@sanity/ailf 0.5.0 → 2.0.0

package/dist/pipeline/compiler/sandbox/git-worktree-sandbox.js

@@ -0,0 +1,114 @@
+/**
+ * GitWorktreeSandboxStrategy — sandbox using `git worktree` for repo-based tasks.
+ *
+ * Creates a git worktree at a specific ref, providing a deterministic
+ * starting state for tasks that modify a git repository.
+ *
+ * All git CLI calls use `execFileSync` (array form, no shell) to prevent
+ * injection from task-supplied values like git refs or repo paths.
+ *
+ * @see docs/exec-plans/architecture-overhaul/phase-4-agent-harness.md
+ */
+import { randomUUID } from "crypto";
+import { execFileSync } from "child_process";
+import { existsSync, rmSync } from "fs";
+import { tmpdir } from "os";
+import { resolve } from "path";
+/** Validate a git ref contains no shell metacharacters or path traversal */
+function validateGitRef(ref) {
+    // Git refs: alphanumeric, -, _, /, ., ~, ^ — no spaces, no shell metacharacters
+    if (!/^[a-zA-Z0-9._\-/~^]+$/.test(ref)) {
+        throw new Error(`Invalid git ref: "${ref}" — must contain only alphanumeric, -, _, /, ., ~, ^ characters`);
+    }
+    // Disallow path traversal via ".." segments
+    if (ref.includes("..")) {
+        throw new Error(`Invalid git ref: "${ref}" — must not contain ".." (path traversal)`);
+    }
+}
+export class GitWorktreeSandboxStrategy {
+    name = "Git Worktree";
+    type = "git-worktree";
+    async isAvailable() {
+        try {
+            execFileSync("git", ["--version"], { stdio: "ignore", timeout: 5000 });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async provision(options) {
+        const repoPath = options.repoPath;
+        if (!repoPath) {
+            throw new Error("GitWorktreeSandboxStrategy requires repoPath — " +
+                "the path to the git repository to create a worktree from");
+        }
+        const ref = options.gitRef ?? "HEAD";
+        validateGitRef(ref);
+        const id = `ailf-worktree-${randomUUID().slice(0, 8)}`;
+        const workingDir = resolve(tmpdir(), id);
+        try {
+            // Array form — no shell, prevents injection via repoPath/workingDir/ref
+            execFileSync("git", ["-C", repoPath, "worktree", "add", workingDir, ref], {
+                encoding: "utf-8",
+                timeout: 30_000,
+            });
+            return {
+                id,
+                workingDir,
+                strategy: "git-worktree",
+                gitRef: ref,
+                createdAt: new Date().toISOString(),
+            };
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            throw new Error(`Failed to create git worktree at "${ref}": ${msg}`, {
+                cause: err,
+            });
+        }
+    }
+    async collectArtifacts(sandbox) {
+        const modifiedFiles = [];
+        let diff;
+        if (existsSync(sandbox.workingDir)) {
+            try {
+                diff = execFileSync("git", ["-C", sandbox.workingDir, "diff"], {
+                    encoding: "utf-8",
+                    timeout: 10_000,
+                }).trim();
+                const statusOutput = execFileSync("git", ["-C", sandbox.workingDir, "status", "--porcelain"], { encoding: "utf-8", timeout: 10_000 }).trim();
+                if (statusOutput) {
+                    for (const line of statusOutput.split("\n")) {
+                        const file = line.slice(3).trim();
+                        if (file)
+                            modifiedFiles.push(file);
+                    }
+                }
+            }
+            catch {
+                // Best-effort artifact collection
+            }
+        }
+        return {
+            modifiedFiles,
+            diff: diff || undefined,
+            durationMs: Date.now() - new Date(sandbox.createdAt).getTime(),
+        };
+    }
+    async teardown(sandbox) {
+        if (existsSync(sandbox.workingDir)) {
+            try {
+                execFileSync("git", ["worktree", "remove", sandbox.workingDir, "--force"], { stdio: "ignore", timeout: 10_000 });
+            }
+            catch {
+                // If worktree remove fails, fall back to manual cleanup.
+                // Guard: only delete under tmpdir to prevent accidental deletion.
+                const tmp = resolve(tmpdir());
+                if (resolve(sandbox.workingDir).startsWith(tmp)) {
+                    rmSync(sandbox.workingDir, { recursive: true, force: true });
+                }
+            }
+        }
+    }
+}

package/dist/pipeline/compiler/sandbox/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Sandbox infrastructure — isolated execution environments for agent harness mode.
+ *
+ * @see docs/exec-plans/architecture-overhaul/phase-4-agent-harness.md
+ */
+export type { SandboxArtifacts, SandboxInfo, SandboxProvisionOptions, SandboxStrategy, SandboxType, } from "./sandbox-strategy.js";
+export { DockerSandboxStrategy } from "./docker-sandbox.js";
+export { GitWorktreeSandboxStrategy } from "./git-worktree-sandbox.js";
+export { TempDirSandboxStrategy } from "./tempdir-sandbox.js";
+export { createSandboxStrategy, selectSandboxStrategy, type SandboxSelectionResult, } from "./sandbox-selector.js";

package/dist/pipeline/compiler/sandbox/index.js

@@ -0,0 +1,11 @@
+/**
+ * Sandbox infrastructure — isolated execution environments for agent harness mode.
+ *
+ * @see docs/exec-plans/architecture-overhaul/phase-4-agent-harness.md
+ */
+// Implementations
+export { DockerSandboxStrategy } from "./docker-sandbox.js";
+export { GitWorktreeSandboxStrategy } from "./git-worktree-sandbox.js";
+export { TempDirSandboxStrategy } from "./tempdir-sandbox.js";
+// Selector
+export { createSandboxStrategy, selectSandboxStrategy, } from "./sandbox-selector.js";

package/dist/pipeline/compiler/sandbox/sandbox-selector.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Sandbox selector — chooses the best available sandbox strategy.
+ *
+ * Selection logic:
+ * 1. If task config specifies a strategy, use it
+ * 2. If Docker is available, prefer Docker (better isolation)
+ * 3. Fall back to TempDir (always available)
+ *
+ * CI environments (detected via CI env var) always prefer Docker.
+ *
+ * @see docs/exec-plans/architecture-overhaul/phase-4-agent-harness.md
+ */
+import type { SandboxStrategy, SandboxType } from "./sandbox-strategy.js";
+/** Result of sandbox selection */
+export interface SandboxSelectionResult {
+    /** The selected strategy */
+    strategy: SandboxStrategy;
+    /** Whether this was a fallback from the preferred strategy */
+    isFallback: boolean;
+    /** Warning message if fallback was used */
+    warning?: string;
+}
+/**
+ * Select the best available sandbox strategy.
+ *
+ * @param preferred - Preferred sandbox type from task config
+ * @param log - Optional log function for diagnostics
+ * @returns The selected strategy with fallback metadata
+ */
+export declare function selectSandboxStrategy(preferred?: SandboxType, log?: (msg: string) => void): Promise<SandboxSelectionResult>;
+/**
+ * Create a specific sandbox strategy by type.
+ * Does NOT check availability — caller should verify first.
+ */
+export declare function createSandboxStrategy(type: SandboxType): SandboxStrategy;

package/dist/pipeline/compiler/sandbox/sandbox-selector.js

@@ -0,0 +1,86 @@
+/**
+ * Sandbox selector — chooses the best available sandbox strategy.
+ *
+ * Selection logic:
+ * 1. If task config specifies a strategy, use it
+ * 2. If Docker is available, prefer Docker (better isolation)
+ * 3. Fall back to TempDir (always available)
+ *
+ * CI environments (detected via CI env var) always prefer Docker.
+ *
+ * @see docs/exec-plans/architecture-overhaul/phase-4-agent-harness.md
+ */
+import { DockerSandboxStrategy } from "./docker-sandbox.js";
+import { GitWorktreeSandboxStrategy } from "./git-worktree-sandbox.js";
+import { TempDirSandboxStrategy } from "./tempdir-sandbox.js";
+// ---------------------------------------------------------------------------
+// Strategy registry
+// ---------------------------------------------------------------------------
+const strategies = {
+    docker: () => new DockerSandboxStrategy(),
+    "git-worktree": () => new GitWorktreeSandboxStrategy(),
+    none: () => new TempDirSandboxStrategy(), // "none" = tempdir
+    tempdir: () => new TempDirSandboxStrategy(),
+};
+/**
+ * Select the best available sandbox strategy.
+ *
+ * @param preferred - Preferred sandbox type from task config
+ * @param log - Optional log function for diagnostics
+ * @returns The selected strategy with fallback metadata
+ */
+export async function selectSandboxStrategy(preferred, log) {
+    const emit = log ?? (() => { });
+    // If a specific strategy is requested, try it first
+    if (preferred && preferred !== "none") {
+        const strategy = strategies[preferred]();
+        const available = await strategy.isAvailable();
+        if (available) {
+            emit(`Using ${strategy.name} sandbox strategy (requested)`);
+            return { strategy, isFallback: false };
+        }
+        emit(`${strategy.name} is not available, falling back...`);
+    }
+    // CI environments prefer Docker
+    const isCI = Boolean(process.env.CI || process.env.GITHUB_ACTIONS);
+    if (isCI) {
+        const docker = new DockerSandboxStrategy();
+        if (await docker.isAvailable()) {
+            emit("Using Docker sandbox strategy (CI environment)");
+            return { strategy: docker, isFallback: preferred !== "docker" };
+        }
+    }
+    // Default fallback: Docker → TempDir
+    const docker = new DockerSandboxStrategy();
+    if (await docker.isAvailable()) {
+        emit("Using Docker sandbox strategy (auto-detected)");
+        return {
+            strategy: docker,
+            isFallback: preferred !== undefined && preferred !== "docker",
+            ...(preferred && preferred !== "docker"
+                ? {
+                    warning: `Preferred sandbox "${preferred}" unavailable, using Docker instead`,
+                }
+                : {}),
+        };
+    }
+    // Universal fallback
+    const tempdir = new TempDirSandboxStrategy();
+    emit("Using TempDir sandbox strategy (fallback)");
+    return {
+        strategy: tempdir,
+        isFallback: preferred !== undefined && preferred !== "tempdir",
+        ...(preferred && preferred !== "tempdir" && preferred !== "none"
+            ? {
+                warning: `Preferred sandbox "${preferred}" unavailable, using temp directory instead`,
+            }
+            : {}),
+    };
+}
+/**
+ * Create a specific sandbox strategy by type.
+ * Does NOT check availability — caller should verify first.
+ */
+export function createSandboxStrategy(type) {
+    return strategies[type]();
+}

package/dist/pipeline/compiler/sandbox/sandbox-strategy.d.ts

@@ -0,0 +1,81 @@
+/**
+ * SandboxStrategy — port interface for isolated agent execution environments.
+ *
+ * Three implementations, selected by task config with automatic fallback:
+ *
+ * - DockerSandboxStrategy — full isolation via Docker containers
+ * - TempDirSandboxStrategy — lightweight fallback using OS temp directories
+ * - GitWorktreeSandboxStrategy — uses `git worktree` for repo-based tasks
+ *
+ * Selection: task config specifies preferred strategy; runtime falls back
+ * Docker → TempDir if Docker is unavailable. CI environments prefer Docker.
+ *
+ * @see docs/exec-plans/architecture-overhaul/phase-4-agent-harness.md
+ */
+/** Metadata describing a provisioned sandbox */
+export interface SandboxInfo {
+    /** Unique sandbox identifier */
+    id: string;
+    /** Absolute path to the sandbox working directory */
+    workingDir: string;
+    /** Which strategy created this sandbox */
+    strategy: SandboxType;
+    /** Docker container ID (when strategy is "docker") */
+    containerId?: string;
+    /** Git worktree ref (when strategy is "git-worktree") */
+    gitRef?: string;
+    /** Timestamp when the sandbox was provisioned */
+    createdAt: string;
+}
+/** Supported sandbox strategies */
+export type SandboxType = "docker" | "git-worktree" | "none" | "tempdir";
+/** Configuration for sandbox provisioning */
+export interface SandboxProvisionOptions {
+    /** Sandbox type to use */
+    type: SandboxType;
+    /** Task ID (used for naming) */
+    taskId: string;
+    /** Docker image (for docker strategy) */
+    image?: string;
+    /** Resource limits */
+    limits?: {
+        cpus?: number;
+        memoryBytes?: number;
+        diskBytes?: number;
+        networkAccess?: boolean;
+    };
+    /** Git ref for git-worktree strategy */
+    gitRef?: string;
+    /** Git repo path for git-worktree strategy */
+    repoPath?: string;
+}
+/** Artifacts collected from sandbox after execution */
+export interface SandboxArtifacts {
+    /** Files modified during execution (relative paths) */
+    modifiedFiles: string[];
+    /** Git diff output (if applicable) */
+    diff?: string;
+    /** Stdout/stderr captured during execution */
+    output?: string;
+    /** Total execution time in milliseconds */
+    durationMs: number;
+}
+/**
+ * Port interface for sandbox lifecycle management.
+ *
+ * Implementations handle the full lifecycle: provision → use → collect → teardown.
+ */
+export interface SandboxStrategy {
+    /** Human-readable strategy name */
+    readonly name: string;
+    /** Strategy type identifier */
+    readonly type: SandboxType;
+    /** Check if this strategy is available in the current environment */
+    isAvailable(): Promise<boolean>;
+    /** Provision a new sandbox environment */
+    provision(options: SandboxProvisionOptions): Promise<SandboxInfo>;
+    /** Collect artifacts from the sandbox after execution */
+    collectArtifacts(sandbox: SandboxInfo): Promise<SandboxArtifacts>;
+    /** Tear down the sandbox (remove files, stop containers) */
+    teardown(sandbox: SandboxInfo): Promise<void>;
+}

package/dist/pipeline/compiler/sandbox/sandbox-strategy.js

@@ -0,0 +1,15 @@
+/**
+ * SandboxStrategy — port interface for isolated agent execution environments.
+ *
+ * Three implementations, selected by task config with automatic fallback:
+ *
+ * - DockerSandboxStrategy — full isolation via Docker containers
+ * - TempDirSandboxStrategy — lightweight fallback using OS temp directories
+ * - GitWorktreeSandboxStrategy — uses `git worktree` for repo-based tasks
+ *
+ * Selection: task config specifies preferred strategy; runtime falls back
+ * Docker → TempDir if Docker is unavailable. CI environments prefer Docker.
+ *
+ * @see docs/exec-plans/architecture-overhaul/phase-4-agent-harness.md
+ */
+export {};

package/dist/pipeline/compiler/sandbox/tempdir-sandbox.d.ts

@@ -0,0 +1,20 @@
+/**
+ * TempDirSandboxStrategy — lightweight sandbox using OS temp directories.
+ *
+ * Creates a temporary directory for each test case, provides it as
+ * the working directory, and cleans up after execution. No isolation
+ * guarantees — the agent has full access to the host filesystem.
+ *
+ * This is the universal fallback when Docker is unavailable.
+ *
+ * @see docs/exec-plans/architecture-overhaul/phase-4-agent-harness.md
+ */
+import type { SandboxArtifacts, SandboxInfo, SandboxProvisionOptions, SandboxStrategy } from "./sandbox-strategy.js";
+export declare class TempDirSandboxStrategy implements SandboxStrategy {
+    readonly name = "Temporary Directory";
+    readonly type: "tempdir";
+    isAvailable(): Promise<boolean>;
+    provision(options: SandboxProvisionOptions): Promise<SandboxInfo>;
+    collectArtifacts(sandbox: SandboxInfo): Promise<SandboxArtifacts>;
+    teardown(sandbox: SandboxInfo): Promise<void>;
+}

package/dist/pipeline/compiler/sandbox/tempdir-sandbox.js

@@ -0,0 +1,74 @@
+/**
+ * TempDirSandboxStrategy — lightweight sandbox using OS temp directories.
+ *
+ * Creates a temporary directory for each test case, provides it as
+ * the working directory, and cleans up after execution. No isolation
+ * guarantees — the agent has full access to the host filesystem.
+ *
+ * This is the universal fallback when Docker is unavailable.
+ *
+ * @see docs/exec-plans/architecture-overhaul/phase-4-agent-harness.md
+ */
+import { randomUUID } from "crypto";
+import { existsSync, mkdirSync, readdirSync, rmSync } from "fs";
+import { tmpdir } from "os";
+import { resolve } from "path";
+export class TempDirSandboxStrategy {
+    name = "Temporary Directory";
+    type = "tempdir";
+    async isAvailable() {
+        // Always available — every OS has a temp directory
+        return true;
+    }
+    async provision(options) {
+        // Include sanitized taskId for debugging (strip non-alphanumeric for safety)
+        const safeTaskId = (options.taskId ?? "anon")
+            .replace(/[^a-zA-Z0-9_-]/g, "")
+            .slice(0, 20);
+        const id = `ailf-sandbox-${safeTaskId}-${randomUUID().slice(0, 8)}`;
+        const workingDir = resolve(tmpdir(), id);
+        mkdirSync(workingDir, { recursive: true });
+        return {
+            id,
+            workingDir,
+            strategy: "tempdir",
+            createdAt: new Date().toISOString(),
+        };
+    }
+    async collectArtifacts(sandbox) {
+        const modifiedFiles = [];
+        if (existsSync(sandbox.workingDir)) {
+            collectFilesRecursive(sandbox.workingDir, "", modifiedFiles);
+        }
+        return {
+            modifiedFiles,
+            durationMs: Date.now() - new Date(sandbox.createdAt).getTime(),
+        };
+    }
+    async teardown(sandbox) {
+        const workDir = resolve(sandbox.workingDir);
+        // Guard: only delete directories under os.tmpdir() to prevent
+        // accidental deletion if workingDir is corrupted
+        if (existsSync(workDir) && workDir.startsWith(resolve(tmpdir()))) {
+            rmSync(workDir, { recursive: true, force: true });
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function collectFilesRecursive(dir, prefix, files, maxDepth = 20) {
+    if (maxDepth <= 0)
+        return;
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+        if (entry.isSymbolicLink())
+            continue; // Skip symlinks to prevent traversal
+        const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
+        if (entry.isDirectory()) {
+            collectFilesRecursive(resolve(dir, entry.name), relative, files, maxDepth - 1);
+        }
+        else {
+            files.push(relative);
+        }
+    }
+}

package/dist/pipeline/compiler/scoring-bridge.d.ts

@@ -0,0 +1,49 @@
+/**
+ * scoring-bridge.ts — Bridge between Promptfoo raw results and the
+ * 4-tier scoring engine.
+ *
+ * Converts Promptfoo `ComponentResult[]` (from test results) into the
+ * scoring engine's `AssertionScore[]` format, then delegates aggregation
+ * to `aggregateDimensions` and `computeTaskScore` from core.
+ *
+ * This bridge replaces the three legacy scoring primitives in
+ * `calculate-scores.ts`:
+ *   - `accumulateDimensions`  → `convertToAssertionScores` + `aggregateDimensions`
+ *   - `averageDimensions`     → (handled internally by `aggregateDimensions`)
+ *   - `weightedComposite`     → `computeTaskScore`
+ *
+ * The bridge preserves the existing 0–100 output scale. The 4-tier
+ * engine works in [0, 1]; this module handles the conversion at
+ * boundaries.
+ *
+ * @see packages/core/src/services/scoring-engine.ts — the 4-tier engine
+ * @see packages/eval/src/pipeline/calculate-scores.ts — the consumer
+ * @see docs/exec-plans/architecture-overhaul/phase-7-migrate-literacy.md
+ */
+import { type DimensionScore } from "../../_vendor/ailf-core/index.d.ts";
+import type { TestResult } from "../../_vendor/ailf-core/index.d.ts";
+/** Result of scoring a group of tests via the 4-tier engine */
+export interface BridgedScoreResult {
+    /** Per-dimension breakdown (0–100 scale) */
+    dimensions: Record<string, number>;
+    /** Weighted composite score (0–100 scale) */
+    composite: number;
+    /** Total cost across all tests */
+    totalCost: number;
+    /** Raw DimensionScore objects from the engine (0–1 scale) */
+    rawDimensions: DimensionScore[];
+}
+/**
+ * Score a group of test results using the 4-tier scoring engine.
+ *
+ * This replaces the legacy `accumulateDimensions → averageDimensions →
+ * weightedComposite` chain with the new engine's `aggregateDimensions →
+ * computeTaskScore` chain.
+ *
+ * @param tests    Pre-filtered test results (e.g., all gold or all baseline)
+ * @param profile  Weight profile mapping kebab-case dimension names to weights
+ *                 (e.g., `{ "task-completion": 0.4, "code-correctness": 0.35, "doc-coverage": 0.25 }`)
+ * @param taskId   Optional task identifier for traceability in TaskScore output
+ * @returns        Dimensions (0–100) and composite (0–100), matching legacy output format
+ */
+export declare function scoreTestGroup(tests: TestResult[], profile: Record<string, number>, taskId?: string): BridgedScoreResult;

package/dist/pipeline/compiler/scoring-bridge.js

@@ -0,0 +1,114 @@
+/**
+ * scoring-bridge.ts — Bridge between Promptfoo raw results and the
+ * 4-tier scoring engine.
+ *
+ * Converts Promptfoo `ComponentResult[]` (from test results) into the
+ * scoring engine's `AssertionScore[]` format, then delegates aggregation
+ * to `aggregateDimensions` and `computeTaskScore` from core.
+ *
+ * This bridge replaces the three legacy scoring primitives in
+ * `calculate-scores.ts`:
+ *   - `accumulateDimensions`  → `convertToAssertionScores` + `aggregateDimensions`
+ *   - `averageDimensions`     → (handled internally by `aggregateDimensions`)
+ *   - `weightedComposite`     → `computeTaskScore`
+ *
+ * The bridge preserves the existing 0–100 output scale. The 4-tier
+ * engine works in [0, 1]; this module handles the conversion at
+ * boundaries.
+ *
+ * @see packages/core/src/services/scoring-engine.ts — the 4-tier engine
+ * @see packages/eval/src/pipeline/calculate-scores.ts — the consumer
+ * @see docs/exec-plans/architecture-overhaul/phase-7-migrate-literacy.md
+ */
+import { aggregateDimensions, computeTaskScore, normalizeScore, } from "../../_vendor/ailf-core/index.js";
+import { classifyRubric, parseRubricScore } from "../../_vendor/ailf-core/index.js";
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Score a group of test results using the 4-tier scoring engine.
+ *
+ * This replaces the legacy `accumulateDimensions → averageDimensions →
+ * weightedComposite` chain with the new engine's `aggregateDimensions →
+ * computeTaskScore` chain.
+ *
+ * @param tests    Pre-filtered test results (e.g., all gold or all baseline)
+ * @param profile  Weight profile mapping kebab-case dimension names to weights
+ *                 (e.g., `{ "task-completion": 0.4, "code-correctness": 0.35, "doc-coverage": 0.25 }`)
+ * @param taskId   Optional task identifier for traceability in TaskScore output
+ * @returns        Dimensions (0–100) and composite (0–100), matching legacy output format
+ */
+export function scoreTestGroup(tests, profile, taskId) {
+    let totalCost = 0;
+    // Step 1: Convert all ComponentResults into AssertionScore[] (0–1 scale)
+    const assertionScores = [];
+    for (const test of tests) {
+        totalCost += test.cost;
+        for (const comp of test.gradingResult.componentResults) {
+            if (comp.assertion?.type !== "llm-rubric")
+                continue;
+            const converted = componentToAssertionScore(comp);
+            if (converted)
+                assertionScores.push(converted);
+        }
+    }
+    // Step 2: Aggregate into DimensionScores (0–1 scale)
+    const dimensionLabels = {
+        "code-correctness": "Code Correctness",
+        "doc-coverage": "Doc Coverage",
+        "task-completion": "Task Completion",
+    };
+    const rawDimensions = aggregateDimensions(assertionScores, {
+        defaultAggregation: "mean",
+        dimensionLabels,
+    });
+    // Step 3: Compute weighted composite via TaskScore (0–1 scale)
+    const taskScoreResult = computeTaskScore(rawDimensions, {
+        taskId: taskId ?? "aggregate",
+        weights: profile,
+        weightSource: "scoring-bridge",
+    });
+    // Step 4: Convert back to 0–100 scale for legacy compatibility
+    const dimensions = {};
+    for (const dim of rawDimensions) {
+        // Map kebab-case dimension IDs to camelCase for legacy compatibility
+        const camelKey = kebabToCamel(dim.dimensionId);
+        dimensions[camelKey] = Math.round(dim.score * 100);
+    }
+    return {
+        composite: Math.round(taskScoreResult.score * 100),
+        dimensions,
+        rawDimensions,
+        totalCost,
+    };
+}
+// ---------------------------------------------------------------------------
+// Conversion helpers
+// ---------------------------------------------------------------------------
+/**
+ * Convert a single Promptfoo ComponentResult into the scoring engine's
+ * AssertionScore format.
+ *
+ * Returns null if the component doesn't map to a known dimension.
+ */
+function componentToAssertionScore(comp) {
+    const dim = classifyRubric(comp);
+    if (!dim)
+        return null;
+    // Parse the raw score (0–100 from the grader) and normalize to [0, 1]
+    const rawScore = parseRubricScore(comp);
+    const normalized = normalizeScore(rawScore, "llm-rubric");
+    return {
+        assertionType: comp.assertion?.type ?? "llm-rubric",
+        dimension: dim,
+        latencyMs: 0,
+        pass: comp.pass,
+        reason: comp.reason ?? "",
+        score: normalized,
+        weight: 1.0,
+    };
+}
+/** Convert kebab-case dimension key to camelCase (e.g., "task-completion" → "taskCompletion") */
+function kebabToCamel(kebab) {
+    return kebab.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
+}

package/dist/pipeline/compiler/task-graph-builder.d.ts

@@ -0,0 +1,54 @@
+/**
+ * TaskGraphBuilder — converts task definitions into a TaskGraph IR.
+ *
+ * The builder is the first stage of the compilation pipeline:
+ *   GeneralizedTaskDefinitions → TaskGraphBuilder → TaskGraph → PromptfooCompiler → YAML
+ *
+ * Responsibilities:
+ * - Accept tasks from any source (TS, YAML, Content Lake)
+ * - Apply area/tag/mode filtering
+ * - Resolve inter-task dependencies into edges
+ * - Validate the graph is a DAG (reject cycles)
+ * - Assign execution priority via topological sort
+ *
+ * This module exists alongside `generate-configs.ts` — it does NOT replace
+ * the existing codegen path. Phase 7 will swap callers over to the compiler.
+ *
+ * @see packages/core/src/types/task-graph.ts — TaskGraph types
+ * @see docs/exec-plans/architecture-overhaul/phase-2-config-compiler.md
+ */
+import type { DependencyEdge, FilterOptions, GeneralizedTaskDefinition, TaskGraph, TaskNode } from "../../_vendor/ailf-core/index.d.ts";
+/** Options for building a task graph */
+export interface TaskGraphBuildOptions {
+    /** Task definitions from any source */
+    tasks: GeneralizedTaskDefinition[];
+    /** Optional filter to narrow task set */
+    filter?: FilterOptions;
+    /** Compilation target backend */
+    compilationTarget?: "custom" | "promptfoo";
+}
+/** Result of building a task graph */
+export interface TaskGraphBuildResult {
+    /** The built graph (null if no tasks survived filtering) */
+    graph: TaskGraph | null;
+    /** Warnings emitted during build (non-fatal) */
+    warnings: string[];
+    /** Tasks that were filtered out */
+    filteredOut: string[];
+}
+/**
+ * Build a TaskGraph from task definitions.
+ *
+ * 1. Filters tasks by area, tags, task IDs, and status
+ * 2. Creates TaskNodes with resolved variables
+ * 3. Discovers dependency edges from task metadata
+ * 4. Validates the graph is acyclic
+ * 5. Assigns topological priority
+ */
+export declare function buildTaskGraph(options: TaskGraphBuildOptions): TaskGraphBuildResult;
+/**
+ * Detect cycles in the task graph using Kahn's algorithm.
+ *
+ * @returns null if acyclic, or the cycle path as a string array
+ */
+export declare function detectCycle(nodes: Map<string, TaskNode>, edges: DependencyEdge[]): string[] | null;