@jinn-network/core 0.1.0-canary.3afae198

package/dist/scrub/data/gitleaks-rules.d.ts

@@ -0,0 +1,56 @@
+/** Vendored gitleaks MIT rule subset — see pin.note (Q6). */
+export declare const GITLEAKS_PACK: {
+    readonly pin: {
+        readonly source: "https://github.com/gitleaks/gitleaks";
+        readonly ref: "v8.28.0";
+        readonly date: "2026-07-22";
+        readonly license: "MIT";
+        readonly note: "Q6: pin-and-manually-refresh subset; no build-time sync. Regexes adapted to JS (no Go (?i)/(?-i:) verbs).";
+    };
+    readonly rules: readonly [{
+        readonly id: "github-pat";
+        readonly description: "GitHub Personal Access Token (classic).";
+        readonly regex: "\\bghp_[0-9a-zA-Z]{36}\\b";
+    }, {
+        readonly id: "github-fine-grained-pat";
+        readonly description: "GitHub Fine-Grained Personal Access Token.";
+        readonly regex: "\\bgithub_pat_[0-9a-zA-Z_]{82}\\b";
+    }, {
+        readonly id: "slack-bot-token";
+        readonly description: "Slack Bot token.";
+        readonly regex: "\\bxoxb-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9-]*";
+    }, {
+        readonly id: "npm-access-token";
+        readonly description: "npm access token.";
+        readonly regex: "\\bnpm_[A-Za-z0-9]{36}\\b";
+    }, {
+        readonly id: "stripe-access-token";
+        readonly description: "Stripe secret/restricted key.";
+        readonly regex: "\\b(?:sk|rk)_(?:test|live|prod)_[A-Za-z0-9]{10,99}\\b";
+    }, {
+        readonly id: "openai-api-key";
+        readonly description: "OpenAI API key (legacy sk-…T3BlbkFJ… shape).";
+        readonly regex: "\\bsk-[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20}\\b";
+    }, {
+        readonly id: "anthropic-api-key";
+        readonly description: "Anthropic API key.";
+        readonly regex: "\\bsk-ant-api03-[A-Za-z0-9_-]{93}AA\\b";
+    }, {
+        readonly id: "aws-access-token";
+        readonly description: "AWS access key id.";
+        readonly regex: "\\b(?:A3T[A-Z0-9]|AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16}\\b";
+    }, {
+        readonly id: "pypi-upload-token";
+        readonly description: "PyPI upload token.";
+        readonly regex: "\\bpypi-AgEIcHlwaS5vcmc[\\w-]{50,1000}";
+    }, {
+        readonly id: "hashicorp-tf-api-token";
+        readonly description: "HashiCorp Terraform API token (…atlasv1…).";
+        readonly regex: "\\b[a-z0-9]{14}\\.atlasv1\\.[A-Za-z0-9\\-_=]{60,70}\\b";
+    }, {
+        readonly id: "private-key";
+        readonly description: "PEM private key block.";
+        readonly regex: "-----BEGIN[ A-Z0-9_-]{0,100}PRIVATE KEY(?: BLOCK)?-----[\\s\\S-]{64,}?-----END[ A-Z0-9_-]{0,100}PRIVATE KEY(?: BLOCK)?-----";
+    }];
+};
+export type GitleaksPack = typeof GITLEAKS_PACK;

package/dist/scrub/data/gitleaks-rules.js

@@ -0,0 +1,67 @@
+/** Vendored gitleaks MIT rule subset — see pin.note (Q6). */
+export const GITLEAKS_PACK = {
+    "pin": {
+        "source": "https://github.com/gitleaks/gitleaks",
+        "ref": "v8.28.0",
+        "date": "2026-07-22",
+        "license": "MIT",
+        "note": "Q6: pin-and-manually-refresh subset; no build-time sync. Regexes adapted to JS (no Go (?i)/(?-i:) verbs)."
+    },
+    "rules": [
+        {
+            "id": "github-pat",
+            "description": "GitHub Personal Access Token (classic).",
+            "regex": "\\bghp_[0-9a-zA-Z]{36}\\b"
+        },
+        {
+            "id": "github-fine-grained-pat",
+            "description": "GitHub Fine-Grained Personal Access Token.",
+            "regex": "\\bgithub_pat_[0-9a-zA-Z_]{82}\\b"
+        },
+        {
+            "id": "slack-bot-token",
+            "description": "Slack Bot token.",
+            "regex": "\\bxoxb-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9-]*"
+        },
+        {
+            "id": "npm-access-token",
+            "description": "npm access token.",
+            "regex": "\\bnpm_[A-Za-z0-9]{36}\\b"
+        },
+        {
+            "id": "stripe-access-token",
+            "description": "Stripe secret/restricted key.",
+            "regex": "\\b(?:sk|rk)_(?:test|live|prod)_[A-Za-z0-9]{10,99}\\b"
+        },
+        {
+            "id": "openai-api-key",
+            "description": "OpenAI API key (legacy sk-…T3BlbkFJ… shape).",
+            "regex": "\\bsk-[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20}\\b"
+        },
+        {
+            "id": "anthropic-api-key",
+            "description": "Anthropic API key.",
+            "regex": "\\bsk-ant-api03-[A-Za-z0-9_-]{93}AA\\b"
+        },
+        {
+            "id": "aws-access-token",
+            "description": "AWS access key id.",
+            "regex": "\\b(?:A3T[A-Z0-9]|AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16}\\b"
+        },
+        {
+            "id": "pypi-upload-token",
+            "description": "PyPI upload token.",
+            "regex": "\\bpypi-AgEIcHlwaS5vcmc[\\w-]{50,1000}"
+        },
+        {
+            "id": "hashicorp-tf-api-token",
+            "description": "HashiCorp Terraform API token (…atlasv1…).",
+            "regex": "\\b[a-z0-9]{14}\\.atlasv1\\.[A-Za-z0-9\\-_=]{60,70}\\b"
+        },
+        {
+            "id": "private-key",
+            "description": "PEM private key block.",
+            "regex": "-----BEGIN[ A-Z0-9_-]{0,100}PRIVATE KEY(?: BLOCK)?-----[\\s\\S-]{64,}?-----END[ A-Z0-9_-]{0,100}PRIVATE KEY(?: BLOCK)?-----"
+        }
+    ]
+};

package/dist/scrub/emit-scrub.d.ts

@@ -0,0 +1,52 @@
+import type { RedactionManifest, Span } from '../trajectory/schema.js';
+import type { ScrubPipeline } from './pipeline.js';
+/**
+ * Seller-side scrub applied at emit time, before a trajectory is signed and
+ * published. Runs every span's attributes (and each event's attributes) through
+ * the pipeline, rebuilds the prev-span hash chain over the scrubbed spans, and
+ * produces the redaction manifest (one entry per span listing the keys touched;
+ * `event.<key>` for event-attribute redactions). Populates additive provenance
+ * fields (#1974): `schemaVersion`, optional `policyHash`, `perClassCounts`.
+ */
+export declare function scrubSpansForEmit(spans: Span[], pipeline: ScrubPipeline, taskCid: string): Promise<{
+    spans: Span[];
+    redactionManifest: RedactionManifest;
+}>;
+/**
+ * Minimal structural shape of a capture span (jinn.capture-trajectory.v1): a
+ * flat attribute bag plus the keys already redacted at ingest. Captures have no
+ * events array and no in-run hash chain, so they cannot go through
+ * {@link scrubSpansForEmit}; this is their dedicated seller-side scrub.
+ */
+export interface ScrubbableCaptureSpan {
+    attributes: Record<string, unknown>;
+    redactedKeys: string[];
+}
+export interface ScrubCaptureSpansOptions {
+    /**
+     * Optional mutable tally bag. When provided, applied disposition counts from
+     * each span are merged in (#1974) so callers can attach `perClassCounts` to
+     * a capture redaction manifest.
+     */
+    perClassCounts?: Record<string, number>;
+}
+/**
+ * Seller-side scrub for capture spans, applied at publish time before the
+ * capture trajectory is uploaded. Runs each span's attributes through the
+ * pipeline, replacing them with the scrubbed values, and unions the pipeline's
+ * redactions into the span's existing `redactedKeys`. Unlike
+ * {@link scrubSpansForEmit} it does NOT touch events or inject a hash chain —
+ * capture spans carry neither. Generic over the span type so the concrete
+ * `SpanRow` (with its extra columns) is returned unchanged apart from
+ * `attributes` and `redactedKeys`.
+ */
+export declare function scrubCaptureSpans<T extends ScrubbableCaptureSpan>(spans: T[], pipeline: ScrubPipeline, opts?: ScrubCaptureSpansOptions): Promise<T[]>;
+/**
+ * Unions two redaction manifests by spanId (dedup redactedKeys per span). Used
+ * when an ingestion-time manifest (e.g. a capture's stored redactedKeys) is
+ * combined with the emit-time pipeline manifest. Keeps the
+ * `totalRedactions === sum(redactedKeys)` invariant the schema enforces.
+ * Provenance fields (#1974): prefer the higher `schemaVersion`, take the first
+ * defined `policyHash`, and sum `perClassCounts`.
+ */
+export declare function mergeRedactionManifests(a: RedactionManifest, b: RedactionManifest): RedactionManifest;

package/dist/scrub/emit-scrub.js

@@ -0,0 +1,122 @@
+import { computeGenesisHash, computePrevSpanHash, } from '../trajectory/hash-chain.js';
+import { mergePerClassCounts } from './provenance.js';
+/**
+ * Seller-side scrub applied at emit time, before a trajectory is signed and
+ * published. Runs every span's attributes (and each event's attributes) through
+ * the pipeline, rebuilds the prev-span hash chain over the scrubbed spans, and
+ * produces the redaction manifest (one entry per span listing the keys touched;
+ * `event.<key>` for event-attribute redactions). Populates additive provenance
+ * fields (#1974): `schemaVersion`, optional `policyHash`, `perClassCounts`.
+ */
+export async function scrubSpansForEmit(spans, pipeline, taskCid) {
+    const out = [];
+    const manifestSpans = [];
+    let total = 0;
+    let prev = computeGenesisHash(taskCid);
+    let perClassCounts = {};
+    for (const span of spans) {
+        const redactedKeys = new Set();
+        const attrResult = await pipeline.run(span.attributes ?? {});
+        for (const r of attrResult.redactions)
+            redactedKeys.add(r.key);
+        perClassCounts =
+            mergePerClassCounts(perClassCounts, attrResult.perClassCounts) ?? perClassCounts;
+        const events = [];
+        for (const event of span.events) {
+            if (event.attributes && Object.keys(event.attributes).length > 0) {
+                const evResult = await pipeline.run(event.attributes);
+                events.push({ ...event, attributes: evResult.attributes });
+                for (const r of evResult.redactions)
+                    redactedKeys.add(`event.${r.key}`);
+                perClassCounts =
+                    mergePerClassCounts(perClassCounts, evResult.perClassCounts) ?? perClassCounts;
+            }
+            else {
+                events.push(event);
+            }
+        }
+        const scrubbed = {
+            ...span,
+            attributes: { ...attrResult.attributes, 'jinn.prevSpanHash': prev },
+            events,
+        };
+        out.push(scrubbed);
+        prev = computePrevSpanHash(scrubbed);
+        if (redactedKeys.size > 0) {
+            const keys = [...redactedKeys];
+            manifestSpans.push({ spanId: span.spanId, redactedKeys: keys });
+            total += keys.length;
+        }
+    }
+    return {
+        spans: out,
+        redactionManifest: {
+            spans: manifestSpans,
+            totalRedactions: total,
+            ...pipeline.manifestProvenance(perClassCounts),
+        },
+    };
+}
+/**
+ * Seller-side scrub for capture spans, applied at publish time before the
+ * capture trajectory is uploaded. Runs each span's attributes through the
+ * pipeline, replacing them with the scrubbed values, and unions the pipeline's
+ * redactions into the span's existing `redactedKeys`. Unlike
+ * {@link scrubSpansForEmit} it does NOT touch events or inject a hash chain —
+ * capture spans carry neither. Generic over the span type so the concrete
+ * `SpanRow` (with its extra columns) is returned unchanged apart from
+ * `attributes` and `redactedKeys`.
+ */
+export async function scrubCaptureSpans(spans, pipeline, opts = {}) {
+    const out = [];
+    for (const span of spans) {
+        const result = await pipeline.run(span.attributes ?? {});
+        const redactedKeys = new Set(span.redactedKeys);
+        for (const r of result.redactions)
+            redactedKeys.add(r.key);
+        if (opts.perClassCounts && result.perClassCounts) {
+            const merged = mergePerClassCounts(opts.perClassCounts, result.perClassCounts);
+            if (merged) {
+                for (const key of Object.keys(opts.perClassCounts))
+                    delete opts.perClassCounts[key];
+                Object.assign(opts.perClassCounts, merged);
+            }
+        }
+        out.push({ ...span, attributes: result.attributes, redactedKeys: [...redactedKeys] });
+    }
+    return out;
+}
+/**
+ * Unions two redaction manifests by spanId (dedup redactedKeys per span). Used
+ * when an ingestion-time manifest (e.g. a capture's stored redactedKeys) is
+ * combined with the emit-time pipeline manifest. Keeps the
+ * `totalRedactions === sum(redactedKeys)` invariant the schema enforces.
+ * Provenance fields (#1974): prefer the higher `schemaVersion`, take the first
+ * defined `policyHash`, and sum `perClassCounts`.
+ */
+export function mergeRedactionManifests(a, b) {
+    const bySpan = new Map();
+    for (const m of [a, b]) {
+        for (const s of m.spans) {
+            const set = bySpan.get(s.spanId) ?? new Set();
+            for (const k of s.redactedKeys)
+                set.add(k);
+            bySpan.set(s.spanId, set);
+        }
+    }
+    const spans = [...bySpan]
+        .map(([spanId, keys]) => ({ spanId, redactedKeys: [...keys] }))
+        .filter((s) => s.redactedKeys.length > 0);
+    const perClassCounts = mergePerClassCounts(a.perClassCounts, b.perClassCounts);
+    const schemaVersion = a.schemaVersion !== undefined || b.schemaVersion !== undefined
+        ? Math.max(a.schemaVersion ?? 0, b.schemaVersion ?? 0)
+        : undefined;
+    const policyHash = a.policyHash ?? b.policyHash;
+    return {
+        spans,
+        totalRedactions: spans.reduce((n, s) => n + s.redactedKeys.length, 0),
+        ...(schemaVersion !== undefined ? { schemaVersion } : {}),
+        ...(policyHash !== undefined ? { policyHash } : {}),
+        ...(perClassCounts !== undefined ? { perClassCounts } : {}),
+    };
+}

package/dist/scrub/eval/findings-from-scrub.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Map current-pipeline redactions + before/after text into approximate span
+ * findings for the M0 baseline harness. Prefer exact original-span absence:
+ * if a labeled substring is gone from the scrubbed output, emit a finding
+ * covering that label. Extra stubs in output that do not match any label
+ * become FP via orphan stub detection.
+ */
+import type { EvalFixture, ScoredFinding, ScrubClass } from './types.js';
+/** Map known redaction `detail` / stage hints → ScrubClass. */
+export declare function classFromRedactionDetail(detail: string | undefined, stage: string): ScrubClass | undefined;
+/**
+ * Derive predicted findings for a fixture from original text, scrubbed text,
+ * and redaction records. Uses label-survival for TP/FN and stub orphans for FP.
+ */
+export declare function findingsFromScrubResult(fixture: EvalFixture, scrubbedText: string, redactions: Array<{
+    stage: string;
+    detail?: string;
+}>): ScoredFinding[];

package/dist/scrub/eval/findings-from-scrub.js

@@ -0,0 +1,99 @@
+/**
+ * Map current-pipeline redactions + before/after text into approximate span
+ * findings for the M0 baseline harness. Prefer exact original-span absence:
+ * if a labeled substring is gone from the scrubbed output, emit a finding
+ * covering that label. Extra stubs in output that do not match any label
+ * become FP via orphan stub detection.
+ */
+/** Map known redaction `detail` / stage hints → ScrubClass. */
+export function classFromRedactionDetail(detail, stage) {
+    if (!detail) {
+        if (stage === 'key-policy')
+            return 'A5';
+        return undefined;
+    }
+    const d = detail.toLowerCase();
+    // B2 before generic "name"/"email" — git-identity evidence is carrier-shaped.
+    if (d.includes('git-identity') || d === 'trailer-name' || d === 'user-name' || d === 'user-email') {
+        return 'B2';
+    }
+    if (d.includes('email'))
+        return 'B1';
+    if (d.includes('home-path') || d.includes('home_path'))
+        return 'D1';
+    if (d.includes('eth-address') || d.includes('ethereum') || d.includes('eth_addr'))
+        return 'C1';
+    if (d.includes('aws') || d.includes('gcp') || d.includes('github') || d.includes('slack') || d.includes('npm') || d.includes('jwt') || d.includes('ssh') || d.includes('secret') || d.includes('token')) {
+        return 'A1';
+    }
+    if (d.includes('high-entropy') || d.includes('entropy'))
+        return 'A2';
+    if (d.includes('person') || d.includes('per') || d.includes('name'))
+        return 'B3';
+    if (d.includes('phone'))
+        return 'B5';
+    if (d.includes('iban') || d.includes('credit') || d.includes('ssn') || d.includes('card') || d.includes('luhn'))
+        return 'B7';
+    if (d.includes('ipv4') || d === 'ip' || d.startsWith('ip-') || d.includes('loopback') || d.includes('reserved')) {
+        return 'D2';
+    }
+    if (d.includes('hostname') ||
+        d.includes('known-identity:hostname') ||
+        d.includes('machine-identity') ||
+        d.includes('host')) {
+        return 'D3';
+    }
+    if (d.includes('username') || d.includes('gh-login') || d.includes('home-username'))
+        return 'B4';
+    if (d.includes('git-user-name') || d.includes('known-identity:git-user-name'))
+        return 'B3';
+    if (d.includes('url-') || d.includes('userinfo') || d.includes('query-credential'))
+        return 'A3';
+    if (d.includes('private-key') || d.includes('bip39') || d.includes('mnemonic'))
+        return 'A4';
+    if (d.includes('env-block'))
+        return 'A5';
+    if (d.includes('gitleaks'))
+        return 'A1';
+    if (detail === 'EMAIL' || detail.includes('EMAIL'))
+        return 'B1';
+    if (detail.includes('ETHEREUM') || detail.includes('ETH'))
+        return 'C1';
+    if (detail.includes('PATH') || detail.includes('USERNAME'))
+        return 'D1';
+    return 'E1';
+}
+/**
+ * Derive predicted findings for a fixture from original text, scrubbed text,
+ * and redaction records. Uses label-survival for TP/FN and stub orphans for FP.
+ */
+export function findingsFromScrubResult(fixture, scrubbedText, redactions) {
+    const findings = [];
+    const claimed = new Set();
+    for (let i = 0; i < fixture.labels.length; i += 1) {
+        const label = fixture.labels[i];
+        const original = fixture.text.slice(label.start, label.end);
+        if (!original)
+            continue;
+        // Survived → miss (no finding). Gone or replaced → predicted hit at label span.
+        if (!scrubbedText.includes(original)) {
+            findings.push({ class: label.class, start: label.start, end: label.end });
+            claimed.add(i);
+        }
+    }
+    // Orphan redactions (more redaction records than claimed labels of matching class)
+    // approximate FPs when scrubbed diverges without a matching label.
+    if (scrubbedText !== fixture.text) {
+        const labeledClasses = new Set(fixture.labels.map((l) => l.class));
+        for (const r of redactions) {
+            const cls = classFromRedactionDetail(r.detail, r.stage);
+            if (!cls)
+                continue;
+            if (!labeledClasses.has(cls)) {
+                // Synthetic FP span at 0..0+1 so scoreClass counts it
+                findings.push({ class: cls, start: 0, end: Math.min(1, fixture.text.length || 1) });
+            }
+        }
+    }
+    return findings;
+}

package/dist/scrub/eval/fixtures.d.ts

@@ -0,0 +1,14 @@
+import type { EvalFixture } from './types.js';
+/**
+ * Public synthetic fixtures for CI (#1968 / #1972). No real PII — template shapes only.
+ * Targets mirror design §3.2; baseline may miss some classes until later PRs.
+ */
+export declare function syntheticFixtures(): EvalFixture[];
+/**
+ * Corruption corpus: known-clean prose that must stay byte-identical.
+ * Includes #1784 residual samples that seed profile intentionally leaves alone,
+ * plus a short excerpt shape from distractor-operator-claims (no secrets).
+ * Checksummed cards/IBANs are labeled fixtures (B7), not corruption samples.
+ */
+export declare function corruptionFixtures(): EvalFixture[];
+export declare function allCiFixtures(): EvalFixture[];

package/dist/scrub/eval/fixtures.js

@@ -0,0 +1,159 @@
+/** Helper: build a fixture with a single labeled span covering `needle` in `text`. */
+function labeled(id, text, needle, cls, opts = {}) {
+    const start = text.indexOf(needle);
+    if (start < 0)
+        throw new Error(`needle not found in fixture ${id}`);
+    return {
+        id,
+        text,
+        labels: [{ class: cls, start, end: start + needle.length }],
+        profile: opts.profile ?? 'seed',
+        ...opts,
+    };
+}
+/** Synthetic BIP-39 12-word run (wordlist words; not a funded wallet). */
+const SYNTH_MNEMONIC = 'abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about';
+/** Synthetic 64-hex private-key material (not a real key). */
+const SYNTH_PRIVKEY = 'a'.repeat(64);
+/**
+ * Public synthetic fixtures for CI (#1968 / #1972). No real PII — template shapes only.
+ * Targets mirror design §3.2; baseline may miss some classes until later PRs.
+ */
+export function syntheticFixtures() {
+    return [
+        labeled('B1-email', 'Contact the operator at alice.operator@example.com for access.', 'alice.operator@example.com', 'B1'),
+        labeled('D1-home-path', 'Working directory was /Users/synthuser/jinn-mono/client.', '/Users/synthuser', 'D1'),
+        labeled('C1-wallet', 'Router lives at 0x1111222233334444555566667777888899990000 on Base.', '0x1111222233334444555566667777888899990000', 'C1', { profile: 'seed' }),
+        labeled('A1-github-pat-shape', 'Export GITHUB_TOKEN=ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcd before running.', 'ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcd', 'A1', { profile: 'seed' }),
+        labeled('A1-aws-key-id', 'Using key AKIAIOSFODNN7EXAMPLE in the dry-run.', 'AKIAIOSFODNN7EXAMPLE', 'A1', { profile: 'seed' }),
+        labeled('A3-url-userinfo', 'Fetch https://user:s3cr3t@localhost/v2/manifests/latest then continue.', 'user:s3cr3t@', 'A3'),
+        labeled('A3-url-token-query', 'Webhook https://hooks.example/push?token=tok_synth_example_value_001&x=1 fired.', 'tok_synth_example_value_001', 'A3'),
+        labeled('A4-private-key-hex', `Loaded private key ${SYNTH_PRIVKEY} into the signer.`, SYNTH_PRIVKEY, 'A4'),
+        labeled('A4-bip39-mnemonic', `Recovery phrase: ${SYNTH_MNEMONIC}`, SYNTH_MNEMONIC, 'A4'),
+        labeled('A5-env-block', 'Tool dumped env:\nAPI_KEY=synth\nDATABASE_URL=postgres://x\nSECRET_TOKEN=yyy\nDone.', 'API_KEY=synth\nDATABASE_URL=postgres://x\nSECRET_TOKEN=yyy', 'A5'),
+        labeled('B7-card-luhn', 'Customer card: 4111111111111111.', '4111111111111111', 'B7'),
+        labeled('B7-iban-mod97', 'Wire to IBAN GB82WEST12345698765432 only.', 'GB82WEST12345698765432', 'B7'),
+        labeled('D2-public-ip', 'Peer connected from 8.8.8.8 during the probe.', '8.8.8.8', 'D2'),
+        // Hazard: bare UUID must NOT be treated as a secret (batch-2 FP class).
+        {
+            id: 'hazard-uuid-not-secret',
+            text: 'Task id a33f2ca5-e325-4749-b2b5-adaab30c5fc6 completed.',
+            labels: [],
+            profile: 'seed',
+            mustSurvive: true,
+        },
+        // Hazard: bare 40-hex git SHA must survive (no 0x).
+        {
+            id: 'hazard-git-sha-survive',
+            text: 'Pinned commit deadbeefdeadbeefdeadbeefdeadbeefdeadbeef in the lockfile.',
+            labels: [],
+            profile: 'seed',
+            mustSurvive: true,
+        },
+        // Hazard: tx hash 0x+64 must survive C1 (C2 is flag-only later).
+        {
+            id: 'hazard-tx-hash-survive',
+            text: 'Receipt 0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa confirmed.',
+            labels: [],
+            profile: 'seed',
+            mustSurvive: true,
+        },
+        // Hazard: env-var *reference* must not trip a token-name denylist.
+        {
+            id: 'hazard-env-ref-survive',
+            text: 'curl -H "Authorization: Bearer $GH_TOKEN" https://api.github.com/user',
+            labels: [],
+            profile: 'seed',
+            mustSurvive: true,
+        },
+        // Hazard: GIT_CONFIG tutorial blocks are env-shaped but not secret dumps (#2005).
+        {
+            id: 'hazard-git-config-tutorial-survive',
+            text: [
+                'export GIT_CONFIG_GLOBAL=/dev/null',
+                'export GIT_CONFIG_SYSTEM=/dev/null',
+                'export GIT_CONFIG_NOSYSTEM=1',
+                'export GIT_CONFIG_COUNT=2',
+                'export GIT_CONFIG_KEY_0=credential.helper',
+                'export GIT_CONFIG_VALUE_0=',
+                'export GIT_CONFIG_KEY_1=core.askPass',
+                'export GIT_CONFIG_VALUE_1=/attempt/askpass',
+            ].join('\n'),
+            labels: [],
+            profile: 'seed',
+            mustSurvive: true,
+        },
+        // Hazard: loopback IP must survive (illustrative config knowledge).
+        {
+            id: 'hazard-loopback-ip-survive',
+            text: 'Listen on 127.0.0.1:7331 for the local dashboard.',
+            labels: [],
+            profile: 'seed',
+            mustSurvive: true,
+        },
+        // B2 carrier — git-identity detector (#1970) jointly covers the name;
+        // email on the same line remains B1 via plain-patterns.
+        labeled('B2-git-author', 'Author: Synth Operator <synth.operator@example.com>', 'Synth Operator', 'B2', { profile: 'seed' }),
+        // B4 self-handle — requires known-identity pack (#1971).
+        {
+            id: 'B4-self-handle',
+            text: 'Operator login synth_operator_handle pushed the branch.',
+            labels: [
+                {
+                    class: 'B4',
+                    start: 'Operator login '.length,
+                    end: 'Operator login synth_operator_handle'.length,
+                },
+            ],
+            profile: 'seed',
+            identityPack: { ghLogin: 'synth_operator_handle' },
+        },
+        // D3 self-hostname — requires known-identity pack (#1971).
+        {
+            id: 'D3-self-hostname',
+            text: 'attempt host=synth-laptop-01 completed.',
+            labels: [
+                {
+                    class: 'D3',
+                    start: 'attempt host='.length,
+                    end: 'attempt host=synth-laptop-01'.length,
+                },
+            ],
+            profile: 'seed',
+            identityPack: { hostname: 'synth-laptop-01' },
+        },
+        // Allowlist: loopback IP must survive (D2 pass, #1971 Q1).
+        {
+            id: 'allowlist-loopback-survive',
+            text: 'Bind the health check to 127.0.0.1:7331 before serving.',
+            labels: [],
+            mustSurvive: true,
+            profile: 'seed',
+        },
+    ];
+}
+/**
+ * Corruption corpus: known-clean prose that must stay byte-identical.
+ * Includes #1784 residual samples that seed profile intentionally leaves alone,
+ * plus a short excerpt shape from distractor-operator-claims (no secrets).
+ * Checksummed cards/IBANs are labeled fixtures (B7), not corruption samples.
+ */
+export function corruptionFixtures() {
+    const residuals = [
+        'Call the customer at +1 (415) 555-2671.',
+        'Reporter SSN on file: 123-45-6789.',
+        'Medical record MRN: MED123456.',
+        'The operator claims the flake is environmental, not a product defect.',
+        'Catalog number SKU-7781 maps to the distractor fixture.',
+    ];
+    return residuals.map((text, i) => ({
+        id: `corruption-${i}`,
+        text,
+        labels: [],
+        mustSurvive: true,
+        profile: 'seed',
+    }));
+}
+export function allCiFixtures() {
+    return [...syntheticFixtures(), ...corruptionFixtures()];
+}

package/dist/scrub/eval/index.d.ts

@@ -0,0 +1,6 @@
+export * from './types.js';
+export * from './metrics.js';
+export * from './findings-from-scrub.js';
+export * from './run-bench.js';
+export * from './fixtures.js';
+export * from './local-corpus.js';

package/dist/scrub/eval/index.js

@@ -0,0 +1,6 @@
+export * from './types.js';
+export * from './metrics.js';
+export * from './findings-from-scrub.js';
+export * from './run-bench.js';
+export * from './fixtures.js';
+export * from './local-corpus.js';

package/dist/scrub/eval/local-corpus.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Operator-local labeled corpus loader (#1968).
+ *
+ * Reads a JSONL file of EvalFixture objects from an operator-local path
+ * (default `~/.jinn-client/local-corpus/scrub-eval.jsonl`). Never ships
+ * fixture text in the metrics artifact — only counts.
+ *
+ * The mining-batch{1,2}-pii-inventory.md files are human analysis (counts +
+ * redacted examples). Operators derive synthetic/local JSONL labels from them;
+ * this loader does not parse the markdown inventories (they intentionally
+ * omit raw spans).
+ */
+import type { EvalFixture } from './types.js';
+export declare const DEFAULT_LOCAL_CORPUS_PATH: string;
+export declare function loadLocalCorpus(path?: string): EvalFixture[];

package/dist/scrub/eval/local-corpus.js

@@ -0,0 +1,29 @@
+/**
+ * Operator-local labeled corpus loader (#1968).
+ *
+ * Reads a JSONL file of EvalFixture objects from an operator-local path
+ * (default `~/.jinn-client/local-corpus/scrub-eval.jsonl`). Never ships
+ * fixture text in the metrics artifact — only counts.
+ *
+ * The mining-batch{1,2}-pii-inventory.md files are human analysis (counts +
+ * redacted examples). Operators derive synthetic/local JSONL labels from them;
+ * this loader does not parse the markdown inventories (they intentionally
+ * omit raw spans).
+ */
+import { readFileSync, existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+export const DEFAULT_LOCAL_CORPUS_PATH = join(homedir(), '.jinn-client', 'local-corpus', 'scrub-eval.jsonl');
+export function loadLocalCorpus(path = DEFAULT_LOCAL_CORPUS_PATH) {
+    if (!existsSync(path))
+        return [];
+    const raw = readFileSync(path, 'utf8');
+    const fixtures = [];
+    for (const line of raw.split('\n')) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#'))
+            continue;
+        fixtures.push(JSON.parse(trimmed));
+    }
+    return fixtures;
+}