@vibe-agent-toolkit/agent-skills 0.1.42 → 0.2.0-rc.10

package/dist/skill-test/executor-prompt.js

@@ -1,24 +1,27 @@
 import { PromptInvariantError } from './prompt-invariants.js';
 /**
- * Build the prompt handed to the blind executor subagent (issue #145 —
- * transcript-grounded eval rewrite). The executor is a real worker, not a
+ * Build the prompt handed to the blind executor subagent (the
+ * transcript-grounded eval design). The executor is a real worker, not a
  * participant in an eval: it receives the task and its working context ONLY,
  * phrased exactly as a genuine user request. It must NEVER be told (directly
  * or by implication) that it is being tested, evaluated, or graded — that
  * knowledge would change its behavior and invalidate the eval.
  *
  * `subjectPath` is where the skill/plugin under test is staged (context the
- * executor's environment provides); `workspaceDir`, when the eval declares
- * input `files`, is the project the executor is actually meant to operate on.
+ * executor's environment provides) and is OMITTED for the skill-absent arm;
+ * `workspaceDir` is the project the executor is actually meant to operate on.
  *
  * Pure function: same inputs always produce the same prompt.
  */
 export function buildExecutorPrompt(opts) {
-    const lines = [opts.task, '', `The relevant files are located at ${opts.subjectPath}.`];
+    const context = [];
+    if (opts.subjectPath !== undefined) {
+        context.push(`The relevant files are located at ${opts.subjectPath}.`);
+    }
     if (opts.workspaceDir !== undefined) {
-        lines.push(`Your working directory is ${opts.workspaceDir} — the project to operate on.`);
+        context.push(`Your working directory is ${opts.workspaceDir} — the project to operate on.`);
     }
-    return lines.join('\n');
+    return context.length === 0 ? opts.task : [opts.task, '', ...context].join('\n');
 }
 /**
  * Phrases that, if present in an executor prompt, would break the blind

package/dist/skill-test/executor-prompt.js.map

@@ -1 +1 @@
-{"version":3,"file":"executor-prompt.js","sourceRoot":"","sources":["../../src/skill-test/executor-prompt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAW9D;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAgC;IAClE,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,qCAAqC,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;IACxF,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,6BAA6B,IAAI,CAAC,YAAY,+BAA+B,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,CAAC,cAAc,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,SAAS,CAAC,CAAC;AAEpG;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAAc,EAAE,IAAY;IACzE,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,oBAAoB,CAAC,4CAA4C,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAAC,yDAAyD,CAAC,CAAC;IAC5F,CAAC;IACD,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/D,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACxC,IAAI,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,oBAAoB,CAC5B,oFAAoF,OAAO,IAAI,CAChG,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"executor-prompt.js","sourceRoot":"","sources":["../../src/skill-test/executor-prompt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAmB9D;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAgC;IAClE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,qCAAqC,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,6BAA6B,IAAI,CAAC,YAAY,+BAA+B,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,CAAC,cAAc,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,SAAS,CAAC,CAAC;AAEpG;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAAc,EAAE,IAAY;IACzE,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,oBAAoB,CAAC,4CAA4C,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAAC,yDAAyD,CAAC,CAAC;IAC5F,CAAC;IACD,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/D,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACxC,IAAI,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,oBAAoB,CAC5B,oFAAoF,OAAO,IAAI,CAChG,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/skill-test/failure-reason.d.ts

@@ -0,0 +1,113 @@
+import { VatError } from '@vibe-agent-toolkit/utils';
+/**
+ * WHY a `vat skill test run` ended on `ExitCode.ERROR`.
+ *
+ * This used to be three exit codes — 1 internal, 2 preflight, 3 bootstrap —
+ * beside 4 for "an eval failed". Under the one exit-code contract every verb
+ * shares (`ExitCode` in `@vibe-agent-toolkit/schema`) a failed eval is
+ * `FINDINGS` (1) like every other gate that ran and did not pass, and every way
+ * the harness could NOT run is `ERROR` (2). The distinction a CI author still
+ * needs — "did the harness break, or is my environment wrong?" — is said on
+ * stderr as `Reason: <reason>`, never in a fourth number a wrapper would have
+ * to look up per command.
+ *
+ * - `internal` — the harness broke: a spawn failure, a watchdog stall, a grader
+ *   fragment that did not parse, a forged nonce. VAT's fault until proven
+ *   otherwise.
+ * - `preflight` — the operator can fix it: a bad config, a missing binary, an
+ *   absent security ack, a held lock, a companion that would not build.
+ * - `bootstrap` — nothing was wrong; the run scaffolded an `evals.json`
+ *   template and stopped so the author can fill it in.
+ */
+export type SkillTestFailureReason = 'internal' | 'preflight' | 'bootstrap';
+/**
+ * The reason an error, thrown out of the harness, gives for the run's `ERROR`.
+ *
+ * An error DECLARES its reason with a `readonly reason` field — every VAT error
+ * class in this feature carries one — and this reads it. Only a VAT error is
+ * consulted (the `Symbol.for('vat.error')` brand, which survives the
+ * `src`/`dist` boundary that `instanceof` does not): a foreign error carrying
+ * `reason` is not opting in to anything, and a foreign error carrying nothing
+ * is the harness's own fault, `internal`. That closes the residual the old
+ * `exitCode` read left open, where `commander`'s `CommanderError` carried a 2
+ * and would have reported "your environment is wrong" for a crash.
+ *
+ * The read is guarded: a getter or `Proxy` that throws on `reason` is a foreign
+ * object misbehaving, and this runs inside the CLI's own `catch`, where a
+ * rethrow escapes the handler entirely — no summary, no exit code, a bare
+ * stack.
+ */
+export declare function skillTestFailureReason(err: unknown): SkillTestFailureReason;
+/**
+ * A required input is absent in a way vat can scaffold (missing evals.json).
+ * Reason `bootstrap`, NOT a failure. `expectedPath` is the persistent location
+ * of the annotated starter template.
+ *
+ * In a real run the harness has already written that template, and the message
+ * says so. Under `--dry-run` the TEMPLATE is not written, so the message instead
+ * describes what a real run *would* scaffold and where, while surfacing the same
+ * "bootstrap needed" signal.
+ *
+ * That scope is exact, and it used to read "a dry run must never touch the
+ * filesystem", which is not true of this command. A dry run is not a read-only
+ * mode: it takes the harness lock, creates the harness root, stages BOTH arms'
+ * per-eval workspaces, and — once `--i-understand-this-runs-skill-code` is passed —
+ * runs the repo's `test.build` hook and builds the subject. What it never does is
+ * SPAWN: no executor session, no grader session, no tokens.
+ *
+ * It also never touches `results/`: it neither creates the directory, nor writes
+ * `provenance.json`, nor wipes the previous run's artifacts. That last one is the
+ * reason the ordering matters — the wipe used to sit AHEAD of the dry-run
+ * short-circuit, so a free `--dry-run` (or any failure after it) destroyed the
+ * `grading.json` / `baseline.json` / `friction.json` / `tool-eval.json` of the
+ * expensive real run an operator was about to read. The summary now names the
+ * provenance path it WOULD write rather than writing it.
+ *
+ * The scaffold is the other filesystem effect a dry run deliberately withholds,
+ * and for a different reason: that write lands in the AUTHOR's source
+ * tree rather than in vat's own scratch space.
+ */
+export declare class BootstrapNeededError extends VatError {
+    readonly expectedPath: string;
+    readonly reason: "bootstrap";
+    constructor(expectedPath: string, opts?: {
+        dryRun?: boolean;
+    });
+}
+/** Thrown when building a declared skill (pool packageSkill or plugin build) fails. Reason `preflight`. */
+export declare class SkillBuildError extends VatError {
+    readonly reason: "preflight";
+    constructor(message: string);
+}
+/**
+ * The §12 security acknowledgment is required but absent, thrown BEFORE any
+ * build/pre-stage command (which executes untrusted repo code) runs for a
+ * buildable subject. Reason `preflight`. Mirrors the harness Step-6 ack
+ * message wording so the two enforcement points read identically.
+ */
+export declare class SecurityAckError extends VatError {
+    readonly reason: "preflight";
+    constructor();
+}
+/**
+ * A skill name is staged more than once in a single run — the subject, a
+ * `--with` companion, and a `--with-optional` companion must all have distinct
+ * names. Both `--with` and `--with-optional` STAGE the named companion and make
+ * it invocable (they differ only in required-vs-optional resolution, not in
+ * whether they are staged), so a colliding name would silently overwrite an
+ * earlier staged copy under the same slot — never an error, never a manifest
+ * trace — which makes a routing/deferral eval look correct while testing
+ * something else. Reason `preflight`: user-correctable input, like a bad env
+ * token or missing security ack.
+ */
+export declare class DuplicateStagedSkillError extends VatError {
+    readonly skillName: string;
+    readonly reason: "preflight";
+    constructor(skillName: string);
+}
+/** Internal harness failure (an executor/grader spawn error, watchdog timeout/stall, or a missing grader fragment). Reason `internal`. */
+export declare class InternalHarnessError extends VatError {
+    readonly reason: "internal";
+    constructor(message: string);
+}
+//# sourceMappingURL=failure-reason.d.ts.map

package/dist/skill-test/failure-reason.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"failure-reason.d.ts","sourceRoot":"","sources":["../../src/skill-test/failure-reason.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG,WAAW,GAAG,WAAW,CAAC;AAQ5E;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,sBAAsB,CAY3E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,qBAAa,oBAAqB,SAAQ,QAAQ;aAEpB,YAAY,EAAE,MAAM;IADhD,QAAQ,CAAC,MAAM,EAAG,WAAW,CAAU;gBACX,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE;CAQ9E;AAED,2GAA2G;AAC3G,qBAAa,eAAgB,SAAQ,QAAQ;IAC3C,QAAQ,CAAC,MAAM,EAAG,WAAW,CAAU;gBAC3B,OAAO,EAAE,MAAM;CAG5B;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,QAAQ;IAC5C,QAAQ,CAAC,MAAM,EAAG,WAAW,CAAU;;CAOxC;AAED;;;;;;;;;;GAUG;AACH,qBAAa,yBAA0B,SAAQ,QAAQ;aAEzB,SAAS,EAAE,MAAM;IAD7C,QAAQ,CAAC,MAAM,EAAG,WAAW,CAAU;gBACX,SAAS,EAAE,MAAM;CAO9C;AAED,0IAA0I;AAC1I,qBAAa,oBAAqB,SAAQ,QAAQ;IAChD,QAAQ,CAAC,MAAM,EAAG,UAAU,CAAU;gBAC1B,OAAO,EAAE,MAAM;CAG5B"}

package/dist/skill-test/failure-reason.js

@@ -0,0 +1,124 @@
+import { isVatError, VatError } from '@vibe-agent-toolkit/utils';
+const FAILURE_REASONS = new Set([
+    'internal',
+    'preflight',
+    'bootstrap',
+]);
+/**
+ * The reason an error, thrown out of the harness, gives for the run's `ERROR`.
+ *
+ * An error DECLARES its reason with a `readonly reason` field — every VAT error
+ * class in this feature carries one — and this reads it. Only a VAT error is
+ * consulted (the `Symbol.for('vat.error')` brand, which survives the
+ * `src`/`dist` boundary that `instanceof` does not): a foreign error carrying
+ * `reason` is not opting in to anything, and a foreign error carrying nothing
+ * is the harness's own fault, `internal`. That closes the residual the old
+ * `exitCode` read left open, where `commander`'s `CommanderError` carried a 2
+ * and would have reported "your environment is wrong" for a crash.
+ *
+ * The read is guarded: a getter or `Proxy` that throws on `reason` is a foreign
+ * object misbehaving, and this runs inside the CLI's own `catch`, where a
+ * rethrow escapes the handler entirely — no summary, no exit code, a bare
+ * stack.
+ */
+export function skillTestFailureReason(err) {
+    if (!isVatError(err))
+        return 'internal';
+    let declared;
+    try {
+        declared = err.reason;
+        // eslint-disable-next-line local/no-blind-catch -- a property read throws only from a getter or Proxy trap on a misbehaving object, and "the read itself threw" is exactly "declared nothing": there is no second case to tell apart, and this runs inside the CLI's own catch, where a rethrow escapes the handler entirely (pinned in failure-reason.test.ts).
+    }
+    catch {
+        return 'internal';
+    }
+    return typeof declared === 'string' && FAILURE_REASONS.has(declared)
+        ? declared
+        : 'internal';
+}
+/**
+ * A required input is absent in a way vat can scaffold (missing evals.json).
+ * Reason `bootstrap`, NOT a failure. `expectedPath` is the persistent location
+ * of the annotated starter template.
+ *
+ * In a real run the harness has already written that template, and the message
+ * says so. Under `--dry-run` the TEMPLATE is not written, so the message instead
+ * describes what a real run *would* scaffold and where, while surfacing the same
+ * "bootstrap needed" signal.
+ *
+ * That scope is exact, and it used to read "a dry run must never touch the
+ * filesystem", which is not true of this command. A dry run is not a read-only
+ * mode: it takes the harness lock, creates the harness root, stages BOTH arms'
+ * per-eval workspaces, and — once `--i-understand-this-runs-skill-code` is passed —
+ * runs the repo's `test.build` hook and builds the subject. What it never does is
+ * SPAWN: no executor session, no grader session, no tokens.
+ *
+ * It also never touches `results/`: it neither creates the directory, nor writes
+ * `provenance.json`, nor wipes the previous run's artifacts. That last one is the
+ * reason the ordering matters — the wipe used to sit AHEAD of the dry-run
+ * short-circuit, so a free `--dry-run` (or any failure after it) destroyed the
+ * `grading.json` / `baseline.json` / `friction.json` / `tool-eval.json` of the
+ * expensive real run an operator was about to read. The summary now names the
+ * provenance path it WOULD write rather than writing it.
+ *
+ * The scaffold is the other filesystem effect a dry run deliberately withholds,
+ * and for a different reason: that write lands in the AUTHOR's source
+ * tree rather than in vat's own scratch space.
+ */
+export class BootstrapNeededError extends VatError {
+    expectedPath;
+    reason = 'bootstrap';
+    constructor(expectedPath, opts) {
+        super('SKILL_TEST_BOOTSTRAP_NEEDED', opts?.dryRun === true
+            ? `[dry-run] No evals.json found. A real run would scaffold an annotated template at ${expectedPath} — fill it in and re-run. (dry-run: nothing was written to your source tree.)`
+            : `Wrote an evals.json template at ${expectedPath} — fill it in and re-run.`);
+        this.expectedPath = expectedPath;
+    }
+}
+/** Thrown when building a declared skill (pool packageSkill or plugin build) fails. Reason `preflight`. */
+export class SkillBuildError extends VatError {
+    reason = 'preflight';
+    constructor(message) {
+        super('SKILL_TEST_BUILD_FAILED', message);
+    }
+}
+/**
+ * The §12 security acknowledgment is required but absent, thrown BEFORE any
+ * build/pre-stage command (which executes untrusted repo code) runs for a
+ * buildable subject. Reason `preflight`. Mirrors the harness Step-6 ack
+ * message wording so the two enforcement points read identically.
+ */
+export class SecurityAckError extends VatError {
+    reason = 'preflight';
+    constructor() {
+        super('SKILL_TEST_SECURITY_ACK_MISSING', 'Security acknowledgment required. Pass --i-understand-this-runs-skill-code to proceed.');
+    }
+}
+/**
+ * A skill name is staged more than once in a single run — the subject, a
+ * `--with` companion, and a `--with-optional` companion must all have distinct
+ * names. Both `--with` and `--with-optional` STAGE the named companion and make
+ * it invocable (they differ only in required-vs-optional resolution, not in
+ * whether they are staged), so a colliding name would silently overwrite an
+ * earlier staged copy under the same slot — never an error, never a manifest
+ * trace — which makes a routing/deferral eval look correct while testing
+ * something else. Reason `preflight`: user-correctable input, like a bad env
+ * token or missing security ack.
+ */
+export class DuplicateStagedSkillError extends VatError {
+    skillName;
+    reason = 'preflight';
+    constructor(skillName) {
+        super('SKILL_TEST_DUPLICATE_STAGED_SKILL', `Skill name "${skillName}" is staged more than once (subject / --with / --with-optional). ` +
+            `Each staged skill must have a unique name.`);
+        this.skillName = skillName;
+    }
+}
+/** Internal harness failure (an executor/grader spawn error, watchdog timeout/stall, or a missing grader fragment). Reason `internal`. */
+export class InternalHarnessError extends VatError {
+    reason = 'internal';
+    constructor(message) {
+        super('SKILL_TEST_INTERNAL', message);
+    }
+}
+//# sourceMappingURL=failure-reason.js.map

package/dist/skill-test/failure-reason.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"failure-reason.js","sourceRoot":"","sources":["../../src/skill-test/failure-reason.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAwBjE,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAyB;IAC3E,UAAU;IACV,WAAW;IACX,WAAW;CACZ,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IACxC,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAI,GAA4B,CAAC,MAAM,CAAC;QAChD,iWAAiW;IACnW,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClE,CAAC,CAAE,QAAmC;QACtC,CAAC,CAAC,UAAU,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,OAAO,oBAAqB,SAAQ,QAAQ;IAEpB;IADnB,MAAM,GAAG,WAAoB,CAAC;IACvC,YAA4B,YAAoB,EAAE,IAA2B;QAC3E,KAAK,CACH,6BAA6B,EAC7B,IAAI,EAAE,MAAM,KAAK,IAAI;YACnB,CAAC,CAAC,qFAAqF,YAAY,+EAA+E;YAClL,CAAC,CAAC,mCAAmC,YAAY,2BAA2B,CAC/E,CAAC;QANwB,iBAAY,GAAZ,YAAY,CAAQ;IAOhD,CAAC;CACF;AAED,2GAA2G;AAC3G,MAAM,OAAO,eAAgB,SAAQ,QAAQ;IAClC,MAAM,GAAG,WAAoB,CAAC;IACvC,YAAY,OAAe;QACzB,KAAK,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,gBAAiB,SAAQ,QAAQ;IACnC,MAAM,GAAG,WAAoB,CAAC;IACvC;QACE,KAAK,CACH,iCAAiC,EACjC,wFAAwF,CACzF,CAAC;IACJ,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,yBAA0B,SAAQ,QAAQ;IAEzB;IADnB,MAAM,GAAG,WAAoB,CAAC;IACvC,YAA4B,SAAiB;QAC3C,KAAK,CACH,mCAAmC,EACnC,eAAe,SAAS,mEAAmE;YACzF,4CAA4C,CAC/C,CAAC;QALwB,cAAS,GAAT,SAAS,CAAQ;IAM7C,CAAC;CACF;AAED,0IAA0I;AAC1I,MAAM,OAAO,oBAAqB,SAAQ,QAAQ;IACvC,MAAM,GAAG,UAAmB,CAAC;IACtC,YAAY,OAAe;QACzB,KAAK,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;CACF"}

package/dist/skill-test/fragment-merge.d.ts

@@ -2,24 +2,7 @@ import type { EvalFragment } from './eval-fragment.js';
 import { type FrictionReport } from './friction-schema.js';
 import { type NormalizedGrading } from './grading-adapter.js';
 import { type ToolEvalReport } from './tool-eval-schema.js';
-/**
- * Assemble the run's aggregate grading result (skill-creator's flat
- * `grading.json` shape) from every eval's per-eval grader fragment (issue #145
- * Task 4/5). vat is the SOLE writer of the aggregate; this is that assembly
- * step — the result feeds {@link import('./grading-adapter.js').reconcileGrading}
- * unchanged.
- *
- * Every fragment must carry the SAME `runNonce` the harness stamped for this
- * run — a mismatch means a fragment was not produced for this run (forged,
- * stale, or left behind by untrusted skill code in the shared sandbox) and is
- * rejected via {@link GradingNonceError}, never silently dropped.
- *
- * Zero fragments in → zero expectations out. This is deliberate: the existing
- * "graded nothing" guard in `reconcileGrading` already throws
- * `GradingSkewError` on an empty `expectations[]`, so that case is NOT
- * special-cased here.
- */
-export declare function mergeFragmentsToGrading(fragments: EvalFragment[], runNonce: string): NormalizedGrading;
+export declare function mergeFragmentsToGrading(fragments: EvalFragment[], runNonce: string, arm: 'with' | 'without'): NormalizedGrading;
 /**
  * Assemble the run's aggregate friction report from every eval's fragment
  * (vat-owned; see friction-schema.ts). Concatenates each fragment's
@@ -30,8 +13,8 @@ export declare function mergeFragmentsToGrading(fragments: EvalFragment[], runNo
  */
 export declare function mergeFragmentsToFriction(fragments: EvalFragment[]): FrictionReport;
 /**
- * Assemble vat's `tool-eval.json` from every eval's fragment (issue #145
- * Phase T; see tool-eval-schema.ts). A SEPARATE channel from `grading.json`
+ * Assemble vat's `tool-eval.json` from every eval's fragment (see
+ * tool-eval-schema.ts). A SEPARATE channel from `grading.json`
  * and from friction (C2) — tool verdicts judge declared `toolExpectations`
  * against the transcript, not prose expectations or packaging friction.
  *

package/dist/skill-test/fragment-merge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fragment-merge.d.ts","sourceRoot":"","sources":["../../src/skill-test/fragment-merge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACjF,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACjF,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAElF;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,iBAAiB,CAoBtG;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,YAAY,EAAE,GAAG,cAAc,CAYlF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,YAAY,EAAE,GAAG,cAAc,CAMlF"}
+{"version":3,"file":"fragment-merge.d.ts","sourceRoot":"","sources":["../../src/skill-test/fragment-merge.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACjF,OAAO,EAAsC,KAAK,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAClG,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAkElF,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,YAAY,EAAE,EACzB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GAAG,SAAS,GACtB,iBAAiB,CAmCnB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,YAAY,EAAE,GAAG,cAAc,CAYlF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,YAAY,EAAE,GAAG,cAAc,CAMlF"}

package/dist/skill-test/fragment-merge.js

@@ -1,10 +1,11 @@
+import { createHash } from 'node:crypto';
 import { FrictionReportSchema } from './friction-schema.js';
-import { GradingNonceError } from './grading-adapter.js';
+import { GradingArmError, GradingNonceError } from './grading-adapter.js';
 import { ToolEvalReportSchema } from './tool-eval-schema.js';
 /**
  * Assemble the run's aggregate grading result (skill-creator's flat
- * `grading.json` shape) from every eval's per-eval grader fragment (issue #145
- * Task 4/5). vat is the SOLE writer of the aggregate; this is that assembly
+ * `grading.json` shape) from every eval's per-eval grader fragment.
+ * vat is the SOLE writer of the aggregate; this is that assembly
  * step — the result feeds {@link import('./grading-adapter.js').reconcileGrading}
  * unchanged.
  *
@@ -13,27 +14,85 @@ import { ToolEvalReportSchema } from './tool-eval-schema.js';
  * stale, or left behind by untrusted skill code in the shared sandbox) and is
  * rejected via {@link GradingNonceError}, never silently dropped.
  *
+ * The nonce is CONSUMED here, not republished: the returned report carries none.
+ * It used to, and the caller writes that report verbatim to `results/grading.json`
+ * — so the one value four separate docblocks promise "never touches disk" was on
+ * disk in two artifacts, in a directory `--out`/`--keep` can place inside a repo.
+ *
+ * Every fragment must ALSO belong to the `arm` being assembled (a fragment with
+ * no `arm` of its own is a default-'with' fragment — see
+ * {@link import('./eval-fragment.js').EvalFragmentSchema}); a fragment from the
+ * other arm is rejected via {@link GradingArmError} for the same reason a stale
+ * nonce is: the merged count would no longer be a measurement of one arm, and
+ * that is exactly the number `--baseline` subtracts. `arm` is REQUIRED, not
+ * defaulted, because a default is precisely how a caller would silently
+ * mislabel the control artifact as the treatment one.
+ *
+ * The returned report carries that `arm`, and every merged expectation carries
+ * its source fragment's `evalId` — together these are what let a reader holding
+ * ONE of the two `--baseline` artifacts say which arm it is, and line the two up
+ * per eval to compute a delta at all.
+ *
  * Zero fragments in → zero expectations out. This is deliberate: the existing
  * "graded nothing" guard in `reconcileGrading` already throws
  * `GradingSkewError` on an empty `expectations[]`, so that case is NOT
  * special-cased here.
  */
-export function mergeFragmentsToGrading(fragments, runNonce) {
+/** How much of the nonce digest to print — enough to tell two runs apart by eye. */
+const NONCE_FINGERPRINT_LENGTH = 12;
+/**
+ * A nonce rendered for an ERROR MESSAGE: never the value, always a digest of it.
+ *
+ * `runNonce` is the ONE field {@link import('./grader-text.js').sanitizeGraderTextDeep}
+ * is told to skip, because it must survive byte-exact to be compared — so it is
+ * also the one grader-supplied string in the fragment that reaches an operator
+ * with no neutralization at all. The CLI prints an error's `message` raw, so
+ * interpolating it here would print attacker bytes BY CONSTRUCTION: a fragment
+ * whose `runNonce` is `ESC[2K CR ESC[32m vat: verified` wipes vat's line and
+ * continues in vat's colour, from inside the very check that exists to catch a
+ * forged fragment.
+ *
+ * That path is currently unreachable — `runGraderForEval` compares the nonce one
+ * call earlier and throws a message quoting nothing — so this is defense in depth,
+ * and defense in depth that prints raw untrusted text is not defense. A digest
+ * keeps every diagnostic the value had (are the two the same? is the fragment from
+ * an older run?) and carries no bytes the fragment chose. Length is reported too,
+ * since a truncated or padded nonce is the likeliest honest mistake and the digest
+ * hides it.
+ */
+function nonceFingerprint(nonce) {
+    const digest = createHash('sha256').update(nonce, 'utf8').digest('hex').slice(0, NONCE_FINGERPRINT_LENGTH);
+    return `sha256:${digest} (${nonce.length} chars)`;
+}
+export function mergeFragmentsToGrading(fragments, runNonce, arm) {
     const expectations = [];
     for (const fragment of fragments) {
         if (fragment.runNonce !== runNonce) {
-            throw new GradingNonceError(`fragment for eval "${fragment.evalId}" carries runNonce "${fragment.runNonce}", expected "${runNonce}"`);
+            throw new GradingNonceError(`fragment for eval "${fragment.evalId}" carries runNonce ${nonceFingerprint(fragment.runNonce)}, ` +
+                `expected ${nonceFingerprint(runNonce)}`);
+        }
+        const fragmentArm = fragment.arm ?? 'with';
+        if (fragmentArm !== arm) {
+            throw new GradingArmError(`fragment for eval "${fragment.evalId}" is from the "${fragmentArm}" arm, expected "${arm}"`);
         }
         for (const expectation of fragment.expectations) {
             expectations.push({
                 text: expectation.text,
                 passed: expectation.passed,
                 ...(expectation.evidence === undefined ? {} : { evidence: expectation.evidence }),
+                evalId: fragment.evalId,
             });
         }
     }
     const passed = expectations.filter(e => e.passed).length;
-    return { summary: { passed, total: expectations.length }, expectations, runNonce };
+    // `runNonce` is deliberately NOT carried onto the returned report. The report is
+    // `JSON.stringify`d straight into `results/grading.json` (and `baseline.json` on a
+    // `--baseline` run), so carrying it wrote the run's integrity secret to disk —
+    // breaking a guarantee stated in four docblocks, and the same guarantee that
+    // justifies unlinking each grader fragment the instant it is read. Nothing
+    // consumed it: `reconcileGrading` ignores it, and `parseGradingJson`'s `runNonce`
+    // comes from an externally produced grading.json, a different producer entirely.
+    return { summary: { passed, total: expectations.length }, expectations, arm };
 }
 /**
  * Assemble the run's aggregate friction report from every eval's fragment
@@ -56,8 +115,8 @@ export function mergeFragmentsToFriction(fragments) {
     return FrictionReportSchema.parse({ items: deduped });
 }
 /**
- * Assemble vat's `tool-eval.json` from every eval's fragment (issue #145
- * Phase T; see tool-eval-schema.ts). A SEPARATE channel from `grading.json`
+ * Assemble vat's `tool-eval.json` from every eval's fragment (see
+ * tool-eval-schema.ts). A SEPARATE channel from `grading.json`
  * and from friction (C2) — tool verdicts judge declared `toolExpectations`
  * against the transcript, not prose expectations or packaging friction.
  *

package/dist/skill-test/fragment-merge.js.map

@@ -1 +1 @@
-{"version":3,"file":"fragment-merge.js","sourceRoot":"","sources":["../../src/skill-test/fragment-merge.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAuB,MAAM,sBAAsB,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAA0B,MAAM,sBAAsB,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAuB,MAAM,uBAAuB,CAAC;AAElF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAAyB,EAAE,QAAgB;IACjF,MAAM,YAAY,GAAsC,EAAE,CAAC;IAE3D,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,IAAI,iBAAiB,CACzB,sBAAsB,QAAQ,CAAC,MAAM,uBAAuB,QAAQ,CAAC,QAAQ,gBAAgB,QAAQ,GAAG,CACzG,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,WAAW,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YAChD,YAAY,CAAC,IAAI,CAAC;gBAChB,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,GAAG,CAAC,WAAW,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC;aAClF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACzD,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;AACrF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAyB;IAChE,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAExE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO,oBAAoB,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAyB;IAChE,MAAM,KAAK,GAAG,SAAS;SACpB,MAAM,CAAC,CAAC,QAAQ,EAA0E,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC;SACzH,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEpE,OAAO,oBAAoB,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"fragment-merge.js","sourceRoot":"","sources":["../../src/skill-test/fragment-merge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,oBAAoB,EAAuB,MAAM,sBAAsB,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAA0B,MAAM,sBAAsB,CAAC;AAClG,OAAO,EAAE,oBAAoB,EAAuB,MAAM,uBAAuB,CAAC;AAElF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,oFAAoF;AACpF,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;IAC3G,OAAO,UAAU,MAAM,KAAK,KAAK,CAAC,MAAM,SAAS,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,SAAyB,EACzB,QAAgB,EAChB,GAAuB;IAEvB,MAAM,YAAY,GAAsC,EAAE,CAAC;IAE3D,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,IAAI,iBAAiB,CACzB,sBAAsB,QAAQ,CAAC,MAAM,sBAAsB,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI;gBAChG,YAAY,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAC3C,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,IAAI,MAAM,CAAC;QAC3C,IAAI,WAAW,KAAK,GAAG,EAAE,CAAC;YACxB,MAAM,IAAI,eAAe,CACvB,sBAAsB,QAAQ,CAAC,MAAM,kBAAkB,WAAW,oBAAoB,GAAG,GAAG,CAC7F,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,WAAW,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YAChD,YAAY,CAAC,IAAI,CAAC;gBAChB,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,GAAG,CAAC,WAAW,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC;gBACjF,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACzD,iFAAiF;IACjF,mFAAmF;IACnF,+EAA+E;IAC/E,6EAA6E;IAC7E,2EAA2E;IAC3E,kFAAkF;IAClF,iFAAiF;IACjF,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;AAChF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAyB;IAChE,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAExE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO,oBAAoB,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAyB;IAChE,MAAM,KAAK,GAAG,SAAS;SACpB,MAAM,CAAC,CAAC,QAAQ,EAA0E,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC;SACzH,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEpE,OAAO,oBAAoB,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/C,CAAC"}

package/dist/skill-test/grader-prompt.d.ts

@@ -15,7 +15,7 @@ export interface BuildGraderPromptOptions {
     /** Per-run integrity nonce the grader must copy verbatim into the fragment's `runNonce`. */
     nonce: string;
     /**
-     * The eval's declared tool expectations (issue #145 Phase T — see
+     * The eval's declared tool expectations (see
      * `eval-inputs.ts`'s `EvalEntrySchema.toolExpectations`). When present, the
      * grader is additionally instructed to judge these FROM THE TRANSCRIPT and
      * emit a `tool` object (see {@link import('./tool-eval-schema.js').ToolVerdictBody})
@@ -36,7 +36,7 @@ export interface BuildGraderPromptOptions {
     }>;
 }
 /**
- * Build the prompt handed to the blind grader subagent (issue #145 — GRADER
+ * Build the prompt handed to the blind grader subagent (the GRADER
  * half of the per-eval executor/grader pipeline). The grader receives ONE
  * eval's captured transcript and expectations, and must produce ONE fragment
  * (see eval-fragment.ts) — never grade any other eval, never touch the
@@ -56,6 +56,13 @@ export interface BuildGraderPromptOptions {
  * always present regardless of any earlier prompt content.
  */
 export declare function buildGraderPrompt(opts: BuildGraderPromptOptions): string;
+/**
+ * The label of every invariant {@link assertGraderPromptInvariants} enforces, in
+ * order. Exported so the test table that removes one directive at a time can pin
+ * that it covers each invariant EXACTLY once — the check that would have caught
+ * the dead pattern above, and that catches a row silently lost in a refactor.
+ */
+export declare const GRADER_PROMPT_INVARIANT_LABELS: readonly string[];
 /**
  * Invariants for the grader prompt: MUST reference the fragment output path,
  * MUST instruct STOP, MUST forbid opening a browser/viewer and forbid
@@ -63,12 +70,25 @@ export declare function buildGraderPrompt(opts: BuildGraderPromptOptions): strin
  * `appendIntegrityNonceDirective` was applied). Throws `PromptInvariantError`
  * on violation.
  *
- * The checks run against OUR scaffolding ONLY — the (attacker-controlled)
- * `transcript` is excised first (mirrors {@link assertExecutorPromptInvariants}
- * excluding the adopter task). Otherwise a transcript that happened to contain
- * e.g. "STOP" could satisfy the invariant and mask a real regression in the
- * builder's own directives. `transcript` is optional so callers testing a bare
- * scaffolding string need not supply one.
+ * The checks run against OUR scaffolding ONLY — the contents of every untrusted
+ * fence are excised first (mirrors {@link assertExecutorPromptInvariants}
+ * excluding the adopter task). Otherwise text that happened to contain e.g.
+ * "STOP" could satisfy the invariant and mask a real regression in the builder's
+ * own directives — and that is not hypothetical: with `toolExpectations`
+ * unfenced, a suite supplying `STOP fragment forbidden browser iterate runNonce`
+ * plus `Each "friction" item MUST be a JSON object:` passed this assert on a
+ * prompt with EVERY ONE of vat's own directive lines deleted. The excision now
+ * covers the transcript, the subject manifest, the suite's own
+ * `expectations`/`expected_output`, AND its `toolExpectations` — every channel
+ * that reaches the prompt from the fetched artifact the skill travels in.
+ *
+ * `nonce` is REQUIRED and is what locates those regions. It is the run's own
+ * nonce or nothing: a caller that passes the wrong value (the transcript, say, as
+ * an earlier version of the production call site did) or `''` finds no markers,
+ * cuts nothing, and — because {@link FENCED_BLOCKS} now compares markers
+ * byte-exactly against it — is REFUSED rather than quietly downgraded to a check
+ * over attacker-controlled text. A caller asserting a bare scaffolding string
+ * with no fences in it may pass `''`; there is then nothing to locate.
  */
-export declare function assertGraderPromptInvariants(prompt: string, transcript?: string): void;
+export declare function assertGraderPromptInvariants(prompt: string, nonce: string): void;
 //# sourceMappingURL=grader-prompt.d.ts.map

package/dist/skill-test/grader-prompt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grader-prompt.d.ts","sourceRoot":"","sources":["../../src/skill-test/grader-prompt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAGzD,MAAM,WAAW,wBAAwB;IACvC,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,wGAAwG;IACxG,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,8FAA8F;IAC9F,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAC;IACnB,wGAAwG;IACxG,WAAW,EAAE,MAAM,CAAC;IACpB,4FAA4F;IAC5F,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjF;AAqGD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,wBAAwB,GAAG,MAAM,CAqExE;AAcD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,SAAK,GAAG,IAAI,CAsBlF"}
+{"version":3,"file":"grader-prompt.d.ts","sourceRoot":"","sources":["../../src/skill-test/grader-prompt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAGzD,MAAM,WAAW,wBAAwB;IACvC,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,wGAAwG;IACxG,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,8FAA8F;IAC9F,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAC;IACnB,wGAAwG;IACxG,WAAW,EAAE,MAAM,CAAC;IACpB,4FAA4F;IAC5F,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjF;AA4LD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,wBAAwB,GAAG,MAAM,CA8DxE;AAyBD;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAAgD,CAAC;AAyF7G;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAahF"}