@kontourai/survey 1.5.0 → 1.6.1

package/dist/src/index.d.ts

@@ -12,8 +12,8 @@ export { buildSurveyTrustBundle } from "./to-surface.js";
 export type { BuildSurveyTrustBundleOptions } from "./to-surface.js";
 export { buildSurveyLearningProjections } from "./learning-projections.js";
 export type { LearningProjection, LearningProjectionKind, LearningProjectionSeverity, LearningProjectionSignal, } from "./learning-projections.js";
-export { buildCanonicalReviewProofPayload, buildReviewProofAnchor, canonicalReviewProofJson, hashCanonicalReviewProofPayload, REVIEW_PROOF_CONTRACT_VERSION, REVIEW_PROOF_PACKAGE_NAME, REVIEW_PROOF_SCHEMA, REVIEW_PROOF_SCHEMA_VERSION, } from "./review-proof.js";
-export type { CanonicalReviewProofPayload, ReviewProofInput, } from "./review-proof.js";
+export { buildCanonicalReviewProofPayload, buildReviewProofAnchor, canonicalReviewProofJson, hashCanonicalReviewProofPayload, verifyCanonicalReviewProofPayload, REVIEW_PROOF_CONTRACT_VERSION, REVIEW_PROOF_PACKAGE_NAME, REVIEW_PROOF_SCHEMA, REVIEW_PROOF_SCHEMA_VERSION, } from "./review-proof.js";
+export type { CanonicalReviewProofPayload, CanonicalReviewProofPayloadV1, CanonicalReviewProofPayloadV2, ReviewProofInput, } from "./review-proof.js";
 export { fieldObservation } from "./field-observation.js";
 export type { FieldObservationInput } from "./field-observation.js";
 export { repeatedObservation } from "./repeated-observation.js";

package/dist/src/index.js

@@ -5,7 +5,7 @@ export { reviewedCandidateResolution } from "./reviewed-candidate-resolution.js"
 export { reviewedCurrentProposedResolution } from "./reviewed-current-proposed-resolution.js";
 export { buildSurveyTrustBundle } from "./to-surface.js";
 export { buildSurveyLearningProjections } from "./learning-projections.js";
-export { buildCanonicalReviewProofPayload, buildReviewProofAnchor, canonicalReviewProofJson, hashCanonicalReviewProofPayload, REVIEW_PROOF_CONTRACT_VERSION, REVIEW_PROOF_PACKAGE_NAME, REVIEW_PROOF_SCHEMA, REVIEW_PROOF_SCHEMA_VERSION, } from "./review-proof.js";
+export { buildCanonicalReviewProofPayload, buildReviewProofAnchor, canonicalReviewProofJson, hashCanonicalReviewProofPayload, verifyCanonicalReviewProofPayload, REVIEW_PROOF_CONTRACT_VERSION, REVIEW_PROOF_PACKAGE_NAME, REVIEW_PROOF_SCHEMA, REVIEW_PROOF_SCHEMA_VERSION, } from "./review-proof.js";
 export { fieldObservation } from "./field-observation.js";
 export { repeatedObservation } from "./repeated-observation.js";
 export { sourceOfAuthorityObservation, sourceOfAuthorityObservationBuilder, SourceOfAuthorityObservationBuilder, } from "./source-of-authority-observation.js";

package/dist/src/inquiry-mapping.js

@@ -18,7 +18,7 @@
  * and lives in the flow-agents repo.
  */
 import { resolveInquiry } from "@kontourai/surface";
-import { AUTO_ACCEPT_ACTOR, AUTO_ACCEPT_WITHIN_COMFORT_ZONE, getProducerProposal, hasCandidateConflict, meetsAutoAcceptThreshold, projectProposalsToCandidateSet, } from "./producer-profile.js";
+import { evaluateAutoAccept, getProducerProposal, hasCandidateConflict, projectProposalsToCandidateSet, } from "./producer-profile.js";
 import { reviewResourceApiVersion } from "./review-resource.js";
 // ---------------------------------------------------------------------------
 // Question normalization
@@ -152,20 +152,25 @@ export function applyAutoAcceptPolicy(proposals, policy) {
     // If proposals disagree, none can be auto-accepted
     if (hasCandidateConflict(proposals.map((p) => ({ equivalenceKey: mappingEquivalenceKey(p) }))))
         return [];
-    return proposals
-        .filter((p) => meetsAutoAcceptThreshold(p.confidence, policy.minConfidence))
-        .map((proposal) => ({
-        id: `inquiry-mapping.auto.${normalizeQuestion(proposal.question)}`,
-        normalizedQuestion: normalizeQuestion(proposal.question),
-        target: proposal.proposedTarget,
-        ruleId: proposal.proposedRuleId,
-        status: "assumed",
-        reviewedBy: AUTO_ACCEPT_ACTOR,
-        reviewedAt: proposal.proposedAt,
-        rationale: `Auto-accepted: confidence ${proposal.confidence} >= threshold ${policy.minConfidence}. ${proposal.rationale}`,
-        withinComfortZone: AUTO_ACCEPT_WITHIN_COMFORT_ZONE,
-        proposalId: proposal.id,
-    }));
+    return proposals.flatMap((proposal) => {
+        const decision = evaluateAutoAccept({ confidence: proposal.confidence, rationale: proposal.rationale, proposedAt: proposal.proposedAt }, false, policy, proposal.proposedAt);
+        if (!decision.accepted)
+            return [];
+        return [
+            {
+                id: `inquiry-mapping.auto.${normalizeQuestion(proposal.question)}`,
+                normalizedQuestion: normalizeQuestion(proposal.question),
+                target: proposal.proposedTarget,
+                ruleId: proposal.proposedRuleId,
+                status: "assumed",
+                reviewedBy: decision.actor,
+                reviewedAt: decision.reviewedAt,
+                rationale: decision.rationale,
+                withinComfortZone: decision.withinComfortZone,
+                proposalId: proposal.id,
+            },
+        ];
+    });
 }
 // ---------------------------------------------------------------------------
 // Mapping lookup

package/dist/src/producer-profile.d.ts

@@ -117,18 +117,88 @@ export declare const AUTO_ACCEPT_WITHIN_COMFORT_ZONE: true;
 /**
  * The one auto-accept threshold rule every Producer Profile applies: a
  * confidence value clears an auto-accept policy iff it is at or above
- * (inclusive) the policy's minimum confidence. This is the only piece of
- * auto-accept *mechanics* that is identical across profiles today — each
- * profile decides its own iteration granularity (per-proposal filter vs.
- * per-group max-confidence gate) and output record shape around this call;
- * the core does not decide that.
+ * (inclusive) the policy's minimum confidence.
  *
- * These three exports are the ONLY auto-accept semantics the two profiles
- * genuinely share today (see the Slice 3 plan's Part (a) field-by-field
- * diff table). Everything else about auto-accept — iteration granularity
- * (per-proposal vs. per-group), output record type and cardinality, id
- * templates, timestamp source, and rationale string format — diverges
- * between profiles and stays entirely per-profile; this module does not
- * decide any of it.
+ * This is a low-level primitive used by {@link evaluateAutoAccept} below,
+ * which is now the single place that decides the gate/rationale/`reviewedAt`
+ * auto-accept policy for both profiles (see
+ * `docs/decisions/producer-profile.md`, "Auto-accept policy unification").
+ * What still stays entirely per-profile: output record shapes (e.g.
+ * `InquiryMapping` vs. schema-mapping's inline `ReviewOutcome`), id
+ * templates, and each profile's own selection/iteration algorithm for which
+ * candidate's evidence gets passed into that decision.
  */
 export declare function meetsAutoAcceptThreshold(confidence: number, minConfidence: number): boolean;
+/**
+ * The accepted-candidate-shaped evidence `evaluateAutoAccept` decides over.
+ * Deliberately narrow: only the fields the auto-accept policy itself reads,
+ * not a whole proposal/candidate shape, so any profile can adapt its own
+ * proposal type into this without a dependency the other direction.
+ */
+export interface AutoAcceptEvidence {
+    /**
+     * The accepted evidence's OWN confidence — this is what gates AND what the
+     * composed rationale cites (owner-accepted decisions 1 and 2 in
+     * `docs/decisions/producer-profile.md`; fixes schema-mapping's pre-Slice-3
+     * group-max-gate / selected-candidate-confidence-rationale mismatch).
+     */
+    confidence: number;
+    /**
+     * The evidence's own rationale, appended to the composed rationale when
+     * present (decision 2; mirrors inquiry-mapping's pre-existing behavior).
+     * Presence is decided with `!== undefined`, not truthiness, so an
+     * empty-string rationale is still appended.
+     */
+    rationale?: string;
+    /**
+     * ISO 8601 timestamp of when this specific evidence was proposed (decision
+     * 3). When absent, `evaluateAutoAccept` falls back to `fallbackTimestamp`
+     * and reports that in `reviewedAtSource`.
+     */
+    proposedAt?: string;
+}
+/** The auto-accept policy `evaluateAutoAccept` gates against. */
+export interface AutoAcceptPolicy {
+    /** Minimum confidence (inclusive) a proposal must clear to auto-accept. */
+    minConfidence: number;
+}
+/** The unified auto-accept decision `evaluateAutoAccept` returns. */
+export interface AutoAcceptDecision {
+    /** `true` iff there is no conflict and `evidence.confidence` clears `policy.minConfidence`. */
+    accepted: boolean;
+    /** The confidence value that was gated on (== `evidence.confidence`). */
+    confidence: number;
+    /** Composed rationale — always computed; callers only use it when `accepted`. */
+    rationale: string;
+    /** The resolved review timestamp — `evidence.proposedAt` when present, `fallbackTimestamp` otherwise. */
+    reviewedAt: string;
+    /** Which source `reviewedAt` came from. */
+    reviewedAtSource: "proposedAt" | "fallback";
+    /** Always `AUTO_ACCEPT_ACTOR`. */
+    actor: typeof AUTO_ACCEPT_ACTOR;
+    /** Always `AUTO_ACCEPT_WITHIN_COMFORT_ZONE`. */
+    withinComfortZone: typeof AUTO_ACCEPT_WITHIN_COMFORT_ZONE;
+}
+/**
+ * The one core auto-accept policy decision every Producer Profile delegates
+ * to, per the owner-accepted semantics recorded in
+ * `docs/decisions/producer-profile.md` ("Auto-accept policy unification"):
+ *
+ * 1. Gate on the accepted evidence's OWN confidence (not a group's), via
+ *    {@link meetsAutoAcceptThreshold} — and never accept when `hasConflict`.
+ * 2. Compose a rationale citing that same gate-clearing confidence, and
+ *    append `evidence.rationale` when present (`!== undefined`).
+ * 3. Stamp `reviewedAt` from `evidence.proposedAt` when present, falling
+ *    back to `fallbackTimestamp` (and reporting which source was used via
+ *    `reviewedAtSource`) when a profile's evidence carries no timestamp of
+ *    its own.
+ * 4. Always report `actor: AUTO_ACCEPT_ACTOR` and
+ *    `withinComfortZone: AUTO_ACCEPT_WITHIN_COMFORT_ZONE` (ADR 0003 §4:
+ *    auto-accept only ever yields "assumed" with the comfort-zone posture).
+ *
+ * This function decides the policy only — it never renders a review outcome
+ * or claim-status record itself (ADR 0003 §4). Each profile still renders
+ * its own distinct record shape (`InquiryMapping` vs. schema-mapping's
+ * inline `ReviewOutcome`) from this decision's fields.
+ */
+export declare function evaluateAutoAccept(evidence: AutoAcceptEvidence, hasConflict: boolean, policy: AutoAcceptPolicy, fallbackTimestamp: string): AutoAcceptDecision;

package/dist/src/producer-profile.js

@@ -105,20 +105,54 @@ export const AUTO_ACCEPT_WITHIN_COMFORT_ZONE = true;
 /**
  * The one auto-accept threshold rule every Producer Profile applies: a
  * confidence value clears an auto-accept policy iff it is at or above
- * (inclusive) the policy's minimum confidence. This is the only piece of
- * auto-accept *mechanics* that is identical across profiles today — each
- * profile decides its own iteration granularity (per-proposal filter vs.
- * per-group max-confidence gate) and output record shape around this call;
- * the core does not decide that.
+ * (inclusive) the policy's minimum confidence.
  *
- * These three exports are the ONLY auto-accept semantics the two profiles
- * genuinely share today (see the Slice 3 plan's Part (a) field-by-field
- * diff table). Everything else about auto-accept — iteration granularity
- * (per-proposal vs. per-group), output record type and cardinality, id
- * templates, timestamp source, and rationale string format — diverges
- * between profiles and stays entirely per-profile; this module does not
- * decide any of it.
+ * This is a low-level primitive used by {@link evaluateAutoAccept} below,
+ * which is now the single place that decides the gate/rationale/`reviewedAt`
+ * auto-accept policy for both profiles (see
+ * `docs/decisions/producer-profile.md`, "Auto-accept policy unification").
+ * What still stays entirely per-profile: output record shapes (e.g.
+ * `InquiryMapping` vs. schema-mapping's inline `ReviewOutcome`), id
+ * templates, and each profile's own selection/iteration algorithm for which
+ * candidate's evidence gets passed into that decision.
  */
 export function meetsAutoAcceptThreshold(confidence, minConfidence) {
     return confidence >= minConfidence;
 }
+/**
+ * The one core auto-accept policy decision every Producer Profile delegates
+ * to, per the owner-accepted semantics recorded in
+ * `docs/decisions/producer-profile.md` ("Auto-accept policy unification"):
+ *
+ * 1. Gate on the accepted evidence's OWN confidence (not a group's), via
+ *    {@link meetsAutoAcceptThreshold} — and never accept when `hasConflict`.
+ * 2. Compose a rationale citing that same gate-clearing confidence, and
+ *    append `evidence.rationale` when present (`!== undefined`).
+ * 3. Stamp `reviewedAt` from `evidence.proposedAt` when present, falling
+ *    back to `fallbackTimestamp` (and reporting which source was used via
+ *    `reviewedAtSource`) when a profile's evidence carries no timestamp of
+ *    its own.
+ * 4. Always report `actor: AUTO_ACCEPT_ACTOR` and
+ *    `withinComfortZone: AUTO_ACCEPT_WITHIN_COMFORT_ZONE` (ADR 0003 §4:
+ *    auto-accept only ever yields "assumed" with the comfort-zone posture).
+ *
+ * This function decides the policy only — it never renders a review outcome
+ * or claim-status record itself (ADR 0003 §4). Each profile still renders
+ * its own distinct record shape (`InquiryMapping` vs. schema-mapping's
+ * inline `ReviewOutcome`) from this decision's fields.
+ */
+export function evaluateAutoAccept(evidence, hasConflict, policy, fallbackTimestamp) {
+    const accepted = !hasConflict && meetsAutoAcceptThreshold(evidence.confidence, policy.minConfidence);
+    const rationale = `Auto-accepted: confidence ${evidence.confidence} >= threshold ${policy.minConfidence}.` +
+        (evidence.rationale !== undefined ? ` ${evidence.rationale}` : "");
+    const reviewedAt = evidence.proposedAt ?? fallbackTimestamp;
+    return {
+        accepted,
+        confidence: evidence.confidence,
+        rationale,
+        reviewedAt,
+        reviewedAtSource: evidence.proposedAt !== undefined ? "proposedAt" : "fallback",
+        actor: AUTO_ACCEPT_ACTOR,
+        withinComfortZone: AUTO_ACCEPT_WITHIN_COMFORT_ZONE,
+    };
+}

package/dist/src/review-authorizing.d.ts

@@ -1,5 +1,5 @@
 import type { ReviewAuthorizing, ReviewAuthorizingAuthorizedAction } from "./types.js";
-export type ReviewAuthorizingIssueCode = "not-an-object" | "missing-kind" | "unknown-kind" | "missing-statement" | "missing-prompt" | "missing-response" | "missing-prompt-ref" | "missing-rendered-prompt" | "missing-action" | "invalid-action" | "missing-authority-ref";
+export type ReviewAuthorizingIssueCode = "not-an-object" | "missing-kind" | "unknown-kind" | "missing-statement" | "invalid-source" | "missing-prompt" | "missing-response" | "missing-prompt-ref" | "missing-rendered-prompt" | "missing-action" | "invalid-action" | "missing-authority-ref";
 export interface ReviewAuthorizingIssue {
     readonly code: ReviewAuthorizingIssueCode;
     readonly message: string;

package/dist/src/review-authorizing.js

@@ -43,6 +43,7 @@ function validateExplicitStatement(block) {
             message: "explicit-statement authorizing block requires a non-empty 'statement' string.",
         });
     }
+    validateOptionalSource(block.source, issues);
     return issues;
 }
 function validateExchange(block) {
@@ -59,8 +60,17 @@ function validateExchange(block) {
             message: "exchange authorizing block requires a non-empty 'response' string (both halves required for self-contained testimony).",
         });
     }
+    validateOptionalSource(block.source, issues);
     return issues;
 }
+function validateOptionalSource(source, issues) {
+    if (source !== undefined && (typeof source !== "string" || source.trim() === "")) {
+        issues.push({
+            code: "invalid-source",
+            message: "authorizing 'source', when present, must be a non-empty string.",
+        });
+    }
+}
 function validateAuthorizedAction(block) {
     const issues = [];
     if (!block.promptRef || typeof block.promptRef !== "string" || block.promptRef.trim() === "") {

package/dist/src/review-proof.d.ts

@@ -1,9 +1,11 @@
 import type { IntegrityAnchor } from "@kontourai/surface";
-import type { Candidate, CandidateSet, ClaimTarget, Extraction, RawSource, ReviewOutcome } from "./types.js";
+import type { Candidate, CandidateSet, ClaimTarget, Extraction, RawSource, ReviewAuthorizing, ReviewOutcome } from "./types.js";
 export declare const REVIEW_PROOF_SCHEMA = "survey.review-proof";
-export declare const REVIEW_PROOF_SCHEMA_VERSION = 1;
+export declare const REVIEW_PROOF_SCHEMA_VERSION = 2;
 export declare const REVIEW_PROOF_PACKAGE_NAME = "@kontourai/survey";
-export declare const REVIEW_PROOF_CONTRACT_VERSION = "1";
+export declare const REVIEW_PROOF_CONTRACT_VERSION = "2";
+declare const LEGACY_REVIEW_PROOF_SCHEMA_VERSION = 1;
+declare const LEGACY_REVIEW_PROOF_CONTRACT_VERSION = "1";
 export interface ReviewProofInput {
     rawSource: RawSource;
     extraction: Extraction;
@@ -15,13 +17,13 @@ export interface ReviewProofInput {
     observedAt?: string;
     metadata?: Record<string, unknown>;
 }
-export interface CanonicalReviewProofPayload {
+export interface CanonicalReviewProofPayloadV1 {
     schemaVersion: 1;
     proof: {
         schema: typeof REVIEW_PROOF_SCHEMA;
-        schemaVersion: typeof REVIEW_PROOF_SCHEMA_VERSION;
+        schemaVersion: typeof LEGACY_REVIEW_PROOF_SCHEMA_VERSION;
         packageName: typeof REVIEW_PROOF_PACKAGE_NAME;
-        packageVersion: typeof REVIEW_PROOF_CONTRACT_VERSION;
+        packageVersion: typeof LEGACY_REVIEW_PROOF_CONTRACT_VERSION;
         issuer: string;
         producer: string;
         issuedAt: string;
@@ -110,7 +112,38 @@ export interface CanonicalReviewProofPayload {
         eventMethod?: string;
     };
 }
-export declare function buildCanonicalReviewProofPayload(input: ReviewProofInput): CanonicalReviewProofPayload;
+type CanonicalReviewAuthorizing = (Extract<ReviewAuthorizing, {
+    kind: "explicit-statement";
+}> & {
+    authorityRef?: never;
+}) | (Extract<ReviewAuthorizing, {
+    kind: "exchange";
+}> & {
+    authorityRef?: never;
+}) | (Extract<ReviewAuthorizing, {
+    kind: "authorized-action";
+}> & {
+    source?: never;
+});
+export type CanonicalReviewProofPayloadV2 = Omit<CanonicalReviewProofPayloadV1, "schemaVersion" | "proof" | "reviewOutcome"> & {
+    schemaVersion: 2;
+    proof: Omit<CanonicalReviewProofPayloadV1["proof"], "schemaVersion" | "packageVersion"> & {
+        schemaVersion: typeof REVIEW_PROOF_SCHEMA_VERSION;
+        packageVersion: typeof REVIEW_PROOF_CONTRACT_VERSION;
+    };
+    reviewOutcome?: NonNullable<CanonicalReviewProofPayloadV1["reviewOutcome"]> & {
+        authorizing?: CanonicalReviewAuthorizing;
+    };
+};
+export type CanonicalReviewProofPayload = CanonicalReviewProofPayloadV1 | CanonicalReviewProofPayloadV2;
+export declare function buildCanonicalReviewProofPayload(input: ReviewProofInput): CanonicalReviewProofPayloadV2;
 export declare function canonicalReviewProofJson(payload: CanonicalReviewProofPayload): string;
 export declare function hashCanonicalReviewProofPayload(payload: CanonicalReviewProofPayload): string;
+/**
+ * Verifies the integrity hash of a persisted v1 or v2 canonical review proof.
+ * Envelope compatibility and v2 authorizing admissibility are checked before
+ * the expected hash is compared.
+ */
+export declare function verifyCanonicalReviewProofPayload(payload: unknown, expectedHash: string): boolean;
 export declare function buildReviewProofAnchor(input: ReviewProofInput): IntegrityAnchor;
+export {};

package/dist/src/review-proof.js

@@ -1,10 +1,13 @@
 import { createHash } from "node:crypto";
+import { validateAuthorizing } from "./review-authorizing.js";
 export const REVIEW_PROOF_SCHEMA = "survey.review-proof";
-export const REVIEW_PROOF_SCHEMA_VERSION = 1;
+export const REVIEW_PROOF_SCHEMA_VERSION = 2;
 export const REVIEW_PROOF_PACKAGE_NAME = "@kontourai/survey";
 // Version of the review proof contract emitted by this helper. This is intentionally
 // independent from the npm package release version because it participates in hashes.
-export const REVIEW_PROOF_CONTRACT_VERSION = "1";
+export const REVIEW_PROOF_CONTRACT_VERSION = "2";
+const LEGACY_REVIEW_PROOF_SCHEMA_VERSION = 1;
+const LEGACY_REVIEW_PROOF_CONTRACT_VERSION = "1";
 export function buildCanonicalReviewProofPayload(input) {
     assertCandidateConsistency(input);
     return {
@@ -78,6 +81,7 @@ export function buildCanonicalReviewProofPayload(input) {
                 reviewedAt: input.reviewOutcome.reviewedAt,
                 rationale: input.reviewOutcome.rationale,
                 evidenceIds: input.reviewOutcome.evidenceIds ? [...input.reviewOutcome.evidenceIds].sort() : undefined,
+                authorizing: copyCanonicalAuthorizing(input.reviewOutcome.authorizing),
             }
             : undefined,
         claim: {
@@ -111,6 +115,45 @@ export function buildCanonicalReviewProofPayload(input) {
         },
     };
 }
+function copyCanonicalAuthorizing(authorizing) {
+    if (authorizing === undefined)
+        return undefined;
+    const kind = authorizing.kind;
+    let snapshot;
+    switch (kind) {
+        case "explicit-statement":
+            snapshot = {
+                kind,
+                statement: authorizing.statement,
+                source: authorizing.source,
+            };
+            break;
+        case "exchange":
+            snapshot = {
+                kind,
+                prompt: authorizing.prompt,
+                response: authorizing.response,
+                source: authorizing.source,
+            };
+            break;
+        case "authorized-action":
+            snapshot = {
+                kind,
+                promptRef: authorizing.promptRef,
+                renderedPrompt: authorizing.renderedPrompt,
+                action: authorizing.action,
+                authorityRef: authorizing.authorityRef,
+            };
+            break;
+        default:
+            snapshot = { kind };
+    }
+    const issues = validateAuthorizing(snapshot);
+    if (issues.length > 0) {
+        throw new Error(`Canonical review proof has invalid authorizing: ${issues.map((issue) => issue.message).join(" ")}`);
+    }
+    return snapshot;
+}
 function assertCandidateConsistency(input) {
     if (input.extraction.sourceId !== input.rawSource.id) {
         throw new Error(`Review proof extraction sourceId "${input.extraction.sourceId}" does not match raw source id "${input.rawSource.id}".`);
@@ -143,6 +186,56 @@ export function canonicalReviewProofJson(payload) {
 export function hashCanonicalReviewProofPayload(payload) {
     return createHash("sha256").update(canonicalReviewProofJson(payload)).digest("hex");
 }
+/**
+ * Verifies the integrity hash of a persisted v1 or v2 canonical review proof.
+ * Envelope compatibility and v2 authorizing admissibility are checked before
+ * the expected hash is compared.
+ */
+export function verifyCanonicalReviewProofPayload(payload, expectedHash) {
+    try {
+        const snapshot = canonicalize(payload);
+        const canonicalJson = JSON.stringify(snapshot);
+        if (typeof canonicalJson !== "string" || !isRecord(snapshot) || !isRecord(snapshot.proof))
+            return false;
+        if (snapshot.proof.schema !== REVIEW_PROOF_SCHEMA)
+            return false;
+        if (snapshot.proof.packageName !== REVIEW_PROOF_PACKAGE_NAME)
+            return false;
+        const schemaVersion = snapshot.schemaVersion;
+        const proofSchemaVersion = snapshot.proof.schemaVersion;
+        const packageVersion = snapshot.proof.packageVersion;
+        const reviewOutcome = snapshot.reviewOutcome;
+        if (schemaVersion === LEGACY_REVIEW_PROOF_SCHEMA_VERSION) {
+            if (proofSchemaVersion !== LEGACY_REVIEW_PROOF_SCHEMA_VERSION
+                || packageVersion !== LEGACY_REVIEW_PROOF_CONTRACT_VERSION) {
+                return false;
+            }
+            if (isRecord(reviewOutcome) && Object.prototype.hasOwnProperty.call(reviewOutcome, "authorizing")) {
+                return false;
+            }
+        }
+        else if (schemaVersion === REVIEW_PROOF_SCHEMA_VERSION) {
+            if (proofSchemaVersion !== REVIEW_PROOF_SCHEMA_VERSION || packageVersion !== REVIEW_PROOF_CONTRACT_VERSION) {
+                return false;
+            }
+            if (reviewOutcome !== undefined && !isRecord(reviewOutcome))
+                return false;
+            if (isRecord(reviewOutcome)
+                && Object.prototype.hasOwnProperty.call(reviewOutcome, "authorizing")
+                && reviewOutcome.authorizing !== undefined
+                && validateAuthorizing(reviewOutcome.authorizing).length > 0) {
+                return false;
+            }
+        }
+        else {
+            return false;
+        }
+        return createHash("sha256").update(canonicalJson).digest("hex") === expectedHash;
+    }
+    catch {
+        return false;
+    }
+}
 export function buildReviewProofAnchor(input) {
     const payload = buildCanonicalReviewProofPayload(input);
     const hash = hashCanonicalReviewProofPayload(payload);

package/dist/src/schema-mapping.js

@@ -20,7 +20,7 @@
  *      so that resolveInquiry can resolve across systems with weakest-link
  *      capping.
  */
-import { AUTO_ACCEPT_ACTOR, AUTO_ACCEPT_WITHIN_COMFORT_ZONE, getProducerProposal, meetsAutoAcceptThreshold, projectProposalsToCandidateSet, } from "./producer-profile.js";
+import { evaluateAutoAccept, getProducerProposal, projectProposalsToCandidateSet, } from "./producer-profile.js";
 import { buildSurveyTrustBundle } from "./to-surface.js";
 // ---------------------------------------------------------------------------
 // Canonical pair key
@@ -156,29 +156,42 @@ export async function surveySchemaMapping(context, extractor, options = {}) {
         });
         candidateSet.selectedCandidateId = candidateSet.status !== "conflict" ? candidates[0]?.id : undefined;
         candidateSets.push(candidateSet);
-        // Auto-accept policy: non-conflicting proposals above threshold → assumed
-        let autoReviewStatus;
-        if (candidateSet.status !== "conflict" && options.autoAcceptMinConfidence !== undefined) {
-            const topConfidence = Math.max(...pairProposals.map((p) => p.confidence));
-            if (meetsAutoAcceptThreshold(topConfidence, options.autoAcceptMinConfidence)) {
-                autoReviewStatus = "assumed";
-            }
-        }
+        // Auto-accept policy: delegate the gate/rationale/reviewedAt decision to
+        // the core (docs/decisions/producer-profile.md — gates on the SELECTED
+        // candidate's own confidence, not the group's; keeps the existing
+        // candidates[0]-based selection algorithm unchanged, out of scope here).
         const selectedCandidate = candidateSet.selectedCandidateId
             ? candidates.find((c) => c.id === candidateSet.selectedCandidateId)
             : candidates[0];
-        if (autoReviewStatus && selectedCandidate) {
-            const reviewId = `schema-mapping.review.${pairKey}`;
-            reviewOutcomes.push({
-                id: reviewId,
-                candidateSetId,
-                candidateId: selectedCandidate.id,
-                status: autoReviewStatus,
-                actor: AUTO_ACCEPT_ACTOR,
-                reviewedAt: generatedAt,
-                rationale: `Auto-accepted: confidence ${selectedCandidate.confidence} >= threshold ${options.autoAcceptMinConfidence}`,
-                withinComfortZone: AUTO_ACCEPT_WITHIN_COMFORT_ZONE,
-            });
+        const hasConflict = candidateSet.status === "conflict";
+        if (!hasConflict && options.autoAcceptMinConfidence !== undefined && selectedCandidate) {
+            const selectedProposal = getProducerProposal(selectedCandidate);
+            const decision = evaluateAutoAccept({
+                // Fail-closed fallback: Candidate.confidence is `number | undefined`
+                // (src/types.ts), but no conforming SchemaMappingExtractor can
+                // produce an undefined confidence today (MappingProposalRecord.confidence
+                // is required and is copied straight through to Candidate.confidence
+                // at construction), so this is unreachable through the typed contract.
+                // NEGATIVE_INFINITY (not 0) guarantees rejection regardless of
+                // autoAcceptMinConfidence's sign, matching old code's NaN-poisoning
+                // behavior of never auto-accepting on a missing confidence.
+                confidence: selectedCandidate.confidence ?? Number.NEGATIVE_INFINITY,
+                rationale: selectedProposal?.rationale,
+                proposedAt: selectedProposal?.proposedAt,
+            }, hasConflict, { minConfidence: options.autoAcceptMinConfidence }, generatedAt);
+            if (decision.accepted) {
+                const reviewId = `schema-mapping.review.${pairKey}`;
+                reviewOutcomes.push({
+                    id: reviewId,
+                    candidateSetId,
+                    candidateId: selectedCandidate.id,
+                    status: "assumed",
+                    actor: decision.actor,
+                    reviewedAt: decision.reviewedAt,
+                    rationale: decision.rationale,
+                    withinComfortZone: decision.withinComfortZone,
+                });
+            }
         }
         // Project to ClaimTarget (subjectType "system-field", fieldOrBehavior "maps-to")
         if (selectedCandidate) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontourai/survey",
-  "version": "1.5.0",
+  "version": "1.6.1",
   "description": "Producer-side source, extraction, candidate, and review contracts for projecting verified claims into Surface.",
   "license": "Apache-2.0",
   "type": "module",