@sanity/ailf 4.0.6 → 4.1.0

package/dist/composition-root.js

@@ -32,9 +32,10 @@ import { PromptfooEvalAdapter } from "./adapters/eval-runners/promptfoo-eval-ada
 import { ConsoleLogger, JsonLogger, QuietLogger, } from "./adapters/loggers/index.js";
 import { ConsoleProgressReporter } from "./adapters/progress/console-progress-reporter.js";
 import { CompositeTaskSource, ContentLakeTaskSource, RepoTaskSource, } from "./adapters/task-sources/index.js";
+import { resolveVendoredSubdir } from "./pipeline/compiler/config-loader.js";
 import { createAgentHarnessBase, createKnowledgeProbeBase, createLiteracyModeBase, createMcpServerModeBase, } from "./pipeline/compiler/mode-bases/index.js";
 import { createSanityLiteracyPreset } from "./pipeline/compiler/presets/index.js";
-import { getSanityClient } from "./sanity/client.js";
+import { getAilfSanityClient } from "./sanity/client.js";
 import { ReportStore } from "./report-store.js";
 import { loadSinks } from "./sinks/index.js";
 /**
@@ -297,7 +298,12 @@ function createCache(config) {
         return local;
     return new ContentLakeCacheAdapter(local, createReportStore(config));
 }
-function createTaskSource(config) {
+/**
+ * Build the `TaskSource` adapter wired by the composition root for a
+ * given `ResolvedConfig`. Exported for test access — composition-root
+ * wiring is a contract worth asserting directly.
+ */
+export function createTaskSource(config) {
     // "repo" mode — use ONLY repo tasks, no Content Lake or YAML merge.
     // This is the correct mode for API-triggered inline-task evaluations
     // where the caller sent their own task definitions. Without this,
@@ -309,21 +315,30 @@ function createTaskSource(config) {
         }
         return new RepoTaskSource(config.repoTasksPath);
     }
-    // Primary source — Content Lake (the only non-repo source remaining)
-    const primary = new ContentLakeTaskSource(getSanityClient({
-        token: process.env.AILF_REPORT_SANITY_API_TOKEN ??
-            process.env.SANITY_API_TOKEN ??
-            undefined,
-    }));
-    // If repo tasks path is set, combine primary + repo sources.
-    // This is the "augment" mode — repo tasks extend the primary source.
+    // "content-lake" — Studio-authored ailf.task documents only.
+    // AILF documents live in the private dataset (D0043) — route through
+    // the AILF client factory so reads target `ailf-prod-private`.
+    if (config.taskSourceType === "content-lake") {
+        return new ContentLakeTaskSource(getAilfSanityClient({
+            token: process.env.AILF_REPORT_SANITY_API_TOKEN ??
+                process.env.SANITY_API_TOKEN ??
+                undefined,
+        }));
+    }
+    // Unset — AILF-bundled defaults from `tasks/${mode}/`, optionally
+    // augmented with the caller's `--repo-tasks-path` (W0146). The
+    // bundled directory is allowed to be missing so test rootDirs and
+    // modes that ship no defaults degrade gracefully to the augment
+    // source (or empty).
+    const bundledDir = resolveVendoredSubdir(config.rootDir, `tasks/${config.mode}`);
+    const bundled = new RepoTaskSource(bundledDir, { allowMissing: true });
     if (config.repoTasksPath) {
         return new CompositeTaskSource([
-            primary,
+            bundled,
             new RepoTaskSource(config.repoTasksPath),
         ]);
     }
-    return primary;
+    return bundled;
 }
 // ---------------------------------------------------------------------------
 // Layer 0: Framework built-in assertions

package/dist/index.d.ts

@@ -38,6 +38,6 @@ export type { PricingEntry, PromptEntry, SourceEntry } from "./_vendor/ailf-core
 export { env } from "./_vendor/ailf-core/index.d.ts";
 export type { AgentHarnessTaskDefinition, CustomTaskDefinition, GeneralizedAssertionDefinition, GeneralizedDocRef, GeneralizedTaskDefinition, GeneralizedTemplatedAssertion, GeneralizedValueAssertion, IdDocRef, KnowledgeProbeTaskDefinition, LiteracyTaskDefinition, MCPServerTaskDefinition, PathDocRef, PerspectiveDocRef, RubricRef, SlugDocRef, TaskCommonFields, TaskDifficulty, TaskOptions, TaskProviderConfig, TaskStatus, } from "./_vendor/ailf-core/index.d.ts";
 export { CanonicalTaskFileSchema, CanonicalTaskSchema, CURATED_ASSERTION_TYPES, detectLegacyFieldNames, parseCanonicalTaskFile, RUBRIC_TEMPLATE_NAMES, type CanonicalTask, type CuratedAssertionType, type RubricTemplateName, } from "./adapters/task-sources/repo-schemas.js";
-export { formatValidationResult, validateCanonicalTasks, type ValidationMessage, type ValidationResult, } from "./adapters/task-sources/repo-validation.js";
+export { formatRepoValidationResult, validateCanonicalTasks, type RepoValidationMessage, type RepoValidationResult, } from "./adapters/task-sources/repo-validation.js";
 export { InMemoryPluginRegistry } from "./_vendor/ailf-core/index.d.ts";
 export type { CompilationContext, ModeBase, ModeCompileResult, ModeHandler, PresetDefinition, } from "./_vendor/ailf-core/index.d.ts";

package/dist/index.js

@@ -45,7 +45,7 @@ export { env } from "./_vendor/ailf-core/index.js";
 // Validation — for programmatic validation of task YAML
 // ---------------------------------------------------------------------------
 export { CanonicalTaskFileSchema, CanonicalTaskSchema, CURATED_ASSERTION_TYPES, detectLegacyFieldNames, parseCanonicalTaskFile, RUBRIC_TEMPLATE_NAMES, } from "./adapters/task-sources/repo-schemas.js";
-export { formatValidationResult, validateCanonicalTasks, } from "./adapters/task-sources/repo-validation.js";
+export { formatRepoValidationResult, validateCanonicalTasks, } from "./adapters/task-sources/repo-validation.js";
 // ---------------------------------------------------------------------------
 // Plugin extension points — for authoring custom presets, modes, and registries
 // ---------------------------------------------------------------------------

package/dist/job-store.js

@@ -11,7 +11,7 @@
  * @see docs/design-docs/api-service-gateway.md
  * @see packages/studio/src/schema/job.ts — Sanity document schema
  */
-import { getSanityClient } from "./sanity/client.js";
+import { getAilfSanityClient } from "./sanity/client.js";
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -28,7 +28,7 @@ export class JobStore {
             this.client = options.client;
         }
         else {
-            this.client = getSanityClient({
+            this.client = getAilfSanityClient({
                 ...(options.dataset ? { dataset: options.dataset } : {}),
                 ...(options.projectId ? { projectId: options.projectId } : {}),
                 ...(options.token ? { token: options.token } : {}),

package/dist/lib/dotenv-resolution.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Dotenv resolution helpers shared between the CLI bootstrap
+ * (`packages/eval/src/cli.ts`) and any code path that needs to honor the
+ * same `--dotenv <path>` override (today: `pipeline/checks.ts::checkEnvironment`,
+ * which re-loads the active env file as part of validation).
+ *
+ * Centralizing the argv parse means future changes — validating the path
+ * exists before returning, supporting `--dotenv=path` form, accepting an
+ * env-var fallback — happen in one place instead of drifting between
+ * call sites.
+ */
+/**
+ * Find an explicit `--dotenv <path>` argument and return its absolute,
+ * resolved path. Returns `undefined` when the flag is absent or has no
+ * following value.
+ *
+ * @param argv - Defaults to `process.argv`. Pass an explicit array in
+ *   tests or in non-CLI hosts that have already shifted off the script
+ *   prefix.
+ */
+export declare function findExplicitDotenvArg(argv?: readonly string[]): string | undefined;

package/dist/lib/dotenv-resolution.js

@@ -0,0 +1,30 @@
+/**
+ * Dotenv resolution helpers shared between the CLI bootstrap
+ * (`packages/eval/src/cli.ts`) and any code path that needs to honor the
+ * same `--dotenv <path>` override (today: `pipeline/checks.ts::checkEnvironment`,
+ * which re-loads the active env file as part of validation).
+ *
+ * Centralizing the argv parse means future changes — validating the path
+ * exists before returning, supporting `--dotenv=path` form, accepting an
+ * env-var fallback — happen in one place instead of drifting between
+ * call sites.
+ */
+import { resolve } from "node:path";
+/**
+ * Find an explicit `--dotenv <path>` argument and return its absolute,
+ * resolved path. Returns `undefined` when the flag is absent or has no
+ * following value.
+ *
+ * @param argv - Defaults to `process.argv`. Pass an explicit array in
+ *   tests or in non-CLI hosts that have already shifted off the script
+ *   prefix.
+ */
+export function findExplicitDotenvArg(argv = process.argv) {
+    const idx = argv.indexOf("--dotenv");
+    if (idx === -1)
+        return undefined;
+    const value = argv[idx + 1];
+    if (!value)
+        return undefined;
+    return resolve(value);
+}

package/dist/orchestration/steps/fetch-docs-step.js

@@ -17,7 +17,6 @@ import { emitFileContents } from "../../artifact-capture/emit-file.js";
 import { getStepInputPaths } from "../../pipeline/cache.js";
 import { buildCacheContext } from "../cache-context.js";
 import { checkCanonicalContextsExist } from "../../pipeline/checks.js";
-import { loadPipelineTasks } from "../load-pipeline-tasks.js";
 import { loadSource } from "../../sources.js";
 import { configToSourceOverrides } from "../config-to-source-overrides.js";
 export class FetchDocsStep {
@@ -30,35 +29,16 @@ export class FetchDocsStep {
             return { status: "skipped", reason: "--no-fetch" };
         }
         const start = Date.now();
-        // Load tasks — use the same source as GenerateConfigsStep to avoid
-        // a mismatch where configs reference context files that were never
-        // fetched.
-        //
-        // Adapter path: ctx.taskSource handles both content-lake and repo modes.
-        // The composition root wires the right adapter (ContentLakeTaskSource
-        // or RepoTaskSource) per taskSourceType. RepoTaskSource loads BOTH
-        // .yaml and .task.ts files — necessary for external-consumer evals
-        // that materialize inline tasks as YAML (W0148).
-        // Filesystem path: load from .task.ts files (legacy unset path —
-        // AILF defaults from tasks/${mode}/ + optional repoTasksPath augment).
-        let allTasks;
-        if (ctx.config.taskSourceType === "content-lake" ||
-            ctx.config.taskSourceType === "repo") {
-            const filter = {
-                ...(ctx.config.areas?.length ? { areas: ctx.config.areas } : {}),
-                ...(ctx.config.tasks?.length ? { taskIds: ctx.config.tasks } : {}),
-                ...(ctx.config.tags?.length ? { tags: ctx.config.tags } : {}),
-            };
-            allTasks = await ctx.taskSource.loadTasks(Object.keys(filter).length > 0 ? filter : undefined);
-        }
-        else {
-            allTasks = await loadPipelineTasks({
-                rootDir: ctx.config.rootDir,
-                mode: ctx.config.mode,
-                repoTasksPath: ctx.config.repoTasksPath,
-                taskSourceType: ctx.config.taskSourceType,
-            });
-        }
+        // Load tasks via ctx.taskSource — the composition root wires the
+        // right adapter for every taskSourceType (W0146). FetchDocsStep and
+        // GenerateConfigsStep MUST go through the same adapter so configs
+        // reference context files that were actually fetched.
+        const filter = {
+            ...(ctx.config.areas?.length ? { areas: ctx.config.areas } : {}),
+            ...(ctx.config.tasks?.length ? { taskIds: ctx.config.tasks } : {}),
+            ...(ctx.config.tags?.length ? { tags: ctx.config.tags } : {}),
+        };
+        const allTasks = await ctx.taskSource.loadTasks(Object.keys(filter).length > 0 ? filter : undefined);
         // Bridge: narrow to literacy tasks for canonical doc access
         const literacyTasks = allTasks.filter((t) => t.mode === "literacy");
         const tasksWithDocs = literacyTasks.filter((t) => (t.context?.docs?.length ?? 0) > 0);

package/dist/orchestration/steps/generate-configs-step.d.ts

@@ -17,24 +17,17 @@ export declare class GenerateConfigsStep implements PipelineStep {
     execute(ctx: AppContext, state: PipelineState): Promise<StepResult>;
     private compileLiteracyVariants;
     private compileSingleMode;
-    private loadTasks;
     /**
-     * Load tasks via ctx.taskSource (the composition-root-wired adapter).
+     * Load tasks via ctx.taskSource — the single adapter wired by the
+     * composition root for every taskSourceType (W0146). FetchDocsStep
+     * and GenerateConfigsStep MUST go through the same adapter so configs
+     * reference context files that were actually fetched.
      *
-     * Used for both `taskSourceType === "content-lake"` (ContentLakeTaskSource)
-     * and `taskSourceType === "repo"` (RepoTaskSource). Filtering by
-     * area/task/tag is delegated to the adapter — ContentLakeTaskSource
-     * pushes it into the GROQ query, RepoTaskSource applies it in-memory.
+     * Filtering by area/task/tag is delegated to the adapter:
+     * ContentLakeTaskSource pushes it into the GROQ query;
+     * RepoTaskSource applies it in-memory.
      */
-    private loadTasksFromAdapter;
-    /**
-     * Load tasks from filesystem .task.ts files.
-     *
-     * This is the original path used for repo-based and inline tasks.
-     * It scans tasks/{mode}/ and optionally --repo-tasks-path.
-     */
-    private loadTasksFromFilesystem;
-    private applyFilters;
+    private loadTasks;
     /**
      * Build a descriptive error message when no tasks match the current filters.
      * Distinguishes between "no tasks exist" and "tasks exist but filters exclude them".

package/dist/orchestration/steps/generate-configs-step.js

@@ -208,99 +208,36 @@ export class GenerateConfigsStep {
     // ---------------------------------------------------------------------------
     // Task loading — unified for all modes
     // ---------------------------------------------------------------------------
-    async loadTasks(ctx, mode, state) {
-        // Adapter path — use ctx.taskSource. The composition root wires the
-        // right adapter for each taskSourceType:
-        //   - "content-lake" → ContentLakeTaskSource (Studio-owned ailf.task docs)
-        //   - "repo"         → RepoTaskSource (loads .yaml AND .task.ts from repoTasksPath)
-        // Routing both through ctx.taskSource keeps the orchestration step
-        // file-format-agnostic (W0148: external-consumer evals materialize
-        // inline tasks as .yaml, which loadPipelineTasks can't read).
-        if (ctx.config.taskSourceType === "content-lake" ||
-            ctx.config.taskSourceType === "repo") {
-            return this.loadTasksFromAdapter(ctx, state);
-        }
-        // Filesystem path — load from .task.ts files (legacy unset path:
-        // AILF defaults from tasks/${mode}/ + optional repoTasksPath augment).
-        return this.loadTasksFromFilesystem(ctx, mode, state);
-    }
     /**
-     * Load tasks via ctx.taskSource (the composition-root-wired adapter).
+     * Load tasks via ctx.taskSource — the single adapter wired by the
+     * composition root for every taskSourceType (W0146). FetchDocsStep
+     * and GenerateConfigsStep MUST go through the same adapter so configs
+     * reference context files that were actually fetched.
      *
-     * Used for both `taskSourceType === "content-lake"` (ContentLakeTaskSource)
-     * and `taskSourceType === "repo"` (RepoTaskSource). Filtering by
-     * area/task/tag is delegated to the adapter — ContentLakeTaskSource
-     * pushes it into the GROQ query, RepoTaskSource applies it in-memory.
+     * Filtering by area/task/tag is delegated to the adapter:
+     * ContentLakeTaskSource pushes it into the GROQ query;
+     * RepoTaskSource applies it in-memory.
      */
-    async loadTasksFromAdapter(ctx, state) {
+    async loadTasks(ctx, mode, state) {
         const filter = {
             ...(ctx.config.areas?.length ? { areas: ctx.config.areas } : {}),
             ...(ctx.config.tasks?.length ? { taskIds: ctx.config.tasks } : {}),
             ...(ctx.config.tags?.length ? { tags: ctx.config.tags } : {}),
         };
-        const tasks = await ctx.taskSource.loadTasks(Object.keys(filter).length > 0 ? filter : undefined);
-        // Capture loaded IDs for error messages (same as filesystem path)
-        this.lastLoadedTaskIds = tasks
-            .map((t) => t.id)
-            .filter((id) => !!id);
-        // Release auto-scope
-        if (state.releaseAutoScope && !ctx.config.noAutoScope) {
-            const scopedIds = new Set(state.releaseAutoScope.affectedTaskIds);
-            const beforeCount = tasks.length;
-            const scoped = tasks.filter((t) => "id" in t && scopedIds.has(t.id));
-            ctx.logger.info(`  🎯 Auto-scoped to ${scoped.length} of ${beforeCount} task(s) affected by release`);
-            return scoped;
-        }
-        return tasks;
-    }
-    /**
-     * Load tasks from filesystem .task.ts files.
-     *
-     * This is the original path used for repo-based and inline tasks.
-     * It scans tasks/{mode}/ and optionally --repo-tasks-path.
-     */
-    async loadTasksFromFilesystem(ctx, mode, state) {
-        const { resolve } = await import("path");
-        const { discoverTsTaskFiles, loadTsTaskFile } = await import("../../adapters/task-sources/task-file-loader.js");
-        const { resolveVendoredSubdir } = await import("../../pipeline/compiler/config-loader.js");
-        // Discover task files from the mode-specific directory and --repo-tasks-path.
-        // Use vendored copies in dist/ when @sanity/ailf-core isn't resolvable
-        // (i.e., running outside the monorepo via npx).
-        //
-        // When taskSourceType === "repo", skip the AILF-bundled tasks/${mode}/
-        // directory and load ONLY from repoTasksPath. Mirrors the composition-root
-        // contract for repo-only mode (see composition-root.ts:392-405).
-        const dirs = [];
-        if (ctx.config.taskSourceType !== "repo") {
-            dirs.push(resolveVendoredSubdir(ctx.config.rootDir, `tasks/${mode}`));
-        }
-        else if (!ctx.config.repoTasksPath) {
-            throw new Error('taskSourceType "repo" requires repoTasksPath to be set (no AILF defaults loaded in repo-only mode)');
-        }
-        // Also search --repo-tasks-path (e.g., .ailf/tasks/) for repo-based tasks
-        if (ctx.config.repoTasksPath) {
-            const repoDir = resolve(ctx.config.repoTasksPath);
-            if (!dirs.includes(repoDir)) {
-                dirs.push(repoDir);
-            }
-        }
+        const allTasks = await ctx.taskSource.loadTasks(Object.keys(filter).length > 0 ? filter : undefined);
+        // Mode filter — the adapter may return a mixed-mode set (e.g. a user's
+        // `--repo-tasks-path` containing tasks of multiple modes). Skip
+        // non-matching modes with a warning so unintentional misclassification
+        // is visible without breaking the run.
         const tasks = [];
         const skippedByMode = new Map();
-        for (const dir of dirs) {
-            const files = discoverTsTaskFiles(dir);
-            for (const file of files) {
-                const raw = await loadTsTaskFile(file);
-                for (const t of raw.tasks) {
-                    const task = t;
-                    // Filter to matching mode (skip tasks from other modes in same dir)
-                    if (!("mode" in task) || task.mode === mode) {
-                        tasks.push(task);
-                    }
-                    else {
-                        const taskMode = task.mode ?? "unknown";
-                        skippedByMode.set(taskMode, (skippedByMode.get(taskMode) ?? 0) + 1);
-                    }
-                }
+        for (const task of allTasks) {
+            if (!("mode" in task) || task.mode === mode) {
+                tasks.push(task);
+            }
+            else {
+                const taskMode = task.mode ?? "unknown";
+                skippedByMode.set(taskMode, (skippedByMode.get(taskMode) ?? 0) + 1);
             }
         }
         if (skippedByMode.size > 0) {
@@ -310,46 +247,17 @@ export class GenerateConfigsStep {
                 .join(", ");
             ctx.logger.warn(`  ⚠ Skipped ${total} task(s) with non-matching mode (${summary}). Current pipeline mode: ${mode}. Run with --mode <mode> to include them.`);
         }
-        // Apply area/task/tag filters
-        const filtered = this.applyFilters(ctx, tasks);
-        // Release auto-scope
+        this.lastLoadedTaskIds = tasks
+            .map((t) => t.id)
+            .filter((id) => !!id);
         if (state.releaseAutoScope && !ctx.config.noAutoScope) {
             const scopedIds = new Set(state.releaseAutoScope.affectedTaskIds);
-            const beforeCount = filtered.length;
-            const scoped = filtered.filter((t) => "id" in t && scopedIds.has(t.id));
+            const beforeCount = tasks.length;
+            const scoped = tasks.filter((t) => "id" in t && scopedIds.has(t.id));
             ctx.logger.info(`  🎯 Auto-scoped to ${scoped.length} of ${beforeCount} task(s) affected by release`);
             return scoped;
         }
-        return filtered;
-    }
-    applyFilters(ctx, tasks) {
-        // Capture pre-filter IDs for diagnostic messages
-        this.lastLoadedTaskIds = tasks
-            .map((t) => t.id)
-            .filter((id) => !!id);
-        let result = tasks;
-        if (ctx.config.areas?.length) {
-            const allowed = new Set(ctx.config.areas.map((a) => a.toLowerCase()));
-            result = result.filter((t) => {
-                const area = t.area?.toLowerCase();
-                return area && allowed.has(area);
-            });
-        }
-        if (ctx.config.tasks?.length) {
-            const allowed = new Set(ctx.config.tasks);
-            result = result.filter((t) => {
-                const id = t.id;
-                return id && allowed.has(id);
-            });
-        }
-        if (ctx.config.tags?.length) {
-            const allowed = new Set(ctx.config.tags);
-            result = result.filter((t) => {
-                const tags = t.tags;
-                return tags?.some((tag) => allowed.has(tag));
-            });
-        }
-        return result;
+        return tasks;
     }
     /**
      * Build a descriptive error message when no tasks match the current filters.

package/dist/orchestration/steps/mirror-repo-tasks-step.js

@@ -12,7 +12,7 @@
  * @see packages/eval/src/pipeline/mirror-repo-tasks.ts
  * @see docs/archive/exec-plans/tasks-as-content/phase-5-content-lake-mirroring.md
  */
-import { getSanityClient } from "../../sanity/client.js";
+import { getAilfSanityClient, getSanityClient } from "../../sanity/client.js";
 import { detectGitContext, mirrorRepoTasks, } from "../../pipeline/mirror-repo-tasks.js";
 export class MirrorRepoTasksStep {
     name = "mirror-repo-tasks";
@@ -28,6 +28,18 @@ export class MirrorRepoTasksStep {
         if (!ctx.config.repoTasksPath) {
             return { status: "skipped", reason: "No --repo-tasks-path provided" };
         }
+        // W0145 — never mirror under repo-only mode. The API gateway maps
+        // PipelineRequest.taskMode="inline" → taskSourceType="repo", so an
+        // external consumer's ephemeral inline tasks would otherwise be
+        // upserted into AILF's canonical Content Lake. Mirroring is only
+        // correct for the in-tree dogfood path (taskSourceType unset +
+        // repoTasksPath set, e.g. external-eval.yml).
+        if (ctx.config.taskSourceType === "repo") {
+            return {
+                status: "skipped",
+                reason: 'taskSourceType="repo" — inline tasks are not mirrored',
+            };
+        }
         // Need a write token for mirroring
         const token = process.env.AILF_REPORT_SANITY_API_TOKEN ?? process.env.SANITY_API_TOKEN;
         if (!token) {
@@ -54,11 +66,22 @@ export class MirrorRepoTasksStep {
             // Detect git context (from env vars or git CLI)
             const git = await detectGitContext(ctx.config.repoTasksPath);
             ctx.logger.info(`  Mirroring ${repoTasks.length} repo task(s) from ${git.repo}@${git.branch}`);
-            // Create a client with write access
-            const client = getSanityClient({ token });
+            // Two clients are required after the D0043 dataset split:
+            //   - `client` writes ailf.task / ailf.featureArea to the AILF
+            //     dataset and reads existing mirror state — uses the
+            //     AILF-scoped token explicitly so writes work even when
+            //     SANITY_API_TOKEN is editorial-read-only.
+            //   - `editorialClient` resolves `article` slugs against the
+            //     editorial dataset. Operators may scope the AILF token to
+            //     AILF only (D0043 consequence #5); using it here would
+            //     401 on the editorial query. Let it pick up SANITY_API_TOKEN
+            //     from the default config instead.
+            const client = getAilfSanityClient({ token });
+            const editorialClient = getSanityClient();
             // Run the mirror
             const result = await mirrorRepoTasks({
                 client,
+                editorialClient,
                 git,
                 logger: ctx.logger,
                 tasks: repoTasks,

package/dist/orchestration/steps/run-eval-step.js

@@ -111,10 +111,28 @@ export class RunEvalStep {
                 // required eval modes were satisfied from the remote cache.
                 state.remoteCacheHits ??= new Set();
                 state.remoteCacheHits.add(this.mode);
-                // Carry forward Promptfoo share URLs from the cached report
-                if (remoteCacheResult.promptfooUrls?.length) {
+                // Carry forward the share-link backreference for THIS mode only.
+                // Pushing every entry from `remoteCacheResult.promptfooUrls`
+                // snowballs across the daily perspective cron: each cache-hit
+                // run inherits the cached report's full URL list (including
+                // other modes and any URLs the cached report had itself
+                // accumulated from earlier hits), then layers its own on top.
+                // Iterate from the tail to handle pre-fix cached reports that
+                // may carry multiple entries for the same mode.
+                const cachedUrls = remoteCacheResult.promptfooUrls;
+                let inherited;
+                if (cachedUrls) {
+                    for (let i = cachedUrls.length - 1; i >= 0; i--) {
+                        const entry = cachedUrls[i];
+                        if (entry?.mode === this.mode) {
+                            inherited = entry;
+                            break;
+                        }
+                    }
+                }
+                if (inherited) {
                     state.promptfooUrls ??= [];
-                    state.promptfooUrls.push(...remoteCacheResult.promptfooUrls);
+                    state.promptfooUrls.push(inherited);
                 }
                 // D0040 / W0135 — restore the cached report's artifact manifest into
                 // the accumulator so the new run's RunManifest advertises the cached

package/dist/pipeline/agent-behavior-report.d.ts

@@ -4,7 +4,9 @@
  * Pure analysis functions for agent behavior observation reports.
  * No I/O, no process.env, no process.argv — all data is passed in.
  */
+import type { TestResult } from "../_vendor/ailf-core/index.d.ts";
 import type { AgentBehaviorSummary } from "../agent-observer/types.js";
+export type { TestResult } from "../_vendor/ailf-core/index.d.ts";
 export interface PromptfooResults {
     results: TestResult[];
 }
@@ -13,14 +15,6 @@ export interface PromptfooResultsEnvelope {
         results: TestResult[];
     };
 }
-export interface TestResult {
-    description: string;
-    metadata?: Record<string, unknown>;
-    response: {
-        output: string;
-    };
-    vars: Record<string, string>;
-}
 export interface TaskBehavior {
     behavior: AgentBehaviorSummary;
     description: string;

package/dist/pipeline/cache.d.ts

@@ -28,7 +28,7 @@ export interface CacheEntry {
     timestamp: string;
 }
 /** Result of a cache lookup */
-export type CacheLookupResult = {
+export type ManifestCacheLookupResult = {
     hit: false;
     currentHash: string;
 } | {
@@ -84,7 +84,7 @@ export declare function hashFiles(paths: string[], context?: string[]): string;
  * Optional `context` strings are included in the hash so that non-file
  * state (e.g., area/task filter flags) participates in cache key computation.
  */
-export declare function lookupCache(rootDir: string, step: string, context?: string[]): CacheLookupResult;
+export declare function lookupCache(rootDir: string, step: string, context?: string[]): ManifestCacheLookupResult;
 /**
  * Read the cache manifest for a step.
  * Returns null if no manifest exists or it's corrupt.

package/dist/pipeline/checks.d.ts

@@ -18,8 +18,16 @@ export declare function checkCanonicalContextsExist(rootDir: string, taskIds: st
 export declare function checkContextsExist(rootDir: string, areas: string[]): ValidationIssue[];
 /**
  * Check that required environment variables are set.
- * Loads the root `.env` file first (with override, matching the dotenv CLI
- * `-o` flag used by other scripts), then checks for required keys.
+ *
+ * Loads the resolved `.env` file first (with override, matching the dotenv
+ * CLI `-o` flag used by other scripts), then checks for required keys. The
+ * resolution order mirrors `cli.ts`'s `resolveEnvPath()` so a `--dotenv
+ * <path>` argument on the parent CLI invocation isn't silently clobbered
+ * here. Without this, a Tier 2 test that uses `--dotenv` to override
+ * tenant-pointing vars (e.g. `AILF_GCS_ARTIFACT_BUCKET`,
+ * `GOOGLE_APPLICATION_CREDENTIALS`) gets its overrides reverted to the
+ * repo `.env` values when this function runs as part of the validate
+ * step. (W0138 Slice 2 surface — see `gcs-pipeline-replay-roundtrip.test.ts`.)
  */
 export declare function checkEnvironment(rootDir: string): ValidationIssue[];
 /**

package/dist/pipeline/checks.js

@@ -8,6 +8,7 @@
 import { config as loadEnv } from "dotenv";
 import { existsSync, readFileSync, statSync } from "fs";
 import { join, resolve } from "path";
+import { findExplicitDotenvArg } from "../lib/dotenv-resolution.js";
 import { configFileForMode } from "./eval-constants.js";
 // ---------------------------------------------------------------------------
 // Precondition: contexts exist for each feature area
@@ -80,13 +81,22 @@ export function checkContextsExist(rootDir, areas) {
 // ---------------------------------------------------------------------------
 /**
  * Check that required environment variables are set.
- * Loads the root `.env` file first (with override, matching the dotenv CLI
- * `-o` flag used by other scripts), then checks for required keys.
+ *
+ * Loads the resolved `.env` file first (with override, matching the dotenv
+ * CLI `-o` flag used by other scripts), then checks for required keys. The
+ * resolution order mirrors `cli.ts`'s `resolveEnvPath()` so a `--dotenv
+ * <path>` argument on the parent CLI invocation isn't silently clobbered
+ * here. Without this, a Tier 2 test that uses `--dotenv` to override
+ * tenant-pointing vars (e.g. `AILF_GCS_ARTIFACT_BUCKET`,
+ * `GOOGLE_APPLICATION_CREDENTIALS`) gets its overrides reverted to the
+ * repo `.env` values when this function runs as part of the validate
+ * step. (W0138 Slice 2 surface — see `gcs-pipeline-replay-roundtrip.test.ts`.)
  */
 export function checkEnvironment(rootDir) {
     const issues = [];
-    // Load root .env so we see the same vars as dotenv -e ../../.env -o
-    const envPath = resolve(rootDir, "..", "..", ".env");
+    // Load the active .env so we see the same vars as dotenv -e <path> -o.
+    // Resolution: explicit --dotenv arg wins, then the repo-root .env.
+    const envPath = findExplicitDotenvArg() ?? resolve(rootDir, "..", "..", ".env");
     if (existsSync(envPath)) {
         loadEnv({ override: true, path: envPath });
     }

package/dist/pipeline/compiler/literacy-bridge.js

@@ -46,7 +46,7 @@ import { buildTaskGraph } from "./task-graph-builder.js";
  * rules (e.g., rejecting archived tasks that slipped through).
  */
 export function compileLiteracyTasks(tasks, options) {
-    const rubricConfig = loadRubricConfig(options.rootDir);
+    const rubricConfig = loadRubricResolutionInput(options.rootDir);
     const warnings = [];
     const results = [];
     let totalTests = 0;
@@ -146,7 +146,7 @@ export function compareCompilerOutputs(legacyEntries, newResult) {
 // ---------------------------------------------------------------------------
 // Rubric config loading
 // ---------------------------------------------------------------------------
-function loadRubricConfig(rootDir) {
+function loadRubricResolutionInput(rootDir) {
     const result = tryLoadConfigFile("rubrics", rootDir);
     if (!result)
         return undefined;