@kontourai/survey 1.4.0 → 1.6.0

package/dist/src/producer-profile.js

@@ -0,0 +1,158 @@
+/**
+ * Producer Profile core — ADR 0003 §4, CONTEXT.md "Producer Profile".
+ *
+ * This module carries the shared scaffolding every Producer Profile
+ * (inquiry-mapping, schema-mapping, and — from Slice 4 — agent-utterance)
+ * needs to turn its own proposals into Survey's existing Candidate/Candidate
+ * Set records: a generic proposal -> Candidate Set projection grouped by
+ * target, the Candidate Conflict rule, and one canonical `Candidate.metadata`
+ * key with a typed accessor, replacing each profile's hand-rolled projection,
+ * conflict check, and `as`-cast metadata round-trip.
+ *
+ * This is a module-internal seam: its exports are consumed directly by
+ * profile modules via relative import and are NOT re-exported from
+ * `src/index.ts`.
+ *
+ * Hard constraint (ADR 0003 §4): this module never decides a review outcome
+ * or a claim status. It only shapes proposal-backed Candidate/Candidate Set
+ * records — every profile still routes its output through Survey's existing
+ * review -> claim machinery unchanged.
+ */
+// ---------------------------------------------------------------------------
+// Canonical proposal-metadata key
+// ---------------------------------------------------------------------------
+/**
+ * The one canonical `Candidate.metadata` key every Producer Profile uses to
+ * carry its profile-specific proposal payload. Replaces the per-profile keys
+ * (`mappingProposal`, `schemaMappingProposal`) each profile used before
+ * adopting this core module.
+ */
+export const PRODUCER_PROPOSAL_METADATA_KEY = "producerProposal";
+// ---------------------------------------------------------------------------
+// Candidate Conflict rule
+// ---------------------------------------------------------------------------
+/**
+ * The shared Candidate Conflict rule: a group of proposals conflicts iff it
+ * carries more than one distinct `equivalenceKey`. A group of 0 or 1
+ * proposals can never conflict.
+ */
+export function hasCandidateConflict(proposals) {
+    return new Set(proposals.map((p) => p.equivalenceKey)).size > 1;
+}
+/**
+ * Build one Candidate Set (and its Candidates) from one target's proposal
+ * group. Grouping proposals by target itself stays a caller concern — this
+ * function projects exactly one group per call; it never reaches across
+ * multiple targets on its own. `status` is `"conflict"` when
+ * {@link hasCandidateConflict} is true for `proposals`, otherwise
+ * `"needs-review"` (an empty `proposals` array yields `"needs-review"` with
+ * an empty `candidates` array). `selectedCandidateId` is left unset — both
+ * profiles compute it themselves, or not at all, per their own review flow.
+ */
+export function projectProposalsToCandidateSet(target, proposals, options) {
+    const candidates = proposals.map((proposal) => ({
+        id: proposal.candidateId,
+        extractionId: proposal.extractionId,
+        value: proposal.value,
+        confidence: proposal.confidence,
+        metadata: {
+            [PRODUCER_PROPOSAL_METADATA_KEY]: proposal.metadata,
+        },
+    }));
+    const status = hasCandidateConflict(proposals) ? "conflict" : "needs-review";
+    const candidateSet = {
+        id: options.candidateSetId,
+        target,
+        candidates,
+        status,
+        rationale: options.candidateSetRationale?.(status, proposals),
+        metadata: options.candidateSetMetadata,
+    };
+    return { candidateSet, candidates };
+}
+// ---------------------------------------------------------------------------
+// Typed proposal-metadata accessor
+// ---------------------------------------------------------------------------
+/**
+ * Typed read-back of the proposal payload a Candidate carries under
+ * {@link PRODUCER_PROPOSAL_METADATA_KEY}. Returns `undefined` if the
+ * Candidate, its `metadata`, or the key itself is absent — never throws.
+ *
+ * No fallback reads of any legacy per-profile metadata key are performed
+ * (Owner decision: no legacy support).
+ */
+export function getProducerProposal(candidate) {
+    return candidate?.metadata?.[PRODUCER_PROPOSAL_METADATA_KEY];
+}
+// ---------------------------------------------------------------------------
+// Shared auto-accept primitives
+// ---------------------------------------------------------------------------
+/**
+ * Actor identity every Producer Profile's auto-accept policy uses when it
+ * accepts a proposal without human review. Shared literal — see ADR 0003
+ * §4 (the core never decides "verified"; auto-accept only ever produces
+ * "assumed" + comfort-zone true).
+ */
+export const AUTO_ACCEPT_ACTOR = "auto-accept-policy";
+/**
+ * The comfort-zone posture every Producer Profile's auto-accept policy
+ * sets when it accepts a proposal: `withinComfortZone: true` always — an
+ * auto-accepted proposal is, by definition, one the policy's declared
+ * threshold covers, so there is nothing "outside comfort zone" about an
+ * auto-accept decision (ADR 0003 §4).
+ */
+export const AUTO_ACCEPT_WITHIN_COMFORT_ZONE = true;
+/**
+ * The one auto-accept threshold rule every Producer Profile applies: a
+ * confidence value clears an auto-accept policy iff it is at or above
+ * (inclusive) the policy's minimum confidence.
+ *
+ * This is a low-level primitive used by {@link evaluateAutoAccept} below,
+ * which is now the single place that decides the gate/rationale/`reviewedAt`
+ * auto-accept policy for both profiles (see
+ * `docs/decisions/producer-profile.md`, "Auto-accept policy unification").
+ * What still stays entirely per-profile: output record shapes (e.g.
+ * `InquiryMapping` vs. schema-mapping's inline `ReviewOutcome`), id
+ * templates, and each profile's own selection/iteration algorithm for which
+ * candidate's evidence gets passed into that decision.
+ */
+export function meetsAutoAcceptThreshold(confidence, minConfidence) {
+    return confidence >= minConfidence;
+}
+/**
+ * The one core auto-accept policy decision every Producer Profile delegates
+ * to, per the owner-accepted semantics recorded in
+ * `docs/decisions/producer-profile.md` ("Auto-accept policy unification"):
+ *
+ * 1. Gate on the accepted evidence's OWN confidence (not a group's), via
+ *    {@link meetsAutoAcceptThreshold} — and never accept when `hasConflict`.
+ * 2. Compose a rationale citing that same gate-clearing confidence, and
+ *    append `evidence.rationale` when present (`!== undefined`).
+ * 3. Stamp `reviewedAt` from `evidence.proposedAt` when present, falling
+ *    back to `fallbackTimestamp` (and reporting which source was used via
+ *    `reviewedAtSource`) when a profile's evidence carries no timestamp of
+ *    its own.
+ * 4. Always report `actor: AUTO_ACCEPT_ACTOR` and
+ *    `withinComfortZone: AUTO_ACCEPT_WITHIN_COMFORT_ZONE` (ADR 0003 §4:
+ *    auto-accept only ever yields "assumed" with the comfort-zone posture).
+ *
+ * This function decides the policy only — it never renders a review outcome
+ * or claim-status record itself (ADR 0003 §4). Each profile still renders
+ * its own distinct record shape (`InquiryMapping` vs. schema-mapping's
+ * inline `ReviewOutcome`) from this decision's fields.
+ */
+export function evaluateAutoAccept(evidence, hasConflict, policy, fallbackTimestamp) {
+    const accepted = !hasConflict && meetsAutoAcceptThreshold(evidence.confidence, policy.minConfidence);
+    const rationale = `Auto-accepted: confidence ${evidence.confidence} >= threshold ${policy.minConfidence}.` +
+        (evidence.rationale !== undefined ? ` ${evidence.rationale}` : "");
+    const reviewedAt = evidence.proposedAt ?? fallbackTimestamp;
+    return {
+        accepted,
+        confidence: evidence.confidence,
+        rationale,
+        reviewedAt,
+        reviewedAtSource: evidence.proposedAt !== undefined ? "proposedAt" : "fallback",
+        actor: AUTO_ACCEPT_ACTOR,
+        withinComfortZone: AUTO_ACCEPT_WITHIN_COMFORT_ZONE,
+    };
+}

package/dist/src/raw-source.d.ts

@@ -39,6 +39,24 @@ export interface PolicyStandardSourceInput extends Omit<RawSourceInput, "locator
     locatorScheme?: LocatorScheme;
     metadata?: Record<string, unknown>;
 }
+/**
+ * Raw Source kinds whose factories accept a caller-supplied `locatorScheme`
+ * override and otherwise fall back to a per-kind default. `uploaded-document`
+ * has no default (`undefined`) because `UploadedDocumentSourceInput.locatorScheme`
+ * is required, not optional — modeled here as a real, explicit table entry
+ * rather than an omission, so a caller-supplied value is the only source of
+ * truth for that kind.
+ *
+ * Module-internal seam: consumed by relative import from
+ * `rawSourceWithDefaultLocatorScheme` below and by
+ * `tests/raw-source-defaults.test.ts`, NOT re-exported from `src/index.ts`.
+ */
+export declare const DEFAULT_LOCATOR_SCHEME: {
+    "uploaded-document": undefined;
+    "api-record": LocatorScheme;
+    "web-page": LocatorScheme;
+    "manual-entry": LocatorScheme;
+};
 export declare function uploadedDocumentSource(input: UploadedDocumentSourceInput): RawSource;
 export declare function apiRecordSource(input: ApiRecordSourceInput): RawSource;
 export declare function webPageSource(input: WebPageSourceInput): RawSource;

package/dist/src/raw-source.js

@@ -1,23 +1,38 @@
+/**
+ * Raw Source kinds whose factories accept a caller-supplied `locatorScheme`
+ * override and otherwise fall back to a per-kind default. `uploaded-document`
+ * has no default (`undefined`) because `UploadedDocumentSourceInput.locatorScheme`
+ * is required, not optional — modeled here as a real, explicit table entry
+ * rather than an omission, so a caller-supplied value is the only source of
+ * truth for that kind.
+ *
+ * Module-internal seam: consumed by relative import from
+ * `rawSourceWithDefaultLocatorScheme` below and by
+ * `tests/raw-source-defaults.test.ts`, NOT re-exported from `src/index.ts`.
+ */
+export const DEFAULT_LOCATOR_SCHEME = {
+    "uploaded-document": undefined,
+    "api-record": "structured-field",
+    "web-page": "html",
+    "manual-entry": "structured-field",
+};
+function rawSourceWithDefaultLocatorScheme(kind, input) {
+    return rawSource(kind, {
+        locatorScheme: DEFAULT_LOCATOR_SCHEME[kind],
+        ...input,
+    });
+}
 export function uploadedDocumentSource(input) {
-    return rawSource("uploaded-document", input);
+    return rawSourceWithDefaultLocatorScheme("uploaded-document", input);
 }
 export function apiRecordSource(input) {
-    return rawSource("api-record", {
-        locatorScheme: "structured-field",
-        ...input,
-    });
+    return rawSourceWithDefaultLocatorScheme("api-record", input);
 }
 export function webPageSource(input) {
-    return rawSource("web-page", {
-        locatorScheme: "html",
-        ...input,
-    });
+    return rawSourceWithDefaultLocatorScheme("web-page", input);
 }
 export function manualEntrySource(input) {
-    return rawSource("manual-entry", {
-        locatorScheme: "structured-field",
-        ...input,
-    });
+    return rawSourceWithDefaultLocatorScheme("manual-entry", input);
 }
 export function policyStandardSource(input) {
     const policyStandard = {

package/dist/src/repeated-observation.d.ts

@@ -1,20 +1,6 @@
 import type { SurveyObservationInput } from "./builder.js";
-export interface RepeatedObservationInput<TItem> {
-    id: string;
-    field: string;
-    value: readonly TItem[];
-    rawSource: SurveyObservationInput["rawSource"];
-    extraction: Omit<SurveyObservationInput["extraction"], "target" | "value" | "excerpt"> & {
-        target?: string;
-        excerpt?: string | null;
-    };
-    reviewOutcome?: SurveyObservationInput["reviewOutcome"];
-    claim: Omit<SurveyObservationInput["claim"], "fieldOrBehavior" | "value"> & {
-        fieldOrBehavior?: string;
-    };
-    candidate?: SurveyObservationInput["candidate"];
-    candidateSet?: SurveyObservationInput["candidateSet"];
+import { type ObservationAuthoringInput } from "./observation-helper.js";
+export interface RepeatedObservationInput<TItem> extends ObservationAuthoringInput<readonly TItem[]> {
     representation?: "aggregate-array";
-    metadata?: Record<string, unknown>;
 }
 export declare function repeatedObservation<TItem>(input: RepeatedObservationInput<TItem>): SurveyObservationInput;

package/dist/src/repeated-observation.js

@@ -1,16 +1,4 @@
-import { buildObservation } from "./observation-helper.js";
+import { buildRepeatedObservation } from "./observation-helper.js";
 export function repeatedObservation(input) {
-    const representation = input.representation ?? "aggregate-array";
-    const value = [...input.value];
-    return buildObservation({
-        ...input,
-        value,
-        surveyMetadata: {
-            repeated: {
-                representation,
-                itemCount: value.length,
-            },
-        },
-        defaultExcerpt: `${input.field}: ${value.length} item(s)`,
-    });
+    return buildRepeatedObservation(input);
 }

package/dist/src/review-workbench/server-review-session.d.ts

@@ -2,7 +2,7 @@ import { type DeriveReviewSessionApplyResultForSnapshotResult, type MapReviewWor
 import { type ReviewDecisionModeIssue } from "./producer-decision-mode.js";
 import { type ReviewSessionReplayIssue } from "./review-session-replay.js";
 import type { ReviewDecision, ReviewSessionEvent } from "../review-resource.js";
-import type { ReviewQueueSessionState } from "./review-queue-session.js";
+import { type ReviewQueueSessionState } from "./review-queue-session.js";
 export interface ServerReviewSessionRecord {
     readonly sessionName: string;
     readonly snapshot: ReviewQueueSessionState;
@@ -59,6 +59,19 @@ export interface DeriveServerReviewSessionApplyResultOptions {
 }
 export declare function createServerReviewSessionRecord(options: CreateServerReviewSessionRecordOptions): ServerReviewSessionRecord;
 export declare function hashReviewSessionSnapshot(snapshot: ReviewQueueSessionState): string;
+/**
+ * Project the current review session state from a snapshot plus its
+ * append-only event log: replay events over the snapshot when any exist,
+ * otherwise return the snapshot itself unchanged (same object reference —
+ * no eager replay, no copy). Collapses the
+ * `events.length > 0 ? replayReviewSessionEvents(snapshot, events) : snapshot`
+ * conditional that was duplicated across the MCP and console review
+ * adapters (src/mcp/review-mcp.ts, src/console/review-console-server.ts) —
+ * same shape of fix as canonicalJson in ./canonical.ts, which was
+ * extracted after two near-identical copies of a derivation desynced
+ * (audit 2026-06-28, ops#24).
+ */
+export declare function currentSessionState(snapshot: ReviewQueueSessionState, events: readonly ReviewSessionEvent[]): ReviewQueueSessionState;
 export declare function compareServerReviewSessionFreshness(record: ServerReviewSessionRecord, snapshot: ReviewQueueSessionState, eventCount?: number): ServerReviewSessionFreshnessComparison;
 export declare function assertServerReviewSessionFreshness(record: ServerReviewSessionRecord, snapshot: ReviewQueueSessionState, eventCount?: number): void;
 export declare function validateServerReviewSessionEvents(record: ServerReviewSessionRecord, events: readonly ReviewSessionEvent[]): ServerReviewSessionEventValidationIssue[];

package/dist/src/review-workbench/server-review-session.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { deriveReviewSessionApplyResultForSnapshot, mapReviewWorkbenchResultsToApplyActions, ReviewApplyActionMappingError, } from "./review-workbench.js";
 import { validateReviewDecisionMode, } from "./producer-decision-mode.js";
 import { validateReviewSessionEventsForSnapshot, } from "./review-session-replay.js";
+import { replayReviewSessionEvents } from "./review-queue-session.js";
 import { canonicalJson } from "./canonical.js";
 export class StaleServerReviewSessionError extends Error {
     name = "StaleServerReviewSessionError";
@@ -34,6 +35,21 @@ export function createServerReviewSessionRecord(options) {
 export function hashReviewSessionSnapshot(snapshot) {
     return sha256(canonicalJson(snapshot));
 }
+/**
+ * Project the current review session state from a snapshot plus its
+ * append-only event log: replay events over the snapshot when any exist,
+ * otherwise return the snapshot itself unchanged (same object reference —
+ * no eager replay, no copy). Collapses the
+ * `events.length > 0 ? replayReviewSessionEvents(snapshot, events) : snapshot`
+ * conditional that was duplicated across the MCP and console review
+ * adapters (src/mcp/review-mcp.ts, src/console/review-console-server.ts) —
+ * same shape of fix as canonicalJson in ./canonical.ts, which was
+ * extracted after two near-identical copies of a derivation desynced
+ * (audit 2026-06-28, ops#24).
+ */
+export function currentSessionState(snapshot, events) {
+    return events.length > 0 ? replayReviewSessionEvents(snapshot, events) : snapshot;
+}
 export function compareServerReviewSessionFreshness(record, snapshot, eventCount) {
     const actualSnapshotHash = hashReviewSessionSnapshot(snapshot);
     const eventCountMatches = record.eventCount === undefined || eventCount === undefined || record.eventCount === eventCount;

package/dist/src/schema-mapping.js

@@ -20,6 +20,7 @@
  *      so that resolveInquiry can resolve across systems with weakest-link
  *      capping.
  */
+import { evaluateAutoAccept, getProducerProposal, projectProposalsToCandidateSet, } from "./producer-profile.js";
 import { buildSurveyTrustBundle } from "./to-surface.js";
 // ---------------------------------------------------------------------------
 // Canonical pair key
@@ -84,10 +85,7 @@ export async function surveySchemaMapping(context, extractor, options = {}) {
         const subjectId = mappingSubjectId(first.sourceField, first.targetField);
         const candidateSetId = `schema-mapping.candidate-set.${pairKey}`;
         const claimId = `schema-mapping.claim.${pairKey}`;
-        // Detect conflict: proposals disagree on relation
-        const relations = new Set(pairProposals.map((p) => p.relation));
-        const status = relations.size > 1 ? "conflict" : "needs-review";
-        const candidates = pairProposals.map((proposal) => {
+        const candidateSetProposals = pairProposals.map((proposal) => {
             // Use the source system's RawSource for this extraction
             const rawSource = sourceById.get(proposal.sourceField.system) ?? rawSources[0];
             const extractionId = `schema-mapping.extraction.${proposal.id}`;
@@ -120,7 +118,7 @@ export async function surveySchemaMapping(context, extractor, options = {}) {
             };
             extractions.push(extraction);
             return {
-                id: `schema-mapping.candidate.${proposal.id}`,
+                candidateId: `schema-mapping.candidate.${proposal.id}`,
                 extractionId,
                 value: {
                     relation: proposal.relation,
@@ -128,70 +126,79 @@ export async function surveySchemaMapping(context, extractor, options = {}) {
                     conversion: proposal.conversion,
                 },
                 confidence: proposal.confidence,
+                equivalenceKey: proposal.relation,
                 metadata: {
-                    schemaMappingProposal: {
-                        proposalId: proposal.id,
-                        sourceField: proposal.sourceField,
-                        targetField: proposal.targetField,
-                        relation: proposal.relation,
-                        conversion: proposal.conversion,
-                        evidence: proposal.evidence,
-                        confidence: proposal.confidence,
-                        rationale: proposal.rationale,
-                        proposedBy: proposal.proposedBy,
-                        proposedAt: proposal.proposedAt,
-                    },
+                    proposalId: proposal.id,
+                    sourceField: proposal.sourceField,
+                    targetField: proposal.targetField,
+                    relation: proposal.relation,
+                    conversion: proposal.conversion,
+                    evidence: proposal.evidence,
+                    confidence: proposal.confidence,
+                    rationale: proposal.rationale,
+                    proposedBy: proposal.proposedBy,
+                    proposedAt: proposal.proposedAt,
                 },
             };
         });
-        const candidateSet = {
-            id: candidateSetId,
-            target: `schema-mapping:${pairKey}`,
-            candidates,
-            selectedCandidateId: status !== "conflict" ? candidates[0]?.id : undefined,
-            status,
-            rationale: status === "conflict"
-                ? `Proposals disagree on relation for pair ${pairKey}: ${[...relations].join(", ")}`
-                : `${candidates.length} proposal(s) agree on relation "${first.relation}" for pair ${pairKey}.`,
-            metadata: {
+        const { candidateSet, candidates } = projectProposalsToCandidateSet(`schema-mapping:${pairKey}`, candidateSetProposals, {
+            candidateSetId,
+            candidateSetMetadata: {
                 schemaMapping: {
                     pairKey,
                     sourceField: first.sourceField,
                     targetField: first.targetField,
                 },
             },
-        };
+            candidateSetRationale: (status, proposals) => status === "conflict"
+                ? `Proposals disagree on relation for pair ${pairKey}: ${[...new Set(proposals.map((p) => p.equivalenceKey))].join(", ")}`
+                : `${proposals.length} proposal(s) agree on relation "${first.relation}" for pair ${pairKey}.`,
+        });
+        candidateSet.selectedCandidateId = candidateSet.status !== "conflict" ? candidates[0]?.id : undefined;
         candidateSets.push(candidateSet);
-        // Auto-accept policy: non-conflicting proposals above threshold → assumed
-        let autoReviewStatus;
-        if (status !== "conflict" && options.autoAcceptMinConfidence !== undefined) {
-            const topConfidence = Math.max(...pairProposals.map((p) => p.confidence));
-            if (topConfidence >= options.autoAcceptMinConfidence) {
-                autoReviewStatus = "assumed";
-            }
-        }
+        // Auto-accept policy: delegate the gate/rationale/reviewedAt decision to
+        // the core (docs/decisions/producer-profile.md — gates on the SELECTED
+        // candidate's own confidence, not the group's; keeps the existing
+        // candidates[0]-based selection algorithm unchanged, out of scope here).
         const selectedCandidate = candidateSet.selectedCandidateId
             ? candidates.find((c) => c.id === candidateSet.selectedCandidateId)
             : candidates[0];
-        if (autoReviewStatus && selectedCandidate) {
-            const reviewId = `schema-mapping.review.${pairKey}`;
-            reviewOutcomes.push({
-                id: reviewId,
-                candidateSetId,
-                candidateId: selectedCandidate.id,
-                status: autoReviewStatus,
-                actor: "auto-accept-policy",
-                reviewedAt: generatedAt,
-                rationale: `Auto-accepted: confidence ${selectedCandidate.confidence} >= threshold ${options.autoAcceptMinConfidence}`,
-                withinComfortZone: true,
-            });
+        const hasConflict = candidateSet.status === "conflict";
+        if (!hasConflict && options.autoAcceptMinConfidence !== undefined && selectedCandidate) {
+            const selectedProposal = getProducerProposal(selectedCandidate);
+            const decision = evaluateAutoAccept({
+                // Fail-closed fallback: Candidate.confidence is `number | undefined`
+                // (src/types.ts), but no conforming SchemaMappingExtractor can
+                // produce an undefined confidence today (MappingProposalRecord.confidence
+                // is required and is copied straight through to Candidate.confidence
+                // at construction), so this is unreachable through the typed contract.
+                // NEGATIVE_INFINITY (not 0) guarantees rejection regardless of
+                // autoAcceptMinConfidence's sign, matching old code's NaN-poisoning
+                // behavior of never auto-accepting on a missing confidence.
+                confidence: selectedCandidate.confidence ?? Number.NEGATIVE_INFINITY,
+                rationale: selectedProposal?.rationale,
+                proposedAt: selectedProposal?.proposedAt,
+            }, hasConflict, { minConfidence: options.autoAcceptMinConfidence }, generatedAt);
+            if (decision.accepted) {
+                const reviewId = `schema-mapping.review.${pairKey}`;
+                reviewOutcomes.push({
+                    id: reviewId,
+                    candidateSetId,
+                    candidateId: selectedCandidate.id,
+                    status: "assumed",
+                    actor: decision.actor,
+                    reviewedAt: decision.reviewedAt,
+                    rationale: decision.rationale,
+                    withinComfortZone: decision.withinComfortZone,
+                });
+            }
         }
         // Project to ClaimTarget (subjectType "system-field", fieldOrBehavior "maps-to")
         if (selectedCandidate) {
             const review = reviewOutcomes.find((r) => r.candidateSetId === candidateSetId);
             const claimStatus = review
                 ? review.status
-                : (status === "conflict" ? "disputed" : undefined);
+                : (candidateSet.status === "conflict" ? "disputed" : undefined);
             const claimTarget = {
                 id: claimId,
                 candidateSetId,
@@ -266,7 +273,7 @@ export function mappingReviewToSurface(reviewedMappings, options = {}) {
     const rawSources = [];
     const seenSources = new Set();
     for (const rm of accepted) {
-        const meta = rm.selectedCandidate.metadata?.schemaMappingProposal;
+        const meta = getProducerProposal(rm.selectedCandidate);
         const sourceField = meta?.sourceField ?? rm.proposal.sourceField;
         const sourceId = `schema-mapping.source.${sourceField.system}`;
         if (!seenSources.has(sourceId)) {
@@ -290,7 +297,7 @@ export function mappingReviewToSurface(reviewedMappings, options = {}) {
     const reviewOutcomes = [];
     const claims = [];
     for (const rm of accepted) {
-        const meta = rm.selectedCandidate.metadata?.schemaMappingProposal;
+        const meta = getProducerProposal(rm.selectedCandidate);
         const sourceField = meta?.sourceField ?? rm.proposal.sourceField;
         const targetField = meta?.targetField ?? rm.proposal.targetField;
         const relation = (meta?.relation ?? rm.proposal.relation);
@@ -379,7 +386,7 @@ export function mappingReviewToSurface(reviewedMappings, options = {}) {
     // subject and back-references the mapping claim via mappingClaimId.
     const identityLinks = [];
     for (const rm of accepted) {
-        const meta = rm.selectedCandidate.metadata?.schemaMappingProposal;
+        const meta = getProducerProposal(rm.selectedCandidate);
         const sourceField = meta?.sourceField ?? rm.proposal.sourceField;
         const targetField = meta?.targetField ?? rm.proposal.targetField;
         const relation = (meta?.relation ?? rm.proposal.relation);

package/dist/src/source-of-authority-observation.js

@@ -1,4 +1,5 @@
 import { buildObservation } from "./observation-helper.js";
+import { assertReviewOutcomeDiscipline } from "./producer-discipline.js";
 export class SourceOfAuthorityObservationBuilder {
     state;
     constructor(args) {
@@ -115,15 +116,11 @@ function assertVerifiedPosture(input) {
     if (!input.extraction.locator) {
         throw new Error(`Source-of-authority observation ${input.id} cannot be ${status} without a source locator`);
     }
-    if (!input.reviewOutcome) {
-        throw new Error(`Source-of-authority observation ${input.id} cannot be ${status} without a review outcome`);
-    }
-    if (!input.reviewOutcome.actor) {
-        throw new Error(`Source-of-authority observation ${input.id} cannot be ${status} without review actor authority`);
-    }
-    if (!input.reviewOutcome.reviewedAt) {
-        throw new Error(`Source-of-authority observation ${input.id} cannot be ${status} without reviewedAt`);
-    }
+    assertReviewOutcomeDiscipline({
+        subject: `Source-of-authority observation ${input.id}`,
+        status,
+        review: input.reviewOutcome,
+    });
 }
 function claimStatus(claimStatusValue, reviewStatus) {
     return claimStatusValue ?? reviewStatus;

package/dist/src/to-surface.js

@@ -1,4 +1,5 @@
 import { buildReviewProofAnchor } from "./review-proof.js";
+import { assertReviewOutcomeDiscipline } from "./producer-discipline.js";
 export function buildSurveyTrustBundle(input, options = {}) {
     const rawSources = indexById(input.rawSources, "raw source");
     const extractions = indexById(input.extractions, "extraction");
@@ -334,15 +335,11 @@ function statusFor(input) {
     return "proposed";
 }
 function assertProducerDiscipline(input) {
-    if ((input.status === "verified" || input.status === "assumed") && !input.review) {
-        throw new Error(`Claim ${input.projection.id} cannot be ${input.status} without a review outcome`);
-    }
-    if ((input.status === "verified" || input.status === "assumed") && !input.review?.actor) {
-        throw new Error(`Claim ${input.projection.id} cannot be ${input.status} without review actor authority`);
-    }
-    if ((input.status === "verified" || input.status === "assumed") && !input.review?.reviewedAt) {
-        throw new Error(`Claim ${input.projection.id} cannot be ${input.status} without reviewedAt`);
-    }
+    assertReviewOutcomeDiscipline({
+        subject: `Claim ${input.projection.id}`,
+        status: input.status,
+        review: input.review,
+    });
     if (input.rawSource.kind !== "manual-entry" && !input.extraction.locator) {
         throw new Error(`Claim ${input.projection.id} needs a source locator for ${input.rawSource.kind}`);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontourai/survey",
-  "version": "1.4.0",
+  "version": "1.6.0",
   "description": "Producer-side source, extraction, candidate, and review contracts for projecting verified claims into Surface.",
   "license": "Apache-2.0",
   "type": "module",
@@ -55,8 +55,11 @@
     "typecheck": "tsc --noEmit",
     "test": "npm run build && node --test dist/tests/*.test.js",
     "test:browser": "playwright test",
-    "verify": "node scripts/check-content-boundary.cjs && npm run typecheck && npm test && npm run check:review-workbench-assets && npm run check:review-workbench && npm run test:browser",
+    "verify": "node scripts/check-content-boundary.cjs && npm run check:decisions && npm run typecheck && npm test && npm run check:review-workbench-assets && npm run check:review-workbench && npm run test:browser",
     "check:content-boundary": "node scripts/check-content-boundary.cjs",
+    "check:decisions": "node scripts/check-decisions.cjs check",
+    "gen:decisions-index": "node scripts/check-decisions.cjs gen-index",
+    "freeze:adrs": "node scripts/freeze-adrs.mjs",
     "sync:review-workbench-assets": "node scripts/sync-review-workbench-assets.cjs",
     "check:review-workbench-assets": "node scripts/sync-review-workbench-assets.cjs --check",
     "check:review-workbench": "npm run check:review-workbench:static && npm run check:generated-css",