@skill-harness/cli 0.25.0 → 0.26.0

package/dist/decision.js

@@ -253,10 +253,20 @@ def ordinary(path):
 def closed(value, fields, name):
     require(isinstance(value, dict) and set(value) == set(fields), name + ' has unsupported or missing fields')
 
+def jsonl_rows(path):
+    # JSONL records end only at LF. Unicode NEL/LS/PS are legal JSON string data.
+    lines = ordinary(path).decode('utf-8').split('\n')
+    if lines[-1] == '': lines.pop()
+    return [json.loads(line) for line in lines]
+
 def export_data(root):
     root = pathlib.Path(root).absolute()
     raw = ordinary(root / 'export-manifest.json'); m = json.loads(raw)
-    require(m.get('schema') == 1 and m.get('kind') == 'decision-learning-export', 'Unsupported export')
+    require(m.get('schema') == 2 and m.get('kind') == 'decision-learning-export', 'Unsupported export schema; re-export with the current skill-harness')
+    normalization = m['inputNormalization']
+    closed(normalization, ['algorithm','runtime','nodeVersion','unicodeVersion'], 'Input normalization producer')
+    require(normalization['algorithm'] == 'ecmascript-nfkc-whitespace-trim-lower-sha256-v1' and normalization['runtime'] == 'node', 'Unsupported input normalization producer')
+    require(all(isinstance(normalization[key], str) and re.fullmatch(r'[0-9]+(?:\.[0-9]+){1,2}', normalization[key]) for key in ['nodeVersion','unicodeVersion']), 'Invalid input normalization producer version')
     require(m.get('trainingExecuted') is False and m.get('providerPredictionsIncluded') is False, 'Unsupported source provenance')
     require(set(m['files']) == {'train.jsonl','validation.jsonl','test.jsonl','train-lora.py','requirements-training.txt','training-config.example.json','TRAINING.md'}, 'Unexpected export files')
     for name, ref in m['files'].items():
@@ -266,10 +276,10 @@ def export_data(root):
     require(digest(ordinary(pathlib.Path(__file__).absolute())) == m['files']['train-lora.py']['sha256'], 'Run the exact exported training script')
     groups, seen_inputs, seen_cases = {}, {}, set()
     for split in ['train','validation','test']:
-        rows = [json.loads(line) for line in ordinary(root / (split+'.jsonl')).decode('utf-8').splitlines()]
+        rows = jsonl_rows(root / (split+'.jsonl'))
         require(len(rows) == m['counts'][split], 'Split count mismatch')
         for row in rows:
-            closed(row, ['caseId','caseHash','taskGroup','lineageGroup','sessionId','fixtureOnly','input','question','answer','label','source'], 'Dataset row')
+            closed(row, ['caseId','caseHash','taskGroup','lineageGroup','sessionId','fixtureOnly','input','inputIdentity','question','answer','label','source'], 'Dataset row')
             require(row['caseId'] not in seen_cases and type(row['answer']) is bool, 'Duplicate case or invalid label')
             seen_cases.add(row['caseId'])
             require(row['label']['caseId'] == row['caseId'] and row['label']['caseHash'] == row['caseHash'] and row['label']['value'] == row['answer'] and row['label']['kind'] in ['human','test'] and row['label']['independent'] is True, 'Label identity mismatch')
@@ -278,7 +288,15 @@ def export_data(root):
                     identity = key + ':' + row[key]
                     require(identity not in groups or groups[identity] == split, 'Related cases cross splits')
                     groups[identity] = split
-            normalized = ' '.join(row['input'].casefold().split())
+            identity = row['inputIdentity']
+            closed(identity, ['algorithm','inputSha256','normalizedSha256'], 'Input identity receipt')
+            require(identity['algorithm'] == normalization['algorithm'], 'Input identity algorithm mismatch')
+            require(all(isinstance(identity[key], str) and re.fullmatch(r'[0-9a-f]{64}', identity[key]) for key in ['inputSha256','normalizedSha256']), 'Invalid input identity digest')
+            require(isinstance(row['input'], str) and digest(row['input'].encode('utf-8')) == identity['inputSha256'], 'Input identity byte mismatch')
+            # This is producer evidence bound by the exact row/file/manifest hashes.
+            # Recomputing with Python Unicode tables can disagree with the Node producer.
+            # The receipt is not an independent proof that normalization was correct.
+            normalized = identity['normalizedSha256']
             require(normalized not in seen_inputs or seen_inputs[normalized] == split, 'Duplicate input crosses splits')
             seen_inputs[normalized] = split
             if m.get('trainingEligible') is True: require(row['fixtureOnly'] is False and row['sessionId'] is not None, 'Fixture/anonymous data cannot be training eligible')
@@ -353,8 +371,7 @@ def main():
     model = get_peft_model(model, LoraConfig(task_type=TaskType.CAUSAL_LM, r=t['loraRank'], lora_alpha=t['loraAlpha'], target_modules=t['targetModules'], lora_dropout=0.0, bias='none'))
     def rows(split):
         data = []
-        for line in ordinary(root / (split + '.jsonl')).decode('utf-8').splitlines():
-            row = json.loads(line)
+        for row in jsonl_rows(root / (split + '.jsonl')):
             require(row['fixtureOnly'] is False and type(row['answer']) is bool and row['label']['kind'] in ['human','test'] and row['label']['independent'] is True, 'Only independently labeled reviewed real data may train')
             prompt = 'Question: ' + row['question'] + '\nEvidence:\n' + row['input'] + '\nAnswer (true or false): '
             prefix = tokenizer.encode(prompt, add_special_tokens=True)
@@ -384,6 +401,8 @@ var TRAINING_DOC = `# Local LoRA workflow
 
 This export contains independent labels, never JEV predictions. A fixture demonstration is not training eligible. No training or installation has been performed by exporting these files.
 
+Export schema 2 records the producer's normalized-input SHA-256 receipt in every row, the exact input UTF-8 SHA-256, and the Node/Unicode versions and normalization algorithm in the manifest. One JavaScript normalizer validates the split and writes the receipt. Python checks receipt shape, raw-input binding, duplicate identities and exact file hashes; it does not reinterpret those identities with its own Unicode tables. These are trusted producer receipts, not independent proofs of correct normalization. Separate training approval still pins the exact export manifest. Invalid Unicode scalar input is refused by the producer. Re-export older schema-1 packets with the current CLI; do not modify their bound script, rows or manifest in place.
+
 1. Check the intact export offline: python3 train-lora.py --export /absolute/export --check-export-only.
 2. For reviewed real data only, select a base model, immutable full revision, license and an existing canonical local weight directory. Pin every file by SHA-256 in a separate copy of training-config.example.json. Select architecture-specific LoRA target modules. Record an explicit eligibility review bound to the exact export-manifest.json digest. Storage consent alone is insufficient.
 3. Use an isolated Python 3.12 environment with the exact requirements-training.txt versions. Resolve dependencies separately, retain the complete resolved environment/wheel hashes, and assess the host memory requirements. The template pins direct versions; it is not a platform-complete dependency lock or proof of hardware support.
@@ -459,6 +478,11 @@ function consentFor(consents, sessionId) {
   check(c.decision === "granted", "session storage declined; advice remains allowed");
   return c;
 }
+var INPUT_NORMALIZATION_ALGORITHM = "ecmascript-nfkc-whitespace-trim-lower-sha256-v1";
+function inputIdentity(input) {
+  check(!/[\uD800-\uDFFF]/u.test(input), "learning input must contain valid Unicode scalar values");
+  return { algorithm: INPUT_NORMALIZATION_ALGORITHM, inputSha256: learningDigest(input), normalizedSha256: learningDigest(input.normalize("NFKC").replace(/\s+/gu, " ").trim().toLowerCase()) };
+}
 var ENTRY_KEYS = ["caseId", "caseHash", "taskGroup", "lineageGroup", "split", "sessionId", "fixtureOnly", "decisionTimeReviewed", "redactionReviewed", "rights", "exportApproved", "trainingApproved", "reviewer"];
 function parseEntry(c, e) {
   keys(e, ENTRY_KEYS, "experiment entry");
@@ -490,7 +514,7 @@ function parseExperiment(cases, manifest) {
     bind(groups, "task:" + e.taskGroup, e.split, "task group");
     bind(groups, "lineage:" + e.lineageGroup, e.split, "lineage group");
     if (e.sessionId !== null) bind(groups, "session:" + e.sessionId, e.split, "session");
-    bind(duplicates, learningDigest(cases[i].input.normalize("NFKC").replace(/\s+/gu, " ").trim().toLowerCase()), e.split, "duplicate input");
+    bind(duplicates, inputIdentity(cases[i].input).normalizedSha256, e.split, "duplicate input");
     bind(duplicates, "source:" + cases[i].source.sha256 + ":" + cases[i].source.recordId, e.split, "source record");
   });
   return { ...structuredClone(manifest), entries };
@@ -660,7 +684,7 @@ async function prepareExport({ cases, labels, manifest, consents, labelEvidence,
       excluded.push({ caseId: c.id, reasons });
       continue;
     }
-    const row = { caseId: c.id, caseHash: c.hash, taskGroup: e.taskGroup, lineageGroup: e.lineageGroup, sessionId: e.sessionId, fixtureOnly: e.fixtureOnly, input: c.input, question: c.question, answer: label.label.value, label: { ...label.label }, source: { ...c.source } };
+    const row = { caseId: c.id, caseHash: c.hash, taskGroup: e.taskGroup, lineageGroup: e.lineageGroup, sessionId: e.sessionId, fixtureOnly: e.fixtureOnly, input: c.input, inputIdentity: inputIdentity(c.input), question: c.question, answer: label.label.value, label: { ...label.label }, source: { ...c.source } };
     splitRows[e.split].push(row);
     included.push(e);
   }
@@ -668,16 +692,16 @@ async function prepareExport({ cases, labels, manifest, consents, labelEvidence,
   const trainingEligible = mode === "reviewed-data" && excluded.length === 0 && Object.values(splitRows).every((rows) => rows.length > 0) && included.every((e) => !e.fixtureOnly && e.trainingApproved && e.rights === "local-training");
   const files = { ...trainingAssets() };
   for (const [split, rows] of Object.entries(splitRows)) files[`${split}.jsonl`] = rows.map((r) => JSON.stringify(r) + "\n").join("");
-  const metadata2 = { schema: 1, kind: "decision-learning-export", mode, experimentId: manifest.id, experimentHash: learningDigest(manifest), trainingEligible, trainingExecuted: false, providerPredictionsIncluded: false, counts: Object.fromEntries(Object.entries(splitRows).map(([s, r]) => [s, r.length])), excluded, review: { frozenAt: manifest.frozenAt, eligibilityRecords: included, independentLabelReceipts: reviewed.reviewed.map((r) => ({ ...r.reference, recordedAt: r.recordedAt })), sessionConsents: [...new Set(included.filter((e) => e.sessionId !== null).map((e) => e.sessionId))].map((sessionId) => {
+  const metadata2 = { schema: 2, kind: "decision-learning-export", inputNormalization: { algorithm: INPUT_NORMALIZATION_ALGORITHM, runtime: "node", nodeVersion: process.versions.node, unicodeVersion: process.versions.unicode }, mode, experimentId: manifest.id, experimentHash: learningDigest(manifest), trainingEligible, trainingExecuted: false, providerPredictionsIncluded: false, counts: Object.fromEntries(Object.entries(splitRows).map(([s, r]) => [s, r.length])), excluded, review: { frozenAt: manifest.frozenAt, eligibilityRecords: included, independentLabelReceipts: reviewed.reviewed.map((r) => ({ ...r.reference, recordedAt: r.recordedAt })), sessionConsents: [...new Set(included.filter((e) => e.sessionId !== null).map((e) => e.sessionId))].map((sessionId) => {
     const c = consentFor(consents, sessionId);
     return { sessionId, sha256: learningDigest(c), decision: c.decision, interactionId: c.interactionId, recordedAt: c.recordedAt };
   }) }, files: Object.fromEntries(Object.entries(files).map(([name, s]) => [name, { sha256: learningDigest(s), bytes: Buffer.byteLength(s) }])) };
   files["export-manifest.json"] = JSON.stringify(metadata2, null, 2) + "\n";
-  return { schema: 1, kind: "prepared-decision-learning-export", metadata: metadata2, files };
+  return { schema: 2, kind: "prepared-decision-learning-export", metadata: metadata2, files };
 }
 async function writePreparedExport({ prepared, directory }) {
   keys(prepared, ["schema", "kind", "metadata", "files"], "prepared export");
-  check(prepared.schema === 1 && prepared.kind === "prepared-decision-learning-export", "unsupported prepared export");
+  check(prepared.schema === 2 && prepared.metadata?.schema === 2 && prepared.kind === "prepared-decision-learning-export", "unsupported prepared export");
   text(directory, "output directory", 4096);
   check(isAbsolute(directory), "output directory must be absolute");
   const allowed = ["train.jsonl", "validation.jsonl", "test.jsonl", "export-manifest.json", "train-lora.py", "training-config.example.json", "requirements-training.txt", "TRAINING.md"];
@@ -1529,8 +1553,9 @@ function normalize2(payload) {
 }
 function deadline(signal) {
   return new Promise((_, reject) => {
-    if (signal.aborted) return reject(new Error("provider request timed out"));
-    signal.addEventListener("abort", () => reject(new Error("provider request timed out")), { once: true });
+    const fail = () => reject(signal.reason instanceof Error ? signal.reason : new Error("provider request timed out"));
+    if (signal.aborted) return fail();
+    signal.addEventListener("abort", fail, { once: true });
   });
 }
 async function readBounded(response, timedOut) {
@@ -1566,7 +1591,7 @@ async function readBounded(response, timedOut) {
   return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
 }
 function failure(startedAt, error) {
-  const publicErrors = ["invalid provider response", "provider request timed out", "provider response exceeded limit"];
+  const publicErrors = ["invalid provider response", "provider request timed out", "provider response exceeded limit", "provider request cancelled"];
   const message = error instanceof Error && publicErrors.includes(error.message) ? error.message : "provider request failed";
   return {
     status: "error",
@@ -1581,6 +1606,7 @@ async function callProvider(provider, model, example, options = {}) {
   const startedAt = performance.now();
   let controller;
   let timer;
+  let cancel;
   try {
     const request = makeRequest(provider, model, example);
     requiredString(options.apiKey, "apiKey", 16 * 1024);
@@ -1591,8 +1617,14 @@ async function callProvider(provider, model, example, options = {}) {
     if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 3e5) {
       throw new TypeError("invalid timeout");
     }
+    if (options.signal !== void 0 && !(options.signal instanceof AbortSignal)) {
+      throw new TypeError("signal must be an AbortSignal");
+    }
+    if (options.signal?.aborted) throw new Error("provider request cancelled");
     controller = new AbortController();
-    timer = setTimeout(() => controller.abort(), timeoutMs);
+    cancel = () => controller.abort(new Error("provider request cancelled"));
+    options.signal?.addEventListener("abort", cancel, { once: true });
+    timer = setTimeout(() => controller.abort(new Error("provider request timed out")), timeoutMs);
     const timedOut = deadline(controller.signal);
     const response = await Promise.race([
       (options.fetchImpl ?? fetch)(request.url, {
@@ -1617,6 +1649,7 @@ async function callProvider(provider, model, example, options = {}) {
     return failure(startedAt, error);
   } finally {
     if (timer !== void 0) clearTimeout(timer);
+    if (cancel) options.signal?.removeEventListener("abort", cancel);
     controller?.abort();
   }
 }

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@skill-harness/cli",
-    "version": "0.25.0",
-    "description": "skill-harness CLI — run, grade, review, and lint agent-skill scenarios on the pi harness",
+    "version": "0.26.0",
+    "description": "skill-harness CLI \u2014 run, grade, review, and lint agent-skill scenarios on the pi harness",
     "type": "module",
     "license": "MIT",
     "main": "./dist/cli.js",
@@ -44,7 +44,7 @@
         "prepack": "node ../../scripts/release-pack.mjs --guard"
     },
     "dependencies": {
-        "@skill-harness/core": "0.25.0",
-        "@skill-harness/adapters": "0.25.0"
+        "@skill-harness/core": "0.26.0",
+        "@skill-harness/adapters": "0.26.0"
     }
 }