@sanity/ailf 6.0.0 → 6.1.1

package/dist/adapters/synthesis/synthesis-telemetry-schema.js

@@ -0,0 +1,55 @@
+/**
+ * Zod adapter schema for SynthesisCostTelemetry at the trust boundary.
+ *
+ * This schema sits at `packages/eval/src/adapters/**` and is therefore
+ * scanned by `pnpm check-trust-boundary-satisfies` (D0045). The
+ * `satisfies z.ZodType<SynthesisCostTelemetry>` clause makes schema/type
+ * drift a build error, not a runtime bug.
+ *
+ * Used by:
+ * - Plan 06-04 `ReportStore.patchSynthesis` — validates telemetry before
+ *   writing to Sanity (process memory → Sanity write boundary, T-06-04).
+ * - Any future Sanity-side reader of `summary.synthesis.diagnosis.*`
+ *   (Sanity Content Lake → eval process boundary, T-06-04).
+ *
+ * Security constraints:
+ * - No `.passthrough()` — schema is closed to prevent PII leakage from
+ *   card body text into the telemetry shape (T-06-05).
+ * - Satisfies clause is load-bearing (T-06-06); no exemption marker.
+ *
+ * @see packages/core/src/types/synthesis-telemetry.ts — independently authored domain types
+ * @see docs/decisions/D0045-type-architecture-and-contract-enforcement.md
+ * @see .planning/phases/06-post-run-integration-cost-telemetry/06-CONTEXT.md §D6-09
+ */
+import { z } from "zod";
+/**
+ * Enum of all valid card types — mirrors `CardType` from diagnosis.ts.
+ * Using `z.enum()` (not `z.string()`) so the schema satisfies
+ * `z.ZodType<SynthesisPerCardTelemetry>` (which requires `cardType: CardType`).
+ */
+const CardTypeSchema = z.enum([
+    "area-summary",
+    "failure-mode-summary",
+    "no-issues",
+    "top-recommendations",
+    "weakest-area",
+    "low-confidence-attribution",
+    "doc-attribution-spotlight",
+    "regression-vs-baseline",
+]);
+const SynthesisPerCardSchema = z.object({
+    cardType: CardTypeSchema,
+    cost: z.number().nonnegative().optional(),
+    parseFailed: z.boolean(),
+    latencyMs: z.number().int().nonnegative().optional(),
+    tokenInput: z.number().int().nonnegative().optional(),
+    tokenOutput: z.number().int().nonnegative().optional(),
+    cardVersion: z.string(),
+    generatedAt: z.string().datetime({ offset: false }), // ISO 8601 UTC required
+});
+export const SynthesisCostTelemetrySchema = z.object({
+    cost: z.number().nonnegative(),
+    parseFailureCount: z.number().int().nonnegative(),
+    parseFailureRate: z.number().min(0).max(1),
+    perCard: z.array(SynthesisPerCardSchema),
+});

package/dist/adapters/task-sources/content-lake-task-source.js

@@ -286,16 +286,21 @@ function mapAssertions(raw) {
                     .map((c) => ({ id: c.id, text: c.text })),
                 template: a.template,
                 type: "llm-rubric",
-                ...(a.weight !== undefined ? { weight: a.weight } : {}),
+                // Use `!= null` (loose) so we drop both `undefined` AND `null`.
+                // GROQ projects missing scalar fields as `null`, but the domain
+                // schema's `z.number().optional()` accepts `T | undefined`, not
+                // `T | null` — a strict `!== undefined` check would forward
+                // `weight: null` and trigger Zod's "Invalid input" on assertions.
+                ...(a.weight != null ? { weight: a.weight } : {}),
             };
         }
-        // Value-based assertion
+        // Value-based assertion — same null-vs-undefined hazard as above.
         const result = { type: a.type };
-        if (a.value !== undefined)
+        if (a.value != null)
             result.value = a.value;
-        if (a.threshold !== undefined)
+        if (a.threshold != null)
             result.threshold = a.threshold;
-        if (a.weight !== undefined)
+        if (a.weight != null)
             result.weight = a.weight;
         return result;
     });

package/dist/adapters/task-sources/repo-schemas.d.ts

@@ -1561,6 +1561,13 @@ export declare const RepoConfigSchema: z.ZodObject<{
         dir: z.ZodOptional<z.ZodString>;
         exclude: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>;
+    summary: z.ZodOptional<z.ZodObject<{
+        onRun: z.ZodOptional<z.ZodEnum<{
+            never: "never";
+            always: "always";
+            auto: "auto";
+        }>>;
+    }, z.core.$strip>>;
     taskSource: z.ZodOptional<z.ZodObject<{
         type: z.ZodOptional<z.ZodEnum<{
             "content-lake": "content-lake";

package/dist/adapters/task-sources/repo-schemas.js

@@ -646,6 +646,15 @@ const OwnerConfigSchema = z
     individual: z.string().min(1).optional(),
 })
     .optional();
+/**
+ * Post-run diagnosis summary policy (Phase 6 / DIAG-06).
+ * Sits in the W0077 Phase-6a auto-load pathway.
+ */
+const SummaryConfigSchema = z
+    .object({
+    onRun: z.enum(["auto", "always", "never"]).optional(),
+})
+    .optional();
 /**
  * Agentic-mode configuration (W0077 Phase 6f). Replaces the retired
  * `--header` and `--allowed-origin` CLI flags. `headers` is a key/value
@@ -694,6 +703,7 @@ export const RepoConfigSchema = z.object({
     owner: OwnerConfigSchema,
     agentic: AgenticConfigSchema,
     artifacts: ArtifactsConfigSchema,
+    summary: SummaryConfigSchema,
     taskSource: TaskSourceConfigSchema,
     triggers: z
         .object({

package/dist/artifact-capture/api-gateway-artifact-writer.d.ts

@@ -27,7 +27,7 @@
  * @see docs/decisions/D0032-run-anchored-artifact-store.md
  * @see docs/decisions/D0033-unified-run-anchored-artifact-capture.md
  */
-import { type ArtifactEntry, type ArtifactRef, type ArtifactType, type ArtifactWriter, type AssociationValues, type RunId, type RunManifest } from "../_vendor/ailf-core/index.d.ts";
+import { type ArtifactEntry, type ArtifactRef, type ArtifactType, type ArtifactWriter, type AssociationValues, type RunId, type RunManifest, type WriteSource } from "../_vendor/ailf-core/index.d.ts";
 import { type UploadMetricsSink } from "./upload-metrics.js";
 export interface ApiGatewayArtifactWriterOptions {
     /** Base URL of the API gateway (e.g., "https://ailf-api.sanity.build"). */
@@ -41,10 +41,20 @@ export interface ApiGatewayArtifactWriterOptions {
      * Defaults to a no-op so the hot path stays free when metrics are off.
      */
     metrics?: UploadMetricsSink;
+    /**
+     * Identifies what kind of execution context owns this writer instance.
+     * The D0050 guard refuses to emit a descriptor whose `writePolicy` is
+     * different from this value. `"pipeline"` (the default) is for writers
+     * driven by an `ailf run` pipeline; `"post-hoc"` is for writers driven
+     * by deferred commands like `ailf interpret` that emit descriptors
+     * declared `writePolicy: "post-hoc"` (D0050).
+     */
+    writerSource?: WriteSource;
 }
 export declare class ApiGatewayArtifactWriter implements ArtifactWriter {
     private readonly options;
     private readonly metrics;
+    private readonly writerSource;
     constructor(options: ApiGatewayArtifactWriterOptions);
     emit<T extends ArtifactType>(type: T, association: AssociationValues, payload: unknown): Promise<ArtifactRef | null>;
     appendNdjson(): Promise<ArtifactRef | null>;

package/dist/artifact-capture/api-gateway-artifact-writer.js

@@ -33,14 +33,16 @@ import { NO_OP_UPLOAD_METRICS, } from "./upload-metrics.js";
 export class ApiGatewayArtifactWriter {
     options;
     metrics;
+    writerSource;
     constructor(options) {
         this.options = options;
         this.metrics = options.metrics ?? NO_OP_UPLOAD_METRICS;
+        this.writerSource = options.writerSource ?? "pipeline";
     }
     // ---- Canonical W0049 API ------------------------------------------------
     async emit(type, association, payload) {
         const descriptor = ARTIFACT_REGISTRY[type];
-        assertWritePolicyMatches("pipeline", descriptor);
+        assertWritePolicyMatches(this.writerSource, descriptor);
         const runId = association.run;
         if (!runId) {
             console.warn(`  ⚠️  emit("${type}"): association.run is required, skipping`);

package/dist/artifact-capture/batching-api-gateway-artifact-writer.d.ts

@@ -25,7 +25,7 @@
  * does this writer. Traces flow through the GCS-direct writer when ADC
  * credentials are present.
  */
-import { type ArtifactEntry, type ArtifactRef, type ArtifactType, type ArtifactWriter, type AssociationValues, type RunId, type RunManifest } from "../_vendor/ailf-core/index.d.ts";
+import { type ArtifactEntry, type ArtifactRef, type ArtifactType, type ArtifactWriter, type AssociationValues, type RunId, type RunManifest, type WriteSource } from "../_vendor/ailf-core/index.d.ts";
 import { type UploadMetricsSink } from "./upload-metrics.js";
 export interface BatchingApiGatewayArtifactWriterOptions {
     /** Base URL of the API gateway (e.g., "https://ailf-api.sanity.build"). */
@@ -46,12 +46,22 @@ export interface BatchingApiGatewayArtifactWriterOptions {
     putConcurrency?: number;
     /** Optional metrics sink; defaults to no-op. */
     metrics?: UploadMetricsSink;
+    /**
+     * Identifies what kind of execution context owns this writer instance.
+     * The D0050 guard refuses to emit a descriptor whose `writePolicy` is
+     * different from this value. `"pipeline"` (the default) is for writers
+     * driven by an `ailf run` pipeline; `"post-hoc"` is for writers driven
+     * by deferred commands like `ailf interpret` that emit descriptors
+     * declared `writePolicy: "post-hoc"` (D0050).
+     */
+    writerSource?: WriteSource;
 }
 export declare class BatchingApiGatewayArtifactWriter implements ArtifactWriter {
     private readonly options;
     private readonly pending;
     private flushing;
     private microtaskScheduled;
+    private readonly writerSource;
     constructor(options: BatchingApiGatewayArtifactWriterOptions);
     emit<T extends ArtifactType>(type: T, association: AssociationValues, payload: unknown): Promise<ArtifactRef | null>;
     appendNdjson(): Promise<ArtifactRef | null>;

package/dist/artifact-capture/batching-api-gateway-artifact-writer.js

@@ -51,6 +51,7 @@ export class BatchingApiGatewayArtifactWriter {
     pending = [];
     flushing = null;
     microtaskScheduled = false;
+    writerSource;
     constructor(options) {
         this.options = {
             apiBaseUrl: options.apiBaseUrl,
@@ -60,11 +61,12 @@ export class BatchingApiGatewayArtifactWriter {
             putConcurrency: options.putConcurrency ?? DEFAULT_PUT_CONCURRENCY,
             metrics: options.metrics ?? NO_OP_UPLOAD_METRICS,
         };
+        this.writerSource = options.writerSource ?? "pipeline";
     }
     // ---- ArtifactWriter surface --------------------------------------------
     async emit(type, association, payload) {
         const descriptor = ARTIFACT_REGISTRY[type];
-        assertWritePolicyMatches("pipeline", descriptor);
+        assertWritePolicyMatches(this.writerSource, descriptor);
         const runId = association.run;
         if (!runId) {
             console.warn(`  ⚠️  emit("${type}"): association.run is required, skipping`);

package/dist/artifact-capture/gcs-artifact-writer.d.ts

@@ -28,7 +28,7 @@
  * @see docs/decisions/D0033-unified-run-anchored-artifact-capture.md
  */
 import { Storage } from "@google-cloud/storage";
-import { type ArtifactEntry, type ArtifactRef, type ArtifactType, type ArtifactWriter, type ArtifactWriterProgressOptions, type AssociationValues, type RunId, type RunManifest } from "../_vendor/ailf-core/index.d.ts";
+import { type ArtifactEntry, type ArtifactRef, type ArtifactType, type ArtifactWriter, type ArtifactWriterProgressOptions, type AssociationValues, type RunId, type RunManifest, type WriteSource } from "../_vendor/ailf-core/index.d.ts";
 import { type UploadMetricsSink } from "./upload-metrics.js";
 export interface GcsArtifactWriterOptions {
     /** GCS bucket name (e.g., "ailf-artifacts") */
@@ -51,6 +51,15 @@ export interface GcsArtifactWriterOptions {
      * Defaults to a no-op so the hot path stays free when metrics are off.
      */
     metrics?: UploadMetricsSink;
+    /**
+     * Identifies what kind of execution context owns this writer instance.
+     * The D0050 guard refuses to emit a descriptor whose `writePolicy` is
+     * different from this value. `"pipeline"` (the default) is for writers
+     * driven by an `ailf run` pipeline; `"post-hoc"` is for writers driven
+     * by deferred commands like `ailf interpret` that emit descriptors
+     * declared `writePolicy: "post-hoc"` (D0050).
+     */
+    writerSource?: WriteSource;
 }
 export declare class GcsArtifactWriter implements ArtifactWriter {
     private client;
@@ -68,6 +77,7 @@ export declare class GcsArtifactWriter implements ArtifactWriter {
      * measured safe, without forcing the producer to own that knob.
      */
     private readonly limiter;
+    private readonly writerSource;
     constructor(options: GcsArtifactWriterOptions);
     private reportProgress;
     emit<T extends ArtifactType>(type: T, association: AssociationValues, payload: unknown): Promise<ArtifactRef | null>;

package/dist/artifact-capture/gcs-artifact-writer.js

@@ -57,9 +57,11 @@ export class GcsArtifactWriter {
      * measured safe, without forcing the producer to own that knob.
      */
     limiter;
+    writerSource;
     constructor(options) {
         this.options = options;
         this.metrics = options.metrics ?? NO_OP_UPLOAD_METRICS;
+        this.writerSource = options.writerSource ?? "pipeline";
         if (options.storage) {
             this.client = options.storage;
         }
@@ -79,7 +81,7 @@ export class GcsArtifactWriter {
     // ---- Canonical W0049 API ------------------------------------------------
     async emit(type, association, payload) {
         const descriptor = ARTIFACT_REGISTRY[type];
-        assertWritePolicyMatches("pipeline", descriptor);
+        assertWritePolicyMatches(this.writerSource, descriptor);
         const runId = association.run;
         if (!runId) {
             console.warn(`  ⚠️  emit("${type}"): association.run is required, skipping`);
@@ -92,7 +94,8 @@ export class GcsArtifactWriter {
         const { body } = prepareUploadBody(payload, descriptor.mime);
         const preview = buildManifestPreview(descriptor, payload);
         if (descriptor.layout === "bulk") {
-            const path = descriptor.objectPath(runId);
+            const extra = descriptor.extractPathArgs?.(association, payload) ?? [];
+            const path = descriptor.objectPath(runId, ...extra);
             const ref = await this.putBody(path, body, {
                 layout: "bulk",
                 mime: descriptor.mime,
@@ -133,7 +136,7 @@ export class GcsArtifactWriter {
     }
     async appendNdjson(type, association, rows) {
         const descriptor = ARTIFACT_REGISTRY[type];
-        assertWritePolicyMatches("pipeline", descriptor);
+        assertWritePolicyMatches(this.writerSource, descriptor);
         if (descriptor.mime !== "application/x-ndjson") {
             console.warn(`  ⚠️  appendNdjson("${type}"): descriptor mime is ${descriptor.mime}, not application/x-ndjson — skipping`);
             return null;

package/dist/artifact-capture/local-fs-artifact-writer.d.ts

@@ -36,7 +36,7 @@
  * @see docs/decisions/D0033-unified-run-anchored-artifact-capture.md (§ M4)
  * @see packages/eval/src/artifact-capture/gcs-artifact-writer.ts (mirror)
  */
-import { type ArtifactEntry, type ArtifactRef, type ArtifactType, type ArtifactWriter, type ArtifactWriterProgressOptions, type AssociationValues, type RunId, type RunManifest } from "../_vendor/ailf-core/index.d.ts";
+import { type ArtifactEntry, type ArtifactRef, type ArtifactType, type ArtifactWriter, type ArtifactWriterProgressOptions, type AssociationValues, type RunId, type RunManifest, type WriteSource } from "../_vendor/ailf-core/index.d.ts";
 export interface LocalFilesystemArtifactWriterOptions {
     /**
      * Absolute or cwd-relative root directory under which `runs/{runId}/…`
@@ -56,10 +56,20 @@ export interface LocalFilesystemArtifactWriterOptions {
      * render per-batch updates during long export phases.
      */
     progress?: ArtifactWriterProgressOptions;
+    /**
+     * Identifies what kind of execution context owns this writer instance.
+     * The D0050 guard refuses to emit a descriptor whose `writePolicy` is
+     * different from this value. `"pipeline"` (the default) is for writers
+     * driven by an `ailf run` pipeline; `"post-hoc"` is for writers driven
+     * by deferred commands like `ailf interpret` that emit descriptors
+     * declared `writePolicy: "post-hoc"` (D0050).
+     */
+    writerSource?: WriteSource;
 }
 export declare class LocalFilesystemArtifactWriter implements ArtifactWriter {
     private readonly options;
     private readonly excludeSet;
+    private readonly writerSource;
     constructor(options: LocalFilesystemArtifactWriterOptions);
     private reportProgress;
     emit<T extends ArtifactType>(type: T, association: AssociationValues, payload: unknown): Promise<ArtifactRef | null>;

package/dist/artifact-capture/local-fs-artifact-writer.js

@@ -46,9 +46,11 @@ import { redactArtifactData } from "./redact-artifact.js";
 export class LocalFilesystemArtifactWriter {
     options;
     excludeSet;
+    writerSource;
     constructor(options) {
         this.options = options;
         this.excludeSet = new Set(options.exclude ?? []);
+        this.writerSource = options.writerSource ?? "pipeline";
     }
     reportProgress(ref) {
         const progress = this.options.progress;
@@ -66,7 +68,7 @@ export class LocalFilesystemArtifactWriter {
         if (this.excludeSet.has(type))
             return null;
         const descriptor = ARTIFACT_REGISTRY[type];
-        assertWritePolicyMatches("pipeline", descriptor);
+        assertWritePolicyMatches(this.writerSource, descriptor);
         const runId = association.run;
         if (!runId) {
             console.warn(`  ⚠️  emit("${type}"): association.run is required, skipping`);
@@ -81,7 +83,8 @@ export class LocalFilesystemArtifactWriter {
         // descriptor's capBytes.
         const preview = buildManifestPreview(descriptor, payload);
         if (descriptor.layout === "bulk") {
-            const relPath = descriptor.objectPath(runId);
+            const extra = descriptor.extractPathArgs?.(association, payload) ?? [];
+            const relPath = descriptor.objectPath(runId, ...extra);
             const absPath = this.resolve(relPath);
             const wrote = await this.writeAtomic(absPath, body);
             if (!wrote)
@@ -128,7 +131,7 @@ export class LocalFilesystemArtifactWriter {
         if (this.excludeSet.has(type))
             return null;
         const descriptor = ARTIFACT_REGISTRY[type];
-        assertWritePolicyMatches("pipeline", descriptor);
+        assertWritePolicyMatches(this.writerSource, descriptor);
         if (descriptor.mime !== "application/x-ndjson") {
             console.warn(`  ⚠️  appendNdjson("${type}"): descriptor mime is ${descriptor.mime}, not application/x-ndjson — skipping`);
             return null;

package/dist/commands/interpret.d.ts

@@ -16,7 +16,7 @@
  * @see .planning/phases/05-diagnosis-engine-cli-llm-cards/05-AI-SPEC.md §6
  */
 import { Command } from "commander";
-import type { DiagnosisRunner, VersionedInputs } from "../_vendor/ailf-core/index.d.ts";
+import { type DiagnosisCard, type DiagnosisRunner, type VersionedInputs } from "../_vendor/ailf-core/index.d.ts";
 interface MinimalReportStore {
     read(id: string): Promise<unknown | null>;
     latest(): Promise<unknown | null>;
@@ -39,6 +39,26 @@ export interface InterpretCommandOptions {
      */
     readonly versionsFromReport?: (report: unknown) => VersionedInputs;
 }
+/**
+ * Visual status markers — locked visual contract per plan Test 7:
+ * ready: "✓", degraded: "⚠", missing: "—"
+ *
+ * Exported so Plan 06-04's post-run hook imports the SAME object and
+ * D6-04's "single formatter, single visual contract" is physically
+ * enforced — no copy/paste drift possible.
+ */
+export declare const STATUS_ICONS: Record<DiagnosisCard["status"], string>;
+/**
+ * Format a single card as a one-line summary string.
+ *
+ * Format: `<icon> <cardType>: <summary>`
+ * Per AI-SPEC §6: distinct icons for ready / degraded / missing.
+ *
+ * Exported so Plan 06-04's post-run hook imports the SAME function and
+ * D6-04's "single formatter, single visual contract" is physically
+ * enforced — no copy/paste drift possible.
+ */
+export declare function formatCardSummaryLine(card: DiagnosisCard): string;
 /**
  * Create the `ailf interpret <reportId>` Commander command.
  *

package/dist/commands/interpret.js

@@ -18,6 +18,7 @@
 import { dirname, resolve } from "path";
 import { fileURLToPath } from "url";
 import { Command } from "commander";
+import { CARD_REGISTRY_VERSION, diagnosisVersion, } from "../_vendor/ailf-core/index.js";
 import { addOutputDirOption } from "./shared/options.js";
 import { resolveOutputDir } from "./shared/resolve-output-dir.js";
 // ---------------------------------------------------------------------------
@@ -31,8 +32,12 @@ const ROOT = resolve(__dirname, "..", "..");
 /**
  * Visual status markers — locked visual contract per plan Test 7:
  * ready: "✓", degraded: "⚠", missing: "—"
+ *
+ * Exported so Plan 06-04's post-run hook imports the SAME object and
+ * D6-04's "single formatter, single visual contract" is physically
+ * enforced — no copy/paste drift possible.
  */
-const STATUS_ICONS = {
+export const STATUS_ICONS = {
     ready: "✓",
     degraded: "⚠",
     missing: "—",
@@ -52,8 +57,12 @@ function getCardSummaryText(card) {
  *
  * Format: `<icon> <cardType>: <summary>`
  * Per AI-SPEC §6: distinct icons for ready / degraded / missing.
+ *
+ * Exported so Plan 06-04's post-run hook imports the SAME function and
+ * D6-04's "single formatter, single visual contract" is physically
+ * enforced — no copy/paste drift possible.
  */
-function formatCardSummaryLine(card) {
+export function formatCardSummaryLine(card) {
     const icon = STATUS_ICONS[card.status];
     const text = getCardSummaryText(card);
     return `${icon} ${card.cardType}: ${text}`;
@@ -82,10 +91,10 @@ function defaultVersionsFromReport(report) {
             : "unknown",
         diagnosisVersion: typeof versions?.diagnosisVersion === "string"
             ? versions.diagnosisVersion
-            : "0.1.0",
+            : diagnosisVersion,
         cardVersion: typeof versions?.cardVersion === "string"
             ? versions.cardVersion
-            : "0.1.0",
+            : CARD_REGISTRY_VERSION,
     };
 }
 // ---------------------------------------------------------------------------

package/dist/commands/pipeline-action.d.ts

@@ -12,6 +12,7 @@
  */
 import { type ImpactSummary } from "../pipeline/reverse-mapping.js";
 import type { DebugOptions, EvalMode } from "../pipeline/types.js";
+import { type Diagnosis, type ReportStorePort, type SynthesisCostTelemetry } from "../_vendor/ailf-core/index.d.ts";
 import type { PipelineCliOptions } from "./run.js";
 export interface ResolvedOptions {
     allowedOriginArgs: string[];
@@ -63,6 +64,12 @@ export interface ResolvedOptions {
     studioOriginOverride?: string;
     remote: boolean;
     repoTasksPath?: string;
+    /** Phase 6 / DIAG-06: post-run diagnosis summary policy. Precedence
+     * resolution (CLI flag > env > config > auto) lives in
+     * shouldRunPostSummary() — this field carries only the config-file
+     * signal so the helper has a single typed input.
+     */
+    summaryOnRun?: "auto" | "always" | "never";
     taskOption?: string;
     tagOption?: string[];
     taskSourceType?: "content-lake" | "repo";
@@ -88,6 +95,43 @@ export interface ResolvedOptions {
  * Exported so the plan builder can call it independently.
  */
 export declare function computeResolvedOptions(opts: PipelineCliOptions): ResolvedOptions;
+/**
+ * Determine whether the post-run diagnosis summary hook should fire.
+ *
+ * 4-level precedence chain (D6-20):
+ *   Level 1 — CLI flag (absolute): if `cliOpts.summary` is boolean, use it.
+ *   Level 2 — AILF_INTERPRET_ON_RUN env var (absolute): strict "1"/"0" parse;
+ *             anything else falls through (T-06-11 spoofing mitigation).
+ *   Level 3 — config `summary.onRun` (absolute): "always" → true; "never" → false;
+ *             "auto" or absent falls through to level 4.
+ *   Level 4 — default auto: TTY && !CI (SC1 default-off in CI).
+ */
+export declare function shouldRunPostSummary(cliOpts: PipelineCliOptions, resolvedOnRun: "auto" | "always" | "never" | undefined): boolean;
+export declare function buildSynthesisTelemetry(diagnosis: Diagnosis): SynthesisCostTelemetry;
+/**
+ * Run post-pipeline hooks after the pipeline completes.
+ *
+ * Fires after orchestratePipeline() + writePipelineResult() (D6-02).
+ * Hook failure prints to stderr but does NOT change exit code (D6-03).
+ * CI default-off: fires only when shouldRunPostSummary returns true (D6-20).
+ *
+ * @param ctx - App context (composition root wiring)
+ * @param result - Pipeline result (includes reportId when published)
+ * @param args - Hook options (cliOpts, summaryOnRun from config, optional runnerFactory for tests)
+ */
+export declare function runPostPipelineHooks(ctx: {
+    reportStore?: ReportStorePort;
+}, result: {
+    success: boolean;
+    reportId?: string;
+}, args: {
+    cliOpts: PipelineCliOptions;
+    summaryOnRun?: "auto" | "always" | "never";
+    /** Override runner factory for tests — avoids vi.mock of composition root */
+    runnerFactory?: (ctx: unknown) => {
+        run(opts: unknown): Promise<Diagnosis>;
+    };
+}): Promise<void>;
 /**
  * Execute the evaluation pipeline.
  *