@iowarp/clio-coder 0.3.0 → 0.3.2

package/dist/{chunk-7BHLZB3A.js → chunk-GGXXDWE4.js}

@@ -1,18 +1,13 @@
+import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   isAgentCapabilityClass
-} from "./chunk-WD6AJM35.js";
+} from "./chunk-5UUP6MWO.js";
 import {
-  assertSafeId
-} from "./chunk-5N2FG33Q.js";
-import {
-  safeResourceWrite
-} from "./chunk-VPAWTYLY.js";
-import {
-  readClioVersion,
-  resolvePackageRoot
-} from "./chunk-DXQNI4PC.js";
+  init_esm_shims
+} from "./chunk-3R73A4XB.js";
 
 // src/domains/dispatch/execution-role.ts
+init_esm_shims();
 var EXECUTION_ROLES = [
   "builder",
   "reviewer",
@@ -95,13 +90,186 @@ function gateRouteCorrelation(subject, decider) {
   };
 }
 
-// src/domains/dispatch/receipt-integrity.ts
-import { createHash as createHash2 } from "node:crypto";
-
-// src/domains/dispatch/route-decision.ts
-import { createHash } from "node:crypto";
+// src/domains/dispatch/routing-intent.ts
+init_esm_shims();
+var KEYS = /* @__PURE__ */ new Set([
+  "posture",
+  "maxCostUsd",
+  "deadlineMs",
+  "minimumQuality",
+  "requiredCapabilities",
+  "locality",
+  "failover"
+]);
+var POSTURES = /* @__PURE__ */ new Set(["manual", "quality", "balanced", "latency", "economy"]);
+var LOCALITIES = /* @__PURE__ */ new Set(["local-only", "prefer-local", "any"]);
+var FAILOVERS = /* @__PURE__ */ new Set(["none", "approved"]);
+function record(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isRoutingIntent(value) {
+  if (!record(value) || Object.keys(value).some((key) => !KEYS.has(key))) return false;
+  return typeof value.posture === "string" && POSTURES.has(value.posture) && (value.maxCostUsd === null || typeof value.maxCostUsd === "number" && Number.isFinite(value.maxCostUsd) && value.maxCostUsd > 0) && (value.deadlineMs === null || typeof value.deadlineMs === "number" && Number.isInteger(value.deadlineMs) && value.deadlineMs > 0) && (value.minimumQuality === null || typeof value.minimumQuality === "number" && value.minimumQuality >= 0 && value.minimumQuality <= 1) && Array.isArray(value.requiredCapabilities) && value.requiredCapabilities.every((entry) => typeof entry === "string" && entry.length > 0) && typeof value.locality === "string" && LOCALITIES.has(value.locality) && typeof value.failover === "string" && FAILOVERS.has(value.failover);
+}
+function parseRoutingIntent(value, pins = {}) {
+  const errors = [];
+  if (value !== void 0 && !record(value)) return { ok: false, errors: ["routing must be an object"] };
+  const input = value === void 0 ? {} : value;
+  for (const key of Object.keys(input)) if (!KEYS.has(key)) errors.push(`routing unknown key: ${key}`);
+  const pinned = pins.target !== void 0 || pins.model !== void 0 || pins.node !== void 0;
+  const posture = input.posture ?? (pinned ? "manual" : "balanced");
+  if (typeof posture !== "string" || !POSTURES.has(posture)) {
+    errors.push("routing.posture must be one of: manual|quality|balanced|latency|economy");
+  }
+  if (pinned && posture !== "manual") errors.push("exact target, model, or node pins require routing.posture manual");
+  const positive = (key) => {
+    const candidate = input[key];
+    if (candidate === void 0) return null;
+    if (typeof candidate !== "number" || !Number.isFinite(candidate) || candidate <= 0) {
+      errors.push(`routing.${key} must be a finite number greater than zero`);
+      return null;
+    }
+    if (key === "deadlineMs" && !Number.isInteger(candidate)) errors.push("routing.deadlineMs must be an integer");
+    return candidate;
+  };
+  const maxCostUsd = positive("maxCostUsd");
+  const deadlineMs = positive("deadlineMs");
+  let minimumQuality = null;
+  if (input.minimumQuality !== void 0) {
+    if (typeof input.minimumQuality !== "number" || !Number.isFinite(input.minimumQuality) || input.minimumQuality < 0 || input.minimumQuality > 1)
+      errors.push("routing.minimumQuality must be between zero and one");
+    else minimumQuality = input.minimumQuality;
+  }
+  const requiredCapabilities = input.requiredCapabilities ?? [];
+  if (!Array.isArray(requiredCapabilities) || requiredCapabilities.some((entry) => typeof entry !== "string" || entry.trim().length === 0) || new Set(requiredCapabilities).size !== requiredCapabilities.length)
+    errors.push("routing.requiredCapabilities must be an array of unique non-empty strings");
+  const locality = input.locality ?? "any";
+  if (typeof locality !== "string" || !LOCALITIES.has(locality)) {
+    errors.push("routing.locality must be one of: local-only|prefer-local|any");
+  }
+  const failover = input.failover ?? "none";
+  if (typeof failover !== "string" || !FAILOVERS.has(failover)) {
+    errors.push("routing.failover must be one of: none|approved");
+  }
+  if (pinned && failover !== "none") errors.push("manual pins imply routing.failover none");
+  if (errors.length > 0) return { ok: false, errors };
+  return {
+    ok: true,
+    intent: {
+      posture,
+      maxCostUsd,
+      deadlineMs,
+      minimumQuality,
+      requiredCapabilities: [...requiredCapabilities],
+      locality,
+      failover
+    }
+  };
+}
+function defaultRoutingIntent(pins) {
+  const parsed = parseRoutingIntent(void 0, pins);
+  if (!parsed.ok) throw new Error(parsed.errors.join("; "));
+  return parsed.intent;
+}
+function routingIntentRejection(input) {
+  const { intent } = input;
+  if (intent.minimumQuality !== null && input.qualityLowerBound < intent.minimumQuality) return "minimum-quality";
+  if (intent.maxCostUsd !== null && input.costUpperBoundUsd > intent.maxCostUsd) return "max-cost";
+  if (intent.deadlineMs !== null && input.endToEndUpperBoundMs > intent.deadlineMs) return "deadline";
+  if (intent.locality === "local-only" && input.candidate.nodeId !== "local") return "local-only";
+  if (intent.requiredCapabilities.some((capability) => !input.capabilities.includes(capability))) {
+    return "required-capabilities";
+  }
+  return null;
+}
+var ROUTE_EXPLANATION_MAX_BYTES = 4096;
+function safeIdentity(candidate) {
+  const safe = (value) => {
+    const redacted = /(?:https?:\/\/|api[_-]?key|token|secret|password)/i.test(value) ? "[redacted]" : value;
+    return redacted.length <= 128 ? redacted : `${redacted.slice(0, 127)}\u2026`;
+  };
+  return {
+    ...candidate,
+    agentId: safe(candidate.agentId),
+    specFingerprint: safe(candidate.specFingerprint),
+    targetId: safe(candidate.targetId),
+    modelId: safe(candidate.modelId),
+    runtimeId: safe(candidate.runtimeId),
+    nodeId: safe(candidate.nodeId),
+    ...candidate.thinkingLevel !== void 0 ? { thinkingLevel: safe(candidate.thinkingLevel) } : {},
+    toolSignature: safe(candidate.toolSignature),
+    promptCompositionHash: safe(candidate.promptCompositionHash),
+    endpointIdentityHash: safe(candidate.endpointIdentityHash),
+    settingsFingerprint: safe(candidate.settingsFingerprint)
+  };
+}
+function explainRouteDecision(decision, intent) {
+  const exclusions = [
+    ...new Set(decision.candidateEvaluations.flatMap((entry) => entry.rejection ? [entry.rejection] : []))
+  ];
+  const explanation = {
+    mode: decision.mode,
+    executedRoute: safeIdentity(decision.executedRoute),
+    shadowRecommendation: decision.mode === "shadow" ? safeIdentity(decision.selected) : null,
+    hardExclusions: exclusions.slice(0, 16),
+    approvedFallbacks: decision.approvedFallbacks.slice(0, 3).map(safeIdentity),
+    costUpperBoundUsd: intent.maxCostUsd,
+    deadlineMs: intent.deadlineMs,
+    confidence: decision.confidence,
+    activeEligible: decision.candidateEvaluations.some(
+      (entry) => entry.rejection === null && entry.activeReadiness.ready
+    ),
+    reasonCodes: decision.reasonCodes.slice(0, 16),
+    decisionHash: decision.decisionHash,
+    agentSelection: {
+      request: decision.agentSelection.request,
+      activation: decision.agentSelection.activation,
+      baselineAgentId: safeIdentity({ ...decision.executedRoute, agentId: decision.agentSelection.baselineAgentId }).agentId,
+      recommendedAgentId: safeIdentity({ ...decision.executedRoute, agentId: decision.agentSelection.recommendedAgentId }).agentId,
+      excluded: decision.agentSelection.evaluations.filter((entry) => entry.rejections.length > 0).slice(0, 16).map((entry) => ({
+        agentId: safeIdentity({ ...decision.executedRoute, agentId: entry.agentId }).agentId,
+        reasons: entry.rejections.slice(0, 8)
+      })),
+      authorityTransition: decision.agentSelection.authorityTransition === null ? null : {
+        ...decision.agentSelection.authorityTransition,
+        from: safeIdentity({
+          ...decision.executedRoute,
+          agentId: decision.agentSelection.authorityTransition.from
+        }).agentId,
+        to: safeIdentity({
+          ...decision.executedRoute,
+          agentId: decision.agentSelection.authorityTransition.to
+        }).agentId
+      }
+    }
+  };
+  if (Buffer.byteLength(JSON.stringify(explanation), "utf8") <= ROUTE_EXPLANATION_MAX_BYTES) return explanation;
+  const compact = {
+    ...explanation,
+    approvedFallbacks: explanation.approvedFallbacks.slice(0, 1),
+    hardExclusions: explanation.hardExclusions.slice(0, 4),
+    reasonCodes: explanation.reasonCodes.slice(0, 4),
+    agentSelection: {
+      ...explanation.agentSelection,
+      excluded: explanation.agentSelection.excluded.slice(0, 4).map((entry) => ({ ...entry, reasons: entry.reasons.slice(0, 2) }))
+    }
+  };
+  if (Buffer.byteLength(JSON.stringify(compact), "utf8") <= ROUTE_EXPLANATION_MAX_BYTES) return compact;
+  return {
+    ...compact,
+    shadowRecommendation: null,
+    approvedFallbacks: [],
+    hardExclusions: compact.hardExclusions.slice(0, 2),
+    reasonCodes: compact.reasonCodes.slice(0, 2),
+    agentSelection: {
+      ...compact.agentSelection,
+      excluded: []
+    }
+  };
+}
 
 // src/domains/dispatch/route-policy.ts
+init_esm_shims();
 var ROUTE_POLICY_VERSION = "route-policy/4";
 var MINIMUM_QUALITY_LABELED_OUTCOMES = 6;
 var ROUTE_POSTURES = {
@@ -299,7 +467,12 @@ function compareRankedRoutes(left, right) {
   return left.key < right.key ? -1 : left.key > right.key ? 1 : 0;
 }
 
+// src/domains/dispatch/route-decision.ts
+init_esm_shims();
+import { createHash } from "node:crypto";
+
 // src/domains/dispatch/route-readiness.ts
+init_esm_shims();
 var MINIMUM_ACTIVE_QUALITY_LABELS = 6;
 var DECISION_LATENCY_BUDGET_MS = 10;
 function evaluateRouteReadiness(input) {
@@ -879,1191 +1052,6 @@ function evaluateRouteDecision(decision, realized) {
   };
 }
 
-// src/domains/dispatch/routing-intent.ts
-var KEYS = /* @__PURE__ */ new Set([
-  "posture",
-  "maxCostUsd",
-  "deadlineMs",
-  "minimumQuality",
-  "requiredCapabilities",
-  "locality",
-  "failover"
-]);
-var POSTURES = /* @__PURE__ */ new Set(["manual", "quality", "balanced", "latency", "economy"]);
-var LOCALITIES = /* @__PURE__ */ new Set(["local-only", "prefer-local", "any"]);
-var FAILOVERS = /* @__PURE__ */ new Set(["none", "approved"]);
-function record(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isRoutingIntent(value) {
-  if (!record(value) || Object.keys(value).some((key) => !KEYS.has(key))) return false;
-  return typeof value.posture === "string" && POSTURES.has(value.posture) && (value.maxCostUsd === null || typeof value.maxCostUsd === "number" && Number.isFinite(value.maxCostUsd) && value.maxCostUsd > 0) && (value.deadlineMs === null || typeof value.deadlineMs === "number" && Number.isInteger(value.deadlineMs) && value.deadlineMs > 0) && (value.minimumQuality === null || typeof value.minimumQuality === "number" && value.minimumQuality >= 0 && value.minimumQuality <= 1) && Array.isArray(value.requiredCapabilities) && value.requiredCapabilities.every((entry) => typeof entry === "string" && entry.length > 0) && typeof value.locality === "string" && LOCALITIES.has(value.locality) && typeof value.failover === "string" && FAILOVERS.has(value.failover);
-}
-function parseRoutingIntent(value, pins = {}) {
-  const errors = [];
-  if (value !== void 0 && !record(value)) return { ok: false, errors: ["routing must be an object"] };
-  const input = value === void 0 ? {} : value;
-  for (const key of Object.keys(input)) if (!KEYS.has(key)) errors.push(`routing unknown key: ${key}`);
-  const pinned = pins.target !== void 0 || pins.model !== void 0 || pins.node !== void 0;
-  const posture = input.posture ?? (pinned ? "manual" : "balanced");
-  if (typeof posture !== "string" || !POSTURES.has(posture)) {
-    errors.push("routing.posture must be one of: manual|quality|balanced|latency|economy");
-  }
-  if (pinned && posture !== "manual") errors.push("exact target, model, or node pins require routing.posture manual");
-  const positive = (key) => {
-    const candidate = input[key];
-    if (candidate === void 0) return null;
-    if (typeof candidate !== "number" || !Number.isFinite(candidate) || candidate <= 0) {
-      errors.push(`routing.${key} must be a finite number greater than zero`);
-      return null;
-    }
-    if (key === "deadlineMs" && !Number.isInteger(candidate)) errors.push("routing.deadlineMs must be an integer");
-    return candidate;
-  };
-  const maxCostUsd = positive("maxCostUsd");
-  const deadlineMs = positive("deadlineMs");
-  let minimumQuality = null;
-  if (input.minimumQuality !== void 0) {
-    if (typeof input.minimumQuality !== "number" || !Number.isFinite(input.minimumQuality) || input.minimumQuality < 0 || input.minimumQuality > 1)
-      errors.push("routing.minimumQuality must be between zero and one");
-    else minimumQuality = input.minimumQuality;
-  }
-  const requiredCapabilities = input.requiredCapabilities ?? [];
-  if (!Array.isArray(requiredCapabilities) || requiredCapabilities.some((entry) => typeof entry !== "string" || entry.trim().length === 0) || new Set(requiredCapabilities).size !== requiredCapabilities.length)
-    errors.push("routing.requiredCapabilities must be an array of unique non-empty strings");
-  const locality = input.locality ?? "any";
-  if (typeof locality !== "string" || !LOCALITIES.has(locality)) {
-    errors.push("routing.locality must be one of: local-only|prefer-local|any");
-  }
-  const failover = input.failover ?? "none";
-  if (typeof failover !== "string" || !FAILOVERS.has(failover)) {
-    errors.push("routing.failover must be one of: none|approved");
-  }
-  if (pinned && failover !== "none") errors.push("manual pins imply routing.failover none");
-  if (errors.length > 0) return { ok: false, errors };
-  return {
-    ok: true,
-    intent: {
-      posture,
-      maxCostUsd,
-      deadlineMs,
-      minimumQuality,
-      requiredCapabilities: [...requiredCapabilities],
-      locality,
-      failover
-    }
-  };
-}
-function defaultRoutingIntent(pins) {
-  const parsed = parseRoutingIntent(void 0, pins);
-  if (!parsed.ok) throw new Error(parsed.errors.join("; "));
-  return parsed.intent;
-}
-function routingIntentRejection(input) {
-  const { intent } = input;
-  if (intent.minimumQuality !== null && input.qualityLowerBound < intent.minimumQuality) return "minimum-quality";
-  if (intent.maxCostUsd !== null && input.costUpperBoundUsd > intent.maxCostUsd) return "max-cost";
-  if (intent.deadlineMs !== null && input.endToEndUpperBoundMs > intent.deadlineMs) return "deadline";
-  if (intent.locality === "local-only" && input.candidate.nodeId !== "local") return "local-only";
-  if (intent.requiredCapabilities.some((capability) => !input.capabilities.includes(capability))) {
-    return "required-capabilities";
-  }
-  return null;
-}
-var ROUTE_EXPLANATION_MAX_BYTES = 4096;
-function safeIdentity(candidate) {
-  const safe = (value) => {
-    const redacted = /(?:https?:\/\/|api[_-]?key|token|secret|password)/i.test(value) ? "[redacted]" : value;
-    return redacted.length <= 128 ? redacted : `${redacted.slice(0, 127)}\u2026`;
-  };
-  return {
-    ...candidate,
-    agentId: safe(candidate.agentId),
-    specFingerprint: safe(candidate.specFingerprint),
-    targetId: safe(candidate.targetId),
-    modelId: safe(candidate.modelId),
-    runtimeId: safe(candidate.runtimeId),
-    nodeId: safe(candidate.nodeId),
-    ...candidate.thinkingLevel !== void 0 ? { thinkingLevel: safe(candidate.thinkingLevel) } : {},
-    toolSignature: safe(candidate.toolSignature),
-    promptCompositionHash: safe(candidate.promptCompositionHash),
-    endpointIdentityHash: safe(candidate.endpointIdentityHash),
-    settingsFingerprint: safe(candidate.settingsFingerprint)
-  };
-}
-function explainRouteDecision(decision, intent) {
-  const exclusions = [
-    ...new Set(decision.candidateEvaluations.flatMap((entry) => entry.rejection ? [entry.rejection] : []))
-  ];
-  const explanation = {
-    mode: decision.mode,
-    executedRoute: safeIdentity(decision.executedRoute),
-    shadowRecommendation: decision.mode === "shadow" ? safeIdentity(decision.selected) : null,
-    hardExclusions: exclusions.slice(0, 16),
-    approvedFallbacks: decision.approvedFallbacks.slice(0, 3).map(safeIdentity),
-    costUpperBoundUsd: intent.maxCostUsd,
-    deadlineMs: intent.deadlineMs,
-    confidence: decision.confidence,
-    activeEligible: decision.candidateEvaluations.some(
-      (entry) => entry.rejection === null && entry.activeReadiness.ready
-    ),
-    reasonCodes: decision.reasonCodes.slice(0, 16),
-    decisionHash: decision.decisionHash,
-    agentSelection: {
-      request: decision.agentSelection.request,
-      activation: decision.agentSelection.activation,
-      baselineAgentId: safeIdentity({ ...decision.executedRoute, agentId: decision.agentSelection.baselineAgentId }).agentId,
-      recommendedAgentId: safeIdentity({ ...decision.executedRoute, agentId: decision.agentSelection.recommendedAgentId }).agentId,
-      excluded: decision.agentSelection.evaluations.filter((entry) => entry.rejections.length > 0).slice(0, 16).map((entry) => ({
-        agentId: safeIdentity({ ...decision.executedRoute, agentId: entry.agentId }).agentId,
-        reasons: entry.rejections.slice(0, 8)
-      })),
-      authorityTransition: decision.agentSelection.authorityTransition === null ? null : {
-        ...decision.agentSelection.authorityTransition,
-        from: safeIdentity({
-          ...decision.executedRoute,
-          agentId: decision.agentSelection.authorityTransition.from
-        }).agentId,
-        to: safeIdentity({
-          ...decision.executedRoute,
-          agentId: decision.agentSelection.authorityTransition.to
-        }).agentId
-      }
-    }
-  };
-  if (Buffer.byteLength(JSON.stringify(explanation), "utf8") <= ROUTE_EXPLANATION_MAX_BYTES) return explanation;
-  const compact = {
-    ...explanation,
-    approvedFallbacks: explanation.approvedFallbacks.slice(0, 1),
-    hardExclusions: explanation.hardExclusions.slice(0, 4),
-    reasonCodes: explanation.reasonCodes.slice(0, 4),
-    agentSelection: {
-      ...explanation.agentSelection,
-      excluded: explanation.agentSelection.excluded.slice(0, 4).map((entry) => ({ ...entry, reasons: entry.reasons.slice(0, 2) }))
-    }
-  };
-  if (Buffer.byteLength(JSON.stringify(compact), "utf8") <= ROUTE_EXPLANATION_MAX_BYTES) return compact;
-  return {
-    ...compact,
-    shadowRecommendation: null,
-    approvedFallbacks: [],
-    hardExclusions: compact.hardExclusions.slice(0, 2),
-    reasonCodes: compact.reasonCodes.slice(0, 2),
-    agentSelection: {
-      ...compact.agentSelection,
-      excluded: []
-    }
-  };
-}
-
-// src/domains/dispatch/receipt-integrity.ts
-var RUN_RECEIPT_INTEGRITY_VERSION = 15;
-var RUN_RECEIPT_INTEGRITY_ALGORITHM = "sha256";
-function sha256(input) {
-  return createHash2("sha256").update(input, "utf8").digest("hex");
-}
-function canonicalJson(value) {
-  return serializeCanonical(value);
-}
-function serializeCanonical(value) {
-  if (value === null) return "null";
-  if (typeof value === "number") {
-    if (!Number.isFinite(value)) {
-      throw new Error(`receipt integrity: non-finite number ${String(value)} is not representable`);
-    }
-    return JSON.stringify(value);
-  }
-  if (typeof value === "string" || typeof value === "boolean") return JSON.stringify(value);
-  if (typeof value === "bigint") throw new Error("receipt integrity: bigint is not representable");
-  if (typeof value === "symbol" || typeof value === "function") {
-    throw new Error(`receipt integrity: ${typeof value} is not representable`);
-  }
-  if (value === void 0) throw new Error("receipt integrity: undefined is not representable at root");
-  if (Array.isArray(value)) {
-    const parts = [];
-    for (let i = 0; i < value.length; i++) {
-      if (!(i in value) || value[i] === void 0) {
-        parts.push("null");
-        continue;
-      }
-      parts.push(serializeCanonical(value[i]));
-    }
-    return `[${parts.join(",")}]`;
-  }
-  if (typeof value === "object") {
-    const obj = value;
-    const keys = Object.keys(obj).sort();
-    const parts = [];
-    for (const key of keys) {
-      const child = obj[key];
-      if (child === void 0) continue;
-      parts.push(`${JSON.stringify(key)}:${serializeCanonical(child)}`);
-    }
-    return `{${parts.join(",")}}`;
-  }
-  throw new Error(`receipt integrity: unsupported value of type ${typeof value}`);
-}
-var RECEIPT_INTEGRITY_FIELD_COVERAGE = {
-  runId: true,
-  agentId: true,
-  executionRole: true,
-  agentAudience: true,
-  requestOrigin: true,
-  task: true,
-  targetId: true,
-  wireModelId: true,
-  runtimeId: true,
-  runtimeKind: true,
-  startedAt: true,
-  endedAt: true,
-  outcome: true,
-  outcomeDetail: true,
-  lineage: true,
-  identity: true,
-  node: true,
-  attestation: true,
-  reroutes: true,
-  pipeline: true,
-  gate: true,
-  plan: true,
-  personaOverride: true,
-  projectContext: true,
-  exitCode: true,
-  failureMessage: true,
-  tokenCount: true,
-  inputTokenCount: true,
-  outputTokenCount: true,
-  cacheReadTokenCount: true,
-  cacheWriteTokenCount: true,
-  reasoningTokenCount: true,
-  upstreamResponses: true,
-  output: true,
-  costUsd: true,
-  costProvenance: true,
-  compiledPromptHash: true,
-  staticCompositionHash: true,
-  staticShellHash: true,
-  sessionShellHash: true,
-  dynamicHash: true,
-  promptSignature: true,
-  toolSignature: true,
-  clioVersion: true,
-  piMonoVersion: true,
-  platform: true,
-  nodeVersion: true,
-  toolCalls: true,
-  toolStats: true,
-  toolActivity: true,
-  verification: true,
-  routingIntent: true,
-  quality: true,
-  skillActivations: true,
-  autonomyEnforcement: true,
-  safety: true,
-  reproducibility: true,
-  runtimeResolution: true,
-  delegation: true,
-  findingsSummary: true,
-  // Both are optional and absent unless the run produced the condition they
-  // name, so a receipt that carries neither digests exactly as it did before
-  // they existed and the integrity version stays where it is.
-  validationGrounding: true,
-  capabilityMismatch: true,
-  // Same reasoning: absent unless the run had an agent ledger, so a receipt
-  // without one digests byte-identically to one produced before it existed.
-  ledgerContribution: true,
-  sessionId: true,
-  briefing: true,
-  outcomeCode: true,
-  steering: true,
-  routeDecision: true
-};
-var RECEIPT_FIELDS = Object.keys(RECEIPT_INTEGRITY_FIELD_COVERAGE);
-function selectedReceiptFields(receipt, fields) {
-  const source = receipt;
-  const result = {};
-  for (const field of fields) {
-    const value = source[field];
-    if (value !== void 0) result[field] = value;
-  }
-  return result;
-}
-function receiptDigestFields(receipt) {
-  const result = selectedReceiptFields(receipt, RECEIPT_FIELDS);
-  result.briefing = receipt.briefing ?? null;
-  result.outcomeCode = receipt.outcomeCode ?? null;
-  result.steering = receipt.steering ?? null;
-  return result;
-}
-function ledgerDigestFields(envelope) {
-  return {
-    id: envelope.id,
-    agentId: envelope.agentId,
-    executionRole: envelope.executionRole,
-    task: envelope.task,
-    targetId: envelope.targetId,
-    wireModelId: envelope.wireModelId,
-    runtimeId: envelope.runtimeId,
-    runtimeKind: envelope.runtimeKind,
-    startedAt: envelope.startedAt,
-    endedAt: envelope.endedAt,
-    status: envelope.status,
-    exitCode: envelope.exitCode,
-    sessionId: envelope.sessionId,
-    cwd: envelope.cwd,
-    tokenCount: envelope.tokenCount,
-    cacheReadTokenCount: envelope.cacheReadTokenCount,
-    cacheWriteTokenCount: envelope.cacheWriteTokenCount,
-    reasoningTokenCount: envelope.reasoningTokenCount,
-    staticShellHash: envelope.staticShellHash,
-    sessionShellHash: envelope.sessionShellHash,
-    dynamicHash: envelope.dynamicHash,
-    costUsd: envelope.costUsd,
-    agentAudience: envelope.agentAudience ?? null,
-    requestOrigin: envelope.requestOrigin ?? null,
-    outcome: envelope.outcome ?? null,
-    outcomeDetail: envelope.outcomeDetail ?? null,
-    lineage: envelope.lineage ?? null,
-    identity: envelope.identity ?? null,
-    node: envelope.node ?? null,
-    reroutes: envelope.reroutes ?? null,
-    pipeline: envelope.pipeline ?? null,
-    gate: envelope.gate ?? null,
-    plan: envelope.plan ?? null,
-    personaOverride: envelope.personaOverride ?? null,
-    inputTokenCount: envelope.inputTokenCount ?? 0,
-    outputTokenCount: envelope.outputTokenCount ?? 0,
-    promptSignature: envelope.promptSignature ?? null,
-    toolSignature: envelope.toolSignature ?? null,
-    briefing: envelope.briefing ?? null,
-    outcomeCode: envelope.outcomeCode ?? null,
-    steering: envelope.steering ?? null
-  };
-}
-function integrityPayload(receipt, envelope) {
-  return {
-    contract: "clio.runReceipt.integrity",
-    version: RUN_RECEIPT_INTEGRITY_VERSION,
-    sources: ["receipt", "run-ledger"],
-    receipt: receiptDigestFields(receipt),
-    ledger: ledgerDigestFields(envelope)
-  };
-}
-function computeReceiptIntegrity(receipt, envelope) {
-  return {
-    version: RUN_RECEIPT_INTEGRITY_VERSION,
-    algorithm: RUN_RECEIPT_INTEGRITY_ALGORITHM,
-    digest: sha256(canonicalJson(integrityPayload(receipt, envelope)))
-  };
-}
-function isReceiptQuality(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-  const quality = value;
-  if (quality.version !== 1 || !Array.isArray(quality.typedValidations)) return false;
-  if (!quality.typedValidations.every(
-    (fact) => fact !== null && typeof fact === "object" && typeof fact.sourceId === "string" && typeof fact.validatorDigest === "string" && /^[0-9a-f]{64}$/.test(String(fact.validatorDigest)) && typeof fact.passed === "boolean"
-  ))
-    return false;
-  const schema = quality.responseSchema;
-  if (!schema || typeof schema !== "object" || Array.isArray(schema)) return false;
-  const responseSchema = schema;
-  const resultContract = quality.resultContract;
-  const validResultContract = resultContract === null || resultContract !== void 0 && typeof resultContract === "object" && !Array.isArray(resultContract) && typeof resultContract.sourceId === "string" && typeof resultContract.validatorDigest === "string" && /^[0-9a-f]{64}$/.test(String(resultContract.validatorDigest)) && (resultContract.conformance === "pass" || resultContract.conformance === "fail" || resultContract.conformance === "not-reached") && (resultContract.quality === "pass" || resultContract.quality === "fail" || resultContract.quality === "unmeasured");
-  return (responseSchema.sourceId === null || typeof responseSchema.sourceId === "string") && (responseSchema.schemaDigest === null || typeof responseSchema.schemaDigest === "string" && /^[0-9a-f]{64}$/.test(responseSchema.schemaDigest)) && typeof responseSchema.runtimeEnforceable === "boolean" && (responseSchema.enforcementPassed === null || typeof responseSchema.enforcementPassed === "boolean") && validResultContract;
-}
-function isCurrentRouteDecision(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
-  const decision = value;
-  return decision.policyVersion === ROUTE_POLICY_VERSION && (decision.mode === "fixed" || decision.mode === "shadow" || decision.mode === "active") && isRouteDecisionAgentSelection(decision.agentSelection) && typeof decision.decisionHash === "string" && /^[0-9a-f]{64}$/u.test(decision.decisionHash);
-}
-function withReceiptIntegrity(receipt, envelope) {
-  if (!isReceiptQuality(receipt.quality)) throw new Error("receipt integrity: required quality block invalid");
-  if (!isExecutionRole(receipt.executionRole)) throw new Error("receipt integrity: required execution role invalid");
-  if (!isRoutingIntent(receipt.routingIntent)) {
-    throw new Error("receipt integrity: required routing intent invalid");
-  }
-  if (receipt.routeDecision !== void 0 && !isCurrentRouteDecision(receipt.routeDecision)) {
-    throw new Error("receipt integrity: route decision is invalid or retired");
-  }
-  return {
-    ...receipt,
-    routingIntent: receipt.routingIntent,
-    integrity: computeReceiptIntegrity(receipt, envelope)
-  };
-}
-function isReceiptIntegrity(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-  const candidate = value;
-  return candidate.version === RUN_RECEIPT_INTEGRITY_VERSION && candidate.algorithm === RUN_RECEIPT_INTEGRITY_ALGORITHM && typeof candidate.digest === "string" && /^[0-9a-f]{64}$/.test(candidate.digest);
-}
-function firstLedgerMismatch(receipt, envelope) {
-  const sharedFields = [
-    ["runId", receipt.runId, envelope.id],
-    ["agentId", receipt.agentId, envelope.agentId],
-    ["executionRole", receipt.executionRole, envelope.executionRole],
-    ["agentAudience", receipt.agentAudience, envelope.agentAudience],
-    ["requestOrigin", receipt.requestOrigin, envelope.requestOrigin],
-    ["task", receipt.task, envelope.task],
-    ["targetId", receipt.targetId, envelope.targetId],
-    ["wireModelId", receipt.wireModelId, envelope.wireModelId],
-    ["runtimeId", receipt.runtimeId, envelope.runtimeId],
-    ["runtimeKind", receipt.runtimeKind, envelope.runtimeKind],
-    ["startedAt", receipt.startedAt, envelope.startedAt],
-    ["endedAt", receipt.endedAt, envelope.endedAt],
-    ["exitCode", receipt.exitCode, envelope.exitCode],
-    ["tokenCount", receipt.tokenCount, envelope.tokenCount],
-    ["cacheReadTokenCount", receipt.cacheReadTokenCount ?? 0, envelope.cacheReadTokenCount ?? 0],
-    ["cacheWriteTokenCount", receipt.cacheWriteTokenCount ?? 0, envelope.cacheWriteTokenCount ?? 0],
-    ["reasoningTokenCount", receipt.reasoningTokenCount ?? 0, envelope.reasoningTokenCount ?? 0],
-    ["staticShellHash", receipt.staticShellHash ?? null, envelope.staticShellHash ?? null],
-    ["sessionShellHash", receipt.sessionShellHash ?? null, envelope.sessionShellHash ?? null],
-    ["dynamicHash", receipt.dynamicHash ?? null, envelope.dynamicHash ?? null],
-    ["costUsd", receipt.costUsd, envelope.costUsd],
-    ["sessionId", receipt.sessionId, envelope.sessionId],
-    ["outcome", receipt.outcome ?? null, envelope.outcome ?? null],
-    ["outcomeDetail", receipt.outcomeDetail ?? null, envelope.outcomeDetail ?? null],
-    ["nodeId", receipt.node?.id ?? null, envelope.node?.id ?? null],
-    ["outcomeCode", receipt.outcomeCode ?? null, envelope.outcomeCode ?? null]
-  ];
-  for (const [field, receiptValue, ledgerValue] of sharedFields) {
-    if (!Object.is(receiptValue, ledgerValue)) return field;
-  }
-  if (canonicalJson(receipt.briefing ?? null) !== canonicalJson(envelope.briefing ?? null)) return "briefing";
-  if (canonicalJson(receipt.steering ?? null) !== canonicalJson(envelope.steering ?? null)) return "steering";
-  return null;
-}
-function verifyReceiptIntegrity(receipt, envelope) {
-  if (!isReceiptQuality(receipt.quality) || !isReceiptIntegrity(receipt.integrity)) {
-    return { ok: false, reason: "integrity invalid" };
-  }
-  if (!isExecutionRole(receipt.executionRole)) return { ok: false, reason: "execution role invalid" };
-  if (!isRoutingIntent(receipt.routingIntent)) {
-    return { ok: false, reason: "routing intent invalid" };
-  }
-  if (receipt.routeDecision !== void 0 && !isCurrentRouteDecision(receipt.routeDecision)) {
-    return { ok: false, reason: "route decision invalid" };
-  }
-  const mismatch = firstLedgerMismatch(receipt, envelope);
-  if (mismatch) {
-    return { ok: false, reason: `ledger mismatch: ${mismatch}` };
-  }
-  const expected = computeReceiptIntegrity(receipt, envelope);
-  if (expected.digest !== receipt.integrity.digest) {
-    return { ok: false, reason: "integrity mismatch" };
-  }
-  return { ok: true };
-}
-
-// src/domains/eval/harness-metrics.ts
-var ZERO_EVAL_HARNESS_METRICS = {
-  receiptCount: 0,
-  toolCalls: 0,
-  retries: 0,
-  safetyBlocks: 0,
-  correctionLatencyMs: 0,
-  validationEvidence: 0
-};
-function evalHarnessMetricsFromCommands(commands) {
-  return {
-    ...ZERO_EVAL_HARNESS_METRICS,
-    validationEvidence: commands.filter(
-      (command) => command.phase === "verifier" && command.exitCode === 0 && !command.timedOut
-    ).length
-  };
-}
-function sumEvalHarnessMetrics(records) {
-  return records.reduce((total, record2) => addEvalHarnessMetrics(total, record2.harness), {
-    ...ZERO_EVAL_HARNESS_METRICS
-  });
-}
-function addEvalHarnessMetrics(left, right) {
-  return {
-    receiptCount: left.receiptCount + right.receiptCount,
-    toolCalls: left.toolCalls + right.toolCalls,
-    retries: left.retries + right.retries,
-    safetyBlocks: left.safetyBlocks + right.safetyBlocks,
-    correctionLatencyMs: left.correctionLatencyMs + right.correctionLatencyMs,
-    validationEvidence: left.validationEvidence + right.validationEvidence
-  };
-}
-
-// src/domains/eval/store.ts
-import { readFile } from "node:fs/promises";
-import { join } from "node:path";
-
-// src/domains/eval/artifacts/redact.ts
-var SENSITIVE_KEY = /(?:^|[_-])(api[_-]?key|authorization|cookie|password|secret|token)(?:$|[_-])/i;
-var CREDENTIAL_PATTERNS = [
-  [/\b(authorization\s*[:=]\s*)(?:bearer|basic)\s+[A-Za-z0-9._~+/=-]+/gi, "$1[redacted]"],
-  [/\b(bearer\s+)[A-Za-z0-9._~+/=-]{12,}/gi, "$1[redacted]"],
-  [/\b(sk-[A-Za-z0-9_-]{16,})\b/g, "[redacted]"],
-  [/\b(gh[pousr]_[A-Za-z0-9_]{16,})\b/g, "[redacted]"],
-  [/\b(AKIA[0-9A-Z]{16})\b/g, "[redacted]"],
-  [/\b((?:api[_-]?key|access[_-]?token|refresh[_-]?token|password|secret)\s*[:=]\s*)[^\s"',}]+/gi, "$1[redacted]"]
-];
-function redactArtifactForStorage(value, env = process.env) {
-  return redactValue(value, env);
-}
-function redactValue(value, env) {
-  if (typeof value === "string") return redactString(value, env);
-  if (Array.isArray(value)) return value.map((entry) => redactValue(entry, env));
-  if (value !== null && typeof value === "object") {
-    const out = {};
-    for (const [key, entry] of Object.entries(value)) {
-      out[key] = SENSITIVE_KEY.test(key) ? "[redacted]" : redactValue(entry, env);
-    }
-    return out;
-  }
-  return value;
-}
-function redactString(value, env) {
-  let out = stripHomePrefix(value, env.HOME);
-  for (const [pattern, replacement] of CREDENTIAL_PATTERNS) {
-    out = out.replace(pattern, replacement);
-  }
-  return out;
-}
-function stripHomePrefix(value, home) {
-  if (home === void 0 || home.length === 0) return value;
-  const normalized = home.replace(/\/+$/g, "");
-  if (normalized.length === 0) return value;
-  return value.split(normalized).join("$HOME");
-}
-
-// src/domains/eval/store.ts
-var NODE_SIGNALS = /* @__PURE__ */ new Set([
-  "SIGHUP",
-  "SIGINT",
-  "SIGQUIT",
-  "SIGILL",
-  "SIGTRAP",
-  "SIGABRT",
-  "SIGIOT",
-  "SIGBUS",
-  "SIGFPE",
-  "SIGKILL",
-  "SIGUSR1",
-  "SIGSEGV",
-  "SIGUSR2",
-  "SIGPIPE",
-  "SIGALRM",
-  "SIGTERM",
-  "SIGCHLD",
-  "SIGSTKFLT",
-  "SIGCONT",
-  "SIGSTOP",
-  "SIGTSTP",
-  "SIGTTIN",
-  "SIGTTOU",
-  "SIGURG",
-  "SIGXCPU",
-  "SIGXFSZ",
-  "SIGVTALRM",
-  "SIGPROF",
-  "SIGWINCH",
-  "SIGIO",
-  "SIGPOLL",
-  "SIGPWR",
-  "SIGSYS",
-  "SIGUNUSED"
-]);
-function evalRoot(dataDir) {
-  return join(dataDir, "evals");
-}
-function evalArtifactPath(dataDir, evalId) {
-  assertSafeId(evalId, "eval");
-  return join(evalRoot(dataDir), `${evalId}.json`);
-}
-function createEvalId(startedAt, taskFileHash) {
-  const stamp = startedAt.toISOString().replace(/[-:.]/g, "");
-  return `eval-${stamp}-${taskFileHash.slice(0, 8)}`;
-}
-async function writeEvalArtifact(dataDir, artifact) {
-  const path = evalArtifactPath(dataDir, artifact.evalId);
-  const redacted = redactArtifactForStorage({
-    ...artifact,
-    paths: { ...artifact.paths, artifact: path }
-  });
-  safeResourceWrite(path, `${JSON.stringify(redacted, null, 2)}
-`, { encoding: "utf8" });
-  return path;
-}
-async function loadEvalArtifact(dataDir, evalId) {
-  let raw;
-  try {
-    raw = await readFile(evalArtifactPath(dataDir, evalId), "utf8");
-  } catch (error) {
-    if (isErrorWithCode(error) && error.code === "ENOENT") throw new Error(`eval artifact not found: ${evalId}`);
-    throw error;
-  }
-  const source = evalArtifactPath(dataDir, evalId);
-  const parsed = parseJson(raw, source);
-  return parseArtifact(parsed, source);
-}
-function parseArtifact(value, source) {
-  if (!isRecord(value)) throw new Error(`${source}: expected object`);
-  if (value.version !== 1) throw new Error(`${source}.version: expected 1`);
-  const results = readArray(value, source, "results").map(
-    (entry, index) => parseRecord(entry, `${source}.results[${index}]`)
-  );
-  return {
-    version: 1,
-    evalId: readString(value, source, "evalId"),
-    taskFile: readString(value, source, "taskFile"),
-    taskFileHash: readString(value, source, "taskFileHash"),
-    clio: parseClioProvenance(readRequiredArtifactField(value, source, "clio"), `${source}.clio`),
-    environment: parseEnvironmentProvenance(
-      readRequiredArtifactField(value, source, "environment"),
-      `${source}.environment`
-    ),
-    target: readOptionalNullableString(value, source, "target"),
-    model: readOptionalNullableString(value, source, "model"),
-    thinking: readOptionalNullableString(value, source, "thinking"),
-    paths: parseArtifactPaths(readRequiredArtifactField(value, source, "paths"), `${source}.paths`),
-    repeat: readNumber(value, source, "repeat"),
-    startedAt: readString(value, source, "startedAt"),
-    endedAt: readString(value, source, "endedAt"),
-    summary: parseSummary(value.summary, `${source}.summary`),
-    results
-  };
-}
-function parseSummary(value, source) {
-  if (!isRecord(value)) throw new Error(`${source}: expected object`);
-  return {
-    runs: readNumber(value, source, "runs"),
-    passed: readNumber(value, source, "passed"),
-    failed: readNumber(value, source, "failed"),
-    passRate: readNumber(value, source, "passRate"),
-    tokens: readNumber(value, source, "tokens"),
-    costUsd: readNumber(value, source, "costUsd"),
-    wallTimeMs: readNumber(value, source, "wallTimeMs"),
-    harness: value.harness === void 0 ? { ...ZERO_EVAL_HARNESS_METRICS } : parseHarnessMetrics(value.harness, `${source}.harness`),
-    failureClasses: readArray(value, source, "failureClasses").map(
-      (entry, index) => parseFailureClassCount(entry, `${source}.failureClasses[${index}]`)
-    )
-  };
-}
-function parseRecord(value, source) {
-  if (!isRecord(value)) throw new Error(`${source}: expected object`);
-  const failureClass = readOptionalFailureClass(value, source, "failureClass");
-  const commands = readArray(value, source, "commands").map(
-    (entry, index) => parseCommand(entry, `${source}.commands[${index}]`)
-  );
-  const record2 = {
-    taskId: readString(value, source, "taskId"),
-    runId: readString(value, source, "runId"),
-    repeatIndex: readNumber(value, source, "repeatIndex"),
-    cwd: readString(value, source, "cwd"),
-    prompt: readString(value, source, "prompt"),
-    tags: readStringArray(value, source, "tags"),
-    pass: readBoolean(value, source, "pass"),
-    exitCode: readNumber(value, source, "exitCode"),
-    tokens: readNumber(value, source, "tokens"),
-    costUsd: readNumber(value, source, "costUsd"),
-    wallTimeMs: readNumber(value, source, "wallTimeMs"),
-    harness: value.harness === void 0 ? evalHarnessMetricsFromCommands(commands) : parseHarnessMetrics(value.harness, `${source}.harness`),
-    commands
-  };
-  if (failureClass !== void 0) record2.failureClass = failureClass;
-  const receiptPath = readOptionalString(value, source, "receiptPath");
-  if (receiptPath !== void 0) record2.receiptPath = receiptPath;
-  const evidenceId = readOptionalString(value, source, "evidenceId");
-  if (evidenceId !== void 0) record2.evidenceId = evidenceId;
-  const paths = value.paths === void 0 ? void 0 : parseRunPaths(value.paths, `${source}.paths`);
-  if (paths !== void 0) record2.paths = paths;
-  return record2;
-}
-function parseClioProvenance(value, source) {
-  if (!isRecord(value)) throw new Error(`${source}: expected object`);
-  return {
-    version: readString(value, source, "version"),
-    commit: readNullableString(value, source, "commit"),
-    entry: readString(value, source, "entry")
-  };
-}
-function parseEnvironmentProvenance(value, source) {
-  if (!isRecord(value)) throw new Error(`${source}: expected object`);
-  return {
-    platform: readString(value, source, "platform"),
-    node: readString(value, source, "node")
-  };
-}
-function parseArtifactPaths(value, source) {
-  if (!isRecord(value)) throw new Error(`${source}: expected object`);
-  const out = {
-    taskFile: readString(value, source, "taskFile"),
-    receipts: readStringArray(value, source, "receipts"),
-    sessionLedgers: readStringArray(value, source, "sessionLedgers")
-  };
-  const artifact = readOptionalString(value, source, "artifact");
-  if (artifact !== void 0) out.artifact = artifact;
-  const evidence = readOptionalString(value, source, "evidence");
-  if (evidence !== void 0) out.evidence = evidence;
-  return out;
-}
-function parseRunPaths(value, source) {
-  if (!isRecord(value)) throw new Error(`${source}: expected object`);
-  const out = {};
-  const receipt = readOptionalString(value, source, "receipt");
-  if (receipt !== void 0) out.receipt = receipt;
-  const sessionLedger = readOptionalString(value, source, "sessionLedger");
-  if (sessionLedger !== void 0) out.sessionLedger = sessionLedger;
-  const evidence = readOptionalString(value, source, "evidence");
-  if (evidence !== void 0) out.evidence = evidence;
-  return out;
-}
-function readRequiredArtifactField(record2, source, field) {
-  const value = record2[field];
-  if (value === void 0) {
-    throw new Error(
-      `eval artifact has an invalid schema: missing required field '${field}' in ${source}. Re-run the evaluation suite to generate a complete artifact.`
-    );
-  }
-  return value;
-}
-function parseHarnessMetrics(value, source) {
-  if (!isRecord(value)) throw new Error(`${source}: expected object`);
-  return {
-    receiptCount: readNumber(value, source, "receiptCount"),
-    toolCalls: readNumber(value, source, "toolCalls"),
-    retries: readNumber(value, source, "retries"),
-    safetyBlocks: readNumber(value, source, "safetyBlocks"),
-    correctionLatencyMs: readNumber(value, source, "correctionLatencyMs"),
-    validationEvidence: readNumber(value, source, "validationEvidence")
-  };
-}
-function parseCommand(value, source) {
-  if (!isRecord(value)) throw new Error(`${source}: expected object`);
-  const phase = readString(value, source, "phase");
-  if (phase !== "setup" && phase !== "verifier") throw new Error(`${source}.phase: expected setup or verifier`);
-  return {
-    phase,
-    index: readNumber(value, source, "index"),
-    command: readString(value, source, "command"),
-    exitCode: readNumber(value, source, "exitCode"),
-    signal: readSignal(value.signal, `${source}.signal`),
-    timedOut: readBoolean(value, source, "timedOut"),
-    wallTimeMs: readNumber(value, source, "wallTimeMs"),
-    stdout: readStringAllowEmpty(value, source, "stdout"),
-    stderr: readStringAllowEmpty(value, source, "stderr")
-  };
-}
-function readSignal(value, source) {
-  if (value === null) return null;
-  if (typeof value === "string" && NODE_SIGNALS.has(value)) return value;
-  throw new Error(`${source}: expected signal or null`);
-}
-function parseFailureClassCount(value, source) {
-  if (!isRecord(value)) throw new Error(`${source}: expected object`);
-  return {
-    failureClass: readFailureClass(value, source, "failureClass"),
-    count: readNumber(value, source, "count")
-  };
-}
-function readFailureClass(record2, source, field) {
-  const value = record2[field];
-  if (value === "setup_failed" || value === "verifier_failed" || value === "timeout" || value === "cwd_missing" || value === "command_error") {
-    return value;
-  }
-  throw new Error(`${source}.${field}: expected failure class`);
-}
-function readOptionalFailureClass(record2, source, field) {
-  if (record2[field] === void 0) return void 0;
-  return readFailureClass(record2, source, field);
-}
-function readString(record2, source, field) {
-  const value = record2[field];
-  if (typeof value !== "string" || value.length === 0) throw new Error(`${source}.${field}: expected string`);
-  return value;
-}
-function readStringAllowEmpty(record2, source, field) {
-  const value = record2[field];
-  if (typeof value !== "string") throw new Error(`${source}.${field}: expected string`);
-  return value;
-}
-function readOptionalString(record2, source, field) {
-  const value = record2[field];
-  if (value === void 0) return void 0;
-  if (typeof value !== "string" || value.length === 0) throw new Error(`${source}.${field}: expected string`);
-  return value;
-}
-function readNullableString(record2, source, field) {
-  const value = record2[field];
-  if (value === null) return null;
-  if (typeof value !== "string" || value.length === 0) throw new Error(`${source}.${field}: expected string or null`);
-  return value;
-}
-function readOptionalNullableString(record2, source, field) {
-  const value = record2[field];
-  if (value === void 0 || value === null) return null;
-  if (typeof value !== "string" || value.length === 0) throw new Error(`${source}.${field}: expected string or null`);
-  return value;
-}
-function readStringArray(record2, source, field) {
-  const value = readArray(record2, source, field);
-  const out = [];
-  for (let index = 0; index < value.length; index += 1) {
-    const entry = value[index];
-    if (typeof entry !== "string") throw new Error(`${source}.${field}[${index}]: expected string`);
-    out.push(entry);
-  }
-  return out;
-}
-function readNumber(record2, source, field) {
-  const value = record2[field];
-  if (typeof value !== "number" || !Number.isFinite(value)) throw new Error(`${source}.${field}: expected number`);
-  return value;
-}
-function readBoolean(record2, source, field) {
-  const value = record2[field];
-  if (typeof value !== "boolean") throw new Error(`${source}.${field}: expected boolean`);
-  return value;
-}
-function readArray(record2, source, field) {
-  const value = record2[field];
-  if (!Array.isArray(value)) throw new Error(`${source}.${field}: expected array`);
-  return value;
-}
-function parseJson(raw, source) {
-  try {
-    return JSON.parse(raw);
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    throw new Error(`${source}: invalid JSON: ${message}`);
-  }
-}
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isErrorWithCode(error) {
-  return error instanceof Error && "code" in error && typeof error.code === "string";
-}
-
-// src/domains/eval/artifacts/store.ts
-import { readFile as readFile2 } from "node:fs/promises";
-import { join as join2 } from "node:path";
-function evalArtifactPathV4(dataDir, evalId) {
-  assertSafeId(evalId, "eval");
-  return join2(evalRoot(dataDir), `${evalId}.json`);
-}
-async function writeEvalArtifactV4(dataDir, artifact, out) {
-  const path = out === void 0 ? evalArtifactPathV4(dataDir, artifact.evalId) : out.endsWith(".json") ? out : join2(out, `${artifact.evalId}.json`);
-  safeResourceWrite(path, `${JSON.stringify(redactArtifactForStorage(artifact), null, 2)}
-`, { encoding: "utf8" });
-  return path;
-}
-async function loadEvalArtifactV4(dataDir, evalId) {
-  let raw;
-  try {
-    raw = await readFile2(evalArtifactPathV4(dataDir, evalId), "utf8");
-  } catch (error) {
-    if (error.code === "ENOENT") throw new Error(`eval artifact not found: ${evalId}`);
-    throw error;
-  }
-  return parseEvalArtifactV4(JSON.parse(raw), evalId);
-}
-function parseEvalArtifactV4(value, source) {
-  if (!isRecord2(value)) throw new Error(`${source}: expected object`);
-  if (value.version !== 4) throw new Error(`${source}.version: expected current version 4`);
-  const summary = asRecord(value.summary, `${source}.summary`);
-  const matrix = asRecord(value.matrix, `${source}.matrix`);
-  const suite = asRecord(value.suite, `${source}.suite`);
-  return {
-    version: 4,
-    evalId: readString2(value, source, "evalId"),
-    suite: { id: readString2(suite, `${source}.suite`, "id"), hash: readString2(suite, `${source}.suite`, "hash") },
-    clio: {
-      version: readString2(asRecord(value.clio, `${source}.clio`), `${source}.clio`, "version"),
-      commit: readNullableString2(asRecord(value.clio, `${source}.clio`), `${source}.clio`, "commit"),
-      entry: readString2(asRecord(value.clio, `${source}.clio`), `${source}.clio`, "entry")
-    },
-    environment: {
-      platform: readString2(asRecord(value.environment, `${source}.environment`), `${source}.environment`, "platform"),
-      node: readString2(asRecord(value.environment, `${source}.environment`), `${source}.environment`, "node")
-    },
-    matrix: {
-      target: readString2(matrix, `${source}.matrix`, "target"),
-      model: readNullableString2(matrix, `${source}.matrix`, "model"),
-      thinking: readNullableString2(matrix, `${source}.matrix`, "thinking")
-    },
-    summary: {
-      runs: readNumber2(summary, `${source}.summary`, "runs"),
-      passed: readNumber2(summary, `${source}.summary`, "passed"),
-      failed: readNumber2(summary, `${source}.summary`, "failed"),
-      passRate: readNumber2(summary, `${source}.summary`, "passRate"),
-      tokens: parseTokenAccounting(summary.tokens, `${source}.summary.tokens`),
-      wallTimeMs: readNumber2(summary, `${source}.summary`, "wallTimeMs")
-    },
-    results: readArray2(value, source, "results").map((entry, index) => parseResult(entry, `${source}.results[${index}]`))
-  };
-}
-function parseTokenAccounting(value, source) {
-  const record2 = asRecord(value, source);
-  const measured = readBoolean2(record2, source, "measured");
-  const runs = readNumber2(record2, source, "runs");
-  const measuredRuns = readNumber2(record2, source, "measuredRuns");
-  const countFields = ["input", "output", "total", "cacheRead", "cacheWrite"];
-  if (!measured) {
-    if (measuredRuns !== 0) throw new Error(`${source}.measuredRuns: expected 0 when unmeasured`);
-    const present = countFields.filter((field) => field in record2);
-    if (present.length > 0) throw new Error(`${source}: unmeasured accounting carries no counts (${present.join(", ")})`);
-    return { measured: false, runs, measuredRuns: 0 };
-  }
-  if (measuredRuns <= 0) throw new Error(`${source}.measuredRuns: expected a positive count when measured`);
-  return {
-    measured: true,
-    runs,
-    measuredRuns,
-    input: readNumber2(record2, source, "input"),
-    output: readNumber2(record2, source, "output"),
-    total: readNumber2(record2, source, "total"),
-    cacheRead: readNumber2(record2, source, "cacheRead"),
-    cacheWrite: readNumber2(record2, source, "cacheWrite")
-  };
-}
-function parseResult(value, source) {
-  const record2 = asRecord(value, source);
-  const target = asRecord(record2.target, `${source}.target`);
-  return {
-    assignmentId: readNullableString2(record2, source, "assignmentId"),
-    terminalReceiptDigest: readNullableDigest(record2, source, "terminalReceiptDigest"),
-    taskId: readString2(record2, source, "taskId"),
-    repeatIndex: readNumber2(record2, source, "repeatIndex"),
-    target: {
-      id: readString2(target, `${source}.target`, "id"),
-      model: readNullableString2(target, `${source}.target`, "model"),
-      thinking: readNullableString2(target, `${source}.target`, "thinking")
-    },
-    pass: readBoolean2(record2, source, "pass"),
-    failureClass: readNullableString2(record2, source, "failureClass"),
-    metrics: asRecord(record2.metrics, `${source}.metrics`),
-    artifacts: asRecord(record2.artifacts, `${source}.artifacts`)
-  };
-}
-function asRecord(value, source) {
-  if (isRecord2(value)) return value;
-  throw new Error(`${source}: expected object`);
-}
-function isRecord2(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function readString2(record2, source, field) {
-  const value = record2[field];
-  if (typeof value !== "string" || value.length === 0) throw new Error(`${source}.${field}: expected string`);
-  return value;
-}
-function readNullableString2(record2, source, field) {
-  const value = record2[field];
-  if (value === null) return null;
-  if (typeof value !== "string" || value.length === 0) throw new Error(`${source}.${field}: expected string or null`);
-  return value;
-}
-function readNullableDigest(record2, source, field) {
-  const value = readNullableString2(record2, source, field);
-  if (value !== null && !/^[0-9a-f]{64}$/u.test(value))
-    throw new Error(`${source}.${field}: expected sha256 digest or null`);
-  return value;
-}
-function readNumber2(record2, source, field) {
-  const value = record2[field];
-  if (typeof value !== "number" || !Number.isFinite(value)) throw new Error(`${source}.${field}: expected number`);
-  return value;
-}
-function readBoolean2(record2, source, field) {
-  const value = record2[field];
-  if (typeof value !== "boolean") throw new Error(`${source}.${field}: expected boolean`);
-  return value;
-}
-function readArray2(record2, source, field) {
-  const value = record2[field];
-  if (!Array.isArray(value)) throw new Error(`${source}.${field}: expected array`);
-  return value;
-}
-
-// src/domains/eval/provenance.ts
-import { spawnSync } from "node:child_process";
-function evalClioProvenance(options = {}) {
-  return {
-    version: readClioVersion(),
-    commit: options.commit === void 0 ? currentClioCommit() : options.commit,
-    entry: options.entry ?? process.argv[1] ?? "unknown"
-  };
-}
-function evalEnvironmentProvenance() {
-  return {
-    platform: `${process.platform}-${process.arch}`,
-    node: process.version
-  };
-}
-function currentClioCommit() {
-  const result = spawnSync("git", ["rev-parse", "HEAD"], {
-    cwd: resolvePackageRoot(),
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "ignore"],
-    timeout: 1e3
-  });
-  if (result.status !== 0 || typeof result.stdout !== "string") return null;
-  const value = result.stdout.trim();
-  return value.length > 0 ? value : null;
-}
-
-// src/domains/eval/task-file.ts
-import { createHash as createHash3 } from "node:crypto";
-import { readFile as readFile3 } from "node:fs/promises";
-import { dirname, isAbsolute, relative, resolve } from "node:path";
-import { parse as parseYaml } from "yaml";
-
-// src/domains/eval/types.ts
-var EVAL_TASK_FILE_VERSION = 1;
-
-// src/domains/eval/task-file.ts
-var TASK_KEYS = /* @__PURE__ */ new Set(["id", "prompt", "cwd", "setup", "verifier", "timeoutMs", "tags"]);
-async function loadEvalTaskFile(path) {
-  const resolved = resolve(path);
-  const raw = await readFile3(resolved, "utf8");
-  const result = parseEvalTaskFileYaml(raw);
-  if (!result.valid) {
-    throw new EvalTaskFileError(result.issues);
-  }
-  const baseDir = dirname(resolved);
-  const cwdIssues = validateTaskCwds(result.taskFile.tasks, baseDir);
-  if (cwdIssues.length > 0) throw new EvalTaskFileError(cwdIssues);
-  return {
-    path: resolved,
-    baseDir,
-    contentHash: sha256Hex(raw),
-    taskFile: result.taskFile
-  };
-}
-function parseEvalTaskFileYaml(raw) {
-  let parsed;
-  try {
-    parsed = parseYaml(raw);
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return { valid: false, issues: [{ path: "$", message: `invalid YAML: ${message}` }] };
-  }
-  return validateEvalTaskFile(parsed);
-}
-function validateEvalTaskFile(value) {
-  const issues = [];
-  if (!isRecord3(value)) {
-    return { valid: false, issues: [{ path: "$", message: "expected object" }] };
-  }
-  if (value.version !== EVAL_TASK_FILE_VERSION) {
-    issues.push({ path: "$.version", message: "expected version 1" });
-  }
-  if (!Array.isArray(value.tasks)) {
-    issues.push({ path: "$.tasks", message: "expected non-empty array" });
-    return { valid: false, issues };
-  }
-  if (value.tasks.length === 0) {
-    issues.push({ path: "$.tasks", message: "expected non-empty array" });
-  }
-  const tasks = [];
-  const seenIds = /* @__PURE__ */ new Set();
-  for (let index = 0; index < value.tasks.length; index += 1) {
-    const task = parseTask(value.tasks[index], `$.tasks[${index}]`, issues);
-    if (task === null) continue;
-    if (seenIds.has(task.id)) {
-      issues.push({ path: `$.tasks[${index}].id`, message: `duplicate task id: ${task.id}` });
-    }
-    seenIds.add(task.id);
-    tasks.push(task);
-  }
-  if (issues.length > 0) return { valid: false, issues };
-  return { valid: true, taskFile: { version: 1, tasks } };
-}
-var EvalTaskFileError = class extends Error {
-  issues;
-  constructor(issues) {
-    super(`eval task file invalid (${issues.length} ${issues.length === 1 ? "issue" : "issues"})`);
-    this.name = "EvalTaskFileError";
-    this.issues = [...issues];
-  }
-};
-function parseTask(value, path, issues) {
-  if (!isRecord3(value)) {
-    issues.push({ path, message: "expected object" });
-    return null;
-  }
-  for (const key of Object.keys(value).sort((a, b) => a.localeCompare(b))) {
-    if (!TASK_KEYS.has(key)) issues.push({ path: `${path}.${key}`, message: "unknown field" });
-  }
-  const id = readNonEmptyString(value, path, "id", issues);
-  if (id !== null && !/^[A-Za-z0-9._-]+$/.test(id)) {
-    issues.push({ path: `${path}.id`, message: "expected id with letters, numbers, dots, underscores, or hyphens" });
-  }
-  const prompt = readNonEmptyString(value, path, "prompt", issues);
-  const cwd = readNonEmptyString(value, path, "cwd", issues);
-  if (cwd !== null && isAbsolute(cwd)) {
-    issues.push({ path: `${path}.cwd`, message: "expected repo-local relative path" });
-  }
-  const setup = readStringArray2(value, path, "setup", issues, true);
-  const verifier = readStringArray2(value, path, "verifier", issues, false);
-  if (verifier !== null && verifier.length === 0) {
-    issues.push({ path: `${path}.verifier`, message: "expected at least one command" });
-  }
-  const timeoutMs = readPositiveInteger(value, path, "timeoutMs", issues);
-  const tags = readStringArray2(value, path, "tags", issues, true);
-  if (id === null || prompt === null || cwd === null || setup === null || verifier === null || timeoutMs === null) {
-    return null;
-  }
-  return { id, prompt, cwd, setup, verifier, timeoutMs, tags: tags ?? [] };
-}
-function validateTaskCwds(tasks, baseDir) {
-  const issues = [];
-  for (let index = 0; index < tasks.length; index += 1) {
-    const task = tasks[index];
-    if (task === void 0) continue;
-    const resolved = resolve(baseDir, task.cwd);
-    const rel = relative(baseDir, resolved);
-    if (rel === "" || !rel.startsWith("..") && !isAbsolute(rel)) continue;
-    issues.push({ path: `$.tasks[${index}].cwd`, message: "cwd must stay within the task file directory" });
-  }
-  return issues;
-}
-function readNonEmptyString(record2, path, field, issues) {
-  const value = record2[field];
-  if (typeof value !== "string" || value.trim().length === 0) {
-    issues.push({ path: `${path}.${field}`, message: "expected non-empty string" });
-    return null;
-  }
-  return value;
-}
-function readStringArray2(record2, path, field, issues, allowMissing) {
-  const value = record2[field];
-  if (value === void 0 && allowMissing) return [];
-  if (!Array.isArray(value)) {
-    issues.push({ path: `${path}.${field}`, message: "expected string array" });
-    return null;
-  }
-  const out = [];
-  for (let index = 0; index < value.length; index += 1) {
-    const entry = value[index];
-    if (typeof entry !== "string" || entry.trim().length === 0) {
-      issues.push({ path: `${path}.${field}[${index}]`, message: "expected non-empty string" });
-      continue;
-    }
-    out.push(entry);
-  }
-  return out;
-}
-function readPositiveInteger(record2, path, field, issues) {
-  const value = record2[field];
-  if (typeof value !== "number" || !Number.isInteger(value) || value <= 0) {
-    issues.push({ path: `${path}.${field}`, message: "expected positive integer" });
-    return null;
-  }
-  return value;
-}
-function isRecord3(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function sha256Hex(content) {
-  return createHash3("sha256").update(content, "utf8").digest("hex");
-}
-
 export {
   isExecutionRole,
   deriveExecutionRole,
@@ -2094,22 +1082,6 @@ export {
   parseRoutingIntent,
   defaultRoutingIntent,
   routingIntentRejection,
-  explainRouteDecision,
-  withReceiptIntegrity,
-  isReceiptIntegrity,
-  verifyReceiptIntegrity,
-  redactArtifactForStorage,
-  ZERO_EVAL_HARNESS_METRICS,
-  sumEvalHarnessMetrics,
-  createEvalId,
-  writeEvalArtifact,
-  loadEvalArtifact,
-  writeEvalArtifactV4,
-  loadEvalArtifactV4,
-  parseEvalArtifactV4,
-  evalClioProvenance,
-  evalEnvironmentProvenance,
-  loadEvalTaskFile,
-  EvalTaskFileError
+  explainRouteDecision
 };
-//# sourceMappingURL=chunk-7BHLZB3A.js.map
+//# sourceMappingURL=chunk-GGXXDWE4.js.map