@skill-harness/cli 0.24.3 → 0.25.0

package/dist/decision.js

@@ -0,0 +1,2478 @@
+// experiments/decision-shadow/main.mjs
+import { createHash as createHash5 } from "node:crypto";
+import { open as open4, readFile as readFile2, stat } from "node:fs/promises";
+import { resolve as resolve2 } from "node:path";
+
+// experiments/decision-shadow/research-commands.mjs
+import { mkdir as mkdir2, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join2, resolve } from "node:path";
+
+// experiments/decision-shadow/learning-data.mjs
+import { createHash as createHash2 } from "node:crypto";
+import { constants } from "node:fs";
+import { open, mkdir, writeFile } from "node:fs/promises";
+import { isAbsolute, join, normalize } from "node:path";
+
+// experiments/decision-shadow/dataset.mjs
+import { createHash } from "node:crypto";
+var CASE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
+var SHA256 = /^[0-9a-f]{64}$/;
+var MAX_CASES = 100;
+var MAX_RECORD_ID = 256;
+var MAX_ACTOR = 256;
+function plainObject(value, path) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new TypeError(`${path} must be an object`);
+  }
+  return value;
+}
+function exactKeys(value, expected, path) {
+  const actual = Object.keys(value).sort();
+  const wanted = [...expected].sort();
+  if (actual.length !== wanted.length || actual.some((key, index) => key !== wanted[index])) {
+    throw new TypeError(`${path} must contain exactly: ${wanted.join(", ")}`);
+  }
+}
+function boundedString(value, min, max, path) {
+  if (typeof value !== "string") throw new TypeError(`${path} must be a string`);
+  const length = Array.from(value).length;
+  if (length < min || length > max) {
+    throw new RangeError(`${path} must contain ${min}..${max} characters`);
+  }
+  return value;
+}
+function sha(value, path) {
+  if (typeof value !== "string" || !SHA256.test(value)) {
+    throw new TypeError(`${path} must be a lowercase SHA-256 hex digest`);
+  }
+  return value;
+}
+function canonical(value) {
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  if (value !== null && typeof value === "object") {
+    return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function hashCase(value) {
+  return createHash("sha256").update(canonical(value), "utf8").digest("hex");
+}
+function parseCases(value) {
+  const root = plainObject(value, "dataset");
+  exactKeys(root, ["schema", "cases"], "dataset");
+  if (root.schema !== 1) throw new TypeError("dataset.schema must be 1");
+  if (!Array.isArray(root.cases)) throw new TypeError("dataset.cases must be an array");
+  if (root.cases.length < 1 || root.cases.length > MAX_CASES) {
+    throw new RangeError(`dataset.cases must contain 1..${MAX_CASES} cases`);
+  }
+  const ids = /* @__PURE__ */ new Set();
+  return root.cases.map((candidate, index) => {
+    const path = `dataset.cases[${index}]`;
+    const item = plainObject(candidate, path);
+    exactKeys(item, ["id", "input", "question", "provenance", "source", "visibility"], path);
+    if (typeof item.id !== "string" || !CASE_ID.test(item.id)) {
+      throw new TypeError(`${path}.id has an invalid format`);
+    }
+    if (ids.has(item.id)) throw new TypeError(`duplicate case id: ${item.id}`);
+    ids.add(item.id);
+    const source = plainObject(item.source, `${path}.source`);
+    exactKeys(source, ["sha256", "recordId"], `${path}.source`);
+    const validated = {
+      id: item.id,
+      input: boundedString(item.input, 1, 16e3, `${path}.input`),
+      question: boundedString(item.question, 1, 4e3, `${path}.question`),
+      provenance: item.provenance,
+      source: {
+        sha256: sha(source.sha256, `${path}.source.sha256`),
+        recordId: boundedString(source.recordId, 1, MAX_RECORD_ID, `${path}.source.recordId`)
+      },
+      visibility: item.visibility
+    };
+    if (validated.source.recordId.trim().length === 0) {
+      throw new TypeError(`${path}.source.recordId must not be blank`);
+    }
+    if (!["synthetic", "observed"].includes(validated.provenance)) {
+      throw new TypeError(`${path}.provenance is invalid`);
+    }
+    if (!["public", "redacted"].includes(validated.visibility)) {
+      throw new TypeError(`${path}.visibility is invalid`);
+    }
+    return { ...validated, hash: hashCase(validated) };
+  });
+}
+function parseLabels(value, cases) {
+  if (!Array.isArray(cases)) throw new TypeError("cases must be an array");
+  const caseById = new Map(cases.map((item) => [item.id, item]));
+  if (caseById.size !== cases.length) throw new TypeError("cases contain duplicate ids");
+  const root = plainObject(value, "label dataset");
+  exactKeys(root, ["schema", "labels"], "label dataset");
+  if (root.schema !== 1) throw new TypeError("label dataset.schema must be 1");
+  if (!Array.isArray(root.labels)) throw new TypeError("label dataset.labels must be an array");
+  const seen = /* @__PURE__ */ new Set();
+  return root.labels.map((candidate, index) => {
+    const path = `label dataset.labels[${index}]`;
+    const item = plainObject(candidate, path);
+    exactKeys(item, ["caseId", "caseHash", "value", "kind", "actor", "evidenceSha256", "independent"], path);
+    if (typeof item.caseId !== "string" || !CASE_ID.test(item.caseId)) {
+      throw new TypeError(`${path}.caseId has an invalid format`);
+    }
+    if (seen.has(item.caseId)) throw new TypeError(`duplicate label for case: ${item.caseId}`);
+    seen.add(item.caseId);
+    const matched = caseById.get(item.caseId);
+    if (!matched) throw new TypeError(`label refers to unknown case: ${item.caseId}`);
+    sha(item.caseHash, `${path}.caseHash`);
+    if (item.caseHash !== matched.hash) throw new TypeError(`stale case hash for label: ${item.caseId}`);
+    if (typeof item.value !== "boolean") throw new TypeError(`${path}.value must be boolean`);
+    if (!["human", "test"].includes(item.kind)) throw new TypeError(`${path}.kind is invalid`);
+    if (item.independent !== true) throw new TypeError(`${path}.independent must be true`);
+    const validated = {
+      caseId: item.caseId,
+      caseHash: item.caseHash,
+      value: item.value,
+      kind: item.kind,
+      actor: boundedString(item.actor, 1, MAX_ACTOR, `${path}.actor`),
+      evidenceSha256: sha(item.evidenceSha256, `${path}.evidenceSha256`),
+      independent: true
+    };
+    if (validated.actor.trim().length === 0) {
+      throw new TypeError(`${path}.actor must not be blank`);
+    }
+    return validated;
+  });
+}
+function scorePredictions(cases, labels, records) {
+  if (!Array.isArray(cases) || !Array.isArray(labels) || !Array.isArray(records)) {
+    throw new TypeError("cases, labels, and records must be arrays");
+  }
+  const caseById = new Map(cases.map((item) => [item.id, item]));
+  if (caseById.size !== cases.length) throw new TypeError("cases contain duplicate ids");
+  const validatedLabels = parseLabels({ schema: 1, labels }, cases);
+  const labelById = new Map(validatedLabels.map((item) => [item.caseId, item]));
+  const recordById = /* @__PURE__ */ new Map();
+  for (const [index, candidate] of records.entries()) {
+    const path = `records[${index}]`;
+    const record = plainObject(candidate, path);
+    exactKeys(record, ["caseId", "caseHash", "status", "probability"], path);
+    if (recordById.has(record.caseId)) throw new TypeError(`duplicate prediction for case: ${record.caseId}`);
+    const matched = caseById.get(record.caseId);
+    if (!matched) throw new TypeError(`prediction refers to unknown case: ${record.caseId}`);
+    if (record.caseHash !== matched.hash) throw new TypeError(`stale case hash for prediction: ${record.caseId}`);
+    if (!["answered", "refused", "error"].includes(record.status)) {
+      throw new TypeError(`${path}.status is invalid`);
+    }
+    if (record.status === "answered") {
+      if (typeof record.probability !== "number" || !Number.isFinite(record.probability) || record.probability < 0 || record.probability > 1) {
+        throw new TypeError(`${path}.probability must be finite and within 0..1 when answered`);
+      }
+    } else if (record.probability !== null) {
+      throw new TypeError(`${path}.probability must be null when not answered`);
+    }
+    recordById.set(record.caseId, record);
+  }
+  let answered = 0;
+  let refused = 0;
+  let errors = 0;
+  let scored = 0;
+  let correct = 0;
+  let brierTotal = 0;
+  let falsePositives = 0;
+  let falseNegatives = 0;
+  for (const record of recordById.values()) {
+    if (record.status === "answered") answered++;
+    else if (record.status === "refused") refused++;
+    else errors++;
+    const label = labelById.get(record.caseId);
+    if (!label || record.status !== "answered") continue;
+    scored++;
+    const predicted = record.probability >= 0.5;
+    if (predicted === label.value) correct++;
+    else if (predicted) falsePositives++;
+    else falseNegatives++;
+    brierTotal += (record.probability - Number(label.value)) ** 2;
+  }
+  return {
+    totalCases: cases.length,
+    labeledCases: labels.length,
+    attempted: records.length,
+    answered,
+    refused,
+    errors,
+    missing: cases.length - records.length,
+    scored,
+    correct,
+    accuracy: scored === 0 ? null : correct / scored,
+    brier: scored === 0 ? null : brierTotal / scored,
+    falsePositives,
+    falseNegatives
+  };
+}
+function localCorpus(cases, labels) {
+  if (!Array.isArray(cases) || !Array.isArray(labels)) {
+    throw new TypeError("cases and labels must be arrays");
+  }
+  const validatedLabels = parseLabels({ schema: 1, labels }, cases);
+  const labelById = new Map(validatedLabels.map((item) => [item.caseId, item]));
+  return {
+    schema: 1,
+    kind: "independent-label-corpus",
+    trainingReady: false,
+    purpose: "Human/test curated observations for future lawful research; not a training dataset.",
+    rows: cases.filter((item) => labelById.has(item.id)).map((item) => ({
+      caseId: item.id,
+      caseHash: item.hash,
+      input: item.input,
+      question: item.question,
+      provenance: item.provenance,
+      source: { ...item.source },
+      visibility: item.visibility,
+      label: { ...labelById.get(item.id) }
+    }))
+  };
+}
+
+// experiments/decision-shadow/learning-training.mjs
+var TRAINING_REQUIREMENTS = "torch==2.8.0\ntransformers==4.57.1\npeft==0.17.0\naccelerate==1.10.1\nsafetensors==0.6.2\n";
+var TRAINING_CONFIG = { schema: 1, baseModel: { id: null, revision: null, localPath: null, files: [], license: { identifier: null, accepted: false, reviewer: null } }, eligibilityReview: { approved: false, reviewer: null, exportManifestSha256: null }, training: { device: "cpu", seed: 17, epochs: 1, maxLength: 1024, learningRate: 2e-4, loraRank: 8, loraAlpha: 16, targetModules: [] } };
+var TRAINING_PY = String.raw`#!/usr/bin/env python3
+"""Local reviewed-data LoRA workflow. Default is validation only. Never downloads or uploads."""
+import argparse, hashlib, importlib.metadata, json, os, pathlib, re, sys
+
+PINS = {'torch':'2.8.0','transformers':'4.57.1','peft':'0.17.0','accelerate':'1.10.1','safetensors':'0.6.2'}
+
+def require(condition, message):
+    if not condition: raise ValueError(message)
+
+def digest(data): return hashlib.sha256(data).hexdigest()
+
+def ordinary(path):
+    path = pathlib.Path(path)
+    require(path.is_absolute() and not path.is_symlink() and path.is_file(), 'Expected an explicit ordinary file')
+    require(path.resolve() == path, 'Symlinked file ancestors are unsupported')
+    return path.read_bytes()
+
+def closed(value, fields, name):
+    require(isinstance(value, dict) and set(value) == set(fields), name + ' has unsupported or missing fields')
+
+def export_data(root):
+    root = pathlib.Path(root).absolute()
+    raw = ordinary(root / 'export-manifest.json'); m = json.loads(raw)
+    require(m.get('schema') == 1 and m.get('kind') == 'decision-learning-export', 'Unsupported export')
+    require(m.get('trainingExecuted') is False and m.get('providerPredictionsIncluded') is False, 'Unsupported source provenance')
+    require(set(m['files']) == {'train.jsonl','validation.jsonl','test.jsonl','train-lora.py','requirements-training.txt','training-config.example.json','TRAINING.md'}, 'Unexpected export files')
+    for name, ref in m['files'].items():
+        closed(ref, ['sha256','bytes'], 'File reference')
+        b = ordinary(root / name)
+        require(len(b) == ref['bytes'] and digest(b) == ref['sha256'], 'Export file hash/length mismatch: ' + name)
+    require(digest(ordinary(pathlib.Path(__file__).absolute())) == m['files']['train-lora.py']['sha256'], 'Run the exact exported training script')
+    groups, seen_inputs, seen_cases = {}, {}, set()
+    for split in ['train','validation','test']:
+        rows = [json.loads(line) for line in ordinary(root / (split+'.jsonl')).decode('utf-8').splitlines()]
+        require(len(rows) == m['counts'][split], 'Split count mismatch')
+        for row in rows:
+            closed(row, ['caseId','caseHash','taskGroup','lineageGroup','sessionId','fixtureOnly','input','question','answer','label','source'], 'Dataset row')
+            require(row['caseId'] not in seen_cases and type(row['answer']) is bool, 'Duplicate case or invalid label')
+            seen_cases.add(row['caseId'])
+            require(row['label']['caseId'] == row['caseId'] and row['label']['caseHash'] == row['caseHash'] and row['label']['value'] == row['answer'] and row['label']['kind'] in ['human','test'] and row['label']['independent'] is True, 'Label identity mismatch')
+            for key in ['taskGroup','lineageGroup','sessionId']:
+                if row[key] is not None:
+                    identity = key + ':' + row[key]
+                    require(identity not in groups or groups[identity] == split, 'Related cases cross splits')
+                    groups[identity] = split
+            normalized = ' '.join(row['input'].casefold().split())
+            require(normalized not in seen_inputs or seen_inputs[normalized] == split, 'Duplicate input crosses splits')
+            seen_inputs[normalized] = split
+            if m.get('trainingEligible') is True: require(row['fixtureOnly'] is False and row['sessionId'] is not None, 'Fixture/anonymous data cannot be training eligible')
+    return root, m, digest(raw)
+
+def config_data(path, manifest, manifest_hash):
+    c = json.loads(ordinary(pathlib.Path(path).absolute()))
+    closed(c, ['schema','baseModel','eligibilityReview','training'], 'Configuration')
+    require(c['schema'] == 1, 'Unsupported configuration')
+    r = c['eligibilityReview']; closed(r, ['approved','reviewer','exportManifestSha256'], 'Eligibility review')
+    require(manifest.get('trainingEligible') is True and manifest.get('mode') == 'reviewed-data', 'Export is not eligible for training; fixtures remain plumbing demonstrations')
+    require(r['approved'] is True and isinstance(r['reviewer'], str) and r['reviewer'].strip() and r['exportManifestSha256'] == manifest_hash, 'Exact export eligibility review required')
+    b = c['baseModel']; closed(b, ['id','revision','localPath','files','license'], 'Base model')
+    require(isinstance(b['id'], str) and b['id'].strip() and isinstance(b['revision'], str) and re.fullmatch(r'[0-9a-f]{40}', b['revision']), 'Select an exact base model and full pinned revision')
+    license = b['license']; closed(license, ['identifier','accepted','reviewer'], 'License review')
+    require(license['accepted'] is True and all(isinstance(license[k],str) and license[k].strip() for k in ['identifier','reviewer']), 'Explicit model license review required')
+    model = pathlib.Path(b['localPath'] or '')
+    require(model.is_absolute() and model.is_dir() and model.resolve() == model, 'Base weights must already exist at a canonical local directory')
+    require(isinstance(b['files'], list) and b['files'], 'Pinned local model file manifest required')
+    expected = {}
+    for ref in b['files']:
+        closed(ref, ['path','sha256'], 'Model file reference'); name = ref['path']
+        require(isinstance(name,str) and name and not pathlib.PurePosixPath(name).is_absolute() and '..' not in pathlib.PurePosixPath(name).parts and '\\' not in name and name not in expected, 'Invalid model relative path')
+        require(isinstance(ref['sha256'],str) and re.fullmatch(r'[0-9a-f]{64}',ref['sha256']), 'Invalid model file digest')
+        expected[name] = ref['sha256']
+        require(digest(ordinary(model / name)) == ref['sha256'], 'Local model hash mismatch')
+    actual = set()
+    for item in model.rglob('*'):
+        require(not item.is_symlink(), 'Model symlinks unsupported')
+        if item.is_file(): actual.add(item.relative_to(model).as_posix())
+    require(actual == set(expected) and 'config.json' in actual and any(x.endswith('.safetensors') for x in actual), 'Every local model file must be pinned, including config and safe weights')
+    t = c['training']; closed(t, ['device','seed','epochs','maxLength','learningRate','loraRank','loraAlpha','targetModules'], 'Training')
+    require(t['device'] in ['cpu','cuda'], 'Explicit cpu/cuda device required')
+    for name, lo, hi in [('seed',0,2147483647),('epochs',1,10),('maxLength',32,8192),('loraRank',1,64),('loraAlpha',1,128)]:
+        require(type(t[name]) is int and lo <= t[name] <= hi, 'Invalid ' + name)
+    require(type(t['learningRate']) in [float,int] and 0 < t['learningRate'] <= 0.01, 'Invalid learning rate')
+    require(isinstance(t['targetModules'],list) and t['targetModules'] and all(isinstance(x,str) and x for x in t['targetModules']), 'Select target modules for the reviewed base architecture')
+    return c
+
+def main():
+    p = argparse.ArgumentParser(description=__doc__)
+    p.add_argument('--export', required=True); p.add_argument('--config'); p.add_argument('--output'); p.add_argument('--check-export-only', action='store_true'); p.add_argument('--train', action='store_true')
+    args = p.parse_args()
+    require(not (args.train and args.check_export_only), 'Export-only check cannot train')
+    root, manifest, manifest_hash = export_data(args.export)
+    if args.check_export_only:
+        print(json.dumps({'mode':'offline-export-check','exportManifestSha256':manifest_hash,'trainingEligible':manifest['trainingEligible'],'trainingExecuted':False})); return
+    require(args.config is not None, 'Supply a reviewed config; the example has no selected model or approval')
+    config = config_data(args.config, manifest, manifest_hash)
+    versions = {}
+    for name in PINS:
+        try: versions[name] = importlib.metadata.version(name)
+        except importlib.metadata.PackageNotFoundError: versions[name] = None
+    receipt = {'mode':'validation-only','exportManifestSha256':manifest_hash,'configSha256':digest(ordinary(pathlib.Path(args.config).absolute())),'python':sys.version,'dependencyVersions':versions,'requiredVersions':PINS,'trainingExecuted':False,'networkAllowed':False}
+    if not args.train:
+        print(json.dumps(receipt)); return
+    require(sys.version_info[:2] == (3,12), 'Training workflow pins Python 3.12; validation itself is standard-library only')
+    require(versions == PINS, 'Install and independently verify the exact pinned dependencies before opting into training')
+    require(args.output is not None, 'Choose a new local output directory')
+    output = pathlib.Path(args.output).absolute(); require(not output.exists(), 'Training output must be new')
+    os.environ.update({'HF_HUB_OFFLINE':'1','TRANSFORMERS_OFFLINE':'1','HF_DATASETS_OFFLINE':'1','HF_HUB_DISABLE_TELEMETRY':'1','WANDB_DISABLED':'true'})
+    import torch
+    from transformers import AutoModelForCausalLM, AutoTokenizer, Trainer, TrainingArguments, set_seed
+    from peft import LoraConfig, TaskType, get_peft_model
+    t = config['training']; set_seed(t['seed'])
+    require(t['device'] != 'cuda' or torch.cuda.is_available(), 'Configured CUDA device unavailable')
+    local = config['baseModel']['localPath']
+    tokenizer = AutoTokenizer.from_pretrained(local, local_files_only=True, trust_remote_code=False)
+    require(tokenizer.eos_token_id is not None, 'Selected tokenizer requires an EOS token')
+    if tokenizer.pad_token_id is None: tokenizer.pad_token = tokenizer.eos_token
+    model = AutoModelForCausalLM.from_pretrained(local, local_files_only=True, trust_remote_code=False, use_safetensors=True)
+    model = get_peft_model(model, LoraConfig(task_type=TaskType.CAUSAL_LM, r=t['loraRank'], lora_alpha=t['loraAlpha'], target_modules=t['targetModules'], lora_dropout=0.0, bias='none'))
+    def rows(split):
+        data = []
+        for line in ordinary(root / (split + '.jsonl')).decode('utf-8').splitlines():
+            row = json.loads(line)
+            require(row['fixtureOnly'] is False and type(row['answer']) is bool and row['label']['kind'] in ['human','test'] and row['label']['independent'] is True, 'Only independently labeled reviewed real data may train')
+            prompt = 'Question: ' + row['question'] + '\nEvidence:\n' + row['input'] + '\nAnswer (true or false): '
+            prefix = tokenizer.encode(prompt, add_special_tokens=True)
+            target = tokenizer.encode('true' if row['answer'] else 'false', add_special_tokens=False) + [tokenizer.eos_token_id]
+            require(len(prefix) + len(target) <= t['maxLength'], 'Example exceeds reviewed token limit; do not silently truncate evidence')
+            data.append({'input_ids':prefix+target,'attention_mask':[1]*(len(prefix)+len(target)),'labels':[-100]*len(prefix)+target})
+        require(data, 'Training and validation splits must be nonempty'); return data
+    def collate(batch):
+        width = max(len(r['input_ids']) for r in batch)
+        return {key:torch.tensor([r[key]+[(-100 if key=='labels' else tokenizer.pad_token_id if key=='input_ids' else 0)]*(width-len(r[key])) for r in batch]) for key in ['input_ids','attention_mask','labels']}
+    train, validation = rows('train'), rows('validation')
+    output.mkdir(mode=0o700)
+    receipt['mode']='explicit-local-training'; receipt['trainingExecuted']=True
+    receipt['resolvedEnvironment']={d.metadata.get('Name','unknown'):d.version for d in importlib.metadata.distributions()}
+    (output/'run-config.json').write_text(json.dumps({'receipt':receipt,'config':config},indent=2)+'\n')
+    trainer = Trainer(model=model,args=TrainingArguments(output_dir=str(output/'checkpoints'),use_cpu=t['device']=='cpu',seed=t['seed'],data_seed=t['seed'],num_train_epochs=t['epochs'],learning_rate=t['learningRate'],per_device_train_batch_size=1,per_device_eval_batch_size=1,eval_strategy='epoch',save_strategy='no',report_to=[],push_to_hub=False,dataloader_num_workers=0),train_dataset=train,eval_dataset=validation,data_collator=collate)
+    trainer.train(); model.save_pretrained(output/'adapter',safe_serialization=True); tokenizer.save_pretrained(output/'adapter')
+    (output/'validation-metrics.json').write_text(json.dumps(trainer.evaluate(),indent=2)+'\n')
+    print(json.dumps({'adapter':str(output/'adapter'),'trainingExecuted':True,'heldOutTestUsedForTraining':False,'deploymentAuthorized':False}))
+
+if __name__ == '__main__':
+    try: main()
+    except (ValueError, OSError, KeyError, TypeError, json.JSONDecodeError) as error:
+        print('learning workflow refused: ' + str(error), file=sys.stderr); sys.exit(1)
+`;
+var TRAINING_DOC = `# Local LoRA workflow
+
+This export contains independent labels, never JEV predictions. A fixture demonstration is not training eligible. No training or installation has been performed by exporting these files.
+
+1. Check the intact export offline: python3 train-lora.py --export /absolute/export --check-export-only.
+2. For reviewed real data only, select a base model, immutable full revision, license and an existing canonical local weight directory. Pin every file by SHA-256 in a separate copy of training-config.example.json. Select architecture-specific LoRA target modules. Record an explicit eligibility review bound to the exact export-manifest.json digest. Storage consent alone is insufficient.
+3. Use an isolated Python 3.12 environment with the exact requirements-training.txt versions. Resolve dependencies separately, retain the complete resolved environment/wheel hashes, and assess the host memory requirements. The template pins direct versions; it is not a platform-complete dependency lock or proof of hardware support.
+4. Run python3 train-lora.py --export /absolute/export --config /absolute/reviewed-config.json. Default behavior validates only. It reports installed dependency versions and never loads a model.
+5. Only after separate approval, add --train --output /absolute/new-adapter-directory. Training requires the pinned environment and already available safe weights. The script disables Hub access, telemetry, remote code and publishing. It refuses occupied output or evidence truncation. Only train/validation examples feed the trainer; the test split is hash-checked but never loaded into the trainer.
+6. Evaluate the held-out test split against the unchanged base and deterministic oracle before considering deployment. Validation loss and an adapter file are not proof of decision quality, calibration, speed, generality or runtime authority.
+
+The selected repository/task families and their variants must remain together across splits. Recheck consent, rights and eligibility for any new export. This local script is not an OS sandbox; do not run untrusted model code or packages. A seed records intended reproducibility, not bit-for-bit GPU determinism.
+
+Implementation references: https://huggingface.co/docs/peft/v0.17.0/en/quicktour and https://huggingface.co/docs/transformers/v4.57.1/en/main_classes/trainer . Local-only loading: https://huggingface.co/docs/transformers/v4.57.1/en/installation . This workflow has offline validation tests only; no installed-library training qualification or trained model is claimed.
+`;
+function trainingAssets() {
+  return { "train-lora.py": TRAINING_PY, "requirements-training.txt": TRAINING_REQUIREMENTS, "training-config.example.json": JSON.stringify(TRAINING_CONFIG, null, 2) + "\n", "TRAINING.md": TRAINING_DOC };
+}
+
+// experiments/decision-shadow/learning-data.mjs
+var learningDigest = (value) => createHash2("sha256").update(typeof value === "string" || Buffer.isBuffer(value) ? value : canonical2(value)).digest("hex");
+function canonical2(value) {
+  return Array.isArray(value) ? `[${value.map(canonical2).join(",")}]` : value !== null && typeof value === "object" ? `{${Object.keys(value).sort().map((k) => `${JSON.stringify(k)}:${canonical2(value[k])}`).join(",")}}` : JSON.stringify(value);
+}
+function check(ok, message) {
+  if (!ok) throw new TypeError(message);
+}
+function keys(v, names, name) {
+  check(v && typeof v === "object" && !Array.isArray(v) && Object.keys(v).sort().join("|") === [...names].sort().join("|"), `${name}: unsupported or missing fields`);
+}
+function text(v, name, max = 256) {
+  check(typeof v === "string" && v.trim().length > 0 && v.length <= max && !v.includes("\0"), `${name}: invalid text`);
+}
+function sha2(v) {
+  check(typeof v === "string" && /^[0-9a-f]{64}$/.test(v), "invalid SHA-256");
+}
+function date(v) {
+  check(typeof v === "string" && /^\d{4}-\d\d-\d\dT/.test(v) && Number.isFinite(Date.parse(v)), "invalid timestamp");
+}
+function bool(v) {
+  check(typeof v === "boolean", "expected boolean");
+}
+function choice(v, allowed, name) {
+  check(allowed.includes(v), `${name}: unsupported value`);
+}
+function parsedCases(cases) {
+  check(Array.isArray(cases), "cases must be parsed cases");
+  const raw = cases.map((c) => {
+    keys(c, ["id", "input", "question", "provenance", "source", "visibility", "hash"], "parsed case");
+    const { hash: hash3, ...rest } = c;
+    return rest;
+  });
+  const validated = parseCases({ schema: 1, cases: raw });
+  validated.forEach((c, i) => check(c.hash === cases[i].hash, "stale parsed case hash"));
+  return validated;
+}
+var CONSENT_KEYS = ["schema", "kind", "sessionId", "decision", "interactionId", "recordedAt", "source", "scope"];
+function createStorageConsent({ sessionId, decision, interactionId, recordedAt }) {
+  return parseStorageConsent({ schema: 1, kind: "decision-session-storage-consent", sessionId, decision, interactionId, recordedAt, source: "explicit-user-response", scope: "selected-session-data-for-lora-review" }, sessionId);
+}
+function parseStorageConsent(record, expectedSessionId) {
+  keys(record, CONSENT_KEYS, "storage consent");
+  text(expectedSessionId, "expected session ID");
+  check(record.schema === 1 && record.kind === "decision-session-storage-consent" && record.source === "explicit-user-response" && record.scope === "selected-session-data-for-lora-review", "unsupported consent contract");
+  text(record.sessionId, "session ID");
+  text(record.interactionId, "interaction ID");
+  date(record.recordedAt);
+  check(record.sessionId === expectedSessionId, "storage consent belongs to another session");
+  choice(record.decision, ["granted", "declined"], "consent");
+  return structuredClone(record);
+}
+function consentFor(consents, sessionId) {
+  check(Array.isArray(consents), "consents must be an array");
+  const matches = consents.filter((c2) => c2.sessionId === sessionId);
+  check(matches.length === 1, "one explicit current-session storage consent required");
+  const c = parseStorageConsent(matches[0], sessionId);
+  check(c.decision === "granted", "session storage declined; advice remains allowed");
+  return c;
+}
+var ENTRY_KEYS = ["caseId", "caseHash", "taskGroup", "lineageGroup", "split", "sessionId", "fixtureOnly", "decisionTimeReviewed", "redactionReviewed", "rights", "exportApproved", "trainingApproved", "reviewer"];
+function parseEntry(c, e) {
+  keys(e, ENTRY_KEYS, "experiment entry");
+  check(e.caseId === c.id && e.caseHash === c.hash, "experiment case identity mismatch");
+  for (const k of ["taskGroup", "lineageGroup", "reviewer"]) text(e[k], k);
+  choice(e.split, ["train", "validation", "test", "unassigned"], "split");
+  choice(e.rights, ["unknown", "local-export", "local-training"], "rights");
+  for (const k of ["fixtureOnly", "decisionTimeReviewed", "redactionReviewed", "exportApproved", "trainingApproved"]) bool(e[k]);
+  if (c.provenance === "observed") {
+    text(e.sessionId, "observed session ID");
+    check(!e.fixtureOnly, "observed case cannot be a synthetic fixture");
+  } else check(e.sessionId === null && e.fixtureOnly === true, "synthetic data must remain fixture-only, without session consent");
+  return structuredClone(e);
+}
+function parseExperiment(cases, manifest) {
+  cases = parsedCases(cases);
+  keys(manifest, ["schema", "kind", "id", "frozenAt", "entries"], "experiment");
+  check(manifest.schema === 1 && manifest.kind === "decision-learning-experiment", "unsupported experiment");
+  text(manifest.id, "experiment ID");
+  date(manifest.frozenAt);
+  check(Array.isArray(manifest.entries) && manifest.entries.length === cases.length, "one ordered experiment entry required per case");
+  const entries = cases.map((c, i) => parseEntry(c, manifest.entries[i]));
+  const groups = /* @__PURE__ */ new Map(), duplicates = /* @__PURE__ */ new Map();
+  function bind(map, key, split, what) {
+    if (map.has(key)) check(map.get(key) === split, `${what} crosses splits`);
+    else map.set(key, split);
+  }
+  entries.forEach((e, i) => {
+    bind(groups, "task:" + e.taskGroup, e.split, "task group");
+    bind(groups, "lineage:" + e.lineageGroup, e.split, "lineage group");
+    if (e.sessionId !== null) bind(groups, "session:" + e.sessionId, e.split, "session");
+    bind(duplicates, learningDigest(cases[i].input.normalize("NFKC").replace(/\s+/gu, " ").trim().toLowerCase()), e.split, "duplicate input");
+    bind(duplicates, "source:" + cases[i].source.sha256 + ":" + cases[i].source.recordId, e.split, "source record");
+  });
+  return { ...structuredClone(manifest), entries };
+}
+async function readExplicit(path, expected, limit = 1024 * 1024) {
+  text(path, "artifact path", 4096);
+  check(process.platform === "linux", "Evidence review requires Linux no-follow directory descriptors");
+  check(isAbsolute(path) && normalize(path) === path && !path.endsWith("/"), "artifact path must be canonical and absolute");
+  sha2(expected);
+  const components = path.split("/").filter(Boolean);
+  check(components.length <= 128, "artifact path too deep");
+  check(!components.some((p) => ["sessions", "native-sessions", "auth.json", ".env"].includes(p.toLowerCase())), "private session or credential paths are unsupported");
+  const directories = [], flags = constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW | constants.O_NONBLOCK;
+  const identity2 = (s) => [s.dev, s.ino, s.mode].map(String).join(":");
+  const metadata2 = (s) => [s.dev, s.ino, s.mode, s.size, s.mtimeNs, s.ctimeNs].map(String).join(":");
+  let file;
+  try {
+    let handle = await open("/", flags);
+    directories.push({ handle, parent: null, name: "/", identity: identity2(await handle.stat({ bigint: true })) });
+    for (const name2 of components.slice(0, -1)) {
+      const parent2 = handle;
+      handle = await open(`/proc/self/fd/${parent2.fd}/${name2}`, flags);
+      directories.push({ handle, parent: parent2, name: name2, identity: identity2(await handle.stat({ bigint: true })) });
+    }
+    const name = components.at(-1), parent = handle;
+    file = await open(`/proc/self/fd/${parent.fd}/${name}`, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    const before = await file.stat({ bigint: true });
+    check(before.isFile() && before.size <= BigInt(limit), "artifact must be a bounded ordinary file");
+    const b = Buffer.alloc(Number(before.size) + 1);
+    let n = 0;
+    while (n < b.length) {
+      const r = await file.read(b, n, b.length - n, n);
+      if (!r.bytesRead) break;
+      n += r.bytesRead;
+    }
+    check(n === Number(before.size) && metadata2(before) === metadata2(await file.stat({ bigint: true })), "artifact changed while reading");
+    const reopened = await open(`/proc/self/fd/${parent.fd}/${name}`, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+      check(metadata2(before) === metadata2(await reopened.stat({ bigint: true })), "artifact path changed while reading");
+    } finally {
+      await reopened.close();
+    }
+    for (const d of directories) {
+      const h = await open(d.parent ? `/proc/self/fd/${d.parent.fd}/${d.name}` : "/", flags);
+      try {
+        check(identity2(await h.stat({ bigint: true })) === d.identity, "artifact ancestor changed");
+      } finally {
+        await h.close();
+      }
+    }
+    const bytes = b.subarray(0, n);
+    check(learningDigest(bytes) === expected, "artifact hash mismatch");
+    return bytes;
+  } finally {
+    if (file) await file.close();
+    await Promise.allSettled(directories.map((d) => d.handle.close()));
+  }
+}
+function json(bytes) {
+  return JSON.parse(new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes));
+}
+async function reviewLabelEvidence({ cases, labels, references }) {
+  cases = parsedCases(cases);
+  labels = parseLabels({ schema: 1, labels }, cases);
+  check(labels.length <= 100 && Array.isArray(references) && references.length === labels.length && references.length <= cases.length, "one bounded label evidence reference required per label");
+  const seen = /* @__PURE__ */ new Set(), reviewed = [];
+  for (const label of labels) {
+    const matches = references.filter((r2) => r2.caseId === label.caseId);
+    check(matches.length === 1, "duplicate or missing label evidence");
+    const r = matches[0];
+    keys(r, ["caseId", "path", "sha256"], "label reference");
+    check(!seen.has(r.path), "label receipt reused");
+    seen.add(r.path);
+    check(r.sha256 === label.evidenceSha256, "label evidence digest mismatch");
+    const receipt = json(await readExplicit(r.path, r.sha256));
+    keys(receipt, ["schema", "kind", "caseId", "caseHash", "source", "value", "labelKind", "actor", "independent", "recordedAt", "method"], "label receipt");
+    check(receipt.schema === 1 && receipt.kind === "independent-decision-label", "model/audit output is not independent label evidence");
+    for (const k of ["caseId", "caseHash", "value", "actor", "independent"]) check(receipt[k] === label[k], "label receipt disagrees with " + k);
+    check(receipt.labelKind === label.kind, "label provenance mismatch");
+    date(receipt.recordedAt);
+    const c = cases.find((c2) => c2.id === label.caseId);
+    keys(receipt.source, ["sha256", "recordId"], "label source");
+    check(canonical2(receipt.source) === canonical2(c.source), "label source mismatch");
+    keys(receipt.method, ["kind", "id", "version"], "label method");
+    check(receipt.method.kind === (label.kind === "human" ? "human-review" : "deterministic-test"), "prediction cannot supply a label");
+    text(receipt.method.id, "method");
+    text(receipt.method.version, "method version");
+    reviewed.push({ caseId: c.id, caseHash: c.hash, reference: { ...r }, label: { ...label }, method: { ...receipt.method }, recordedAt: receipt.recordedAt });
+  }
+  return { schema: 1, kind: "decision-label-evidence-review", reviewed, meaning: "Exact receipt bytes and declared provenance checked; human identity, truth, independence and rights remain explicit reviewer assertions." };
+}
+async function importSelectedCase({ caseDocument, selection, sessionConsent, experimentEntry }) {
+  const cases = parseCases(caseDocument);
+  check(cases.length === 1 && cases[0].provenance === "observed", "import requires exactly one observed case");
+  const c = cases[0];
+  const e = parseEntry(c, experimentEntry);
+  const consent = parseStorageConsent(sessionConsent, e.sessionId);
+  check(consent.decision === "granted", "session storage declined; advice remains allowed");
+  check(e.decisionTimeReviewed && e.redactionReviewed, "decision-time and redaction review required");
+  keys(selection, ["schema", "kind", "sessionId", "source", "fragments"], "public selection");
+  check(selection.schema === 1 && selection.kind === "decision-selected-public-input" && selection.sessionId === e.sessionId, "selection session mismatch");
+  keys(selection.source, ["path", "sha256"], "selected source");
+  check(selection.source.sha256 === c.source.sha256, "selected source hash mismatch");
+  const primary = json(await readExplicit(selection.source.path, selection.source.sha256));
+  check(primary.toolCallId === c.source.recordId, "selected source tool-call identity mismatch");
+  check(Array.isArray(selection.fragments) && selection.fragments.length > 0 && selection.fragments.length <= 16, "select 1..16 explicit public fragments");
+  const parts = [], refs = [];
+  for (const f of selection.fragments) {
+    keys(f, ["path", "sha256", "jsonlLine", "jsonPointer", "start", "end", "replacements"], "fragment");
+    let s = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(await readExplicit(f.path, f.sha256));
+    if (f.jsonlLine !== null) {
+      check(Number.isSafeInteger(f.jsonlLine) && f.jsonlLine > 0, "invalid JSONL line");
+      s = s.split("\n")[f.jsonlLine - 1];
+      check(s !== void 0, "missing JSONL line");
+    }
+    if (f.jsonPointer !== null) {
+      check(typeof f.jsonPointer === "string" && f.jsonPointer.startsWith("/"), "invalid JSON pointer");
+      let v = JSON.parse(s);
+      for (const key of f.jsonPointer.slice(1).split("/").map((k) => k.replace(/~1/g, "/").replace(/~0/g, "~"))) {
+        check(v && typeof v === "object" && Object.hasOwn(v, key), "missing selected field");
+        v = v[key];
+      }
+      check(typeof v === "string", "selected field must be public text");
+      s = v;
+    }
+    const points = Array.from(s);
+    check(Number.isSafeInteger(f.start) && Number.isSafeInteger(f.end) && f.start >= 0 && f.end > f.start && f.end <= points.length, "invalid excerpt range");
+    let excerpt = points.slice(f.start, f.end).join("");
+    check(Array.isArray(f.replacements) && f.replacements.length <= 32, "invalid redactions");
+    for (const r of f.replacements) {
+      keys(r, ["from", "to"], "redaction");
+      text(r.from, "redaction source", 4096);
+      check(typeof r.to === "string" && /^<[A-Z0-9_ -]{1,80}>$/.test(r.to), "redaction must use a placeholder");
+      check(excerpt.includes(r.from), "redaction source absent");
+      excerpt = excerpt.replaceAll(r.from, r.to);
+    }
+    parts.push(excerpt);
+    refs.push({ ...f, replacements: f.replacements.map((r) => ({ fromSha256: learningDigest(r.from), fromCodepoints: Array.from(r.from).length, to: r.to })) });
+  }
+  check(parts.join("\n\n") === c.input, "case input must equal exact selected redacted fragments joined by two newlines");
+  return { caseDocument: structuredClone(caseDocument), experimentEntry: e, receipt: { schema: 1, kind: "decision-selected-public-import", caseId: c.id, caseHash: c.hash, sessionId: e.sessionId, consentHash: learningDigest(consent), source: structuredClone(selection.source), fragments: refs, trainingEligible: false, automaticCollection: false } };
+}
+async function prepareExport({ cases, labels, manifest, consents, labelEvidence, mode }) {
+  cases = parsedCases(cases);
+  manifest = parseExperiment(cases, manifest);
+  choice(mode, ["fixture-demo", "reviewed-data"], "export mode");
+  const reviewed = await reviewLabelEvidence({ cases, labels, references: labelEvidence });
+  const byId = new Map(reviewed.reviewed.map((r) => [r.caseId, r]));
+  const splitRows = { train: [], validation: [], test: [] }, excluded = [], included = [];
+  for (const [i, c] of cases.entries()) {
+    const e = manifest.entries[i], reasons = [];
+    const label = byId.get(c.id);
+    if (!label) reasons.push("independent label unavailable");
+    if (e.split === "unassigned") reasons.push("split unassigned");
+    if (!e.decisionTimeReviewed || !e.redactionReviewed) reasons.push("input review missing");
+    if (!e.exportApproved || e.rights === "unknown") reasons.push("local export permission or rights missing");
+    if (mode === "fixture-demo" && !e.fixtureOnly) reasons.push("fixture demo excludes observed data");
+    if (mode === "reviewed-data" && e.fixtureOnly) reasons.push("synthetic fixture excluded from reviewed training data");
+    if (!e.fixtureOnly) {
+      try {
+        consentFor(consents, e.sessionId);
+      } catch (error) {
+        reasons.push(error.message);
+      }
+    }
+    if (reasons.length) {
+      excluded.push({ caseId: c.id, reasons });
+      continue;
+    }
+    const row = { caseId: c.id, caseHash: c.hash, taskGroup: e.taskGroup, lineageGroup: e.lineageGroup, sessionId: e.sessionId, fixtureOnly: e.fixtureOnly, input: c.input, question: c.question, answer: label.label.value, label: { ...label.label }, source: { ...c.source } };
+    splitRows[e.split].push(row);
+    included.push(e);
+  }
+  check(included.length > 0, "no export-eligible cases");
+  const trainingEligible = mode === "reviewed-data" && excluded.length === 0 && Object.values(splitRows).every((rows) => rows.length > 0) && included.every((e) => !e.fixtureOnly && e.trainingApproved && e.rights === "local-training");
+  const files = { ...trainingAssets() };
+  for (const [split, rows] of Object.entries(splitRows)) files[`${split}.jsonl`] = rows.map((r) => JSON.stringify(r) + "\n").join("");
+  const metadata2 = { schema: 1, kind: "decision-learning-export", mode, experimentId: manifest.id, experimentHash: learningDigest(manifest), trainingEligible, trainingExecuted: false, providerPredictionsIncluded: false, counts: Object.fromEntries(Object.entries(splitRows).map(([s, r]) => [s, r.length])), excluded, review: { frozenAt: manifest.frozenAt, eligibilityRecords: included, independentLabelReceipts: reviewed.reviewed.map((r) => ({ ...r.reference, recordedAt: r.recordedAt })), sessionConsents: [...new Set(included.filter((e) => e.sessionId !== null).map((e) => e.sessionId))].map((sessionId) => {
+    const c = consentFor(consents, sessionId);
+    return { sessionId, sha256: learningDigest(c), decision: c.decision, interactionId: c.interactionId, recordedAt: c.recordedAt };
+  }) }, files: Object.fromEntries(Object.entries(files).map(([name, s]) => [name, { sha256: learningDigest(s), bytes: Buffer.byteLength(s) }])) };
+  files["export-manifest.json"] = JSON.stringify(metadata2, null, 2) + "\n";
+  return { schema: 1, kind: "prepared-decision-learning-export", metadata: metadata2, files };
+}
+async function writePreparedExport({ prepared, directory }) {
+  keys(prepared, ["schema", "kind", "metadata", "files"], "prepared export");
+  check(prepared.schema === 1 && prepared.kind === "prepared-decision-learning-export", "unsupported prepared export");
+  text(directory, "output directory", 4096);
+  check(isAbsolute(directory), "output directory must be absolute");
+  const allowed = ["train.jsonl", "validation.jsonl", "test.jsonl", "export-manifest.json", "train-lora.py", "training-config.example.json", "requirements-training.txt", "TRAINING.md"];
+  check(Object.keys(prepared.files).sort().join("|") === [...allowed].sort().join("|"), "unexpected export files");
+  check(prepared.files["export-manifest.json"] === JSON.stringify(prepared.metadata, null, 2) + "\n", "export metadata mismatch");
+  for (const [name, s] of Object.entries(prepared.files)) {
+    check(typeof s === "string", "export file must be text");
+    if (name !== "export-manifest.json") check(prepared.metadata.files[name]?.sha256 === learningDigest(s) && prepared.metadata.files[name]?.bytes === Buffer.byteLength(s), "prepared export bytes changed");
+  }
+  await mkdir(directory, { mode: 448 });
+  for (const [name, s] of Object.entries(prepared.files)) await writeFile(join(directory, name), s, { encoding: "utf8", flag: "wx", mode: 384 });
+  return { directory, trainingEligible: prepared.metadata.trainingEligible, files: Object.fromEntries(Object.entries(prepared.files).map(([name, s]) => [name, { sha256: learningDigest(s), bytes: Buffer.byteLength(s) }])) };
+}
+
+// experiments/decision-shadow/learning-fixtures.mjs
+var FIXTURE_ORACLE_VERSION = "mechanical-fixture-oracles-v1";
+var COMMIT = /^[a-f0-9]{40}$/;
+var PHASES = ["planned", "implemented", "reviewed", "integrated", "verified"];
+function evaluateFixture(family, e) {
+  if (!e || typeof e !== "object" || Array.isArray(e)) return false;
+  switch (family) {
+    case "candidate":
+      return typeof e.candidate === "string" && COMMIT.test(e.candidate) && e.tested === e.candidate && e.reviewed === e.candidate;
+    case "phases": {
+      if (!Array.isArray(e.required) || !e.required.length || new Set(e.required).size !== e.required.length || !Array.isArray(e.records)) return false;
+      const latest = /* @__PURE__ */ new Map();
+      for (const r of e.records) {
+        if (!r || typeof r.step !== "string" || !r.phases) return false;
+        latest.set(r.step, r.phases);
+      }
+      return latest.size === e.required.length && e.required.every((s) => typeof s === "string" && s.length > 0 && latest.has(s) && PHASES.every((p) => latest.get(s)[p] === "complete"));
+    }
+    case "findings": {
+      if (e.historyObserved !== true || !Array.isArray(e.records)) return false;
+      const latest = /* @__PURE__ */ new Map();
+      for (const r of e.records) {
+        if (!r || typeof r.step !== "string" || !r.step.trim() || !Array.isArray(r.findings)) return false;
+        for (const f of r.findings) {
+          if (!f || typeof f.id !== "string" || !f.id || typeof f.source !== "string" || !f.source) return false;
+          latest.set(JSON.stringify([r.step, f.source, f.id]), f.status);
+        }
+      }
+      return [...latest.values()].every((s) => s === "verified");
+    }
+    case "capability":
+      return e.inventoryObserved === true && Array.isArray(e.required) && e.required.length > 0 && Array.isArray(e.available) && e.required.every((t) => typeof t === "string" && e.available.includes(t)) && e.backendQualified === true;
+    case "report":
+      return e.protocol === "saved-full-report-and-five-line-summary" && (e.persistence === "available" && e.requestedDelivery === "saved-full-report-and-five-line-summary" && e.reportReference === "required" || e.persistence === "unavailable" && e.requestedDelivery === "blocked-no-invented-report" && e.reportReference === "not-saved");
+    case "cleanup":
+      return typeof e.executionId === "string" && e.executionId.length > 0 && e.state === "settled" && e.receipt?.state === "settled" && e.receipt.executionId === e.executionId && e.receipt.reapedAll === true;
+    default:
+      throw new TypeError("Unknown fixture oracle family");
+  }
+}
+function createLearningFixtures({ recordedAt = "2026-10-08T00:00:00.000Z" } = {}) {
+  const commit = "a".repeat(40), complete = Object.fromEntries(PHASES.map((p) => [p, "complete"]));
+  const families = [
+    { family: "candidate", split: "train", question: "Do the records establish one exact full 40-character lowercase Git candidate shared by candidate, tested and reviewed?", facts: [{ candidate: commit, tested: commit, reviewed: commit }, { candidate: commit, tested: "b".repeat(40), reviewed: commit }, { candidate: commit, tested: commit, reviewed: "c".repeat(40) }, { candidate: "aaaaaaa", tested: "aaaaaaa", reviewed: "aaaaaaa" }] },
+    { family: "phases", split: "train", question: "Do the latest snapshots cover exactly every required step with all five named phases complete? Earlier complete phases cannot fill later omissions.", facts: [{ required: ["step-1"], records: [{ step: "step-1", phases: complete }] }, { required: ["step-1", "step-2"], records: [{ step: "step-1", phases: complete }] }, { required: ["step-1"], records: [{ step: "step-1", phases: complete }, { step: "step-extra", phases: complete }] }, { required: ["step-1"], records: [{ step: "step-1", phases: complete }, { step: "step-1", phases: { ...complete, verified: "unknown" } }] }] },
+    { family: "findings", split: "train", question: "Does the observed finding history establish that every finding identity (step, source, id) has an explicit latest verified disposition? Omission never clears an earlier finding.", facts: [{ historyObserved: true, records: [{ step: "step-1", findings: [] }] }, { historyObserved: true, records: [{ step: "step-1", findings: [{ id: "f1", source: "report-a", status: "open" }] }, { step: "step-1", findings: [{ id: "f1", source: "report-a", status: "verified" }] }] }, { historyObserved: true, records: [{ step: "step-1", findings: [{ id: "f1", source: "report-a", status: "open" }] }, { step: "step-1", findings: [] }] }, { historyObserved: true, records: [{ step: "step-1", findings: [{ id: "f1", source: "report-a", status: "open" }] }, { step: "step-1", findings: [{ id: "f1", source: "report-b", status: "verified" }] }] }] },
+    { family: "capability", split: "validation", question: "Does the observed inventory establish every explicitly required tool and a qualified backend? Missing or unobserved capability evidence does not establish availability.", facts: [{ inventoryObserved: true, required: ["read", "grep", "find", "ls"], available: ["read", "grep", "find", "ls"], backendQualified: true }, { inventoryObserved: true, required: ["read", "grep", "find", "ls"], available: ["read", "bash"], backendQualified: true }, { inventoryObserved: true, required: ["read"], available: ["read"], backendQualified: false }, { inventoryObserved: false, required: ["read"], available: ["read"], backendQualified: true }] },
+    { family: "report", split: "test", question: "Does this structured requested delivery comply with the selected saved-full-report/five-line-summary protocol, including its explicit unavailable-persistence blocked exception?", facts: [{ protocol: "saved-full-report-and-five-line-summary", persistence: "available", requestedDelivery: "saved-full-report-and-five-line-summary", reportReference: "required" }, { protocol: "saved-full-report-and-five-line-summary", persistence: "available", requestedDelivery: "complete-report-only-in-final", reportReference: "forbidden" }, { protocol: "saved-full-report-and-five-line-summary", persistence: "available", requestedDelivery: "saved-full-report-and-five-line-summary", reportReference: "omitted" }, { protocol: "saved-full-report-and-five-line-summary", persistence: "unavailable", requestedDelivery: "blocked-no-invented-report", reportReference: "not-saved" }] },
+    { family: "cleanup", split: "test", question: "Do these records establish settled cleanup with a matching execution identity and reapedAll true? This does not establish task success or approval.", facts: [{ executionId: "exec:one", state: "settled", receipt: { state: "settled", executionId: "exec:one", reapedAll: true } }, { executionId: "exec:one", state: "settled", receipt: null }, { executionId: "exec:one", state: "settled", receipt: { state: "settled", executionId: "exec:other", reapedAll: true } }, { executionId: "exec:one", state: "settled", receipt: { state: "settled", executionId: "exec:one", reapedAll: false } }] }
+  ];
+  const caseDocument = { schema: 1, cases: families.flatMap((f) => f.facts.map((facts, i) => {
+    const input = JSON.stringify(facts);
+    return { id: `fixture-${f.family}-${i + 1}`, input, question: f.question, provenance: "synthetic", source: { sha256: learningDigest(input), recordId: `${FIXTURE_ORACLE_VERSION}/${f.family}/${i + 1}` }, visibility: "public" };
+  })) };
+  const cases = parseCases(caseDocument), receipts = [], labels = [], entries = [];
+  for (const c of cases) {
+    const family = c.id.split("-")[1], f = families.find((f2) => f2.family === family);
+    const value = evaluateFixture(family, JSON.parse(c.input));
+    const receipt = { schema: 1, kind: "independent-decision-label", caseId: c.id, caseHash: c.hash, source: c.source, value, labelKind: "test", actor: FIXTURE_ORACLE_VERSION, independent: true, recordedAt, method: { kind: "deterministic-test", id: family, version: FIXTURE_ORACLE_VERSION + ":" + learningDigest(evaluateFixture.toString()) } };
+    const bytes = JSON.stringify(receipt, null, 2) + "\n";
+    receipts.push({ caseId: c.id, filename: c.id + "-label.json", bytes, sha256: learningDigest(bytes) });
+    labels.push({ caseId: c.id, caseHash: c.hash, value, kind: "test", actor: receipt.actor, evidenceSha256: learningDigest(bytes), independent: true });
+    entries.push({ caseId: c.id, caseHash: c.hash, taskGroup: "fixture-family-" + family, lineageGroup: "fixture-family-" + family, split: f.split, sessionId: null, fixtureOnly: true, decisionTimeReviewed: true, redactionReviewed: true, rights: "local-export", exportApproved: true, trainingApproved: false, reviewer: "prospective-synthetic-fixture-rule" });
+  }
+  const labelDocument = { schema: 1, labels };
+  parseLabels(labelDocument, cases);
+  const manifest = parseExperiment(cases, { schema: 1, kind: "decision-learning-experiment", id: "mechanical-fixtures-24-v1", frozenAt: recordedAt, entries });
+  return { caseDocument, labelDocument, manifest, labelReceipts: receipts, fixtureOnly: true, trainingEligible: false, scope: "24 synthetic mechanical plumbing cases; no observed examples or model-quality claims." };
+}
+
+// experiments/decision-shadow/research.mjs
+import { createHash as createHash3, randomUUID } from "node:crypto";
+import { open as open2, readFile } from "node:fs/promises";
+import { DECISION_SYSTEM_PROMPT } from "@skill-harness/adapters";
+var PROMPT_REVISION = "decision-input-question-v1";
+var decisionPrompt = (c) => JSON.stringify({ input: c.input, question: c.question });
+var fullCaseSetHash = (cases) => learningDigest(cases.map((c) => ({ id: c.id, hash: c.hash })));
+var hash = (s) => createHash3("sha256").update(s).digest("hex");
+function check2(ok, message) {
+  if (!ok) throw TypeError(message);
+}
+function keys2(value, names, name) {
+  check2(
+    value && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === [...names].sort().join("|"),
+    name + " has unsupported/missing fields"
+  );
+}
+function sha3(value) {
+  check2(
+    typeof value === "string" && /^[0-9a-f]{64}$/.test(value),
+    "invalid digest"
+  );
+}
+function selected(cases, manifest, split) {
+  check2(
+    ["train", "validation", "test", "all"].includes(split),
+    "explicit train/validation/test/all split required"
+  );
+  return cases.filter(
+    (c, i) => split === "all" || manifest.entries[i].split === split
+  );
+}
+function previewPi(cases, manifest, { model, thinking, split }) {
+  manifest = parseExperiment(cases, manifest);
+  check2(
+    /^openai-codex:[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(model),
+    "explicit subscription model required"
+  );
+  check2(
+    ["off", "minimal", "low", "medium", "high", "xhigh"].includes(thinking),
+    "explicit thinking level required"
+  );
+  const subset = selected(cases, manifest, split);
+  check2(subset.length > 0, "selected split is empty");
+  return {
+    schema: 1,
+    kind: "decision-pi-preview",
+    model,
+    thinking,
+    split,
+    experimentHash: learningDigest(manifest),
+    caseSetHash: fullCaseSetHash(cases),
+    promptRevision: PROMPT_REVISION,
+    trainingEligible: false,
+    requests: subset.map((c) => ({
+      caseId: c.id,
+      caseHash: c.hash,
+      prompt: decisionPrompt(c),
+      promptSha256: hash(decisionPrompt(c))
+    }))
+  };
+}
+async function runPiBaseline({
+  cases,
+  manifest,
+  model,
+  thinking,
+  split,
+  piPackage,
+  nodeExecutable,
+  authPath,
+  out,
+  timeoutMs,
+  runner,
+  emit = () => {
+  }
+}) {
+  const preview = previewPi(cases, manifest, { model, thinking, split });
+  const adapter = await import("@skill-harness/adapters");
+  const call = runner ?? adapter.runPiDecision;
+  const header = {
+    schema: 2,
+    kind: "decision-pi-run",
+    runId: randomUUID(),
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    caseSetHash: preview.caseSetHash,
+    experimentHash: preview.experimentHash,
+    requestedModel: model,
+    thinking,
+    split,
+    selected: preview.requests.map((r) => ({
+      caseId: r.caseId,
+      caseHash: r.caseHash
+    })),
+    promptRevision: PROMPT_REVISION,
+    systemPromptSha256: hash(adapter.DECISION_SYSTEM_PROMPT),
+    trainingEligible: false
+  };
+  const file = await open2(out, "wx", 384);
+  const append = async (row) => {
+    await file.writeFile(JSON.stringify(row) + "\n");
+    await file.sync();
+  };
+  let failed = false;
+  try {
+    await append(header);
+    for (const request of preview.requests) {
+      let result;
+      try {
+        result = await call({
+          piPackage,
+          model,
+          thinking,
+          nodeExecutable,
+          authPath,
+          prompt: request.prompt,
+          caseId: request.caseId,
+          timeoutMs
+        });
+      } catch {
+        result = {
+          status: "error",
+          probability: null,
+          error: "Pi decision failed; no retry or fallback."
+        };
+        failed = true;
+      }
+      await append({
+        kind: "prediction",
+        caseId: request.caseId,
+        caseHash: request.caseHash,
+        promptSha256: request.promptSha256,
+        ...result,
+        trainingEligible: false
+      });
+      emit({ caseId: request.caseId, status: result.status });
+      if (failed) break;
+    }
+  } finally {
+    await file.close();
+  }
+  if (failed)
+    throw Error(
+      "Pi comparison stopped after an error; partial run retained without retry."
+    );
+  return header;
+}
+function parsePiRun(text2, cases, manifest) {
+  manifest = parseExperiment(cases, manifest);
+  let rows;
+  try {
+    rows = text2.trim().split("\n").map((line) => JSON.parse(line));
+  } catch {
+    throw Error("Invalid Pi run JSONL");
+  }
+  const [header, ...records] = rows;
+  keys2(
+    header,
+    [
+      "schema",
+      "kind",
+      "runId",
+      "createdAt",
+      "caseSetHash",
+      "experimentHash",
+      "requestedModel",
+      "thinking",
+      "split",
+      "selected",
+      "promptRevision",
+      "systemPromptSha256",
+      "trainingEligible"
+    ],
+    "Pi run header"
+  );
+  check2(
+    header.schema === 2 && header.kind === "decision-pi-run" && header.trainingEligible === false,
+    "unsupported Pi run"
+  );
+  check2(
+    /^[0-9a-f-]{36}$/.test(header.runId) && new Date(header.createdAt).toISOString() === header.createdAt,
+    "invalid run identity/time"
+  );
+  const preview = previewPi(cases, manifest, {
+    model: header.requestedModel,
+    thinking: header.thinking,
+    split: header.split
+  });
+  check2(
+    header.caseSetHash === preview.caseSetHash && header.experimentHash === preview.experimentHash && header.promptRevision === PROMPT_REVISION && learningDigest(header.selected) === learningDigest(
+      preview.requests.map((r) => ({
+        caseId: r.caseId,
+        caseHash: r.caseHash
+      }))
+    ),
+    "Pi run belongs to a different experiment/selection"
+  );
+  check2(
+    header.systemPromptSha256 === hash(DECISION_SYSTEM_PROMPT),
+    "Pi system prompt revision mismatch"
+  );
+  check2(records.length <= preview.requests.length, "too many Pi predictions");
+  let worker = null;
+  const sessions = /* @__PURE__ */ new Set();
+  for (const [i, r] of records.entries()) {
+    const expected = preview.requests[i];
+    check2(
+      r.caseId === expected.caseId && r.caseHash === expected.caseHash && r.promptSha256 === expected.promptSha256 && r.kind === "prediction" && r.trainingEligible === false,
+      "Pi prediction identity/order mismatch"
+    );
+    if (r.status === "error") {
+      keys2(
+        r,
+        [
+          "kind",
+          "caseId",
+          "caseHash",
+          "promptSha256",
+          "status",
+          "probability",
+          "error",
+          "trainingEligible"
+        ],
+        "Pi error"
+      );
+      check2(
+        r.probability === null && r.error === "Pi decision failed; no retry or fallback." && i === records.length - 1,
+        "invalid Pi error prefix"
+      );
+      continue;
+    }
+    keys2(
+      r,
+      [
+        "kind",
+        "caseId",
+        "caseHash",
+        "promptSha256",
+        "status",
+        "probability",
+        "resolvedModel",
+        "piVersion",
+        "nativeFinal",
+        "usage",
+        "route",
+        "trainingEligible",
+        "latencyMs",
+        "workerSha256",
+        "systemPromptSha256"
+      ],
+      "Pi prediction"
+    );
+    check2(
+      ["answered", "abstained"].includes(r.status) && r.resolvedModel === header.requestedModel && r.piVersion === "1.0.4" && r.systemPromptSha256 === header.systemPromptSha256,
+      "Pi result route/version mismatch"
+    );
+    check2(
+      r.status === "abstained" ? r.probability === null : typeof r.probability === "number" && Number.isFinite(r.probability) && r.probability >= 0 && r.probability <= 1,
+      "invalid Pi probability"
+    );
+    keys2(r.nativeFinal, ["sessionId", "messageId", "sha256"], "native final");
+    for (const k of ["sessionId", "messageId"])
+      check2(
+        typeof r.nativeFinal[k] === "string" && r.nativeFinal[k].length > 0 && r.nativeFinal[k].length <= 256,
+        "invalid native identity"
+      );
+    sha3(r.nativeFinal.sha256);
+    check2(
+      !sessions.has(r.nativeFinal.sessionId),
+      "Pi cases must have independent fresh sessions"
+    );
+    sessions.add(r.nativeFinal.sessionId);
+    keys2(r.route, ["oauth", "subscription"], "route");
+    check2(
+      r.route.oauth === true && r.route.subscription === true,
+      "non-subscription Pi result"
+    );
+    keys2(r.usage, ["inputTokens", "outputTokens", "costUsd"], "usage");
+    check2(r.usage.costUsd === null, "subscription cost must not be estimated");
+    for (const k of ["inputTokens", "outputTokens"])
+      check2(
+        r.usage[k] === null || Number.isSafeInteger(r.usage[k]) && r.usage[k] >= 0,
+        "invalid Pi usage"
+      );
+    check2(Number.isFinite(r.latencyMs) && r.latencyMs >= 0, "invalid latency");
+    sha3(r.workerSha256);
+    if (worker !== null)
+      check2(worker === r.workerSha256, "mixed worker revisions");
+    worker = r.workerSha256;
+  }
+  return {
+    header,
+    records,
+    runSha256: hash(text2),
+    cases: preview.requests.map((r) => cases.find((c) => c.id === r.caseId)),
+    experimentBound: true
+  };
+}
+function metrics(cases, labels, records) {
+  const normalized = records.map((r) => ({
+    caseId: r.caseId,
+    caseHash: r.caseHash,
+    status: r.status === "abstained" ? "refused" : r.status,
+    probability: r.probability
+  }));
+  const score = scorePredictions(cases, labels, normalized);
+  const bins = Array.from({ length: 5 }, (_, i) => ({
+    lower: i / 5,
+    upper: (i + 1) / 5,
+    count: 0,
+    meanProbability: null,
+    observedPositiveFraction: null
+  }));
+  for (const r of records) {
+    const label = labels.find((l) => l.caseId === r.caseId);
+    if (r.status !== "answered" || !label) continue;
+    const bin = bins[Math.min(4, Math.floor(r.probability * 5))];
+    bin.count++;
+    bin.meanProbability = (bin.meanProbability ?? 0) + (r.probability - (bin.meanProbability ?? 0)) / bin.count;
+    bin.observedPositiveFraction = (bin.observedPositiveFraction ?? 0) + (Number(label.value) - (bin.observedPositiveFraction ?? 0)) / bin.count;
+  }
+  const latency = records.filter((r) => Number.isFinite(r.latencyMs));
+  let mean = null;
+  latency.forEach((r, i) => {
+    mean = (mean ?? 0) + (r.latencyMs - (mean ?? 0)) / (i + 1);
+  });
+  return {
+    ...score,
+    abstained: records.filter((r) => r.status === "abstained").length,
+    calibration: bins,
+    latencyMs: { reported: latency.length, attempted: records.length, mean },
+    errorCases: records.filter((r) => r.status === "error").map((r) => r.caseId),
+    falsePositiveCases: records.filter(
+      (r) => r.status === "answered" && r.probability >= 0.5 && labels.some((l) => l.caseId === r.caseId && !l.value)
+    ).map((r) => r.caseId),
+    falseNegativeCases: records.filter(
+      (r) => r.status === "answered" && r.probability < 0.5 && labels.some((l) => l.caseId === r.caseId && l.value)
+    ).map((r) => r.caseId)
+  };
+}
+function compareRuns(cases, labels, manifest, runs) {
+  manifest = parseExperiment(cases, manifest);
+  check2(
+    Array.isArray(runs) && runs.length >= 1 && runs.length <= 8,
+    "compare 1..8 explicit runs"
+  );
+  check2(
+    new Set(runs.map((r) => r.runSha256)).size === runs.length,
+    "duplicate run files"
+  );
+  const answered = runs.map(
+    (run) => new Set(
+      run.records.filter((r) => r.status === "answered").map((r) => r.caseId)
+    )
+  );
+  const common = cases.filter(
+    (c) => labels.some((l) => l.caseId === c.id) && answered.every((set) => set.has(c.id))
+  );
+  const arms = runs.map((run) => {
+    const observedModels = [
+      ...new Set(
+        run.records.filter((r) => r.status === "answered" || r.status === "abstained").map((r) => r.resolvedModel)
+      )
+    ];
+    check2(
+      observedModels.length <= 1,
+      "mixed resolved models in one comparison arm"
+    );
+    const selectedCases = run.cases ?? cases;
+    const selectedIds = new Set(selectedCases.map((c) => c.id));
+    const armLabels = labels.filter((l) => selectedIds.has(l.caseId));
+    return {
+      runSha256: run.runSha256,
+      runId: run.header.runId ?? null,
+      model: run.header.requestedModel,
+      observedModels,
+      createdAt: run.header.createdAt,
+      thinking: run.header.thinking ?? null,
+      split: run.header.split ?? null,
+      promptRevision: run.header.promptRevision ?? null,
+      systemPromptSha256: run.header.systemPromptSha256 ?? null,
+      workerSha256: run.records.find((r) => r.workerSha256)?.workerSha256 ?? null,
+      experimentBound: run.experimentBound === true,
+      selection: metrics(selectedCases, armLabels, run.records),
+      common: metrics(
+        common,
+        labels.filter((l) => common.some((c) => c.id === l.caseId)),
+        run.records.filter((r) => common.some((c) => c.id === r.caseId))
+      )
+    };
+  });
+  return {
+    schema: 1,
+    kind: "decision-comparison",
+    caseSetHash: fullCaseSetHash(cases),
+    experimentHash: learningDigest(manifest),
+    labelSetHash: learningDigest(labels),
+    threshold: 0.5,
+    thresholdSelection: "fixed-before-run",
+    commonLabeledAnswered: common.length,
+    commonCaseIds: common.map((c) => c.id),
+    arms,
+    polarity: "false positive means the recorded question was answered true for a false independent label; it means false-ready only for a question whose true polarity is readiness",
+    population: {
+      cases: cases.length,
+      groups: new Set(manifest.entries.map((e) => e.taskGroup)).size,
+      synthetic: cases.filter((c) => c.provenance === "synthetic").length,
+      observed: cases.filter((c) => c.provenance === "observed").length
+    },
+    qualification: "descriptive comparison only; no runtime qualification or speed improvement claim",
+    trainingReady: false
+  };
+}
+
+// experiments/decision-shadow/research-commands.mjs
+var RESEARCH_OPTIONS = {
+  "validate-experiment": ["cases", "experiment"],
+  "preview-pi": ["cases", "experiment", "model", "thinking", "split"],
+  "run-pi": [
+    "cases",
+    "experiment",
+    "model",
+    "thinking",
+    "split",
+    "pi-package",
+    "out",
+    "allow-subscription"
+  ],
+  compare: ["cases", "experiment", "labels", "label-evidence", "run", "out"],
+  "export-learning": [
+    "cases",
+    "experiment",
+    "labels",
+    "label-evidence",
+    "consents",
+    "mode",
+    "out"
+  ],
+  "import-session": ["cases", "selection", "consent", "entry", "out"],
+  fixtures: ["out"]
+};
+var RESEARCH_OPTIONAL = {
+  "run-pi": ["pi-node", "auth-path", "timeout-ms"]
+};
+async function researchCommand(command, flags, helpers, options) {
+  const { cases, jsonFile: jsonFile2, textFile: textFile2, writeNew: writeNew2, readLegacyRun } = helpers;
+  const { emit = console.log, piRunner } = options;
+  if (command === "fixtures") {
+    const f = createLearningFixtures({});
+    const dir = resolve(flags.out);
+    await mkdir2(dir, { mode: 448 });
+    const refs = [];
+    for (const r of f.labelReceipts) {
+      const path = join2(dir, r.filename);
+      await writeFile2(path, r.bytes, { flag: "wx", mode: 384 });
+      refs.push({ caseId: r.caseId, path, sha256: r.sha256 });
+    }
+    for (const [name, value] of Object.entries({
+      "cases.json": f.caseDocument,
+      "labels.json": f.labelDocument,
+      "experiment.json": f.manifest,
+      "label-evidence.json": refs,
+      "consents.json": []
+    }))
+      await writeNew2(join2(dir, name), value);
+    emit(
+      JSON.stringify({
+        saved: dir,
+        cases: f.caseDocument.cases.length,
+        fixtureOnly: true,
+        trainingEligible: false
+      })
+    );
+    return;
+  }
+  if (command === "import-session") {
+    const result = await importSelectedCase({
+      caseDocument: await jsonFile2(flags.cases),
+      selection: await jsonFile2(flags.selection),
+      sessionConsent: await jsonFile2(flags.consent),
+      experimentEntry: await jsonFile2(flags.entry)
+    });
+    await writeNew2(flags.out, result);
+    emit(JSON.stringify({ saved: resolve(flags.out), trainingReady: false }));
+    return;
+  }
+  const manifest = parseExperiment(cases, await jsonFile2(flags.experiment));
+  if (command === "validate-experiment") {
+    emit(
+      JSON.stringify({
+        valid: true,
+        cases: cases.length,
+        groups: new Set(manifest.entries.map((e) => e.taskGroup)).size,
+        trainingReady: false
+      })
+    );
+    return;
+  }
+  if (command === "preview-pi") {
+    emit(
+      JSON.stringify(
+        previewPi(cases, manifest, {
+          model: flags.model,
+          thinking: flags.thinking,
+          split: flags.split
+        }),
+        null,
+        2
+      )
+    );
+    return;
+  }
+  if (command === "run-pi") {
+    const header = await runPiBaseline({
+      cases,
+      manifest,
+      model: flags.model,
+      thinking: flags.thinking,
+      split: flags.split,
+      piPackage: flags["pi-package"],
+      nodeExecutable: flags["pi-node"],
+      authPath: flags["auth-path"],
+      timeoutMs: flags["timeout-ms"] === void 0 ? void 0 : Number(flags["timeout-ms"]),
+      out: flags.out,
+      runner: piRunner
+    });
+    emit(
+      JSON.stringify({
+        saved: resolve(flags.out),
+        runId: header.runId,
+        trainingEligible: false
+      })
+    );
+    return;
+  }
+  const labels = parseLabels(await jsonFile2(flags.labels), cases);
+  const labelEvidence = await jsonFile2(flags["label-evidence"]);
+  if (command === "export-learning") {
+    const prepared = await prepareExport({
+      cases,
+      labels,
+      manifest,
+      consents: await jsonFile2(flags.consents),
+      labelEvidence,
+      mode: flags.mode
+    });
+    const result = await writePreparedExport({
+      prepared,
+      directory: resolve(flags.out)
+    });
+    emit(JSON.stringify(result));
+    return;
+  }
+  if (command === "compare") {
+    const evidence = await reviewLabelEvidence({
+      cases,
+      labels,
+      references: labelEvidence
+    });
+    const runs = [];
+    for (const path of flags.run) {
+      const text2 = await textFile2(path);
+      let first;
+      try {
+        first = JSON.parse(text2.split("\n")[0]);
+      } catch {
+        throw Error("Invalid run header");
+      }
+      if (first.kind === "decision-pi-run")
+        runs.push(parsePiRun(text2, cases, manifest));
+      else
+        runs.push({
+          ...await readLegacyRun(path, cases),
+          cases,
+          experimentBound: false
+        });
+    }
+    const report = compareRuns(cases, labels, manifest, runs);
+    report.labelEvidenceReview = evidence;
+    await writeNew2(flags.out, report);
+    emit(
+      JSON.stringify({
+        saved: resolve(flags.out),
+        commonLabeledAnswered: report.commonLabeledAnswered,
+        trainingReady: false
+      })
+    );
+    return;
+  }
+  throw Error("Unhandled research command");
+}
+
+// experiments/decision-shadow/consent.mjs
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { createInterface } from "node:readline/promises";
+import { stdin, stderr } from "node:process";
+import { openSync, writeFileSync, fsyncSync, closeSync } from "node:fs";
+var STORAGE_QUESTION = "Retain this session\u2019s explicitly selected inputs and questions for future LoRA dataset review? This grants storage only, not training or use of JEV predictions as labels.";
+async function requestSessionStorage({
+  sessionId = randomUUID2(),
+  storage,
+  promptStorage
+} = {}) {
+  let answer = storage;
+  if (answer === void 0) {
+    if (promptStorage) answer = await promptStorage(STORAGE_QUESTION);
+    else {
+      if (!stdin.isTTY || !stderr.isTTY)
+        throw Error(
+          "JEV activation requires this session\u2019s storage choice: --storage yes|no (no inherited preference)."
+        );
+      const rl = createInterface({ input: stdin, output: stderr });
+      try {
+        answer = /^(y|yes)$/i.test(
+          (await rl.question(STORAGE_QUESTION + " [y/N] ")).trim()
+        ) ? "yes" : "no";
+      } finally {
+        rl.close();
+      }
+    }
+  }
+  if (answer === true) answer = "yes";
+  if (answer === false || answer === null) answer = "no";
+  if (!["yes", "no"].includes(answer))
+    throw Error("--storage must be yes or no");
+  return createStorageConsent({
+    sessionId,
+    decision: answer === "yes" ? "granted" : "declined",
+    interactionId: randomUUID2(),
+    recordedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+}
+async function retainSelectedSessionData({
+  cases,
+  consent,
+  out,
+  assertCurrent = () => {
+  }
+}) {
+  consent = parseStorageConsent(consent, consent.sessionId);
+  if (consent.decision === "declined")
+    return {
+      retained: false,
+      reason: "session-storage-declined",
+      trainingReady: false
+    };
+  const document = {
+    schema: 1,
+    kind: "decision-session-selected-data",
+    sessionId: consent.sessionId,
+    consent,
+    consentSha256: learningDigest(consent),
+    trainingReady: false,
+    trainingEligible: false,
+    labelStatus: "unlabeled",
+    providerOutputsIncluded: false,
+    cases: cases.map(({ hash: hash3, ...c }) => ({ caseHash: hash3, ...c }))
+  };
+  assertCurrent();
+  const fd = openSync(out, "wx", 384);
+  try {
+    writeFileSync(fd, JSON.stringify(document, null, 2) + "\n");
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+  return { retained: true, path: out, trainingReady: false };
+}
+
+// experiments/decision-shadow/providers.mjs
+var MAX_RESPONSE_BYTES = 64 * 1024;
+var MAX_INPUT_LENGTH = 64 * 1024;
+var MAX_QUESTION_LENGTH = 8 * 1024;
+var PROVIDER = Object.freeze({
+  name: "jev",
+  model: "typesafe/jev-1.13",
+  url: "https://openrouter.ai/api/alpha/decisions"
+});
+var emptyUsage = () => ({ inputTokens: null, outputTokens: null, costUsd: null });
+function requiredString(value, name, maxLength) {
+  if (typeof value !== "string" || value.length === 0 || value.length > maxLength) {
+    throw new TypeError(`${name} must be a non-empty bounded string`);
+  }
+}
+function validateSelection(provider, model) {
+  if (provider !== PROVIDER.name) throw new TypeError("unsupported provider");
+  if (model !== PROVIDER.model) throw new TypeError("unsupported model");
+}
+function makeRequest(provider, model, example) {
+  validateSelection(provider, model);
+  if (!example || typeof example !== "object" || Array.isArray(example)) {
+    throw new TypeError("example must be an object");
+  }
+  requiredString(example.input, "input", MAX_INPUT_LENGTH);
+  requiredString(example.question, "question", MAX_QUESTION_LENGTH);
+  return {
+    url: PROVIDER.url,
+    body: {
+      model,
+      state: example.input,
+      questions: { decision: { type: "noul", instructions: example.question } }
+    }
+  };
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function probability(value) {
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0 || value > 1) {
+    throw new Error("invalid provider response");
+  }
+  return value;
+}
+function tokenCount(value) {
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new Error("invalid provider response");
+  }
+  return value;
+}
+function cost(value) {
+  if (value === void 0 || value === null) return null;
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+    throw new Error("invalid provider response");
+  }
+  return value;
+}
+function isSupportedResolvedModel(value) {
+  if (value === PROVIDER.model) return true;
+  const prefix = `${PROVIDER.model}-`;
+  if (typeof value !== "string" || !value.startsWith(prefix)) return false;
+  const snapshot = value.slice(prefix.length);
+  if (snapshot.length !== 8 || !/^\d{8}$/.test(snapshot)) return false;
+  const year = Number(snapshot.slice(0, 4));
+  const month = Number(snapshot.slice(4, 6));
+  const day = Number(snapshot.slice(6, 8));
+  const leapYear = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+  const monthLengths = [31, leapYear ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+  return year > 0 && month >= 1 && month <= 12 && day >= 1 && day <= monthLengths[month - 1];
+}
+function resolvedModel(value) {
+  if (!isSupportedResolvedModel(value)) {
+    throw new Error("invalid provider response");
+  }
+  return value;
+}
+function normalize2(payload) {
+  if (!isRecord(payload) || !isRecord(payload.answers) || Object.keys(payload.answers).length !== 1 || !isRecord(payload.usage)) {
+    throw new Error("invalid provider response");
+  }
+  const answer = payload.answers.decision;
+  if (!isRecord(answer) || answer.type !== "noul") {
+    throw new Error("invalid provider response");
+  }
+  return {
+    status: "answered",
+    probability: probability(answer.noul),
+    resolvedModel: resolvedModel(payload.model),
+    usage: {
+      inputTokens: tokenCount(payload.usage.input_tokens),
+      outputTokens: tokenCount(payload.usage.output_tokens),
+      costUsd: cost(payload.usage.cost)
+    },
+    error: null
+  };
+}
+function deadline(signal) {
+  return new Promise((_, reject) => {
+    if (signal.aborted) return reject(new Error("provider request timed out"));
+    signal.addEventListener("abort", () => reject(new Error("provider request timed out")), { once: true });
+  });
+}
+async function readBounded(response, timedOut) {
+  if (!response.body || typeof response.body.getReader !== "function") {
+    throw new Error("invalid provider response");
+  }
+  const reader = response.body.getReader();
+  const chunks = [];
+  let length = 0;
+  let complete = false;
+  try {
+    for (; ; ) {
+      const { done, value } = await Promise.race([reader.read(), timedOut]);
+      if (done) {
+        complete = true;
+        break;
+      }
+      if (!(value instanceof Uint8Array)) throw new Error("invalid provider response");
+      length += value.byteLength;
+      if (length > MAX_RESPONSE_BYTES) throw new Error("provider response exceeded limit");
+      chunks.push(value);
+    }
+  } finally {
+    if (!complete) void reader.cancel().catch(() => {
+    });
+  }
+  const bytes = new Uint8Array(length);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+}
+function failure(startedAt, error) {
+  const publicErrors = ["invalid provider response", "provider request timed out", "provider response exceeded limit"];
+  const message = error instanceof Error && publicErrors.includes(error.message) ? error.message : "provider request failed";
+  return {
+    status: "error",
+    probability: null,
+    resolvedModel: null,
+    usage: emptyUsage(),
+    latencyMs: Math.max(0, performance.now() - startedAt),
+    error: message
+  };
+}
+async function callProvider(provider, model, example, options = {}) {
+  const startedAt = performance.now();
+  let controller;
+  let timer;
+  try {
+    const request = makeRequest(provider, model, example);
+    requiredString(options.apiKey, "apiKey", 16 * 1024);
+    if (options.fetchImpl !== void 0 && typeof options.fetchImpl !== "function") {
+      throw new TypeError("fetchImpl must be a function");
+    }
+    const timeoutMs = options.timeoutMs ?? 3e4;
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 3e5) {
+      throw new TypeError("invalid timeout");
+    }
+    controller = new AbortController();
+    timer = setTimeout(() => controller.abort(), timeoutMs);
+    const timedOut = deadline(controller.signal);
+    const response = await Promise.race([
+      (options.fetchImpl ?? fetch)(request.url, {
+        method: "POST",
+        headers: { authorization: `Bearer ${options.apiKey}`, "content-type": "application/json" },
+        body: JSON.stringify(request.body),
+        redirect: "error",
+        signal: controller.signal
+      }),
+      timedOut
+    ]);
+    if (!response || response.ok !== true) throw new Error("provider request failed");
+    const text2 = await readBounded(response, timedOut);
+    let payload;
+    try {
+      payload = JSON.parse(text2);
+    } catch {
+      throw new Error("invalid provider response");
+    }
+    return { ...normalize2(payload), latencyMs: Math.max(0, performance.now() - startedAt) };
+  } catch (error) {
+    return failure(startedAt, error);
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+    controller?.abort();
+  }
+}
+
+// experiments/decision-shadow/public-evidence.mjs
+import { constants as constants2 } from "node:fs";
+import { open as open3 } from "node:fs/promises";
+import { createHash as createHash4 } from "node:crypto";
+import { isDeepStrictEqual } from "node:util";
+import { basename, dirname, isAbsolute as isAbsolute2, join as join3, normalize as normalize3 } from "node:path";
+var MAX_PUBLIC_SOURCE_FILE_BYTES = 64 * 1024 * 1024;
+var MAX_PUBLIC_SOURCE_TOTAL_BYTES = 128 * 1024 * 1024;
+var MAX_PUBLIC_SOURCE_FILES = 256;
+var MAX_PUBLIC_SOURCE_MANIFEST_BYTES = 1024 * 1024;
+var LIMITS = Object.freeze({
+  fileBytes: MAX_PUBLIC_SOURCE_FILE_BYTES,
+  totalBytes: MAX_PUBLIC_SOURCE_TOTAL_BYTES,
+  files: MAX_PUBLIC_SOURCE_FILES,
+  manifestBytes: MAX_PUBLIC_SOURCE_MANIFEST_BYTES
+});
+var HASH = /^[0-9a-f]{64}$/;
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+var TOOLS = ["delegate_describe", "delegate", "delegate_all", "delegate_chain"];
+var RUNTIME_PREFIX = "Runtime execution evidence (process settlement; not workspace cleanup or task acceptance):\n```json\n";
+var DIR_FLAGS = constants2.O_RDONLY | constants2.O_DIRECTORY | constants2.O_NOFOLLOW | constants2.O_NONBLOCK;
+var FILE_FLAGS = constants2.O_RDONLY | constants2.O_NOFOLLOW | constants2.O_NONBLOCK;
+var digest = (bytes) => createHash4("sha256").update(bytes).digest("hex");
+function check3(ok, message) {
+  if (!ok) throw new TypeError(message);
+}
+function object(value, name) {
+  check3(value !== null && typeof value === "object" && !Array.isArray(value), `${name} must be an object`);
+}
+function keys3(value, expected, name) {
+  object(value, name);
+  check3(isDeepStrictEqual(Object.keys(value).sort(), [...expected].sort()), `${name} has unsupported or missing fields`);
+}
+function string(value, name, nullable = false) {
+  if (nullable && value === null) return;
+  check3(typeof value === "string" && value.length > 0 && value.length <= 4096 && !value.includes("\0"), `${name} must be a bounded nonempty string`);
+}
+function publicText(value, name) {
+  check3(typeof value === "string", name + " must be a string");
+}
+function hash2(value, name, nullable = false) {
+  check3(nullable && value === null || typeof value === "string" && HASH.test(value), `${name} must be a lowercase SHA-256`);
+}
+function integer(value, name, min = 0) {
+  check3(Number.isSafeInteger(value) && value >= min, `${name} must be a bounded integer`);
+}
+function enumeration(value, allowed, name) {
+  check3(allowed.includes(value), `${name} has an unsupported value`);
+}
+function array(value, name, max = 64) {
+  check3(Array.isArray(value) && value.length <= max, `${name} must be a bounded array`);
+}
+function canonicalPath(path, name) {
+  string(path, name);
+  check3(isAbsolute2(path) && normalize3(path) === path && (path === "/" || !path.endsWith("/")), `${name} must be canonical and absolute`);
+  check3(path.split("/").length <= 128, `${name} exceeds directory depth limit`);
+}
+function metadata(stat2) {
+  return ["dev", "ino", "mode", "uid", "gid", "size", "mtimeNs", "ctimeNs"].map((key) => stat2[key].toString()).join(":");
+}
+function identity(stat2) {
+  return ["dev", "ino", "mode"].map((key) => stat2[key].toString()).join(":");
+}
+function json2(bytes, name) {
+  try {
+    return JSON.parse(new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes));
+  } catch {
+    throw new TypeError(`${name} must be UTF-8 JSON without a BOM`);
+  }
+}
+var EvidenceReader = class {
+  directories = [];
+  captures = /* @__PURE__ */ new Map();
+  files = /* @__PURE__ */ new Map();
+  totalBytes = 0;
+  constructor(root) {
+    this.root = root;
+  }
+  async directory(parent, component, path, stable = false) {
+    const handle = await open3(parent ? `/proc/self/fd/${parent.handle.fd}/${component}` : "/", DIR_FLAGS);
+    try {
+      const stat2 = await handle.stat({ bigint: true });
+      check3(stat2.isDirectory(), "Evidence path component is not a directory");
+      const record = { handle, parent, component, path, metadata: metadata(stat2), identity: identity(stat2), stable };
+      this.directories.push(record);
+      return record;
+    } catch (error) {
+      await handle.close();
+      throw error;
+    }
+  }
+  async start() {
+    let current = await this.directory(null, "", "/");
+    let path = "";
+    for (const component of this.root.split("/").filter(Boolean)) {
+      path += "/" + component;
+      current = await this.directory(current, component, path);
+    }
+    current.stable = true;
+    this.rootDirectory = current;
+  }
+  async read(path, limit = MAX_PUBLIC_SOURCE_FILE_BYTES) {
+    canonicalPath(path, "Copied evidence path");
+    const capturePath = dirname(path), captureId = basename(capturePath);
+    check3(dirname(capturePath) === this.root && UUID.test(captureId), "Copied evidence must be directly inside a capture directory beneath the evidence root");
+    const cached = this.files.get(path);
+    if (cached) {
+      check3(cached.bytes.length <= limit, "Evidence file exceeds its byte limit");
+      return cached.bytes;
+    }
+    check3(this.files.size < MAX_PUBLIC_SOURCE_FILES, "Evidence file-count limit exceeded");
+    let directory = this.captures.get(captureId);
+    if (!directory) {
+      directory = await this.directory(this.rootDirectory, captureId, capturePath, true);
+      this.captures.set(captureId, directory);
+    }
+    const name = basename(path);
+    const handle = await open3(`/proc/self/fd/${directory.handle.fd}/${name}`, FILE_FLAGS);
+    try {
+      const before = await handle.stat({ bigint: true });
+      check3(before.isFile(), "Evidence must be an ordinary file");
+      check3(before.size <= BigInt(limit), "Evidence file exceeds its byte limit");
+      const size = Number(before.size);
+      check3(this.totalBytes + size <= MAX_PUBLIC_SOURCE_TOTAL_BYTES, "Evidence total-byte limit exceeded");
+      const buffer = Buffer.alloc(size + 1);
+      let length = 0;
+      while (length < buffer.length) {
+        const result = await handle.read(buffer, length, buffer.length - length, length);
+        if (!result.bytesRead) break;
+        length += result.bytesRead;
+      }
+      check3(length === size, "Evidence file changed size while reading");
+      check3(metadata(await handle.stat({ bigint: true })) === metadata(before), "Evidence file metadata changed while reading");
+      const bytes = buffer.subarray(0, length);
+      this.files.set(path, { handle, directory, name, metadata: metadata(before), bytes });
+      this.totalBytes += length;
+      return bytes;
+    } catch (error) {
+      await handle.close();
+      throw error;
+    }
+  }
+  async stable() {
+    for (const directory of this.directories) {
+      const current = await directory.handle.stat({ bigint: true });
+      check3(identity(current) === directory.identity && (!directory.stable || metadata(current) === directory.metadata), "Evidence directory changed during verification");
+      const reopened = await open3(directory.parent ? `/proc/self/fd/${directory.parent.handle.fd}/${directory.component}` : "/", DIR_FLAGS);
+      try {
+        check3(identity(await reopened.stat({ bigint: true })) === directory.identity, "Evidence directory path changed during verification");
+      } finally {
+        await reopened.close();
+      }
+    }
+    for (const file of this.files.values()) {
+      check3(metadata(await file.handle.stat({ bigint: true })) === file.metadata, "Evidence file changed during verification");
+      const reopened = await open3(`/proc/self/fd/${file.directory.handle.fd}/${file.name}`, FILE_FLAGS);
+      try {
+        check3(metadata(await reopened.stat({ bigint: true })) === file.metadata, "Evidence file path changed during verification");
+      } finally {
+        await reopened.close();
+      }
+    }
+  }
+  async close() {
+    await Promise.allSettled([...this.files.values()].map((file) => file.handle.close()));
+    await Promise.allSettled(this.directories.map((directory) => directory.handle.close()));
+  }
+};
+function requestedRow(row, index, tool) {
+  keys3(row, ["ordinal", "agent", "requestedDefinitionId", "definitionId", "executionId"], "Requested row");
+  check3(row.ordinal === index + 1, "Requested ordinals must be a contiguous ordered sequence");
+  string(row.agent, "Requested agent", true);
+  hash2(row.requestedDefinitionId, "Requested definition identity", true);
+  hash2(row.definitionId, "Observed definition identity", true);
+  string(row.executionId, "Execution identity", tool === "delegate_describe");
+  check3(row.definitionId === null || row.agent !== null, "An observed definition must identify its agent");
+  if (tool === "delegate_describe") check3(row.executionId === null && row.requestedDefinitionId === null && row.agent !== null && row.definitionId !== null, "Describe has a definition but no execution/requested definition identity");
+}
+function finalIdentity(final) {
+  keys3(final, ["state", "sessionId", "messageId", "leafId", "sha256"], "Native final");
+  check3(final.state === "complete", "Native final must be complete");
+  for (const key of ["sessionId", "messageId", "leafId"]) string(final[key], "Native final " + key);
+  hash2(final.sha256, "Native final hash");
+}
+function workerIdentity(value, executionId) {
+  keys3(value, ["revision", "executionId", "nonce", "root", "rootDevice", "rootInode", "bootId", "pidNamespace", "helperPid", "helperStartTicks", "helperSha256", "workerPid", "ownershipPath", "receiptPath"], "Cleanup identity");
+  check3(value.revision === 1 && value.executionId === executionId, "Cleanup identity must bind the requested execution");
+  for (const key of ["executionId", "nonce", "root", "rootDevice", "rootInode", "bootId", "pidNamespace", "helperStartTicks", "ownershipPath", "receiptPath"]) string(value[key], "Cleanup identity " + key);
+  integer(value.helperPid, "Helper pid", 1);
+  integer(value.workerPid, "Worker pid");
+  hash2(value.helperSha256, "Helper hash");
+}
+function cleanup(value, executionId) {
+  if (value === null) return;
+  object(value, "Cleanup");
+  if (value.state === "not-started" || value.state === "unknown") {
+    const fields = ["state", "reason"];
+    if (value.state === "unknown" && Object.hasOwn(value, "identity")) fields.push("identity");
+    keys3(value, fields, "Cleanup");
+    publicText(value.reason, "Cleanup reason");
+    if (Object.hasOwn(value, "identity")) workerIdentity(value.identity, executionId);
+    return;
+  }
+  keys3(value, ["state", "identity", "receipt"], "Cleanup");
+  check3(value.state === "settled", "Unsupported cleanup state");
+  workerIdentity(value.identity, executionId);
+  keys3(value.receipt, ["state", "identity", "workerCode", "workerSignal", "reason", "reapedAll"], "Cleanup receipt");
+  check3(value.receipt.state === "settled" && value.receipt.reapedAll === true && isDeepStrictEqual(value.receipt.identity, value.identity), "Cleanup receipt identity or settlement mismatch");
+  if (value.receipt.workerCode !== null) integer(value.receipt.workerCode, "Worker exit code");
+  integer(value.receipt.workerSignal, "Worker signal");
+  enumeration(value.receipt.reason, ["worker-exit", "owner-loss", "cancelled", "helper-signal", "ownership-write-failed", "start-failed"], "Cleanup receipt reason");
+}
+function runtimeOutcome(outcome, index, requested) {
+  keys3(outcome, ["ordinal", "ok", "work", "control", "reason", "exitCode", "timedOut", "aborted", "truncated", "spawnFailed", "final", "cleanup", "observation", "retention"], "Runtime outcome");
+  check3(outcome.ordinal === index + 1, "Runtime ordinals must follow requested order");
+  check3(typeof outcome.ok === "boolean", "Runtime ok must be boolean");
+  enumeration(outcome.work, [null, "succeeded", "failed", "unknown"], "Work state");
+  enumeration(outcome.control, [null, "failed"], "Control state");
+  if (outcome.reason !== null) publicText(outcome.reason, "Runtime reason");
+  if (outcome.exitCode !== null) integer(outcome.exitCode, "Runtime exit code");
+  for (const key of ["timedOut", "aborted", "truncated", "spawnFailed"]) check3(outcome[key] === null || typeof outcome[key] === "boolean", "Runtime flags must be nullable booleans");
+  if (outcome.final !== null) {
+    object(outcome.final, "Runtime final");
+    if (outcome.final.state === "unavailable") {
+      keys3(outcome.final, ["state", "reason"], "Unavailable final");
+      publicText(outcome.final.reason, "Unavailable final reason");
+    } else finalIdentity(outcome.final);
+  }
+  cleanup(outcome.cleanup, requested.executionId);
+  if (outcome.observation !== null) {
+    keys3(outcome.observation, ["state", "reasons"], "Observation");
+    enumeration(outcome.observation.state, ["complete", "incomplete"], "Observation state");
+    array(outcome.observation.reasons, "Observation reasons");
+    for (const reason of outcome.observation.reasons) publicText(reason, "Observation reason");
+  }
+  if (outcome.retention !== null) {
+    keys3(outcome.retention, ["status"], "Retention");
+    enumeration(outcome.retention.status, ["disabled", "pending", "retained", "lost"], "Retention status");
+  }
+}
+function binding(value) {
+  if (value === null) return;
+  keys3(value, ["package", "phase"], "Definition binding");
+  check3(value.package === "principal-pi-skills", "Unsupported definition binding package");
+  string(value.phase, "Definition phase");
+}
+async function capture(reader, reference) {
+  keys3(reference, ["path", "sha256"], "Manifest reference");
+  hash2(reference.sha256, "Manifest hash");
+  const manifestBytes = await reader.read(reference.path, MAX_PUBLIC_SOURCE_MANIFEST_BYTES);
+  check3(digest(manifestBytes) === reference.sha256, "Manifest hash mismatch");
+  const manifest = json2(manifestBytes, "Manifest");
+  keys3(manifest, ["schema", "version", "captureId", "ownerId", "toolCallId", "tool", "state", "response", "requested", "runtimeEvidence", "finals", "definitions"], "Public manifest");
+  check3(manifest.schema === "pi-daddy-public-evidence-v1" && manifest.version === 1 && manifest.state === "returned", "Unsupported public manifest version or state");
+  check3(UUID.test(manifest.captureId) && UUID.test(manifest.ownerId), "Capture/owner identity must be a UUID");
+  string(manifest.toolCallId, "Tool-call identity");
+  enumeration(manifest.tool, TOOLS, "Tool");
+  const directory = join3(reader.root, manifest.captureId);
+  check3(reference.path === join3(directory, "manifest.json"), "Manifest path does not bind its capture identity");
+  const refs = [{ kind: "manifest", ...reference, bytes: manifestBytes.length }];
+  const seen = /* @__PURE__ */ new Set([reference.path]);
+  async function copied(ref, filename, kind) {
+    keys3(ref, ["path", "sha256", "bytes"], "Copied reference");
+    hash2(ref.sha256, "Copied hash");
+    integer(ref.bytes, "Copied byte count");
+    check3(ref.path === join3(directory, filename) && !seen.has(ref.path), "Copied reference path is foreign or reused");
+    seen.add(ref.path);
+    check3(ref.bytes <= MAX_PUBLIC_SOURCE_FILE_BYTES, "Copied reference exceeds file-byte limit");
+    const bytes = await reader.read(ref.path);
+    check3(bytes.length === ref.bytes && digest(bytes) === ref.sha256, "Copied reference byte count or hash mismatch");
+    refs.push({ kind, ...ref });
+    return bytes;
+  }
+  array(manifest.requested, "Requested", 8);
+  check3(manifest.requested.length > 0, "Capture must identify a requested row");
+  if (manifest.tool === "delegate" || manifest.tool === "delegate_describe") check3(manifest.requested.length === 1, "Single tool requires one requested row");
+  manifest.requested.forEach((row, index) => requestedRow(row, index, manifest.tool));
+  const executionIds = manifest.requested.map((row) => row.executionId).filter((value) => value !== null);
+  check3(new Set(executionIds).size === executionIds.length, "Requested execution identities must be unique");
+  const response = json2(await copied(manifest.response, "response.json", "response"), "Public response");
+  keys3(response, ["isError", "content"], "Public response");
+  check3(typeof response.isError === "boolean", "Public isError must be boolean");
+  array(response.content, "Public content", 2);
+  for (const block of response.content) {
+    keys3(block, ["type", "text"], "Public block");
+    check3(block.type === "text" && typeof block.text === "string", "Only public text blocks are supported");
+  }
+  array(manifest.finals, "Final copies", 8);
+  array(manifest.definitions, "Definition copies", 8);
+  let outcomes = [];
+  if (manifest.tool === "delegate_describe") {
+    check3(manifest.runtimeEvidence === null && manifest.finals.length === 0 && response.content.length === 1 && response.isError === false, "Describe capture has no runtime/final outcome");
+  } else {
+    const runtime = manifest.runtimeEvidence;
+    keys3(runtime, ["version", "tool", "requested", "outcomes"], "Runtime evidence");
+    check3(runtime.version === 1 && runtime.tool === manifest.tool && runtime.requested === manifest.requested.length, "Runtime header does not match capture");
+    array(runtime.outcomes, "Runtime outcomes", 8);
+    outcomes = runtime.outcomes;
+    check3(outcomes.length > 0 && outcomes.length <= manifest.requested.length, "Runtime outcome count is invalid");
+    if (manifest.tool !== "delegate_chain") check3(outcomes.length === manifest.requested.length, "Non-chain captures must retain every outcome");
+    outcomes.forEach((outcome, index) => runtimeOutcome(outcome, index, manifest.requested[index]));
+    check3(response.content.length === 2 && response.content[1].text.startsWith(RUNTIME_PREFIX) && response.content[1].text.endsWith("\n```"), "Public response lacks its exact runtime evidence block");
+    const projection = json2(Buffer.from(response.content[1].text.slice(RUNTIME_PREFIX.length, -4)), "Public runtime projection");
+    check3(isDeepStrictEqual(projection, runtime), "Public runtime projection differs from manifest");
+    const failed = outcomes.some((outcome) => !outcome.ok || outcome.control === "failed");
+    if (manifest.tool !== "delegate_chain") check3(response.isError === failed, "Public isError differs from runtime outcome");
+    else if (failed || outcomes.length < manifest.requested.length || outcomes.some((outcome) => outcome.final?.state === "unavailable")) check3(response.isError, "Stopped chain must remain an error response");
+    check3(manifest.finals.length === outcomes.length, "Every returned outcome must retain its final availability");
+  }
+  for (const [index, row] of manifest.finals.entries()) {
+    keys3(row, ["ordinal", "executionId", "final"], "Final copy row");
+    check3(row.ordinal === index + 1 && row.executionId === manifest.requested[index].executionId, "Final copy identity differs from requested execution");
+    const final = outcomes[index].final;
+    if (final?.state !== "complete") {
+      check3(row.final === null, "Unavailable native final cannot have a complete copy");
+      continue;
+    }
+    keys3(row.final, ["state", "sessionId", "messageId", "leafId", "sha256", "content"], "Final copy");
+    const { content, ...identity2 } = row.final;
+    check3(isDeepStrictEqual(identity2, final), "Final copy identity differs from runtime final");
+    const bytes = await copied(content, `outcome-${row.ordinal}-final.txt`, "final");
+    check3(bytes.length > 0 && digest(bytes) === final.sha256, "Final copy differs from native final hash");
+    check3(Buffer.from(response.content[0].text, "utf8").includes(bytes), "Complete final bytes are absent from authored public content");
+  }
+  const expectedDefinitions = manifest.requested.filter((row) => row.definitionId !== null).map((row) => JSON.stringify([row.agent, row.definitionId])).sort();
+  const observedDefinitions = [];
+  for (const [index, definition] of manifest.definitions.entries()) {
+    keys3(definition, ["agent", "definitionId", "sourceHash", "bodySha256", "binding", "resources", "body"], "Definition copy");
+    string(definition.agent, "Definition agent");
+    hash2(definition.definitionId, "Definition identity");
+    hash2(definition.sourceHash, "Definition source hash", true);
+    hash2(definition.bodySha256, "Definition body hash");
+    binding(definition.binding);
+    observedDefinitions.push(JSON.stringify([definition.agent, definition.definitionId]));
+    array(definition.resources, "Definition resources");
+    check3(definition.resources.length > 0, "Definition source resources are missing");
+    for (const [resourceIndex, resource] of definition.resources.entries()) {
+      keys3(resource, ["kind", "path", "copy"], "Definition resource");
+      enumeration(resource.kind, ["selected-skill", "package", "binding-manifest", "delegated-agent"], "Source kind");
+      string(resource.path, "Original source identity");
+      await copied(resource.copy, `definition-${index}-source-${resourceIndex}.bin`, "source-copy");
+    }
+    const body = await copied(definition.body, `definition-${index}-body.txt`, "definition-body");
+    check3(digest(body) === definition.bodySha256, "Definition body copy differs from bodySha256");
+  }
+  check3(isDeepStrictEqual(observedDefinitions.sort(), expectedDefinitions), "Copied definitions differ from observed requested definitions");
+  if (manifest.tool === "delegate_describe") {
+    const described = json2(Buffer.from(response.content[0].text), "Described definition");
+    const definition = manifest.definitions[0];
+    const expected = { version: 1, agent: definition.agent, bodySha256: definition.bodySha256, binding: definition.binding, definitionId: definition.definitionId };
+    if (Object.hasOwn(described, "sourceHash")) expected.sourceHash = definition.sourceHash;
+    else check3(definition.sourceHash === null, "Described source hash is missing");
+    check3(isDeepStrictEqual(described, expected), "Described definition differs from manifest source/body identity");
+  }
+  return { manifest, refs, responseIsError: response.isError, outcomes };
+}
+async function verifySources(cases, selection, evidenceRoot) {
+  check3(process.platform === "linux", "Public source verification requires Linux held-directory-FD reads");
+  canonicalPath(evidenceRoot, "Evidence root");
+  check3(evidenceRoot !== "/", "Evidence root cannot be the filesystem root");
+  array(cases, "Cases", 100);
+  const raw = cases.map((item) => {
+    keys3(item, ["id", "input", "question", "provenance", "source", "visibility", "hash"], "Parsed case");
+    const { hash: ignored, ...original } = item;
+    return original;
+  });
+  const validated = parseCases({ schema: 1, cases: raw });
+  validated.forEach((item, index) => check3(item.hash === cases[index].hash, "Incoming parsed case hash is stale"));
+  keys3(selection, ["schema", "kind", "selections"], "Source selection");
+  check3(selection.schema === 1 && selection.kind === "decision-public-sources", "Unsupported source selection version");
+  array(selection.selections, "Selections", 100);
+  check3(selection.selections.length === validated.length, "Require exactly one ordered selection per case");
+  for (const [index, row] of selection.selections.entries()) {
+    keys3(row, ["caseId", "caseHash", "manifest", "captureId", "toolCallId", "ordinal", "agent", "definitionId", "executionId"], "Source selection row");
+    const item = validated[index];
+    check3(row.caseId === item.id && row.caseHash === item.hash, "Selections must match exact ordered case identities");
+    keys3(row.manifest, ["path", "sha256"], "Manifest selection");
+    hash2(row.manifest.sha256, "Selected manifest hash");
+    check3(item.source.sha256 === row.manifest.sha256 && item.source.recordId === row.toolCallId, "Case source must bind the manifest hash and tool-call identity");
+    check3(UUID.test(row.captureId), "Selected capture identity must be a UUID");
+    string(row.toolCallId, "Selected tool-call identity");
+    integer(row.ordinal, "Selected ordinal", 1);
+    string(row.agent, "Selected agent", true);
+    hash2(row.definitionId, "Selected observed definition identity", true);
+    string(row.executionId, "Selected execution identity", true);
+  }
+  const reader = new EvidenceReader(evidenceRoot);
+  try {
+    await reader.start();
+    const captures = /* @__PURE__ */ new Map(), rows = [];
+    for (const row of selection.selections) {
+      let verified = captures.get(row.manifest.path);
+      if (!verified) {
+        verified = await capture(reader, row.manifest);
+        captures.set(row.manifest.path, verified);
+      }
+      check3(verified.refs[0].sha256 === row.manifest.sha256, "Repeated manifest selections disagree on hash");
+      const { manifest, refs, outcomes } = verified;
+      check3(manifest.captureId === row.captureId && manifest.toolCallId === row.toolCallId, "Selected capture/tool-call identity mismatch");
+      const requested = manifest.requested[row.ordinal - 1];
+      check3(requested !== void 0 && ["ordinal", "agent", "definitionId", "executionId"].every((key) => requested[key] === row[key]), "Selected requested row identity mismatch");
+      const outcome = outcomes[row.ordinal - 1];
+      rows.push({
+        caseId: row.caseId,
+        caseHash: row.caseHash,
+        source: { sha256: row.manifest.sha256, recordId: manifest.toolCallId },
+        captureId: manifest.captureId,
+        ownerId: manifest.ownerId,
+        toolCallId: manifest.toolCallId,
+        tool: manifest.tool,
+        requested: { ...requested },
+        manifest: { ...row.manifest },
+        copiedRefs: refs.map((ref) => ({ ...ref })),
+        observed: {
+          responseIsError: verified.responseIsError,
+          returnedOutcomeCount: outcomes.length,
+          selectedOutcome: outcome ? {
+            ok: outcome.ok,
+            work: outcome.work,
+            control: outcome.control,
+            finalState: outcome.final?.state ?? null,
+            cleanupState: outcome.cleanup?.state ?? null,
+            observationState: outcome.observation?.state ?? null,
+            retentionStatus: outcome.retention?.status ?? null
+          } : null
+        }
+      });
+    }
+    await reader.stable();
+    return {
+      schema: 1,
+      kind: "decision-public-source-verification",
+      status: "verified-bytes-and-record-identities",
+      platform: "linux",
+      evidenceRoot,
+      limits: { ...LIMITS },
+      artifactCount: reader.files.size,
+      totalBytes: reader.totalBytes,
+      captureCount: captures.size,
+      cases: rows,
+      trainingReady: false,
+      trainingEligible: false,
+      assessments: { approval: "not-assessed", taskAcceptance: "not-assessed", decisionTimeAvailability: "not-assessed", redaction: "not-assessed", rights: "not-assessed" }
+    };
+  } finally {
+    await reader.close();
+  }
+}
+
+// experiments/decision-shadow/main.mjs
+var terms = { jev: "https://typesafe.ai/legal/mca" };
+var providerErrors = /* @__PURE__ */ new Set([
+  "invalid provider response",
+  "provider request timed out",
+  "provider response exceeded limit",
+  "provider request failed",
+  "Provider call failed."
+]);
+var help = `Decision research workflow (Node >=20; qualified Pi execution needs Linux / Pi 1.0.4 / Node >=22.19)
+  preview --cases FILE --provider jev --model MODEL
+  run --cases FILE --provider jev --model MODEL --out NEW.jsonl --allow-remote
+  score --cases FILE --labels FILE --run RESULT.jsonl [--run RESULT2.jsonl]
+  corpus --cases FILE --labels FILE --out NEW.json
+  verify-sources --cases FILE --sources SELECTION.json --evidence-root DIR --out NEW.json
+  fixtures --out NEW_DIR
+  validate-experiment --cases FILE --experiment FILE
+  preview-pi --cases FILE --experiment FILE --model openai-codex:MODEL --thinking LEVEL --split test
+  run-pi --cases FILE --experiment FILE --model openai-codex:MODEL --thinking LEVEL --split test --pi-package DIR --out NEW.jsonl --allow-subscription [--pi-node PATH] [--auth-path FILE] [--timeout-ms N]
+  compare --cases FILE --experiment FILE --labels FILE --label-evidence FILE --run FILE [--run FILE] --out NEW.json
+  import-session --cases FILE --selection FILE --consent FILE --entry FILE --out NEW.json
+  export-learning --cases FILE --experiment FILE --labels FILE --label-evidence FILE --consents FILE --mode fixture-demo|reviewed-data --out NEW_DIR
+
+JEV run asks this session whether to retain selected data for later LoRA review.
+Noninteractive runs must supply --storage yes|no [--session-id ID]. No choice is inherited.
+
+preview, score, corpus and verify-sources are offline. verify-sources reads only
+explicitly selected Linux public captures; it does not assess decision readiness,
+decision-time availability, redaction, rights or labels. run sends only the curated input and
+question to the selected provider, bills its API, and requires its API key in
+OPENROUTER_API_KEY. No retries. Output must be new.
+Labels/predictions are research records, never runtime authority.
+Corpus excludes predictions and is NOT approved for training.`;
+function argumentsFor(argv) {
+  const [command, ...rest] = argv;
+  if (!command || command === "--help") return { command: "help", flags: {} };
+  const commands = {
+    ...RESEARCH_OPTIONS,
+    preview: ["cases", "provider", "model"],
+    run: ["cases", "provider", "model", "out", "allow-remote"],
+    score: ["cases", "labels", "run"],
+    corpus: ["cases", "labels", "out"],
+    "verify-sources": ["cases", "sources", "evidence-root", "out"]
+  };
+  if (!Object.hasOwn(commands, command))
+    throw new Error("Unknown command; use --help.");
+  const required = commands[command];
+  const optional = command === "run" ? ["storage", "session-id"] : RESEARCH_OPTIONAL[command] ?? [];
+  const allowed = [...required, ...optional];
+  const flags = {};
+  for (let i = 0; i < rest.length; i++) {
+    const key = rest[i].slice(2);
+    if (!rest[i].startsWith("--") || !allowed.includes(key))
+      throw new Error("Unknown option.");
+    if (key in flags && !(["score", "compare"].includes(command) && key === "run"))
+      throw new Error("Duplicate --" + key);
+    if (["allow-remote", "allow-subscription"].includes(key)) {
+      flags[key] = true;
+      continue;
+    }
+    const value = rest[++i];
+    if (!value || value.startsWith("--"))
+      throw new Error("Missing --" + key + " value.");
+    if (["score", "compare"].includes(command) && key === "run")
+      (flags.run ??= []).push(value);
+    else flags[key] = value;
+  }
+  for (const key of required)
+    if (!(key in flags)) throw new Error("Required --" + key);
+  return { command, flags };
+}
+async function textFile(path) {
+  const info = await stat(path);
+  if (!info.isFile() || info.size > 4 * 1024 * 1024)
+    throw new Error("Expected regular file <=4 MiB.");
+  const bytes = await readFile2(path);
+  if (bytes.length > 4 * 1024 * 1024) throw new Error("File exceeded 4 MiB.");
+  try {
+    return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(
+      bytes
+    );
+  } catch {
+    throw new Error("Input file is not valid UTF-8.");
+  }
+}
+async function jsonFile(path) {
+  const text2 = await textFile(path);
+  try {
+    return JSON.parse(text2);
+  } catch {
+    throw new Error("Invalid JSON input file.");
+  }
+}
+function sha256(text2) {
+  return createHash5("sha256").update(text2, "utf8").digest("hex");
+}
+function caseSetHash(cases) {
+  return sha256(JSON.stringify(cases.map((c) => ({ id: c.id, hash: c.hash }))));
+}
+function labelSetHash(labels) {
+  return sha256(
+    JSON.stringify(
+      [...labels].sort(
+        (a, b) => a.caseId < b.caseId ? -1 : a.caseId > b.caseId ? 1 : 0
+      )
+    )
+  );
+}
+function validCreatedAt(value) {
+  return typeof value === "string" && !Number.isNaN(Date.parse(value)) && new Date(value).toISOString() === value;
+}
+async function readRun(path, cases) {
+  let rows;
+  const text2 = await textFile(path);
+  try {
+    rows = text2.trimEnd().split("\n").map((line) => JSON.parse(line));
+  } catch {
+    throw new Error("Invalid run JSONL; retain damaged evidence separately.");
+  }
+  const [header, ...records] = rows;
+  if (header?.schema !== 1 || header.kind !== "decision-shadow-run" || header.caseSetHash !== caseSetHash(cases) || header.caseCount !== cases.length || header.trainingEligible !== false || !validCreatedAt(header.createdAt) || !Object.hasOwn(terms, header.provider))
+    throw new Error("Run header does not match this case set.");
+  makeRequest(header.provider, header.requestedModel, cases[0]);
+  if (records.length > cases.length)
+    throw new Error("Too many prediction records.");
+  for (const [index, r] of records.entries()) {
+    const validState = r?.status === "answered" ? isSupportedResolvedModel(r.resolvedModel) && r.error === null : r?.status === "error" && r.probability === null && providerErrors.has(r.error) && (r.resolvedModel === null || isSupportedResolvedModel(r.resolvedModel)) && index === records.length - 1;
+    if (!r || r.kind !== "prediction" || r.trainingEligible !== false || r.caseId !== cases[index].id || r.caseHash !== cases[index].hash || !validState || !nullableMetric(r.latencyMs) || !r.usage || !["inputTokens", "outputTokens"].every(
+      (key) => nullableTokenCount(r.usage[key])
+    ) || !nullableMetric(r.usage.costUsd))
+      throw new Error("Invalid prediction record.");
+  }
+  return { header, records, runSha256: sha256(text2) };
+}
+function nullableMetric(value) {
+  return value === null || typeof value === "number" && Number.isFinite(value) && value >= 0;
+}
+function nullableTokenCount(value) {
+  return value === null || Number.isSafeInteger(value) && value >= 0;
+}
+function measurements(records) {
+  const summarize = (values, integer2 = false) => {
+    const reported = values.filter((value) => value !== null);
+    let total = 0;
+    for (const value of reported) {
+      total += value;
+      if (!Number.isFinite(total) || integer2 && !Number.isSafeInteger(total)) {
+        throw new Error("Measurement totals exceed supported numeric bounds.");
+      }
+    }
+    return {
+      reported: reported.length,
+      attempted: records.length,
+      total: reported.length ? total : null
+    };
+  };
+  const latency = records.map((r) => r.latencyMs).filter((value) => value !== null);
+  const meanLatency = latency.reduce(
+    (mean, value, index) => mean + (value - mean) / (index + 1),
+    0
+  );
+  return {
+    latencyMs: {
+      reported: latency.length,
+      attempted: records.length,
+      mean: latency.length ? meanLatency : null
+    },
+    inputTokens: summarize(
+      records.map((r) => r.usage.inputTokens),
+      true
+    ),
+    outputTokens: summarize(
+      records.map((r) => r.usage.outputTokens),
+      true
+    ),
+    costUsd: summarize(records.map((r) => r.usage.costUsd))
+  };
+}
+async function writeNew(path, value) {
+  const file = await open4(path, "wx", 384);
+  try {
+    await file.writeFile(JSON.stringify(value, null, 2) + "\n");
+    await file.sync();
+  } finally {
+    await file.close();
+  }
+}
+async function main(argv, {
+  emit = console.log,
+  env = process.env,
+  providerCall = callProvider,
+  promptStorage,
+  piRunner,
+  sessionConsent,
+  expectedCaseSetHash,
+  beforeProviderCall
+} = {}) {
+  const { command, flags } = argumentsFor(argv);
+  if (command === "help") {
+    emit(help);
+    return;
+  }
+  const cases = command === "fixtures" ? null : parseCases(await jsonFile(flags.cases));
+  if (Object.hasOwn(RESEARCH_OPTIONS, command))
+    return researchCommand(
+      command,
+      flags,
+      { cases, jsonFile, textFile, writeNew, readLegacyRun: readRun },
+      { emit, piRunner }
+    );
+  if (command === "verify-sources") {
+    const sourceText = await textFile(flags.sources);
+    let selection;
+    try {
+      selection = JSON.parse(sourceText);
+    } catch {
+      throw new Error("Invalid JSON source selection.");
+    }
+    const verification = await verifySources(
+      cases,
+      selection,
+      flags["evidence-root"]
+    );
+    const receipt = {
+      ...verification,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      caseSetHash: caseSetHash(cases),
+      selectionFileSha256: sha256(sourceText)
+    };
+    await writeNew(flags.out, receipt);
+    emit(
+      JSON.stringify({
+        saved: resolve2(flags.out),
+        status: receipt.status,
+        caseCount: cases.length,
+        artifactCount: receipt.artifactCount,
+        trainingReady: false,
+        trainingEligible: false
+      })
+    );
+    return;
+  }
+  if (command === "preview" || command === "run") {
+    if (expectedCaseSetHash !== void 0 && caseSetHash(cases) !== expectedCaseSetHash)
+      throw new Error("Cases changed after confirmation.");
+    const requests = cases.map(
+      (c) => makeRequest(flags.provider, flags.model, c)
+    );
+    if (command === "preview") {
+      emit(
+        JSON.stringify(
+          {
+            schema: 1,
+            caseSetHash: caseSetHash(cases),
+            count: cases.length,
+            trainingEligible: false,
+            requests: requests.map((request, i) => ({
+              caseId: cases[i].id,
+              caseHash: cases[i].hash,
+              ...request
+            }))
+          },
+          null,
+          2
+        )
+      );
+      return;
+    }
+    const consent = sessionConsent ?? await requestSessionStorage({
+      sessionId: flags["session-id"],
+      storage: flags.storage,
+      promptStorage
+    });
+    const apiKey = env.OPENROUTER_API_KEY;
+    if (!apiKey?.trim())
+      throw new Error("Selected provider API key is not configured.");
+    const file = await open4(flags.out, "wx", 384);
+    const append = async (row) => {
+      await file.writeFile(JSON.stringify(row) + "\n");
+      await file.sync();
+    };
+    let failures = 0;
+    try {
+      if (beforeProviderCall) beforeProviderCall();
+      await writeNew(flags.out + ".consent.json", consent);
+      await retainSelectedSessionData({
+        cases,
+        consent,
+        out: flags.out + ".learning.json",
+        assertCurrent: beforeProviderCall
+      });
+      await append({
+        schema: 1,
+        kind: "decision-shadow-run",
+        provider: flags.provider,
+        requestedModel: flags.model,
+        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+        caseCount: cases.length,
+        caseSetHash: caseSetHash(cases),
+        trainingEligible: false,
+        termsUrl: terms[flags.provider]
+      });
+      for (const c of cases) {
+        let result;
+        try {
+          if (beforeProviderCall) beforeProviderCall();
+          result = await providerCall(flags.provider, flags.model, c, {
+            apiKey
+          });
+        } catch {
+          result = {
+            status: "error",
+            probability: null,
+            resolvedModel: null,
+            usage: { inputTokens: null, outputTokens: null, costUsd: null },
+            latencyMs: null,
+            error: "Provider call failed."
+          };
+        }
+        await append({
+          kind: "prediction",
+          caseId: c.id,
+          caseHash: c.hash,
+          ...result,
+          trainingEligible: false
+        });
+        if (result.status === "error") {
+          failures++;
+          break;
+        }
+      }
+    } finally {
+      await file.close();
+    }
+    emit(
+      JSON.stringify({
+        saved: resolve2(flags.out),
+        errors: failures,
+        trainingEligible: false
+      })
+    );
+    if (failures)
+      throw new Error(
+        "Run stopped after a provider error; saved partial evidence. No retry was made."
+      );
+    return;
+  }
+  const labels = parseLabels(await jsonFile(flags.labels), cases);
+  if (command === "corpus") {
+    await writeNew(flags.out, localCorpus(cases, labels));
+    emit(JSON.stringify({ saved: resolve2(flags.out), trainingReady: false }));
+    return;
+  }
+  const reports = [];
+  for (const path of flags.run) {
+    const { header, records, runSha256 } = await readRun(path, cases);
+    const resolvedModels = [
+      ...new Set(records.map((r) => r.resolvedModel).filter(Boolean))
+    ];
+    if (resolvedModels.length > 1) {
+      throw new Error(
+        "Run contains multiple resolved models; retain this evidence and use a new single-snapshot run."
+      );
+    }
+    reports.push({
+      provider: header.provider,
+      requestedModel: header.requestedModel,
+      resolvedModels,
+      runSha256,
+      createdAt: header.createdAt,
+      ...scorePredictions(
+        cases,
+        labels,
+        records.map(({ caseId, caseHash, status, probability: probability2 }) => ({
+          caseId,
+          caseHash,
+          status,
+          probability: probability2
+        }))
+      ),
+      measurements: measurements(records),
+      trainingEligible: false
+    });
+  }
+  emit(
+    JSON.stringify(
+      {
+        schema: 1,
+        threshold: 0.5,
+        caseSetHash: caseSetHash(cases),
+        labelSetHash: labelSetHash(labels),
+        reports
+      },
+      null,
+      2
+    )
+  );
+}
+
+// packages/cli/src/decision.ts
+async function cmdDecision(argv) {
+  await main(argv);
+}
+export {
+  cmdDecision
+};