@tangle-network/agent-eval 0.144.5 → 0.144.7

package/dist/{mint-DD-0oQTA.js.map → mint-CGEkzPLf.js.map}

@@ -1 +1 @@
-{"version":3,"file":"mint-DD-0oQTA.js","names":[],"sources":["../src/rollout/mint.ts"],"sourcesContent":["/**\n * Rollout minting — `tangle.rollout.v1` lines joined from the records the\n * substrate ALREADY keeps. There is no separate rollout store: a rollout\n * is the JOIN of a RunRecord (identity, provenance, cost, outcome) with\n * its trace (spans share `runId`), projected into the canonical line.\n *\n * Composition, not duplication:\n *   - identity/provenance     → `RunRecord` (candidateId, splitTag, agentProfile, hashes)\n *   - step structure          → `buildTrajectory` over the shared TraceStore\n *   - preference-pair export  → `feedbackTrajectoryToOptimizerRow` (feedback-trajectory.ts)\n *   - PRM / reward-model      → `reward-model-export.ts`\n *\n * Anti-Goodhart invariant: a run whose `outcome.realness.gated` is true is\n * never exported with a positive reward OR with any of the numbers that reward\n * was computed from. The gate travels into the training data (`reward` forced\n * to 0, `realness_gated: true`) and the whole outcome is transformed by\n * `gateGamedOutcome` inside `assertMinted` below, which relocates `metrics` and\n * `verdict` to `provenance.gated_evidence`. Mint returns\n * `MintedRolloutLine[]`: the brand the training exporters require, which only\n * this function, `readRolloutLedger`, and an explicit `assertMinted` can mint.\n *\n * A record carrying NEITHER split score is REJECTED (`ValidationError`), never\n * minted at 0 — \"nobody graded this\" is not the same claim as \"graded a total\n * failure\", and a trainer reading 0 learns the second. Lines that already\n * carry `reward: null` (interchange imports, existing ledgers) remain valid on\n * the wire; only the RunRecord→line door refuses.\n *\n * Records without spans become labeled GAP LINES (messages: [],\n * provenance.gap) — present in the output AND surfaced in\n * `missingTraces`; a capture gap is a finding, never a silent omission.\n */\n\nimport { ValidationError } from '../errors'\nimport { type RunRecord, runTaskScore } from '../run-record'\nimport type { LlmSpan, Message, Span, ToolSpan } from '../trace/schema'\nimport type { TraceStore } from '../trace/store'\nimport { buildTrajectory } from '../trajectory'\nimport { rolloutRewardFields, scoreOrigin } from './reward'\nimport {\n  assertMinted,\n  type ChatMessage,\n  type MintedRolloutLine,\n  ROLLOUT_SCHEMA,\n  type RolloutRole,\n  type RolloutSplit,\n  type RolloutStep,\n} from './schema'\n\n/** Redactor applied to every exported string (secrets, PII). Identity by default. */\nexport type RolloutScrubber = (text: string) => string\n\nexport interface MintRolloutOptions {\n  scrub?: RolloutScrubber\n  /** Cap steps per line (longest runs first drop middle steps). Default: no cap. */\n  maxSteps?: number\n  /** Role recorded on every minted line. Default 'agent' (a solo eval run). */\n  role?: RolloutRole\n  /** Task suite label. Default: the record's `experimentId`. */\n  suite?: string\n  /** Injected clock for deterministic output. */\n  now?: () => Date\n}\n\nexport interface MintRolloutResult {\n  rows: MintedRolloutLine[]\n  /** runIds that had a RunRecord but no spans — emitted as gap lines AND listed here. */\n  missingTraces: string[]\n}\n\nconst asText = (v: unknown, scrub: RolloutScrubber): string => {\n  const s = typeof v === 'string' ? v : JSON.stringify(v)\n  return scrub(s ?? '')\n}\n\nfunction projectStep(span: Span, scrub: RolloutScrubber): RolloutStep {\n  const base: RolloutStep = {\n    kind: span.kind,\n    name: scrub(span.name),\n    status: span.status,\n    durationMs: span.endedAt !== undefined ? span.endedAt - span.startedAt : undefined,\n  }\n  if (span.kind === 'llm') {\n    const llm = span as LlmSpan\n    const last = llm.messages[llm.messages.length - 1]\n    if (last) base.input = scrub(last.content)\n    if (llm.output !== undefined) base.output = scrub(llm.output)\n  } else if (span.kind === 'tool') {\n    const tool = span as ToolSpan\n    base.input = asText(tool.args, scrub)\n    if (tool.result !== undefined) base.output = asText(tool.result, scrub)\n  }\n  return base\n}\n\n/** The final llm span's history + output is the completed conversation. */\nfunction finalConversation(spans: Span[], scrub: RolloutScrubber): ChatMessage[] {\n  const llms = spans.filter((s): s is LlmSpan => s.kind === 'llm')\n  const last = llms[llms.length - 1]\n  if (!last) return []\n  const messages: ChatMessage[] = last.messages.map((m: Message) => ({\n    role: m.role,\n    content: scrub(m.content),\n  }))\n  if (last.output !== undefined && last.output !== '') {\n    messages.push({ role: 'assistant', content: scrub(last.output) })\n  }\n  return messages\n}\n\n// The reward derivations live in the leaf module `./reward` so gate and\n// reporting code can import them without dragging in the trace store; they are\n// re-exported here because the derivations shipped from this path.\nexport {\n  isRealnessGated,\n  observedScore,\n  observedSplitScore,\n  type ScoreOrigin,\n  type ScorePreference,\n  scoreOrigin,\n  trainingReward,\n  trainingScore,\n} from './reward'\n\nconst REWARD_SOURCE: Record<ReturnType<typeof scoreOrigin>, string> = {\n  holdout: 'run-record/holdout-score',\n  search: 'run-record/search-score',\n  unscored: 'run-record/unscored',\n}\n\n/**\n * The mint door refuses an execution-only record: a missing training label is\n * not a zero reward, and not a mintable line either. Lines that already carry\n * `reward: null` — interchange imports, existing ledgers — stay valid on the\n * wire and keep their labeled gap; this guard is only about the\n * RunRecord→line door, where the producer can still be told to go score the\n * run instead of shipping an unlabeled row.\n */\nfunction requireTaskScore(record: RunRecord): void {\n  if (runTaskScore(record) === undefined) {\n    throw new ValidationError(`Cannot mint rollout for run ${record.runId}: task score is missing`)\n  }\n}\n\nconst isObject = (value: unknown): value is Record<string, unknown> =>\n  typeof value === 'object' && value !== null\n\ninterface MintFieldCheck {\n  /** The RunRecord path, spelled the way the caller has to fix it. */\n  readonly field: string\n  /** True when the record carries something the line can honestly be built from. */\n  readonly present: (bag: Record<string, unknown>) => boolean\n  /** What the caller writes onto the record, and why that value and not another. */\n  readonly remedy: string\n}\n\n/**\n * The RunRecord fields mint reads that a record can be missing even though the\n * TYPE says it cannot. There are exactly two ways that happens:\n *\n *   1. The field was OPTIONAL when the record was serialized. `costProvenance`,\n *      `terminalOutcome` and `scenarioId` were optional through agent-eval\n *      0.125 and became required in 0.126, with no on-disk migration — so every\n *      ledger written before 0.126 is full of records the type calls complete.\n *   2. Mint reads a level DEEPER than the record's own type is checked at:\n *      `outcome.raw`, `tokenUsage.input`, `tokenUsage.output`.\n *\n * Nothing else needs a check here. Every other field mint copies is a top-level\n * scalar landing in a typed slot on the line, where an absent value arrives as\n * `undefined` and `assertMinted` refuses it by name. These are the ones where an\n * absent value instead kills the join with `TypeError: Cannot read properties of\n * undefined`, or — worse — mints a line that reads as measured.\n *\n * This is deliberately NOT `validateRunRecord`. That validator answers \"is this\n * a valid RunRecord\", which is a wider question than \"can a rollout line be\n * built from this one\": it also enforces model-snapshot discipline, the\n * `terminalFailureReason` coupling, and the `costUsd === costProvenance.usd`\n * agreement. Routing the mint door through it would refuse records mint can\n * mint honestly today (a model alias with no snapshot date, for one), which is\n * a policy change with its own blast radius and not this bug. The door asks the\n * narrower question and answers it precisely.\n */\nconst MINT_FIELD_CHECKS: readonly MintFieldCheck[] = [\n  {\n    field: 'costProvenance',\n    present: (bag) => isObject(bag.costProvenance) && typeof bag.costProvenance.kind === 'string',\n    remedy:\n      \"Records written before agent-eval 0.126 predate this field and carry `costUsd: 0` as the documented uncaptured sentinel, which is NOT an observed zero. Backfill it as costProvenance: { kind: 'uncaptured', usd: null } WITH costUsd: null — an uncaptured cost whose costUsd is non-null is rejected by validateRunRecord, so provenance alone leaves the record invalid.\",\n  },\n  {\n    field: 'tokenUsage',\n    present: (bag) => isObject(bag.tokenUsage),\n    remedy:\n      \"The line's cost.tokens_in and cost.tokens_out are read from it. Backfill it from the provider's usage report; mint will not write 0 for tokens nobody counted.\",\n  },\n  {\n    field: 'tokenUsage.input',\n    present: (bag) => !isObject(bag.tokenUsage) || typeof bag.tokenUsage.input === 'number',\n    remedy: \"The line's cost.tokens_in is read from it, and a missing count is not a zero count.\",\n  },\n  {\n    field: 'tokenUsage.output',\n    present: (bag) => !isObject(bag.tokenUsage) || typeof bag.tokenUsage.output === 'number',\n    remedy: \"The line's cost.tokens_out is read from it, and a missing count is not a zero count.\",\n  },\n  {\n    field: 'outcome',\n    present: (bag) => isObject(bag.outcome),\n    remedy:\n      \"The line's reward, reward_source and metrics are all read from it. A record with no outcome carries no training label at all, and mint refuses an unlabeled row.\",\n  },\n  {\n    field: 'outcome.raw',\n    // Reported only when `outcome` itself is present: one absent field should\n    // produce one reason per CAUSE, not one per path that dereferences it.\n    present: (bag) => !isObject(bag.outcome) || isObject(bag.outcome.raw),\n    remedy:\n      'It is the metric bag copied verbatim into the line\\'s outcome.metrics. `{ ...undefined }` spreads to `{}` without complaint, so an absent bag would mint as \"this run reported no metrics\" — a different claim from \"this record predates the field\". Backfill it as {} only when that is what you mean.',\n  },\n  {\n    field: 'terminalOutcome',\n    present: (bag) => typeof bag.terminalOutcome === 'string',\n    remedy:\n      \"It became required in agent-eval 0.126. Backfill it from root-run or process evidence, or as 'unknown' when the producer has none — mint will not decide the line's is_completed and is_truncated for you.\",\n  },\n  {\n    field: 'scenarioId',\n    present: (bag) => typeof bag.scenarioId === 'string' && bag.scenarioId.length > 0,\n    remedy:\n      \"It became required in agent-eval 0.126 and becomes the line's task.instance_id, which must be a non-empty string. Backfill it from the scenario the run was dealt (pre-0.126 producers often left it in outcome.raw.scenario_id).\",\n  },\n]\n\n/**\n * Why a record cannot be minted, one entry per missing field, empty when it can.\n *\n * Exported so a caller can partition a whole ledger — \"which of my 2742 records\n * predate 0.126\" — without catching an exception per record, and without\n * re-deriving the field list on their side. A re-derived list is a list that\n * drifts from the door it is supposed to predict.\n *\n * Takes a `RunRecord` because that is what the caller holds and what the\n * compiler agrees they hold. The type is precisely the thing that is wrong, so\n * the checks read the record as the untyped bag it actually is on disk.\n */\nexport function unmintableReasons(record: RunRecord): string[] {\n  const bag = record as unknown as Record<string, unknown>\n  return MINT_FIELD_CHECKS.filter((check) => !check.present(bag)).map(\n    (check) => `${check.field} is missing. ${check.remedy}`,\n  )\n}\n\n/**\n * The mint door THROWS on a record it cannot build a line from. It does NOT\n * normalise an absent `costProvenance` to `{kind:'uncaptured', usd:null}`, and\n * the choice is not stylistic:\n *\n *   - Normalising cannot cover the record, only part of it. `terminalOutcome`\n *     feeds `is_completed` and `is_truncated`, which the rollout schema requires\n *     to be BOOLEAN — there is no null to fall back to, so every possible\n *     default is a claim about how the run ended. A door that quietly fixes the\n *     cost and invents the ending is a door no caller can predict.\n *   - Normalising the cost requires knowing what `costUsd: 0` meant, and mint\n *     cannot know. A genuinely free run and an uncaptured one are the same bytes\n *     in a pre-0.126 record; only the producer can tell them apart. Guessing is\n *     exactly the failure this guard exists to stop — the 0.125 optional chain\n *     `record.costProvenance?.kind === 'uncaptured'` already made that guess,\n *     silently, and every record it touched minted `cost.usd: 0`: an unmeasured\n *     cost published as a measured zero, into a training dataset.\n *   - `requireTaskScore`, directly above, already refuses an unlabeled record\n *     for the same reason: \"nobody graded this\" is not \"graded zero\". \"Nobody\n *     billed this\" is not \"billed zero\".\n *\n * The caller who wants historical records minted backfills them at their store,\n * in one pass, where `costUsd` can be corrected alongside `costProvenance` —\n * which is the only place that decision can be made correctly. The refusal names\n * the run, names every missing field, and spells the value to write.\n */\nfunction requireMintableRecord(record: RunRecord): void {\n  const reasons = unmintableReasons(record)\n  if (reasons.length === 0) return\n  throw new ValidationError(`Cannot mint rollout for run ${record.runId}: ${reasons.join('\\n  ')}`)\n}\n\nconst SPLIT_FROM_TAG: Record<RunRecord['splitTag'], RolloutSplit> = {\n  search: 'search',\n  dev: 'dev',\n  holdout: 'holdout',\n}\n\nfunction mintLine(\n  record: RunRecord,\n  steps: RolloutStep[],\n  messages: ChatMessage[],\n  options: MintRolloutOptions,\n  capturedAt: string,\n  gap?: string,\n): MintedRolloutLine {\n  // Field presence first, and BEFORE `requireTaskScore`: that guard reads\n  // `record.outcome.searchScore` on its way to the answer, so an absent\n  // `outcome` would throw a bare TypeError from inside the guard whose whole\n  // job is to produce a clean refusal.\n  //\n  // Both branches of `mintRolloutRows` — the traced line and the gap line —\n  // land here, which is the point: `mintLine` is the only constructor of a\n  // `MintedRolloutLine` from a RunRecord, so there is no path into the waist\n  // that skips the check and no way to get this wrong from the outside.\n  requireMintableRecord(record)\n  // A missing task score is refused before anything is built: an\n  // execution-only record has no training label, and a missing label is\n  // neither a zero reward nor a mintable row.\n  requireTaskScore(record)\n  // `reward` and `realness_gated` come out of one call, so neither door into\n  // the waist can write one and forget the other.\n  const rewardFields = rolloutRewardFields(record)\n  const uncaptured = record.costProvenance.kind === 'uncaptured'\n  const terminalOutcome = record.terminalOutcome\n  const isCompleted = terminalOutcome === 'succeeded' || terminalOutcome === 'failed'\n  const isTruncated = terminalOutcome === 'cancelled' || terminalOutcome === 'incomplete'\n  const terminalError =\n    terminalOutcome === 'failed' ||\n    terminalOutcome === 'cancelled' ||\n    terminalOutcome === 'incomplete'\n      ? (record.terminalFailureReason ?? `run ended ${terminalOutcome}`)\n      : null\n  // `assertMinted` rather than a cast: mint is the producer the whole gate\n  // rests on, so it proves the line it just built is valid instead of asserting\n  // it by fiat. The brand is unforgeable precisely because nobody casts to it.\n  return assertMinted(\n    {\n      schema: ROLLOUT_SCHEMA,\n      rollout_id: record.runId,\n      parent_rollout_id: null,\n      run_id: record.runId,\n      experiment_id: record.experimentId,\n      candidate_id: record.candidateId,\n      generation: null,\n      candidate_index: null,\n      role: options.role ?? 'agent',\n      task: {\n        suite: options.suite ?? record.experimentId,\n        instance_id: record.scenarioId,\n        split: SPLIT_FROM_TAG[record.splitTag],\n        seed: record.seed,\n        rep: 0,\n      },\n      policy: {\n        harness: null,\n        harness_version: null,\n        model: record.model,\n        provider: null,\n        profile_commit: record.commitSha,\n        prompt_hash: record.promptHash,\n        config_hash: record.configHash,\n        agent_profile_cell_id: record.agentProfile?.cellId ?? null,\n        sampling: null,\n      },\n      messages,\n      tool_defs: [],\n      ...(steps.length > 0 ? { steps } : {}),\n      outcome: {\n        ...rewardFields,\n        reward_source: REWARD_SOURCE[scoreOrigin(record)],\n        verdict: null,\n        // A verbatim bulk copy, deliberately UNFILTERED here. `outcome.raw`\n        // holds the per-layer verifier scores (`layer.*`) that the reward was\n        // derived from, so on a gated run this dict is the reward signal in\n        // component form — but filtering it at this call site is the pattern\n        // that has now leaked twice, because the next producer to write a\n        // reward-bearing field forgets. The gate is applied to the whole\n        // outcome once, in `assertMinted` below (`gateGamedOutcome`), which\n        // moves the block to `provenance.gated_evidence` when the run is gated\n        // and leaves it here untouched when it is not.\n        metrics: { ...record.outcome.raw },\n        is_completed: isCompleted,\n        is_truncated: isTruncated,\n        error: terminalError,\n      },\n      cost: {\n        usd: uncaptured ? null : record.costUsd,\n        tokens_in: record.tokenUsage.input,\n        tokens_out: record.tokenUsage.output,\n        tokens_reasoning: record.tokenUsage.reasoning ?? null,\n        cache_read: record.tokenUsage.cached ?? null,\n        cache_write: record.tokenUsage.cacheWrite ?? null,\n        wall_s: Math.round(record.wallMs / 1000),\n      },\n      artifacts: { patch_path: null, run_dir: null, transcript_ref: null },\n      provenance: {\n        captured_at: capturedAt,\n        capture: 'mint',\n        ...(gap !== undefined ? { gap } : {}),\n      },\n    },\n    `minted rollout line for run ${record.runId}`,\n  )\n}\n\n/**\n * Join RunRecords with their traces into canonical rollout lines. Records\n * without spans are emitted as labeled gap lines and reported in\n * `missingTraces`. Execution-only records without a task score are rejected\n * because a missing training label is not a zero reward.\n */\nexport async function mintRolloutRows(\n  records: RunRecord[],\n  store: TraceStore,\n  options: MintRolloutOptions = {},\n): Promise<MintRolloutResult> {\n  const scrub = options.scrub ?? ((t) => t)\n  const capturedAt = (options.now?.() ?? new Date()).toISOString()\n  const rows: MintedRolloutLine[] = []\n  const missingTraces: string[] = []\n  for (const record of records) {\n    const trajectory = await buildTrajectory(store, record.runId)\n    if (trajectory.steps.length === 0) {\n      missingTraces.push(record.runId)\n      rows.push(\n        mintLine(record, [], [], options, capturedAt, 'no trace spans recorded for this runId'),\n      )\n      continue\n    }\n    let steps = trajectory.steps.map((s) => projectStep(s.span, scrub))\n    if (options.maxSteps !== undefined && steps.length > options.maxSteps) {\n      // Keep the head and tail — the middle of a long run is the least\n      // informative for outcome attribution.\n      const head = Math.ceil(options.maxSteps / 2)\n      const tail = options.maxSteps - head\n      steps = [...steps.slice(0, head), ...steps.slice(steps.length - tail)]\n    }\n    const conversation = finalConversation(\n      trajectory.steps.map((s) => s.span),\n      scrub,\n    )\n    const gap =\n      conversation.length === 0 ? 'trace has no llm spans — no conversation to inline' : undefined\n    rows.push(mintLine(record, steps, conversation, options, capturedAt, gap))\n  }\n  return { rows, missingTraces }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqEA,MAAM,UAAU,GAAY,UAAmC;CAE7D,OAAO,OADG,OAAO,MAAM,WAAW,IAAI,KAAK,UAAU,CAAC,MACpC,EAAE;AACtB;AAEA,SAAS,YAAY,MAAY,OAAqC;CACpE,MAAM,OAAoB;EACxB,MAAM,KAAK;EACX,MAAM,MAAM,KAAK,IAAI;EACrB,QAAQ,KAAK;EACb,YAAY,KAAK,YAAY,KAAA,IAAY,KAAK,UAAU,KAAK,YAAY,KAAA;CAC3E;CACA,IAAI,KAAK,SAAS,OAAO;EACvB,MAAM,MAAM;EACZ,MAAM,OAAO,IAAI,SAAS,IAAI,SAAS,SAAS;EAChD,IAAI,MAAM,KAAK,QAAQ,MAAM,KAAK,OAAO;EACzC,IAAI,IAAI,WAAW,KAAA,GAAW,KAAK,SAAS,MAAM,IAAI,MAAM;CAC9D,OAAO,IAAI,KAAK,SAAS,QAAQ;EAC/B,MAAM,OAAO;EACb,KAAK,QAAQ,OAAO,KAAK,MAAM,KAAK;EACpC,IAAI,KAAK,WAAW,KAAA,GAAW,KAAK,SAAS,OAAO,KAAK,QAAQ,KAAK;CACxE;CACA,OAAO;AACT;;AAGA,SAAS,kBAAkB,OAAe,OAAuC;CAC/E,MAAM,OAAO,MAAM,QAAQ,MAAoB,EAAE,SAAS,KAAK;CAC/D,MAAM,OAAO,KAAK,KAAK,SAAS;CAChC,IAAI,CAAC,MAAM,OAAO,CAAC;CACnB,MAAM,WAA0B,KAAK,SAAS,KAAK,OAAgB;EACjE,MAAM,EAAE;EACR,SAAS,MAAM,EAAE,OAAO;CAC1B,EAAE;CACF,IAAI,KAAK,WAAW,KAAA,KAAa,KAAK,WAAW,IAC/C,SAAS,KAAK;EAAE,MAAM;EAAa,SAAS,MAAM,KAAK,MAAM;CAAE,CAAC;CAElE,OAAO;AACT;AAgBA,MAAM,gBAAgE;CACpE,SAAS;CACT,QAAQ;CACR,UAAU;AACZ;;;;;;;;;AAUA,SAAS,iBAAiB,QAAyB;CACjD,IAAI,aAAa,MAAM,MAAM,KAAA,GAC3B,MAAM,IAAI,gBAAgB,+BAA+B,OAAO,MAAM,wBAAwB;AAElG;AAEA,MAAM,YAAY,UAChB,OAAO,UAAU,YAAY,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCzC,MAAM,oBAA+C;CACnD;EACE,OAAO;EACP,UAAU,QAAQ,SAAS,IAAI,cAAc,KAAK,OAAO,IAAI,eAAe,SAAS;EACrF,QACE;CACJ;CACA;EACE,OAAO;EACP,UAAU,QAAQ,SAAS,IAAI,UAAU;EACzC,QACE;CACJ;CACA;EACE,OAAO;EACP,UAAU,QAAQ,CAAC,SAAS,IAAI,UAAU,KAAK,OAAO,IAAI,WAAW,UAAU;EAC/E,QAAQ;CACV;CACA;EACE,OAAO;EACP,UAAU,QAAQ,CAAC,SAAS,IAAI,UAAU,KAAK,OAAO,IAAI,WAAW,WAAW;EAChF,QAAQ;CACV;CACA;EACE,OAAO;EACP,UAAU,QAAQ,SAAS,IAAI,OAAO;EACtC,QACE;CACJ;CACA;EACE,OAAO;EAGP,UAAU,QAAQ,CAAC,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,QAAQ,GAAG;EACpE,QACE;CACJ;CACA;EACE,OAAO;EACP,UAAU,QAAQ,OAAO,IAAI,oBAAoB;EACjD,QACE;CACJ;CACA;EACE,OAAO;EACP,UAAU,QAAQ,OAAO,IAAI,eAAe,YAAY,IAAI,WAAW,SAAS;EAChF,QACE;CACJ;AACF;;;;;;;;;;;;;AAcA,SAAgB,kBAAkB,QAA6B;CAC7D,MAAM,MAAM;CACZ,OAAO,kBAAkB,QAAQ,UAAU,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,KAC7D,UAAU,GAAG,MAAM,MAAM,eAAe,MAAM,QACjD;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,SAAS,sBAAsB,QAAyB;CACtD,MAAM,UAAU,kBAAkB,MAAM;CACxC,IAAI,QAAQ,WAAW,GAAG;CAC1B,MAAM,IAAI,gBAAgB,+BAA+B,OAAO,MAAM,IAAI,QAAQ,KAAK,MAAM,GAAG;AAClG;AAEA,MAAM,iBAA8D;CAClE,QAAQ;CACR,KAAK;CACL,SAAS;AACX;AAEA,SAAS,SACP,QACA,OACA,UACA,SACA,YACA,KACmB;CAUnB,sBAAsB,MAAM;CAI5B,iBAAiB,MAAM;CAGvB,MAAM,eAAe,oBAAoB,MAAM;CAC/C,MAAM,aAAa,OAAO,eAAe,SAAS;CAClD,MAAM,kBAAkB,OAAO;CAC/B,MAAM,cAAc,oBAAoB,eAAe,oBAAoB;CAC3E,MAAM,cAAc,oBAAoB,eAAe,oBAAoB;CAC3E,MAAM,gBACJ,oBAAoB,YACpB,oBAAoB,eACpB,oBAAoB,eACf,OAAO,yBAAyB,aAAa,oBAC9C;CAIN,OAAO,aACL;EACE,QAAQ;EACR,YAAY,OAAO;EACnB,mBAAmB;EACnB,QAAQ,OAAO;EACf,eAAe,OAAO;EACtB,cAAc,OAAO;EACrB,YAAY;EACZ,iBAAiB;EACjB,MAAM,QAAQ,QAAQ;EACtB,MAAM;GACJ,OAAO,QAAQ,SAAS,OAAO;GAC/B,aAAa,OAAO;GACpB,OAAO,eAAe,OAAO;GAC7B,MAAM,OAAO;GACb,KAAK;EACP;EACA,QAAQ;GACN,SAAS;GACT,iBAAiB;GACjB,OAAO,OAAO;GACd,UAAU;GACV,gBAAgB,OAAO;GACvB,aAAa,OAAO;GACpB,aAAa,OAAO;GACpB,uBAAuB,OAAO,cAAc,UAAU;GACtD,UAAU;EACZ;EACA;EACA,WAAW,CAAC;EACZ,GAAI,MAAM,SAAS,IAAI,EAAE,MAAM,IAAI,CAAC;EACpC,SAAS;GACP,GAAG;GACH,eAAe,cAAc,YAAY,MAAM;GAC/C,SAAS;GAUT,SAAS,EAAE,GAAG,OAAO,QAAQ,IAAI;GACjC,cAAc;GACd,cAAc;GACd,OAAO;EACT;EACA,MAAM;GACJ,KAAK,aAAa,OAAO,OAAO;GAChC,WAAW,OAAO,WAAW;GAC7B,YAAY,OAAO,WAAW;GAC9B,kBAAkB,OAAO,WAAW,aAAa;GACjD,YAAY,OAAO,WAAW,UAAU;GACxC,aAAa,OAAO,WAAW,cAAc;GAC7C,QAAQ,KAAK,MAAM,OAAO,SAAS,GAAI;EACzC;EACA,WAAW;GAAE,YAAY;GAAM,SAAS;GAAM,gBAAgB;EAAK;EACnE,YAAY;GACV,aAAa;GACb,SAAS;GACT,GAAI,QAAQ,KAAA,IAAY,EAAE,IAAI,IAAI,CAAC;EACrC;CACF,GACA,+BAA+B,OAAO,OACxC;AACF;;;;;;;AAQA,eAAsB,gBACpB,SACA,OACA,UAA8B,CAAC,GACH;CAC5B,MAAM,QAAQ,QAAQ,WAAW,MAAM;CACvC,MAAM,cAAc,QAAQ,MAAM,qBAAK,IAAI,KAAK,EAAA,CAAG,YAAY;CAC/D,MAAM,OAA4B,CAAC;CACnC,MAAM,gBAA0B,CAAC;CACjC,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,aAAa,MAAM,gBAAgB,OAAO,OAAO,KAAK;EAC5D,IAAI,WAAW,MAAM,WAAW,GAAG;GACjC,cAAc,KAAK,OAAO,KAAK;GAC/B,KAAK,KACH,SAAS,QAAQ,CAAC,GAAG,CAAC,GAAG,SAAS,YAAY,wCAAwC,CACxF;GACA;EACF;EACA,IAAI,QAAQ,WAAW,MAAM,KAAK,MAAM,YAAY,EAAE,MAAM,KAAK,CAAC;EAClE,IAAI,QAAQ,aAAa,KAAA,KAAa,MAAM,SAAS,QAAQ,UAAU;GAGrE,MAAM,OAAO,KAAK,KAAK,QAAQ,WAAW,CAAC;GAC3C,MAAM,OAAO,QAAQ,WAAW;GAChC,QAAQ,CAAC,GAAG,MAAM,MAAM,GAAG,IAAI,GAAG,GAAG,MAAM,MAAM,MAAM,SAAS,IAAI,CAAC;EACvE;EACA,MAAM,eAAe,kBACnB,WAAW,MAAM,KAAK,MAAM,EAAE,IAAI,GAClC,KACF;EACA,MAAM,MACJ,aAAa,WAAW,IAAI,uDAAuD,KAAA;EACrF,KAAK,KAAK,SAAS,QAAQ,OAAO,cAAc,SAAS,YAAY,GAAG,CAAC;CAC3E;CACA,OAAO;EAAE;EAAM;CAAc;AAC/B"}
+{"version":3,"file":"mint-CGEkzPLf.js","names":[],"sources":["../src/rollout/mint.ts"],"sourcesContent":["/**\n * Rollout minting — `tangle.rollout.v1` lines joined from the records the\n * substrate ALREADY keeps. There is no separate rollout store: a rollout\n * is the JOIN of a RunRecord (identity, provenance, cost, outcome) with\n * its trace (spans share `runId`), projected into the canonical line.\n *\n * Composition, not duplication:\n *   - identity/provenance     → `RunRecord` (candidateId, splitTag, agentProfile, hashes)\n *   - step structure          → `buildTrajectory` over the shared TraceStore\n *   - preference-pair export  → `feedbackTrajectoryToOptimizerRow` (feedback-trajectory.ts)\n *   - PRM / reward-model      → `reward-model-export.ts`\n *\n * Anti-Goodhart invariant: a run whose `outcome.realness.gated` is true is\n * never exported with a positive reward OR with any of the numbers that reward\n * was computed from. The gate travels into the training data (`reward` forced\n * to 0, `realness_gated: true`) and the whole outcome is transformed by\n * `gateGamedOutcome` inside `assertMinted` below, which relocates `metrics` and\n * `verdict` to `provenance.gated_evidence`. Mint returns\n * `MintedRolloutLine[]`: the brand the training exporters require, which only\n * this function, `readRolloutLedger`, and an explicit `assertMinted` can mint.\n *\n * A record carrying NEITHER split score is REJECTED (`ValidationError`), never\n * minted at 0 — \"nobody graded this\" is not the same claim as \"graded a total\n * failure\", and a trainer reading 0 learns the second. Lines that already\n * carry `reward: null` (interchange imports, existing ledgers) remain valid on\n * the wire; only the RunRecord→line door refuses.\n *\n * Records without spans become labeled GAP LINES (messages: [],\n * provenance.gap) — present in the output AND surfaced in\n * `missingTraces`; a capture gap is a finding, never a silent omission.\n */\n\nimport { ValidationError } from '../errors'\nimport { type RunRecord, runTaskScore } from '../run-record'\nimport type { LlmSpan, Message, Span, ToolSpan } from '../trace/schema'\nimport type { TraceStore } from '../trace/store'\nimport { buildTrajectory } from '../trajectory'\nimport { rolloutRewardFields, scoreOrigin } from './reward'\nimport {\n  assertMinted,\n  type ChatMessage,\n  type MintedRolloutLine,\n  ROLLOUT_SCHEMA,\n  type RolloutRole,\n  type RolloutSplit,\n  type RolloutStep,\n} from './schema'\n\n/** Redactor applied to every exported string (secrets, PII). Identity by default. */\nexport type RolloutScrubber = (text: string) => string\n\nexport interface MintRolloutOptions {\n  scrub?: RolloutScrubber\n  /** Cap steps per line (longest runs first drop middle steps). Default: no cap. */\n  maxSteps?: number\n  /** Role recorded on every minted line. Default 'agent' (a solo eval run). */\n  role?: RolloutRole\n  /** Task suite label. Default: the record's `experimentId`. */\n  suite?: string\n  /** Injected clock for deterministic output. */\n  now?: () => Date\n}\n\nexport interface MintRolloutResult {\n  rows: MintedRolloutLine[]\n  /** runIds that had a RunRecord but no spans — emitted as gap lines AND listed here. */\n  missingTraces: string[]\n}\n\nconst asText = (v: unknown, scrub: RolloutScrubber): string => {\n  const s = typeof v === 'string' ? v : JSON.stringify(v)\n  return scrub(s ?? '')\n}\n\nfunction projectStep(span: Span, scrub: RolloutScrubber): RolloutStep {\n  const base: RolloutStep = {\n    kind: span.kind,\n    name: scrub(span.name),\n    status: span.status,\n    durationMs: span.endedAt !== undefined ? span.endedAt - span.startedAt : undefined,\n  }\n  if (span.kind === 'llm') {\n    const llm = span as LlmSpan\n    const last = llm.messages[llm.messages.length - 1]\n    if (last) base.input = scrub(last.content)\n    if (llm.output !== undefined) base.output = scrub(llm.output)\n  } else if (span.kind === 'tool') {\n    const tool = span as ToolSpan\n    base.input = asText(tool.args, scrub)\n    if (tool.result !== undefined) base.output = asText(tool.result, scrub)\n  }\n  return base\n}\n\n/** The final llm span's history + output is the completed conversation. */\nfunction finalConversation(spans: Span[], scrub: RolloutScrubber): ChatMessage[] {\n  const llms = spans.filter((s): s is LlmSpan => s.kind === 'llm')\n  const last = llms[llms.length - 1]\n  if (!last) return []\n  const messages: ChatMessage[] = last.messages.map((m: Message) => ({\n    role: m.role,\n    content: scrub(m.content),\n  }))\n  if (last.output !== undefined && last.output !== '') {\n    messages.push({ role: 'assistant', content: scrub(last.output) })\n  }\n  return messages\n}\n\n// The reward derivations live in the leaf module `./reward` so gate and\n// reporting code can import them without dragging in the trace store; they are\n// re-exported here because the derivations shipped from this path.\nexport {\n  isRealnessGated,\n  observedScore,\n  observedSplitScore,\n  type ScoreOrigin,\n  type ScorePreference,\n  scoreOrigin,\n  trainingReward,\n  trainingScore,\n} from './reward'\n\nconst REWARD_SOURCE: Record<ReturnType<typeof scoreOrigin>, string> = {\n  holdout: 'run-record/holdout-score',\n  search: 'run-record/search-score',\n  unscored: 'run-record/unscored',\n}\n\n/**\n * The mint door refuses an execution-only record: a missing training label is\n * not a zero reward, and not a mintable line either. Lines that already carry\n * `reward: null` — interchange imports, existing ledgers — stay valid on the\n * wire and keep their labeled gap; this guard is only about the\n * RunRecord→line door, where the producer can still be told to go score the\n * run instead of shipping an unlabeled row.\n */\nfunction requireTaskScore(record: RunRecord): void {\n  if (runTaskScore(record) === undefined) {\n    throw new ValidationError(`Cannot mint rollout for run ${record.runId}: task score is missing`)\n  }\n}\n\nconst isObject = (value: unknown): value is Record<string, unknown> =>\n  typeof value === 'object' && value !== null\n\ninterface MintFieldCheck {\n  /** The RunRecord path, spelled the way the caller has to fix it. */\n  readonly field: string\n  /** True when the record carries something the line can honestly be built from. */\n  readonly present: (bag: Record<string, unknown>) => boolean\n  /** What the caller writes onto the record, and why that value and not another. */\n  readonly remedy: string\n}\n\n/**\n * The RunRecord fields mint reads that a record can be missing even though the\n * TYPE says it cannot. There are exactly two ways that happens:\n *\n *   1. The field was OPTIONAL when the record was serialized. `costProvenance`,\n *      `terminalOutcome` and `scenarioId` were optional through agent-eval\n *      0.125 and became required in 0.126, with no on-disk migration — so every\n *      ledger written before 0.126 is full of records the type calls complete.\n *   2. Mint reads a level DEEPER than the record's own type is checked at:\n *      `outcome.raw`, `tokenUsage.input`, `tokenUsage.output`.\n *\n * Nothing else needs a check here. Every other field mint copies is a top-level\n * scalar landing in a typed slot on the line, where an absent value arrives as\n * `undefined` and `assertMinted` refuses it by name. These are the ones where an\n * absent value instead kills the join with `TypeError: Cannot read properties of\n * undefined`, or — worse — mints a line that reads as measured.\n *\n * This is deliberately NOT `validateRunRecord`. That validator answers \"is this\n * a valid RunRecord\", which is a wider question than \"can a rollout line be\n * built from this one\": it also enforces model-snapshot discipline, the\n * `terminalFailureReason` coupling, and the `costUsd === costProvenance.usd`\n * agreement. Routing the mint door through it would refuse records mint can\n * mint honestly today (a model alias with no snapshot date, for one), which is\n * a policy change with its own blast radius and not this bug. The door asks the\n * narrower question and answers it precisely.\n */\nconst MINT_FIELD_CHECKS: readonly MintFieldCheck[] = [\n  {\n    field: 'costProvenance',\n    present: (bag) => isObject(bag.costProvenance) && typeof bag.costProvenance.kind === 'string',\n    remedy:\n      \"Records written before agent-eval 0.126 predate this field and carry `costUsd: 0` as the documented uncaptured sentinel, which is NOT an observed zero. Backfill it as costProvenance: { kind: 'uncaptured', usd: null } WITH costUsd: null — an uncaptured cost whose costUsd is non-null is rejected by validateRunRecord, so provenance alone leaves the record invalid.\",\n  },\n  {\n    field: 'tokenUsage',\n    present: (bag) => isObject(bag.tokenUsage),\n    remedy:\n      \"The line's cost.tokens_in and cost.tokens_out are read from it. Backfill it from the provider's usage report; mint will not write 0 for tokens nobody counted.\",\n  },\n  {\n    field: 'tokenUsage.input',\n    present: (bag) => !isObject(bag.tokenUsage) || typeof bag.tokenUsage.input === 'number',\n    remedy: \"The line's cost.tokens_in is read from it, and a missing count is not a zero count.\",\n  },\n  {\n    field: 'tokenUsage.output',\n    present: (bag) => !isObject(bag.tokenUsage) || typeof bag.tokenUsage.output === 'number',\n    remedy: \"The line's cost.tokens_out is read from it, and a missing count is not a zero count.\",\n  },\n  {\n    field: 'outcome',\n    present: (bag) => isObject(bag.outcome),\n    remedy:\n      \"The line's reward, reward_source and metrics are all read from it. A record with no outcome carries no training label at all, and mint refuses an unlabeled row.\",\n  },\n  {\n    field: 'outcome.raw',\n    // Reported only when `outcome` itself is present: one absent field should\n    // produce one reason per CAUSE, not one per path that dereferences it.\n    present: (bag) => !isObject(bag.outcome) || isObject(bag.outcome.raw),\n    remedy:\n      'It is the metric bag copied verbatim into the line\\'s outcome.metrics. `{ ...undefined }` spreads to `{}` without complaint, so an absent bag would mint as \"this run reported no metrics\" — a different claim from \"this record predates the field\". Backfill it as {} only when that is what you mean.',\n  },\n  {\n    field: 'terminalOutcome',\n    present: (bag) => typeof bag.terminalOutcome === 'string',\n    remedy:\n      \"It became required in agent-eval 0.126. Backfill it from root-run or process evidence, or as 'unknown' when the producer has none — mint will not decide the line's is_completed and is_truncated for you.\",\n  },\n  {\n    field: 'scenarioId',\n    present: (bag) => typeof bag.scenarioId === 'string' && bag.scenarioId.length > 0,\n    remedy:\n      \"It became required in agent-eval 0.126 and becomes the line's task.instance_id, which must be a non-empty string. Backfill it from the scenario the run was dealt (pre-0.126 producers often left it in outcome.raw.scenario_id).\",\n  },\n]\n\n/**\n * Why a record cannot be minted, one entry per missing field, empty when it can.\n *\n * Exported so a caller can partition a whole ledger — \"which of my 2742 records\n * predate 0.126\" — without catching an exception per record, and without\n * re-deriving the field list on their side. A re-derived list is a list that\n * drifts from the door it is supposed to predict.\n *\n * Takes a `RunRecord` because that is what the caller holds and what the\n * compiler agrees they hold. The type is precisely the thing that is wrong, so\n * the checks read the record as the untyped bag it actually is on disk.\n */\nexport function unmintableReasons(record: RunRecord): string[] {\n  const bag = record as unknown as Record<string, unknown>\n  return MINT_FIELD_CHECKS.filter((check) => !check.present(bag)).map(\n    (check) => `${check.field} is missing. ${check.remedy}`,\n  )\n}\n\n/**\n * The mint door THROWS on a record it cannot build a line from. It does NOT\n * normalise an absent `costProvenance` to `{kind:'uncaptured', usd:null}`, and\n * the choice is not stylistic:\n *\n *   - Normalising cannot cover the record, only part of it. `terminalOutcome`\n *     feeds `is_completed` and `is_truncated`, which the rollout schema requires\n *     to be BOOLEAN — there is no null to fall back to, so every possible\n *     default is a claim about how the run ended. A door that quietly fixes the\n *     cost and invents the ending is a door no caller can predict.\n *   - Normalising the cost requires knowing what `costUsd: 0` meant, and mint\n *     cannot know. A genuinely free run and an uncaptured one are the same bytes\n *     in a pre-0.126 record; only the producer can tell them apart. Guessing is\n *     exactly the failure this guard exists to stop — the 0.125 optional chain\n *     `record.costProvenance?.kind === 'uncaptured'` already made that guess,\n *     silently, and every record it touched minted `cost.usd: 0`: an unmeasured\n *     cost published as a measured zero, into a training dataset.\n *   - `requireTaskScore`, directly above, already refuses an unlabeled record\n *     for the same reason: \"nobody graded this\" is not \"graded zero\". \"Nobody\n *     billed this\" is not \"billed zero\".\n *\n * The caller who wants historical records minted backfills them at their store,\n * in one pass, where `costUsd` can be corrected alongside `costProvenance` —\n * which is the only place that decision can be made correctly. The refusal names\n * the run, names every missing field, and spells the value to write.\n */\nfunction requireMintableRecord(record: RunRecord): void {\n  const reasons = unmintableReasons(record)\n  if (reasons.length === 0) return\n  throw new ValidationError(`Cannot mint rollout for run ${record.runId}: ${reasons.join('\\n  ')}`)\n}\n\nconst SPLIT_FROM_TAG: Record<RunRecord['splitTag'], RolloutSplit> = {\n  search: 'search',\n  dev: 'dev',\n  holdout: 'holdout',\n}\n\nfunction mintLine(\n  record: RunRecord,\n  steps: RolloutStep[],\n  messages: ChatMessage[],\n  options: MintRolloutOptions,\n  capturedAt: string,\n  gap?: string,\n): MintedRolloutLine {\n  // Field presence first, and BEFORE `requireTaskScore`: that guard reads\n  // `record.outcome.searchScore` on its way to the answer, so an absent\n  // `outcome` would throw a bare TypeError from inside the guard whose whole\n  // job is to produce a clean refusal.\n  //\n  // Both branches of `mintRolloutRows` — the traced line and the gap line —\n  // land here, which is the point: `mintLine` is the only constructor of a\n  // `MintedRolloutLine` from a RunRecord, so there is no path into the waist\n  // that skips the check and no way to get this wrong from the outside.\n  requireMintableRecord(record)\n  // A missing task score is refused before anything is built: an\n  // execution-only record has no training label, and a missing label is\n  // neither a zero reward nor a mintable row.\n  requireTaskScore(record)\n  // `reward` and `realness_gated` come out of one call, so neither door into\n  // the waist can write one and forget the other.\n  const rewardFields = rolloutRewardFields(record)\n  const uncaptured = record.costProvenance.kind === 'uncaptured'\n  const terminalOutcome = record.terminalOutcome\n  const isCompleted = terminalOutcome === 'succeeded' || terminalOutcome === 'failed'\n  const isTruncated = terminalOutcome === 'cancelled' || terminalOutcome === 'incomplete'\n  const terminalError =\n    terminalOutcome === 'failed' ||\n    terminalOutcome === 'cancelled' ||\n    terminalOutcome === 'incomplete'\n      ? (record.terminalFailureReason ?? `run ended ${terminalOutcome}`)\n      : null\n  // `assertMinted` rather than a cast: mint is the producer the whole gate\n  // rests on, so it proves the line it just built is valid instead of asserting\n  // it by fiat. The brand is unforgeable precisely because nobody casts to it.\n  return assertMinted(\n    {\n      schema: ROLLOUT_SCHEMA,\n      rollout_id: record.runId,\n      parent_rollout_id: null,\n      run_id: record.runId,\n      experiment_id: record.experimentId,\n      candidate_id: record.candidateId,\n      generation: null,\n      candidate_index: null,\n      role: options.role ?? 'agent',\n      task: {\n        suite: options.suite ?? record.experimentId,\n        instance_id: record.scenarioId,\n        split: SPLIT_FROM_TAG[record.splitTag],\n        seed: record.seed,\n        rep: 0,\n      },\n      policy: {\n        harness: null,\n        harness_version: null,\n        model: record.model,\n        provider: null,\n        profile_commit: record.commitSha,\n        prompt_hash: record.promptHash,\n        config_hash: record.configHash,\n        agent_profile_cell_id: record.agentProfile?.cellId ?? null,\n        sampling: null,\n      },\n      messages,\n      tool_defs: [],\n      ...(steps.length > 0 ? { steps } : {}),\n      outcome: {\n        ...rewardFields,\n        reward_source: REWARD_SOURCE[scoreOrigin(record)],\n        verdict: null,\n        // A verbatim bulk copy, deliberately UNFILTERED here. `outcome.raw`\n        // holds the per-layer verifier scores (`layer.*`) that the reward was\n        // derived from, so on a gated run this dict is the reward signal in\n        // component form — but filtering it at this call site is the pattern\n        // that has now leaked twice, because the next producer to write a\n        // reward-bearing field forgets. The gate is applied to the whole\n        // outcome once, in `assertMinted` below (`gateGamedOutcome`), which\n        // moves the block to `provenance.gated_evidence` when the run is gated\n        // and leaves it here untouched when it is not.\n        metrics: { ...record.outcome.raw },\n        is_completed: isCompleted,\n        is_truncated: isTruncated,\n        error: terminalError,\n      },\n      cost: {\n        usd: uncaptured ? null : record.costUsd,\n        tokens_in: record.tokenUsage.input,\n        tokens_out: record.tokenUsage.output,\n        tokens_reasoning: record.tokenUsage.reasoning ?? null,\n        cache_read: record.tokenUsage.cached ?? null,\n        cache_write: record.tokenUsage.cacheWrite ?? null,\n        wall_s: Math.round(record.wallMs / 1000),\n      },\n      artifacts: { patch_path: null, run_dir: null, transcript_ref: null },\n      provenance: {\n        captured_at: capturedAt,\n        capture: 'mint',\n        ...(gap !== undefined ? { gap } : {}),\n      },\n    },\n    `minted rollout line for run ${record.runId}`,\n  )\n}\n\n/**\n * Join RunRecords with their traces into canonical rollout lines. Records\n * without spans are emitted as labeled gap lines and reported in\n * `missingTraces`. Execution-only records without a task score are rejected\n * because a missing training label is not a zero reward.\n */\nexport async function mintRolloutRows(\n  records: RunRecord[],\n  store: TraceStore,\n  options: MintRolloutOptions = {},\n): Promise<MintRolloutResult> {\n  const scrub = options.scrub ?? ((t) => t)\n  const capturedAt = (options.now?.() ?? new Date()).toISOString()\n  const rows: MintedRolloutLine[] = []\n  const missingTraces: string[] = []\n  for (const record of records) {\n    const trajectory = await buildTrajectory(store, record.runId)\n    if (trajectory.steps.length === 0) {\n      missingTraces.push(record.runId)\n      rows.push(\n        mintLine(record, [], [], options, capturedAt, 'no trace spans recorded for this runId'),\n      )\n      continue\n    }\n    let steps = trajectory.steps.map((s) => projectStep(s.span, scrub))\n    if (options.maxSteps !== undefined && steps.length > options.maxSteps) {\n      // Keep the head and tail — the middle of a long run is the least\n      // informative for outcome attribution.\n      const head = Math.ceil(options.maxSteps / 2)\n      const tail = options.maxSteps - head\n      steps = [...steps.slice(0, head), ...steps.slice(steps.length - tail)]\n    }\n    const conversation = finalConversation(\n      trajectory.steps.map((s) => s.span),\n      scrub,\n    )\n    const gap =\n      conversation.length === 0 ? 'trace has no llm spans — no conversation to inline' : undefined\n    rows.push(mintLine(record, steps, conversation, options, capturedAt, gap))\n  }\n  return { rows, missingTraces }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqEA,MAAM,UAAU,GAAY,UAAmC;CAE7D,OAAO,OADG,OAAO,MAAM,WAAW,IAAI,KAAK,UAAU,CAAC,MACpC,EAAE;AACtB;AAEA,SAAS,YAAY,MAAY,OAAqC;CACpE,MAAM,OAAoB;EACxB,MAAM,KAAK;EACX,MAAM,MAAM,KAAK,IAAI;EACrB,QAAQ,KAAK;EACb,YAAY,KAAK,YAAY,KAAA,IAAY,KAAK,UAAU,KAAK,YAAY,KAAA;CAC3E;CACA,IAAI,KAAK,SAAS,OAAO;EACvB,MAAM,MAAM;EACZ,MAAM,OAAO,IAAI,SAAS,IAAI,SAAS,SAAS;EAChD,IAAI,MAAM,KAAK,QAAQ,MAAM,KAAK,OAAO;EACzC,IAAI,IAAI,WAAW,KAAA,GAAW,KAAK,SAAS,MAAM,IAAI,MAAM;CAC9D,OAAO,IAAI,KAAK,SAAS,QAAQ;EAC/B,MAAM,OAAO;EACb,KAAK,QAAQ,OAAO,KAAK,MAAM,KAAK;EACpC,IAAI,KAAK,WAAW,KAAA,GAAW,KAAK,SAAS,OAAO,KAAK,QAAQ,KAAK;CACxE;CACA,OAAO;AACT;;AAGA,SAAS,kBAAkB,OAAe,OAAuC;CAC/E,MAAM,OAAO,MAAM,QAAQ,MAAoB,EAAE,SAAS,KAAK;CAC/D,MAAM,OAAO,KAAK,KAAK,SAAS;CAChC,IAAI,CAAC,MAAM,OAAO,CAAC;CACnB,MAAM,WAA0B,KAAK,SAAS,KAAK,OAAgB;EACjE,MAAM,EAAE;EACR,SAAS,MAAM,EAAE,OAAO;CAC1B,EAAE;CACF,IAAI,KAAK,WAAW,KAAA,KAAa,KAAK,WAAW,IAC/C,SAAS,KAAK;EAAE,MAAM;EAAa,SAAS,MAAM,KAAK,MAAM;CAAE,CAAC;CAElE,OAAO;AACT;AAgBA,MAAM,gBAAgE;CACpE,SAAS;CACT,QAAQ;CACR,UAAU;AACZ;;;;;;;;;AAUA,SAAS,iBAAiB,QAAyB;CACjD,IAAI,aAAa,MAAM,MAAM,KAAA,GAC3B,MAAM,IAAI,gBAAgB,+BAA+B,OAAO,MAAM,wBAAwB;AAElG;AAEA,MAAM,YAAY,UAChB,OAAO,UAAU,YAAY,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCzC,MAAM,oBAA+C;CACnD;EACE,OAAO;EACP,UAAU,QAAQ,SAAS,IAAI,cAAc,KAAK,OAAO,IAAI,eAAe,SAAS;EACrF,QACE;CACJ;CACA;EACE,OAAO;EACP,UAAU,QAAQ,SAAS,IAAI,UAAU;EACzC,QACE;CACJ;CACA;EACE,OAAO;EACP,UAAU,QAAQ,CAAC,SAAS,IAAI,UAAU,KAAK,OAAO,IAAI,WAAW,UAAU;EAC/E,QAAQ;CACV;CACA;EACE,OAAO;EACP,UAAU,QAAQ,CAAC,SAAS,IAAI,UAAU,KAAK,OAAO,IAAI,WAAW,WAAW;EAChF,QAAQ;CACV;CACA;EACE,OAAO;EACP,UAAU,QAAQ,SAAS,IAAI,OAAO;EACtC,QACE;CACJ;CACA;EACE,OAAO;EAGP,UAAU,QAAQ,CAAC,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,QAAQ,GAAG;EACpE,QACE;CACJ;CACA;EACE,OAAO;EACP,UAAU,QAAQ,OAAO,IAAI,oBAAoB;EACjD,QACE;CACJ;CACA;EACE,OAAO;EACP,UAAU,QAAQ,OAAO,IAAI,eAAe,YAAY,IAAI,WAAW,SAAS;EAChF,QACE;CACJ;AACF;;;;;;;;;;;;;AAcA,SAAgB,kBAAkB,QAA6B;CAC7D,MAAM,MAAM;CACZ,OAAO,kBAAkB,QAAQ,UAAU,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,KAC7D,UAAU,GAAG,MAAM,MAAM,eAAe,MAAM,QACjD;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,SAAS,sBAAsB,QAAyB;CACtD,MAAM,UAAU,kBAAkB,MAAM;CACxC,IAAI,QAAQ,WAAW,GAAG;CAC1B,MAAM,IAAI,gBAAgB,+BAA+B,OAAO,MAAM,IAAI,QAAQ,KAAK,MAAM,GAAG;AAClG;AAEA,MAAM,iBAA8D;CAClE,QAAQ;CACR,KAAK;CACL,SAAS;AACX;AAEA,SAAS,SACP,QACA,OACA,UACA,SACA,YACA,KACmB;CAUnB,sBAAsB,MAAM;CAI5B,iBAAiB,MAAM;CAGvB,MAAM,eAAe,oBAAoB,MAAM;CAC/C,MAAM,aAAa,OAAO,eAAe,SAAS;CAClD,MAAM,kBAAkB,OAAO;CAC/B,MAAM,cAAc,oBAAoB,eAAe,oBAAoB;CAC3E,MAAM,cAAc,oBAAoB,eAAe,oBAAoB;CAC3E,MAAM,gBACJ,oBAAoB,YACpB,oBAAoB,eACpB,oBAAoB,eACf,OAAO,yBAAyB,aAAa,oBAC9C;CAIN,OAAO,aACL;EACE,QAAQ;EACR,YAAY,OAAO;EACnB,mBAAmB;EACnB,QAAQ,OAAO;EACf,eAAe,OAAO;EACtB,cAAc,OAAO;EACrB,YAAY;EACZ,iBAAiB;EACjB,MAAM,QAAQ,QAAQ;EACtB,MAAM;GACJ,OAAO,QAAQ,SAAS,OAAO;GAC/B,aAAa,OAAO;GACpB,OAAO,eAAe,OAAO;GAC7B,MAAM,OAAO;GACb,KAAK;EACP;EACA,QAAQ;GACN,SAAS;GACT,iBAAiB;GACjB,OAAO,OAAO;GACd,UAAU;GACV,gBAAgB,OAAO;GACvB,aAAa,OAAO;GACpB,aAAa,OAAO;GACpB,uBAAuB,OAAO,cAAc,UAAU;GACtD,UAAU;EACZ;EACA;EACA,WAAW,CAAC;EACZ,GAAI,MAAM,SAAS,IAAI,EAAE,MAAM,IAAI,CAAC;EACpC,SAAS;GACP,GAAG;GACH,eAAe,cAAc,YAAY,MAAM;GAC/C,SAAS;GAUT,SAAS,EAAE,GAAG,OAAO,QAAQ,IAAI;GACjC,cAAc;GACd,cAAc;GACd,OAAO;EACT;EACA,MAAM;GACJ,KAAK,aAAa,OAAO,OAAO;GAChC,WAAW,OAAO,WAAW;GAC7B,YAAY,OAAO,WAAW;GAC9B,kBAAkB,OAAO,WAAW,aAAa;GACjD,YAAY,OAAO,WAAW,UAAU;GACxC,aAAa,OAAO,WAAW,cAAc;GAC7C,QAAQ,KAAK,MAAM,OAAO,SAAS,GAAI;EACzC;EACA,WAAW;GAAE,YAAY;GAAM,SAAS;GAAM,gBAAgB;EAAK;EACnE,YAAY;GACV,aAAa;GACb,SAAS;GACT,GAAI,QAAQ,KAAA,IAAY,EAAE,IAAI,IAAI,CAAC;EACrC;CACF,GACA,+BAA+B,OAAO,OACxC;AACF;;;;;;;AAQA,eAAsB,gBACpB,SACA,OACA,UAA8B,CAAC,GACH;CAC5B,MAAM,QAAQ,QAAQ,WAAW,MAAM;CACvC,MAAM,cAAc,QAAQ,MAAM,qBAAK,IAAI,KAAK,EAAA,CAAG,YAAY;CAC/D,MAAM,OAA4B,CAAC;CACnC,MAAM,gBAA0B,CAAC;CACjC,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,aAAa,MAAM,gBAAgB,OAAO,OAAO,KAAK;EAC5D,IAAI,WAAW,MAAM,WAAW,GAAG;GACjC,cAAc,KAAK,OAAO,KAAK;GAC/B,KAAK,KACH,SAAS,QAAQ,CAAC,GAAG,CAAC,GAAG,SAAS,YAAY,wCAAwC,CACxF;GACA;EACF;EACA,IAAI,QAAQ,WAAW,MAAM,KAAK,MAAM,YAAY,EAAE,MAAM,KAAK,CAAC;EAClE,IAAI,QAAQ,aAAa,KAAA,KAAa,MAAM,SAAS,QAAQ,UAAU;GAGrE,MAAM,OAAO,KAAK,KAAK,QAAQ,WAAW,CAAC;GAC3C,MAAM,OAAO,QAAQ,WAAW;GAChC,QAAQ,CAAC,GAAG,MAAM,MAAM,GAAG,IAAI,GAAG,GAAG,MAAM,MAAM,MAAM,SAAS,IAAI,CAAC;EACvE;EACA,MAAM,eAAe,kBACnB,WAAW,MAAM,KAAK,MAAM,EAAE,IAAI,GAClC,KACF;EACA,MAAM,MACJ,aAAa,WAAW,IAAI,uDAAuD,KAAA;EACrF,KAAK,KAAK,SAAS,QAAQ,OAAO,cAAc,SAAS,YAAY,GAAG,CAAC;CAC3E;CACA,OAAO;EAAE;EAAM;CAAc;AAC/B"}

package/dist/{multi-layer-verifier-BHY1gWAc.d.ts → multi-layer-verifier-DnAqwl0h.d.ts}

@@ -1,4 +1,4 @@
-import { t as DefaultVerdict } from "./verdict-Dps8_okt.js";
+import { t as DefaultVerdict } from "./verdict-DExhxfgR.js";
 //#region src/multi-layer-verifier.d.ts
 type LayerStatus = 'pass' | 'fail' | 'skipped' | 'error' | 'timeout';
 type Severity = 'critical' | 'major' | 'minor' | 'info';
@@ -135,4 +135,4 @@ declare class MultiLayerVerifier<Env = unknown> {
 }
 //#endregion
 export { MultiLayerVerifier as a, VerifyContext as c, LayerStatus as i, VerifyOptions as l, Layer as n, Severity as o, LayerResult as r, VerificationReport as s, Finding as t, gradeSemanticStatus as u };
-//# sourceMappingURL=multi-layer-verifier-BHY1gWAc.d.ts.map
+//# sourceMappingURL=multi-layer-verifier-DnAqwl0h.d.ts.map

package/dist/{multi-layer-verifier-BHY1gWAc.d.ts.map → multi-layer-verifier-DnAqwl0h.d.ts.map}

@@ -1 +1 @@
-{"version":3,"file":"multi-layer-verifier-BHY1gWAc.d.ts","names":[],"sources":["../src/multi-layer-verifier.ts"],"mappings":";;KA4BY;KAEA;UAEK;EACf,UAAU;EACV;EACA;;EAEA;;;;;;EAMA,SAAS;;UAGM;EACf;EACA,QAAQ;;EAER;;EAEA;EACA;EACA,UAAU;;EAEV;;;;;;;;;EASA,cAAc;;EAEd,SAAS;;UAGM,cAAc;;EAE7B,KAAK;;EAEL,OAAO,eAAe;;EAEtB,QAAQ;;UAGO,MAAM;EACrB;;EAEA;;EAEA;;;;;EAKA;;;;;;EAMA;;EAEA;EACA,MAAM,KAAK,cAAc,SAAS,QAAQ,eAAe;;UAG1C,cAAc;EAC7B,KAAK;;;;;EAKL;;EAEA,WAAW,QAAQ;;;;UAKJ,2BAA2B;EAC1C,QAAQ;EACR;EACA;EACA;EACA;;EAEA;;;;;EAKA;;;;;;;;EAQA;EACA;EACA;EACA;;;;;;;;;;;;;iBAgBc,oBAAoB;EAClC;EACA,UAAU;IAAQ,UAAU;IAAU;IAAmB;;EACzD;EACA;IACE;;;;cAcS,mBAAmB;mBACD;EAA7B,YAA6B,QAAQ,MAAM;EAiBrC,IAAI,MAAM,cAAc,OAAO,QAAQ"}
+{"version":3,"file":"multi-layer-verifier-DnAqwl0h.d.ts","names":[],"sources":["../src/multi-layer-verifier.ts"],"mappings":";;KA4BY;KAEA;UAEK;EACf,UAAU;EACV;EACA;;EAEA;;;;;;EAMA,SAAS;;UAGM;EACf;EACA,QAAQ;;EAER;;EAEA;EACA;EACA,UAAU;;EAEV;;;;;;;;;EASA,cAAc;;EAEd,SAAS;;UAGM,cAAc;;EAE7B,KAAK;;EAEL,OAAO,eAAe;;EAEtB,QAAQ;;UAGO,MAAM;EACrB;;EAEA;;EAEA;;;;;EAKA;;;;;;EAMA;;EAEA;EACA,MAAM,KAAK,cAAc,SAAS,QAAQ,eAAe;;UAG1C,cAAc;EAC7B,KAAK;;;;;EAKL;;EAEA,WAAW,QAAQ;;;;UAKJ,2BAA2B;EAC1C,QAAQ;EACR;EACA;EACA;EACA;;EAEA;;;;;EAKA;;;;;;;;EAQA;EACA;EACA;EACA;;;;;;;;;;;;;iBAgBc,oBAAoB;EAClC;EACA,UAAU;IAAQ,UAAU;IAAU;IAAmB;;EACzD;EACA;IACE;;;;cAcS,mBAAmB;mBACD;EAA7B,YAA6B,QAAQ,MAAM;EAiBrC,IAAI,MAAM,cAAc,OAAO,QAAQ"}

package/dist/multishot/index.d.ts

@@ -1,6 +1,6 @@
-import { p as CostProvenance } from "../cost-ledger-FuQvHxPm.js";
-import { w as JudgeScore } from "../types-Dcoaqcsc.js";
-import { o as MatrixResult } from "../index-DSC51roc.js";
+import { p as CostProvenance } from "../cost-ledger-Bv_e8XHY.js";
+import { w as JudgeScore } from "../types-DYuNHo9R.js";
+import { o as MatrixResult } from "../index-C3ssXVLv.js";
 import { AgentProfile } from "@tangle-network/agent-interface";
 //#region src/multishot/types.d.ts
 interface MultishotMessage {

package/dist/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "@tangle-network/agent-eval — wire protocol",
-    "version": "0.144.5",
+    "version": "0.144.7",
     "description": "HTTP and stdio RPC interface to agent-eval. The TypeScript runtime is the source of truth; this spec is the contract that cross-language clients (Python, Rust, Go) generate from.\n\nWire-protocol version: 1.0.0. Bumps on breaking changes to request/response schemas.",
     "contact": {
       "name": "Tangle Network",

package/dist/paired-promotion-decision-B6zJ3gYM.d.ts

@@ -0,0 +1,114 @@
+import { y as PairedBootstrapResult } from "./statistics-D6Uebe_4.js";
+//#region src/paired-promotion-decision.d.ts
+/** Which paired estimator produced the deciding interval. */
+type PairedDecisionStatistic = 'paired_risk_difference' | 'mean_bootstrap' | 'median_bootstrap';
+/** Which test carried the decision, given the estimator and the sample size. */
+type PairedDecisionMethod = 'score-interval' | 'bootstrap-ci' | 'exact-sign';
+/** McNemar's exact paired-binary evidence, on the two-point path only. */
+interface PairedMcNemarEvidence {
+  /** Discordant pairs the treatment won. */
+  b: number;
+  /** Discordant pairs the control won. */
+  c: number;
+  /** b + c — the only pairs carrying information. */
+  nDiscordant: number;
+  /** Two-sided exact p-value. */
+  pValue: number;
+}
+interface PairedPromotionDecisionOptions {
+  /** Smallest candidate-minus-baseline delta that counts as improvement, in the
+   *  caller's native units. May be negative (a noninferiority margin). Default 0. */
+  threshold?: number;
+  /** Confidence level. Default 0.95. */
+  confidence?: number;
+  /** Bootstrap resamples, on the paths where a bootstrap decides. Default 2000. */
+  resamples?: number;
+  /** Deterministic bootstrap seed. Omitted ⇒ derived from the deltas. */
+  seed?: number;
+  /** Caller-required paired observations. The exact test may impose a higher
+   *  minimum; the effective one is reported as `minimumPairs`. */
+  minPairs?: number;
+  /**
+   * `'mean'` (default) routes by SHAPE: a two-point (pass/fail) outcome on any
+   * encoding decides on the score interval, everything else on the mean
+   * bootstrap. `'median'` forces the median bootstrap on every input, including
+   * shapes where it is structurally blind — kept for callers who want outlier
+   * robustness on genuinely continuous outcomes and accept that cost.
+   */
+  statistic?: 'mean' | 'median';
+}
+interface PairedPromotionDecision {
+  /** Paired observations supplied. */
+  n: number;
+  /** Threshold the interval was judged against, native units. */
+  threshold: number;
+  confidence: number;
+  statistic: PairedDecisionStatistic;
+  method: PairedDecisionMethod;
+  /** Common positive level of a two-point outcome ({0,1} ⇒ 1, {0,100} ⇒ 100),
+   *  or null when the outcome is not two-point. Non-null is exactly the
+   *  condition for the `paired_risk_difference` path, and it is the factor
+   *  `delta` / `low` / `high` were rescaled by. */
+  binaryScale: number | null;
+  /** Exact-tie fraction over the paired deltas; null when there are no pairs. */
+  tieFraction: number | null;
+  /** Point estimate of the DECIDING statistic, in the caller's native units. */
+  delta: number;
+  /** Lower bound of the DECIDING interval, native units. */
+  low: number;
+  /** Upper bound of the DECIDING interval, native units. */
+  high: number;
+  /** The bootstrap that decided, or null when the score interval did. Callers
+   *  that need a bootstrap as a diagnostic on the two-point path compute their
+   *  own — it is not computed here, so the binary path costs no resamples. */
+  bootstrap: PairedBootstrapResult | null;
+  /** McNemar's exact evidence, or null off the two-point path. */
+  mcnemar: PairedMcNemarEvidence | null;
+  /** Exact one-sided sign-test p-value on the small-sample bootstrap path;
+   *  null otherwise. */
+  pValue: number | null;
+  /** Effective observation minimum after accounting for confidence. */
+  minimumPairs: number;
+  /** n >= minimumPairs. */
+  sufficient: boolean;
+  /** The deciding interval is zero-width or non-finite — no evidence in either
+   *  direction, so it cannot clear any threshold on evidence. */
+  indeterminate: boolean;
+  /** McNemar's exact test refuses at a non-negative threshold. */
+  exactTestVetoes: boolean;
+  /** The deciding interval clears the threshold, ignoring the other two guards. */
+  clearsThreshold: boolean;
+  /** `sufficient && !indeterminate && clearsThreshold && !exactTestVetoes` —
+   *  the whole rule. */
+  promote: boolean;
+  /** What `delta` measures, for a reason string. */
+  label: 'success-rate' | 'mean' | 'median';
+  /** Why a zero-width interval is zero-width; empty when it is not. */
+  indeterminateCause: string;
+  /** Sentence naming the test when the exact sign test decided; else empty. */
+  methodDetail: string;
+}
+/** The shape facts that pick the estimator, without computing an interval. */
+interface PairedDecisionShape {
+  statistic: PairedDecisionStatistic;
+  /** Common positive level of a two-point outcome; null when not two-point. */
+  binaryScale: number | null;
+  /** Exact-tie fraction over the paired deltas; null when there are no pairs. */
+  tieFraction: number | null;
+}
+/**
+ * Which estimator {@link decidePairedPromotion} would use on this data, and the
+ * shape facts behind it — for callers that must report the shape on a path
+ * where no interval is computed at all (an early rejection, or zero pairs).
+ * Cheap: no bootstrap, no interval.
+ */
+declare function pairedDecisionShape(before: number[], after: number[], statistic?: 'mean' | 'median'): PairedDecisionShape;
+/**
+ * Decide whether a paired candidate-minus-baseline delta clears a promotion
+ * threshold. `before` is the baseline arm, `after` the candidate arm, paired by
+ * position. Throws on unequal lengths.
+ */
+declare function decidePairedPromotion(before: number[], after: number[], options?: PairedPromotionDecisionOptions): PairedPromotionDecision;
+//#endregion
+export { PairedPromotionDecision as a, pairedDecisionShape as c, PairedMcNemarEvidence as i, PairedDecisionShape as n, PairedPromotionDecisionOptions as o, PairedDecisionStatistic as r, decidePairedPromotion as s, PairedDecisionMethod as t };
+//# sourceMappingURL=paired-promotion-decision-B6zJ3gYM.d.ts.map

package/dist/paired-promotion-decision-B6zJ3gYM.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paired-promotion-decision-B6zJ3gYM.d.ts","names":[],"sources":["../src/paired-promotion-decision.ts"],"mappings":";;;KA2DY;;KAMA;;UAGK;;EAEf;;EAEA;;EAEA;;EAEA;;UAGe;;;EAGf;;EAEA;;EAEA;;EAEA;;;EAGA;;;;;;;;EAQA;;UAGe;;EAEf;;EAEA;EACA;EACA,WAAW;EACX,QAAQ;;;;;EAKR;;EAEA;;EAEA;;EAEA;;EAEA;;;;EAIA,WAAW;;EAEX,SAAS;;;EAGT;;EAEA;;EAEA;;;EAGA;;EAEA;;EAEA;;;EAGA;;EAEA;;EAEA;;EAEA;;;UAIe;EACf,WAAW;;EAEX;;EAEA;;;;;;;;iBASc,oBACd,kBACA,iBACA,gCACC;;;;;;iBAiBa,sBACd,kBACA,iBACA,UAAS,iCACR"}

package/dist/pipelines/index.d.ts

@@ -2,7 +2,8 @@ import { S as ToolSpan, f as Run, r as BudgetSpec } from "../schema-BtVldJ3T.js"
 import { a as RunFilter, s as TraceStore } from "../store-CT9YIIve.js";
 import { o as llmSpans } from "../query-CJ_DX8vl.js";
 import { n as FailureClusterReport, r as failureClusterView, t as FailureCluster } from "../failure-cluster-CqcvCcdR.js";
-import { d as TrajectoryStep, g as computeToolUseMetrics, n as BaselineReport, t as BaselineOptions } from "../baseline-D_fT6277.js";
+import { n as BaselineReport, p as computeToolUseMetrics, t as BaselineOptions } from "../baseline-CavEbRyH.js";
+import { n as TrajectoryStep } from "../trajectory-YC15QDYQ.js";
 //#region src/pipelines/budget-breach.d.ts
 interface BudgetBreachFinding {
   runId: string;

package/dist/pipelines/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../../src/pipelines/budget-breach.ts","../../src/pipelines/first-divergence.ts","../../src/pipelines/judge-agreement.ts","../../src/pipelines/regression.ts","../../src/pipelines/stuck-loop.ts","../../src/pipelines/tool-waste.ts"],"mappings":";;;;;;UAUiB;EACf;EACA;EACA;EACA,iBAAiB;EACjB;EACA;EACA;EACA;;UAGe;EACf,UAAU;EACV,aAAa;EACb,YAAY;EACZ,WAAW;EACX;EACA;;iBAGoB,iBACpB,OAAO,YACP;EAAW;EAAqB;IAC/B,QAAQ;;;UCrBM;EACf;EACA;EACA;EACA,QAAQ;EACR,QAAQ;EACR;;EAEA;;UAGe;;EAEf,cAAc,GAAG,gBAAgB,GAAG;;iBAGhB,oBACpB,OAAO,YACP,cACA,cACA,UAAS,oBACR,QAAQ;;;UCnBM;EACf;EACA;EACA;;EAEA;EACA;EACA;;UAGe;EACf,OAAO;EACP;EACA;;iBAGoB,mBAAmB,OAAO,aAAa,QAAQ;;;UChBpD;EACf;EACA;;EAEA,WAAW,KAAK,KAAK,OAAO,eAAe;;UAG5B,0BAA0B;EACzC,UAAU;EACV,WAAW;;iBAGS,eACpB,OAAO,YACP,SAAS,kBACT,SAAS,oBACR,QAAQ;;;UCDM;EACf;EACA;EACA;;EAEA;EACA;;EAEA;;EAEA;;UAGe;EACf,UAAU;EACV;EACA;;UAGe;;EAEf;;EAEA;;;;;EAKA;;EAEA;;iBAGoB,cACpB,OAAO,YACP,UAAS,mBACR,QAAQ;;;UChDM;EACf;EACA;EACA;EACA;;UAGe;EACf,OAAO;EACP;;UAGe;EACf;EACA,eAAe,MAAM,UAAU;IAAS,KAAK,QAAQ,kBAAkB;;;iBAGnD,cACpB,OAAO,YACP,UAAS,mBACR,QAAQ"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../src/pipelines/budget-breach.ts","../../src/pipelines/first-divergence.ts","../../src/pipelines/judge-agreement.ts","../../src/pipelines/regression.ts","../../src/pipelines/stuck-loop.ts","../../src/pipelines/tool-waste.ts"],"mappings":";;;;;;;UAUiB;EACf;EACA;EACA;EACA,iBAAiB;EACjB;EACA;EACA;EACA;;UAGe;EACf,UAAU;EACV,aAAa;EACb,YAAY;EACZ,WAAW;EACX;EACA;;iBAGoB,iBACpB,OAAO,YACP;EAAW;EAAqB;IAC/B,QAAQ;;;UCrBM;EACf;EACA;EACA;EACA,QAAQ;EACR,QAAQ;EACR;;EAEA;;UAGe;;EAEf,cAAc,GAAG,gBAAgB,GAAG;;iBAGhB,oBACpB,OAAO,YACP,cACA,cACA,UAAS,oBACR,QAAQ;;;UCnBM;EACf;EACA;EACA;;EAEA;EACA;EACA;;UAGe;EACf,OAAO;EACP;EACA;;iBAGoB,mBAAmB,OAAO,aAAa,QAAQ;;;UChBpD;EACf;EACA;;EAEA,WAAW,KAAK,KAAK,OAAO,eAAe;;UAG5B,0BAA0B;EACzC,UAAU;EACV,WAAW;;iBAGS,eACpB,OAAO,YACP,SAAS,kBACT,SAAS,oBACR,QAAQ;;;UCDM;EACf;EACA;EACA;;EAEA;EACA;;EAEA;;EAEA;;UAGe;EACf,UAAU;EACV;EACA;;UAGe;;EAEf;;EAEA;;;;;EAKA;;EAEA;;iBAGoB,cACpB,OAAO,YACP,UAAS,mBACR,QAAQ;;;UChDM;EACf;EACA;EACA;EACA;;UAGe;EACf,OAAO;EACP;;UAGe;EACf;EACA,eAAe,MAAM,UAAU;IAAS,KAAK,QAAQ,kBAAkB;;;iBAGnD,cACpB,OAAO,YACP,UAAS,mBACR,QAAQ"}

package/dist/pre-registration-DakwTRXk.js

@@ -0,0 +1,96 @@
+//#region src/pre-registration.ts
+/**
+* Deterministic JSON canonicalization — sort object keys recursively.
+*
+* Two semantically-equal objects produce byte-identical canonicalized output;
+* this is what makes a content-hash stable across encoders, key insertion
+* orders, and runtime versions. Exported for any consumer that needs the same
+* canonicalization guarantee outside the manifest-signing path (e.g., signing
+* an artifact bundle, hashing a dataset version, etc.).
+*/
+function canonicalize(v) {
+	if (v === null || typeof v !== "object") return v;
+	if (Array.isArray(v)) return v.map(canonicalize);
+	const keys = Object.keys(v).sort();
+	const out = {};
+	for (const k of keys) out[k] = canonicalize(v[k]);
+	return out;
+}
+/**
+* SHA-256 hex (full 64 chars) over the canonicalized JSON encoding of `obj`.
+*
+* The same primitive `signManifest` and `verifyManifest` are built on, exposed
+* directly so consumers signing arbitrary structured content (artifact bundles,
+* production packets, dataset manifests, etc.) don't have to re-derive
+* canonicalize+sha256 from scratch.
+*
+* Stable across:
+*   - object key insertion order (canonicalization sorts keys recursively)
+*   - encoder choice (UTF-8 via TextEncoder, fixed)
+*   - runtime (uses the Web Crypto subtle digest, present in Node ≥18 and browsers)
+*
+* Named `hashJson` to disambiguate from `prompt-registry.ts`'s `hashContent`,
+* which takes a string input and returns a truncated 12-char prompt id.
+* Use `hashJson` when you mean "canonicalize then hash."
+*
+* @example
+*   const hash = await hashJson({ id: '1', kind: 'spec' })
+*   // 'a3f1...' (64 hex chars)
+*/
+async function hashJson(obj) {
+	const canonical = canonicalize(obj);
+	const bytes = new TextEncoder().encode(JSON.stringify(canonical));
+	const digest = await globalThis.crypto.subtle.digest("SHA-256", bytes);
+	return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+/**
+* Sign a manifest with a SHA-256 content hash.
+*
+* The hash covers the canonicalized manifest with the `contentHash`
+* and `algo` fields stripped; this lets verifiers re-sign the rest and
+* compare. Returned manifest always carries `algo: 'sha256-content'`
+* so downstream consumers can identify the scheme; manifests without
+* `algo` still verify because it is stripped before hashing on both sides.
+*/
+async function signManifest(m) {
+	const hash = await hashJson(m);
+	return {
+		...m,
+		contentHash: hash,
+		algo: "sha256-content"
+	};
+}
+/**
+* Verify that a signed manifest has not been tampered with.
+*
+* Strips `contentHash` and `algo` before re-signing so manifests without
+* `algo` verify identically to ones that carry it.
+*/
+async function verifyManifest(m) {
+	const { contentHash, algo: _algo, ...rest } = m;
+	return (await signManifest(rest)).contentHash === contentHash;
+}
+/**
+* Evaluate a pre-registered hypothesis against observed results.
+* Mechanical — no re-interpretation permitted.
+*/
+async function evaluateHypothesis(manifest, observed) {
+	if (!await verifyManifest(manifest)) throw new Error("evaluateHypothesis: manifest content hash mismatch (tampered)");
+	const reasons = [];
+	if (!(manifest.direction === "increase" ? observed.effect > 0 : observed.effect < 0)) reasons.push("wrong_direction");
+	if (Math.abs(observed.effect) < manifest.minEffect) reasons.push("effect_too_small");
+	if (observed.pValue >= manifest.alpha) reasons.push("not_significant");
+	if (observed.n < manifest.preRegisteredN) reasons.push("undersampled");
+	return {
+		manifest,
+		observedN: observed.n,
+		observedEffect: observed.effect,
+		observedPValue: observed.pValue,
+		confirmed: reasons.length === 0,
+		rejectionReasons: reasons
+	};
+}
+//#endregion
+export { verifyManifest as a, signManifest as i, evaluateHypothesis as n, hashJson as r, canonicalize as t };
+
+//# sourceMappingURL=pre-registration-DakwTRXk.js.map

package/dist/pre-registration-DakwTRXk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pre-registration-DakwTRXk.js","names":[],"sources":["../src/pre-registration.ts"],"sourcesContent":["/**\n * Pre-registered hypotheses — declare what you're testing BEFORE the\n * run, check it AFTER. Prevents p-hacking, optional stopping, and the\n * \"we ran until it looked good\" failure mode.\n *\n * Manifest is a plain JSON-friendly object. Sign it with a content hash\n * + timestamp; the registered record becomes immutable. Post-run,\n * evaluate the manifest against observed results — the library refuses\n * to let you re-interpret a different metric as the declared one.\n */\n\nexport interface HypothesisManifest {\n  id: string\n  /** Human prose — goes into the audit trail. */\n  hypothesis: string\n  /** Metric the hypothesis claims to move. */\n  metric: string\n  /** 'increase' = candidate should score higher than baseline; 'decrease' = lower. */\n  direction: 'increase' | 'decrease'\n  /** Minimum effect size to count (same units as the metric). */\n  minEffect: number\n  /** Alpha threshold. */\n  alpha: number\n  /** Target statistical power at which sample size was pre-computed. */\n  power: number\n  /** Declared N per arm before running. */\n  preRegisteredN: number\n  /** ISO8601 timestamp the manifest was registered. */\n  registeredAt: string\n  /** Optional identifiers to tie into the trace corpus. */\n  baselineLabel?: string\n  candidateLabel?: string\n}\n\n/**\n * Identifier for the hashing scheme used to produce `contentHash`.\n *\n * `'sha256-content'` — sha256 hex over the canonicalized manifest with\n * the `contentHash` and `algo` fields stripped. Held as a string union\n * so future schemes can be added without breaking parsers; SignedManifest\n * values without `algo` deserialize cleanly because the field is optional.\n */\nexport type SignedManifestAlgo = 'sha256-content'\n\nexport interface SignedManifest extends HypothesisManifest {\n  /** sha256 hex of canonicalized manifest (everything except contentHash and algo). */\n  contentHash: string\n  /**\n   * Algorithm string describing how `contentHash` was produced.\n   *\n   * Optional on the type so serialized manifests without it still parse,\n   * but ALWAYS populated by {@link signManifest}. Consumers that want to\n   * enforce a known algorithm should reject manifests where this field\n   * is missing or unrecognized.\n   */\n  algo?: SignedManifestAlgo\n}\n\nexport interface HypothesisResult {\n  manifest: SignedManifest\n  observedN: number\n  observedEffect: number\n  observedPValue: number\n  /** True iff the observed effect hits the pre-declared direction with\n   *  magnitude ≥ minEffect AND p < alpha. */\n  confirmed: boolean\n  /** Enumerated reasons the hypothesis was rejected (each a machine-tag). */\n  rejectionReasons: Array<\n    'wrong_direction' | 'effect_too_small' | 'not_significant' | 'undersampled'\n  >\n  notes?: string\n}\n\n/**\n * Deterministic JSON canonicalization — sort object keys recursively.\n *\n * Two semantically-equal objects produce byte-identical canonicalized output;\n * this is what makes a content-hash stable across encoders, key insertion\n * orders, and runtime versions. Exported for any consumer that needs the same\n * canonicalization guarantee outside the manifest-signing path (e.g., signing\n * an artifact bundle, hashing a dataset version, etc.).\n */\nexport function canonicalize(v: unknown): unknown {\n  if (v === null || typeof v !== 'object') return v\n  if (Array.isArray(v)) return v.map(canonicalize)\n  const keys = Object.keys(v as Record<string, unknown>).sort()\n  const out: Record<string, unknown> = {}\n  for (const k of keys) out[k] = canonicalize((v as Record<string, unknown>)[k])\n  return out\n}\n\n/**\n * SHA-256 hex (full 64 chars) over the canonicalized JSON encoding of `obj`.\n *\n * The same primitive `signManifest` and `verifyManifest` are built on, exposed\n * directly so consumers signing arbitrary structured content (artifact bundles,\n * production packets, dataset manifests, etc.) don't have to re-derive\n * canonicalize+sha256 from scratch.\n *\n * Stable across:\n *   - object key insertion order (canonicalization sorts keys recursively)\n *   - encoder choice (UTF-8 via TextEncoder, fixed)\n *   - runtime (uses the Web Crypto subtle digest, present in Node ≥18 and browsers)\n *\n * Named `hashJson` to disambiguate from `prompt-registry.ts`'s `hashContent`,\n * which takes a string input and returns a truncated 12-char prompt id.\n * Use `hashJson` when you mean \"canonicalize then hash.\"\n *\n * @example\n *   const hash = await hashJson({ id: '1', kind: 'spec' })\n *   // 'a3f1...' (64 hex chars)\n */\nexport async function hashJson<T>(obj: T): Promise<string> {\n  const canonical = canonicalize(obj)\n  const bytes = new TextEncoder().encode(JSON.stringify(canonical))\n  const digest = await globalThis.crypto.subtle.digest('SHA-256', bytes)\n  return Array.from(new Uint8Array(digest))\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('')\n}\n\n/**\n * Sign a manifest with a SHA-256 content hash.\n *\n * The hash covers the canonicalized manifest with the `contentHash`\n * and `algo` fields stripped; this lets verifiers re-sign the rest and\n * compare. Returned manifest always carries `algo: 'sha256-content'`\n * so downstream consumers can identify the scheme; manifests without\n * `algo` still verify because it is stripped before hashing on both sides.\n */\nexport async function signManifest(m: HypothesisManifest): Promise<SignedManifest> {\n  const hash = await hashJson(m)\n  return { ...m, contentHash: hash, algo: 'sha256-content' }\n}\n\n/**\n * Verify that a signed manifest has not been tampered with.\n *\n * Strips `contentHash` and `algo` before re-signing so manifests without\n * `algo` verify identically to ones that carry it.\n */\nexport async function verifyManifest(m: SignedManifest): Promise<boolean> {\n  const { contentHash, algo: _algo, ...rest } = m\n  void _algo\n  const resigned = await signManifest(rest)\n  return resigned.contentHash === contentHash\n}\n\n/**\n * Evaluate a pre-registered hypothesis against observed results.\n * Mechanical — no re-interpretation permitted.\n */\nexport async function evaluateHypothesis(\n  manifest: SignedManifest,\n  observed: { n: number; effect: number; pValue: number },\n): Promise<HypothesisResult> {\n  if (!(await verifyManifest(manifest))) {\n    throw new Error('evaluateHypothesis: manifest content hash mismatch (tampered)')\n  }\n  const reasons: HypothesisResult['rejectionReasons'] = []\n  const directionOk = manifest.direction === 'increase' ? observed.effect > 0 : observed.effect < 0\n  if (!directionOk) reasons.push('wrong_direction')\n  if (Math.abs(observed.effect) < manifest.minEffect) reasons.push('effect_too_small')\n  if (observed.pValue >= manifest.alpha) reasons.push('not_significant')\n  if (observed.n < manifest.preRegisteredN) reasons.push('undersampled')\n  return {\n    manifest,\n    observedN: observed.n,\n    observedEffect: observed.effect,\n    observedPValue: observed.pValue,\n    confirmed: reasons.length === 0,\n    rejectionReasons: reasons,\n  }\n}\n"],"mappings":";;;;;;;;;;AAkFA,SAAgB,aAAa,GAAqB;CAChD,IAAI,MAAM,QAAQ,OAAO,MAAM,UAAU,OAAO;CAChD,IAAI,MAAM,QAAQ,CAAC,GAAG,OAAO,EAAE,IAAI,YAAY;CAC/C,MAAM,OAAO,OAAO,KAAK,CAA4B,CAAC,CAAC,KAAK;CAC5D,MAAM,MAA+B,CAAC;CACtC,KAAK,MAAM,KAAK,MAAM,IAAI,KAAK,aAAc,EAA8B,EAAE;CAC7E,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;;AAuBA,eAAsB,SAAY,KAAyB;CACzD,MAAM,YAAY,aAAa,GAAG;CAClC,MAAM,QAAQ,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,UAAU,SAAS,CAAC;CAChE,MAAM,SAAS,MAAM,WAAW,OAAO,OAAO,OAAO,WAAW,KAAK;CACrE,OAAO,MAAM,KAAK,IAAI,WAAW,MAAM,CAAC,CAAC,CACtC,KAAK,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAC3C,KAAK,EAAE;AACZ;;;;;;;;;;AAWA,eAAsB,aAAa,GAAgD;CACjF,MAAM,OAAO,MAAM,SAAS,CAAC;CAC7B,OAAO;EAAE,GAAG;EAAG,aAAa;EAAM,MAAM;CAAiB;AAC3D;;;;;;;AAQA,eAAsB,eAAe,GAAqC;CACxE,MAAM,EAAE,aAAa,MAAM,OAAO,GAAG,SAAS;CAG9C,QAAO,MADgB,aAAa,IAAI,EAAA,CACxB,gBAAgB;AAClC;;;;;AAMA,eAAsB,mBACpB,UACA,UAC2B;CAC3B,IAAI,CAAE,MAAM,eAAe,QAAQ,GACjC,MAAM,IAAI,MAAM,+DAA+D;CAEjF,MAAM,UAAgD,CAAC;CAEvD,IAAI,EADgB,SAAS,cAAc,aAAa,SAAS,SAAS,IAAI,SAAS,SAAS,IAC9E,QAAQ,KAAK,iBAAiB;CAChD,IAAI,KAAK,IAAI,SAAS,MAAM,IAAI,SAAS,WAAW,QAAQ,KAAK,kBAAkB;CACnF,IAAI,SAAS,UAAU,SAAS,OAAO,QAAQ,KAAK,iBAAiB;CACrE,IAAI,SAAS,IAAI,SAAS,gBAAgB,QAAQ,KAAK,cAAc;CACrE,OAAO;EACL;EACA,WAAW,SAAS;EACpB,gBAAgB,SAAS;EACzB,gBAAgB,SAAS;EACzB,WAAW,QAAQ,WAAW;EAC9B,kBAAkB;CACpB;AACF"}

package/dist/prime-bridge-transport-6feEglLf.d.ts

@@ -0,0 +1,49 @@
+//#region src/analyst/prime-bridge-transport.d.ts
+/**
+ * The bridge seam for the prime analyst protocol: one POST to an
+ * OpenAI-compatible `/v1/chat/completions` endpoint, returning the raw status
+ * and body text.
+ *
+ * Deliberately NOT `callLlm` from `../llm-client`, which serves a different
+ * contract:
+ *  - it retries transient failures, and a prime turn holds a single model seat
+ *    for minutes — a silent second attempt doubles the seat time and the spend;
+ *  - it normalizes usage, while the protocol's receipt depends on the bridge's
+ *    non-standard `model_requests` and `estimated` fields;
+ *  - it composes sampling and response-format options the bridge's CLI backends
+ *    reject;
+ *  - it collapses HTTP status, unparseable body, and empty content into two
+ *    error classes, while the protocol classifies them as three distinct
+ *    terminal reasons.
+ */
+interface PrimeBridgeTransportRequest {
+  url: string;
+  body: {
+    model: string;
+    messages: Array<{
+      role: 'user';
+      content: string;
+    }>;
+  };
+  /**
+   * The call's only deadline. The protocol aborts it on the per-call timeout
+   * and on the caller's cancellation, so a transport that imposes a second
+   * deadline of its own competes with this one.
+   */
+  signal: AbortSignal;
+}
+interface PrimeBridgeTransportResult {
+  status: number;
+  text: string;
+}
+/** One POST to the bridge. Injectable so tests run against a fake bridge. */
+type PrimeBridgeTransport = (request: PrimeBridgeTransportRequest) => Promise<PrimeBridgeTransportResult>;
+/**
+ * Default transport on node:http/node:https rather than fetch: undici's fixed
+ * response-header timeout kills prime calls that legitimately run past five
+ * minutes, so the request's AbortSignal is the only deadline.
+ */
+declare function nodeHttpPrimeBridgeTransport(): PrimeBridgeTransport;
+//#endregion
+export { nodeHttpPrimeBridgeTransport as i, PrimeBridgeTransportRequest as n, PrimeBridgeTransportResult as r, PrimeBridgeTransport as t };
+//# sourceMappingURL=prime-bridge-transport-6feEglLf.d.ts.map

package/dist/prime-bridge-transport-6feEglLf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prime-bridge-transport-6feEglLf.d.ts","names":[],"sources":["../src/analyst/prime-bridge-transport.ts"],"mappings":";;;;;;;;;;;;;;;;;;UAoBiB;EACf;EACA;IACE;IACA,UAAU;MAAQ;MAAc;;;;;;;;EAOlC,QAAQ;;UAGO;EACf;EACA;;;KAIU,wBACV,SAAS,gCACN,QAAQ;;;;;;iBAOG,gCAAgC"}