@piagent/platform 1.6.1 → 1.7.1

package/evals/fs5-causal-arm.v1.json

@@ -16,8 +16,12 @@
     "authority": "enforce"
   },
   "differenceContract": {
-    "environmentKeys": ["PIAGENT_PHASE_TOOLS"],
-    "capabilityIds": ["CAP-09"],
+    "environmentKeys": [
+      "PIAGENT_PHASE_TOOLS"
+    ],
+    "capabilityIds": [
+      "CAP-09"
+    ],
     "changedFrom": "shadow",
     "changedTo": "on",
     "allOtherTreatmentValuesEqual": true
@@ -29,15 +33,15 @@
     },
     {
       "path": "scripts/phase-tools-evaluation.mjs",
-      "sha256": "5cc8ca065d3c2c0f362529ff782c352b279a2e0b3b4c180b940a945a4d12dbb0"
+      "sha256": "5c72c265181ac44975569482278bf2b1fb859c74440263c84626197257069e0b"
     },
     {
       "path": "tests/phase-tools-evaluation.test.mjs",
-      "sha256": "6a3686db841273e6003279c026a2c7a9907601d457bb42d1f5621577c8f70357"
+      "sha256": "7f264447903ef795834d7f0867add1ad38adf8336d092e1a4506dc977f414e6f"
     },
     {
       "path": "evals/fs5-pilot-protocol.v1.json",
-      "sha256": "39e87e706a87ea3b97344e1185ce46f3ff52c357d84115f93540719c18cdf54c"
+      "sha256": "3e57ca3c46e78bca6967d4670a357d1157af57bb70041a0b8cc46b3fdf18be0d"
     }
   ],
   "localReproducer": {

package/evals/fs5-pilot-protocol.v1.json

@@ -33,7 +33,7 @@
     {
       "id": "task-contract-schema",
       "path": "schemas/task-contract.schema.json",
-      "sha256": "62ea354afb6816b148ae9bd95ffb1ee5e29580eb4a22473e1ae19dbb471ec36b"
+      "sha256": "b936a604db87a697bf69581c33d753e26d9e5e2ccce40bf9c9b2070948f49919"
     },
     {
       "id": "assurance-schema",

package/evals/fs5-pilot-protocol.v4.json

@@ -18,14 +18,14 @@
     { "id": "authority-manifest", "path": "packages/piagent-core/policy/authority-manifest.v1.json", "sha256": "1f073f6d42c093a3182685e0e096144c8b3befd87594aeea1af05ce17653860c" },
     { "id": "canary-suite", "path": "benchmarks/capability-v1/suite.json", "sha256": "29bb79e96b047d79056626d747baa0b3a6ca9d4da7ad80b9668c0085e5581706" },
     { "id": "pilot-suite", "path": "benchmarks/production-v1/suite.json", "sha256": "1ff46984c5ff668647dfad94248cd9dcfb72384a8aa529279345582f90d7486a" },
-    { "id": "task-contract-schema", "path": "schemas/task-contract.schema.json", "sha256": "62ea354afb6816b148ae9bd95ffb1ee5e29580eb4a22473e1ae19dbb471ec36b" },
+    { "id": "task-contract-schema", "path": "schemas/task-contract.schema.json", "sha256": "b936a604db87a697bf69581c33d753e26d9e5e2ccce40bf9c9b2070948f49919" },
     { "id": "assurance-schema", "path": "schemas/benchmark-assurance-evidence.schema.json", "sha256": "5d937632d2cfff34dbbb781dd367bb78feb64c36d571c36ca15f2cc40c576af8" },
-    { "id": "failure-and-operational-classifier", "path": "packages/piagent-core/benchmark/benchmark-forensics.js", "sha256": "976a9908adfd765ee7be0655616f39a44fff64824f5e8535d726082e550b02eb" },
+    { "id": "failure-and-operational-classifier", "path": "packages/piagent-core/benchmark/benchmark-forensics.js", "sha256": "8987775b742f3b3650d75cce84e6d58fcdd3dfb835d03dac4c2bfe6d9eea3a2e" },
     { "id": "phase-attribution", "path": "packages/piagent-core/benchmark/benchmark-phase-attribution.js", "sha256": "9c07bda5bfe7bb7b0959844ccea6790735cc9f154d8d5972e18785148cea6d9a" },
     { "id": "record-validator", "path": "packages/piagent-core/benchmark/benchmark-record-validation.js", "sha256": "37ecc65febe2c5947ac9288ad958bc149e0f08c6beda137edb1c660908853832" },
-    { "id": "timing-diagnostics", "path": "packages/piagent-core/benchmark/benchmark-timing-diagnostics.js", "sha256": "5f52293f4c5c6d8444a35f94c6ccfd9e9183db8c8fa0e755c3da5b0cb847c2aa" },
+    { "id": "timing-diagnostics", "path": "packages/piagent-core/benchmark/benchmark-timing-diagnostics.js", "sha256": "902e886d0920b66811f54d0d1d933d70f8fab8704813b46d578bee6af1f21eef" },
     { "id": "protocol-enforcement", "path": "packages/piagent-core/benchmark/fs5-pilot-protocol.js", "sha256": "2bcc0cf6c18eee0c080c30e727610b0f10a278f5862855d920ba5797f07a2f2d" },
-    { "id": "runner-core", "path": "scripts/benchmark-runner-core.mjs", "sha256": "bf91f69473f48fc3de7c7c55e7ce893ba0511074c4ec930d9f3bcb9615d8e9d5" }
+    { "id": "runner-core", "path": "scripts/benchmark-runner-core.mjs", "sha256": "db97f444db8ba604512daf0aa26b3fe1e2a120ace2b21d4730db5b18aa0c528f" }
   ],
   "runIdentityContract": {
     "required": [

package/evals/fs5-pilot-protocol.v5.json

@@ -18,16 +18,17 @@
     { "id": "authority-manifest", "path": "packages/piagent-core/policy/authority-manifest.v1.json", "sha256": "1f073f6d42c093a3182685e0e096144c8b3befd87594aeea1af05ce17653860c" },
     { "id": "canary-suite", "path": "benchmarks/capability-v1/suite.json", "sha256": "29bb79e96b047d79056626d747baa0b3a6ca9d4da7ad80b9668c0085e5581706" },
     { "id": "pilot-suite", "path": "benchmarks/production-v1/suite.json", "sha256": "1ff46984c5ff668647dfad94248cd9dcfb72384a8aa529279345582f90d7486a" },
-    { "id": "task-contract-schema", "path": "schemas/task-contract.schema.json", "sha256": "62ea354afb6816b148ae9bd95ffb1ee5e29580eb4a22473e1ae19dbb471ec36b" },
+    { "id": "task-contract-schema", "path": "schemas/task-contract.schema.json", "sha256": "b936a604db87a697bf69581c33d753e26d9e5e2ccce40bf9c9b2070948f49919" },
     { "id": "assurance-schema", "path": "schemas/benchmark-assurance-evidence.schema.json", "sha256": "5d937632d2cfff34dbbb781dd367bb78feb64c36d571c36ca15f2cc40c576af8" },
-    { "id": "failure-and-operational-classifier", "path": "packages/piagent-core/benchmark/benchmark-forensics.js", "sha256": "976a9908adfd765ee7be0655616f39a44fff64824f5e8535d726082e550b02eb" },
+    { "id": "failure-and-operational-classifier", "path": "packages/piagent-core/benchmark/benchmark-forensics.js", "sha256": "8987775b742f3b3650d75cce84e6d58fcdd3dfb835d03dac4c2bfe6d9eea3a2e" },
     { "id": "runtime-causal-receipt", "path": "packages/piagent-core/benchmark/benchmark-runtime-causal.js", "sha256": "6057c7bf2f40f8e3db7e293f08d745133c05293b75e9f363fb4e2e53bd09a76a" },
-    { "id": "session-orchestration", "path": "scripts/benchmark-session.mjs", "sha256": "085ef089b37b98361e6e43f16d42413848130ead93756cf6b9a3057a0ad29cb7" },
+    { "id": "session-orchestration", "path": "scripts/benchmark-session.mjs", "sha256": "20a5e1ef1cab3234a888b876b3cec52e702a05bc5ac000b691f94c651beed9ca" },
+    { "id": "session-usage-parser", "path": "scripts/pi-usage-history.mjs", "sha256": "ce4ed1b4a033f2a8cb4632d1336b0867edb3454ce1380f0642c4055149e6ac59" },
     { "id": "phase-attribution", "path": "packages/piagent-core/benchmark/benchmark-phase-attribution.js", "sha256": "9c07bda5bfe7bb7b0959844ccea6790735cc9f154d8d5972e18785148cea6d9a" },
     { "id": "record-validator", "path": "packages/piagent-core/benchmark/benchmark-record-validation.js", "sha256": "37ecc65febe2c5947ac9288ad958bc149e0f08c6beda137edb1c660908853832" },
-    { "id": "timing-diagnostics", "path": "packages/piagent-core/benchmark/benchmark-timing-diagnostics.js", "sha256": "5f52293f4c5c6d8444a35f94c6ccfd9e9183db8c8fa0e755c3da5b0cb847c2aa" },
+    { "id": "timing-diagnostics", "path": "packages/piagent-core/benchmark/benchmark-timing-diagnostics.js", "sha256": "902e886d0920b66811f54d0d1d933d70f8fab8704813b46d578bee6af1f21eef" },
     { "id": "protocol-enforcement", "path": "packages/piagent-core/benchmark/fs5-pilot-protocol.js", "sha256": "2bcc0cf6c18eee0c080c30e727610b0f10a278f5862855d920ba5797f07a2f2d" },
-    { "id": "runner-core", "path": "scripts/benchmark-runner-core.mjs", "sha256": "bf91f69473f48fc3de7c7c55e7ce893ba0511074c4ec930d9f3bcb9615d8e9d5" }
+    { "id": "runner-core", "path": "scripts/benchmark-runner-core.mjs", "sha256": "db97f444db8ba604512daf0aa26b3fe1e2a120ace2b21d4730db5b18aa0c528f" }
   ],
   "runIdentityContract": {
     "required": [

package/evals/harness-next/development-corpus.mjs

@@ -0,0 +1,106 @@
+// Development calibration only. These examples are not a held-out evaluation.
+// Expected values are contract tables, never computed by a candidate program.
+export function data(value) {
+  if (value === null) return { type: "null" };
+  if (value === undefined) return { type: "undefined" };
+  if (value instanceof Date) return { type: "date", value: Number.isNaN(value.getTime()) ? "NaN" : value.getTime() };
+  if (Array.isArray(value)) return { type: "array", value: value.map(data) };
+  if (typeof value === "object") return { type: "record", value: Object.entries(value).map(([key, item]) => ({ key, value: data(item) })) };
+  return { type: typeof value, value: typeof value === "number" && !Number.isFinite(value) ? String(value)
+    : Object.is(value, -0) ? "-0" : value };
+}
+const returns = (value) => ({ outcome: "return", value: data(value) });
+const raises = (errorClass = "TypeError") => ({ outcome: "throw", errorClass });
+const call = (id, args, expected, extra = {}) => ({ id, args: args.map(data), expected, ...extra });
+const contract = (source, cases, exportName = "run") => ({ schemaVersion: 1, source, exportName, checks: [{ id: "specified-behavior", cases }] });
+
+const sumA = `export function run(values) { let sum=0; for(const x of values) {
+  if(typeof x!=='number'||!Number.isFinite(x)) throw new TypeError(); sum+=x; } return sum; }`;
+const sumB = `export const run = xs => { if(xs.some(x=>typeof x!=='number'||!Number.isFinite(x))) throw new TypeError();
+  return xs.reduce((total,x)=>total+x,0); };`;
+const sumCases = [call("empty", [[]], returns(0)), call("signed", [[7, -3, 0, 2]], returns(6)),
+  call("fraction", [[0.5, 0.25]], returns(0.75)), call("invalid-text", [[1, "2"]], raises()), call("invalid-nan", [[NaN]], raises())];
+
+const timeA = `export function run(expiry,now) { const value=expiry instanceof Date?expiry.getTime():expiry;
+  if(typeof value!=='number'||!Number.isFinite(value)||typeof now!=='number'||!Number.isFinite(now)) throw new TypeError();
+  return {expired:now>=value,remaining:Math.max(0,value-now)}; }`;
+const timeB = `export function run(expiry, now) { let end=expiry;
+  if(Object.prototype.toString.call(end)==='[object Date]') end=Number(end);
+  for(const n of [end,now]) if(typeof n!=='number'||!Number.isFinite(n)) throw new TypeError();
+  return now<end?{remaining:end-now,expired:false}:{remaining:0,expired:true}; }`;
+const timeCases = [call("before", [100, 99], returns({ expired: false, remaining: 1 })),
+  call("equal", [100, 100], returns({ expired: true, remaining: 0 })),
+  call("after", [100, 101], returns({ expired: true, remaining: 0 })),
+  call("date", [new Date(100), 99], { ...returns({ expired: false, remaining: 1 }), dateArgsAfter: [{ index: 0, value: 100 }] }),
+  call("invalid-date", [new Date(NaN), 0], raises()), call("invalid-now", [100, NaN], raises()), call("text", ["100", 99], raises())];
+
+// First non-undefined wins; null, false, zero and empty string are explicit values.
+const configA = `export function run(options, environment, defaults) {
+  const pick=key=>options[key]!==undefined?options[key]:environment[key]!==undefined?environment[key]:defaults[key];
+  return {limit:pick('limit'),enabled:pick('enabled'),label:pick('label')}; }`;
+const configB = `export function run(a,b,c) { const out={}; for(const key of ['label','enabled','limit']) {
+  for(const source of [a,b,c]) if(source[key]!==undefined) { out[key]=source[key]; break; }
+  if(!(key in out)) out[key]=undefined; } return out; }`;
+const defaults = { limit: 9, enabled: true, label: "default" };
+const configCases = [call("defaults", [{}, {}, defaults], returns(defaults)),
+  call("false-values", [{ limit: 0, enabled: false, label: "" }, {}, defaults], returns({ limit: 0, enabled: false, label: "" })),
+  call("environment", [{ limit: undefined }, { limit: 3, label: "env" }, defaults], returns({ limit: 3, enabled: true, label: "env" })),
+  call("null", [{ enabled: null, label: null }, { limit: 4 }, defaults], returns({ limit: 4, enabled: null, label: null })),
+  call("missing", [{}, {}, {}], returns({ limit: undefined, enabled: undefined, label: undefined }))];
+
+const ledgerA = `let entries=new Map(), total=0;
+export function apply(id,delta) { if(!entries.has(id)) { entries.set(id,delta); total+=delta; } return total; }
+export const snapshot=()=>({version:1,entries:[...entries],total});
+export function restore(saved) { entries=new Map(saved.entries); total=saved.total; return total; }
+export const read=()=>total;`;
+const ledgerB = `let journal=[]; const total=()=>journal.reduce((s,e)=>s+e[1],0);
+export function apply(id,delta) { if(!journal.some(e=>e[0]===id)) journal.push([id,delta]); return total(); }
+export const snapshot=()=>({total:total(),entries:journal.map(e=>[...e]),version:1});
+export function restore(saved) { journal=saved.entries.map(e=>[...e]); return total(); }
+export const read=()=>total();`;
+const saved = { version: 1, entries: [["x", 7]], total: 7 };
+const ledgerCall = (id, exportName, args, expected, extra = {}) => call(id, args, returns(expected), { sequence: "checkpoint-history", exportName, ...extra });
+const ledgerCases = [ledgerCall("add", "apply", ["x", 7], 7), ledgerCall("saved", "snapshot", [], saved),
+  ledgerCall("later", "apply", ["y", -3], 4), ledgerCall("restart", "read", [], 0, { reset: true }),
+  ledgerCall("restore", "restore", [], 7, { args: [{ type: "result", value: "saved" }], observeArgs: true,
+    expected: { ...returns(7), argsAfter: [data(saved)] } }),
+  ledgerCall("duplicate", "apply", ["x", 7], 7), ledgerCall("new", "apply", ["z", -2], 5),
+  ledgerCall("final", "snapshot", [], { version: 1, entries: [["x", 7], ["z", -2]], total: 5 }),
+  ledgerCall("independent", "read", [], 0, { sequence: "fresh-history" })];
+
+export function developmentCorpus() {
+  const rows = [];
+  const add = (domain, cases, variants) => {
+    for (const [id, expectedVerdict, source, rationale] of variants) rows.push({ id: `${domain}:${id}`, domain, expectedVerdict, rationale, plan: contract(source, cases) });
+  };
+  add("pure-function", sumCases, [
+    ["loop", "pass", sumA, "Finite-number sum, including empty and signed lists."],
+    ["reduction", "pass", sumB, "Equivalent up-front validation and reduction."],
+    ["drops-negative", "fail", sumA.replace("sum+=x", "sum+=Math.max(0,x)"), "Signed-list expected sum is 6, not 9."],
+    ["coerces-text", "fail", "export const run=xs=>xs.reduce((s,x)=>s+Number(x),0)", "String and NaN inputs must throw TypeError."],
+    ["async", "unknown", sumA.replace("export function", "export async function"), "Async result handling is not supported by this backend."]
+  ]);
+  add("temporal-input", timeCases, [
+    ["direct", "pass", timeA, "Inclusive expiry and nonnegative remaining duration."],
+    ["branching", "pass", timeB, "Equivalent branching and Date normalization."],
+    ["strict-boundary", "fail", timeA.replace("now>=value", "now>value"), "Equality is expired."],
+    ["negative-remaining", "fail", timeA.replace("Math.max(0,value-now)", "value-now"), "Remaining duration is clamped after expiry."],
+    ["async", "unknown", timeA.replace("export function", "export async function"), "Async result handling is unsupported."]
+  ]);
+  add("configuration-precedence", configCases, [
+    ["selection", "pass", configA, "Only undefined means inherit."],
+    ["iteration", "pass", configB, "Equivalent explicit source precedence."],
+    ["truthiness", "fail", configA.replace("options[key]!==undefined?options[key]:environment[key]!==undefined?environment[key]:defaults[key]", "options[key]||environment[key]||defaults[key]"), "Falsy and null overrides are explicit."],
+    ["defaults-first", "fail", configA.replace("options[key]!==undefined?options[key]", "defaults[key]!==undefined?defaults[key]"), "Defaults must not override a present option."],
+    ["imports", "unknown", "import fs from 'node:fs'; export const run=()=>fs;", "Closed-module adapter has no import authority."]
+  ]);
+  add("stateful-recovery", ledgerCases, [
+    ["indexed", "pass", ledgerA, "Event IDs are idempotent; restore uses the last saved checkpoint."],
+    ["journal", "pass", ledgerB, "Equivalent journal representation without a cached total."],
+    ["duplicate-applied", "fail", ledgerA.replace("if(!entries.has(id))", "if(true)"), "Replayed x must not add 7 again."],
+    ["dedup-lost", "fail", ledgerA.replace("entries=new Map(saved.entries)", "entries=new Map()"), "Checkpoint must retain applied event IDs."],
+    ["total-lost", "fail", ledgerA.replace("total=saved.total", "total=0"), "Restored total must be 7."],
+    ["async", "unknown", ledgerA.replace("export function apply", "export async function apply"), "Unawaited async observations cannot pass."]
+  ]);
+  return { schemaVersion: 1, id: "harness-next-development-v1", split: "development", heldOut: false, claimEligible: false, rows };
+}

package/evals/harness-next/resource-budget-probe.mjs

@@ -0,0 +1,38 @@
+// Diagnostic only. The host sends this trusted probe to a constrained worker
+// image; candidate source is evaluated exclusively inside its QuickJS realm.
+import { newQuickJSWASMModuleFromVariant } from "quickjs-emscripten-core";
+import variant from "@jitl/quickjs-wasmfile-release-sync";
+import { createGuestSession } from "/executor/guest.mjs";
+import { parseRequest, WORKER_VERSION } from "/executor/protocol.mjs";
+
+let input = "";
+for await (const chunk of process.stdin) {
+  input += chunk;
+  if (Buffer.byteLength(input) > 16384) throw new Error("Probe input limit");
+}
+const { requestText, stallMs } = JSON.parse(input);
+if (![0, 600, 5200].includes(stallMs)) throw new Error("Invalid probe stall");
+const request = parseRequest(requestText);
+if (request.cases.length !== 1) throw new Error("One diagnostic case required");
+const QuickJS = await newQuickJSWASMModuleFromVariant(variant);
+let interrupts = 0, stalled = false;
+const instrumented = { newRuntime() {
+  const runtime = QuickJS.newRuntime(), install = runtime.setInterruptHandler.bind(runtime);
+  runtime.setInterruptHandler = (handler) => install((...args) => {
+    interrupts++;
+    if (stallMs && !stalled) {
+      stalled = true;
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, stallMs);
+    }
+    return handler(...args);
+  });
+  return runtime;
+} };
+const session = createGuestSession(instrumented, request, performance.now() + 5000);
+const cpuStart = process.cpuUsage(), wallStart = performance.now();
+let observation;
+try { observation = session.execute(request.cases[0]); }
+finally { session.dispose(); }
+const cpu = process.cpuUsage(cpuStart);
+process.stdout.write(JSON.stringify({ diagnostic: "resource-budget-probe-v1", workerVersion: WORKER_VERSION,
+  stallMs, stalled, interrupts, elapsedMs: performance.now() - wallStart, cpuMicros: cpu.user + cpu.system, observation }));

package/evals/harness-next/run-calibration.mjs

@@ -0,0 +1,83 @@
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { developmentCorpus } from "./development-corpus.mjs";
+import { selectedDevelopmentCorpus } from "./selected-development-corpus.mjs";
+import { compileIndependentContract, runIndependentContract } from "../../packages/piagent-core/extensions/acceptance-independent-contract.js";
+import { installedContractVerifierDigest } from "../../packages/piagent-core/extensions/acceptance-host-configuration.js";
+
+const hash = (value) => createHash("sha256").update(value).digest("hex");
+const repositoryRoot = path.resolve(import.meta.dirname, "../..");
+
+/** Diagnostic calibration, not a benchmark or completion authority. */
+export async function calibrate({ imageId, dockerSocket, corpus = developmentCorpus(), execute = runIndependentContract } = {}) {
+  const corpusText = JSON.stringify(corpus), verifierDigest = installedContractVerifierDigest(repositoryRoot);
+  const fixed = JSON.parse(corpusText);
+  if (fixed.split !== "development" || fixed.heldOut !== false || fixed.claimEligible !== false || !Array.isArray(fixed.rows)
+    || fixed.rows.length < 1 || fixed.rows.length > 128) throw new Error("Explicit nonempty development corpus required");
+  const ids = new Set();
+  for (const item of fixed.rows) {
+    if (typeof item.id !== "string" || ids.has(item.id) || !["pass", "fail", "unknown"].includes(item.expectedVerdict)) throw new Error("Invalid calibration row");
+    ids.add(item.id); compileIndependentContract(JSON.stringify(item.plan));
+  }
+  const rows = [];
+  for (const item of fixed.rows) {
+    let result;
+    try { result = await execute({ planText: JSON.stringify(item.plan), imageId, dockerSocket }); }
+    catch { result = { verdict: "error", reason: "calibration-execution-threw", checks: [], counterexamples: [] }; }
+    const matched = result.verdict === item.expectedVerdict && result.execution?.status === "completed" && result.execution.cleanupConfirmed === true
+      && (item.expectedVerdict !== "fail" || result.counterexamples?.length > 0);
+    rows.push({ id: item.id, domain: item.domain, expectedVerdict: item.expectedVerdict, rationale: item.rationale,
+      ...(item.selection ? { selection: item.selection } : {}), matched, result });
+  }
+  const count = (predicate) => rows.filter(predicate).length;
+  const summary = { total: rows.length, matched: count((r) => r.matched),
+    falseAcceptance: count((r) => r.expectedVerdict === "fail" && r.result.verdict === "pass"),
+    falseRejection: count((r) => r.expectedVerdict === "pass" && r.result.verdict === "fail"),
+    unexpectedAbstention: count((r) => r.expectedVerdict !== "unknown" && r.result.verdict === "unknown"),
+    unknown: count((r) => r.result.verdict === "unknown"), executorError: count((r) => r.result.verdict === "error"),
+    correctImplementationsPassed: count((r) => r.expectedVerdict === "pass" && r.matched),
+    defectsRejectedWithCounterexamples: count((r) => r.expectedVerdict === "fail" && r.matched) };
+  const verifierCurrent = installedContractVerifierDigest(repositoryRoot) === verifierDigest;
+  return { schemaVersion: 1, kind: "development-calibration", corpusId: fixed.id, corpusDigest: hash(corpusText), verifierDigest,
+    verifierCurrent, imageId, heldOut: false, claimEligible: false, summary, expectationsMatched: verifierCurrent && rows.every((row) => row.matched), rows };
+}
+
+async function main(argv) {
+  const options = {};
+  for (let index = 0; index < argv.length; index += 2) {
+    const key = { "--image-id": "imageId", "--docker-socket": "dockerSocket", "--output": "output", "--families": "families" }[argv[index]];
+    if (!key || options[key] || !argv[index + 1] || argv[index + 1].startsWith("--")) throw new Error("Expected unique --image-id, --docker-socket, --output and optional --families arguments");
+    options[key] = argv[index + 1];
+  }
+  if (!/^sha256:[a-f0-9]{64}$/.test(options.imageId ?? "") || !path.isAbsolute(options.dockerSocket ?? "") || !path.isAbsolute(options.output ?? "")
+    || options.families && !path.isAbsolute(options.families)) {
+    throw new Error("Pinned local image, absolute socket and new absolute output path are required");
+  }
+  // Reserve output before execution; reruns never overwrite diagnostic history.
+  const fd = fs.openSync(options.output, "wx", 0o600);
+  try {
+    let libraryText;
+    if (options.families) {
+      const input = fs.openSync(options.families, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+      try {
+        const stat = fs.fstatSync(input);
+        if (!stat.isFile() || stat.size < 1 || stat.size > 2 * 1024 * 1024) throw new Error("Invalid calibration family library");
+        const bytes = fs.readFileSync(input); libraryText = bytes.toString("utf8");
+        if (bytes.length !== stat.size || !Buffer.from(libraryText).equals(bytes)) throw new Error("Invalid calibration family bytes");
+      } finally { fs.closeSync(input); }
+    }
+    const corpus = options.families ? selectedDevelopmentCorpus(libraryText, {
+      imageId: options.imageId, dockerSocket: options.dockerSocket, timeoutMs: 10000
+    }) : undefined;
+    const report = await calibrate({ ...options, ...(corpus ? { corpus } : {}) });
+    fs.writeFileSync(fd, `${JSON.stringify(report, null, 2)}\n`); fs.fsyncSync(fd);
+    process.stdout.write(`${JSON.stringify({ output: options.output, expectationsMatched: report.expectationsMatched, summary: report.summary, heldOut: false, claimEligible: false })}\n`);
+    if (!report.expectationsMatched) process.exitCode = 1;
+  } finally { fs.closeSync(fd); }
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  main(process.argv.slice(2)).catch((error) => { process.stderr.write(`${error.message}\n`); process.exitCode = 1; });
+}

package/evals/harness-next/run-resource-probe.mjs

@@ -0,0 +1,55 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { isolatedContainerArguments } from "../../packages/piagent-core/extensions/acceptance-isolated-executor.js";
+
+const imageId = process.env.PIAGENT_CONTRACT_EXECUTOR_IMAGE_ID;
+const socket = process.env.PIAGENT_CONTRACT_EXECUTOR_SOCKET;
+assert.match(imageId ?? "", /^sha256:[a-f0-9]{64}$/);
+assert.ok(socket && path.isAbsolute(socket) && fs.statSync(socket).isSocket());
+const probe = fs.readFileSync(new URL("./resource-budget-probe.mjs", import.meta.url), "utf8");
+const probeDigest = createHash("sha256").update(probe).digest("hex");
+const env = { ...process.env };
+for (const key of ["DOCKER_CONTEXT", "DOCKER_HOST", "DOCKER_TLS_VERIFY", "DOCKER_CERT_PATH"]) delete env[key];
+const docker = (args, input) => execFileSync("docker", ["--host", "unix://" + socket, ...args],
+  { env, input, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 15000, maxBuffer: 65536 });
+
+for (const [name, source] of [
+  ["correct-sum", "export const run = (a,b) => a+b;"],
+  ["wrong-sum", "export const run = (a,b) => a-b;"],
+  ["infinite", "export const run = () => { while(true) {} };"]
+]) {
+  for (const stallMs of [0, 600, ...(name === "correct-sum" ? [5200] : [])]) {
+    const runId = randomUUID(), args = isolatedContainerArguments(imageId, runId);
+    // Retain the same watchdog, memory, CPU, filesystem and network limits.
+    // This explicit diagnostic entrypoint cannot produce an acceptance receipt.
+    args.splice(args.length - 1, 0, "--entrypoint", "timeout");
+    args.push("--signal=KILL", "8s", "node", "--max-old-space-size=96", "--input-type=module", "-e", probe);
+    let id;
+    try {
+      id = docker(args).trim();
+      assert.match(id, /^[a-f0-9]{64}$/);
+      const [container] = JSON.parse(docker(["inspect", "--type", "container", id]));
+      assert.equal(container.Image, imageId);
+      assert.equal(container.Config.Labels["io.piagent.contract-execution"], runId);
+      assert.equal(container.Config.User, "65534:65534");
+      assert.equal(container.HostConfig.ReadonlyRootfs, true);
+      assert.equal(container.HostConfig.NetworkMode, "none");
+      assert.deepEqual(container.Mounts, []);
+      const requestText = JSON.stringify({ schemaVersion: 1, source, exportName: "run",
+        cases: [{ id: "sum", args: [{ type: "number", value: 2 }, { type: "number", value: 3 }] }] });
+      const output = JSON.parse(docker(["start", "--attach", "--interactive", id], JSON.stringify({ requestText, stallMs })));
+      assert.equal(output.diagnostic, "resource-budget-probe-v1");
+      process.stdout.write(JSON.stringify({ name, imageId, probeDigest, requestDigest: createHash("sha256").update(requestText).digest("hex"), ...output }) + "\n");
+    } finally {
+      if (id) {
+        const [owned] = JSON.parse(docker(["inspect", "--type", "container", id]));
+        assert.equal(owned.Id, id); assert.equal(owned.Image, imageId);
+        assert.equal(owned.Config.Labels["io.piagent.contract-execution"], runId);
+        assert.equal(docker(["rm", "--force", id]).trim(), id);
+      }
+    }
+  }
+}

package/evals/harness-next/selected-development-corpus.mjs

@@ -0,0 +1,27 @@
+import { createHash } from "node:crypto";
+import { developmentCorpus } from "./development-corpus.mjs";
+import { compileContractSelection } from "../../packages/piagent-core/extensions/acceptance-contract-selection.js";
+
+// Development labels are deliberately reused, never promoted to held-out data.
+// Selection/expectation compilation has no candidate-source or output input.
+export function selectedDevelopmentCorpus(libraryText, backend) {
+  const families = {
+    "pure-function": ["finite-list-sum", { call: "run" }],
+    "temporal-input": ["deadline-status", { call: "run" }],
+    "configuration-precedence": ["defined-config-precedence", { call: "run", numericKey: "limit", booleanKey: "enabled", textKey: "label" }],
+    "stateful-recovery": ["idempotent-accumulator-checkpoint", { apply: "apply", snapshot: "snapshot", restore: "restore", read: "read" }]
+  };
+  const original = developmentCorpus(), rows = original.rows.map((row) => {
+    const [id, parameters] = families[row.domain], text = `Development contract: ${id}`;
+    const preview = compileContractSelection({ libraryText,
+      taskText: JSON.stringify({ operatorRequestDigest: `operator-request-v1:${"a".repeat(64)}`, acceptanceCriteria: [text],
+        acceptanceReceipt: { criteria: [{ id: "development", hash: createHash("sha256").update(text).digest("hex"), obligation: "requested-behavior" }] } }),
+      recipeText: JSON.stringify({ schemaVersion: 1, backend, selections: [{ criterion: { text, obligation: "requested-behavior" },
+        family: { id, version: 1 }, parameters, sourcePath: "candidate.js", maxAttempts: 1 }] })
+    });
+    if (preview.status !== "preview-only" || !preview.plan || preview.unselectedCriteria.length) throw new Error("Development contract selection failed");
+    const contract = preview.plan.contracts[0];
+    return { ...row, selection: contract.selection, plan: { schemaVersion: 1, source: row.plan.source, exportName: contract.exportName, checks: contract.checks } };
+  });
+  return { ...original, id: "harness-next-selected-development-v1", rows };
+}

package/evals/harness-next.v1.json

@@ -0,0 +1,51 @@
+{
+  "schemaVersion": 1,
+  "id": "harness-next-evidence-v1",
+  "status": "implementation-in-progress",
+  "researchDate": "2026-08-30",
+  "baselineCommit": "db4bbca147bb9c6a181a4758239035e95d41504b",
+  "primaryHypotheses": [
+    "verifier-abstention-does-not-authorize-source-repair",
+    "equivalent-implementations-pass-independent-contract-checks",
+    "known-defects-and-forged-evidence-remain-rejected",
+    "durable-verification-does-not-repeat-paid-attempts"
+  ],
+  "offlineGates": {
+    "graderCalibration": {
+      "validFixtures": "retained-correct-plus-independently-labelled-structural-variants",
+      "invalidFixtures": "retained-defects-plus-mutants-with-independent-counterexamples",
+      "report": ["falseAcceptance", "falseRejection", "unknown", "executorError", "unsupportedContract"],
+      "maximumKnownFalseAcceptance": 0,
+      "maximumKnownFalseRejection": 0,
+      "unknownMustNotBeCountedAsPass": true,
+      "equivalentMutantsReportedSeparately": true
+    },
+    "requiredDomains": ["pure-function", "temporal-input", "configuration-precedence", "stateful-recovery"],
+    "requiredAdversaries": [
+      "forged-receipt", "stale-tree", "verifier-drift", "contract-drift", "partial-checks", "duplicate-checks",
+      "counterexample-omitted", "test-tampering", "source-mutation-during-check", "infinite-loop", "memory-exhaustion",
+      "filesystem-access", "network-access", "process-spawn", "cross-run-state-leak", "crash-during-checkpoint"
+    ],
+    "heldOut": {
+      "separateFromDevelopmentFixtures": true,
+      "freezeManifestBeforeCandidateEvaluation": true,
+      "doNotPromoteDiagnosticReplays": true,
+      "reportEveryFailureAndUnknown": true
+    }
+  },
+  "experiments": [
+    { "id": "verification-mechanism", "vary": "assessment-and-independent-verification", "hold": ["model", "thinking", "service-tier", "task-contract", "permission-policy"] },
+    { "id": "recovery-interface", "vary": "bounded-evidence-directed-recovery", "hold": ["verified-correctness-mechanism", "model", "thinking", "permission-policy"] },
+    { "id": "prompt-ablation", "vary": "one-redundant-prompt-group-at-a-time", "after": "correctness-and-recovery-gates", "hold": ["model", "tools-required-for-task", "safety-policy", "release-outcome-floor"] }
+  ],
+  "release": {
+    "requiredCampaign": "production-v2",
+    "requiredSessions": 108,
+    "frozenCandidate": true,
+    "singleOutputLineage": true,
+    "allProviderAttemptsAccounted": true,
+    "closedCampaignsRemainImmutable": true,
+    "requireExistingQualitySafetyEfficiencyGates": true,
+    "zeroEdgeCasesClaimAllowed": false
+  }
+}

package/evals/long-horizon-v1/README.md

@@ -28,3 +28,22 @@ not provider/model context usage. This lane can prove lifecycle durability,
 bounded local-state growth, compaction, continuation enforcement, and stable
 final verification. It cannot prove model quality, token or latency savings,
 90-minute wall-clock behavior, generalization, or release readiness.
+
+## Checkpoint projection and growth
+
+The atomic worker checkpoint is authoritative. Reopening it repairs incomplete
+telemetry and journal projections without rerunning committed units. Progress
+journal entries use the bounded, idempotent append API: one event per committed
+unit, with the original task/session, timestamp and source/digest data. An
+existing key with conflicting content fails; unrelated journal history is not
+replaced. Replaying only the newest unit would lose evidence when a process
+dies between checkpoint commit and projection.
+
+The prior raw-append projection on `ea08496` produced 4,185 progress events for
+90 units (including the two restart prefixes), exceeding the unchanged 2 MiB
+state ceiling. This was a fixture projection defect, not journal corruption.
+The full-unit worker regression now checks exact-once projection, byte growth,
+SIGKILL/resume and committed artifacts at accelerated timing. Existing runner
+tests additionally cover before/after checkpoint crash windows. Accelerated
+tests remain development evidence; the production S0 still requires the
+unchanged 90-unit, at-least-30-minute run.