockers);
-        const identities = JSON.parse(readFileSync(join(outputRoot, 'IDENTITIES.json'), 'utf8'));
-        assert.equal(identities.rebuildCommit, '387de69eae9ec176f32bfb0f3a7b769a4e0b6686');
-        const protocolSkeleton = JSON.parse(readFileSync(join(outputRoot, 'protocol-skeleton.json'), 'utf8'));
-        assert.equal(protocolSkeleton.rebuild.sourceCommit, identities.rebuildCommit);
-        assert.equal(protocolSkeleton.baseline.packageVersion, '3.2.0');
-        const operator = readFileSync(join(outputRoot, 'OPERATOR.md'), 'utf8');
-        assert.match(operator, /four separate reports/);
-        assert.match(operator, /Product publish does not wait on this kit/);
-        assert.match(operator, /Never record PROCEED_TO_MAR_365/);
-        assert.match(operator, /product npm publish may proceed without this kit/);
-        assert.match(operator, /do not claim writer checkpoints passed/);
-    }
-    finally {
-        rmSync(parent, { recursive: true, force: true });
-    }
-});
-test('Stage 2 human packet refuses fabricated human ratings', () => {
-    assert.throws(() => execFileSync(process.execPath, ['scripts/run-stage2-human-packet.mjs', '--fabricate-human-ratings'], { stdio: 'pipe' }), /Human evidence cannot be fabricated/);
-});
-test('Stage 2 human packet refuses a relative output path', () => {
-    assert.throws(() => execFileSync(process.execPath, ['scripts/run-stage2-human-packet.mjs', '--out', 'stage2-human-output'], { stdio: 'pipe' }), /Human packet output must use an absolute path/);
-});
-test('Stage 2 human packet refuses repository output', () => {
-    assert.throws(() => execFileSync(process.execPath, ['scripts/run-stage2-human-packet.mjs', '--out', join(process.cwd(), 'stage2-human-output')], { stdio: 'pipe' }), /Human packet output must stay outside the repository and every worktree/);
-});
-test('Stage 2 human packet refuses every linked worktree and the primary clone', () => {
-    const porcelain = execFileSync('git', ['worktree', 'list', '--porcelain'], { encoding: 'utf8' });
-    const trees = porcelain.split('\n').flatMap((line) => (line.startsWith('worktree ') ? [realpathSync(line.slice('worktree '.length))] : []));
-    const gitCommonDir = realpathSync(execFileSync('git', ['rev-parse', '--git-common-dir'], { encoding: 'utf8' }).trim());
-    trees.push(dirname(gitCommonDir));
-    for (const root of new Set(trees)) {
-        assert.throws(() => execFileSync(process.execPath, ['scripts/run-stage2-human-packet.mjs', '--out', join(root, 'stage2-human-output')], { stdio: 'pipe' }), /Human packet output must stay outside the repository and every worktree/);
-    }
-});
-test('Stage 2 human packet refuses a symlinked ancestor into the repository', () => {
-    const parent = mkdtempSync(join(tmpdir(), 'hyv-stage2-human-symlink-test-'));
-    const repositoryTarget = join(process.cwd(), 'stage2-human-symlink-target');
-    mkdirSync(repositoryTarget);
-    symlinkSync(repositoryTarget, join(parent, 'redirect'));
-    try {
-        assert.throws(() => execFileSync(process.execPath, ['scripts/run-stage2-human-packet.mjs', '--out', join(parent, 'redirect', 'packet')], { stdio: 'pipe' }), /Human packet output must stay outside the repository and every worktree/);
-    }
-    finally {
-        rmSync(parent, { recursive: true, force: true });
-        rmSync(repositoryTarget, { recursive: true, force: true });
-    }
-});

package/dist/strict-quality.test.js

@@ -1,62 +0,0 @@
-import assert from 'node:assert/strict';
-import { createHash } from 'node:crypto';
-import test from 'node:test';
-import { evaluateStrictQuality } from './strict-quality.js';
-function canonical(value) {
-    if (Array.isArray(value))
-        return `[${value.map(canonical).join(',')}]`;
-    if (value !== null && typeof value === 'object')
-        return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => `${JSON.stringify(key)}:${canonical(item)}`).join(',')}}`;
-    return JSON.stringify(value);
-}
-function profile() {
-    const unsigned = {
-        version: '3', id: 'strict.author', revision: 1, sampleCount: 5,
-        metrics: { sentenceLength: 6, sentenceVariation: 2, sentenceStructure: [], rhythm: 1, paragraphLength: 1, openingMoves: [], vocabulary: [], lexicalDensity: 0.5, pointOfView: 'mixed', punctuation: { '!': 0, '?': 0, ';': 0, ':': 0, '—': 0 }, caseStyle: 'standard', questionRate: 0, transitions: [] },
-        avoid: [], provenance: { source: 'local', rights: 'author-owned', createdAt: '2026-08-25T00:00:00.000Z' }, rulePolicy: {},
-        fingerprint: { contractionRate: 0, sentenceLengthDistribution: { short: 1, medium: 0, long: 0 }, bulletRate: 0, enDashRate: 0 },
-        tolerances: { contractionRate: { absolute: 1, calibrated: true }, sentenceLengthDistribution: { absolute: 1, calibrated: true }, bulletRate: { absolute: 1, calibrated: true }, enDashRate: { absolute: 1, calibrated: true } },
-        metricFixtures: { contractionRate: ['fixture.a'], sentenceLengthDistribution: ['fixture.b'], bulletRate: ['fixture.c'], enDashRate: ['fixture.d'] },
-    };
-    return { ...unsigned, revisionDigest: createHash('sha256').update(canonical(unsigned)).digest('hex') };
-}
-function samples() { return Array.from({ length: 5 }, (_, index) => Array.from({ length: 100 }, () => `sample${index} records one concrete detail.`).join(' ')); }
-test('returns strict-ready only for a calibrated, adequately sampled, clean v3 profile', () => {
-    const report = evaluateStrictQuality('The launch starts Tuesday. The owner signed the checklist.', profile(), samples());
-    assert.equal(report.disposition, 'strict-ready');
-    assert.deepEqual(report.findings, []);
-});
-test('blocks an underpowered or uncalibrated voice profile before trusting voice matching', () => {
-    const underpowered = evaluateStrictQuality('The launch starts Tuesday.', profile(), samples().slice(0, 2));
-    assert.equal(underpowered.disposition, 'blocked');
-    assert.ok(underpowered.findings.some((item) => item.id === 'strict.profile.sample-count'));
-    const sparse = evaluateStrictQuality('The launch starts Tuesday.', profile(), Array.from({ length: 5 }, (_, index) => `sample ${index}.`));
-    assert.ok(sparse.findings.some((item) => item.id === 'strict.profile.sample-coverage'));
-    const uncalibrated = profile();
-    uncalibrated.tolerances.bulletRate.calibrated = false;
-    const report = evaluateStrictQuality('The launch starts Tuesday.', uncalibrated, samples());
-    assert.ok(report.findings.some((item) => item.id === 'strict.profile.uncalibrated.bulletRate'));
-    const thinProfile = profile();
-    thinProfile.sampleCount = 2;
-    const thinProfileReport = evaluateStrictQuality('The launch starts Tuesday.', thinProfile, samples());
-    assert.ok(thinProfileReport.findings.some((item) => item.id === 'strict.profile.profile-sample-count'));
-    const mixedFormats = samples();
-    mixedFormats[0] = Array.from({ length: 100 }, () => 'subject: a concise update for the release list.').join(' ');
-    const mixedFormatReport = evaluateStrictQuality('The launch starts Tuesday.', profile(), mixedFormats);
-    assert.ok(mixedFormatReport.findings.some((item) => item.id === 'strict.profile.format-spread'));
-});
-test('blocks every active AI Editor pattern under strict quality', () => {
-    const review = evaluateStrictQuality('We leverage the existing checklist.', profile(), samples());
-    assert.equal(review.disposition, 'blocked');
-    assert.ok(review.findings.some((item) => item.id === 'strict.ai_editor.ai.leverage' && item.disposition === 'block'));
-    const blockedProfile = profile();
-    blockedProfile.rulePolicy['ai.leverage'] = 'blocking';
-    const blocked = evaluateStrictQuality('We leverage the existing checklist.', blockedProfile, samples());
-    assert.equal(blocked.disposition, 'blocked');
-    assert.ok(blocked.findings.some((item) => item.id === 'strict.ai_editor.ai.leverage' && item.disposition === 'block'));
-});
-test('blocks unresolved final-output hygiene', () => {
-    const report = evaluateStrictQuality('The launch starts\u200b Tuesday.', profile(), samples());
-    assert.equal(report.disposition, 'blocked');
-    assert.ok(report.findings.some((item) => item.id === 'strict.final-output'));
-});

package/dist/text-provenance.feature.test.js

@@ -1,45 +0,0 @@
-import assert from 'node:assert/strict';
-import { readFileSync } from 'node:fs';
-import test from 'node:test';
-import { applyHiddenTextPolicy, inspectHiddenText } from './hidden-text.js';
-import { provenanceStatusForRebuild, writerRequestForRebuild } from './provenance-status.js';
-const feature = readFileSync(new URL('../features/text-provenance.feature', import.meta.url), 'utf8');
-const policy = { version: '1', mode: 'meaning-first', lexicalResidual: { ngramSize: 5, maxSharedNgramFraction: 0.1, maxLongestSharedRunTokens: 8 }, acknowledgement: 'Measures shared wording only; does not detect or prove removal of a watermark.' };
-const task = {
-    version: '1', fingerprint: 'a'.repeat(64), draft: 'private source phrase', prompt: 'structured task prompt',
-    copySpec: { version: '1', audience: 'operators', intent: 'explain', channel: 'email', claims: [{ id: 'date', text: 'The date is fixed.', evidence: 'calendar' }] },
-    recommendationFingerprint: 'b'.repeat(64), authorizationFingerprint: 'c'.repeat(64), profileId: 'profile', profileRevisionDigest: 'd'.repeat(64), recompositionPolicy: policy,
-};
-function scenario(name, verify) {
-    test(`Feature: bounded text provenance sanitation — Scenario: ${name}`, () => {
-        assert.match(feature, new RegExp(`Scenario: ${name}`));
-        verify();
-    });
-}
-scenario('explicitly approved non-semantic controls are removed with evidence', () => {
-    const receipt = applyHiddenTextPolicy('one\u0007two\uFEFFthree');
-    assert.deepEqual(receipt.proposedChanges.map((item) => item.codepoint), ['U+0007', 'U+FEFF']);
-    assert.match(receipt.inputHash, /^[a-f0-9]{64}$/);
-    assert.match(receipt.outputHash, /^[a-f0-9]{64}$/);
-    assert.equal(receipt.idempotent, true);
-});
-scenario('multilingual and structured text is review-only by default', () => {
-    const source = '```md\nالعربية\u202E ไทย\u200B 👩\u200D💻\t\n```';
-    const receipt = applyHiddenTextPolicy(source);
-    assert.equal(receipt.output, source);
-    assert.equal(receipt.proposedChanges.length, 0);
-    assert.ok(inspectHiddenText(source).findings.every((item) => item.action === 'review'));
-});
-scenario('an external writer receives no source prose', () => {
-    const request = writerRequestForRebuild(task);
-    assert.match(request.prompt, /structured task prompt/);
-    assert.doesNotMatch(JSON.stringify(request), /private source phrase|authorizationFingerprint|profileRevisionDigest|draft/);
-});
-scenario('unknown provider status remains explicit', () => {
-    assert.deepEqual(provenanceStatusForRebuild(task), { version: '1', state: 'unknown', reason: 'private_or_unavailable_verifier' });
-    assert.match(feature, /does not claim watermark removal or absence/);
-});
-scenario('a controlled verifier is not configured', () => {
-    assert.deepEqual(provenanceStatusForRebuild({ ...task, recompositionPolicy: undefined }), { version: '1', state: 'not_configured' });
-    assert.match(feature, /lexical residual is not used as a provider verifier/);
-});

package/dist/text.test.js

@@ -1,16 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import { sentences, words } from './text.js';
-test('keeps decimals and common abbreviations inside a sentence', () => {
-    assert.deepEqual(sentences('Dr. Shah raised $3.5m. It funded the work.').map((sentence) => sentence.text), ['Dr. Shah raised $3.5m.', 'It funded the work.']);
-});
-test('records exact sentence offsets across newlines', () => {
-    const text = 'First line\nSecond line.';
-    assert.deepEqual(sentences(text), [
-        { index: 1, start: 0, end: 10, text: 'First line' },
-        { index: 2, start: 11, end: 23, text: 'Second line.' },
-    ]);
-});
-test('counts Unicode writing as words', () => {
-    assert.deepEqual(words('café नमस्ते दुनिया'), ['café', 'नमस्ते', 'दुनिया']);
-});