@iowarp/clio-coder 0.5.0 → 0.5.2

package/dist/{skills-eval-CQ23MYQK.js → skills-eval-AIBR2L7H.js}

@@ -1,39 +1,40 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import "./chunk-GGPF6LLE.js";
 import {
+  checkSkillDrift,
   parseSkillEvals
-} from "./chunk-4WOOTKFD.js";
+} from "./chunk-U3FETNQB.js";
 import {
   buildEvalEvidence,
   summarizeEvalResults
-} from "./chunk-LTWH2ACR.js";
+} from "./chunk-EQPFEDFV.js";
 import "./chunk-PECBKCDK.js";
-import "./chunk-OV62D6KO.js";
-import "./chunk-I4ELN5BX.js";
-import "./chunk-DXSETN72.js";
-import "./chunk-NFSK2VNU.js";
+import "./chunk-KQMYL5GR.js";
+import "./chunk-ZTNOEJRI.js";
+import "./chunk-7WUGNN43.js";
+import "./chunk-LZMTVVN4.js";
 import {
   evalClioProvenance,
   evalEnvironmentProvenance
-} from "./chunk-OZ76TLGU.js";
-import "./chunk-EOJPDNUP.js";
+} from "./chunk-EEITU7S6.js";
+import "./chunk-GPTR6OTU.js";
 import {
   ZERO_EVAL_HARNESS_METRICS,
   writeEvalArtifact
 } from "./chunk-BOBCCDJ6.js";
 import "./chunk-E6IPKW2E.js";
-import "./chunk-XMDBTYCH.js";
+import "./chunk-N3CWOGVF.js";
 import "./chunk-UQIVHSE4.js";
 import "./chunk-BYFHHCFV.js";
 import "./chunk-TKDRT2DF.js";
 import "./chunk-LQTKDAUO.js";
 import "./chunk-ZU4JPCPR.js";
-import "./chunk-U5QU5ZOD.js";
+import "./chunk-XYPWFSU5.js";
 import "./chunk-DNHVRBH4.js";
 import "./chunk-O5F25NIE.js";
-import "./chunk-U6YTUVOX.js";
+import "./chunk-Q4RMNWMZ.js";
 import "./chunk-SD7SHNDW.js";
-import "./chunk-7RET77VB.js";
+import "./chunk-Q2HKY32Y.js";
 import "./chunk-YQ3GFEUY.js";
 import "./chunk-WTQGRBHV.js";
 import "./chunk-GLIQT7SU.js";
@@ -44,55 +45,56 @@ import {
 } from "./chunk-NBXFPI7U.js";
 import "./chunk-SQZHXUB3.js";
 import "./chunk-SUTLW6ND.js";
-import "./chunk-RNDCROSG.js";
-import "./chunk-5KQEUIWM.js";
-import "./chunk-5JQR5B4D.js";
-import "./chunk-ZARZ4POR.js";
-import "./chunk-UX2L5CUD.js";
+import "./chunk-CNXU7TR2.js";
+import "./chunk-7LUEQODV.js";
+import "./chunk-6KV4KCQZ.js";
+import "./chunk-G5ZDQQE3.js";
+import "./chunk-AI36V3ON.js";
 import {
   discoverMarketplaceSkills,
   loadSkills
-} from "./chunk-LAR7DX5E.js";
+} from "./chunk-B5TASTCK.js";
 import "./chunk-DNCE23JJ.js";
 import "./chunk-CDQ2UC6W.js";
 import "./chunk-5LP5FNNR.js";
 import "./chunk-NVPXXW2H.js";
-import "./chunk-R7FGRZNF.js";
-import "./chunk-DOUISWEE.js";
-import "./chunk-VKHLUZNO.js";
+import "./chunk-LXYHCCIZ.js";
+import "./chunk-QOJ4ERMU.js";
+import "./chunk-UZ7YBL43.js";
 import {
   HEADLESS_PERMISSION_DENIED_MARKER,
   combineBashOutput,
   runBashCommand
-} from "./chunk-OQ2EOAHA.js";
-import "./chunk-NDPF2N2L.js";
+} from "./chunk-PF36KOGI.js";
+import "./chunk-7DW7CJW2.js";
 import "./chunk-7QXCO3AF.js";
-import "./chunk-T33IYTZM.js";
+import "./chunk-SAASVMIY.js";
 import "./chunk-OH3YYA3B.js";
 import "./chunk-VESL6DQY.js";
 import "./chunk-FD3IAHQM.js";
 import "./chunk-XNIZBOFV.js";
-import "./chunk-XZWSP67B.js";
-import "./chunk-BRCOSE7O.js";
-import "./chunk-55RMDDFM.js";
+import "./chunk-5APYAXCB.js";
+import "./chunk-SZUO5BSE.js";
+import "./chunk-PGQG7ZMW.js";
 import "./chunk-L4N3DWNW.js";
-import "./chunk-TDGYTWM6.js";
-import "./chunk-CTFPFW3H.js";
+import "./chunk-F4I3H56H.js";
+import "./chunk-Q6FRR3AQ.js";
 import {
   effectiveToolCall
-} from "./chunk-DE2LU267.js";
+} from "./chunk-KKAJGT3B.js";
+import "./chunk-H7REJ7L5.js";
 import "./chunk-YYLCPDCC.js";
 import "./chunk-EFSEIZE6.js";
 import {
   NO_NETWORK_TOOLS_ENV
-} from "./chunk-KBUTSJSR.js";
-import "./chunk-YBUECLAF.js";
-import "./chunk-CRHPCPZP.js";
-import "./chunk-FFYTC2KQ.js";
-import "./chunk-UJD5MPP6.js";
+} from "./chunk-4XBYHXGK.js";
+import "./chunk-YEJQDODA.js";
+import "./chunk-4KC4CHKJ.js";
+import "./chunk-MNABNEBX.js";
+import "./chunk-FLNXQQ5B.js";
 import "./chunk-DZLR4UEH.js";
-import "./chunk-OPD7GL6F.js";
-import "./chunk-733ZBT5P.js";
+import "./chunk-H6FQVNZC.js";
+import "./chunk-E74MJF6G.js";
 import "./chunk-GHXGMFQ5.js";
 import "./chunk-KECNXMDE.js";
 import "./chunk-WXA2CFJO.js";
@@ -100,12 +102,12 @@ import "./chunk-6CTHLZFB.js";
 import "./chunk-2KUBKL63.js";
 import "./chunk-MYI32N4R.js";
 import "./chunk-X6FLVUM5.js";
-import "./chunk-EYTLV3W3.js";
+import "./chunk-HTWTORF7.js";
 import "./chunk-MCJKEGHO.js";
 import "./chunk-DVTBERFY.js";
 import "./chunk-6EJYVCTN.js";
 import "./chunk-W53XSRQE.js";
-import "./chunk-6W75D37F.js";
+import "./chunk-53P775GE.js";
 import "./chunk-77DCC6JZ.js";
 import "./chunk-SYF7FVBL.js";
 import "./chunk-Z4GLJ6J4.js";
@@ -116,22 +118,23 @@ import "./chunk-L7G7K4I2.js";
 import "./chunk-ALJWT6O6.js";
 import "./chunk-4WV4PI66.js";
 import "./chunk-HMN2C6YL.js";
-import "./chunk-I4Y4WKZR.js";
+import "./chunk-F6KCJO3U.js";
 import "./chunk-UZVYEF57.js";
+import "./chunk-MMZMM6SW.js";
 import "./chunk-O3VV6IVK.js";
-import "./chunk-EKV4UBCM.js";
+import "./chunk-PZBQUJ2F.js";
 import "./chunk-UHW5V7HC.js";
-import "./chunk-LNOXCGN2.js";
+import "./chunk-7UFDIOBT.js";
 import "./chunk-BJH6WFIB.js";
 import "./chunk-5EQO5NWP.js";
-import "./chunk-VYRQHORQ.js";
-import "./chunk-P4GNZPXO.js";
+import "./chunk-NMQSO6Z6.js";
+import "./chunk-OYUS3UZP.js";
 import "./chunk-R2P2U3ZS.js";
 import "./chunk-NTTS3O53.js";
 import "./chunk-C2CPOIH2.js";
 import "./chunk-MGLRTOCK.js";
 import "./chunk-M4KFUXS7.js";
-import "./chunk-V4XJWDHR.js";
+import "./chunk-6UKFRTXI.js";
 import "./chunk-56XP4FJU.js";
 import "./chunk-QZTTRSJE.js";
 import "./chunk-U2MSJ57E.js";
@@ -174,10 +177,10 @@ import {
 init_esm_shims();
 import { spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
-import { existsSync } from "node:fs";
-import { cp, mkdir, mkdtemp, readdir, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { existsSync, realpathSync } from "node:fs";
+import { cp, mkdir, mkdtemp, readdir, readFile, readlink, realpath, rm, stat, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
+import { isAbsolute, join, relative as relativePath, resolve } from "node:path";
 import { performance } from "node:perf_hooks";
 var DEFAULT_RUN_TIMEOUT_MS = 6e5;
 var ARM_AUTONOMY = "full-auto";
@@ -186,6 +189,115 @@ var PREVIEW_MAX_CHARS = 300;
 var TRANSCRIPT_HEAD_CHARS = 9e3;
 var TRANSCRIPT_TAIL_CHARS = 4e3;
 var SKILL_EVAL_SIDECAR = "skill-eval.json";
+function deriveBulletAttribution(baseline, treatment) {
+  if (baseline === "unmeasured" || baseline === "error") return "unmeasured";
+  if (treatment === "unmeasured" || treatment === "error") return "unmeasured";
+  if (baseline === "fail" && treatment === "pass") return "helped";
+  if (baseline === "pass" && treatment === "fail") return "regressed";
+  return baseline === "pass" ? "no-change-pass" : "no-change-fail";
+}
+function deriveScenarioAttributionVerdict(bullets) {
+  if (bullets.length === 0) return "unmeasured";
+  if (bullets.some((bullet) => bullet.attribution === "unmeasured")) return "unmeasured";
+  const helped = bullets.some((bullet) => bullet.attribution === "helped");
+  const regressed = bullets.some((bullet) => bullet.attribution === "regressed");
+  if (helped && regressed) return "mixed";
+  if (regressed) return "regressed";
+  if (helped) return "helped";
+  return "no-change";
+}
+function attributionCounts(bullets) {
+  const counts = { helped: 0, regressed: 0, noChangePass: 0, noChangeFail: 0, unmeasured: 0 };
+  for (const bullet of bullets) {
+    if (bullet.attribution === "helped") counts.helped += 1;
+    else if (bullet.attribution === "regressed") counts.regressed += 1;
+    else if (bullet.attribution === "no-change-pass") counts.noChangePass += 1;
+    else if (bullet.attribution === "no-change-fail") counts.noChangeFail += 1;
+    else counts.unmeasured += 1;
+  }
+  return counts;
+}
+function attributionFromStrict(scenario, baseline, treatment) {
+  const verdictOf = (pass) => pass === void 0 ? "unmeasured" : pass ? "pass" : "fail";
+  const refusal = (side, strict, index) => {
+    if (strict.verdicts.has(index)) return null;
+    if (strict.absent !== null) return `${side} judge: ${strict.absent}`;
+    return `${side} judge: ${strict.rejected.get(index) ?? `no verdict for bullet ${index}`}`;
+  };
+  const bullets = scenario.expected.map((text, i) => {
+    const index = i + 1;
+    const baselinePass = baseline.verdicts.get(index);
+    const treatmentPass = treatment.verdicts.get(index);
+    const baselineVerdict = verdictOf(baselinePass);
+    const treatmentVerdict = verdictOf(treatmentPass);
+    const reason = refusal("baseline", baseline, index) ?? refusal("treatment", treatment, index);
+    return {
+      index,
+      text,
+      baseline: baselineVerdict,
+      treatment: treatmentVerdict,
+      attribution: deriveBulletAttribution(baselineVerdict, treatmentVerdict),
+      ...reason !== null ? { reason } : {}
+    };
+  });
+  const verdict = deriveScenarioAttributionVerdict(bullets);
+  const firstReason = bullets.find((bullet) => bullet.reason !== void 0)?.reason ?? null;
+  return {
+    verdict,
+    reason: verdict === "unmeasured" ? firstReason : null,
+    bullets,
+    counts: attributionCounts(bullets)
+  };
+}
+async function skillTreeDigest(baseDir) {
+  const root = resolve(baseDir);
+  const entries = [];
+  const seenDirs = /* @__PURE__ */ new Set();
+  const walk = async (dir) => {
+    const real = await realpath(dir);
+    if (seenDirs.has(real)) throw new Error("cycle");
+    seenDirs.add(real);
+    const found = await readdir(dir, { withFileTypes: true });
+    for (const entry of found.sort((a, b) => a.name.localeCompare(b.name))) {
+      const full = join(dir, entry.name);
+      if (entry.isSymbolicLink()) {
+        const target = await readlink(full);
+        const resolved = resolve(dir, target);
+        const relative = relativePath(root, resolved);
+        if (relative.startsWith("..") || isAbsolute(relative)) throw new Error("escaping symlink");
+        entries.push({ relative: full.slice(root.length), kind: "symlink", target });
+        continue;
+      }
+      if (entry.isDirectory()) await walk(full);
+      else if (entry.isFile()) entries.push({ relative: full.slice(root.length), kind: "file" });
+    }
+  };
+  try {
+    await walk(root);
+    const hash = createHash("sha256");
+    for (const entry of entries.sort((a, b) => a.relative.localeCompare(b.relative))) {
+      hash.update(entry.relative, "utf8");
+      hash.update("\0");
+      hash.update(entry.kind, "utf8");
+      hash.update("\0");
+      if (entry.kind === "symlink") hash.update(entry.target ?? "", "utf8");
+      else hash.update(await readFile(join(root, entry.relative)));
+      hash.update("\0");
+    }
+    return hash.digest("hex");
+  } catch {
+    return null;
+  }
+}
+function artifactIsPinnable(skillBody) {
+  return !skillBody.includes("${pluginRoot}") && !skillBody.includes("${component:");
+}
+function notAttemptedAttribution(reason) {
+  return { verdict: "not-attempted", reason, bullets: [], counts: attributionCounts([]) };
+}
+function unmeasurableAttribution(reason) {
+  return { verdict: "unmeasured", reason, bullets: [], counts: attributionCounts([]) };
+}
 async function runSkillsEvalCommand(nameOrPath, options) {
   const resolved = resolveSkillBaseDir(nameOrPath, process.cwd());
   if (resolved.baseDir === null) {
@@ -215,6 +327,29 @@ async function runSkillsEvalCommand(nameOrPath, options) {
     process.stderr.write(`clio-coder eval skill: ${diagnostic}
 `);
   }
+  const subjectTree = await skillTreeDigest(resolved.baseDir);
+  const reread = await readFile(join(resolved.baseDir, "SKILL.md"), "utf8").catch(() => null);
+  const coherent = reread !== null && createHash("sha256").update(reread, "utf8").digest("hex") === skill.hash;
+  const pinnable = reread !== null && artifactIsPinnable(reread);
+  const driftReport = checkSkillDrift(skill, process.cwd());
+  const subject = {
+    name: skill.name,
+    baseDir: resolved.baseDir,
+    origin: resolved.origin ?? "unknown",
+    sha256: skill.hash,
+    normalizedHash: skill.normalizedHash,
+    treeSha256: coherent ? subjectTree : null,
+    pinnable,
+    evalsPath,
+    evalsSha256: createHash("sha256").update(evalsRaw, "utf8").digest("hex"),
+    drift: driftReport === null ? null : { verdict: driftReport.verdict, authority: driftReport.authority, expected: driftReport.expected }
+  };
+  if (subject.drift?.verdict === "mismatch") {
+    process.stderr.write(
+      `clio-coder eval skill: WARNING skill_drift: ${skill.name} content (sha256 ${skill.normalizedHash.slice(0, 12)}\u2026) does not match the hash recorded for it by the ${subject.drift.authority} (expected ${subject.drift.expected.slice(0, 12)}\u2026); this run measures the copy on disk, not the recorded one
+`
+    );
+  }
   const matcher = options.scenario === void 0 ? null : scenarioMatcher(options.scenario);
   if (options.scenario !== void 0 && matcher === null) {
     printError(`invalid --scenario "${options.scenario}": use a scenario id like S1 or a bare number`);
@@ -238,24 +373,38 @@ async function runSkillsEvalCommand(nameOrPath, options) {
   }
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const outcomes = [];
+  const attributionEnabled = !options.noAttribution;
   for (const scenario of scenarios) {
-    process.stderr.write(`clio-coder eval skill: ${skill.name} ${scenario.id} baseline/treatment/judge...
-`);
+    process.stderr.write(
+      `clio-coder eval skill: ${skill.name} ${scenario.id} baseline/treatment/judge${attributionEnabled ? "/baseline-judge" : ""}...
+`
+    );
     outcomes.push(
-      await runScenario(
-        skill.name,
-        resolved.baseDir,
+      await runScenario({
+        skillName: skill.name,
+        skillBaseDir: resolved.baseDir,
         scenario,
-        options.target,
+        target: options.target,
         timeoutMs,
         workspaceOverride,
-        options.trustFixtures,
-        childEnv
-      )
+        trustFixtures: options.trustFixtures,
+        childEnv,
+        attributionEnabled,
+        subjectTreeSha256: subject.treeSha256,
+        subjectSha256: subject.sha256,
+        pinnable: subject.pinnable
+      })
+    );
+  }
+  const unverified = outcomes.filter((outcome) => outcome.subjectVerification === "mismatch");
+  if (unverified.length > 0) {
+    process.stderr.write(
+      `clio-coder eval skill: WARNING subject_changed: the skill tree at ${resolved.baseDir} changed during ${unverified.map((outcome) => outcome.scenario.id).join(", ")}; those scenarios' rubric results stand but their baseline comparison is unmeasured
+`
     );
   }
   const endedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const artifact = synthesizeArtifact(skill.name, evalsPath, evalsRaw, startedAt, endedAt, outcomes, options.target);
+  const artifact = synthesizeArtifact(subject, evalsPath, evalsRaw, startedAt, endedAt, outcomes, options.target);
   let evidenceId = null;
   let evidenceDirectory = null;
   const evidenceErrors = [];
@@ -271,7 +420,7 @@ async function runSkillsEvalCommand(nameOrPath, options) {
     evidenceDirectory = built.directory;
     await writeFile(
       join(built.directory, SKILL_EVAL_SIDECAR),
-      `${JSON.stringify(sidecar(skill.name, artifact.evalId, outcomes, options.allowNetwork), null, 2)}
+      `${JSON.stringify(sidecar(subject, artifact.evalId, outcomes, options.allowNetwork, attributionEnabled), null, 2)}
 `,
       "utf8"
     );
@@ -284,23 +433,35 @@ async function runSkillsEvalCommand(nameOrPath, options) {
   }
   if (options.json) {
     for (const outcome of outcomes) {
+      const attributed = new Map(outcome.attribution.bullets.map((item) => [item.index, item]));
       for (const bullet of outcome.bullets) {
+        const pair = attributed.get(bullet.index);
         process.stdout.write(
           `${JSON.stringify({
             schema: "experimental",
             kind: "skill-eval-bullet",
             skill: skill.name,
+            skillSha256: subject.normalizedHash,
+            skillOrigin: subject.origin,
+            skillDrift: subject.drift?.verdict ?? null,
             scenario: outcome.scenario.id,
             title: outcome.scenario.title,
             bullet: bullet.index,
             expected: bullet.text,
             verdict: bullet.verdict,
             reason: bullet.reason,
+            // Advisory, never a gate: `verdict` above is the rubric result and
+            // is unchanged by anything here.
+            baselineVerdict: pair?.baseline ?? null,
+            attribution: pair?.attribution ?? null,
+            scenarioAttribution: outcome.attribution.verdict,
+            attributionReason: outcome.attribution.reason,
             network: networkPolicyLabel(options.allowNetwork),
             autonomy: ARM_AUTONOMY,
             baselineSessionId: outcome.baseline?.sessionId ?? null,
             treatmentSessionId: outcome.treatment?.sessionId ?? null,
             judgeSessionId: outcome.judge?.sessionId ?? null,
+            baselineJudgeSessionId: outcome.baselineJudge?.sessionId ?? null,
             evalId: artifact.evalId,
             evidenceId
           })}
@@ -309,7 +470,7 @@ async function runSkillsEvalCommand(nameOrPath, options) {
       }
     }
   } else {
-    printHumanReport(skill.name, outcomes, artifact.evalId, evidenceId, evidenceDirectory, options.allowNetwork);
+    printHumanReport(subject, outcomes, artifact.evalId, evidenceId, evidenceDirectory, options.allowNetwork);
   }
   const anyFailure = outcomes.some(
     (outcome) => outcome.bullets.some((bullet) => bullet.verdict === "fail" || bullet.verdict === "error")
@@ -329,9 +490,12 @@ function describeArmPolicyOutcome(allowNetwork) {
   const network = allowNetwork ? "network: allowed (--allow-network); arm runs kept the web tools" : "retrieval: disabled; bash networking was not constrained";
   return `policy: the baseline and treatment arms ran at autonomy ${ARM_AUTONOMY}; ${network}`;
 }
+function isJudgeArm(arm) {
+  return arm === "judge" || arm === "baseline-judge";
+}
 function armRunArgs(arm, prompt, options = {}) {
   const args = ["run", "--json", "--json-events", "full", "--no-skills"];
-  if (arm !== "judge") args.push("--autonomy", ARM_AUTONOMY);
+  if (!isJudgeArm(arm)) args.push("--autonomy", ARM_AUTONOMY);
   if (options.skillBaseDir !== void 0) args.push("--skill", options.skillBaseDir);
   if (options.target !== void 0) args.push("--target", options.target);
   args.push(prompt);
@@ -401,11 +565,35 @@ async function resolveWorkspaceOverride(workspace) {
     return { error: `--workspace is not readable: ${resolved}: ${detail}` };
   }
 }
-async function runScenario(skillName, skillBaseDir, scenario, target, timeoutMs, workspaceOverride, trustFixtures, childEnv) {
+async function runScenario(input) {
+  const {
+    skillName,
+    skillBaseDir,
+    scenario,
+    target,
+    timeoutMs,
+    workspaceOverride,
+    trustFixtures,
+    childEnv,
+    attributionEnabled,
+    subjectTreeSha256,
+    subjectSha256,
+    pinnable
+  } = input;
+  const runArm = input.runner ?? captureHeadlessRun;
   const scenarioStart = performance.now();
   const workspace = await mkdtemp(join(tmpdir(), "clio-coder-skill-eval-seed-"));
   let runWorkspaces = null;
+  let subjectVerification = "not-checked";
+  let observedTreeSha256 = null;
   try {
+    const skipAttribution = (reason) => attributionEnabled ? unmeasurableAttribution(reason) : notAttemptedAttribution(ATTRIBUTION_DISABLED_REASON);
+    const outcomeBase = () => ({
+      workspace,
+      subjectVerification,
+      observedTreeSha256,
+      wallTimeMs: Math.round(performance.now() - scenarioStart)
+    });
     if (workspaceOverride !== null) await copyWorkspace(workspaceOverride, workspace);
     const fixtureError = await runFixtureCommands(scenario, workspace, timeoutMs, trustFixtures);
     if (fixtureError !== null) {
@@ -415,24 +603,31 @@ async function runScenario(skillName, skillBaseDir, scenario, target, timeoutMs,
         baseline: null,
         treatment: null,
         judge: null,
-        workspace,
-        wallTimeMs: Math.round(performance.now() - scenarioStart),
+        baselineJudge: null,
+        attribution: skipAttribution(fixtureError),
+        ...outcomeBase(),
         infraError: fixtureError
       });
     }
-    runWorkspaces = await materializeSkillEvalWorkspaces(workspace);
-    const baseline = await captureHeadlessRun(
+    runWorkspaces = await materializeSkillEvalWorkspaces(workspace, pinnable ? skillBaseDir : null);
+    const baseline = await runArm(
       armRunArgs("baseline", scenario.setup, { target }),
       runWorkspaces.baseline,
       timeoutMs,
       childEnv
     );
-    const treatment = await captureHeadlessRun(
-      armRunArgs("treatment", `/skill ${skillName} ${scenario.setup}`, { target, skillBaseDir }),
+    const pinned = pinnable ? runWorkspaces.pin : null;
+    const armSkillDir = pinned ?? skillBaseDir;
+    const before = await skillTreeDigest(armSkillDir);
+    const treatment = await runArm(
+      armRunArgs("treatment", `/skill ${skillName} ${scenario.setup}`, { target, skillBaseDir: armSkillDir }),
       runWorkspaces.treatment,
       timeoutMs,
       childEnv
     );
+    const after = await skillTreeDigest(armSkillDir);
+    observedTreeSha256 = after;
+    subjectVerification = !pinnable ? "not-pinned" : verifySubjectTree(subjectTreeSha256, before, after) === "verified" ? verifyObservedActivation(skillName, subjectSha256, join(armSkillDir, "SKILL.md"), treatment.activations) : verifySubjectTree(subjectTreeSha256, before, after);
     const infra = runInfraError("baseline", baseline) ?? runInfraError("treatment", treatment);
     if (infra !== null) {
       return await completeScenarioOutcome({
@@ -441,8 +636,9 @@ async function runScenario(skillName, skillBaseDir, scenario, target, timeoutMs,
         baseline,
         treatment,
         judge: null,
-        workspace,
-        wallTimeMs: Math.round(performance.now() - scenarioStart),
+        baselineJudge: null,
+        attribution: skipAttribution(infra),
+        ...outcomeBase(),
         infraError: infra
       });
     }
@@ -454,12 +650,13 @@ async function runScenario(skillName, skillBaseDir, scenario, target, timeoutMs,
         baseline,
         treatment,
         judge: null,
-        workspace,
-        wallTimeMs: Math.round(performance.now() - scenarioStart),
+        baselineJudge: null,
+        attribution: skipAttribution(wall),
+        ...outcomeBase(),
         infraError: wall
       });
     }
-    const judge = await captureHeadlessRun(
+    const judge = await runArm(
       armRunArgs("judge", judgePrompt(scenario, baseline.transcript, treatment.transcript), { target }),
       runWorkspaces.judge,
       timeoutMs,
@@ -473,20 +670,35 @@ async function runScenario(skillName, skillBaseDir, scenario, target, timeoutMs,
         baseline,
         treatment,
         judge,
-        workspace,
-        wallTimeMs: Math.round(performance.now() - scenarioStart),
+        baselineJudge: null,
+        attribution: skipAttribution(judgeInfra),
+        ...outcomeBase(),
         infraError: judgeInfra
       });
     }
     const bullets = parseJudgeVerdicts(scenario, judge);
+    const attributed = await attributeScenario({
+      scenario,
+      bullets,
+      baseline,
+      judge,
+      target,
+      timeoutMs,
+      childEnv,
+      attributionEnabled,
+      subjectVerification,
+      workspace: runWorkspaces.baselineJudge,
+      runner: runArm
+    });
     return await completeScenarioOutcome({
       scenario,
       bullets,
       baseline,
       treatment,
       judge,
-      workspace,
-      wallTimeMs: Math.round(performance.now() - scenarioStart),
+      baselineJudge: attributed.baselineJudge,
+      attribution: attributed.attribution,
+      ...outcomeBase(),
       infraError: null
     });
   } finally {
@@ -497,6 +709,77 @@ async function runScenario(skillName, skillBaseDir, scenario, target, timeoutMs,
     }
   }
 }
+var ATTRIBUTION_DISABLED_REASON = "disabled by --no-attribution";
+function verifySubjectTree(subject, before, after) {
+  if (subject === null || before === null || after === null) return "unreadable";
+  return subject === before && before === after ? "verified" : "mismatch";
+}
+function verifyObservedActivation(skillName, expectedSha256, expectedPath, activations) {
+  const matching = activations.filter((entry) => entry.name === skillName);
+  if (matching.length === 0) return "not-activated";
+  if (matching.length > 1 && new Set(matching.map((entry) => `${entry.hash}|${entry.path}`)).size > 1) {
+    return "activation-mismatch";
+  }
+  const observed = matching[0];
+  if (observed === void 0 || observed.hash !== expectedSha256) return "activation-mismatch";
+  return samePath(observed.path, expectedPath) ? "verified" : "activation-mismatch";
+}
+function samePath(left, right) {
+  if (left.length === 0 || right.length === 0) return false;
+  try {
+    return realpathSync.native(left) === realpathSync.native(right);
+  } catch {
+    return resolve(left) === resolve(right);
+  }
+}
+var SUBJECT_REFUSAL = {
+  mismatch: "the measured skill tree changed on disk during this scenario, so its two arms did not run against one artifact",
+  unreadable: "the measured skill tree could not be re-read, so the artifact under test is unverified",
+  "not-pinned": "the skill body carries package references, which resolve against an owning package root outside the skill directory, so the artifact could not be copied faithfully for this run",
+  "not-activated": "the treatment arm recorded no successful activation of this skill, so nothing establishes that the measured artifact ran",
+  "activation-mismatch": "the treatment arm activated content whose hash is not the pinned artifact's, so the comparison would name the wrong revision",
+  "not-checked": "the artifact identity was never checked for this scenario"
+};
+async function attributeScenario(input) {
+  if (!input.attributionEnabled) {
+    return { attribution: notAttemptedAttribution(ATTRIBUTION_DISABLED_REASON), baselineJudge: null };
+  }
+  if (input.subjectVerification !== "verified") {
+    return { attribution: unmeasurableAttribution(SUBJECT_REFUSAL[input.subjectVerification]), baselineJudge: null };
+  }
+  const treatmentWall = permissionWallReason("judge", input.judge);
+  if (treatmentWall !== null) return { attribution: unmeasurableAttribution(treatmentWall), baselineJudge: null };
+  if (!input.bullets.some((bullet) => bullet.verdict === "pass" || bullet.verdict === "fail")) {
+    return {
+      attribution: unmeasurableAttribution(
+        "the treatment arm produced no scored bullet, so there is nothing to compare a baseline against"
+      ),
+      baselineJudge: null
+    };
+  }
+  const baselineJudge = await input.runner(
+    armRunArgs("baseline-judge", baselineJudgePrompt(input.scenario, input.baseline.transcript), {
+      target: input.target
+    }),
+    input.workspace,
+    input.timeoutMs,
+    input.childEnv
+  );
+  const infra = runInfraError("baseline-judge", baselineJudge);
+  if (infra !== null) {
+    return { attribution: unmeasurableAttribution(infra), baselineJudge };
+  }
+  const wall = permissionWallReason("baseline-judge", baselineJudge);
+  if (wall !== null) return { attribution: unmeasurableAttribution(wall), baselineJudge };
+  return {
+    attribution: attributionFromStrict(
+      input.scenario,
+      strictJudgeVerdicts(input.scenario, baselineJudge),
+      strictJudgeVerdicts(input.scenario, input.judge)
+    ),
+    baselineJudge
+  };
+}
 async function armWorkspace(created) {
   const root = await mkdtemp(join(tmpdir(), "clio-coder-skill-eval-"));
   created.push(root);
@@ -504,17 +787,27 @@ async function armWorkspace(created) {
   await mkdir(workspace, { recursive: true });
   return workspace;
 }
-async function materializeSkillEvalWorkspaces(seedWorkspace) {
+async function materializeSkillEvalWorkspaces(seedWorkspace, pinSource) {
   const created = [];
   try {
     const baseline = await armWorkspace(created);
     const treatment = await armWorkspace(created);
     const judge = await armWorkspace(created);
+    const baselineJudge = await armWorkspace(created);
+    let pin = null;
+    if (pinSource !== null) {
+      const root = await mkdtemp(join(tmpdir(), "clio-coder-skill-eval-pin-"));
+      created.push(root);
+      pin = join(root, "skill");
+      await cp(pinSource, pin, { recursive: true, preserveTimestamps: true, verbatimSymlinks: true });
+    }
     await Promise.all([copyWorkspace(seedWorkspace, baseline), copyWorkspace(seedWorkspace, treatment)]);
     return {
       baseline,
       treatment,
       judge,
+      baselineJudge,
+      pin,
       cleanup: async () => {
         await Promise.all(created.map((path) => rm(path, { recursive: true, force: true })));
       }
@@ -534,7 +827,7 @@ async function copyWorkspace(source, destination) {
 async function completeScenarioOutcome(outcome) {
   return {
     ...outcome,
-    usage: await usageForCapturedRuns([outcome.baseline, outcome.treatment, outcome.judge])
+    usage: await usageForCapturedRuns([outcome.baseline, outcome.treatment, outcome.judge, outcome.baselineJudge])
   };
 }
 async function runFixtureCommands(scenario, workspace, timeoutMs, trustFixtures) {
@@ -703,11 +996,21 @@ function loadsSkillBody(tool, args) {
   if (tool !== "context" || !isRecord(args)) return false;
   return args.scope === "skills" && typeof args.name === "string" && args.name.trim().length > 0;
 }
+function activationFromResult(result) {
+  if (!isRecord(result)) return null;
+  const details = isRecord(result.details) ? result.details : null;
+  if (details === null) return null;
+  const name = readString(details.name);
+  const hash = readString(details.hash);
+  if (name === null || hash === null) return null;
+  return { name, hash, path: readString(details.filePath) ?? readString(details.path) ?? "" };
+}
 function parseRunStdout(stdout) {
   let sessionId = null;
   const lines = [];
   let finalText = "";
   let sawJson = false;
+  const activations = [];
   const streamedText = /* @__PURE__ */ new Map();
   const skillBodyCallIds = /* @__PURE__ */ new Set();
   for (const line of stdout.split("\n")) {
@@ -748,6 +1051,10 @@ ${args.content}`);
       const tool = readString(event.toolName) ?? readString(event.tool) ?? "tool";
       const status = event.isError === true ? "error" : "ok";
       const callId = readString(event.toolCallId);
+      if (event.isError !== true && callId !== null && skillBodyCallIds.has(callId)) {
+        const activation = activationFromResult(event.result);
+        if (activation !== null) activations.push(activation);
+      }
       if (callId !== null && skillBodyCallIds.has(callId)) {
         lines.push(`RESULT ${tool} ${status}: <skill body withheld from the judge>`);
         continue;
@@ -771,9 +1078,9 @@ ${args.content}`);
   }
   if (!sawJson) {
     const text = stdout.trim();
-    return { sessionId: null, transcript: text, finalText: text };
+    return { sessionId: null, transcript: text, finalText: text, activations: [] };
   }
-  return { sessionId, transcript: elide(lines.join("\n")), finalText };
+  return { sessionId, transcript: elide(lines.join("\n")), finalText, activations };
 }
 function judgePrompt(scenario, baselineTranscript, treatmentTranscript) {
   const bullets = scenario.expected.map((text, index) => `${index + 1}. ${text}`).join("\n");
@@ -798,6 +1105,26 @@ function judgePrompt(scenario, baselineTranscript, treatmentTranscript) {
     treatmentTranscript.length > 0 ? treatmentTranscript : "(empty)"
   ].join("\n");
 }
+function baselineJudgePrompt(scenario, baselineTranscript) {
+  const bullets = scenario.expected.map((text, index) => `${index + 1}. ${text}`).join("\n");
+  return [
+    "You are scoring an agent run. One transcript follows: it ran WITHOUT any skill loaded.",
+    "Score each EXPECTED bullet strictly against the TRANSCRIPT.",
+    "A bullet passes only if the transcript observably satisfies it; anything unverifiable from the transcript fails.",
+    'Reply with STRICT JSON only, no prose and no code fences, exactly: {"bullets":[{"index":1,"pass":true,"reason":"<= 25 words"}]}',
+    `Include one entry per bullet, indexes 1 through ${scenario.expected.length} in order.`,
+    "Do not use any tools. Respond with the JSON verdict directly.",
+    "",
+    `SCENARIO ${scenario.id} - ${scenario.title}`,
+    `SETUP: ${scenario.setup}`,
+    "",
+    "EXPECTED BULLETS:",
+    bullets,
+    "",
+    "TRANSCRIPT:",
+    baselineTranscript.length > 0 ? baselineTranscript : "(empty)"
+  ].join("\n");
+}
 function judgeVerdictAbsenceReason(judge) {
   const sawBulletsKey = `${judge.finalText}
 ${judge.transcript}`.includes('"bullets"');
@@ -835,6 +1162,47 @@ function parseJudgeVerdicts(scenario, judge) {
     return { index, text, verdict: entry.pass ? "pass" : "fail", reason: entry.reason };
   });
 }
+function strictJudgeVerdicts(scenario, judge) {
+  const verdicts = /* @__PURE__ */ new Map();
+  const rejected = /* @__PURE__ */ new Map();
+  const parsed = extractBulletsObject(judge.finalText) ?? extractBulletsObject(judge.transcript);
+  if (parsed === null) return { verdicts, rejected, absent: judgeVerdictAbsenceReason(judge) };
+  if (!Array.isArray(parsed.bullets)) {
+    return { verdicts, rejected, absent: "judge verdict object carried no bullets array" };
+  }
+  const count = scenario.expected.length;
+  const seen = /* @__PURE__ */ new Map();
+  for (const item of parsed.bullets) {
+    if (!isRecord(item)) continue;
+    const index = item.index;
+    if (typeof index !== "number" || !Number.isInteger(index) || index < 1 || index > count) {
+      continue;
+    }
+    if (typeof item.pass !== "boolean") {
+      rejected.set(index, `judge gave no boolean pass for bullet ${index}: comparison evidence refused`);
+      verdicts.delete(index);
+      continue;
+    }
+    if (rejected.has(index)) {
+      verdicts.delete(index);
+      continue;
+    }
+    const previous = seen.get(index);
+    if (previous !== void 0 && previous !== item.pass) {
+      rejected.set(index, `judge gave contradictory verdicts for bullet ${index}: comparison evidence refused`);
+      verdicts.delete(index);
+      continue;
+    }
+    seen.set(index, item.pass);
+    verdicts.set(index, item.pass);
+  }
+  for (let index = 1; index <= count; index += 1) {
+    if (!verdicts.has(index) && !rejected.has(index)) {
+      rejected.set(index, `judge omitted bullet ${index}: comparison evidence absent`);
+    }
+  }
+  return { verdicts, rejected, absent: null };
+}
 function extractBulletsObject(text) {
   const stripped = text.replace(/```(?:json)?/g, "");
   const bulletsAt = stripped.indexOf('"bullets"');
@@ -881,7 +1249,8 @@ function balancedJsonSlice(text, start) {
   }
   return null;
 }
-function synthesizeArtifact(skillName, evalsPath, evalsRaw, startedAt, endedAt, outcomes, target) {
+function synthesizeArtifact(subject, evalsPath, evalsRaw, startedAt, endedAt, outcomes, target) {
+  const skillName = subject.name;
   const contentHash = createHash("sha256").update(evalsRaw, "utf8").digest("hex");
   const stamp = startedAt.replace(/[-:.]/g, "");
   const evalId = `skill-${skillName}-${stamp}-${contentHash.slice(0, 8)}-${randomBytes(6).toString("hex")}`;
@@ -898,6 +1267,14 @@ function synthesizeArtifact(skillName, evalsPath, evalsRaw, startedAt, endedAt,
       tags: [
         "skill-eval",
         `skill:${skillName}`,
+        // The artifact identity, on every record. Two bundles for one skill
+        // name are only comparable when both say which content they ran.
+        `skill-sha:${subject.normalizedHash.slice(0, 12)}`,
+        `skill-origin:${subject.origin}`,
+        ...subject.drift !== null ? [`skill-drift:${subject.drift.verdict}`] : [],
+        // Advisory. `pass` and `exitCode` below keep their treatment-only
+        // meaning; this tag is read by nothing that gates.
+        `attribution:${outcome.attribution.verdict}`,
         ...unmeasured ? ["scenario:unmeasured"] : [],
         ...outcome.bullets.map((bullet) => `bullet-${bullet.index}:${bullet.verdict}`)
       ],
@@ -934,20 +1311,39 @@ function synthesizeArtifact(skillName, evalsPath, evalsRaw, startedAt, endedAt,
     results
   };
 }
-function sidecar(skillName, evalId, outcomes, allowNetwork) {
+function sidecar(subject, evalId, outcomes, allowNetwork, attributionEnabled) {
   return {
-    version: 1,
+    version: 2,
     schema: "experimental",
     kind: "skill-eval",
-    skill: skillName,
+    skill: subject.name,
+    // What this run measured, by identity rather than by name. `version` moved
+    // to 2 for this block; readers of version 1 keep working, they just never
+    // learn which copy produced their numbers.
+    subject,
     evalId,
     network: networkPolicyLabel(allowNetwork),
     autonomy: ARM_AUTONOMY,
+    attributionEnabled,
+    attributionSummary: attributionSummary(outcomes),
     deltas: [
       "bullet verdicts are judge-scored from run transcripts, not command exit codes; the evals-domain artifact carries scenario-level records with empty command lists",
       "a bullet the judge never scored is recorded unmeasured, not failed: its scenario record is pass:false with exitCode 3 and no failureClass",
       "an arm whose transcript carries the headless permission wall is recorded unmeasured with an infraError: the harness's own gate is not a verdict about the skill",
       "tokens and cost are rolled up from headless main-agent receipts when those receipts are present",
+      "attribution is advisory and gates nothing: pass, exitCode and failureClass keep their treatment-only meaning",
+      "attribution unmeasured means the comparison was impossible; not-attempted means it was never run. Neither is no-change",
+      "the baseline judge scores the baseline transcript alone; the treatment judge prompt is unchanged from version 1 bundles",
+      "comparison reads both judges' raw output under strict rules (boolean pass, integer in-range index, no contradictory duplicate); refused evidence stays unmeasured and never becomes a verdict",
+      "the rubric bullets above keep the legacy parser's forgiving coercions: tightening comparison eligibility does not move the pass/exitCode gate",
+      "the treatment arm runs against a private per-run copy of the skill directory, so an edit to the source during the arm cannot reach the child; subject.pinnable is false when the body carries package references, which resolve above the skill directory and cannot be snapshotted faithfully",
+      "that copy is an isolated snapshot, not an immutable pin: it lives in a writable temp directory and the arm runs at full-auto, so a model that edited the copy, read it and restored it would not be detected. These are results about a cooperative model, the same caveat the arm workspaces already carry",
+      "subjectVerification is verified only when the snapshot held (tree digest equal before and after the arm) AND the treatment arm reported a successful activation whose sha256 equals subject.sha256 and whose file is the snapshot's own SKILL.md by canonical path. not-activated, activation-mismatch, not-pinned, mismatch and unreadable each name what was not established",
+      "a scenario whose subjectVerification is not verified keeps its rubric result and records its comparison unmeasured",
+      "treeSha256 covers regular files and in-tree symlink targets; a symlink leaving the directory makes the tree unverifiable rather than partially hashed",
+      "both judges are checked for the headless permission wall before their verdicts are eligible for comparison; the legacy rubric result is unaffected either way",
+      "subject.drift records whether the measured content still matches its recorded hash; a mismatch never blocks the run",
+      "subject hashes cover SKILL.md (sha256, normalizedHash) and the whole skill directory (treeSha256); neither covers resources the skill reads from outside its own directory",
       "this sidecar is additive and is registered in overview.json files[]"
     ],
     scenarios: outcomes.map((outcome) => ({
@@ -958,12 +1354,28 @@ function sidecar(skillName, evalId, outcomes, allowNetwork) {
       infraError: outcome.infraError,
       usage: outcome.usage,
       bullets: outcome.bullets,
+      subjectVerification: outcome.subjectVerification,
+      observedTreeSha256: outcome.observedTreeSha256,
+      attribution: outcome.attribution,
       baseline: sidecarRun(outcome.baseline),
       treatment: sidecarRun(outcome.treatment),
-      judge: sidecarRun(outcome.judge)
+      judge: sidecarRun(outcome.judge),
+      baselineJudge: sidecarRun(outcome.baselineJudge)
     }))
   };
 }
+function attributionSummary(outcomes) {
+  const summary = {
+    helped: 0,
+    regressed: 0,
+    mixed: 0,
+    "no-change": 0,
+    unmeasured: 0,
+    "not-attempted": 0
+  };
+  for (const outcome of outcomes) summary[outcome.attribution.verdict] += 1;
+  return summary;
+}
 function sidecarRun(run) {
   if (run === null) return null;
   return {
@@ -975,11 +1387,19 @@ function sidecarRun(run) {
     stderrTail: run.stderr.slice(-500)
   };
 }
-function printHumanReport(skillName, outcomes, evalId, evidenceId, evidenceDirectory, allowNetwork) {
-  const rows = [["scenario", "bullet", "verdict", "expected"]];
+function printHumanReport(subject, outcomes, evalId, evidenceId, evidenceDirectory, allowNetwork) {
+  const skillName = subject.name;
+  const rows = [["scenario", "bullet", "verdict", "vs base", "expected"]];
   for (const outcome of outcomes) {
+    const attributed = new Map(outcome.attribution.bullets.map((item) => [item.index, item]));
     for (const bullet of outcome.bullets) {
-      rows.push([outcome.scenario.id, String(bullet.index), bullet.verdict, truncate(bullet.text, 76)]);
+      rows.push([
+        outcome.scenario.id,
+        String(bullet.index),
+        bullet.verdict,
+        attributed.get(bullet.index)?.attribution ?? "-",
+        truncate(bullet.text, 64)
+      ]);
     }
   }
   process.stdout.write(formatColumns(rows));
@@ -1017,8 +1437,27 @@ ${skillName}: ${passed}/${total} bullets passed${unmeasuredNote} (judge-scored,
       );
     }
   }
+  printAttributionReport(outcomes);
   process.stdout.write(`${describeArmPolicyOutcome(allowNetwork)}
 `);
+  process.stdout.write(
+    `subject: ${skillName} from ${subject.origin} at ${subject.baseDir} (sha256 ${subject.normalizedHash.slice(0, 12)}\u2026)
+`
+  );
+  if (subject.drift !== null) {
+    process.stdout.write(
+      subject.drift.verdict === "mismatch" ? `subject drift: MISMATCH against the ${subject.drift.authority} (expected ${subject.drift.expected.slice(0, 12)}\u2026); this run measured the copy on disk
+` : `subject drift: matches the ${subject.drift.authority}
+`
+    );
+  }
+  const unverified = outcomes.filter((outcome) => outcome.subjectVerification !== "verified");
+  if (unverified.length > 0) {
+    process.stdout.write(
+      `subject verification: ${unverified.map((o) => `${o.scenario.id}=${o.subjectVerification}`).join(", ")}; those scenarios kept their rubric result and recorded no baseline comparison
+`
+    );
+  }
   process.stdout.write(`eval artifact: ${evalId}
 `);
   if (evidenceId !== null && evidenceDirectory !== null) {
@@ -1026,6 +1465,45 @@ ${skillName}: ${passed}/${total} bullets passed${unmeasuredNote} (judge-scored,
 `);
   }
 }
+function printAttributionReport(outcomes) {
+  if (outcomes.length === 0) return;
+  const summary = attributionSummary(outcomes);
+  const compared = summary.helped + summary.regressed + summary.mixed + summary["no-change"];
+  if (compared === 0) {
+    const reason = outcomes.find((outcome) => outcome.attribution.reason !== null)?.attribution.reason ?? null;
+    process.stdout.write(
+      `attribution: no scenario was compared against its baseline${reason !== null ? ` (${reason})` : ""}
+`
+    );
+    return;
+  }
+  const parts = [
+    `${summary.helped} helped`,
+    `${summary.regressed} regressed`,
+    `${summary.mixed} mixed`,
+    `${summary["no-change"]} no-change`
+  ];
+  if (summary.unmeasured > 0) parts.push(`${summary.unmeasured} unmeasured`);
+  if (summary["not-attempted"] > 0) parts.push(`${summary["not-attempted"]} not-attempted`);
+  process.stdout.write(
+    `attribution (advisory, vs the no-skill baseline; gates nothing): ${parts.join(", ")} of ${outcomes.length} scenario${outcomes.length === 1 ? "" : "s"}
+`
+  );
+  for (const outcome of outcomes) {
+    if (outcome.attribution.verdict === "regressed" || outcome.attribution.verdict === "mixed") {
+      const regressed = outcome.attribution.bullets.filter((bullet) => bullet.attribution === "regressed").map((bullet) => String(bullet.index));
+      process.stdout.write(
+        `${outcome.scenario.id}: ${outcome.attribution.verdict}; the baseline passed bullet${regressed.length === 1 ? "" : "s"} ${regressed.join(", ")} and the treatment did not
+`
+      );
+    } else if (outcome.attribution.reason !== null) {
+      process.stdout.write(
+        `${outcome.scenario.id}: attribution ${outcome.attribution.verdict}: ${outcome.attribution.reason}
+`
+      );
+    }
+  }
+}
 function preview(value) {
   if (value === void 0) return "";
   const text = typeof value === "string" ? value : safeStringify(value);
@@ -1058,7 +1536,7 @@ function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 async function runSkillEvalCli(args) {
-  const options = { json: false, trustFixtures: false, allowNetwork: false };
+  const options = { json: false, trustFixtures: false, allowNetwork: false, noAttribution: false };
   let source;
   try {
     for (let i = 0; i < args.length; i++) {
@@ -1067,6 +1545,7 @@ async function runSkillEvalCli(args) {
       if (arg === "--json") options.json = true;
       else if (arg === "--trust-fixtures") options.trustFixtures = true;
       else if (arg === "--allow-network") options.allowNetwork = true;
+      else if (arg === "--no-attribution") options.noAttribution = true;
       else if (["--scenario", "--target", "--workspace", "--timeout"].includes(arg)) {
         const value = args[++i];
         if (!value || value.startsWith("-")) throw new Error(`${arg} requires a value`);
@@ -1079,7 +1558,7 @@ async function runSkillEvalCli(args) {
         else options.workspace = value;
       } else if (arg === "--help" || arg === "-h") {
         process.stdout.write(
-          "clio-coder eval skill <name|path> [--scenario <id>] [--target <id>] [--workspace <path>] [--timeout <seconds>] [--trust-fixtures] [--allow-network] [--json]\n"
+          "clio-coder eval skill <name|path> [--scenario <id>] [--target <id>] [--workspace <path>] [--timeout <seconds>] [--trust-fixtures] [--allow-network] [--no-attribution] [--json]\n  --no-attribution  skip the baseline judge and the paired comparison; saves one judge run per scenario\n"
         );
         return 0;
       } else if (arg.startsWith("-") || source) throw new Error(`unexpected skill eval argument: ${arg}`);
@@ -1093,7 +1572,18 @@ async function runSkillEvalCli(args) {
   }
 }
 export {
+  artifactIsPinnable,
+  attributionFromStrict,
+  deriveBulletAttribution,
+  deriveScenarioAttributionVerdict,
   evalChildEnv,
-  runSkillEvalCli
+  parseRunStdout,
+  runScenario,
+  runSkillEvalCli,
+  sidecar,
+  skillTreeDigest,
+  strictJudgeVerdicts,
+  verifyObservedActivation,
+  verifySubjectTree
 };
-//# sourceMappingURL=skills-eval-CQ23MYQK.js.map
+//# sourceMappingURL=skills-eval-AIBR2L7H.js.map