@tangle-network/agent-eval 0.129.0 → 0.130.1

package/dist/chunk-3OCR4R5I.js

@@ -1,728 +0,0 @@
-import {
-  toJsonl,
-  toRftItems,
-  toSftRows,
-  toVerifiersRolloutOutputs
-} from "./chunk-OWN5NPMC.js";
-import {
-  GATE_CHECK_IDS,
-  GATE_POLICIES,
-  ROLLOUT_ROLES,
-  ROLLOUT_SCHEMA,
-  assertMinted,
-  assertRolloutLine,
-  isTrainableSplit,
-  undeclaredStepPayload
-} from "./chunk-PC5DOSM7.js";
-
-// src/rollout/ledger.ts
-import { appendFile, mkdir, readFile, writeFile } from "fs/promises";
-import { dirname } from "path";
-function serialize(lines) {
-  for (const [i, line] of lines.entries()) assertRolloutLine(line, `rollout line [${i}]`);
-  return lines.map((line) => JSON.stringify(line)).join("\n") + (lines.length > 0 ? "\n" : "");
-}
-async function writeRolloutLedger(path, lines) {
-  const payload = serialize(lines);
-  await mkdir(dirname(path), { recursive: true });
-  await writeFile(path, payload);
-}
-async function appendRolloutLines(path, lines) {
-  if (lines.length === 0) return;
-  const payload = serialize(lines);
-  await mkdir(dirname(path), { recursive: true });
-  await appendFile(path, payload);
-}
-async function readRolloutLedger(path) {
-  return readLines(path, (parsed, context) => assertMinted(parsed, context));
-}
-async function readRolloutJournal(path) {
-  return readLines(path, (parsed, context) => {
-    assertRolloutLine(parsed, context);
-    return parsed;
-  });
-}
-async function readLines(path, admit) {
-  const raw = await readFile(path, "utf8");
-  const lines = [];
-  const rawLines = raw.split("\n");
-  for (let i = 0; i < rawLines.length; i++) {
-    const text = rawLines[i];
-    if (!text?.trim()) continue;
-    let parsed;
-    try {
-      parsed = JSON.parse(text);
-    } catch (error) {
-      throw new Error(
-        `${path}:${i + 1}: malformed JSON \u2014 ${error instanceof Error ? error.message : String(error)}`
-      );
-    }
-    lines.push(admit(parsed, `${path}:${i + 1}`));
-  }
-  return lines;
-}
-
-// src/rollout/release/gate-report.ts
-var FORMAT_GATE_DISPOSITION = {
-  sft: "exclude",
-  verifiers: "zero-and-flag",
-  rft: "zero-and-flag",
-  raw: "zero-and-flag"
-};
-function gatedRolloutIds(lines) {
-  return new Set(lines.filter((line) => line.outcome.realness_gated).map((line) => line.rollout_id));
-}
-var releaseRowRefs = {
-  // An SFT row is `{messages, metadata}` and `metadata` holds ids plus the
-  // scalar — no reward-derived payload beyond `reward` itself, and the gated
-  // disposition is EXCLUDE anyway.
-  sft: (rows) => rows.map((row) => ({
-    rollout_id: row.metadata.rollout_id,
-    reward: row.metadata.reward,
-    realness_screened: row.metadata.realness_screened
-  })),
-  // `metrics` IS the per-rubric score dict in the Prime Intellect verifiers
-  // format — the same numbers the reward was computed from. This is the leak
-  // that shipped.
-  verifiers: (rows) => rows.map((row) => ({
-    rollout_id: row.info.rollout_id,
-    reward: row.reward,
-    evidence: row.metrics,
-    realness_screened: row.info.realness_screened
-  })),
-  // RFT re-samples the completion, but the grader reads `item.reference.*`, so
-  // the verbatim judge verdict is a reward-bearing field on the row.
-  rft: (rows) => rows.map((row) => ({
-    rollout_id: row.reference.rollout_id,
-    reward: row.reference.reward,
-    evidence: row.reference.verdict,
-    realness_screened: row.reference.realness_screened
-  })),
-  raw: (lines) => lines.map((line) => ({
-    rollout_id: line.rollout_id,
-    reward: line.outcome.reward,
-    // `provenance.gated_evidence` is deliberately NOT walked: relocating the
-    // diagnostics there is what the gate DOES, and the raw config is the
-    // audit dump those diagnostics exist for.
-    evidence: { metrics: line.outcome.metrics, verdict: line.outcome.verdict },
-    // `raw` is the only config that writes the whole line, so it is the only
-    // one whose rows can carry a per-step reward.
-    stepEvidence: undeclaredStepPayload(line.steps),
-    realness_screened: line.outcome.realness_screened ?? null
-  }))
-};
-function positiveNumbersIn(value, path) {
-  if (typeof value === "number") {
-    return Number.isFinite(value) && value > 0 ? [{ path, value }] : [];
-  }
-  if (Array.isArray(value)) {
-    return value.flatMap((item, i) => positiveNumbersIn(item, `${path}[${i}]`));
-  }
-  if (typeof value === "object" && value !== null) {
-    return Object.entries(value).flatMap(
-      ([key, child]) => positiveNumbersIn(child, path === "" ? key : `${path}.${key}`)
-    );
-  }
-  return [];
-}
-function measureFormatGate(gated, refs) {
-  const emitted = refs.filter((ref) => gated.has(ref.rollout_id));
-  const rewards = emitted.map((ref) => ref.reward).filter((r) => r !== null);
-  const evidence = emitted.flatMap((ref) => positiveNumbersIn(ref.evidence, ""));
-  const stepEvidence = emitted.flatMap((ref) => positiveNumbersIn(ref.stepEvidence, "steps"));
-  const unscreened = refs.filter((ref) => ref.realness_screened === false).map((ref) => ref.reward).filter((r) => r !== null && r > 0);
-  return {
-    input: gated.size,
-    emitted: emitted.length,
-    excluded: gated.size - emitted.length,
-    maxEmittedReward: rewards.length === 0 ? null : Math.max(...rewards),
-    maxEmittedEvidence: evidence.reduce(
-      (best, found) => best === null || found.value > best.value ? found : best,
-      null
-    ),
-    unscreenedPositiveRows: unscreened.length,
-    maxUnscreenedReward: unscreened.length === 0 ? null : Math.max(...unscreened),
-    maxEmittedStepEvidence: stepEvidence.reduce(
-      (best, found) => best === null || found.value > best.value ? found : best,
-      null
-    )
-  };
-}
-var REPORT_MEASURES = {
-  "reward-relationship": (format, counts) => counts.maxEmittedReward === null || counts.maxEmittedReward <= 0 ? null : `release format "${format}": ${counts.emitted} realness-gated row(s) carry a positive reward (max ${counts.maxEmittedReward}). A run flagged as gamed may not ship a positive reward in any config.`,
-  "gated-evidence": (format, counts) => {
-    if (counts.maxEmittedEvidence === null) return null;
-    const { path, value } = counts.maxEmittedEvidence;
-    return `release format "${format}": ${counts.emitted} realness-gated row(s) carry a positive reward-derived number (${path} = ${value}). Zeroing the scalar is not enough \u2014 the per-layer scores and judge verdict a fabricated reward was computed FROM are the same signal in component form, and in this format they are read as training input. They belong in \`provenance.gated_evidence\` (see \`gateGamedOutcome\`), not on the row.`;
-  },
-  "undeclared-step-payload": (format, counts) => {
-    if (counts.maxEmittedStepEvidence === null) return null;
-    const { path, value } = counts.maxEmittedStepEvidence;
-    return `release format "${format}": ${counts.emitted} realness-gated row(s) carry a positive per-step number under a field \`tangle.rollout.v1\` does not declare (${path} = ${value}). A per-step reward is the same training signal as the scalar, in credit-assignment form, and the exporters copy \`steps\` through verbatim \u2014 so the row ships it beside a \`reward\` of 0. It belongs in \`provenance.gated_evidence.steps\` (see \`gateGamedOutcome\`).`;
-  },
-  "unscreened-reward": (format, counts) => counts.maxUnscreenedReward === null ? null : `release format "${format}": ${counts.unscreenedPositiveRows} row(s) carry a positive reward (max ${counts.maxUnscreenedReward}) whose producer declares that NO authenticity screen ran on it (\`realness_screened: false\`). Nothing has established those successes are real, and a published dataset may not present an unqualified verdict as a measured one. Screen the runs, or publish them at \`reward: null\`.`
-};
-function assertGateReport(report) {
-  for (const [format, counts] of Object.entries(report.byFormat)) {
-    for (const id of GATE_CHECK_IDS) {
-      if (GATE_POLICIES.assertGateReport[id].kind !== "enforce") continue;
-      const failure = REPORT_MEASURES[id](format, counts);
-      if (failure !== null) throw new Error(failure);
-    }
-    if (FORMAT_GATE_DISPOSITION[format] === "exclude" && counts.emitted > 0) {
-      throw new Error(
-        `release format "${format}" declares gated lines EXCLUDED but wrote ${counts.emitted} of them.`
-      );
-    }
-  }
-}
-
-// src/rollout/release/card.ts
-var RELEASE_FORMATS = ["sft", "verifiers", "rft", "raw"];
-var FORMAT_FILES = {
-  sft: "sft/train.jsonl",
-  verifiers: "verifiers/train.jsonl",
-  rft: "rft/train.jsonl",
-  raw: "raw/train.jsonl"
-};
-var FORMAT_DESCRIPTIONS = {
-  sft: "Successful trainable-split transcripts (`reward >= 1`, never realness-gated) as `{messages, metadata}` chat JSONL.",
-  verifiers: "Prime Intellect verifiers `RolloutOutput`: prompt/completion split at the first assistant turn, plus reward, metrics, tool defs, and token usage.",
-  rft: "OpenAI RFT items: prompt turns plus `reference.*` verdict fields for a grader (completions are re-sampled during RFT).",
-  raw: `Full \`${ROLLOUT_SCHEMA}\` ledger lines (scrubbed), one per agent invocation.`
-};
-function unique(values) {
-  return [...new Set(values.filter((v) => v !== null))].sort();
-}
-function formatReward(reward) {
-  if (reward === null) return "null";
-  return Number.isInteger(reward) ? String(reward) : reward.toFixed(4);
-}
-function markdownTable(header, rows) {
-  return [
-    `| ${header.join(" | ")} |`,
-    `| ${header.map(() => "---").join(" | ")} |`,
-    ...rows.map((row) => `| ${row.join(" | ")} |`)
-  ].join("\n");
-}
-var GATE_FLAG_FIELD = {
-  sft: "\u2014 (no gated row is written)",
-  verifiers: "`info.realness_gated`",
-  rft: "`reference.realness_gated`",
-  raw: "`outcome.realness_gated`"
-};
-var GATE_POLICY_LABEL = {
-  sft: "EXCLUDED \u2014 an SFT row is an imitation target",
-  verifiers: "INCLUDED, reward forced to 0, flagged",
-  rft: "INCLUDED, reward forced to 0, flagged",
-  raw: "INCLUDED verbatim, flagged"
-};
-function gateSection(formats, gate, totalLines) {
-  const rows = formats.map((format) => {
-    const counts = gate.byFormat[format];
-    return [
-      format,
-      GATE_POLICY_LABEL[format],
-      String(counts?.emitted ?? 0),
-      String(counts?.excluded ?? 0),
-      counts?.maxEmittedReward === null || counts === void 0 ? "\u2014" : formatReward(counts.maxEmittedReward),
-      counts?.maxEmittedEvidence == null ? "\u2014" : `${counts.maxEmittedEvidence.path} = ${counts.maxEmittedEvidence.value}`,
-      GATE_FLAG_FIELD[format]
-    ];
-  });
-  const mixedExclusion = formats.some(
-    (format) => FORMAT_GATE_DISPOSITION[format] === "zero-and-flag"
-  );
-  return [
-    `\`outcome.realness_gated: true\` marks a run whose success signal was faked (it satisfied the proxy without doing the work). **${gate.gatedLines} of ${totalLines} lines in this release are gated.**`,
-    "",
-    "The gate is enforced, not asserted. A line pairing `realness_gated: true` with a reward above 0 is rejected by the schema validator, so it cannot be read out of a source ledger or written into `raw/train.jsonl` at all; on a gated line the numbers the reward was computed from (`outcome.metrics`, the verbatim judge `outcome.verdict`, and any per-step field the schema does not declare \u2014 a per-step reward is the same signal in credit-assignment form) are moved out of `outcome` and `steps[]` and into `provenance.gated_evidence`, where no config reads them as training input; the exporters re-check the same invariant on every line; and the release build measures the rows it is about to write and refuses to write ANY file if a gated row carries a positive reward \u2014 or any positive number derived from one \u2014 in ANY config.",
-    "",
-    "The table below is **measured on the rows in this release**, not a description of intent \u2014 the build counts the emitted rows and this card renders those counts:",
-    "",
-    markdownTable(
-      [
-        "config",
-        "policy",
-        "gated rows written",
-        "gated rows not written",
-        "max reward",
-        "max reward-derived number",
-        "flag"
-      ],
-      rows
-    ),
-    "",
-    "Why gated rows are kept where they are kept: an SFT row is imitated verbatim, so a gamed trajectory must never appear in one at any weight. In `verifiers` the reward is a signed learning signal, and a gamed trajectory at reward 0 is a correct negative \u2014 dropping it would bias the negative population toward honest failures and leave a trainer no example of gaming being penalized. `rft` re-samples the completion, so only the prompt and the grader reference ship. `raw` is a faithful audit dump, where the gated row is the one an auditor most wants.",
-    "",
-    "Reward 0 is never the only label: every included config carries the flag on the row itself, because zeroing alone makes a faked success indistinguishable from an honest failure. Filter on the flag to drop the gamed population, or select on it to mine it. The gated run's own measurements are not destroyed either \u2014 they are parked verbatim under `provenance.gated_evidence` in `raw/train.jsonl`, which is where an auditor can see what the run claimed and why it was flagged.",
-    mixedExclusion ? '\n"Gated rows not written" is not all gate: `verifiers` also drops gap lines (empty transcript) and `rft` drops lines with no prompt turn, so that column can mix both causes.' : ""
-  ].join("\n").trimEnd();
-}
-function roleRewardRows(lines) {
-  const counts = /* @__PURE__ */ new Map();
-  for (const line of lines) {
-    const byReward = counts.get(line.role) ?? /* @__PURE__ */ new Map();
-    const key = formatReward(line.outcome.reward);
-    byReward.set(key, (byReward.get(key) ?? 0) + 1);
-    counts.set(line.role, byReward);
-  }
-  const rows = [];
-  for (const role of ROLLOUT_ROLES) {
-    const byReward = counts.get(role);
-    if (!byReward) continue;
-    const keys = [...byReward.keys()].sort((a, b) => {
-      if (a === "null") return 1;
-      if (b === "null") return -1;
-      return Number(b) - Number(a);
-    });
-    for (const key of keys) rows.push([role, key, String(byReward.get(key))]);
-  }
-  return rows;
-}
-function buildDatasetCard(inputs) {
-  const {
-    lines,
-    formats,
-    includeProposers,
-    sourceFiles,
-    scrubTotals,
-    excluded,
-    formatCounts,
-    gate
-  } = inputs;
-  assertGateReport(gate);
-  const runIds = unique(lines.map((line) => line.run_id));
-  const generations = [...new Set(lines.map((line) => line.generation))].filter((g) => g !== null).sort((a, b) => a - b);
-  const models = unique(lines.map((line) => line.policy.model));
-  const harnesses = unique(lines.map((line) => line.policy.harness));
-  const captures = unique(lines.map((line) => line.provenance.capture));
-  const rewardSources = unique(lines.map((line) => line.outcome.reward_source));
-  const gapLines = lines.filter((line) => line.messages.length === 0).length;
-  const gatedLines = lines.filter((line) => line.outcome.realness_gated).length;
-  if (gatedLines !== gate.gatedLines) {
-    throw new Error(
-      `dataset card: gate report claims ${gate.gatedLines} realness-gated line(s) but the lines it describes contain ${gatedLines} \u2014 the card and the build measured different data.`
-    );
-  }
-  const configs = formats.map(
-    (format) => [
-      `  - config_name: ${format}`,
-      "    data_files:",
-      "      - split: train",
-      `        path: ${FORMAT_FILES[format]}`
-    ].join("\n")
-  ).join("\n");
-  const frontmatter = [
-    "---",
-    "license: unknown",
-    "pretty_name: Tangle rollout ledger \u2014 agent trajectories",
-    "configs:",
-    configs,
-    "---"
-  ].join("\n");
-  const formatsTable = markdownTable(
-    ["config", "path", "rows", "contents"],
-    formats.map((format) => [
-      format,
-      `\`${FORMAT_FILES[format]}\``,
-      String(formatCounts[format] ?? 0),
-      FORMAT_DESCRIPTIONS[format]
-    ])
-  );
-  const countsTable = markdownTable(["role", "reward", "lines"], roleRewardRows(lines));
-  const scrubTable = markdownTable(
-    ["rule", "rewrites"],
-    Object.entries(scrubTotals).map(([rule, count]) => [rule, String(count)])
-  );
-  const proposerNote = includeProposers ? "Proposer sessions are INCLUDED (`--include-proposers`); their transcripts contain improvement-loop harness source." : `Proposer sessions are excluded by default (${excluded.proposers} lines dropped); they contain improvement-loop harness source. Rebuild with \`--include-proposers\` to keep them.`;
-  return `${frontmatter}
-
-# Tangle rollout ledger \u2014 agent trajectories
-
-One line per agent invocation (supervisor episode, worker session, proposer shot, judge call, analyst pass) captured by the \`${ROLLOUT_SCHEMA}\` rollout ledger, labeled with improvement-loop coordinates and the official-judge reward, with the full message transcript inline.
-
-This release contains the **trainable split only** (\`search\`). Holdout, dev, and canary splits are structurally excluded at build time, and the build additionally drops any non-trainable line as a fail-closed filter (${excluded.nonTrain} dropped here).
-
-## Formats
-
-${formatsTable}
-
-## Anti-Goodhart gate (\`realness_gated\`)
-
-${gateSection(formats, gate, lines.length)}
-
-## Schema (\`${ROLLOUT_SCHEMA}\`)
-
-Each raw line carries:
-
-- \`rollout_id\` / \`parent_rollout_id\` \u2014 invocation identity; workers point at their spawning supervisor episode.
-- \`run_id\`, \`experiment_id\`, \`candidate_id\` \u2014 run/experiment/candidate identity from the producing RunRecord, when present.
-- \`generation\`, \`candidate_index\` \u2014 improvement-loop coordinates (\`-1\` = baseline campaign; \`null\` = not an improvement loop).
-- \`role\` \u2014 one of ${ROLLOUT_ROLES.map((role) => `\`${role}\``).join(", ")}.
-- \`task\` \u2014 suite, instance id, split, seed, replicate index.
-- \`policy\` \u2014 harness, model, provider, profile commit, prompt/config hashes, sampling params.
-- \`messages\` / \`tool_defs\` \u2014 full transcript in canonical OpenAI chat-with-tools form (including \`reasoning_content\`). An empty \`messages\` array is a labeled gap line; \`provenance.gap\` says why the transcript could not be recovered (${gapLines} gap lines in this release).
-- \`outcome\` \u2014 \`reward\` (the single scalar), \`reward_source\`, the verbatim judge \`verdict\`, non-scalar \`metrics\`, and \`realness_gated\` (anti-Goodhart flag; see [Anti-Goodhart gate](#anti-goodhart-gate-realness_gated) for the per-config treatment and the measured counts).
-- \`cost\` \u2014 usd, token counts, wall time.
-- \`artifacts\` / \`provenance\` \u2014 patch/run-dir/transcript pointers (scrubbed) and capture metadata.
-
-## Provenance
-
-- Source ledgers: ${sourceFiles.map((file) => `\`${file}\``).join(", ")}
-- Run ids: ${runIds.map((id) => `\`${id}\``).join(", ")}
-- Generations: ${generations.join(", ")} (\`-1\` = baseline campaign)
-- Models: ${models.map((m) => `\`${m}\``).join(", ")}
-- Harnesses: ${harnesses.map((h) => `\`${h}\``).join(", ")}
-- Capture modes: ${captures.join(", ")}
-- Every reward traces to a named source (reward sources in this release: ${rewardSources.map((s) => `\`${s}\``).join(", ")}).
-
-${proposerNote}
-
-## Reward semantics per role
-
-- **agent** \u2014 the producing RunRecord's holdout/search score, with the realness gate forcing gamed successes to 0.
-- **supervisor** \u2014 the official-judge verdict on the episode's delivered artifact (1 = resolved, 0 = not).
-- **worker** \u2014 INHERITED from the parent supervisor episode (\`\u2026/inherited\`). Caveat: reward 1 does not establish this worker's individual contribution (sibling workers in the same episode share the episode outcome), and reward 0 does not prove this worker failed.
-- **proposer** \u2014 the fraction of improvement-set instances the proposed candidate resolved (\`\u2026/candidate-resolved-fraction\`); a scalar in [0, 1], not a binary verdict.
-- **judge / analyst** \u2014 carry the episode verdict where one applies; otherwise \`reward: null\` (a labeled gap, never 0).
-
-## Counts
-
-${countsTable}
-
-Total lines: ${lines.length}
-
-## Scrubbing
-
-Absolute home paths were rewritten to \`$WORK\`, credential-shaped strings were replaced with \`[REDACTED:<kind>]\` markers, internal hostnames were normalized to \`*.internal.example\`, and username-bearing incidentals (\`ls -l\` owner columns, per-user pytest tmpdirs) were normalized to \`user\` / \`$USER\`. Rewrite counts for this release (full per-file breakdown in \`scrub-report.json\`):
-
-${scrubTable}
-
-## License
-
-\`license: unknown\` is a placeholder \u2014 the releasing operator must set the real SPDX license id in the frontmatter above before publishing.
-
-## Citation
-
-\`\`\`bibtex
-@misc{tangle_rollout_ledger,
-  title = {Tangle rollout ledger \u2014 agent trajectories},
-  author = {{Tangle Network}},
-  howpublished = {HuggingFace Datasets},
-  note = {Operator: fill in the repository URL, authors, and year before publishing}
-}
-\`\`\`
-`;
-}
-
-// src/rollout/release/scrub.ts
-var SCRUB_RULES = [
-  {
-    // /home/<user> and /Users/<user> prefixes → $WORK ($HOME-derived paths).
-    name: "home-path",
-    pattern: /\/(?:home|Users)\/[A-Za-z0-9._-]+/g,
-    rewrite: () => "$WORK"
-  },
-  {
-    // Harness stores encode cwd as a dashed path segment (-home-drew-…);
-    // strip the leading -home-<user> so the username never ships.
-    name: "home-path-encoded",
-    pattern: /(?<=\/)-(?:home|Users)-[A-Za-z0-9_.]+/g,
-    rewrite: () => "$WORK"
-  },
-  {
-    // pytest names its tmpdir after the invoking user (/tmp/pytest-of-drew).
-    name: "tmp-user-dir",
-    pattern: /\/tmp\/pytest-of-[A-Za-z0-9._-]+/g,
-    rewrite: () => "/tmp/pytest-of-$USER"
-  },
-  {
-    // `ls -l` owner/group columns leak the username in captured tool output.
-    // The `(?!user user…)` guard keeps a second pass at zero rewrites.
-    name: "ls-owner",
-    pattern: /([-bcdlps][-rwxsStT]{9}[.+@]?\s+\d+\s+)(?!user user(?=\s))[A-Za-z0-9._-]+\s+[A-Za-z0-9._-]+(?=\s)/g,
-    rewrite: (_match, prefix) => `${prefix}user user`
-  },
-  {
-    // Env-var-shaped secrets: NAME=value where NAME looks credential-bearing.
-    // The (?!\[REDACTED:) guard keeps the rule idempotent on its own output.
-    name: "env-secret",
-    pattern: /\b([A-Z][A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIALS?))=(?!\[REDACTED:)("[^"]*"|'[^']*'|[^\s"']+)/g,
-    rewrite: (_match, name) => `${name}=[REDACTED:env]`
-  },
-  {
-    name: "bearer-token",
-    pattern: /\b(Bearer|Basic)\s+(?!\[REDACTED:)[A-Za-z0-9\-._~+/=]{8,}/g,
-    rewrite: (_match, scheme) => `${scheme} [REDACTED:bearer]`
-  },
-  {
-    // Bare provider-prefixed keys (OpenAI/Anthropic sk-, GitHub ghp_/gho_/…,
-    // fine-grained PATs, HuggingFace hf_, Slack xox*, AWS AKIA).
-    name: "api-key",
-    pattern: /\b(?:sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{16,}|github_pat_[A-Za-z0-9_]{20,}|hf_[A-Za-z0-9]{16,}|xox[baprs]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16})\b/g,
-    rewrite: () => "[REDACTED:api-key]"
-  },
-  {
-    // Our infra hostnames → placeholder domain, subdomain preserved
-    // (router.tangle.tools → router.internal.example).
-    name: "infra-host",
-    pattern: /(?<![A-Za-z0-9.-])((?:[A-Za-z0-9-]+\.)*)tangle\.(?:tools|network)(?![A-Za-z0-9-])/g,
-    rewrite: (_match, prefix) => `${prefix ?? ""}internal.example`
-  },
-  {
-    // Known workstation hostnames leak through email Message-IDs and fqdn
-    // lookups inside captured test output; extend the list as machines join.
-    name: "machine-host",
-    pattern: /\b[A-Za-z0-9]+-GTR-Pro\b/g,
-    rewrite: () => "workstation"
-  }
-];
-function emptyScrubCounts() {
-  return Object.fromEntries(SCRUB_RULES.map((rule) => [rule.name, 0]));
-}
-function addScrubCounts(into, from) {
-  for (const [name, count] of Object.entries(from)) into[name] = (into[name] ?? 0) + count;
-  return into;
-}
-function scrubText(text, counts) {
-  let out = text;
-  for (const rule of SCRUB_RULES) {
-    out = out.replace(rule.pattern, (match, ...rest) => {
-      counts[rule.name] = (counts[rule.name] ?? 0) + 1;
-      return rule.rewrite(match, typeof rest[0] === "string" ? rest[0] : void 0);
-    });
-  }
-  return out;
-}
-function scrubValue(value, counts) {
-  if (typeof value === "string") return scrubText(value, counts);
-  if (Array.isArray(value)) return value.map((item) => scrubValue(item, counts));
-  if (value !== null && typeof value === "object") {
-    const out = {};
-    for (const [key, item] of Object.entries(value)) out[key] = scrubValue(item, counts);
-    return out;
-  }
-  return value;
-}
-function scrubRolloutLine(line, counts) {
-  return assertMinted(scrubValue(line, counts), `scrubbed rollout line ${line.rollout_id}`);
-}
-function scrubLines(lines) {
-  const counts = emptyScrubCounts();
-  return { lines: lines.map((line) => scrubRolloutLine(line, counts)), counts };
-}
-function defaultRolloutScrubber(text) {
-  return scrubText(text, emptyScrubCounts());
-}
-
-// src/rollout/release/hf-dataset.ts
-import { spawnSync } from "child_process";
-import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
-import { basename, dirname as dirname2, join } from "path";
-async function buildHfDataset(inputs, options) {
-  if (inputs.length === 0) throw new Error("no input ledgers given");
-  if (options.formats.length === 0) throw new Error("no formats selected");
-  const report = {
-    files: {},
-    totals: emptyScrubCounts(),
-    excluded: { proposers: 0, nonTrain: 0 }
-  };
-  const kept = [];
-  let read = 0;
-  for (const input of inputs) {
-    const lines = await readRolloutLedger(input);
-    read += lines.length;
-    const shippable = lines.filter((line) => {
-      if (!isTrainableSplit(line.task.split)) {
-        report.excluded.nonTrain += 1;
-        return false;
-      }
-      if (!options.includeProposers && line.role === "proposer") {
-        report.excluded.proposers += 1;
-        return false;
-      }
-      return true;
-    });
-    const scrubbed = scrubLines(shippable);
-    report.files[input] = scrubbed.counts;
-    addScrubCounts(report.totals, scrubbed.counts);
-    kept.push(...scrubbed.lines);
-  }
-  const formatCounts = {};
-  const files = [];
-  const gated = gatedRolloutIds(kept);
-  const gate = { gatedLines: gated.size, byFormat: {} };
-  const pending = [];
-  for (const format of options.formats) {
-    const path = join(options.out, FORMAT_FILES[format]);
-    if (format === "raw") {
-      gate.byFormat.raw = measureFormatGate(gated, releaseRowRefs.raw(kept));
-      formatCounts.raw = kept.length;
-      pending.push({ path, write: () => writeRolloutLedger(path, kept) });
-    } else if (format === "sft") {
-      const rows = toSftRows(kept);
-      gate.byFormat.sft = measureFormatGate(gated, releaseRowRefs.sft(rows));
-      formatCounts.sft = rows.length;
-      pending.push({ path, write: () => writeFile2(path, toJsonl(rows)) });
-    } else if (format === "verifiers") {
-      const outputs = toVerifiersRolloutOutputs(kept, {
-        gatedLines: FORMAT_GATE_DISPOSITION.verifiers
-      });
-      gate.byFormat.verifiers = measureFormatGate(gated, releaseRowRefs.verifiers(outputs));
-      formatCounts.verifiers = outputs.length;
-      pending.push({ path, write: () => writeFile2(path, toJsonl(outputs)) });
-    } else {
-      const items = toRftItems(kept, { gatedLines: FORMAT_GATE_DISPOSITION.rft });
-      gate.byFormat.rft = measureFormatGate(gated, releaseRowRefs.rft(items));
-      formatCounts.rft = items.length;
-      pending.push({ path, write: () => writeFile2(path, toJsonl(items)) });
-    }
-  }
-  assertGateReport(gate);
-  for (const { path, write } of pending) {
-    await mkdir2(dirname2(path), { recursive: true });
-    await write();
-    files.push(path);
-  }
-  const reportPath = join(options.out, "scrub-report.json");
-  await writeFile2(reportPath, `${JSON.stringify(report, null, 2)}
-`);
-  files.push(reportPath);
-  const cardPath = join(options.out, "README.md");
-  await writeFile2(
-    cardPath,
-    buildDatasetCard({
-      lines: kept,
-      formats: options.formats,
-      includeProposers: options.includeProposers,
-      sourceFiles: inputs.map((input) => basename(input)),
-      scrubTotals: report.totals,
-      excluded: report.excluded,
-      formatCounts,
-      gate
-    })
-  );
-  files.push(cardPath);
-  return { inputs, read, kept: kept.length, scrub: report, formatCounts, gate, files };
-}
-function planPushCommand(repo, outDir) {
-  return ["huggingface-cli", "upload", repo, outDir, ".", "--repo-type", "dataset"];
-}
-function pushDataset(repo, outDir) {
-  const found = spawnSync("which", ["huggingface-cli"], { stdio: "ignore" });
-  if (found.status !== 0) {
-    throw new Error(
-      "huggingface-cli not found on PATH \u2014 install huggingface_hub[cli] before --push"
-    );
-  }
-  if (!process.env.HF_TOKEN) {
-    throw new Error("HF_TOKEN not present in env \u2014 refusing to push");
-  }
-  const [command, ...args] = planPushCommand(repo, outDir);
-  const run = spawnSync(command, args, { stdio: "inherit" });
-  if (run.status !== 0) throw new Error(`huggingface-cli upload exited ${String(run.status)}`);
-}
-var ROLLOUT_RELEASE_USAGE = "usage: agent-eval rollout-release <ledger.jsonl...> --out <dir> [--formats sft,verifiers,rft,raw] [--include-proposers] [--push <org/name>]";
-function parseRolloutReleaseArgs(argv) {
-  const args = {
-    inputs: [],
-    out: "",
-    formats: [...RELEASE_FORMATS],
-    includeProposers: false,
-    push: null
-  };
-  for (let i = 0; i < argv.length; i++) {
-    const arg = argv[i];
-    if (arg === "--out") {
-      args.out = argv[++i] ?? "";
-    } else if (arg === "--formats") {
-      const raw = (argv[++i] ?? "").split(",").filter(Boolean);
-      for (const format of raw) {
-        if (!RELEASE_FORMATS.includes(format)) {
-          throw new Error(
-            `unknown format "${format}" \u2014 expected one of ${RELEASE_FORMATS.join(",")}`
-          );
-        }
-      }
-      args.formats = raw;
-    } else if (arg === "--include-proposers") {
-      args.includeProposers = true;
-    } else if (arg === "--push") {
-      args.push = argv[++i] ?? null;
-    } else if (arg.startsWith("--")) {
-      throw new Error(`unknown flag "${arg}"`);
-    } else {
-      args.inputs.push(arg);
-    }
-  }
-  if (args.inputs.length === 0 || !args.out) {
-    throw new Error(ROLLOUT_RELEASE_USAGE);
-  }
-  if (args.push !== null && !/^[\w.-]+\/[\w.-]+$/.test(args.push)) {
-    throw new Error(`--push expects <org/name>, got "${args.push}"`);
-  }
-  return args;
-}
-async function runRolloutReleaseCli(argv) {
-  let args;
-  try {
-    args = parseRolloutReleaseArgs(argv);
-  } catch (error) {
-    process.stderr.write(`${error instanceof Error ? error.message : String(error)}
-`);
-    return 2;
-  }
-  const summary = await buildHfDataset(args.inputs, args);
-  process.stdout.write(
-    `${JSON.stringify(
-      {
-        read: summary.read,
-        kept: summary.kept,
-        formatCounts: summary.formatCounts,
-        gate: summary.gate,
-        scrub: summary.scrub
-      },
-      null,
-      2
-    )}
-`
-  );
-  process.stdout.write(`dataset \u2192 ${args.out} (${summary.files.length} files)
-`);
-  if (args.push !== null) {
-    pushDataset(args.push, args.out);
-    process.stdout.write(`pushed \u2192 ${args.push}
-`);
-  }
-  return 0;
-}
-
-export {
-  writeRolloutLedger,
-  appendRolloutLines,
-  readRolloutLedger,
-  readRolloutJournal,
-  FORMAT_GATE_DISPOSITION,
-  gatedRolloutIds,
-  releaseRowRefs,
-  measureFormatGate,
-  assertGateReport,
-  RELEASE_FORMATS,
-  FORMAT_FILES,
-  buildDatasetCard,
-  SCRUB_RULES,
-  emptyScrubCounts,
-  addScrubCounts,
-  scrubText,
-  scrubRolloutLine,
-  scrubLines,
-  defaultRolloutScrubber,
-  buildHfDataset,
-  planPushCommand,
-  pushDataset,
-  ROLLOUT_RELEASE_USAGE,
-  parseRolloutReleaseArgs,
-  runRolloutReleaseCli
-};
-//# sourceMappingURL=chunk-3OCR4R5I.js.map