@sanity/ailf 4.0.5 → 4.0.7

package/dist/_vendor/ailf-core/constants.d.ts

@@ -0,0 +1,22 @@
+/**
+ * @sanity/ailf-core — Cross-package sentinel constants.
+ *
+ * Sentinel strings shared between the init template (which writes them
+ * into `.github/workflows/ailf-eval.yml`) and the consumers that must
+ * recognize them (run-context builder, caller envelope assembly, CLI
+ * pre-flight checks). Centralizing here keeps the placeholder definition
+ * in exactly one place — duplicating the literal across producers and
+ * consumers historically caused the literal to leak into Sanity reports
+ * (W0143).
+ */
+/**
+ * The literal string `ailf init` writes into the scaffolded GitHub Actions
+ * workflow as the value of `AILF_OWNER_TEAM`. Consumers treat this string
+ * as semantically unset — it must never end up persisted as a real team
+ * slug on a run report.
+ *
+ * @see packages/core/examples/ailf-eval-workflow.yml — the canonical source
+ * @see packages/eval/src/pipeline/run-context.ts — sanitizes on read
+ * @see packages/eval/src/adapters/api-client/build-request.ts — drops on the wire
+ */
+export declare const PLACEHOLDER_OWNER_TEAM = "<REPLACE-WITH-YOUR-TEAM-SLUG>";

package/dist/_vendor/ailf-core/constants.js

@@ -0,0 +1,22 @@
+/**
+ * @sanity/ailf-core — Cross-package sentinel constants.
+ *
+ * Sentinel strings shared between the init template (which writes them
+ * into `.github/workflows/ailf-eval.yml`) and the consumers that must
+ * recognize them (run-context builder, caller envelope assembly, CLI
+ * pre-flight checks). Centralizing here keeps the placeholder definition
+ * in exactly one place — duplicating the literal across producers and
+ * consumers historically caused the literal to leak into Sanity reports
+ * (W0143).
+ */
+/**
+ * The literal string `ailf init` writes into the scaffolded GitHub Actions
+ * workflow as the value of `AILF_OWNER_TEAM`. Consumers treat this string
+ * as semantically unset — it must never end up persisted as a real team
+ * slug on a run report.
+ *
+ * @see packages/core/examples/ailf-eval-workflow.yml — the canonical source
+ * @see packages/eval/src/pipeline/run-context.ts — sanitizes on read
+ * @see packages/eval/src/adapters/api-client/build-request.ts — drops on the wire
+ */
+export const PLACEHOLDER_OWNER_TEAM = "<REPLACE-WITH-YOUR-TEAM-SLUG>";

package/dist/_vendor/ailf-core/index.d.ts

@@ -17,6 +17,7 @@ export * from "./services/index.js";
 export * from "./examples/index.js";
 export * from "./artifact-registry.js";
 export * from "./batch-signing.js";
+export * from "./constants.js";
 export { defineCanaryTasks, defineConfig, defineFeatures, defineModeBase, defineModels, definePricingTable, definePreset, definePrompts, defineRubrics, defineSchedules, defineSinks, defineSources, defineTask, defineTestBudgets, defineThresholds, } from "./config-helpers.js";
 export type { PricingEntry, PromptEntry, SourceEntry, } from "./config-helpers.js";
 export { env } from "./env-helper.js";

package/dist/_vendor/ailf-core/index.js

@@ -17,6 +17,7 @@ export * from "./services/index.js";
 export * from "./examples/index.js";
 export * from "./artifact-registry.js";
 export * from "./batch-signing.js";
+export * from "./constants.js";
 // ---------------------------------------------------------------------------
 // Architecture overhaul — Phase 0 helpers
 // ---------------------------------------------------------------------------

package/dist/adapters/api-client/build-request.js

@@ -14,7 +14,7 @@
  */
 import { existsSync } from "fs";
 import { resolve } from "path";
-import { PipelineRequestSchema, } from "../../_vendor/ailf-core/index.js";
+import { PLACEHOLDER_OWNER_TEAM, PipelineRequestSchema, } from "../../_vendor/ailf-core/index.js";
 import { LEGACY_EVAL_MODE_ALIASES, isRunClassification, } from "../../_vendor/ailf-shared/index.js";
 import { RepoTaskSource } from "../task-sources/repo-task-source.js";
 const LEGACY_LITERACY_VARIANT_SET = new Set(LEGACY_EVAL_MODE_ALIASES);
@@ -316,7 +316,12 @@ export function buildCallerEnvelope(config) {
         }
     }
     // Owner: flag > env. Team required, individual optional.
-    const team = config.ownerTeamOption ?? process.env.AILF_OWNER_TEAM?.trim() ?? undefined;
+    // W0143: drop the init-template placeholder — when a consumer hasn't
+    // filled in their team slug yet we treat it as unset rather than
+    // shipping the literal `<REPLACE-WITH-YOUR-TEAM-SLUG>` across the wire
+    // and into the report's Provenance card.
+    const rawTeam = config.ownerTeamOption ?? process.env.AILF_OWNER_TEAM?.trim() ?? undefined;
+    const team = rawTeam === PLACEHOLDER_OWNER_TEAM ? undefined : rawTeam;
     const individual = config.ownerIndividualOption ??
         process.env.AILF_OWNER_INDIVIDUAL?.trim() ??
         process.env.GITHUB_ACTOR?.trim() ??

package/dist/adapters/task-sources/repo-schemas.js

@@ -376,12 +376,16 @@ export function parseCanonicalTaskFile(raw, filename) {
 // (featureArea, canonicalDocs, assert, vars), surface a helpful error
 // message telling them what the canonical names are.
 // ---------------------------------------------------------------------------
+// Phrasing avoids literal `{` and `}` characters on purpose. GitHub Actions
+// registers each line of a multi-line secret as a mask, so a pretty-printed
+// JSON secret introduces standalone `{` / `}` masks that then redact every
+// `{` / `}` in subsequent log output. See W0144.
 /** Old field names from @sanity/ailf-tasks → canonical equivalents */
 const LEGACY_FIELD_MAP = {
     featureArea: "area",
-    canonicalDocs: "context.docs (nested under context: { docs: [...] })",
+    canonicalDocs: "context.docs (move the docs array under a context parent)",
     assert: "assertions",
-    vars: "prompt (nested under prompt: { text: ... })",
+    vars: "prompt (move the text string under a prompt parent)",
 };
 /**
  * Detect legacy field names in raw task data and return helpful messages.

package/dist/adapters/task-sources/repo-task-source.d.ts

@@ -19,8 +19,18 @@
  * @see packages/core/src/ports/task-source.ts — TaskSource port
  */
 import type { FilterOptions, GeneralizedTaskDefinition, TaskSource } from "../../_vendor/ailf-core/index.d.ts";
+export interface RepoTaskSourceOptions {
+    /**
+     * When true, treat a missing directory or empty task set as a valid
+     * empty result instead of throwing. Used by the composition root for
+     * the AILF-bundled `tasks/${mode}/` source, which is missing in some
+     * test rootDirs and modes that ship no defaults.
+     */
+    allowMissing?: boolean;
+}
 export declare class RepoTaskSource implements TaskSource {
     private readonly tasksDir;
-    constructor(tasksDir: string);
+    private readonly options;
+    constructor(tasksDir: string, options?: RepoTaskSourceOptions);
     loadTasks(filter?: FilterOptions): Promise<GeneralizedTaskDefinition[]>;
 }

package/dist/adapters/task-sources/repo-task-source.js

@@ -26,16 +26,17 @@ import { detectLegacyFieldNames, parseCanonicalTaskFile, } from "./repo-schemas.
 import { discoverTsTaskFiles, loadTsTaskFile } from "./task-file-loader.js";
 /** Set of canonical mode names for O(1) lookup */
 const KNOWN_MODES = new Set(CANONICAL_EVAL_MODES);
-// ---------------------------------------------------------------------------
-// RepoTaskSource adapter
-// ---------------------------------------------------------------------------
 export class RepoTaskSource {
     tasksDir;
-    constructor(tasksDir) {
+    options;
+    constructor(tasksDir, options = {}) {
         this.tasksDir = tasksDir;
+        this.options = options;
     }
     async loadTasks(filter) {
         if (!existsSync(this.tasksDir)) {
+            if (this.options.allowMissing)
+                return [];
             throw new Error(`Repo tasks directory not found: ${this.tasksDir}\n` +
                 "  Provide a valid path via --repo-tasks-path");
         }
@@ -44,6 +45,8 @@ export class RepoTaskSource {
             .sort();
         const tsFiles = discoverTsTaskFiles(this.tasksDir);
         if (yamlFiles.length === 0 && tsFiles.length === 0) {
+            if (this.options.allowMissing)
+                return [];
             throw new Error(`No task files found in ${this.tasksDir}\n` +
                 "  Expected .ailf/tasks/*.yaml or .ailf/tasks/*.task.ts files");
         }

package/dist/commands/pipeline-action.js

@@ -20,6 +20,7 @@ import { buildAppContext, parseArtifactUploadEnv, } from "../orchestration/build
 import { buildStepSequence } from "../orchestration/build-step-sequence.js";
 import { orchestratePipeline } from "../orchestration/pipeline-orchestrator.js";
 import { load } from "js-yaml";
+import { PLACEHOLDER_OWNER_TEAM } from "../_vendor/ailf-core/index.js";
 import { parseRepoConfig, } from "../adapters/task-sources/repo-schemas.js";
 import { getCallerCwd, resolveOutputDir } from "./shared/resolve-output-dir.js";
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -406,6 +407,7 @@ function resolveRepoTasksPath(callerCwd, explicitPath, taskSourceType) {
  * 4. Delegate to the PipelineOrchestrator
  */
 export async function executePipeline(cliOpts) {
+    warnIfPlaceholderOwnerTeam();
     // When --config is provided, resolve config from file instead of CLI flags
     if (cliOpts.config) {
         const { existsSync } = await import("fs");
@@ -493,6 +495,20 @@ export async function executePipeline(cliOpts) {
 // ---------------------------------------------------------------------------
 // Internal helpers
 // ---------------------------------------------------------------------------
+/**
+ * W0143: warn once on stderr when the consumer is still running with the
+ * unedited init-template placeholder for AILF_OWNER_TEAM. The run
+ * continues — provenance just gets attributed as unset rather than the
+ * literal placeholder.
+ */
+function warnIfPlaceholderOwnerTeam() {
+    if (process.env.AILF_OWNER_TEAM?.trim() !== PLACEHOLDER_OWNER_TEAM)
+        return;
+    console.warn(`  ⚠️  AILF_OWNER_TEAM is still set to the init-template placeholder ` +
+        `"${PLACEHOLDER_OWNER_TEAM}". Provenance will be logged as unset. ` +
+        `Set a real team slug in .github/workflows/ailf-eval.yml (or unset ` +
+        `AILF_OWNER_TEAM) to attribute this run.`);
+}
 /**
  * Resolve CLI options into typed ResolvedOptions.
  */

package/dist/composition-root.d.ts

@@ -16,6 +16,7 @@
  * @see docs/archive/exec-plans/ports-and-adapters/phase-7-composition-root.md
  */
 import { type AppContext, type ArtifactWriter, type ArtifactWriterProgressOptions, type AssertionRegistration, type Logger, type ResolvedConfig } from "./_vendor/ailf-core/index.d.ts";
+import { CompositeTaskSource, ContentLakeTaskSource, RepoTaskSource } from "./adapters/task-sources/index.js";
 /**
  * Create a fully wired AppContext from resolved configuration.
  *
@@ -42,6 +43,12 @@ export declare function createAppContext(config: ResolvedConfig): AppContext;
  * Exported for unit-test access; not part of the public package API.
  */
 export declare function createArtifactWriter(config: ResolvedConfig, logger: Logger, progress?: ArtifactWriterProgressOptions): ArtifactWriter;
+/**
+ * Build the `TaskSource` adapter wired by the composition root for a
+ * given `ResolvedConfig`. Exported for test access — composition-root
+ * wiring is a contract worth asserting directly.
+ */
+export declare function createTaskSource(config: ResolvedConfig): CompositeTaskSource | ContentLakeTaskSource | RepoTaskSource;
 /**
  * Generic Promptfoo assertion types available to all evaluation modes.
  *

package/dist/composition-root.js

@@ -32,6 +32,7 @@ import { PromptfooEvalAdapter } from "./adapters/eval-runners/promptfoo-eval-ada
 import { ConsoleLogger, JsonLogger, QuietLogger, } from "./adapters/loggers/index.js";
 import { ConsoleProgressReporter } from "./adapters/progress/console-progress-reporter.js";
 import { CompositeTaskSource, ContentLakeTaskSource, RepoTaskSource, } from "./adapters/task-sources/index.js";
+import { resolveVendoredSubdir } from "./pipeline/compiler/config-loader.js";
 import { createAgentHarnessBase, createKnowledgeProbeBase, createLiteracyModeBase, createMcpServerModeBase, } from "./pipeline/compiler/mode-bases/index.js";
 import { createSanityLiteracyPreset } from "./pipeline/compiler/presets/index.js";
 import { getSanityClient } from "./sanity/client.js";
@@ -297,7 +298,12 @@ function createCache(config) {
         return local;
     return new ContentLakeCacheAdapter(local, createReportStore(config));
 }
-function createTaskSource(config) {
+/**
+ * Build the `TaskSource` adapter wired by the composition root for a
+ * given `ResolvedConfig`. Exported for test access — composition-root
+ * wiring is a contract worth asserting directly.
+ */
+export function createTaskSource(config) {
     // "repo" mode — use ONLY repo tasks, no Content Lake or YAML merge.
     // This is the correct mode for API-triggered inline-task evaluations
     // where the caller sent their own task definitions. Without this,
@@ -309,21 +315,28 @@ function createTaskSource(config) {
         }
         return new RepoTaskSource(config.repoTasksPath);
     }
-    // Primary source — Content Lake (the only non-repo source remaining)
-    const primary = new ContentLakeTaskSource(getSanityClient({
-        token: process.env.AILF_REPORT_SANITY_API_TOKEN ??
-            process.env.SANITY_API_TOKEN ??
-            undefined,
-    }));
-    // If repo tasks path is set, combine primary + repo sources.
-    // This is the "augment" mode — repo tasks extend the primary source.
+    // "content-lake" — Studio-authored ailf.task documents only.
+    if (config.taskSourceType === "content-lake") {
+        return new ContentLakeTaskSource(getSanityClient({
+            token: process.env.AILF_REPORT_SANITY_API_TOKEN ??
+                process.env.SANITY_API_TOKEN ??
+                undefined,
+        }));
+    }
+    // Unset — AILF-bundled defaults from `tasks/${mode}/`, optionally
+    // augmented with the caller's `--repo-tasks-path` (W0146). The
+    // bundled directory is allowed to be missing so test rootDirs and
+    // modes that ship no defaults degrade gracefully to the augment
+    // source (or empty).
+    const bundledDir = resolveVendoredSubdir(config.rootDir, `tasks/${config.mode}`);
+    const bundled = new RepoTaskSource(bundledDir, { allowMissing: true });
     if (config.repoTasksPath) {
         return new CompositeTaskSource([
-            primary,
+            bundled,
             new RepoTaskSource(config.repoTasksPath),
         ]);
     }
-    return primary;
+    return bundled;
 }
 // ---------------------------------------------------------------------------
 // Layer 0: Framework built-in assertions

package/dist/orchestration/steps/fetch-docs-step.js

@@ -17,7 +17,6 @@ import { emitFileContents } from "../../artifact-capture/emit-file.js";
 import { getStepInputPaths } from "../../pipeline/cache.js";
 import { buildCacheContext } from "../cache-context.js";
 import { checkCanonicalContextsExist } from "../../pipeline/checks.js";
-import { loadPipelineTasks } from "../load-pipeline-tasks.js";
 import { loadSource } from "../../sources.js";
 import { configToSourceOverrides } from "../config-to-source-overrides.js";
 export class FetchDocsStep {
@@ -30,35 +29,16 @@ export class FetchDocsStep {
             return { status: "skipped", reason: "--no-fetch" };
         }
         const start = Date.now();
-        // Load tasks — use the same source as GenerateConfigsStep to avoid
-        // a mismatch where configs reference context files that were never
-        // fetched.
-        //
-        // Adapter path: ctx.taskSource handles both content-lake and repo modes.
-        // The composition root wires the right adapter (ContentLakeTaskSource
-        // or RepoTaskSource) per taskSourceType. RepoTaskSource loads BOTH
-        // .yaml and .task.ts files — necessary for external-consumer evals
-        // that materialize inline tasks as YAML (W0148).
-        // Filesystem path: load from .task.ts files (legacy unset path —
-        // AILF defaults from tasks/${mode}/ + optional repoTasksPath augment).
-        let allTasks;
-        if (ctx.config.taskSourceType === "content-lake" ||
-            ctx.config.taskSourceType === "repo") {
-            const filter = {
-                ...(ctx.config.areas?.length ? { areas: ctx.config.areas } : {}),
-                ...(ctx.config.tasks?.length ? { taskIds: ctx.config.tasks } : {}),
-                ...(ctx.config.tags?.length ? { tags: ctx.config.tags } : {}),
-            };
-            allTasks = await ctx.taskSource.loadTasks(Object.keys(filter).length > 0 ? filter : undefined);
-        }
-        else {
-            allTasks = await loadPipelineTasks({
-                rootDir: ctx.config.rootDir,
-                mode: ctx.config.mode,
-                repoTasksPath: ctx.config.repoTasksPath,
-                taskSourceType: ctx.config.taskSourceType,
-            });
-        }
+        // Load tasks via ctx.taskSource — the composition root wires the
+        // right adapter for every taskSourceType (W0146). FetchDocsStep and
+        // GenerateConfigsStep MUST go through the same adapter so configs
+        // reference context files that were actually fetched.
+        const filter = {
+            ...(ctx.config.areas?.length ? { areas: ctx.config.areas } : {}),
+            ...(ctx.config.tasks?.length ? { taskIds: ctx.config.tasks } : {}),
+            ...(ctx.config.tags?.length ? { tags: ctx.config.tags } : {}),
+        };
+        const allTasks = await ctx.taskSource.loadTasks(Object.keys(filter).length > 0 ? filter : undefined);
         // Bridge: narrow to literacy tasks for canonical doc access
         const literacyTasks = allTasks.filter((t) => t.mode === "literacy");
         const tasksWithDocs = literacyTasks.filter((t) => (t.context?.docs?.length ?? 0) > 0);

package/dist/orchestration/steps/generate-configs-step.d.ts

@@ -17,24 +17,17 @@ export declare class GenerateConfigsStep implements PipelineStep {
     execute(ctx: AppContext, state: PipelineState): Promise<StepResult>;
     private compileLiteracyVariants;
     private compileSingleMode;
-    private loadTasks;
     /**
-     * Load tasks via ctx.taskSource (the composition-root-wired adapter).
+     * Load tasks via ctx.taskSource — the single adapter wired by the
+     * composition root for every taskSourceType (W0146). FetchDocsStep
+     * and GenerateConfigsStep MUST go through the same adapter so configs
+     * reference context files that were actually fetched.
      *
-     * Used for both `taskSourceType === "content-lake"` (ContentLakeTaskSource)
-     * and `taskSourceType === "repo"` (RepoTaskSource). Filtering by
-     * area/task/tag is delegated to the adapter — ContentLakeTaskSource
-     * pushes it into the GROQ query, RepoTaskSource applies it in-memory.
+     * Filtering by area/task/tag is delegated to the adapter:
+     * ContentLakeTaskSource pushes it into the GROQ query;
+     * RepoTaskSource applies it in-memory.
      */
-    private loadTasksFromAdapter;
-    /**
-     * Load tasks from filesystem .task.ts files.
-     *
-     * This is the original path used for repo-based and inline tasks.
-     * It scans tasks/{mode}/ and optionally --repo-tasks-path.
-     */
-    private loadTasksFromFilesystem;
-    private applyFilters;
+    private loadTasks;
     /**
      * Build a descriptive error message when no tasks match the current filters.
      * Distinguishes between "no tasks exist" and "tasks exist but filters exclude them".

package/dist/orchestration/steps/generate-configs-step.js

@@ -208,99 +208,36 @@ export class GenerateConfigsStep {
     // ---------------------------------------------------------------------------
     // Task loading — unified for all modes
     // ---------------------------------------------------------------------------
-    async loadTasks(ctx, mode, state) {
-        // Adapter path — use ctx.taskSource. The composition root wires the
-        // right adapter for each taskSourceType:
-        //   - "content-lake" → ContentLakeTaskSource (Studio-owned ailf.task docs)
-        //   - "repo"         → RepoTaskSource (loads .yaml AND .task.ts from repoTasksPath)
-        // Routing both through ctx.taskSource keeps the orchestration step
-        // file-format-agnostic (W0148: external-consumer evals materialize
-        // inline tasks as .yaml, which loadPipelineTasks can't read).
-        if (ctx.config.taskSourceType === "content-lake" ||
-            ctx.config.taskSourceType === "repo") {
-            return this.loadTasksFromAdapter(ctx, state);
-        }
-        // Filesystem path — load from .task.ts files (legacy unset path:
-        // AILF defaults from tasks/${mode}/ + optional repoTasksPath augment).
-        return this.loadTasksFromFilesystem(ctx, mode, state);
-    }
     /**
-     * Load tasks via ctx.taskSource (the composition-root-wired adapter).
+     * Load tasks via ctx.taskSource — the single adapter wired by the
+     * composition root for every taskSourceType (W0146). FetchDocsStep
+     * and GenerateConfigsStep MUST go through the same adapter so configs
+     * reference context files that were actually fetched.
      *
-     * Used for both `taskSourceType === "content-lake"` (ContentLakeTaskSource)
-     * and `taskSourceType === "repo"` (RepoTaskSource). Filtering by
-     * area/task/tag is delegated to the adapter — ContentLakeTaskSource
-     * pushes it into the GROQ query, RepoTaskSource applies it in-memory.
+     * Filtering by area/task/tag is delegated to the adapter:
+     * ContentLakeTaskSource pushes it into the GROQ query;
+     * RepoTaskSource applies it in-memory.
      */
-    async loadTasksFromAdapter(ctx, state) {
+    async loadTasks(ctx, mode, state) {
         const filter = {
             ...(ctx.config.areas?.length ? { areas: ctx.config.areas } : {}),
             ...(ctx.config.tasks?.length ? { taskIds: ctx.config.tasks } : {}),
             ...(ctx.config.tags?.length ? { tags: ctx.config.tags } : {}),
         };
-        const tasks = await ctx.taskSource.loadTasks(Object.keys(filter).length > 0 ? filter : undefined);
-        // Capture loaded IDs for error messages (same as filesystem path)
-        this.lastLoadedTaskIds = tasks
-            .map((t) => t.id)
-            .filter((id) => !!id);
-        // Release auto-scope
-        if (state.releaseAutoScope && !ctx.config.noAutoScope) {
-            const scopedIds = new Set(state.releaseAutoScope.affectedTaskIds);
-            const beforeCount = tasks.length;
-            const scoped = tasks.filter((t) => "id" in t && scopedIds.has(t.id));
-            ctx.logger.info(`  🎯 Auto-scoped to ${scoped.length} of ${beforeCount} task(s) affected by release`);
-            return scoped;
-        }
-        return tasks;
-    }
-    /**
-     * Load tasks from filesystem .task.ts files.
-     *
-     * This is the original path used for repo-based and inline tasks.
-     * It scans tasks/{mode}/ and optionally --repo-tasks-path.
-     */
-    async loadTasksFromFilesystem(ctx, mode, state) {
-        const { resolve } = await import("path");
-        const { discoverTsTaskFiles, loadTsTaskFile } = await import("../../adapters/task-sources/task-file-loader.js");
-        const { resolveVendoredSubdir } = await import("../../pipeline/compiler/config-loader.js");
-        // Discover task files from the mode-specific directory and --repo-tasks-path.
-        // Use vendored copies in dist/ when @sanity/ailf-core isn't resolvable
-        // (i.e., running outside the monorepo via npx).
-        //
-        // When taskSourceType === "repo", skip the AILF-bundled tasks/${mode}/
-        // directory and load ONLY from repoTasksPath. Mirrors the composition-root
-        // contract for repo-only mode (see composition-root.ts:392-405).
-        const dirs = [];
-        if (ctx.config.taskSourceType !== "repo") {
-            dirs.push(resolveVendoredSubdir(ctx.config.rootDir, `tasks/${mode}`));
-        }
-        else if (!ctx.config.repoTasksPath) {
-            throw new Error('taskSourceType "repo" requires repoTasksPath to be set (no AILF defaults loaded in repo-only mode)');
-        }
-        // Also search --repo-tasks-path (e.g., .ailf/tasks/) for repo-based tasks
-        if (ctx.config.repoTasksPath) {
-            const repoDir = resolve(ctx.config.repoTasksPath);
-            if (!dirs.includes(repoDir)) {
-                dirs.push(repoDir);
-            }
-        }
+        const allTasks = await ctx.taskSource.loadTasks(Object.keys(filter).length > 0 ? filter : undefined);
+        // Mode filter — the adapter may return a mixed-mode set (e.g. a user's
+        // `--repo-tasks-path` containing tasks of multiple modes). Skip
+        // non-matching modes with a warning so unintentional misclassification
+        // is visible without breaking the run.
         const tasks = [];
         const skippedByMode = new Map();
-        for (const dir of dirs) {
-            const files = discoverTsTaskFiles(dir);
-            for (const file of files) {
-                const raw = await loadTsTaskFile(file);
-                for (const t of raw.tasks) {
-                    const task = t;
-                    // Filter to matching mode (skip tasks from other modes in same dir)
-                    if (!("mode" in task) || task.mode === mode) {
-                        tasks.push(task);
-                    }
-                    else {
-                        const taskMode = task.mode ?? "unknown";
-                        skippedByMode.set(taskMode, (skippedByMode.get(taskMode) ?? 0) + 1);
-                    }
-                }
+        for (const task of allTasks) {
+            if (!("mode" in task) || task.mode === mode) {
+                tasks.push(task);
+            }
+            else {
+                const taskMode = task.mode ?? "unknown";
+                skippedByMode.set(taskMode, (skippedByMode.get(taskMode) ?? 0) + 1);
             }
         }
         if (skippedByMode.size > 0) {
@@ -310,46 +247,17 @@ export class GenerateConfigsStep {
                 .join(", ");
             ctx.logger.warn(`  ⚠ Skipped ${total} task(s) with non-matching mode (${summary}). Current pipeline mode: ${mode}. Run with --mode <mode> to include them.`);
         }
-        // Apply area/task/tag filters
-        const filtered = this.applyFilters(ctx, tasks);
-        // Release auto-scope
+        this.lastLoadedTaskIds = tasks
+            .map((t) => t.id)
+            .filter((id) => !!id);
         if (state.releaseAutoScope && !ctx.config.noAutoScope) {
             const scopedIds = new Set(state.releaseAutoScope.affectedTaskIds);
-            const beforeCount = filtered.length;
-            const scoped = filtered.filter((t) => "id" in t && scopedIds.has(t.id));
+            const beforeCount = tasks.length;
+            const scoped = tasks.filter((t) => "id" in t && scopedIds.has(t.id));
             ctx.logger.info(`  🎯 Auto-scoped to ${scoped.length} of ${beforeCount} task(s) affected by release`);
             return scoped;
         }
-        return filtered;
-    }
-    applyFilters(ctx, tasks) {
-        // Capture pre-filter IDs for diagnostic messages
-        this.lastLoadedTaskIds = tasks
-            .map((t) => t.id)
-            .filter((id) => !!id);
-        let result = tasks;
-        if (ctx.config.areas?.length) {
-            const allowed = new Set(ctx.config.areas.map((a) => a.toLowerCase()));
-            result = result.filter((t) => {
-                const area = t.area?.toLowerCase();
-                return area && allowed.has(area);
-            });
-        }
-        if (ctx.config.tasks?.length) {
-            const allowed = new Set(ctx.config.tasks);
-            result = result.filter((t) => {
-                const id = t.id;
-                return id && allowed.has(id);
-            });
-        }
-        if (ctx.config.tags?.length) {
-            const allowed = new Set(ctx.config.tags);
-            result = result.filter((t) => {
-                const tags = t.tags;
-                return tags?.some((tag) => allowed.has(tag));
-            });
-        }
-        return result;
+        return tasks;
     }
     /**
      * Build a descriptive error message when no tasks match the current filters.

package/dist/orchestration/steps/mirror-repo-tasks-step.js

@@ -28,6 +28,18 @@ export class MirrorRepoTasksStep {
         if (!ctx.config.repoTasksPath) {
             return { status: "skipped", reason: "No --repo-tasks-path provided" };
         }
+        // W0145 — never mirror under repo-only mode. The API gateway maps
+        // PipelineRequest.taskMode="inline" → taskSourceType="repo", so an
+        // external consumer's ephemeral inline tasks would otherwise be
+        // upserted into AILF's canonical Content Lake. Mirroring is only
+        // correct for the in-tree dogfood path (taskSourceType unset +
+        // repoTasksPath set, e.g. external-eval.yml).
+        if (ctx.config.taskSourceType === "repo") {
+            return {
+                status: "skipped",
+                reason: 'taskSourceType="repo" — inline tasks are not mirrored',
+            };
+        }
         // Need a write token for mirroring
         const token = process.env.AILF_REPORT_SANITY_API_TOKEN ?? process.env.SANITY_API_TOKEN;
         if (!token) {

package/dist/pipeline/run-context.d.ts

@@ -12,7 +12,7 @@
  *
  * @see docs/decisions/D0032-run-anchored-artifact-store.md (§ Move 5 — Drift Prevention)
  */
-import type { Logger, RunContext } from "../_vendor/ailf-core/index.d.ts";
+import { type Logger, type RunContext } from "../_vendor/ailf-core/index.d.ts";
 import { type RunClassification, type RunExecutor, type RunExecutorSurface, type RunHost, type RunLineage, type RunOwner, type RunTool } from "../_vendor/ailf-shared/index.d.ts";
 import type { ResolvedSourceConfig } from "../sources.js";
 import type { EvalMode } from "./types.js";
@@ -92,6 +92,11 @@ export declare function detectClassification(log: Logger): RunClassification;
 /**
  * Resolve `owner` from `AILF_OWNER_TEAM` (+ optional
  * `AILF_OWNER_INDIVIDUAL`). `team` is free-form; default is `"unknown"`.
+ *
+ * The init-template placeholder (`PLACEHOLDER_OWNER_TEAM`) is treated as
+ * if the env var were unset — consumers that haven't filled it in yet
+ * end up with `team: "unknown"` instead of the literal placeholder being
+ * persisted onto the report (W0143).
  */
 export declare function detectOwner(): RunOwner;
 /**

package/dist/pipeline/run-context.js

@@ -15,6 +15,7 @@
 import { execSync } from "node:child_process";
 import { createRequire } from "node:module";
 import * as os from "node:os";
+import { PLACEHOLDER_OWNER_TEAM, } from "../_vendor/ailf-core/index.js";
 import { isRunClassification, } from "../_vendor/ailf-shared/index.js";
 import { ConsoleLogger } from "../adapters/loggers/index.js";
 import { tryLoadConfigFile } from "./compiler/config-loader.js";
@@ -45,7 +46,15 @@ export function buildRunContext(input) {
     // preservation across the --remote boundary.
     const envelope = input.callerEnvelope;
     const classification = envelope?.classification ?? detectClassification(log);
-    const owner = envelope?.owner ?? detectOwner();
+    // W0143: a caller-supplied owner whose team is the init-template
+    // placeholder is treated as "user hasn't filled this in yet" — drop the
+    // envelope owner and fall through to env detection (which performs the
+    // same sanitization on AILF_OWNER_TEAM). Avoids persisting the literal
+    // placeholder verbatim on the report.
+    const sanitizedEnvelopeOwner = envelope?.owner && envelope.owner.team !== PLACEHOLDER_OWNER_TEAM
+        ? envelope.owner
+        : undefined;
+    const owner = sanitizedEnvelopeOwner ?? detectOwner();
     const executor = envelope?.executor ?? detectExecutor();
     // `tool` and `host` are server-environment facts — they always reflect
     // where this pipeline is actually running, never what a caller claimed.
@@ -184,9 +193,15 @@ export function detectClassification(log) {
 /**
  * Resolve `owner` from `AILF_OWNER_TEAM` (+ optional
  * `AILF_OWNER_INDIVIDUAL`). `team` is free-form; default is `"unknown"`.
+ *
+ * The init-template placeholder (`PLACEHOLDER_OWNER_TEAM`) is treated as
+ * if the env var were unset — consumers that haven't filled it in yet
+ * end up with `team: "unknown"` instead of the literal placeholder being
+ * persisted onto the report (W0143).
  */
 export function detectOwner() {
-    const team = process.env.AILF_OWNER_TEAM?.trim() || "unknown";
+    const rawTeam = process.env.AILF_OWNER_TEAM?.trim();
+    const team = rawTeam && rawTeam !== PLACEHOLDER_OWNER_TEAM ? rawTeam : "unknown";
     const individual = process.env.AILF_OWNER_INDIVIDUAL?.trim() || undefined;
     return individual ? { individual, team } : { team };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sanity/ailf",
-  "version": "4.0.5",
+  "version": "4.0.7",
   "private": false,
   "publishConfig": {
     "access": "public"

package/dist/orchestration/load-pipeline-tasks.d.ts

@@ -1,40 +0,0 @@
-/**
- * Shared task loading for pipeline orchestration steps.
- *
- * Both FetchDocsStep and GenerateConfigsStep need to see the same set of
- * tasks. This function loads from filesystem .task.ts files — the
- * authoritative source for the current pipeline architecture.
- *
- * Background: The composition root wires ctx.taskSource to
- * ContentLakeTaskSource by default, but GenerateConfigsStep bypasses it
- * and loads directly from the filesystem. FetchDocsStep must use the
- * same source to avoid a mismatch where configs reference context files
- * that were never fetched.
- *
- * @see packages/eval/src/orchestration/steps/generate-configs-step.ts
- * @see packages/eval/src/orchestration/steps/fetch-docs-step.ts
- */
-import type { GeneralizedTaskDefinition } from "../_vendor/ailf-core/index.d.ts";
-export interface LoadPipelineTasksOptions {
-    /** Absolute path to the eval package root (packages/eval) */
-    rootDir: string;
-    /** Evaluation mode — determines the tasks/{mode}/ subdirectory */
-    mode: string;
-    /** Optional extra directory for repo-based tasks (--repo-tasks-path) */
-    repoTasksPath?: string;
-    /**
-     * When `"repo"`, load ONLY from `repoTasksPath` and skip the AILF
-     * bundled `tasks/${mode}/` directory. Mirrors the composition-root
-     * contract for `taskSourceType: "repo"` (see composition-root.ts).
-     */
-    taskSourceType?: "content-lake" | "repo";
-}
-/**
- * Load task definitions from the filesystem, matching the pipeline's
- * authoritative task source.
- *
- * Discovers and loads `*.task.ts` files from `tasks/{mode}/` and
- * optionally `--repo-tasks-path`. Tasks whose `mode` field doesn't
- * match the requested mode are excluded.
- */
-export declare function loadPipelineTasks(opts: LoadPipelineTasksOptions): Promise<GeneralizedTaskDefinition[]>;

package/dist/orchestration/load-pipeline-tasks.js

@@ -1,57 +0,0 @@
-/**
- * Shared task loading for pipeline orchestration steps.
- *
- * Both FetchDocsStep and GenerateConfigsStep need to see the same set of
- * tasks. This function loads from filesystem .task.ts files — the
- * authoritative source for the current pipeline architecture.
- *
- * Background: The composition root wires ctx.taskSource to
- * ContentLakeTaskSource by default, but GenerateConfigsStep bypasses it
- * and loads directly from the filesystem. FetchDocsStep must use the
- * same source to avoid a mismatch where configs reference context files
- * that were never fetched.
- *
- * @see packages/eval/src/orchestration/steps/generate-configs-step.ts
- * @see packages/eval/src/orchestration/steps/fetch-docs-step.ts
- */
-import { resolve } from "path";
-import { discoverTsTaskFiles, loadTsTaskFile, } from "../adapters/task-sources/task-file-loader.js";
-import { resolveVendoredSubdir } from "../pipeline/compiler/config-loader.js";
-/**
- * Load task definitions from the filesystem, matching the pipeline's
- * authoritative task source.
- *
- * Discovers and loads `*.task.ts` files from `tasks/{mode}/` and
- * optionally `--repo-tasks-path`. Tasks whose `mode` field doesn't
- * match the requested mode are excluded.
- */
-export async function loadPipelineTasks(opts) {
-    const dirs = [];
-    if (opts.taskSourceType !== "repo") {
-        dirs.push(resolveVendoredSubdir(opts.rootDir, `tasks/${opts.mode}`));
-    }
-    else if (!opts.repoTasksPath) {
-        throw new Error('taskSourceType "repo" requires repoTasksPath to be set (no AILF defaults loaded in repo-only mode)');
-    }
-    if (opts.repoTasksPath) {
-        const repoDir = resolve(opts.repoTasksPath);
-        if (!dirs.includes(repoDir)) {
-            dirs.push(repoDir);
-        }
-    }
-    const tasks = [];
-    for (const dir of dirs) {
-        const files = discoverTsTaskFiles(dir);
-        for (const file of files) {
-            const raw = await loadTsTaskFile(file);
-            for (const t of raw.tasks) {
-                const task = t;
-                // Filter to matching mode (skip tasks from other modes in same dir)
-                if (!("mode" in task) || task.mode === opts.mode) {
-                    tasks.push(task);
-                }
-            }
-        }
-    }
-    return tasks;
-}