@sanity/ailf 2.7.1 → 2.9.0

package/dist/composition-root.js

@@ -16,11 +16,14 @@
  * @see docs/archive/exec-plans/ports-and-adapters/phase-7-composition-root.md
  */
 import { join } from "node:path";
-import { InMemoryPluginRegistry, NoOpArtifactCollector, } from "./_vendor/ailf-core/index.js";
-import { ApiGatewayArtifactUploader } from "./artifact-capture/api-gateway-artifact-uploader.js";
+import { InMemoryPluginRegistry, NoOpArtifactCollector, NoOpArtifactWriter, generateRunId, isArtifactType, } from "./_vendor/ailf-core/index.js";
+import { AccumulatingArtifactWriter } from "./artifact-capture/accumulating-artifact-writer.js";
+import { ApiGatewayArtifactWriter } from "./artifact-capture/api-gateway-artifact-writer.js";
+import { FanoutArtifactWriter } from "./artifact-capture/fanout-artifact-writer.js";
 import { FilesystemArtifactCollector } from "./artifact-capture/filesystem-collector.js";
 import { GcsArtifactCollector } from "./artifact-capture/gcs-collector.js";
-import { GcsReportArtifactUploader } from "./artifact-capture/gcs-report-artifact-uploader.js";
+import { GcsArtifactWriter } from "./artifact-capture/gcs-artifact-writer.js";
+import { LocalFilesystemArtifactWriter } from "./artifact-capture/local-fs-artifact-writer.js";
 import { ContentLakeCacheAdapter } from "./adapters/cache/content-lake-cache.js";
 import { loadExternalPresets } from "./pipeline/compiler/preset-loader.js";
 import { FilesystemCache } from "./adapters/cache/filesystem-cache.js";
@@ -82,13 +85,17 @@ export function createAppContext(config) {
             })
             : fsCollector;
     }
-    // Report artifact uploader — uploads structured files to GCS at known
-    // paths for Studio to fetch via signed URLs (D0030). Auto-detects the
-    // right adapter from available credentials; defaults bucket to
-    // "ailf-artifacts". Set artifactUpload: false to opt out entirely.
-    const artifactUploader = createArtifactUploader(config, logger);
+    // Artifact writer — writes run artifacts + manifest to GCS at known
+    // `runs/{runId}/…` paths (D0032). Auto-detects the right adapter from
+    // available credentials; defaults bucket to "ailf-artifacts". Set
+    // artifactUpload: false to opt out entirely.
+    const artifactWriter = createArtifactWriter(config, logger);
+    // Generate the pipeline's RunId once; every downstream step reads it
+    // from the context (D0032).
+    const runId = generateRunId();
+    logger.debug(`Pipeline runId: ${runId}`);
     return {
-        artifactUploader,
+        artifactWriter,
         cache,
         collector,
         config,
@@ -97,6 +104,7 @@ export function createAppContext(config) {
         logger,
         registry,
         reportStore,
+        runId,
         sinks,
         taskSource,
     };
@@ -124,44 +132,95 @@ function createLogger() {
  */
 const DEFAULT_ARTIFACT_BUCKET = "ailf-artifacts";
 /**
- * Selects an ArtifactUploader implementation based on available credentials.
+ * D0033 M4 default root for local artifacts when `--artifacts-dir` is unset.
+ * Mirrors the pre-W0050 capture root so existing dev tooling (Studio
+ * retrieval, CI archivers) keeps finding files at the same path prefix.
+ */
+const DEFAULT_LOCAL_ARTIFACTS_DIR = ".ailf/results/captures";
+/**
+ * Selects the `ArtifactWriter` wiring per D0033 M4:
  *
- * Selection order:
- *   1. config.artifactUpload === false → always skip (explicit opt-out)
- *   2. GOOGLE_APPLICATION_CREDENTIALS or GCLOUD_PROJECT present → direct GCS
- *   3. apiKey + apiUrl present → gateway-signed PUT URL
- *   4. Neither → skip silently (P5)
+ *   1. `--no-artifacts` (`config.artifactsDisabled === true`, or legacy
+ *      `config.artifactUpload === false`) → `NoOpArtifactWriter`.
+ *   2. Otherwise: always attach `LocalFilesystemArtifactWriter` under
+ *      `--artifacts-dir` (default `.ailf/results/captures`).
+ *   3. When a remote backend is reachable (ADC, GCLOUD_PROJECT, or an
+ *      AILF API key + URL), layer it via `FanoutArtifactWriter([local, gcs])`.
+ *      Local is listed first so a local success + remote failure still
+ *      produces a non-null ref.
  *
- * The bucket defaults to DEFAULT_ARTIFACT_BUCKET when not explicitly set —
- * users only need to override for self-hosted deployments with a different
- * bucket (and matching gateway signing credentials).
+ * Always returns a writer — pipeline code can assume `ctx.artifactWriter`
+ * is present. Producers post-W0050 drop their `if (ctx.artifactWriter)`
+ * guards in Slice 6.
  *
  * Exported for unit-test access; not part of the public package API.
  */
-export function createArtifactUploader(config, logger) {
-    if (config.artifactUpload === false) {
-        logger.debug("Artifact upload explicitly disabled via artifactUpload=false");
-        return undefined;
+export function createArtifactWriter(config, logger) {
+    // Legacy `artifactUpload: false` still disables — treat as an alias for
+    // the canonical `artifactsDisabled: true` until W0052 removes it.
+    if (config.artifactsDisabled === true || config.artifactUpload === false) {
+        logger.debug("Artifact writer: NoOpArtifactWriter (--no-artifacts / artifactsDisabled / artifactUpload=false)");
+        return new NoOpArtifactWriter();
+    }
+    const exclude = resolveExcludeList(config.artifactsExclude, logger);
+    const rootDir = config.artifactsDir ?? DEFAULT_LOCAL_ARTIFACTS_DIR;
+    const local = new LocalFilesystemArtifactWriter({ rootDir, exclude });
+    const remote = createRemoteArtifactWriter(config, logger);
+    const base = remote
+        ? new FanoutArtifactWriter([local, remote])
+        : local;
+    if (!remote) {
+        logger.debug(`Artifact writer: LocalFilesystemArtifactWriter only (rootDir=${rootDir})`);
+    }
+    else {
+        logger.debug(`Artifact writer: FanoutArtifactWriter([local=${rootDir}, ${remote.constructor.name}])`);
     }
+    // Wrap in the accumulator so FinalizeRunStep can build a populated
+    // RunManifest without each producer bookkeeping its own ArtifactRefs
+    // (W0051 Slice 3 revisit — Option B of the "manifest empty on real runs"
+    // fix).
+    return new AccumulatingArtifactWriter(base);
+}
+/**
+ * Validate the exclude list against the registry. Unknown types are dropped
+ * with a warning — a typo'd CLI flag shouldn't silently match nothing.
+ */
+function resolveExcludeList(raw, logger) {
+    if (!raw || raw.length === 0)
+        return [];
+    const valid = [];
+    for (const name of raw) {
+        if (isArtifactType(name)) {
+            valid.push(name);
+        }
+        else {
+            logger.warn(`--capture-exclude: "${name}" is not a known artifact type — ignored`);
+        }
+    }
+    return valid;
+}
+/**
+ * The optional remote-backend writer layered on top of the local writer.
+ * Returns null when no credentials are available — the local writer stays
+ * the sole backend for that run, which is the D0033 M4 default for laptops
+ * and CI without GCS creds.
+ */
+function createRemoteArtifactWriter(config, logger) {
     const bucket = config.artifactGcsBucket ?? DEFAULT_ARTIFACT_BUCKET;
-    // CI / GCP runtime — direct GCS upload (fastest, no extra hop).
-    // We treat the presence of either env var as the user opting in to ADC.
     const hasGcsCredentials = Boolean(process.env.GOOGLE_APPLICATION_CREDENTIALS || process.env.GCLOUD_PROJECT);
     if (hasGcsCredentials) {
-        logger.debug(`Artifact uploader: GcsReportArtifactUploader (direct GCS via ADC, bucket=${bucket})`);
-        return new GcsReportArtifactUploader({ bucket });
+        logger.debug(`Artifact remote backend: GcsArtifactWriter (ADC, bucket=${bucket})`);
+        return new GcsArtifactWriter({ bucket });
     }
-    // Local dev — request signed PUT URLs from the API gateway, no GCS creds needed.
     if (config.apiKey && config.apiUrl) {
-        logger.debug(`Artifact uploader: ApiGatewayArtifactUploader (signed URL via ${config.apiUrl}, bucket=${bucket})`);
-        return new ApiGatewayArtifactUploader({
+        logger.debug(`Artifact remote backend: ApiGatewayArtifactWriter (via ${config.apiUrl}, bucket=${bucket})`);
+        return new ApiGatewayArtifactWriter({
             apiBaseUrl: config.apiUrl,
             apiKey: config.apiKey,
             bucket,
         });
     }
-    logger.debug("Artifact upload skipped: no GCS credentials or AILF_API_KEY available");
-    return undefined;
+    return null;
 }
 function createCache(config) {
     const local = new FilesystemCache(config.rootDir);

package/dist/orchestration/build-step-sequence.js

@@ -11,6 +11,7 @@ import { CalculateScoresStep } from "./steps/calculate-scores-step.js";
 import { CompareStep } from "./steps/compare-step.js";
 import { DiscoveryReportStep } from "./steps/discovery-report-step.js";
 import { FetchDocsStep } from "./steps/fetch-docs-step.js";
+import { FinalizeRunStep } from "./steps/finalize-run-step.js";
 import { GapAnalysisStep } from "./steps/gap-analysis-step.js";
 import { GenerateConfigsStep } from "./steps/generate-configs-step.js";
 import { GraderConsistencyStep } from "./steps/grader-consistency-step.js";
@@ -76,7 +77,11 @@ export function buildStepSequence(ctx, pipelineStart = Date.now()) {
     if (config.gapAnalysisEnabled) {
         steps.push(new GapAnalysisStep());
     }
-    // Step 4b: Publish report (optional, when token is configured)
+    // Step 4c: Finalize the run — write `runs/{runId}/manifest.json` with the
+    // catalog of artifacts produced so far. Skipped silently when no
+    // artifactWriter is wired (D0032).
+    steps.push(new FinalizeRunStep(pipelineStart));
+    // Step 4d: Publish report (optional, when token is configured)
     if (config.publishEnabled) {
         steps.push(new PublishReportStep(pipelineStart, {
             publishTag: config.publishTag,

package/dist/orchestration/pipeline-orchestrator.d.ts

@@ -11,7 +11,7 @@
  * each step completes. This enables the GET /v1/jobs/:jobId polling
  * endpoint to show real-time progress.
  */
-import type { AppContext, PipelineResult, PipelineStep } from "../_vendor/ailf-core/index.d.ts";
+import { type AppContext, type PipelineResult, type PipelineStep } from "../_vendor/ailf-core/index.d.ts";
 /**
  * Run a sequence of pipeline steps, short-circuiting on required step failure.
  *

package/dist/orchestration/pipeline-orchestrator.js

@@ -11,6 +11,7 @@
  * each step completes. This enables the GET /v1/jobs/:jobId polling
  * endpoint to show real-time progress.
  */
+import { assoc, } from "../_vendor/ailf-core/index.js";
 import { runStep } from "./step-runner.js";
 // ---------------------------------------------------------------------------
 // Job progress reporter
@@ -75,28 +76,40 @@ async function reportJobProgress(ctx, stepName, completedSteps, totalSteps, stat
  * Capture a snapshot of the pipeline config, final state, and step results.
  * Strips secrets (API keys, tokens) from the config.
  */
-function capturePipelineContext(ctx, state, results) {
-    if (!ctx.collector.enabled)
-        return;
+async function capturePipelineContext(ctx, state, results) {
     const sanitized = Object.fromEntries(Object.entries(ctx.config).filter(([k]) => !/token|secret|key/i.test(k)));
-    ctx.collector.capture("pipeline", "pipeline-context", {
-        config: sanitized,
-        state: {
-            reportId: state.reportId,
-            evalFingerprint: state.evalFingerprint,
-            belowCritical: state.belowCritical,
-            remoteCacheHits: state.remoteCacheHits
-                ? [...state.remoteCacheHits]
-                : undefined,
-            releaseAutoScope: state.releaseAutoScope,
-            testSummary: state.testSummary,
-        },
-        steps: Object.entries(results).map(([name, result]) => ({
-            name,
-            status: result.status,
-            durationMs: result.status !== "skipped" ? result.durationMs : undefined,
-        })),
-    });
+    // W0050 — migrated from ctx.collector.capture("pipeline", "pipeline-context", …)
+    // to the registry-driven emit() path. The writer handles redaction,
+    // --capture-exclude gating, and local+GCS fanout internally.
+    //
+    // Awaited (not fire-and-forget) so the write is observable by the
+    // orchestrator's caller — a fire-and-forget let the emit fall through
+    // to runtime teardown in tests with aggressive afterEach cleanup.
+    // `emit` is non-blocking internally (P5): failures return null + warn,
+    // never throw, so awaiting can't surface a rejected promise either.
+    try {
+        await ctx.artifactWriter.emit("pipelineContext", assoc(ctx), {
+            config: sanitized,
+            state: {
+                reportId: state.reportId,
+                evalFingerprint: state.evalFingerprint,
+                belowCritical: state.belowCritical,
+                remoteCacheHits: state.remoteCacheHits
+                    ? [...state.remoteCacheHits]
+                    : undefined,
+                releaseAutoScope: state.releaseAutoScope,
+                testSummary: state.testSummary,
+            },
+            steps: Object.entries(results).map(([name, result]) => ({
+                name,
+                status: result.status,
+                durationMs: result.status !== "skipped" ? result.durationMs : undefined,
+            })),
+        });
+    }
+    catch (err) {
+        ctx.logger.debug(`pipelineContext emit rejected: ${err instanceof Error ? err.message : String(err)}`);
+    }
 }
 /**
  * Flush captured artifacts to disk. Non-blocking — failures are logged
@@ -170,10 +183,10 @@ export async function orchestratePipeline(ctx, steps) {
                 }, jobUpdates);
             }
             // Capture pipeline context and job updates before flushing
-            capturePipelineContext(ctx, state, results);
-            if (jobUpdates.length > 0) {
-                ctx.collector.capture("job-store", "job-updates", jobUpdates);
-            }
+            await capturePipelineContext(ctx, state, results);
+            // W0050 — `job-updates` was an observability-only capture not tied
+            // to a registered artifact type; dropped here. Use the JobStore
+            // path if job telemetry is needed.
             // Flush captured artifacts even on failure (partial capture is useful)
             await flushArtifacts(ctx);
             return {
@@ -229,11 +242,9 @@ export async function orchestratePipeline(ctx, steps) {
             ctx.logger.warn("Failed to report job completion — continuing");
         }
     }
-    // Capture pipeline context and job updates before flushing
-    capturePipelineContext(ctx, state, results);
-    if (jobUpdates.length > 0) {
-        ctx.collector.capture("job-store", "job-updates", jobUpdates);
-    }
+    // Capture pipeline context. `job-updates` observability captures were
+    // dropped in Slice 6.1 — JobStore is the supported telemetry path.
+    await capturePipelineContext(ctx, state, results);
     // Flush captured artifacts (non-blocking — failures never affect pipeline result)
     await flushArtifacts(ctx);
     return {

package/dist/orchestration/steps/calculate-scores-step.d.ts

@@ -4,7 +4,7 @@
  * Calls calculateAndWriteScores() from pipeline/calculate-scores.ts with
  * typed options derived from AppContext. No env bridge needed.
  */
-import type { AppContext, PipelineState, PipelineStep, StepResult, ValidationIssue } from "../../_vendor/ailf-core/index.d.ts";
+import { type AppContext, type PipelineState, type PipelineStep, type StepResult, type ValidationIssue } from "../../_vendor/ailf-core/index.d.ts";
 export declare class CalculateScoresStep implements PipelineStep {
     readonly name = "calculate-scores";
     check(): ValidationIssue[];

package/dist/orchestration/steps/calculate-scores-step.js

@@ -4,8 +4,10 @@
  * Calls calculateAndWriteScores() from pipeline/calculate-scores.ts with
  * typed options derived from AppContext. No env bridge needed.
  */
-import { existsSync } from "node:fs";
-import { join } from "path";
+import { existsSync, readFileSync } from "node:fs";
+import { join, resolve } from "path";
+import { assoc, } from "../../_vendor/ailf-core/index.js";
+import { emitFileContents } from "../../artifact-capture/emit-file.js";
 import { LiteracyVariant } from "../../pipeline/normalize-mode.js";
 import { getStepInputPaths } from "../../pipeline/cache.js";
 import { buildCacheContext } from "../cache-context.js";
@@ -13,6 +15,7 @@ import { calculateAndWriteScores } from "../../pipeline/calculate-scores.js";
 import { checkResultsExist, checkScoreSummaryValid, } from "../../pipeline/checks.js";
 import { resultsFileForMode } from "../../pipeline/eval-constants.js";
 import { loadSource } from "../../sources.js";
+import { uploadTestOutputs } from "../../pipeline/upload-test-outputs.js";
 import { configToSourceOverrides } from "../config-to-source-overrides.js";
 export class CalculateScoresStep {
     name = "calculate-scores";
@@ -121,15 +124,34 @@ export class CalculateScoresStep {
             state.belowCritical = belowCritical;
         }
         // Capture score artifacts
+        // W0050 — score-summary → scoreSummary (run-scoped bulk).
+        // grader-judgments.json and test-results.json were aggregated captures
+        // without registered descriptors. graderJudgments is now per-entry
+        // ({run, mode, task, model, grader}) and lands via run-eval-step in
+        // Slice 6.6; the aggregated file is dropped.
         const resultsDir = join(ctx.config.rootDir, "results", "latest");
-        for (const file of [
-            "score-summary.json",
-            "grader-judgments.json",
-            "test-results.json",
-        ]) {
-            const filePath = join(resultsDir, file);
-            if (existsSync(filePath)) {
-                ctx.collector.captureFile("calculate-scores", file.replace(".json", ""), filePath);
+        const summaryPath = join(resultsDir, "score-summary.json");
+        if (existsSync(summaryPath)) {
+            await emitFileContents(ctx.artifactWriter, "scoreSummary", assoc(ctx), summaryPath);
+        }
+        // Upload testOutputs to GCS (D0032 — non-blocking, P5).
+        // Read from test-results.json rather than score-summary.json: the
+        // gap-analysis step (downstream) is the one that enriches score-summary
+        // with testResults, so at this point the summary still has an empty
+        // testResults[]. test-results.json is written by calculateAndWriteScores
+        // above and carries the full per-test shape we need for per-entry upload.
+        // The full responseOutput lives in the GCS artifact; PublishReportStep
+        // later strips it from the inline Content Lake document when this
+        // upload succeeds.
+        // W0050 — ctx.artifactWriter is always present; no guard needed.
+        const testResults = tryReadTestResults(ctx.config.rootDir);
+        if (testResults?.length) {
+            const artifactRef = await uploadTestOutputs(ctx.artifactWriter, ctx.runId, testResults);
+            if (artifactRef) {
+                state.artifactRefs = {
+                    ...state.artifactRefs,
+                    testOutputs: artifactRef,
+                };
             }
         }
         const criticalSuffix = belowCritical.length > 0
@@ -148,3 +170,21 @@ export class CalculateScoresStep {
         return buildCacheContext(ctx.config);
     }
 }
+/**
+ * Read the per-test result set written by `calculateAndWriteScores`.
+ *
+ * This is the authoritative source for `uploadTestOutputs` at the time
+ * CalculateScoresStep runs — `score-summary.json` doesn't carry
+ * `testResults[]` until `gap-analysis-step` enriches it downstream.
+ */
+function tryReadTestResults(rootDir) {
+    const path = resolve(rootDir, "results", "latest", "test-results.json");
+    if (!existsSync(path))
+        return undefined;
+    try {
+        return JSON.parse(readFileSync(path, "utf-8"));
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/orchestration/steps/callback-step.d.ts

@@ -11,7 +11,7 @@
  * @see packages/eval/src/pipeline/callback-delivery.ts
  * @see docs/design-docs/api-service-gateway.md
  */
-import type { AppContext, PipelineState, PipelineStep, StepResult, ValidationIssue } from "../../_vendor/ailf-core/index.d.ts";
+import { type AppContext, type PipelineState, type PipelineStep, type StepResult, type ValidationIssue } from "../../_vendor/ailf-core/index.d.ts";
 import { type CallbackConfig } from "../../pipeline/callback-delivery.js";
 export declare class CallbackStep implements PipelineStep {
     private readonly callback;

package/dist/orchestration/steps/callback-step.js

@@ -13,6 +13,7 @@
  */
 import { readFileSync } from "fs";
 import { resolve } from "path";
+import { assoc, } from "../../_vendor/ailf-core/index.js";
 import { deliverCallback, } from "../../pipeline/callback-delivery.js";
 export class CallbackStep {
     callback;
@@ -58,11 +59,12 @@ export class CallbackStep {
             reportId: state.reportId,
             summary,
         };
-        // Capture callback payload (Tier 2 — no secrets: headers are NOT captured)
-        ctx.collector.capture("callback", "callback-payload", callbackPayload);
+        // W0050 — callbackRequest/callbackResponse are per-entry artifacts
+        // keyed by the callback target URL (the `name` slot on the association).
+        const callbackName = this.callback.url;
+        await ctx.artifactWriter.emit("callbackRequest", assoc(ctx, { name: callbackName }), callbackPayload);
         const result = await deliverCallback(this.callback, callbackPayload);
-        // Capture callback response status (not the body — that's the user's system)
-        ctx.collector.capture("callback", "callback-response", {
+        await ctx.artifactWriter.emit("callbackResponse", assoc(ctx, { name: callbackName }), {
             ok: result.ok,
             attempts: result.attempts,
             error: result.error,

package/dist/orchestration/steps/compare-step.d.ts

@@ -5,7 +5,7 @@
  * inlined directly from the former pipeline/steps/compare-step.ts.
  * This is an optional step — failure doesn't stop the pipeline.
  */
-import type { AppContext, PipelineStep, StepResult, ValidationIssue } from "../../_vendor/ailf-core/index.d.ts";
+import { type AppContext, type PipelineStep, type StepResult, type ValidationIssue } from "../../_vendor/ailf-core/index.d.ts";
 export declare class CompareStep implements PipelineStep {
     readonly name = "compare";
     readonly optional = true;

package/dist/orchestration/steps/compare-step.js

@@ -7,6 +7,8 @@
  */
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync, } from "fs";
 import { join, resolve } from "path";
+import { assoc, } from "../../_vendor/ailf-core/index.js";
+import { emitFileContents } from "../../artifact-capture/emit-file.js";
 import { compare } from "../../pipeline/compare.js";
 export class CompareStep {
     name = "compare";
@@ -69,8 +71,8 @@ export class CompareStep {
         mkdirSync(ctx.config.outputDir, { recursive: true });
         const reportPath = resolve(ctx.config.outputDir, "comparison-report.json");
         writeFileSync(reportPath, JSON.stringify(report, null, 2));
-        // Capture comparison report
-        ctx.collector.captureFile("compare", "comparison-report", reportPath);
+        // W0050 — comparisonReport is per-entry keyed by mode ({run, mode}).
+        await emitFileContents(ctx.artifactWriter, "comparisonReport", assoc(ctx, { mode: ctx.config.mode }), reportPath);
         // Build summary
         const improved = report.improved.length;
         const regressed = report.regressed.length;

package/dist/orchestration/steps/discovery-report-step.d.ts

@@ -4,7 +4,7 @@
  * Calls pure functions from pipeline/discovery-report.ts directly.
  * Optional step — failure doesn't stop the pipeline.
  */
-import type { AppContext, PipelineStep, StepResult, ValidationIssue } from "../../_vendor/ailf-core/index.d.ts";
+import { type AppContext, type PipelineStep, type StepResult, type ValidationIssue } from "../../_vendor/ailf-core/index.d.ts";
 export declare class DiscoveryReportStep implements PipelineStep {
     readonly name = "discovery-report";
     readonly optional = true;

package/dist/orchestration/steps/discovery-report-step.js

@@ -6,6 +6,8 @@
  */
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
 import { resolve } from "path";
+import { assoc, } from "../../_vendor/ailf-core/index.js";
+import { emitFileContents } from "../../artifact-capture/emit-file.js";
 import { formatDiscoveryMarkdown, generateDiscoveryReport, } from "../../pipeline/discovery-report.js";
 export class DiscoveryReportStep {
     name = "discovery-report";
@@ -38,7 +40,8 @@ export class DiscoveryReportStep {
             mkdirSync(ctx.config.outputDir, { recursive: true });
             const discoveryPath = resolve(ctx.config.outputDir, "discovery-report.md");
             writeFileSync(discoveryPath, md);
-            ctx.collector.captureFile("discovery-report", "discovery-report", discoveryPath);
+            // W0050 — discoveryReport is per-entry keyed by mode.
+            await emitFileContents(ctx.artifactWriter, "discoveryReport", assoc(ctx, { mode: ctx.config.mode }), discoveryPath);
             console.log(md);
             const invisible = report.invisibleDocs.length;
             const f1 = report.overall.avgF1.toFixed(2);

package/dist/orchestration/steps/fetch-docs-step.js

@@ -12,7 +12,8 @@
  */
 import { existsSync, mkdirSync, writeFileSync } from "fs";
 import { join } from "path";
-import { isIdRef, isPathRef, isSlugRef, } from "../../_vendor/ailf-core/index.js";
+import { assoc, isIdRef, isPathRef, isSlugRef, } from "../../_vendor/ailf-core/index.js";
+import { emitFileContents } from "../../artifact-capture/emit-file.js";
 import { getStepInputPaths } from "../../pipeline/cache.js";
 import { buildCacheContext } from "../cache-context.js";
 import { checkCanonicalContextsExist } from "../../pipeline/checks.js";
@@ -94,20 +95,13 @@ export class FetchDocsStep {
             if (result.metadata) {
                 writeMetadataFiles(ctx.config.rootDir, result.metadata);
             }
-            // Capture metadata files (mode-specific extras)
-            if (ctx.collector.extrasEnabled) {
-                const contextsDir = join(ctx.config.rootDir, "contexts");
-                for (const [type, filename] of [
-                    ["document-manifest", "document-manifest.json"],
-                    ["release-impact", "release-impact.json"],
-                    ["document-overlay", "document-overlay.json"],
-                    ["url-fetch", "url-fetch.json"],
-                ]) {
-                    const filePath = join(contextsDir, filename);
-                    if (existsSync(filePath)) {
-                        ctx.collector.captureFile("fetch-docs", type, filePath);
-                    }
-                }
+            // W0050 — documentManifest is run-scoped bulk JSON. The
+            // release-impact/document-overlay/url-fetch captures had no
+            // registered descriptors (they were extras-only); dropped per Q3
+            // ("producers always call emit; registered types only").
+            const documentManifestPath = join(ctx.config.rootDir, "contexts", "document-manifest.json");
+            if (existsSync(documentManifestPath)) {
+                await emitFileContents(ctx.artifactWriter, "documentManifest", assoc(ctx), documentManifestPath);
             }
         }
         catch (err) {

package/dist/orchestration/steps/finalize-run-step.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Pipeline step: FinalizeRunStep — writes the run manifest at pipeline end.
+ *
+ * Inserts between `GapAnalysis` and `PublishReport`. Assembles a
+ * `RunManifest` from `state.artifactRefs` (populated by producer steps)
+ * and the shared `RunContext` (via `buildRunContext`), then writes it to
+ * `runs/{runId}/manifest.json`. The written manifest becomes the source
+ * of truth for artifact locations; `PublishReportStep` snapshots the
+ * `artifacts` slice into `Report.artifactManifest` (D0032).
+ *
+ * Design principles:
+ * - Single writer — one `writeManifest()` call per pipeline run.
+ * - Idempotent — retries produce the same manifest bytes for the same inputs.
+ * - Skipped when no writer is wired (local/air-gapped runs stay functional).
+ *
+ * @see docs/decisions/D0032-run-anchored-artifact-store.md
+ */
+import type { AppContext, PipelineState, PipelineStep, StepResult, ValidationIssue } from "../../_vendor/ailf-core/index.d.ts";
+export declare class FinalizeRunStep implements PipelineStep {
+    private readonly pipelineStart;
+    private readonly options;
+    readonly name = "finalize-run";
+    readonly optional = true;
+    constructor(pipelineStart: number, options?: {
+        evalFingerprint?: string;
+    });
+    check(): ValidationIssue[];
+    execute(ctx: AppContext, state: PipelineState): Promise<StepResult>;
+}