@tangle-network/agent-eval 0.129.0 → 0.130.0

package/dist/index-2JJSA6-r2.d.ts

@@ -0,0 +1,926 @@
+import { a as RunRecord } from "./run-record-CnZu_gjl.js";
+import { s as TraceStore } from "./store-CT9YIIve.js";
+import { a as GatedEvidence, b as RolloutSplit, g as RolloutOutcome, h as RolloutLine, n as ChatMessage, o as MintedRolloutLine, w as ToolDef, x as RolloutStep, y as RolloutRole } from "./schema-Cef2cFmb.js";
+import { DatabaseSync } from "node:sqlite";
+//#region src/rollout/exporters.d.ts
+/**
+ * The gate's two claims, which travel TOGETHER on every emitted row.
+ *
+ * `realness_gated` alone is ambiguous, and the ambiguity is exploitable:
+ * `false` reads as "we screened it and nothing fired", so a producer that has no
+ * screen at all emitted rows indistinguishable from screened-clean ones, and
+ * every consumer of the published dataset read them as clean. The second field
+ * is what separates the two claims, and it only removes the ambiguity if it
+ * reaches the WIRE — for a round it existed on `RolloutOutcome` and on no
+ * exported row shape at all, which left the published rows exactly as ambiguous
+ * as before.
+ *
+ * So there is one helper and every row shape spreads it. A row that states one
+ * claim without the other is not constructible by copying the pattern, and
+ * `exporters.test.ts` walks every emitted shape to prove none does.
+ */
+interface RealnessLabels {
+  /** The screen's VERDICT: the run faked its success signal. */
+  realness_gated: boolean;
+  /**
+   * Whether a screen RAN at all. `true` = it ran, so `realness_gated` is its
+   * verdict. `false` = the producer declares it has none. `null` = not stated
+   * (pre-unification producers), which is "unknown" and never "clean".
+   */
+  realness_screened: boolean | null;
+}
+declare function realnessLabels(line: MintedRolloutLine): RealnessLabels;
+interface TrainingExportOptions {
+  /** Include held-out evaluation data in training output. Default false. */
+  allowHeldOutTrainingData?: boolean;
+  /** Require reward to be strictly greater than this value. Default 0. */
+  minimumQualityExclusive?: number;
+}
+/**
+ * What a signed-signal exporter (verifiers, RFT) does with lines that are not
+ * clean trainable successes — realness-gated lines above all.
+ *
+ *   - 'exclude'       — the default, the same fail-closed policy as every
+ *                       other training export: positive, completed,
+ *                       non-gated rows on a trainable split.
+ *   - 'zero-and-flag' — keep them, at their non-positive (or null) reward,
+ *                       with `RealnessLabels` on the row. The dataset release
+ *                       sets this per `FORMAT_GATE_DISPOSITION`: in these
+ *                       formats the reward is a signed learning signal, so a
+ *                       gamed trajectory at reward 0 is a correct negative,
+ *                       and dropping it would bias the negative population
+ *                       toward honest failures and leave a trainer no example
+ *                       of gaming being penalized. The split policy is NOT
+ *                       relaxed: held-out lines still need the named opt-in.
+ *
+ * SFT deliberately has no such option — an SFT row is an imitation target and
+ * a gamed trajectory must never appear in one at any weight.
+ */
+type GatedLineDisposition = 'exclude' | 'zero-and-flag';
+interface SignedSignalExportOptions extends TrainingExportOptions {
+  /** Disposition for non-trainable lines. Default 'exclude'. */
+  gatedLines?: GatedLineDisposition;
+}
+type SftExportOptions = TrainingExportOptions;
+interface SftRow {
+  messages: ChatMessage[];
+  metadata: {
+    rollout_id: string;
+    run_id: string;
+    candidate_id: string | null;
+    instance_id: string;
+    reward: number;
+  } & RealnessLabels;
+}
+/**
+ * Supervised fine-tune rows: the completed conversation of each qualifying
+ * line. Fail-closed filters: trainable split only (never holdout/canary),
+ * reward strictly above `minimumQualityExclusive` (default 0), realness-gated
+ * lines never qualify, gap lines carry no trainable content, and
+ * copied-context turns are dropped from the transcript (Harbor ATIF RFC 0001
+ * rule 7 — see `ChatMessage.is_copied_context`).
+ *
+ * `realness_gated` is therefore always `false` on an emitted row. It is carried
+ * anyway: an SFT row is a pure imitation target, so the row states its realness
+ * claims instead of making the reader know the format's policy, and carrying
+ * both flags on all four shapes is what lets the release accounting measure
+ * every config with one rule rather than skipping the one whose row shape
+ * happened to omit the field.
+ */
+declare function toSftRows(lines: MintedRolloutLine[], options?: SftExportOptions): SftRow[];
+interface RewardRow {
+  /** First user turn — the task prompt. */
+  prompt: string;
+  steps: RolloutStep[];
+  reward: number;
+  metadata: {
+    rollout_id: string;
+    run_id: string;
+    candidate_id: string | null;
+    instance_id: string;
+    split: RolloutSplit;
+  } & RealnessLabels;
+}
+/**
+ * Reward-labeled rows for completed, positive-quality training runs.
+ */
+declare function toRewardRows(lines: MintedRolloutLine[], options?: TrainingExportOptions): RewardRow[];
+interface VerifiersTokenUsage {
+  input_tokens: number | null;
+  output_tokens: number | null;
+  reasoning_tokens: number | null;
+  cache_read_tokens: number | null;
+  cache_write_tokens: number | null;
+}
+interface VerifiersRolloutOutput {
+  /** Messages through the last turn BEFORE the first assistant turn. */
+  prompt: ChatMessage[];
+  /** The first assistant turn onward — what the policy produced. */
+  completion: ChatMessage[];
+  reward: number | null;
+  metrics: Record<string, unknown>;
+  tool_defs: ToolDef[];
+  token_usage: VerifiersTokenUsage;
+  info: {
+    task: RolloutLine['task'];
+    policy: RolloutLine['policy'];
+    rollout_id: string;
+    run_id: string;
+    experiment_id: string | null;
+    candidate_id: string | null;
+    generation: number | null;
+    candidate_index: number | null;
+    role: RolloutLine['role'];
+  } & RealnessLabels;
+}
+declare function toVerifiersRolloutOutput(line: MintedRolloutLine): VerifiersRolloutOutput;
+declare function toVerifiersRolloutOutputs(lines: MintedRolloutLine[], options?: SignedSignalExportOptions): VerifiersRolloutOutput[];
+interface RftItem {
+  /** Prompt turns only — the graded completion is re-sampled during RFT. */
+  messages: ChatMessage[];
+  /** Verdict/label fields the grader references as item.reference.* */
+  reference: {
+    reward: number | null;
+    reward_source: string | null;
+    verdict: unknown;
+    instance_id: string;
+    suite: string;
+    split: RolloutSplit;
+    rollout_id: string;
+  } & RealnessLabels;
+}
+declare function toRftItem(line: MintedRolloutLine): RftItem;
+/** RFT needs a real prompt: lines whose transcript starts with prompt turns. */
+declare function toRftItems(lines: MintedRolloutLine[], options?: SignedSignalExportOptions): RftItem[];
+declare function toJsonl(rows: ReadonlyArray<unknown>): string;
+//#endregion
+//#region src/rollout/gate-checks.d.ts
+/**
+ * Every gate check in the package, in the order they are applied.
+ *
+ * Order is load-bearing only for which message a caller sees first: a line that
+ * trips two checks reports the earlier one, and `reward-relationship` is first
+ * because it is the invariant the other three protect.
+ */
+declare const GATE_CHECK_IDS: readonly ['reward-relationship', 'gated-evidence', 'undeclared-step-payload', 'unscreened-reward'];
+type GateCheckId = (typeof GATE_CHECK_IDS)[number];
+/**
+ * An outcome as it reaches a check.
+ *
+ * Deliberately accepts a raw record as well as the typed shape: the checks are
+ * the RUNTIME half of the gate, and the callers they exist for — JSON off a
+ * ledger, a plain-JavaScript consumer of the published package — arrive with no
+ * types at all. `Partial` because a tripwire states only the fields it trips on.
+ */
+type GateCheckedOutcome = Partial<RolloutOutcome> | Readonly<Record<string, unknown>>;
+/**
+ * What a gate check reads: the reward-bearing surface of ONE LINE.
+ *
+ * For three rounds the subject was the OUTCOME alone, and that assumption is
+ * what produced the next leak rather than any missing check: `steps[]` sits on
+ * the LINE, outside `outcome`, so a per-step reward on a gated line was read by
+ * no check at all while `toRewardRows` copied it out verbatim — through the
+ * MINTED door, not merely the raw one. Widening the subject is what makes
+ * "somewhere else on the line" a place the checks can see.
+ *
+ * `outcome` is REQUIRED, and that is the point: a bare `RolloutOutcome` is then
+ * not assignable to a subject, so every call site that used to pass one is a
+ * COMPILE error until it passes the line instead. A subject with an optional
+ * `outcome` would have let the old call sites keep compiling while silently
+ * checking nothing — the exact failure this module exists to make impossible.
+ */
+interface GateSubject {
+  outcome: GateCheckedOutcome;
+  /** The line's trajectory steps, when it carries any. */
+  steps?: unknown;
+}
+interface GateCheck {
+  id: GateCheckId;
+  /** One sentence: what this check refuses. */
+  refuses: string;
+  /** One dotted-path message per defect; `[]` when the line is clean. */
+  errors: (subject: GateSubject) => string[];
+  /**
+   * Every minimal subject that MUST trip `errors` — the executable form of
+   * `refuses`, and the reason a check cannot be added without being provable.
+   * The calibration test feeds each one to every entry point declaring
+   * `enforced`.
+   *
+   * A LIST rather than one case: a check that refuses two distinct populations
+   * (a positive reward AND a reward it cannot read as a number) proved able to
+   * hold for the first while silently passing the second, so each population
+   * states its own tripwire and each is exercised separately.
+   */
+  tripwires: GateSubject[];
+}
+/**
+ * The reward-bearing outcome fields that are NOT the scalar: the numbers the
+ * reward was computed from, and the verdict record that claimed it.
+ *
+ * Returned as one block rather than filtered key-by-key. A key-name heuristic
+ * ("zero anything matching `layer.*` or `/score/`") is the same defect shape as
+ * the line-oriented regex the AST score guard replaced: it holds until someone
+ * names a metric `pass_fraction`, and the next reward-shaped key ships at full
+ * value. The producer's OWN classification — "this is the scalar, that is
+ * everything else" — is the only partition that cannot be out-guessed.
+ */
+declare function gatedEvidenceOf(subject: GateSubject): GatedEvidence | undefined;
+/**
+ * The registry. Total over `GateCheckId`, so an id with no check does not
+ * compile, and `GATE_CHECK_IDS` stays the single enumeration everything
+ * iterates.
+ */
+declare const GATE_CHECKS: { readonly [K in GateCheckId]: GateCheck; };
+/**
+ * What ONE entry point does about ONE check.
+ *
+ * `repair` and `omit` both carry a mandatory sentence, which is the mechanism
+ * that keeps a legitimate omission distinguishable from a forgotten one: you
+ * cannot skip a check without writing down why, and the reasons are readable
+ * side by side in `GATE_POLICIES`.
+ */
+type GateCheckDisposition = {
+  readonly kind: 'enforce';
+} |
+/** Resolved by TRANSFORMING the line instead of rejecting it; `by` names the function. */
+{
+  readonly kind: 'repair';
+  readonly by: string;
+} |
+/** Deliberately not applied here; `because` states the reason. */
+{
+  readonly kind: 'omit';
+  readonly because: string;
+};
+/** Total over `GateCheckId`: a new check makes every policy literal a type error. */
+type GatePolicy = { readonly [K in GateCheckId]: GateCheckDisposition; };
+/**
+ * Every entry point that decides about the gate, and what it decides.
+ *
+ * Read this as the package's gate policy in one screen. The four entry points
+ * are not interchangeable — a validator that rejects, a mint funnel that
+ * repairs, a runtime backstop for untyped callers, and a release certifier over
+ * emitted rows — and the dispositions say which is which.
+ */
+declare const GATE_POLICIES: {
+  /**
+   * The schema validator. Rejects the reward relationship and NOTHING ELSE, on
+   * purpose: it runs on every line read off disk, and the other two conditions
+   * describe artifacts that already exist.
+   */
+  readonly validateRolloutLine: {
+    readonly 'reward-relationship': {
+      readonly kind: 'enforce';
+    };
+    readonly 'gated-evidence': GateCheckDisposition;
+    readonly 'undeclared-step-payload': GateCheckDisposition;
+    readonly 'unscreened-reward': GateCheckDisposition;
+  };
+  /**
+   * The mint funnel — the single door every `MintedRolloutLine` passes. Validates
+   * first (so the reward relationship has already been rejected), then refuses
+   * what cannot be repaired, then repairs what can.
+   */
+  readonly assertMinted: {
+    readonly 'reward-relationship': {
+      readonly kind: 'enforce';
+    };
+    readonly 'gated-evidence': GateCheckDisposition;
+    readonly 'undeclared-step-payload': GateCheckDisposition;
+    readonly 'unscreened-reward': {
+      readonly kind: 'enforce';
+    };
+  };
+  /**
+   * The runtime backstop, and the one entry point with no license to omit
+   * anything: it exists for callers the type system never saw (plain JavaScript
+   * handing an object literal to a published exporter), so a check it skips is a
+   * check that does not run at all for them. This is where the fourth leak was.
+   */
+  readonly assertRewardGate: {
+    readonly 'reward-relationship': {
+      readonly kind: 'enforce';
+    };
+    readonly 'gated-evidence': {
+      readonly kind: 'enforce';
+    };
+    readonly 'undeclared-step-payload': {
+      readonly kind: 'enforce';
+    };
+    readonly 'unscreened-reward': {
+      readonly kind: 'enforce';
+    };
+  };
+  /**
+   * The release certifier. Same checks, measured over the rows a release is
+   * ABOUT TO WRITE rather than over one line's outcome — see `REPORT_MEASURES`
+   * in `release/gate-report.ts`, which is the second total map this policy
+   * drives.
+   */
+  readonly assertGateReport: {
+    readonly 'reward-relationship': {
+      readonly kind: 'enforce';
+    };
+    readonly 'gated-evidence': {
+      readonly kind: 'enforce';
+    };
+    readonly 'undeclared-step-payload': {
+      readonly kind: 'enforce';
+    };
+    readonly 'unscreened-reward': {
+      readonly kind: 'enforce';
+    };
+  };
+};
+/** Every entry point that declares a gate policy. */
+type GateEntryPoint = keyof typeof GATE_POLICIES;
+/**
+ * Run the checks one entry point enforces. The ONLY way an entry point should
+ * obtain gate errors — hand-composing two of the three is the bug this module
+ * exists to remove.
+ */
+declare function gateErrors(subject: GateSubject, policy: GatePolicy): string[];
+//#endregion
+//#region src/rollout/interchange/harbor.d.ts
+declare const ATIF_SCHEMA_VERSION = "ATIF-v1.7";
+/** Gap note on every imported line — ATIF carries no verdict, so nothing is scored. */
+declare const HARBOR_IMPORT_GAP = "imported from Harbor ATIF; no verdict";
+type HarborStepSource = 'system' | 'user' | 'agent';
+interface HarborImageSource {
+  media_type: string;
+  path: string;
+}
+interface HarborContentPart {
+  type: 'text' | 'image';
+  text?: string;
+  source?: HarborImageSource;
+}
+interface HarborToolCall {
+  tool_call_id: string;
+  function_name: string;
+  /** ATIF requires a decoded JSON object here, unlike our raw argument string. */
+  arguments: Record<string, unknown>;
+  extra?: Record<string, unknown>;
+}
+interface HarborSubagentTrajectoryRef {
+  trajectory_id?: string;
+  trajectory_path?: string;
+  /** Informational only since v1.7 — never a resolution key. */
+  session_id?: string;
+  extra?: Record<string, unknown>;
+}
+interface HarborObservationResult {
+  source_call_id?: string;
+  content?: string | HarborContentPart[];
+  subagent_trajectory_ref?: HarborSubagentTrajectoryRef[];
+  extra?: Record<string, unknown>;
+}
+interface HarborObservation {
+  results: HarborObservationResult[];
+}
+interface HarborMetrics {
+  prompt_tokens?: number;
+  completion_tokens?: number;
+  cached_tokens?: number;
+  cost_usd?: number;
+  prompt_token_ids?: number[];
+  completion_token_ids?: number[];
+  logprobs?: number[];
+  extra?: Record<string, unknown>;
+}
+interface HarborStep {
+  /** Ordinal, sequential from 1. */
+  step_id: number;
+  timestamp?: string;
+  source: HarborStepSource;
+  model_name?: string;
+  reasoning_effort?: string | number;
+  message: string | HarborContentPart[];
+  reasoning_content?: string;
+  tool_calls?: HarborToolCall[];
+  observation?: HarborObservation;
+  metrics?: HarborMetrics;
+  llm_call_count?: number;
+  is_copied_context?: boolean;
+  extra?: Record<string, unknown>;
+}
+interface HarborAgent {
+  name: string;
+  version: string;
+  model_name?: string;
+  /** OpenAI function-calling schema — byte-identical to our `ToolDef`. */
+  tool_definitions?: ToolDef[];
+  extra?: Record<string, unknown>;
+}
+interface HarborFinalMetrics {
+  total_prompt_tokens?: number;
+  total_completion_tokens?: number;
+  total_cached_tokens?: number;
+  total_cost_usd?: number;
+  total_steps?: number;
+  extra?: Record<string, unknown>;
+}
+interface HarborTrajectory {
+  schema_version: string;
+  session_id?: string;
+  /** Required on embedded subagents; we always set it so lines stay joinable. */
+  trajectory_id?: string;
+  agent: HarborAgent;
+  steps: HarborStep[];
+  notes?: string;
+  final_metrics?: HarborFinalMetrics;
+  continued_trajectory_ref?: string;
+  subagent_trajectories?: HarborTrajectory[];
+  extra?: Record<string, unknown>;
+}
+/**
+ * Assemble one episode's flat lines into a single ATIF trajectory tree,
+ * linked by `parent_rollout_id`.
+ *
+ * Reward, verdict and split are NOT emitted (ATIF models none of them); the
+ * split and the rest of the task coordinates survive only in `extra.tangle`.
+ *
+ * We deliberately do NOT synthesize an `observation.subagent_trajectory_ref`
+ * pointing at each child: our ledger records WHICH invocation spawned a
+ * worker, not which STEP did, and attaching the ref to a guessed step would
+ * fabricate a causal claim. Children are embedded in `subagent_trajectories`
+ * (each with the `trajectory_id` the spec requires) and the edge is stated in
+ * the child's escrowed `parent_rollout_id`.
+ *
+ * Throws when the lines are not one tree — use `toHarborTrajectories` for a forest.
+ */
+declare function toHarborTrajectory(lines: RolloutLine[]): HarborTrajectory;
+/** Every independent tree in the input, one ATIF document each. */
+declare function toHarborTrajectories(lines: RolloutLine[]): HarborTrajectory[];
+interface FromHarborOptions {
+  /** Injected clock for deterministic output when the source carries no capture time. */
+  now?: () => Date;
+}
+/**
+ * Flatten an ATIF trajectory tree back into `tangle.rollout.v1` lines, parent
+ * first, each child carrying `parent_rollout_id`.
+ *
+ * Every line comes back UNLABELED: `reward`, `reward_source` and `verdict` are
+ * null and `provenance.gap` says why. ATIF models no verdict, so scoring an
+ * imported trajectory is a judge's job, not this function's. Every line lands
+ * on `holdout` whatever the document claims — see `relabelImportedSplit`.
+ */
+declare function fromHarborTrajectory(trajectory: HarborTrajectory, options?: FromHarborOptions): RolloutLine[];
+/**
+ * THE explicit door out of `holdout` for imported lines.
+ *
+ * Import forces `holdout` because a document's own claim about its split is not
+ * evidence — anyone can write `extra.tangle.task.split`. Promoting a file to a
+ * trainable split is an operator's decision about provenance they verified, so
+ * it is a separate, greppable call: `grep relabelImportedSplit` enumerates
+ * every place foreign data was declared trainable, which is exactly the audit
+ * the trusted-escrow version made impossible.
+ *
+ * Returns plain `RolloutLine`s. They still have to pass `assertMinted` (and its
+ * anti-Goodhart check) to reach an exporter — re-labeling a split is not
+ * minting a reward.
+ */
+declare function relabelImportedSplit(lines: readonly RolloutLine[], split: RolloutSplit): RolloutLine[];
+//#endregion
+//#region src/rollout/ledger.d.ts
+/** Replace the ledger file with exactly `lines`. */
+declare function writeRolloutLedger(path: string, lines: RolloutLine[]): Promise<void>;
+/** Append `lines` to the ledger file (created if absent). */
+declare function appendRolloutLines(path: string, lines: RolloutLine[]): Promise<void>;
+/**
+ * Read and validate every line. Throws on the first malformed/invalid line
+ * (with its 1-based line number) — fail-closed, never a silent drop.
+ *
+ * Validation includes the anti-Goodhart invariant, which is why the result is
+ * `MintedRolloutLine[]`: a ledger file is the main way a rollout reaches this
+ * process from outside the type system (another run, another machine, a
+ * hand-edited JSONL), so this read is the runtime boundary where a poisoned
+ * line is refused rather than exported.
+ */
+declare function readRolloutLedger(path: string): Promise<MintedRolloutLine[]>;
+/**
+ * Read a ledger under the WRITE-side policy (`validateRolloutLine`), which
+ * omits the unscreened-reward check. `writeRolloutLedger` accepts a
+ * supervision-journal row (`realness_screened: false` with a positive reward
+ * — the documented `unscreenedRewardFields` shape), and `GATE_POLICIES` says
+ * such rows "must stay writable, readable and reportable"; a read API that
+ * only re-validated under `assertMinted` made every such file unreadable —
+ * write-accepted but read-refused is a data-loss trap.
+ *
+ * The result is `RolloutLine[]`, NOT `MintedRolloutLine[]`: nothing read here
+ * can reach a training exporter without passing `assertMinted`, so the
+ * promotion gate (which DOES enforce unscreened-reward) is exactly as closed
+ * as before. Use `readRolloutLedger` when the file is training data.
+ */
+declare function readRolloutJournal(path: string): Promise<RolloutLine[]>;
+//#endregion
+//#region src/rollout/reward.d.ts
+/**
+ * Which split's score wins when a record carries both. `'holdout'` is the
+ * canonical "real signal" default; `'search'` exists because some callers
+ * deliberately score on the search split when both are present.
+ */
+type ScorePreference = 'holdout' | 'search';
+/** Only the outcome is read, so every accessor here accepts anything carrying one. */
+type Scored = Pick<RunRecord, 'outcome'>;
+/** True when the authenticity gate flagged the run as gamed (`realness.gated`). */
+declare function isRealnessGated(record: Scored): boolean;
+/**
+ * The RAW score recorded on ONE split, with no cross-split fallback and no
+ * anti-Goodhart gate.
+ *
+ * The narrowest of the three raw readers, and the one every split-scoped
+ * consumer wants: a per-split report, a promotion gate, or a paired comparison
+ * asks "what did this run score on the split I am summarising", and answering
+ * it with the other split's number silently mixes populations. `undefined` =
+ * that split was never scored.
+ *
+ * Same warning as `observedScore`: this INCLUDES runs flagged as gamed. Never
+ * feed it into training data.
+ */
+declare function observedSplitScore(record: Scored, split: ScorePreference): number | undefined;
+/**
+ * The RAW split score the run carries, with NO anti-Goodhart gate applied.
+ *
+ * INCLUDES RUNS FLAGGED AS GAMED (`outcome.realness.gated === true`); NEVER
+ * feed this into training data — a fine-tune that sees it learns from gamed
+ * successes. It is exported anyway because analysis, reporting, and
+ * reward-hacking detection legitimately need the ungated number: forcing a
+ * gamed run to 0 collapses the proxy signal toward ground truth and makes a
+ * detector report "clean" on exactly the population that is being gamed.
+ *
+ * Returns `undefined` when the record carries neither score — an unscored run
+ * is a labeled gap, not a measured zero, and each caller picks its own
+ * sentinel (`?? 0`, `?? null`, skip, throw). Non-finite values are returned
+ * as-is; callers that care keep their own `Number.isFinite` guard.
+ */
+declare function observedScore(record: Scored, prefer?: ScorePreference): number | undefined;
+/** Which split actually carried the score, or that none did. */
+type ScoreOrigin = 'holdout' | 'search' | 'unscored';
+/**
+ * Where `observedScore` / `trainingScore` read their number from — the
+ * provenance label a rollout line's `reward_source` is built from, and the
+ * only supported way to ask "was this run scored at all" without respelling
+ * the field access.
+ */
+declare function scoreOrigin(record: Scored, prefer?: ScorePreference): ScoreOrigin;
+/**
+ * The GATED score — the only derivation allowed to reach training data.
+ *
+ * A realness-gated run scores 0 no matter what it claims, so a fine-tune
+ * cannot learn from a gamed success. An unscored run stays `undefined` (a
+ * labeled gap), keeping "we never measured this" distinct from "we measured
+ * zero"; callers that need a number apply their own sentinel.
+ */
+declare function trainingScore(record: Scored, prefer?: ScorePreference): number | undefined;
+/**
+ * `{reward, gated}` as written onto a minted `RolloutLine` — `trainingScore`
+ * plus the flag itself, so the gate travels into the exported row and a
+ * downstream filter can drop or down-weight the line.
+ *
+ * An unscored record yields `reward: null`, matching the schema's "no verdict
+ * exists — a labeled gap, never 0" rule. It previously collapsed to 0, which
+ * made a run nobody graded indistinguishable from one graded as a total
+ * failure, and taught any trainer reading the row that the trajectory was bad.
+ * A gated run still yields 0, because that IS a verdict: the gate decided.
+ */
+declare function trainingReward(record: Scored): {
+  reward: number | null;
+  gated: boolean;
+};
+//#endregion
+//#region src/rollout/mint.d.ts
+/** Redactor applied to every exported string (secrets, PII). Identity by default. */
+type RolloutScrubber = (text: string) => string;
+interface MintRolloutOptions {
+  scrub?: RolloutScrubber;
+  /** Cap steps per line (longest runs first drop middle steps). Default: no cap. */
+  maxSteps?: number;
+  /** Role recorded on every minted line. Default 'agent' (a solo eval run). */
+  role?: RolloutRole;
+  /** Task suite label. Default: the record's `experimentId`. */
+  suite?: string;
+  /** Injected clock for deterministic output. */
+  now?: () => Date;
+}
+interface MintRolloutResult {
+  rows: MintedRolloutLine[];
+  /** runIds that had a RunRecord but no spans — emitted as gap lines AND listed here. */
+  missingTraces: string[];
+}
+/**
+ * Join RunRecords with their traces into canonical rollout lines. Records
+ * without spans are emitted as labeled gap lines and reported in
+ * `missingTraces`. Execution-only records without a task score are rejected
+ * because a missing training label is not a zero reward.
+ */
+declare function mintRolloutRows(records: RunRecord[], store: TraceStore, options?: MintRolloutOptions): Promise<MintRolloutResult>;
+//#endregion
+//#region src/rollout/readers/claude-jsonl.d.ts
+declare const DEFAULT_CLAUDE_PROJECTS_DIR: string;
+/** Claude Code's project-directory slug for a working directory. */
+declare function claudeProjectSlug(cwd: string): string;
+interface ClaudeTranscriptRef {
+  sessionId: string;
+  path: string;
+}
+/** Transcript files recorded for sessions launched from `cwd`. */
+declare function findClaudeTranscripts(cwd: string, projectsDir?: string): Promise<ClaudeTranscriptRef[]>;
+interface ClaudeUsageTotals {
+  tokensIn: number;
+  tokensOut: number;
+  cacheRead: number;
+  cacheWrite: number;
+}
+interface ClaudeTranscript {
+  messages: ChatMessage[];
+  usage: ClaudeUsageTotals;
+  /** Timestamp of the first conversation line; null = empty transcript. */
+  startedAt: string | null;
+  endedAt: string | null;
+  model: string | null;
+}
+interface ReadClaudeTranscriptOptions {
+  /**
+   * Read the sidechain (subagent) thread instead of skipping it. Subagent
+   * transcripts under `<session>/subagents/agent-<id>.jsonl` are sidechain
+   * lines end to end, so their usage is invisible without this.
+   */
+  readonly includeSidechain?: boolean;
+}
+/** Parse one transcript jsonl into canonical messages + usage totals. */
+declare function readClaudeTranscript(path: string, options?: ReadClaudeTranscriptOptions): Promise<ClaudeTranscript>;
+//#endregion
+//#region src/rollout/readers/opencode-sqlite.d.ts
+declare const DEFAULT_OPENCODE_DB: string;
+interface OpencodeSessionRow {
+  id: string;
+  parentId: string | null;
+  directory: string;
+  agent: string | null;
+  /** Raw session.model JSON: {id, providerID, variant} where present. */
+  model: {
+    id?: string;
+    providerID?: string;
+  } | null;
+  costUsd: number;
+  tokensInput: number;
+  tokensOutput: number;
+  tokensReasoning: number;
+  tokensCacheRead: number;
+  tokensCacheWrite: number;
+  timeCreated: number;
+  timeUpdated: number;
+}
+/** Open the store read-only; null = unavailable/corrupt (caller records a gap). */
+declare function openOpencodeDb(path?: string): Promise<DatabaseSync | null>;
+/** Sessions whose cwd is `directory` (the worker-clone join key). */
+declare function findOpencodeSessionsByDirectory(db: DatabaseSync, directory: string): OpencodeSessionRow[];
+declare function findOpencodeSessionById(db: DatabaseSync, sessionId: string): OpencodeSessionRow | null;
+/**
+ * Convert one session's message+part rows into canonical messages.
+ * An opencode assistant message row spans several model steps; each step's
+ * parts (reasoning → text → tool …) become one assistant message followed by
+ * the role:"tool" results of its calls, preserving order.
+ */
+declare function readOpencodeSessionMessages(db: DatabaseSync, sessionId: string): ChatMessage[];
+//#endregion
+//#region src/rollout/release/gate-report.d.ts
+/** What a format does with a line the realness gate flagged. */
+type GateDisposition = 'exclude' | 'zero-and-flag';
+declare const FORMAT_GATE_DISPOSITION: Record<ReleaseFormat, GateDisposition>;
+/** What the gate accounting reads off an emitted row, per format. */
+interface ReleaseRowRef {
+  rollout_id: string;
+  reward: number | null;
+  /**
+   * The rest of the row that was DERIVED from the reward — the per-layer score
+   * dict, the judge verdict record, whatever this format ships beside the
+   * scalar. Walked for positive numbers, so the certification is about the
+   * whole outcome rather than one field.
+   *
+   * Absent when the format's row carries nothing but the scalar. NOT the whole
+   * row: `cost.tokens_in`, `wall_s` and `total_steps` are positive numbers that
+   * have nothing to do with the reward, and a certification that flags them is
+   * a certification nobody can act on.
+   */
+  evidence?: unknown;
+  /**
+   * The screen claim AS EMITTED — read off the row, not off the line it came
+   * from, because what ships is what matters. Required, not optional: an
+   * optional field is how a format quietly opts out of the check that reads it,
+   * and every emitted row shape carries `RealnessLabels` precisely so no adapter
+   * has to.
+   */
+  realness_screened: boolean | null;
+  /**
+   * The part of an emitted `steps[]` the wire format does not declare.
+   *
+   * Separate from `evidence` because the declared step fields are FULL of
+   * legitimate positive numbers — `durationMs`, `llm_call_count`,
+   * `prompt_token_ids` — and a certification that flags those is one nobody can
+   * act on. Only the undeclared remainder is unclassified reward-bearing
+   * payload, which is the same partition the check applies.
+   *
+   * Set only by formats whose row carries steps: today `raw` alone.
+   */
+  stepEvidence?: unknown;
+}
+/** A positive number found inside an emitted gated row, with where it was. */
+interface EmittedEvidence {
+  /** JSON-ish path from the row's evidence root, e.g. `metrics['layer.tests']`. */
+  path: string;
+  value: number;
+}
+interface FormatGateCounts {
+  /** Gated lines that reached this format's exporter. */
+  input: number;
+  /** Gated rows the format actually wrote. */
+  emitted: number;
+  /**
+   * Gated lines this format did not write. Not all of these are the gate:
+   * `verifiers` also drops gap lines (empty transcript) and `rft` drops lines
+   * with no prompt turn, so an excluded count can mix both causes.
+   */
+  excluded: number;
+  /** Highest reward on an emitted gated row; `null` when none was emitted. */
+  maxEmittedReward: number | null;
+  /**
+   * The largest positive number found in the reward-DERIVED payload of an
+   * emitted gated row, and its path; `null` when there is none.
+   *
+   * This column exists because the release once certified CLEAN while leaking.
+   * `assertGateReport` inspected `outcome.reward` alone, so a gated row shipping
+   * `reward: 0` next to `metrics['layer.tests']: 1` — the deterministic verifier
+   * score the reward was computed from, and the per-rubric score dict of the
+   * Prime Intellect verifiers format — passed, and the card rendered "max reward
+   * | 0" over a file that carried the gamed signal at full value. A wrong
+   * certification is worse than the leak: it is the leak plus a document saying
+   * there isn't one.
+   */
+  maxEmittedEvidence: EmittedEvidence | null;
+  /**
+   * Rows this format wrote carrying a positive reward whose producer DECLARED
+   * that no authenticity screen ever ran on it (`realness_screened: false`).
+   *
+   * Measured over EVERY emitted row, not just the gated ones: an unscreened
+   * reward is by definition one the gate never had a verdict on, so it is not in
+   * the gated set and a measurement scoped to that set would report 0 forever.
+   * `assertMinted` already refuses these, which is exactly why the release still
+   * measures them — the last door before a public dataset does not get to assume
+   * the earlier doors held.
+   */
+  unscreenedPositiveRows: number;
+  /** Highest reward on such a row; `null` when there is none. */
+  maxUnscreenedReward: number | null;
+  /**
+   * The largest positive number found in an emitted gated row's UNDECLARED
+   * per-step payload, and its path; `null` when there is none.
+   *
+   * The column exists because the gate read `outcome` and nothing else for
+   * three rounds, so a gated line shipping `steps: [{kind, name, reward: 0.86}]`
+   * certified clean — the release accounting agreed with the exporter that a
+   * per-step reward was not a reward.
+   */
+  maxEmittedStepEvidence: EmittedEvidence | null;
+}
+interface GateReport {
+  /** Gated lines in the release input, after the split/proposer filters. */
+  gatedLines: number;
+  byFormat: Partial<Record<ReleaseFormat, FormatGateCounts>>;
+}
+/** Rollout ids of every gated line, the key the emitted rows are matched on. */
+declare function gatedRolloutIds(lines: readonly MintedRolloutLine[]): Set<string>;
+/**
+ * Row refs per format. Written as one adapter per format so that the knowledge
+ * of WHERE the id and reward live in each published shape sits next to the
+ * assertion that uses it — an exporter that moves either field breaks here
+ * rather than silently reporting zero gated rows.
+ */
+declare const releaseRowRefs: {
+  sft: (rows: readonly SftRow[]) => ReleaseRowRef[];
+  verifiers: (rows: readonly VerifiersRolloutOutput[]) => ReleaseRowRef[];
+  rft: (rows: readonly RftItem[]) => ReleaseRowRef[];
+  raw: (lines: readonly MintedRolloutLine[]) => ReleaseRowRef[];
+};
+/** Measure one format's gated rows from the refs of the rows about to be written. */
+declare function measureFormatGate(gated: ReadonlySet<string>, refs: readonly ReleaseRowRef[]): FormatGateCounts;
+/**
+ * Fail the build when the measurement disagrees with the declared policy.
+ *
+ * Throws, never filters: an emitted positive reward on a gated row means an
+ * exporter upstream stopped applying the gate, and silently dropping the row
+ * would hide the producer that made it — the producer is the actual defect.
+ *
+ * Certifies the whole emitted outcome, not `reward` alone. The earlier version
+ * checked one field and therefore certified a release CLEAN while its
+ * `verifiers/train.jsonl` shipped the gamed run's per-layer scores at 1.0 in
+ * the top-level `metrics` dict — the card then rendered "max reward | 0" over
+ * exactly that file. A certification that is wrong is worse than an
+ * uncertified leak, so the checks it runs are no longer written down here at
+ * all: it iterates `GATE_CHECK_IDS` under its own declared policy.
+ */
+declare function assertGateReport(report: GateReport): void;
+//#endregion
+//#region src/rollout/release/scrub.d.ts
+interface ScrubRule {
+  name: string;
+  pattern: RegExp;
+  /** Rewrite for one match; `g1` is the first capture group when present. */
+  rewrite: (match: string, g1?: string) => string;
+}
+declare const SCRUB_RULES: readonly ScrubRule[];
+/** Rule name → number of matches rewritten. Always carries every rule (0 is data). */
+type ScrubCounts = Record<string, number>;
+declare function emptyScrubCounts(): ScrubCounts;
+declare function addScrubCounts(into: ScrubCounts, from: ScrubCounts): ScrubCounts;
+declare function scrubText(text: string, counts: ScrubCounts): string;
+/**
+ * Scrub every string value in a line; structure and key order are preserved.
+ *
+ * `assertMinted` on the way out rather than a cast: scrubbing rebuilds the
+ * object, so the brand has to be re-earned, and re-validating proves the rules
+ * did not rewrite a field the schema constrains (`reward` is a number, not a
+ * string, so no rule should ever touch it — this is what checks that).
+ */
+declare function scrubRolloutLine(line: MintedRolloutLine, counts: ScrubCounts): MintedRolloutLine;
+declare function scrubLines(lines: MintedRolloutLine[]): {
+  lines: MintedRolloutLine[];
+  counts: ScrubCounts;
+};
+/**
+ * A `RolloutScrubber` (text → text) applying the full rule set — the
+ * default hook to pass to `mintRolloutRows({ scrub })` so lines are
+ * scrubbed at mint time, before they ever reach a ledger file. Release
+ * builds re-run `scrubLines` regardless (idempotent), so double-scrubbing
+ * is safe and counted as zero.
+ */
+declare function defaultRolloutScrubber(text: string): string;
+//#endregion
+//#region src/rollout/release/card.d.ts
+declare const RELEASE_FORMATS: readonly ['sft', 'verifiers', 'rft', 'raw'];
+type ReleaseFormat = (typeof RELEASE_FORMATS)[number];
+/** Format → data file path inside the dataset dir (train split only). */
+declare const FORMAT_FILES: Record<ReleaseFormat, string>;
+interface DatasetCardInputs {
+  /** Scrubbed, release-filtered lines (what actually ships). */
+  lines: MintedRolloutLine[];
+  formats: ReleaseFormat[];
+  includeProposers: boolean;
+  /** Source ledger basenames, for provenance. */
+  sourceFiles: string[];
+  scrubTotals: ScrubCounts;
+  excluded: {
+    proposers: number;
+    nonTrain: number;
+  };
+  formatCounts: Partial<Record<ReleaseFormat, number>>;
+  /**
+   * Per-format anti-Goodhart accounting MEASURED on the rows the build wrote.
+   * Required, not optional: the card's only statement about the gate is a
+   * render of these numbers, so a card cannot be produced without them and
+   * cannot drift from the data files it ships beside.
+   */
+  gate: GateReport;
+}
+declare function buildDatasetCard(inputs: DatasetCardInputs): string;
+//#endregion
+//#region src/rollout/release/hf-dataset.d.ts
+interface BuildOptions {
+  out: string;
+  formats: ReleaseFormat[];
+  includeProposers: boolean;
+}
+interface ScrubReport {
+  /** Input ledger path → rule → rewrite count (only shipped lines are scrubbed). */
+  files: Record<string, ScrubCounts>;
+  totals: ScrubCounts;
+  excluded: {
+    proposers: number;
+    nonTrain: number;
+  };
+}
+interface BuildSummary {
+  inputs: string[];
+  read: number;
+  kept: number;
+  scrub: ScrubReport;
+  formatCounts: Partial<Record<ReleaseFormat, number>>;
+  /** Per-format anti-Goodhart accounting, measured on the rows written. */
+  gate: GateReport;
+  files: string[];
+}
+declare function buildHfDataset(inputs: string[], options: BuildOptions): Promise<BuildSummary>;
+declare function planPushCommand(repo: string, outDir: string): string[];
+declare function pushDataset(repo: string, outDir: string): void;
+interface RolloutReleaseCliArgs extends BuildOptions {
+  inputs: string[];
+  push: string | null;
+}
+declare const ROLLOUT_RELEASE_USAGE = "usage: agent-eval rollout-release <ledger.jsonl...> --out <dir> [--formats sft,verifiers,rft,raw] [--include-proposers] [--push <org/name>]";
+declare function parseRolloutReleaseArgs(argv: string[]): RolloutReleaseCliArgs;
+/** CLI driver for `agent-eval rollout-release`. Returns the process exit code. */
+declare function runRolloutReleaseCli(argv: string[]): Promise<number>;
+//#endregion
+export { ScorePreference as $, toVerifiersRolloutOutput as $t, ReleaseRowRef as A, GATE_CHECK_IDS as At, readOpencodeSessionMessages as B, RealnessLabels as Bt, scrubRolloutLine as C, HarborToolCall as Ct, FormatGateCounts as D, toHarborTrajectories as Dt, FORMAT_GATE_DISPOSITION as E, relabelImportedSplit as Et, DEFAULT_OPENCODE_DB as F, GateCheckedOutcome as Ft, claudeProjectSlug as G, VerifiersRolloutOutput as Gt, ClaudeTranscriptRef as H, RftItem as Ht, OpencodeSessionRow as I, GateEntryPoint as It, MintRolloutOptions as J, toJsonl as Jt, findClaudeTranscripts as K, VerifiersTokenUsage as Kt, findOpencodeSessionById as L, GatePolicy as Lt, gatedRolloutIds as M, GateCheck as Mt, measureFormatGate as N, GateCheckDisposition as Nt, GateDisposition as O, toHarborTrajectory as Ot, releaseRowRefs as P, GateCheckId as Pt, ScoreOrigin as Q, toSftRows as Qt, findOpencodeSessionsByDirectory as R, gateErrors as Rt, scrubLines as S, HarborSubagentTrajectoryRef as St, EmittedEvidence as T, fromHarborTrajectory as Tt, ClaudeUsageTotals as U, SftExportOptions as Ut, ClaudeTranscript as V, RewardRow as Vt, DEFAULT_CLAUDE_PROJECTS_DIR as W, SftRow as Wt, RolloutScrubber as X, toRftItem as Xt, MintRolloutResult as Y, toRewardRows as Yt, mintRolloutRows as Z, toRftItems as Zt, ScrubCounts as _, HarborMetrics as _t, ScrubReport as a, trainingScore as at, defaultRolloutScrubber as b, HarborStep as bt, planPushCommand as c, readRolloutLedger as ct, DatasetCardInputs as d, FromHarborOptions as dt, toVerifiersRolloutOutputs as en, isRealnessGated as et, FORMAT_FILES as f, HARBOR_IMPORT_GAP as ft, SCRUB_RULES as g, HarborImageSource as gt, buildDatasetCard as h, HarborFinalMetrics as ht, RolloutReleaseCliArgs as i, trainingReward as it, assertGateReport as j, GATE_POLICIES as jt, GateReport as k, GATE_CHECKS as kt, pushDataset as l, writeRolloutLedger as lt, ReleaseFormat as m, HarborContentPart as mt, BuildSummary as n, observedSplitScore as nt, buildHfDataset as o, appendRolloutLines as ot, RELEASE_FORMATS as p, HarborAgent as pt, readClaudeTranscript as q, realnessLabels as qt, ROLLOUT_RELEASE_USAGE as r, scoreOrigin as rt, parseRolloutReleaseArgs as s, readRolloutJournal as st, BuildOptions as t, observedScore as tt, runRolloutReleaseCli as u, ATIF_SCHEMA_VERSION as ut, ScrubRule as v, HarborObservation as vt, scrubText as w, HarborTrajectory as wt, emptyScrubCounts as x, HarborStepSource as xt, addScrubCounts as y, HarborObservationResult as yt, openOpencodeDb as z, gatedEvidenceOf as zt };
+//# sourceMappingURL=index-2JJSA6-r2.d.ts.map