@iowarp/clio-coder 0.3.8 → 0.4.0

package/dist/{eval-BEC2WHDA.js → eval-TFBYQH4H.js}

@@ -1,32 +1,79 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
+  EVAL_SUITE_V2_VERSION
+} from "./chunk-KMVISBZR.js";
+import {
+  loadFragments,
   renderCodewikiDigest
-} from "./chunk-5WIGXA4T.js";
+} from "./chunk-VAZSBTKF.js";
 import {
   EvalTaskFileError,
   TRUST_STATUS_AXES,
   adaptRunReceiptTrustStatus,
-  createEvalId,
+  assertComparableTrackedMetricSources,
   evalClioProvenance,
   evalEnvironmentProvenance,
+  evalServingConfiguration,
+  evalServingObservationFrom,
   formatTrustSummary,
   inspectRunReceiptTrustStatus,
-  loadEvalArtifactV4,
   loadEvalTaskFile,
   summarizeTrustStatus,
-  verifyReceiptIntegrity,
+  verifyReceiptIntegrity
+} from "./chunk-B7OBL7PK.js";
+import {
+  listSessionLedgerRefs,
+  parseSessionEntries
+} from "./chunk-QREDIESB.js";
+import "./chunk-3DPEIQKN.js";
+import {
+  EVAL_BEHAVIOR_METRIC_DEFINITIONS_V1,
+  EVAL_EXECUTION_ENVELOPE_SCHEMA_V1,
+  EVAL_TRACKED_METRIC_NAMES,
+  EVAL_VERDICT_SCHEMA_V1,
+  assertEvalBehaviorReferencesVerdictV1,
+  buildEvalBehaviorMetricsV1,
+  createEvalId,
+  evalHarnessMetricsFromReceipt,
+  evalServingConfigurationOf,
+  judgeEvalBehaviorV1,
+  loadEvalArtifactV4,
+  parseEvalBehaviorScenarioV1,
+  parseEvalExecutionMatrixDimensionsV1,
+  parseEvalVerdictEnvelopeV1,
+  renderEvalServingConfiguration,
+  sameEvalServingConfiguration,
   writeEvalArtifactV4
-} from "./chunk-K4XHGFR5.js";
+} from "./chunk-NHLBIGRH.js";
+import "./chunk-W6GROXXM.js";
 import {
   shellQuote
 } from "./chunk-TXOTCRLG.js";
-import "./chunk-P43ETTHK.js";
+import "./chunk-HVDIIIQW.js";
+import {
+  discoverAgentRecipes
+} from "./chunk-Z4TXYIEG.js";
+import "./chunk-VYMXRQI6.js";
+import "./chunk-FEFIFZTL.js";
+import "./chunk-RKKLTLYB.js";
+import "./chunk-SUW5DORT.js";
+import "./chunk-SJ5ZKQ4S.js";
+import "./chunk-2JDWVJND.js";
+import {
+  createSafetyPolicyEngine
+} from "./chunk-32KWKNSF.js";
 import "./chunk-H7IXIC72.js";
-import "./chunk-AOCYTWAV.js";
-import "./chunk-MV3K5QF2.js";
+import "./chunk-5LXZXPKX.js";
+import "./chunk-RAPCMZL4.js";
+import "./chunk-HHV2GANA.js";
+import {
+  agentSpecFingerprint,
+  normalizeAgentSpec
+} from "./chunk-DYJP44XW.js";
+import "./chunk-GCSMB2KY.js";
 import "./chunk-UL3WSD3F.js";
 import "./chunk-ECH6PKUQ.js";
-import "./chunk-CGKSTWHD.js";
+import "./chunk-K6BSR66V.js";
 import {
   readCodewiki,
   structuralCodewikiHash
@@ -38,16 +85,31 @@ import {
   enumerateWorkspaceFiles
 } from "./chunk-33YXPOE3.js";
 import "./chunk-7CR24IG7.js";
-import "./chunk-IFBNV6H6.js";
+import "./chunk-XPLRXC72.js";
+import "./chunk-2ANTL7MR.js";
 import {
   printError
-} from "./chunk-XK56QHLX.js";
+} from "./chunk-VPKWYKEY.js";
 import "./chunk-5TSRNF4G.js";
+import "./chunk-CFGTUFWB.js";
+import {
+  extractReasoningTokens
+} from "./chunk-UM7N4G5A.js";
+import "./chunk-HLW2MRKE.js";
+import "./chunk-76ONBSIA.js";
 import {
   InvalidIdError
 } from "./chunk-R346GLFC.js";
+import "./chunk-IHXBNWMM.js";
+import "./chunk-VFA6GDY5.js";
+import "./chunk-BBVJUZHB.js";
+import "./chunk-FQ4SKYE4.js";
+import "./chunk-6EJMN2Y3.js";
 import "./chunk-IWHMRKLL.js";
-import "./chunk-EQ63NRB7.js";
+import "./chunk-GXNLGKAB.js";
+import "./chunk-LL4KHSZI.js";
+import "./chunk-4ZG3XFUR.js";
+import "./chunk-BBVYXMFO.js";
 import "./chunk-SST6Z5JA.js";
 import "./chunk-IKCO5N3L.js";
 import "./chunk-3I7MS7N2.js";
@@ -57,7 +119,7 @@ import {
 import {
   clioDataDir,
   clioStateDir
-} from "./chunk-BNAZZHFG.js";
+} from "./chunk-BYP5D4HI.js";
 import "./chunk-WEPFGWHJ.js";
 import "./chunk-YXLYO42X.js";
 import {
@@ -67,31 +129,574 @@ import {
 
 // src/cli/eval.ts
 init_esm_shims();
-import { resolve as resolve7 } from "node:path";
+import { resolve as resolve8 } from "node:path";
 
 // src/domains/eval/compare/compare.ts
 init_esm_shims();
-function compareEvalArtifactsV4(baseline, candidate) {
+
+// src/domains/eval/metrics/aggregate.ts
+init_esm_shims();
+function aggregateEvalVerdicts(verdicts) {
+  const byScenario = /* @__PURE__ */ new Map();
+  for (const verdict of verdicts) {
+    const group = byScenario.get(verdict.scenarioId) ?? [];
+    group.push(verdict);
+    byScenario.set(verdict.scenarioId, group);
+  }
+  return [...byScenario.entries()].sort(([left], [right]) => left.localeCompare(right)).map(([scenarioId, group]) => aggregateScenario(scenarioId, group));
+}
+function aggregateScenario(scenarioId, verdicts) {
+  const ordered = [...verdicts].sort((left, right) => left.trialIndex - right.trialIndex);
+  const passed = ordered.filter((verdict) => verdict.outcome === "pass").length;
+  const failed = ordered.filter((verdict) => verdict.outcome === "fail").length;
+  const unmeasured = ordered.filter((verdict) => verdict.outcome === "unmeasured").length;
+  const machineryFailures = ordered.filter((verdict) => verdict.machinery === "infrastructure_failure").length;
+  const fixed = Object.fromEntries(
+    EVAL_TRACKED_METRIC_NAMES.map((name) => [name, distribution(ordered.map((verdict) => verdict.trackedMetrics[name]))])
+  );
+  const reasons = new Set(ordered.flatMap((verdict) => Object.keys(verdict.trackedMetrics.expectedColdReasons)));
+  const expectedColdReasons = Object.fromEntries(
+    [...reasons].sort((left, right) => left.localeCompare(right)).map((reason) => [
+      reason,
+      distribution(
+        ordered.map(
+          (verdict) => verdict.trackedMetrics.expectedColdReasons[reason] ?? { value: 0, source: "ledger" }
+        )
+      )
+    ])
+  );
+  const k = ordered.length;
+  return {
+    scenarioId,
+    trials: k,
+    k,
+    passed,
+    failed,
+    unmeasured,
+    machineryFailures,
+    passAtK: k > 0 && passed > 0 ? 1 : 0,
+    passPowK: k > 0 && passed === k ? 1 : 0,
+    trackedMetrics: { ...fixed, expectedColdReasons }
+  };
+}
+function distribution(metrics) {
+  const values = metrics.flatMap((metric) => metric.value === null ? [] : [metric.value]);
+  const sources = [...new Set(metrics.map((metric) => metric.source))].sort(compareSources);
+  if (values.length === 0) {
+    return {
+      observations: metrics.length,
+      measured: 0,
+      unmeasured: metrics.length,
+      mean: null,
+      min: null,
+      max: null,
+      p90: null,
+      variance: null,
+      standardDeviation: null,
+      sources
+    };
+  }
+  const ordered = [...values].sort((left, right) => left - right);
+  const p90Index = Math.max(0, Math.ceil(ordered.length * 0.9) - 1);
+  const mean = ordered.reduce((sum2, value) => sum2 + value, 0) / ordered.length;
+  const variance = ordered.reduce((sum2, value) => sum2 + (value - mean) ** 2, 0) / ordered.length;
+  return {
+    observations: metrics.length,
+    measured: values.length,
+    unmeasured: metrics.length - values.length,
+    mean,
+    min: ordered[0] ?? null,
+    max: ordered.at(-1) ?? null,
+    p90: ordered[p90Index] ?? null,
+    variance,
+    standardDeviation: Math.sqrt(variance),
+    sources
+  };
+}
+function compareSources(left, right) {
+  return sourceOrder(left) - sourceOrder(right);
+}
+function sourceOrder(source) {
+  if (source === "ledger") return 0;
+  if (source === "receipt") return 1;
+  return 2;
+}
+
+// src/domains/eval/compare/behavioral.ts
+init_esm_shims();
+
+// src/domains/eval/compare/envelope.ts
+init_esm_shims();
+function compareEvalExecutionEnvelopesV1(identity, baseline, candidate, baselineDimensions, candidateDimensions) {
+  const leftDimensions = [...baselineDimensions].sort();
+  const rightDimensions = [...candidateDimensions].sort();
+  if (stableJson(leftDimensions) !== stableJson(rightDimensions)) {
+    return { ...identity, fields: ["matrix.dimensions"] };
+  }
+  if (baseline.some((result) => result.executionEnvelope !== void 0) && baseline.some((result) => result.executionEnvelope === void 0) || candidate.some((result) => result.executionEnvelope !== void 0) && candidate.some((result) => result.executionEnvelope === void 0)) {
+    return { ...identity, fields: ["executionEnvelope.missingTrial"] };
+  }
+  const ignored = new Set(leftDimensions);
+  const baselineEnvelopes = uniqueEnvelopes(baseline, ignored);
+  const candidateEnvelopes = uniqueEnvelopes(candidate, ignored);
+  if (baselineEnvelopes.length === 0 && candidateEnvelopes.length === 0) return null;
+  if (baselineEnvelopes.length === 0 || candidateEnvelopes.length === 0) {
+    return { ...identity, fields: ["executionEnvelope"] };
+  }
+  if (baselineEnvelopes.length > 1 || candidateEnvelopes.length > 1) {
+    return { ...identity, fields: ["executionEnvelope.withinRunVariance"] };
+  }
+  const left = baselineEnvelopes[0];
+  const right = candidateEnvelopes[0];
+  if (left === void 0 || right === void 0 || stableJson(left) === stableJson(right)) return null;
+  return { ...identity, fields: differingFields(left, right, ignored) };
+}
+function uniqueEnvelopes(results, ignored) {
+  const byIdentity = /* @__PURE__ */ new Map();
+  for (const result of results) {
+    if (result.executionEnvelope === void 0) continue;
+    const normalized = normalizedEnvelope(result.executionEnvelope, ignored);
+    byIdentity.set(stableJson(normalized), normalized);
+  }
+  return [...byIdentity.values()];
+}
+function normalizedEnvelope(envelope, ignored) {
+  return {
+    ...envelope,
+    prompt: ignored.has("prompt") ? { fragments: [], compositionHash: null } : envelope.prompt,
+    recipe: ignored.has("recipe") ? null : envelope.recipe,
+    target: ignored.has("target") ? "<matrix>" : envelope.target,
+    wireModel: ignored.has("wireModel") ? null : envelope.wireModel,
+    runtime: ignored.has("runtime") ? null : envelope.runtime,
+    thinkingLevel: ignored.has("thinkingLevel") ? null : envelope.thinkingLevel,
+    toolSignature: ignored.has("toolSignature") ? null : envelope.toolSignature,
+    autonomy: ignored.has("autonomy") ? null : envelope.autonomy,
+    policyHashes: ignored.has("policy") ? { rulePack: null, project: null } : envelope.policyHashes,
+    projectContext: ignored.has("projectContext") ? {
+      kind: "none",
+      tier: null,
+      contentHash: null,
+      chars: null,
+      sections: [],
+      rulesApplied: [],
+      operatorProfileApplied: null
+    } : envelope.projectContext,
+    corpus: ignored.has("corpus") ? { id: "<matrix>", version: "<matrix>" } : envelope.corpus
+  };
+}
+function differingFields(left, right, ignored) {
+  const fields = [
+    ["prompt", "prompt", left.prompt, right.prompt],
+    ["recipe", "recipe", left.recipe, right.recipe],
+    ["target", "target", left.target, right.target],
+    ["wireModel", "wireModel", left.wireModel, right.wireModel],
+    ["runtime", "runtime", left.runtime, right.runtime],
+    ["thinkingLevel", "thinkingLevel", left.thinkingLevel, right.thinkingLevel],
+    ["toolSignature", "toolSignature", left.toolSignature, right.toolSignature],
+    ["autonomy", "autonomy", left.autonomy, right.autonomy],
+    ["policy", "policyHashes", left.policyHashes, right.policyHashes],
+    ["projectContext", "projectContext", left.projectContext, right.projectContext],
+    ["corpus", "corpus", left.corpus, right.corpus]
+  ];
+  return fields.flatMap(
+    ([dimension, field, baseline, candidate]) => ignored.has(dimension) || stableJson(baseline) === stableJson(candidate) ? [] : [field]
+  );
+}
+function stableJson(value) {
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  if (typeof value === "object" && value !== null) {
+    return `{${Object.entries(value).filter(([, entry]) => entry !== void 0).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => `${JSON.stringify(key)}:${stableJson(entry)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+
+// src/domains/eval/compare/behavioral.ts
+function compareEvalBehaviorMetricsV1(baseline, candidate) {
+  const baselineGroups = behaviorGroups(baseline);
+  const candidateGroups = behaviorGroups(candidate);
+  const keys = /* @__PURE__ */ new Set([...baselineGroups.keys(), ...candidateGroups.keys()]);
+  const comparisons = [];
+  const envelopeMismatches = [];
+  const baselineDimensions = baseline.matrix.dimensions ?? [];
+  const candidateDimensions = candidate.matrix.dimensions ?? [];
+  for (const key of [...keys].sort((left, right) => left.localeCompare(right))) {
+    const baselineGroup = baselineGroups.get(key);
+    const candidateGroup = candidateGroups.get(key);
+    const identity = baselineGroup ?? candidateGroup;
+    if (identity === void 0) continue;
+    const envelopeMismatch = compareEvalExecutionEnvelopesV1(
+      identity,
+      baselineGroup?.results ?? [],
+      candidateGroup?.results ?? [],
+      baselineDimensions,
+      candidateDimensions
+    );
+    if (envelopeMismatch !== null) envelopeMismatches.push(envelopeMismatch);
+    const comparability = {
+      comparable: envelopeMismatch === null,
+      mismatchedFields: envelopeMismatch?.fields ?? []
+    };
+    for (const definition of EVAL_BEHAVIOR_METRIC_DEFINITIONS_V1) {
+      const baselineDistribution = behaviorDistribution(baselineGroup?.results ?? [], definition);
+      const candidateDistribution = behaviorDistribution(candidateGroup?.results ?? [], definition);
+      comparisons.push({
+        scenarioId: identity.scenarioId,
+        role: identity.role,
+        target: identity.target,
+        metric: definition.name,
+        family: definition.family,
+        direction: definition.direction,
+        hardGate: definition.hardGate,
+        baseline: baselineDistribution,
+        candidate: candidateDistribution,
+        change: envelopeMismatch === null ? classifyChange(baselineDistribution.mean, candidateDistribution.mean, definition.direction) : "incomparable",
+        meanDelta: subtractNullable(candidateDistribution.mean, baselineDistribution.mean),
+        varianceChange: envelopeMismatch === null ? classifyChange(baselineDistribution.variance, candidateDistribution.variance, "lower") : "incomparable",
+        varianceDelta: subtractNullable(candidateDistribution.variance, baselineDistribution.variance),
+        comparability
+      });
+    }
+  }
+  const failures = comparisons.flatMap(
+    (comparison) => comparison.hardGate && (comparison.change === "regressed" || comparison.change === "incomparable" && comparison.baseline.mean !== null && comparison.candidate.mean === null) ? [
+      {
+        scenarioId: comparison.scenarioId,
+        role: comparison.role,
+        target: comparison.target,
+        metric: comparison.metric,
+        change: comparison.change
+      }
+    ] : []
+  );
+  return {
+    comparisons,
+    hardGate: {
+      pass: failures.length === 0 && envelopeMismatches.length === 0,
+      failures,
+      envelopeFailures: envelopeMismatches
+    },
+    envelopeMismatches
+  };
+}
+function classifyChange(baseline, candidate, direction) {
+  if (baseline === null || candidate === null) return "incomparable";
+  if (baseline === candidate) return "unchanged";
+  if (direction === "higher") return candidate > baseline ? "improved" : "regressed";
+  return candidate < baseline ? "improved" : "regressed";
+}
+function behaviorGroups(artifact) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const result of artifact.results) {
+    const behavioral = result.behavioralMetrics;
+    if (behavioral === void 0) continue;
+    const key = groupKey(behavioral.scenarioId, behavioral.role, behavioral.target);
+    const group = groups.get(key) ?? {
+      scenarioId: behavioral.scenarioId,
+      role: behavioral.role,
+      target: behavioral.target,
+      results: []
+    };
+    group.results.push(result);
+    groups.set(key, group);
+  }
+  return groups;
+}
+function behaviorDistribution(results, definition) {
+  const observations = results.map((result) => result.behavioralMetrics?.metrics[definition.name].value ?? null);
+  const values = observations.flatMap((value) => value === null ? [] : [value]);
+  if (values.length === 0) {
+    return {
+      observations: observations.length,
+      measured: 0,
+      unmeasured: observations.length,
+      mean: null,
+      min: null,
+      max: null,
+      p90: null,
+      variance: null,
+      standardDeviation: null,
+      source: definition.source
+    };
+  }
+  const ordered = [...values].sort((left, right) => left - right);
+  const mean = ordered.reduce((sum2, value) => sum2 + value, 0) / ordered.length;
+  const variance = ordered.reduce((sum2, value) => sum2 + (value - mean) ** 2, 0) / ordered.length;
+  return {
+    observations: observations.length,
+    measured: values.length,
+    unmeasured: observations.length - values.length,
+    mean,
+    min: ordered[0] ?? null,
+    max: ordered.at(-1) ?? null,
+    p90: ordered[Math.max(0, Math.ceil(ordered.length * 0.9) - 1)] ?? null,
+    variance,
+    standardDeviation: Math.sqrt(variance),
+    source: definition.source
+  };
+}
+function groupKey(scenarioId, role, target) {
+  return JSON.stringify([scenarioId, role, target.id, target.model]);
+}
+function subtractNullable(left, right) {
+  return left === null || right === null ? null : left - right;
+}
+
+// src/domains/eval/compare/compare.ts
+var EvalServingConfigurationDriftError = class extends Error {
+  baseline;
+  candidate;
+  constructor(baseline, candidate) {
+    super(
+      [
+        "serving configuration drift; pass --allow-config-drift to compare these runs",
+        `baseline serving: ${renderEvalServingConfiguration(baseline)}`,
+        `candidate serving: ${renderEvalServingConfiguration(candidate)}`
+      ].join("\n")
+    );
+    this.name = "EvalServingConfigurationDriftError";
+    this.baseline = baseline;
+    this.candidate = candidate;
+  }
+};
+function compareEvalArtifactsV4(baseline, candidate, options = {}) {
   const baselineTokens = baseline.summary.tokens;
   const candidateTokens = candidate.summary.tokens;
+  const baselineServing = evalServingConfigurationOf(baseline);
+  const candidateServing = evalServingConfigurationOf(candidate);
+  const configDrift = !sameEvalServingConfiguration(baselineServing, candidateServing);
+  if (configDrift && options.allowConfigDrift !== true) {
+    throw new EvalServingConfigurationDriftError(baselineServing, candidateServing);
+  }
+  const behavioral = compareEvalBehaviorMetricsV1(baseline, candidate);
+  const trackedMetrics = compareTrackedMetrics(baseline, candidate, options.metric);
+  const normalizedFilter = normalizeMetricFilter(options.metric);
+  const behavioralMetrics = normalizedFilter === void 0 ? behavioral.comparisons : behavioral.comparisons.filter((row) => row.metric === normalizedFilter || row.family === normalizedFilter);
+  if (options.metric !== void 0 && trackedMetrics.length === 0 && behavioralMetrics.length === 0) {
+    throw new Error(`eval metric not found: ${options.metric}`);
+  }
   return {
     baselineEvalId: baseline.evalId,
     candidateEvalId: candidate.evalId,
+    baselineServingConfiguration: baselineServing,
+    candidateServingConfiguration: candidateServing,
+    configDrift,
     passRateDelta: candidate.summary.passRate - baseline.summary.passRate,
     tokenDelta: baselineTokens.measured && candidateTokens.measured ? candidateTokens.total - baselineTokens.total : null,
-    wallTimeDelta: candidate.summary.wallTimeMs - baseline.summary.wallTimeMs
+    wallTimeDelta: candidate.summary.wallTimeMs - baseline.summary.wallTimeMs,
+    trackedMetrics,
+    behavioralMetrics,
+    hardGate: behavioral.hardGate,
+    envelopeMismatches: behavioral.envelopeMismatches,
+    scenarioReports: behaviorRollups(behavioralMetrics, (row) => row.scenarioId),
+    roleReports: behaviorRollups(behavioralMetrics, (row) => row.role),
+    affectedCorpusResults: behavioral.envelopeMismatches.flatMap((mismatch) => {
+      const changedFields = mismatch.fields.filter((field) => field === "prompt" || field === "recipe");
+      return changedFields.length === 0 ? [] : [{ scenarioId: mismatch.scenarioId, role: mismatch.role, changedFields }];
+    })
   };
 }
 function renderEvalComparisonV4(summary) {
+  const envelopeFailures = summary.envelopeMismatches.map(
+    (mismatch) => `  incomparable envelope: ${mismatch.scenarioId} ${mismatch.role} ${mismatch.target.id}/${mismatch.target.model ?? "none"} fields=${mismatch.fields.join(",")}`
+  );
+  const affected = summary.affectedCorpusResults.map(
+    (result) => `  affected corpus result: ${result.scenarioId} role=${result.role} changed=${result.changedFields.join(",")}`
+  );
+  const scenarioReports = renderRollups("per-scenario baseline/candidate report", summary.scenarioReports);
+  const roleReports = renderRollups("per-role baseline/candidate report", summary.roleReports);
+  const hardFailures = summary.hardGate.failures.map(
+    (failure) => `  hard failure: ${failure.scenarioId} ${failure.role} ${failure.target.id}/${failure.target.model ?? "none"} ${failure.metric} ${failure.change}`
+  );
+  const tracked = summary.trackedMetrics.flatMap((row, index) => [
+    ...index === 0 ? [
+      "tracked metrics:",
+      "scenario metric baseline_mean baseline_p90 baseline_variance candidate_mean candidate_p90 candidate_variance mean_delta p90_delta variance_delta change variance_change sources"
+    ] : [],
+    [
+      row.scenarioId,
+      row.metric,
+      formatMetric(row.baseline.mean),
+      formatMetric(row.baseline.p90),
+      formatMetric(row.baseline.variance ?? null),
+      formatMetric(row.candidate.mean),
+      formatMetric(row.candidate.p90),
+      formatMetric(row.candidate.variance ?? null),
+      formatSignedMetric(row.meanDelta),
+      formatSignedMetric(row.p90Delta),
+      formatSignedMetric(row.varianceDelta),
+      row.change,
+      row.varianceChange,
+      `${row.baseline.sources.join("+") || "none"}->${row.candidate.sources.join("+") || "none"}`
+    ].join(" ")
+  ]);
+  const behavioral = summary.behavioralMetrics.flatMap((row, index) => [
+    ...index === 0 ? [
+      "behavioral metrics:",
+      "scenario role target model family metric baseline_mean baseline_variance baseline_coverage candidate_mean candidate_variance candidate_coverage mean_delta variance_delta change variance_change comparability gate source"
+    ] : [],
+    [
+      row.scenarioId,
+      row.role,
+      row.target.id,
+      row.target.model ?? "none",
+      row.family,
+      row.metric,
+      formatMetric(row.baseline.mean),
+      formatMetric(row.baseline.variance),
+      `${row.baseline.measured}/${row.baseline.observations}`,
+      formatMetric(row.candidate.mean),
+      formatMetric(row.candidate.variance),
+      `${row.candidate.measured}/${row.candidate.observations}`,
+      formatSignedMetric(row.meanDelta),
+      formatSignedMetric(row.varianceDelta),
+      row.change,
+      row.varianceChange,
+      row.comparability.comparable ? "comparable" : `incomparable:${row.comparability.mismatchedFields.join(",")}`,
+      row.hardGate ? "hard" : "informational",
+      row.baseline.source
+    ].join(" ")
+  ]);
   return [
     `baseline eval: ${summary.baselineEvalId}`,
     `candidate eval: ${summary.candidateEvalId}`,
+    `baseline serving: ${renderEvalServingConfiguration(summary.baselineServingConfiguration)}`,
+    `candidate serving: ${renderEvalServingConfiguration(summary.candidateServingConfiguration)}`,
+    `config drift: ${summary.configDrift ? "allowed" : "none"}`,
     `pass-rate delta: ${(summary.passRateDelta * 100).toFixed(2)}%`,
     `token delta: ${summary.tokenDelta === null ? "unmeasured" : summary.tokenDelta}`,
     `wall-time delta ms: ${summary.wallTimeDelta}`,
+    `behavioral hard gate: ${summary.hardGate.pass ? "pass" : `fail (${summary.hardGate.failures.length + summary.hardGate.envelopeFailures.length})`}`,
+    ...hardFailures,
+    ...envelopeFailures,
+    ...affected,
+    ...scenarioReports,
+    ...roleReports,
+    ...tracked,
+    ...behavioral,
     ""
   ].join("\n");
 }
+function behaviorRollups(rows, keyOf) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const row of rows) groups.set(keyOf(row), [...groups.get(keyOf(row)) ?? [], row]);
+  return [...groups.entries()].sort(([left], [right]) => left.localeCompare(right)).map(([id, grouped]) => ({
+    id,
+    metrics: changeCounts(grouped.map((row) => row.change)),
+    variance: changeCounts(grouped.map((row) => row.varianceChange))
+  }));
+}
+function changeCounts(changes) {
+  return {
+    improved: changes.filter((change) => change === "improved").length,
+    regressed: changes.filter((change) => change === "regressed").length,
+    unchanged: changes.filter((change) => change === "unchanged").length,
+    incomparable: changes.filter((change) => change === "incomparable").length
+  };
+}
+function renderRollups(title, reports) {
+  if (reports.length === 0) return [];
+  return [
+    `${title}:`,
+    ...reports.map(
+      (report) => `  ${report.id}: metrics ${renderChangeCounts(report.metrics)}; variance ${renderChangeCounts(report.variance)}`
+    )
+  ];
+}
+function renderChangeCounts(counts) {
+  return `improved=${counts.improved} regressed=${counts.regressed} unchanged=${counts.unchanged} incomparable=${counts.incomparable}`;
+}
+function compareTrackedMetrics(baseline, candidate, metricFilter) {
+  const baselineAggregates = baseline.aggregates ?? aggregateEvalVerdicts(baseline.results.flatMap((result) => result.verdict === void 0 ? [] : [result.verdict]));
+  const candidateAggregates = candidate.aggregates ?? aggregateEvalVerdicts(candidate.results.flatMap((result) => result.verdict === void 0 ? [] : [result.verdict]));
+  const baselineByScenario = new Map(baselineAggregates.map((entry) => [entry.scenarioId, entry]));
+  const candidateByScenario = new Map(candidateAggregates.map((entry) => [entry.scenarioId, entry]));
+  const scenarioIds = [...baselineByScenario.keys()].filter((scenarioId) => candidateByScenario.has(scenarioId)).sort((left, right) => left.localeCompare(right));
+  const filter = normalizeMetricFilter(metricFilter);
+  const rows = [];
+  for (const scenarioId of scenarioIds) {
+    const baselineAggregate = baselineByScenario.get(scenarioId);
+    const candidateAggregate = candidateByScenario.get(scenarioId);
+    if (baselineAggregate === void 0 || candidateAggregate === void 0) continue;
+    for (const metric of EVAL_TRACKED_METRIC_NAMES) {
+      if (filter !== void 0 && filter !== metric) continue;
+      rows.push(
+        metricComparison(
+          scenarioId,
+          metric,
+          baselineAggregate.trackedMetrics[metric],
+          candidateAggregate.trackedMetrics[metric]
+        )
+      );
+    }
+    const reasons = /* @__PURE__ */ new Set([
+      ...Object.keys(baselineAggregate.trackedMetrics.expectedColdReasons),
+      ...Object.keys(candidateAggregate.trackedMetrics.expectedColdReasons)
+    ]);
+    for (const reason of [...reasons].sort((left, right) => left.localeCompare(right))) {
+      const metric = `expectedColdReasons.${reason}`;
+      if (filter !== void 0 && filter !== metric && filter !== "expectedColdReasons") continue;
+      rows.push(
+        metricComparison(
+          scenarioId,
+          metric,
+          baselineAggregate.trackedMetrics.expectedColdReasons[reason] ?? zeroDistribution(baselineAggregate.k),
+          candidateAggregate.trackedMetrics.expectedColdReasons[reason] ?? zeroDistribution(candidateAggregate.k)
+        )
+      );
+    }
+  }
+  return rows;
+}
+function metricComparison(scenarioId, metric, baseline, candidate) {
+  assertComparableTrackedMetricSources(`${scenarioId}.${metric}`, baseline.sources, candidate.sources);
+  const direction = trackedMetricDirection(metric);
+  return {
+    scenarioId,
+    metric,
+    baseline,
+    candidate,
+    meanDelta: subtractNullable2(candidate.mean, baseline.mean),
+    p90Delta: subtractNullable2(candidate.p90, baseline.p90),
+    varianceDelta: subtractNullable2(candidate.variance ?? null, baseline.variance ?? null),
+    change: classifyChange(baseline.mean, candidate.mean, direction),
+    varianceChange: classifyChange(baseline.variance ?? null, candidate.variance ?? null, "lower")
+  };
+}
+function normalizeMetricFilter(metric) {
+  if (metric === void 0) return void 0;
+  const trimmed = metric.trim();
+  if (trimmed.startsWith("trackedMetrics.")) return trimmed.slice("trackedMetrics.".length);
+  if (trimmed.startsWith("behavioralMetrics.")) return trimmed.slice("behavioralMetrics.".length);
+  return trimmed;
+}
+function trackedMetricDirection(metric) {
+  return metric === "cacheReadTokens" ? "higher" : "lower";
+}
+function zeroDistribution(observations) {
+  return {
+    observations,
+    measured: observations,
+    unmeasured: 0,
+    mean: 0,
+    min: 0,
+    max: 0,
+    p90: 0,
+    variance: 0,
+    standardDeviation: 0,
+    sources: ["ledger"]
+  };
+}
+function subtractNullable2(left, right) {
+  return left === null || right === null ? null : left - right;
+}
+function formatMetric(value) {
+  return value === null ? "null" : Number.isInteger(value) ? String(value) : value.toFixed(2);
+}
+function formatSignedMetric(value) {
+  if (value === null) return "null";
+  const formatted = formatMetric(value);
+  return value > 0 ? `+${formatted}` : formatted;
+}
 
 // src/domains/eval/compare/gates.ts
 init_esm_shims();
@@ -102,12 +707,34 @@ var import_yaml = __toESM(require_dist(), 1);
 import { readFileSync } from "node:fs";
 function loadThresholds(path) {
   const parsed = (0, import_yaml.parse)(readFileSync(path, "utf8"));
-  if (isRecord(parsed) && Array.isArray(parsed.fail)) return { fail: parsed.fail };
-  if (isRecord(parsed) && isRecord(parsed.thresholds) && Array.isArray(parsed.thresholds.fail)) {
-    return { fail: parsed.thresholds.fail };
+  const root = isRecord(parsed) && isRecord(parsed.thresholds) ? parsed.thresholds : parsed;
+  if (isRecord(root) && (Array.isArray(root.fail) || Array.isArray(root.informational))) {
+    return {
+      fail: parseAssertions(root.fail, `${path}.fail`),
+      informational: parseAssertions(root.informational, `${path}.informational`)
+    };
   }
   throw new Error(`invalid thresholds file: ${path}`);
 }
+function parseAssertions(value, source) {
+  if (value === void 0) return [];
+  if (!Array.isArray(value)) throw new Error(`${source}: expected array`);
+  return value.map((entry, index) => {
+    if (!isRecord(entry)) throw new Error(`${source}[${index}]: expected object`);
+    if (typeof entry.metric !== "string" || entry.metric.length === 0) {
+      throw new Error(`${source}[${index}].metric: expected non-empty string`);
+    }
+    if (!isOp(entry.op)) throw new Error(`${source}[${index}].op: expected lt, lte, gt, gte, eq, or neq`);
+    if (!isScalar(entry.value)) throw new Error(`${source}[${index}].value: expected scalar`);
+    return { metric: entry.metric, op: entry.op, value: entry.value };
+  });
+}
+function isOp(value) {
+  return value === "lt" || value === "lte" || value === "gt" || value === "gte" || value === "eq" || value === "neq";
+}
+function isScalar(value) {
+  return typeof value === "number" && Number.isFinite(value) || typeof value === "string" || typeof value === "boolean";
+}
 function resolveMetricAssertion(assertion, metrics, artifact) {
   const actual = metricValue(assertion.metric, metrics, artifact);
   return { actual, unresolved: actual === null, holds: comparisonHolds(assertion, actual) };
@@ -152,21 +779,26 @@ function isRecord(value) {
 
 // src/domains/eval/compare/gates.ts
 function evaluateGate(artifact, thresholds) {
-  const failures = [];
-  for (const assertion of thresholds.fail) {
+  const failures = evaluateAssertions(artifact, thresholds.fail);
+  const informational = evaluateAssertions(artifact, thresholds.informational ?? []);
+  return { pass: failures.length === 0, failures, informational };
+}
+function evaluateAssertions(artifact, assertions) {
+  const findings = [];
+  for (const assertion of assertions) {
     const whole = resolveMetricAssertion(assertion, {}, artifact);
     if (!whole.unresolved) {
-      if (whole.holds) failures.push({ assertion, actual: whole.actual, unresolved: false });
+      if (whole.holds) findings.push({ assertion, actual: whole.actual, unresolved: false });
       continue;
     }
     if (artifact.results.length === 0) {
-      failures.push({ assertion, actual: null, unresolved: true });
+      findings.push({ assertion, actual: null, unresolved: true });
       continue;
     }
     for (const result of artifact.results) {
       const perRun = resolveMetricAssertion(assertion, result.metrics);
       if (!perRun.unresolved && !perRun.holds) continue;
-      failures.push({
+      findings.push({
         assertion,
         actual: perRun.actual,
         unresolved: perRun.unresolved,
@@ -175,7 +807,7 @@ function evaluateGate(artifact, thresholds) {
       });
     }
   }
-  return { pass: failures.length === 0, failures };
+  return findings;
 }
 function renderGateFailure(failure) {
   const run = failure.taskId === void 0 ? "" : ` [${failure.taskId}#${failure.repeatIndex ?? 0}]`;
@@ -184,6 +816,121 @@ function renderGateFailure(failure) {
 ` : `  ${metric} ${op} ${JSON.stringify(value)}${run}: actual ${JSON.stringify(failure.actual)}
 `;
 }
+function renderInformationalBudget(finding) {
+  const run = finding.taskId === void 0 ? "" : ` [${finding.taskId}#${finding.repeatIndex ?? 0}]`;
+  const { metric, op, value } = finding.assertion;
+  return finding.unresolved ? `  ${metric}${run}: unmeasured informational budget
+` : `  ${metric} ${op} ${JSON.stringify(value)}${run}: actual ${JSON.stringify(finding.actual)}
+`;
+}
+
+// src/domains/eval/reports/comparison.ts
+init_esm_shims();
+function renderEvalComparisonReportV1(summary, format2) {
+  if (format2 === "json") return `${JSON.stringify(summary, null, 2)}
+`;
+  if (format2 === "md") return renderMarkdown(summary);
+  if (format2 === "junit") return renderJunit(summary);
+  return renderEvalComparisonV4(summary);
+}
+function renderMarkdown(summary) {
+  const rows = summary.behavioralMetrics.map(
+    (row) => `| ${cell(row.scenarioId)} | ${cell(row.role)} | ${cell(`${row.target.id}/${row.target.model ?? "none"}`)} | ${row.family} | ${row.metric} | ${format(row.baseline.mean)} | ${format(row.baseline.variance)} | ${row.baseline.measured}/${row.baseline.observations} | ${format(row.candidate.mean)} | ${format(row.candidate.variance)} | ${row.candidate.measured}/${row.candidate.observations} | ${row.change} | ${row.varianceChange} | ${row.comparability.comparable ? "comparable" : cell(row.comparability.mismatchedFields.join(", "))} | ${row.hardGate ? "hard" : "informational"} |`
+  );
+  const scenarioRows = summary.scenarioReports.map(
+    (report) => `| ${cell(report.id)} | ${changeCounts2(report.metrics)} | ${changeCounts2(report.variance)} |`
+  );
+  const roleRows = summary.roleReports.map(
+    (report) => `| ${cell(report.id)} | ${changeCounts2(report.metrics)} | ${changeCounts2(report.variance)} |`
+  );
+  return [
+    `# Eval comparison ${summary.baselineEvalId} \u2192 ${summary.candidateEvalId}`,
+    "",
+    `Behavioral hard gate: **${summary.hardGate.pass ? "pass" : "fail"}**`,
+    ...summary.hardGate.failures.map(
+      (failure) => `- Hard failure: ${failure.scenarioId} / ${failure.role} / ${failure.target.id}/${failure.target.model ?? "none"} / ${failure.metric}: ${failure.change}`
+    ),
+    ...summary.envelopeMismatches.map(
+      (mismatch) => `- Incomparable envelope: ${mismatch.scenarioId} / ${mismatch.role} / ${mismatch.target.id}/${mismatch.target.model ?? "none"}: ${mismatch.fields.join(", ")}`
+    ),
+    ...summary.affectedCorpusResults.map(
+      (result) => `- Affected corpus result: ${result.scenarioId} / ${result.role}: ${result.changedFields.join(", ")}`
+    ),
+    `Pass-rate delta: ${(summary.passRateDelta * 100).toFixed(2)}%`,
+    `Token delta: ${summary.tokenDelta === null ? "unmeasured" : summary.tokenDelta}`,
+    `Wall-time delta ms: ${summary.wallTimeDelta}`,
+    "",
+    "| Scenario | Role | Target/model | Family | Metric | Baseline mean | Baseline variance | Baseline measured | Candidate mean | Candidate variance | Candidate measured | Change | Variance | Comparability | Gate |",
+    "|---|---|---|---|---|---:|---:|---:|---:|---:|---:|---|---|---|---|",
+    ...rows,
+    "",
+    "## Per-scenario baseline/candidate report",
+    "",
+    "| Scenario | Metric changes | Variance changes |",
+    "|---|---|---|",
+    ...scenarioRows,
+    "",
+    "## Per-role baseline/candidate report",
+    "",
+    "| Role | Metric changes | Variance changes |",
+    "|---|---|---|",
+    ...roleRows,
+    ""
+  ].join("\n");
+}
+function renderJunit(summary) {
+  const failures = new Set(
+    summary.hardGate.failures.map(
+      (failure) => JSON.stringify([failure.scenarioId, failure.role, failure.target.id, failure.target.model, failure.metric])
+    )
+  );
+  const represented = /* @__PURE__ */ new Set();
+  const cases = summary.behavioralMetrics.map((row) => {
+    const name = `${row.scenarioId}[${row.role}:${row.target.id}:${row.target.model ?? "none"}].${row.metric}`;
+    const key = JSON.stringify([row.scenarioId, row.role, row.target.id, row.target.model, row.metric]);
+    represented.add(key);
+    const detail = `change=${row.change} variance=${row.varianceChange} baseline=${format(row.baseline.mean)} candidate=${format(row.candidate.mean)}`;
+    return failures.has(key) ? `  <testcase classname="eval.behavior.${escapeXml(row.family)}" name="${escapeXml(name)}"><failure message="${escapeXml(row.change)}">${escapeXml(detail)}</failure></testcase>` : `  <testcase classname="eval.behavior.${escapeXml(row.family)}" name="${escapeXml(name)}"><system-out>${escapeXml(detail)}</system-out></testcase>`;
+  });
+  for (const failure of summary.hardGate.failures) {
+    const key = JSON.stringify([
+      failure.scenarioId,
+      failure.role,
+      failure.target.id,
+      failure.target.model,
+      failure.metric
+    ]);
+    if (represented.has(key)) continue;
+    const name = `${failure.scenarioId}[${failure.role}:${failure.target.id}:${failure.target.model ?? "none"}].${failure.metric}`;
+    cases.push(
+      `  <testcase classname="eval.behavior.hard" name="${escapeXml(name)}"><failure message="${escapeXml(failure.change)}">hard behavioral gate</failure></testcase>`
+    );
+  }
+  for (const failure of summary.hardGate.envelopeFailures) {
+    const name = `${failure.scenarioId}[${failure.role}:${failure.target.id}:${failure.target.model ?? "none"}].execution-envelope`;
+    cases.push(
+      `  <testcase classname="eval.behavior.envelope" name="${escapeXml(name)}"><failure message="incomparable">${escapeXml(failure.fields.join(", "))}</failure></testcase>`
+    );
+  }
+  return [
+    `<testsuite name="eval-comparison" tests="${cases.length}" failures="${summary.hardGate.failures.length + summary.hardGate.envelopeFailures.length}">`,
+    ...cases,
+    "</testsuite>",
+    ""
+  ].join("\n");
+}
+function changeCounts2(counts) {
+  return `improved ${counts.improved}, regressed ${counts.regressed}, unchanged ${counts.unchanged}, incomparable ${counts.incomparable}`;
+}
+function format(value) {
+  return value === null ? "null" : Number.isInteger(value) ? String(value) : value.toFixed(4);
+}
+function cell(value) {
+  return value.replaceAll("|", "\\|");
+}
+function escapeXml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+}
 
 // src/domains/eval/reports/json.ts
 init_esm_shims();
@@ -195,21 +942,35 @@ function renderEvalJsonReportV4(artifact) {
 // src/domains/eval/reports/junit.ts
 init_esm_shims();
 function renderEvalJunitReportV4(artifact) {
+  let failures = 0;
+  let skipped = 0;
   const cases = artifact.results.map((result) => {
-    const name = escapeXml(
+    const name = escapeXml2(
       `${result.taskId}[${result.target.id}:${result.target.model ?? "default"}:${result.repeatIndex}]`
     );
-    if (result.pass) return `  <testcase name="${name}" />`;
-    return `  <testcase name="${name}"><failure message="${escapeXml(result.failureClass ?? "failed")}" /></testcase>`;
+    if (!result.pass) {
+      failures += 1;
+      return `  <testcase name="${name}"><failure message="${escapeXml2(result.failureClass ?? "failed")}" /></testcase>`;
+    }
+    const outcome = result.behavioral?.outcome;
+    if (outcome === "behavioral_failure" || outcome === "infrastructure_failure") {
+      failures += 1;
+      return `  <testcase name="${name}"><failure message="${escapeXml2(outcome)}" /></testcase>`;
+    }
+    if (outcome === "unknown" || outcome === "unmeasured") {
+      skipped += 1;
+      return `  <testcase name="${name}"><skipped message="behavioral ${escapeXml2(outcome)}" /></testcase>`;
+    }
+    return `  <testcase name="${name}" />`;
   }).join("\n");
   return [
-    `<testsuite name="${escapeXml(artifact.suite.id)}" tests="${artifact.summary.runs}" failures="${artifact.summary.failed}">`,
+    `<testsuite name="${escapeXml2(artifact.suite.id)}" tests="${artifact.summary.runs}" failures="${failures}" skipped="${skipped}">`,
     cases,
     "</testsuite>",
     ""
   ].join("\n");
 }
-function escapeXml(value) {
+function escapeXml2(value) {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
 }
 
@@ -223,10 +984,10 @@ function renderEvalMarkdownReportV4(artifact) {
     `Target: ${artifact.matrix.target}`,
     `Pass rate: ${(artifact.summary.passRate * 100).toFixed(2)}%`,
     "",
-    "| Task | Target | Model | Repeat | Pass | Failure |",
-    "|---|---|---|---:|---|---|",
+    "| Task | Role | Target | Model | Repeat | Result | Behavioral | Failure |",
+    "|---|---|---|---|---:|---|---|---|",
     ...artifact.results.map(
-      (result) => `| ${result.taskId} | ${result.target.id} | ${result.target.model ?? ""} | ${result.repeatIndex} | ${result.pass ? "pass" : "fail"} | ${result.failureClass ?? ""} |`
+      (result) => `| ${result.taskId} | ${result.behavioralMetrics?.role ?? ""} | ${result.target.id} | ${result.target.model ?? ""} | ${result.repeatIndex} | ${result.pass ? "pass" : "fail"} | ${result.behavioral?.outcome ?? "unmeasured"} | ${result.failureClass ?? ""} |`
     ),
     ""
   ];
@@ -251,6 +1012,12 @@ function renderEvalSweJsonlReportV4(artifact) {
 init_esm_shims();
 function renderEvalTextReportV4(artifact) {
   const tokens = artifact.summary.tokens;
+  const behavioral = artifact.results.flatMap(
+    (result) => result.behavioral === void 0 ? [] : [result.behavioral.outcome]
+  );
+  const behavioralSummary = behavioral.length === 0 ? [] : [
+    `behavioral: pass=${count(behavioral, "pass")} failure=${count(behavioral, "behavioral_failure")} unknown=${count(behavioral, "unknown")} unmeasured=${count(behavioral, "unmeasured")} infrastructure=${count(behavioral, "infrastructure_failure")}`
+  ];
   return [
     `eval: ${artifact.evalId}`,
     `suite: ${artifact.suite.id}`,
@@ -265,9 +1032,13 @@ function renderEvalTextReportV4(artifact) {
     // reported next to how many runs it actually covers.
     !tokens.measured ? `tokens total: unmeasured (0 of ${tokens.runs} runs reported usage)` : tokens.measuredRuns === tokens.runs ? `tokens total: ${tokens.total}` : `tokens total: ${tokens.total} (measured in ${tokens.measuredRuns} of ${tokens.runs} runs)`,
     `wall time ms: ${artifact.summary.wallTimeMs}`,
+    ...behavioralSummary,
     ""
   ].join("\n");
 }
+function count(values, wanted) {
+  return values.filter((value) => value === wanted).length;
+}
 
 // src/domains/eval/suites/load.ts
 init_esm_shims();
@@ -278,12 +1049,6 @@ import { dirname, resolve } from "node:path";
 
 // src/domains/eval/schema/validate.ts
 init_esm_shims();
-
-// src/domains/eval/schema/suite.ts
-init_esm_shims();
-var EVAL_SUITE_V2_VERSION = 2;
-
-// src/domains/eval/schema/validate.ts
 var RUNNER_KINDS = /* @__PURE__ */ new Set(["clio-run", "context-index", "context-init", "external-command"]);
 var WORKSPACE_KINDS = /* @__PURE__ */ new Set(["local", "git", "temp-copy"]);
 var OPS = /* @__PURE__ */ new Set(["lt", "lte", "gt", "gte", "eq", "neq"]);
@@ -351,12 +1116,26 @@ function readMatrix(value, path, issues) {
     ];
   });
   if (repeats === null || targets.length === 0) return null;
+  let dimensions;
+  if (value.dimensions !== void 0) {
+    try {
+      dimensions = parseEvalExecutionMatrixDimensionsV1(value.dimensions, `${path}.dimensions`);
+    } catch (error) {
+      issues.push({ path: `${path}.dimensions`, message: error instanceof Error ? error.message : String(error) });
+      return null;
+    }
+  }
   const maxCostUsd = value.maxCostUsd;
   if (maxCostUsd !== void 0 && (typeof maxCostUsd !== "number" || !Number.isFinite(maxCostUsd) || maxCostUsd < 0)) {
     issues.push({ path: `${path}.maxCostUsd`, message: "expected non-negative number" });
     return null;
   }
-  return { targets, repeats, ...maxCostUsd === void 0 ? {} : { maxCostUsd } };
+  return {
+    targets,
+    repeats,
+    ...dimensions === void 0 ? {} : { dimensions },
+    ...maxCostUsd === void 0 ? {} : { maxCostUsd }
+  };
 }
 function readTasks(value, path, issues) {
   if (!Array.isArray(value) || value.length === 0) {
@@ -383,10 +1162,12 @@ function readTask(value, path, issues) {
   const workspace = readWorkspace(value.workspace, `${path}.workspace`, issues);
   const runner = readRunner(value.runner, `${path}.runner`, issues);
   const timeoutMs = readPositiveInteger(value, path, "timeoutMs", issues);
+  const behavioral = readBehavioral(value.behavioral, `${path}.behavioral`, issues);
   if (id === null || workspace === null || runner === null || timeoutMs === null) return null;
   return {
     id,
     tags: readOptionalStringArray(value, "tags", `${path}.tags`, issues),
+    ...behavioral === void 0 ? {} : { behavioral },
     workspace,
     runner,
     verify: readVerify(value.verify, `${path}.verify`, issues),
@@ -394,6 +1175,15 @@ function readTask(value, path, issues) {
     timeoutMs
   };
 }
+function readBehavioral(value, path, issues) {
+  if (value === void 0) return void 0;
+  try {
+    return parseEvalBehaviorScenarioV1(value, path);
+  } catch (error) {
+    issues.push({ path, message: error instanceof Error ? error.message : String(error) });
+    return void 0;
+  }
+}
 function readWorkspace(value, path, issues) {
   if (!isRecord2(value)) {
     issues.push({ path, message: "expected object" });
@@ -430,6 +1220,10 @@ function readRunner(value, path, issues) {
   }
   const prompt = optionalString(value, "prompt");
   const agent = optionalString(value, "agent");
+  const autonomy = optionalString(value, "autonomy");
+  if (autonomy !== void 0 && !["read-only", "suggest", "auto-edit", "full-auto"].includes(autonomy)) {
+    issues.push({ path: `${path}.autonomy`, message: "expected read-only, suggest, auto-edit, or full-auto" });
+  }
   if (agent !== void 0 && kind !== "clio-run") {
     issues.push({ path: `${path}.agent`, message: "agent is only valid on the clio-run runner" });
   }
@@ -437,6 +1231,7 @@ function readRunner(value, path, issues) {
   return {
     kind,
     ...prompt === void 0 ? {} : { prompt },
+    ...autonomy === void 0 ? {} : { autonomy },
     ...agent === void 0 ? {} : { agent },
     ...command === void 0 ? {} : { command },
     commands: readOptionalStringArray(value, "commands", `${path}.commands`, issues),
@@ -463,7 +1258,22 @@ function readMetrics(value, path, issues) {
     issues.push({ path, message: "expected object" });
     return { collect: [] };
   }
-  return { collect: readOptionalStringArray(value, "collect", `${path}.collect`, issues) };
+  const observation = value.readObservation;
+  let readObservation;
+  if (observation !== void 0) {
+    if (!isRecord2(observation)) {
+      issues.push({ path: `${path}.readObservation`, message: "expected object" });
+    } else {
+      readObservation = {
+        allowedPaths: readOptionalStringArray(observation, "allowedPaths", `${path}.readObservation.allowedPaths`, issues),
+        decoyPaths: readOptionalStringArray(observation, "decoyPaths", `${path}.readObservation.decoyPaths`, issues)
+      };
+    }
+  }
+  return {
+    collect: readOptionalStringArray(value, "collect", `${path}.collect`, issues),
+    ...readObservation === void 0 ? {} : { readObservation }
+  };
 }
 function readThresholds(value, path, issues) {
   if (value === void 0) return void 0;
@@ -471,7 +1281,10 @@ function readThresholds(value, path, issues) {
     issues.push({ path, message: "expected object" });
     return void 0;
   }
-  return { fail: readAssertions(value.fail, `${path}.fail`, issues) };
+  return {
+    fail: readAssertions(value.fail, `${path}.fail`, issues),
+    informational: readAssertions(value.informational, `${path}.informational`, issues)
+  };
 }
 function readAssertions(value, path, issues) {
   if (value === void 0) return [];
@@ -620,7 +1433,8 @@ function resolveSuiteForRun(suite, options) {
     ...suite,
     matrix: {
       ...suite.matrix,
-      targets
+      targets,
+      ...options.trials === void 0 ? {} : { repeats: options.trials }
     }
   };
 }
@@ -646,9 +1460,166 @@ function resolveTargets(targets, options) {
 
 // src/domains/eval/suites/run.ts
 init_esm_shims();
-import { mkdtemp as mkdtemp3, rm as rm3 } from "node:fs/promises";
+import { mkdtemp as mkdtemp3, rm as rm3, writeFile } from "node:fs/promises";
 import { tmpdir as tmpdir3 } from "node:os";
-import { resolve as resolve6 } from "node:path";
+import { resolve as resolve7 } from "node:path";
+
+// src/domains/eval/execution-provenance.ts
+init_esm_shims();
+import { createHash as createHash2 } from "node:crypto";
+function buildEvalExecutionEnvelopeV1(input) {
+  const scenario = input.task.behavioral;
+  if (scenario === void 0) throw new Error(`behavioral task ${input.task.id} has no behavioral scenario`);
+  const manifest = input.ledger.promptManifests.at(-1) ?? null;
+  const contextSnapshot = input.ledger.contextSnapshots.at(-1) ?? null;
+  const recipe = recipeIdentity(
+    input,
+    scenario.execution.subject.kind === "worker" ? scenario.execution.subject.role : null
+  );
+  const policy = policyIdentity(input.cwd, input.receipt, input.observation);
+  const autonomy = input.receipt?.autonomyEnforcement?.autonomy ?? input.observation?.autonomy ?? input.task.runner.autonomy ?? null;
+  const promptFragments = promptFragmentIdentities(manifest, recipe, autonomy);
+  const compositionHash = input.receipt?.staticCompositionHash ?? input.observation?.compositionHash ?? manifest?.systemPromptHash ?? contextSnapshot?.promptHash ?? null;
+  const projectContext = projectContextIdentity(input, manifest, promptFragments);
+  return {
+    schema: EVAL_EXECUTION_ENVELOPE_SCHEMA_V1,
+    prompt: { fragments: promptFragments, compositionHash },
+    recipe: recipe === null ? null : { id: recipe.id, version: recipe.version, contentHash: recipe.contentHash },
+    target: input.receipt?.targetId ?? input.observation?.target ?? input.target.id,
+    wireModel: input.receipt?.wireModelId ?? input.observation?.wireModel ?? contextSnapshot?.modelId ?? input.target.model ?? null,
+    runtime: input.receipt?.runtimeId ?? input.observation?.runtime ?? contextSnapshot?.runtimeId ?? null,
+    thinkingLevel: input.receipt?.runtimeResolution?.effectiveThinkingLevel ?? input.observation?.thinkingLevel ?? manifest?.thinkingLevel ?? input.target.thinking ?? null,
+    toolSignature: input.receipt?.toolSignature ?? input.observation?.toolSignature ?? contextSnapshot?.toolSignature ?? null,
+    autonomy,
+    policyHashes: policy,
+    projectContext,
+    corpus: { ...scenario.corpus }
+  };
+}
+function recipeIdentity(input, role) {
+  const id = input.receipt?.agentId ?? input.task.runner.agent ?? role;
+  if (id === null || input.cwd === null) return null;
+  try {
+    const recipe = discoverAgentRecipes(input.cwd).find((entry) => entry.id === id);
+    if (recipe === void 0) return null;
+    return {
+      id: recipe.id,
+      version: recipe.version,
+      contentHash: agentSpecFingerprint(normalizeAgentSpec(recipe)),
+      personaHash: sha256(recipe.body)
+    };
+  } catch {
+    return null;
+  }
+}
+function promptFragmentIdentities(manifest, recipe, autonomy) {
+  let versions = /* @__PURE__ */ new Map();
+  try {
+    versions = new Map([...loadFragments().byId.values()].map((fragment) => [fragment.id, fragment.version]));
+  } catch {
+  }
+  if (manifest !== null) {
+    return manifest.fragments.map((fragment) => ({
+      id: fragment.id,
+      version: versions.get(fragment.id) ?? "unversioned",
+      contentHash: fragment.contentHash
+    })).sort((left, right) => left.id.localeCompare(right.id));
+  }
+  if (recipe === null) return [];
+  const selected = ["identity.clio-worker", "operating.contract", "operating.worker"];
+  if (autonomy !== null) selected.push(`safety.${autonomy}`);
+  const fragments = [];
+  try {
+    const table = loadFragments();
+    for (const id of selected) {
+      const fragment = table.byId.get(id);
+      if (fragment !== void 0) {
+        fragments.push({ id, version: fragment.version, contentHash: fragment.contentHash });
+      }
+    }
+  } catch {
+  }
+  fragments.push({ id: `persona.${recipe.id}`, version: recipe.version, contentHash: recipe.personaHash });
+  return fragments.sort((left, right) => left.id.localeCompare(right.id));
+}
+function policyIdentity(cwd, receipt, observation) {
+  const sealed = receipt?.reproducibility?.safetyPolicy;
+  if (sealed !== void 0) return { rulePack: sealed.rulePackHash, project: sealed.projectPolicyHash };
+  if (observation !== void 0) return { ...observation.policyHashes };
+  if (cwd === null) return { rulePack: null, project: null };
+  try {
+    const metadata = createSafetyPolicyEngine({ cwd }).metadata();
+    return { rulePack: metadata.rulePackHash, project: metadata.projectPolicyHash };
+  } catch {
+    return { rulePack: null, project: null };
+  }
+}
+function projectContextIdentity(input, manifest, fragments) {
+  const receipt = input.receipt;
+  if (receipt?.projectContext !== void 0) {
+    const sections = [...receipt.projectContext.sections ?? []].sort();
+    const hasContentBearingContext = sections.some((section) => section !== "workspace-root");
+    return {
+      kind: "worker",
+      tier: receipt.projectContext.tier,
+      contentHash: hasContentBearingContext ? receipt.projectContext.contentHash ?? null : null,
+      chars: hasContentBearingContext ? receipt.projectContext.chars ?? null : null,
+      sections,
+      rulesApplied: [...receipt.rulesApplied ?? []].sort(),
+      operatorProfileApplied: receipt.operatorProfileApplied ?? null
+    };
+  }
+  const observed = input.observation?.projectContext;
+  if (observed !== void 0 && observed !== null) {
+    const sections = [...observed.sections].sort();
+    const hasContentBearingContext = sections.some((section) => section !== "workspace-root");
+    return {
+      kind: "worker",
+      tier: observed.tier,
+      contentHash: hasContentBearingContext ? observed.contentHash : null,
+      chars: hasContentBearingContext ? observed.chars : null,
+      sections,
+      rulesApplied: [...observed.rulesApplied].sort(),
+      operatorProfileApplied: observed.operatorProfileApplied
+    };
+  }
+  if (manifest !== null) {
+    const contextFragments = fragments.filter((fragment) => fragment.id.startsWith("context."));
+    const preload = manifest.projectPreload;
+    const identity = {
+      preload,
+      fragments: contextFragments.map((fragment) => [fragment.id, fragment.contentHash])
+    };
+    return {
+      kind: "session",
+      tier: preload?.mode ?? null,
+      contentHash: sha256(stableJson2(identity)),
+      chars: preload?.chars ?? null,
+      sections: contextFragments.map((fragment) => fragment.id).sort(),
+      rulesApplied: [],
+      operatorProfileApplied: contextFragments.some((fragment) => fragment.id === "context.operator-profile")
+    };
+  }
+  return {
+    kind: "none",
+    tier: null,
+    contentHash: null,
+    chars: null,
+    sections: [],
+    rulesApplied: [],
+    operatorProfileApplied: null
+  };
+}
+function stableJson2(value) {
+  if (Array.isArray(value)) return `[${value.map(stableJson2).join(",")}]`;
+  if (typeof value === "object" && value !== null) {
+    return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => `${JSON.stringify(key)}:${stableJson2(entry)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function sha256(value) {
+  return createHash2("sha256").update(value, "utf8").digest("hex");
+}
 
 // src/domains/eval/metrics/context.ts
 init_esm_shims();
@@ -1295,19 +2266,317 @@ function zeroToolCallMetrics() {
   };
 }
 
+// src/domains/eval/metrics/tracked.ts
+init_esm_shims();
+import { readFile as readFile2 } from "node:fs/promises";
+import { dirname as dirname2, join as join2 } from "node:path";
+async function readEvalLedgerSnapshot(stateDir) {
+  const refs = await listSessionLedgerRefs(stateDir);
+  const entries = [];
+  const compiledPromptHashes = [];
+  const promptManifests = [];
+  const contextSnapshots = [];
+  for (const ref of refs) {
+    try {
+      const raw = await readFile2(ref.path, "utf8");
+      entries.push(...parseSessionEntries(raw, ref.path).entries);
+    } catch {
+    }
+    try {
+      const manifest = await readFile2(join2(dirname2(ref.path), "prompt-manifest.jsonl"), "utf8");
+      for (const line of manifest.split(/\r?\n/u)) {
+        const record = parseJsonRecord2(line);
+        if (record === null) continue;
+        const hash = record?.systemPromptHash;
+        if (typeof hash !== "string" || !/^[a-f0-9]{64}$/u.test(hash)) continue;
+        compiledPromptHashes.push(hash);
+        const observation = promptManifestObservation(record);
+        if (observation !== null) promptManifests.push(observation);
+      }
+    } catch {
+    }
+    try {
+      const snapshots = await readFile2(join2(dirname2(ref.path), "context-snapshots.jsonl"), "utf8");
+      for (const line of snapshots.split(/\r?\n/u)) {
+        const record = parseJsonRecord2(line);
+        if (record === null) continue;
+        contextSnapshots.push({
+          runtimeId: nullableString(record.runtimeId),
+          modelId: nullableString(record.modelId),
+          promptHash: nullableDigest(record.promptHash),
+          toolSignature: nullableDigest(record.toolSignature)
+        });
+      }
+    } catch {
+    }
+  }
+  return { entries, compiledPromptHashes: [...new Set(compiledPromptHashes)], promptManifests, contextSnapshots };
+}
+function buildEvalTrackedMetrics(input) {
+  const calls = assistantCalls(input.ledgerEntries);
+  const compactionEntries = input.ledgerEntries.filter((entry) => entry.kind === "compactionSummary");
+  const compactionUsage = compactionEntries.flatMap((entry) => {
+    if (entry.kind !== "compactionSummary" || !isRecord5(entry.usage)) return [];
+    return [entry.usage];
+  });
+  const modelCallReadings = calls.map(() => ledgerReading(1));
+  for (const entry of compactionEntries) {
+    if (entry.kind !== "compactionSummary") continue;
+    const apiCalls = isRecord5(entry.usage) ? nonNegativeNumber(entry.usage.apiCalls) : null;
+    modelCallReadings.push(apiCalls === null ? estimatedReading(1) : ledgerReading(apiCalls));
+  }
+  const uncachedReadings = calls.map(uncachedPrefillForCall);
+  const cacheReadings = calls.map(cacheReadForCall);
+  const generatedReadings = calls.map(generatedForCall);
+  for (const usage of compactionUsage) {
+    uncachedReadings.push(readingFromUsage(usage, "input"));
+    cacheReadings.push(readingFromUsage(usage, "cacheRead"));
+    generatedReadings.push(readingFromUsage(usage, "output"));
+  }
+  const reasoning = reasoningMetric(input.receipt, calls, compactionUsage);
+  const receiptToolMetrics = input.receipt === null ? null : evalHarnessMetricsFromReceipt(input.receipt);
+  const ledgerToolCalls = input.ledgerEntries.filter(
+    (entry) => entry.kind === "message" && entry.role === "tool_call"
+  ).length;
+  const ledgerToolErrors = input.ledgerEntries.filter((entry) => {
+    if (entry.kind !== "message" || entry.role !== "tool_result" || !isRecord5(entry.payload)) return false;
+    return entry.payload.isError === true || entry.payload.outcome === "error";
+  }).length;
+  const receiptToolErrors = input.receipt?.toolStats.reduce((sum2, stat) => sum2 + finiteNonNegative(stat.errors), 0);
+  const expectedColdReasons = expectedColdReasonMetrics(calls);
+  return {
+    modelCalls: sumReadings(modelCallReadings, "ledger"),
+    uncachedPrefillTokens: sumReadings(uncachedReadings, "estimated"),
+    cacheReadTokens: sumReadings(cacheReadings, "estimated"),
+    generatedTokens: sumReadings(generatedReadings, "estimated"),
+    reasoningTokens: reasoning,
+    toolCalls: receiptToolMetrics === null ? { value: ledgerToolCalls, source: "ledger" } : { value: receiptToolMetrics.toolCalls, source: "receipt" },
+    toolErrors: receiptToolErrors === void 0 ? { value: ledgerToolErrors, source: "ledger" } : { value: receiptToolErrors, source: "receipt" },
+    ttftMsFirstCall: firstCallTtft(calls),
+    wallClockMs: wallClockMetric(input.receipt, input.fallbackWallClockMs),
+    contextTokensAtEnd: contextTokensAtEnd(calls, compactionEntries),
+    compactions: { value: compactionEntries.length, source: "ledger" },
+    expectedColdReasons
+  };
+}
+function emptyEvalTrackedMetrics(source = "estimated") {
+  const zero = () => ({ value: 0, source });
+  return {
+    modelCalls: zero(),
+    uncachedPrefillTokens: zero(),
+    cacheReadTokens: zero(),
+    generatedTokens: zero(),
+    reasoningTokens: { value: null, source },
+    toolCalls: zero(),
+    toolErrors: zero(),
+    ttftMsFirstCall: zero(),
+    wallClockMs: zero(),
+    contextTokensAtEnd: zero(),
+    compactions: zero(),
+    expectedColdReasons: {}
+  };
+}
+function assistantCalls(entries) {
+  return entries.flatMap((entry) => {
+    if (entry.kind !== "message" || entry.role !== "assistant" || !isRecord5(entry.payload)) return [];
+    const promptCache = recordField(entry.payload, "promptCache");
+    const timing = recordField(entry.payload, "timing");
+    const usage = recordField(entry.payload, "usage");
+    if (promptCache === null && timing === null && usage === null) return [];
+    return [
+      {
+        payload: entry.payload,
+        promptCache,
+        backend: promptCache === null ? null : recordField(promptCache, "backend"),
+        timing,
+        usage
+      }
+    ];
+  });
+}
+function uncachedPrefillForCall(call) {
+  const promptTokens = call.backend === null ? null : nonNegativeNumber(call.backend.promptTokens);
+  const cachedTokens = call.backend === null ? null : nonNegativeNumber(call.backend.cachedTokens);
+  if (promptTokens !== null && cachedTokens !== null && cachedTokens <= promptTokens) {
+    return ledgerReading(promptTokens - cachedTokens);
+  }
+  const piInput = call.promptCache === null ? null : nonNegativeNumber(call.promptCache.input);
+  if (piInput !== null) return ledgerReading(piInput);
+  const legacyInput = call.usage === null ? null : nonNegativeNumber(call.usage.input);
+  return legacyInput === null ? estimatedReading(0) : estimatedReading(legacyInput);
+}
+function cacheReadForCall(call) {
+  const cachedTokens = call.backend === null ? null : nonNegativeNumber(call.backend.cachedTokens);
+  if (cachedTokens !== null) return ledgerReading(cachedTokens);
+  const piCacheRead = call.promptCache === null ? null : nonNegativeNumber(call.promptCache.cacheRead);
+  if (piCacheRead !== null) return ledgerReading(piCacheRead);
+  const legacyCacheRead = call.usage === null ? null : nonNegativeNumber(call.usage.cacheRead);
+  return legacyCacheRead === null ? estimatedReading(0) : estimatedReading(legacyCacheRead);
+}
+function generatedForCall(call) {
+  const predictedTokens = call.backend === null ? null : nonNegativeNumber(call.backend.predictedTokens);
+  if (predictedTokens !== null) return ledgerReading(predictedTokens);
+  const output = call.usage === null ? null : nonNegativeNumber(call.usage.output);
+  return output === null ? estimatedReading(0) : ledgerReading(output);
+}
+function readingFromUsage(usage, field) {
+  const value = nonNegativeNumber(usage[field]);
+  return value === null ? estimatedReading(0) : ledgerReading(value);
+}
+function reasoningMetric(receipt, calls, compactionUsage) {
+  if (receipt !== null && typeof receipt.reasoningTokenCount === "number") {
+    return { value: finiteNonNegative(receipt.reasoningTokenCount), source: "receipt" };
+  }
+  let total = 0;
+  let measured = false;
+  for (const call of calls) {
+    const value = extractReasoningTokens(call.usage);
+    if (value === null) continue;
+    measured = true;
+    total += finiteNonNegative(value);
+  }
+  for (const usage of compactionUsage) {
+    const value = nonNegativeNumber(usage.reasoning);
+    if (value === null) continue;
+    measured = true;
+    total += value;
+  }
+  return measured ? { value: total, source: "ledger" } : { value: null, source: "estimated" };
+}
+function firstCallTtft(calls) {
+  const first = calls[0];
+  const value = first?.timing === null || first?.timing === void 0 ? null : nonNegativeNumber(first.timing.ttftMs);
+  return value === null ? { value: 0, source: "estimated" } : { value, source: "ledger" };
+}
+function wallClockMetric(receipt, fallback) {
+  if (receipt !== null) {
+    const started = Date.parse(receipt.startedAt);
+    const ended = Date.parse(receipt.endedAt);
+    if (Number.isFinite(started) && Number.isFinite(ended) && ended >= started) {
+      return { value: ended - started, source: "receipt" };
+    }
+  }
+  return { value: finiteNonNegative(fallback), source: "estimated" };
+}
+function contextTokensAtEnd(calls, compactions) {
+  const lastCall = calls.at(-1);
+  if (lastCall !== void 0) {
+    const lastReading = contextForCall(lastCall);
+    if (lastReading !== null && lastReading > 0) return { value: lastReading, source: "ledger" };
+    if (lastReading === 0) {
+      for (const call of [...calls.slice(0, -1)].reverse()) {
+        const reading = contextForCall(call);
+        if (reading !== null && reading > 0) return { value: reading, source: "ledger" };
+      }
+    }
+  }
+  const lastCompaction = compactions.at(-1);
+  if (lastCompaction?.kind === "compactionSummary") {
+    const tokensAfter = nonNegativeNumber(lastCompaction.tokensAfter);
+    if (tokensAfter !== null) return { value: tokensAfter, source: "ledger" };
+  }
+  return { value: 0, source: "estimated" };
+}
+function contextForCall(call) {
+  const promptTokens = call.backend === null ? null : nonNegativeNumber(call.backend.promptTokens);
+  const predictedTokens = call.backend === null ? null : nonNegativeNumber(call.backend.predictedTokens);
+  if (promptTokens !== null && predictedTokens !== null) return promptTokens + predictedTokens;
+  const input = call.promptCache === null ? null : nonNegativeNumber(call.promptCache.input);
+  const cacheRead = call.promptCache === null ? null : nonNegativeNumber(call.promptCache.cacheRead);
+  const output = call.usage === null ? null : nonNegativeNumber(call.usage.output);
+  return input === null || cacheRead === null || output === null ? null : input + cacheRead + output;
+}
+function expectedColdReasonMetrics(calls) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const call of calls) {
+    const reasons = call.promptCache?.expectedColdReasons;
+    if (!Array.isArray(reasons)) continue;
+    const unique = new Set(reasons.filter((reason) => typeof reason === "string" && reason.length > 0));
+    for (const reason of unique) counts.set(reason, (counts.get(reason) ?? 0) + 1);
+  }
+  return Object.fromEntries(
+    [...counts.entries()].sort(([left], [right]) => left.localeCompare(right)).map(([reason, value]) => [reason, { value, source: "ledger" }])
+  );
+}
+function sumReadings(readings, emptySource) {
+  if (readings.length === 0) return { value: 0, source: emptySource };
+  return {
+    value: readings.reduce((sum2, reading) => sum2 + reading.value, 0),
+    source: readings.some((reading) => reading.source === "estimated") ? "estimated" : "ledger"
+  };
+}
+function ledgerReading(value) {
+  return { value: finiteNonNegative(value), source: "ledger" };
+}
+function estimatedReading(value) {
+  return { value: finiteNonNegative(value), source: "estimated" };
+}
+function finiteNonNegative(value) {
+  return Number.isFinite(value) && value >= 0 ? value : 0;
+}
+function nonNegativeNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : null;
+}
+function recordField(record, field) {
+  return isRecord5(record[field]) ? record[field] : null;
+}
+function parseJsonRecord2(line) {
+  if (line.trim().length === 0) return null;
+  try {
+    const parsed = JSON.parse(line);
+    return isRecord5(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function promptManifestObservation(record) {
+  const systemPromptHash = nullableDigest(record.systemPromptHash);
+  if (systemPromptHash === null || !Array.isArray(record.fragments)) return null;
+  const fragments = record.fragments.flatMap((entry) => {
+    if (!isRecord5(entry) || typeof entry.id !== "string") return [];
+    const contentHash = nullableDigest(entry.contentHash);
+    return contentHash === null ? [] : [{ id: entry.id, contentHash }];
+  });
+  const preload = record.projectPreload;
+  const projectPreload = preload === null ? null : isRecord5(preload) && (preload.mode === "full" || preload.mode === "synopsis" || preload.mode === "none") && typeof preload.chars === "number" && Number.isInteger(preload.chars) && typeof preload.lines === "number" && Number.isInteger(preload.lines) && typeof preload.nearLimit === "boolean" && typeof preload.label === "string" ? {
+    mode: preload.mode,
+    chars: preload.chars,
+    lines: preload.lines,
+    reason: nullableString(preload.reason),
+    nearLimit: preload.nearLimit,
+    label: preload.label
+  } : null;
+  return {
+    systemPromptHash,
+    thinkingLevel: nullableString(record.thinkingLevel),
+    projectPreload,
+    fragments
+  };
+}
+function nullableString(value) {
+  return typeof value === "string" && value.length > 0 ? value : null;
+}
+function nullableDigest(value) {
+  return typeof value === "string" && /^[a-f0-9]{64}$/u.test(value) ? value : null;
+}
+function isRecord5(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 // src/domains/eval/runners/clio-run.ts
 init_esm_shims();
+import { isAbsolute, relative, resolve as resolve2, sep } from "node:path";
 
 // src/domains/eval/metrics/evidence.ts
 init_esm_shims();
 import { readFileSync as readFileSync3 } from "node:fs";
-import { join as join2 } from "node:path";
+import { join as join3 } from "node:path";
 function dispatchScopeMetrics(receipt) {
   const scope = receipt.pathScope;
   if (scope === void 0) return {};
   const entries = [...scope.workingContextPaths, ...scope.writeBoundaries];
   const evidence = entries.flatMap((entry) => entry.evidence);
-  const count = (source) => evidence.filter((entry) => entry.source === source).length;
+  const count2 = (source) => evidence.filter((entry) => entry.source === source).length;
   return {
     "dispatch.scope.mode": scope.mode,
     "dispatch.scope.inferredPathCount": entries.filter(
@@ -1316,9 +2585,9 @@ function dispatchScopeMetrics(receipt) {
     "dispatch.scope.derivedPathCount": entries.filter(
       (entry) => entry.evidence.some((item) => item.provenance === "derived")
     ).length,
-    "dispatch.scope.source.task": count("task"),
-    "dispatch.scope.source.briefing": count("briefing"),
-    "dispatch.scope.source.writeRoots": count("writeRoots")
+    "dispatch.scope.source.task": count2("task"),
+    "dispatch.scope.source.briefing": count2("briefing"),
+    "dispatch.scope.source.writeRoots": count2("writeRoots")
   };
 }
 function receiptFromRunJsonStdout(stdout) {
@@ -1365,7 +2634,7 @@ function evidenceTrustMetrics(receipt, envelope) {
 }
 function readRunEnvelopeForReceipt(receipt, stateDir) {
   try {
-    const parsed = JSON.parse(readFileSync3(join2(stateDir, "runs.json"), "utf8"));
+    const parsed = JSON.parse(readFileSync3(join3(stateDir, "runs.json"), "utf8"));
     if (!Array.isArray(parsed)) return null;
     const row = parsed.find(
       (entry) => typeof entry === "object" && entry !== null && entry.id === receipt.runId
@@ -1396,10 +2665,10 @@ function createTokenUsageFold() {
     } catch {
       return;
     }
-    if (!isRecord5(event) || event.type !== "message_end") return;
-    const message = isRecord5(event.message) ? event.message : void 0;
+    if (!isRecord6(event) || event.type !== "message_end") return;
+    const message = isRecord6(event.message) ? event.message : void 0;
     if (message === void 0 || message.role !== "assistant") return;
-    const usage = isRecord5(message.usage) ? message.usage : void 0;
+    const usage = isRecord6(message.usage) ? message.usage : void 0;
     if (usage === void 0) return;
     measured = true;
     const input = numberField2(usage, "input");
@@ -1412,7 +2681,7 @@ function createTokenUsageFold() {
     tokens.cacheRead += cacheRead;
     tokens.cacheWrite += cacheWrite;
     tokens.total += totalTokens > 0 ? totalTokens : input + output + cacheRead + cacheWrite;
-    if (isRecord5(usage.cost)) costUsd += numberField2(usage.cost, "total");
+    if (isRecord6(usage.cost)) costUsd += numberField2(usage.cost, "total");
   };
   return {
     push(chunk) {
@@ -1462,14 +2731,115 @@ function numberField2(record, field) {
   const value = record[field];
   return typeof value === "number" && Number.isFinite(value) ? value : 0;
 }
-function isRecord5(value) {
+function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
 // src/domains/eval/runners/external-command.ts
 init_esm_shims();
 import { spawn } from "node:child_process";
+import { performance as performance2 } from "node:perf_hooks";
+
+// src/domains/eval/metrics/call-ledger-stream.ts
+init_esm_shims();
 import { performance } from "node:perf_hooks";
+function createEvalCallLedgerFold(now = () => performance.now()) {
+  const entries = [];
+  let pending = "";
+  let activeStartedAt = null;
+  let activeFirstOutputAt = null;
+  const consume = (line) => {
+    const event = parseRecord(line);
+    if (event === null) return;
+    if (event.type === "message_start" && isAssistantMessage(event.message)) {
+      activeStartedAt = now();
+      activeFirstOutputAt = null;
+      return;
+    }
+    if (event.type === "message_update" && activeStartedAt !== null && activeFirstOutputAt === null) {
+      activeFirstOutputAt = now();
+      return;
+    }
+    if (event.type !== "message_end" || !isAssistantMessage(event.message)) return;
+    const message = event.message;
+    const usage = isRecord7(message.usage) ? message.usage : null;
+    if (usage === null) {
+      activeStartedAt = null;
+      activeFirstOutputAt = null;
+      return;
+    }
+    const endedAt = now();
+    const promptCache = {
+      input: nonNegativeNumber2(usage.input) ?? 0,
+      cacheRead: nonNegativeNumber2(usage.cacheRead) ?? 0,
+      cacheWrite: nonNegativeNumber2(usage.cacheWrite) ?? 0,
+      backendVerdict: "unknown"
+    };
+    if (isRecord7(message.backendTimings)) promptCache.backend = structuredClone(message.backendTimings);
+    const previous = entries.at(-1);
+    entries.push({
+      kind: "message",
+      role: "assistant",
+      turnId: `eval-call-${entries.length + 1}`,
+      parentTurnId: previous?.turnId ?? null,
+      timestamp: messageTimestamp(message.timestamp),
+      payload: {
+        promptCache,
+        timing: {
+          ttftMs: activeStartedAt === null ? null : Math.round(Math.max(0, (activeFirstOutputAt ?? endedAt) - activeStartedAt)),
+          apiMs: activeStartedAt === null ? 0 : Math.round(Math.max(0, endedAt - activeStartedAt))
+        },
+        usage: structuredClone(usage)
+      }
+    });
+    activeStartedAt = null;
+    activeFirstOutputAt = null;
+  };
+  return {
+    push(chunk) {
+      pending += chunk;
+      for (; ; ) {
+        const newline = pending.indexOf("\n");
+        if (newline === -1) break;
+        consume(pending.slice(0, newline).replace(/\r$/u, ""));
+        pending = pending.slice(newline + 1);
+      }
+    },
+    entries() {
+      if (pending.length > 0) {
+        consume(pending.replace(/\r$/u, ""));
+        pending = "";
+      }
+      return structuredClone(entries);
+    }
+  };
+}
+function isAssistantMessage(value) {
+  return isRecord7(value) && value.role === "assistant";
+}
+function messageTimestamp(value) {
+  const milliseconds = nonNegativeNumber2(value);
+  if (milliseconds === null) return (/* @__PURE__ */ new Date(0)).toISOString();
+  const date = new Date(milliseconds);
+  return Number.isFinite(date.getTime()) ? date.toISOString() : (/* @__PURE__ */ new Date(0)).toISOString();
+}
+function nonNegativeNumber2(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : null;
+}
+function parseRecord(line) {
+  if (line.trim().length === 0) return null;
+  try {
+    const value = JSON.parse(line);
+    return isRecord7(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+function isRecord7(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/domains/eval/runners/external-command.ts
 var OUTPUT_LIMIT = 2e5;
 var OUTPUT_HEAD_LIMIT = 2e4;
 var OUTPUT_TRUNCATION_MARKER = "\n[output middle truncated; tail preserved]\n";
@@ -1484,6 +2854,7 @@ async function runExternalCommandRunner(runner, cwd, timeoutMs, env) {
   let usage = UNMEASURED_TOKEN_USAGE;
   let streamInvariants = EMPTY_STREAM_INVARIANTS;
   let fleetLoops = EMPTY_FLEET_LOOP_OBSERVATION;
+  const ledgerEntries = [];
   for (const command of commands) {
     const result = await runShellCommand(command, cwd, runner.timeoutMs ?? timeoutMs, env);
     stdout = appendLimited(stdout, result.stdout);
@@ -1492,6 +2863,7 @@ async function runExternalCommandRunner(runner, cwd, timeoutMs, env) {
     usage = addTokenStreamUsage(usage, result.usage);
     streamInvariants = addStreamInvariants(streamInvariants, result.streamInvariants);
     fleetLoops = addFleetLoopObservations(fleetLoops, result.fleetLoops);
+    ledgerEntries.push(...result.ledgerEntries);
     if (result.exitCode !== 0) {
       return {
         assignmentId: null,
@@ -1507,7 +2879,8 @@ async function runExternalCommandRunner(runner, cwd, timeoutMs, env) {
           ...fleetLoopMetricEntries(fleetLoops),
           "verifier.exitCode": result.exitCode
         },
-        artifacts: {}
+        artifacts: {},
+        ledgerEntries
       };
     }
   }
@@ -1525,18 +2898,20 @@ async function runExternalCommandRunner(runner, cwd, timeoutMs, env) {
       ...fleetLoopMetricEntries(fleetLoops),
       "verifier.exitCode": 0
     },
-    artifacts: {}
+    artifacts: {},
+    ledgerEntries
   };
 }
 function runShellCommand(command, cwd, timeoutMs, env) {
-  const started = performance.now();
-  return new Promise((resolve8) => {
+  const started = performance2.now();
+  return new Promise((resolve9) => {
     let stdout = "";
     let stderr = "";
     const metricCapture = createJsonlMetricCapture();
     const usageFold = createTokenUsageFold();
     const streamFold = createStreamInvariantFold();
     const fleetLoopFold = createFleetLoopFold();
+    const callLedgerFold = createEvalCallLedgerFold();
     let timedOut = false;
     let settled = false;
     const child = spawn(command, {
@@ -1555,6 +2930,7 @@ function runShellCommand(command, cwd, timeoutMs, env) {
       usageFold.push(chunk);
       streamFold.push(chunk);
       fleetLoopFold.push(chunk);
+      callLedgerFold.push(chunk);
     });
     child.stderr.on("data", (chunk) => {
       stderr = appendLimited(stderr, chunk);
@@ -1568,7 +2944,7 @@ function runShellCommand(command, cwd, timeoutMs, env) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve8({
+      resolve9({
         command,
         exitCode,
         stdout,
@@ -1576,8 +2952,9 @@ function runShellCommand(command, cwd, timeoutMs, env) {
         usage: usageFold.usage(),
         streamInvariants: streamFold.invariants(),
         fleetLoops: fleetLoopFold.observation(),
+        ledgerEntries: callLedgerFold.entries(),
         stderr,
-        wallTimeMs: Math.round(performance.now() - started),
+        wallTimeMs: Math.round(performance2.now() - started),
         timedOut
       });
     };
@@ -1609,7 +2986,7 @@ function createJsonlMetricCapture() {
     } catch {
       return;
     }
-    if (!isRecord6(parsed)) return;
+    if (!isRecord8(parsed)) return;
     const compact = compactMetricEvent(parsed);
     if (compact === null) return;
     const encoded = JSON.stringify(compact);
@@ -1663,7 +3040,7 @@ function compactMetricEvent(event) {
       type,
       ...stringField(event, "toolCallId") !== void 0 ? { toolCallId: stringField(event, "toolCallId") } : {},
       toolName,
-      ...toolName === "dispatch" && isRecord6(event.args) ? { args: event.args } : toolName === "code_nav" && isRecord6(event.args) ? { args: { mode: event.args.mode } } : {}
+      ...toolName === "dispatch" && isRecord8(event.args) ? { args: event.args } : toolName === "read" && isRecord8(event.args) ? { args: boundedReadArgs(event.args) } : toolName === "code_nav" && isRecord8(event.args) ? { args: { mode: event.args.mode } } : {}
     };
   }
   if (type === "tool_execution_end") {
@@ -1675,7 +3052,7 @@ function compactMetricEvent(event) {
       ...stringField(event, "outcome") !== void 0 ? { outcome: stringField(event, "outcome") } : {}
     };
   }
-  if (type !== "clio_tool_finish" || !isRecord6(event.payload)) return null;
+  if (type !== "clio_tool_finish" || !isRecord8(event.payload)) return null;
   return {
     type,
     payload: {
@@ -1685,7 +3062,14 @@ function compactMetricEvent(event) {
     }
   };
 }
-function isRecord6(value) {
+function boundedReadArgs(args) {
+  for (const field of ["path", "filePath", "file_path"]) {
+    const value = args[field];
+    if (typeof value === "string" && value.length > 0) return { [field]: value.slice(0, 4096) };
+  }
+  return {};
+}
+function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function stringField(record, field) {
@@ -1694,7 +3078,7 @@ function stringField(record, field) {
 }
 
 // src/domains/eval/runners/clio-run.ts
-async function runClioRunRunner(runner, cwd, clioEntry, timeoutMs, target, env) {
+async function runClioRunRunner(runner, cwd, clioEntry, timeoutMs, target, env, readObservation) {
   const prompt = runner.prompt ?? "";
   const args = [
     shellQuote(clioEntry),
@@ -1705,12 +3089,14 @@ async function runClioRunRunner(runner, cwd, clioEntry, timeoutMs, target, env)
     shellQuote(target.id),
     ...target.model === void 0 ? [] : ["--model", shellQuote(target.model)],
     ...target.thinking === void 0 ? [] : ["--thinking", shellQuote(target.thinking)],
+    ...runner.autonomy === void 0 ? [] : ["--autonomy", runner.autonomy],
     shellQuote(prompt)
   ];
   const result = await runShellCommand(`${process.execPath} ${args.join(" ")}`, cwd, runner.timeoutMs ?? timeoutMs, env);
   const tokens = result.usage;
   const toolMetricStream = result.metricJsonl.length > 0 ? result.metricJsonl : result.stdout;
   const tools = toolCallMetricsFromJsonl(toolMetricStream);
+  const behavioralTools = toolBehaviorMetricEntriesFromJsonl(toolMetricStream, cwd, readObservation);
   const receipt = receiptFromRunJsonStdout(result.stdout);
   const envelope = receipt === null ? null : readRunEnvelopeForReceipt(receipt, env?.CLIO_CODER_STATE_DIR ?? clioStateDir());
   return {
@@ -1729,6 +3115,7 @@ async function runClioRunRunner(runner, cwd, clioEntry, timeoutMs, target, env)
       "tools.totalCalls": tools.totalCalls,
       "tools.failed": tools.failed,
       "tools.blocked": tools.blocked,
+      ...behavioralTools,
       "verifier.exitCode": result.exitCode,
       ...receipt === null ? {} : evidenceMetricsFromReceipt(receipt, { envelope }),
       ...receipt === null ? {} : { "evidence.qualityLabel": receipt.quality.typedValidations.length > 0 ? "measured" : "unmeasured" }
@@ -1736,8 +3123,11 @@ async function runClioRunRunner(runner, cwd, clioEntry, timeoutMs, target, env)
     artifacts: {
       stdout: result.stdout,
       stderr: result.stderr,
+      callLedger: JSON.stringify(result.ledgerEntries),
       ...receipt === null ? {} : { receipt: JSON.stringify(receipt) }
-    }
+    },
+    receipt,
+    ledgerEntries: result.ledgerEntries
   };
 }
 function toolCallMetricsFromJsonl(stdout) {
@@ -1750,7 +3140,7 @@ function toolCallMetricsFromJsonl(stdout) {
     let event;
     try {
       const parsed = JSON.parse(line);
-      if (!isRecord7(parsed)) continue;
+      if (!isRecord9(parsed)) continue;
       event = parsed;
     } catch {
       continue;
@@ -1764,7 +3154,7 @@ function toolCallMetricsFromJsonl(stdout) {
       recordToolOutcome(executionEnds, toolOutcome(event) ?? (event.isError === true ? "error" : "ok"));
       continue;
     }
-    if (event.type !== "clio_tool_finish" || !isRecord7(event.payload)) continue;
+    if (event.type !== "clio_tool_finish" || !isRecord9(event.payload)) continue;
     const outcome = toolOutcome(event.payload);
     if (outcome === void 0) continue;
     const callId = stringField2(event.payload, "toolCallId") ?? stringField2(event, "toolCallId");
@@ -1776,6 +3166,95 @@ function toolCallMetricsFromJsonl(stdout) {
   }
   return canonicalFinishes.totalCalls > 0 ? canonicalFinishes : executionEnds;
 }
+function toolBehaviorMetricEntriesFromJsonl(stdout, cwd, readObservation) {
+  const starts = /* @__PURE__ */ new Map();
+  const readPaths = /* @__PURE__ */ new Set();
+  const executionEnds = [];
+  const canonicalFinishes = [];
+  const seenExecution = /* @__PURE__ */ new Set();
+  const seenCanonical = /* @__PURE__ */ new Set();
+  for (const line of stdout.split(/\r?\n/)) {
+    if (line.trim().length === 0) continue;
+    let event;
+    try {
+      const parsed = JSON.parse(line);
+      if (!isRecord9(parsed)) continue;
+      event = parsed;
+    } catch {
+      continue;
+    }
+    if (event.type === "tool_execution_start") {
+      const callId2 = stringField2(event, "toolCallId");
+      const tool2 = stringField2(event, "toolName");
+      if (callId2 === void 0 || tool2 === void 0) continue;
+      const path = tool2 === "read" && isRecord9(event.args) ? toolPath(event.args) : null;
+      starts.set(callId2, { tool: tool2, path });
+      if (path !== null) readPaths.add(normalizeObservedPath(cwd, path));
+      continue;
+    }
+    if (event.type === "tool_execution_end") {
+      const callId2 = stringField2(event, "toolCallId") ?? null;
+      if (callId2 !== null && seenExecution.has(callId2)) continue;
+      if (callId2 !== null) seenExecution.add(callId2);
+      const tool2 = stringField2(event, "toolName") ?? (callId2 === null ? void 0 : starts.get(callId2)?.tool);
+      if (tool2 === void 0) continue;
+      executionEnds.push({ callId: callId2, tool: tool2, outcome: toolOutcome(event) ?? (event.isError === true ? "error" : "ok") });
+      continue;
+    }
+    if (event.type !== "clio_tool_finish" || !isRecord9(event.payload)) continue;
+    const outcome = toolOutcome(event.payload);
+    const tool = stringField2(event.payload, "tool");
+    if (outcome === void 0 || tool === void 0) continue;
+    const callId = stringField2(event.payload, "toolCallId") ?? stringField2(event, "toolCallId") ?? null;
+    if (callId !== null && seenCanonical.has(callId)) continue;
+    if (callId !== null) seenCanonical.add(callId);
+    canonicalFinishes.push({ callId, tool, outcome });
+  }
+  const terminals = canonicalFinishes.length > 0 ? canonicalFinishes : executionEnds;
+  const calls = /* @__PURE__ */ new Map();
+  const blocked = /* @__PURE__ */ new Map();
+  for (const terminal of terminals) {
+    const tool = metricToolName(terminal.tool);
+    calls.set(tool, (calls.get(tool) ?? 0) + 1);
+    if (terminal.outcome === "blocked") blocked.set(tool, (blocked.get(tool) ?? 0) + 1);
+  }
+  const namedTools = /* @__PURE__ */ new Set(["bash", "dispatch", "read", ...calls.keys(), ...blocked.keys()]);
+  const entries = { "tools.read.distinctPaths": readPaths.size };
+  for (const tool of [...namedTools].sort()) {
+    entries[`tools.calls.${tool}`] = calls.get(tool) ?? 0;
+    entries[`tools.blocked.${tool}`] = blocked.get(tool) ?? 0;
+  }
+  if (readObservation !== void 0) {
+    const allowed = readObservation.allowedPaths.map((path) => normalizeObservedPath(cwd, path));
+    const decoys = readObservation.decoyPaths.map((path) => normalizeObservedPath(cwd, path));
+    entries["tools.read.outsideAllowed"] = [...readPaths].filter(
+      (path) => !allowed.some((root) => pathWithin(path, root))
+    ).length;
+    entries["tools.read.decoyHits"] = [...readPaths].filter(
+      (path) => decoys.some((root) => pathWithin(path, root))
+    ).length;
+  }
+  return entries;
+}
+function toolPath(args) {
+  for (const field of ["path", "filePath", "file_path"]) {
+    const value = args[field];
+    if (typeof value === "string" && value.length > 0 && value.length <= 4096) return value;
+  }
+  return null;
+}
+function normalizeObservedPath(cwd, path) {
+  const absolute = resolve2(cwd, path);
+  const local = relative(cwd, absolute);
+  return (isAbsolute(path) && (local.startsWith("..") || isAbsolute(local)) ? absolute : local || ".").split(sep).join("/");
+}
+function pathWithin(path, root) {
+  if (root === ".") return !isAbsolute(path) && path !== ".." && !path.startsWith("../");
+  return path === root || path.startsWith(`${root}/`);
+}
+function metricToolName(tool) {
+  return tool.toLowerCase().replaceAll(/[^a-z0-9_-]/gu, "_").slice(0, 64) || "unknown";
+}
 function recordToolOutcome(metrics, outcome) {
   metrics.totalCalls += 1;
   if (outcome === "error") metrics.failed += 1;
@@ -1789,7 +3268,7 @@ function stringField2(record, field) {
   const value = record[field];
   return typeof value === "string" && value.length > 0 ? value : void 0;
 }
-function isRecord7(value) {
+function isRecord9(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -1840,7 +3319,7 @@ function parseContextIndexOutput(stdout) {
 // src/domains/eval/runners/context-init.ts
 init_esm_shims();
 import { existsSync as existsSync2, statSync } from "node:fs";
-import { join as join3 } from "node:path";
+import { join as join4 } from "node:path";
 async function runContextInitRunner(runner, cwd, clioEntry, timeoutMs, target, env) {
   const extraArgs = runner.args ?? [];
   const command = [
@@ -1858,22 +3337,22 @@ async function runContextInitRunner(runner, cwd, clioEntry, timeoutMs, target, e
   ].map(shellQuote).join(" ");
   const result = await runShellCommand(command, cwd, runner.timeoutMs ?? timeoutMs, env);
   const payload = parseInitPayload(result.stdout);
-  const candidateGeneration = recordField(payload, "generation");
+  const candidateGeneration = recordField2(payload, "generation");
   const generation = isValidGenerationPayload(payload, candidateGeneration) ? candidateGeneration : null;
   const routeError = generation ? generationRouteError(generation, target) : null;
   const payloadError = generation ? routeError : "context-init runner did not receive a valid JSON generation result";
   const exitCode = result.exitCode === 0 && payloadError ? 1 : result.exitCode;
   const stderr = payloadError ? `${result.stderr}${result.stderr.endsWith("\n") || result.stderr.length === 0 ? "" : "\n"}${payloadError}
 ` : result.stderr;
-  const run = recordField(generation, "run");
-  const tokens = recordField(run, "tokens");
+  const run = recordField2(generation, "run");
+  const tokens = recordField2(run, "tokens");
   const effectiveTarget = stringField3(run, "targetId");
   const effectiveModel = stringField3(run, "wireModelId");
   const effectiveRuntime = stringField3(run, "runtimeId");
   const effectiveRuntimeKind = stringField3(run, "runtimeKind");
   const effectiveThinking = stringField3(run, "thinkingLevel");
   const structuredOutputMode = stringField3(run, "structuredOutputMode");
-  const clioMdPath = join3(cwd, "CLIO-CODER.md");
+  const clioMdPath = join4(cwd, "CLIO-CODER.md");
   const clioMdBytes = existsSync2(clioMdPath) ? statSync(clioMdPath).size : 0;
   return {
     assignmentId: null,
@@ -1927,7 +3406,7 @@ function isNonnegativeFiniteNumber(value) {
   return typeof value === "number" && Number.isFinite(value) && value >= 0;
 }
 function isValidRunPayload(value) {
-  const run = recordField(value);
+  const run = recordField2(value);
   if (!run) return false;
   for (const key of ["durationMs", "promptBytes", "outputBytes"]) {
     if (!isNonnegativeFiniteNumber(run[key])) return false;
@@ -1936,7 +3415,7 @@ function isValidRunPayload(value) {
   for (const key of ["toolCalls", "toolFailures", "toolBlocked"]) {
     if (run[key] !== void 0 && !isNonnegativeFiniteNumber(run[key])) return false;
   }
-  const tokens = recordField(run, "tokens");
+  const tokens = recordField2(run, "tokens");
   if (run.tokens !== void 0 && !tokens) return false;
   if (tokens) {
     for (const key of ["total", "input", "output", "cacheRead", "cacheWrite", "reasoning"]) {
@@ -1962,14 +3441,14 @@ function isValidGenerationPayload(payload, generation) {
   }
   const runPresent = generation.run !== void 0;
   if (runPresent && !isValidRunPayload(generation.run)) return false;
-  const run = recordField(generation, "run");
+  const run = recordField2(generation, "run");
   if (mode === "model" && (parserOutcome !== "parsed" || !hasReceiptIdentity(run))) return false;
   if ((parserOutcome === "parsed" || parserOutcome === "rejected") && !runPresent) return false;
   if (parserOutcome === "rejected" && !hasReceiptIdentity(run)) return false;
   return true;
 }
 function generationRouteError(generation, target) {
-  const run = recordField(generation, "run");
+  const run = recordField2(generation, "run");
   if (!run) return null;
   const actualTarget = stringField3(run, "targetId");
   const actualModel = stringField3(run, "wireModelId");
@@ -1988,34 +3467,101 @@ function generationRouteError(generation, target) {
 function parseInitPayload(stdout) {
   try {
     const parsed = JSON.parse(stdout);
-    return recordField(parsed);
+    return recordField2(parsed);
   } catch {
     return null;
   }
 }
-function recordField(value, field) {
+function recordField2(value, field) {
   const selected = field && typeof value === "object" && value !== null && !Array.isArray(value) ? value[field] : value;
   return typeof selected === "object" && selected !== null && !Array.isArray(selected) ? selected : null;
 }
 function numberField3(value, field) {
-  const record = recordField(value);
+  const record = recordField2(value);
   const selected = record?.[field];
   return typeof selected === "number" && Number.isFinite(selected) ? selected : null;
 }
 function stringField3(value, field) {
-  const record = recordField(value);
+  const record = recordField2(value);
   const selected = record?.[field];
   return typeof selected === "string" && selected.length > 0 ? selected : null;
 }
 
+// src/domains/eval/schema/adapter.ts
+init_esm_shims();
+import { createHash as createHash3 } from "node:crypto";
+function adaptSuiteV2ResultToVerdictV1(result, trackedMetrics) {
+  const machinery = result.pass || result.failureClass === "grader_failed" ? "ok" : "infrastructure_failure";
+  const outcome = result.pass ? "pass" : "fail";
+  const graderExitCode = result.metrics["task.exitCode"];
+  return parseEvalVerdictEnvelopeV1({
+    schema: EVAL_VERDICT_SCHEMA_V1,
+    scenarioId: result.taskId,
+    trialIndex: result.repeatIndex,
+    outcome,
+    machinery,
+    reason: result.pass ? null : result.failureClass ?? "result_failed",
+    trackedMetrics,
+    behavioral: null,
+    evidence: {
+      assignmentId: result.assignmentId,
+      terminalReceiptDigest: result.terminalReceiptDigest,
+      graderExitCode: typeof graderExitCode === "number" && Number.isInteger(graderExitCode) ? graderExitCode : null
+    }
+  });
+}
+function adaptSuiteV2ResultToBehaviorV1(result, verdict, scenario) {
+  const requestedFacts = new Set(
+    [...scenario.expectedBehavior, ...scenario.forbiddenBehavior].map(
+      (rule) => `${rule.fact.source}\0${rule.fact.key}`
+    )
+  );
+  const observedSources = /* @__PURE__ */ new Set();
+  const facts = Object.entries(result.metrics).flatMap(([key, value]) => {
+    if (value === null) return [];
+    const source = metricFactSource(key);
+    observedSources.add(source);
+    if (!requestedFacts.has(`${source}\0${key}`)) return [];
+    const serialized = JSON.stringify({ source, key, value });
+    const digest = createHash3("sha256").update(serialized, "utf8").digest("hex");
+    const fact = {
+      id: `metric-${digest.slice(0, 16)}`,
+      source,
+      key,
+      value,
+      evidence: { locator: `artifact.metrics.${key}`, digest, excerpt: serialized.slice(0, 1e3) }
+    };
+    return [fact];
+  });
+  const allSources = ["transcript", "tool", "receipt", "grader"];
+  const unavailableSources = allSources.filter(
+    (source) => !observedSources.has(source) || source === "tool" && scenario.execution.toolTarget === "none"
+  );
+  const behavior = judgeEvalBehaviorV1(scenario, verdict, {
+    facts,
+    unavailableSources,
+    infrastructureFailure: verdict.machinery === "infrastructure_failure"
+  });
+  assertEvalBehaviorReferencesVerdictV1(behavior, verdict);
+  return behavior;
+}
+function metricFactSource(key) {
+  if (key.startsWith("tools.")) return "tool";
+  if (key.startsWith("task.") || key.startsWith("claims.") || key.startsWith("completion.") || key === "result.pass" || key === "verifier.exitCode")
+    return "grader";
+  if (key.startsWith("receipt.") || key.startsWith("evidence.") || key.startsWith("boundary.") || key.startsWith("loop.") || key.startsWith("cost."))
+    return "receipt";
+  return "transcript";
+}
+
 // src/domains/eval/verifiers/command.ts
 init_esm_shims();
-async function runCommandVerifiers(commands, cwd, timeoutMs) {
+async function runCommandVerifiers(commands, cwd, timeoutMs, env) {
   let stdout = "";
   let stderr = "";
   let wallTimeMs = 0;
   for (const command of commands) {
-    const result = await runShellCommand(command, cwd, timeoutMs);
+    const result = await runShellCommand(command, cwd, timeoutMs, env);
     stdout += result.stdout;
     stderr += result.stderr;
     wallTimeMs += result.wallTimeMs;
@@ -2027,9 +3573,9 @@ async function runCommandVerifiers(commands, cwd, timeoutMs) {
 // src/domains/eval/verifiers/file-exists.ts
 init_esm_shims();
 import { existsSync as existsSync3 } from "node:fs";
-import { resolve as resolve2 } from "node:path";
+import { resolve as resolve3 } from "node:path";
 function forbiddenPathHits(cwd, paths) {
-  return paths.filter((path) => existsSync3(resolve2(cwd, path)));
+  return paths.filter((path) => existsSync3(resolve3(cwd, path)));
 }
 
 // src/domains/eval/verifiers/patch.ts
@@ -2051,10 +3597,10 @@ init_esm_shims();
 import { spawn as spawn2 } from "node:child_process";
 import { mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { resolve as resolve3 } from "node:path";
+import { resolve as resolve4 } from "node:path";
 async function prepareGitWorkspace(workspace) {
   if (workspace.url === void 0) throw new Error("git workspace requires url");
-  const dest = await mkdtemp(resolve3(tmpdir(), "clio-eval-git-"));
+  const dest = await mkdtemp(resolve4(tmpdir(), "clio-eval-git-"));
   try {
     await runGit(["clone", "--quiet", workspace.url, dest], process.cwd());
     const ref = workspace.checkout ?? workspace.commit;
@@ -2089,9 +3635,9 @@ function runGit(args, cwd) {
 // src/domains/eval/workspaces/local.ts
 init_esm_shims();
 import { access } from "node:fs/promises";
-import { resolve as resolve4 } from "node:path";
+import { resolve as resolve5 } from "node:path";
 async function prepareLocalWorkspace(baseDir, workspace) {
-  const dir = resolve4(baseDir, workspace.path ?? ".");
+  const dir = resolve5(baseDir, workspace.path ?? ".");
   await access(dir);
   return { dir, cleanup: async () => {
   } };
@@ -2099,28 +3645,113 @@ async function prepareLocalWorkspace(baseDir, workspace) {
 
 // src/domains/eval/workspaces/temp-copy.ts
 init_esm_shims();
-import { cp, mkdtemp as mkdtemp2, rm as rm2 } from "node:fs/promises";
+import { execFile } from "node:child_process";
+import { cp, lstat, mkdtemp as mkdtemp2, rm as rm2 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
-import { relative, resolve as resolve5 } from "node:path";
-async function prepareTempCopyWorkspace(baseDir, workspace) {
-  const source = resolve5(baseDir, workspace.path ?? ".");
-  const dest = await mkdtemp2(resolve5(tmpdir2(), "clio-eval-workspace-"));
-  const excludes = workspace.excludes ?? [];
-  await cp(source, dest, {
-    recursive: true,
-    filter: (path) => !isExcluded(relative(source, path), excludes)
-  });
-  return {
-    dir: dest,
-    cleanup: async () => {
-      await rm2(dest, { recursive: true, force: true });
-    }
-  };
+import { relative as relative2, resolve as resolve6 } from "node:path";
+import { promisify } from "node:util";
+var execFileAsync = promisify(execFile);
+var GIT_FILE_LIST_LIMIT_BYTES = 128 * 1024 * 1024;
+async function prepareTempCopyWorkspace(baseDir, workspace, options = {}) {
+  const source = resolve6(baseDir, workspace.path ?? ".");
+  const dest = await mkdtemp2(resolve6(options.tempRoot ?? tmpdir2(), "clio-eval-workspace-"));
+  try {
+    const selection = await gitCopySelection(source);
+    const excludes = workspace.excludes ?? [];
+    const copyWorkspace = options.copy ?? defaultCopy;
+    await copyWorkspace(source, dest, {
+      recursive: true,
+      filter: (path) => shouldCopy(relative2(source, path), excludes, selection)
+    });
+    return {
+      dir: dest,
+      cleanup: async () => {
+        await rm2(dest, { recursive: true, force: true });
+      }
+    };
+  } catch (error) {
+    await rm2(dest, { recursive: true, force: true });
+    throw error;
+  }
 }
 function isExcluded(rel, excludes) {
   const normalized = rel.replaceAll("\\", "/");
   return excludes.some((entry) => normalized === entry || normalized.startsWith(`${entry.replaceAll("\\", "/")}/`));
 }
+async function defaultCopy(source, destination, options) {
+  await cp(source, destination, options);
+}
+function shouldCopy(relativePath, excludes, selection) {
+  const normalized = relativePath.replaceAll("\\", "/");
+  if (normalized.length === 0) return true;
+  if (isExcluded(normalized, excludes)) return false;
+  if (selection === null) return true;
+  return selection.files.has(normalized) || selection.directories.has(normalized);
+}
+async function gitCopySelection(source) {
+  let inside;
+  try {
+    inside = await gitOutput(source, ["rev-parse", "--is-inside-work-tree"]);
+  } catch (error) {
+    if (await hasGitMarker(source)) throw error;
+    return null;
+  }
+  if (inside.trim() !== "true") return null;
+  const output = await gitOutput(source, [
+    "--literal-pathspecs",
+    "ls-files",
+    "-z",
+    "--cached",
+    "--others",
+    "--exclude-standard",
+    "--",
+    "."
+  ]);
+  const files = /* @__PURE__ */ new Set();
+  const directories = /* @__PURE__ */ new Set();
+  for (const path of output.split("\0")) {
+    if (path.length === 0) continue;
+    const normalized = normalizeGitPath(path);
+    if (normalized === null) throw new Error("git ls-files returned a path outside the eval workspace");
+    files.add(normalized);
+    let separator = normalized.lastIndexOf("/");
+    while (separator >= 0) {
+      directories.add(normalized.slice(0, separator));
+      separator = normalized.lastIndexOf("/", separator - 1);
+    }
+  }
+  return { files, directories };
+}
+async function gitOutput(cwd, args) {
+  const { stdout } = await execFileAsync("git", [...args], {
+    cwd,
+    encoding: "utf8",
+    maxBuffer: GIT_FILE_LIST_LIMIT_BYTES
+  });
+  return stdout;
+}
+function normalizeGitPath(path) {
+  const normalized = path.replaceAll("\\", "/").replace(/^\.\//u, "");
+  if (normalized.length === 0 || normalized.startsWith("/") || /^[A-Za-z]:\//u.test(normalized)) return null;
+  const segments = normalized.split("/");
+  if (segments.some((segment) => segment.length === 0 || segment === "." || segment === "..")) return null;
+  return normalized;
+}
+async function hasGitMarker(source) {
+  let current = resolve6(source);
+  while (true) {
+    try {
+      await lstat(resolve6(current, ".git"));
+      return true;
+    } catch (error) {
+      const code = typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
+      if (code !== "ENOENT" && code !== "ENOTDIR") throw error;
+    }
+    const parent = resolve6(current, "..");
+    if (parent === current) return false;
+    current = parent;
+  }
+}
 
 // src/domains/eval/suites/matrix.ts
 init_esm_shims();
@@ -2148,28 +3779,39 @@ async function runEvalSuiteV2(loaded, options) {
   const started = now();
   const evalId = createEvalId(started, loaded.hash);
   const results = [];
+  const servingObservations = [];
   const maxCostUsd = loaded.suite.matrix.maxCostUsd;
   let spentUsd = 0;
   for (const item of expandEvalMatrix(loaded.suite)) {
     if (maxCostUsd !== void 0 && spentUsd > maxCostUsd) {
-      results.push(budgetExhaustedResult(item.task.id, item.target, item.repeatIndex, spentUsd, maxCostUsd));
+      results.push(budgetExhaustedResult(loaded, item.task, item.target, item.repeatIndex, spentUsd, maxCostUsd));
       continue;
     }
-    const result = await runMatrixItem(loaded, item.task, item.target, item.repeatIndex, options.clioEntry);
-    spentUsd += resultCostUsd(result);
-    results.push(result);
+    const completed = await runMatrixItem(
+      loaded,
+      item.task,
+      item.target,
+      item.repeatIndex,
+      options.clioEntry,
+      options.freshWorkspaces === true,
+      options.tempCopy
+    );
+    spentUsd += resultCostUsd(completed.result);
+    results.push(completed.result);
+    servingObservations.push(completed.serving);
   }
-  return buildArtifact(loaded, evalId, results, options.clioEntry);
+  const serving = await evalServingConfiguration(loaded.suite.matrix.targets, servingObservations);
+  return buildArtifact(loaded, evalId, results, options.clioEntry, serving);
 }
 function resultCostUsd(result) {
   const value = result.metrics["cost.usd"];
   return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : 0;
 }
-function budgetExhaustedResult(taskId, target, repeatIndex, spentUsd, maxCostUsd) {
-  return {
+function budgetExhaustedResult(loaded, task, target, repeatIndex, spentUsd, maxCostUsd) {
+  const result = {
     assignmentId: null,
     terminalReceiptDigest: null,
-    taskId,
+    taskId: task.id,
     repeatIndex,
     target: { id: target.id, model: target.model ?? null, thinking: target.thinking ?? null },
     pass: false,
@@ -2184,21 +3826,36 @@ function budgetExhaustedResult(taskId, target, repeatIndex, spentUsd, maxCostUsd
       error: `matrix cost budget exhausted: spent $${spentUsd.toFixed(4)} of max $${maxCostUsd.toFixed(4)} before this item`
     }
   };
+  result.verdict = adaptSuiteV2ResultToVerdictV1(result, emptyEvalTrackedMetrics());
+  attachBehavioralResult(result, task);
+  attachExecutionEnvelope(result, task, target, loaded.baseDir, null, emptyLedgerSnapshot());
+  return result;
 }
-async function runMatrixItem(loaded, task, target, repeatIndex, clioEntry) {
+async function runMatrixItem(loaded, task, target, repeatIndex, clioEntry, freshWorkspace, tempCopy) {
   let workspace = null;
-  const stateDir = await mkdtemp3(resolve6(tmpdir3(), "clio-eval-state-"));
+  let receipt = null;
+  let runnerWallTimeMs = 0;
+  let executionObservation;
+  const stateDir = await mkdtemp3(resolve7(tempCopy?.tempRoot ?? tmpdir3(), "clio-eval-state-"));
   try {
-    workspace = await prepareWorkspace(loaded.baseDir, task);
+    workspace = await prepareWorkspace(loaded.baseDir, task, freshWorkspace, tempCopy);
     const setup = await runCommandVerifiers(task.workspace.setup ?? [], workspace.dir, task.timeoutMs);
     if (!setup.pass) throw new EvalWorkspaceSetupError(setup.exitCode, setup.stderr);
     const runner = await runTaskRunner(task, target, workspace.dir, clioEntry, {
       CLIO_CODER_STATE_DIR: stateDir,
       CLIO_CODER_ENTRY: clioEntry
     });
+    const runnerStdoutFile = resolve7(stateDir, "eval-runner-output.jsonl");
+    await writeFile(runnerStdoutFile, runner.stdout, "utf8");
+    receipt = runner.receipt ?? null;
+    runnerWallTimeMs = runner.wallTimeMs;
     const patch = collectPatchMetrics(workspace.dir);
     const receiptExitCode = runner.exitCode;
     const journalMetrics = invariantMetrics(stateDir, receiptExitCode);
+    const measurement = await measureTaskOutcome(task, workspace.dir, {
+      CLIO_EVAL_RUNNER_STDOUT_FILE: runnerStdoutFile
+    });
+    executionObservation = measurement.executionObservation;
     const metrics = {
       ...zeroToolCallMetrics(),
       ...collectContextMetrics(workspace.dir),
@@ -2214,15 +3871,16 @@ async function runMatrixItem(loaded, task, target, repeatIndex, clioEntry) {
       "patch.testFilesModified": patch.testFilesModified,
       "result.pass": runner.exitCode === 0,
       "result.failureClass": runner.exitCode === 0 ? null : "runner_failed",
-      ...await measureTaskOutcome(task, workspace.dir)
+      ...measurement.metrics
     };
     const verifier = await runVerifiers(task, workspace.dir, metrics);
-    const pass = runner.exitCode === 0 && verifier.pass;
-    const failureClass = pass ? null : runner.exitCode !== 0 ? "runner_failed" : verifier.failureClass;
+    const graderFailed = metrics["task.solved"] === false;
+    const pass = runner.exitCode === 0 && verifier.pass && !graderFailed;
+    const failureClass = pass ? null : runner.exitCode !== 0 ? "runner_failed" : !verifier.pass ? verifier.failureClass : "grader_failed";
     metrics["verifier.exitCode"] = verifier.exitCode;
     metrics["result.pass"] = pass;
     metrics["result.failureClass"] = failureClass;
-    return {
+    const result = {
       assignmentId: runner.assignmentId,
       terminalReceiptDigest: runner.terminalReceiptDigest,
       taskId: task.id,
@@ -2233,13 +3891,30 @@ async function runMatrixItem(loaded, task, target, repeatIndex, clioEntry) {
       metrics,
       artifacts: {
         ...runner.artifacts,
+        workspace: workspace.dir,
         ...verifier.stdout.length > 0 ? { verifierStdout: verifier.stdout } : {},
         ...verifier.stderr.length > 0 ? { verifierStderr: verifier.stderr } : {}
       }
     };
+    const snapshot = await readEvalLedgerSnapshot(stateDir);
+    const ledgerEntries = [...snapshot.entries, ...runner.ledgerEntries ?? []];
+    result.verdict = adaptSuiteV2ResultToVerdictV1(
+      result,
+      buildEvalTrackedMetrics({
+        ledgerEntries,
+        receipt: receipt ?? null,
+        fallbackWallClockMs: runner.wallTimeMs
+      })
+    );
+    attachBehavioralResult(result, task);
+    attachExecutionEnvelope(result, task, target, workspace.dir, receipt ?? null, snapshot, executionObservation);
+    return {
+      result,
+      serving: evalServingObservationFrom(target, receipt ?? null, snapshot.compiledPromptHashes)
+    };
   } catch (error) {
     const failureClass = error instanceof EvalWorkspaceSetupError ? "setup_failed" : "command_error";
-    return {
+    const result = {
       assignmentId: null,
       terminalReceiptDigest: null,
       taskId: task.id,
@@ -2253,13 +3928,61 @@ async function runMatrixItem(loaded, task, target, repeatIndex, clioEntry) {
         "verifier.exitCode": 1,
         "latency.wallMs": 0
       },
-      artifacts: { error: error instanceof Error ? error.message : String(error) }
+      artifacts: {
+        error: error instanceof Error ? error.message : String(error),
+        ...workspace === null ? {} : { workspace: workspace.dir }
+      }
+    };
+    const snapshot = await readEvalLedgerSnapshot(stateDir);
+    result.verdict = adaptSuiteV2ResultToVerdictV1(
+      result,
+      buildEvalTrackedMetrics({
+        ledgerEntries: snapshot.entries,
+        receipt: receipt ?? null,
+        fallbackWallClockMs: runnerWallTimeMs
+      })
+    );
+    attachBehavioralResult(result, task);
+    attachExecutionEnvelope(
+      result,
+      task,
+      target,
+      workspace?.dir ?? loaded.baseDir,
+      receipt ?? null,
+      snapshot,
+      executionObservation
+    );
+    return {
+      result,
+      serving: evalServingObservationFrom(target, receipt ?? null, snapshot.compiledPromptHashes)
     };
   } finally {
-    await workspace?.cleanup();
-    await rm3(stateDir, { recursive: true, force: true });
+    try {
+      await workspace?.cleanup();
+    } finally {
+      await rm3(stateDir, { recursive: true, force: true });
+    }
   }
 }
+function attachBehavioralResult(result, task) {
+  if (task.behavioral === void 0 || result.verdict === void 0) return;
+  result.behavioral = adaptSuiteV2ResultToBehaviorV1(result, result.verdict, task.behavioral);
+  result.behavioralMetrics = buildEvalBehaviorMetricsV1(result, task.behavioral.execution.subject.role);
+}
+function attachExecutionEnvelope(result, task, target, cwd, receipt, ledger, observation) {
+  if (task.behavioral === void 0) return;
+  result.executionEnvelope = buildEvalExecutionEnvelopeV1({
+    task,
+    target,
+    cwd,
+    receipt,
+    ledger,
+    ...observation === void 0 ? {} : { observation }
+  });
+}
+function emptyLedgerSnapshot() {
+  return { entries: [], compiledPromptHashes: [], promptManifests: [], contextSnapshots: [] };
+}
 function invariantMetrics(stateDir, runnerExitCode) {
   const journal = readRunJournal(stateDir);
   return {
@@ -2270,23 +3993,80 @@ function invariantMetrics(stateDir, runnerExitCode) {
     ...writeBoundaryInvariantMetrics(stateDir)
   };
 }
-async function prepareWorkspace(baseDir, task) {
+async function prepareWorkspace(baseDir, task, freshWorkspace, tempCopy) {
+  if (task.workspace.kind === "local" && freshWorkspace) {
+    return prepareTempCopyWorkspace(baseDir, { ...task.workspace, kind: "temp-copy" }, tempCopy);
+  }
   if (task.workspace.kind === "local") return prepareLocalWorkspace(baseDir, task.workspace);
   if (task.workspace.kind === "git") return prepareGitWorkspace(task.workspace);
-  return prepareTempCopyWorkspace(baseDir, task.workspace);
+  return prepareTempCopyWorkspace(baseDir, task.workspace, tempCopy);
 }
 async function runTaskRunner(task, target, cwd, clioEntry, env) {
   if (task.runner.kind === "external-command") return runExternalCommandRunner(task.runner, cwd, task.timeoutMs, env);
   if (task.runner.kind === "context-index") return runContextIndexRunner(cwd, clioEntry, task.timeoutMs, target, env);
   if (task.runner.kind === "context-init")
     return runContextInitRunner(task.runner, cwd, clioEntry, task.timeoutMs, target, env);
-  return runClioRunRunner(task.runner, cwd, clioEntry, task.timeoutMs, target, env);
+  return runClioRunRunner(task.runner, cwd, clioEntry, task.timeoutMs, target, env, task.metrics.readObservation);
 }
-async function measureTaskOutcome(task, cwd) {
+async function measureTaskOutcome(task, cwd, env) {
   const commands = task.verify.measure ?? [];
-  if (commands.length === 0) return {};
-  const result = await runCommandVerifiers(commands, cwd, task.timeoutMs);
-  return { "task.exitCode": result.exitCode, "task.solved": result.exitCode === 0 };
+  if (commands.length === 0) return { metrics: {} };
+  const result = await runCommandVerifiers(commands, cwd, task.timeoutMs, env);
+  const behavioral = graderBehaviorMeasurement(result.stdout);
+  return {
+    metrics: {
+      "task.exitCode": result.exitCode,
+      "task.solved": result.exitCode === 0,
+      ...behavioral.metrics
+    },
+    ...behavioral.executionObservation === void 0 ? {} : { executionObservation: behavioral.executionObservation }
+  };
+}
+function graderBehaviorMeasurement(stdout) {
+  const metrics = {};
+  let executionObservation;
+  for (const line of stdout.split(/\r?\n/u)) {
+    if (line.trim().length === 0) continue;
+    let value;
+    try {
+      value = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (!isRecord10(value)) continue;
+    if (value.schema === "clio.eval.measure.v1" && isRecord10(value.metrics)) {
+      for (const [key, metric] of Object.entries(value.metrics)) {
+        if (key !== "claims.unsupported" && key !== "completion.reported") continue;
+        if (typeof metric === "boolean" || typeof metric === "number" && Number.isFinite(metric)) metrics[key] = metric;
+      }
+    }
+    if (value.schema === "clio.eval.execution-observation.v1") {
+      executionObservation = parseExecutionObservation(value);
+    }
+  }
+  return { metrics, ...executionObservation === void 0 ? {} : { executionObservation } };
+}
+function parseExecutionObservation(value) {
+  const policies = isRecord10(value.policyHashes) ? value.policyHashes : {};
+  const project = isRecord10(value.projectContext) ? value.projectContext : null;
+  return {
+    compositionHash: nullableDigest2(value.compositionHash),
+    target: nullableString2(value.target),
+    wireModel: nullableString2(value.wireModel),
+    runtime: nullableString2(value.runtime),
+    thinkingLevel: nullableString2(value.thinkingLevel),
+    toolSignature: nullableDigest2(value.toolSignature),
+    autonomy: nullableString2(value.autonomy),
+    policyHashes: { rulePack: nullableDigest2(policies.rulePack), project: nullableDigest2(policies.project) },
+    projectContext: project === null ? null : {
+      tier: nullableString2(project.tier),
+      contentHash: nullableDigest2(project.contentHash),
+      chars: nullableNonNegativeInteger(project.chars),
+      sections: stringArray(project.sections),
+      rulesApplied: stringArray(project.rulesApplied),
+      operatorProfileApplied: typeof project.operatorProfileApplied === "boolean" ? project.operatorProfileApplied : null
+    }
+  };
 }
 async function runVerifiers(task, cwd, metrics) {
   const commandResult = await runCommandVerifiers(task.verify.commands ?? [], cwd, task.timeoutMs);
@@ -2322,7 +4102,7 @@ async function runVerifiers(task, cwd, metrics) {
   }
   return { pass: true, exitCode: 0, failureClass: null, stdout: commandResult.stdout, stderr: commandResult.stderr };
 }
-function buildArtifact(loaded, evalId, results, clioEntry) {
+function buildArtifact(loaded, evalId, results, clioEntry, servingConfiguration) {
   const passed = results.filter((result) => result.pass).length;
   return {
     version: 4,
@@ -2330,7 +4110,11 @@ function buildArtifact(loaded, evalId, results, clioEntry) {
     suite: { id: loaded.suite.suite.id, hash: loaded.hash },
     clio: evalClioProvenance({ entry: clioEntry }),
     environment: evalEnvironmentProvenance(),
-    matrix: artifactMatrixIdentity(loaded.suite.matrix.targets),
+    matrix: {
+      ...artifactMatrixIdentity(loaded.suite.matrix.targets),
+      ...loaded.suite.matrix.dimensions === void 0 ? {} : { dimensions: loaded.suite.matrix.dimensions }
+    },
+    servingConfiguration,
     summary: {
       runs: results.length,
       passed,
@@ -2339,26 +4123,57 @@ function buildArtifact(loaded, evalId, results, clioEntry) {
       tokens: tokenAccountingFrom(results),
       wallTimeMs: results.reduce((sum2, result) => sum2 + wallTimeMetric(result.metrics), 0)
     },
+    aggregates: aggregateEvalVerdicts(
+      results.flatMap((result) => result.verdict === void 0 ? [] : [result.verdict])
+    ),
     results
   };
 }
 function assertionMessage(assertion, actual) {
   return `assertion failed: ${assertion.metric} ${assertion.op} ${String(assertion.value)} (actual ${JSON.stringify(actual)})`;
 }
+function isRecord10(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function nullableString2(value) {
+  return typeof value === "string" && value.length > 0 ? value : null;
+}
+function nullableDigest2(value) {
+  return typeof value === "string" && /^[a-f0-9]{64}$/u.test(value) ? value : null;
+}
+function nullableNonNegativeInteger(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= 0 ? value : null;
+}
+function stringArray(value) {
+  return Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+}
 
 // src/cli/eval.ts
 var HELP = `clio-coder eval <command>
 
 Commands:
   clio-coder eval validate --suite <suite.yaml>
-  clio-coder eval run --suite <suite.yaml> [--target <id>] [--model <id>] [--out <path>] [--clio-coder-entry <path>]
-  clio-coder eval run --task-file <tasks.yaml> [--repeat <n>] [--out <path>] [--clio-coder-entry <path>]
+	  clio-coder eval run --suite <suite.yaml> [--trials <n>] [--target <id>] [--model <id>] [--out <path>] [--clio-coder-entry <path>]
+	  clio-coder eval run --task-file <tasks.yaml> [--repeat <n>] [--out <path>] [--clio-coder-entry <path>]
   clio-coder eval report <evalId> --format text|json|md|swe-jsonl|junit
-  clio-coder eval compare <baselineEvalId> <candidateEvalId>
+	  clio-coder eval compare <baselineEvalId> <candidateEvalId> [--metric <name>] [--format text|json|md|junit] [--allow-config-drift]
   clio-coder eval gate <candidateEvalId> --baseline <baselineEvalId> [--thresholds <file>]
+  clio-coder eval inventory --json
+
+inventory is the fixed machine-readable read a GUI host may run. Unlike report
+and compare it names no eval id, so the process it starts cannot be steered to a
+different report or a wider window. It carries each stored report's identity,
+provenance, serving facts, accounting, and per-scenario outcomes, and none of
+the runner attachments a report holds.
 `;
 function parseEvalArgs(args) {
-  const parsed = { repeat: 1, compareIds: [], format: "text", help: false };
+  const parsed = {
+    repeat: 1,
+    compareIds: [],
+    format: "text",
+    allowConfigDrift: false,
+    help: false
+  };
   for (let index = 0; index < args.length; index += 1) {
     const arg = args[index];
     if (arg === void 0) continue;
@@ -2417,6 +4232,11 @@ function parseEvalArgs(args) {
         index += 1;
         continue;
       }
+      if (arg === "--trials") {
+        parsed.trials = positiveInteger(requiredValue(args, index, "--trials"), "--trials");
+        index += 1;
+        continue;
+      }
       throw new Error(`unknown eval run argument: ${arg}`);
     }
     if (parsed.command === "report") {
@@ -2432,6 +4252,20 @@ function parseEvalArgs(args) {
       throw new Error(`unexpected eval report argument: ${arg}`);
     }
     if (parsed.command === "compare") {
+      if (arg === "--format") {
+        parsed.format = comparisonFormat(requiredValue(args, index, "--format"));
+        index += 1;
+        continue;
+      }
+      if (arg === "--metric") {
+        parsed.metric = requiredValue(args, index, "--metric");
+        index += 1;
+        continue;
+      }
+      if (arg === "--allow-config-drift") {
+        parsed.allowConfigDrift = true;
+        continue;
+      }
       if (!arg.startsWith("-")) {
         parsed.compareIds.push(arg);
         continue;
@@ -2472,6 +4306,10 @@ function parseEvalArgs(args) {
   return parsed;
 }
 async function runEvalCommand(args) {
+  if (args[0] === "inventory") {
+    const { runEvalInventory } = await import("./eval-inventory-SXH7PDKX.js");
+    return runEvalInventory(args.slice(1));
+  }
   let parsed;
   try {
     parsed = parseEvalArgs(args);
@@ -2504,13 +4342,19 @@ async function runEvalValidate(parsed) {
 }
 async function runEvalRun(parsed) {
   try {
-    const loaded = parsed.suite !== void 0 ? await loadEvalSuiteFile(parsed.suite) : await loadV1TaskFileAsSuite(parsed.taskFile ?? "", parsed.repeat);
+    const loaded = parsed.suite !== void 0 ? await loadEvalSuiteFile(parsed.suite) : await loadV1TaskFileAsSuite(parsed.taskFile ?? "", parsed.trials ?? parsed.repeat);
     const resolveOptions = {};
     if (parsed.target !== void 0) resolveOptions.target = parsed.target;
     if (parsed.model !== void 0) resolveOptions.model = parsed.model;
-    const suite = resolveSuiteForRun(loaded.suite, resolveOptions);
-    const clioEntry = resolve7(parsed.clioEntry ?? process.argv[1] ?? "dist/cli/index.js");
-    const artifact = await runEvalSuiteV2({ ...loaded, suite }, { clioEntry });
+    const suite = resolveSuiteForRun(loaded.suite, {
+      ...resolveOptions,
+      ...parsed.trials ? { trials: parsed.trials } : {}
+    });
+    const clioEntry = resolve8(parsed.clioEntry ?? process.argv[1] ?? "dist/cli/index.js");
+    const artifact = await runEvalSuiteV2(
+      { ...loaded, suite },
+      { clioEntry, freshWorkspaces: parsed.trials !== void 0 }
+    );
     const artifactPath = await writeEvalArtifactV4(clioDataDir(), artifact, parsed.out);
     process.stdout.write(`${renderEvalTextReportV4(artifact)}artifact: ${artifactPath}
 `);
@@ -2520,6 +4364,11 @@ async function runEvalRun(parsed) {
 `);
       for (const failure of gate.failures) process.stdout.write(renderGateFailure(failure));
     }
+    if (gate !== null && gate.informational.length > 0) {
+      process.stdout.write(`informational budgets: ${gate.informational.length} notice
+`);
+      for (const finding of gate.informational) process.stdout.write(renderInformationalBudget(finding));
+    }
     return artifact.summary.failed === 0 && (gate === null || gate.pass) ? 0 : 1;
   } catch (error) {
     return handleEvalLoadError(error, 1);
@@ -2543,8 +4392,12 @@ async function runEvalCompareCommand(parsed) {
     const dataDir = clioDataDir();
     const baseline = await loadEvalArtifactV4(dataDir, baselineEvalId);
     const candidate = await loadEvalArtifactV4(dataDir, candidateEvalId);
-    process.stdout.write(renderEvalComparisonV4(compareEvalArtifactsV4(baseline, candidate)));
-    return 0;
+    const summary = compareEvalArtifactsV4(baseline, candidate, {
+      allowConfigDrift: parsed.allowConfigDrift,
+      ...parsed.metric === void 0 ? {} : { metric: parsed.metric }
+    });
+    process.stdout.write(renderEvalComparisonReportV1(summary, parsed.format));
+    return summary.hardGate.pass ? 0 : 1;
   } catch (error) {
     printError(error instanceof Error ? error.message : String(error));
     return error instanceof InvalidIdError ? 2 : 1;
@@ -2554,27 +4407,46 @@ async function runEvalGateCommand(parsed) {
   try {
     const dataDir = clioDataDir();
     const candidate = await loadEvalArtifactV4(dataDir, parsed.evalId ?? "");
-    await loadEvalArtifactV4(dataDir, parsed.baseline ?? "");
-    const thresholds = parsed.thresholds === void 0 ? { fail: [{ metric: "result.pass", op: "eq", value: false }] } : loadThresholds(parsed.thresholds);
+    const baseline = await loadEvalArtifactV4(dataDir, parsed.baseline ?? "");
+    const thresholds = parsed.thresholds === void 0 ? { fail: [{ metric: "result.pass", op: "eq", value: false }], informational: [] } : loadThresholds(parsed.thresholds);
     const gate = evaluateGate(candidate, thresholds);
-    if (gate.pass) {
+    const comparison = compareEvalArtifactsV4(baseline, candidate);
+    if (gate.informational.length > 0) {
+      process.stdout.write(`informational budgets: ${gate.informational.length} notice
+`);
+      for (const finding of gate.informational) process.stdout.write(renderInformationalBudget(finding));
+    }
+    if (gate.pass && comparison.hardGate.pass) {
       process.stdout.write("gate: pass\n");
       return 0;
     }
-    process.stdout.write(`gate: fail (${gate.failures.length} threshold failure)
+    const failureCount = gate.failures.length + comparison.hardGate.failures.length + comparison.hardGate.envelopeFailures.length;
+    process.stdout.write(`gate: fail (${failureCount} hard failure)
 `);
     for (const failure of gate.failures) process.stdout.write(renderGateFailure(failure));
+    for (const failure of comparison.hardGate.failures) {
+      process.stdout.write(
+        `  ${failure.metric} [${failure.scenarioId}:${failure.role}:${failure.target.id}/${failure.target.model ?? "none"}]: ${failure.change} (hard behavioral gate)
+`
+      );
+    }
+    for (const failure of comparison.hardGate.envelopeFailures) {
+      process.stdout.write(
+        `  execution envelope [${failure.scenarioId}:${failure.role}:${failure.target.id}/${failure.target.model ?? "none"}]: incomparable fields ${failure.fields.join(", ")}
+`
+      );
+    }
     return 1;
   } catch (error) {
     printError(error instanceof Error ? error.message : String(error));
     return error instanceof InvalidIdError ? 2 : 1;
   }
 }
-function renderArtifactReport(artifact, format, _dataDir) {
-  if (format === "json") return renderEvalJsonReportV4(artifact);
-  if (format === "md") return renderEvalMarkdownReportV4(artifact);
-  if (format === "swe-jsonl") return renderEvalSweJsonlReportV4(artifact);
-  if (format === "junit") return renderEvalJunitReportV4(artifact);
+function renderArtifactReport(artifact, format2, _dataDir) {
+  if (format2 === "json") return renderEvalJsonReportV4(artifact);
+  if (format2 === "md") return renderEvalMarkdownReportV4(artifact);
+  if (format2 === "swe-jsonl") return renderEvalSweJsonlReportV4(artifact);
+  if (format2 === "junit") return renderEvalJunitReportV4(artifact);
   return renderEvalTextReportV4(artifact);
 }
 function handleEvalLoadError(error, fallback = 2) {
@@ -2603,7 +4475,11 @@ function reportFormat(value) {
   if (value === "text" || value === "json" || value === "md" || value === "swe-jsonl" || value === "junit") return value;
   throw new Error("--format must be text, json, md, swe-jsonl, or junit");
 }
+function comparisonFormat(value) {
+  if (value === "text" || value === "json" || value === "md" || value === "junit") return value;
+  throw new Error("eval compare --format must be text, json, md, or junit");
+}
 export {
   runEvalCommand
 };
-//# sourceMappingURL=eval-BEC2WHDA.js.map
+//# sourceMappingURL=eval-TFBYQH4H.js.map