@sanity/ailf 7.0.1 → 7.1.0

package/dist/_vendor/ailf-shared/index.d.ts

@@ -20,15 +20,17 @@
 export { computeCanaryDrift, type CanaryDriftReport, type CanaryReportSlim, type DriftEntry, type DriftThresholds, type DriftVerdict, } from "./canary-drift.js";
 export { type DocumentRef } from "./document-ref.js";
 export { makeEditorialReference, type EditorialReference, type MakeEditorialReferenceArgs, } from "./editorial-reference.js";
+export { isKnownEventType, KNOWN_EVENT_TYPES, type EventType, type KnownEventType, } from "./event-types.js";
 export { FEATURE_FLAGS, type FeatureFlag, type FeatureFlagKey, } from "./feature-flags.js";
 export { DEFAULT_GCS_ARTIFACT_BUCKET } from "./gcs-defaults.js";
 export { GLOSSARY, type GlossaryEntry, type GlossarySlug } from "./glossary.js";
 export { HELP_TOPICS } from "./help-content.js";
 export { type HelpTopic } from "./help-topics.js";
+export { isKnownMemberRole, KNOWN_MEMBER_ROLES, type KnownMemberRole, type MemberRole, } from "./member-roles.js";
 export { GRADE_BOUNDARIES, scoreGrade, type ScoreGrade, } from "./score-grades.js";
 export { NOISE_THRESHOLD } from "./noise-threshold.js";
-export { CANONICAL_EVAL_MODES, LEGACY_EVAL_MODE_ALIASES, LITERACY_VARIANTS, RAW_EVAL_MODES, type EvalMode, type LiteracyVariant, type RawEvalMode, } from "./eval-modes.js";
-export { isKnownOwnerTeam, KNOWN_OWNER_TEAMS, normalizeOwnerTeam, } from "./owner-teams.js";
+export { CANONICAL_EVAL_MODES, isLiteracyVariant, LEGACY_EVAL_MODE_ALIASES, LITERACY_VARIANTS, RAW_EVAL_MODES, type EvalMode, type LiteracyVariant, type RawEvalMode, } from "./eval-modes.js";
+export { isKnownOwnerTeam, KNOWN_OWNER_TEAMS, normalizeOwnerTeam, resolveTeamRef, type SlugLike, } from "./owner-teams.js";
 export { isRunClassification, RUN_CLASSIFICATIONS, RUN_EXECUTOR_SURFACES, type RunClassification, type RunExecutor, type RunExecutorSurface, type RunExecutorSystem, type RunExecutorUser, type RunHost, type RunLineage, type RunOwner, type RunTool, } from "./run-classification.js";
 export { type RunTrigger } from "./run-trigger.js";
 export { type RunContext } from "./run-context.js";

package/dist/_vendor/ailf-shared/index.js

@@ -19,12 +19,14 @@
  */
 export { computeCanaryDrift, } from "./canary-drift.js";
 export { makeEditorialReference, } from "./editorial-reference.js";
+export { isKnownEventType, KNOWN_EVENT_TYPES, } from "./event-types.js";
 export { FEATURE_FLAGS, } from "./feature-flags.js";
 export { DEFAULT_GCS_ARTIFACT_BUCKET } from "./gcs-defaults.js";
 export { GLOSSARY } from "./glossary.js";
 export { HELP_TOPICS } from "./help-content.js";
+export { isKnownMemberRole, KNOWN_MEMBER_ROLES, } from "./member-roles.js";
 export { GRADE_BOUNDARIES, scoreGrade, } from "./score-grades.js";
 export { NOISE_THRESHOLD } from "./noise-threshold.js";
-export { CANONICAL_EVAL_MODES, LEGACY_EVAL_MODE_ALIASES, LITERACY_VARIANTS, RAW_EVAL_MODES, } from "./eval-modes.js";
-export { isKnownOwnerTeam, KNOWN_OWNER_TEAMS, normalizeOwnerTeam, } from "./owner-teams.js";
+export { CANONICAL_EVAL_MODES, isLiteracyVariant, LEGACY_EVAL_MODE_ALIASES, LITERACY_VARIANTS, RAW_EVAL_MODES, } from "./eval-modes.js";
+export { isKnownOwnerTeam, KNOWN_OWNER_TEAMS, normalizeOwnerTeam, resolveTeamRef, } from "./owner-teams.js";
 export { isRunClassification, RUN_CLASSIFICATIONS, RUN_EXECUTOR_SURFACES, } from "./run-classification.js";

package/dist/_vendor/ailf-shared/member-roles.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Known team-member roles and soft-enum helpers.
+ *
+ * Roles are free-form strings — teams can introduce custom roles (e.g.
+ * `"reviewer"`, `"sme"`) without a code change. This module seeds Studio
+ * comboboxes with canonical values and exposes a narrowing predicate
+ * without closing the enum.
+ *
+ * Parallel to the same type aliases in `@sanity/ailf-core`'s team module:
+ * `shared` is the leaf of the dependency graph, so the studio schema can
+ * import the runtime tuple without pulling in core.
+ */
+export declare const KNOWN_MEMBER_ROLES: readonly ["lead", "member", "oncall"];
+export type KnownMemberRole = (typeof KNOWN_MEMBER_ROLES)[number];
+export type MemberRole = KnownMemberRole | (string & {});
+export declare function isKnownMemberRole(value: string): value is KnownMemberRole;

package/dist/_vendor/ailf-shared/member-roles.js

@@ -0,0 +1,16 @@
+/**
+ * Known team-member roles and soft-enum helpers.
+ *
+ * Roles are free-form strings — teams can introduce custom roles (e.g.
+ * `"reviewer"`, `"sme"`) without a code change. This module seeds Studio
+ * comboboxes with canonical values and exposes a narrowing predicate
+ * without closing the enum.
+ *
+ * Parallel to the same type aliases in `@sanity/ailf-core`'s team module:
+ * `shared` is the leaf of the dependency graph, so the studio schema can
+ * import the runtime tuple without pulling in core.
+ */
+export const KNOWN_MEMBER_ROLES = ["lead", "member", "oncall"];
+export function isKnownMemberRole(value) {
+    return KNOWN_MEMBER_ROLES.includes(value);
+}

package/dist/_vendor/ailf-shared/owner-teams.d.ts

@@ -24,3 +24,22 @@ export declare const KNOWN_OWNER_TEAMS: readonly string[];
  */
 export declare function normalizeOwnerTeam(value: string | undefined | null): string;
 export declare function isKnownOwnerTeam(value: string): boolean;
+/**
+ * Lightweight team lookup against an in-memory team list.
+ *
+ * Consumers fetch team docs via GROQ then call this helper to resolve a
+ * freeform `owner.team` string (D0037) into a Sanity reference. Unknown
+ * strings return null. Known aliases (via OWNER_TEAM_ALIASES) are honored.
+ *
+ * Returning null is the cue for the UI to render an "unresolved team"
+ * badge — not an error condition.
+ */
+export interface SlugLike {
+    _id: string;
+    slug: {
+        current: string;
+    };
+}
+export declare function resolveTeamRef(value: string | null | undefined, teams: readonly SlugLike[]): {
+    _ref: string;
+} | null;

package/dist/_vendor/ailf-shared/owner-teams.js

@@ -50,3 +50,10 @@ export function normalizeOwnerTeam(value) {
 export function isKnownOwnerTeam(value) {
     return KNOWN_OWNER_TEAMS.includes(value);
 }
+export function resolveTeamRef(value, teams) {
+    const normalized = normalizeOwnerTeam(value ?? undefined);
+    if (!normalized || normalized === "unknown")
+        return null;
+    const match = teams.find((t) => t.slug?.current === normalized);
+    return match ? { _ref: match._id } : null;
+}

package/dist/_vendor/ailf-shared/run-context.d.ts

@@ -14,7 +14,7 @@
  * @see docs/decisions/D0032-run-anchored-artifact-store.md
  * @see docs/design-docs/run-artifact-store.md (§ Drift Prevention)
  */
-import type { EvalMode } from "./eval-modes.js";
+import type { EvalMode, LiteracyVariant } from "./eval-modes.js";
 import type { RunClassification, RunExecutor, RunHost, RunLineage, RunOwner, RunTool } from "./run-classification.js";
 import type { RunTrigger } from "./run-trigger.js";
 export interface RunContext {
@@ -75,4 +75,11 @@ export interface RunContext {
     tool?: RunTool;
     /** What initiated this run */
     trigger: RunTrigger;
+    /**
+     * Literacy mode variant — `baseline`, `agentic`, `observed`, or `full`.
+     * Only meaningful when `mode === "literacy"`; absent for other modes.
+     * Surfaced on `ReportProvenance` so dashboards can disambiguate which
+     * variant produced a given report.
+     */
+    variant?: LiteracyVariant;
 }

package/dist/adapters/grader-outputs/promptfoo-grader-output.d.ts

@@ -99,4 +99,68 @@ export declare const GraderJudgmentSchema: z.ZodObject<{
         graderJudgmentsVersion: z.ZodString;
     }, z.core.$strip>;
 }, z.core.$strict>;
-export type { GraderJudgment } from "../../_vendor/ailf-core/index.d.ts";
+/**
+ * Wire-format schema — what the grader LLM is asked to emit.
+ *
+ * This is the subset of {@link GraderJudgmentSchema} that contains only
+ * fields the LLM can correctly produce. The pipeline parses untrusted
+ * grader output against this shape, then synthesizes the four
+ * pipeline-owned fields (`judgmentId`, `metadata.graderModel`,
+ * `metadata.graderJudgmentsVersion`, `hallucinationCheckedAgainst`) plus
+ * the three result-context fields (`taskId`, `modelId`, `dimension`) to
+ * build the full {@link GraderJudgment} storage shape.
+ *
+ * `.strict()` is retained — the LLM is told exactly which keys to emit,
+ * so any extras are either prompt-injection attempts or noise we want
+ * to surface as parse failures (which then drop to the
+ * `synthesizeUnparsedJudgment` fallback). The bar to hit that fallback
+ * is much lower than before W0273 — previously a missing pipeline-owned
+ * field tripped it on every emission.
+ *
+ * Asserts `satisfies z.ZodType<GraderEmittedJudgment>` against the
+ * independently-authored core type (D0045). The trust-boundary CI gate
+ * (`pnpm check-trust-boundary-satisfies`) covers this file.
+ *
+ * @see docs/audits/2026-05-22-empty-gap-analysis-regression.md
+ */
+export declare const GraderEmittedJudgmentSchema: z.ZodObject<{
+    score: z.ZodNumber;
+    reason: z.ZodString;
+    failureMode: z.ZodString;
+    subJudgments: z.ZodArray<z.ZodObject<{
+        criterionId: z.ZodString;
+        met: z.ZodBoolean;
+        evidence: z.ZodString;
+        confidence: z.ZodObject<{
+            level: z.ZodEnum<{
+                low: "low";
+                medium: "medium";
+                high: "high";
+            }>;
+            signalsPresent: z.ZodNumber;
+            derivation: z.ZodString;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
+    docCitations: z.ZodArray<z.ZodObject<{
+        documentId: z.ZodString;
+        slug: z.ZodOptional<z.ZodString>;
+        role: z.ZodEnum<{
+            supports: "supports";
+            contradicts: "contradicts";
+            missing: "missing";
+            irrelevant: "irrelevant";
+        }>;
+        hallucinated: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    confidence: z.ZodObject<{
+        level: z.ZodEnum<{
+            low: "low";
+            medium: "medium";
+            high: "high";
+        }>;
+        signalsPresent: z.ZodNumber;
+        derivation: z.ZodString;
+    }, z.core.$strip>;
+    outputFailure: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export type { GraderEmittedJudgment, GraderJudgment } from "../../_vendor/ailf-core/index.d.ts";

package/dist/adapters/grader-outputs/promptfoo-grader-output.js

@@ -91,3 +91,38 @@ export const GraderJudgmentSchema = z
     }),
 })
     .strict();
+/**
+ * Wire-format schema — what the grader LLM is asked to emit.
+ *
+ * This is the subset of {@link GraderJudgmentSchema} that contains only
+ * fields the LLM can correctly produce. The pipeline parses untrusted
+ * grader output against this shape, then synthesizes the four
+ * pipeline-owned fields (`judgmentId`, `metadata.graderModel`,
+ * `metadata.graderJudgmentsVersion`, `hallucinationCheckedAgainst`) plus
+ * the three result-context fields (`taskId`, `modelId`, `dimension`) to
+ * build the full {@link GraderJudgment} storage shape.
+ *
+ * `.strict()` is retained — the LLM is told exactly which keys to emit,
+ * so any extras are either prompt-injection attempts or noise we want
+ * to surface as parse failures (which then drop to the
+ * `synthesizeUnparsedJudgment` fallback). The bar to hit that fallback
+ * is much lower than before W0273 — previously a missing pipeline-owned
+ * field tripped it on every emission.
+ *
+ * Asserts `satisfies z.ZodType<GraderEmittedJudgment>` against the
+ * independently-authored core type (D0045). The trust-boundary CI gate
+ * (`pnpm check-trust-boundary-satisfies`) covers this file.
+ *
+ * @see docs/audits/2026-05-22-empty-gap-analysis-regression.md
+ */
+export const GraderEmittedJudgmentSchema = z
+    .object({
+    score: z.number(),
+    reason: z.string(),
+    failureMode: z.string(),
+    subJudgments: z.array(CriterionSubJudgmentSchema),
+    docCitations: z.array(DocCitationSchema),
+    confidence: ConfidenceSchema,
+    outputFailure: z.boolean().optional(),
+})
+    .strict();

package/dist/adapters/task-sources/changed-docs-filter.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Filter tasks by changed doc slugs.
+ *
+ * When `changedDocs` is set and non-empty, returns only tasks whose
+ * `context.docs[*].slug` intersects the provided list. Tasks without a
+ * `context.docs` array (e.g. knowledge-probe, mcp-server, agent-harness
+ * modes) are excluded — there's no way for them to "touch" a doc slug.
+ *
+ * An empty or undefined `changedDocs` is a no-op (returns input).
+ */
+import type { GeneralizedTaskDefinition } from "../../_vendor/ailf-core/index.d.ts";
+export declare function filterByChangedDocs(tasks: readonly GeneralizedTaskDefinition[], changedDocs: readonly string[] | undefined): GeneralizedTaskDefinition[];

package/dist/adapters/task-sources/changed-docs-filter.js

@@ -0,0 +1,30 @@
+/**
+ * Every variant of `GeneralizedTaskDefinition` declares an optional
+ * `context?: { docs?: GeneralizedDocRef[]; ... }`, so structural access
+ * narrows correctly without an `as` cast. Returns `undefined` when the
+ * task carries no doc refs.
+ */
+function taskContextDocs(task) {
+    return task.context?.docs;
+}
+/**
+ * `GeneralizedDocRef` is a 4-way union — only `SlugDocRef` and `IdDocRef`
+ * carry a `slug`. Returns `undefined` for path / perspective refs.
+ */
+function docSlug(ref) {
+    return "slug" in ref ? ref.slug : undefined;
+}
+export function filterByChangedDocs(tasks, changedDocs) {
+    if (!changedDocs || changedDocs.length === 0)
+        return [...tasks];
+    const wanted = new Set(changedDocs);
+    return tasks.filter((task) => {
+        const docs = taskContextDocs(task);
+        if (!docs || docs.length === 0)
+            return false;
+        return docs.some((d) => {
+            const slug = docSlug(d);
+            return slug != null && wanted.has(slug);
+        });
+    });
+}

package/dist/adapters/task-sources/content-lake-task-source.js

@@ -15,6 +15,7 @@
  * @see packages/core/src/ports/task-source.ts — TaskSource port
  * @see docs/decisions/D0038-content-lake-authorable-task-modes.md
  */
+import { filterByChangedDocs } from "./changed-docs-filter.js";
 import { ContentLakeAuthorableTaskSchema } from "./repo-schemas.js";
 // ---------------------------------------------------------------------------
 // GROQ query — fetches ailf.task documents with resolved references
@@ -127,7 +128,7 @@ export class ContentLakeTaskSource {
             console.warn("  ⚠️  ContentLakeTaskSource: no ailf.task documents found in the Content Lake. " +
                 "Have you run the migration (Phase 3) or created tasks in Studio?");
         }
-        return definitions;
+        return filterByChangedDocs(definitions, filter?.changedDocs);
     }
 }
 // ---------------------------------------------------------------------------

package/dist/adapters/task-sources/repo-task-source.js

@@ -22,6 +22,7 @@ import { existsSync, readdirSync, readFileSync } from "fs";
 import { resolve } from "path";
 import { load } from "js-yaml";
 import { CANONICAL_EVAL_MODES } from "../../_vendor/ailf-shared/index.js";
+import { filterByChangedDocs } from "./changed-docs-filter.js";
 import { detectLegacyFieldNames, migratePromptShape, parseCanonicalTaskFile, } from "./repo-schemas.js";
 import { discoverTsTaskFiles, loadTsTaskFile } from "./task-file-loader.js";
 /** Set of canonical mode names for O(1) lookup */
@@ -111,7 +112,7 @@ export class RepoTaskSource {
                 }
             }
         }
-        return definitions;
+        return filterByChangedDocs(definitions, filter?.changedDocs);
     }
 }
 // ---------------------------------------------------------------------------

package/dist/commands/pipeline-action.d.ts

@@ -98,13 +98,14 @@ export declare function computeResolvedOptions(opts: PipelineCliOptions): Resolv
 /**
  * Determine whether the post-run diagnosis summary hook should fire.
  *
- * 4-level precedence chain (D6-20):
+ * 4-level precedence chain (D0054):
  *   Level 1 — CLI flag (absolute): if `cliOpts.summary` is boolean, use it.
  *   Level 2 — AILF_INTERPRET_ON_RUN env var (absolute): strict "1"/"0" parse;
  *             anything else falls through (T-06-11 spoofing mitigation).
  *   Level 3 — config `summary.onRun` (absolute): "always" → true; "never" → false;
  *             "auto" or absent falls through to level 4.
- *   Level 4 — default auto: TTY && !CI (SC1 default-off in CI).
+ *   Level 4 — default always-on: diagnosis is a first-class output produced
+ *             for every pipeline run unless explicitly opted out at levels 1–3.
  */
 export declare function shouldRunPostSummary(cliOpts: PipelineCliOptions, resolvedOnRun: "auto" | "always" | "never" | undefined): boolean;
 export declare function buildSynthesisTelemetry(diagnosis: Diagnosis): SynthesisCostTelemetry;
@@ -113,7 +114,7 @@ export declare function buildSynthesisTelemetry(diagnosis: Diagnosis): Synthesis
  *
  * Fires after orchestratePipeline() + writePipelineResult() (D6-02).
  * Hook failure prints to stderr but does NOT change exit code (D6-03).
- * CI default-off: fires only when shouldRunPostSummary returns true (D6-20).
+ * Fires whenever shouldRunPostSummary returns true (D0054 — default on).
  *
  * @param ctx - App context (composition root wiring)
  * @param result - Pipeline result (includes reportId when published)

package/dist/commands/pipeline-action.js

@@ -388,13 +388,14 @@ function resolvePublishAuto(repoValue) {
 /**
  * Determine whether the post-run diagnosis summary hook should fire.
  *
- * 4-level precedence chain (D6-20):
+ * 4-level precedence chain (D0054):
  *   Level 1 — CLI flag (absolute): if `cliOpts.summary` is boolean, use it.
  *   Level 2 — AILF_INTERPRET_ON_RUN env var (absolute): strict "1"/"0" parse;
  *             anything else falls through (T-06-11 spoofing mitigation).
  *   Level 3 — config `summary.onRun` (absolute): "always" → true; "never" → false;
  *             "auto" or absent falls through to level 4.
- *   Level 4 — default auto: TTY && !CI (SC1 default-off in CI).
+ *   Level 4 — default always-on: diagnosis is a first-class output produced
+ *             for every pipeline run unless explicitly opted out at levels 1–3.
  */
 export function shouldRunPostSummary(cliOpts, resolvedOnRun) {
     // Level 1: CLI flag wins absolutely
@@ -415,8 +416,9 @@ export function shouldRunPostSummary(cliOpts, resolvedOnRun) {
     if (resolvedOnRun === "never")
         return false;
     // "auto" or undefined falls through
-    // Level 4: default auto — fire only when stdout is interactive and not in CI
-    return Boolean(process.stdout.isTTY) && process.env.CI !== "true";
+    // Level 4: diagnosis is on by default — emit a diagnosis artifact for every
+    // pipeline run unless an upstream level explicitly opted out (D0054).
+    return true;
 }
 /**
  * Build a SynthesisCostTelemetry payload from a completed Diagnosis.
@@ -479,7 +481,7 @@ export function buildSynthesisTelemetry(diagnosis) {
  *
  * Fires after orchestratePipeline() + writePipelineResult() (D6-02).
  * Hook failure prints to stderr but does NOT change exit code (D6-03).
- * CI default-off: fires only when shouldRunPostSummary returns true (D6-20).
+ * Fires whenever shouldRunPostSummary returns true (D0054 — default on).
  *
  * @param ctx - App context (composition root wiring)
  * @param result - Pipeline result (includes reportId when published)

package/dist/commands/run.js

@@ -43,8 +43,8 @@ export function createRunCommand() {
         .option("-p, --publish", "Write report to Sanity + fan out to sinks (auto-enabled for full runs when report store is configured)")
         .option("--no-publish", "Suppress auto-publishing")
         .option("--publish-tag <tag>", "Label for published report")
-        .option("--summary", "Force post-run diagnosis summary (overrides config and CI default-off)")
-        .option("--no-summary", "Suppress post-run diagnosis summary")
+        .option("--summary", "Force post-run diagnosis summary (overrides config and env var)")
+        .option("--no-summary", "Suppress post-run diagnosis summary (default is on)")
         .option("--config <path>", "Load pipeline config from a TS/JS/YAML/JSON file (overrides most CLI flags)")
         .option("-o, --output <path>", "Write PR comment markdown to file")
         .option("--promptfoo-url <url>", "Promptfoo share URL for report")

package/dist/config/rubrics.ts

@@ -15,10 +15,6 @@ import { defineRubrics } from "../_vendor/ailf-core/index.js"
 // template entry below. Source of truth lives in packages/eval/src/grader/;
 // the helper picks the right list by dimension family.
 import { failureModesForDimension } from "../grader/index.js"
-// Single source of truth for the wire-format version stamped into the
-// grader-prompt footer (VER-01 D-02). Interpolated below so the
-// announced version cannot drift from the schema's expected value.
-import { graderJudgmentsVersion } from "../adapters/grader-outputs/index.js"
 
 export default defineRubrics({
   templates: {
@@ -242,20 +238,23 @@ export default defineRubrics({
     "agent-harness": { gold: "agent-harness" },
   },
 
-  // Phase 3 GRAD-05 (Plan 03-01) — structured GraderJudgment JSON sketch.
-  // Documents the target wire format the grader emits. The strict schema's
-  // GRAD-02 additive fields stay optional in this plan; Plan 03-04 flips
-  // them to required and bumps graderJudgmentsVersion to 1.0.0.
+  // W0273 — the footer documents the wire-format subset of GraderJudgment
+  // that the grader LLM actually controls. The pipeline parses this against
+  // GraderEmittedJudgmentSchema and then synthesizes the four pipeline-owned
+  // fields (judgmentId, metadata.{graderModel,graderJudgmentsVersion},
+  // hallucinationCheckedAgainst) to build the storage GraderJudgment.
+  //
+  // See docs/audits/2026-05-22-empty-gap-analysis-regression.md for the
+  // rationale (Phase 3 GRAD-05 made these fields required + .strict(),
+  // and asking the LLM for pipeline-owned values caused 100% parse
+  // failures starting 2026-05-11).
   footer: `Return ONLY a JSON object with this exact shape:
 {
-  "judgmentId": "<string>",
   "score": <number 0-100>,
   "reason": "<explanation, ≤500 chars>",
+  "failureMode": "<one of the declared modes for this dimension or 'unclassified'>",
   "subJudgments": [{ "criterionId": "<id>", "met": <bool>, "evidence": "<≤280 chars>", "confidence": { "level": "high|medium|low", "signalsPresent": <int>, "derivation": "<string>" } }],
   "docCitations": [{ "documentId": "<id>", "slug": "<optional slug>", "role": "supports|contradicts|missing|irrelevant", "hallucinated": <bool> }],
-  "failureMode": "<one of the declared modes for this dimension or 'unclassified'>",
-  "confidence": { "level": "high|medium|low", "signalsPresent": <int>, "derivation": "<string>" },
-  "hallucinationCheckedAgainst": ["<doc id>"],
-  "metadata": { "graderModel": "<string>", "graderJudgmentsVersion": "${graderJudgmentsVersion}" }
+  "confidence": { "level": "high|medium|low", "signalsPresent": <int>, "derivation": "<string>" }
 }`,
 })

package/dist/job-store.d.ts

@@ -101,4 +101,22 @@ export declare class JobStore {
      * Update a job's status and optional associated data.
      */
     updateJob(jobId: string, update: Partial<Pick<JobDocument, "completedAt" | "error" | "execution" | "progress" | "reportId" | "startedAt" | "status">>): Promise<boolean>;
+    /**
+     * Patch the parent ailf.evalRequest doc when this job reaches a terminal
+     * state. The webhook handler writes `jobId` onto the evalRequest at
+     * dispatch time, so we look the parent up by that field.
+     *
+     * Best-effort: returns `false` on lookup miss or write failure, never
+     * throws. Closes the S1-B gap from the 2026-05-24 new-eval audit — until
+     * this runs, evalRequest docs stay `status: "dispatched"` indefinitely
+     * and the dashboard can't surface completion or errors to users.
+     *
+     * @returns true on successful patch, false on lookup miss or write error
+     */
+    patchEvalRequestForJob(jobId: string, patch: {
+        status: "completed" | "failed";
+        completedAt: string;
+        reportId?: string;
+        error?: string;
+    }): Promise<boolean>;
 }

package/dist/job-store.js

@@ -149,6 +149,40 @@ export class JobStore {
             return false;
         }
     }
+    /**
+     * Patch the parent ailf.evalRequest doc when this job reaches a terminal
+     * state. The webhook handler writes `jobId` onto the evalRequest at
+     * dispatch time, so we look the parent up by that field.
+     *
+     * Best-effort: returns `false` on lookup miss or write failure, never
+     * throws. Closes the S1-B gap from the 2026-05-24 new-eval audit — until
+     * this runs, evalRequest docs stay `status: "dispatched"` indefinitely
+     * and the dashboard can't surface completion or errors to users.
+     *
+     * @returns true on successful patch, false on lookup miss or write error
+     */
+    async patchEvalRequestForJob(jobId, patch) {
+        try {
+            const evalRequest = await this.client.fetch(`*[_type == "ailf.evalRequest" && jobId == $jobId][0]{_id}`, { jobId });
+            if (!evalRequest?._id) {
+                return false;
+            }
+            await this.client
+                .patch(evalRequest._id)
+                .set({
+                status: patch.status,
+                completedAt: patch.completedAt,
+                ...(patch.reportId ? { reportId: patch.reportId } : {}),
+                ...(patch.error ? { error: patch.error } : {}),
+            })
+                .commit();
+            return true;
+        }
+        catch (error) {
+            console.warn(`  ⚠️  Failed to patch ailf.evalRequest for jobId ${jobId}: ${error instanceof Error ? error.message : String(error)}`);
+            return false;
+        }
+    }
 }
 // ---------------------------------------------------------------------------
 // Helpers

package/dist/orchestration/build-app-context.js

@@ -8,6 +8,7 @@
  * Once all commands construct ResolvedConfig directly (or use --config),
  * this bridge can be deleted.
  */
+import { isLiteracyVariant } from "../_vendor/ailf-shared/index.js";
 import { createAppContext } from "../composition-root.js";
 import { tryLoadConfigFile } from "../pipeline/compiler/config-loader.js";
 /**
@@ -18,10 +19,16 @@ import { tryLoadConfigFile } from "../pipeline/compiler/config-loader.js";
  * are derived (e.g., areas from areaOption).
  */
 export function mapToResolvedConfig(opts, rootDir) {
+    // `opts.variant` is a free-form string from CLI / config flags; narrow it
+    // to the closed `LiteracyVariant` set so downstream consumers (the report
+    // provenance derivation, in particular) never see a bogus string.
+    // Unknown values silently drop to undefined — the legacy behavior — but a
+    // narrowing surface is in place for the day we want to error here.
+    const variant = isLiteracyVariant(opts.variant) ? opts.variant : undefined;
     return {
         rootDir,
         mode: opts.mode,
-        variant: opts.variant,
+        variant,
         noAutoScope: opts.noAutoScope ?? false,
         debug: opts.debug,
         areas: opts.areaOption

package/dist/orchestration/pipeline-orchestrator.js

@@ -69,6 +69,35 @@ async function reportJobProgress(ctx, stepName, completedSteps, totalSteps, stat
         ctx.logger.warn(`Failed to report job progress for step "${stepName}" — continuing`);
     }
 }
+/**
+ * Patch the parent ailf.evalRequest doc when the underlying ailf.job
+ * reaches a terminal state (completed | failed).
+ *
+ * Thin wrapper over `JobStore.patchEvalRequestForJob` that handles client
+ * construction (env-driven token) and the logger callback. Best-effort:
+ * never throws, logs warnings on lookup miss or write failure.
+ *
+ * Closes the S1-B gap from the 2026-05-24 new-eval audit — until this
+ * runs, evalRequest docs stay `status: "dispatched"` indefinitely and
+ * the dashboard can't surface completion or errors to users.
+ */
+async function patchEvalRequestForJob(ctx, jobId, patch) {
+    try {
+        const { JobStore } = await import("../job-store.js");
+        const store = new JobStore({
+            token: process.env.AILF_REPORT_SANITY_API_TOKEN ??
+                process.env.SANITY_API_TOKEN ??
+                undefined,
+        });
+        const patched = await store.patchEvalRequestForJob(jobId, patch);
+        if (!patched) {
+            ctx.logger.debug(`No ailf.evalRequest patched for jobId ${jobId} — lookup miss or write failure`);
+        }
+    }
+    catch (err) {
+        ctx.logger.warn(`Failed to patch ailf.evalRequest for jobId ${jobId}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
 // ---------------------------------------------------------------------------
 // Artifact capture
 // ---------------------------------------------------------------------------
@@ -188,6 +217,11 @@ export async function orchestratePipeline(ctx, steps) {
                     message: failedError,
                     step: step.name,
                 }, jobUpdates);
+                await patchEvalRequestForJob(ctx, ctx.config.jobId, {
+                    status: "failed",
+                    completedAt: new Date().toISOString(),
+                    error: `${step.name}: ${failedError}`,
+                });
             }
             // Capture pipeline context before exiting. `job-updates` was an
             // observability-only capture not tied to a registered artifact type;
@@ -242,9 +276,10 @@ export async function orchestratePipeline(ctx, steps) {
             // (P5 / local-first) and `success: true` is preserved; the `error`
             // field is the wire signal that a configured optional step failed.
             const firstOptionalFailure = getFirstOptionalFailure(steps, results);
+            const completedAt = new Date().toISOString();
             await store.updateJob(ctx.config.jobId, {
                 status: "completed",
-                completedAt: new Date().toISOString(),
+                completedAt,
                 progress: {
                     currentStep: "complete",
                     completedSteps: steps.length,
@@ -253,6 +288,16 @@ export async function orchestratePipeline(ctx, steps) {
                 ...(state.reportId ? { reportId: state.reportId } : {}),
                 ...(firstOptionalFailure ? { error: firstOptionalFailure } : {}),
             });
+            await patchEvalRequestForJob(ctx, ctx.config.jobId, {
+                status: "completed",
+                completedAt,
+                ...(state.reportId ? { reportId: state.reportId } : {}),
+                ...(firstOptionalFailure
+                    ? {
+                        error: `${firstOptionalFailure.step}: ${firstOptionalFailure.message}`,
+                    }
+                    : {}),
+            });
         }
         catch {
             ctx.logger.warn("Failed to report job completion — continuing");

package/dist/orchestration/steps/compare-step.d.ts

@@ -4,6 +4,13 @@
  * This step is already pure (no execSync, no env vars) — the logic is
  * inlined directly from the former pipeline/steps/compare-step.ts.
  * This is an optional step — failure doesn't stop the pipeline.
+ *
+ * Baseline resolution order (highest priority first):
+ *  1. `compareBaselineReportId` — fetch the named report doc
+ *     and use its `summary` (a ReportSummary, which is a
+ *     superset of ComparableSummary) as the baseline.
+ *  2. `compareBaseline` — local filesystem path (CLI ergonomics).
+ *  3. Latest baseline in `results/baselines/`.
  */
 import { type AppContext, type PipelineStep, type StepResult, type ValidationIssue } from "../../_vendor/ailf-core/index.d.ts";
 export declare class CompareStep implements PipelineStep {