@iowarp/clio-coder 0.3.8 → 0.3.9

package/dist/{chunk-K4XHGFR5.js → chunk-MLOK6ZOS.js}

@@ -3,13 +3,16 @@ import {
   ROUTE_POLICY_VERSION,
   isRouteDecisionAgentSelection,
   isRoutingIntent
-} from "./chunk-P43ETTHK.js";
+} from "./chunk-VPTUJU4P.js";
 import {
   isExecutionRole
 } from "./chunk-H7IXIC72.js";
+import {
+  readSettings
+} from "./chunk-PNY46YEY.js";
 import {
   assertSafeId
-} from "./chunk-R346GLFC.js";
+} from "./chunk-KV2AOLDF.js";
 import {
   readClioVersion,
   resolvePackageRoot
@@ -357,6 +360,16 @@ function evalHarnessMetricsFromCommands(commands) {
     ).length
   };
 }
+function evalHarnessMetricsFromReceipt(receipt, extras = {}) {
+  return {
+    receiptCount: 1,
+    toolCalls: receipt.toolCalls,
+    retries: extras.retries ?? 0,
+    safetyBlocks: receipt.safety?.decisions.blocked ?? 0,
+    correctionLatencyMs: extras.correctionLatencyMs ?? 0,
+    validationEvidence: extras.validationEvidence ?? 0
+  };
+}
 function sumEvalHarnessMetrics(records) {
   return records.reduce((total, record) => addEvalHarnessMetrics(total, record.harness), {
     ...ZERO_EVAL_HARNESS_METRICS
@@ -732,6 +745,887 @@ function isErrorWithCode(error) {
 init_esm_shims();
 import { readFile as readFile2 } from "node:fs/promises";
 import { join as join2 } from "node:path";
+
+// src/domains/eval/schema/behavioral.ts
+init_esm_shims();
+import { createHash as createHash3 } from "node:crypto";
+
+// src/domains/eval/schema/verdict.ts
+init_esm_shims();
+var EVAL_VERDICT_SCHEMA_V1 = "clio.eval.verdict.v1";
+var EVAL_TRACKED_METRIC_NAMES = [
+  "modelCalls",
+  "uncachedPrefillTokens",
+  "cacheReadTokens",
+  "generatedTokens",
+  "reasoningTokens",
+  "toolCalls",
+  "toolErrors",
+  "ttftMsFirstCall",
+  "wallClockMs",
+  "contextTokensAtEnd",
+  "compactions"
+];
+function parseEvalVerdictEnvelopeV1(value, source = "verdict") {
+  const record = asRecord(value, source);
+  if (record.schema !== EVAL_VERDICT_SCHEMA_V1) {
+    throw new Error(`${source}.schema: expected ${EVAL_VERDICT_SCHEMA_V1}`);
+  }
+  const scenarioId = readNonEmptyString(record, source, "scenarioId");
+  const trialIndex = readNonNegativeInteger(record, source, "trialIndex");
+  const outcome = readOutcome(record.outcome, `${source}.outcome`);
+  const machinery = readMachinery(record.machinery, `${source}.machinery`);
+  if (machinery === "infrastructure_failure" && outcome === "pass") {
+    throw new Error(`${source}: infrastructure_failure cannot carry a pass outcome`);
+  }
+  if (record.behavioral !== null) throw new Error(`${source}.behavioral: expected null in verdict v1`);
+  const evidence = parseEvidence(record.evidence, `${source}.evidence`);
+  const reason = record.reason === void 0 ? legacyVerdictReason(outcome, machinery, evidence) : readNullableNonEmptyString(record, source, "reason");
+  if (outcome === "fail" && reason === null) throw new Error(`${source}.reason: failed outcome requires a reason`);
+  if (outcome !== "fail" && reason !== null) {
+    throw new Error(`${source}.reason: only a failed outcome can carry a reason`);
+  }
+  return {
+    schema: EVAL_VERDICT_SCHEMA_V1,
+    scenarioId,
+    trialIndex,
+    outcome,
+    machinery,
+    reason,
+    trackedMetrics: parseTrackedMetrics(record.trackedMetrics, `${source}.trackedMetrics`),
+    behavioral: null,
+    evidence
+  };
+}
+function parseTrackedMetrics(value, source) {
+  const record = asRecord(value, source);
+  const expectedColdReasons = asRecord(record.expectedColdReasons, `${source}.expectedColdReasons`);
+  return {
+    modelCalls: readSourcedNumber(record.modelCalls, `${source}.modelCalls`),
+    uncachedPrefillTokens: readSourcedNumber(record.uncachedPrefillTokens, `${source}.uncachedPrefillTokens`),
+    cacheReadTokens: readSourcedNumber(record.cacheReadTokens, `${source}.cacheReadTokens`),
+    generatedTokens: readSourcedNumber(record.generatedTokens, `${source}.generatedTokens`),
+    reasoningTokens: readSourcedNullableNumber(record.reasoningTokens, `${source}.reasoningTokens`),
+    toolCalls: readSourcedNumber(record.toolCalls, `${source}.toolCalls`),
+    toolErrors: readSourcedNumber(record.toolErrors, `${source}.toolErrors`),
+    ttftMsFirstCall: readSourcedNumber(record.ttftMsFirstCall, `${source}.ttftMsFirstCall`),
+    wallClockMs: readSourcedNumber(record.wallClockMs, `${source}.wallClockMs`),
+    contextTokensAtEnd: readSourcedNumber(record.contextTokensAtEnd, `${source}.contextTokensAtEnd`),
+    compactions: readSourcedNumber(record.compactions, `${source}.compactions`),
+    expectedColdReasons: Object.fromEntries(
+      Object.entries(expectedColdReasons).map(([reason, metric]) => {
+        if (reason.trim().length === 0) throw new Error(`${source}.expectedColdReasons: expected non-empty reason`);
+        return [reason, readSourcedNumber(metric, `${source}.expectedColdReasons.${reason}`)];
+      })
+    )
+  };
+}
+function parseEvidence(value, source) {
+  const record = asRecord(value, source);
+  const terminalReceiptDigest = readNullableString2(record, source, "terminalReceiptDigest");
+  if (terminalReceiptDigest !== null && !/^[a-f0-9]{64}$/u.test(terminalReceiptDigest)) {
+    throw new Error(`${source}.terminalReceiptDigest: expected sha256 digest or null`);
+  }
+  const graderExitCode = record.graderExitCode;
+  if (graderExitCode !== null && (!Number.isInteger(graderExitCode) || !Number.isFinite(graderExitCode))) {
+    throw new Error(`${source}.graderExitCode: expected integer or null`);
+  }
+  return {
+    assignmentId: readNullableString2(record, source, "assignmentId"),
+    terminalReceiptDigest,
+    graderExitCode
+  };
+}
+function legacyVerdictReason(outcome, machinery, evidence) {
+  if (outcome !== "fail") return null;
+  if (machinery === "infrastructure_failure") return "infrastructure_failure";
+  if (evidence.graderExitCode !== null && evidence.graderExitCode !== 0) return "grader_failed";
+  return "outcome_failed";
+}
+function readSourcedNumber(value, source) {
+  const record = asRecord(value, source);
+  return {
+    value: readNonNegativeNumber(record.value, `${source}.value`),
+    source: readMetricSource(record.source, source)
+  };
+}
+function readSourcedNullableNumber(value, source) {
+  const record = asRecord(value, source);
+  return {
+    value: record.value === null ? null : readNonNegativeNumber(record.value, `${source}.value`),
+    source: readMetricSource(record.source, source)
+  };
+}
+function readMetricSource(value, source) {
+  if (value === "ledger" || value === "receipt" || value === "estimated") return value;
+  throw new Error(`${source}.source: expected ledger, receipt, or estimated`);
+}
+function readOutcome(value, source) {
+  if (value === "pass" || value === "fail" || value === "unmeasured") return value;
+  throw new Error(`${source}: expected pass, fail, or unmeasured`);
+}
+function readMachinery(value, source) {
+  if (value === "ok" || value === "infrastructure_failure") return value;
+  throw new Error(`${source}: expected ok or infrastructure_failure`);
+}
+function readNonNegativeNumber(value, source) {
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+    throw new Error(`${source}: expected non-negative number`);
+  }
+  return value;
+}
+function readNonNegativeInteger(record, source, field) {
+  const value = record[field];
+  if (!Number.isInteger(value) || typeof value !== "number" || value < 0) {
+    throw new Error(`${source}.${field}: expected non-negative integer`);
+  }
+  return value;
+}
+function readNonEmptyString(record, source, field) {
+  const value = record[field];
+  if (typeof value !== "string" || value.trim().length === 0) throw new Error(`${source}.${field}: expected string`);
+  return value;
+}
+function readNullableString2(record, source, field) {
+  const value = record[field];
+  if (value === null) return null;
+  if (typeof value !== "string" || value.length === 0) throw new Error(`${source}.${field}: expected string or null`);
+  return value;
+}
+function readNullableNonEmptyString(record, source, field) {
+  const value = readNullableString2(record, source, field);
+  if (value !== null && value.trim().length === 0) {
+    throw new Error(`${source}.${field}: expected non-empty string or null`);
+  }
+  return value;
+}
+function asRecord(value, source) {
+  if (typeof value === "object" && value !== null && !Array.isArray(value)) return value;
+  throw new Error(`${source}: expected object`);
+}
+
+// src/domains/eval/schema/behavioral.ts
+var EVAL_BEHAVIOR_SCENARIO_SCHEMA_V1 = "clio.eval.scenario.v1";
+var EVAL_BEHAVIOR_SCHEMA_V1 = "clio.eval.behavior.v1";
+var EVAL_BEHAVIOR_CATEGORIES = [
+  "tool_choice",
+  "exploration",
+  "delegation",
+  "safety_comprehension",
+  "claim_grounding",
+  "denied_tool_recovery",
+  "completion_behavior",
+  "task_correctness"
+];
+var MAX_RULES = 64;
+var MAX_FACTS = 128;
+var MAX_EVIDENCE_PER_LABEL = 8;
+var MAX_ID_CHARS = 128;
+var MAX_TEXT_CHARS = 1e3;
+var MAX_EXPLANATION_CHARS = 2e3;
+function parseEvalBehaviorScenarioV1(value, source = "behavioral scenario") {
+  const record = asRecord2(value, source);
+  if (record.schema !== EVAL_BEHAVIOR_SCENARIO_SCHEMA_V1) {
+    throw new Error(`${source}.schema: expected ${EVAL_BEHAVIOR_SCENARIO_SCHEMA_V1}`);
+  }
+  const corpus = asRecord2(record.corpus, `${source}.corpus`);
+  const execution = asRecord2(record.execution, `${source}.execution`);
+  const subject = asRecord2(execution.subject, `${source}.execution.subject`);
+  const mode = execution.mode;
+  if (mode !== "machinery-only" && mode !== "model-required") {
+    throw new Error(`${source}.execution.mode: expected machinery-only or model-required`);
+  }
+  const subjectKind = subject.kind;
+  if (subjectKind !== "main-agent" && subjectKind !== "worker") {
+    throw new Error(`${source}.execution.subject.kind: expected main-agent or worker`);
+  }
+  const toolTarget = execution.toolTarget;
+  if (toolTarget !== "available" && toolTarget !== "none") {
+    throw new Error(`${source}.execution.toolTarget: expected available or none`);
+  }
+  const expectedBehavior = parseRules(record.expectedBehavior, `${source}.expectedBehavior`);
+  const forbiddenBehavior = parseRules(record.forbiddenBehavior, `${source}.forbiddenBehavior`);
+  const ruleIds = /* @__PURE__ */ new Set();
+  for (const rule of [...expectedBehavior, ...forbiddenBehavior]) {
+    if (ruleIds.has(rule.id)) throw new Error(`${source}: duplicate behavioral rule id ${rule.id}`);
+    ruleIds.add(rule.id);
+  }
+  if (ruleIds.size === 0) throw new Error(`${source}: expected at least one behavioral rule`);
+  const judge = asRecord2(record.judge, `${source}.judge`);
+  const maxEvidenceItems = readBoundedInteger(judge.maxEvidenceItems, `${source}.judge.maxEvidenceItems`, 1, MAX_FACTS);
+  const maxExplanationChars = readBoundedInteger(
+    judge.maxExplanationChars,
+    `${source}.judge.maxExplanationChars`,
+    1,
+    MAX_EXPLANATION_CHARS
+  );
+  return {
+    schema: EVAL_BEHAVIOR_SCENARIO_SCHEMA_V1,
+    corpus: {
+      id: readId(corpus.id, `${source}.corpus.id`),
+      version: readText(corpus.version, `${source}.corpus.version`, MAX_ID_CHARS)
+    },
+    execution: {
+      mode,
+      subject: { kind: subjectKind, role: readId(subject.role, `${source}.execution.subject.role`) },
+      toolTarget
+    },
+    expectedBehavior,
+    forbiddenBehavior,
+    judge: { maxEvidenceItems, maxExplanationChars }
+  };
+}
+function canonicalizeEvalBehaviorJudgeInputV1(value, scenario, source = "behavioral judge input") {
+  const record = asRecord2(value, source);
+  if (!Array.isArray(record.facts)) throw new Error(`${source}.facts: expected array`);
+  if (record.facts.length > scenario.judge.maxEvidenceItems || record.facts.length > MAX_FACTS) {
+    throw new Error(`${source}.facts: exceeds bounded evidence limit`);
+  }
+  const facts = record.facts.map((fact, index) => parseFact(fact, `${source}.facts[${index}]`));
+  const factIds = /* @__PURE__ */ new Set();
+  const factKeys = /* @__PURE__ */ new Set();
+  for (const fact of facts) {
+    if (factIds.has(fact.id)) throw new Error(`${source}: duplicate fact id ${fact.id}`);
+    const key = `${fact.source}\0${fact.key}`;
+    if (factKeys.has(key)) throw new Error(`${source}: conflicting fact ${fact.source}.${fact.key}`);
+    factIds.add(fact.id);
+    factKeys.add(key);
+  }
+  const unavailableSources = parseSources(record.unavailableSources, `${source}.unavailableSources`);
+  const infrastructureFailure = record.infrastructureFailure;
+  if (typeof infrastructureFailure !== "boolean") {
+    throw new Error(`${source}.infrastructureFailure: expected boolean`);
+  }
+  const input = {
+    facts: facts.sort((left, right) => left.source.localeCompare(right.source) || left.key.localeCompare(right.key)),
+    unavailableSources: [...new Set(unavailableSources)].sort(),
+    infrastructureFailure
+  };
+  return { input, digest: sha2562(stableJson(input)) };
+}
+function judgeEvalBehaviorV1(scenarioValue, verdict, inputValue) {
+  const scenario = parseEvalBehaviorScenarioV1(scenarioValue);
+  const { input, digest } = canonicalizeEvalBehaviorJudgeInputV1(inputValue, scenario);
+  const labels = EVAL_BEHAVIOR_CATEGORIES.map(
+    (category) => judgeCategory(category, scenario, input, scenario.judge.maxExplanationChars)
+  );
+  const outcome = input.infrastructureFailure ? "infrastructure_failure" : labels.some((label) => label.label === "violated") ? "behavioral_failure" : labels.some((label) => label.label === "unknown") ? "unknown" : labels.every((label) => label.label === "unmeasured") ? "unmeasured" : "pass";
+  return parseEvalBehaviorVerdictV1({
+    schema: EVAL_BEHAVIOR_SCHEMA_V1,
+    verdictRef: {
+      schema: verdict.schema,
+      scenarioId: verdict.scenarioId,
+      trialIndex: verdict.trialIndex
+    },
+    corpus: scenario.corpus,
+    judgeInputDigest: digest,
+    outcome,
+    labels
+  });
+}
+function parseEvalBehaviorVerdictV1(value, source = "behavioral verdict") {
+  const record = asRecord2(value, source);
+  if (record.schema !== EVAL_BEHAVIOR_SCHEMA_V1)
+    throw new Error(`${source}.schema: expected ${EVAL_BEHAVIOR_SCHEMA_V1}`);
+  const verdictRef = asRecord2(record.verdictRef, `${source}.verdictRef`);
+  if (verdictRef.schema !== EVAL_VERDICT_SCHEMA_V1) {
+    throw new Error(`${source}.verdictRef.schema: expected ${EVAL_VERDICT_SCHEMA_V1}`);
+  }
+  const corpus = asRecord2(record.corpus, `${source}.corpus`);
+  const outcome = readOutcome2(record.outcome, `${source}.outcome`);
+  if (!Array.isArray(record.labels)) throw new Error(`${source}.labels: expected array`);
+  const labels = record.labels.map((label, index) => parseLabel(label, `${source}.labels[${index}]`));
+  const categories = labels.map((label) => label.category);
+  if (labels.length !== EVAL_BEHAVIOR_CATEGORIES.length || new Set(categories).size !== EVAL_BEHAVIOR_CATEGORIES.length) {
+    throw new Error(`${source}.labels: expected every behavioral category exactly once`);
+  }
+  for (const category of EVAL_BEHAVIOR_CATEGORIES) {
+    if (!categories.includes(category)) throw new Error(`${source}.labels: missing category ${category}`);
+  }
+  const derived = deriveOutcome(labels, outcome === "infrastructure_failure");
+  if (outcome !== derived) throw new Error(`${source}.outcome: ${outcome} conflicts with labels (expected ${derived})`);
+  return {
+    schema: EVAL_BEHAVIOR_SCHEMA_V1,
+    verdictRef: {
+      schema: EVAL_VERDICT_SCHEMA_V1,
+      scenarioId: readId(verdictRef.scenarioId, `${source}.verdictRef.scenarioId`),
+      trialIndex: readBoundedInteger(verdictRef.trialIndex, `${source}.verdictRef.trialIndex`, 0, Number.MAX_SAFE_INTEGER)
+    },
+    corpus: {
+      id: readId(corpus.id, `${source}.corpus.id`),
+      version: readText(corpus.version, `${source}.corpus.version`, MAX_ID_CHARS)
+    },
+    judgeInputDigest: readDigest(record.judgeInputDigest, `${source}.judgeInputDigest`),
+    outcome,
+    labels
+  };
+}
+function assertEvalBehaviorReferencesVerdictV1(behavior, verdict, source = "behavioral verdict") {
+  if (behavior.verdictRef.scenarioId !== verdict.scenarioId || behavior.verdictRef.trialIndex !== verdict.trialIndex) {
+    throw new Error(`${source}.verdictRef: conflicts with result verdict identity`);
+  }
+  if (verdict.machinery === "infrastructure_failure" && behavior.outcome !== "infrastructure_failure") {
+    throw new Error(`${source}.outcome: machinery failure must remain infrastructure_failure`);
+  }
+  if (behavior.outcome === "pass" && verdict.outcome !== "pass") {
+    throw new Error(`${source}.outcome: behavioral pass cannot override a failed or unmeasured result`);
+  }
+}
+function judgeCategory(category, scenario, input, maxExplanationChars) {
+  const expected = scenario.expectedBehavior.filter((rule) => rule.category === category);
+  const forbidden = scenario.forbiddenBehavior.filter((rule) => rule.category === category);
+  const rules = [...expected, ...forbidden];
+  if (input.infrastructureFailure)
+    return labelResult(category, "unknown", rules, [], "infrastructure failure", maxExplanationChars);
+  if (rules.length === 0) return labelResult(category, "unmeasured", [], [], null, maxExplanationChars);
+  const unavailable = rules.some((rule) => input.unavailableSources.includes(rule.fact.source));
+  if (unavailable)
+    return labelResult(category, "unmeasured", rules, [], "required evidence source unavailable", maxExplanationChars);
+  const evaluations = rules.map((rule) => {
+    const fact = input.facts.find(
+      (candidate) => candidate.source === rule.fact.source && candidate.key === rule.fact.key
+    );
+    if (fact === void 0) return { rule, fact: null, holds: null };
+    const matches = compare(fact.value, rule.fact.op, rule.fact.value);
+    return { rule, fact, holds: expected.includes(rule) ? matches : !matches };
+  });
+  const evidence = evaluations.flatMap(({ fact }) => fact === null ? [] : [toEvidence(fact)]).slice(0, MAX_EVIDENCE_PER_LABEL);
+  if (evaluations.some(({ holds }) => holds === false)) {
+    return labelResult(category, "violated", rules, evidence, "one or more declared rules failed", maxExplanationChars);
+  }
+  if (evaluations.some(({ holds }) => holds === null)) {
+    return labelResult(category, "unknown", rules, evidence, "required observable fact missing", maxExplanationChars);
+  }
+  return labelResult(category, "satisfied", rules, evidence, null, maxExplanationChars);
+}
+function labelResult(category, label, rules, evidence, explanation, maxExplanationChars) {
+  return {
+    category,
+    label,
+    ruleIds: rules.map((rule) => rule.id).sort(),
+    evidence,
+    explanation: explanation === null ? null : explanation.slice(0, maxExplanationChars)
+  };
+}
+function deriveOutcome(labels, infrastructure) {
+  if (infrastructure) return "infrastructure_failure";
+  if (labels.some((label) => label.label === "violated")) return "behavioral_failure";
+  if (labels.some((label) => label.label === "unknown")) return "unknown";
+  if (labels.every((label) => label.label === "unmeasured")) return "unmeasured";
+  return "pass";
+}
+function parseRules(value, source) {
+  if (!Array.isArray(value)) throw new Error(`${source}: expected array`);
+  if (value.length > MAX_RULES) throw new Error(`${source}: exceeds ${MAX_RULES} rules`);
+  return value.map((entry, index) => {
+    const record = asRecord2(entry, `${source}[${index}]`);
+    const fact = asRecord2(record.fact, `${source}[${index}].fact`);
+    const rationale = record.rationale === void 0 ? void 0 : readText(record.rationale, `${source}[${index}].rationale`, MAX_TEXT_CHARS);
+    return {
+      id: readId(record.id, `${source}[${index}].id`),
+      category: readCategory(record.category, `${source}[${index}].category`),
+      fact: {
+        source: readSource(fact.source, `${source}[${index}].fact.source`),
+        key: readText(fact.key, `${source}[${index}].fact.key`, MAX_TEXT_CHARS),
+        op: readOp(fact.op, `${source}[${index}].fact.op`),
+        value: readScalar(fact.value, `${source}[${index}].fact.value`)
+      },
+      ...rationale === void 0 ? {} : { rationale }
+    };
+  });
+}
+function parseFact(value, source) {
+  const record = asRecord2(value, source);
+  const evidence = asRecord2(record.evidence, `${source}.evidence`);
+  return {
+    id: readId(record.id, `${source}.id`),
+    source: readSource(record.source, `${source}.source`),
+    key: readText(record.key, `${source}.key`, MAX_TEXT_CHARS),
+    value: readScalar(record.value, `${source}.value`),
+    evidence: {
+      locator: readText(evidence.locator, `${source}.evidence.locator`, MAX_TEXT_CHARS),
+      digest: readDigest(evidence.digest, `${source}.evidence.digest`),
+      excerpt: evidence.excerpt === null ? null : readText(evidence.excerpt, `${source}.evidence.excerpt`, MAX_TEXT_CHARS)
+    }
+  };
+}
+function parseLabel(value, source) {
+  const record = asRecord2(value, source);
+  const label = record.label;
+  if (label !== "satisfied" && label !== "violated" && label !== "unknown" && label !== "unmeasured") {
+    throw new Error(`${source}.label: expected satisfied, violated, unknown, or unmeasured`);
+  }
+  if (!Array.isArray(record.ruleIds) || !Array.isArray(record.evidence)) {
+    throw new Error(`${source}: expected ruleIds and evidence arrays`);
+  }
+  if (record.evidence.length > MAX_EVIDENCE_PER_LABEL) throw new Error(`${source}.evidence: exceeds bounded limit`);
+  if ((label === "satisfied" || label === "violated") && (record.ruleIds.length === 0 || record.evidence.length === 0)) {
+    throw new Error(`${source}: ${label} label requires a rule and observable evidence`);
+  }
+  const explanation = record.explanation;
+  if (explanation !== null && (typeof explanation !== "string" || explanation.length > MAX_EXPLANATION_CHARS)) {
+    throw new Error(`${source}.explanation: expected bounded string or null`);
+  }
+  return {
+    category: readCategory(record.category, `${source}.category`),
+    label,
+    ruleIds: record.ruleIds.map((id, index) => readId(id, `${source}.ruleIds[${index}]`)),
+    evidence: record.evidence.map((entry, index) => {
+      const evidence = asRecord2(entry, `${source}.evidence[${index}]`);
+      return {
+        factId: readId(evidence.factId, `${source}.evidence[${index}].factId`),
+        source: readSource(evidence.source, `${source}.evidence[${index}].source`),
+        locator: readText(evidence.locator, `${source}.evidence[${index}].locator`, MAX_TEXT_CHARS),
+        digest: readDigest(evidence.digest, `${source}.evidence[${index}].digest`),
+        excerpt: evidence.excerpt === null ? null : readText(evidence.excerpt, `${source}.evidence[${index}].excerpt`, MAX_TEXT_CHARS)
+      };
+    }),
+    explanation
+  };
+}
+function toEvidence(fact) {
+  return { factId: fact.id, source: fact.source, ...fact.evidence };
+}
+function compare(actual, op, expected) {
+  if (op === "eq") return actual === expected;
+  if (op === "neq") return actual !== expected;
+  if (typeof actual !== "number" || typeof expected !== "number") return false;
+  if (op === "lt") return actual < expected;
+  if (op === "lte") return actual <= expected;
+  if (op === "gt") return actual > expected;
+  return actual >= expected;
+}
+function parseSources(value, source) {
+  if (!Array.isArray(value)) throw new Error(`${source}: expected array`);
+  return value.map((entry, index) => readSource(entry, `${source}[${index}]`));
+}
+function readOutcome2(value, source) {
+  if (value === "pass" || value === "behavioral_failure" || value === "unknown" || value === "unmeasured" || value === "infrastructure_failure")
+    return value;
+  throw new Error(`${source}: expected a closed behavioral outcome`);
+}
+function readCategory(value, source) {
+  if (typeof value === "string" && EVAL_BEHAVIOR_CATEGORIES.includes(value)) {
+    return value;
+  }
+  throw new Error(`${source}: expected a closed behavioral category`);
+}
+function readSource(value, source) {
+  if (value === "transcript" || value === "tool" || value === "receipt" || value === "grader") return value;
+  throw new Error(`${source}: expected transcript, tool, receipt, or grader`);
+}
+function readOp(value, source) {
+  if (value === "eq" || value === "neq" || value === "lt" || value === "lte" || value === "gt" || value === "gte") {
+    return value;
+  }
+  throw new Error(`${source}: expected eq, neq, lt, lte, gt, or gte`);
+}
+function readScalar(value, source) {
+  if (typeof value === "boolean") return value;
+  if (typeof value === "number" && Number.isFinite(value)) return value;
+  if (typeof value === "string" && value.length <= MAX_TEXT_CHARS) return value;
+  throw new Error(`${source}: expected bounded string, finite number, or boolean`);
+}
+function readId(value, source) {
+  const id = readText(value, source, MAX_ID_CHARS);
+  if (!/^[A-Za-z0-9._-]+$/u.test(id)) throw new Error(`${source}: expected stable id`);
+  return id;
+}
+function readText(value, source, maxChars) {
+  if (typeof value !== "string" || value.trim().length === 0 || value.length > maxChars) {
+    throw new Error(`${source}: expected non-empty string no longer than ${maxChars} characters`);
+  }
+  return value;
+}
+function readDigest(value, source) {
+  if (typeof value !== "string" || !/^[a-f0-9]{64}$/u.test(value)) throw new Error(`${source}: expected sha256 digest`);
+  return value;
+}
+function readBoundedInteger(value, source, min, max) {
+  if (typeof value !== "number" || !Number.isInteger(value) || value < min || value > max) {
+    throw new Error(`${source}: expected integer from ${min} through ${max}`);
+  }
+  return value;
+}
+function asRecord2(value, source) {
+  if (typeof value === "object" && value !== null && !Array.isArray(value)) return value;
+  throw new Error(`${source}: expected object`);
+}
+function stableJson(value) {
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  if (typeof value === "object" && value !== null) {
+    return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => `${JSON.stringify(key)}:${stableJson(entry)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function sha2562(value) {
+  return createHash3("sha256").update(value, "utf8").digest("hex");
+}
+
+// src/domains/eval/schema/behavioral-metrics.ts
+init_esm_shims();
+var EVAL_BEHAVIOR_METRICS_SCHEMA_V1 = "clio.eval.behavior.metrics.v1";
+var EVAL_BEHAVIOR_METRIC_DEFINITIONS_V1 = [
+  {
+    name: "correctness.taskSolved",
+    family: "correctness",
+    direction: "higher",
+    hardGate: true,
+    source: "grader"
+  },
+  {
+    name: "safety.violations",
+    family: "safety",
+    direction: "lower",
+    hardGate: true,
+    source: "behavioral-label"
+  },
+  {
+    name: "behavior.labelViolations",
+    family: "behavior",
+    direction: "lower",
+    hardGate: false,
+    source: "behavioral-label"
+  },
+  {
+    name: "efficiency.toolCalls",
+    family: "efficiency",
+    direction: "lower",
+    hardGate: false,
+    source: "tool-event"
+  },
+  {
+    name: "exploration.unnecessaryReads",
+    family: "exploration",
+    direction: "lower",
+    hardGate: false,
+    source: "tool-event"
+  },
+  {
+    name: "delegation.quality",
+    family: "delegation",
+    direction: "higher",
+    hardGate: false,
+    source: "behavioral-label"
+  },
+  {
+    name: "claims.unsupported",
+    family: "claims",
+    direction: "lower",
+    hardGate: false,
+    source: "grader"
+  },
+  {
+    name: "tokens.total",
+    family: "tokens",
+    direction: "lower",
+    hardGate: false,
+    source: "runner"
+  },
+  {
+    name: "latency.wallMs",
+    family: "latency",
+    direction: "lower",
+    hardGate: false,
+    source: "runner"
+  },
+  {
+    name: "cost.usd",
+    family: "cost",
+    direction: "lower",
+    hardGate: false,
+    source: "receipt"
+  }
+];
+function buildEvalBehaviorMetricsV1(result, role) {
+  const label = (category) => result.behavioral?.labels.find((entry) => entry.category === category)?.label ?? null;
+  const observedLabels = result.behavioral?.labels.filter(
+    (entry) => entry.label === "satisfied" || entry.label === "violated"
+  );
+  const values = {
+    "correctness.taskSolved": booleanMetric(result.metrics["task.solved"]),
+    "safety.violations": violationMetric(label("safety_comprehension")),
+    "behavior.labelViolations": observedLabels === void 0 || observedLabels.length !== result.behavioral?.labels.length ? null : observedLabels.filter((entry) => entry.label === "violated").length,
+    "efficiency.toolCalls": numberMetric(result.metrics["tools.totalCalls"]),
+    "exploration.unnecessaryReads": numberMetric(result.metrics["tools.read.outsideAllowed"]),
+    "delegation.quality": qualityMetric(label("delegation")),
+    "claims.unsupported": numberMetric(result.metrics["claims.unsupported"]),
+    "tokens.total": numberMetric(result.metrics["tokens.total"]),
+    "latency.wallMs": numberMetric(result.metrics["latency.wallMs"]),
+    "cost.usd": numberMetric(result.metrics["cost.usd"])
+  };
+  const metrics = Object.fromEntries(
+    EVAL_BEHAVIOR_METRIC_DEFINITIONS_V1.map((definition) => [
+      definition.name,
+      { value: values[definition.name], source: definition.source }
+    ])
+  );
+  return {
+    schema: EVAL_BEHAVIOR_METRICS_SCHEMA_V1,
+    scenarioId: result.taskId,
+    role,
+    target: { id: result.target.id, model: result.target.model },
+    metrics
+  };
+}
+function parseEvalBehaviorMetricsV1(value, source = "behavioral metrics") {
+  const record = asRecord3(value, source);
+  if (record.schema !== EVAL_BEHAVIOR_METRICS_SCHEMA_V1) {
+    throw new Error(`${source}.schema: expected ${EVAL_BEHAVIOR_METRICS_SCHEMA_V1}`);
+  }
+  const target = asRecord3(record.target, `${source}.target`);
+  const rawMetrics = asRecord3(record.metrics, `${source}.metrics`);
+  const expectedMetricNames = new Set(EVAL_BEHAVIOR_METRIC_DEFINITIONS_V1.map((definition) => definition.name));
+  for (const metricName of Object.keys(rawMetrics)) {
+    if (!expectedMetricNames.has(metricName)) {
+      throw new Error(`${source}.metrics.${metricName}: unknown behavioral metric`);
+    }
+  }
+  const metrics = Object.fromEntries(
+    EVAL_BEHAVIOR_METRIC_DEFINITIONS_V1.map((definition) => {
+      const observation = asRecord3(rawMetrics[definition.name], `${source}.metrics.${definition.name}`);
+      const metricSource = observation.source;
+      if (metricSource !== definition.source) {
+        throw new Error(`${source}.metrics.${definition.name}.source: expected ${definition.source}`);
+      }
+      const metricValue = observation.value;
+      if (metricValue !== null && (typeof metricValue !== "number" || !Number.isFinite(metricValue))) {
+        throw new Error(`${source}.metrics.${definition.name}.value: expected finite number or null`);
+      }
+      return [definition.name, { value: metricValue, source: metricSource }];
+    })
+  );
+  return {
+    schema: EVAL_BEHAVIOR_METRICS_SCHEMA_V1,
+    scenarioId: readString2(record.scenarioId, `${source}.scenarioId`),
+    role: readString2(record.role, `${source}.role`),
+    target: {
+      id: readString2(target.id, `${source}.target.id`),
+      model: target.model === null ? null : readString2(target.model, `${source}.target.model`)
+    },
+    metrics
+  };
+}
+function numberMetric(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function booleanMetric(value) {
+  return typeof value === "boolean" ? value ? 1 : 0 : null;
+}
+function violationMetric(label) {
+  if (label === "violated") return 1;
+  if (label === "satisfied") return 0;
+  return null;
+}
+function qualityMetric(label) {
+  if (label === "satisfied") return 1;
+  if (label === "violated") return 0;
+  return null;
+}
+function asRecord3(value, source) {
+  if (typeof value === "object" && value !== null && !Array.isArray(value)) return value;
+  throw new Error(`${source}: expected object`);
+}
+function readString2(value, source) {
+  if (typeof value === "string" && value.length > 0) return value;
+  throw new Error(`${source}: expected non-empty string`);
+}
+
+// src/domains/eval/schema/execution-envelope.ts
+init_esm_shims();
+var EVAL_EXECUTION_ENVELOPE_SCHEMA_V1 = "clio.eval.execution-envelope.v1";
+var EVAL_EXECUTION_MATRIX_DIMENSIONS_V1 = [
+  "prompt",
+  "recipe",
+  "target",
+  "wireModel",
+  "runtime",
+  "thinkingLevel",
+  "toolSignature",
+  "autonomy",
+  "policy",
+  "projectContext",
+  "corpus"
+];
+function parseEvalExecutionEnvelopeV1(value, source = "execution envelope") {
+  const record = asRecord4(value, source);
+  if (record.schema !== EVAL_EXECUTION_ENVELOPE_SCHEMA_V1) {
+    throw new Error(`${source}.schema: expected ${EVAL_EXECUTION_ENVELOPE_SCHEMA_V1}`);
+  }
+  const prompt = asRecord4(record.prompt, `${source}.prompt`);
+  if (!Array.isArray(prompt.fragments)) throw new Error(`${source}.prompt.fragments: expected array`);
+  const fragments = prompt.fragments.map((entry, index) => {
+    const fragment = asRecord4(entry, `${source}.prompt.fragments[${index}]`);
+    const version = fragment.version;
+    if (version !== "unversioned" && (!Number.isInteger(version) || typeof version !== "number" || version <= 0)) {
+      throw new Error(`${source}.prompt.fragments[${index}].version: expected positive integer or unversioned`);
+    }
+    return {
+      id: readString3(fragment.id, `${source}.prompt.fragments[${index}].id`),
+      version,
+      contentHash: readDigest2(fragment.contentHash, `${source}.prompt.fragments[${index}].contentHash`)
+    };
+  });
+  const fragmentIds = fragments.map((fragment) => fragment.id);
+  if (new Set(fragmentIds).size !== fragmentIds.length) {
+    throw new Error(`${source}.prompt.fragments: duplicate fragment id`);
+  }
+  const recipe = record.recipe === null ? null : (() => {
+    const value2 = asRecord4(record.recipe, `${source}.recipe`);
+    const version = value2.version;
+    if (!Number.isInteger(version) || typeof version !== "number" || version <= 0) {
+      throw new Error(`${source}.recipe.version: expected positive integer`);
+    }
+    return {
+      id: readString3(value2.id, `${source}.recipe.id`),
+      version,
+      contentHash: readDigest2(value2.contentHash, `${source}.recipe.contentHash`)
+    };
+  })();
+  const policyHashes = asRecord4(record.policyHashes, `${source}.policyHashes`);
+  const projectContext = asRecord4(record.projectContext, `${source}.projectContext`);
+  const projectKind = projectContext.kind;
+  if (projectKind !== "none" && projectKind !== "session" && projectKind !== "worker") {
+    throw new Error(`${source}.projectContext.kind: expected none, session, or worker`);
+  }
+  const corpus = asRecord4(record.corpus, `${source}.corpus`);
+  return {
+    schema: EVAL_EXECUTION_ENVELOPE_SCHEMA_V1,
+    prompt: {
+      fragments,
+      compositionHash: readNullableDigest(prompt.compositionHash, `${source}.prompt.compositionHash`)
+    },
+    recipe,
+    target: readString3(record.target, `${source}.target`),
+    wireModel: readNullableString3(record.wireModel, `${source}.wireModel`),
+    runtime: readNullableString3(record.runtime, `${source}.runtime`),
+    thinkingLevel: readNullableString3(record.thinkingLevel, `${source}.thinkingLevel`),
+    toolSignature: readNullableDigest(record.toolSignature, `${source}.toolSignature`),
+    autonomy: readNullableString3(record.autonomy, `${source}.autonomy`),
+    policyHashes: {
+      rulePack: readNullableDigest(policyHashes.rulePack, `${source}.policyHashes.rulePack`),
+      project: readNullableDigest(policyHashes.project, `${source}.policyHashes.project`)
+    },
+    projectContext: {
+      kind: projectKind,
+      tier: readNullableString3(projectContext.tier, `${source}.projectContext.tier`),
+      contentHash: readNullableDigest(projectContext.contentHash, `${source}.projectContext.contentHash`),
+      chars: readNullableNonNegativeInteger(projectContext.chars, `${source}.projectContext.chars`),
+      sections: readStringArray2(projectContext.sections, `${source}.projectContext.sections`),
+      rulesApplied: readStringArray2(projectContext.rulesApplied, `${source}.projectContext.rulesApplied`),
+      operatorProfileApplied: readNullableBoolean(
+        projectContext.operatorProfileApplied,
+        `${source}.projectContext.operatorProfileApplied`
+      )
+    },
+    corpus: {
+      id: readString3(corpus.id, `${source}.corpus.id`),
+      version: readString3(corpus.version, `${source}.corpus.version`)
+    }
+  };
+}
+function parseEvalExecutionMatrixDimensionsV1(value, source) {
+  if (!Array.isArray(value)) throw new Error(`${source}: expected array`);
+  const allowed = new Set(EVAL_EXECUTION_MATRIX_DIMENSIONS_V1);
+  const dimensions = value.map((entry, index) => {
+    if (typeof entry !== "string" || !allowed.has(entry)) {
+      throw new Error(`${source}[${index}]: expected a declared execution-envelope dimension`);
+    }
+    return entry;
+  });
+  if (new Set(dimensions).size !== dimensions.length) throw new Error(`${source}: duplicate matrix dimension`);
+  return dimensions;
+}
+function readString3(value, source) {
+  if (typeof value !== "string" || value.length === 0) throw new Error(`${source}: expected non-empty string`);
+  return value;
+}
+function readNullableString3(value, source) {
+  if (value === null) return null;
+  return readString3(value, source);
+}
+function readDigest2(value, source) {
+  const digest = readString3(value, source);
+  if (!/^[a-f0-9]{64}$/u.test(digest)) throw new Error(`${source}: expected sha256 digest`);
+  return digest;
+}
+function readNullableDigest(value, source) {
+  return value === null ? null : readDigest2(value, source);
+}
+function readNullableNonNegativeInteger(value, source) {
+  if (value === null) return null;
+  if (typeof value !== "number" || !Number.isInteger(value) || value < 0) {
+    throw new Error(`${source}: expected non-negative integer or null`);
+  }
+  return value;
+}
+function readNullableBoolean(value, source) {
+  if (value === null || typeof value === "boolean") return value;
+  throw new Error(`${source}: expected boolean or null`);
+}
+function readStringArray2(value, source) {
+  if (!Array.isArray(value)) throw new Error(`${source}: expected array`);
+  const entries = value.map((entry, index) => readString3(entry, `${source}[${index}]`));
+  if (new Set(entries).size !== entries.length) throw new Error(`${source}: duplicate value`);
+  return entries;
+}
+function asRecord4(value, source) {
+  if (typeof value === "object" && value !== null && !Array.isArray(value)) return value;
+  throw new Error(`${source}: expected object`);
+}
+
+// src/domains/eval/schema/serving.ts
+init_esm_shims();
+function parseEvalServingConfigurationV1(value, source) {
+  const record = asRecord5(value, source);
+  const targetId = readString4(record.targetId, `${source}.targetId`);
+  const totalSlots = record.total_slots;
+  if (totalSlots !== null && (typeof totalSlots !== "number" || !Number.isInteger(totalSlots) || totalSlots <= 0)) {
+    throw new Error(`${source}.total_slots: expected positive integer or null`);
+  }
+  const compiledPromptHash = readNullableString4(record.compiledPromptHash, `${source}.compiledPromptHash`);
+  if (compiledPromptHash !== null && !/^[a-f0-9]{64}$/u.test(compiledPromptHash)) {
+    throw new Error(`${source}.compiledPromptHash: expected sha256 digest or null`);
+  }
+  return {
+    targetId,
+    runtimeId: readNullableString4(record.runtimeId, `${source}.runtimeId`),
+    modelId: readNullableString4(record.modelId, `${source}.modelId`),
+    serverBuild: readNullableString4(record.serverBuild, `${source}.serverBuild`),
+    total_slots: totalSlots,
+    thinkingLevel: readNullableString4(record.thinkingLevel, `${source}.thinkingLevel`),
+    compiledPromptHash
+  };
+}
+function sameEvalServingConfiguration(left, right) {
+  return left.targetId === right.targetId && left.runtimeId === right.runtimeId && left.modelId === right.modelId && left.serverBuild === right.serverBuild && left.total_slots === right.total_slots && left.thinkingLevel === right.thinkingLevel && left.compiledPromptHash === right.compiledPromptHash;
+}
+function renderEvalServingConfiguration(config) {
+  return [
+    `target=${config.targetId}`,
+    `runtime=${config.runtimeId ?? "unknown"}`,
+    `model=${config.modelId ?? "unknown"}`,
+    `server_build=${config.serverBuild ?? "unknown"}`,
+    `total_slots=${config.total_slots ?? "unknown"}`,
+    `thinking=${config.thinkingLevel ?? "unknown"}`,
+    `compiled_prompt_hash=${config.compiledPromptHash ?? "unknown"}`
+  ].join(" ");
+}
+function readString4(value, source) {
+  if (typeof value !== "string" || value.length === 0) throw new Error(`${source}: expected string`);
+  return value;
+}
+function readNullableString4(value, source) {
+  if (value === null) return null;
+  if (typeof value !== "string" || value.length === 0) throw new Error(`${source}: expected string or null`);
+  return value;
+}
+function asRecord5(value, source) {
+  if (typeof value === "object" && value !== null && !Array.isArray(value)) return value;
+  throw new Error(`${source}: expected object`);
+}
+
+// src/domains/eval/artifacts/store.ts
 function evalArtifactPathV4(dataDir, evalId) {
   assertSafeId(evalId, "eval");
   return join2(evalRoot(dataDir), `${evalId}.json`);
@@ -755,27 +1649,31 @@ async function loadEvalArtifactV4(dataDir, evalId) {
 function parseEvalArtifactV4(value, source) {
   if (!isRecord2(value)) throw new Error(`${source}: expected object`);
   if (value.version !== 4) throw new Error(`${source}.version: expected current version 4`);
-  const summary = asRecord(value.summary, `${source}.summary`);
-  const matrix = asRecord(value.matrix, `${source}.matrix`);
-  const suite = asRecord(value.suite, `${source}.suite`);
+  const summary = asRecord6(value.summary, `${source}.summary`);
+  const matrix = asRecord6(value.matrix, `${source}.matrix`);
+  const suite = asRecord6(value.suite, `${source}.suite`);
+  const servingConfiguration = value.servingConfiguration === void 0 ? void 0 : parseEvalServingConfigurationV1(value.servingConfiguration, `${source}.servingConfiguration`);
+  const aggregates = value.aggregates === void 0 ? void 0 : readArray2(value, source, "aggregates");
   return {
     version: 4,
-    evalId: readString2(value, source, "evalId"),
-    suite: { id: readString2(suite, `${source}.suite`, "id"), hash: readString2(suite, `${source}.suite`, "hash") },
+    evalId: readString5(value, source, "evalId"),
+    suite: { id: readString5(suite, `${source}.suite`, "id"), hash: readString5(suite, `${source}.suite`, "hash") },
     clio: {
-      version: readString2(asRecord(value.clio, `${source}.clio`), `${source}.clio`, "version"),
-      commit: readNullableString2(asRecord(value.clio, `${source}.clio`), `${source}.clio`, "commit"),
-      entry: readString2(asRecord(value.clio, `${source}.clio`), `${source}.clio`, "entry")
+      version: readString5(asRecord6(value.clio, `${source}.clio`), `${source}.clio`, "version"),
+      commit: readNullableString5(asRecord6(value.clio, `${source}.clio`), `${source}.clio`, "commit"),
+      entry: readString5(asRecord6(value.clio, `${source}.clio`), `${source}.clio`, "entry")
     },
     environment: {
-      platform: readString2(asRecord(value.environment, `${source}.environment`), `${source}.environment`, "platform"),
-      node: readString2(asRecord(value.environment, `${source}.environment`), `${source}.environment`, "node")
+      platform: readString5(asRecord6(value.environment, `${source}.environment`), `${source}.environment`, "platform"),
+      node: readString5(asRecord6(value.environment, `${source}.environment`), `${source}.environment`, "node")
     },
     matrix: {
-      target: readString2(matrix, `${source}.matrix`, "target"),
-      model: readNullableString2(matrix, `${source}.matrix`, "model"),
-      thinking: readNullableString2(matrix, `${source}.matrix`, "thinking")
+      target: readString5(matrix, `${source}.matrix`, "target"),
+      model: readNullableString5(matrix, `${source}.matrix`, "model"),
+      thinking: readNullableString5(matrix, `${source}.matrix`, "thinking"),
+      ...matrix.dimensions === void 0 ? {} : { dimensions: parseEvalExecutionMatrixDimensionsV1(matrix.dimensions, `${source}.matrix.dimensions`) }
     },
+    ...servingConfiguration === void 0 ? {} : { servingConfiguration },
     summary: {
       runs: readNumber2(summary, `${source}.summary`, "runs"),
       passed: readNumber2(summary, `${source}.summary`, "passed"),
@@ -784,11 +1682,12 @@ function parseEvalArtifactV4(value, source) {
       tokens: parseTokenAccounting(summary.tokens, `${source}.summary.tokens`),
       wallTimeMs: readNumber2(summary, `${source}.summary`, "wallTimeMs")
     },
+    ...aggregates === void 0 ? {} : { aggregates },
     results: readArray2(value, source, "results").map((entry, index) => parseResult(entry, `${source}.results[${index}]`))
   };
 }
 function parseTokenAccounting(value, source) {
-  const record = asRecord(value, source);
+  const record = asRecord6(value, source);
   const measured = readBoolean2(record, source, "measured");
   const runs = readNumber2(record, source, "runs");
   const measuredRuns = readNumber2(record, source, "measuredRuns");
@@ -812,44 +1711,73 @@ function parseTokenAccounting(value, source) {
   };
 }
 function parseResult(value, source) {
-  const record = asRecord(value, source);
-  const target = asRecord(record.target, `${source}.target`);
+  const record = asRecord6(value, source);
+  const target = asRecord6(record.target, `${source}.target`);
+  const verdict = record.verdict === void 0 ? void 0 : parseEvalVerdictEnvelopeV1(record.verdict, `${source}.verdict`);
+  const behavioral = record.behavioral === void 0 ? void 0 : parseEvalBehaviorVerdictV1(record.behavioral, `${source}.behavioral`);
+  const behavioralMetrics = record.behavioralMetrics === void 0 ? void 0 : parseEvalBehaviorMetricsV1(record.behavioralMetrics, `${source}.behavioralMetrics`);
+  const executionEnvelope = record.executionEnvelope === void 0 ? void 0 : parseEvalExecutionEnvelopeV1(record.executionEnvelope, `${source}.executionEnvelope`);
+  if (behavioral !== void 0 && verdict === void 0) {
+    throw new Error(`${source}.behavioral: sibling document requires a verdict`);
+  }
+  if (behavioral !== void 0 && verdict !== void 0) {
+    assertEvalBehaviorReferencesVerdictV1(behavioral, verdict, `${source}.behavioral`);
+  }
+  if (behavioralMetrics !== void 0) {
+    if (behavioral === void 0) throw new Error(`${source}.behavioralMetrics: requires a behavioral verdict`);
+    if (behavioralMetrics.scenarioId !== readString5(record, source, "taskId")) {
+      throw new Error(`${source}.behavioralMetrics.scenarioId: conflicts with result taskId`);
+    }
+    if (behavioralMetrics.target.id !== readString5(target, `${source}.target`, "id") || behavioralMetrics.target.model !== readNullableString5(target, `${source}.target`, "model")) {
+      throw new Error(`${source}.behavioralMetrics.target: conflicts with result target`);
+    }
+  }
+  if (executionEnvelope !== void 0) {
+    if (behavioral === void 0) throw new Error(`${source}.executionEnvelope: requires a behavioral verdict`);
+    if (executionEnvelope.target !== readString5(target, `${source}.target`, "id") || executionEnvelope.corpus.id !== behavioral.corpus.id || executionEnvelope.corpus.version !== behavioral.corpus.version) {
+      throw new Error(`${source}.executionEnvelope: conflicts with result target or behavioral corpus`);
+    }
+  }
   return {
-    assignmentId: readNullableString2(record, source, "assignmentId"),
-    terminalReceiptDigest: readNullableDigest(record, source, "terminalReceiptDigest"),
-    taskId: readString2(record, source, "taskId"),
+    assignmentId: readNullableString5(record, source, "assignmentId"),
+    terminalReceiptDigest: readNullableDigest2(record, source, "terminalReceiptDigest"),
+    taskId: readString5(record, source, "taskId"),
     repeatIndex: readNumber2(record, source, "repeatIndex"),
     target: {
-      id: readString2(target, `${source}.target`, "id"),
-      model: readNullableString2(target, `${source}.target`, "model"),
-      thinking: readNullableString2(target, `${source}.target`, "thinking")
+      id: readString5(target, `${source}.target`, "id"),
+      model: readNullableString5(target, `${source}.target`, "model"),
+      thinking: readNullableString5(target, `${source}.target`, "thinking")
     },
     pass: readBoolean2(record, source, "pass"),
-    failureClass: readNullableString2(record, source, "failureClass"),
-    metrics: asRecord(record.metrics, `${source}.metrics`),
-    artifacts: asRecord(record.artifacts, `${source}.artifacts`)
+    failureClass: readNullableString5(record, source, "failureClass"),
+    metrics: asRecord6(record.metrics, `${source}.metrics`),
+    artifacts: asRecord6(record.artifacts, `${source}.artifacts`),
+    ...verdict === void 0 ? {} : { verdict },
+    ...behavioral === void 0 ? {} : { behavioral },
+    ...behavioralMetrics === void 0 ? {} : { behavioralMetrics },
+    ...executionEnvelope === void 0 ? {} : { executionEnvelope }
   };
 }
-function asRecord(value, source) {
+function asRecord6(value, source) {
   if (isRecord2(value)) return value;
   throw new Error(`${source}: expected object`);
 }
 function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function readString2(record, source, field) {
+function readString5(record, source, field) {
   const value = record[field];
   if (typeof value !== "string" || value.length === 0) throw new Error(`${source}.${field}: expected string`);
   return value;
 }
-function readNullableString2(record, source, field) {
+function readNullableString5(record, source, field) {
   const value = record[field];
   if (value === null) return null;
   if (typeof value !== "string" || value.length === 0) throw new Error(`${source}.${field}: expected string or null`);
   return value;
 }
-function readNullableDigest(record, source, field) {
-  const value = readNullableString2(record, source, field);
+function readNullableDigest2(record, source, field) {
+  const value = readNullableString5(record, source, field);
   if (value !== null && !/^[0-9a-f]{64}$/u.test(value))
     throw new Error(`${source}.${field}: expected sha256 digest or null`);
   return value;
@@ -1416,20 +2344,6 @@ function adaptGroundedEvidenceValidationStatus(input) {
     uniqueBoundedReferences([{ kind: "evidence_bundle", id: input.evidenceId }, ...observed])
   );
 }
-function adaptFinishContractCompletionStatus(assessment, options = {}) {
-  const artifacts = uniqueBoundedReferences(
-    options.artifacts ?? assessment.evidence.map((evidence, index) => ({
-      kind: evidence.turnId === void 0 ? "finish_contract_evidence" : "session_entry",
-      id: evidence.turnId ?? `${evidence.kind}:${index + 1}`
-    }))
-  );
-  const source = { kind: "finish_contract", id: options.sourceId ?? assessment.reason };
-  const authority = { kind: "clio", id: "finish-contract" };
-  if (assessment.reason === "no_mutation") return attributed("not_applicable", source, authority, artifacts);
-  if (assessment.reason === "validation_evidence") return attributed("evidenced", source, authority, artifacts);
-  if (assessment.reason === "explicit_limitation") return attributed("limited", source, authority, artifacts);
-  return attributed("incomplete", source, authority, artifacts);
-}
 function uniqueBoundedReferences(references) {
   const sorted = [...references].sort(compareArtifactReferences);
   const unique = sorted.filter(
@@ -1438,24 +2352,196 @@ function uniqueBoundedReferences(references) {
   return unique.slice(0, TRUST_STATUS_MAX_ARTIFACT_REFERENCES);
 }
 
-// src/domains/eval/provenance.ts
+// src/domains/evidence/trust-projection.ts
 init_esm_shims();
-import { spawnSync } from "node:child_process";
-function evalClioProvenance(options = {}) {
-  return {
-    version: readClioVersion(),
-    commit: options.commit === void 0 ? currentClioCommit() : options.commit,
-    entry: options.entry ?? process.argv[1] ?? "unknown"
-  };
-}
-function evalEnvironmentProvenance() {
-  return {
-    platform: `${process.platform}-${process.arch}`,
-    node: process.version
-  };
-}
-function currentClioCommit() {
-  const result = spawnSync("git", ["rev-parse", "HEAD"], {
+var TRUST_SUMMARY_VERSION = 1;
+var TRUST_SUMMARY_MAX_REFS = 8;
+var TRUST_STATE_WORDS = {
+  artifactIntegrity: {
+    verified: "sealed",
+    failed: "seal broken",
+    absent: "no receipt",
+    unknown: "seal unchecked",
+    not_applicable: "seal not applicable"
+  },
+  validationGrounding: {
+    validated: "grounded",
+    failed: "validation failed",
+    ungrounded: "inferred: validation claimed, none observed",
+    absent: "no validation observed",
+    unknown: "validation unknown",
+    not_applicable: "validation not applicable"
+  },
+  independentReview: {
+    passed: "independently reviewed: pass",
+    failed: "independently reviewed: fail",
+    inconclusive: "independent review inconclusive",
+    not_independent: "review not independent",
+    absent: "not independently reviewed",
+    unknown: "independent review unknown",
+    not_applicable: "independent review not applicable"
+  },
+  contextProvenance: {
+    recorded: "context recorded",
+    invalid: "context record invalid",
+    absent: "context not recorded",
+    unknown: "context unknown",
+    not_applicable: "context not applicable"
+  },
+  autonomyEnforcement: {
+    enforced: "mediated",
+    approximated: "approximated",
+    bypassed: "bypassed",
+    absent: "autonomy not recorded",
+    unknown: "autonomy unknown",
+    not_applicable: "autonomy not applicable"
+  },
+  completionEvidence: {
+    evidenced: "completion evidenced",
+    incomplete: "completion unevidenced",
+    limited: "completion limited",
+    absent: "completion not recorded",
+    unknown: "completion unknown",
+    not_applicable: "completion not applicable"
+  }
+};
+function trustStateWord(axis, state) {
+  const words = TRUST_STATE_WORDS[axis];
+  return words[state] ?? words.unknown ?? "unknown";
+}
+function authorityOf(status, axis) {
+  const entry = status[axis];
+  return entry.state === "absent" ? null : `${entry.authority.kind}:${entry.authority.id}`;
+}
+function integrityClause(status) {
+  const retired = retiredIntegrityVersionOf(status.artifactIntegrity);
+  if (retired !== null) return `seal v${retired} retired (this build verifies v${RUN_RECEIPT_INTEGRITY_VERSION})`;
+  return trustStateWord("artifactIntegrity", status.artifactIntegrity.state);
+}
+function validationClause(status) {
+  const entry = status.validationGrounding;
+  const word = trustStateWord("validationGrounding", entry.state);
+  if (entry.state === "absent") return word;
+  if (entry.state === "validated" || entry.state === "failed") return `${word} by ${entry.authority.id}`;
+  if (entry.state === "unknown" && entry.authority.kind !== "unknown") return `${word} (${entry.authority.id})`;
+  return word;
+}
+function autonomyClause(status) {
+  const entry = status.autonomyEnforcement;
+  const word = trustStateWord("autonomyEnforcement", entry.state);
+  if (entry.state !== "approximated" && entry.state !== "bypassed") return word;
+  return `${word} (${entry.authority.id})`;
+}
+function formatTrustSummary(status) {
+  return [
+    integrityClause(status),
+    validationClause(status),
+    trustStateWord("independentReview", status.independentReview.state),
+    autonomyClause(status),
+    trustStateWord("contextProvenance", status.contextProvenance.state),
+    trustStateWord("completionEvidence", status.completionEvidence.state)
+  ].join("; ");
+}
+function formatTrustSummaryLine(status) {
+  return `trust v${TRUST_SUMMARY_VERSION}: ${trustVerdict(status)}; ${formatTrustSummary(status)}`;
+}
+function formatTrustAxes(status) {
+  return [`trust_status=v${status.version}`, ...TRUST_STATUS_AXES.map((axis) => `${axis}:${status[axis].state}`)].join(
+    " "
+  );
+}
+function isUnanswered(status, axis) {
+  const state = status[axis].state;
+  return state === "absent" || state === "unknown";
+}
+function trustVerdict(status) {
+  const integrity = status.artifactIntegrity.state;
+  const validation = status.validationGrounding.state;
+  const review = status.independentReview.state;
+  const autonomy = status.autonomyEnforcement.state;
+  if (integrity === "failed" || autonomy === "bypassed" || validation === "failed" || validation === "ungrounded" || review === "failed" || review === "not_independent" || status.contextProvenance.state === "invalid") {
+    return "compromised";
+  }
+  if (integrity !== "verified") return "unknown";
+  if (review === "passed") return "reviewed";
+  if (validation === "validated") return "grounded";
+  return "unverified";
+}
+function claimantOf(status) {
+  const state = status.validationGrounding.state;
+  if (state === "absent" || state === "ungrounded") return "worker";
+  return authorityOf(status, "validationGrounding") ?? "worker";
+}
+function referenceKey(reference) {
+  return `${reference.kind}:${reference.id}`;
+}
+function trustSummaryReferences(status) {
+  const keys = /* @__PURE__ */ new Set();
+  for (const axis of TRUST_STATUS_AXES) {
+    const entry = status[axis];
+    if (entry.state === "absent") continue;
+    for (const reference of entry.artifacts) keys.add(referenceKey(reference));
+  }
+  return [...keys].sort().slice(0, TRUST_SUMMARY_MAX_REFS);
+}
+function summarizeTrustStatus(status) {
+  const axes = Object.fromEntries(TRUST_STATUS_AXES.map((axis) => [axis, status[axis].state]));
+  return {
+    version: TRUST_SUMMARY_VERSION,
+    verdict: trustVerdict(status),
+    text: formatTrustSummary(status),
+    axes,
+    claimant: claimantOf(status),
+    unknown: TRUST_STATUS_AXES.filter((axis) => isUnanswered(status, axis)),
+    refs: trustSummaryReferences(status)
+  };
+}
+
+// src/domains/eval/provenance.ts
+init_esm_shims();
+import { spawnSync } from "node:child_process";
+function evalClioProvenance(options = {}) {
+  return {
+    version: readClioVersion(),
+    commit: options.commit === void 0 ? currentClioCommit() : options.commit,
+    entry: options.entry ?? process.argv[1] ?? "unknown"
+  };
+}
+function evalEnvironmentProvenance() {
+  return {
+    platform: `${process.platform}-${process.arch}`,
+    node: process.version
+  };
+}
+async function evalServingConfiguration(targets, observations) {
+  const targetId = targets.length === 1 ? targets[0]?.id ?? "unknown" : "multiple";
+  const configured = configuredTarget(targetId);
+  const target = targets.length === 1 ? targets[0] : void 0;
+  const runtimeId = consensus(observations.map((entry) => entry.runtimeId)) ?? configured?.runtime ?? null;
+  const modelId = consensus(observations.map((entry) => entry.modelId)) ?? target?.model ?? configured?.defaultModel ?? null;
+  const props = configured?.url === void 0 ? null : await readServingProps(configured.url, modelId);
+  return {
+    targetId,
+    runtimeId,
+    modelId,
+    serverBuild: props?.serverBuild ?? null,
+    total_slots: props?.totalSlots ?? null,
+    thinkingLevel: consensus(observations.map((entry) => entry.thinkingLevel)) ?? target?.thinking ?? null,
+    compiledPromptHash: consensus(observations.map((entry) => entry.compiledPromptHash))
+  };
+}
+function evalServingObservationFrom(target, receipt, compiledPromptHashes) {
+  const compiledPromptHash = receipt?.staticCompositionHash ?? receipt?.compiledPromptHash ?? consensus(compiledPromptHashes);
+  return {
+    targetId: receipt?.targetId ?? target.id,
+    runtimeId: receipt?.runtimeId ?? null,
+    modelId: receipt?.wireModelId ?? target.model ?? null,
+    thinkingLevel: receipt?.runtimeResolution?.effectiveThinkingLevel ?? target.thinking ?? null,
+    compiledPromptHash
+  };
+}
+function currentClioCommit() {
+  const result = spawnSync("git", ["rev-parse", "HEAD"], {
     cwd: resolvePackageRoot(),
     encoding: "utf8",
     stdio: ["ignore", "pipe", "ignore"],
@@ -1465,11 +2551,62 @@ function currentClioCommit() {
   const value = result.stdout.trim();
   return value.length > 0 ? value : null;
 }
+function configuredTarget(targetId) {
+  try {
+    const target = readSettings().targets.find((entry) => entry.id === targetId);
+    if (target === void 0) return null;
+    return {
+      runtime: target.runtime,
+      ...target.url === void 0 ? {} : { url: target.url },
+      ...target.defaultModel === void 0 ? {} : { defaultModel: target.defaultModel }
+    };
+  } catch {
+    return null;
+  }
+}
+async function readServingProps(targetUrl, modelId) {
+  const root = targetUrl.replace(/\/+$/u, "").replace(/\/v1$/u, "");
+  try {
+    const response = await fetch(`${root}/props`, { signal: AbortSignal.timeout(5e3) });
+    if (!response.ok) return null;
+    const value = await response.json();
+    if (!isRecord4(value)) return null;
+    const totalSlots = positiveInteger(value.total_slots) ?? await readServingSlots(root, modelId);
+    return {
+      serverBuild: typeof value.build_info === "string" && value.build_info.length > 0 ? value.build_info : null,
+      totalSlots
+    };
+  } catch {
+    return null;
+  }
+}
+async function readServingSlots(root, modelId) {
+  if (modelId === null) return null;
+  try {
+    const query = new URLSearchParams({ model: modelId });
+    const response = await fetch(`${root}/slots?${query}`, { signal: AbortSignal.timeout(5e3) });
+    if (!response.ok) return null;
+    const value = await response.json();
+    return Array.isArray(value) && value.length > 0 ? value.length : null;
+  } catch {
+    return null;
+  }
+}
+function consensus(values) {
+  const known = [...new Set(values.filter((value) => typeof value === "string" && value.length > 0))];
+  return known.length === 1 ? known[0] ?? null : null;
+}
+function positiveInteger(value) {
+  return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : null;
+}
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 
 // src/domains/eval/task-file.ts
 init_esm_shims();
 var import_yaml = __toESM(require_dist(), 1);
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import { readFile as readFile3 } from "node:fs/promises";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
 
@@ -1508,7 +2645,7 @@ function parseEvalTaskFileYaml(raw) {
 }
 function validateEvalTaskFile(value) {
   const issues = [];
-  if (!isRecord4(value)) {
+  if (!isRecord5(value)) {
     return { valid: false, issues: [{ path: "$", message: "expected object" }] };
   }
   if (value.version !== EVAL_TASK_FILE_VERSION) {
@@ -1544,29 +2681,29 @@ var EvalTaskFileError = class extends Error {
   }
 };
 function parseTask(value, path, issues) {
-  if (!isRecord4(value)) {
+  if (!isRecord5(value)) {
     issues.push({ path, message: "expected object" });
     return null;
   }
   for (const key of Object.keys(value).sort((a, b) => a.localeCompare(b))) {
     if (!TASK_KEYS.has(key)) issues.push({ path: `${path}.${key}`, message: "unknown field" });
   }
-  const id = readNonEmptyString(value, path, "id", issues);
+  const id = readNonEmptyString2(value, path, "id", issues);
   if (id !== null && !/^[A-Za-z0-9._-]+$/.test(id)) {
     issues.push({ path: `${path}.id`, message: "expected id with letters, numbers, dots, underscores, or hyphens" });
   }
-  const prompt = readNonEmptyString(value, path, "prompt", issues);
-  const cwd = readNonEmptyString(value, path, "cwd", issues);
+  const prompt = readNonEmptyString2(value, path, "prompt", issues);
+  const cwd = readNonEmptyString2(value, path, "cwd", issues);
   if (cwd !== null && isAbsolute(cwd)) {
     issues.push({ path: `${path}.cwd`, message: "expected repo-local relative path" });
   }
-  const setup = readStringArray2(value, path, "setup", issues, true);
-  const verifier = readStringArray2(value, path, "verifier", issues, false);
+  const setup = readStringArray3(value, path, "setup", issues, true);
+  const verifier = readStringArray3(value, path, "verifier", issues, false);
   if (verifier !== null && verifier.length === 0) {
     issues.push({ path: `${path}.verifier`, message: "expected at least one command" });
   }
   const timeoutMs = readPositiveInteger(value, path, "timeoutMs", issues);
-  const tags = readStringArray2(value, path, "tags", issues, true);
+  const tags = readStringArray3(value, path, "tags", issues, true);
   if (id === null || prompt === null || cwd === null || setup === null || verifier === null || timeoutMs === null) {
     return null;
   }
@@ -1584,7 +2721,7 @@ function validateTaskCwds(tasks, baseDir) {
   }
   return issues;
 }
-function readNonEmptyString(record, path, field, issues) {
+function readNonEmptyString2(record, path, field, issues) {
   const value = record[field];
   if (typeof value !== "string" || value.trim().length === 0) {
     issues.push({ path: `${path}.${field}`, message: "expected non-empty string" });
@@ -1592,7 +2729,7 @@ function readNonEmptyString(record, path, field, issues) {
   }
   return value;
 }
-function readStringArray2(record, path, field, issues, allowMissing) {
+function readStringArray3(record, path, field, issues, allowMissing) {
   const value = record[field];
   if (value === void 0 && allowMissing) return [];
   if (!Array.isArray(value)) {
@@ -1618,166 +2755,105 @@ function readPositiveInteger(record, path, field, issues) {
   }
   return value;
 }
-function isRecord4(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function sha256Hex(content) {
-  return createHash3("sha256").update(content, "utf8").digest("hex");
+  return createHash4("sha256").update(content, "utf8").digest("hex");
 }
 
-// src/domains/evidence/trust-projection.ts
+// src/domains/eval/run-compare.ts
 init_esm_shims();
-var TRUST_SUMMARY_VERSION = 1;
-var TRUST_SUMMARY_MAX_REFS = 8;
-var TRUST_STATE_WORDS = {
-  artifactIntegrity: {
-    verified: "sealed",
-    failed: "seal broken",
-    absent: "no receipt",
-    unknown: "seal unchecked",
-    not_applicable: "seal not applicable"
-  },
-  validationGrounding: {
-    validated: "grounded",
-    failed: "validation failed",
-    ungrounded: "inferred: validation claimed, none observed",
-    absent: "no validation observed",
-    unknown: "validation unknown",
-    not_applicable: "validation not applicable"
-  },
-  independentReview: {
-    passed: "independently reviewed: pass",
-    failed: "independently reviewed: fail",
-    inconclusive: "independent review inconclusive",
-    not_independent: "review not independent",
-    absent: "not independently reviewed",
-    unknown: "independent review unknown",
-    not_applicable: "independent review not applicable"
-  },
-  contextProvenance: {
-    recorded: "context recorded",
-    invalid: "context record invalid",
-    absent: "context not recorded",
-    unknown: "context unknown",
-    not_applicable: "context not applicable"
-  },
-  autonomyEnforcement: {
-    enforced: "mediated",
-    approximated: "approximated",
-    bypassed: "bypassed",
-    absent: "autonomy not recorded",
-    unknown: "autonomy unknown",
-    not_applicable: "autonomy not applicable"
-  },
-  completionEvidence: {
-    evidenced: "completion evidenced",
-    incomplete: "completion unevidenced",
-    limited: "completion limited",
-    absent: "completion not recorded",
-    unknown: "completion unknown",
-    not_applicable: "completion not applicable"
+var EvalTrackedMetricSourceMismatchError = class extends Error {
+  constructor(metric, baseline, candidate) {
+    super(
+      `tracked metric ${metric} cannot compare estimated and measured values (baseline=${baseline.join(",") || "none"}, candidate=${candidate.join(",") || "none"})`
+    );
+    this.name = "EvalTrackedMetricSourceMismatchError";
   }
 };
-function trustStateWord(axis, state) {
-  const words = TRUST_STATE_WORDS[axis];
-  return words[state] ?? words.unknown ?? "unknown";
+function assertComparableTrackedMetricSources(metric, baseline, candidate) {
+  if (baseline.includes("estimated") === candidate.includes("estimated")) return;
+  throw new EvalTrackedMetricSourceMismatchError(metric, baseline, candidate);
 }
-function authorityOf(status, axis) {
-  const entry = status[axis];
-  return entry.state === "absent" ? null : `${entry.authority.kind}:${entry.authority.id}`;
-}
-function integrityClause(status) {
-  const retired = retiredIntegrityVersionOf(status.artifactIntegrity);
-  if (retired !== null) return `seal v${retired} retired (this build verifies v${RUN_RECEIPT_INTEGRITY_VERSION})`;
-  return trustStateWord("artifactIntegrity", status.artifactIntegrity.state);
-}
-function validationClause(status) {
-  const entry = status.validationGrounding;
-  const word = trustStateWord("validationGrounding", entry.state);
-  if (entry.state === "absent") return word;
-  if (entry.state === "validated" || entry.state === "failed") return `${word} by ${entry.authority.id}`;
-  if (entry.state === "unknown" && entry.authority.kind !== "unknown") return `${word} (${entry.authority.id})`;
-  return word;
-}
-function autonomyClause(status) {
-  const entry = status.autonomyEnforcement;
-  const word = trustStateWord("autonomyEnforcement", entry.state);
-  if (entry.state !== "approximated" && entry.state !== "bypassed") return word;
-  return `${word} (${entry.authority.id})`;
-}
-function formatTrustSummary(status) {
-  return [
-    integrityClause(status),
-    validationClause(status),
-    trustStateWord("independentReview", status.independentReview.state),
-    autonomyClause(status),
-    trustStateWord("contextProvenance", status.contextProvenance.state),
-    trustStateWord("completionEvidence", status.completionEvidence.state)
-  ].join("; ");
-}
-function formatTrustSummaryLine(status) {
-  return `trust v${TRUST_SUMMARY_VERSION}: ${formatTrustSummary(status)}`;
+
+// src/domains/prompts/hash.ts
+init_esm_shims();
+import { createHash as createHash5 } from "node:crypto";
+function sha2563(input) {
+  return createHash5("sha256").update(input, "utf8").digest("hex");
 }
-function formatTrustAxes(status) {
-  return [`trust_status=v${status.version}`, ...TRUST_STATUS_AXES.map((axis) => `${axis}:${status[axis].state}`)].join(
-    " "
-  );
+function canonicalJson2(value) {
+  return serialize(value);
 }
-function isUnanswered(status, axis) {
-  const state = status[axis].state;
-  return state === "absent" || state === "unknown";
-}
-function trustVerdict(status) {
-  const integrity = status.artifactIntegrity.state;
-  const validation = status.validationGrounding.state;
-  const review = status.independentReview.state;
-  const autonomy = status.autonomyEnforcement.state;
-  if (integrity === "failed" || autonomy === "bypassed" || validation === "failed" || validation === "ungrounded" || review === "failed" || review === "not_independent" || status.contextProvenance.state === "invalid") {
-    return "compromised";
+function serialize(value) {
+  if (value === null) return "null";
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new Error(`canonicalJson: non-finite number ${String(value)} is not representable`);
+    }
+    return JSON.stringify(value);
   }
-  if (integrity !== "verified") return "unknown";
-  if (review === "passed") return "reviewed";
-  if (validation === "validated") return "grounded";
-  return "unverified";
-}
-function claimantOf(status) {
-  const state = status.validationGrounding.state;
-  if (state === "absent" || state === "ungrounded") return "worker";
-  return authorityOf(status, "validationGrounding") ?? "worker";
-}
-function referenceKey(reference) {
-  return `${reference.kind}:${reference.id}`;
-}
-function trustSummaryReferences(status) {
-  const keys = /* @__PURE__ */ new Set();
-  for (const axis of TRUST_STATUS_AXES) {
-    const entry = status[axis];
-    if (entry.state === "absent") continue;
-    for (const reference of entry.artifacts) keys.add(referenceKey(reference));
+  if (typeof value === "string" || typeof value === "boolean") {
+    return JSON.stringify(value);
   }
-  return [...keys].sort().slice(0, TRUST_SUMMARY_MAX_REFS);
-}
-function summarizeTrustStatus(status) {
-  const axes = Object.fromEntries(TRUST_STATUS_AXES.map((axis) => [axis, status[axis].state]));
-  return {
-    version: TRUST_SUMMARY_VERSION,
-    verdict: trustVerdict(status),
-    text: formatTrustSummary(status),
-    axes,
-    claimant: claimantOf(status),
-    unknown: TRUST_STATUS_AXES.filter((axis) => isUnanswered(status, axis)),
-    refs: trustSummaryReferences(status)
-  };
+  if (typeof value === "bigint") {
+    throw new Error("canonicalJson: bigint is not representable");
+  }
+  if (typeof value === "symbol" || typeof value === "function") {
+    throw new Error(`canonicalJson: ${typeof value} is not representable`);
+  }
+  if (value === void 0) {
+    throw new Error("canonicalJson: undefined is not representable at root");
+  }
+  if (Array.isArray(value)) {
+    const parts = [];
+    for (let i = 0; i < value.length; i++) {
+      if (!(i in value) || value[i] === void 0) {
+        parts.push("null");
+        continue;
+      }
+      parts.push(serialize(value[i]));
+    }
+    return `[${parts.join(",")}]`;
+  }
+  if (typeof value === "object") {
+    const obj = value;
+    const keys = Object.keys(obj).sort();
+    const parts = [];
+    for (const key of keys) {
+      const child = obj[key];
+      if (child === void 0) continue;
+      parts.push(`${JSON.stringify(key)}:${serialize(child)}`);
+    }
+    return `{${parts.join(",")}}`;
+  }
+  throw new Error(`canonicalJson: unsupported value of type ${typeof value}`);
 }
 
 export {
+  sha2563 as sha256,
+  canonicalJson2 as canonicalJson,
   RUN_RECEIPT_INTEGRITY_VERSION,
   RUN_RECEIPT_INTEGRITY_ALGORITHM,
   withReceiptIntegrity,
   isReceiptIntegrity,
   verifyReceiptIntegrity,
+  EVAL_VERDICT_SCHEMA_V1,
+  EVAL_TRACKED_METRIC_NAMES,
+  parseEvalVerdictEnvelopeV1,
+  parseEvalBehaviorScenarioV1,
+  judgeEvalBehaviorV1,
+  assertEvalBehaviorReferencesVerdictV1,
+  EVAL_BEHAVIOR_METRIC_DEFINITIONS_V1,
+  buildEvalBehaviorMetricsV1,
+  EVAL_EXECUTION_ENVELOPE_SCHEMA_V1,
+  parseEvalExecutionMatrixDimensionsV1,
+  sameEvalServingConfiguration,
+  renderEvalServingConfiguration,
   redactArtifactForStorage,
   ZERO_EVAL_HARNESS_METRICS,
+  evalHarnessMetricsFromReceipt,
   sumEvalHarnessMetrics,
   createEvalId,
   writeEvalArtifact,
@@ -1796,14 +2872,17 @@ export {
   inspectRunReceiptTrustStatus,
   adaptGateDecisionReviewStatus,
   adaptGroundedEvidenceValidationStatus,
-  adaptFinishContractCompletionStatus,
-  evalClioProvenance,
-  evalEnvironmentProvenance,
-  loadEvalTaskFile,
-  EvalTaskFileError,
   formatTrustSummary,
   formatTrustSummaryLine,
   formatTrustAxes,
-  summarizeTrustStatus
+  trustVerdict,
+  summarizeTrustStatus,
+  evalClioProvenance,
+  evalEnvironmentProvenance,
+  evalServingConfiguration,
+  evalServingObservationFrom,
+  assertComparableTrackedMetricSources,
+  loadEvalTaskFile,
+  EvalTaskFileError
 };
-//# sourceMappingURL=chunk-K4XHGFR5.js.map
+//# sourceMappingURL=chunk-MLOK6ZOS.js.map