@tangle-network/agent-eval 0.147.0 → 0.149.0

package/dist/experiment/index.d.ts

@@ -725,6 +725,122 @@ interface RegisteredExperiment {
  */
 declare function openSealedExperiment(sealed: SealedExperiment): Promise<RegisteredExperiment>;
 //#endregion
+//#region src/attestation.d.ts
+/**
+ * Reproducibility attestation for any serializable report object.
+ *
+ * `attest()` binds a report to its content address (sha-256 over canonical
+ * JSON) AND binds that address to the provenance needed to reproduce it:
+ * model versions, seeds, price-table hash, code SHA, inputs hash. The outer
+ * `envelopeHash` prevents provenance from being rewritten while leaving the
+ * report hash valid.
+ *
+ * Layering: content-addressing is the substrate's job; cryptographic SIGNING
+ * (who vouches for the attestation, key management, transparency logs) is the
+ * consumer's layer on top. An `AttestedReport` is a stable byte-identical
+ * payload a consumer can sign — the substrate never holds keys.
+ *
+ * Generic by design: the report parameter is ANY value `canonicalJson`
+ * accepts (campaign results, fuzz capsules, scorecards, cost ledgers). Do not
+ * couple this module to a specific report schema.
+ */
+/** Hash scheme identifier carried by every attestation. A verifier rejects
+ * unknown algorithms instead of guessing. */
+declare const ATTESTATION_ALGORITHM: 'sha256/canonical-json';
+interface AttestationProvenance {
+  /** Every model involved in producing the report, name → version/id. */
+  modelVersions: Record<string, string>;
+  /** RNG seeds the run was driven by, when seeded. */
+  seeds?: number[];
+  /** Content hash of the price table used for cost figures — cost numbers
+   * are only reproducible against the same prices. */
+  priceTableHash?: string;
+  /** Git SHA of the code that produced the report. */
+  codeSha: string;
+  /** Content hash of the input set (scenarios, dataset manifest, ...). */
+  inputsHash?: string;
+  /** ISO-8601 timestamp, caller-supplied — the substrate stays clock-free
+   * so attestation is deterministic and testable. */
+  createdAt: string;
+}
+interface AttestedReport {
+  /** Hex sha-256 over the canonical JSON of the report. */
+  reportHash: string;
+  provenance: AttestationProvenance;
+  algorithm: typeof ATTESTATION_ALGORITHM;
+  /**
+   * Hex sha-256 over `{ reportHash, provenance, algorithm }`. New attestations
+   * always carry it. Optional only so persisted pre-envelope attestations can
+   * still be read and explicitly recognized as legacy by callers.
+   */
+  envelopeHash?: string;
+}
+//#endregion
+//#region src/experiment/evidence-receipt.d.ts
+declare const EVIDENCE_RECEIPT_VERSION: '1.0.0';
+/** Closed promotion vocabulary. A typo or unknown future kind is never independent by default. */
+declare const EVIDENCE_AUTHORITY_KINDS: readonly ['candidate-self-report', 'independent-evaluator', 'independent-replication', 'human-review', 'production-canary'];
+type EvidenceAuthorityKind = (typeof EVIDENCE_AUTHORITY_KINDS)[number];
+declare const INDEPENDENT_EVIDENCE_AUTHORITY_KINDS: readonly ["independent-evaluator", "independent-replication", "human-review", "production-canary"];
+interface EvidenceAuthority {
+  readonly kind: EvidenceAuthorityKind;
+  /** Stable authority/service/person identifier; never inferred from model prose. */
+  readonly id: string;
+}
+interface EvidenceBinding {
+  readonly schemaVersion: typeof EVIDENCE_RECEIPT_VERSION;
+  /** Stable objective identity spanning retries, forks, resumes, and multiple runs. */
+  readonly pursuitId: string;
+  /** Concrete execution/evaluation run this evidence was produced from. */
+  readonly runId: string;
+  /** Exact candidate/program/profile bundle under evaluation. */
+  readonly candidateDigest: string;
+  /** Exact evaluator/checker program or registered experiment definition. */
+  readonly evaluatorDigest: string;
+  /** Exact sandbox/container/dependency/environment identity. */
+  readonly environmentDigest: string;
+  /** Commitment to the input set. The hidden inputs themselves need not be exposed. */
+  readonly inputSetCommitment: string;
+  /** Content identity of the raw evaluated output/artifact set. */
+  readonly outputDigest: string;
+  /** Content identity of the evaluation result/report/verdict body. */
+  readonly resultDigest: string;
+  readonly authority: EvidenceAuthority;
+  /** Optional experiment seal that governed the evaluation. */
+  readonly experimentDigest?: string;
+  /** Optional observer-journal chain tip covering the execution being evaluated. */
+  readonly observerDigest?: string;
+}
+interface EvidenceReceipt {
+  readonly binding: EvidenceBinding;
+  readonly attestation: AttestedReport;
+}
+interface EvidenceReceiptVerification {
+  readonly valid: boolean;
+  readonly reason?: string;
+}
+interface CreateEvidenceReceiptInput extends Omit<EvidenceBinding, 'schemaVersion'> {}
+/**
+ * Mint a content-attested evidence receipt. Required identity fields are deliberately
+ * non-optional: unknown evidence stays unknown and cannot accidentally look certified.
+ * The attestation's input provenance must equal the receipt commitment so two competing
+ * descriptions of the evaluated population cannot coexist inside one valid receipt.
+ */
+declare function createEvidenceReceipt(input: CreateEvidenceReceiptInput, provenance: AttestationProvenance): EvidenceReceipt;
+/**
+ * Verify promotion-grade evidence. Generic report attestation keeps a legacy read path,
+ * but an EvidenceReceipt never accepts unbound provenance: changing the evaluator code,
+ * model versions, input commitment provenance, or creation record must invalidate the
+ * evidence rather than merely annotating it as legacy.
+ */
+declare function verifyEvidenceReceipt(receipt: EvidenceReceipt): EvidenceReceiptVerification;
+/**
+ * Promotion may choose a stricter policy, but this primitive makes the basic separation
+ * explicit: only a recognized independent authority is independent. Unknown/forged kinds
+ * and candidate self-reports both return false.
+ */
+declare function isIndependentEvidence(receipt: EvidenceReceipt): boolean;
+//#endregion
 //#region src/experiment/power.d.ts
 /** A design refused at configuration time, before any spend. */
 declare class DesignRefusalError extends ValidationError {}
@@ -805,5 +921,5 @@ declare function clusteredPower(options: ClusteredPowerOptions): ClusteredPowerR
 /** Throw the refusal for callers that want configuration-time failure. */
 declare function assertDesignAdequate(result: ClusteredPowerResult): void;
 //#endregion
-export { type AdmissionExecution, type AdmissionPartition, type AdmissionRule, type AdmissionStage, type ArmRealizedBudget, type ArmSpec, BOOTSTRAP_GATE_MIN_N, type BudgetRule, type ClusteredPowerOptions, type ClusteredPowerPoint, type ClusteredPowerRefusal, type ClusteredPowerResult, type ComputedInterval, type Condition, type DecisionBranch, type DecisionOutcome, type DecisionRule, DecisionTableNotTotalError, type DerivedQuantities, DesignRefusalError, type EProcess, type EProcessOptions, type EProcessState, type EProcessStep, type Estimand, type EstimandResult, type EvidenceRecord, type EvidenceVector, type Experiment, type ExperimentFunnel, type ExperimentRep, type ExperimentSpec, type ExperimentStats, ExperimentTracker, type ExperimentVerdict, FunnelIntegrityError, type FunnelPartitionCount, type FunnelStageCount, type FunnelStageInput, type GateEvidence, type GateResult, type HaltOutcome, type HaltRule, type HeldoutSignificance, type HeldoutSignificanceOptions, type HypothesisManifest, type HypothesisResult, type IntervalSpec, type JsonValue, MatchedBudgetError, type MatchedBudgetRule, type MatchedBudgetVerdict, type MatchedPair, type NLadderProjection, type Obligation, type OutcomeSpec, type PairArmsOptions, type PairArmsResult, type PairedArmRow, type PairedBootstrapOptions, type PairedBootstrapResult, type PairedEvalueOptions, type PairedEvalueSequence, type PairedEvalueStep, type PairedHoldout, type PowerPreflight, type PowerPreflightOptions, type Predicate, type PromotionPolicy, type ProportionInterval, type RegisteredExperiment, type ReissuePolicy, type ReissueVerdict, type SealAmendment, SealIntegrityError, type SealedExperiment, type SeedDerivation, type SelectionRule, type SequentialCrossingHorizon, type SequentialCrossingHorizonOptions, type SequentialDecision, type SequentialObservation, type SequentialPairedGate, type SequentialPairedGateOptions, type SetExpr, type SignFlipFloor, type SignedManifest, type UniformPassDecision, type UniformPassSchedule, type ValidityGate, amendExperiment, assertDesignAdequate, assertFunnelReconciles, assertMatchedBudgets, benjaminiHochberg, bonferroni, buildEvidenceVector, buildFunnel, canonicalize, classifyReissue, clusteredPower, comparePairedArms, composeFunnels, computeEstimand, computeInterval, defineExperiment, eProcess, evaluateCondition, evaluateHaltRule, evaluateHypothesis, evaluateIdentityGate, evaluateOracleDeterminismGate, evaluatePopulationReproducibilityGate, evaluatePowerFloorGate, evaluatePredicate, evaluateProvenanceGate, executeAdmissionRule, executeDecisionRule, fileExperimentStore, hashJson, heldoutSignificance, holm, inMemoryExperimentStore, mcnemar, mcnemarPower, mcnemarRequiredN, mulberry32, openSealedExperiment, pairArms, pairHoldout, pairRunRecords, pairedBootstrap, pairedEvalueSequence, pairedMde, pairedRiskDifference, pairedRiskDifferenceExact, pairedRiskDifferenceScore, paretoPolicy, paretoSignificanceGate, powerPreflight, projectNLadderBudget, readField, renderFunnelTable, requiredPairedSampleSize, requiredSampleSize, runSelectionRule, runUniformPassBudget, sealExperiment, sequentialCrossingHorizon, sequentialDecide, sequentialPairedGate, signManifest, verifyManifest, verifyMatchedBudgets, verifySealedExperiment, wilson };
+export { type AdmissionExecution, type AdmissionPartition, type AdmissionRule, type AdmissionStage, type ArmRealizedBudget, type ArmSpec, BOOTSTRAP_GATE_MIN_N, type BudgetRule, type ClusteredPowerOptions, type ClusteredPowerPoint, type ClusteredPowerRefusal, type ClusteredPowerResult, type ComputedInterval, type Condition, type CreateEvidenceReceiptInput, type DecisionBranch, type DecisionOutcome, type DecisionRule, DecisionTableNotTotalError, type DerivedQuantities, DesignRefusalError, type EProcess, type EProcessOptions, type EProcessState, type EProcessStep, EVIDENCE_AUTHORITY_KINDS, EVIDENCE_RECEIPT_VERSION, type Estimand, type EstimandResult, type EvidenceAuthority, type EvidenceAuthorityKind, type EvidenceBinding, type EvidenceReceipt, type EvidenceReceiptVerification, type EvidenceRecord, type EvidenceVector, type Experiment, type ExperimentFunnel, type ExperimentRep, type ExperimentSpec, type ExperimentStats, ExperimentTracker, type ExperimentVerdict, FunnelIntegrityError, type FunnelPartitionCount, type FunnelStageCount, type FunnelStageInput, type GateEvidence, type GateResult, type HaltOutcome, type HaltRule, type HeldoutSignificance, type HeldoutSignificanceOptions, type HypothesisManifest, type HypothesisResult, INDEPENDENT_EVIDENCE_AUTHORITY_KINDS, type IntervalSpec, type JsonValue, MatchedBudgetError, type MatchedBudgetRule, type MatchedBudgetVerdict, type MatchedPair, type NLadderProjection, type Obligation, type OutcomeSpec, type PairArmsOptions, type PairArmsResult, type PairedArmRow, type PairedBootstrapOptions, type PairedBootstrapResult, type PairedEvalueOptions, type PairedEvalueSequence, type PairedEvalueStep, type PairedHoldout, type PowerPreflight, type PowerPreflightOptions, type Predicate, type PromotionPolicy, type ProportionInterval, type RegisteredExperiment, type ReissuePolicy, type ReissueVerdict, type SealAmendment, SealIntegrityError, type SealedExperiment, type SeedDerivation, type SelectionRule, type SequentialCrossingHorizon, type SequentialCrossingHorizonOptions, type SequentialDecision, type SequentialObservation, type SequentialPairedGate, type SequentialPairedGateOptions, type SetExpr, type SignFlipFloor, type SignedManifest, type UniformPassDecision, type UniformPassSchedule, type ValidityGate, amendExperiment, assertDesignAdequate, assertFunnelReconciles, assertMatchedBudgets, benjaminiHochberg, bonferroni, buildEvidenceVector, buildFunnel, canonicalize, classifyReissue, clusteredPower, comparePairedArms, composeFunnels, computeEstimand, computeInterval, createEvidenceReceipt, defineExperiment, eProcess, evaluateCondition, evaluateHaltRule, evaluateHypothesis, evaluateIdentityGate, evaluateOracleDeterminismGate, evaluatePopulationReproducibilityGate, evaluatePowerFloorGate, evaluatePredicate, evaluateProvenanceGate, executeAdmissionRule, executeDecisionRule, fileExperimentStore, hashJson, heldoutSignificance, holm, inMemoryExperimentStore, isIndependentEvidence, mcnemar, mcnemarPower, mcnemarRequiredN, mulberry32, openSealedExperiment, pairArms, pairHoldout, pairRunRecords, pairedBootstrap, pairedEvalueSequence, pairedMde, pairedRiskDifference, pairedRiskDifferenceExact, pairedRiskDifferenceScore, paretoPolicy, paretoSignificanceGate, powerPreflight, projectNLadderBudget, readField, renderFunnelTable, requiredPairedSampleSize, requiredSampleSize, runSelectionRule, runUniformPassBudget, sealExperiment, sequentialCrossingHorizon, sequentialDecide, sequentialPairedGate, signManifest, verifyEvidenceReceipt, verifyManifest, verifyMatchedBudgets, verifySealedExperiment, wilson };
 //# sourceMappingURL=index.d.ts.map

package/dist/experiment/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../../src/experiment/ast.ts","../../src/experiment/budget.ts","../../src/experiment/funnel.ts","../../src/experiment/define.ts","../../src/experiment/power.ts"],"mappings":";;;;;;;;;;;KA8BY,+CAA+C;GAAiB,YAAY;;;KAG5E,iBAAiB;;cAGhB,mCAAmC;;;;;KAQpC;EAEN;EACA;EACA;EACA,OAAO;;EAEP;EAAY;EAAe,QAAQ;;EACnC;EAAa,IAAI;;EACjB;EAAa,IAAI;;EACjB;EAAa,IAAI;;;iBAGP,UAAU,QAAQ,gBAAgB;;iBAUlC,kBAAkB,WAAW,WAAW,QAAQ;;;;;UA4C/C;EACf;EACA,MAAM;EACN;;;UAIe;EACf;;EAEA;EACA,MAAM;EACN;;;UAIe;EACf;EACA,QAAQ;EACR,aAAa;;;;;;;KAUH;EAEN;EACA;EACA;EACA;IAAe;IAAe;;EAC9B;EACA;;EAGA;;EAEA;EACA,MAAM;EACN;IAAS;IAAe;;;;;;;;;;;;;iBAad,iBACd,MAAM,eACN,kBAAkB,kBAClB;;EAEE;;EAEA,QAAQ;;EAER,YAAY,eAAe;;;KA0DnB;EACN;EAAoB;EAAa,OAAO;;EACxC;EAAmB,IAAI;;;;;;KAMjB;EACN;EAAc,OAAO;EAAW;;EAChC;EAA4B,OAAO;EAAW;;EAE9C;EACA;EACA;EACA;EACA;;;;;EAKA;;EAEA;;EAGA;EACA;EACA;EACA,WAAW;EACX,aAAa;;UAGF;EACf;EACA;EACA;;;iBA8Cc,gBACd,UAAU,UACV,eAAe,mBACd;;KA2ES;EAEN;EACA;EACA;EACA;EACA;EACA;;EAEA;EAAyB;;UAEd;EACf;EACA;EACA;;;;;;;;;;iBAWc,gBACd,MAAM,cACN;EACM;EAAc,eAAe;EAAkB;;EAC/C;EAAkB;EAAmB;IAC1C;;KA8HS;EACN;EAAgC;EAAkB;;EAClD;EAAgC;;EAChC;EAA4B;EAAkB;EAAiC;;EAC/E;EAAwB;;EACxB;EAAa,IAAI;;EACjB;EAAa,IAAI;;EACjB;EAAa,IAAI;;;UAGN;EACf,WAAW;IAAiB;IAAe;;EAC3C,YAAY;EACZ,gBAAgB;;iBAGF,kBAAkB,WAAW,WAAW,UAAU;UAyCjD;EACf,MAAM;EACN;EACA;;;;;;;;;KAUU;EACN;EAAe,UAAU;;EAEzB;EACA;EACA;EACA;EACA;IAAmB;IAAuB;;;UAG/B;EACf;EACA;;iBAGc,oBACd,MAAM,cACN,UAAU,oBACT;;UAec;EACf;EACA;EACA;;;KAMU;EAEN;EACA;EACA;EACA;;EAGA;EACA;EACA;EACA;;EAEA;EAA8B,OAAO;;EAErC;EACA;EACA;EACA;IAAO;IAAgB;IAAmB;;;EAE1C;EAAkB;EAAuB;EAAmB;;UAEjD;EACf;EACA;EACA,UAAU;;;;;;iBAOI,8BACd,YACA,MAAM,QAAQ;EAAgB;IAC9B,aAAa,qCACZ;;;;;;iBAiBa,sCACd,YACA,MAAM,QAAQ;EAAgB;IAC9B;EAAe,eAAe;EAAkB,gBAAgB;IAC/D;;iBAkBa,uBACd,YACA,MAAM,QAAQ;EAAgB;IAC9B,YAAY,iBACX;;iBAMa,qBACd,YACA,OAAO,QAAQ;EAAgB;IAC/B;EAAc;EAAgB;IAC7B;;;;;;iBAea,uBACd,YACA,MAAM,QAAQ;EAAgB;IAC9B;EAAkB;EAAgB;MACjC;;UAsBc;EACf;IAAQ;IAAyB;;EACjC;EACA;;UAGe;EACf;EACA;EACA;;iBAGc,iBAAiB,MAAM,UAAU,gBAAgB,eAAe;;;;;KAoBpE;EAEN;EACA;EACA;EACA;EACA;EACA;IAAU;IAAY;;EACtB;;EAGA;EACA;EACA;EACA;EACA;;UAGW;EACf;EACA;EACA;EACA;;UAGe;EACf,WAAW;EACX;;;;;;;;iBASc,qBACd,MAAM,QAAQ;EAAc;IAC5B,uCACC;UAuBc;EACf;EACA;IAAe;IAAW;IAAsB;;EAChD;IAAkB;IAAuC;;;;;;;;iBAQ3C,qBACd,MAAM,QAAQ;EAAc;IAC5B;EAAY;EAAqB;IAChC;;UAoBc;EACf;EACA;EACA;;;UAIe;EACf;EACA;EACA;;KAGU;;;;;;iBAOI,gBACd,QAAQ,eACR,eACA,sBACC;;;;cCn6BU,2BAA2B;UAEvB;EACf;;EAEA;;UAGe;EACf,MAAM;EACN,MAAM;;EAEN;;EAEA;EACA;;EAEA;IAAkB;IAA2B;;;;;;;;iBAQ/B,qBACd,MAAM,mBACN,eAAe,sBACd;;iBAsCa,qBACd,MAAM,mBACN,eAAe,sBACd;;;;cC/DU,6BAA6B;UAEzB;EACf;EACA;EACA;EACA;;EAEA,aAAa;;EAEb;;UAGe;EACf;;EAEA;EACA;;EAEA;;UAGe;EACf;EACA;EACA,QAAQ;EACR;EACA,YAAY;;UAGG;EACf;;EAEA;EACA,aAAa;EACb;;;;;;;;;;;iBAYc,YAAY;EAC1B;EACA;EACA,QAAQ;EACR;IAAe;IAAY;IAAc;;IACvC;;iBAsEY,uBAAuB,QAAQ;UAwB9B;EACf,QAAQ;EACR,WAAW;;EAEX,eAAe,eAAe;;;;;;;;iBAShB,qBACd,MAAM,eACN,kBAAkB,mBACjB;;;;;;iBA8Ca,eACd,OAAO,kBACP,QAAQ,mBACP;;;;;;iBA4Ba,kBAAkB,QAAQ;;;;cCvM7B,2BAA2B;UAIvB;EACf;EACA;;EAEA;;EAEA;;EAEA,OAAO,eAAe;;KAGZ;EAEN;;EAEA;EACA;;EAEA;;EAEA;;EAGA;EACA;EACA;EACA;;;;;;UAOW;EACf;;UAGe;EACf;;EAEA;EACA,MAAM;EACN,SAAS;EACT,YAAY;;EAEZ,aAAa,eAAe;;;;;EAK5B,gBAAgB;EAChB,YAAY,eAAe;EAC3B,YAAY,eAAe;EAC3B,UAAU;EACV,cAAc;;EAEd,QAAQ,eAAe;EACvB,OAAO;EACP,SAAS;EACT,gBAAgB;EAChB,UAAU;EACV,iBAAiB;EACjB;;;;;;;;;;iBAwCc,iBAAiB,MAAM,iBAAiB;UAkHvC;;EAEf;EACA;;EAEA;;EAEA;;UAGe;EACf,MAAM;;EAEN;EACA;EACA;;EAEA;EACA,YAAY;;;iBAIQ,eACpB,MAAM,gBACN;EAAW;IACV,QAAQ;;;;;;iBAkBW,gBACpB,QAAQ,kBACR;EAAa,MAAM;EAAgB;EAAgB;EAAiB;IACnE,QAAQ;;iBAuBW,uBAAuB,QAAQ,mBAAmB;;KAe5D;EACN;EAA4B,aAAa;;EAEzC;EACA,eAAe;EACf,gBAAgB;;EAEhB;EAA8B,YAAY;;EAC1C;EAAkB;EAAgB;;EAClC;EAAqB;IAAkB;IAAgB;;;;;;;UAM5C;WACN,QAAQ;;EAEjB,OAAO,UAAU,oBAAoB;;EAErC,MAAM,kBAAkB,mBAAmB;;EAE3C,OAAO,cAAc,kBAAkB,kBAAkB;IAAW;;;EAEpE,KAAK,cAAc,UAAU,eAAe;;EAE5C,KAAK,gBAAgB,eAAe;;EAEpC,qBAAqB,uCAAuC;;EAE5D,qBAAqB;IAAY;IAAqB;MAAiB;;EAEvE,eAAe,eAAe,sBAAsB;;EAEpD,SAAS,cAAc,eAAe,mBAAmB;;EAEzD,SACE,cACA;IACM;IAAc,eAAe;IAAkB;;IAC/C;IAAkB;IAAmB;MAC1C;;;;;;;iBAQiB,qBACpB,QAAQ,mBACP,QAAQ;;;;cClYE,2BAA2B;UAEvB;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;;;;;EAMA;IAAkB;IAAe;;;UAGlB;EACf;EACA;EACA;;UAGe;;EAEf;;EAEA;EACA;;EAEA;;EAEA;;UAGe;EACf;EACA;EACA;;UAGe;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA,OAAO;;EAEP;EACA,eAAe;;EAEf;;EAEA,SAAS;;;;;;iBAOK,eAAe,SAAS,wBAAwB;;iBAsGhD,qBAAqB,QAAQ"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../src/experiment/ast.ts","../../src/experiment/budget.ts","../../src/experiment/funnel.ts","../../src/experiment/define.ts","../../src/attestation.ts","../../src/experiment/evidence-receipt.ts","../../src/experiment/power.ts"],"mappings":";;;;;;;;;;;KA8BY,+CAA+C;GAAiB,YAAY;;;KAG5E,iBAAiB;;cAGhB,mCAAmC;;;;;KAQpC;EAEN;EACA;EACA;EACA,OAAO;;EAEP;EAAY;EAAe,QAAQ;;EACnC;EAAa,IAAI;;EACjB;EAAa,IAAI;;EACjB;EAAa,IAAI;;;iBAGP,UAAU,QAAQ,gBAAgB;;iBAUlC,kBAAkB,WAAW,WAAW,QAAQ;;;;;UA4C/C;EACf;EACA,MAAM;EACN;;;UAIe;EACf;;EAEA;EACA,MAAM;EACN;;;UAIe;EACf;EACA,QAAQ;EACR,aAAa;;;;;;;KAUH;EAEN;EACA;EACA;EACA;IAAe;IAAe;;EAC9B;EACA;;EAGA;;EAEA;EACA,MAAM;EACN;IAAS;IAAe;;;;;;;;;;;;;iBAad,iBACd,MAAM,eACN,kBAAkB,kBAClB;;EAEE;;EAEA,QAAQ;;EAER,YAAY,eAAe;;;KA0DnB;EACN;EAAoB;EAAa,OAAO;;EACxC;EAAmB,IAAI;;;;;;KAMjB;EACN;EAAc,OAAO;EAAW;;EAChC;EAA4B,OAAO;EAAW;;EAE9C;EACA;EACA;EACA;EACA;;;;;EAKA;;EAEA;;EAGA;EACA;EACA;EACA,WAAW;EACX,aAAa;;UAGF;EACf;EACA;EACA;;;iBA8Cc,gBACd,UAAU,UACV,eAAe,mBACd;;KA2ES;EAEN;EACA;EACA;EACA;EACA;EACA;;EAEA;EAAyB;;UAEd;EACf;EACA;EACA;;;;;;;;;;iBAWc,gBACd,MAAM,cACN;EACM;EAAc,eAAe;EAAkB;;EAC/C;EAAkB;EAAmB;IAC1C;;KA8HS;EACN;EAAgC;EAAkB;;EAClD;EAAgC;;EAChC;EAA4B;EAAkB;EAAiC;;EAC/E;EAAwB;;EACxB;EAAa,IAAI;;EACjB;EAAa,IAAI;;EACjB;EAAa,IAAI;;;UAGN;EACf,WAAW;IAAiB;IAAe;;EAC3C,YAAY;EACZ,gBAAgB;;iBAGF,kBAAkB,WAAW,WAAW,UAAU;UAyCjD;EACf,MAAM;EACN;EACA;;;;;;;;;KAUU;EACN;EAAe,UAAU;;EAEzB;EACA;EACA;EACA;EACA;IAAmB;IAAuB;;;UAG/B;EACf;EACA;;iBAGc,oBACd,MAAM,cACN,UAAU,oBACT;;UAec;EACf;EACA;EACA;;;KAMU;EAEN;EACA;EACA;EACA;;EAGA;EACA;EACA;EACA;;EAEA;EAA8B,OAAO;;EAErC;EACA;EACA;EACA;IAAO;IAAgB;IAAmB;;;EAE1C;EAAkB;EAAuB;EAAmB;;UAEjD;EACf;EACA;EACA,UAAU;;;;;;iBAOI,8BACd,YACA,MAAM,QAAQ;EAAgB;IAC9B,aAAa,qCACZ;;;;;;iBAiBa,sCACd,YACA,MAAM,QAAQ;EAAgB;IAC9B;EAAe,eAAe;EAAkB,gBAAgB;IAC/D;;iBAkBa,uBACd,YACA,MAAM,QAAQ;EAAgB;IAC9B,YAAY,iBACX;;iBAMa,qBACd,YACA,OAAO,QAAQ;EAAgB;IAC/B;EAAc;EAAgB;IAC7B;;;;;;iBAea,uBACd,YACA,MAAM,QAAQ;EAAgB;IAC9B;EAAkB;EAAgB;MACjC;;UAsBc;EACf;IAAQ;IAAyB;;EACjC;EACA;;UAGe;EACf;EACA;EACA;;iBAGc,iBAAiB,MAAM,UAAU,gBAAgB,eAAe;;;;;KAoBpE;EAEN;EACA;EACA;EACA;EACA;EACA;IAAU;IAAY;;EACtB;;EAGA;EACA;EACA;EACA;EACA;;UAGW;EACf;EACA;EACA;EACA;;UAGe;EACf,WAAW;EACX;;;;;;;;iBASc,qBACd,MAAM,QAAQ;EAAc;IAC5B,uCACC;UAuBc;EACf;EACA;IAAe;IAAW;IAAsB;;EAChD;IAAkB;IAAuC;;;;;;;;iBAQ3C,qBACd,MAAM,QAAQ;EAAc;IAC5B;EAAY;EAAqB;IAChC;;UAoBc;EACf;EACA;EACA;;;UAIe;EACf;EACA;EACA;;KAGU;;;;;;iBAOI,gBACd,QAAQ,eACR,eACA,sBACC;;;;cCn6BU,2BAA2B;UAEvB;EACf;;EAEA;;UAGe;EACf,MAAM;EACN,MAAM;;EAEN;;EAEA;EACA;;EAEA;IAAkB;IAA2B;;;;;;;;iBAQ/B,qBACd,MAAM,mBACN,eAAe,sBACd;;iBAsCa,qBACd,MAAM,mBACN,eAAe,sBACd;;;;cC/DU,6BAA6B;UAEzB;EACf;EACA;EACA;EACA;;EAEA,aAAa;;EAEb;;UAGe;EACf;;EAEA;EACA;;EAEA;;UAGe;EACf;EACA;EACA,QAAQ;EACR;EACA,YAAY;;UAGG;EACf;;EAEA;EACA,aAAa;EACb;;;;;;;;;;;iBAYc,YAAY;EAC1B;EACA;EACA,QAAQ;EACR;IAAe;IAAY;IAAc;;IACvC;;iBAsEY,uBAAuB,QAAQ;UAwB9B;EACf,QAAQ;EACR,WAAW;;EAEX,eAAe,eAAe;;;;;;;;iBAShB,qBACd,MAAM,eACN,kBAAkB,mBACjB;;;;;;iBA8Ca,eACd,OAAO,kBACP,QAAQ,mBACP;;;;;;iBA4Ba,kBAAkB,QAAQ;;;;cCvM7B,2BAA2B;UAIvB;EACf;EACA;;EAEA;;EAEA;;EAEA,OAAO,eAAe;;KAGZ;EAEN;;EAEA;EACA;;EAEA;;EAEA;;EAGA;EACA;EACA;EACA;;;;;;UAOW;EACf;;UAGe;EACf;;EAEA;EACA,MAAM;EACN,SAAS;EACT,YAAY;;EAEZ,aAAa,eAAe;;;;;EAK5B,gBAAgB;EAChB,YAAY,eAAe;EAC3B,YAAY,eAAe;EAC3B,UAAU;EACV,cAAc;;EAEd,QAAQ,eAAe;EACvB,OAAO;EACP,SAAS;EACT,gBAAgB;EAChB,UAAU;EACV,iBAAiB;EACjB;;;;;;;;;;iBAwCc,iBAAiB,MAAM,iBAAiB;UAkHvC;;EAEf;EACA;;EAEA;;EAEA;;UAGe;EACf,MAAM;;EAEN;EACA;EACA;;EAEA;EACA,YAAY;;;iBAIQ,eACpB,MAAM,gBACN;EAAW;IACV,QAAQ;;;;;;iBAkBW,gBACpB,QAAQ,kBACR;EAAa,MAAM;EAAgB;EAAgB;EAAiB;IACnE,QAAQ;;iBAuBW,uBAAuB,QAAQ,mBAAmB;;KAe5D;EACN;EAA4B,aAAa;;EAEzC;EACA,eAAe;EACf,gBAAgB;;EAEhB;EAA8B,YAAY;;EAC1C;EAAkB;EAAgB;;EAClC;EAAqB;IAAkB;IAAgB;;;;;;;UAM5C;WACN,QAAQ;;EAEjB,OAAO,UAAU,oBAAoB;;EAErC,MAAM,kBAAkB,mBAAmB;;EAE3C,OAAO,cAAc,kBAAkB,kBAAkB;IAAW;;;EAEpE,KAAK,cAAc,UAAU,eAAe;;EAE5C,KAAK,gBAAgB,eAAe;;EAEpC,qBAAqB,uCAAuC;;EAE5D,qBAAqB;IAAY;IAAqB;MAAiB;;EAEvE,eAAe,eAAe,sBAAsB;;EAEpD,SAAS,cAAc,eAAe,mBAAmB;;EAEzD,SACE,cACA;IACM;IAAc,eAAe;IAAkB;;IAC/C;IAAkB;IAAmB;MAC1C;;;;;;;iBAQiB,qBACpB,QAAQ,mBACP,QAAQ;;;;;;;;;;;;;;;;;;;;;;;cCvYE;UAEI;;EAEf,eAAe;;EAEf;;;EAGA;;EAEA;;EAEA;;;EAGA;;UAGe;;EAEf;EACA,YAAY;EACZ,kBAAkB;;;;;;EAMlB;;;;cChCW;;cAGA;KAQD,gCAAgC;cAE/B;UAOI;WACN,MAAM;;WAEN;;UAGM;WACN,sBAAsB;;WAEtB;;WAEA;;WAEA;;WAEA;;WAEA;;WAEA;;WAEA;;WAEA;WACA,WAAW;;WAEX;;WAEA;;UAGM;WACN,SAAS;WACT,aAAa;;UAGP;WACN;WACA;;UAGM,mCAAmC,KAAK;;;;;;;iBAQzC,sBACd,OAAO,4BACP,YAAY,wBACX;;;;;;;iBA8Ba,sBAAsB,SAAS,kBAAkB;;;;;;iBA6CjD,sBAAsB,SAAS;;;;cC3IlC,2BAA2B;UAEvB;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;;;;;EAMA;IAAkB;IAAe;;;UAGlB;EACf;EACA;EACA;;UAGe;;EAEf;;EAEA;EACA;;EAEA;;EAEA;;UAGe;EACf;EACA;EACA;;UAGe;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA,OAAO;;EAEP;EACA,eAAe;;EAEf;;EAEA,SAAS;;;;;;iBAOK,eAAe,SAAS,wBAAwB;;iBAsGhD,qBAAqB,QAAQ"}

package/dist/experiment/index.js

@@ -5,6 +5,7 @@ import { a as requiredSampleSize, c as holm, i as requiredPairedSampleSize, n as
 import { f as mcnemar, g as pairedRiskDifferenceScore, h as pairedRiskDifferenceExact, m as pairedRiskDifference, n as pairArms, r as pairRunRecords, t as comparePairedArms, v as wilson } from "../paired-arms-D-XRF_fy.js";
 import { r as pairedBootstrap, t as BOOTSTRAP_GATE_MIN_N } from "../paired-tests-BHIhYVdu.js";
 import { t as eProcess } from "../sequential-eprocess-CbUt2htw.js";
+import { n as contentHash } from "../verdict-cache-mZf5FEiY.js";
 import { a as heldoutSignificance, o as pairHoldout, t as powerPreflight } from "../power-preflight-DEw-uC7q.js";
 import { a as inMemoryExperimentStore, r as fileExperimentStore, t as ExperimentTracker } from "../experiment-tracker-Ym6rEQT1.js";
 import { n as pairedEvalueSequence, r as sequentialCrossingHorizon } from "../sequential-CzK5DarL.js";
@@ -952,6 +953,221 @@ async function openSealedExperiment(sealed) {
 	};
 }
 //#endregion
+//#region src/attestation.ts
+/**
+* Reproducibility attestation for any serializable report object.
+*
+* `attest()` binds a report to its content address (sha-256 over canonical
+* JSON) AND binds that address to the provenance needed to reproduce it:
+* model versions, seeds, price-table hash, code SHA, inputs hash. The outer
+* `envelopeHash` prevents provenance from being rewritten while leaving the
+* report hash valid.
+*
+* Layering: content-addressing is the substrate's job; cryptographic SIGNING
+* (who vouches for the attestation, key management, transparency logs) is the
+* consumer's layer on top. An `AttestedReport` is a stable byte-identical
+* payload a consumer can sign — the substrate never holds keys.
+*
+* Generic by design: the report parameter is ANY value `canonicalJson`
+* accepts (campaign results, fuzz capsules, scorecards, cost ledgers). Do not
+* couple this module to a specific report schema.
+*/
+/** Hash scheme identifier carried by every attestation. A verifier rejects
+* unknown algorithms instead of guessing. */
+const ATTESTATION_ALGORITHM = "sha256/canonical-json";
+function envelopeMaterial(reportHash, provenance, algorithm) {
+	return {
+		reportHash,
+		provenance,
+		algorithm
+	};
+}
+/**
+* Content-address a report and bind it to its provenance. Throws (via
+* `canonicalJson`) if the report or provenance contains undefined / function /
+* symbol / non-finite numbers — an attestation that cannot be unambiguously
+* serialized cannot be trusted.
+*/
+function attest(report, provenance) {
+	const reportHash = contentHash(report);
+	const algorithm = ATTESTATION_ALGORITHM;
+	return {
+		reportHash,
+		provenance,
+		algorithm,
+		envelopeHash: contentHash(envelopeMaterial(reportHash, provenance, algorithm))
+	};
+}
+/**
+* Verify a report against its attestation. Returns a typed outcome rather
+* than throwing: an unverifiable report (e.g. one that no longer
+* canonicalizes) is a verification failure with the cause in `reason`, not a
+* crash — verifiers run in pipelines that must record WHY, not die.
+*
+* Legacy attestations without `envelopeHash` remain readable, but verification
+* explicitly marks their provenance as unbound so a promotion path can refuse
+* them instead of accidentally treating old metadata as cryptographic proof.
+*/
+function verifyAttestation(report, attested) {
+	if (attested.algorithm !== "sha256/canonical-json") return {
+		valid: false,
+		reason: `unknown algorithm '${attested.algorithm}' — this verifier only checks '${ATTESTATION_ALGORITHM}'`
+	};
+	let recomputed;
+	try {
+		recomputed = contentHash(report);
+	} catch (err) {
+		return {
+			valid: false,
+			reason: `report is not canonicalizable: ${err instanceof Error ? err.message : String(err)}`
+		};
+	}
+	if (recomputed !== attested.reportHash) return {
+		valid: false,
+		reason: `report hash mismatch: attested ${attested.reportHash}, recomputed ${recomputed}`
+	};
+	if (attested.envelopeHash === void 0) return {
+		valid: true,
+		legacyUnboundProvenance: true
+	};
+	let envelopeHash;
+	try {
+		envelopeHash = contentHash(envelopeMaterial(attested.reportHash, attested.provenance, attested.algorithm));
+	} catch (err) {
+		return {
+			valid: false,
+			reason: `attestation provenance is not canonicalizable: ${err instanceof Error ? err.message : String(err)}`
+		};
+	}
+	if (envelopeHash !== attested.envelopeHash) return {
+		valid: false,
+		reason: `attestation envelope hash mismatch: attested ${attested.envelopeHash}, recomputed ${envelopeHash}`
+	};
+	return { valid: true };
+}
+//#endregion
+//#region src/experiment/evidence-receipt.ts
+/**
+* Evidence receipts are the join between Runtime execution and Eval promotion.
+*
+* Runtime says what actually ran. Eval says what independently measured it.
+* This receipt binds those worlds without making either package import the other:
+* stable pursuit/run identity, exact candidate/evaluator/environment/input/output
+* content identities, and the authority class that produced the observation.
+*
+* The payload is attested with agent-eval's existing canonical report attestation.
+* Signing/key management deliberately remains outside this substrate; consumers may
+* sign the byte-stable receipt or anchor its attestation in a transparency log.
+*/
+const EVIDENCE_RECEIPT_VERSION = "1.0.0";
+/** Closed promotion vocabulary. A typo or unknown future kind is never independent by default. */
+const EVIDENCE_AUTHORITY_KINDS = [
+	"candidate-self-report",
+	"independent-evaluator",
+	"independent-replication",
+	"human-review",
+	"production-canary"
+];
+const INDEPENDENT_EVIDENCE_AUTHORITY_KINDS = [
+	"independent-evaluator",
+	"independent-replication",
+	"human-review",
+	"production-canary"
+];
+/**
+* Mint a content-attested evidence receipt. Required identity fields are deliberately
+* non-optional: unknown evidence stays unknown and cannot accidentally look certified.
+* The attestation's input provenance must equal the receipt commitment so two competing
+* descriptions of the evaluated population cannot coexist inside one valid receipt.
+*/
+function createEvidenceReceipt(input, provenance) {
+	const inputSetCommitment = requiredIdentity(input.inputSetCommitment, "inputSetCommitment");
+	assertInputCommitment(provenance, inputSetCommitment);
+	const binding = Object.freeze({
+		schemaVersion: EVIDENCE_RECEIPT_VERSION,
+		pursuitId: requiredIdentity(input.pursuitId, "pursuitId"),
+		runId: requiredIdentity(input.runId, "runId"),
+		candidateDigest: requiredIdentity(input.candidateDigest, "candidateDigest"),
+		evaluatorDigest: requiredIdentity(input.evaluatorDigest, "evaluatorDigest"),
+		environmentDigest: requiredIdentity(input.environmentDigest, "environmentDigest"),
+		inputSetCommitment,
+		outputDigest: requiredIdentity(input.outputDigest, "outputDigest"),
+		resultDigest: requiredIdentity(input.resultDigest, "resultDigest"),
+		authority: requiredAuthority(input.authority),
+		...input.experimentDigest === void 0 ? {} : { experimentDigest: requiredIdentity(input.experimentDigest, "experimentDigest") },
+		...input.observerDigest === void 0 ? {} : { observerDigest: requiredIdentity(input.observerDigest, "observerDigest") }
+	});
+	return Object.freeze({
+		binding,
+		attestation: attest(binding, provenance)
+	});
+}
+/**
+* Verify promotion-grade evidence. Generic report attestation keeps a legacy read path,
+* but an EvidenceReceipt never accepts unbound provenance: changing the evaluator code,
+* model versions, input commitment provenance, or creation record must invalidate the
+* evidence rather than merely annotating it as legacy.
+*/
+function verifyEvidenceReceipt(receipt) {
+	if (receipt.binding.schemaVersion !== "1.0.0") return {
+		valid: false,
+		reason: `unsupported evidence receipt version '${receipt.binding.schemaVersion}'`
+	};
+	try {
+		for (const [field, value] of Object.entries({
+			pursuitId: receipt.binding.pursuitId,
+			runId: receipt.binding.runId,
+			candidateDigest: receipt.binding.candidateDigest,
+			evaluatorDigest: receipt.binding.evaluatorDigest,
+			environmentDigest: receipt.binding.environmentDigest,
+			inputSetCommitment: receipt.binding.inputSetCommitment,
+			outputDigest: receipt.binding.outputDigest,
+			resultDigest: receipt.binding.resultDigest
+		})) requiredIdentity(value, field);
+		requiredAuthority(receipt.binding.authority);
+		assertInputCommitment(receipt.attestation.provenance, receipt.binding.inputSetCommitment);
+	} catch (error) {
+		return {
+			valid: false,
+			reason: error instanceof Error ? error.message : String(error)
+		};
+	}
+	const verification = verifyAttestation(receipt.binding, receipt.attestation);
+	if (!verification.valid) return verification;
+	if (verification.legacyUnboundProvenance === true || receipt.attestation.envelopeHash === void 0) return {
+		valid: false,
+		reason: "evidence receipt provenance is not bound by an attestation envelope"
+	};
+	return { valid: true };
+}
+/**
+* Promotion may choose a stricter policy, but this primitive makes the basic separation
+* explicit: only a recognized independent authority is independent. Unknown/forged kinds
+* and candidate self-reports both return false.
+*/
+function isIndependentEvidence(receipt) {
+	return INDEPENDENT_EVIDENCE_AUTHORITY_KINDS.includes(receipt.binding.authority?.kind);
+}
+function requiredAuthority(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new TypeError("evidence receipt: authority must be an object");
+	const authority = value;
+	if (typeof authority.kind !== "string" || !EVIDENCE_AUTHORITY_KINDS.includes(authority.kind)) throw new TypeError(`evidence receipt: unknown authority kind '${String(authority.kind)}'`);
+	if (typeof authority.id !== "string") throw new TypeError("evidence receipt: authority.id must be a string");
+	return Object.freeze({
+		kind: authority.kind,
+		id: requiredIdentity(authority.id, "authority.id")
+	});
+}
+function assertInputCommitment(provenance, inputSetCommitment) {
+	if (typeof provenance?.inputsHash !== "string" || provenance.inputsHash.trim().length === 0) throw new TypeError("evidence receipt: provenance.inputsHash is required");
+	if (provenance.inputsHash.trim() !== inputSetCommitment) throw new TypeError("evidence receipt: provenance.inputsHash must equal binding.inputSetCommitment");
+}
+function requiredIdentity(value, field) {
+	const normalized = value.trim();
+	if (normalized.length === 0) throw new TypeError(`evidence receipt: ${field} must be non-empty`);
+	return normalized;
+}
+//#endregion
 //#region src/experiment/power.ts
 /**
 * Design-time power for task-clustered paired designs, with a refusal verdict.
@@ -1120,6 +1336,6 @@ function mixSeed(seed, effect) {
 	return (seed ^ Math.round(effect * 1000003) * 2654435769) >>> 0 | 0;
 }
 //#endregion
-export { BOOTSTRAP_GATE_MIN_N, DecisionTableNotTotalError, DesignRefusalError, ExperimentTracker, FunnelIntegrityError, MatchedBudgetError, SealIntegrityError, amendExperiment, assertDesignAdequate, assertFunnelReconciles, assertMatchedBudgets, benjaminiHochberg, bonferroni, buildEvidenceVector, buildFunnel, canonicalize, classifyReissue, clusteredPower, comparePairedArms, composeFunnels, computeEstimand, computeInterval, defineExperiment, eProcess, evaluateCondition, evaluateHaltRule, evaluateHypothesis, evaluateIdentityGate, evaluateOracleDeterminismGate, evaluatePopulationReproducibilityGate, evaluatePowerFloorGate, evaluatePredicate, evaluateProvenanceGate, executeAdmissionRule, executeDecisionRule, fileExperimentStore, hashJson, heldoutSignificance, holm, inMemoryExperimentStore, mcnemar, mcnemarPower, mcnemarRequiredN, mulberry32, openSealedExperiment, pairArms, pairHoldout, pairRunRecords, pairedBootstrap, pairedEvalueSequence, pairedMde, pairedRiskDifference, pairedRiskDifferenceExact, pairedRiskDifferenceScore, paretoPolicy, paretoSignificanceGate, powerPreflight, projectNLadderBudget, readField, renderFunnelTable, requiredPairedSampleSize, requiredSampleSize, runSelectionRule, runUniformPassBudget, sealExperiment, sequentialCrossingHorizon, sequentialDecide, sequentialPairedGate, signManifest, verifyManifest, verifyMatchedBudgets, verifySealedExperiment, wilson };
+export { BOOTSTRAP_GATE_MIN_N, DecisionTableNotTotalError, DesignRefusalError, EVIDENCE_AUTHORITY_KINDS, EVIDENCE_RECEIPT_VERSION, ExperimentTracker, FunnelIntegrityError, INDEPENDENT_EVIDENCE_AUTHORITY_KINDS, MatchedBudgetError, SealIntegrityError, amendExperiment, assertDesignAdequate, assertFunnelReconciles, assertMatchedBudgets, benjaminiHochberg, bonferroni, buildEvidenceVector, buildFunnel, canonicalize, classifyReissue, clusteredPower, comparePairedArms, composeFunnels, computeEstimand, computeInterval, createEvidenceReceipt, defineExperiment, eProcess, evaluateCondition, evaluateHaltRule, evaluateHypothesis, evaluateIdentityGate, evaluateOracleDeterminismGate, evaluatePopulationReproducibilityGate, evaluatePowerFloorGate, evaluatePredicate, evaluateProvenanceGate, executeAdmissionRule, executeDecisionRule, fileExperimentStore, hashJson, heldoutSignificance, holm, inMemoryExperimentStore, isIndependentEvidence, mcnemar, mcnemarPower, mcnemarRequiredN, mulberry32, openSealedExperiment, pairArms, pairHoldout, pairRunRecords, pairedBootstrap, pairedEvalueSequence, pairedMde, pairedRiskDifference, pairedRiskDifferenceExact, pairedRiskDifferenceScore, paretoPolicy, paretoSignificanceGate, powerPreflight, projectNLadderBudget, readField, renderFunnelTable, requiredPairedSampleSize, requiredSampleSize, runSelectionRule, runUniformPassBudget, sealExperiment, sequentialCrossingHorizon, sequentialDecide, sequentialPairedGate, signManifest, verifyEvidenceReceipt, verifyManifest, verifyMatchedBudgets, verifySealedExperiment, wilson };
 
 //# sourceMappingURL=index.js.map