@jinn-network/jinn-layer 0.1.0

package/dist/distill.js

@@ -0,0 +1,337 @@
+/**
+ * The distillation step — evidence clusters → layer-2 skills
+ * (spec/2026-07-06-distillation-v1.md §7, D4/D10).
+ *
+ * Scripted, single-shot, flat (recursion/hierarchy are v3). Three modes keyed to
+ * the cluster's tier (§7): pattern → strategic-pattern skill; lesson →
+ * failure-lesson skill (diagnosis, not prescription); contrastive → one skill
+ * from both polarities of an instance. Each skill is:
+ *   1. distilled by an injected LLM port (`deps.distill`) using
+ *      `jinn-skill-distill-prompt-v1` (the port owns the model call);
+ *   2. **secret-scrubbed fail-closed** — the body is run through the layer-2
+ *      pipeline; if the scrub would change anything (a secret was present), the
+ *      skill is DROPPED, not published (so published bodies are provably clean
+ *      AND never re-defaced, §7 step 4 / §10);
+ *   3. **contamination-scanned** against the held-out slate (§12 axis 3) — a
+ *      body naming a slate instance/repo/PR is dropped;
+ *   4. **structurally gated** (§7 step 6, v0.5) — the fixed skeleton (five
+ *      non-empty sections), the description anti-trigger ("Not for:"), and (for
+ *      lessons) the imperative-counterfactual guard, all DETERMINISTIC (a deep
+ *      quality judge is deferred admission-checking, §13);
+ *   5. published via `publishSkill()` with provenance back-links, the prompt
+ *      SHA, and the auditability fields (distill model + token estimates, §5).
+ *
+ * Clustering is upstream (human-curated for v1, §7) — this consumes pre-formed
+ * clusters of eligible evidence.
+ */
+import { buildLayer2ScrubPipeline, } from '@jinn-network/core/scrub';
+import { assertConformantName, } from './skill-package.js';
+import { JINN_SKILL_DISTILL_PROMPT_V1_SHA256, JINN_SKILL_META_DISTILL_PROMPT_V1_SHA256 } from './distill-prompt.js';
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * Derive held-out slate tokens from SWE-bench `instance_id`s (`owner__repo-<pr#>`)
+ * and any explicit repos, split by match strategy:
+ *
+ * - **substrings** — delimiter-bearing tokens with a low false-positive rate
+ *   (the full `owner__repo-n` instance id, `owner/repo`, `#pr`). Matched by
+ *   plain `includes`.
+ * - **words** — bare identifiers (the repo name alone, e.g. `flask`, `go`,
+ *   `requests`) that recur inside ordinary prose. Matched on `\b`-word
+ *   boundaries so "we are **go**ing" / "handle **requests**" do NOT trip the
+ *   scan, while a body literally naming the held-out repo as a word does.
+ *
+ * Local to the distiller (cap-v0 will carry repos explicitly, retiring this)
+ * so the module does not couple to the bridge branch.
+ */
+function slateTokens(slate) {
+    const substrings = new Set();
+    const words = new Set();
+    for (const id of slate.instanceIds) {
+        substrings.add(id.toLowerCase()); // full instance id (carries `__` and `-`)
+        const m = /^(.+)__(.+)-(\d+)$/.exec(id);
+        if (m) {
+            substrings.add(`${m[1]}/${m[2]}`.toLowerCase()); // owner/repo (carries `/`)
+            substrings.add(`#${m[3]}`); // #pr (carries `#`)
+            words.add(m[2].toLowerCase()); // bare repo → word-boundary match
+        }
+    }
+    for (const repo of slate.repos ?? [])
+        words.add(repo.toLowerCase());
+    return { substrings: [...substrings], words: [...words] };
+}
+/**
+ * Scan a distilled body for held-out slate tokens (instance id / repo / PR#).
+ * Delimiter-bearing tokens match as substrings; bare repo names match only on
+ * word boundaries, so a common-word repo does not silently drop a clean skill.
+ */
+export function lexicalContaminationScan(body, slate) {
+    const lower = body.toLowerCase();
+    const { substrings, words } = slateTokens(slate);
+    const hits = [];
+    for (const t of substrings)
+        if (t && lower.includes(t))
+            hits.push(t);
+    for (const w of words) {
+        if (w && new RegExp(`\\b${escapeRegExp(w)}\\b`).test(lower))
+            hits.push(w);
+    }
+    return { contaminated: hits.length > 0, hits };
+}
+function sanitizeName(raw) {
+    return raw.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
+}
+/** The fixed distilled-skill skeleton (§5, v0.5): each section must be non-empty. */
+const REQUIRED_SECTIONS = ['When to use', 'Strategy', 'Steps', 'Pitfalls', 'Verify'];
+/**
+ * Extract the trimmed content under a `## <title>` heading (case-insensitive),
+ * up to the next `## ` heading or EOF. Returns null when the heading is absent.
+ * `### ` and deeper subheadings are content, not section boundaries.
+ */
+function sectionContent(md, title) {
+    let capturing = false;
+    const captured = [];
+    for (const line of md.split('\n')) {
+        const h = /^##\s+(.+?)\s*$/.exec(line);
+        if (h) {
+            if (capturing)
+                break; // next section heading ends this one
+            if (h[1].trim().toLowerCase() === title.toLowerCase())
+                capturing = true;
+            continue;
+        }
+        if (capturing)
+            captured.push(line);
+    }
+    return capturing ? captured.join('\n').trim() : null;
+}
+/**
+ * Lexical markers of an IMPERATIVE counterfactual in a failure-lesson body
+ * (spec §7 v0.5 verified-counterfactual rule). Deliberately SHALLOW — a deep
+ * semantic judge of lesson quality is admission-checking, deferred (§13). The
+ * evidence verifies THAT an attempt failed; a lesson states diagnosis, and
+ * stating a prescription ("do X instead") as fact overstates that evidence.
+ */
+const LESSON_IMPERATIVE_COUNTERFACTUAL = [
+    /\binstead[,:]?\s+(do|use|run|call|apply|prefer|switch|add|set|replace|write)\b/i,
+    /\bthe (correct|right)\s+\w+\s+is\b/i,
+];
+/**
+ * Deterministic structural conformance gate (spec §7 step 6, v0.5). Returns a
+ * rejection reason, or null when the output conforms:
+ *  - fixed skeleton: all five sections present and non-empty;
+ *  - description anti-trigger: a "Not for:" clause is present;
+ *  - (lesson tier only) no imperative counterfactual.
+ */
+function structuralRejection(out, tier) {
+    for (const title of REQUIRED_SECTIONS) {
+        const content = sectionContent(out.body, title);
+        if (content === null)
+            return `skeleton: missing section "## ${title}"`;
+        if (content.length === 0)
+            return `skeleton: empty section "## ${title}"`;
+    }
+    if (!/\bNot for\b/i.test(out.description)) {
+        return 'description missing "Not for:" anti-trigger clause';
+    }
+    if (tier === 'lesson' && LESSON_IMPERATIVE_COUNTERFACTUAL.some((re) => re.test(out.body))) {
+        return 'lesson counterfactual: unverified prescription (diagnosis only unless contrastive)';
+    }
+    return null;
+}
+/** Deterministic token estimate: ceil(utf8 bytes / 4) — the §5 compression metric. */
+function estimateTokens(s) {
+    return Math.ceil(new TextEncoder().encode(s).length / 4);
+}
+const SKILL_KIND_BY_TIER = {
+    pattern: 'strategic-pattern',
+    lesson: 'failure-lesson',
+    contrastive: 'contrastive',
+};
+/**
+ * The shared per-skill finish: fail-closed output scrub (2) → contamination scan
+ * (3) → structural gate (4) → name check → package build → publish (5). Returns a
+ * deterministic rejection reason, or the published package. `publishSkill`
+ * failures throw (the caller records them as errors). Called by BOTH
+ * `distillClusters` and `metaDistill` so stage-2 passes the identical gate.
+ */
+async function finalizeSkill(out, spec, deps) {
+    // (2) fail-closed output secret scrub.
+    const scrubbed = await deps.pipeline.run({ 'skill.md': out.body });
+    if (scrubbed.redactions.length > 0 || String(scrubbed.attributes['skill.md']) !== out.body) {
+        const hits = [...new Set(scrubbed.redactions.map((r) => `${r.stage}/${r.detail ?? r.kind}`))];
+        const detail = hits.length > 0 ? hits.join(', ') : 'body altered by scrub';
+        return { ok: false, reason: `secret-in-output (dropped, fail-closed): ${detail}` };
+    }
+    // (3) contamination scan against the held-out slate.
+    const scan = lexicalContaminationScan(out.body, deps.slate);
+    if (scan.contaminated)
+        return { ok: false, reason: `contamination: ${scan.hits.join(', ')}` };
+    // (4) deterministic structural conformance gate.
+    const structuralReason = structuralRejection(out, spec.tier);
+    if (structuralReason)
+        return { ok: false, reason: structuralReason };
+    const name = sanitizeName(out.name);
+    if (!name)
+        return { ok: false, reason: `non-conformant skill name from distiller: ${JSON.stringify(out.name)}` };
+    assertConformantName(name);
+    const pkg = {
+        name,
+        description: out.description,
+        license: null,
+        jinn: {
+            schema: 'jinn.skill.v1',
+            distribution: deps.distribution,
+            verifiabilityTier: deps.verifiabilityTier ?? 'evaluator-verified',
+            distilledFrom: spec.distinctInstances,
+            provenance: spec.evidenceRefs,
+            distillPromptSha256: spec.promptSha,
+            distilledAt: deps.now.toISOString(),
+            skillKind: spec.skillKind,
+            ...(deps.skillStatus ? { status: deps.skillStatus } : {}),
+            ...(deps.evidenceTier ? { evidenceTier: deps.evidenceTier } : {}),
+            ...(deps.sourceTools ? { sourceTools: deps.sourceTools } : {}),
+            ...(deps.targetTools ? { targetTools: deps.targetTools } : {}),
+            ...(deps.distillModel ? { distillModel: deps.distillModel } : {}),
+            evidenceTokens: estimateTokens(JSON.stringify(spec.input ?? '')),
+            skillTokens: estimateTokens(out.body),
+        },
+        body: out.body,
+    };
+    const pub = await deps.publishSkill(pkg);
+    return { ok: true, pkg, envelopeRef: pub.envelopeRef };
+}
+/** Resolve the lazy per-stage deps into the concrete {@link FinalizeDeps} both stages share. */
+function resolveFinalizeDeps(deps) {
+    return {
+        pipeline: deps.scrubPipeline ?? buildLayer2ScrubPipeline(),
+        distribution: deps.distribution ?? 'coding',
+        now: deps.now?.() ?? new Date(),
+        slate: deps.slate,
+        ...(deps.distillModel ? { distillModel: deps.distillModel } : {}),
+        ...(deps.verifiabilityTier ? { verifiabilityTier: deps.verifiabilityTier } : {}),
+        ...(deps.skillStatus ? { skillStatus: deps.skillStatus } : {}),
+        ...(deps.evidenceTier ? { evidenceTier: deps.evidenceTier } : {}),
+        ...(deps.sourceTools ? { sourceTools: deps.sourceTools } : {}),
+        ...(deps.targetTools ? { targetTools: deps.targetTools } : {}),
+        publishSkill: deps.publishSkill,
+    };
+}
+export async function distillClusters(clusters, deps) {
+    const finalizeDeps = resolveFinalizeDeps(deps);
+    const result = { published: [], rejected: [], errors: [] };
+    deps.onPlan?.(clusters.map((c, i) => ({
+        clusterId: c.clusterId,
+        index: i + 1,
+        captureCount: c.evidenceRefs.length,
+        refs: [...c.evidenceRefs],
+    })));
+    const total = clusters.length;
+    for (const [i, cluster] of clusters.entries()) {
+        const index = i + 1;
+        const base = { clusterId: cluster.clusterId, index, total };
+        deps.onCluster?.({ phase: 'start', ...base });
+        const startedAt = Date.now();
+        try {
+            const out = await deps.distill(cluster);
+            const skillKind = SKILL_KIND_BY_TIER[cluster.tier];
+            const fin = await finalizeSkill(out, {
+                tier: cluster.tier,
+                evidenceRefs: cluster.evidenceRefs,
+                distinctInstances: new Set(cluster.instanceIds).size,
+                input: cluster.input,
+                skillKind,
+                promptSha: JINN_SKILL_DISTILL_PROMPT_V1_SHA256,
+            }, finalizeDeps);
+            if (fin.ok) {
+                result.published.push({ clusterId: cluster.clusterId, skillKind, envelopeRef: fin.envelopeRef, pkg: fin.pkg });
+                deps.onCluster?.({ phase: 'end', ...base, outcome: 'published', skillName: fin.pkg.name, durationMs: Date.now() - startedAt });
+            }
+            else {
+                result.rejected.push({ clusterId: cluster.clusterId, reason: fin.reason });
+                deps.onCluster?.({ phase: 'end', ...base, outcome: 'rejected', reason: fin.reason, durationMs: Date.now() - startedAt });
+            }
+        }
+        catch (err) {
+            const error = err instanceof Error ? err.message : String(err);
+            result.errors.push({ clusterId: cluster.clusterId, error });
+            deps.onCluster?.({ phase: 'end', ...base, outcome: 'error', error, durationMs: Date.now() - startedAt });
+        }
+    }
+    return result;
+}
+/**
+ * Stage-2 cross-instance meta-distill (issue #1463). For each same-polarity
+ * meta-cluster: run the meta LLM, keep only the sources it names in `supports`,
+ * require **≥2 distinct supporting instances**, union their layer-1 evidence
+ * CIDs into the provenance, and finish through the SAME `finalizeSkill` gate as
+ * stage-1 — so a meta-skill passes the identical scrub / contamination /
+ * structural checks. Additive and opt-in; never called unless the pipeline
+ * enables it.
+ */
+export async function metaDistill(clusters, deps) {
+    const finalizeDeps = resolveFinalizeDeps(deps);
+    const result = { published: [], rejected: [], errors: [] };
+    for (const cluster of clusters) {
+        try {
+            const out = await deps.metaDistill(cluster);
+            // Keep sources the model corroborated, in the cluster's stable id order
+            // (deterministic regardless of the model's `supports` ordering).
+            const supported = new Set(out.supports);
+            const supportedSources = cluster.sources.filter((s) => supported.has(s.id));
+            const distinctInstances = new Set(supportedSources.flatMap((s) => s.instanceIds));
+            if (distinctInstances.size < 2) {
+                result.rejected.push({
+                    metaClusterId: cluster.metaClusterId,
+                    reason: `cross-instance: fewer than 2 distinct supporting instances (got ${distinctInstances.size})`,
+                });
+                continue;
+            }
+            // Union the supporting evidence refs (dedup, preserve first-seen order) →
+            // provenance (the full audited evidence set). distilledFrom is the
+            // distinct-instance count (§6, #1478), NOT the union size. The finalize
+            // `input` is the supported source bodies, so evidenceTokens is honest.
+            const seen = new Set();
+            const unionRefs = [];
+            for (const s of supportedSources)
+                for (const ref of s.evidenceRefs) {
+                    if (!seen.has(ref)) {
+                        seen.add(ref);
+                        unionRefs.push(ref);
+                    }
+                }
+            // Defensive publish-boundary guard: the feature's invariant (AC1) is that a
+            // cross-instance skill's provenance is the *union* of >1 supporting evidence
+            // refs. buildMetaClusters upholds this, but metaDistill is exported and a
+            // direct caller could pass sources whose refs collapse to <2 (shared or empty
+            // evidenceRefs). Reject rather than publish a skill that violates distilledFrom > 1.
+            if (unionRefs.length < 2) {
+                result.rejected.push({
+                    metaClusterId: cluster.metaClusterId,
+                    reason: `cross-instance: union provenance has fewer than 2 evidence refs (got ${unionRefs.length})`,
+                });
+                continue;
+            }
+            const finalizeInput = supportedSources.map((s) => ({ name: s.name, description: s.description, body: s.body }));
+            const fin = await finalizeSkill(out, {
+                tier: cluster.gateTier,
+                evidenceRefs: unionRefs,
+                distinctInstances: distinctInstances.size,
+                input: finalizeInput,
+                skillKind: 'cross-instance',
+                promptSha: JINN_SKILL_META_DISTILL_PROMPT_V1_SHA256,
+            }, finalizeDeps);
+            if (fin.ok) {
+                result.published.push({ metaClusterId: cluster.metaClusterId, skillKind: 'cross-instance', envelopeRef: fin.envelopeRef, pkg: fin.pkg });
+            }
+            else {
+                result.rejected.push({ metaClusterId: cluster.metaClusterId, reason: fin.reason });
+            }
+        }
+        catch (err) {
+            result.errors.push({ metaClusterId: cluster.metaClusterId, error: err instanceof Error ? err.message : String(err) });
+        }
+    }
+    return result;
+}

package/dist/distiller.d.ts

@@ -0,0 +1,118 @@
+/**
+ * The `Distiller` seam (issue #1488) — one interface, two backends.
+ *
+ * A single surface, "distill these captures → skills", sits OVER the merged
+ * distillation engine (`clusterEvidence` → `distillClusters`, spec
+ * §6–§7). The engine is untouched; a backend only binds the SOURCE (where the
+ * captures come from) and the SINK (where the distilled skills go):
+ *
+ *   - {@link createLocalDistiller} (rung 1) — source = the operator's OWN local
+ *     captures; sink = a private local skill install (SKILL.md, NO chain
+ *     anchor). It scrubs each capture at the layer-2 (secret-only) altitude —
+ *     the same altitude the network bridge uses (bridge.ts, D6) — parses the
+ *     resulting envelope, and hands it to the SAME gate/cluster/distill engine
+ *     the network path runs. Nothing is published to the corpus; both the
+ *     layer-1 evidence and the layer-2 skill stay on the operator's machine.
+ *
+ *   - {@link createNetworkDistiller} (rung 3) — source = the bonded network's
+ *     verified evidence (the existing `session-derived.v1` task path); sink =
+ *     the public anchored corpus. STUBBED for the MVP: it fails closed until
+ *     #1395 wires the source + sink, so it is a drop-in later.
+ *
+ * The two rungs are symmetric behind the one interface: the same `distill()`
+ * call, a different backend.
+ */
+import { type ScrubPipeline } from '@jinn-network/core/scrub';
+import { type CapturedTask } from './capture.js';
+import { type DistillCluster, type DistillDeps, type DistillLLMOutput, type DistillResult } from './distill.js';
+import { type SkillPackage } from './skill-package.js';
+/** The held-out slate shape shared by the engine's gate + contamination scan. */
+export interface HeldOutSlate {
+    instanceIds: Set<string>;
+    repos?: Set<string>;
+}
+/**
+ * The layer-2 skill sink: install one distilled skill, returning the corpus ref
+ * and (if anchored) the anchor tx. This is the engine's `publishSkill` port
+ * shape, named as the seam's SINK so a backend supplies either a private local
+ * install (no anchor) or the anchored corpus.
+ */
+export type SkillSink = (pkg: SkillPackage) => Promise<{
+    envelopeRef: string;
+    anchorTx: string | null;
+}>;
+/** The result of one distillation run: the engine's distilled output + cluster count. */
+export interface DistillerResult {
+    /** Distinct clusters the eligible captures formed (§7). */
+    clusterCount: number;
+    /** The engine's per-cluster outcome: published skills, rejections, errors. */
+    distilled: DistillResult;
+}
+/**
+ * The single distillation surface. Backends bind the source (via the captures
+ * they accept) and the sink (where the skills go); the engine in between is
+ * shared and unchanged.
+ */
+export interface Distiller {
+    /** Distill a batch of captures into layer-2 skills via this backend's sink. */
+    distill(captures: CapturedTask[]): Promise<DistillerResult>;
+}
+/**
+ * A private local skill install (rung-1 sink): write `<outDir>/<name>/SKILL.md`
+ * with the embedded provenance block, no chain anchor. Mirrors the fs-writer the
+ * `distill run` CLI + `distill-run-live.ts` already use, extracted so the
+ * LocalDistiller and those call sites share one implementation.
+ */
+export declare function createLocalSkillSink(outDir: string): SkillSink;
+export interface LocalDistillerDeps {
+    /** The LLM distill port (jinn-skill-distill-prompt-v1 over a cluster). */
+    distill: (cluster: DistillCluster) => Promise<DistillLLMOutput>;
+    /** Where distilled skills are installed (default sink: {@link createLocalSkillSink}). */
+    sink: SkillSink;
+    /**
+     * Held-out slate — defence-in-depth over the gate + the distiller's
+     * contamination scan. Own-captures rarely intersect a public held-out slate,
+     * so this defaults to empty.
+     */
+    slate?: HeldOutSlate;
+    /** Skill distribution recorded in provenance (§5). Default `coding`. */
+    distribution?: string;
+    /** The distilling model, recorded in each skill's provenance (§5 auditability). */
+    distillModel?: string;
+    /** Injectable layer-2 scrub pipeline (tests). Default: {@link buildLayer2ScrubPipeline}. */
+    scrubPipeline?: ScrubPipeline;
+    now?: () => Date;
+    /** Progress seam (#1533), threaded through to {@link distillClusters}. */
+    onPlan?: DistillDeps['onPlan'];
+    onCluster?: DistillDeps['onCluster'];
+}
+/**
+ * Rung-1 backend: distill the operator's OWN local captures in-process.
+ *
+ * Each capture is scrubbed at the layer-2 altitude and turned into an in-memory
+ * layer-1 envelope (never published), then the whole batch runs through the
+ * shared gate/cluster/distill engine. The instance key for clustering is the
+ * capture's `sessionId` — one own session is one instance. Only
+ * evaluator-verified captures are eligible (the gate, §6); everything else is
+ * dropped before the LLM is called.
+ */
+export declare function createLocalDistiller(deps: LocalDistillerDeps): Distiller;
+/**
+ * Thrown when {@link createNetworkDistiller}'s backend is invoked before it is
+ * wired (fail-closed). The rung-3 wiring — a `session-derived.v1` verdict source
+ * feeding `runDistillationPipeline`, sinking to the anchored corpus — lands with
+ * #1395.
+ */
+export declare class NetworkDistillerNotWiredError extends Error {
+    constructor();
+}
+/**
+ * Rung-3 backend (STUBBED). The drop-in seam: the wired version drives the same
+ * merged engine as LocalDistiller, but binds the network SOURCE — the
+ * `session-derived.v1` task path over the bonded network's verified evidence
+ * (bridge-verdict-source.ts → bridgeAttempts → clusterEvidence) — and the
+ * anchored-corpus SINK (`publishSkill` with a chain anchor). Until #1395 wires
+ * those ports, `distill()` fails closed with {@link NetworkDistillerNotWiredError}
+ * so the not-wired state is loud, never a silent no-op.
+ */
+export declare function createNetworkDistiller(): Distiller;

package/dist/distiller.js

@@ -0,0 +1,142 @@
+/**
+ * The `Distiller` seam (issue #1488) — one interface, two backends.
+ *
+ * A single surface, "distill these captures → skills", sits OVER the merged
+ * distillation engine (`clusterEvidence` → `distillClusters`, spec
+ * §6–§7). The engine is untouched; a backend only binds the SOURCE (where the
+ * captures come from) and the SINK (where the distilled skills go):
+ *
+ *   - {@link createLocalDistiller} (rung 1) — source = the operator's OWN local
+ *     captures; sink = a private local skill install (SKILL.md, NO chain
+ *     anchor). It scrubs each capture at the layer-2 (secret-only) altitude —
+ *     the same altitude the network bridge uses (bridge.ts, D6) — parses the
+ *     resulting envelope, and hands it to the SAME gate/cluster/distill engine
+ *     the network path runs. Nothing is published to the corpus; both the
+ *     layer-1 evidence and the layer-2 skill stay on the operator's machine.
+ *
+ *   - {@link createNetworkDistiller} (rung 3) — source = the bonded network's
+ *     verified evidence (the existing `session-derived.v1` task path); sink =
+ *     the public anchored corpus. STUBBED for the MVP: it fails closed until
+ *     #1395 wires the source + sink, so it is a drop-in later.
+ *
+ * The two rungs are symmetric behind the one interface: the same `distill()`
+ * call, a different backend.
+ */
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { buildLayer2ScrubPipeline, } from '@jinn-network/core/scrub';
+import { capture } from './capture.js';
+import { parseTraceEnvelopeV0 } from './envelope.js';
+import { clusterEvidence } from './cluster.js';
+import { distillClusters, } from './distill.js';
+import { assertConformantName, buildSkillMarkdown } from './skill-package.js';
+/**
+ * A private local skill install (rung-1 sink): write `<outDir>/<name>/SKILL.md`
+ * with the embedded provenance block, no chain anchor. Mirrors the fs-writer the
+ * `distill run` CLI + `distill-run-live.ts` already use, extracted so the
+ * LocalDistiller and those call sites share one implementation.
+ */
+export function createLocalSkillSink(outDir) {
+    return async (pkg) => {
+        // Validate the publisher-controlled name BEFORE it touches the filesystem —
+        // the engine already emits conformant names, but this helper is exported, so
+        // it defends its own boundary (no `../` in the install path).
+        assertConformantName(pkg.name);
+        const dir = join(outDir, pkg.name);
+        mkdirSync(dir, { recursive: true });
+        writeFileSync(join(dir, 'SKILL.md'), buildSkillMarkdown(pkg));
+        return { envelopeRef: `local:${pkg.name}`, anchorTx: null };
+    };
+}
+/**
+ * Rung-1 backend: distill the operator's OWN local captures in-process.
+ *
+ * Each capture is scrubbed at the layer-2 altitude and turned into an in-memory
+ * layer-1 envelope (never published), then the whole batch runs through the
+ * shared gate/cluster/distill engine. The instance key for clustering is the
+ * capture's `sessionId` — one own session is one instance. Only
+ * evaluator-verified captures are eligible (the gate, §6); everything else is
+ * dropped before the LLM is called.
+ */
+export function createLocalDistiller(deps) {
+    return {
+        async distill(captures) {
+            const layer2 = deps.scrubPipeline ?? buildLayer2ScrubPipeline();
+            const slate = deps.slate ?? { instanceIds: new Set() };
+            // Source binding: own capture → scrubbed layer-1 envelope → cluster item.
+            // Parsing with consent=true only CONSTRUCTS the in-memory envelope for the
+            // gate/cluster; nothing leaves the machine (the network bridge does the
+            // same, pipeline.ts).
+            const items = [];
+            for (const task of captures) {
+                const pending = await capture(task, { pipeline: layer2 });
+                const env = parseTraceEnvelopeV0({
+                    ...pending.draft,
+                    consent: { contributionConsent: true, scrubCompleted: true },
+                });
+                items.push({
+                    ref: `local-capture:${task.session.sessionId}`,
+                    instanceId: task.session.sessionId,
+                    env,
+                });
+            }
+            const clusters = clusterEvidence(items, {
+                heldOut: (id) => slate.instanceIds.has(id),
+                eligibilityMode: 'local-experimental',
+            });
+            const sourceTools = [...new Set(captures.map((task) => task.environment.harness.name))].sort();
+            const evidenceTier = clusters.some((cluster) => cluster.tier === 'contrastive')
+                ? 'contrastive'
+                : captures.length > 1
+                    ? 'recurring-pattern'
+                    : 'single-example';
+            const distilled = await distillClusters(clusters, {
+                distill: deps.distill,
+                publishSkill: deps.sink,
+                slate,
+                distribution: deps.distribution ?? 'coding',
+                verifiabilityTier: 'user-accepted',
+                skillStatus: 'experimental',
+                evidenceTier,
+                sourceTools,
+                targetTools: ['current'],
+                ...(deps.distillModel ? { distillModel: deps.distillModel } : {}),
+                ...(deps.now ? { now: deps.now } : {}),
+                ...(deps.onPlan ? { onPlan: deps.onPlan } : {}),
+                ...(deps.onCluster ? { onCluster: deps.onCluster } : {}),
+            });
+            return { clusterCount: clusters.length, distilled };
+        },
+    };
+}
+/**
+ * Thrown when {@link createNetworkDistiller}'s backend is invoked before it is
+ * wired (fail-closed). The rung-3 wiring — a `session-derived.v1` verdict source
+ * feeding `runDistillationPipeline`, sinking to the anchored corpus — lands with
+ * #1395.
+ */
+export class NetworkDistillerNotWiredError extends Error {
+    constructor() {
+        super('NetworkDistiller is not wired for the MVP (rung 3). The bonded-network ' +
+            'source (session-derived.v1 verified evidence) and the anchored-corpus ' +
+            'sink land with #1395; until then this backend fails closed. Use ' +
+            'createLocalDistiller for own-captures distillation.');
+        this.name = 'NetworkDistillerNotWiredError';
+    }
+}
+/**
+ * Rung-3 backend (STUBBED). The drop-in seam: the wired version drives the same
+ * merged engine as LocalDistiller, but binds the network SOURCE — the
+ * `session-derived.v1` task path over the bonded network's verified evidence
+ * (bridge-verdict-source.ts → bridgeAttempts → clusterEvidence) — and the
+ * anchored-corpus SINK (`publishSkill` with a chain anchor). Until #1395 wires
+ * those ports, `distill()` fails closed with {@link NetworkDistillerNotWiredError}
+ * so the not-wired state is loud, never a silent no-op.
+ */
+export function createNetworkDistiller() {
+    return {
+        async distill() {
+            throw new NetworkDistillerNotWiredError();
+        },
+    };
+}

package/dist/envelope.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Re-export shim — the canonical trace-envelope schema now lives in
+ * `@jinn-network/core` (moved in C2, #1833). This file keeps the ~13
+ * harness-layer `./envelope.js` importers unchanged while the schema lives
+ * one package up. Import the surface from core:
+ *
+ *   import { TraceEnvelopeV0Schema } from '@jinn-network/core';
+ */
+export * from '@jinn-network/core';

package/dist/envelope.js

@@ -0,0 +1,9 @@
+/**
+ * Re-export shim — the canonical trace-envelope schema now lives in
+ * `@jinn-network/core` (moved in C2, #1833). This file keeps the ~13
+ * harness-layer `./envelope.js` importers unchanged while the schema lives
+ * one package up. Import the surface from core:
+ *
+ *   import { TraceEnvelopeV0Schema } from '@jinn-network/core';
+ */
+export * from '@jinn-network/core';