@tangle-network/agent-eval 0.108.1 → 0.110.0

package/dist/chunk-K7QEIHHJ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/action-policy.ts","../src/run-evidence.ts","../src/propose-review.ts","../src/propose-review-control.ts"],"sourcesContent":["import type { FeedbackLabel, ProposedSideEffect } from './feedback-trajectory'\n\nexport interface ActionExecutionPolicy {\n  allowedTypes?: string[]\n  blockedTypes?: string[]\n  alwaysRequireApprovalTypes?: string[]\n  autoApproveTypes?: string[]\n  requireApprovalForExternalSideEffects?: boolean\n  requireApprovalAboveCostUsd?: number\n  maxActionCostUsd?: number\n  remainingBudgetUsd?: number\n  expectedOutcomeRequired?: boolean\n  killCriteriaRequired?: boolean\n}\n\nexport interface ActionPolicyDecision {\n  allowed: boolean\n  blocked: boolean\n  requiresApproval: boolean\n  reasons: string[]\n  label?: FeedbackLabel\n}\n\nexport function evaluateActionPolicy(\n  action: ProposedSideEffect,\n  policy: ActionExecutionPolicy = {},\n  options: { createdAt?: string } = {},\n): ActionPolicyDecision {\n  const reasons: string[] = []\n  let blocked = false\n  let requiresApproval = Boolean(action.requiresApproval)\n\n  if (policy.allowedTypes?.length && !policy.allowedTypes.includes(action.type)) {\n    blocked = true\n    reasons.push(`action type \"${action.type}\" is not allowed`)\n  }\n  if (policy.blockedTypes?.includes(action.type)) {\n    blocked = true\n    reasons.push(`action type \"${action.type}\" is blocked`)\n  }\n  if (policy.alwaysRequireApprovalTypes?.includes(action.type)) {\n    requiresApproval = true\n    reasons.push(`action type \"${action.type}\" requires approval`)\n  }\n  if (policy.requireApprovalForExternalSideEffects && action.externalSideEffect) {\n    requiresApproval = true\n    reasons.push('external side effect requires approval')\n  }\n  if (\n    policy.requireApprovalAboveCostUsd !== undefined &&\n    (action.costUsd ?? 0) > policy.requireApprovalAboveCostUsd\n  ) {\n    requiresApproval = true\n    reasons.push(\n      `cost ${action.costUsd} exceeds approval threshold ${policy.requireApprovalAboveCostUsd}`,\n    )\n  }\n  if (policy.maxActionCostUsd !== undefined && (action.costUsd ?? 0) > policy.maxActionCostUsd) {\n    blocked = true\n    reasons.push(`cost ${action.costUsd} exceeds max action cost ${policy.maxActionCostUsd}`)\n  }\n  if (\n    policy.remainingBudgetUsd !== undefined &&\n    (action.costUsd ?? 0) > policy.remainingBudgetUsd\n  ) {\n    blocked = true\n    reasons.push(`cost ${action.costUsd} exceeds remaining budget ${policy.remainingBudgetUsd}`)\n  }\n  if (policy.expectedOutcomeRequired && !action.metadata?.expectedOutcome) {\n    blocked = true\n    reasons.push('expected outcome is required')\n  }\n  if (policy.killCriteriaRequired && !action.metadata?.killCriteria) {\n    blocked = true\n    reasons.push('kill criteria are required')\n  }\n  if (policy.autoApproveTypes?.includes(action.type) && requiresApproval) {\n    reasons.push(\n      `action type \"${action.type}\" is auto-approved only when no approval policy applies`,\n    )\n  }\n\n  if (!reasons.length) reasons.push(requiresApproval ? 'approval required' : 'action allowed')\n\n  const label =\n    blocked || requiresApproval\n      ? {\n          source: 'policy' as const,\n          kind: blocked ? ('policy_block' as const) : ('comment' as const),\n          value: { actionType: action.type, blocked, requiresApproval },\n          reason: reasons.join('; '),\n          severity: blocked ? ('critical' as const) : ('warning' as const),\n          createdAt: options.createdAt ?? new Date().toISOString(),\n          metadata: { action, policy },\n        }\n      : undefined\n\n  return {\n    allowed: !blocked,\n    blocked,\n    requiresApproval: !blocked && requiresApproval,\n    reasons,\n    label,\n  }\n}\n","import type { ControlEvalResult, ControlRunResult } from './control-runtime'\nimport {\n  type RunRecord,\n  type RunSplitTag,\n  type RunTokenUsage,\n  validateRunRecord,\n} from './run-record'\nimport type { FailureClass } from './trace/schema'\n\nexport interface RunEvidenceMetadata {\n  experimentId: string\n  candidateId: string\n  seed: number\n  model: string\n  promptHash: string\n  configHash: string\n  commitSha: string\n  splitTag: RunSplitTag\n  tokenUsage: RunTokenUsage\n  queueMs?: number\n  judgeMetadata?: RunRecord['judgeMetadata']\n  raw?: Record<string, number>\n}\n\nexport interface ControlRunToRunRecordOptions extends RunEvidenceMetadata {\n  runId?: string\n  score?: number\n  failureMode?: string\n}\n\n/**\n * Project a completed control-loop run into the strict RunRecord shape used by\n * release gates, optimizer tables, and research reports.\n *\n * The control loop owns live execution evidence. The caller still supplies the\n * experiment-cell metadata because prompt/config hashes, split assignment,\n * model snapshot, and commit SHA are product/harness concerns.\n */\nexport function controlRunToRunRecord<\n  TState,\n  TAction,\n  TActionResult,\n  TEval extends ControlEvalResult = ControlEvalResult,\n>(\n  run: ControlRunResult<TState, TAction, TActionResult, TEval>,\n  options: ControlRunToRunRecordOptions,\n): RunRecord {\n  const score = clampScore(\n    options.score ?? run.score ?? scoreFromEvals(run.finalEvals) ?? (run.pass ? 1 : 0),\n  )\n  const outcome =\n    options.splitTag === 'holdout'\n      ? { holdoutScore: score, raw: normalizeRawMetrics(options.raw, run, score) }\n      : { searchScore: score, raw: normalizeRawMetrics(options.raw, run, score) }\n\n  return validateRunRecord({\n    runId:\n      options.runId ??\n      run.runId ??\n      `control:${options.experimentId}:${options.candidateId}:${options.seed}:${options.splitTag}`,\n    experimentId: options.experimentId,\n    candidateId: options.candidateId,\n    seed: options.seed,\n    model: options.model,\n    promptHash: options.promptHash,\n    configHash: options.configHash,\n    commitSha: options.commitSha,\n    wallMs: run.wallMs,\n    ...(options.queueMs !== undefined ? { queueMs: options.queueMs } : {}),\n    costUsd: run.spentCostUsd,\n    tokenUsage: options.tokenUsage,\n    ...(options.judgeMetadata ? { judgeMetadata: options.judgeMetadata } : {}),\n    outcome,\n    failureMode: options.failureMode ?? failureModeFromRun(run),\n    splitTag: options.splitTag,\n  })\n}\n\nexport function scoreFromEvals(evals: readonly ControlEvalResult[]): number | undefined {\n  const scores = evals\n    .map((e) => e.score)\n    .filter((score): score is number => typeof score === 'number' && Number.isFinite(score))\n  if (scores.length === 0) return undefined\n  return clampScore(scores.reduce((sum, score) => sum + score, 0) / scores.length)\n}\n\nfunction normalizeRawMetrics<TState, TAction, TActionResult, TEval extends ControlEvalResult>(\n  raw: Record<string, number> | undefined,\n  run: ControlRunResult<TState, TAction, TActionResult, TEval>,\n  score: number,\n): Record<string, number> {\n  return {\n    ...finiteOnly(raw ?? {}),\n    score,\n    pass: run.pass ? 1 : 0,\n    completed: run.completed ? 1 : 0,\n    steps: run.steps.length,\n    runtimeErrors: run.runtimeErrors.length,\n  }\n}\n\nfunction finiteOnly(values: Record<string, number>): Record<string, number> {\n  const out: Record<string, number> = {}\n  for (const [key, value] of Object.entries(values)) {\n    if (Number.isFinite(value)) out[key] = value\n  }\n  return out\n}\n\nfunction failureModeFromRun<TState, TAction, TActionResult, TEval extends ControlEvalResult>(\n  run: ControlRunResult<TState, TAction, TActionResult, TEval>,\n): FailureClass | undefined {\n  if (run.pass) return undefined\n  return run.failureClass ?? 'unknown'\n}\n\nfunction clampScore(value: number): number {\n  if (!Number.isFinite(value)) return 0\n  return Math.max(0, Math.min(1, value))\n}\n","/**\n * Propose / Verify / Review — the core multi-shot primitive.\n *\n *   shot N:  propose(state, priorReview) → new state\n *            verify(state)               → pass/fail, optional layers\n *            review(state, verification, memory) → observations + next-shot\n *                                                   instruction + shouldContinue\n *            memory.append(entry)\n *\n * Roles are strictly separated:\n *\n *   - The WORKER is whatever the caller wraps in `propose`. It is\n *     stateful — caller owns its resume/session mechanism.\n *   - The VERIFIER grades the state. It produces the ground truth.\n *     The reviewer cannot overturn or downgrade a verification layer.\n *   - The REVIEWER is stateless per call. Its continuity is the\n *     `ReviewMemoryStore` — durable JSONL by default, or any store\n *     implementing the interface. It reads memory + trace summary +\n *     verification and directs the NEXT proposer shot.\n *\n * This shape is load-bearing. The reviewer never grades; the verifier\n * never directs. Two processes, two prompts, two concerns — which is\n * what keeps the loop from confirmation-biasing itself into \"all\n * passed\" when it didn't.\n *\n * Short-circuits and soft-fails are both first-class:\n *   - verify.pass === true  → reviewer LLM call is skipped, memory\n *     records a success entry, loop exits.\n *   - review throws         → the shot still counts; the loop uses the\n *     last-known instruction (or `fallbackInstruction`) for the next\n *     propose call. A transient reviewer failure must NEVER abort a\n *     valid arc.\n *\n * Composable: `propose` itself can be another `runProposeReview` call.\n * That's the dogfooding path — a harness built on this primitive is in\n * turn evaluable by it.\n */\n\nimport { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs'\nimport { dirname } from 'node:path'\nimport { type SpanHandle, TraceEmitter } from './trace/emitter'\nimport type { FailureClass } from './trace/schema'\nimport type { TraceStore } from './trace/store'\n\n// ── Types ────────────────────────────────────────────────────────────\n\nexport interface Verification {\n  pass: boolean\n  score?: number\n  failingLayers?: string[]\n  details?: unknown\n}\n\nexport interface Review {\n  observations: string\n  diagnosis: string\n  nextShotInstruction: string\n  shouldContinue: boolean\n  confidence: number\n}\n\nexport interface ReviewMemoryEntry extends Review {\n  shot: number\n  timestamp: number\n  verification: {\n    pass: boolean\n    score?: number\n    failingLayers?: string[]\n  }\n}\n\nexport interface ProposeInput<State> {\n  shot: number\n  goal: string\n  state: State\n  priorReview: Review | null\n  abortSignal: AbortSignal\n  emitter?: TraceEmitter\n}\n\nexport interface ProposeOutput<State, Summary = unknown> {\n  state: State\n  traceSummary?: Summary\n}\n\nexport interface ReviewInput<State, Summary = unknown> {\n  shot: number\n  goal: string\n  state: State\n  verification: Verification\n  traceSummary: Summary | undefined\n  memory: ReviewMemoryEntry[]\n}\n\nexport type ProposeFn<State, Summary = unknown> = (\n  input: ProposeInput<State>,\n) => Promise<ProposeOutput<State, Summary>>\n\nexport type VerifyFn<State> = (state: State) => Promise<Verification>\n\nexport type ReviewFn<State, Summary = unknown> = (\n  input: ReviewInput<State, Summary>,\n) => Promise<Review>\n\nexport interface ReviewMemoryStore {\n  load(): Promise<ReviewMemoryEntry[]>\n  append(entry: ReviewMemoryEntry): Promise<void>\n}\n\nexport interface ProposeReviewConfig<State, Summary = unknown> {\n  goal: string\n  initialState: State\n  propose: ProposeFn<State, Summary>\n  verify: VerifyFn<State>\n  review: ReviewFn<State, Summary>\n  /** Hard shot cap. Default 10. */\n  maxShots?: number\n  /** Wall-clock cap in ms. Default 10 min. */\n  maxWallMs?: number\n  /**\n   * If the reviewer returns confidence ≤ floor on `confidenceFloorWindow`\n   * consecutive shots, terminate early. Default floor 0.3, window 2.\n   * Set window to 0 or floor to <0 to disable.\n   */\n  confidenceFloor?: number\n  confidenceFloorWindow?: number\n  /** Defaults to an in-memory store if omitted. */\n  memory?: ReviewMemoryStore\n  /** If provided, emit a Run + per-shot spans. */\n  store?: TraceStore\n  scenarioId?: string\n  projectId?: string\n  variantId?: string\n  /**\n   * Used when the reviewer soft-fails on shot 1 (no prior instruction to\n   * fall back to). Default is a generic \"inspect failures and fix\".\n   */\n  fallbackInstruction?: string\n}\n\nexport interface ProposeReviewShot<State, Summary = unknown> {\n  shot: number\n  state: State\n  verification: Verification\n  traceSummary: Summary | undefined\n  review: Review\n  reviewAvailable: boolean\n  reviewError?: string\n  durationMs: number\n}\n\nexport interface ProposeReviewReport<State, Summary = unknown> {\n  runId: string | null\n  completed: boolean\n  shots: ProposeReviewShot<State, Summary>[]\n  finalState: State\n  finalVerification: Verification\n  failureClass?: FailureClass\n  wallMs: number\n  score: number\n}\n\n// ── Memory stores ────────────────────────────────────────────────────\n\nexport function inMemoryReviewStore(initial: ReviewMemoryEntry[] = []): ReviewMemoryStore {\n  const entries: ReviewMemoryEntry[] = [...initial]\n  return {\n    async load() {\n      return [...entries]\n    },\n    async append(entry) {\n      entries.push(entry)\n    },\n  }\n}\n\nexport function jsonlReviewStore(path: string): ReviewMemoryStore {\n  return {\n    async load() {\n      if (!existsSync(path)) return []\n      const raw = readFileSync(path, 'utf8')\n      const out: ReviewMemoryEntry[] = []\n      for (const line of raw.split('\\n')) {\n        const trimmed = line.trim()\n        if (!trimmed) continue\n        try {\n          out.push(JSON.parse(trimmed) as ReviewMemoryEntry)\n        } catch {\n          // A corrupt line is an observability problem, not a correctness\n          // one — skip it rather than aborting the loop.\n        }\n      }\n      return out\n    },\n    async append(entry) {\n      mkdirSync(dirname(path), { recursive: true })\n      appendFileSync(path, `${JSON.stringify(entry)}\\n`)\n    },\n  }\n}\n\n// ── Core loop ────────────────────────────────────────────────────────\n\nconst DEFAULT_FALLBACK_INSTRUCTION =\n  'Inspect the verification failures above. Fix the critical issues first, then the major ones. Do not restate the failures — act on them.'\n\nexport async function runProposeReview<State, Summary = unknown>(\n  config: ProposeReviewConfig<State, Summary>,\n): Promise<ProposeReviewReport<State, Summary>> {\n  const maxShots = config.maxShots ?? 10\n  const maxWallMs = config.maxWallMs ?? 10 * 60 * 1000\n  const confidenceFloor = config.confidenceFloor ?? 0.3\n  const confidenceFloorWindow = config.confidenceFloorWindow ?? 2\n  const memory = config.memory ?? inMemoryReviewStore()\n  const fallbackInstruction = config.fallbackInstruction ?? DEFAULT_FALLBACK_INSTRUCTION\n\n  const emitter = config.store ? new TraceEmitter(config.store) : null\n  if (emitter) {\n    await emitter.startRun({\n      scenarioId: config.scenarioId ?? 'propose-review',\n      projectId: config.projectId,\n      variantId: config.variantId,\n      layer: 'meta',\n      tags: {\n        goal: config.goal.slice(0, 120),\n        maxShots: String(maxShots),\n      },\n    })\n  }\n\n  const abort = new AbortController()\n  const wallStart = Date.now()\n  const wallTimer = setTimeout(\n    () => abort.abort(new Error('propose-review wall timeout')),\n    maxWallMs,\n  )\n\n  const shots: ProposeReviewShot<State, Summary>[] = []\n  let state = config.initialState\n  let priorReview: Review | null = null\n  let lastVerification: Verification = { pass: false }\n  let failureClass: FailureClass | undefined\n  let completed = false\n  let lowConfidenceStreak = 0\n\n  try {\n    for (let shot = 1; shot <= maxShots; shot++) {\n      if (abort.signal.aborted) {\n        failureClass = 'timeout'\n        break\n      }\n\n      const shotStart = Date.now()\n      const shotHandle = emitter ? await emitter.span({ kind: 'tool', name: `shot-${shot}` }) : null\n\n      // 1. Propose.\n      let proposeOut: ProposeOutput<State, Summary>\n      try {\n        proposeOut = await config.propose({\n          shot,\n          goal: config.goal,\n          state,\n          priorReview,\n          abortSignal: abort.signal,\n          emitter: emitter ?? undefined,\n        })\n      } catch (err) {\n        await shotHandle?.fail(err instanceof Error ? err : String(err))\n        failureClass = 'unknown'\n        throw err\n      }\n      state = proposeOut.state\n      const traceSummary = proposeOut.traceSummary\n\n      // 2. Verify.\n      let verification: Verification\n      try {\n        verification = await config.verify(state)\n      } catch (err) {\n        await shotHandle?.fail(err instanceof Error ? err : String(err))\n        failureClass = 'unknown'\n        throw err\n      }\n      lastVerification = verification\n\n      // 3. Review — short-circuit on pass; soft-fail on throw.\n      const memorySnapshot = await memory.load()\n      const verificationDigest = {\n        pass: verification.pass,\n        score: verification.score,\n        failingLayers: verification.failingLayers ?? [],\n      }\n\n      let review: Review\n      let reviewAvailable = true\n      let reviewError: string | undefined\n\n      if (verification.pass) {\n        review = {\n          observations: 'verification passed — skipping reviewer LLM call',\n          diagnosis: 'no failures to diagnose',\n          nextShotInstruction: '(done)',\n          shouldContinue: false,\n          confidence: 1,\n        }\n      } else {\n        try {\n          review = await config.review({\n            shot,\n            goal: config.goal,\n            state,\n            verification,\n            traceSummary,\n            memory: memorySnapshot,\n          })\n          review = coerceReview(review)\n        } catch (err) {\n          reviewAvailable = false\n          reviewError = err instanceof Error ? err.message : String(err)\n          const lastInstruction =\n            memorySnapshot.length > 0\n              ? memorySnapshot[memorySnapshot.length - 1]!.nextShotInstruction\n              : fallbackInstruction\n          review = {\n            observations: '(reviewer unavailable — using last-known instruction)',\n            diagnosis: reviewError,\n            nextShotInstruction: lastInstruction,\n            shouldContinue: true,\n            confidence: 0.3,\n          }\n        }\n      }\n\n      const entry: ReviewMemoryEntry = {\n        shot,\n        timestamp: Date.now(),\n        ...review,\n        verification: verificationDigest,\n      }\n      await memory.append(entry)\n\n      const shotRecord: ProposeReviewShot<State, Summary> = {\n        shot,\n        state,\n        verification,\n        traceSummary,\n        review,\n        reviewAvailable,\n        reviewError,\n        durationMs: Date.now() - shotStart,\n      }\n      shots.push(shotRecord)\n\n      await shotHandle?.end({\n        attributes: {\n          verificationPass: verification.pass,\n          verificationScore: verification.score ?? null,\n          reviewShouldContinue: review.shouldContinue,\n          reviewConfidence: review.confidence,\n          reviewAvailable,\n        },\n      } as Partial<SpanHandle['span']>)\n\n      // 4. Exit rules.\n      if (verification.pass) {\n        completed = true\n        break\n      }\n      if (!review.shouldContinue) {\n        break\n      }\n      if (confidenceFloorWindow > 0 && review.confidence <= confidenceFloor) {\n        lowConfidenceStreak += 1\n        if (lowConfidenceStreak >= confidenceFloorWindow) break\n      } else {\n        lowConfidenceStreak = 0\n      }\n\n      priorReview = review\n    }\n\n    if (!completed && !failureClass) {\n      failureClass = shots.length >= maxShots ? 'budget_exceeded' : 'unknown'\n    }\n  } finally {\n    clearTimeout(wallTimer)\n  }\n\n  const score = lastVerification.pass\n    ? 1\n    : typeof lastVerification.score === 'number'\n      ? lastVerification.score\n      : 0\n\n  if (emitter) {\n    await emitter.endRun({\n      pass: completed,\n      score,\n      failureClass,\n      notes: `${shots.length} shot(s); final pass=${lastVerification.pass}`,\n    })\n  }\n\n  return {\n    runId: emitter?.runId ?? null,\n    completed,\n    shots,\n    finalState: state,\n    finalVerification: lastVerification,\n    failureClass,\n    wallMs: Date.now() - wallStart,\n    score,\n  }\n}\n\n// ── Reviewer helper (LLM-backed) ─────────────────────────────────────\n\nexport type LlmJsonCall = (req: { system: string; user: string }) => Promise<unknown>\n\nexport interface LlmReviewerConfig<State, Summary = unknown> {\n  callJson: LlmJsonCall\n  renderState?: (state: State) => string\n  renderTraceSummary?: (summary: Summary | undefined) => string\n  /** Appended to the default system prompt. */\n  systemPromptAddendum?: string\n}\n\nconst REVIEWER_SYSTEM_PROMPT = `You are a senior reviewer directing a multi-shot build loop.\nYou do NOT grade — the verifier already did. Your job is to direct the worker's next shot.\nYou are blind to the worker's inner monologue. You see what it DID, not what it thought.\nReturn STRICT JSON matching the schema. No prose outside the JSON.`\n\nexport function createLlmReviewer<State, Summary = unknown>(\n  cfg: LlmReviewerConfig<State, Summary>,\n): ReviewFn<State, Summary> {\n  const renderState = cfg.renderState ?? ((s: State) => safeJson(s))\n  const renderTraceSummary =\n    cfg.renderTraceSummary ??\n    ((s: Summary | undefined) => (s === undefined ? '(none)' : safeJson(s)))\n  const system = cfg.systemPromptAddendum\n    ? `${REVIEWER_SYSTEM_PROMPT}\\n\\n${cfg.systemPromptAddendum}`\n    : REVIEWER_SYSTEM_PROMPT\n\n  return async (input) => {\n    const memoryBlock =\n      input.memory.length === 0\n        ? '(no prior shots — this is shot 1)'\n        : input.memory\n            .map((m) =>\n              [\n                `shot ${m.shot} — verification.pass=${m.verification.pass}` +\n                  (typeof m.verification.score === 'number'\n                    ? ` score=${m.verification.score.toFixed(2)}`\n                    : '') +\n                  ` confidence=${m.confidence.toFixed(2)} failing=[${(m.verification.failingLayers ?? []).join(',')}]`,\n                `  observations: ${m.observations.slice(0, 400)}`,\n                `  diagnosis: ${m.diagnosis.slice(0, 400)}`,\n                `  instruction given: ${m.nextShotInstruction.slice(0, 400)}`,\n              ].join('\\n'),\n            )\n            .join('\\n\\n')\n\n    const user = [\n      `=== GOAL ===`,\n      input.goal,\n      ``,\n      `=== SHOT NUMBER ===`,\n      String(input.shot),\n      ``,\n      `=== CURRENT STATE ===`,\n      renderState(input.state),\n      ``,\n      `=== TRACE SUMMARY ===`,\n      renderTraceSummary(input.traceSummary),\n      ``,\n      `=== VERIFICATION ===`,\n      summarizeVerification(input.verification),\n      ``,\n      `=== REVIEWER MEMORY (prior shots) ===`,\n      memoryBlock,\n      ``,\n      `=== YOUR TASK ===`,\n      `Return STRICT JSON:`,\n      `{`,\n      `  \"observations\": string (20..2000 chars, first-person worker behavior — quote counts, errors, loops)`,\n      `  \"diagnosis\": string (20..1500 chars, root cause, NOT a restatement of verification)`,\n      `  \"nextShotInstruction\": string (40..3000 chars, concrete directive to the worker)`,\n      `  \"shouldContinue\": boolean (false if verification.pass, or if thrashing, or unachievable)`,\n      `  \"confidence\": number in [0,1]`,\n      `}`,\n    ].join('\\n')\n\n    const raw = await cfg.callJson({ system, user })\n    return coerceReview(raw as Partial<Review>)\n  }\n}\n\n// ── Helpers ──────────────────────────────────────────────────────────\n\nfunction coerceReview(raw: Partial<Review> | null | undefined): Review {\n  if (!raw || typeof raw !== 'object') {\n    throw new Error('reviewer returned non-object')\n  }\n  const observations = typeof raw.observations === 'string' ? raw.observations : ''\n  const diagnosis = typeof raw.diagnosis === 'string' ? raw.diagnosis : ''\n  const nextShotInstruction =\n    typeof raw.nextShotInstruction === 'string' ? raw.nextShotInstruction : ''\n  if (!observations || !diagnosis || !nextShotInstruction) {\n    throw new Error('reviewer missing required string fields')\n  }\n  if (typeof raw.shouldContinue !== 'boolean') {\n    throw new Error('reviewer missing shouldContinue boolean')\n  }\n  const confidenceRaw = Number(raw.confidence)\n  if (!Number.isFinite(confidenceRaw)) {\n    throw new Error('reviewer confidence not finite')\n  }\n  return {\n    observations,\n    diagnosis,\n    nextShotInstruction,\n    shouldContinue: raw.shouldContinue,\n    confidence: Math.max(0, Math.min(1, confidenceRaw)),\n  }\n}\n\nfunction summarizeVerification(v: Verification): string {\n  const header =\n    `pass=${v.pass}` +\n    (typeof v.score === 'number' ? ` score=${v.score.toFixed(3)}` : '') +\n    (v.failingLayers && v.failingLayers.length > 0\n      ? ` failing=[${v.failingLayers.join(', ')}]`\n      : '')\n  const details = v.details === undefined ? '' : `\\n${safeJson(v.details).slice(0, 1500)}`\n  return header + details\n}\n\nfunction safeJson(x: unknown): string {\n  try {\n    return JSON.stringify(x, null, 2)\n  } catch {\n    return String(x)\n  }\n}\n","import {\n  type ControlRunResult,\n  type ControlRuntimeConfig,\n  objectiveEval,\n  runAgentControlLoop,\n} from './control-runtime'\nimport {\n  inMemoryReviewStore,\n  type ProposeFn,\n  type ProposeOutput,\n  type Review,\n  type ReviewFn,\n  type ReviewMemoryEntry,\n  type ReviewMemoryStore,\n  type Verification,\n  type VerifyFn,\n} from './propose-review'\nimport type { FailureClass } from './trace/schema'\nimport type { TraceStore } from './trace/store'\n\nexport interface ProposeReviewControlState<State, Summary = unknown> {\n  shot: number\n  state: State\n  priorReview: Review | null\n  verification: Verification\n  traceSummary?: Summary\n  memory: ReviewMemoryEntry[]\n  completed: boolean\n  reviewAvailable: boolean\n  reviewError?: string\n}\n\nexport interface ProposeReviewControlAction {\n  type: 'propose-review-shot'\n  shot: number\n}\n\nexport interface ProposeReviewControlResult<State, Summary = unknown> {\n  state: State\n  verification: Verification\n  traceSummary?: Summary\n  review: Review | null\n  reviewAvailable: boolean\n  reviewError?: string\n}\n\nexport interface ProposeReviewControlConfig<State, Summary = unknown> {\n  goal: string\n  initialState: State\n  propose: ProposeFn<State, Summary>\n  verify: VerifyFn<State>\n  review: ReviewFn<State, Summary>\n  maxShots?: number\n  maxWallMs?: number\n  memory?: ReviewMemoryStore\n  store?: TraceStore\n  scenarioId?: string\n  projectId?: string\n  variantId?: string\n  fallbackInstruction?: string\n  confidenceFloor?: number\n  confidenceFloorWindow?: number\n  failureClassFromVerification?: (verification: Verification) => FailureClass | undefined\n  actionFailure?: ControlRuntimeConfig<\n    ProposeReviewControlState<State, Summary>,\n    ProposeReviewControlAction,\n    ProposeReviewControlResult<State, Summary>\n  >['actionFailure']\n}\n\nconst DEFAULT_FALLBACK_INSTRUCTION =\n  'Inspect the verification failures above. Fix the critical issues first, then the major ones. Do not restate the failures — act on them.'\n\nexport async function runProposeReviewAsControlLoop<State, Summary = unknown>(\n  config: ProposeReviewControlConfig<State, Summary>,\n): Promise<\n  ControlRunResult<\n    ProposeReviewControlState<State, Summary>,\n    ProposeReviewControlAction,\n    ProposeReviewControlResult<State, Summary>\n  >\n> {\n  const maxShots = config.maxShots ?? 10\n  const confidenceFloor = config.confidenceFloor ?? 0.3\n  const confidenceFloorWindow = config.confidenceFloorWindow ?? 2\n  const memory = config.memory ?? inMemoryReviewStore()\n  const fallbackInstruction = config.fallbackInstruction ?? DEFAULT_FALLBACK_INSTRUCTION\n  const failureClassFromVerification =\n    config.failureClassFromVerification ?? controlFailureClassFromVerification\n  let lowConfidenceStreak = 0\n\n  let current: ProposeReviewControlState<State, Summary> = {\n    shot: 0,\n    state: config.initialState,\n    priorReview: null,\n    verification: { pass: false },\n    memory: await memory.load(),\n    completed: false,\n    reviewAvailable: false,\n  }\n\n  return runAgentControlLoop({\n    intent: config.goal,\n    budget: { maxSteps: maxShots, maxWallMs: config.maxWallMs },\n    store: config.store,\n    scenarioId: config.scenarioId ?? 'propose-review-control',\n    projectId: config.projectId,\n    variantId: config.variantId,\n    actionFailure: config.actionFailure ?? 'stop',\n    observe: () => current,\n    validate: ({ state }) => [\n      objectiveEval({\n        id: 'verification',\n        passed: state.verification.pass,\n        score: state.verification.score,\n        severity: 'critical',\n        detail: state.verification.pass\n          ? 'verification passed'\n          : `verification failed${state.verification.failingLayers?.length ? `: ${state.verification.failingLayers.join(', ')}` : ''}`,\n      }),\n    ],\n    shouldStop: ({ state }) => {\n      if (state.verification.pass) {\n        return {\n          stop: true,\n          pass: true,\n          reason: 'verification passed',\n          score: state.verification.score,\n        }\n      }\n      if (state.completed) {\n        return {\n          stop: true,\n          pass: false,\n          reason: 'reviewer stopped continuation',\n          score: state.verification.score,\n          failureClass: failureClassFromVerification(state.verification),\n        }\n      }\n      return {\n        stop: false,\n        pass: false,\n        reason: 'verification still failing',\n        score: state.verification.score,\n      }\n    },\n    decide: ({ state }) => ({\n      type: 'continue',\n      action: { type: 'propose-review-shot', shot: state.shot + 1 },\n      reason: state.priorReview?.nextShotInstruction ?? fallbackInstruction,\n    }),\n    act: async (action, ctx) => {\n      const shot = action.shot\n      const proposeOut: ProposeOutput<State, Summary> = await config.propose({\n        shot,\n        goal: config.goal,\n        state: current.state,\n        priorReview: current.priorReview,\n        abortSignal: ctx.abortSignal,\n        emitter: ctx.emitter,\n      })\n\n      const nextState = proposeOut.state\n      const verification = await config.verify(nextState)\n      let review: Review | null = null\n      let reviewAvailable = false\n      let reviewError: string | undefined\n      let shouldContinue = !verification.pass\n\n      if (!verification.pass) {\n        try {\n          review = await config.review({\n            shot,\n            goal: config.goal,\n            state: nextState,\n            verification,\n            traceSummary: proposeOut.traceSummary,\n            memory: await memory.load(),\n          })\n          reviewAvailable = true\n          shouldContinue = review.shouldContinue\n          lowConfidenceStreak = review.confidence <= confidenceFloor ? lowConfidenceStreak + 1 : 0\n          if (confidenceFloorWindow > 0 && lowConfidenceStreak >= confidenceFloorWindow)\n            shouldContinue = false\n        } catch (err) {\n          reviewError = err instanceof Error ? err.message : String(err)\n          review = current.priorReview ?? {\n            observations: 'Reviewer unavailable.',\n            diagnosis: reviewError,\n            nextShotInstruction: fallbackInstruction,\n            shouldContinue: true,\n            confidence: 0,\n          }\n          shouldContinue = true\n        }\n      } else {\n        review = {\n          observations: 'Verification passed.',\n          diagnosis: 'No further revision needed.',\n          nextShotInstruction: '',\n          shouldContinue: false,\n          confidence: 1,\n        }\n      }\n\n      const entry: ReviewMemoryEntry = {\n        ...(review ?? {\n          observations: 'No review.',\n          diagnosis: '',\n          nextShotInstruction: fallbackInstruction,\n          shouldContinue,\n          confidence: 0,\n        }),\n        shot,\n        timestamp: Date.now(),\n        verification: {\n          pass: verification.pass,\n          score: verification.score,\n          failingLayers: verification.failingLayers,\n        },\n      }\n      await memory.append(entry)\n\n      current = {\n        shot,\n        state: nextState,\n        priorReview: review,\n        verification,\n        traceSummary: proposeOut.traceSummary,\n        memory: await memory.load(),\n        completed: verification.pass || !shouldContinue,\n        reviewAvailable,\n        reviewError,\n      }\n\n      return {\n        state: nextState,\n        verification,\n        traceSummary: proposeOut.traceSummary,\n        review,\n        reviewAvailable,\n        reviewError,\n      }\n    },\n  })\n}\n\nexport function controlFailureClassFromVerification(\n  verification: Verification,\n): FailureClass | undefined {\n  if (verification.pass) return undefined\n  return verification.failingLayers?.length ? 'instruction_following' : 'unknown'\n}\n"],"mappings":";;;;;;;;;;;;AAuBO,SAAS,qBACd,QACA,SAAgC,CAAC,GACjC,UAAkC,CAAC,GACb;AACtB,QAAM,UAAoB,CAAC;AAC3B,MAAI,UAAU;AACd,MAAI,mBAAmB,QAAQ,OAAO,gBAAgB;AAEtD,MAAI,OAAO,cAAc,UAAU,CAAC,OAAO,aAAa,SAAS,OAAO,IAAI,GAAG;AAC7E,cAAU;AACV,YAAQ,KAAK,gBAAgB,OAAO,IAAI,kBAAkB;AAAA,EAC5D;AACA,MAAI,OAAO,cAAc,SAAS,OAAO,IAAI,GAAG;AAC9C,cAAU;AACV,YAAQ,KAAK,gBAAgB,OAAO,IAAI,cAAc;AAAA,EACxD;AACA,MAAI,OAAO,4BAA4B,SAAS,OAAO,IAAI,GAAG;AAC5D,uBAAmB;AACnB,YAAQ,KAAK,gBAAgB,OAAO,IAAI,qBAAqB;AAAA,EAC/D;AACA,MAAI,OAAO,yCAAyC,OAAO,oBAAoB;AAC7E,uBAAmB;AACnB,YAAQ,KAAK,wCAAwC;AAAA,EACvD;AACA,MACE,OAAO,gCAAgC,WACtC,OAAO,WAAW,KAAK,OAAO,6BAC/B;AACA,uBAAmB;AACnB,YAAQ;AAAA,MACN,QAAQ,OAAO,OAAO,+BAA+B,OAAO,2BAA2B;AAAA,IACzF;AAAA,EACF;AACA,MAAI,OAAO,qBAAqB,WAAc,OAAO,WAAW,KAAK,OAAO,kBAAkB;AAC5F,cAAU;AACV,YAAQ,KAAK,QAAQ,OAAO,OAAO,4BAA4B,OAAO,gBAAgB,EAAE;AAAA,EAC1F;AACA,MACE,OAAO,uBAAuB,WAC7B,OAAO,WAAW,KAAK,OAAO,oBAC/B;AACA,cAAU;AACV,YAAQ,KAAK,QAAQ,OAAO,OAAO,6BAA6B,OAAO,kBAAkB,EAAE;AAAA,EAC7F;AACA,MAAI,OAAO,2BAA2B,CAAC,OAAO,UAAU,iBAAiB;AACvE,cAAU;AACV,YAAQ,KAAK,8BAA8B;AAAA,EAC7C;AACA,MAAI,OAAO,wBAAwB,CAAC,OAAO,UAAU,cAAc;AACjE,cAAU;AACV,YAAQ,KAAK,4BAA4B;AAAA,EAC3C;AACA,MAAI,OAAO,kBAAkB,SAAS,OAAO,IAAI,KAAK,kBAAkB;AACtE,YAAQ;AAAA,MACN,gBAAgB,OAAO,IAAI;AAAA,IAC7B;AAAA,EACF;AAEA,MAAI,CAAC,QAAQ,OAAQ,SAAQ,KAAK,mBAAmB,sBAAsB,gBAAgB;AAE3F,QAAM,QACJ,WAAW,mBACP;AAAA,IACE,QAAQ;AAAA,IACR,MAAM,UAAW,iBAA4B;AAAA,IAC7C,OAAO,EAAE,YAAY,OAAO,MAAM,SAAS,iBAAiB;AAAA,IAC5D,QAAQ,QAAQ,KAAK,IAAI;AAAA,IACzB,UAAU,UAAW,aAAwB;AAAA,IAC7C,WAAW,QAAQ,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,IACvD,UAAU,EAAE,QAAQ,OAAO;AAAA,EAC7B,IACA;AAEN,SAAO;AAAA,IACL,SAAS,CAAC;AAAA,IACV;AAAA,IACA,kBAAkB,CAAC,WAAW;AAAA,IAC9B;AAAA,IACA;AAAA,EACF;AACF;;;AClEO,SAAS,sBAMd,KACA,SACW;AACX,QAAM,QAAQ;AAAA,IACZ,QAAQ,SAAS,IAAI,SAAS,eAAe,IAAI,UAAU,MAAM,IAAI,OAAO,IAAI;AAAA,EAClF;AACA,QAAM,UACJ,QAAQ,aAAa,YACjB,EAAE,cAAc,OAAO,KAAK,oBAAoB,QAAQ,KAAK,KAAK,KAAK,EAAE,IACzE,EAAE,aAAa,OAAO,KAAK,oBAAoB,QAAQ,KAAK,KAAK,KAAK,EAAE;AAE9E,SAAO,kBAAkB;AAAA,IACvB,OACE,QAAQ,SACR,IAAI,SACJ,WAAW,QAAQ,YAAY,IAAI,QAAQ,WAAW,IAAI,QAAQ,IAAI,IAAI,QAAQ,QAAQ;AAAA,IAC5F,cAAc,QAAQ;AAAA,IACtB,aAAa,QAAQ;AAAA,IACrB,MAAM,QAAQ;AAAA,IACd,OAAO,QAAQ;AAAA,IACf,YAAY,QAAQ;AAAA,IACpB,YAAY,QAAQ;AAAA,IACpB,WAAW,QAAQ;AAAA,IACnB,QAAQ,IAAI;AAAA,IACZ,GAAI,QAAQ,YAAY,SAAY,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;AAAA,IACpE,SAAS,IAAI;AAAA,IACb,YAAY,QAAQ;AAAA,IACpB,GAAI,QAAQ,gBAAgB,EAAE,eAAe,QAAQ,cAAc,IAAI,CAAC;AAAA,IACxE;AAAA,IACA,aAAa,QAAQ,eAAe,mBAAmB,GAAG;AAAA,IAC1D,UAAU,QAAQ;AAAA,EACpB,CAAC;AACH;AAEO,SAAS,eAAe,OAAyD;AACtF,QAAM,SAAS,MACZ,IAAI,CAAC,MAAM,EAAE,KAAK,EAClB,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,CAAC;AACzF,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,SAAO,WAAW,OAAO,OAAO,CAAC,KAAK,UAAU,MAAM,OAAO,CAAC,IAAI,OAAO,MAAM;AACjF;AAEA,SAAS,oBACP,KACA,KACA,OACwB;AACxB,SAAO;AAAA,IACL,GAAG,WAAW,OAAO,CAAC,CAAC;AAAA,IACvB;AAAA,IACA,MAAM,IAAI,OAAO,IAAI;AAAA,IACrB,WAAW,IAAI,YAAY,IAAI;AAAA,IAC/B,OAAO,IAAI,MAAM;AAAA,IACjB,eAAe,IAAI,cAAc;AAAA,EACnC;AACF;AAEA,SAAS,WAAW,QAAwD;AAC1E,QAAM,MAA8B,CAAC;AACrC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,OAAO,SAAS,KAAK,EAAG,KAAI,GAAG,IAAI;AAAA,EACzC;AACA,SAAO;AACT;AAEA,SAAS,mBACP,KAC0B;AAC1B,MAAI,IAAI,KAAM,QAAO;AACrB,SAAO,IAAI,gBAAgB;AAC7B;AAEA,SAAS,WAAW,OAAuB;AACzC,MAAI,CAAC,OAAO,SAAS,KAAK,EAAG,QAAO;AACpC,SAAO,KAAK,IAAI,GAAG,KAAK,IAAI,GAAG,KAAK,CAAC;AACvC;;;ACjFA,SAAS,gBAAgB,YAAY,WAAW,oBAAoB;AACpE,SAAS,eAAe;AA6HjB,SAAS,oBAAoB,UAA+B,CAAC,GAAsB;AACxF,QAAM,UAA+B,CAAC,GAAG,OAAO;AAChD,SAAO;AAAA,IACL,MAAM,OAAO;AACX,aAAO,CAAC,GAAG,OAAO;AAAA,IACpB;AAAA,IACA,MAAM,OAAO,OAAO;AAClB,cAAQ,KAAK,KAAK;AAAA,IACpB;AAAA,EACF;AACF;AAEO,SAAS,iBAAiB,MAAiC;AAChE,SAAO;AAAA,IACL,MAAM,OAAO;AACX,UAAI,CAAC,WAAW,IAAI,EAAG,QAAO,CAAC;AAC/B,YAAM,MAAM,aAAa,MAAM,MAAM;AACrC,YAAM,MAA2B,CAAC;AAClC,iBAAW,QAAQ,IAAI,MAAM,IAAI,GAAG;AAClC,cAAM,UAAU,KAAK,KAAK;AAC1B,YAAI,CAAC,QAAS;AACd,YAAI;AACF,cAAI,KAAK,KAAK,MAAM,OAAO,CAAsB;AAAA,QACnD,QAAQ;AAAA,QAGR;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,IACA,MAAM,OAAO,OAAO;AAClB,gBAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC5C,qBAAe,MAAM,GAAG,KAAK,UAAU,KAAK,CAAC;AAAA,CAAI;AAAA,IACnD;AAAA,EACF;AACF;AAIA,IAAM,+BACJ;AAEF,eAAsB,iBACpB,QAC8C;AAC9C,QAAM,WAAW,OAAO,YAAY;AACpC,QAAM,YAAY,OAAO,aAAa,KAAK,KAAK;AAChD,QAAM,kBAAkB,OAAO,mBAAmB;AAClD,QAAM,wBAAwB,OAAO,yBAAyB;AAC9D,QAAM,SAAS,OAAO,UAAU,oBAAoB;AACpD,QAAM,sBAAsB,OAAO,uBAAuB;AAE1D,QAAM,UAAU,OAAO,QAAQ,IAAI,aAAa,OAAO,KAAK,IAAI;AAChE,MAAI,SAAS;AACX,UAAM,QAAQ,SAAS;AAAA,MACrB,YAAY,OAAO,cAAc;AAAA,MACjC,WAAW,OAAO;AAAA,MAClB,WAAW,OAAO;AAAA,MAClB,OAAO;AAAA,MACP,MAAM;AAAA,QACJ,MAAM,OAAO,KAAK,MAAM,GAAG,GAAG;AAAA,QAC9B,UAAU,OAAO,QAAQ;AAAA,MAC3B;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,QAAQ,IAAI,gBAAgB;AAClC,QAAM,YAAY,KAAK,IAAI;AAC3B,QAAM,YAAY;AAAA,IAChB,MAAM,MAAM,MAAM,IAAI,MAAM,6BAA6B,CAAC;AAAA,IAC1D;AAAA,EACF;AAEA,QAAM,QAA6C,CAAC;AACpD,MAAI,QAAQ,OAAO;AACnB,MAAI,cAA6B;AACjC,MAAI,mBAAiC,EAAE,MAAM,MAAM;AACnD,MAAI;AACJ,MAAI,YAAY;AAChB,MAAI,sBAAsB;AAE1B,MAAI;AACF,aAAS,OAAO,GAAG,QAAQ,UAAU,QAAQ;AAC3C,UAAI,MAAM,OAAO,SAAS;AACxB,uBAAe;AACf;AAAA,MACF;AAEA,YAAM,YAAY,KAAK,IAAI;AAC3B,YAAM,aAAa,UAAU,MAAM,QAAQ,KAAK,EAAE,MAAM,QAAQ,MAAM,QAAQ,IAAI,GAAG,CAAC,IAAI;AAG1F,UAAI;AACJ,UAAI;AACF,qBAAa,MAAM,OAAO,QAAQ;AAAA,UAChC;AAAA,UACA,MAAM,OAAO;AAAA,UACb;AAAA,UACA;AAAA,UACA,aAAa,MAAM;AAAA,UACnB,SAAS,WAAW;AAAA,QACtB,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,cAAM,YAAY,KAAK,eAAe,QAAQ,MAAM,OAAO,GAAG,CAAC;AAC/D,uBAAe;AACf,cAAM;AAAA,MACR;AACA,cAAQ,WAAW;AACnB,YAAM,eAAe,WAAW;AAGhC,UAAI;AACJ,UAAI;AACF,uBAAe,MAAM,OAAO,OAAO,KAAK;AAAA,MAC1C,SAAS,KAAK;AACZ,cAAM,YAAY,KAAK,eAAe,QAAQ,MAAM,OAAO,GAAG,CAAC;AAC/D,uBAAe;AACf,cAAM;AAAA,MACR;AACA,yBAAmB;AAGnB,YAAM,iBAAiB,MAAM,OAAO,KAAK;AACzC,YAAM,qBAAqB;AAAA,QACzB,MAAM,aAAa;AAAA,QACnB,OAAO,aAAa;AAAA,QACpB,eAAe,aAAa,iBAAiB,CAAC;AAAA,MAChD;AAEA,UAAI;AACJ,UAAI,kBAAkB;AACtB,UAAI;AAEJ,UAAI,aAAa,MAAM;AACrB,iBAAS;AAAA,UACP,cAAc;AAAA,UACd,WAAW;AAAA,UACX,qBAAqB;AAAA,UACrB,gBAAgB;AAAA,UAChB,YAAY;AAAA,QACd;AAAA,MACF,OAAO;AACL,YAAI;AACF,mBAAS,MAAM,OAAO,OAAO;AAAA,YAC3B;AAAA,YACA,MAAM,OAAO;AAAA,YACb;AAAA,YACA;AAAA,YACA;AAAA,YACA,QAAQ;AAAA,UACV,CAAC;AACD,mBAAS,aAAa,MAAM;AAAA,QAC9B,SAAS,KAAK;AACZ,4BAAkB;AAClB,wBAAc,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC7D,gBAAM,kBACJ,eAAe,SAAS,IACpB,eAAe,eAAe,SAAS,CAAC,EAAG,sBAC3C;AACN,mBAAS;AAAA,YACP,cAAc;AAAA,YACd,WAAW;AAAA,YACX,qBAAqB;AAAA,YACrB,gBAAgB;AAAA,YAChB,YAAY;AAAA,UACd;AAAA,QACF;AAAA,MACF;AAEA,YAAM,QAA2B;AAAA,QAC/B;AAAA,QACA,WAAW,KAAK,IAAI;AAAA,QACpB,GAAG;AAAA,QACH,cAAc;AAAA,MAChB;AACA,YAAM,OAAO,OAAO,KAAK;AAEzB,YAAM,aAAgD;AAAA,QACpD;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY,KAAK,IAAI,IAAI;AAAA,MAC3B;AACA,YAAM,KAAK,UAAU;AAErB,YAAM,YAAY,IAAI;AAAA,QACpB,YAAY;AAAA,UACV,kBAAkB,aAAa;AAAA,UAC/B,mBAAmB,aAAa,SAAS;AAAA,UACzC,sBAAsB,OAAO;AAAA,UAC7B,kBAAkB,OAAO;AAAA,UACzB;AAAA,QACF;AAAA,MACF,CAAgC;AAGhC,UAAI,aAAa,MAAM;AACrB,oBAAY;AACZ;AAAA,MACF;AACA,UAAI,CAAC,OAAO,gBAAgB;AAC1B;AAAA,MACF;AACA,UAAI,wBAAwB,KAAK,OAAO,cAAc,iBAAiB;AACrE,+BAAuB;AACvB,YAAI,uBAAuB,sBAAuB;AAAA,MACpD,OAAO;AACL,8BAAsB;AAAA,MACxB;AAEA,oBAAc;AAAA,IAChB;AAEA,QAAI,CAAC,aAAa,CAAC,cAAc;AAC/B,qBAAe,MAAM,UAAU,WAAW,oBAAoB;AAAA,IAChE;AAAA,EACF,UAAE;AACA,iBAAa,SAAS;AAAA,EACxB;AAEA,QAAM,QAAQ,iBAAiB,OAC3B,IACA,OAAO,iBAAiB,UAAU,WAChC,iBAAiB,QACjB;AAEN,MAAI,SAAS;AACX,UAAM,QAAQ,OAAO;AAAA,MACnB,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA,OAAO,GAAG,MAAM,MAAM,wBAAwB,iBAAiB,IAAI;AAAA,IACrE,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,OAAO,SAAS,SAAS;AAAA,IACzB;AAAA,IACA;AAAA,IACA,YAAY;AAAA,IACZ,mBAAmB;AAAA,IACnB;AAAA,IACA,QAAQ,KAAK,IAAI,IAAI;AAAA,IACrB;AAAA,EACF;AACF;AAcA,IAAM,yBAAyB;AAAA;AAAA;AAAA;AAKxB,SAAS,kBACd,KAC0B;AAC1B,QAAM,cAAc,IAAI,gBAAgB,CAAC,MAAa,SAAS,CAAC;AAChE,QAAM,qBACJ,IAAI,uBACH,CAAC,MAA4B,MAAM,SAAY,WAAW,SAAS,CAAC;AACvE,QAAM,SAAS,IAAI,uBACf,GAAG,sBAAsB;AAAA;AAAA,EAAO,IAAI,oBAAoB,KACxD;AAEJ,SAAO,OAAO,UAAU;AACtB,UAAM,cACJ,MAAM,OAAO,WAAW,IACpB,2CACA,MAAM,OACH;AAAA,MAAI,CAAC,MACJ;AAAA,QACE,QAAQ,EAAE,IAAI,6BAAwB,EAAE,aAAa,IAAI,MACtD,OAAO,EAAE,aAAa,UAAU,WAC7B,UAAU,EAAE,aAAa,MAAM,QAAQ,CAAC,CAAC,KACzC,MACJ,eAAe,EAAE,WAAW,QAAQ,CAAC,CAAC,cAAc,EAAE,aAAa,iBAAiB,CAAC,GAAG,KAAK,GAAG,CAAC;AAAA,QACnG,mBAAmB,EAAE,aAAa,MAAM,GAAG,GAAG,CAAC;AAAA,QAC/C,gBAAgB,EAAE,UAAU,MAAM,GAAG,GAAG,CAAC;AAAA,QACzC,wBAAwB,EAAE,oBAAoB,MAAM,GAAG,GAAG,CAAC;AAAA,MAC7D,EAAE,KAAK,IAAI;AAAA,IACb,EACC,KAAK,MAAM;AAEpB,UAAM,OAAO;AAAA,MACX;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA,OAAO,MAAM,IAAI;AAAA,MACjB;AAAA,MACA;AAAA,MACA,YAAY,MAAM,KAAK;AAAA,MACvB;AAAA,MACA;AAAA,MACA,mBAAmB,MAAM,YAAY;AAAA,MACrC;AAAA,MACA;AAAA,MACA,sBAAsB,MAAM,YAAY;AAAA,MACxC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,IAAI;AAEX,UAAM,MAAM,MAAM,IAAI,SAAS,EAAE,QAAQ,KAAK,CAAC;AAC/C,WAAO,aAAa,GAAsB;AAAA,EAC5C;AACF;AAIA,SAAS,aAAa,KAAiD;AACrE,MAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;AACnC,UAAM,IAAI,MAAM,8BAA8B;AAAA,EAChD;AACA,QAAM,eAAe,OAAO,IAAI,iBAAiB,WAAW,IAAI,eAAe;AAC/E,QAAM,YAAY,OAAO,IAAI,cAAc,WAAW,IAAI,YAAY;AACtE,QAAM,sBACJ,OAAO,IAAI,wBAAwB,WAAW,IAAI,sBAAsB;AAC1E,MAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,qBAAqB;AACvD,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AACA,MAAI,OAAO,IAAI,mBAAmB,WAAW;AAC3C,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AACA,QAAM,gBAAgB,OAAO,IAAI,UAAU;AAC3C,MAAI,CAAC,OAAO,SAAS,aAAa,GAAG;AACnC,UAAM,IAAI,MAAM,gCAAgC;AAAA,EAClD;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB,IAAI;AAAA,IACpB,YAAY,KAAK,IAAI,GAAG,KAAK,IAAI,GAAG,aAAa,CAAC;AAAA,EACpD;AACF;AAEA,SAAS,sBAAsB,GAAyB;AACtD,QAAM,SACJ,QAAQ,EAAE,IAAI,MACb,OAAO,EAAE,UAAU,WAAW,UAAU,EAAE,MAAM,QAAQ,CAAC,CAAC,KAAK,OAC/D,EAAE,iBAAiB,EAAE,cAAc,SAAS,IACzC,aAAa,EAAE,cAAc,KAAK,IAAI,CAAC,MACvC;AACN,QAAM,UAAU,EAAE,YAAY,SAAY,KAAK;AAAA,EAAK,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;AACtF,SAAO,SAAS;AAClB;AAEA,SAAS,SAAS,GAAoB;AACpC,MAAI;AACF,WAAO,KAAK,UAAU,GAAG,MAAM,CAAC;AAAA,EAClC,QAAQ;AACN,WAAO,OAAO,CAAC;AAAA,EACjB;AACF;;;ACzdA,IAAMA,gCACJ;AAEF,eAAsB,8BACpB,QAOA;AACA,QAAM,WAAW,OAAO,YAAY;AACpC,QAAM,kBAAkB,OAAO,mBAAmB;AAClD,QAAM,wBAAwB,OAAO,yBAAyB;AAC9D,QAAM,SAAS,OAAO,UAAU,oBAAoB;AACpD,QAAM,sBAAsB,OAAO,uBAAuBA;AAC1D,QAAM,+BACJ,OAAO,gCAAgC;AACzC,MAAI,sBAAsB;AAE1B,MAAI,UAAqD;AAAA,IACvD,MAAM;AAAA,IACN,OAAO,OAAO;AAAA,IACd,aAAa;AAAA,IACb,cAAc,EAAE,MAAM,MAAM;AAAA,IAC5B,QAAQ,MAAM,OAAO,KAAK;AAAA,IAC1B,WAAW;AAAA,IACX,iBAAiB;AAAA,EACnB;AAEA,SAAO,oBAAoB;AAAA,IACzB,QAAQ,OAAO;AAAA,IACf,QAAQ,EAAE,UAAU,UAAU,WAAW,OAAO,UAAU;AAAA,IAC1D,OAAO,OAAO;AAAA,IACd,YAAY,OAAO,cAAc;AAAA,IACjC,WAAW,OAAO;AAAA,IAClB,WAAW,OAAO;AAAA,IAClB,eAAe,OAAO,iBAAiB;AAAA,IACvC,SAAS,MAAM;AAAA,IACf,UAAU,CAAC,EAAE,MAAM,MAAM;AAAA,MACvB,cAAc;AAAA,QACZ,IAAI;AAAA,QACJ,QAAQ,MAAM,aAAa;AAAA,QAC3B,OAAO,MAAM,aAAa;AAAA,QAC1B,UAAU;AAAA,QACV,QAAQ,MAAM,aAAa,OACvB,wBACA,sBAAsB,MAAM,aAAa,eAAe,SAAS,KAAK,MAAM,aAAa,cAAc,KAAK,IAAI,CAAC,KAAK,EAAE;AAAA,MAC9H,CAAC;AAAA,IACH;AAAA,IACA,YAAY,CAAC,EAAE,MAAM,MAAM;AACzB,UAAI,MAAM,aAAa,MAAM;AAC3B,eAAO;AAAA,UACL,MAAM;AAAA,UACN,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,OAAO,MAAM,aAAa;AAAA,QAC5B;AAAA,MACF;AACA,UAAI,MAAM,WAAW;AACnB,eAAO;AAAA,UACL,MAAM;AAAA,UACN,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,OAAO,MAAM,aAAa;AAAA,UAC1B,cAAc,6BAA6B,MAAM,YAAY;AAAA,QAC/D;AAAA,MACF;AACA,aAAO;AAAA,QACL,MAAM;AAAA,QACN,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,OAAO,MAAM,aAAa;AAAA,MAC5B;AAAA,IACF;AAAA,IACA,QAAQ,CAAC,EAAE,MAAM,OAAO;AAAA,MACtB,MAAM;AAAA,MACN,QAAQ,EAAE,MAAM,uBAAuB,MAAM,MAAM,OAAO,EAAE;AAAA,MAC5D,QAAQ,MAAM,aAAa,uBAAuB;AAAA,IACpD;AAAA,IACA,KAAK,OAAO,QAAQ,QAAQ;AAC1B,YAAM,OAAO,OAAO;AACpB,YAAM,aAA4C,MAAM,OAAO,QAAQ;AAAA,QACrE;AAAA,QACA,MAAM,OAAO;AAAA,QACb,OAAO,QAAQ;AAAA,QACf,aAAa,QAAQ;AAAA,QACrB,aAAa,IAAI;AAAA,QACjB,SAAS,IAAI;AAAA,MACf,CAAC;AAED,YAAM,YAAY,WAAW;AAC7B,YAAM,eAAe,MAAM,OAAO,OAAO,SAAS;AAClD,UAAI,SAAwB;AAC5B,UAAI,kBAAkB;AACtB,UAAI;AACJ,UAAI,iBAAiB,CAAC,aAAa;AAEnC,UAAI,CAAC,aAAa,MAAM;AACtB,YAAI;AACF,mBAAS,MAAM,OAAO,OAAO;AAAA,YAC3B;AAAA,YACA,MAAM,OAAO;AAAA,YACb,OAAO;AAAA,YACP;AAAA,YACA,cAAc,WAAW;AAAA,YACzB,QAAQ,MAAM,OAAO,KAAK;AAAA,UAC5B,CAAC;AACD,4BAAkB;AAClB,2BAAiB,OAAO;AACxB,gCAAsB,OAAO,cAAc,kBAAkB,sBAAsB,IAAI;AACvF,cAAI,wBAAwB,KAAK,uBAAuB;AACtD,6BAAiB;AAAA,QACrB,SAAS,KAAK;AACZ,wBAAc,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC7D,mBAAS,QAAQ,eAAe;AAAA,YAC9B,cAAc;AAAA,YACd,WAAW;AAAA,YACX,qBAAqB;AAAA,YACrB,gBAAgB;AAAA,YAChB,YAAY;AAAA,UACd;AACA,2BAAiB;AAAA,QACnB;AAAA,MACF,OAAO;AACL,iBAAS;AAAA,UACP,cAAc;AAAA,UACd,WAAW;AAAA,UACX,qBAAqB;AAAA,UACrB,gBAAgB;AAAA,UAChB,YAAY;AAAA,QACd;AAAA,MACF;AAEA,YAAM,QAA2B;AAAA,QAC/B,GAAI,UAAU;AAAA,UACZ,cAAc;AAAA,UACd,WAAW;AAAA,UACX,qBAAqB;AAAA,UACrB;AAAA,UACA,YAAY;AAAA,QACd;AAAA,QACA;AAAA,QACA,WAAW,KAAK,IAAI;AAAA,QACpB,cAAc;AAAA,UACZ,MAAM,aAAa;AAAA,UACnB,OAAO,aAAa;AAAA,UACpB,eAAe,aAAa;AAAA,QAC9B;AAAA,MACF;AACA,YAAM,OAAO,OAAO,KAAK;AAEzB,gBAAU;AAAA,QACR;AAAA,QACA,OAAO;AAAA,QACP,aAAa;AAAA,QACb;AAAA,QACA,cAAc,WAAW;AAAA,QACzB,QAAQ,MAAM,OAAO,KAAK;AAAA,QAC1B,WAAW,aAAa,QAAQ,CAAC;AAAA,QACjC;AAAA,QACA;AAAA,MACF;AAEA,aAAO;AAAA,QACL,OAAO;AAAA,QACP;AAAA,QACA,cAAc,WAAW;AAAA,QACzB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEO,SAAS,oCACd,cAC0B;AAC1B,MAAI,aAAa,KAAM,QAAO;AAC9B,SAAO,aAAa,eAAe,SAAS,0BAA0B;AACxE;","names":["DEFAULT_FALLBACK_INSTRUCTION"]}

package/dist/chunk-KKHDIONI.js

@@ -1,414 +0,0 @@
-// src/governance/types.ts
-function renderMarkdown(report) {
-  const sevEmoji = {
-    info: "\u2139\uFE0E",
-    low: "\xB7",
-    medium: "!",
-    high: "!!",
-    critical: "\u203C"
-  };
-  const lines = [];
-  lines.push(`# ${report.framework} report \u2014 ${report.context.systemName}`);
-  lines.push("");
-  lines.push(`- Organization: **${report.context.organization}**`);
-  lines.push(`- Period: ${report.context.periodStart} \u2192 ${report.context.periodEnd}`);
-  lines.push(
-    `- Owner: ${report.context.owner.role} ${report.context.owner.name} <${report.context.owner.email}>`
-  );
-  lines.push(`- Generated: ${report.generatedAt}`);
-  lines.push("");
-  lines.push(`## Summary \u2014 ${report.summary.overall}`);
-  lines.push("");
-  lines.push(`${report.summary.findings} finding(s).`);
-  for (const [sev, n] of Object.entries(report.summary.byeverity)) {
-    if (n > 0) lines.push(`- ${sevEmoji[sev]} ${sev}: ${n}`);
-  }
-  lines.push("");
-  lines.push("## Findings");
-  lines.push("");
-  for (const f of report.findings) {
-    lines.push(`### ${sevEmoji[f.severity]} ${f.id} \u2014 ${f.control}`);
-    lines.push("");
-    lines.push(f.summary);
-    if (f.evidence) {
-      lines.push("");
-      lines.push(`**Evidence:** ${f.evidence}`);
-    }
-    if (f.remediation) {
-      lines.push("");
-      lines.push(`**Remediation:** ${f.remediation}`);
-    }
-    lines.push("");
-  }
-  return lines.join("\n");
-}
-function summarize(findings) {
-  const byeverity = {
-    info: 0,
-    low: 0,
-    medium: 0,
-    high: 0,
-    critical: 0
-  };
-  for (const f of findings) byeverity[f.severity]++;
-  const overall = byeverity.critical + byeverity.high > 0 ? "non-compliant" : byeverity.medium + byeverity.low > 0 ? "compliant-with-findings" : "compliant";
-  return { findings: findings.length, byeverity, overall };
-}
-
-// src/governance/eu-ai-act.ts
-function classifyEuAiRisk(signals) {
-  if (signals.biometricPublic || signals.socialScoring || signals.subliminal) return "unacceptable";
-  if (signals.annexIII) return "high";
-  if (signals.chatbot || signals.generatesSyntheticMedia) return "limited";
-  return "minimal";
-}
-async function euAiActReport(ctx, signals) {
-  const riskClass = classifyEuAiRisk(signals);
-  const findings = [];
-  if (riskClass === "unacceptable") {
-    findings.push({
-      id: "EU-ART-5",
-      severity: "critical",
-      control: "EU-AI-ACT:Article-5",
-      summary: "Use case matches a prohibited practice under Article 5.",
-      remediation: "Discontinue or substantially redesign the use case."
-    });
-  }
-  if (riskClass === "high") {
-    if (!ctx.redTeam) {
-      findings.push({
-        id: "EU-ART-9",
-        severity: "high",
-        control: "EU-AI-ACT:Article-9",
-        summary: "High-risk system lacks documented adversarial-testing evidence (Art. 9 risk mgmt).",
-        remediation: "Run redTeamDataset() + attach the report."
-      });
-    }
-    if (ctx.datasets.length === 0) {
-      findings.push({
-        id: "EU-ART-10",
-        severity: "high",
-        control: "EU-AI-ACT:Article-10",
-        summary: "No training/eval datasets recorded with provenance (Art. 10)."
-      });
-    }
-    const runs = await ctx.traceStore.listRuns({
-      since: Date.parse(ctx.periodStart),
-      until: Date.parse(ctx.periodEnd)
-    });
-    if (runs.length === 0) {
-      findings.push({
-        id: "EU-ART-11",
-        severity: "high",
-        control: "EU-AI-ACT:Article-11",
-        summary: "No eval runs recorded (Art. 11 technical documentation)."
-      });
-    }
-    if (!signals.chatbot && !signals.generatesSyntheticMedia) {
-    } else {
-      findings.push({
-        id: "EU-ART-13",
-        severity: "info",
-        control: "EU-AI-ACT:Article-13",
-        summary: "Chatbot/synthetic-media transparency obligations apply; verify user-facing disclosures."
-      });
-    }
-    if (!ctx.owner?.email) {
-      findings.push({
-        id: "EU-ART-14",
-        severity: "high",
-        control: "EU-AI-ACT:Article-14",
-        summary: "No designated human overseer (Art. 14).",
-        remediation: "Populate GovernanceContext.owner with the responsible individual."
-      });
-    }
-    if (!ctx.outcomeStore) {
-      findings.push({
-        id: "EU-ART-15",
-        severity: "medium",
-        control: "EU-AI-ACT:Article-15",
-        summary: "No post-deployment outcome measurement; accuracy + robustness are un-attested.",
-        remediation: "Attach an OutcomeStore + run correlationStudy() over the reporting period."
-      });
-    }
-  }
-  if (riskClass === "limited") {
-    findings.push({
-      id: "EU-ART-52",
-      severity: "info",
-      control: "EU-AI-ACT:Article-52",
-      summary: "Transparency obligations apply: disclose AI nature + synthetic content labeling.",
-      remediation: "Ensure user-facing surfaces label AI-generated content."
-    });
-  }
-  const payload = {
-    riskClass,
-    signals,
-    articlesReviewed: riskClass === "high" ? ["5", "9", "10", "11", "13", "14", "15"] : riskClass === "limited" ? ["52"] : ["none"]
-  };
-  return {
-    framework: "EU-AI-ACT",
-    version: "Regulation-2024-1689",
-    context: {
-      organization: ctx.organization,
-      systemName: ctx.systemName,
-      periodStart: ctx.periodStart,
-      periodEnd: ctx.periodEnd,
-      owner: ctx.owner
-    },
-    summary: summarize(findings),
-    findings,
-    payload,
-    generatedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-}
-
-// src/governance/nist-ai-rmf.ts
-async function nistAiRmfReport(ctx) {
-  const findings = [];
-  if (!ctx.owner?.email) {
-    findings.push({
-      id: "G-1.1",
-      severity: "high",
-      control: "NIST-AI-RMF:GOVERN-1.1",
-      summary: "No responsible owner recorded for the AI system.",
-      remediation: "Assign an accountable individual + email in GovernanceContext.owner."
-    });
-  }
-  if (ctx.datasets.length === 0) {
-    findings.push({
-      id: "G-1.3",
-      severity: "high",
-      control: "NIST-AI-RMF:GOVERN-1.3",
-      summary: "No versioned datasets recorded for the evaluation period.",
-      remediation: "Register each dataset with a Dataset manifest (content hash + provenance)."
-    });
-  } else {
-    for (const manifest of ctx.datasets) {
-      if (!manifest.contentHash || manifest.contentHash.length < 16) {
-        findings.push({
-          id: "G-1.3-hash",
-          severity: "medium",
-          control: "NIST-AI-RMF:GOVERN-1.3",
-          summary: `Dataset "${manifest.name}" has weak or missing content hash.`,
-          evidence: `contentHash="${manifest.contentHash}"`,
-          remediation: "Call dataset.manifest() to compute SHA-256; commit the manifest alongside releases."
-        });
-      }
-    }
-  }
-  if (!ctx.redTeam) {
-    findings.push({
-      id: "M-2.6",
-      severity: "high",
-      control: "NIST-AI-RMF:MEASURE-2.6",
-      summary: "No red-team evaluation attached to the report period.",
-      remediation: "Run redTeamDataset() against the system and attach the RedTeamReport to context.redTeam."
-    });
-  } else if (ctx.redTeam.overallPassRate < 0.8) {
-    findings.push({
-      id: "M-2.6-rate",
-      severity: "high",
-      control: "NIST-AI-RMF:MEASURE-2.6",
-      summary: `Red-team pass rate ${(ctx.redTeam.overallPassRate * 100).toFixed(1)}% below 80% threshold.`,
-      evidence: JSON.stringify(ctx.redTeam.passRateByCategory),
-      remediation: "Harden the failing categories; rerun the battery."
-    });
-  }
-  const runs = await ctx.traceStore.listRuns({
-    since: Date.parse(ctx.periodStart),
-    until: Date.parse(ctx.periodEnd)
-  });
-  if (runs.length === 0) {
-    findings.push({
-      id: "M-2.1",
-      severity: "critical",
-      control: "NIST-AI-RMF:MEASURE-2.1",
-      summary: "No eval runs recorded for the reporting period.",
-      remediation: "Emit traces for every deployment-relevant evaluation."
-    });
-  }
-  if (!ctx.judgeCalibration || ctx.judgeCalibration.length === 0) {
-    findings.push({
-      id: "M-2.11",
-      severity: "medium",
-      control: "NIST-AI-RMF:MEASURE-2.11",
-      summary: "No judge-vs-human calibration recorded.",
-      remediation: "Build a human golden set; run calibrateJudge() before trusting LLM judge scores."
-    });
-  } else {
-    const weak = ctx.judgeCalibration.filter((c) => Number.isFinite(c.pearson) && c.pearson < 0.6);
-    if (weak.length > 0) {
-      findings.push({
-        id: "M-2.11-weak",
-        severity: "medium",
-        control: "NIST-AI-RMF:MEASURE-2.11",
-        summary: `${weak.length} judge(s) show weak agreement with humans (Pearson < 0.6).`,
-        remediation: "Retrain or replace the underperforming judges."
-      });
-    }
-  }
-  if (!ctx.outcomeStore) {
-    findings.push({
-      id: "MN-1.1",
-      severity: "medium",
-      control: "NIST-AI-RMF:MANAGE-1.1",
-      summary: "No deployment outcomes captured \u2014 meta-eval correlation cannot be computed.",
-      remediation: "Attach an OutcomeStore and ingest production outcome metrics."
-    });
-  } else {
-    const outcomes = await ctx.outcomeStore.list({
-      since: Date.parse(ctx.periodStart),
-      until: Date.parse(ctx.periodEnd)
-    });
-    if (outcomes.length === 0) {
-      findings.push({
-        id: "MN-1.1-empty",
-        severity: "medium",
-        control: "NIST-AI-RMF:MANAGE-1.1",
-        summary: "OutcomeStore present but no outcomes captured for the period."
-      });
-    }
-  }
-  const hashChecks = [];
-  for (const manifest of ctx.datasets) {
-    hashChecks.push({ name: manifest.name, ok: /^[0-9a-f]{64}$/.test(manifest.contentHash) });
-  }
-  const payload = {
-    controlsEvaluated: [
-      "GOVERN-1.1",
-      "GOVERN-1.3",
-      "MEASURE-2.1",
-      "MEASURE-2.6",
-      "MEASURE-2.11",
-      "MANAGE-1.1"
-    ],
-    runCount: runs.length,
-    redTeamPassRate: ctx.redTeam?.overallPassRate ?? null,
-    datasetHashChecks: hashChecks
-  };
-  return {
-    framework: "NIST-AI-RMF",
-    version: "1.0.0",
-    context: {
-      organization: ctx.organization,
-      systemName: ctx.systemName,
-      periodStart: ctx.periodStart,
-      periodEnd: ctx.periodEnd,
-      owner: ctx.owner
-    },
-    summary: summarize(findings),
-    findings,
-    payload,
-    generatedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-}
-
-// src/governance/soc2.ts
-async function soc2Report(ctx) {
-  const findings = [];
-  const start = Date.parse(ctx.periodStart);
-  const end = Date.parse(ctx.periodEnd);
-  const runs = await ctx.traceStore.listRuns({ since: start, until: end });
-  const failureRate = runs.length > 0 ? runs.filter((r) => r.outcome?.pass === false).length / runs.length : null;
-  if (failureRate !== null && failureRate > 0.2) {
-    findings.push({
-      id: "CC7.1-fail-rate",
-      severity: "medium",
-      control: "SOC2:CC7.1",
-      summary: `System failure rate ${(failureRate * 100).toFixed(1)}% over the period exceeds 20%.`,
-      remediation: "Investigate failure clusters (failureClusterView) + prioritize remediation."
-    });
-  }
-  if (runs.length === 0) {
-    findings.push({
-      id: "CC7.1-coverage",
-      severity: "high",
-      control: "SOC2:CC7.1",
-      summary: "No telemetry runs recorded for the period \u2014 monitoring regime is incomplete."
-    });
-  }
-  const aborted = runs.filter((r) => r.status === "aborted");
-  if (aborted.length > runs.length * 0.05 && aborted.length >= 3) {
-    findings.push({
-      id: "CC7.2-abort",
-      severity: "medium",
-      control: "SOC2:CC7.2",
-      summary: `${aborted.length} run(s) aborted \u2014 investigate pattern.`,
-      remediation: "Use the bisector + failureClusterView to localize the trigger."
-    });
-  }
-  const incidentEvents = await ctx.traceStore.events({
-    kind: "policy_violation",
-    since: start,
-    until: end
-  });
-  const errorEvents = await ctx.traceStore.events({ kind: "error", since: start, until: end });
-  const totalIncidents = incidentEvents.length + errorEvents.length;
-  if (totalIncidents > 0) {
-    findings.push({
-      id: "CC7.3-resolution",
-      severity: "low",
-      control: "SOC2:CC7.3",
-      summary: `${totalIncidents} incident-class event(s) recorded; resolution tracking is informal.`,
-      remediation: 'Emit a resolution event (kind="log" with payload.resolves=<eventId>) per remediated incident.'
-    });
-  }
-  const modelFingerprints = new Set(runs.map((r) => r.modelFingerprint).filter(Boolean));
-  const promptHashes = new Set(runs.map((r) => r.promptSha).filter(Boolean));
-  const codeSha = new Set(runs.map((r) => r.codeSha).filter(Boolean));
-  if (codeSha.size === 0) {
-    findings.push({
-      id: "CC7.4-code",
-      severity: "high",
-      control: "SOC2:CC7.4",
-      summary: "No codeSha recorded on runs \u2014 cannot attribute scores to a specific release.",
-      remediation: "Populate Run.codeSha with the git SHA of the system at run time."
-    });
-  }
-  if (promptHashes.size === 0) {
-    findings.push({
-      id: "CC7.4-prompt",
-      severity: "medium",
-      control: "SOC2:CC7.4",
-      summary: "No promptSha recorded \u2014 prompt changes are untracked."
-    });
-  }
-  const payload = {
-    controls: ["CC7.1", "CC7.2", "CC7.3", "CC7.4"],
-    runCount: runs.length,
-    failureRate,
-    abortedCount: aborted.length,
-    incidentEventCount: totalIncidents,
-    distinctReleases: {
-      codeShas: codeSha.size,
-      promptHashes: promptHashes.size,
-      modelFingerprints: modelFingerprints.size
-    }
-  };
-  return {
-    framework: "SOC2",
-    version: "2017-Common-Criteria",
-    context: {
-      organization: ctx.organization,
-      systemName: ctx.systemName,
-      periodStart: ctx.periodStart,
-      periodEnd: ctx.periodEnd,
-      owner: ctx.owner
-    },
-    summary: summarize(findings),
-    findings,
-    payload,
-    generatedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-}
-
-export {
-  renderMarkdown,
-  summarize,
-  classifyEuAiRisk,
-  euAiActReport,
-  nistAiRmfReport,
-  soc2Report
-};
-//# sourceMappingURL=chunk-KKHDIONI.js.map

package/dist/chunk-KKHDIONI.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/governance/types.ts","../src/governance/eu-ai-act.ts","../src/governance/nist-ai-rmf.ts","../src/governance/soc2.ts"],"sourcesContent":["/**\n * Governance reporting — shared types.\n *\n * The framework collects a `GovernanceContext` (traces + outcomes +\n * dataset manifests + red-team results + judge calibration) and each\n * specific template (NIST AI RMF, SOC2, EU AI Act) renders a\n * structured report from it.\n *\n * Reports are machine-readable JSON first; human-readable Markdown is a\n * pure transform on top. External auditors consume the Markdown; CI\n * consumes the JSON.\n */\n\nimport type { DatasetManifest } from '../dataset'\nimport type { CalibrationResult } from '../judge-calibration'\nimport type { OutcomeStore } from '../meta-eval/outcome-store'\nimport type { RedTeamReport } from '../red-team'\nimport type { TraceStore } from '../trace/store'\n\nexport interface GovernanceContext {\n  /** Legal / org identity for the report. */\n  organization: string\n  /** System / agent identifier. */\n  systemName: string\n  /** ISO8601 period the report covers. */\n  periodStart: string\n  periodEnd: string\n  /** Versioned dataset manifests used during the period. */\n  datasets: DatasetManifest[]\n  traceStore: TraceStore\n  outcomeStore?: OutcomeStore\n  /** Cached red-team results for the period, if available. */\n  redTeam?: RedTeamReport\n  /** Judge-vs-human calibration results, if measured. */\n  judgeCalibration?: CalibrationResult[]\n  /** Responsible owner for the system — role + name + email. */\n  owner: { role: string; name: string; email: string }\n}\n\nexport interface GovernanceFinding {\n  id: string\n  severity: 'info' | 'low' | 'medium' | 'high' | 'critical'\n  /** Control reference the finding maps to (e.g. \"NIST-AI-RMF:MEASURE-2.1\"). */\n  control: string\n  summary: string\n  evidence?: string\n  remediation?: string\n}\n\nexport interface GovernanceReport {\n  framework: 'NIST-AI-RMF' | 'SOC2' | 'EU-AI-ACT'\n  version: string\n  context: Pick<\n    GovernanceContext,\n    'organization' | 'systemName' | 'periodStart' | 'periodEnd' | 'owner'\n  >\n  summary: {\n    findings: number\n    byeverity: Record<GovernanceFinding['severity'], number>\n    overall: 'compliant' | 'compliant-with-findings' | 'non-compliant'\n  }\n  findings: GovernanceFinding[]\n  /** Framework-specific structured payload (mapped controls, risk class, etc.). */\n  payload: Record<string, unknown>\n  generatedAt: string\n}\n\nexport function renderMarkdown(report: GovernanceReport): string {\n  const sevEmoji: Record<GovernanceFinding['severity'], string> = {\n    info: 'ℹ︎',\n    low: '·',\n    medium: '!',\n    high: '!!',\n    critical: '‼',\n  }\n  const lines: string[] = []\n  lines.push(`# ${report.framework} report — ${report.context.systemName}`)\n  lines.push('')\n  lines.push(`- Organization: **${report.context.organization}**`)\n  lines.push(`- Period: ${report.context.periodStart} → ${report.context.periodEnd}`)\n  lines.push(\n    `- Owner: ${report.context.owner.role} ${report.context.owner.name} <${report.context.owner.email}>`,\n  )\n  lines.push(`- Generated: ${report.generatedAt}`)\n  lines.push('')\n  lines.push(`## Summary — ${report.summary.overall}`)\n  lines.push('')\n  lines.push(`${report.summary.findings} finding(s).`)\n  for (const [sev, n] of Object.entries(report.summary.byeverity) as Array<\n    [GovernanceFinding['severity'], number]\n  >) {\n    if (n > 0) lines.push(`- ${sevEmoji[sev]} ${sev}: ${n}`)\n  }\n  lines.push('')\n  lines.push('## Findings')\n  lines.push('')\n  for (const f of report.findings) {\n    lines.push(`### ${sevEmoji[f.severity]} ${f.id} — ${f.control}`)\n    lines.push('')\n    lines.push(f.summary)\n    if (f.evidence) {\n      lines.push('')\n      lines.push(`**Evidence:** ${f.evidence}`)\n    }\n    if (f.remediation) {\n      lines.push('')\n      lines.push(`**Remediation:** ${f.remediation}`)\n    }\n    lines.push('')\n  }\n  return lines.join('\\n')\n}\n\nexport function summarize(findings: GovernanceFinding[]): GovernanceReport['summary'] {\n  const byeverity: GovernanceReport['summary']['byeverity'] = {\n    info: 0,\n    low: 0,\n    medium: 0,\n    high: 0,\n    critical: 0,\n  }\n  for (const f of findings) byeverity[f.severity]++\n  const overall: GovernanceReport['summary']['overall'] =\n    byeverity.critical + byeverity.high > 0\n      ? 'non-compliant'\n      : byeverity.medium + byeverity.low > 0\n        ? 'compliant-with-findings'\n        : 'compliant'\n  return { findings: findings.length, byeverity, overall }\n}\n","/**\n * EU AI Act — risk-class classification + compliance checklist.\n *\n * Classification is declarative: caller supplies the domain/use-case\n * signals (biometric? critical infrastructure? education? employment?\n * access to services?) and we map to the Act's risk tiers:\n *   - \"unacceptable\" (prohibited)\n *   - \"high\"        (Annex III — strict obligations)\n *   - \"limited\"     (transparency obligations)\n *   - \"minimal\"     (voluntary codes of conduct)\n *\n * Then the compliance checklist enumerates Article 9 (risk mgmt),\n * 10 (data + data governance), 11 (technical documentation), 13\n * (transparency), 14 (human oversight), 15 (accuracy + robustness)\n * requirements and flags gaps.\n */\n\nimport type { GovernanceContext, GovernanceFinding, GovernanceReport } from './types'\nimport { summarize } from './types'\n\nexport type EuRiskClass = 'unacceptable' | 'high' | 'limited' | 'minimal'\n\nexport interface UseCaseSignals {\n  /** Used for biometric identification in public spaces? (Art. 5 — unacceptable). */\n  biometricPublic?: boolean\n  /** Social scoring by public authorities? (Art. 5). */\n  socialScoring?: boolean\n  /** Subliminal manipulation? (Art. 5). */\n  subliminal?: boolean\n  /** Annex III sector: critical infrastructure / education / employment /\n   *  access to essential services / law enforcement / migration /\n   *  administration of justice / democratic processes? */\n  annexIII?: boolean\n  /** Interacts directly with natural persons (chatbot, agent)? — limited risk. */\n  chatbot?: boolean\n  /** Generates synthetic media (image/audio/video/text deepfakes)? — limited risk. */\n  generatesSyntheticMedia?: boolean\n}\n\nexport function classifyEuAiRisk(signals: UseCaseSignals): EuRiskClass {\n  if (signals.biometricPublic || signals.socialScoring || signals.subliminal) return 'unacceptable'\n  if (signals.annexIII) return 'high'\n  if (signals.chatbot || signals.generatesSyntheticMedia) return 'limited'\n  return 'minimal'\n}\n\nexport async function euAiActReport(\n  ctx: GovernanceContext,\n  signals: UseCaseSignals,\n): Promise<GovernanceReport> {\n  const riskClass = classifyEuAiRisk(signals)\n  const findings: GovernanceFinding[] = []\n\n  if (riskClass === 'unacceptable') {\n    findings.push({\n      id: 'EU-ART-5',\n      severity: 'critical',\n      control: 'EU-AI-ACT:Article-5',\n      summary: 'Use case matches a prohibited practice under Article 5.',\n      remediation: 'Discontinue or substantially redesign the use case.',\n    })\n  }\n\n  if (riskClass === 'high') {\n    // Article 9 — risk management\n    if (!ctx.redTeam) {\n      findings.push({\n        id: 'EU-ART-9',\n        severity: 'high',\n        control: 'EU-AI-ACT:Article-9',\n        summary:\n          'High-risk system lacks documented adversarial-testing evidence (Art. 9 risk mgmt).',\n        remediation: 'Run redTeamDataset() + attach the report.',\n      })\n    }\n    // Article 10 — data + data governance\n    if (ctx.datasets.length === 0) {\n      findings.push({\n        id: 'EU-ART-10',\n        severity: 'high',\n        control: 'EU-AI-ACT:Article-10',\n        summary: 'No training/eval datasets recorded with provenance (Art. 10).',\n      })\n    }\n    // Article 11 — technical documentation (traces + runs)\n    const runs = await ctx.traceStore.listRuns({\n      since: Date.parse(ctx.periodStart),\n      until: Date.parse(ctx.periodEnd),\n    })\n    if (runs.length === 0) {\n      findings.push({\n        id: 'EU-ART-11',\n        severity: 'high',\n        control: 'EU-AI-ACT:Article-11',\n        summary: 'No eval runs recorded (Art. 11 technical documentation).',\n      })\n    }\n    // Article 13 — transparency to users\n    if (!signals.chatbot && !signals.generatesSyntheticMedia) {\n      // High-risk but not a chatbot — transparency may still apply; flag informational\n    } else {\n      findings.push({\n        id: 'EU-ART-13',\n        severity: 'info',\n        control: 'EU-AI-ACT:Article-13',\n        summary:\n          'Chatbot/synthetic-media transparency obligations apply; verify user-facing disclosures.',\n      })\n    }\n    // Article 14 — human oversight\n    if (!ctx.owner?.email) {\n      findings.push({\n        id: 'EU-ART-14',\n        severity: 'high',\n        control: 'EU-AI-ACT:Article-14',\n        summary: 'No designated human overseer (Art. 14).',\n        remediation: 'Populate GovernanceContext.owner with the responsible individual.',\n      })\n    }\n    // Article 15 — accuracy + robustness\n    if (!ctx.outcomeStore) {\n      findings.push({\n        id: 'EU-ART-15',\n        severity: 'medium',\n        control: 'EU-AI-ACT:Article-15',\n        summary: 'No post-deployment outcome measurement; accuracy + robustness are un-attested.',\n        remediation: 'Attach an OutcomeStore + run correlationStudy() over the reporting period.',\n      })\n    }\n  }\n\n  if (riskClass === 'limited') {\n    findings.push({\n      id: 'EU-ART-52',\n      severity: 'info',\n      control: 'EU-AI-ACT:Article-52',\n      summary: 'Transparency obligations apply: disclose AI nature + synthetic content labeling.',\n      remediation: 'Ensure user-facing surfaces label AI-generated content.',\n    })\n  }\n\n  const payload = {\n    riskClass,\n    signals,\n    articlesReviewed:\n      riskClass === 'high'\n        ? ['5', '9', '10', '11', '13', '14', '15']\n        : riskClass === 'limited'\n          ? ['52']\n          : ['none'],\n  }\n\n  return {\n    framework: 'EU-AI-ACT',\n    version: 'Regulation-2024-1689',\n    context: {\n      organization: ctx.organization,\n      systemName: ctx.systemName,\n      periodStart: ctx.periodStart,\n      periodEnd: ctx.periodEnd,\n      owner: ctx.owner,\n    },\n    summary: summarize(findings),\n    findings,\n    payload,\n    generatedAt: new Date().toISOString(),\n  }\n}\n","/**\n * NIST AI RMF 1.0 — Govern / Map / Measure / Manage mapping.\n *\n * Each subcategory derives its status from concrete framework state:\n *   MEASURE 2.x: do we have a calibration regime? contamination controls?\n *   MEASURE 2.7: are red-team results available?\n *   MANAGE 1.x: are outcome metrics captured? correlation measured?\n *   GOVERN 1.x: dataset + prompt provenance recorded?\n *\n * We ship the mapping and the derivation rules; consumers supply the\n * GovernanceContext.\n */\n\nimport type { GovernanceContext, GovernanceFinding, GovernanceReport } from './types'\nimport { summarize } from './types'\n\nexport async function nistAiRmfReport(ctx: GovernanceContext): Promise<GovernanceReport> {\n  const findings: GovernanceFinding[] = []\n\n  // GOVERN 1.1 — \"Accountable individual identified\"\n  if (!ctx.owner?.email) {\n    findings.push({\n      id: 'G-1.1',\n      severity: 'high',\n      control: 'NIST-AI-RMF:GOVERN-1.1',\n      summary: 'No responsible owner recorded for the AI system.',\n      remediation: 'Assign an accountable individual + email in GovernanceContext.owner.',\n    })\n  }\n\n  // GOVERN 1.3 — \"Inventory + lifecycle tracking\"\n  if (ctx.datasets.length === 0) {\n    findings.push({\n      id: 'G-1.3',\n      severity: 'high',\n      control: 'NIST-AI-RMF:GOVERN-1.3',\n      summary: 'No versioned datasets recorded for the evaluation period.',\n      remediation: 'Register each dataset with a Dataset manifest (content hash + provenance).',\n    })\n  } else {\n    // Validate content hashes are stable\n    for (const manifest of ctx.datasets) {\n      if (!manifest.contentHash || manifest.contentHash.length < 16) {\n        findings.push({\n          id: 'G-1.3-hash',\n          severity: 'medium',\n          control: 'NIST-AI-RMF:GOVERN-1.3',\n          summary: `Dataset \"${manifest.name}\" has weak or missing content hash.`,\n          evidence: `contentHash=\"${manifest.contentHash}\"`,\n          remediation:\n            'Call dataset.manifest() to compute SHA-256; commit the manifest alongside releases.',\n        })\n      }\n    }\n  }\n\n  // MEASURE 2.6 — \"Safety + adversarial testing\"\n  if (!ctx.redTeam) {\n    findings.push({\n      id: 'M-2.6',\n      severity: 'high',\n      control: 'NIST-AI-RMF:MEASURE-2.6',\n      summary: 'No red-team evaluation attached to the report period.',\n      remediation:\n        'Run redTeamDataset() against the system and attach the RedTeamReport to context.redTeam.',\n    })\n  } else if (ctx.redTeam.overallPassRate < 0.8) {\n    findings.push({\n      id: 'M-2.6-rate',\n      severity: 'high',\n      control: 'NIST-AI-RMF:MEASURE-2.6',\n      summary: `Red-team pass rate ${(ctx.redTeam.overallPassRate * 100).toFixed(1)}% below 80% threshold.`,\n      evidence: JSON.stringify(ctx.redTeam.passRateByCategory),\n      remediation: 'Harden the failing categories; rerun the battery.',\n    })\n  }\n\n  // MEASURE 2.1 — \"Test results against defined metrics\"\n  const runs = await ctx.traceStore.listRuns({\n    since: Date.parse(ctx.periodStart),\n    until: Date.parse(ctx.periodEnd),\n  })\n  if (runs.length === 0) {\n    findings.push({\n      id: 'M-2.1',\n      severity: 'critical',\n      control: 'NIST-AI-RMF:MEASURE-2.1',\n      summary: 'No eval runs recorded for the reporting period.',\n      remediation: 'Emit traces for every deployment-relevant evaluation.',\n    })\n  }\n\n  // MEASURE 2.11 — \"Calibration + validation regime\"\n  if (!ctx.judgeCalibration || ctx.judgeCalibration.length === 0) {\n    findings.push({\n      id: 'M-2.11',\n      severity: 'medium',\n      control: 'NIST-AI-RMF:MEASURE-2.11',\n      summary: 'No judge-vs-human calibration recorded.',\n      remediation:\n        'Build a human golden set; run calibrateJudge() before trusting LLM judge scores.',\n    })\n  } else {\n    const weak = ctx.judgeCalibration.filter((c) => Number.isFinite(c.pearson) && c.pearson < 0.6)\n    if (weak.length > 0) {\n      findings.push({\n        id: 'M-2.11-weak',\n        severity: 'medium',\n        control: 'NIST-AI-RMF:MEASURE-2.11',\n        summary: `${weak.length} judge(s) show weak agreement with humans (Pearson < 0.6).`,\n        remediation: 'Retrain or replace the underperforming judges.',\n      })\n    }\n  }\n\n  // MANAGE 1.1 — \"Outcomes tracked post-deployment\"\n  if (!ctx.outcomeStore) {\n    findings.push({\n      id: 'MN-1.1',\n      severity: 'medium',\n      control: 'NIST-AI-RMF:MANAGE-1.1',\n      summary: 'No deployment outcomes captured — meta-eval correlation cannot be computed.',\n      remediation: 'Attach an OutcomeStore and ingest production outcome metrics.',\n    })\n  } else {\n    const outcomes = await ctx.outcomeStore.list({\n      since: Date.parse(ctx.periodStart),\n      until: Date.parse(ctx.periodEnd),\n    })\n    if (outcomes.length === 0) {\n      findings.push({\n        id: 'MN-1.1-empty',\n        severity: 'medium',\n        control: 'NIST-AI-RMF:MANAGE-1.1',\n        summary: 'OutcomeStore present but no outcomes captured for the period.',\n      })\n    }\n  }\n\n  // Validate that dataset manifests carry strong SHA-256-shaped content hashes.\n  const hashChecks: Array<{ name: string; ok: boolean }> = []\n  for (const manifest of ctx.datasets) {\n    // We don't persist the scenarios here; the check is that the caller's\n    // manifest already carries a hash in the expected hex format.\n    hashChecks.push({ name: manifest.name, ok: /^[0-9a-f]{64}$/.test(manifest.contentHash) })\n  }\n\n  const payload = {\n    controlsEvaluated: [\n      'GOVERN-1.1',\n      'GOVERN-1.3',\n      'MEASURE-2.1',\n      'MEASURE-2.6',\n      'MEASURE-2.11',\n      'MANAGE-1.1',\n    ],\n    runCount: runs.length,\n    redTeamPassRate: ctx.redTeam?.overallPassRate ?? null,\n    datasetHashChecks: hashChecks,\n  }\n\n  return {\n    framework: 'NIST-AI-RMF',\n    version: '1.0.0',\n    context: {\n      organization: ctx.organization,\n      systemName: ctx.systemName,\n      periodStart: ctx.periodStart,\n      periodEnd: ctx.periodEnd,\n      owner: ctx.owner,\n    },\n    summary: summarize(findings),\n    findings,\n    payload,\n    generatedAt: new Date().toISOString(),\n  }\n}\n","/**\n * SOC 2 — Common Criteria 7 (system operations + change management)\n * audit trail derived from the trace corpus.\n *\n * This is NOT a formal SOC2 report — that requires an external\n * auditor. What we ship is the machine-readable *evidence* package\n * that an auditor consumes: run counts, deploy events, access log\n * summary, anomaly tracking, response-time SLOs.\n */\n\nimport type { GovernanceContext, GovernanceFinding, GovernanceReport } from './types'\nimport { summarize } from './types'\n\nexport async function soc2Report(ctx: GovernanceContext): Promise<GovernanceReport> {\n  const findings: GovernanceFinding[] = []\n  const start = Date.parse(ctx.periodStart)\n  const end = Date.parse(ctx.periodEnd)\n  const runs = await ctx.traceStore.listRuns({ since: start, until: end })\n\n  // CC7.1 — \"Monitoring to detect anomalies\"\n  const failureRate =\n    runs.length > 0 ? runs.filter((r) => r.outcome?.pass === false).length / runs.length : null\n  if (failureRate !== null && failureRate > 0.2) {\n    findings.push({\n      id: 'CC7.1-fail-rate',\n      severity: 'medium',\n      control: 'SOC2:CC7.1',\n      summary: `System failure rate ${(failureRate * 100).toFixed(1)}% over the period exceeds 20%.`,\n      remediation: 'Investigate failure clusters (failureClusterView) + prioritize remediation.',\n    })\n  }\n  if (runs.length === 0) {\n    findings.push({\n      id: 'CC7.1-coverage',\n      severity: 'high',\n      control: 'SOC2:CC7.1',\n      summary: 'No telemetry runs recorded for the period — monitoring regime is incomplete.',\n    })\n  }\n\n  // CC7.2 — \"Anomaly investigation\"\n  const aborted = runs.filter((r) => r.status === 'aborted')\n  if (aborted.length > runs.length * 0.05 && aborted.length >= 3) {\n    findings.push({\n      id: 'CC7.2-abort',\n      severity: 'medium',\n      control: 'SOC2:CC7.2',\n      summary: `${aborted.length} run(s) aborted — investigate pattern.`,\n      remediation: 'Use the bisector + failureClusterView to localize the trigger.',\n    })\n  }\n\n  // CC7.3 — \"Response to incidents\" — require an event tag for resolved incidents\n  const incidentEvents = await ctx.traceStore.events({\n    kind: 'policy_violation',\n    since: start,\n    until: end,\n  })\n  const errorEvents = await ctx.traceStore.events({ kind: 'error', since: start, until: end })\n  const totalIncidents = incidentEvents.length + errorEvents.length\n  if (totalIncidents > 0) {\n    // No formal resolution tracking yet — flag medium by default\n    findings.push({\n      id: 'CC7.3-resolution',\n      severity: 'low',\n      control: 'SOC2:CC7.3',\n      summary: `${totalIncidents} incident-class event(s) recorded; resolution tracking is informal.`,\n      remediation:\n        'Emit a resolution event (kind=\"log\" with payload.resolves=<eventId>) per remediated incident.',\n    })\n  }\n\n  // CC7.4 — \"Configuration change tracking\"\n  const modelFingerprints = new Set(runs.map((r) => r.modelFingerprint).filter(Boolean) as string[])\n  const promptHashes = new Set(runs.map((r) => r.promptSha).filter(Boolean) as string[])\n  const codeSha = new Set(runs.map((r) => r.codeSha).filter(Boolean) as string[])\n  if (codeSha.size === 0) {\n    findings.push({\n      id: 'CC7.4-code',\n      severity: 'high',\n      control: 'SOC2:CC7.4',\n      summary: 'No codeSha recorded on runs — cannot attribute scores to a specific release.',\n      remediation: 'Populate Run.codeSha with the git SHA of the system at run time.',\n    })\n  }\n  if (promptHashes.size === 0) {\n    findings.push({\n      id: 'CC7.4-prompt',\n      severity: 'medium',\n      control: 'SOC2:CC7.4',\n      summary: 'No promptSha recorded — prompt changes are untracked.',\n    })\n  }\n\n  const payload = {\n    controls: ['CC7.1', 'CC7.2', 'CC7.3', 'CC7.4'],\n    runCount: runs.length,\n    failureRate,\n    abortedCount: aborted.length,\n    incidentEventCount: totalIncidents,\n    distinctReleases: {\n      codeShas: codeSha.size,\n      promptHashes: promptHashes.size,\n      modelFingerprints: modelFingerprints.size,\n    },\n  }\n\n  return {\n    framework: 'SOC2',\n    version: '2017-Common-Criteria',\n    context: {\n      organization: ctx.organization,\n      systemName: ctx.systemName,\n      periodStart: ctx.periodStart,\n      periodEnd: ctx.periodEnd,\n      owner: ctx.owner,\n    },\n    summary: summarize(findings),\n    findings,\n    payload,\n    generatedAt: new Date().toISOString(),\n  }\n}\n"],"mappings":";AAmEO,SAAS,eAAe,QAAkC;AAC/D,QAAM,WAA0D;AAAA,IAC9D,MAAM;AAAA,IACN,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,UAAU;AAAA,EACZ;AACA,QAAM,QAAkB,CAAC;AACzB,QAAM,KAAK,KAAK,OAAO,SAAS,kBAAa,OAAO,QAAQ,UAAU,EAAE;AACxE,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,qBAAqB,OAAO,QAAQ,YAAY,IAAI;AAC/D,QAAM,KAAK,aAAa,OAAO,QAAQ,WAAW,WAAM,OAAO,QAAQ,SAAS,EAAE;AAClF,QAAM;AAAA,IACJ,YAAY,OAAO,QAAQ,MAAM,IAAI,IAAI,OAAO,QAAQ,MAAM,IAAI,KAAK,OAAO,QAAQ,MAAM,KAAK;AAAA,EACnG;AACA,QAAM,KAAK,gBAAgB,OAAO,WAAW,EAAE;AAC/C,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,qBAAgB,OAAO,QAAQ,OAAO,EAAE;AACnD,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,GAAG,OAAO,QAAQ,QAAQ,cAAc;AACnD,aAAW,CAAC,KAAK,CAAC,KAAK,OAAO,QAAQ,OAAO,QAAQ,SAAS,GAE3D;AACD,QAAI,IAAI,EAAG,OAAM,KAAK,KAAK,SAAS,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,EAAE;AAAA,EACzD;AACA,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,aAAa;AACxB,QAAM,KAAK,EAAE;AACb,aAAW,KAAK,OAAO,UAAU;AAC/B,UAAM,KAAK,OAAO,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,WAAM,EAAE,OAAO,EAAE;AAC/D,UAAM,KAAK,EAAE;AACb,UAAM,KAAK,EAAE,OAAO;AACpB,QAAI,EAAE,UAAU;AACd,YAAM,KAAK,EAAE;AACb,YAAM,KAAK,iBAAiB,EAAE,QAAQ,EAAE;AAAA,IAC1C;AACA,QAAI,EAAE,aAAa;AACjB,YAAM,KAAK,EAAE;AACb,YAAM,KAAK,oBAAoB,EAAE,WAAW,EAAE;AAAA,IAChD;AACA,UAAM,KAAK,EAAE;AAAA,EACf;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AAEO,SAAS,UAAU,UAA4D;AACpF,QAAM,YAAsD;AAAA,IAC1D,MAAM;AAAA,IACN,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,UAAU;AAAA,EACZ;AACA,aAAW,KAAK,SAAU,WAAU,EAAE,QAAQ;AAC9C,QAAM,UACJ,UAAU,WAAW,UAAU,OAAO,IAClC,kBACA,UAAU,SAAS,UAAU,MAAM,IACjC,4BACA;AACR,SAAO,EAAE,UAAU,SAAS,QAAQ,WAAW,QAAQ;AACzD;;;AC1FO,SAAS,iBAAiB,SAAsC;AACrE,MAAI,QAAQ,mBAAmB,QAAQ,iBAAiB,QAAQ,WAAY,QAAO;AACnF,MAAI,QAAQ,SAAU,QAAO;AAC7B,MAAI,QAAQ,WAAW,QAAQ,wBAAyB,QAAO;AAC/D,SAAO;AACT;AAEA,eAAsB,cACpB,KACA,SAC2B;AAC3B,QAAM,YAAY,iBAAiB,OAAO;AAC1C,QAAM,WAAgC,CAAC;AAEvC,MAAI,cAAc,gBAAgB;AAChC,aAAS,KAAK;AAAA,MACZ,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAEA,MAAI,cAAc,QAAQ;AAExB,QAAI,CAAC,IAAI,SAAS;AAChB,eAAS,KAAK;AAAA,QACZ,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,SACE;AAAA,QACF,aAAa;AAAA,MACf,CAAC;AAAA,IACH;AAEA,QAAI,IAAI,SAAS,WAAW,GAAG;AAC7B,eAAS,KAAK;AAAA,QACZ,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAEA,UAAM,OAAO,MAAM,IAAI,WAAW,SAAS;AAAA,MACzC,OAAO,KAAK,MAAM,IAAI,WAAW;AAAA,MACjC,OAAO,KAAK,MAAM,IAAI,SAAS;AAAA,IACjC,CAAC;AACD,QAAI,KAAK,WAAW,GAAG;AACrB,eAAS,KAAK;AAAA,QACZ,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAEA,QAAI,CAAC,QAAQ,WAAW,CAAC,QAAQ,yBAAyB;AAAA,IAE1D,OAAO;AACL,eAAS,KAAK;AAAA,QACZ,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,SACE;AAAA,MACJ,CAAC;AAAA,IACH;AAEA,QAAI,CAAC,IAAI,OAAO,OAAO;AACrB,eAAS,KAAK;AAAA,QACZ,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,SAAS;AAAA,QACT,aAAa;AAAA,MACf,CAAC;AAAA,IACH;AAEA,QAAI,CAAC,IAAI,cAAc;AACrB,eAAS,KAAK;AAAA,QACZ,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,SAAS;AAAA,QACT,aAAa;AAAA,MACf,CAAC;AAAA,IACH;AAAA,EACF;AAEA,MAAI,cAAc,WAAW;AAC3B,aAAS,KAAK;AAAA,MACZ,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAEA,QAAM,UAAU;AAAA,IACd;AAAA,IACA;AAAA,IACA,kBACE,cAAc,SACV,CAAC,KAAK,KAAK,MAAM,MAAM,MAAM,MAAM,IAAI,IACvC,cAAc,YACZ,CAAC,IAAI,IACL,CAAC,MAAM;AAAA,EACjB;AAEA,SAAO;AAAA,IACL,WAAW;AAAA,IACX,SAAS;AAAA,IACT,SAAS;AAAA,MACP,cAAc,IAAI;AAAA,MAClB,YAAY,IAAI;AAAA,MAChB,aAAa,IAAI;AAAA,MACjB,WAAW,IAAI;AAAA,MACf,OAAO,IAAI;AAAA,IACb;AAAA,IACA,SAAS,UAAU,QAAQ;AAAA,IAC3B;AAAA,IACA;AAAA,IACA,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,EACtC;AACF;;;ACvJA,eAAsB,gBAAgB,KAAmD;AACvF,QAAM,WAAgC,CAAC;AAGvC,MAAI,CAAC,IAAI,OAAO,OAAO;AACrB,aAAS,KAAK;AAAA,MACZ,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAGA,MAAI,IAAI,SAAS,WAAW,GAAG;AAC7B,aAAS,KAAK;AAAA,MACZ,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,EACH,OAAO;AAEL,eAAW,YAAY,IAAI,UAAU;AACnC,UAAI,CAAC,SAAS,eAAe,SAAS,YAAY,SAAS,IAAI;AAC7D,iBAAS,KAAK;AAAA,UACZ,IAAI;AAAA,UACJ,UAAU;AAAA,UACV,SAAS;AAAA,UACT,SAAS,YAAY,SAAS,IAAI;AAAA,UAClC,UAAU,gBAAgB,SAAS,WAAW;AAAA,UAC9C,aACE;AAAA,QACJ,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAGA,MAAI,CAAC,IAAI,SAAS;AAChB,aAAS,KAAK;AAAA,MACZ,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS;AAAA,MACT,aACE;AAAA,IACJ,CAAC;AAAA,EACH,WAAW,IAAI,QAAQ,kBAAkB,KAAK;AAC5C,aAAS,KAAK;AAAA,MACZ,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS,uBAAuB,IAAI,QAAQ,kBAAkB,KAAK,QAAQ,CAAC,CAAC;AAAA,MAC7E,UAAU,KAAK,UAAU,IAAI,QAAQ,kBAAkB;AAAA,MACvD,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAGA,QAAM,OAAO,MAAM,IAAI,WAAW,SAAS;AAAA,IACzC,OAAO,KAAK,MAAM,IAAI,WAAW;AAAA,IACjC,OAAO,KAAK,MAAM,IAAI,SAAS;AAAA,EACjC,CAAC;AACD,MAAI,KAAK,WAAW,GAAG;AACrB,aAAS,KAAK;AAAA,MACZ,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAGA,MAAI,CAAC,IAAI,oBAAoB,IAAI,iBAAiB,WAAW,GAAG;AAC9D,aAAS,KAAK;AAAA,MACZ,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS;AAAA,MACT,aACE;AAAA,IACJ,CAAC;AAAA,EACH,OAAO;AACL,UAAM,OAAO,IAAI,iBAAiB,OAAO,CAAC,MAAM,OAAO,SAAS,EAAE,OAAO,KAAK,EAAE,UAAU,GAAG;AAC7F,QAAI,KAAK,SAAS,GAAG;AACnB,eAAS,KAAK;AAAA,QACZ,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,SAAS,GAAG,KAAK,MAAM;AAAA,QACvB,aAAa;AAAA,MACf,CAAC;AAAA,IACH;AAAA,EACF;AAGA,MAAI,CAAC,IAAI,cAAc;AACrB,aAAS,KAAK;AAAA,MACZ,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,EACH,OAAO;AACL,UAAM,WAAW,MAAM,IAAI,aAAa,KAAK;AAAA,MAC3C,OAAO,KAAK,MAAM,IAAI,WAAW;AAAA,MACjC,OAAO,KAAK,MAAM,IAAI,SAAS;AAAA,IACjC,CAAC;AACD,QAAI,SAAS,WAAW,GAAG;AACzB,eAAS,KAAK;AAAA,QACZ,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AAGA,QAAM,aAAmD,CAAC;AAC1D,aAAW,YAAY,IAAI,UAAU;AAGnC,eAAW,KAAK,EAAE,MAAM,SAAS,MAAM,IAAI,iBAAiB,KAAK,SAAS,WAAW,EAAE,CAAC;AAAA,EAC1F;AAEA,QAAM,UAAU;AAAA,IACd,mBAAmB;AAAA,MACjB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,UAAU,KAAK;AAAA,IACf,iBAAiB,IAAI,SAAS,mBAAmB;AAAA,IACjD,mBAAmB;AAAA,EACrB;AAEA,SAAO;AAAA,IACL,WAAW;AAAA,IACX,SAAS;AAAA,IACT,SAAS;AAAA,MACP,cAAc,IAAI;AAAA,MAClB,YAAY,IAAI;AAAA,MAChB,aAAa,IAAI;AAAA,MACjB,WAAW,IAAI;AAAA,MACf,OAAO,IAAI;AAAA,IACb;AAAA,IACA,SAAS,UAAU,QAAQ;AAAA,IAC3B;AAAA,IACA;AAAA,IACA,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,EACtC;AACF;;;ACnKA,eAAsB,WAAW,KAAmD;AAClF,QAAM,WAAgC,CAAC;AACvC,QAAM,QAAQ,KAAK,MAAM,IAAI,WAAW;AACxC,QAAM,MAAM,KAAK,MAAM,IAAI,SAAS;AACpC,QAAM,OAAO,MAAM,IAAI,WAAW,SAAS,EAAE,OAAO,OAAO,OAAO,IAAI,CAAC;AAGvE,QAAM,cACJ,KAAK,SAAS,IAAI,KAAK,OAAO,CAAC,MAAM,EAAE,SAAS,SAAS,KAAK,EAAE,SAAS,KAAK,SAAS;AACzF,MAAI,gBAAgB,QAAQ,cAAc,KAAK;AAC7C,aAAS,KAAK;AAAA,MACZ,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS,wBAAwB,cAAc,KAAK,QAAQ,CAAC,CAAC;AAAA,MAC9D,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AACA,MAAI,KAAK,WAAW,GAAG;AACrB,aAAS,KAAK;AAAA,MACZ,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAGA,QAAM,UAAU,KAAK,OAAO,CAAC,MAAM,EAAE,WAAW,SAAS;AACzD,MAAI,QAAQ,SAAS,KAAK,SAAS,QAAQ,QAAQ,UAAU,GAAG;AAC9D,aAAS,KAAK;AAAA,MACZ,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS,GAAG,QAAQ,MAAM;AAAA,MAC1B,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAGA,QAAM,iBAAiB,MAAM,IAAI,WAAW,OAAO;AAAA,IACjD,MAAM;AAAA,IACN,OAAO;AAAA,IACP,OAAO;AAAA,EACT,CAAC;AACD,QAAM,cAAc,MAAM,IAAI,WAAW,OAAO,EAAE,MAAM,SAAS,OAAO,OAAO,OAAO,IAAI,CAAC;AAC3F,QAAM,iBAAiB,eAAe,SAAS,YAAY;AAC3D,MAAI,iBAAiB,GAAG;AAEtB,aAAS,KAAK;AAAA,MACZ,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS,GAAG,cAAc;AAAA,MAC1B,aACE;AAAA,IACJ,CAAC;AAAA,EACH;AAGA,QAAM,oBAAoB,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,OAAO,CAAa;AACjG,QAAM,eAAe,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,OAAO,CAAa;AACrF,QAAM,UAAU,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,OAAO,CAAa;AAC9E,MAAI,QAAQ,SAAS,GAAG;AACtB,aAAS,KAAK;AAAA,MACZ,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AACA,MAAI,aAAa,SAAS,GAAG;AAC3B,aAAS,KAAK;AAAA,MACZ,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,QAAM,UAAU;AAAA,IACd,UAAU,CAAC,SAAS,SAAS,SAAS,OAAO;AAAA,IAC7C,UAAU,KAAK;AAAA,IACf;AAAA,IACA,cAAc,QAAQ;AAAA,IACtB,oBAAoB;AAAA,IACpB,kBAAkB;AAAA,MAChB,UAAU,QAAQ;AAAA,MAClB,cAAc,aAAa;AAAA,MAC3B,mBAAmB,kBAAkB;AAAA,IACvC;AAAA,EACF;AAEA,SAAO;AAAA,IACL,WAAW;AAAA,IACX,SAAS;AAAA,IACT,SAAS;AAAA,MACP,cAAc,IAAI;AAAA,MAClB,YAAY,IAAI;AAAA,MAChB,aAAa,IAAI;AAAA,MACjB,WAAW,IAAI;AAAA,MACf,OAAO,IAAI;AAAA,IACb;AAAA,IACA,SAAS,UAAU,QAAQ;AAAA,IAC3B;AAAA,IACA;AAAA,IACA,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,EACtC;AACF;","names":[]}