@iowarp/clio-coder 0.3.8 → 0.4.0

package/dist/{chunk-K4XHGFR5.js → chunk-B7OBL7PK.js}

@@ -3,13 +3,13 @@ import {
   ROUTE_POLICY_VERSION,
   isRouteDecisionAgentSelection,
   isRoutingIntent
-} from "./chunk-P43ETTHK.js";
+} from "./chunk-SJ5ZKQ4S.js";
 import {
   isExecutionRole
 } from "./chunk-H7IXIC72.js";
 import {
-  assertSafeId
-} from "./chunk-R346GLFC.js";
+  readSettings
+} from "./chunk-VFA6GDY5.js";
 import {
   readClioVersion,
   resolvePackageRoot
@@ -17,9 +17,6 @@ import {
 import {
   require_dist
 } from "./chunk-APJ265NV.js";
-import {
-  safeResourceWrite
-} from "./chunk-WEPFGWHJ.js";
 import {
   __toESM,
   init_esm_shims
@@ -339,537 +336,6 @@ function verifyReceiptIntegrity(receipt, envelope) {
   return { ok: true };
 }
 
-// src/domains/eval/harness-metrics.ts
-init_esm_shims();
-var ZERO_EVAL_HARNESS_METRICS = {
-  receiptCount: 0,
-  toolCalls: 0,
-  retries: 0,
-  safetyBlocks: 0,
-  correctionLatencyMs: 0,
-  validationEvidence: 0
-};
-function evalHarnessMetricsFromCommands(commands) {
-  return {
-    ...ZERO_EVAL_HARNESS_METRICS,
-    validationEvidence: commands.filter(
-      (command) => command.phase === "verifier" && command.exitCode === 0 && !command.timedOut
-    ).length
-  };
-}
-function sumEvalHarnessMetrics(records) {
-  return records.reduce((total, record) => addEvalHarnessMetrics(total, record.harness), {
-    ...ZERO_EVAL_HARNESS_METRICS
-  });
-}
-function addEvalHarnessMetrics(left, right) {
-  return {
-    receiptCount: left.receiptCount + right.receiptCount,
-    toolCalls: left.toolCalls + right.toolCalls,
-    retries: left.retries + right.retries,
-    safetyBlocks: left.safetyBlocks + right.safetyBlocks,
-    correctionLatencyMs: left.correctionLatencyMs + right.correctionLatencyMs,
-    validationEvidence: left.validationEvidence + right.validationEvidence
-  };
-}
-
-// src/domains/eval/store.ts
-init_esm_shims();
-import { createHash as createHash2, randomBytes } from "node:crypto";
-import { readFile } from "node:fs/promises";
-import { join } from "node:path";
-
-// src/domains/eval/artifacts/redact.ts
-init_esm_shims();
-var SENSITIVE_KEY = /(?:^|[_-])(api[_-]?key|authorization|cookie|password|secret|token)(?:$|[_-])/i;
-var CREDENTIAL_PATTERNS = [
-  [/\b(authorization\s*[:=]\s*)(?:bearer|basic)\s+[A-Za-z0-9._~+/=-]+/gi, "$1[redacted]"],
-  [/\b(bearer\s+)[A-Za-z0-9._~+/=-]{12,}/gi, "$1[redacted]"],
-  [/\b(sk-[A-Za-z0-9_-]{16,})\b/g, "[redacted]"],
-  [/\b(gh[pousr]_[A-Za-z0-9_]{16,})\b/g, "[redacted]"],
-  [/\b(AKIA[0-9A-Z]{16})\b/g, "[redacted]"],
-  [/\b((?:api[_-]?key|access[_-]?token|refresh[_-]?token|password|secret)\s*[:=]\s*)[^\s"',}]+/gi, "$1[redacted]"]
-];
-function redactArtifactForStorage(value, env = process.env) {
-  return redactValue(value, env);
-}
-function redactValue(value, env) {
-  if (typeof value === "string") return redactString(value, env);
-  if (Array.isArray(value)) return value.map((entry) => redactValue(entry, env));
-  if (value !== null && typeof value === "object") {
-    const out = {};
-    for (const [key, entry] of Object.entries(value)) {
-      out[key] = SENSITIVE_KEY.test(key) ? "[redacted]" : redactValue(entry, env);
-    }
-    return out;
-  }
-  return value;
-}
-function redactString(value, env) {
-  let out = stripHomePrefix(value, env.HOME);
-  for (const [pattern, replacement] of CREDENTIAL_PATTERNS) {
-    out = out.replace(pattern, replacement);
-  }
-  return out;
-}
-function stripHomePrefix(value, home) {
-  if (home === void 0 || home.length === 0) return value;
-  const normalized = home.replace(/\/+$/g, "");
-  if (normalized.length === 0) return value;
-  return value.split(normalized).join("$HOME");
-}
-
-// src/domains/eval/store.ts
-var NODE_SIGNALS = /* @__PURE__ */ new Set([
-  "SIGHUP",
-  "SIGINT",
-  "SIGQUIT",
-  "SIGILL",
-  "SIGTRAP",
-  "SIGABRT",
-  "SIGIOT",
-  "SIGBUS",
-  "SIGFPE",
-  "SIGKILL",
-  "SIGUSR1",
-  "SIGSEGV",
-  "SIGUSR2",
-  "SIGPIPE",
-  "SIGALRM",
-  "SIGTERM",
-  "SIGCHLD",
-  "SIGSTKFLT",
-  "SIGCONT",
-  "SIGSTOP",
-  "SIGTSTP",
-  "SIGTTIN",
-  "SIGTTOU",
-  "SIGURG",
-  "SIGXCPU",
-  "SIGXFSZ",
-  "SIGVTALRM",
-  "SIGPROF",
-  "SIGWINCH",
-  "SIGIO",
-  "SIGPOLL",
-  "SIGPWR",
-  "SIGSYS",
-  "SIGUNUSED"
-]);
-function evalRoot(dataDir) {
-  return join(dataDir, "evals");
-}
-function evalArtifactPath(dataDir, evalId) {
-  assertSafeId(evalId, "eval");
-  return join(evalRoot(dataDir), `${evalId}.json`);
-}
-function createEvalId(startedAt, taskFileHash) {
-  const stamp = startedAt.toISOString().replace(/[-:.]/g, "");
-  return `eval-${stamp}-${taskFileHash.slice(0, 8)}-${randomBytes(6).toString("hex")}`;
-}
-async function writeEvalArtifact(dataDir, artifact) {
-  const path = evalArtifactPath(dataDir, artifact.evalId);
-  const redacted = redactArtifactForStorage({
-    ...artifact,
-    paths: { ...artifact.paths, artifact: path }
-  });
-  safeResourceWrite(path, `${JSON.stringify(redacted, null, 2)}
-`, { encoding: "utf8" });
-  return path;
-}
-async function loadEvalArtifact(dataDir, evalId) {
-  let raw;
-  try {
-    raw = await readFile(evalArtifactPath(dataDir, evalId), "utf8");
-  } catch (error) {
-    if (isErrorWithCode(error) && error.code === "ENOENT") throw new Error(`eval artifact not found: ${evalId}`);
-    throw error;
-  }
-  const source = evalArtifactPath(dataDir, evalId);
-  const parsed = parseJson(raw, source);
-  return parseArtifact(parsed, source);
-}
-function parseArtifact(value, source) {
-  if (!isRecord(value)) throw new Error(`${source}: expected object`);
-  if (value.version !== 1) throw new Error(`${source}.version: expected 1`);
-  const results = readArray(value, source, "results").map(
-    (entry, index) => parseRecord(entry, `${source}.results[${index}]`)
-  );
-  return {
-    version: 1,
-    evalId: readString(value, source, "evalId"),
-    taskFile: readString(value, source, "taskFile"),
-    taskFileHash: readString(value, source, "taskFileHash"),
-    clio: parseClioProvenance(readRequiredArtifactField(value, source, "clio"), `${source}.clio`),
-    environment: parseEnvironmentProvenance(
-      readRequiredArtifactField(value, source, "environment"),
-      `${source}.environment`
-    ),
-    target: readOptionalNullableString(value, source, "target"),
-    model: readOptionalNullableString(value, source, "model"),
-    thinking: readOptionalNullableString(value, source, "thinking"),
-    paths: parseArtifactPaths(readRequiredArtifactField(value, source, "paths"), `${source}.paths`),
-    repeat: readNumber(value, source, "repeat"),
-    startedAt: readString(value, source, "startedAt"),
-    endedAt: readString(value, source, "endedAt"),
-    summary: parseSummary(value.summary, `${source}.summary`),
-    results
-  };
-}
-function parseSummary(value, source) {
-  if (!isRecord(value)) throw new Error(`${source}: expected object`);
-  return {
-    runs: readNumber(value, source, "runs"),
-    passed: readNumber(value, source, "passed"),
-    failed: readNumber(value, source, "failed"),
-    passRate: readNumber(value, source, "passRate"),
-    tokens: readNumber(value, source, "tokens"),
-    costUsd: readNumber(value, source, "costUsd"),
-    wallTimeMs: readNumber(value, source, "wallTimeMs"),
-    harness: value.harness === void 0 ? { ...ZERO_EVAL_HARNESS_METRICS } : parseHarnessMetrics(value.harness, `${source}.harness`),
-    failureClasses: readArray(value, source, "failureClasses").map(
-      (entry, index) => parseFailureClassCount(entry, `${source}.failureClasses[${index}]`)
-    )
-  };
-}
-function parseRecord(value, source) {
-  if (!isRecord(value)) throw new Error(`${source}: expected object`);
-  const failureClass = readOptionalFailureClass(value, source, "failureClass");
-  const commands = readArray(value, source, "commands").map(
-    (entry, index) => parseCommand(entry, `${source}.commands[${index}]`)
-  );
-  const record = {
-    taskId: readString(value, source, "taskId"),
-    runId: readString(value, source, "runId"),
-    repeatIndex: readNumber(value, source, "repeatIndex"),
-    cwd: readString(value, source, "cwd"),
-    prompt: readString(value, source, "prompt"),
-    tags: readStringArray(value, source, "tags"),
-    pass: readBoolean(value, source, "pass"),
-    exitCode: readNumber(value, source, "exitCode"),
-    tokens: readNumber(value, source, "tokens"),
-    costUsd: readNumber(value, source, "costUsd"),
-    wallTimeMs: readNumber(value, source, "wallTimeMs"),
-    harness: value.harness === void 0 ? evalHarnessMetricsFromCommands(commands) : parseHarnessMetrics(value.harness, `${source}.harness`),
-    commands
-  };
-  if (failureClass !== void 0) record.failureClass = failureClass;
-  const receiptPath = readOptionalString(value, source, "receiptPath");
-  if (receiptPath !== void 0) record.receiptPath = receiptPath;
-  const evidenceId = readOptionalString(value, source, "evidenceId");
-  if (evidenceId !== void 0) record.evidenceId = evidenceId;
-  const paths = value.paths === void 0 ? void 0 : parseRunPaths(value.paths, `${source}.paths`);
-  if (paths !== void 0) record.paths = paths;
-  return record;
-}
-function parseClioProvenance(value, source) {
-  if (!isRecord(value)) throw new Error(`${source}: expected object`);
-  return {
-    version: readString(value, source, "version"),
-    commit: readNullableString(value, source, "commit"),
-    entry: readString(value, source, "entry")
-  };
-}
-function parseEnvironmentProvenance(value, source) {
-  if (!isRecord(value)) throw new Error(`${source}: expected object`);
-  return {
-    platform: readString(value, source, "platform"),
-    node: readString(value, source, "node")
-  };
-}
-function parseArtifactPaths(value, source) {
-  if (!isRecord(value)) throw new Error(`${source}: expected object`);
-  const out = {
-    taskFile: readString(value, source, "taskFile"),
-    receipts: readStringArray(value, source, "receipts"),
-    sessionLedgers: readStringArray(value, source, "sessionLedgers")
-  };
-  const artifact = readOptionalString(value, source, "artifact");
-  if (artifact !== void 0) out.artifact = artifact;
-  const evidence = readOptionalString(value, source, "evidence");
-  if (evidence !== void 0) out.evidence = evidence;
-  return out;
-}
-function parseRunPaths(value, source) {
-  if (!isRecord(value)) throw new Error(`${source}: expected object`);
-  const out = {};
-  const receipt = readOptionalString(value, source, "receipt");
-  if (receipt !== void 0) out.receipt = receipt;
-  const sessionLedger = readOptionalString(value, source, "sessionLedger");
-  if (sessionLedger !== void 0) out.sessionLedger = sessionLedger;
-  const evidence = readOptionalString(value, source, "evidence");
-  if (evidence !== void 0) out.evidence = evidence;
-  return out;
-}
-function readRequiredArtifactField(record, source, field) {
-  const value = record[field];
-  if (value === void 0) {
-    throw new Error(
-      `eval artifact has an invalid schema: missing required field '${field}' in ${source}. Re-run the evaluation suite to generate a complete artifact.`
-    );
-  }
-  return value;
-}
-function parseHarnessMetrics(value, source) {
-  if (!isRecord(value)) throw new Error(`${source}: expected object`);
-  return {
-    receiptCount: readNumber(value, source, "receiptCount"),
-    toolCalls: readNumber(value, source, "toolCalls"),
-    retries: readNumber(value, source, "retries"),
-    safetyBlocks: readNumber(value, source, "safetyBlocks"),
-    correctionLatencyMs: readNumber(value, source, "correctionLatencyMs"),
-    validationEvidence: readNumber(value, source, "validationEvidence")
-  };
-}
-function parseCommand(value, source) {
-  if (!isRecord(value)) throw new Error(`${source}: expected object`);
-  const phase = readString(value, source, "phase");
-  if (phase !== "setup" && phase !== "verifier") throw new Error(`${source}.phase: expected setup or verifier`);
-  return {
-    phase,
-    index: readNumber(value, source, "index"),
-    command: readString(value, source, "command"),
-    exitCode: readNumber(value, source, "exitCode"),
-    signal: readSignal(value.signal, `${source}.signal`),
-    timedOut: readBoolean(value, source, "timedOut"),
-    wallTimeMs: readNumber(value, source, "wallTimeMs"),
-    stdout: readStringAllowEmpty(value, source, "stdout"),
-    stderr: readStringAllowEmpty(value, source, "stderr")
-  };
-}
-function readSignal(value, source) {
-  if (value === null) return null;
-  if (typeof value === "string" && NODE_SIGNALS.has(value)) return value;
-  throw new Error(`${source}: expected signal or null`);
-}
-function parseFailureClassCount(value, source) {
-  if (!isRecord(value)) throw new Error(`${source}: expected object`);
-  return {
-    failureClass: readFailureClass(value, source, "failureClass"),
-    count: readNumber(value, source, "count")
-  };
-}
-function readFailureClass(record, source, field) {
-  const value = record[field];
-  if (value === "setup_failed" || value === "verifier_failed" || value === "timeout" || value === "cwd_missing" || value === "command_error") {
-    return value;
-  }
-  throw new Error(`${source}.${field}: expected failure class`);
-}
-function readOptionalFailureClass(record, source, field) {
-  if (record[field] === void 0) return void 0;
-  return readFailureClass(record, source, field);
-}
-function readString(record, source, field) {
-  const value = record[field];
-  if (typeof value !== "string" || value.length === 0) throw new Error(`${source}.${field}: expected string`);
-  return value;
-}
-function readStringAllowEmpty(record, source, field) {
-  const value = record[field];
-  if (typeof value !== "string") throw new Error(`${source}.${field}: expected string`);
-  return value;
-}
-function readOptionalString(record, source, field) {
-  const value = record[field];
-  if (value === void 0) return void 0;
-  if (typeof value !== "string" || value.length === 0) throw new Error(`${source}.${field}: expected string`);
-  return value;
-}
-function readNullableString(record, source, field) {
-  const value = record[field];
-  if (value === null) return null;
-  if (typeof value !== "string" || value.length === 0) throw new Error(`${source}.${field}: expected string or null`);
-  return value;
-}
-function readOptionalNullableString(record, source, field) {
-  const value = record[field];
-  if (value === void 0 || value === null) return null;
-  if (typeof value !== "string" || value.length === 0) throw new Error(`${source}.${field}: expected string or null`);
-  return value;
-}
-function readStringArray(record, source, field) {
-  const value = readArray(record, source, field);
-  const out = [];
-  for (let index = 0; index < value.length; index += 1) {
-    const entry = value[index];
-    if (typeof entry !== "string") throw new Error(`${source}.${field}[${index}]: expected string`);
-    out.push(entry);
-  }
-  return out;
-}
-function readNumber(record, source, field) {
-  const value = record[field];
-  if (typeof value !== "number" || !Number.isFinite(value)) throw new Error(`${source}.${field}: expected number`);
-  return value;
-}
-function readBoolean(record, source, field) {
-  const value = record[field];
-  if (typeof value !== "boolean") throw new Error(`${source}.${field}: expected boolean`);
-  return value;
-}
-function readArray(record, source, field) {
-  const value = record[field];
-  if (!Array.isArray(value)) throw new Error(`${source}.${field}: expected array`);
-  return value;
-}
-function parseJson(raw, source) {
-  try {
-    return JSON.parse(raw);
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    throw new Error(`${source}: invalid JSON: ${message}`);
-  }
-}
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isErrorWithCode(error) {
-  return error instanceof Error && "code" in error && typeof error.code === "string";
-}
-
-// src/domains/eval/artifacts/store.ts
-init_esm_shims();
-import { readFile as readFile2 } from "node:fs/promises";
-import { join as join2 } from "node:path";
-function evalArtifactPathV4(dataDir, evalId) {
-  assertSafeId(evalId, "eval");
-  return join2(evalRoot(dataDir), `${evalId}.json`);
-}
-async function writeEvalArtifactV4(dataDir, artifact, out) {
-  const path = out === void 0 ? evalArtifactPathV4(dataDir, artifact.evalId) : out.endsWith(".json") ? out : join2(out, `${artifact.evalId}.json`);
-  safeResourceWrite(path, `${JSON.stringify(redactArtifactForStorage(artifact), null, 2)}
-`, { encoding: "utf8" });
-  return path;
-}
-async function loadEvalArtifactV4(dataDir, evalId) {
-  let raw;
-  try {
-    raw = await readFile2(evalArtifactPathV4(dataDir, evalId), "utf8");
-  } catch (error) {
-    if (error.code === "ENOENT") throw new Error(`eval artifact not found: ${evalId}`);
-    throw error;
-  }
-  return parseEvalArtifactV4(JSON.parse(raw), evalId);
-}
-function parseEvalArtifactV4(value, source) {
-  if (!isRecord2(value)) throw new Error(`${source}: expected object`);
-  if (value.version !== 4) throw new Error(`${source}.version: expected current version 4`);
-  const summary = asRecord(value.summary, `${source}.summary`);
-  const matrix = asRecord(value.matrix, `${source}.matrix`);
-  const suite = asRecord(value.suite, `${source}.suite`);
-  return {
-    version: 4,
-    evalId: readString2(value, source, "evalId"),
-    suite: { id: readString2(suite, `${source}.suite`, "id"), hash: readString2(suite, `${source}.suite`, "hash") },
-    clio: {
-      version: readString2(asRecord(value.clio, `${source}.clio`), `${source}.clio`, "version"),
-      commit: readNullableString2(asRecord(value.clio, `${source}.clio`), `${source}.clio`, "commit"),
-      entry: readString2(asRecord(value.clio, `${source}.clio`), `${source}.clio`, "entry")
-    },
-    environment: {
-      platform: readString2(asRecord(value.environment, `${source}.environment`), `${source}.environment`, "platform"),
-      node: readString2(asRecord(value.environment, `${source}.environment`), `${source}.environment`, "node")
-    },
-    matrix: {
-      target: readString2(matrix, `${source}.matrix`, "target"),
-      model: readNullableString2(matrix, `${source}.matrix`, "model"),
-      thinking: readNullableString2(matrix, `${source}.matrix`, "thinking")
-    },
-    summary: {
-      runs: readNumber2(summary, `${source}.summary`, "runs"),
-      passed: readNumber2(summary, `${source}.summary`, "passed"),
-      failed: readNumber2(summary, `${source}.summary`, "failed"),
-      passRate: readNumber2(summary, `${source}.summary`, "passRate"),
-      tokens: parseTokenAccounting(summary.tokens, `${source}.summary.tokens`),
-      wallTimeMs: readNumber2(summary, `${source}.summary`, "wallTimeMs")
-    },
-    results: readArray2(value, source, "results").map((entry, index) => parseResult(entry, `${source}.results[${index}]`))
-  };
-}
-function parseTokenAccounting(value, source) {
-  const record = asRecord(value, source);
-  const measured = readBoolean2(record, source, "measured");
-  const runs = readNumber2(record, source, "runs");
-  const measuredRuns = readNumber2(record, source, "measuredRuns");
-  const countFields = ["input", "output", "total", "cacheRead", "cacheWrite"];
-  if (!measured) {
-    if (measuredRuns !== 0) throw new Error(`${source}.measuredRuns: expected 0 when unmeasured`);
-    const present = countFields.filter((field) => field in record);
-    if (present.length > 0) throw new Error(`${source}: unmeasured accounting carries no counts (${present.join(", ")})`);
-    return { measured: false, runs, measuredRuns: 0 };
-  }
-  if (measuredRuns <= 0) throw new Error(`${source}.measuredRuns: expected a positive count when measured`);
-  return {
-    measured: true,
-    runs,
-    measuredRuns,
-    input: readNumber2(record, source, "input"),
-    output: readNumber2(record, source, "output"),
-    total: readNumber2(record, source, "total"),
-    cacheRead: readNumber2(record, source, "cacheRead"),
-    cacheWrite: readNumber2(record, source, "cacheWrite")
-  };
-}
-function parseResult(value, source) {
-  const record = asRecord(value, source);
-  const target = asRecord(record.target, `${source}.target`);
-  return {
-    assignmentId: readNullableString2(record, source, "assignmentId"),
-    terminalReceiptDigest: readNullableDigest(record, source, "terminalReceiptDigest"),
-    taskId: readString2(record, source, "taskId"),
-    repeatIndex: readNumber2(record, source, "repeatIndex"),
-    target: {
-      id: readString2(target, `${source}.target`, "id"),
-      model: readNullableString2(target, `${source}.target`, "model"),
-      thinking: readNullableString2(target, `${source}.target`, "thinking")
-    },
-    pass: readBoolean2(record, source, "pass"),
-    failureClass: readNullableString2(record, source, "failureClass"),
-    metrics: asRecord(record.metrics, `${source}.metrics`),
-    artifacts: asRecord(record.artifacts, `${source}.artifacts`)
-  };
-}
-function asRecord(value, source) {
-  if (isRecord2(value)) return value;
-  throw new Error(`${source}: expected object`);
-}
-function isRecord2(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function readString2(record, source, field) {
-  const value = record[field];
-  if (typeof value !== "string" || value.length === 0) throw new Error(`${source}.${field}: expected string`);
-  return value;
-}
-function readNullableString2(record, source, field) {
-  const value = record[field];
-  if (value === null) return null;
-  if (typeof value !== "string" || value.length === 0) throw new Error(`${source}.${field}: expected string or null`);
-  return value;
-}
-function readNullableDigest(record, source, field) {
-  const value = readNullableString2(record, source, field);
-  if (value !== null && !/^[0-9a-f]{64}$/u.test(value))
-    throw new Error(`${source}.${field}: expected sha256 digest or null`);
-  return value;
-}
-function readNumber2(record, source, field) {
-  const value = record[field];
-  if (typeof value !== "number" || !Number.isFinite(value)) throw new Error(`${source}.${field}: expected number`);
-  return value;
-}
-function readBoolean2(record, source, field) {
-  const value = record[field];
-  if (typeof value !== "boolean") throw new Error(`${source}.${field}: expected boolean`);
-  return value;
-}
-function readArray2(record, source, field) {
-  const value = record[field];
-  if (!Array.isArray(value)) throw new Error(`${source}.${field}: expected array`);
-  return value;
-}
-
 // src/domains/evidence/trust-status.ts
 init_esm_shims();
 var TRUST_STATUS_VERSION = 1;
@@ -953,7 +419,7 @@ var ARTIFACT_KINDS = /* @__PURE__ */ new Set([
   "evidence_bundle",
   "session_entry"
 ]);
-function isRecord3(value) {
+function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function hasExactKeys(value, keys) {
@@ -976,7 +442,7 @@ function compareArtifactReferences(left, right) {
   return leftKey < rightKey ? -1 : leftKey > rightKey ? 1 : 0;
 }
 function normalizeArtifactReference(value, path) {
-  if (!isRecord3(value)) throw new Error(`${path} must be an object`);
+  if (!isRecord(value)) throw new Error(`${path} must be an object`);
   if (!hasExactKeys(value, value.digest === void 0 ? ["kind", "id"] : ["kind", "id", "digest"])) {
     throw new Error(`${path} has unknown or missing fields`);
   }
@@ -986,7 +452,7 @@ function normalizeArtifactReference(value, path) {
   if (!isTrustStatusIdentifier(value.id)) throw new Error(`${path}.id is invalid`);
   const reference = { kind: value.kind, id: value.id };
   if (value.digest !== void 0) {
-    if (!isRecord3(value.digest) || !hasExactKeys(value.digest, ["algorithm", "value"]) || value.digest.algorithm !== "sha256" || typeof value.digest.value !== "string" || !/^[a-f0-9]{64}$/u.test(value.digest.value)) {
+    if (!isRecord(value.digest) || !hasExactKeys(value.digest, ["algorithm", "value"]) || value.digest.algorithm !== "sha256" || typeof value.digest.value !== "string" || !/^[a-f0-9]{64}$/u.test(value.digest.value)) {
       throw new Error(`${path}.digest is invalid`);
     }
     reference.digest = { algorithm: "sha256", value: value.digest.value };
@@ -997,13 +463,13 @@ function normalizeAttributedStatus(axis, value) {
   if (!hasExactKeys(value, ["state", "source", "authority", "artifacts"])) {
     throw new Error(`${axis} has unknown or missing fields`);
   }
-  if (!isRecord3(value.source) || !hasExactKeys(value.source, ["kind", "id"])) {
+  if (!isRecord(value.source) || !hasExactKeys(value.source, ["kind", "id"])) {
     throw new Error(`${axis}.source is invalid`);
   }
   if (typeof value.source.kind !== "string" || !SOURCE_KINDS.has(value.source.kind) || !AXIS_SOURCES[axis].has(value.source.kind) || !isTrustStatusIdentifier(value.source.id)) {
     throw new Error(`${axis}.source is invalid`);
   }
-  if (!isRecord3(value.authority) || !hasExactKeys(value.authority, ["kind", "id"])) {
+  if (!isRecord(value.authority) || !hasExactKeys(value.authority, ["kind", "id"])) {
     throw new Error(`${axis}.authority is invalid`);
   }
   if (typeof value.authority.kind !== "string" || !AUTHORITY_KINDS.has(value.authority.kind) || !SOURCE_AUTHORITIES[value.source.kind].has(
@@ -1037,7 +503,7 @@ function normalizeAttributedStatus(axis, value) {
   };
 }
 function normalizeAxis(axis, value) {
-  if (!isRecord3(value) || typeof value.state !== "string" || !AXIS_STATES[axis].has(value.state)) {
+  if (!isRecord(value) || typeof value.state !== "string" || !AXIS_STATES[axis].has(value.state)) {
     throw new Error(`${axis}.state is invalid`);
   }
   if (value.state === "absent") {
@@ -1049,7 +515,7 @@ function normalizeAxis(axis, value) {
   return normalizeAttributedStatus(axis, value);
 }
 function normalizeTrustStatus(value) {
-  if (!isRecord3(value) || !hasExactKeys(value, ["version", ...TRUST_STATUS_AXES])) {
+  if (!isRecord(value) || !hasExactKeys(value, ["version", ...TRUST_STATUS_AXES])) {
     throw new Error("trust status has unknown or missing fields");
   }
   if (value.version !== TRUST_STATUS_VERSION) throw new Error("trust status version is invalid");
@@ -1107,7 +573,7 @@ function compatibilitySource(receipt, field) {
 var DISPATCH_AUTHORITY = { kind: "clio", id: "dispatch" };
 var COMPATIBILITY_AUTHORITY = { kind: "unknown", id: "historical-persisted-format" };
 function retiredReceiptIntegrity(integrity) {
-  if (!isRecord3(integrity)) return null;
+  if (!isRecord(integrity)) return null;
   const version = integrity.version;
   if (typeof version !== "number" || !Number.isInteger(version) || version < 1) return null;
   if (version >= RUN_RECEIPT_INTEGRITY_VERSION) return null;
@@ -1416,20 +882,6 @@ function adaptGroundedEvidenceValidationStatus(input) {
     uniqueBoundedReferences([{ kind: "evidence_bundle", id: input.evidenceId }, ...observed])
   );
 }
-function adaptFinishContractCompletionStatus(assessment, options = {}) {
-  const artifacts = uniqueBoundedReferences(
-    options.artifacts ?? assessment.evidence.map((evidence, index) => ({
-      kind: evidence.turnId === void 0 ? "finish_contract_evidence" : "session_entry",
-      id: evidence.turnId ?? `${evidence.kind}:${index + 1}`
-    }))
-  );
-  const source = { kind: "finish_contract", id: options.sourceId ?? assessment.reason };
-  const authority = { kind: "clio", id: "finish-contract" };
-  if (assessment.reason === "no_mutation") return attributed("not_applicable", source, authority, artifacts);
-  if (assessment.reason === "validation_evidence") return attributed("evidenced", source, authority, artifacts);
-  if (assessment.reason === "explicit_limitation") return attributed("limited", source, authority, artifacts);
-  return attributed("incomplete", source, authority, artifacts);
-}
 function uniqueBoundedReferences(references) {
   const sorted = [...references].sort(compareArtifactReferences);
   const unique = sorted.filter(
@@ -1438,6 +890,151 @@ function uniqueBoundedReferences(references) {
   return unique.slice(0, TRUST_STATUS_MAX_ARTIFACT_REFERENCES);
 }
 
+// src/domains/evidence/trust-projection.ts
+init_esm_shims();
+var TRUST_SUMMARY_VERSION = 1;
+var TRUST_SUMMARY_MAX_REFS = 8;
+var TRUST_STATE_WORDS = {
+  artifactIntegrity: {
+    verified: "sealed",
+    failed: "seal broken",
+    absent: "no receipt",
+    unknown: "seal unchecked",
+    not_applicable: "seal not applicable"
+  },
+  validationGrounding: {
+    validated: "grounded",
+    failed: "validation failed",
+    ungrounded: "inferred: validation claimed, none observed",
+    absent: "no validation observed",
+    unknown: "validation unknown",
+    not_applicable: "validation not applicable"
+  },
+  independentReview: {
+    passed: "independently reviewed: pass",
+    failed: "independently reviewed: fail",
+    inconclusive: "independent review inconclusive",
+    not_independent: "review not independent",
+    absent: "not independently reviewed",
+    unknown: "independent review unknown",
+    not_applicable: "independent review not applicable"
+  },
+  contextProvenance: {
+    recorded: "context recorded",
+    invalid: "context record invalid",
+    absent: "context not recorded",
+    unknown: "context unknown",
+    not_applicable: "context not applicable"
+  },
+  autonomyEnforcement: {
+    enforced: "mediated",
+    approximated: "approximated",
+    bypassed: "bypassed",
+    absent: "autonomy not recorded",
+    unknown: "autonomy unknown",
+    not_applicable: "autonomy not applicable"
+  },
+  completionEvidence: {
+    evidenced: "completion evidenced",
+    incomplete: "completion unevidenced",
+    limited: "completion limited",
+    absent: "completion not recorded",
+    unknown: "completion unknown",
+    not_applicable: "completion not applicable"
+  }
+};
+function trustStateWord(axis, state) {
+  const words = TRUST_STATE_WORDS[axis];
+  return words[state] ?? words.unknown ?? "unknown";
+}
+function authorityOf(status, axis) {
+  const entry = status[axis];
+  return entry.state === "absent" ? null : `${entry.authority.kind}:${entry.authority.id}`;
+}
+function integrityClause(status) {
+  const retired = retiredIntegrityVersionOf(status.artifactIntegrity);
+  if (retired !== null) return `seal v${retired} retired (this build verifies v${RUN_RECEIPT_INTEGRITY_VERSION})`;
+  return trustStateWord("artifactIntegrity", status.artifactIntegrity.state);
+}
+function validationClause(status) {
+  const entry = status.validationGrounding;
+  const word = trustStateWord("validationGrounding", entry.state);
+  if (entry.state === "absent") return word;
+  if (entry.state === "validated" || entry.state === "failed") return `${word} by ${entry.authority.id}`;
+  if (entry.state === "unknown" && entry.authority.kind !== "unknown") return `${word} (${entry.authority.id})`;
+  return word;
+}
+function autonomyClause(status) {
+  const entry = status.autonomyEnforcement;
+  const word = trustStateWord("autonomyEnforcement", entry.state);
+  if (entry.state !== "approximated" && entry.state !== "bypassed") return word;
+  return `${word} (${entry.authority.id})`;
+}
+function formatTrustSummary(status) {
+  return [
+    integrityClause(status),
+    validationClause(status),
+    trustStateWord("independentReview", status.independentReview.state),
+    autonomyClause(status),
+    trustStateWord("contextProvenance", status.contextProvenance.state),
+    trustStateWord("completionEvidence", status.completionEvidence.state)
+  ].join("; ");
+}
+function formatTrustSummaryLine(status) {
+  return `trust v${TRUST_SUMMARY_VERSION}: ${trustVerdict(status)}; ${formatTrustSummary(status)}`;
+}
+function formatTrustAxes(status) {
+  return [`trust_status=v${status.version}`, ...TRUST_STATUS_AXES.map((axis) => `${axis}:${status[axis].state}`)].join(
+    " "
+  );
+}
+function isUnanswered(status, axis) {
+  const state = status[axis].state;
+  return state === "absent" || state === "unknown";
+}
+function trustVerdict(status) {
+  const integrity = status.artifactIntegrity.state;
+  const validation = status.validationGrounding.state;
+  const review = status.independentReview.state;
+  const autonomy = status.autonomyEnforcement.state;
+  if (integrity === "failed" || autonomy === "bypassed" || validation === "failed" || validation === "ungrounded" || review === "failed" || review === "not_independent" || status.contextProvenance.state === "invalid") {
+    return "compromised";
+  }
+  if (integrity !== "verified") return "unknown";
+  if (review === "passed") return "reviewed";
+  if (validation === "validated") return "grounded";
+  return "unverified";
+}
+function claimantOf(status) {
+  const state = status.validationGrounding.state;
+  if (state === "absent" || state === "ungrounded") return "worker";
+  return authorityOf(status, "validationGrounding") ?? "worker";
+}
+function referenceKey(reference) {
+  return `${reference.kind}:${reference.id}`;
+}
+function trustSummaryReferences(status) {
+  const keys = /* @__PURE__ */ new Set();
+  for (const axis of TRUST_STATUS_AXES) {
+    const entry = status[axis];
+    if (entry.state === "absent") continue;
+    for (const reference of entry.artifacts) keys.add(referenceKey(reference));
+  }
+  return [...keys].sort().slice(0, TRUST_SUMMARY_MAX_REFS);
+}
+function summarizeTrustStatus(status) {
+  const axes = Object.fromEntries(TRUST_STATUS_AXES.map((axis) => [axis, status[axis].state]));
+  return {
+    version: TRUST_SUMMARY_VERSION,
+    verdict: trustVerdict(status),
+    text: formatTrustSummary(status),
+    axes,
+    claimant: claimantOf(status),
+    unknown: TRUST_STATUS_AXES.filter((axis) => isUnanswered(status, axis)),
+    refs: trustSummaryReferences(status)
+  };
+}
+
 // src/domains/eval/provenance.ts
 init_esm_shims();
 import { spawnSync } from "node:child_process";
@@ -1454,6 +1051,33 @@ function evalEnvironmentProvenance() {
     node: process.version
   };
 }
+async function evalServingConfiguration(targets, observations) {
+  const targetId = targets.length === 1 ? targets[0]?.id ?? "unknown" : "multiple";
+  const configured = configuredTarget(targetId);
+  const target = targets.length === 1 ? targets[0] : void 0;
+  const runtimeId = consensus(observations.map((entry) => entry.runtimeId)) ?? configured?.runtime ?? null;
+  const modelId = consensus(observations.map((entry) => entry.modelId)) ?? target?.model ?? configured?.defaultModel ?? null;
+  const props = configured?.url === void 0 ? null : await readServingProps(configured.url, modelId);
+  return {
+    targetId,
+    runtimeId,
+    modelId,
+    serverBuild: props?.serverBuild ?? null,
+    total_slots: props?.totalSlots ?? null,
+    thinkingLevel: consensus(observations.map((entry) => entry.thinkingLevel)) ?? target?.thinking ?? null,
+    compiledPromptHash: consensus(observations.map((entry) => entry.compiledPromptHash))
+  };
+}
+function evalServingObservationFrom(target, receipt, compiledPromptHashes) {
+  const compiledPromptHash = receipt?.staticCompositionHash ?? receipt?.compiledPromptHash ?? consensus(compiledPromptHashes);
+  return {
+    targetId: receipt?.targetId ?? target.id,
+    runtimeId: receipt?.runtimeId ?? null,
+    modelId: receipt?.wireModelId ?? target.model ?? null,
+    thinkingLevel: receipt?.runtimeResolution?.effectiveThinkingLevel ?? target.thinking ?? null,
+    compiledPromptHash
+  };
+}
 function currentClioCommit() {
   const result = spawnSync("git", ["rev-parse", "HEAD"], {
     cwd: resolvePackageRoot(),
@@ -1465,12 +1089,63 @@ function currentClioCommit() {
   const value = result.stdout.trim();
   return value.length > 0 ? value : null;
 }
+function configuredTarget(targetId) {
+  try {
+    const target = readSettings().targets.find((entry) => entry.id === targetId);
+    if (target === void 0) return null;
+    return {
+      runtime: target.runtime,
+      ...target.url === void 0 ? {} : { url: target.url },
+      ...target.defaultModel === void 0 ? {} : { defaultModel: target.defaultModel }
+    };
+  } catch {
+    return null;
+  }
+}
+async function readServingProps(targetUrl, modelId) {
+  const root = targetUrl.replace(/\/+$/u, "").replace(/\/v1$/u, "");
+  try {
+    const response = await fetch(`${root}/props`, { signal: AbortSignal.timeout(5e3) });
+    if (!response.ok) return null;
+    const value = await response.json();
+    if (!isRecord2(value)) return null;
+    const totalSlots = positiveInteger(value.total_slots) ?? await readServingSlots(root, modelId);
+    return {
+      serverBuild: typeof value.build_info === "string" && value.build_info.length > 0 ? value.build_info : null,
+      totalSlots
+    };
+  } catch {
+    return null;
+  }
+}
+async function readServingSlots(root, modelId) {
+  if (modelId === null) return null;
+  try {
+    const query = new URLSearchParams({ model: modelId });
+    const response = await fetch(`${root}/slots?${query}`, { signal: AbortSignal.timeout(5e3) });
+    if (!response.ok) return null;
+    const value = await response.json();
+    return Array.isArray(value) && value.length > 0 ? value.length : null;
+  } catch {
+    return null;
+  }
+}
+function consensus(values) {
+  const known = [...new Set(values.filter((value) => typeof value === "string" && value.length > 0))];
+  return known.length === 1 ? known[0] ?? null : null;
+}
+function positiveInteger(value) {
+  return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : null;
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 
 // src/domains/eval/task-file.ts
 init_esm_shims();
 var import_yaml = __toESM(require_dist(), 1);
-import { createHash as createHash3 } from "node:crypto";
-import { readFile as readFile3 } from "node:fs/promises";
+import { createHash as createHash2 } from "node:crypto";
+import { readFile } from "node:fs/promises";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
 
 // src/domains/eval/types.ts
@@ -1481,7 +1156,7 @@ var EVAL_TASK_FILE_VERSION = 1;
 var TASK_KEYS = /* @__PURE__ */ new Set(["id", "prompt", "cwd", "setup", "verifier", "timeoutMs", "tags"]);
 async function loadEvalTaskFile(path) {
   const resolved = resolve(path);
-  const raw = await readFile3(resolved, "utf8");
+  const raw = await readFile(resolved, "utf8");
   const result = parseEvalTaskFileYaml(raw);
   if (!result.valid) {
     throw new EvalTaskFileError(result.issues);
@@ -1508,7 +1183,7 @@ function parseEvalTaskFileYaml(raw) {
 }
 function validateEvalTaskFile(value) {
   const issues = [];
-  if (!isRecord4(value)) {
+  if (!isRecord3(value)) {
     return { valid: false, issues: [{ path: "$", message: "expected object" }] };
   }
   if (value.version !== EVAL_TASK_FILE_VERSION) {
@@ -1544,7 +1219,7 @@ var EvalTaskFileError = class extends Error {
   }
 };
 function parseTask(value, path, issues) {
-  if (!isRecord4(value)) {
+  if (!isRecord3(value)) {
     issues.push({ path, message: "expected object" });
     return null;
   }
@@ -1560,13 +1235,13 @@ function parseTask(value, path, issues) {
   if (cwd !== null && isAbsolute(cwd)) {
     issues.push({ path: `${path}.cwd`, message: "expected repo-local relative path" });
   }
-  const setup = readStringArray2(value, path, "setup", issues, true);
-  const verifier = readStringArray2(value, path, "verifier", issues, false);
+  const setup = readStringArray(value, path, "setup", issues, true);
+  const verifier = readStringArray(value, path, "verifier", issues, false);
   if (verifier !== null && verifier.length === 0) {
     issues.push({ path: `${path}.verifier`, message: "expected at least one command" });
   }
   const timeoutMs = readPositiveInteger(value, path, "timeoutMs", issues);
-  const tags = readStringArray2(value, path, "tags", issues, true);
+  const tags = readStringArray(value, path, "tags", issues, true);
   if (id === null || prompt === null || cwd === null || setup === null || verifier === null || timeoutMs === null) {
     return null;
   }
@@ -1592,7 +1267,7 @@ function readNonEmptyString(record, path, field, issues) {
   }
   return value;
 }
-function readStringArray2(record, path, field, issues, allowMissing) {
+function readStringArray(record, path, field, issues, allowMissing) {
   const value = record[field];
   if (value === void 0 && allowMissing) return [];
   if (!Array.isArray(value)) {
@@ -1618,173 +1293,90 @@ function readPositiveInteger(record, path, field, issues) {
   }
   return value;
 }
-function isRecord4(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function sha256Hex(content) {
-  return createHash3("sha256").update(content, "utf8").digest("hex");
+  return createHash2("sha256").update(content, "utf8").digest("hex");
 }
 
-// src/domains/evidence/trust-projection.ts
+// src/domains/eval/run-compare.ts
 init_esm_shims();
-var TRUST_SUMMARY_VERSION = 1;
-var TRUST_SUMMARY_MAX_REFS = 8;
-var TRUST_STATE_WORDS = {
-  artifactIntegrity: {
-    verified: "sealed",
-    failed: "seal broken",
-    absent: "no receipt",
-    unknown: "seal unchecked",
-    not_applicable: "seal not applicable"
-  },
-  validationGrounding: {
-    validated: "grounded",
-    failed: "validation failed",
-    ungrounded: "inferred: validation claimed, none observed",
-    absent: "no validation observed",
-    unknown: "validation unknown",
-    not_applicable: "validation not applicable"
-  },
-  independentReview: {
-    passed: "independently reviewed: pass",
-    failed: "independently reviewed: fail",
-    inconclusive: "independent review inconclusive",
-    not_independent: "review not independent",
-    absent: "not independently reviewed",
-    unknown: "independent review unknown",
-    not_applicable: "independent review not applicable"
-  },
-  contextProvenance: {
-    recorded: "context recorded",
-    invalid: "context record invalid",
-    absent: "context not recorded",
-    unknown: "context unknown",
-    not_applicable: "context not applicable"
-  },
-  autonomyEnforcement: {
-    enforced: "mediated",
-    approximated: "approximated",
-    bypassed: "bypassed",
-    absent: "autonomy not recorded",
-    unknown: "autonomy unknown",
-    not_applicable: "autonomy not applicable"
-  },
-  completionEvidence: {
-    evidenced: "completion evidenced",
-    incomplete: "completion unevidenced",
-    limited: "completion limited",
-    absent: "completion not recorded",
-    unknown: "completion unknown",
-    not_applicable: "completion not applicable"
+var EvalTrackedMetricSourceMismatchError = class extends Error {
+  constructor(metric, baseline, candidate) {
+    super(
+      `tracked metric ${metric} cannot compare estimated and measured values (baseline=${baseline.join(",") || "none"}, candidate=${candidate.join(",") || "none"})`
+    );
+    this.name = "EvalTrackedMetricSourceMismatchError";
   }
 };
-function trustStateWord(axis, state) {
-  const words = TRUST_STATE_WORDS[axis];
-  return words[state] ?? words.unknown ?? "unknown";
-}
-function authorityOf(status, axis) {
-  const entry = status[axis];
-  return entry.state === "absent" ? null : `${entry.authority.kind}:${entry.authority.id}`;
-}
-function integrityClause(status) {
-  const retired = retiredIntegrityVersionOf(status.artifactIntegrity);
-  if (retired !== null) return `seal v${retired} retired (this build verifies v${RUN_RECEIPT_INTEGRITY_VERSION})`;
-  return trustStateWord("artifactIntegrity", status.artifactIntegrity.state);
-}
-function validationClause(status) {
-  const entry = status.validationGrounding;
-  const word = trustStateWord("validationGrounding", entry.state);
-  if (entry.state === "absent") return word;
-  if (entry.state === "validated" || entry.state === "failed") return `${word} by ${entry.authority.id}`;
-  if (entry.state === "unknown" && entry.authority.kind !== "unknown") return `${word} (${entry.authority.id})`;
-  return word;
-}
-function autonomyClause(status) {
-  const entry = status.autonomyEnforcement;
-  const word = trustStateWord("autonomyEnforcement", entry.state);
-  if (entry.state !== "approximated" && entry.state !== "bypassed") return word;
-  return `${word} (${entry.authority.id})`;
+function assertComparableTrackedMetricSources(metric, baseline, candidate) {
+  if (baseline.includes("estimated") === candidate.includes("estimated")) return;
+  throw new EvalTrackedMetricSourceMismatchError(metric, baseline, candidate);
 }
-function formatTrustSummary(status) {
-  return [
-    integrityClause(status),
-    validationClause(status),
-    trustStateWord("independentReview", status.independentReview.state),
-    autonomyClause(status),
-    trustStateWord("contextProvenance", status.contextProvenance.state),
-    trustStateWord("completionEvidence", status.completionEvidence.state)
-  ].join("; ");
-}
-function formatTrustSummaryLine(status) {
-  return `trust v${TRUST_SUMMARY_VERSION}: ${formatTrustSummary(status)}`;
+
+// src/domains/prompts/hash.ts
+init_esm_shims();
+import { createHash as createHash3 } from "node:crypto";
+function sha2562(input) {
+  return createHash3("sha256").update(input, "utf8").digest("hex");
 }
-function formatTrustAxes(status) {
-  return [`trust_status=v${status.version}`, ...TRUST_STATUS_AXES.map((axis) => `${axis}:${status[axis].state}`)].join(
-    " "
-  );
+function canonicalJson2(value) {
+  return serialize(value);
 }
-function isUnanswered(status, axis) {
-  const state = status[axis].state;
-  return state === "absent" || state === "unknown";
-}
-function trustVerdict(status) {
-  const integrity = status.artifactIntegrity.state;
-  const validation = status.validationGrounding.state;
-  const review = status.independentReview.state;
-  const autonomy = status.autonomyEnforcement.state;
-  if (integrity === "failed" || autonomy === "bypassed" || validation === "failed" || validation === "ungrounded" || review === "failed" || review === "not_independent" || status.contextProvenance.state === "invalid") {
-    return "compromised";
+function serialize(value) {
+  if (value === null) return "null";
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new Error(`canonicalJson: non-finite number ${String(value)} is not representable`);
+    }
+    return JSON.stringify(value);
   }
-  if (integrity !== "verified") return "unknown";
-  if (review === "passed") return "reviewed";
-  if (validation === "validated") return "grounded";
-  return "unverified";
-}
-function claimantOf(status) {
-  const state = status.validationGrounding.state;
-  if (state === "absent" || state === "ungrounded") return "worker";
-  return authorityOf(status, "validationGrounding") ?? "worker";
-}
-function referenceKey(reference) {
-  return `${reference.kind}:${reference.id}`;
-}
-function trustSummaryReferences(status) {
-  const keys = /* @__PURE__ */ new Set();
-  for (const axis of TRUST_STATUS_AXES) {
-    const entry = status[axis];
-    if (entry.state === "absent") continue;
-    for (const reference of entry.artifacts) keys.add(referenceKey(reference));
+  if (typeof value === "string" || typeof value === "boolean") {
+    return JSON.stringify(value);
   }
-  return [...keys].sort().slice(0, TRUST_SUMMARY_MAX_REFS);
-}
-function summarizeTrustStatus(status) {
-  const axes = Object.fromEntries(TRUST_STATUS_AXES.map((axis) => [axis, status[axis].state]));
-  return {
-    version: TRUST_SUMMARY_VERSION,
-    verdict: trustVerdict(status),
-    text: formatTrustSummary(status),
-    axes,
-    claimant: claimantOf(status),
-    unknown: TRUST_STATUS_AXES.filter((axis) => isUnanswered(status, axis)),
-    refs: trustSummaryReferences(status)
-  };
+  if (typeof value === "bigint") {
+    throw new Error("canonicalJson: bigint is not representable");
+  }
+  if (typeof value === "symbol" || typeof value === "function") {
+    throw new Error(`canonicalJson: ${typeof value} is not representable`);
+  }
+  if (value === void 0) {
+    throw new Error("canonicalJson: undefined is not representable at root");
+  }
+  if (Array.isArray(value)) {
+    const parts = [];
+    for (let i = 0; i < value.length; i++) {
+      if (!(i in value) || value[i] === void 0) {
+        parts.push("null");
+        continue;
+      }
+      parts.push(serialize(value[i]));
+    }
+    return `[${parts.join(",")}]`;
+  }
+  if (typeof value === "object") {
+    const obj = value;
+    const keys = Object.keys(obj).sort();
+    const parts = [];
+    for (const key of keys) {
+      const child = obj[key];
+      if (child === void 0) continue;
+      parts.push(`${JSON.stringify(key)}:${serialize(child)}`);
+    }
+    return `{${parts.join(",")}}`;
+  }
+  throw new Error(`canonicalJson: unsupported value of type ${typeof value}`);
 }
 
 export {
+  sha2562 as sha256,
+  canonicalJson2 as canonicalJson,
   RUN_RECEIPT_INTEGRITY_VERSION,
   RUN_RECEIPT_INTEGRITY_ALGORITHM,
   withReceiptIntegrity,
   isReceiptIntegrity,
   verifyReceiptIntegrity,
-  redactArtifactForStorage,
-  ZERO_EVAL_HARNESS_METRICS,
-  sumEvalHarnessMetrics,
-  createEvalId,
-  writeEvalArtifact,
-  loadEvalArtifact,
-  writeEvalArtifactV4,
-  loadEvalArtifactV4,
-  parseEvalArtifactV4,
   TRUST_STATUS_AXES,
   isTrustStatusIdentifier,
   normalizeTrustStatus,
@@ -1796,14 +1388,18 @@ export {
   inspectRunReceiptTrustStatus,
   adaptGateDecisionReviewStatus,
   adaptGroundedEvidenceValidationStatus,
-  adaptFinishContractCompletionStatus,
-  evalClioProvenance,
-  evalEnvironmentProvenance,
-  loadEvalTaskFile,
-  EvalTaskFileError,
+  trustStateWord,
   formatTrustSummary,
   formatTrustSummaryLine,
   formatTrustAxes,
-  summarizeTrustStatus
+  trustVerdict,
+  summarizeTrustStatus,
+  evalClioProvenance,
+  evalEnvironmentProvenance,
+  evalServingConfiguration,
+  evalServingObservationFrom,
+  assertComparableTrackedMetricSources,
+  loadEvalTaskFile,
+  EvalTaskFileError
 };
-//# sourceMappingURL=chunk-K4XHGFR5.js.map
+//# sourceMappingURL=chunk-B7OBL7PK.js.map