@tangle-network/agent-eval 0.128.2 → 0.129.0

package/dist/rollout/index.d.ts

@@ -25,6 +25,28 @@ import { DatabaseSync } from 'node:sqlite';
  * `outcome.reward` is THE single scalar (null = no verdict exists — a
  * labeled gap, never 0). `outcome.realness_gated` is the anti-Goodhart
  * flag: a gated line must never export as a positive training example.
+ *
+ * That last sentence is enforced here, by `validateRolloutLine`, not merely
+ * documented. Validating `reward` and `realness_gated` independently — each a
+ * well-typed field, their COMBINATION unchecked — is what let a line claiming
+ * `{reward: 0.95, realness_gated: true}` validate clean and walk into every
+ * training export. The relationship between the two IS the invariant, so it is
+ * checked where every other structural claim about a line is checked.
+ *
+ * The invariant is about the OUTCOME, not about one field of it. Zeroing
+ * `reward` while `outcome.metrics` still carried the per-layer scores that
+ * reward was computed from exported the gamed signal anyway, in the dict the
+ * verifiers format reads as its per-rubric scores. So `gateGamedOutcome`
+ * transforms the whole outcome once, at `assertMinted` — the funnel every
+ * minted line passes — and the reward-bearing components are relocated to
+ * `provenance.gated_evidence`, which no exporter projects.
+ *
+ * WHICH checks each door applies is not decided in this file. `./gate-checks`
+ * owns the canonical list and the total per-entry-point policy; the three doors
+ * below (`validateRolloutLine`, `assertRewardGate`, `assertMinted`) each call
+ * `gateErrors` with their declared policy, so a check added to that list applies
+ * here without anyone editing this file, and a check deliberately skipped has to
+ * name itself there.
  */
 declare const ROLLOUT_SCHEMA = "tangle.rollout.v1";
 /** `agent` = a solo evaluation run (no multi-agent topology). */
@@ -59,6 +81,14 @@ interface ChatMessage {
     /** Required on role:"tool" — the ChatToolCall this result answers. */
     tool_call_id?: string;
     name?: string;
+    /**
+     * Harbor ATIF `is_copied_context` (RFC 0001 rule 7): this turn was COPIED IN
+     * from another trajectory's context, not produced by the agent on this line.
+     * The RFC makes excluding it from SFT a MUST, and `toSftRows` does — training
+     * on it teaches the model to author text it never authored, and credits this
+     * run for another one's work. Absent = false (authored here).
+     */
+    is_copied_context?: boolean;
 }
 interface ToolDef {
     type: 'function';
@@ -82,6 +112,21 @@ interface RolloutStep {
     output?: string;
     status?: 'ok' | 'error';
     durationMs?: number;
+    /**
+     * LLM inferences this span represents. 0 = deterministic dispatch with no
+     * model call — distinct from absent, which means the producer did not track it.
+     */
+    llm_call_count?: number;
+    /** Exact prompt tokenization. Removes the ambiguity of re-tokenizing text at train time. */
+    prompt_token_ids?: number[];
+    /** Exact completion tokenization; aligns index-wise with `logprobs`. */
+    completion_token_ids?: number[];
+    /**
+     * Per-completion-token log probabilities under the sampling policy. Required
+     * for off-policy correction (importance weighting) when the rollout was
+     * generated by a policy other than the one being trained.
+     */
+    logprobs?: number[];
 }
 interface RolloutTask {
     /** Benchmark/suite id (e.g. "swe-bench-verified") or the experiment id. */
@@ -126,11 +171,39 @@ interface RolloutOutcome {
     is_truncated: boolean;
     error: string | null;
     /**
-     * Anti-Goodhart flag from `RunRecord.outcome.realness.gated`: the run
-     * faked its success signal. Reward is forced to 0 at mint time and the
-     * line never qualifies for SFT.
+     * Anti-Goodhart flag from `RunRecord.outcome.realness.gated`: the run faked
+     * its success signal. `true` requires `reward` to be 0 or null — the
+     * validator rejects the line otherwise — and the line never qualifies for
+     * SFT. Required on the wire: a line that does not state the flag does not
+     * validate, so no producer can dodge the gate by omitting it.
+     *
+     * `true` ALSO requires `metrics` to be empty and `verdict` to be null: the
+     * numbers the reward was computed from are relocated to
+     * `provenance.gated_evidence` by `gateGamedOutcome`. See that function for
+     * why zeroing the scalar alone was not enough.
      */
     realness_gated: boolean;
+    /**
+     * Whether an authenticity SCREEN ever RAN on this reward — a different claim
+     * from `realness_gated`, which is the screen's VERDICT.
+     *
+     * `realness_gated: false` reads as "we looked and nothing fired". A producer
+     * with no screen at all was emitting exactly that, so a never-screened reward
+     * was indistinguishable on the wire from a screened-clean one, and the whole
+     * anti-Goodhart apparatus silently treated the first as the second. The two
+     * claims are now separable:
+     *
+     *   - `true`   — a screen ran; `realness_gated` is its verdict.
+     *   - `false`  — the producer declares it HAS no screen (`unscreenedRewardFields`).
+     *                `assertMinted` REFUSES such a line when its reward is above
+     *                zero: an unscreened positive reward is precisely the signal
+     *                the gate exists to qualify, and nothing has qualified it.
+     *   - absent   — not stated. Pre-unification ledgers land here, as does a
+     *                `RunRecord` carrying no `outcome.realness` at all. Absent is
+     *                read as "unknown", never as `false` (which would refuse most
+     *                of the existing corpus) and never as `true`.
+     */
+    realness_screened?: boolean;
 }
 interface RolloutCostBlock {
     usd: number | null;
@@ -140,6 +213,11 @@ interface RolloutCostBlock {
     cache_read: number | null;
     cache_write: number | null;
     wall_s: number | null;
+    /**
+     * Total LLM inferences across the invocation (ATIF `llm_call_count`,
+     * aggregated). Optional and additive: absent = not tracked, never 0.
+     */
+    llm_call_count?: number | null;
 }
 interface RolloutArtifacts {
     patch_path: string | null;
@@ -147,11 +225,43 @@ interface RolloutArtifacts {
     /** Source-of-truth transcript pointer (session id / jsonl path) for audit. */
     transcript_ref: string | null;
 }
+/**
+ * The reward-bearing half of a GATED line's outcome, moved off `outcome` and
+ * parked here verbatim. Diagnostics, never training input — see
+ * `gateGamedOutcome`.
+ */
+interface GatedEvidence {
+    /** `outcome.metrics` exactly as the producer measured it. */
+    metrics?: Record<string, unknown>;
+    /** `outcome.verdict` verbatim — the judge record that claimed the success. */
+    verdict?: unknown;
+    /**
+     * The per-step fields `tangle.rollout.v1` does not declare, parked here when
+     * the gate projected `steps[]` down to the schema's own key set.
+     *
+     * A per-step reward is training signal exactly like the scalar, and `steps`
+     * rides through `toRewardRows` verbatim — so a gated line was shipping its
+     * step-level credit assignment at full value beside a `reward` of 0.
+     */
+    steps?: unknown;
+}
 interface RolloutProvenance {
     captured_at: string;
     capture: RolloutCapture;
-    /** Present on gap lines: why `messages` could not be recovered. */
+    /**
+     * Why this line is incomplete. Required when `messages` is empty (the
+     * transcript could not be recovered); also set by interchange importers to
+     * name a MISSING LABEL — an imported trajectory carries no verdict, so
+     * `outcome.reward` is null and this says why.
+     */
     gap?: string;
+    /**
+     * Present only on a realness-gated line: the outcome fields the gate
+     * relocated, kept so an auditor can still see WHY the run was gated and what
+     * it claimed. Deliberately OUTSIDE `outcome`, because every training exporter
+     * reads `outcome` and none reads `provenance`.
+     */
+    gated_evidence?: GatedEvidence;
 }
 interface RolloutLine {
     schema: typeof ROLLOUT_SCHEMA;
@@ -180,9 +290,120 @@ interface RolloutLine {
     artifacts: RolloutArtifacts;
     provenance: RolloutProvenance;
 }
+/**
+ * THE anti-Goodhart gate, applied to the WHOLE outcome as a TRANSFORMATION.
+ *
+ * Two prior rounds enforced the gate as a CHECK ON ONE FIELD at N call sites,
+ * and each round the next reward-bearing field leaked. The one that shipped:
+ * `mintRolloutRows` bulk-copied `RunRecord.outcome.raw` into `outcome.metrics`
+ * with no gate, so a gated run exported `reward: 0` (correct) while the
+ * deterministic per-layer scores that reward was COMPUTED FROM — the
+ * `layer.*` keys `rl/verifiable-reward.ts` calls the RL training signal —
+ * shipped at 1.0, in the top-level `metrics` dict of the Prime Intellect
+ * verifiers format, which IS that format's per-rubric score dict. `verdict`
+ * leaks the same way into `toRftItem`'s `reference.verdict`, where a grader
+ * author reads `resolved: true` off a run that faked it.
+ *
+ * So the rule is no longer "zero the field we remembered". It is: if the gate
+ * fired, the outcome that leaves here carries NOTHING positive that was derived
+ * from the reward, whichever field a present or future exporter decides to
+ * read. `reward` is already forced to 0 upstream (`trainingReward`) and
+ * REJECTED here if it is not; `metrics` and `verdict` are relocated.
+ *
+ * WHERE they go, and why relocation rather than deletion: zeroing destroys the
+ * audit trail that shows why the run was gated and what it claimed, which is
+ * the row an auditor most wants and the labeled example a gaming DETECTOR
+ * trains on. `provenance.gated_evidence` keeps every byte, at a path no
+ * training exporter reads — all four release configs and every `rl/exporters`
+ * shape project from `outcome`, `messages`, `cost` and `task`; none projects
+ * `provenance`. Auditability preserved, training signal removed, and a future
+ * exporter that reads a field nobody thought of is safe by construction because
+ * the field is empty rather than because the exporter remembered to check.
+ *
+ * Idempotent: a second application finds nothing left to move and returns the
+ * line unchanged, so re-minting a line read back off a ledger cannot clobber
+ * the evidence it already carries.
+ */
+declare function gateGamedOutcome(line: RolloutLine): RolloutLine;
 declare function validateRolloutLine(value: unknown): string[];
 declare function assertRolloutLine(value: unknown, context?: string): asserts value is RolloutLine;
 declare function isRolloutLine(value: unknown): value is RolloutLine;
+/**
+ * Phantom property. `declare const` means it exists only in the type system:
+ * nothing is written at runtime, so a branded line still serializes to exactly
+ * the same JSON as a plain one.
+ */
+declare const MINTED_ROLLOUT: unique symbol;
+/**
+ * A minted outcome states the gate verdict — it is not allowed to stay silent —
+ * and, when that verdict is `true`, carries nothing else the reward was derived
+ * from (`gateGamedOutcome` has run).
+ */
+interface MintedRolloutOutcome extends RolloutOutcome {
+    realness_gated: boolean;
+}
+/**
+ * A `RolloutLine` whose reward has been checked against the anti-Goodhart
+ * invariant. The type every training-data exporter takes.
+ *
+ * Why a brand and not just the interface: `RolloutLine` is structural, so any
+ * hand-built object literal of the right shape IS one — which is how a line
+ * declaring `{reward: 0.95, realness_gated: true}` reached the exporters
+ * despite them "only accepting a minted line". The phantom symbol makes the
+ * type nominal: it cannot be produced by writing an object literal, only by
+ * `mintRolloutRows` (which applies the gate), `readRolloutLedger` (which
+ * validates every line off disk), or an explicit, greppable `assertMinted`.
+ *
+ * Belt and braces on purpose. The brand closes first-party call sites at
+ * COMPILE time; `validateRolloutLine` closes data arriving at RUNTIME (ledger
+ * files, foreign imports, JSON from another process) where types are absent.
+ * Neither alone is enough.
+ *
+ * Assignable to `RolloutLine` in one direction only: readers, analysis, and
+ * the ledger writer keep taking the plain type.
+ */
+type MintedRolloutLine = Omit<RolloutLine, 'outcome'> & {
+    readonly [MINTED_ROLLOUT]: true;
+    outcome: MintedRolloutOutcome;
+};
+/**
+ * Promote a line to the type the training exporters accept, applying the
+ * anti-Goodhart gate to the WHOLE outcome on the way through. THE escape hatch
+ * — grep `assertMinted` to enumerate every place a line enters the training
+ * path without coming from mint or a ledger.
+ *
+ * The gate runs HERE, once, rather than at each producer, because this is the
+ * single funnel every minted line passes: `mintRolloutRows` calls it,
+ * `readRolloutLedger` calls it per line off disk, `scrubLines` calls it on the
+ * way out of a release, and a hand-built line has no other door. One
+ * transformation at the funnel means an already-published ledger holding a
+ * gated line with populated `metrics` is RE-GATED when it is read, instead of
+ * being rejected (which would make every such artifact unreadable) or trusted
+ * (which is the leak). Three steps, in this order:
+ *
+ *   1. VALIDATE the schema.
+ *   2. REFUSE every check `GATE_POLICIES.assertMinted` marks `enforce` — today
+ *      the reward relationship (which stays a REJECTION: a caller claiming
+ *      `{reward: 0.95, realness_gated: true}` is a producer defect and must fail
+ *      loudly, since laundering it into `reward: 0` here would hide the
+ *      producer) and a positive reward the producer declared it never screened.
+ *   3. TRANSFORM the one check that policy marks `repair` — relocate the
+ *      reward's components off `outcome` (`gateGamedOutcome`), so no exporter
+ *      can leak them whichever field it reads.
+ *
+ * Step 2 enumerates nothing by hand: a check added to `GATE_CHECKS` is enforced
+ * here the moment its disposition in that policy says so.
+ *
+ * Also normalizes the optional wire flag to an explicit boolean.
+ * `realness_gated` is absent on pre-unification ledgers and absent means "not
+ * flagged" per the schema, so filling it in states a claim the line was already
+ * making, and makes the flag readable on every published row instead of most of
+ * them. `realness_screened` is NOT filled in: absent means "unknown", and
+ * inventing either value there would be the same overclaim this round removed.
+ */
+declare function assertMinted(value: unknown, context?: string): MintedRolloutLine;
+/** `assertMinted` over a batch, naming the offending index in the error. */
+declare function assertMintedLines(values: readonly unknown[], context?: string): MintedRolloutLine[];
 
 /**
  * Pure exporters over `tangle.rollout.v1` lines → the training-data shapes
@@ -195,14 +416,72 @@ declare function isRolloutLine(value: unknown): value is RolloutLine;
  * All exporters are pure functions of the lines — filtering (never train on
  * holdout, reward thresholds, the realness gate) happens HERE, on inline
  * labels, no joins.
+ *
+ * Every exporter takes `MintedRolloutLine[]`, not `RolloutLine[]`: the reward
+ * on a minted line has been checked against the anti-Goodhart invariant, and
+ * the brand is what stops a hand-built object literal claiming a positive
+ * reward on a gamed run from being handed to an exporter that copies it
+ * verbatim into training data.
  */
 
+/**
+ * The gate's two claims, which travel TOGETHER on every emitted row.
+ *
+ * `realness_gated` alone is ambiguous, and the ambiguity is exploitable:
+ * `false` reads as "we screened it and nothing fired", so a producer that has no
+ * screen at all emitted rows indistinguishable from screened-clean ones, and
+ * every consumer of the published dataset read them as clean. The second field
+ * is what separates the two claims, and it only removes the ambiguity if it
+ * reaches the WIRE — for a round it existed on `RolloutOutcome` and on no
+ * exported row shape at all, which left the published rows exactly as ambiguous
+ * as before.
+ *
+ * So there is one helper and every row shape spreads it. A row that states one
+ * claim without the other is not constructible by copying the pattern, and
+ * `exporters.test.ts` walks every emitted shape to prove none does.
+ */
+interface RealnessLabels {
+    /** The screen's VERDICT: the run faked its success signal. */
+    realness_gated: boolean;
+    /**
+     * Whether a screen RAN at all. `true` = it ran, so `realness_gated` is its
+     * verdict. `false` = the producer declares it has none. `null` = not stated
+     * (pre-unification producers), which is "unknown" and never "clean".
+     */
+    realness_screened: boolean | null;
+}
+declare function realnessLabels(line: MintedRolloutLine): RealnessLabels;
 interface TrainingExportOptions {
     /** Include held-out evaluation data in training output. Default false. */
     allowHeldOutTrainingData?: boolean;
     /** Require reward to be strictly greater than this value. Default 0. */
     minimumQualityExclusive?: number;
 }
+/**
+ * What a signed-signal exporter (verifiers, RFT) does with lines that are not
+ * clean trainable successes — realness-gated lines above all.
+ *
+ *   - 'exclude'       — the default, the same fail-closed policy as every
+ *                       other training export: positive, completed,
+ *                       non-gated rows on a trainable split.
+ *   - 'zero-and-flag' — keep them, at their non-positive (or null) reward,
+ *                       with `RealnessLabels` on the row. The dataset release
+ *                       sets this per `FORMAT_GATE_DISPOSITION`: in these
+ *                       formats the reward is a signed learning signal, so a
+ *                       gamed trajectory at reward 0 is a correct negative,
+ *                       and dropping it would bias the negative population
+ *                       toward honest failures and leave a trainer no example
+ *                       of gaming being penalized. The split policy is NOT
+ *                       relaxed: held-out lines still need the named opt-in.
+ *
+ * SFT deliberately has no such option — an SFT row is an imitation target and
+ * a gamed trajectory must never appear in one at any weight.
+ */
+type GatedLineDisposition = 'exclude' | 'zero-and-flag';
+interface SignedSignalExportOptions extends TrainingExportOptions {
+    /** Disposition for non-trainable lines. Default 'exclude'. */
+    gatedLines?: GatedLineDisposition;
+}
 type SftExportOptions = TrainingExportOptions;
 interface SftRow {
     messages: ChatMessage[];
@@ -212,15 +491,24 @@ interface SftRow {
         candidate_id: string | null;
         instance_id: string;
         reward: number;
-    };
+    } & RealnessLabels;
 }
 /**
  * Supervised fine-tune rows: the completed conversation of each qualifying
  * line. Fail-closed filters: trainable split only (never holdout/canary),
- * positive reward, realness-gated lines never qualify, gap lines carry
- * no trainable content.
+ * reward strictly above `minimumQualityExclusive` (default 0), realness-gated
+ * lines never qualify, gap lines carry no trainable content, and
+ * copied-context turns are dropped from the transcript (Harbor ATIF RFC 0001
+ * rule 7 — see `ChatMessage.is_copied_context`).
+ *
+ * `realness_gated` is therefore always `false` on an emitted row. It is carried
+ * anyway: an SFT row is a pure imitation target, so the row states its realness
+ * claims instead of making the reader know the format's policy, and carrying
+ * both flags on all four shapes is what lets the release accounting measure
+ * every config with one rule rather than skipping the one whose row shape
+ * happened to omit the field.
  */
-declare function toSftRows(lines: RolloutLine[], options?: SftExportOptions): SftRow[];
+declare function toSftRows(lines: MintedRolloutLine[], options?: SftExportOptions): SftRow[];
 interface RewardRow {
     /** First user turn — the task prompt. */
     prompt: string;
@@ -232,12 +520,12 @@ interface RewardRow {
         candidate_id: string | null;
         instance_id: string;
         split: RolloutSplit;
-    };
+    } & RealnessLabels;
 }
 /**
  * Reward-labeled rows for completed, positive-quality training runs.
  */
-declare function toRewardRows(lines: RolloutLine[], options?: TrainingExportOptions): RewardRow[];
+declare function toRewardRows(lines: MintedRolloutLine[], options?: TrainingExportOptions): RewardRow[];
 interface VerifiersTokenUsage {
     input_tokens: number | null;
     output_tokens: number | null;
@@ -264,10 +552,10 @@ interface VerifiersRolloutOutput {
         generation: number | null;
         candidate_index: number | null;
         role: RolloutLine['role'];
-    };
+    } & RealnessLabels;
 }
-declare function toVerifiersRolloutOutput(line: RolloutLine): VerifiersRolloutOutput;
-declare function toVerifiersRolloutOutputs(lines: RolloutLine[], options?: TrainingExportOptions): VerifiersRolloutOutput[];
+declare function toVerifiersRolloutOutput(line: MintedRolloutLine): VerifiersRolloutOutput;
+declare function toVerifiersRolloutOutputs(lines: MintedRolloutLine[], options?: SignedSignalExportOptions): VerifiersRolloutOutput[];
 interface RftItem {
     /** Prompt turns only — the graded completion is re-sampled during RFT. */
     messages: ChatMessage[];
@@ -280,18 +568,450 @@ interface RftItem {
         suite: string;
         split: RolloutSplit;
         rollout_id: string;
-    };
+    } & RealnessLabels;
 }
-declare function toRftItem(line: RolloutLine): RftItem;
+declare function toRftItem(line: MintedRolloutLine): RftItem;
 /** RFT needs a real prompt: lines whose transcript starts with prompt turns. */
-declare function toRftItems(lines: RolloutLine[], options?: TrainingExportOptions): RftItem[];
+declare function toRftItems(lines: MintedRolloutLine[], options?: SignedSignalExportOptions): RftItem[];
 declare function toJsonl(rows: ReadonlyArray<unknown>): string;
 
+/**
+ * THE canonical list of anti-Goodhart gate checks, plus the TOTAL policy every
+ * entry point has to declare over it.
+ *
+ * Four rounds of adversarial review found the same defect four times, and it
+ * was never the check itself: it was the COMPOSITION. `validateRolloutLine`
+ * composed one check, `assertMinted` composed two, `assertRewardGate` composed
+ * two of the three, `assertGateReport` composed its own pair — each by hand, in
+ * its own file. So a check added to the package applied wherever its author
+ * happened to remember, and the guard that forgot it looked exactly like the
+ * guard that didn't. The last leak was literally that: `assertRewardGate`
+ * composed `reward-relationship` + `gated-evidence` and not `unscreened-reward`,
+ * so a never-screened positive reward that `assertMinted` correctly REFUSED
+ * walked through all four waist exporters at full value.
+ *
+ * The fix is to make hand-composition impossible rather than to add a third
+ * call to the two places that had two:
+ *
+ *   - `GATE_CHECKS` is a TOTAL map over `GateCheckId`. A new id with no
+ *     implementation does not compile.
+ *   - `GatePolicy` is a TOTAL map over `GateCheckId`. Every entry point
+ *     declares one, so a new id makes EVERY entry point's policy a type error
+ *     until it is wired. Wiring it means writing `enforced`, `repairedBy(...)`
+ *     or `omittedBecause(...)` — and the last two force a written reason, so a
+ *     silent gap is not expressible.
+ *   - every check carries a `tripwire`: the minimal outcome it must refuse.
+ *     `gate-checks.test.ts` feeds each tripwire to every entry point that
+ *     declares `enforced` and requires a rejection, so wiring a check to the
+ *     wrong disposition is a TEST failure even when it type-checks.
+ *
+ * Adding a check is therefore: append the id, write the check, and the compiler
+ * enumerates every place that has to decide about it.
+ */
+
+/**
+ * Every gate check in the package, in the order they are applied.
+ *
+ * Order is load-bearing only for which message a caller sees first: a line that
+ * trips two checks reports the earlier one, and `reward-relationship` is first
+ * because it is the invariant the other three protect.
+ */
+declare const GATE_CHECK_IDS: readonly ["reward-relationship", "gated-evidence", "undeclared-step-payload", "unscreened-reward"];
+type GateCheckId = (typeof GATE_CHECK_IDS)[number];
+/**
+ * An outcome as it reaches a check.
+ *
+ * Deliberately accepts a raw record as well as the typed shape: the checks are
+ * the RUNTIME half of the gate, and the callers they exist for — JSON off a
+ * ledger, a plain-JavaScript consumer of the published package — arrive with no
+ * types at all. `Partial` because a tripwire states only the fields it trips on.
+ */
+type GateCheckedOutcome = Partial<RolloutOutcome> | Readonly<Record<string, unknown>>;
+/**
+ * What a gate check reads: the reward-bearing surface of ONE LINE.
+ *
+ * For three rounds the subject was the OUTCOME alone, and that assumption is
+ * what produced the next leak rather than any missing check: `steps[]` sits on
+ * the LINE, outside `outcome`, so a per-step reward on a gated line was read by
+ * no check at all while `toRewardRows` copied it out verbatim — through the
+ * MINTED door, not merely the raw one. Widening the subject is what makes
+ * "somewhere else on the line" a place the checks can see.
+ *
+ * `outcome` is REQUIRED, and that is the point: a bare `RolloutOutcome` is then
+ * not assignable to a subject, so every call site that used to pass one is a
+ * COMPILE error until it passes the line instead. A subject with an optional
+ * `outcome` would have let the old call sites keep compiling while silently
+ * checking nothing — the exact failure this module exists to make impossible.
+ */
+interface GateSubject {
+    outcome: GateCheckedOutcome;
+    /** The line's trajectory steps, when it carries any. */
+    steps?: unknown;
+}
+interface GateCheck {
+    id: GateCheckId;
+    /** One sentence: what this check refuses. */
+    refuses: string;
+    /** One dotted-path message per defect; `[]` when the line is clean. */
+    errors: (subject: GateSubject) => string[];
+    /**
+     * Every minimal subject that MUST trip `errors` — the executable form of
+     * `refuses`, and the reason a check cannot be added without being provable.
+     * The calibration test feeds each one to every entry point declaring
+     * `enforced`.
+     *
+     * A LIST rather than one case: a check that refuses two distinct populations
+     * (a positive reward AND a reward it cannot read as a number) proved able to
+     * hold for the first while silently passing the second, so each population
+     * states its own tripwire and each is exercised separately.
+     */
+    tripwires: GateSubject[];
+}
+/**
+ * The reward-bearing outcome fields that are NOT the scalar: the numbers the
+ * reward was computed from, and the verdict record that claimed it.
+ *
+ * Returned as one block rather than filtered key-by-key. A key-name heuristic
+ * ("zero anything matching `layer.*` or `/score/`") is the same defect shape as
+ * the line-oriented regex the AST score guard replaced: it holds until someone
+ * names a metric `pass_fraction`, and the next reward-shaped key ships at full
+ * value. The producer's OWN classification — "this is the scalar, that is
+ * everything else" — is the only partition that cannot be out-guessed.
+ */
+declare function gatedEvidenceOf(subject: GateSubject): GatedEvidence | undefined;
+/**
+ * The registry. Total over `GateCheckId`, so an id with no check does not
+ * compile, and `GATE_CHECK_IDS` stays the single enumeration everything
+ * iterates.
+ */
+declare const GATE_CHECKS: {
+    readonly [K in GateCheckId]: GateCheck;
+};
+/**
+ * What ONE entry point does about ONE check.
+ *
+ * `repair` and `omit` both carry a mandatory sentence, which is the mechanism
+ * that keeps a legitimate omission distinguishable from a forgotten one: you
+ * cannot skip a check without writing down why, and the reasons are readable
+ * side by side in `GATE_POLICIES`.
+ */
+type GateCheckDisposition = {
+    readonly kind: 'enforce';
+}
+/** Resolved by TRANSFORMING the line instead of rejecting it; `by` names the function. */
+ | {
+    readonly kind: 'repair';
+    readonly by: string;
+}
+/** Deliberately not applied here; `because` states the reason. */
+ | {
+    readonly kind: 'omit';
+    readonly because: string;
+};
+/** Total over `GateCheckId`: a new check makes every policy literal a type error. */
+type GatePolicy = {
+    readonly [K in GateCheckId]: GateCheckDisposition;
+};
+/**
+ * Every entry point that decides about the gate, and what it decides.
+ *
+ * Read this as the package's gate policy in one screen. The four entry points
+ * are not interchangeable — a validator that rejects, a mint funnel that
+ * repairs, a runtime backstop for untyped callers, and a release certifier over
+ * emitted rows — and the dispositions say which is which.
+ */
+declare const GATE_POLICIES: {
+    /**
+     * The schema validator. Rejects the reward relationship and NOTHING ELSE, on
+     * purpose: it runs on every line read off disk, and the other two conditions
+     * describe artifacts that already exist.
+     */
+    readonly validateRolloutLine: {
+        readonly 'reward-relationship': {
+            readonly kind: "enforce";
+        };
+        readonly 'gated-evidence': GateCheckDisposition;
+        readonly 'undeclared-step-payload': GateCheckDisposition;
+        readonly 'unscreened-reward': GateCheckDisposition;
+    };
+    /**
+     * The mint funnel — the single door every `MintedRolloutLine` passes. Validates
+     * first (so the reward relationship has already been rejected), then refuses
+     * what cannot be repaired, then repairs what can.
+     */
+    readonly assertMinted: {
+        readonly 'reward-relationship': {
+            readonly kind: "enforce";
+        };
+        readonly 'gated-evidence': GateCheckDisposition;
+        readonly 'undeclared-step-payload': GateCheckDisposition;
+        readonly 'unscreened-reward': {
+            readonly kind: "enforce";
+        };
+    };
+    /**
+     * The runtime backstop, and the one entry point with no license to omit
+     * anything: it exists for callers the type system never saw (plain JavaScript
+     * handing an object literal to a published exporter), so a check it skips is a
+     * check that does not run at all for them. This is where the fourth leak was.
+     */
+    readonly assertRewardGate: {
+        readonly 'reward-relationship': {
+            readonly kind: "enforce";
+        };
+        readonly 'gated-evidence': {
+            readonly kind: "enforce";
+        };
+        readonly 'undeclared-step-payload': {
+            readonly kind: "enforce";
+        };
+        readonly 'unscreened-reward': {
+            readonly kind: "enforce";
+        };
+    };
+    /**
+     * The release certifier. Same checks, measured over the rows a release is
+     * ABOUT TO WRITE rather than over one line's outcome — see `REPORT_MEASURES`
+     * in `release/gate-report.ts`, which is the second total map this policy
+     * drives.
+     */
+    readonly assertGateReport: {
+        readonly 'reward-relationship': {
+            readonly kind: "enforce";
+        };
+        readonly 'gated-evidence': {
+            readonly kind: "enforce";
+        };
+        readonly 'undeclared-step-payload': {
+            readonly kind: "enforce";
+        };
+        readonly 'unscreened-reward': {
+            readonly kind: "enforce";
+        };
+    };
+};
+/** Every entry point that declares a gate policy. */
+type GateEntryPoint = keyof typeof GATE_POLICIES;
+/**
+ * Run the checks one entry point enforces. The ONLY way an entry point should
+ * obtain gate errors — hand-composing two of the three is the bug this module
+ * exists to remove.
+ */
+declare function gateErrors(subject: GateSubject, policy: GatePolicy): string[];
+
+/**
+ * Harbor ATIF-v1.7 interchange — `tangle.rollout.v1` ⇄ Agent Trajectory
+ * Interchange Format.
+ *
+ * ATIF is the portability format (spec:
+ * https://www.harborframework.com/docs/agents/trajectory-format, normative
+ * RFC: harbor-framework/harbor `rfcs/0001-trajectory-format.md`). It sits
+ * BELOW the waist of the rollout hourglass in both directions — export reads
+ * `RolloutLine[]`, import writes `RolloutLine[]` — and it is never a source
+ * of training labels:
+ *
+ *   ATIF models NO reward, NO judge verdict, NO task/split coordinates.
+ *
+ * Consequences, both deliberate:
+ *   - EXPORT drops `outcome.reward`, `outcome.reward_source` and
+ *     `outcome.verdict` entirely. They are not smuggled into `extra`: a
+ *     third-party reading our ATIF file must not be able to mistake an
+ *     agent-eval judge score for something ATIF sanctioned.
+ *   - IMPORT therefore mints UNLABELED lines: `reward: null` (the existing
+ *     "null reward is a labeled gap, never 0" semantics), `verdict: null`,
+ *     and a `provenance.gap` naming the missing label. An imported
+ *     trajectory is not a training example until a judge scores it.
+ *
+ * Everything else we own that ATIF has no field for travels in a namespaced
+ * escrow at `extra.tangle.*`, so our own round-trip is exact while a foreign
+ * reader can ignore it. Fields that neither ATIF nor the escrow can carry
+ * come back explicitly null / fail-closed, never invented.
+ *
+ * THE ESCROW IS NAMESPACED, NOT AUTHENTICATED. Anyone can write
+ * `extra.tangle.*` into a file. So the escrow may restore what a value IS, but
+ * never what a line is ALLOWED to do: `task.split` is forced to `holdout` on
+ * every import regardless of what the document claims, and promoting an
+ * imported trajectory to a trainable split is an explicit, greppable act
+ * (`relabelImportedSplit`) rather than a property of the file. The document
+ * keeps its claim — the claim just is not authority.
+ *
+ * Multi-agent shape differs on purpose. ATIF EMBEDS children in
+ * `subagent_trajectories`; we keep a flat ledger with a normalized
+ * `parent_rollout_id` edge. Export assembles the tree, import flattens it.
+ * `session_id` is RUN-scoped in ATIF, so it carries `run_id` — the coordinate
+ * that is shared by every invocation of one run — not `rollout_id`, which
+ * identifies a single invocation and would split one run across session ids.
+ *
+ * ROUND-TRIPPING IS IDEMPOTENT: `import(export(import(export(x))))` is
+ * byte-identical to `import(export(x))`. Import composes `provenance.gap` as a
+ * de-duplicated ordered set rather than appending, and it emits every
+ * `ChatMessage` with keys in the canonical schema order (role, content,
+ * reasoning_content, tool_calls, tool_call_id, name, is_copied_context), so a
+ * ledger hashed on serialized bytes sees no diff across further passes. The
+ * FIRST import may re-order a producer's keys — that is the canonicalization.
+ *
+ * NOT building a Letta converter. Letta's trajectory-v1 is a strict subset of
+ * what we need from ATIF here — no per-step or aggregate cost, no
+ * multi-agent/subagent structure, no token-id or logprob channel — so a Letta
+ * sink would carry less than this one and add a second format to keep
+ * correct. Decision recorded in docs/rollout.md; do not re-litigate without a
+ * concrete consumer that reads Letta and cannot read ATIF.
+ */
+
+declare const ATIF_SCHEMA_VERSION = "ATIF-v1.7";
+/** Gap note on every imported line — ATIF carries no verdict, so nothing is scored. */
+declare const HARBOR_IMPORT_GAP = "imported from Harbor ATIF; no verdict";
+type HarborStepSource = 'system' | 'user' | 'agent';
+interface HarborImageSource {
+    media_type: string;
+    path: string;
+}
+interface HarborContentPart {
+    type: 'text' | 'image';
+    text?: string;
+    source?: HarborImageSource;
+}
+interface HarborToolCall {
+    tool_call_id: string;
+    function_name: string;
+    /** ATIF requires a decoded JSON object here, unlike our raw argument string. */
+    arguments: Record<string, unknown>;
+    extra?: Record<string, unknown>;
+}
+interface HarborSubagentTrajectoryRef {
+    trajectory_id?: string;
+    trajectory_path?: string;
+    /** Informational only since v1.7 — never a resolution key. */
+    session_id?: string;
+    extra?: Record<string, unknown>;
+}
+interface HarborObservationResult {
+    source_call_id?: string;
+    content?: string | HarborContentPart[];
+    subagent_trajectory_ref?: HarborSubagentTrajectoryRef[];
+    extra?: Record<string, unknown>;
+}
+interface HarborObservation {
+    results: HarborObservationResult[];
+}
+interface HarborMetrics {
+    prompt_tokens?: number;
+    completion_tokens?: number;
+    cached_tokens?: number;
+    cost_usd?: number;
+    prompt_token_ids?: number[];
+    completion_token_ids?: number[];
+    logprobs?: number[];
+    extra?: Record<string, unknown>;
+}
+interface HarborStep {
+    /** Ordinal, sequential from 1. */
+    step_id: number;
+    timestamp?: string;
+    source: HarborStepSource;
+    model_name?: string;
+    reasoning_effort?: string | number;
+    message: string | HarborContentPart[];
+    reasoning_content?: string;
+    tool_calls?: HarborToolCall[];
+    observation?: HarborObservation;
+    metrics?: HarborMetrics;
+    llm_call_count?: number;
+    is_copied_context?: boolean;
+    extra?: Record<string, unknown>;
+}
+interface HarborAgent {
+    name: string;
+    version: string;
+    model_name?: string;
+    /** OpenAI function-calling schema — byte-identical to our `ToolDef`. */
+    tool_definitions?: ToolDef[];
+    extra?: Record<string, unknown>;
+}
+interface HarborFinalMetrics {
+    total_prompt_tokens?: number;
+    total_completion_tokens?: number;
+    total_cached_tokens?: number;
+    total_cost_usd?: number;
+    total_steps?: number;
+    extra?: Record<string, unknown>;
+}
+interface HarborTrajectory {
+    schema_version: string;
+    session_id?: string;
+    /** Required on embedded subagents; we always set it so lines stay joinable. */
+    trajectory_id?: string;
+    agent: HarborAgent;
+    steps: HarborStep[];
+    notes?: string;
+    final_metrics?: HarborFinalMetrics;
+    continued_trajectory_ref?: string;
+    subagent_trajectories?: HarborTrajectory[];
+    extra?: Record<string, unknown>;
+}
+/**
+ * Assemble one episode's flat lines into a single ATIF trajectory tree,
+ * linked by `parent_rollout_id`.
+ *
+ * Reward, verdict and split are NOT emitted (ATIF models none of them); the
+ * split and the rest of the task coordinates survive only in `extra.tangle`.
+ *
+ * We deliberately do NOT synthesize an `observation.subagent_trajectory_ref`
+ * pointing at each child: our ledger records WHICH invocation spawned a
+ * worker, not which STEP did, and attaching the ref to a guessed step would
+ * fabricate a causal claim. Children are embedded in `subagent_trajectories`
+ * (each with the `trajectory_id` the spec requires) and the edge is stated in
+ * the child's escrowed `parent_rollout_id`.
+ *
+ * Throws when the lines are not one tree — use `toHarborTrajectories` for a forest.
+ */
+declare function toHarborTrajectory(lines: RolloutLine[]): HarborTrajectory;
+/** Every independent tree in the input, one ATIF document each. */
+declare function toHarborTrajectories(lines: RolloutLine[]): HarborTrajectory[];
+interface FromHarborOptions {
+    /** Injected clock for deterministic output when the source carries no capture time. */
+    now?: () => Date;
+}
+/**
+ * Flatten an ATIF trajectory tree back into `tangle.rollout.v1` lines, parent
+ * first, each child carrying `parent_rollout_id`.
+ *
+ * Every line comes back UNLABELED: `reward`, `reward_source` and `verdict` are
+ * null and `provenance.gap` says why. ATIF models no verdict, so scoring an
+ * imported trajectory is a judge's job, not this function's. Every line lands
+ * on `holdout` whatever the document claims — see `relabelImportedSplit`.
+ */
+declare function fromHarborTrajectory(trajectory: HarborTrajectory, options?: FromHarborOptions): RolloutLine[];
+/**
+ * THE explicit door out of `holdout` for imported lines.
+ *
+ * Import forces `holdout` because a document's own claim about its split is not
+ * evidence — anyone can write `extra.tangle.task.split`. Promoting a file to a
+ * trainable split is an operator's decision about provenance they verified, so
+ * it is a separate, greppable call: `grep relabelImportedSplit` enumerates
+ * every place foreign data was declared trainable, which is exactly the audit
+ * the trusted-escrow version made impossible.
+ *
+ * Returns plain `RolloutLine`s. They still have to pass `assertMinted` (and its
+ * anti-Goodhart check) to reach an exporter — re-labeling a split is not
+ * minting a reward.
+ */
+declare function relabelImportedSplit(lines: readonly RolloutLine[], split: RolloutSplit): RolloutLine[];
+
 /**
  * Rollout-ledger file API — append-only JSONL of validated `tangle.rollout.v1`
  * lines. Writes validate BEFORE touching disk (a bad line never lands);
  * reads validate line-by-line and fail loud with the line number, because a
  * silently-skipped rollout is a corrupted dataset.
+ *
+ * "Validate" includes the anti-Goodhart invariant (a realness-gated line may
+ * not carry a positive reward), so a poisoned line can neither enter a ledger
+ * nor leave one.
+ *
+ * Two read modes, matching the two write-side row classes: `readRolloutLedger`
+ * re-validates under the mint policy (training data), `readRolloutJournal`
+ * under the write policy (supervision journals, whose unscreened positive
+ * rewards are writable and must stay readable).
  */
 
 /** Replace the ledger file with exactly `lines`. */
@@ -301,8 +1021,29 @@ declare function appendRolloutLines(path: string, lines: RolloutLine[]): Promise
 /**
  * Read and validate every line. Throws on the first malformed/invalid line
  * (with its 1-based line number) — fail-closed, never a silent drop.
+ *
+ * Validation includes the anti-Goodhart invariant, which is why the result is
+ * `MintedRolloutLine[]`: a ledger file is the main way a rollout reaches this
+ * process from outside the type system (another run, another machine, a
+ * hand-edited JSONL), so this read is the runtime boundary where a poisoned
+ * line is refused rather than exported.
  */
-declare function readRolloutLedger(path: string): Promise<RolloutLine[]>;
+declare function readRolloutLedger(path: string): Promise<MintedRolloutLine[]>;
+/**
+ * Read a ledger under the WRITE-side policy (`validateRolloutLine`), which
+ * omits the unscreened-reward check. `writeRolloutLedger` accepts a
+ * supervision-journal row (`realness_screened: false` with a positive reward
+ * — the documented `unscreenedRewardFields` shape), and `GATE_POLICIES` says
+ * such rows "must stay writable, readable and reportable"; a read API that
+ * only re-validated under `assertMinted` made every such file unreadable —
+ * write-accepted but read-refused is a data-loss trap.
+ *
+ * The result is `RolloutLine[]`, NOT `MintedRolloutLine[]`: nothing read here
+ * can reach a training exporter without passing `assertMinted`, so the
+ * promotion gate (which DOES enforce unscreened-reward) is exactly as closed
+ * as before. Use `readRolloutLedger` when the file is training data.
+ */
+declare function readRolloutJournal(path: string): Promise<RolloutLine[]>;
 
 type AgentProfileCellSchemaVersion = 'agent-profile-cell/v1';
 type AgentProfileDimensionValue = string | number | boolean | null;
@@ -775,6 +1516,100 @@ interface TraceStore {
     artifacts(runId: string): Promise<Artifact[]>;
 }
 
+/**
+ * The two named score derivations every consumer must choose between.
+ *
+ * The anti-Goodhart gate (`outcome.realness.gated`) only holds if it is
+ * impossible to read a run's score WITHOUT deciding whether the gate applies.
+ * A bare `outcome.holdoutScore ?? outcome.searchScore` makes that decision
+ * invisible — and silently answers "no gate", which is the wrong default on
+ * every path that produces training data. So the expression lives here, once,
+ * behind two names that force the caller to state the intent:
+ *
+ *   - `trainingScore` / `trainingReward` — GATED. Anything that becomes
+ *     training data, or a reward a trainer consumes, uses these.
+ *   - `observedScore` — RAW. Analysis, reporting, and reward-hack DETECTION
+ *     need the ungated number; that is how a gamed run is visible at all.
+ *
+ * A leaf module on purpose: it imports only the `RunRecord` type, so gate and
+ * reporting code can depend on it without pulling in the trace store that
+ * `mint.ts` needs.
+ */
+
+/**
+ * Which split's score wins when a record carries both. `'holdout'` is the
+ * canonical "real signal" default; `'search'` exists because some callers
+ * deliberately score on the search split when both are present.
+ */
+type ScorePreference = 'holdout' | 'search';
+/** Only the outcome is read, so every accessor here accepts anything carrying one. */
+type Scored = Pick<RunRecord, 'outcome'>;
+/** True when the authenticity gate flagged the run as gamed (`realness.gated`). */
+declare function isRealnessGated(record: Scored): boolean;
+/**
+ * The RAW score recorded on ONE split, with no cross-split fallback and no
+ * anti-Goodhart gate.
+ *
+ * The narrowest of the three raw readers, and the one every split-scoped
+ * consumer wants: a per-split report, a promotion gate, or a paired comparison
+ * asks "what did this run score on the split I am summarising", and answering
+ * it with the other split's number silently mixes populations. `undefined` =
+ * that split was never scored.
+ *
+ * Same warning as `observedScore`: this INCLUDES runs flagged as gamed. Never
+ * feed it into training data.
+ */
+declare function observedSplitScore(record: Scored, split: ScorePreference): number | undefined;
+/**
+ * The RAW split score the run carries, with NO anti-Goodhart gate applied.
+ *
+ * INCLUDES RUNS FLAGGED AS GAMED (`outcome.realness.gated === true`); NEVER
+ * feed this into training data — a fine-tune that sees it learns from gamed
+ * successes. It is exported anyway because analysis, reporting, and
+ * reward-hacking detection legitimately need the ungated number: forcing a
+ * gamed run to 0 collapses the proxy signal toward ground truth and makes a
+ * detector report "clean" on exactly the population that is being gamed.
+ *
+ * Returns `undefined` when the record carries neither score — an unscored run
+ * is a labeled gap, not a measured zero, and each caller picks its own
+ * sentinel (`?? 0`, `?? null`, skip, throw). Non-finite values are returned
+ * as-is; callers that care keep their own `Number.isFinite` guard.
+ */
+declare function observedScore(record: Scored, prefer?: ScorePreference): number | undefined;
+/** Which split actually carried the score, or that none did. */
+type ScoreOrigin = 'holdout' | 'search' | 'unscored';
+/**
+ * Where `observedScore` / `trainingScore` read their number from — the
+ * provenance label a rollout line's `reward_source` is built from, and the
+ * only supported way to ask "was this run scored at all" without respelling
+ * the field access.
+ */
+declare function scoreOrigin(record: Scored, prefer?: ScorePreference): ScoreOrigin;
+/**
+ * The GATED score — the only derivation allowed to reach training data.
+ *
+ * A realness-gated run scores 0 no matter what it claims, so a fine-tune
+ * cannot learn from a gamed success. An unscored run stays `undefined` (a
+ * labeled gap), keeping "we never measured this" distinct from "we measured
+ * zero"; callers that need a number apply their own sentinel.
+ */
+declare function trainingScore(record: Scored, prefer?: ScorePreference): number | undefined;
+/**
+ * `{reward, gated}` as written onto a minted `RolloutLine` — `trainingScore`
+ * plus the flag itself, so the gate travels into the exported row and a
+ * downstream filter can drop or down-weight the line.
+ *
+ * An unscored record yields `reward: null`, matching the schema's "no verdict
+ * exists — a labeled gap, never 0" rule. It previously collapsed to 0, which
+ * made a run nobody graded indistinguishable from one graded as a total
+ * failure, and taught any trainer reading the row that the trajectory was bad.
+ * A gated run still yields 0, because that IS a verdict: the gate decided.
+ */
+declare function trainingReward(record: Scored): {
+    reward: number | null;
+    gated: boolean;
+};
+
 /**
  * Rollout minting — `tangle.rollout.v1` lines joined from the records the
  * substrate ALREADY keeps. There is no separate rollout store: a rollout
@@ -787,10 +1622,20 @@ interface TraceStore {
  *   - preference-pair export  → `feedbackTrajectoryToOptimizerRow` (feedback-trajectory.ts)
  *   - PRM / reward-model      → `reward-model-export.ts`
  *
- * Anti-Goodhart invariant: a run whose `outcome.realness.gated` is true
- * is never exported with a positive reward — the gate travels into the
- * training data (`reward` forced to 0, `realness_gated: true`), so a
- * fine-tune cannot learn from gamed successes.
+ * Anti-Goodhart invariant: a run whose `outcome.realness.gated` is true is
+ * never exported with a positive reward OR with any of the numbers that reward
+ * was computed from. The gate travels into the training data (`reward` forced
+ * to 0, `realness_gated: true`) and the whole outcome is transformed by
+ * `gateGamedOutcome` inside `assertMinted` below, which relocates `metrics` and
+ * `verdict` to `provenance.gated_evidence`. Mint returns
+ * `MintedRolloutLine[]`: the brand the training exporters require, which only
+ * this function, `readRolloutLedger`, and an explicit `assertMinted` can mint.
+ *
+ * A record carrying NEITHER split score is REJECTED (`ValidationError`), never
+ * minted at 0 — "nobody graded this" is not the same claim as "graded a total
+ * failure", and a trainer reading 0 learns the second. Lines that already
+ * carry `reward: null` (interchange imports, existing ledgers) remain valid on
+ * the wire; only the RunRecord→line door refuses.
  *
  * Records without spans become labeled GAP LINES (messages: [],
  * provenance.gap) — present in the output AND surfaced in
@@ -811,14 +1656,11 @@ interface MintRolloutOptions {
     now?: () => Date;
 }
 interface MintRolloutResult {
-    rows: RolloutLine[];
+    rows: MintedRolloutLine[];
     /** runIds that had a RunRecord but no spans — emitted as gap lines AND listed here. */
     missingTraces: string[];
 }
-declare function rolloutReward(record: RunRecord): {
-    reward: number;
-    gated: boolean;
-};
+
 /**
  * Join RunRecords with their traces into canonical rollout lines. Records
  * without spans are emitted as labeled gap lines and reported in
@@ -924,6 +1766,187 @@ declare function findOpencodeSessionById(db: DatabaseSync, sessionId: string): O
  */
 declare function readOpencodeSessionMessages(db: DatabaseSync, sessionId: string): ChatMessage[];
 
+/**
+ * Per-format accounting of the anti-Goodhart gate for one dataset release.
+ *
+ * The defect this exists to make impossible: a dataset card that STATES what
+ * the gate does while the build does something else. A sentence in a README is
+ * a claim about bytes it never reads, so it drifts the moment an exporter
+ * changes — and the drift ships to whoever downloads the dataset.
+ *
+ * So the card is not allowed to assert anything about the gate. The build
+ * measures the rows it is ABOUT TO WRITE (`measureFormatGate`), the measurement
+ * is checked against the declared per-format disposition (`assertGateReport`,
+ * which throws rather than warns), and the card renders only numbers handed to
+ * it. A card that disagrees with its own data files cannot be produced without
+ * failing the build first.
+ *
+ * The dispositions themselves are the release policy, stated once as data:
+ *
+ *   sft       EXCLUDE       — an SFT row is an imitation target. A gamed
+ *                             trajectory must never be imitated, at any weight.
+ *   verifiers ZERO_AND_FLAG — reward is a signed learning signal here, so a
+ *                             gamed trajectory at reward 0 is a correct
+ *                             negative. Dropping it would bias the negative
+ *                             population toward honest failures and leave a
+ *                             trainer no example of what gaming looks like
+ *                             when it is penalized.
+ *   rft       ZERO_AND_FLAG — RFT re-samples the completion; only the prompt
+ *                             and the grader's `reference.*` verdict ship, so
+ *                             nothing gamed is imitated. The flag is what lets
+ *                             a grader author skip the instance.
+ *   raw       ZERO_AND_FLAG — a faithful audit dump. Removing rows from it
+ *                             would defeat its only purpose, and the gated
+ *                             row is the one an auditor most wants.
+ *
+ * `ZERO_AND_FLAG` is never `reward: 0` alone. Zeroing without the label makes a
+ * faked success indistinguishable from an honest failure — it hides the gamed
+ * population from the buyer instead of disclosing it. Every included format
+ * carries `realness_gated` on the row itself.
+ *
+ * And `ZERO_AND_FLAG` means the whole outcome, not the scalar. A gated row that
+ * ships `reward: 0` beside the per-layer verifier scores the reward was
+ * computed from has not been zeroed in any sense a trainer respects; the
+ * accounting therefore measures every reward-derived number each format writes,
+ * not just the one field.
+ */
+
+/** What a format does with a line the realness gate flagged. */
+type GateDisposition = 'exclude' | 'zero-and-flag';
+declare const FORMAT_GATE_DISPOSITION: Record<ReleaseFormat, GateDisposition>;
+/** What the gate accounting reads off an emitted row, per format. */
+interface ReleaseRowRef {
+    rollout_id: string;
+    reward: number | null;
+    /**
+     * The rest of the row that was DERIVED from the reward — the per-layer score
+     * dict, the judge verdict record, whatever this format ships beside the
+     * scalar. Walked for positive numbers, so the certification is about the
+     * whole outcome rather than one field.
+     *
+     * Absent when the format's row carries nothing but the scalar. NOT the whole
+     * row: `cost.tokens_in`, `wall_s` and `total_steps` are positive numbers that
+     * have nothing to do with the reward, and a certification that flags them is
+     * a certification nobody can act on.
+     */
+    evidence?: unknown;
+    /**
+     * The screen claim AS EMITTED — read off the row, not off the line it came
+     * from, because what ships is what matters. Required, not optional: an
+     * optional field is how a format quietly opts out of the check that reads it,
+     * and every emitted row shape carries `RealnessLabels` precisely so no adapter
+     * has to.
+     */
+    realness_screened: boolean | null;
+    /**
+     * The part of an emitted `steps[]` the wire format does not declare.
+     *
+     * Separate from `evidence` because the declared step fields are FULL of
+     * legitimate positive numbers — `durationMs`, `llm_call_count`,
+     * `prompt_token_ids` — and a certification that flags those is one nobody can
+     * act on. Only the undeclared remainder is unclassified reward-bearing
+     * payload, which is the same partition the check applies.
+     *
+     * Set only by formats whose row carries steps: today `raw` alone.
+     */
+    stepEvidence?: unknown;
+}
+/** A positive number found inside an emitted gated row, with where it was. */
+interface EmittedEvidence {
+    /** JSON-ish path from the row's evidence root, e.g. `metrics['layer.tests']`. */
+    path: string;
+    value: number;
+}
+interface FormatGateCounts {
+    /** Gated lines that reached this format's exporter. */
+    input: number;
+    /** Gated rows the format actually wrote. */
+    emitted: number;
+    /**
+     * Gated lines this format did not write. Not all of these are the gate:
+     * `verifiers` also drops gap lines (empty transcript) and `rft` drops lines
+     * with no prompt turn, so an excluded count can mix both causes.
+     */
+    excluded: number;
+    /** Highest reward on an emitted gated row; `null` when none was emitted. */
+    maxEmittedReward: number | null;
+    /**
+     * The largest positive number found in the reward-DERIVED payload of an
+     * emitted gated row, and its path; `null` when there is none.
+     *
+     * This column exists because the release once certified CLEAN while leaking.
+     * `assertGateReport` inspected `outcome.reward` alone, so a gated row shipping
+     * `reward: 0` next to `metrics['layer.tests']: 1` — the deterministic verifier
+     * score the reward was computed from, and the per-rubric score dict of the
+     * Prime Intellect verifiers format — passed, and the card rendered "max reward
+     * | 0" over a file that carried the gamed signal at full value. A wrong
+     * certification is worse than the leak: it is the leak plus a document saying
+     * there isn't one.
+     */
+    maxEmittedEvidence: EmittedEvidence | null;
+    /**
+     * Rows this format wrote carrying a positive reward whose producer DECLARED
+     * that no authenticity screen ever ran on it (`realness_screened: false`).
+     *
+     * Measured over EVERY emitted row, not just the gated ones: an unscreened
+     * reward is by definition one the gate never had a verdict on, so it is not in
+     * the gated set and a measurement scoped to that set would report 0 forever.
+     * `assertMinted` already refuses these, which is exactly why the release still
+     * measures them — the last door before a public dataset does not get to assume
+     * the earlier doors held.
+     */
+    unscreenedPositiveRows: number;
+    /** Highest reward on such a row; `null` when there is none. */
+    maxUnscreenedReward: number | null;
+    /**
+     * The largest positive number found in an emitted gated row's UNDECLARED
+     * per-step payload, and its path; `null` when there is none.
+     *
+     * The column exists because the gate read `outcome` and nothing else for
+     * three rounds, so a gated line shipping `steps: [{kind, name, reward: 0.86}]`
+     * certified clean — the release accounting agreed with the exporter that a
+     * per-step reward was not a reward.
+     */
+    maxEmittedStepEvidence: EmittedEvidence | null;
+}
+interface GateReport {
+    /** Gated lines in the release input, after the split/proposer filters. */
+    gatedLines: number;
+    byFormat: Partial<Record<ReleaseFormat, FormatGateCounts>>;
+}
+/** Rollout ids of every gated line, the key the emitted rows are matched on. */
+declare function gatedRolloutIds(lines: readonly MintedRolloutLine[]): Set<string>;
+/**
+ * Row refs per format. Written as one adapter per format so that the knowledge
+ * of WHERE the id and reward live in each published shape sits next to the
+ * assertion that uses it — an exporter that moves either field breaks here
+ * rather than silently reporting zero gated rows.
+ */
+declare const releaseRowRefs: {
+    sft: (rows: readonly SftRow[]) => ReleaseRowRef[];
+    verifiers: (rows: readonly VerifiersRolloutOutput[]) => ReleaseRowRef[];
+    rft: (rows: readonly RftItem[]) => ReleaseRowRef[];
+    raw: (lines: readonly MintedRolloutLine[]) => ReleaseRowRef[];
+};
+/** Measure one format's gated rows from the refs of the rows about to be written. */
+declare function measureFormatGate(gated: ReadonlySet<string>, refs: readonly ReleaseRowRef[]): FormatGateCounts;
+/**
+ * Fail the build when the measurement disagrees with the declared policy.
+ *
+ * Throws, never filters: an emitted positive reward on a gated row means an
+ * exporter upstream stopped applying the gate, and silently dropping the row
+ * would hide the producer that made it — the producer is the actual defect.
+ *
+ * Certifies the whole emitted outcome, not `reward` alone. The earlier version
+ * checked one field and therefore certified a release CLEAN while its
+ * `verifiers/train.jsonl` shipped the gamed run's per-layer scores at 1.0 in
+ * the top-level `metrics` dict — the card then rendered "max reward | 0" over
+ * exactly that file. A certification that is wrong is worse than an
+ * uncertified leak, so the checks it runs are no longer written down here at
+ * all: it iterates `GATE_CHECK_IDS` under its own declared policy.
+ */
+declare function assertGateReport(report: GateReport): void;
+
 /**
  * Deterministic scrubbing pass over rollout-ledger lines before public release.
  *
@@ -948,10 +1971,17 @@ type ScrubCounts = Record<string, number>;
 declare function emptyScrubCounts(): ScrubCounts;
 declare function addScrubCounts(into: ScrubCounts, from: ScrubCounts): ScrubCounts;
 declare function scrubText(text: string, counts: ScrubCounts): string;
-/** Scrub every string value in a line; structure and key order are preserved. */
-declare function scrubRolloutLine(line: RolloutLine, counts: ScrubCounts): RolloutLine;
-declare function scrubLines(lines: RolloutLine[]): {
-    lines: RolloutLine[];
+/**
+ * Scrub every string value in a line; structure and key order are preserved.
+ *
+ * `assertMinted` on the way out rather than a cast: scrubbing rebuilds the
+ * object, so the brand has to be re-earned, and re-validating proves the rules
+ * did not rewrite a field the schema constrains (`reward` is a number, not a
+ * string, so no rule should ever touch it — this is what checks that).
+ */
+declare function scrubRolloutLine(line: MintedRolloutLine, counts: ScrubCounts): MintedRolloutLine;
+declare function scrubLines(lines: MintedRolloutLine[]): {
+    lines: MintedRolloutLine[];
     counts: ScrubCounts;
 };
 /**
@@ -979,7 +2009,7 @@ type ReleaseFormat = (typeof RELEASE_FORMATS)[number];
 declare const FORMAT_FILES: Record<ReleaseFormat, string>;
 interface DatasetCardInputs {
     /** Scrubbed, release-filtered lines (what actually ships). */
-    lines: RolloutLine[];
+    lines: MintedRolloutLine[];
     formats: ReleaseFormat[];
     includeProposers: boolean;
     /** Source ledger basenames, for provenance. */
@@ -990,6 +2020,13 @@ interface DatasetCardInputs {
         nonTrain: number;
     };
     formatCounts: Partial<Record<ReleaseFormat, number>>;
+    /**
+     * Per-format anti-Goodhart accounting MEASURED on the rows the build wrote.
+     * Required, not optional: the card's only statement about the gate is a
+     * render of these numbers, so a card cannot be produced without them and
+     * cannot drift from the data files it ships beside.
+     */
+    gate: GateReport;
 }
 declare function buildDatasetCard(inputs: DatasetCardInputs): string;
 
@@ -1031,6 +2068,8 @@ interface BuildSummary {
     kept: number;
     scrub: ScrubReport;
     formatCounts: Partial<Record<ReleaseFormat, number>>;
+    /** Per-format anti-Goodhart accounting, measured on the rows written. */
+    gate: GateReport;
     files: string[];
 }
 declare function buildHfDataset(inputs: string[], options: BuildOptions): Promise<BuildSummary>;
@@ -1045,4 +2084,4 @@ declare function parseRolloutReleaseArgs(argv: string[]): RolloutReleaseCliArgs;
 /** CLI driver for `agent-eval rollout-release`. Returns the process exit code. */
 declare function runRolloutReleaseCli(argv: string[]): Promise<number>;
 
-export { type BuildOptions, type BuildSummary, CHAT_ROLES, type ChatMessage, type ChatRole, type ChatToolCall, type ClaudeTranscript, type ClaudeTranscriptRef, type ClaudeUsageTotals, DEFAULT_CLAUDE_PROJECTS_DIR, DEFAULT_OPENCODE_DB, type DatasetCardInputs, FORMAT_FILES, type MintRolloutOptions, type MintRolloutResult, type OpencodeSessionRow, RELEASE_FORMATS, ROLLOUT_CAPTURES, ROLLOUT_RELEASE_USAGE, ROLLOUT_ROLES, ROLLOUT_SCHEMA, ROLLOUT_SPLITS, type ReleaseFormat, type RewardRow, type RftItem, type RolloutArtifacts, type RolloutCapture, type RolloutCostBlock, type RolloutLine, type RolloutOutcome, type RolloutPolicy, type RolloutProvenance, type RolloutReleaseCliArgs, type RolloutRole, type RolloutScrubber, type RolloutSplit, type RolloutStep, type RolloutTask, SCRUB_RULES, type ScrubCounts, type ScrubReport, type ScrubRule, type SftExportOptions, type SftRow, TRAINABLE_SPLITS, type ToolDef, type VerifiersRolloutOutput, type VerifiersTokenUsage, addScrubCounts, appendRolloutLines, assertRolloutLine, buildDatasetCard, buildHfDataset, claudeProjectSlug, defaultRolloutScrubber, emptyScrubCounts, findClaudeTranscripts, findOpencodeSessionById, findOpencodeSessionsByDirectory, isRolloutLine, isTrainableSplit, mintRolloutRows, openOpencodeDb, parseRolloutReleaseArgs, planPushCommand, pushDataset, readClaudeTranscript, readOpencodeSessionMessages, readRolloutLedger, rolloutReward, runRolloutReleaseCli, scrubLines, scrubRolloutLine, scrubText, toJsonl, toRewardRows, toRftItem, toRftItems, toSftRows, toVerifiersRolloutOutput, toVerifiersRolloutOutputs, validateRolloutLine, writeRolloutLedger };
+export { ATIF_SCHEMA_VERSION, type BuildOptions, type BuildSummary, CHAT_ROLES, type ChatMessage, type ChatRole, type ChatToolCall, type ClaudeTranscript, type ClaudeTranscriptRef, type ClaudeUsageTotals, DEFAULT_CLAUDE_PROJECTS_DIR, DEFAULT_OPENCODE_DB, type DatasetCardInputs, type EmittedEvidence, FORMAT_FILES, FORMAT_GATE_DISPOSITION, type FormatGateCounts, type FromHarborOptions, GATE_CHECKS, GATE_CHECK_IDS, GATE_POLICIES, type GateCheck, type GateCheckDisposition, type GateCheckId, type GateCheckedOutcome, type GateDisposition, type GateEntryPoint, type GatePolicy, type GateReport, type GatedEvidence, HARBOR_IMPORT_GAP, type HarborAgent, type HarborContentPart, type HarborFinalMetrics, type HarborImageSource, type HarborMetrics, type HarborObservation, type HarborObservationResult, type HarborStep, type HarborStepSource, type HarborSubagentTrajectoryRef, type HarborToolCall, type HarborTrajectory, type MintRolloutOptions, type MintRolloutResult, type MintedRolloutLine, type MintedRolloutOutcome, type OpencodeSessionRow, RELEASE_FORMATS, ROLLOUT_CAPTURES, ROLLOUT_RELEASE_USAGE, ROLLOUT_ROLES, ROLLOUT_SCHEMA, ROLLOUT_SPLITS, type RealnessLabels, type ReleaseFormat, type ReleaseRowRef, type RewardRow, type RftItem, type RolloutArtifacts, type RolloutCapture, type RolloutCostBlock, type RolloutLine, type RolloutOutcome, type RolloutPolicy, type RolloutProvenance, type RolloutReleaseCliArgs, type RolloutRole, type RolloutScrubber, type RolloutSplit, type RolloutStep, type RolloutTask, SCRUB_RULES, type ScoreOrigin, type ScorePreference, type ScrubCounts, type ScrubReport, type ScrubRule, type SftExportOptions, type SftRow, TRAINABLE_SPLITS, type ToolDef, type VerifiersRolloutOutput, type VerifiersTokenUsage, addScrubCounts, appendRolloutLines, assertGateReport, assertMinted, assertMintedLines, assertRolloutLine, buildDatasetCard, buildHfDataset, claudeProjectSlug, defaultRolloutScrubber, emptyScrubCounts, findClaudeTranscripts, findOpencodeSessionById, findOpencodeSessionsByDirectory, fromHarborTrajectory, gateErrors, gateGamedOutcome, gatedEvidenceOf, gatedRolloutIds, isRealnessGated, isRolloutLine, isTrainableSplit, measureFormatGate, mintRolloutRows, observedScore, observedSplitScore, openOpencodeDb, parseRolloutReleaseArgs, planPushCommand, pushDataset, readClaudeTranscript, readOpencodeSessionMessages, readRolloutJournal, readRolloutLedger, realnessLabels, relabelImportedSplit, releaseRowRefs, runRolloutReleaseCli, scoreOrigin, scrubLines, scrubRolloutLine, scrubText, toHarborTrajectories, toHarborTrajectory, toJsonl, toRewardRows, toRftItem, toRftItems, toSftRows, toVerifiersRolloutOutput, toVerifiersRolloutOutputs, trainingReward, trainingScore, validateRolloutLine, writeRolloutLedger };