@tangle-network/agent-eval 0.144.6 → 0.144.8

package/dist/trace-repair/index.d.ts

@@ -0,0 +1,2102 @@
+import { r as CaptureIntegrityError } from "../errors-CKPfb2aH.js";
+import { b as CustomTokenPricing, c as CostLedgerHandle, p as CostProvenance } from "../cost-ledger-Bv_e8XHY.js";
+import { u as RunTokenUsage } from "../run-record-DdSa93_W.js";
+import { a as TraceAnalystLimits, n as TraceAnalysisEngine } from "../engine-nB64f48I.js";
+import { t as PrimeBridgeTransport } from "../prime-bridge-transport-6feEglLf.js";
+import { t as RecordedTrajectoryStep } from "../steps-BArUxhna.js";
+//#region src/trace-repair/mini-swe-scaffold.d.ts
+/**
+ * The mini-swe-agent scaffold as the Terminal-Bench-2 trajectory corpus
+ * recorded it: one bash block per turn, one observation per command, and a
+ * sentinel command that ends the run.
+ *
+ * Every template here is byte-verified against
+ * `yoonholee/terminalbench-trajectories` (agent = `mini-swe-agent`, 6663 rows,
+ * one distinct system prompt across all of them). A continuation that renders
+ * different bytes puts the model in a different distribution than the prefix
+ * it inherits, so these strings are pinned, not configurable.
+ */
+/** Whole-line marker that ends a run. The first output line must equal it and the command must exit 0. */
+declare const SUBMIT_SENTINEL = "COMPLETE_TASK_AND_SUBMIT_FINAL_OUTPUT";
+/** Outputs at or above this length are elided head+tail instead of shown whole. */
+declare const OUTPUT_ELISION_THRESHOLD = 10000;
+/** Characters kept from each end of an elided output. */
+declare const OUTPUT_ELISION_WINDOW = 5000;
+declare const MINI_SWE_SYSTEM_MESSAGE = "You are a helpful assistant that can interact with a computer.\n\nYour response must contain exactly ONE bash code block with ONE command (or commands connected with && or ||).\nInclude a THOUGHT section before your command where you explain your reasoning process.\nFormat your response as shown in <format_example>.\n\n<format_example>\nYour reasoning and analysis here. Explain why you want to perform the action.\n\n```bash\nyour_command_here\n```\n</format_example>\n\nFailure to follow these rules will cause your response to be rejected.\n";
+interface InstanceMessageInput {
+  /** The task statement, substituted verbatim. */
+  task: string;
+  /**
+   * `uname`-style line the recorded runs rendered from the host running the
+   * scaffold, e.g. `Linux 6.8.0-86-generic #87-Ubuntu SMP ... x86_64`.
+   */
+  systemInformation: string;
+}
+/** The second message of every recorded run: task plus workflow rules. */
+declare function renderInstanceMessage(input: InstanceMessageInput): string;
+type ParsedAction = {
+  kind: 'action';
+  command: string;
+} | {
+  kind: 'format-error';
+  actionCount: number;
+};
+/**
+ * Exactly one fenced bash block is an action; zero or many is a format error.
+ * The scaffold trims the command, so a block padded with blank lines executes
+ * the same command as an unpadded one.
+ */
+declare function parseAction(assistantMessage: string): ParsedAction;
+interface CommandOutput {
+  returncode: number;
+  output: string;
+  /** Set when the environment itself failed rather than the command. */
+  exceptionInfo?: string;
+}
+/**
+ * The observation the agent reads after a command. Short outputs are shown
+ * whole; long ones keep the first and last `OUTPUT_ELISION_WINDOW` characters
+ * with the dropped count between them.
+ */
+declare function renderObservation(output: CommandOutput): string;
+/** The observation after the environment killed a command for exceeding its timeout. */
+declare function renderTimeoutObservation(command: string, partialOutput: string): string;
+/**
+ * True when the recording shows the environment killed this step at its
+ * wall-clock bound.
+ *
+ * Such a step carries no returncode, so no replay can confirm or contradict
+ * it. Callers use this to bound the replay of that step cheaply rather than to
+ * decide agreement.
+ */
+declare function isRecordedTimeout(observation: string | null): boolean;
+/** The observation after a turn that did not contain exactly one bash block. */
+declare function renderFormatErrorObservation(actionCount: number): string;
+/**
+ * The submission text when this output ends the run, `null` otherwise.
+ * A non-zero exit does not submit even when the sentinel is echoed, so an
+ * agent cannot end the run through a command that failed.
+ */
+declare function submissionOf(output: CommandOutput): string | null;
+//#endregion
+//#region src/trace-repair/action-budget.d.ts
+/**
+ * The action budget an intervention must fit inside.
+ *
+ * The analyst answers with one action, applied at step k, drawn from the same
+ * action space the scaffold had: one shell command or one edit, at most 4 KB.
+ * An answer that buys a bigger action than the scaffold could take is not a
+ * counterfactual about the recorded run, so the budget is enforced before any
+ * container is opened and a violation never reaches the reproduction gate.
+ *
+ * "One action" is decided by counting top-level statements, not lines. A
+ * command list joined by `&&`, `||` or a pipe is one statement, because that
+ * is one thing the shell runs and one thing the scaffold could have typed.
+ * Two statements separated by a newline or `;` are two actions and are
+ * rejected. Heredoc bodies, comments and compound blocks (`if`, `for`,
+ * `while`, `until`, `case`, `{ … }`) are inside a statement, never separators.
+ */
+/**
+ * Payload shape of an action.
+ *
+ * `edit` authors file content inline through a heredoc; `shell` runs a
+ * command. The split matters because the two carry different amounts of
+ * information for the same byte count, and a report that pools them hides it.
+ */
+type ActionPayloadKind = 'shell' | 'edit';
+interface InterventionBudget {
+  /** Hard cap on the UTF-8 byte length of the action. */
+  readonly maxBytes: number;
+  /** Top-level statements the action may contain. One means one action. */
+  readonly maxStatements: number;
+  /** Heredoc redirections an `edit` may contain. One means one file. */
+  readonly maxHeredocs: number;
+}
+/** The scaffold's own per-action budget, pre-registered for the campaign. */
+declare const SCAFFOLD_INTERVENTION_BUDGET: InterventionBudget;
+/**
+ * Actions whose only effect is to consume a turn. They are rejected before a
+ * container opens: an intervention that changes nothing is measurably
+ * identical to the no-op control, and paying rollouts to rediscover that
+ * wastes the corpus.
+ */
+declare const NO_OP_ACTIONS: readonly string[];
+/**
+ * Split a shell script into top-level statements and count its heredocs.
+ *
+ * The scan tracks quoting, escapes, command substitution, brace and paren
+ * grouping, comments, compound-block keywords, and heredoc bodies. Anything
+ * it cannot resolve stays inside the current statement, so an unparseable
+ * action reads as one oversized statement and is rejected on bytes rather
+ * than silently accepted as one clean action.
+ */
+declare function scanShellAction(script: string): {
+  statements: string[];
+  heredocs: number;
+};
+/** Payload shape of an action: `edit` when it authors file content through a
+ *  heredoc, `shell` otherwise. */
+declare function classifyActionPayload(action: string): ActionPayloadKind;
+/** Why an action fails the budget. Every value is a rejection the report
+ *  counts by name; none of them is a scoring judgement. */
+type BudgetViolation = 'empty' | 'over-byte-cap' | 'multiple-statements' | 'multiple-heredocs' | 'no-op-action' | 'submit-instead-of-repair';
+interface BudgetMeasurement {
+  bytes: number;
+  statements: number;
+  heredocs: number;
+  /** What the action IS, measured from its text. */
+  payload: ActionPayloadKind;
+  /** What the analyst SAID it was. Recorded, never a rejection. */
+  declared: ActionPayloadKind;
+}
+type BudgetCheck = {
+  readonly admissible: true;
+  readonly measurement: BudgetMeasurement;
+} | {
+  readonly admissible: false;
+  readonly violation: BudgetViolation;
+  readonly detail: string;
+  readonly measurement: BudgetMeasurement;
+};
+/**
+ * Measure an action against the budget.
+ *
+ * The budget bounds what the scaffold can execute: one top-level statement,
+ * one authored file, a byte cap, and neither a no-op nor a submit. Every
+ * rejection here is one of those.
+ *
+ * `declaredKind` is what the analyst called its own action. It is recorded
+ * beside the measured payload and never rejected on, because the scaffold runs
+ * the action identically either way — so rejecting the label scores an arm on
+ * how it described a repair rather than on the repair. A reader who wants the
+ * mismatch counts `declared` against `payload`.
+ */
+declare function checkInterventionBudget(action: string, declaredKind: ActionPayloadKind, budget?: InterventionBudget): BudgetCheck;
+/**
+ * Whitespace-insensitive comparison used to reject an intervention that is
+ * the recorded action again. Trailing whitespace and blank lines are the only
+ * differences a re-proposal can carry without changing what runs.
+ */
+declare function normalizeActionForComparison(action: string): string;
+//#endregion
+//#region src/trace-repair/continuation-records.d.ts
+/** Which arm produced a rollout. The policy is identical across all three. */
+type ContinuationArm = 'intervention' | 'no-fix-control' | 'no-op-control';
+/** Chat message in the scaffold's own vocabulary. */
+interface ContinuationMessage {
+  role: 'system' | 'user' | 'assistant';
+  content: string;
+}
+/** Why a rollout stopped. */
+type ContinuationExitStatus = 'submitted' | 'step-budget-exhausted' | 'repeated-format-error' | 'model-error' | 'environment-error';
+interface ContinuationExecRecord {
+  command: string;
+  returncode: number;
+  /** True when the environment killed the command at the policy timeout. */
+  timedOut: boolean;
+  outputChars: number;
+  durationMs: number;
+}
+interface ContinuationModelCall {
+  /** Model id the provider reported serving, which can differ from the requested id. */
+  servedModel: string;
+  seed: number;
+  latencyMs: number;
+  /** `null` when the provider reported no usage. Never a zero-filled stand-in. */
+  usage: RunTokenUsage | null;
+  /** `null` when neither the provider nor local pricing produced an amount. */
+  costUsd: number | null;
+  finishReason: string | null;
+  contentChars: number;
+}
+interface ContinuationStepRecord {
+  /** 1-based index within the continuation, not within the whole trajectory. */
+  step: number;
+  assistantMessage: string;
+  /** `null` when the turn held zero or several bash blocks. */
+  action: string | null;
+  /**
+   * `null` when the command that ran ended the rollout: the submission
+   * sentinel gets no observation, which is how the corpus records a finished
+   * run, and a failed environment call produces none either.
+   */
+  observation: string | null;
+  /** `null` when no command ran, so a format error is never read as an exit-0 command. */
+  execution: ContinuationExecRecord | null;
+  model: ContinuationModelCall;
+  /** Environment failure that ended the rollout at this step. */
+  error?: string;
+}
+interface ContinuationUsageTotals {
+  /**
+   * Recorded model calls. A call that threw produced no step, so it is absent
+   * here and named in `terminalError` instead.
+   */
+  calls: number;
+  /** Calls that carried usage. Below `calls` means the totals cover part of the rollout. */
+  callsWithUsage: number;
+  /** True only when every call reported usage. */
+  captured: boolean;
+  input: number;
+  output: number;
+  reasoning?: number;
+  cached?: number;
+  cacheWrite?: number;
+}
+interface ContinuationEnvironmentDescription {
+  /** Docker network mode of the container. The policy admits `none` only. */
+  networkMode: string;
+  image?: string;
+}
+interface ContinuationRollout {
+  rolloutId: string;
+  arm: ContinuationArm;
+  /** Corpus row the continuation belongs to. Pairs rollouts across arms. */
+  rowId: string;
+  /** 0-based rollout index within the arm. */
+  index: number;
+  /** Seed handed to the model for every call in this rollout. */
+  seed: number;
+  /** Hash over the policy and scaffold templates. Equal across arms by construction. */
+  policyDigest: string;
+  environmentId: string;
+  containerRef: string;
+  environment: ContinuationEnvironmentDescription;
+  steps: ContinuationStepRecord[];
+  exitStatus: ContinuationExitStatus;
+  /** Text after the sentinel line, present only on `submitted`. */
+  submission: string | null;
+  usage: ContinuationUsageTotals;
+  costProvenance: CostProvenance;
+  wallMs: number;
+  startedAt: string;
+  endedAt: string;
+  /** Message from the model or environment failure that ended the rollout. */
+  terminalError?: string;
+}
+/** A tool call in corpus shape. */
+interface RecordedToolCall {
+  fn: 'bash_command';
+  cmd: string;
+}
+/** One trajectory step in corpus shape. */
+interface RecordedStep {
+  src: 'system' | 'user' | 'agent';
+  msg: string;
+  tools: RecordedToolCall[] | null;
+  obs: string | null;
+}
+/**
+ * Project a full message list into corpus steps: the system and task messages
+ * become their own steps, and every assistant turn carries the command it
+ * requested plus the observation that answered it. A trailing assistant turn
+ * with no answer keeps `obs: null`, which is how the corpus records a run that
+ * ended on its last command.
+ */
+declare function toRecordedSteps(messages: readonly ContinuationMessage[]): RecordedStep[];
+/** Corpus steps for the continuation alone, excluding the prefix it inherited. */
+declare function rolloutRecordedSteps(rollout: ContinuationRollout): RecordedStep[];
+/**
+ * Hash over everything the policy determines: the actions taken, the
+ * observations they produced, the seeds, the exit, and the usage.
+ *
+ * Wall-clock fields are excluded because they vary between identical runs;
+ * two rollouts with the same digest did the same work, whatever they cost in
+ * seconds. Use it to assert determinism, never to assert equal latency.
+ */
+declare function rolloutDigest(rollout: ContinuationRollout): string;
+//#endregion
+//#region src/trace-repair/control-policy.d.ts
+/** The declared control cannot produce the outcome the criteria screen for. */
+declare class UncalibratedControlError extends CaptureIntegrityError {}
+/**
+ * What the criteria expect of the control.
+ *
+ * - `enforced` — conditions 3 and 4 decide admission, so the control must be
+ *   able to rescue a row.
+ * - `declared-inert` — the campaign has pinned a control that cannot rescue
+ *   anything (a calibration run comparing arms at equal depth, for instance).
+ *   Conditions 3 and 4 still run, but a pass then means the task's grader
+ *   disagreed with itself about identical state, and the row leaves as that.
+ */
+type ControlScreening = 'enforced' | 'declared-inert';
+declare const CONTROL_SCREENING_MODES: readonly ControlScreening[];
+interface ControlPolicyInput {
+  /** Stable name for the frozen configuration. */
+  readonly id: string;
+  /** Model calls one control rollout may make after the arm's own treatment. */
+  readonly stepBudget: number;
+  /** Scaffold the rollout runs under. */
+  readonly scaffold: string;
+  /** Requested model id, or `null` when the budget calls no model. */
+  readonly model: string | null;
+  /** Per-command wall-clock limit inside the container. */
+  readonly commandTimeoutSeconds: number;
+}
+/**
+ * The part of a control the calibration rule reads.
+ *
+ * Both admission paths declare a control in their own vocabulary — the pure
+ * contract takes a `ControlPolicy`, the executing pre-pass runs a pinned
+ * continuation policy — and both are checked by one rule against this shape,
+ * so the two cannot drift into disagreeing about what a usable control is.
+ */
+interface ControlCapability {
+  readonly id: string;
+  readonly digest: string;
+  /** Model calls one control rollout may make after the arm's own treatment. */
+  readonly stepBudget: number;
+}
+interface ControlPolicy extends ControlPolicyInput, ControlCapability {
+  /** Hash over the whole declaration. A hand-written label cannot stand in for
+   *  it, so two runs cannot share a digest while differing in step budget. */
+  readonly digest: string;
+  /**
+   * Whether a rollout under this policy can reach a state the recorded end
+   * state was not already in. False at a zero step budget: no model call means
+   * no command, which means the graded bytes are the ones condition 2 read.
+   */
+  readonly canRescue: boolean;
+}
+/**
+ * A control rollout changes the graded state only by executing something, and
+ * it executes only what a model call asks for. At a zero budget it grades the
+ * bytes it was handed.
+ */
+declare function controlCanRescue(stepBudget: number): boolean;
+declare function defineControlPolicy(input: ControlPolicyInput): ControlPolicy;
+/**
+ * Refuse a configuration whose control and screening mode contradict.
+ *
+ * Both directions are faults, and both are silent without this. A screening
+ * control that cannot act passes every row through a condition it can never
+ * fire. A control declared inert that can in fact act hides a real screen
+ * behind a label that says nothing was screened.
+ */
+declare function assertControlCalibrated(policy: ControlCapability, screening: ControlScreening): void;
+//#endregion
+//#region src/trace-repair/admission-records.d.ts
+/** A campaign scored rows the pre-pass did not admit, or dropped rows it did. */
+declare class AdmissionDenominatorError extends CaptureIntegrityError {}
+/** A row handed to the pre-pass carried a field only an analyst could produce. */
+declare class AdmissionIndependenceError extends CaptureIntegrityError {}
+/**
+ * One corpus row, described by what the recording holds and nothing else.
+ *
+ * The field list is closed on purpose: `assertAnalystIndependent` rejects any
+ * extra key, which is what stops a finding, a step index, or a proposed
+ * intervention from reaching the gate that fixes the denominator.
+ */
+interface AdmissionRow {
+  /** Stable identifier for the recorded trajectory. Duplicates are rejected. */
+  rowId: string;
+  /** Terminal-Bench-2 task the trajectory ran. */
+  taskName: string;
+  /** Model that produced the recorded trajectory. */
+  recordedModel: string;
+  /**
+   * Recorded shell commands. An action can be substituted at any one of them,
+   * and a replay must execute all of them to reach the recorded end state.
+   */
+  recordedCommands: number;
+  /**
+   * Return code of the trajectory's last recorded observation. Negative values
+   * are signal kills and are real. `null` means the recording did not parse,
+   * which excludes the row instead of defaulting it.
+   */
+  finalReturncode: number | null;
+}
+declare const ADMISSION_ROW_KEYS: readonly string[];
+/**
+ * Reject rows that carry anything beyond the recording.
+ *
+ * The check is a closed key list rather than a list of known analyst field
+ * names, because the failure to catch is "some new analyst output leaked into
+ * the gate", and only a closed shape catches the fields nobody thought of.
+ */
+declare function assertAnalystIndependent(rows: readonly AdmissionRow[]): void;
+/**
+ * Failure population a row belongs to.
+ *
+ * - `clean-exit` — the last command exited 0 and the tests still fail, so the
+ *   agent stopped believing it was done. The assay measured 87.13% of admitted
+ *   failures here.
+ * - `command-error` — the last command exited non-zero.
+ * - `signal-kill` — the last command was killed by a signal, recorded as a
+ *   negative return code. Substituting one command does not address a timeout,
+ *   so this population stays separate from the other two.
+ */
+type AdmissionStratum = 'clean-exit' | 'command-error' | 'signal-kill';
+declare const ADMISSION_STRATA: readonly AdmissionStratum[];
+/** `null` when the recording holds no parseable final return code. */
+declare function stratumOf(finalReturncode: number | null): AdmissionStratum | null;
+/**
+ * Why a row left the funnel.
+ *
+ * `ADMISSION_EXCLUSION_ORDER` is the order the gate applies the checks, and it
+ * is cost-ordered: everything decidable from the recording runs before the
+ * first container, and the control rollouts run last.
+ */
+type AdmissionExclusionReason = 'no-recorded-commands' | 'unparseable-final-returncode' | 'stratum-not-admitted' | 'task-oracle-uncertified' | 'task-oracle-nondeterministic' | 'prefix-replay-error' | 'prefix-replay-empty' | 'prefix-replay-truncated' | 'prefix-divergence-above-threshold' | 'end-state-oracle-error' | 'end-state-tests-pass' | 'no-fix-control-error' | 'no-fix-control-rescued' | 'no-op-control-error' | 'no-op-control-rescued';
+declare const ADMISSION_EXCLUSION_ORDER: readonly AdmissionExclusionReason[];
+declare function isPreStratumReason(reason: AdmissionExclusionReason): boolean;
+/** One line of prose per reason, for the rendered chain. */
+declare const ADMISSION_EXCLUSION_MEANING: Readonly<Record<AdmissionExclusionReason, string>>;
+type AdmissionControlArm = 'no-fix-control' | 'no-op-control';
+/** The inert action the no-op control substitutes, and where it goes. */
+interface AdmissionNoOpInjection {
+  /** 1-based recorded command the inert action replaces. */
+  step: number;
+  action: string;
+}
+type AdmissionCheckRecord = {
+  check: 'stratum';
+  stratum: AdmissionStratum;
+} | {
+  check: 'prefix-replay';
+  prefixExecuted: number;
+  divergences: number;
+  divergenceRatio: number;
+} | {
+  check: 'task-oracle';
+  stable: boolean;
+  flipRate: number;
+  replicates: number;
+} | {
+  check: 'end-state-tests';
+  passed: boolean;
+  reward: number | null;
+} | {
+  check: 'control';
+  arm: AdmissionControlArm;
+  rolloutsRun: number;
+  passes: number;
+  injections: AdmissionNoOpInjection[];
+};
+/** What one control rollout did, small enough to serialize for every row. */
+interface AdmissionRolloutSummary {
+  arm: AdmissionControlArm;
+  index: number;
+  seed: number;
+  policyDigest: string;
+  exitStatus: ContinuationRollout['exitStatus'];
+  testsPassed: boolean;
+  /** `null` when the rollout carried an unpriced model call. */
+  costUsd: number | null;
+}
+interface AdmissionRowVerdict {
+  rowId: string;
+  taskName: string;
+  recordedModel: string;
+  recordedCommands: number;
+  finalReturncode: number | null;
+  /** `null` only together with a pre-stratum exclusion reason. */
+  stratum: AdmissionStratum | null;
+  /** The control this row was screened under, and how a control pass reads.
+   *  Recorded on every verdict, including rows excluded before a control ran,
+   *  so a reader never has to open the runner's source to learn what screened
+   *  the row. */
+  controlPolicyDigest: string;
+  controlScreening: ControlScreening;
+  /** The task's certified oracle flip rate. Zero on a certified-stable task,
+   *  `null` when the task carried no certification. */
+  oracleFlipRate: number | null;
+  admitted: boolean;
+  /** `null` when the row is admitted. */
+  excludedBy: AdmissionExclusionReason | null;
+  /** Message from the boundary that failed, on the four `*-error` reasons. */
+  errorDetail: string | null;
+  /** Checks that ran, in order. A check never reached is absent, not zero. */
+  checks: AdmissionCheckRecord[];
+  rollouts: AdmissionRolloutSummary[];
+}
+interface DenominatorStage {
+  reason: AdmissionExclusionReason;
+  entering: number;
+  excluded: number;
+  remaining: number;
+}
+interface DenominatorChain {
+  /** `all` counts every input row; a stratum chain starts after stratification. */
+  scope: 'all' | AdmissionStratum;
+  input: number;
+  stages: DenominatorStage[];
+  admitted: number;
+}
+interface DenominatorChainArtifact {
+  version: 1;
+  overall: DenominatorChain;
+  byStratum: DenominatorChain[];
+  reasonTotals: Record<AdmissionExclusionReason, number>;
+  /** Rows excluded before a stratum could be assigned. */
+  unstratified: number;
+  /** Strata this run admitted. Others can only reach `stratum-not-admitted`. */
+  admitStrata: readonly AdmissionStratum[];
+}
+/**
+ * Build the funnel every campaign report publishes.
+ *
+ * Each stage names the reason, the rows that reached it, the rows it removed,
+ * and the rows that survived, so `input = admitted + sum(excluded)` can be read
+ * off the table instead of trusted.
+ */
+declare function buildDenominatorChain(verdicts: readonly AdmissionRowVerdict[], admitStrata: readonly AdmissionStratum[]): DenominatorChainArtifact;
+/** A chain that does not add up is a broken denominator, so this throws. */
+declare function assertChainReconciles(artifact: DenominatorChainArtifact): void;
+//#endregion
+//#region src/trace-repair/continuation-policy.d.ts
+/** A rollout ran outside the pinned policy, so its evidence cannot be used. */
+declare class ContinuationPolicyViolationError extends CaptureIntegrityError {}
+/** Two arms did not run the same policy, so their difference is not the intervention. */
+declare class ContinuationSymmetryError extends CaptureIntegrityError {}
+interface PinnedContinuationPolicy {
+  /** Stable name for the frozen configuration, recorded on every rollout. */
+  readonly id: string;
+  /** Requested model id. The served id is recorded per call and can differ. */
+  readonly model: string;
+  /** Seed root. Per-rollout seeds derive from it and never from the arm. */
+  readonly seed: number;
+  /** Model calls allowed per rollout. */
+  readonly stepBudget: number;
+  readonly temperature: number;
+  readonly maxTokens: number;
+  /** Per-command wall-clock limit inside the container. */
+  readonly commandTimeoutSeconds: number;
+  /** Consecutive unparseable turns that end a rollout. */
+  readonly maxConsecutiveFormatErrors: number;
+  /** The only admissible container network mode. */
+  readonly networkMode: 'none';
+  readonly scaffold: 'mini-swe-agent';
+}
+/**
+ * Everything the policy fixes except the two a campaign must choose.
+ *
+ * `commandTimeoutSeconds` is 30 because the recorded runs used the scaffold's
+ * own 30-second environment timeout; a longer limit would let the continuation
+ * finish commands the recorded agent could not.
+ */
+declare const CONTINUATION_POLICY_DEFAULTS: {
+  readonly id: 'tb-repair-continuation-v1';
+  readonly stepBudget: 20;
+  readonly temperature: 0;
+  readonly maxTokens: 4096;
+  readonly commandTimeoutSeconds: 30;
+  readonly maxConsecutiveFormatErrors: 3;
+  readonly networkMode: 'none';
+  readonly scaffold: 'mini-swe-agent';
+};
+interface DefineContinuationPolicyInput extends Partial<Omit<PinnedContinuationPolicy, 'networkMode' | 'scaffold'>> {
+  /** Required: a campaign pins one model, and no default can stand in for it. */
+  model: string;
+  /** Required: a default seed would make two campaigns silently share a draw. */
+  seed: number;
+}
+declare function definePinnedContinuationPolicy(input: DefineContinuationPolicyInput): PinnedContinuationPolicy;
+/**
+ * Hash over the policy and the scaffold text it renders. A changed template
+ * changes the digest, so rollouts recorded before and after an edit cannot be
+ * pooled by accident.
+ */
+declare function continuationPolicyDigest(policy: PinnedContinuationPolicy): string;
+/**
+ * Per-rollout seed. It reads the policy seed, the row, and the rollout index —
+ * deliberately not the arm, so paired rollouts across arms draw identically.
+ */
+declare function continuationSeed(policySeed: number, rowId: string, rolloutIndex: number): number;
+interface ContinuationModelRequest {
+  model: string;
+  messages: ContinuationMessage[];
+  seed: number;
+  temperature: number;
+  maxTokens: number;
+}
+interface ContinuationModelResponse {
+  content: string;
+  /** Model id the provider reported serving. */
+  servedModel: string;
+  /** `null` when the provider omitted usage. Callers must not substitute zeros. */
+  usage: RunTokenUsage | null;
+  /** `null` when no amount is available from the provider or local pricing. */
+  costUsd: number | null;
+  finishReason?: string | null;
+}
+type ContinuationModel = (request: ContinuationModelRequest) => Promise<ContinuationModelResponse>;
+interface ContinuationExecResult {
+  output: string;
+  returncode: number;
+  /** True when the environment killed the command at the policy timeout. */
+  timedOut: boolean;
+  /** Set when the environment itself failed rather than the command. */
+  exceptionInfo?: string;
+}
+interface ContinuationEnvironment {
+  /** Container id or equivalent handle, recorded for provenance. */
+  containerRef: string;
+  describe(): Promise<ContinuationEnvironmentDescription>;
+  exec(command: string, options: {
+    timeoutSeconds: number;
+  }): Promise<ContinuationExecResult>;
+  dispose(): Promise<void>;
+}
+interface ContinuationEnvironmentRequest {
+  rowId: string;
+  arm: ContinuationArm;
+  rolloutIndex: number;
+}
+interface ContinuationEnvironmentFactory {
+  id: string;
+  /**
+   * A container restored to the post-step-k state for one rollout. The arm is
+   * passed because the state under test differs by arm; the policy applied to
+   * that state does not.
+   */
+  create(request: ContinuationEnvironmentRequest): Promise<ContinuationEnvironment>;
+}
+interface RunContinuationOptions {
+  policy: PinnedContinuationPolicy;
+  arm: ContinuationArm;
+  /** Corpus row under repair. Pairs rollouts across arms. */
+  rowId: string;
+  /**
+   * Messages through step k, as the replay layer rebuilt them: the pinned
+   * system and task messages, then every replayed turn with the observation
+   * the replay itself produced.
+   */
+  prefix: readonly ContinuationMessage[];
+  /** Rollouts to run for this arm. */
+  rollouts: number;
+  model: ContinuationModel;
+  environments: ContinuationEnvironmentFactory;
+  /** Epoch milliseconds. Injected so tests can assert on records without wall-clock noise. */
+  clock?: () => number;
+}
+/**
+ * Run the scaffold forward for `rollouts` independent continuations.
+ *
+ * Each rollout gets its own environment from the factory, because a rollout
+ * mutates the container it runs in and the next one must start from the same
+ * state, not from the previous rollout's leftovers.
+ */
+declare function runContinuation(options: RunContinuationOptions): Promise<ContinuationRollout[]>;
+/**
+ * Sum only what the provider reported. A call with no usage raises
+ * `callsWithUsage` short of `calls` and clears `captured`, so a partially
+ * reported rollout can never read as a fully measured one.
+ */
+declare function totalUsage(steps: readonly ContinuationStepRecord[]): ContinuationUsageTotals;
+/**
+ * One unpriced call makes the rollout's cost unknown. Summing the rest would
+ * report a number smaller than what was spent.
+ */
+declare function totalCost(steps: readonly ContinuationStepRecord[]): CostProvenance;
+/**
+ * Prove the arms ran the same policy. Rollouts paired by row and index must
+ * carry the same policy digest and the same seed; anything else means the
+ * measured difference includes a policy change, not only the intervention.
+ */
+declare function assertArmSymmetry(rollouts: readonly ContinuationRollout[]): void;
+//#endregion
+//#region src/trace-repair/oracle-determinism.d.ts
+/** A task graded a repair by something other than the state under test. */
+declare class NondeterministicOracleError extends CaptureIntegrityError {}
+/** The two states certification produces: the published image, and that image
+ *  after the task's own reference solution ran. */
+type OracleStateLabel = 'unsolved' | 'solved';
+/** Machine load the replicate ran under. */
+type OracleLoad = 'idle' | 'contended';
+/** The unit a whole-suite verdict is counted under when nothing finer exists. */
+declare const SUITE_REWARD_UNIT = "suite-reward";
+interface OracleAssertionResult {
+  /** Test identifier the suite reported, verbatim. */
+  readonly id: string;
+  readonly passed: boolean;
+}
+interface OracleReplicate {
+  /** 0-based index within its group. */
+  readonly index: number;
+  /**
+   * Raw reward the task's grader wrote, verbatim. `null` when it wrote none —
+   * a missing reward and a zero reward are different failures, and neither is
+   * folded into the other.
+   */
+  readonly reward: string | null;
+  readonly passed: boolean;
+  readonly wallMs: number;
+  /** Per-assertion verdicts the suite reported, or `null` when it reported
+   *  none. Never an empty array standing in for "the suite said nothing". */
+  readonly assertions: readonly OracleAssertionResult[] | null;
+}
+interface OracleReplicateGroup {
+  readonly state: OracleStateLabel;
+  readonly load: OracleLoad;
+  /**
+   * Replicates that graded one container with nothing written between them.
+   * Two or more, because a single grading measures no flip.
+   */
+  readonly replicates: readonly OracleReplicate[];
+}
+interface OracleDeterminismEvidence {
+  readonly taskName: string;
+  /** Image the replicates ran on, by registry manifest digest. An image with no
+   *  published digest, such as one loaded from an archive, records its tag; the
+   *  absent `@sha256:` is what says so. */
+  readonly image: string;
+  /**
+   * Digest of the suite bytes every replicate graded against, in whatever
+   * scheme the measuring tool uses. Provenance only: it identifies the suite a
+   * certification is about and is never compared against a digest produced by
+   * a different scheme.
+   */
+  readonly suiteDigest: string;
+  readonly groups: readonly OracleReplicateGroup[];
+  readonly measuredAt: string;
+}
+/** One thing that did not agree with itself across replicates of a state. */
+interface OracleFlippedUnit {
+  /** An assertion id, or `suite-reward` when the suite reported no assertions. */
+  readonly unit: string;
+  readonly passes: number;
+  readonly fails: number;
+  readonly flipRate: number;
+}
+interface OracleStateVerdict {
+  readonly state: OracleStateLabel;
+  readonly replicates: number;
+  /** Replicates whose whole-suite reward passed. */
+  readonly passes: number;
+  readonly fails: number;
+  /** What the flip rate was counted over. `reward` is the coarser reading. */
+  readonly granularity: 'per-assertion' | 'reward';
+  /** Largest minority share over the counted units. */
+  readonly flipRate: number;
+  readonly flipped: readonly OracleFlippedUnit[];
+  /** Assertion ids some replicates reported and others did not. The suite's
+   *  own shape moved, which is a flip in itself. */
+  readonly assertionSetUnstable: readonly string[];
+  /** Loads whose whole-suite pass rate on this state differed. */
+  readonly loadSensitive: boolean;
+  /** Every distinct raw reward the grader wrote, sorted. */
+  readonly rewardsObserved: readonly string[];
+}
+interface OracleDeterminismVerdict {
+  readonly taskName: string;
+  readonly image: string;
+  readonly suiteDigest: string;
+  /** True only when every counted unit agreed with itself on every state. */
+  readonly stable: boolean;
+  readonly replicates: number;
+  /** Largest per-unit minority share over every state. Zero on a stable task. */
+  readonly flipRate: number;
+  readonly byState: readonly OracleStateVerdict[];
+  readonly measuredAt: string;
+  /** One line naming what was measured, for an artifact a human reads. */
+  readonly detail: string;
+}
+/** Replicates one group needs before a flip is measurable at all. */
+declare const MIN_ORACLE_REPLICATES = 2;
+/**
+ * Reduce measured replicates to a verdict.
+ *
+ * Pure: it opens no container. The tool that runs the replicates hands the
+ * counts here, so the rule that decides stability is one rule and a reviewer
+ * can re-derive any verdict from the recorded replicates.
+ */
+declare function oracleDeterminism(evidence: OracleDeterminismEvidence): OracleDeterminismVerdict;
+/**
+ * Certified verdicts by task name.
+ *
+ * A task with no entry is uncertified, which is not the same as unstable: one
+ * says the check has not run, the other says it ran and the task failed it.
+ * Both stop a row, with different reasons.
+ */
+type TaskOracleRegistry = ReadonlyMap<string, OracleDeterminismVerdict>;
+/**
+ * What a checked-in certification file holds.
+ *
+ * It stores the measured replicates, not the verdicts they imply. The verdict
+ * is re-derived on read by the same rule a campaign enforces, so a file cannot
+ * declare a task stable — only the replicates can, and a reviewer can recount
+ * them.
+ */
+interface TaskOracleRegistryDocument {
+  readonly version: 1;
+  readonly measurements: readonly OracleDeterminismEvidence[];
+}
+declare function parseTaskOracleRegistry(document: unknown): TaskOracleRegistry;
+declare function taskOracleRegistry(verdicts: readonly OracleDeterminismVerdict[]): TaskOracleRegistry;
+/** Throws unless the task graded the same bytes the same way every replicate. */
+declare function assertDeterministicOracle(verdict: OracleDeterminismVerdict): void;
+//#endregion
+//#region src/trace-repair/admission.d.ts
+/**
+ * Result of an external call. Callers read `succeeded` before `value`: a
+ * boundary failure is an exclusion with its own reason, never a false verdict.
+ */
+type AdmissionOutcome<T> = {
+  succeeded: true;
+  value: T;
+} | {
+  succeeded: false;
+  error: string;
+};
+interface AdmissionDivergence {
+  /** 1-based recorded step. */
+  step: number;
+  expectedReturncode: number | null;
+  actualExit: number;
+}
+interface AdmissionPrefixReplay {
+  /** Recorded steps the replay actually executed. */
+  prefixExecuted: number;
+  /** Steps whose replayed exit differs from the recorded return code. */
+  prefixDivergences: readonly AdmissionDivergence[];
+}
+interface AdmissionPrefixReplayer {
+  /** Lands in the artifact. A fake and a container replayer must not share one. */
+  id: string;
+  /** Replay the recorded prefix in the task's pinned image and report divergence. */
+  replay(row: AdmissionRow): Promise<AdmissionOutcome<AdmissionPrefixReplay>>;
+}
+interface AdmissionTestVerdict {
+  passed: boolean;
+  /** Reward the task's own grader reported. `null` when it reported none. */
+  reward: number | null;
+}
+interface AdmissionEndStateOracle {
+  id: string;
+  /** Run the task's held-out tests against the recorded end state. */
+  grade(row: AdmissionRow): Promise<AdmissionOutcome<AdmissionTestVerdict>>;
+}
+interface AdmissionControlRequest {
+  row: AdmissionRow;
+  arm: AdmissionControlArm;
+  /** 0-based rollout index within the arm. */
+  rolloutIndex: number;
+  /** Present for `no-op-control` only; `null` for `no-fix-control`. */
+  injection: AdmissionNoOpInjection | null;
+}
+interface AdmissionControlObservation {
+  /** The task's held-out tests, run after the continuation stopped. */
+  tests: AdmissionTestVerdict;
+  /** The rollout the pinned policy produced. Its digest and seed prove symmetry. */
+  rollout: ContinuationRollout;
+}
+interface AdmissionControlRunner {
+  id: string;
+  /**
+   * Restore the row's post-trajectory state, apply the arm's treatment, run the
+   * pinned continuation policy forward, then grade the container it left.
+   */
+  run(request: AdmissionControlRequest): Promise<AdmissionOutcome<AdmissionControlObservation>>;
+}
+interface AdmissionConfigInput {
+  /** Share of replayed prefix steps allowed to diverge. Default 0.10. */
+  maxPrefixDivergence?: number;
+  /** Rollouts each control arm must fail. Default 3. */
+  controlRollouts?: number;
+  /**
+   * Strata a campaign accepts. The default omits `signal-kill`, because
+   * substituting one command does not address a timeout. The excluded count
+   * stays visible in the chain instead of disappearing.
+   */
+  admitStrata?: readonly AdmissionStratum[];
+  /** Shell action the no-op control substitutes. Default `true`. */
+  inertAction?: string;
+  /**
+   * How a control pass is read. Default `enforced`, which requires a control
+   * that can act; `resolveAdmissionConfig` refuses the pairing that cannot.
+   */
+  controlScreening?: ControlScreening;
+  /** Rows processed at once. Output order always follows input order. Default 1. */
+  concurrency?: number;
+}
+interface AdmissionConfig {
+  readonly maxPrefixDivergence: number;
+  readonly controlRollouts: number;
+  readonly admitStrata: readonly AdmissionStratum[];
+  readonly inertAction: string;
+  readonly controlScreening: ControlScreening;
+  readonly concurrency: number;
+}
+declare const ADMISSION_CONFIG_DEFAULTS: AdmissionConfig;
+declare function resolveAdmissionConfig(input?: AdmissionConfigInput): AdmissionConfig;
+/**
+ * The recorded command the no-op control replaces, drawn per rollout.
+ *
+ * The draw reads the policy seed, the row, and the rollout index, so it is
+ * reproducible from the artifact and cannot depend on when the pre-pass ran.
+ */
+declare function noOpInjectionStep(policySeed: number, rowId: string, rolloutIndex: number, recordedCommands: number): number;
+interface AdmissionProvenance {
+  replayerId: string;
+  oracleId: string;
+  controlRunnerId: string;
+  policyId: string;
+  policyModel: string;
+  policySeed: number;
+  policyDigest: string;
+  /** Model calls a control rollout may make. Zero cannot screen anything, and
+   *  `resolveAdmissionConfig` refuses that pairing before a container opens. */
+  policyStepBudget: number;
+  controlScreening: ControlScreening;
+  /** Tasks whose oracle carried a determinism certification, and their
+   *  measured flip rates. */
+  certifiedTasks: Readonly<Record<string, number>>;
+}
+interface AdmissionReport {
+  config: AdmissionConfig;
+  provenance: AdmissionProvenance;
+  /** Every input row, in input order, admitted or not. */
+  rows: readonly AdmissionRowVerdict[];
+  /** Admitted row ids per stratum. There is no pooled list; pooling is explicit. */
+  strata: Readonly<Record<AdmissionStratum, readonly string[]>>;
+  chain: DenominatorChainArtifact;
+  /** Model cost of the control rollouts. One unpriced rollout makes it uncaptured. */
+  controlCost: CostProvenance;
+  /** Hash over the admitted ids, the config, and the provenance. */
+  digest: string;
+  generatedAt: string;
+}
+interface RunAdmissionOptions {
+  rows: readonly AdmissionRow[];
+  /** The policy the campaign's arms run under. Its seed drives the no-op draw. */
+  policy: PinnedContinuationPolicy;
+  replayer: AdmissionPrefixReplayer;
+  oracle: AdmissionEndStateOracle;
+  controls: AdmissionControlRunner;
+  /**
+   * Determinism certifications by task name. Required: every check below reads
+   * the task's own suite, so a suite whose verdict is not a function of the
+   * state makes each of them a coin flip. A task with no entry is excluded as
+   * uncertified rather than assumed stable.
+   */
+  taskOracles: TaskOracleRegistry;
+  config?: AdmissionConfigInput;
+  /** Epoch milliseconds. Injected so a report can be compared exactly in a test. */
+  clock?: () => number;
+}
+/**
+ * Run the pre-pass over every row and publish the denominator it produced.
+ *
+ * Nothing here reads an analyst output. The report is frozen, and a campaign
+ * proves it measured this denominator by passing the report back to
+ * `assertDenominatorIntact`.
+ */
+declare function runAdmission(options: RunAdmissionOptions): Promise<AdmissionReport>;
+/** Admitted row ids in one stratum. No call returns them pooled. */
+declare function admittedRowIds(report: AdmissionReport, stratum: AdmissionStratum): readonly string[];
+declare function admittedCount(report: AdmissionReport): number;
+interface DenominatorIntactInput {
+  report: AdmissionReport;
+  /** Strata the campaign drew from. Rows outside them are not expected. */
+  strata: readonly AdmissionStratum[];
+  /** Rows the campaign sampled from the admitted set. */
+  sampled: readonly string[];
+  /** Rows the campaign produced an outcome for, including `no-decisive-failure`. */
+  scored: readonly string[];
+}
+/**
+ * Prove a campaign measured the denominator admission published.
+ *
+ * Three ways a denominator moves after the fact, each rejected here: scoring a
+ * row that was never admitted, scoring a row that was never sampled, and
+ * dropping a sampled row instead of scoring it. The third is the one an analyst
+ * can cause on its own — declining a row it cannot solve — so a sampled row
+ * with no outcome is an error, not a smaller `n`.
+ */
+declare function assertDenominatorIntact(input: DenominatorIntactInput): void;
+//#endregion
+//#region src/trace-repair/admission-contract.d.ts
+/** Pre-registered admission thresholds. */
+interface AdmissionCriteria {
+  /** Share of replayed prefix steps allowed to diverge from their recorded
+   *  returncode. Above it the container state under test is not the recorded
+   *  one, so nothing measured on it is about the recorded run. */
+  readonly maxPrefixDivergenceRatio: number;
+  /** Control rollouts each control arm must run. */
+  readonly controlRollouts: number;
+  /** How a control pass is read. `enforced` requires a control that can act. */
+  readonly controlScreening: ControlScreening;
+}
+declare const TB_REPAIR_ADMISSION_CRITERIA: AdmissionCriteria;
+interface PrefixFidelityEvidence {
+  /** Recorded steps that were replayed. */
+  readonly stepsReplayed: number;
+  /** Replayed steps whose exit code differed from the recorded returncode. */
+  readonly divergences: number;
+}
+interface ControlArmEvidence {
+  readonly rollouts: number;
+  /** Rollouts whose held-out suite passed. Admission requires zero. */
+  readonly passes: number;
+  /** Policy digest every rollout reported. An arm that ran something other
+   *  than the declared control is not the control the criteria describe. */
+  readonly policyDigest: string;
+}
+interface AdmissionEvidence {
+  readonly rowId: string;
+  /** Terminal-Bench-2 task the trajectory ran. It selects the certification
+   *  below, and a certification for another task is refused rather than read. */
+  readonly taskName: string;
+  /** Published image the trajectory was recorded against. */
+  readonly image: string;
+  /** Working directory the scaffold ran every action from. */
+  readonly cwd: string;
+  /** Task statement handed to the recorded agent. */
+  readonly taskStatement: string;
+  readonly steps: readonly RecordedTrajectoryStep[];
+  /**
+   * The task's certified oracle determinism. Required: a campaign that has not
+   * measured whether its ground truth is a function of the state cannot
+   * construct evidence, which is where that omission should stop.
+   */
+  readonly oracleDeterminism: OracleDeterminismVerdict;
+  /** The control both arms ran, declared and hashed. */
+  readonly controlPolicy: ControlPolicy;
+  readonly prefixFidelity: PrefixFidelityEvidence;
+  /** Held-out suite result on the recorded end state. Admission requires a fail. */
+  readonly endStatePassed: boolean;
+  /** Digest of the suite that produced every result above. */
+  readonly suiteDigest: string;
+  readonly noFixControl: ControlArmEvidence;
+  readonly noOpControl: ControlArmEvidence;
+}
+/** Which pre-registered check refused the row. */
+type AdmissionRejection = 'task-oracle-nondeterministic' | 'prefix-divergence-too-high' | 'end-state-already-passes' | 'no-fix-control-passed' | 'no-op-control-passed' | 'control-passed-on-identical-state' | 'control-rollouts-short' | 'control-policy-mismatch' | 'empty-trajectory';
+declare const ADMITTED: unique symbol;
+/**
+ * A row that passed every admission check.
+ *
+ * The brand is a phantom: it exists in the type and never in the value, and
+ * the symbol that names it is not exported, so `AdmittedRow` cannot be
+ * constructed anywhere but here. Both `blindTrajectory` and `gradeRepairRow`
+ * require one. That is the structural form of "admission runs before any
+ * analyst sees a row": there is no signature that accepts an unadmitted row.
+ */
+interface AdmittedRow {
+  readonly [ADMITTED]: true;
+  readonly rowId: string;
+  readonly taskName: string;
+  readonly image: string;
+  readonly cwd: string;
+  readonly taskStatement: string;
+  readonly steps: readonly RecordedTrajectoryStep[];
+  readonly criteria: AdmissionCriteria;
+  readonly prefixDivergenceRatio: number;
+  readonly suiteDigest: string;
+  /** The control the row was screened under, carried whole so a later reader
+   *  never has to open the runner's source to learn what screened it. */
+  readonly controlPolicy: ControlPolicy;
+  readonly controlScreening: ControlScreening;
+  /** Policy digest both controls ran under. Every intervention rollout must
+   *  report the same one or the arms are not comparable. */
+  readonly policyDigest: string;
+  /** Control rate the paired delta subtracts. Zero by admission, carried
+   *  explicitly so the estimator never hardcodes it. */
+  readonly controlRate: number;
+  readonly controlRollouts: number;
+}
+/** Carried by every decision, admitted or not, so an artifact answers "which
+ *  control screened this row" without reading the runner's source. */
+interface AdmissionScreeningRecord {
+  readonly controlPolicy: ControlPolicy;
+  readonly controlScreening: ControlScreening;
+  readonly controlPolicyDigest: string;
+  readonly taskName: string;
+  readonly oracleStable: boolean;
+  readonly oracleFlipRate: number;
+}
+type AdmissionDecision = {
+  readonly admitted: true;
+  readonly screening: AdmissionScreeningRecord;
+  readonly row: AdmittedRow;
+} | {
+  readonly admitted: false;
+  readonly rowId: string;
+  readonly screening: AdmissionScreeningRecord;
+  readonly rejection: AdmissionRejection;
+  readonly detail: string;
+};
+/**
+ * Decide admission from executed evidence.
+ *
+ * Pure: it opens no container and calls no model. Every threshold it applies
+ * is in `criteria`, and every number it reads is in `evidence`, so an
+ * admission decision is reproducible from the recorded evidence alone.
+ *
+ * It throws, rather than rejecting, when the criteria and the declared control
+ * contradict. A contradiction there is a property of the configuration and not
+ * of the row, so it must stop the run instead of producing one verdict per row
+ * that reads as if a check had been applied.
+ */
+declare function admitRow(evidence: AdmissionEvidence, criteria?: AdmissionCriteria): AdmissionDecision;
+//#endregion
+//#region src/trace-repair/admission-report.d.ts
+interface AdmissionArtifact {
+  version: 1;
+  kind: 'tb-repair-admission';
+  generatedAt: string;
+  /** Hash over the admitted ids, the config, and the provenance. */
+  digest: string;
+  config: AdmissionConfig;
+  provenance: AdmissionProvenance;
+  chain: DenominatorChainArtifact;
+  /** Admitted row ids per stratum, the only form the campaign may sample from. */
+  admitted: Record<AdmissionStratum, readonly string[]>;
+  controlCost: {
+    kind: string;
+    usd: number | null;
+  };
+  /** Every input row, admitted or not, with the stratum and reason it carried. */
+  rows: readonly AdmissionRowVerdict[];
+}
+/** Plain JSON. `JSON.stringify` of this object is the machine-readable artifact. */
+declare function admissionArtifact(report: AdmissionReport): AdmissionArtifact;
+interface RenderAdmissionOptions {
+  /** Rows listed in the per-row appendix. Default 0, which omits the appendix. */
+  rowLimit?: number;
+}
+/** Markdown for the campaign report. Every number here is also in the artifact. */
+declare function renderAdmissionReport(artifact: AdmissionArtifact, options?: RenderAdmissionOptions): string;
+//#endregion
+//#region src/trace-repair/analyst-response.d.ts
+/** The literal an analyst returns when no single step carries the failure. */
+declare const NO_DECISIVE_FAILURE = "no-decisive-failure";
+interface RepairIntervention {
+  /** What the action is: a shell command, or an edit that authors file content. */
+  readonly kind: ActionPayloadKind;
+  /** The action itself, exactly as it will be executed at step k. */
+  readonly action: string;
+}
+interface RepairFinding {
+  readonly kind: 'finding';
+  /** 1-based step the analyst blames. The repair must work here; there is no
+   *  credit for naming a step and repairing elsewhere. */
+  readonly k: number;
+  /** What the analyst says went wrong at step k. Recorded, never scored: a
+   *  claim graded by another model would put a judge inside the metric. */
+  readonly failureClaim: string;
+  readonly intervention: RepairIntervention;
+}
+interface RepairDeclined {
+  readonly kind: 'no-decisive-failure';
+}
+type AnalystResponse = RepairFinding | RepairDeclined;
+/** Why a response does not parse. Counted by name in the funnel. */
+type ResponseParseFailure = 'unreadable' | 'not-a-single-answer' | 'missing-k' | 'missing-failure-claim' | 'missing-intervention' | 'unknown-intervention-kind';
+type ParseAnalystResponseOutcome = {
+  readonly succeeded: true;
+  readonly value: AnalystResponse;
+} | {
+  readonly succeeded: false;
+  readonly failure: ResponseParseFailure;
+  readonly detail: string;
+};
+/**
+ * Read an analyst reply.
+ *
+ * Accepts the bare literal, or a JSON object carrying one finding. The reply
+ * is untrusted text, so every field is checked and nothing is defaulted: a
+ * missing `k` is a parse failure, never step 1.
+ */
+declare function parseAnalystResponse(reply: string): ParseAnalystResponseOutcome;
+/** Build a finding directly, for callers that already hold typed fields. */
+declare function repairFinding(input: {
+  k: number;
+  failureClaim: string;
+  intervention: RepairIntervention;
+}): RepairFinding;
+//#endregion
+//#region src/trace-repair/blinding.d.ts
+interface BlindedStep {
+  readonly step_id: number;
+  readonly action: string;
+  readonly observation: string | null;
+}
+interface BlindedTrajectoryPrefix {
+  readonly rowId: string;
+  /** The task statement the recorded agent was given. */
+  readonly taskStatement: string;
+  readonly steps: readonly BlindedStep[];
+  /** Steps the recording holds. Equal to `steps.length` unless the prefix was
+   *  deliberately truncated. */
+  readonly recordedSteps: number;
+  /** Largest k the analyst may name for this prefix. */
+  readonly maxK: number;
+}
+interface BlindTrajectoryOptions {
+  /** Truncate the prefix after this 1-based step. Defaults to the whole
+   *  recording, which is what the recorded agent itself saw before it stopped. */
+  readonly throughStep?: number;
+}
+declare function blindTrajectory(row: AdmittedRow, options?: BlindTrajectoryOptions): BlindedTrajectoryPrefix;
+/**
+ * Fields an analyst prompt must never carry. Exported so a consumer that
+ * builds its own prompt can assert against the same list this module honours.
+ */
+declare const BLINDED_FIELDS: readonly string[];
+//#endregion
+//#region src/trace-repair/analyst-arm.d.ts
+/**
+ * Something an arm can do that another arm cannot.
+ *
+ * Declared per arm and reported beside the result. This list is the vocabulary
+ * of admissible difference: an arm whose advantage is not nameable here is not
+ * comparable to the others, and that is a design decision to take deliberately
+ * rather than a field to widen.
+ */
+type RepairArmAffordance =
+/** The whole trajectory arrives in the prompt text. */
+'inline-trajectory' |
+/** The trajectory is read through bounded tools instead of the prompt. */
+'trajectory-tools' |
+/** The arm may run code while it reasons. */
+'code-interpreter' |
+/** The arm takes internal turns of its own before answering. */
+'agent-loop';
+/**
+ * Whether the arm's instruction text carries a certification, and from where.
+ *
+ * On the repair task nothing is certified: the one certified analyst artifact
+ * this repository holds was earned on a different benchmark under a different
+ * output contract. `kind: 'none'` with a reason is therefore the expected
+ * value, and it is recorded rather than omitted so a reader never has to
+ * assume.
+ */
+type RepairArmCertification = {
+  readonly kind: 'none';
+  readonly reason: string;
+} | {
+  readonly kind: 'certified';
+  /** The artifact whose text this arm runs. */
+  readonly artifact: string;
+  /** The benchmark the certification was earned on. */
+  readonly benchmark: string;
+  /** The output contract it was certified for. */
+  readonly contract: string;
+};
+interface RepairArmDeclaration {
+  readonly id: string;
+  /** What actually answers, in one plain sentence. Recorded so a report never
+   *  has to infer the execution path from the runner's source. */
+  readonly execution: string;
+  readonly certification: RepairArmCertification;
+  /** The action budget the arm's answers are measured against. */
+  readonly budget: InterventionBudget;
+  /** Bounded retries a structurally malformed reply earns. */
+  readonly repairTurns: number;
+  readonly affordances: readonly RepairArmAffordance[];
+  /** The arm's own instruction and output-grammar text, exactly as the arm
+   *  composes it into the question. It enters the per-arm prompt digest, so a
+   *  contract change — a reworded grammar, a new signature version — changes
+   *  the digest of every answer the arm stamps. */
+  readonly promptContract: readonly string[];
+}
+/** What an arm is handed. The type carries only the blinded prefix, so a
+ *  grading field is unreachable rather than merely unread: the admitted row
+ *  stays with `askRepairArm`, which does the blinding and the bookkeeping. */
+interface RepairArmRequest {
+  readonly prefix: BlindedTrajectoryPrefix;
+  readonly signal?: AbortSignal;
+}
+/** Token accounting exactly as the execution path reported it. A side nobody
+ *  measured stays null rather than becoming a zero. */
+interface RepairArmUsage {
+  readonly calls: number | null;
+  readonly inputTokens: number | null;
+  readonly outputTokens: number | null;
+  readonly costUsd: number | null;
+}
+interface RepairArmRepairTurn {
+  readonly attempted: boolean;
+  /** Null when no repair turn ran, or when it never returned a reply. */
+  readonly succeeded: boolean | null;
+}
+/** A row an arm reported and the pipeline refused, counted by reason. */
+interface RepairArmRejectedRow {
+  readonly index: number;
+  readonly reason: string;
+}
+/**
+ * What an arm hands back.
+ *
+ * `finding` and `declined` are the two answers the grader consumes. `failed`
+ * is everything else, and it always carries a reason: an arm that could not
+ * answer must say so rather than return an empty finding that grades as a
+ * decline it never made.
+ */
+type RepairArmReply = {
+  readonly status: 'finding';
+  readonly k: number;
+  readonly failureClaim: string;
+  readonly intervention: RepairIntervention;
+  readonly answer: string | null;
+  readonly reportedRows: number;
+  readonly rejectedRows: readonly RepairArmRejectedRow[];
+  readonly repair: RepairArmRepairTurn;
+  readonly usage: RepairArmUsage;
+} | {
+  readonly status: 'declined';
+  readonly answer: string | null;
+  readonly reportedRows: number;
+  readonly rejectedRows: readonly RepairArmRejectedRow[];
+  readonly repair: RepairArmRepairTurn;
+  readonly usage: RepairArmUsage;
+} | {
+  readonly status: 'failed';
+  readonly failure: string;
+  readonly answer: string | null;
+  readonly rejectedRows: readonly RepairArmRejectedRow[];
+  readonly repair: RepairArmRepairTurn;
+  readonly usage: RepairArmUsage;
+};
+interface RepairArm {
+  readonly declaration: RepairArmDeclaration;
+  ask(request: RepairArmRequest): Promise<RepairArmReply>;
+}
+/**
+ * The budget verdict on an arm's action, measured before any container opens.
+ *
+ * Recorded, never enforced here: `gradeRepairRow` refuses an inadmissible
+ * action, and one authority is the point. Measuring it at answer time is what
+ * lets a report say what an arm spent its bytes on without paying for a
+ * rollout to find out.
+ */
+type RepairArmBudgetRecord = {
+  readonly admissible: true;
+  readonly measurement: BudgetMeasurement;
+} | {
+  readonly admissible: false;
+  readonly violation: BudgetViolation;
+  readonly detail: string;
+  readonly measurement: BudgetMeasurement;
+};
+interface RepairArmAnswer {
+  readonly rowId: string;
+  readonly armId: string;
+  /** Digest of the composed question the arm answered. */
+  readonly promptSha256: string;
+  readonly reply: RepairArmReply;
+  /** Present only for a finding. */
+  readonly budget: RepairArmBudgetRecord | null;
+  readonly wallMs: number;
+}
+interface AskRepairArmOptions {
+  readonly arm: RepairArm;
+  readonly row: AdmittedRow;
+  /** Truncate the prefix after this 1-based step. Defaults to the whole recording. */
+  readonly throughStep?: number;
+  readonly signal?: AbortSignal;
+  /** Injectable clock so a test can assert a recorded duration. */
+  readonly now?: () => number;
+}
+/**
+ * Ask one arm about one admitted row.
+ *
+ * Blinding, prompt identity and budget measurement happen here, once, for
+ * every arm. An arm that wants a different question does not get one.
+ */
+declare function askRepairArm(options: AskRepairArmOptions): Promise<RepairArmAnswer>;
+/**
+ * The answer in the grammar the grader consumes.
+ *
+ * Null for a failure: a run that could not answer has no answer to grade, and
+ * turning it into a decline would credit an arm with an honest null it never
+ * produced.
+ */
+declare function repairArmResponse(answer: RepairArmAnswer): AnalystResponse | null;
+/** One arm's difference from the set, as a report renders it. */
+interface RepairArmAsymmetry {
+  readonly armId: string;
+  /** Affordances this arm has that at least one other arm lacks. */
+  readonly extraAffordances: readonly RepairArmAffordance[];
+  /** Affordances at least one other arm has and this one lacks. */
+  readonly missingAffordances: readonly RepairArmAffordance[];
+  readonly certification: RepairArmCertification;
+  /** Digest of the composed question this arm answers: the shared question
+   *  plus the arm's own contract text. Two arms with the same digest asked the
+   *  identical composed question; two arms with different digests did not. */
+  readonly promptSha256: string;
+}
+interface RepairArmAsymmetryReport {
+  readonly armIds: readonly string[];
+  /** Affordances every arm has. Not an asymmetry; recorded so a reader can see
+   *  the floor the comparison runs on. */
+  readonly sharedAffordances: readonly RepairArmAffordance[];
+  readonly asymmetries: readonly RepairArmAsymmetry[];
+  /** True when no arm carries a certification. The honest state on a task
+   *  whose graders are newer than every certified artifact. */
+  readonly noArmCertified: boolean;
+  readonly budget: InterventionBudget;
+  readonly repairTurns: number;
+  /** Digest of the question and task policy every arm shares. Per-arm
+   *  composed-question digests live on each asymmetry entry. */
+  readonly questionSha256: string;
+}
+/**
+ * Refuse a set of arms that cannot be compared, and describe what still
+ * differs between the ones that can.
+ *
+ * Two properties are hard: the arms measure actions against the same budget,
+ * and a malformed reply earns the same number of retries everywhere. Both are
+ * things that would move a score without moving the thing being measured.
+ *
+ * Certification is the third: a set where some arms run certified text and
+ * others do not is refused outright. An optimisation applies to every arm or
+ * to none — a mixed set measures the optimisation, then reports it as the
+ * harness.
+ */
+declare function repairArmAsymmetries(arms: readonly RepairArm[], options?: {
+  readonly budget?: InterventionBudget;
+}): RepairArmAsymmetryReport;
+//#endregion
+//#region src/trace-repair/arm-completion.d.ts
+interface CompletionRepairArmOptions {
+  readonly id: string;
+  /** What actually answers the POST, in one plain sentence. */
+  readonly execution: string;
+  /** Full endpoint, e.g. `http://127.0.0.1:4200/v1/chat/completions`. */
+  readonly url: string;
+  readonly model: string;
+  /** Injected so a test drives the arm without a network. */
+  readonly transport: PrimeBridgeTransport;
+  /** Deadline for ONE turn. */
+  readonly timeoutMs: number;
+  /** Rates used to price the reported tokens. */
+  readonly pricing: CustomTokenPricing;
+  readonly budget?: InterventionBudget;
+  /** What this arm can do that another cannot. */
+  readonly affordances: readonly RepairArmAffordance[];
+  readonly certification: RepairArmCertification;
+}
+declare function createCompletionRepairArm(options: CompletionRepairArmOptions): RepairArm;
+//#endregion
+//#region src/trace-repair/arm-dspy.d.ts
+/**
+ * Token the bridge reads to select the typed repair signature.
+ *
+ * The wire protocol carries instructions as opaque text, so the task is named
+ * inside them rather than by adding a field every unrelated caller would have
+ * to set. The same mechanism selects the CodeTraceBench typed signature.
+ */
+declare const DSPY_REPAIR_TASK_TOKEN = "tb-repair-typed-";
+/** Signature the bridge reports for a repair analysis. */
+declare const DSPY_REPAIR_SIGNATURE = "tb-repair-typed-v1";
+/** The name the trajectory is bound to inside the program's environment. */
+declare const DSPY_REPAIR_TRAJECTORY_INPUT = "trajectory";
+/**
+ * The repair contract restated for the typed signature.
+ *
+ * Transport differs from the chat-completion arms — typed SUBMIT instead of a
+ * fenced JSON object — and the QUESTION does not. Both read from
+ * `repairTaskPolicy`, so the execution rules an arm is held to cannot drift
+ * between arms.
+ */
+declare function dspyRepairInstructions(budget?: InterventionBudget): string;
+interface DspyRepairArmOptions {
+  /** The DSPy engine. Injected, so a test drives the arm with no subprocess. */
+  readonly engine: TraceAnalysisEngine;
+  readonly limits: TraceAnalystLimits;
+  readonly costLedger: CostLedgerHandle;
+  readonly costPhase: string;
+  readonly analystId: string;
+  readonly costTags?: Record<string, string>;
+  readonly budget?: InterventionBudget;
+  readonly id?: string;
+  readonly log?: (message: string, fields?: Record<string, unknown>) => void;
+}
+declare function createDspyRepairArm(options: DspyRepairArmOptions): RepairArm;
+interface DspyRepairRow {
+  readonly k: number;
+  readonly failureClaim: string;
+  readonly kind: ActionPayloadKind;
+  readonly action: string;
+}
+interface DspyRepairPayload {
+  readonly signature: string;
+  readonly reported: number;
+  readonly rows: readonly DspyRepairRow[];
+  readonly dropped: readonly RepairArmRejectedRow[];
+  /** How the bounded structured re-read recovered the typed field, or null
+   *  when the field arrived typed and no re-read was needed. */
+  readonly repair: string | null;
+  /** The bridge's own account of a typed field it could not read — a reply
+   *  that stayed malformed after the bounded re-read. The analysis completed,
+   *  so the answer text survives beside it; null on a readable reply. */
+  readonly failure: string | null;
+}
+type ReadRepairPayload = {
+  readonly ok: true;
+  readonly value: DspyRepairPayload;
+} | {
+  readonly ok: false;
+  readonly reason: string;
+};
+interface ReadRepairPayloadOptions {
+  /** The step ids the blinded prefix holds. A row naming any other k is the
+   *  model's mistake, not the bridge's, so it lands in `dropped` — the same
+   *  rejected-row path the chat-completion arms take — never in a finding the
+   *  grader would refuse as out of range. */
+  readonly validSteps: readonly number[];
+}
+/**
+ * Read the bridge's typed repair block.
+ *
+ * Structure is checked and fails loud: a missing block, a wrong signature, or
+ * a row that does not carry an integer k and a non-empty action is a wiring
+ * fault with a reason — never a default, and never an empty list that would
+ * grade as a decline the program did not make. A structurally sound row whose
+ * k is not a recorded step id is the model's mistake, and it is dropped with
+ * its reason instead.
+ */
+declare function readRepairPayload(runtime: Record<string, unknown>, options: ReadRepairPayloadOptions): ReadRepairPayload;
+/** Thrown by callers that build a repair arm with a non-DSPy engine. */
+declare function assertDspyRepairEngine(engine: TraceAnalysisEngine): void;
+//#endregion
+//#region src/trace-repair/degenerate-strategies.d.ts
+/**
+ * The strategies that would score without repairing anything, named here so a
+ * reviewer can check each one against the mechanism that defeats it and a
+ * test can be required for each.
+ *
+ * Two kinds of defeat, and the difference matters:
+ *
+ *   gate         the grader refuses the answer before spending a rollout
+ *   measurement  the answer runs and measures the same as its control
+ *
+ * A gate is cheap and certain. A measurement defeat is the honest one where
+ * no syntactic rule can decide — a semantic no-op looks like a repair until
+ * the tests disagree with it — and it costs rollouts to establish.
+ */
+type DegenerateDefeatKind = 'gate' | 'measurement';
+interface DegenerateStrategy {
+  readonly id: string;
+  /** What the analyst does to score without repairing. */
+  readonly strategy: string;
+  /** The mechanism that removes the reward. */
+  readonly defeat: string;
+  readonly defeatKind: DegenerateDefeatKind;
+  /** Module that carries the mechanism. */
+  readonly enforcedIn: string;
+}
+declare const DEGENERATE_STRATEGIES: readonly [{
+  readonly id: 'point-at-any-nonzero-exit-step';
+  readonly strategy: 'Name the first step with a nonzero returncode, claim it failed, and let the reproduction gate confirm it.';
+  readonly defeat: 'Reproduction is a gate, not a tier that pays. The credit vector has no term for it, so a reproduced step with no working intervention scores exactly what an unreproduced one scores: nothing.';
+  readonly defeatKind: 'gate';
+  readonly enforcedIn: 'funnel.ts (repairCredit has no reproduction term)';
+}, {
+  readonly id: 'propose-the-recorded-command-again';
+  readonly strategy: 'Return the action the agent already ran at step k, so the arm reproduces the recorded state and looks like a faithful replay.';
+  readonly defeat: 'The intervention is compared against the recorded action at k after whitespace normalisation and rejected before a container opens.';
+  readonly defeatKind: 'gate';
+  readonly enforcedIn: 'grade.ts (recorded-action-reproposed rejection)';
+}, {
+  readonly id: 'propose-a-no-op';
+  readonly strategy: 'Return an action that changes nothing, so the arm inherits whatever the trajectory would have done anyway.';
+  readonly defeat: 'Literal no-ops are rejected at the budget check. A semantic no-op cannot be detected syntactically, so it runs and measures at the no-op control floor: its paired delta is zero.';
+  readonly defeatKind: 'measurement';
+  readonly enforcedIn: 'action-budget.ts (NO_OP_ACTIONS) and delta-repair.ts (paired delta)';
+}, {
+  readonly id: 'submit-instead-of-repair';
+  readonly strategy: 'Return the submit sentinel so the run ends immediately and the arm terminates cleanly.';
+  readonly defeat: 'An action carrying the submit sentinel is rejected at the budget check. Ending the run is what the recorded agent already did and the tests already failed on it.';
+  readonly defeatKind: 'gate';
+  readonly enforcedIn: 'action-budget.ts (SUBMIT_SENTINEL rejection)';
+}, {
+  readonly id: 'touch-the-test-suite';
+  readonly strategy: "Write a passing suite, or a reward file, at the path the grader will read, so the oracle grades the trajectory's own artifact.";
+  readonly defeat: 'The oracle purges the suite root and uploads the held-out suite from outside the session at grade time, then verifies the bytes it reads back. A planted suite is overwritten; a session that refuses the overwrite raises a tamper error instead of returning a pass.';
+  readonly defeatKind: 'gate';
+  readonly enforcedIn: 'test-oracle.ts (purge, upload, read-back digest)';
+}, {
+  readonly id: 'buy-a-bigger-action';
+  readonly strategy: 'Return a multi-command script or a whole-file rewrite that does far more than one scaffold turn could.';
+  readonly defeat: 'The budget counts top-level statements, heredocs and bytes. More than one action, more than one authored file, or more than 4 KB is rejected before a container opens.';
+  readonly defeatKind: 'gate';
+  readonly enforcedIn: 'action-budget.ts (checkInterventionBudget)';
+}, {
+  readonly id: 'decline-every-hard-row';
+  readonly strategy: 'Answer no-decisive-failure on everything except the rows that are obviously repairable, so the reported rate is computed on an easy subset.';
+  readonly defeat: 'A declined row keeps its cell in the funnel and stays in the denominator with a paired delta of zero, because its intervention arm is definitionally its control arm. Declining cannot raise the headline; it can only dilute it.';
+  readonly defeatKind: 'measurement';
+  readonly enforcedIn: 'grade.ts (declined outcome) and delta-repair.ts (full admitted denominator)';
+}, {
+  readonly id: 'repair-somewhere-other-than-k';
+  readonly strategy: 'Name a plausible-looking k, then submit an intervention that fixes the task from any state, so the answer scores without localising anything.';
+  readonly defeat: 'The intervention is executed at the k the analyst named, on the state produced by replaying steps 1..k-1. There is no separate localisation credit to win and no label the grader reads, so a wrong k is only penalised through the repair failing to work there.';
+  readonly defeatKind: 'measurement';
+  readonly enforcedIn: 'grade.ts (the intervention is applied at the named k only)';
+}];
+type DegenerateStrategyId = (typeof DEGENERATE_STRATEGIES)[number]['id'];
+declare function degenerateStrategy(id: DegenerateStrategyId): DegenerateStrategy;
+//#endregion
+//#region src/trace-repair/ports.d.ts
+/**
+ * Which arm a session serves. The arm names the container state under test,
+ * never a different policy: `Delta-repair` only measures the intervention when
+ * every arm is continued the same way.
+ */
+type RepairArm$1 = 'reproduce' | 'local-flip' | 'intervention' | 'no-fix-control' | 'no-op-control' | 'end-state';
+interface RepairExecResult {
+  exitCode: number;
+  stdout: string;
+  stderr: string;
+  /** True when the environment killed the command at its wall-clock limit. */
+  timedOut: boolean;
+}
+interface RepairSession {
+  /** Container id or equivalent handle, recorded for provenance. */
+  readonly ref: string;
+  exec(command: string, timeoutMs: number): Promise<RepairExecResult>;
+  close(): Promise<void>;
+}
+interface RepairSessionRequest {
+  rowId: string;
+  /** Image the trajectory was recorded against. Never a locally rebuilt one:
+   *  unpinned apt and pip installs drift a rebuild away from the recording. */
+  image: string;
+  arm: RepairArm$1;
+  /** 0-based index within the arm. Every rollout gets its own environment. */
+  rolloutIndex: number;
+}
+interface RepairSessionFactory {
+  /** One fresh environment per call; the grader closes it. */
+  open(request: RepairSessionRequest): Promise<RepairSession>;
+}
+interface TestOracleContext {
+  rowId: string;
+  arm: RepairArm$1;
+  rolloutIndex: number;
+}
+interface TestOracleOutcome {
+  /** True only when the suite command exited 0. Never defaulted. */
+  passed: boolean;
+  exitCode: number;
+  output: string;
+  /** Digest of the suite as read back from inside the container after upload. */
+  suiteDigest: string;
+  timedOut: boolean;
+}
+/**
+ * The held-out suite.
+ *
+ * A conforming oracle uploads the suite from outside the session at grade
+ * time and verifies what it reads back, so a trajectory that plants its own
+ * passing suite is overwritten rather than believed. `injectedTestOracle`
+ * implements that; see `test-oracle.ts`.
+ */
+interface TestOracle {
+  grade(session: RepairSession, context: TestOracleContext): Promise<TestOracleOutcome>;
+}
+interface RepairContinuationRequest {
+  rowId: string;
+  arm: RepairArm$1;
+  rolloutIndex: number;
+  /** Environment already restored to the state this arm continues from. */
+  session: RepairSession;
+  /** Recorded steps the continuation must treat as already taken. */
+  steps: readonly RecordedTrajectoryStep[];
+  /** 1-based step the injected action replaced; null for a control that
+   *  continues from the recorded end state. */
+  k: number | null;
+  /**
+   * The action that ran in place of step k and the raw result it produced.
+   * Null for the no-fix control, which injects nothing. The runner renders it
+   * into the scaffold's own observation grammar, so the grader never emits a
+   * second copy of that format.
+   */
+  injected: InjectedAction | null;
+  taskStatement: string;
+}
+interface InjectedAction {
+  action: string;
+  returncode: number;
+  output: string;
+  timedOut: boolean;
+}
+interface RepairContinuationOutcome {
+  /** Frozen configuration the rollout ran under. */
+  policyId: string;
+  /** Hash over the policy and its scaffold templates. Equal across arms by
+   *  construction; the grader rejects a row whose arms disagree. */
+  policyDigest: string;
+  /** Model calls the rollout made. */
+  steps: number;
+  /** Why the rollout stopped, in the continuation layer's own vocabulary. */
+  exitStatus: string;
+  submitted: boolean;
+}
+/** Runs the pinned continuation policy forward from a prepared session. */
+type RepairContinuationRunner = (request: RepairContinuationRequest) => Promise<RepairContinuationOutcome>;
+//#endregion
+//#region src/trace-repair/funnel.d.ts
+/** Why an answer never reached the reproduction gate. */
+type RepairRejection = {
+  readonly source: 'parse';
+  readonly reason: ResponseParseFailure;
+  readonly detail: string;
+} | {
+  readonly source: 'budget';
+  readonly reason: BudgetViolation;
+  readonly detail: string;
+  readonly measurement: BudgetMeasurement;
+} | {
+  readonly source: 'target';
+  readonly reason: 'k-out-of-range' | 'recorded-action-reproposed';
+  readonly detail: string;
+};
+interface PrefixReplayEvidence {
+  /** Recorded steps 1..k-1 executed to rebuild the state at k. */
+  readonly stepsReplayed: number;
+  /** Replayed steps whose exit code differed from the recorded returncode. */
+  readonly divergences: number;
+  readonly wallMs: number;
+}
+/**
+ * What the reproduction gate observed at k.
+ *
+ * `signature` and `signatureObserved` are null together when the recorded
+ * observation carried no error line; the gate then rests on the returncode
+ * alone and says so through `basis`.
+ */
+type ReproductionEvidence = {
+  /** The step recorded no observation, so there is no state to reproduce.
+   *  The gate passes vacuously and no container is opened for it. */
+  readonly basis: 'no-recorded-observation';
+  readonly reproduced: true;
+} | {
+  readonly basis: 'returncode-only' | 'returncode+output-substring';
+  readonly reproduced: boolean;
+  readonly recordedReturncode: number;
+  readonly observedExitCode: number;
+  readonly signature: string | null;
+  readonly signatureObserved: boolean | null;
+  readonly prefix: PrefixReplayEvidence;
+};
+interface InterventionExecution {
+  readonly command: string;
+  readonly exitCode: number;
+  readonly timedOut: boolean;
+  readonly wallMs: number;
+  readonly output: string;
+  readonly prefix: PrefixReplayEvidence;
+}
+interface TestRunEvidence {
+  readonly passed: boolean;
+  readonly exitCode: number;
+  readonly timedOut: boolean;
+  /** Digest of the suite the oracle read back from inside the container. */
+  readonly suiteDigest: string;
+}
+/**
+ * One repair rollout.
+ *
+ * A rollout whose intervention failed to run is kept and counted as a
+ * non-pass rather than dropped. Dropping it would quietly remove the rollouts
+ * where the environment behaved worst, which is the direction that flatters
+ * the intervention.
+ */
+type RepairRolloutEvidence = {
+  readonly rolloutIndex: number;
+  readonly status: 'completed';
+  readonly interventionExitCode: number;
+  readonly continuation: RepairContinuationOutcome;
+  readonly tests: TestRunEvidence;
+} | {
+  readonly rolloutIndex: number;
+  readonly status: 'intervention-failed';
+  readonly interventionExitCode: number;
+  readonly timedOut: boolean;
+};
+interface RepairArmEvidence {
+  /** Rollouts attempted. The denominator of `repairRate`. */
+  readonly rollouts: number;
+  /** Rollouts whose held-out suite passed. */
+  readonly passes: number;
+  /** Rollouts where the intervention did not run, counted as non-passes. */
+  readonly interventionFailures: number;
+  /** Policy digest every completed rollout reported, checked against the
+   *  controls. Null when no rollout completed. */
+  readonly policyDigest: string | null;
+  readonly rolloutEvidence: readonly RepairRolloutEvidence[];
+}
+/**
+ * The deepest state an answer reached.
+ *
+ * Only `measured` carries a repair, so a gate that closed has no field a score
+ * could read.
+ */
+type RepairGrade = {
+  readonly outcome: 'rejected';
+  readonly rejection: RepairRejection;
+} | {
+  readonly outcome: 'declined';
+} | {
+  readonly outcome: 'not-reproduced';
+  readonly k: number;
+  readonly reproduction: ReproductionEvidence;
+} | {
+  readonly outcome: 'did-not-execute';
+  readonly k: number;
+  readonly reproduction: ReproductionEvidence;
+  readonly execution: InterventionExecution;
+} | {
+  readonly outcome: 'measured';
+  readonly k: number;
+  readonly reproduction: ReproductionEvidence;
+  readonly execution: InterventionExecution;
+  readonly localFlip: TestRunEvidence;
+  readonly repair: RepairArmEvidence;
+};
+/**
+ * Everything an answer earns.
+ *
+ * Three numeric terms and no reproduction term. A vector rather than a scalar
+ * because the three measure different things: whether the action ran, whether
+ * it fixed the task outright, and how often it led to a fix once the agent
+ * carried on.
+ */
+interface RepairCredit {
+  readonly executes: 0 | 1;
+  readonly localFlip: 0 | 1;
+  /** Share of repair rollouts whose held-out suite passed. */
+  readonly repairRate: number;
+}
+declare const CREDIT_TERMS: readonly ["executes", "localFlip", "repairRate"];
+/** What an answer earned. Every outcome but `measured` earns nothing. */
+declare function repairCredit(grade: RepairGrade): RepairCredit;
+/** True once the answer is a well-formed, budget-admissible answer. A decline
+ *  is well formed, so it parses. */
+declare function reachedT0(grade: RepairGrade): boolean;
+/** True once the recorded state at k came back. A decline never reaches the
+ *  gate, because it names no k. */
+declare function reachedT1(grade: RepairGrade): boolean;
+/** True once the intervention ran at k and exited cleanly. */
+declare function reachedT2(grade: RepairGrade): boolean;
+interface RepairFunnelCounts {
+  readonly rows: number;
+  readonly rejected: number;
+  readonly declined: number;
+  readonly t0Parsed: number;
+  readonly t1Reproduced: number;
+  readonly t2Executed: number;
+  readonly t3LocalFlip: number;
+  /** Rows where at least one repair rollout passed the held-out suite. */
+  readonly t4RepairFlipAny: number;
+  /** Rows where every repair rollout passed. */
+  readonly t4RepairFlipAll: number;
+}
+declare function countFunnel(grades: readonly RepairGrade[]): RepairFunnelCounts;
+//#endregion
+//#region src/trace-repair/grade.d.ts
+/** Rollouts of the repair arm disagreed with the controls about the policy. */
+declare class RepairArmSymmetryError extends CaptureIntegrityError {}
+interface GradeRepairOptions {
+  readonly row: AdmittedRow;
+  readonly response: AnalystResponse;
+  readonly sessions: RepairSessionFactory;
+  readonly oracle: TestOracle;
+  readonly continuation: RepairContinuationRunner;
+  /** Repair rollouts for the intervention arm. Defaults to the row's own
+   *  control rollout count so the arms are matched. */
+  readonly repairRollouts?: number;
+  readonly budget?: InterventionBudget;
+  /** Wall-clock limit for one replayed or injected action. */
+  readonly stepTimeoutMs?: number;
+  /**
+   * Wall-clock limit for replaying a step the recording itself killed.
+   *
+   * Such a step carries no returncode, so the replay agrees with the recording
+   * no matter how long it waits. Bounding it separately cuts what a prefix
+   * costs without changing what it counts. Defaults to `stepTimeoutMs`.
+   */
+  readonly recordedTimeoutStepMs?: number;
+  readonly onProgress?: (message: string) => void;
+}
+interface RepairRowResult {
+  readonly rowId: string;
+  readonly grade: RepairGrade;
+  readonly credit: RepairCredit;
+  /** P(tests pass | intervention). Equals `controlRate` when no intervention
+   *  arm ran, because the row's state is then the control's state. */
+  readonly interventionRate: number;
+  readonly controlRate: number;
+  readonly controlRollouts: number;
+  /** How the row's control pass was read. Travels with the result so a report
+   *  can say whether a control rate of zero was screened or merely inert. */
+  readonly controlScreening: ControlScreening;
+  readonly controlPolicyDigest: string;
+  readonly repairRollouts: number;
+  /** The row's paired contribution to Delta-repair. */
+  readonly delta: number;
+  readonly wallMs: number;
+}
+declare function gradeRepairRow(options: GradeRepairOptions): Promise<RepairRowResult>;
+//#endregion
+//#region src/trace-repair/delta-repair.d.ts
+interface DeltaRepairOptions {
+  /** Deterministic resampling seed. Derived from the deltas when omitted. */
+  readonly seed?: number;
+  readonly resamples?: number;
+  readonly confidence?: number;
+}
+interface DeltaRepairInterval {
+  readonly n: number;
+  readonly mean: number;
+  readonly median: number;
+  readonly low: number;
+  readonly high: number;
+  readonly confidence: number;
+  readonly resamples: number;
+  /** False below the pair count where a percentile interval carries its
+   *  nominal error rate. A gate must not turn on a false one. */
+  readonly gateEligible: boolean;
+}
+type RepairThreatId = 'control-position-asymmetry' | 'control-cannot-rescue' | 'admission-conditions-on-control-failure' | 'bootstrap-below-min-n' | 'prefix-divergence-present' | 'intervention-failures-present' | 'zero-variance-interval' | 'declines-carry-the-denominator';
+interface RepairThreat {
+  readonly id: RepairThreatId;
+  readonly statement: string;
+  /** Which way the threat pushes the headline if it is real. */
+  readonly direction: 'understates' | 'overstates' | 'unknown';
+}
+interface DeltaRepairReport {
+  readonly rows: number;
+  readonly funnel: RepairFunnelCounts;
+  /** Mean over every admitted row. */
+  readonly interventionRate: number;
+  readonly controlRate: number;
+  readonly deltaRepair: DeltaRepairInterval;
+  /** The same estimate restricted to rows that reached t2, where an
+   *  intervention actually ran. Conditional on the analyst answering, so it is
+   *  never the headline. */
+  readonly measuredOnly: DeltaRepairInterval;
+  readonly measuredRows: number;
+  readonly rowResults: readonly RepairRowResult[];
+  readonly threats: readonly RepairThreat[];
+}
+declare function deltaRepair(rowResults: readonly RepairRowResult[], options?: DeltaRepairOptions): DeltaRepairReport;
+/** Markdown report: provenance, the funnel, every per-row column, the
+ *  distribution, and the threats. */
+declare function renderDeltaRepairReport(report: DeltaRepairReport): string;
+//#endregion
+//#region src/trace-repair/docker-environment.d.ts
+interface ProcessRequest {
+  argv: string[];
+  /** Kills the process group when exceeded. */
+  timeoutSeconds?: number;
+}
+interface ProcessResult {
+  /** stdout and stderr interleaved, as the scaffold reads them. */
+  output: string;
+  exitCode: number;
+  /** True when the process was killed for exceeding `timeoutSeconds`. */
+  timedOut: boolean;
+}
+/** Runs a process on the host. Injected so the environment is testable without a daemon. */
+type ProcessRunner = (request: ProcessRequest) => Promise<ProcessResult>;
+/**
+ * Spawns a process, merges stdout and stderr the way the scaffold reads them,
+ * and kills the whole process group on timeout so a killed command leaves no
+ * children running in the container's namespace.
+ */
+declare const nodeProcessRunner: ProcessRunner;
+interface DockerContinuationEnvironmentOptions {
+  /** Container id or name holding the post-step-k state. */
+  containerRef: string;
+  /** Working directory for every command. */
+  cwd: string;
+  /** Environment variables set on every command. */
+  env?: Record<string, string>;
+  /** Interpreter the scaffold runs commands through. */
+  interpreter?: string[];
+  /** `docker` unless a compatible client is used. */
+  executable?: string;
+  runProcess: ProcessRunner;
+  /** Removes the container on dispose. Leave false when the caller owns its lifecycle. */
+  removeOnDispose?: boolean;
+}
+/**
+ * Arguments that create a container the policy accepts. `--network none` is
+ * not optional: a continuation with network access could install what the
+ * recorded run could not, and the arms would no longer differ only by the
+ * intervention.
+ */
+declare function dockerRunArgs(input: {
+  image: string;
+  name: string;
+  cwd: string;
+  containerLifetime?: string;
+  executable?: string;
+}): string[];
+declare function createDockerContinuationEnvironment(options: DockerContinuationEnvironmentOptions): ContinuationEnvironment;
+//#endregion
+//#region src/trace-repair/repair-prompt.d.ts
+declare const REPAIR_QUESTION = "This coding agent ran and did not finish the task. Name the ONE recorded step whose action you would replace, and give the single shell action to run instead of it.";
+/**
+ * The task definition. Parameterised by the budget so the stated caps are the
+ * enforced caps.
+ */
+declare function repairTaskPolicy(budget?: InterventionBudget): readonly string[];
+/** The reply grammar, stated to an arm that answers in one JSON object. */
+declare const REPAIR_CONTRACT_LINES: readonly string[];
+/** The same grammar restated for the bounded repair turn, which never carries
+ *  the trajectory again. */
+declare const REPAIR_REPAIR_CONTRACT_LINES: readonly string[];
+/** The trajectory as an arm sees it: actions, observations, nothing about grading. */
+declare function renderRepairTrajectory(prefix: BlindedTrajectoryPrefix): string;
+declare function repairTrajectoryHeader(prefix: BlindedTrajectoryPrefix): string;
+/** The task definition an arm receives: the policy plus the statement the
+ *  recorded agent was given. */
+declare function repairTaskDefinition(prefix: BlindedTrajectoryPrefix, budget?: InterventionBudget): string;
+/**
+ * Digest of the question and task policy every arm shares.
+ *
+ * This is the part of the prompt that is equal by construction across arms:
+ * the question, the execution rules, and the budget the caps are read from.
+ * An arm's own contract text — its output grammar, its typed-signature
+ * instructions — is deliberately outside it, because arms differ there.
+ */
+declare function repairQuestionSha256(budget?: InterventionBudget): string;
+/**
+ * Digest of the composed question one arm answered.
+ *
+ * Covers the shared question and the arm's own declared contract text, so two
+ * arms that ask materially different composed questions — a JSON grammar
+ * versus a typed SUBMIT signature — stamp different digests, and two arms
+ * that ask the identical composed question share one.
+ */
+declare function repairArmPromptSha256(budget: InterventionBudget, contract: readonly string[]): string;
+//#endregion
+//#region src/trace-repair/test-oracle.d.ts
+/** The suite the oracle read back is not the suite it uploaded. */
+declare class TestSuiteTamperedError extends CaptureIntegrityError {}
+/** The oracle could not place or run the suite, so it graded nothing. */
+declare class TestOracleError extends CaptureIntegrityError {}
+interface TestSuiteFile {
+  /** Absolute path inside the container. */
+  readonly path: string;
+  readonly contents: string;
+  /** Octal mode applied after upload, e.g. '0755' for a runner script. */
+  readonly mode?: string;
+}
+interface InjectedTestOracleOptions {
+  /** Every file of the held-out suite. Uploaded on every grade call. */
+  readonly files: readonly TestSuiteFile[];
+  /** Command that runs the suite. Exit 0 is the only pass. */
+  readonly command: string;
+  /** Absolute directories removed before upload. A planted file that the
+   *  upload does not overwrite dies here. */
+  readonly purge?: readonly string[];
+  readonly uploadTimeoutMs?: number;
+  readonly commandTimeoutMs?: number;
+}
+/**
+ * Content digest of the suite: sha256 over each path and its bytes, in path
+ * order. Two suites with the same digest are the same suite.
+ */
+declare function testSuiteDigest(files: readonly TestSuiteFile[]): string;
+declare function injectedTestOracle(options: InjectedTestOracleOptions): TestOracle;
+//#endregion
+export { ADMISSION_CONFIG_DEFAULTS, ADMISSION_EXCLUSION_MEANING, ADMISSION_EXCLUSION_ORDER, ADMISSION_ROW_KEYS, ADMISSION_STRATA, type ActionPayloadKind, type AdmissionArtifact, type AdmissionCheckRecord, type AdmissionConfig, type AdmissionConfigInput, type AdmissionControlArm, type AdmissionControlObservation, type AdmissionControlRequest, type AdmissionControlRunner, type AdmissionCriteria, type AdmissionDecision, AdmissionDenominatorError, type AdmissionDivergence, type AdmissionEndStateOracle, type AdmissionEvidence, type AdmissionExclusionReason, AdmissionIndependenceError, type AdmissionNoOpInjection, type AdmissionOutcome, type AdmissionPrefixReplay, type AdmissionPrefixReplayer, type AdmissionProvenance, type AdmissionRejection, type AdmissionReport, type AdmissionRolloutSummary, type AdmissionRow, type AdmissionRowVerdict, type AdmissionScreeningRecord, type AdmissionStratum, type AdmissionTestVerdict, type AdmittedRow, type AnalystResponse, type AskRepairArmOptions, BLINDED_FIELDS, type BlindTrajectoryOptions, type BlindedStep, type BlindedTrajectoryPrefix, type BudgetCheck, type BudgetMeasurement, type BudgetViolation, CONTINUATION_POLICY_DEFAULTS, CONTROL_SCREENING_MODES, CREDIT_TERMS, type CommandOutput, type CompletionRepairArmOptions, type ContinuationArm, type ContinuationEnvironment, type ContinuationEnvironmentDescription, type ContinuationEnvironmentFactory, type ContinuationEnvironmentRequest, type ContinuationExecRecord, type ContinuationExecResult, type ContinuationExitStatus, type ContinuationMessage, type ContinuationModel, type ContinuationModelCall, type ContinuationModelRequest, type ContinuationModelResponse, ContinuationPolicyViolationError, type ContinuationRollout, type ContinuationStepRecord, ContinuationSymmetryError, type ContinuationUsageTotals, type ControlArmEvidence, type ControlCapability, type ControlPolicy, type ControlPolicyInput, type ControlScreening, DEGENERATE_STRATEGIES, DSPY_REPAIR_SIGNATURE, DSPY_REPAIR_TASK_TOKEN, DSPY_REPAIR_TRAJECTORY_INPUT, type DefineContinuationPolicyInput, type DegenerateDefeatKind, type DegenerateStrategy, type DegenerateStrategyId, type DeltaRepairInterval, type DeltaRepairOptions, type DeltaRepairReport, type DenominatorChain, type DenominatorChainArtifact, type DenominatorIntactInput, type DenominatorStage, type DockerContinuationEnvironmentOptions, type DspyRepairArmOptions, type GradeRepairOptions, type InjectedAction, type InjectedTestOracleOptions, type InterventionBudget, type InterventionExecution, MINI_SWE_SYSTEM_MESSAGE, MIN_ORACLE_REPLICATES, NO_DECISIVE_FAILURE, NO_OP_ACTIONS, NondeterministicOracleError, OUTPUT_ELISION_THRESHOLD, OUTPUT_ELISION_WINDOW, type OracleAssertionResult, type OracleDeterminismEvidence, type OracleDeterminismVerdict, type OracleFlippedUnit, type OracleLoad, type OracleReplicate, type OracleReplicateGroup, type OracleStateLabel, type OracleStateVerdict, type ParseAnalystResponseOutcome, type ParsedAction, type PinnedContinuationPolicy, type PrefixFidelityEvidence, type PrefixReplayEvidence, type ProcessRequest, type ProcessResult, type ProcessRunner, REPAIR_CONTRACT_LINES, REPAIR_QUESTION, REPAIR_REPAIR_CONTRACT_LINES, type ReadRepairPayloadOptions, type RecordedStep, type RecordedToolCall, type RenderAdmissionOptions, type RepairArm as RepairAnalystArm, type RepairArm$1 as RepairArm, type RepairArmAffordance, type RepairArmAnswer, type RepairArmAsymmetry, type RepairArmAsymmetryReport, type RepairArmBudgetRecord, type RepairArmCertification, type RepairArmDeclaration, type RepairArmEvidence, type RepairArmRejectedRow, type RepairArmRepairTurn, type RepairArmReply, type RepairArmRequest, RepairArmSymmetryError, type RepairArmUsage, type RepairContinuationOutcome, type RepairContinuationRequest, type RepairContinuationRunner, type RepairCredit, type RepairDeclined, type RepairExecResult, type RepairFinding, type RepairFunnelCounts, type RepairGrade, type RepairIntervention, type RepairRejection, type RepairRolloutEvidence, type RepairRowResult, type RepairSession, type RepairSessionFactory, type RepairSessionRequest, type RepairThreat, type RepairThreatId, type ReproductionEvidence, type ResponseParseFailure, type RunAdmissionOptions, type RunContinuationOptions, SCAFFOLD_INTERVENTION_BUDGET, SUBMIT_SENTINEL, SUITE_REWARD_UNIT, TB_REPAIR_ADMISSION_CRITERIA, type TaskOracleRegistry, type TaskOracleRegistryDocument, type TestOracle, type TestOracleContext, TestOracleError, type TestOracleOutcome, type TestRunEvidence, type TestSuiteFile, TestSuiteTamperedError, UncalibratedControlError, admissionArtifact, admitRow, admittedCount, admittedRowIds, askRepairArm, assertAnalystIndependent, assertArmSymmetry, assertChainReconciles, assertControlCalibrated, assertDenominatorIntact, assertDeterministicOracle, assertDspyRepairEngine, blindTrajectory, buildDenominatorChain, checkInterventionBudget, classifyActionPayload, continuationPolicyDigest, continuationSeed, controlCanRescue, countFunnel, createCompletionRepairArm, createDockerContinuationEnvironment, createDspyRepairArm, defineControlPolicy, definePinnedContinuationPolicy, degenerateStrategy, deltaRepair, dockerRunArgs, dspyRepairInstructions, gradeRepairRow, injectedTestOracle, isPreStratumReason, isRecordedTimeout, noOpInjectionStep, nodeProcessRunner, normalizeActionForComparison, oracleDeterminism, parseAction, parseAnalystResponse, parseTaskOracleRegistry, reachedT0, reachedT1, reachedT2, readRepairPayload, renderAdmissionReport, renderDeltaRepairReport, renderFormatErrorObservation, renderInstanceMessage, renderObservation, renderRepairTrajectory, renderTimeoutObservation, repairArmAsymmetries, repairArmPromptSha256, repairArmResponse, repairCredit, repairFinding, repairQuestionSha256, repairTaskDefinition, repairTaskPolicy, repairTrajectoryHeader, resolveAdmissionConfig, rolloutDigest, rolloutRecordedSteps, runAdmission, runContinuation, scanShellAction, stratumOf, submissionOf, taskOracleRegistry, testSuiteDigest, toRecordedSteps, totalCost, totalUsage };
+//# sourceMappingURL=index.d.ts.map