@skill-harness/core 0.10.0 → 0.12.0

package/dist/execution-trace.js

@@ -157,12 +157,19 @@ export function parseTrace(lines, meta) {
         }
     }
     const toolCalls = [...calls.values()].sort((a, b) => a.issueIndex - b.issueIndex);
+    const subscription = meta.subject.provider === "openai-codex" || meta.subject.provider === "claude-code";
+    const costSource = subscription
+        ? "subscription"
+        : cost !== null
+            ? "provider-reported"
+            : "unreported";
     const metrics = {
         input_tokens: inputTokens,
         output_tokens: outputTokens,
         cache_read_tokens: cacheReadTokens,
         cache_write_tokens: cacheWriteTokens,
         cost_usd: cost ?? 0,
+        cost_source: costSource,
         tool_calls: toolCalls.length,
         delegated_children: toolCalls
             .filter((call) => call.name === "Agent")
@@ -348,12 +355,13 @@ export function mergeTraces(traces) {
             cache_read_tokens: sum.cache_read_tokens + trace.metrics.cache_read_tokens,
             cache_write_tokens: sum.cache_write_tokens + trace.metrics.cache_write_tokens,
             cost_usd: sum.cost_usd + trace.metrics.cost_usd,
+            cost_source: sum.cost_source === trace.metrics.cost_source ? sum.cost_source : "unreported",
             tool_calls: sum.tool_calls + trace.metrics.tool_calls,
             delegated_children: sum.delegated_children + trace.metrics.delegated_children,
             max_concurrency: Math.max(sum.max_concurrency, trace.metrics.max_concurrency),
         }), {
             input_tokens: 0, output_tokens: 0, cache_read_tokens: 0, cache_write_tokens: 0,
-            cost_usd: 0, tool_calls: 0, delegated_children: 0, max_concurrency: 0,
+            cost_usd: 0, cost_source: traces[0].metrics.cost_source, tool_calls: 0, delegated_children: 0, max_concurrency: 0,
         })
         : undefined;
     const last = traces[traces.length - 1];

package/dist/grade.d.ts

@@ -1,6 +1,7 @@
 import type { Scenario } from "./spec.js";
 import type { HarnessAdapter, ModelRef } from "./adapters/types.js";
 import type { Verdict } from "./score.js";
+import { type CriterionVote } from "./results.js";
 export interface JudgePromptInput {
     skill: string;
     persona: string;
@@ -36,6 +37,7 @@ export declare function parseVerdict(out: string): ParsedVerdict;
 export declare function judgeResemblesSubject(judge: ModelRef, subject: ModelRef): boolean;
 export interface GradeResult extends ParsedVerdict {
     raw: string;
+    criteria: CriterionVote[];
     /** Judge misfire: the overall verdict disagrees with AND(per-item grades). Recorded, never auto-passed; blocks SHIP until re-judged or overridden. */
     suspect: boolean;
 }

package/dist/grade.js

@@ -1,4 +1,5 @@
 import { createWorkspace } from "./workspace.js";
+import { parseCriterionVotes } from "./results.js";
 /** The heading runSeeded writes above the staged diff. Gating on this exact string is what keeps the guidance honest — see below. */
 export const STAGED_DIFF_HEADING = "=== STAGED DIFF ===";
 /**
@@ -133,7 +134,7 @@ export async function gradeTranscript(adapter, judge, prompt, cwd) {
             parsed.reason = `judge unparseable: ${snippet}`;
     }
     const suspect = detectMisfire(raw, parsed.verdict);
-    return { ...parsed, raw, suspect };
+    return { ...parsed, raw, suspect, criteria: parseCriterionVotes(raw) };
 }
 /**
  * Grade a transcript in a fresh, isolated, throwaway workspace — never the

package/dist/index.d.ts

@@ -23,8 +23,12 @@ export * from "./util/env.js";
 export * from "./scaffold.js";
 export * from "./version.js";
 export * from "./defaults.js";
+export * from "./command-cost.js";
 export * from "./judge-policy.js";
+export * from "./judge-agreement.js";
 export * from "./regate.js";
+export * from "./screen.js";
+export * from "./prompt-normalization.js";
 export * from "./downgrade.js";
 export * from "./canary.js";
 export * from "./stability.js";
@@ -37,5 +41,15 @@ export * from "./trajectory-gates.js";
 export * from "./instruction-coverage.js";
 export * from "./affected.js";
 export * from "./adjudication.js";
+export * from "./vote-panel.js";
+export * from "./qualification-panels.js";
+export * from "./qualification-panel-store.js";
+export * from "./qualification-validation.js";
 export * from "./comparison.js";
 export * from "./sandbox.js";
+export * from "./provider-failure.js";
+export * from "./arms.js";
+export * from "./qualification-config.js";
+export * from "./qualification-oauth-directory.js";
+export * from "./qualification-store.js";
+export * from "./qualification-runner.js";

package/dist/index.js

@@ -23,8 +23,12 @@ export * from "./util/env.js";
 export * from "./scaffold.js";
 export * from "./version.js";
 export * from "./defaults.js";
+export * from "./command-cost.js";
 export * from "./judge-policy.js";
+export * from "./judge-agreement.js";
 export * from "./regate.js";
+export * from "./screen.js";
+export * from "./prompt-normalization.js";
 export * from "./downgrade.js";
 export * from "./canary.js";
 export * from "./stability.js";
@@ -37,6 +41,16 @@ export * from "./trajectory-gates.js";
 export * from "./instruction-coverage.js";
 export * from "./affected.js";
 export * from "./adjudication.js";
+export * from "./vote-panel.js";
+export * from "./qualification-panels.js";
+export * from "./qualification-panel-store.js";
+export * from "./qualification-validation.js";
 export * from "./comparison.js";
 export * from "./sandbox.js";
+export * from "./provider-failure.js";
+export * from "./arms.js";
+export * from "./qualification-config.js";
+export * from "./qualification-oauth-directory.js";
+export * from "./qualification-store.js";
+export * from "./qualification-runner.js";
 //# sourceMappingURL=index.js.map

package/dist/journal.d.ts

@@ -90,6 +90,7 @@ export type JournalEvent = {
     ts: string;
     id: string;
     attempt: number;
+    reason?: string;
     rep?: number;
 } | {
     event: "rescore";
@@ -102,7 +103,7 @@ export type JournalEvent = {
 }
 /**
  * A regate: needle gates re-evaluated against the saved staged diffs. `judge_calls`
- * is on the record because regate is advertised as free apart from the reps whose
+ * is on the record because regate may spend only on the reps whose
  * gate verdict flipped — a claim the journal should be able to settle. `skipped`
  * names scenarios it could not regate (vitest/post_test, or missing diff artifacts).
  */

package/dist/judge-agreement.d.ts

@@ -0,0 +1,19 @@
+import type { ResultsFile } from "./results.js";
+import type { Verdict } from "./score.js";
+export interface JudgeAgreementCell {
+    scenario: string;
+    status: "agree" | "disagree" | "error";
+    judges: string[];
+    verdicts: Verdict[];
+    detail: string;
+}
+export interface JudgeAgreementReport {
+    cells: JudgeAgreementCell[];
+    agree: number;
+    disagree: number;
+    error: number;
+    comparable: number;
+    rate: number | null;
+}
+/** Pure/offline projection of judgments already persisted in results.yaml. */
+export declare function judgeAgreement(results: ResultsFile): JudgeAgreementReport;

package/dist/judge-agreement.js

@@ -0,0 +1,31 @@
+/** Pure/offline projection of judgments already persisted in results.yaml. */
+export function judgeAgreement(results) {
+    const cells = results.scenarios.map((scenario) => {
+        const judgments = scenario.judge_history ?? scenario.adjudication?.judgments ?? [];
+        const distinct = new Map();
+        for (const judgment of judgments) {
+            const key = `${judgment.judge.provider}:${judgment.judge.model}`;
+            distinct.delete(key); // insertion order now reflects each judge's latest persisted vote
+            distinct.set(key, judgment);
+        }
+        const pair = [...distinct.entries()].slice(-2);
+        if (pair.length < 2 || pair.some(([, judgment]) => judgment.suspect || judgment.verdict === "ERROR" || judgment.verdict === "NOT-MEASURED" || judgment.verdict === "JUDGE-AMBIGUOUS")) {
+            return {
+                scenario: scenario.id, status: "error", judges: pair.map(([judge]) => judge),
+                verdicts: pair.map(([, judgment]) => judgment.verdict),
+                detail: pair.length < 2 ? "fewer than two distinct persisted judges" : "one or more judgments is not a clean vote",
+            };
+        }
+        const status = pair[0][1].verdict === pair[1][1].verdict ? "agree" : "disagree";
+        return {
+            scenario: scenario.id, status, judges: pair.map(([judge]) => judge),
+            verdicts: pair.map(([, judgment]) => judgment.verdict), detail: `${pair[0][1].verdict} vs ${pair[1][1].verdict}`,
+        };
+    });
+    const agree = cells.filter((cell) => cell.status === "agree").length;
+    const disagree = cells.filter((cell) => cell.status === "disagree").length;
+    const error = cells.filter((cell) => cell.status === "error").length;
+    const comparable = agree + disagree;
+    return { cells, agree, disagree, error, comparable, rate: comparable ? agree / comparable : null };
+}
+//# sourceMappingURL=judge-agreement.js.map

package/dist/judge-policy.js

@@ -4,15 +4,17 @@ import { BAKED_DEFAULT_JUDGE } from "./defaults.js";
  * Judge providers that cannot bill a per-token API.
  *
  * `claude-code` shells out to the `claude` CLI, authenticated with the user's
- * Claude subscription (OAuth). `ollama`/`lmstudio`/`llamacpp`/`local` are local
- * runtimes. Everything else is assumed to charge.
+ * Claude subscription (OAuth). `openai-codex` stays in Pi and authenticates with
+ * the user's ChatGPT subscription (OAuth). `ollama`/`lmstudio`/`llamacpp`/`local`
+ * are local runtimes. Everything else — including direct `openai` — is assumed
+ * to charge.
  *
  * An **allow-list**, deliberately, not a deny-list of known-paid providers: a
  * provider nobody has classified yet should be treated as able to bill, because
  * being wrong in that direction produces a surprise invoice while being wrong in
  * this direction produces one extra flag.
  */
-const FREE_JUDGE_PROVIDERS = new Set(["claude-code", "ollama", "lmstudio", "llamacpp", "local"]);
+const FREE_JUDGE_PROVIDERS = new Set(["claude-code", "openai-codex", "ollama", "lmstudio", "llamacpp", "local"]);
 /** Whether judging with this ref can charge a per-token API. */
 export function isMeteredJudge(judge) {
     return !FREE_JUDGE_PROVIDERS.has(judge.provider);

package/dist/lift.js

@@ -29,7 +29,7 @@ function conclusive(verdict, suspect) {
     // misfire are judge failures. Treating any of them as a FAIL would make
     // "red FAIL -> green PASS" fire on infrastructure noise, and lift would
     // measure flakiness while looking like skill value.
-    return !suspect && verdict !== "ERROR" && verdict !== "JUDGE-AMBIGUOUS";
+    return !suspect && verdict !== "ERROR" && verdict !== "NOT-MEASURED" && verdict !== "JUDGE-AMBIGUOUS";
 }
 function classify(red, green) {
     if (!conclusive(red.verdict, red.suspect) || !conclusive(green.verdict, green.suspect))

package/dist/lint.js

@@ -279,7 +279,7 @@ export function lintSkill(skillDir) {
                 else if (current !== recorded) {
                     // The remedy is per key kind, and it is the whole point of the split: a
                     // rubric edit is re-gradeable from saved transcripts, a policy edit is a
-                    // free rescore, a needle edit is a free regate. Only stimulus drift costs
+                    // free rescore, while a gate edit avoids a subject re-run via regate. Only stimulus drift costs
                     // model spend. One message saying "re-run" for all four is what made
                     // correcting a known-bad rubric expensive enough to skip.
                     findings.push({ skill, scenario, code: "stale", message: `${what} changed since the newest ${basename(tagDir)} run (${newest}) — results are stale; ${remedyForKey(key)}` });

package/dist/prompt-normalization.d.ts

@@ -0,0 +1,6 @@
+export declare const PROMPT_NORMALIZATION_RULE: "cwd-line-v1";
+export declare const PROMPT_NORMALIZATION_PATTERN = "^(Current working directory:)[^\\r\\n]*(\\r?)$";
+export declare const PROMPT_NORMALIZATION_FLAGS = "gm";
+export declare const PROMPT_NORMALIZATION_REPLACEMENT = "$1<normalized>$2";
+export declare const PROMPT_NORMALIZATION_SOURCE_KEY = "observation:prompt-normalization";
+export declare const PROMPT_NORMALIZATION_SOURCE_DIGEST: string;

package/dist/prompt-normalization.js

@@ -0,0 +1,14 @@
+import { createHash } from "node:crypto";
+export const PROMPT_NORMALIZATION_RULE = "cwd-line-v1";
+export const PROMPT_NORMALIZATION_PATTERN = "^(Current working directory:)[^\\r\\n]*(\\r?)$";
+export const PROMPT_NORMALIZATION_FLAGS = "gm";
+export const PROMPT_NORMALIZATION_REPLACEMENT = "$1<normalized>$2";
+export const PROMPT_NORMALIZATION_SOURCE_KEY = "observation:prompt-normalization";
+export const PROMPT_NORMALIZATION_SOURCE_DIGEST = createHash("sha256").update(JSON.stringify([
+    "prompt-normalization-registry",
+    PROMPT_NORMALIZATION_RULE,
+    PROMPT_NORMALIZATION_PATTERN,
+    PROMPT_NORMALIZATION_FLAGS,
+    PROMPT_NORMALIZATION_REPLACEMENT,
+])).digest("hex");
+//# sourceMappingURL=prompt-normalization.js.map

package/dist/provider-failure.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Provider-side failure detection.
+ *
+ * A provider outage is INFRASTRUCTURE, never a model verdict. Measured 2026-08-22:
+ * an invalidated `openai-codex` OAuth token makes pi report
+ * `stopReason: "error"` with a `provider_transport_failure` diagnostic and **exit 0**
+ * in `--mode json`, and exit 1 with `Encountered invalidated oauth token for user,
+ * failing request` on stderr in text mode. Neither path was classified, so a wave
+ * against a dead token produced model FAILs shaped exactly like findings.
+ *
+ * Two entry points because the two run paths surface it differently, and the
+ * structured one is the WEAKER signal — it hides the real message behind a generic
+ * transport error and exits 0. Do not assume `--structured` improves diagnosis.
+ */
+/**
+ * Written into a transcript by the adapter when pi failed provider-side, so the
+ * text path can carry a machine-readable signal through a `string` return without
+ * widening `HarnessAdapter.run`. Read back by `providerFailureFromTranscript`.
+ *
+ * The marker must not be forgeable by a model that types the same words into its
+ * answer — and a verdict is what hangs on it, since a forged marker converts a
+ * would-be FAIL into ERROR and (via `judgeOneRep`'s short-circuit) permanently
+ * suppresses the judge on every later re-grade. Line-anchoring alone does not do
+ * that: nothing stops a model emitting a newline and then the marker.
+ *
+ * So position, not spelling, is the guarantee. The marker is written ONLY into the
+ * transcript PREAMBLE — everything before the first `>>> ` turn header — which the
+ * adapter composes before any model output exists. There is no ordering by which a
+ * model's text can land there. See `withProviderFailure` (write) and
+ * `providerFailureFromTranscript` (read); both live here so the two halves of the
+ * convention cannot drift apart.
+ */
+export declare const PROVIDER_FAILURE_MARKER = "[skill-harness] provider failure:";
+/**
+ * Prefix `transcript` with the provider-failure marker, or return it unchanged.
+ *
+ * The one supported way to write the marker: it must precede the first turn header
+ * to be readable back, and putting the rule next to the reader keeps a future
+ * adapter from re-introducing the forgeable placement.
+ */
+export declare function withProviderFailure(transcript: string, failure: string | null): string;
+/**
+ * A provider failure named by one `pi --mode json` line, or null.
+ *
+ * Fail-closed on the diagnostic, fail-open on the parse: an unreadable line is not
+ * evidence of a failure, and throwing here would abort a wave over one bad line.
+ */
+export declare function providerFailureFromJsonLine(line: string): string | null;
+/**
+ * The failure the adapter recorded in a transcript's preamble, or null.
+ *
+ * Scanning STOPS at the first turn header. Everything from there on is model
+ * output or interleaved with it, so a marker found there is not evidence the
+ * provider failed — it is evidence the model typed the words.
+ */
+export declare function providerFailureFromTranscript(transcript: string): string | null;

package/dist/provider-failure.js

@@ -0,0 +1,98 @@
+/**
+ * Provider-side failure detection.
+ *
+ * A provider outage is INFRASTRUCTURE, never a model verdict. Measured 2026-08-22:
+ * an invalidated `openai-codex` OAuth token makes pi report
+ * `stopReason: "error"` with a `provider_transport_failure` diagnostic and **exit 0**
+ * in `--mode json`, and exit 1 with `Encountered invalidated oauth token for user,
+ * failing request` on stderr in text mode. Neither path was classified, so a wave
+ * against a dead token produced model FAILs shaped exactly like findings.
+ *
+ * Two entry points because the two run paths surface it differently, and the
+ * structured one is the WEAKER signal — it hides the real message behind a generic
+ * transport error and exits 0. Do not assume `--structured` improves diagnosis.
+ */
+/**
+ * Written into a transcript by the adapter when pi failed provider-side, so the
+ * text path can carry a machine-readable signal through a `string` return without
+ * widening `HarnessAdapter.run`. Read back by `providerFailureFromTranscript`.
+ *
+ * The marker must not be forgeable by a model that types the same words into its
+ * answer — and a verdict is what hangs on it, since a forged marker converts a
+ * would-be FAIL into ERROR and (via `judgeOneRep`'s short-circuit) permanently
+ * suppresses the judge on every later re-grade. Line-anchoring alone does not do
+ * that: nothing stops a model emitting a newline and then the marker.
+ *
+ * So position, not spelling, is the guarantee. The marker is written ONLY into the
+ * transcript PREAMBLE — everything before the first `>>> ` turn header — which the
+ * adapter composes before any model output exists. There is no ordering by which a
+ * model's text can land there. See `withProviderFailure` (write) and
+ * `providerFailureFromTranscript` (read); both live here so the two halves of the
+ * convention cannot drift apart.
+ */
+export const PROVIDER_FAILURE_MARKER = "[skill-harness] provider failure:";
+/**
+ * The adapters' shared turn-header prefix (`>>> USER:` / `>>> USER (turn n/m):`),
+ * which is where the preamble ends and model-influenced content begins.
+ */
+const TURN_HEADER_PREFIX = ">>> ";
+/**
+ * Prefix `transcript` with the provider-failure marker, or return it unchanged.
+ *
+ * The one supported way to write the marker: it must precede the first turn header
+ * to be readable back, and putting the rule next to the reader keeps a future
+ * adapter from re-introducing the forgeable placement.
+ */
+export function withProviderFailure(transcript, failure) {
+    return failure ? `${PROVIDER_FAILURE_MARKER} ${failure}\n\n${transcript}` : transcript;
+}
+/** Diagnostic types that mean the provider never ran the request. */
+const FAILURE_DIAGNOSTICS = new Set(["provider_transport_failure"]);
+/**
+ * A provider failure named by one `pi --mode json` line, or null.
+ *
+ * Fail-closed on the diagnostic, fail-open on the parse: an unreadable line is not
+ * evidence of a failure, and throwing here would abort a wave over one bad line.
+ */
+export function providerFailureFromJsonLine(line) {
+    let parsed;
+    try {
+        parsed = JSON.parse(line);
+    }
+    catch {
+        return null;
+    }
+    const message = parsed?.message;
+    if (!message || typeof message !== "object")
+        return null;
+    const diagnostics = message.diagnostics;
+    if (!Array.isArray(diagnostics))
+        return null;
+    for (const raw of diagnostics) {
+        if (typeof raw?.type !== "string" || !FAILURE_DIAGNOSTICS.has(raw.type))
+            continue;
+        const provider = typeof message.provider === "string"
+            ? message.provider
+            : "unknown provider";
+        const detail = typeof raw.error?.message === "string" ? raw.error.message : raw.type;
+        return `${provider}: ${detail}`;
+    }
+    return null;
+}
+/**
+ * The failure the adapter recorded in a transcript's preamble, or null.
+ *
+ * Scanning STOPS at the first turn header. Everything from there on is model
+ * output or interleaved with it, so a marker found there is not evidence the
+ * provider failed — it is evidence the model typed the words.
+ */
+export function providerFailureFromTranscript(transcript) {
+    for (const line of transcript.split("\n")) {
+        if (line.startsWith(TURN_HEADER_PREFIX))
+            return null;
+        if (line.startsWith(PROVIDER_FAILURE_MARKER))
+            return line.slice(PROVIDER_FAILURE_MARKER.length).trim();
+    }
+    return null;
+}
+//# sourceMappingURL=provider-failure.js.map

package/dist/qualification-capture.d.ts

@@ -0,0 +1,44 @@
+export interface QualificationOutputReceipt {
+    path: string;
+    total_bytes: number;
+    captured_bytes: number;
+    truncated: boolean;
+    sha256: string;
+}
+export interface QualificationBoundedCapture {
+    path: string;
+    total_bytes: number;
+    captured_bytes: number;
+    truncated: boolean;
+    write(chunk: Buffer): void;
+    close(): void;
+}
+export interface QualificationArtifactAttestation {
+    ok: boolean;
+    actual: {
+        provider: string;
+        model: string;
+    } | null;
+    fallback: boolean;
+    refused: boolean;
+    error: string | null;
+}
+export declare function redactQualificationOutput(text: string, secretValues?: readonly string[]): string;
+export declare function openQualificationBoundedCapture(path: string, limit: number, redact: (text: string) => string): QualificationBoundedCapture;
+export declare function qualificationOutputReceipt(spoolRoot: string, path: string, capture: QualificationBoundedCapture): QualificationOutputReceipt;
+export declare function verifyQualificationOutputReceipt(spoolRoot: string, receipt: QualificationOutputReceipt): void;
+export declare function attestQualificationPiJsonl(text: string, requested: {
+    provider: string;
+    model: string;
+}): QualificationArtifactAttestation;
+export declare function spawnQualificationCapture(command: string, argv: string[], options: {
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    timeout_ms: number;
+    output_limit_bytes: number;
+}): Promise<{
+    stdout: string;
+    stderr: string;
+    code: number | null;
+    timed_out: boolean;
+}>;

package/dist/qualification-capture.js

@@ -0,0 +1,163 @@
+import { spawn } from "node:child_process";
+import { closeSync, constants, fstatSync, fsyncSync, openSync, readFileSync, writeSync } from "node:fs";
+import { join } from "node:path";
+import { StringDecoder } from "node:string_decoder";
+import { redactText } from "./capture.js";
+import { qualificationSha256 } from "./qualification-config.js";
+export function redactQualificationOutput(text, secretValues = []) {
+    let output = text;
+    for (const secret of [...new Set(secretValues)].sort((left, right) => right.length - left.length)) {
+        if (secret.length >= 8)
+            output = output.split(secret).join("[REDACTED credential]");
+    }
+    output = output
+        .replace(/\b([A-Z][A-Z0-9_]*(?:API_KEY|ACCESS_KEY|SECRET_KEY|AUTH_TOKEN|BEARER_TOKEN|SESSION_TOKEN))\s*[:=]\s*[^\s,;"']+/gi, "$1=[REDACTED credential]")
+        .replace(/\bBearer\s+[A-Za-z0-9._~+\/-]{8,}/gi, "Bearer [REDACTED credential]")
+        .replace(/\b(?:sk|sess|key|token)-[A-Za-z0-9._-]{8,}/gi, "[REDACTED credential]")
+        .replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, "[REDACTED credential]");
+    return redactText(output);
+}
+export function openQualificationBoundedCapture(path, limit, redact) {
+    const fd = openSync(path, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 0o600);
+    const decoder = new StringDecoder("utf8");
+    let pending = "";
+    let acceptedRawBytes = 0;
+    let closed = false;
+    const persist = (text) => {
+        if (!text)
+            return;
+        const sanitized = Buffer.from(redact(text), "utf8");
+        const remaining = Math.max(0, limit - state.captured_bytes);
+        const part = sanitized.subarray(0, remaining);
+        if (part.length > 0) {
+            writeSync(fd, part);
+            state.captured_bytes += part.length;
+            fsyncSync(fd);
+        }
+        if (sanitized.length > remaining)
+            state.truncated = true;
+    };
+    const flushLines = () => {
+        let newline = pending.indexOf("\n");
+        while (newline >= 0) {
+            persist(pending.slice(0, newline + 1));
+            pending = pending.slice(newline + 1);
+            newline = pending.indexOf("\n");
+        }
+    };
+    const state = {
+        path, total_bytes: 0, captured_bytes: 0, truncated: false,
+        write(chunk) {
+            state.total_bytes += chunk.length;
+            const remainingRaw = Math.max(0, limit - acceptedRawBytes);
+            const accepted = chunk.subarray(0, remainingRaw);
+            acceptedRawBytes += accepted.length;
+            if (accepted.length > 0) {
+                pending += decoder.write(accepted);
+                flushLines();
+            }
+            if (chunk.length > remainingRaw)
+                state.truncated = true;
+        },
+        close() {
+            if (closed)
+                return;
+            pending += decoder.end();
+            // If the raw limit split a line, discard that incomplete tail rather than
+            // persisting a credential prefix that cannot be matched as a whole value.
+            if (!state.truncated)
+                persist(pending);
+            pending = "";
+            fsyncSync(fd);
+            closeSync(fd);
+            closed = true;
+        },
+    };
+    return state;
+}
+export function qualificationOutputReceipt(spoolRoot, path, capture) {
+    const bytes = readFileSync(path);
+    return {
+        path: path.slice(spoolRoot.length + 1),
+        total_bytes: capture.total_bytes,
+        captured_bytes: bytes.length,
+        truncated: capture.truncated,
+        sha256: qualificationSha256(bytes),
+    };
+}
+export function verifyQualificationOutputReceipt(spoolRoot, receipt) {
+    const path = join(spoolRoot, receipt.path);
+    let fd;
+    try {
+        fd = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+        const stat = fstatSync(fd);
+        if (!stat.isFile())
+            throw new Error(`qualification output ${receipt.path} must be a regular non-symlink file`);
+        const bytes = readFileSync(fd);
+        if (bytes.length !== receipt.captured_bytes || qualificationSha256(bytes) !== receipt.sha256) {
+            throw new Error(`qualification output ${receipt.path} digest/size mismatch`);
+        }
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
+export function attestQualificationPiJsonl(text, requested) {
+    const records = [];
+    try {
+        for (const line of text.split("\n")) {
+            if (!line.trim())
+                continue;
+            const value = JSON.parse(line);
+            if (!plainObject(value))
+                throw new Error("event is not an object");
+            records.push(value);
+        }
+    }
+    catch {
+        return { ok: false, actual: null, fallback: false, refused: false, error: "artifact is not valid JSONL" };
+    }
+    const fallback = records.some((record) => record.type === "provider_fallback" || record.type === "model_fallback" || Object.hasOwn(record, "fallback_provider") || Object.hasOwn(record, "fallback_model"));
+    const messages = records
+        .filter((record) => record.type === "message_end" && plainObject(record.message) && record.message.role === "assistant")
+        .map((record) => record.message);
+    if (messages.length === 0)
+        return { ok: false, actual: null, fallback, refused: false, error: "artifact has no authoritative assistant provider/model identity" };
+    const identities = messages.map((message) => ({ provider: stringValue(message.provider), model: stringValue(message.model) }));
+    if (identities.some((identity) => !identity.provider || !identity.model))
+        return { ok: false, actual: null, fallback, refused: false, error: "artifact assistant identity is missing provider or model" };
+    const actual = { provider: identities.at(-1).provider, model: identities.at(-1).model };
+    if (fallback)
+        return { ok: false, actual, fallback: true, refused: false, error: "artifact reports provider/model fallback" };
+    if (identities.some((identity) => identity.provider !== requested.provider))
+        return { ok: false, actual, fallback: false, refused: false, error: `provider substitution: requested ${requested.provider}, observed ${actual.provider}` };
+    if (identities.some((identity) => identity.model !== requested.model))
+        return { ok: false, actual, fallback: false, refused: false, error: `model substitution: requested ${requested.model}, observed ${actual.model}` };
+    const terminal = messages.at(-1);
+    const errorMessage = stringValue(terminal.errorMessage) ?? "";
+    const refused = terminal.stopReason === "error" && /(?:refus|not supported|not available|subscription|usage limit|unauthor)/i.test(errorMessage);
+    if (terminal.stopReason === "error" && !refused)
+        return { ok: false, actual, fallback: false, refused: false, error: errorMessage || "assistant ended with an error" };
+    return { ok: true, actual, fallback: false, refused, error: refused ? errorMessage : null };
+}
+export async function spawnQualificationCapture(command, argv, options) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, argv, { cwd: options.cwd, env: options.env, stdio: ["ignore", "pipe", "pipe"] });
+        let stdout = Buffer.alloc(0), stderr = Buffer.alloc(0), timedOut = false;
+        const append = (current, chunk) => Buffer.concat([current, chunk]).subarray(0, options.output_limit_bytes);
+        child.stdout.on("data", (chunk) => { stdout = append(stdout, chunk); });
+        child.stderr.on("data", (chunk) => { stderr = append(stderr, chunk); });
+        const timer = setTimeout(() => { timedOut = true; child.kill("SIGKILL"); }, options.timeout_ms);
+        child.once("error", (error) => { clearTimeout(timer); reject(error); });
+        child.once("close", (code) => { clearTimeout(timer); resolve({ stdout: stdout.toString("utf8"), stderr: stderr.toString("utf8"), code, timed_out: timedOut }); });
+    });
+}
+function plainObject(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+function stringValue(value) { return typeof value === "string" ? value : undefined; }
+//# sourceMappingURL=qualification-capture.js.map