@skill-harness/core 0.17.0 → 0.18.0

package/dist/adjudication.js

@@ -1,422 +0,0 @@
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { judgeRawPath, writeResults, scoreContextFor, findTranscriptFiles, repIndexOf, rebuildScenarioResult, mergeScenarioMetrics, effectiveThreshold, completeCriterionVotes, } from "./results.js";
-import { score } from "./score.js";
-import { buildJudgePrompt, judgeInWorkspace, parseVerdict } from "./grade.js";
-import { appendJournal } from "./journal.js";
-import { collapseVotePanel } from "./vote-panel.js";
-/** Maximum judgments per cell, first wave included. Hard cap, not a default. */
-export const MAX_JUDGMENTS = 3;
-/**
- * Classify triggers and compute the spend ceiling. Pure — calls nothing.
- *
- * Triggers are computed from the COMPLETE first wave, never incrementally. A
- * `ship_deciding` cell can only be identified once every other cell's verdict is
- * known, and computing it mid-wave would make the trigger set depend on the order
- * scenarios happened to finish in.
- */
-export function planAdjudication(input) {
-    const enabled = new Set(input.enabled ?? ["ambiguous", "contradictory", "non_unanimous", "ship_deciding"]);
-    const decisions = [];
-    for (const cell of input.cells) {
-        // Delivery-gated schema-3 cells carry no behavioral claim to adjudicate.
-        if (cell.deliveryStatus && cell.deliveryStatus !== "PASS")
-            continue;
-        const triggers = [];
-        // `JUDGE-AMBIGUOUS` is what the parser emits when a judge's verdict blocks
-        // disagree. `ERROR` is what it emits when nothing parsed at all — and that
-        // was matched by no trigger here, so the least readable judgments in the run
-        // were the ones never asked again. Both are "the first wave produced no
-        // usable answer", which is precisely what a second opinion is for.
-        if (enabled.has("ambiguous") && (cell.verdict === "JUDGE-AMBIGUOUS" || cell.verdict === "ERROR")) {
-            triggers.push("ambiguous");
-        }
-        // A misfire IS the contradiction: the overall verdict disagrees with the
-        // AND of the per-item grades. `detectMisfire` already found it; this is the
-        // decision about what to do with it.
-        if (enabled.has("contradictory") && cell.suspect && cell.verdict !== "JUDGE-AMBIGUOUS" && cell.verdict !== "ERROR") {
-            triggers.push("contradictory");
-        }
-        if (enabled.has("non_unanimous") && isNonUnanimous(cell))
-            triggers.push("non_unanimous");
-        if (enabled.has("ship_deciding") && flipsShipDecision(cell, input))
-            triggers.push("ship_deciding");
-        decisions.push({ id: cell.id, triggers });
-    }
-    const suspectById = new Map(input.cells.map((c) => [c.id, c.suspect]));
-    const fired = decisions.filter((d) => d.triggers.length > 0);
-    // A misfired first-wave judgment is not a clean vote, so with only one extra
-    // judge the cell can never reach the two clean votes a collapse needs. The call
-    // is still worth making — it records a second opinion for the author — but the
-    // buyer has to be told it cannot settle the verdict.
-    const needsTieBreak = input.tieBreakAvailable ? [] : fired.filter((d) => suspectById.get(d.id)).map((d) => d.id);
-    const triggered = fired.map((d) => d.id);
-    // Per triggered cell: one secondary call always, plus one tie-break call only
-    // if a third judge is available to make it.
-    const perCell = input.tieBreakAvailable ? 2 : 1;
-    return { decisions, triggered, needsTieBreak, maxAdditionalCalls: triggered.length * perCell };
-}
-/** A rep set containing both a PASS and a non-PASS is not a settled result. */
-function isNonUnanimous(cell) {
-    const reps = cell.repVerdicts ?? [];
-    if (reps.length < 2)
-        return false;
-    const passes = reps.filter((v) => v === "PASS").length;
-    return passes > 0 && passes < reps.length;
-}
-/**
- * Would flipping this one cell change SHIP / NOT READY?
- *
- * Counterfactual against the REAL scorer, not a reimplementation of the ship
- * rules. min-pass, critical and B-series all move the answer, and a second copy
- * of that logic would be a copy that drifts. Both directions are tested: a cell
- * that would break a shipping run and one that would rescue a blocked one are
- * equally worth a second opinion.
- */
-function flipsShipDecision(cell, input) {
-    // The target cell's `suspect` is cleared on BOTH sides. It has to be: a suspect
-    // cell blocks SHIP on its own, so leaving the flag on the baseline would make
-    // the two scores differ because of the flag rather than the verdict — and every
-    // suspect cell would report as ship-deciding. Clearing it on both sides asks the
-    // question actually being asked: holding everything else fixed, does THIS
-    // CELL'S VERDICT decide the ship?
-    const verdictsWith = (targetVerdict) => input.cells.map((c) => c.id === cell.id
-        ? { id: c.id, verdict: targetVerdict, suspect: false }
-        : { id: c.id, verdict: c.verdict, suspect: c.suspect });
-    const opts = { shipBar: input.shipBar, critical: input.critical };
-    const flipped = cell.verdict === "PASS" ? "FAIL" : "PASS";
-    return score(verdictsWith(cell.verdict), opts).ship !== score(verdictsWith(flipped), opts).ship;
-}
-/**
- * Collapse the judgments recorded for one cell.
- *
- * A judgment is a CLEAN vote only if it is a plain PASS or FAIL from a judge that
- * did not misfire. Ambiguous, suspect and unreadable judgments are recorded in
- * full but never counted — a malformed answer is not evidence, and letting one
- * cast a deciding vote would launder exactly the unreliability being measured.
- */
-export function collapseJudgments(judgments, trigger) {
-    const collapsed = collapseVotePanel(judgments);
-    return {
-        trigger,
-        judgments,
-        state: collapsed.state,
-        ...(collapsed.verdict ? { verdict: collapsed.verdict } : {}),
-    };
-}
-/**
- * Project an adjudication onto the compatibility fields the scorer reads.
- *
- * `unresolved` becomes `suspect: true`, which the existing ship bar already
- * blocks on. The raw judgments survive on the result either way — an author
- * resolving this needs to see what each judge actually said, not just the
- * collapsed answer.
- */
-export function boundAdjudicationToRepetitions(result, scenario, adj) {
-    const criticalAggregate = (result.reps ?? 1) > 1 && effectiveThreshold(result, scenario) === 1;
-    // A cell-level re-judge reads one transcript. It can confirm the aggregate,
-    // but cannot erase another clean repetition's failure.
-    return criticalAggregate && result.judge_verdict !== "PASS" && adj.verdict === "PASS"
-        ? { ...adj, state: "unresolved", verdict: undefined }
-        : adj;
-}
-export function projectAdjudication(result, adj) {
-    if (adj.state === "unresolved") {
-        return {
-            ...result,
-            // Verdict is left as recorded rather than forced to FAIL: `suspect` is what
-            // blocks the ship, and overwriting the verdict would destroy the
-            // first-wave answer an author needs in order to adjudicate.
-            judge_reason: `${adj.judgments.length} judgments disagree (${adj.trigger}) — resolve or re-judge`,
-            suspect: true,
-            adjudication: adj,
-        };
-    }
-    return {
-        ...result,
-        judge_verdict: adj.verdict ?? result.judge_verdict,
-        judge_reason: reasonFor(adj),
-        // A confirmed or tie-broken cell is no longer untrustworthy — that is the
-        // entire point of having asked again.
-        suspect: false,
-        adjudication: adj,
-    };
-}
-/** Apply the one-transcript bound and label it only when the bound changed the panel result. */
-export function projectAdjudicationForScenario(result, scenario, adj) {
-    const bounded = boundAdjudicationToRepetitions(result, scenario, adj);
-    const projected = projectAdjudication(result, bounded);
-    if (bounded !== adj) {
-        projected.judge_reason = `${adj.judgments.length} judgments on one transcript cannot replace a critical all-repetitions aggregate`;
-    }
-    return projected;
-}
-function reasonFor(adj) {
-    const n = adj.judgments.length;
-    const verb = adj.state === "confirmed" ? "confirmed by" : "resolved by majority of";
-    return `${adj.verdict} ${verb} ${n} judgments (${adj.trigger})`;
-}
-/**
- * Execute an adjudication plan.
- *
- * ONE implementation, called from `run`, `grade` and the review server's rejudge
- * path. The plan's three collapse policies were the most likely thing to be
- * reimplemented three times and to disagree — a cell that shipped from the CLI
- * and blocked in the browser would be worse than no feature.
- *
- * The tie-break call is made only when the secondary genuinely disagreed. A third
- * opinion on a settled cell is spend with no decision attached to it.
- */
-export async function runAdjudication(opts) {
-    const byId = new Map();
-    const log = opts.log ?? (() => { });
-    let callsMade = 0;
-    for (const decision of opts.plan.decisions) {
-        if (decision.triggers.length === 0)
-            continue;
-        const cell = opts.cells.find((c) => c.id === decision.id);
-        if (!cell)
-            continue;
-        // A cell can satisfy several triggers; the first is recorded as the reason,
-        // in the fixed order `planAdjudication` evaluates them.
-        const trigger = decision.triggers[0];
-        const judgments = [
-            cell.primaryJudgment
-                ? { ...cell.primaryJudgment, ordinal: 1 }
-                : { ordinal: 1, judge: { ...opts.primaryJudge }, verdict: cell.verdict, reason: cell.reason, suspect: cell.suspect, criteria: cell.criteria ?? [] },
-        ];
-        const second = await opts.rejudge(decision.id, opts.secondaryJudge);
-        callsMade++;
-        judgments.push({ ordinal: 2, judge: { ...opts.secondaryJudge }, ...second });
-        let collapsed = collapseJudgments(judgments, trigger);
-        if (collapsed.state === "unresolved" && opts.tieBreakJudge) {
-            const third = await opts.rejudge(decision.id, opts.tieBreakJudge);
-            callsMade++;
-            judgments.push({ ordinal: 3, judge: { ...opts.tieBreakJudge }, ...third });
-            collapsed = collapseJudgments(judgments, trigger);
-        }
-        log(`  ${decision.id}: ${collapsed.state}${collapsed.verdict ? ` → ${collapsed.verdict}` : ""} (${judgments.length} judgments)`);
-        byId.set(decision.id, collapsed);
-    }
-    return { byId, callsMade };
-}
-/**
- * Adjudicate a completed run: plan, disclose the ceiling, execute, persist.
- *
- * Re-judges the SAME saved transcripts — no subject re-run, so the model's
- * behavior is held fixed and any movement is the judge. That is what makes this
- * a measurement of judge reliability rather than another sample of the model.
- */
-export async function adjudicateRun(opts) {
-    const log = opts.log ?? (() => { });
-    const mode = opts.results.mode;
-    const cells = cellsFromResults(opts.runDir, opts.results);
-    const plan = planAdjudication({
-        cells,
-        scenarios: opts.spec.scenarios,
-        shipBar: opts.spec.ship_bar,
-        critical: opts.spec.critical,
-        tieBreakAvailable: opts.tieBreakJudge !== undefined,
-    });
-    // Disclosed before the first extra call, always — including the zero case, so
-    // "nothing triggered" is visibly different from "the feature did not run".
-    log(formatAdjudicationPlan(plan, { secondary: opts.secondaryJudge, tieBreak: opts.tieBreakJudge }));
-    if (plan.triggered.length === 0)
-        return opts.results;
-    const byIdScenario = new Map(opts.spec.scenarios.map((s) => [s.id, s]));
-    const { byId, callsMade } = await runAdjudication({
-        plan,
-        cells,
-        primaryJudge: opts.primaryJudge,
-        secondaryJudge: opts.secondaryJudge,
-        tieBreakJudge: opts.tieBreakJudge,
-        log,
-        rejudge: async (id, judge) => {
-            const scenario = byIdScenario.get(id);
-            if (!scenario)
-                throw new Error(`adjudication: scenario \`${id}\` is not in the spec`);
-            return judgeCell({ ...opts, scenario, judge, mode });
-        },
-    });
-    const scenarios = opts.results.scenarios.map((s) => {
-        const adj = byId.get(s.id);
-        // Adjudication asks judges again and re-measures nothing else, so the run's
-        // objective evidence carries. Overrides survive too — a judge panel does not
-        // outvote the author.
-        if (!adj)
-            return s;
-        const scenario = byIdScenario.get(s.id);
-        const withRepetition = { ...adj, repetition: s.rep_judgments?.[0]?.repetition ?? 0 };
-        const projected = scenario ? projectAdjudicationForScenario(s, scenario, withRepetition) : projectAdjudication(s, withRepetition);
-        const extraCalls = adj.judgments.filter((judgment) => judgment.ordinal > 1).length;
-        projected.metrics = mergeScenarioMetrics(s.metrics, {
-            wall_time_ms: 0,
-            judge_calls: extraCalls,
-            judge_rejudge_calls: extraCalls,
-            subject_metrics_reps: 0,
-            total_reps: s.metrics?.total_reps ?? s.reps ?? 1,
-        });
-        return rebuildScenarioResult(projected, s, { objective: "carry", adjudication: "fresh" });
-    });
-    appendJournal(opts.runDir, {
-        event: "adjudication",
-        ts: opts.now(),
-        triggered: plan.triggered,
-        judge_calls: callsMade,
-        unresolved: [...byId.entries()].filter(([, a]) => a.state === "unresolved").map(([id]) => id),
-    });
-    const ctx = scoreContextFor(opts.results, opts.spec);
-    return writeResults(opts.runDir, { ...opts.results, scenarios }, ctx);
-}
-/**
- * Ask one judge about one cell, reading the SAME saved transcript the first wave
- * was graded from.
- *
- * A multi-rep cell is adjudicated on its FIRST rep's transcript under one
- * documented policy, rather than whichever rep would move the headline. Picking
- * the convenient rep is how a "second opinion" becomes a way to get the answer
- * you wanted, which would make the whole feature worse than not having it.
- *
- * The extra judgment is written to `.judge2.txt` / `.judge3.txt`, leaving the
- * first-wave `.judge.txt` untouched — the audit trail is the point.
- */
-async function judgeCell(opts) {
-    const files = findTranscriptFiles(opts.runDir, opts.scenario.id, opts.mode);
-    if (files.length === 0) {
-        throw new Error(`adjudication: no ${opts.mode} transcript for \`${opts.scenario.id}\` in ${opts.runDir} — ` +
-            `transcripts are gitignored, so this needs the run dir that produced them`);
-    }
-    const transcript = readFileSync(join(opts.runDir, files[0]), "utf8");
-    const prompt = buildJudgePrompt({
-        skill: opts.spec.skill, persona: opts.spec.judge_persona, scenario: opts.scenario, transcript,
-    });
-    const g = await judgeInWorkspace(opts.adapter, opts.judge, prompt, opts.specDir);
-    // Ordinal 2 and 3 get their own artifacts; the first wave's stays as recorded.
-    const rep = repIndexOf(files[0]) ?? undefined;
-    const base = judgeRawPath(opts.runDir, opts.scenario.id, opts.mode, rep);
-    const nth = existsSync(base.replace(/\.judge\.txt$/, ".judge2.txt")) ? 3 : 2;
-    writeFileSync(base.replace(/\.judge\.txt$/, `.judge${nth}.txt`), g.raw, "utf8");
-    appendJournal(opts.runDir, {
-        event: "judge-verdict", ts: opts.now(), id: opts.scenario.id,
-        verdict: g.verdict, reason: g.reason, suspect: g.suspect,
-    });
-    return { verdict: g.verdict, reason: g.reason, suspect: g.suspect, criteria: completeCriterionVotes(g.criteria, opts.scenario.checklist.length) };
-}
-/**
- * Build the plan's input cells from a run.
- *
- * EXPORTED so the CLI, the review server and the pi extension all price the work
- * exactly as `adjudicateRun` will perform it. When the preflight built cells
- * without `repVerdicts` and the executor built them with, the browser could show
- * "no cell triggered" and then spend on non-unanimous cells nobody was told
- * about — inverting the one invariant this feature actually promises.
- */
-export function cellsFromResults(runDir, results) {
-    return results.scenarios.map((s) => {
-        const primaryJudgment = s.rep_judgments?.find(panel => panel.repetition === 0)?.judgments[0];
-        const deliveryStatus = s.objective?.assertions.find(assertion => assertion.kind === "skill_delivered")?.status;
-        return {
-            id: s.id,
-            verdict: s.judge_verdict,
-            reason: s.judge_reason,
-            suspect: s.suspect,
-            repVerdicts: repVerdictsOf(runDir, s, results.mode),
-            criteria: primaryJudgment?.criteria,
-            ...(deliveryStatus === "PASS" || deliveryStatus === "NOT-MEASURED" || deliveryStatus === "ERROR" ? { deliveryStatus } : {}),
-            ...(primaryJudgment ? { primaryJudgment } : {}),
-        };
-    });
-}
-/** Per-rep verdicts from saved judge artifacts, for the non-unanimous trigger. */
-function repVerdictsOf(runDir, s, mode) {
-    if (!s.reps || s.reps < 2)
-        return undefined;
-    const out = [];
-    // 0-based: `run.ts` writes rep0..repN-1. Looping from 1 dropped rep0 and probed
-    // a repN that never exists, so a 3-rep FAIL/PASS/PASS read as unanimous PASS and
-    // a 2-rep cell returned undefined — `non_unanimous` could never fire correctly.
-    for (let rep = 0; rep < s.reps; rep++) {
-        const path = judgeRawPath(runDir, s.id, mode, rep);
-        if (!existsSync(path)) {
-            // A rep with no judge artifact is an ABSENT vote, not a vote to skip.
-            // `run.ts` deliberately does not call the judge for a rep blocked by a gate
-            // or ending in ERROR — so the missing files are exactly the reps that
-            // failed hardest, and dropping them made `[FAIL, PASS, PASS]` read as
-            // `[PASS, PASS]`: unanimous. The cell whose split was caused by a forbidden
-            // tool call was the one cell adjudication declined to look at, and the
-            // preflight told the buyer "no cell triggered".
-            out.push("ERROR");
-            continue;
-        }
-        out.push(parseVerdict(readFileSync(path, "utf8")).verdict);
-    }
-    return out.length >= 2 ? out : undefined;
-}
-/**
- * Resolve and validate the extra judges.
- *
- * Every configured judge passes the SAME two gates the primary does: the metered
- * refusal and the judge≠subject check. A secondary judge is still a judge — a
- * feature that multiplies judge calls is the last place to let one slip past the
- * policy that exists because a default once billed a corpus by accident.
- *
- * Returns null when adjudication was not authorized, so callers can treat "not
- * enabled" and "enabled with no triggers" as different things.
- */
-export function resolveAdjudicationJudges(opts) {
-    if (!opts.enabled)
-        return null;
-    // An unreadable subject skips the resemblance warning rather than failing the
-    // run. The judge≠subject check is advice; the metered refusal below is the gate.
-    let subject = null;
-    try {
-        subject = opts.parseRef(opts.subjectToken);
-    }
-    catch {
-        opts.warn(`  ⚠ cannot read the run's model (\`${opts.subjectToken}\`) — skipping the judge≠subject check`);
-    }
-    // With no explicit secondary the primary judge is asked again as an independent
-    // draw. That is a real measurement — the judge-variance study found a ~2%
-    // disagreement rate on identical transcripts — not a no-op.
-    const secondary = opts.secondaryToken ? opts.parseRef(opts.secondaryToken) : opts.primary;
-    const tieBreak = opts.tieBreakToken ? opts.parseRef(opts.tieBreakToken) : undefined;
-    opts.assertAllowed(secondary, "--secondary-judge");
-    if (tieBreak)
-        opts.assertAllowed(tieBreak, "--tie-break-judge");
-    if (subject) {
-        for (const [label, judge] of [["secondary", secondary], ["tie-break", tieBreak]]) {
-            if (judge && opts.resemblesSubject(judge, subject)) {
-                opts.warn(`  ⚠ ${label} judge (${judge.provider}:${judge.model}) resembles the model under test ` +
-                    `(${subject.provider}:${subject.model}) — same-family grading inflates scores.`);
-            }
-        }
-    }
-    return tieBreak ? { secondary, tieBreak } : { secondary };
-}
-/** Human-readable preflight line. Counts, never dollars — see `maxAdditionalCalls`. */
-export function formatAdjudicationPlan(plan, judges) {
-    const stuck = plan.needsTieBreak.length
-        ? [
-            `  ${plan.needsTieBreak.length} of those cannot be SETTLED by this plan: ${plan.needsTieBreak.join(", ")}`,
-            "    (their first judgment misfired, so one more judge cannot reach two clean votes — the call",
-            "     buys a second opinion to resolve by hand; add a tie-break judge to settle them outright)",
-        ]
-        : [];
-    if (plan.triggered.length === 0) {
-        return ["adjudication: no cell triggered — no additional judge calls", ...stuck].join("\n");
-    }
-    const lines = [
-        `adjudication: ${plan.triggered.length} cell(s) triggered — up to ${plan.maxAdditionalCalls} additional judge call(s)`,
-        `  secondary judge: ${judges.secondary.provider}:${judges.secondary.model}`,
-    ];
-    if (judges.tieBreak)
-        lines.push(`  tie-break judge: ${judges.tieBreak.provider}:${judges.tieBreak.model}`);
-    else
-        lines.push("  no tie-break judge — a disagreement stays unresolved and blocks SHIP");
-    for (const d of plan.decisions) {
-        if (d.triggers.length)
-            lines.push(`  ${d.id}: ${d.triggers.join(", ")}`);
-    }
-    return [...lines, ...stuck].join("\n");
-}
-//# sourceMappingURL=adjudication.js.map

package/dist/adoption.d.ts

@@ -1,128 +0,0 @@
-export interface AdoptionInput {
-    hypothesisDigest: string;
-    experimentDigest: string;
-    candidateDigest: string;
-    scopeDigest: string;
-    assessmentPolicyDigest: string;
-    rollbackCandidateDigest: string;
-    activationBoundary: "next-orders";
-    expiresAt: number;
-}
-export interface AdoptionBinding extends AdoptionInput {
-    version: "adoption-binding-v1";
-    id: string;
-}
-export interface AdoptionAuthority {
-    id: string;
-    adoptions: readonly string[];
-    rollbacks: readonly string[];
-}
-export interface AdoptionFacts {
-    experimentDigest: string;
-    candidateDigest: string;
-    scopeDigest: string;
-    assessmentPolicyDigest: string;
-    eligible: boolean;
-}
-export declare function buildAdoptionBinding(input: AdoptionInput): AdoptionBinding;
-/** Independent host declarations and independently verified eligible facts are required again at use. */
-export declare function authorizeAdoption(binding: AdoptionBinding, authority: AdoptionAuthority | null, facts: AdoptionFacts, now: number): Readonly<{
-    id: string;
-    version: "adoption-receipt-v1";
-    bindingId: string;
-    authorityId: string;
-    hypothesisDigest: string;
-    experimentDigest: string;
-    candidateDigest: string;
-    scopeDigest: string;
-    assessmentPolicyDigest: string;
-    rollbackCandidateDigest: string;
-    activationBoundary: "next-orders";
-    grantExpansion: false;
-    expiresAt: number;
-}>;
-export type AdoptionReceipt = ReturnType<typeof authorizeAdoption>;
-export declare function validateAdoptionReceipt(receipt: AdoptionReceipt, binding: AdoptionBinding, authority: AdoptionAuthority | null, facts: AdoptionFacts, now: number): void;
-export interface ProductionObservation {
-    id: string;
-    adoptionId: string;
-    candidateDigest: string;
-    scopeDigest: string;
-    originalRequirementDigest: string;
-    currentRequirementDigest: string;
-    /** Only an independent host may supply confirmed outcomes; observer/model claims are not confirmation. */
-    outcome: "confirmed-defect" | "success" | "unknown";
-    acceptanceDigest: string | null;
-    acceptedArtifactDigest: string | null;
-    observedArtifactDigest: string;
-    evidence: string[];
-}
-export declare function classifyProductionObservation(adoption: AdoptionReceipt, input: ProductionObservation): Readonly<{
-    state: "unknown" | "success" | "out-of-scope" | "changed-requirements" | "changed-artifact" | "caught-defect" | "escape";
-    adoptionId: string;
-    hypothesisDigest: string;
-    experimentDigest: string;
-    observationId: string;
-    acceptanceDigest: string | null;
-    acceptedArtifactDigest: string | null;
-    observedArtifactDigest: string;
-    automaticRollback: false;
-}>;
-export interface RollbackRequest {
-    version: "rollback-request-v1";
-    id: string;
-    adoptionId: string;
-    scopeDigest: string;
-    restoreCandidateDigest: string;
-    reason: "operator-request" | "confirmed-escape";
-    evidence: readonly string[];
-    expiresAt: number;
-}
-export declare function buildRollbackRequest(adoption: AdoptionReceipt, reason: RollbackRequest["reason"], evidence: string[], expiresAt?: number): RollbackRequest;
-/** This validates a recorded choice, not an automatic rollback action or a caller-created authority flag. */
-export declare function authorizeRollback(adoption: AdoptionReceipt, request: RollbackRequest, authority: AdoptionAuthority | null, now: number, current: {
-    adoptionId: string;
-    candidateDigest: string;
-    scopeDigest: string;
-}): Readonly<{
-    requestId: string;
-    adoptionId: string;
-    restoreCandidateDigest: string;
-    scopeDigest: string;
-    grantExpansion: false;
-    application: "not-performed";
-}>;
-export interface LeanOutcome {
-    population: string;
-    complete: boolean;
-    accepted: boolean | null;
-    repairAttempts: number | null;
-    escape: "confirmed" | "none-observed" | "unknown";
-    requirementsChanged: boolean;
-    decisionWaitMs: number | null;
-    questions: number | null;
-}
-export declare function summarizeLeanOutcomes(population: string, rows: readonly LeanOutcome[]): {
-    population: string;
-    firstPassAccepted: number;
-    firstPassDenominator: number;
-    incomplete: number;
-    confirmedEscapes: number;
-    changedRequirements: number;
-    recovery: {
-        known: number;
-        observed: number;
-        total: number;
-    };
-    decisionWait: {
-        known: number;
-        observed: number;
-        total: number;
-    };
-    questions: {
-        known: number;
-        observed: number;
-        total: number;
-    };
-    universalScore: null;
-};

package/dist/adoption.js

@@ -1,102 +0,0 @@
-import { createHash } from "node:crypto";
-const SHA = /^[a-f0-9]{64}$/;
-const text = (x) => typeof x === "string" && x.length > 0 && x.length <= 512 && !/[\u0000-\u001f\u007f]/.test(x);
-const closed = (value, names) => {
-    if (!value || ![Object.prototype, null].includes(Object.getPrototypeOf(value)))
-        return false;
-    const fields = Object.getOwnPropertyDescriptors(value);
-    return Reflect.ownKeys(fields).length === names.length && Reflect.ownKeys(fields).every(key => typeof key === "string" && names.includes(key) && fields[key].enumerable && Object.hasOwn(fields[key], "value"));
-};
-const hash = (value) => createHash("sha256").update(JSON.stringify(Object.keys(value).sort().map(k => [k, value[k]]))).digest("hex");
-export function buildAdoptionBinding(input) {
-    if (!input || !closed(input, ["hypothesisDigest", "experimentDigest", "candidateDigest", "scopeDigest", "assessmentPolicyDigest", "rollbackCandidateDigest", "activationBoundary", "expiresAt"])
-        || ![input.hypothesisDigest, input.experimentDigest, input.candidateDigest, input.scopeDigest, input.assessmentPolicyDigest, input.rollbackCandidateDigest].every(s => typeof s === "string" && SHA.test(s))
-        || input.activationBoundary !== "next-orders" || !Number.isSafeInteger(input.expiresAt) || input.expiresAt < 0)
-        throw new Error("invalid scoped adoption binding");
-    const body = { version: "adoption-binding-v1", ...input };
-    return Object.freeze({ ...body, id: hash(body) });
-}
-function bindingValid(binding) {
-    const { version, id, ...input } = binding;
-    if (version !== "adoption-binding-v1" || buildAdoptionBinding(input).id !== id)
-        throw new Error("adoption binding changed");
-}
-function authorityValid(authority) {
-    return !!authority && text(authority.id) && Array.isArray(authority.adoptions) && Array.isArray(authority.rollbacks)
-        && authority.adoptions.length <= 256 && authority.rollbacks.length <= 256 && [...authority.adoptions, ...authority.rollbacks].every(id => typeof id === "string" && SHA.test(id));
-}
-/** Independent host declarations and independently verified eligible facts are required again at use. */
-export function authorizeAdoption(binding, authority, facts, now) {
-    bindingValid(binding);
-    if (!authorityValid(authority) || !authority.adoptions.includes(binding.id))
-        throw new Error("independent adoption authority required");
-    if (!Number.isSafeInteger(now) || now < 0 || now >= binding.expiresAt || !facts || !closed(facts, ["experimentDigest", "candidateDigest", "scopeDigest", "assessmentPolicyDigest", "eligible"]) || facts.eligible !== true
-        || facts.experimentDigest !== binding.experimentDigest || facts.candidateDigest !== binding.candidateDigest
-        || facts.scopeDigest !== binding.scopeDigest || facts.assessmentPolicyDigest !== binding.assessmentPolicyDigest)
-        throw new Error("adoption expired, ineligible or outside verified scope");
-    const body = { version: "adoption-receipt-v1", bindingId: binding.id, authorityId: authority.id, hypothesisDigest: binding.hypothesisDigest,
-        experimentDigest: binding.experimentDigest, candidateDigest: binding.candidateDigest, scopeDigest: binding.scopeDigest,
-        assessmentPolicyDigest: binding.assessmentPolicyDigest, rollbackCandidateDigest: binding.rollbackCandidateDigest,
-        activationBoundary: "next-orders", grantExpansion: false, expiresAt: binding.expiresAt };
-    return Object.freeze({ ...body, id: hash(body) });
-}
-export function validateAdoptionReceipt(receipt, binding, authority, facts, now) {
-    if (authorizeAdoption(binding, authority, facts, now).id !== receipt.id)
-        throw new Error("adoption receipt does not match current independent authority/facts");
-    receiptValid(receipt);
-}
-function receiptValid(receipt) {
-    const { id, ...body } = receipt;
-    if (!closed(receipt, ["version", "bindingId", "authorityId", "hypothesisDigest", "experimentDigest", "candidateDigest", "scopeDigest", "assessmentPolicyDigest", "rollbackCandidateDigest", "activationBoundary", "grantExpansion", "expiresAt", "id"])
-        || body.version !== "adoption-receipt-v1" || !text(body.authorityId) || body.activationBoundary !== "next-orders" || body.grantExpansion !== false || hash(body) !== id)
-        throw new Error("adoption receipt changed");
-    const binding = buildAdoptionBinding({ hypothesisDigest: body.hypothesisDigest, experimentDigest: body.experimentDigest, candidateDigest: body.candidateDigest,
-        scopeDigest: body.scopeDigest, assessmentPolicyDigest: body.assessmentPolicyDigest, rollbackCandidateDigest: body.rollbackCandidateDigest, activationBoundary: body.activationBoundary, expiresAt: body.expiresAt });
-    if (binding.id !== body.bindingId)
-        throw new Error("adoption receipt binding mismatch");
-}
-export function classifyProductionObservation(adoption, input) {
-    receiptValid(adoption);
-    if (!input || !text(input.id) || input.evidence.length > 256 || input.evidence.some(h => !SHA.test(h))
-        || ![input.originalRequirementDigest, input.currentRequirementDigest, input.candidateDigest, input.scopeDigest, input.observedArtifactDigest].every(h => typeof h === "string" && SHA.test(h))
-        || ![input.acceptanceDigest, input.acceptedArtifactDigest].every(h => h === null || (typeof h === "string" && SHA.test(h)))
-        || (input.acceptanceDigest === null) !== (input.acceptedArtifactDigest === null)
-        || !["confirmed-defect", "success", "unknown"].includes(input.outcome))
-        throw new Error("invalid production observation");
-    const state = input.adoptionId !== adoption.id || input.candidateDigest !== adoption.candidateDigest || input.scopeDigest !== adoption.scopeDigest ? "out-of-scope"
-        : input.originalRequirementDigest !== input.currentRequirementDigest ? "changed-requirements"
-            : input.acceptedArtifactDigest !== null && input.acceptedArtifactDigest !== input.observedArtifactDigest ? "changed-artifact"
-                : input.outcome === "confirmed-defect" && input.evidence.length ? input.acceptanceDigest === null ? "caught-defect" : "escape" : input.outcome === "success" ? "success" : "unknown";
-    return Object.freeze({ state, adoptionId: adoption.id, hypothesisDigest: adoption.hypothesisDigest, experimentDigest: adoption.experimentDigest, observationId: input.id, acceptanceDigest: input.acceptanceDigest, acceptedArtifactDigest: input.acceptedArtifactDigest, observedArtifactDigest: input.observedArtifactDigest, automaticRollback: false });
-}
-export function buildRollbackRequest(adoption, reason, evidence, expiresAt = adoption.expiresAt) {
-    receiptValid(adoption);
-    if (!Number.isSafeInteger(expiresAt) || expiresAt < 0 || !["operator-request", "confirmed-escape"].includes(reason) || !evidence.length || evidence.length > 256 || evidence.some(h => !SHA.test(h)))
-        throw new Error("invalid rollback request");
-    const body = { version: "rollback-request-v1", adoptionId: adoption.id, scopeDigest: adoption.scopeDigest, restoreCandidateDigest: adoption.rollbackCandidateDigest, reason, expiresAt, evidence: Object.freeze([...new Set(evidence)].sort()) };
-    return Object.freeze({ ...body, id: hash(body) });
-}
-/** This validates a recorded choice, not an automatic rollback action or a caller-created authority flag. */
-export function authorizeRollback(adoption, request, authority, now, current) {
-    receiptValid(adoption);
-    const { id, ...body } = request;
-    if (!authorityValid(authority) || authority.id !== adoption.authorityId || !authority.rollbacks.includes(id))
-        throw new Error("independent rollback authority required");
-    if (hash(body) !== id || request.version !== "rollback-request-v1" || request.adoptionId !== adoption.id || request.scopeDigest !== adoption.scopeDigest
-        || request.restoreCandidateDigest !== adoption.rollbackCandidateDigest || !Number.isSafeInteger(now) || now < 0 || !Number.isSafeInteger(request.expiresAt) || now >= request.expiresAt
-        || !current || current.adoptionId !== adoption.id || current.candidateDigest !== adoption.candidateDigest || current.scopeDigest !== adoption.scopeDigest)
-        throw new Error("rollback binding changed or expired");
-    return Object.freeze({ requestId: id, adoptionId: adoption.id, restoreCandidateDigest: request.restoreCandidateDigest, scopeDigest: adoption.scopeDigest, grantExpansion: false, application: "not-performed" });
-}
-export function summarizeLeanOutcomes(population, rows) {
-    if (!text(population) || rows.length > 10000 || rows.some(r => r.population !== population || typeof r.complete !== "boolean" || typeof r.requirementsChanged !== "boolean"
-        || ![true, false, null].includes(r.accepted) || !["confirmed", "none-observed", "unknown"].includes(r.escape)
-        || [r.repairAttempts, r.decisionWaitMs, r.questions].some(n => n !== null && (!Number.isSafeInteger(n) || n < 0))))
-        throw new Error("invalid or incomparable lean population");
-    const complete = rows.filter(r => r.complete && r.accepted !== null && r.repairAttempts !== null);
-    const observed = (field) => ({ known: rows.reduce((n, r) => n + (r[field] ?? 0), 0), observed: rows.filter(r => r[field] !== null).length, total: rows.length });
-    return { population, firstPassAccepted: complete.filter(r => r.accepted && r.repairAttempts === 0).length, firstPassDenominator: complete.length,
-        incomplete: rows.length - complete.length, confirmedEscapes: rows.filter(r => r.escape === "confirmed" && !r.requirementsChanged).length,
-        changedRequirements: rows.filter(r => r.requirementsChanged).length, recovery: observed("repairAttempts"), decisionWait: observed("decisionWaitMs"), questions: observed("questions"), universalScore: null };
-}
-//# sourceMappingURL=adoption.js.map