@wrenai/genbi 0.0.4 → 0.0.5

package/dist-server/harness/components/egress.js

@@ -0,0 +1,469 @@
+import { z } from "zod";
+import { answerShapeSchema } from "../providers/zone.js";
+export const slotDeclarationSchema = z.object({
+    slot_id: z.string().min(1).max(128),
+    /** The planner's layout hint; carried in the Hub `plan_report` call, ignored by verification. */
+    block_type: z.string().max(64).optional(),
+    expected_shape: answerShapeSchema,
+    question: z.string().min(1),
+    unit: z.string().optional(),
+    max_rows: z.number().int().positive().optional(),
+}).strict();
+const slotsSchema = z.array(slotDeclarationSchema).min(1).max(64)
+    .refine((slots) => new Set(slots.map((slot) => slot.slot_id)).size === slots.length, "slot ids must be unique");
+const judgeOutputSchema = z.object({
+    verdict: z.enum(["pass", "redact", "refuse"]),
+    reason_category: z.string().max(64).optional(),
+    redact_columns: z.array(z.string().min(1)).max(256).optional(),
+}).strict();
+const tableSchema = z.object({
+    columns: z.array(z.string()).min(1),
+    rows: z.array(z.unknown()),
+    summary: z.string().optional(),
+    unit: z.string().optional(),
+    text: z.string().optional(),
+    definition: z.unknown().optional(),
+    verified: z.boolean().optional(),
+    slot_id: z.string().optional(),
+}).passthrough();
+const narrativeSchema = z.object({ text: z.string().min(1), slot_id: z.string().optional(), definition: z.unknown().optional(), unit: z.string().optional(), verified: z.boolean().optional() }).passthrough();
+/** A per-slot entry the callee declined itself: `{slot_id, status: "unanswerable" | "refused", reason?}`. */
+const unavailableEntrySchema = z.object({ slot_id: z.string().min(1), status: z.enum(["unanswerable", "refused"]) }).passthrough();
+/** A batch is an array of per-slot entries, or `{answers: [...]}`; entries are classified one by one, so an unanswerable entry does not invalidate its neighbours. */
+const batchSchema = z.union([
+    z.array(z.unknown()),
+    z.object({ answers: z.array(z.unknown()) }).passthrough(),
+]);
+const PAYMENT_CARD = /\b(?:\d[ -]?){13,19}\b/;
+const PHONE_NUMBER = /(?:\+?\d{1,3}[ -]?)?\(?\d{3}\)?[ -]?\d{3}[ -]?\d{4}\b/;
+/** Built-in PII patterns applied to every string cell, in addition to the policy's own. */
+export const BUILT_IN_PII_PATTERNS = [
+    /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/, // email
+    /\b\d{3}-\d{2}-\d{4}\b/, // US SSN
+    PAYMENT_CARD,
+    PHONE_NUMBER,
+    /\b(?:25[0-5]|2[0-4]\d|1?\d?\d)(?:\.(?:25[0-5]|2[0-4]\d|1?\d?\d)){3}\b/, // IPv4
+    /\+[1-9]\d{0,2}\.\d{6,14}\b/, // dotted international phone
+];
+/**
+ * The card and phone patterns match bare digit runs, so the fraction of a decimal (`0.12345678901234`)
+ * looks like one. They alone run on the text with each decimal cut to its integer part; every other
+ * pattern, the policy's own included, runs on the raw text.
+ */
+const DIGIT_RUN_PATTERNS = new Set([PAYMENT_CARD, PHONE_NUMBER]);
+/** A run of dot-separated digit groups. Only a two-group run is a decimal; three or more (an IPv4 address, a version) stays as written. */
+const DOTTED_DIGITS = /\d+(?:\.\d+)+/g;
+function withoutFractions(text) {
+    return text.replace(DOTTED_DIGITS, (run) => {
+        const groups = run.split(".");
+        return groups.length === 2 ? groups[0] : run;
+    });
+}
+function piiPatterns(policy) {
+    return [...BUILT_IN_PII_PATTERNS, ...policy.pii_patterns.map(compile)];
+}
+function hasPii(text, patterns) {
+    const integral = withoutFractions(text);
+    return patterns.some((pattern) => pattern.test(DIGIT_RUN_PATTERNS.has(pattern) ? integral : text));
+}
+// Person-name columns count as identifiers: a row keyed by a person's name describes one person.
+// A bare `name` does not, so `product_name` and `category_name` stay grouping keys.
+const IDENTIFIER_LIKE = /(^|[_\s-])(id|ids|uuid|guid|key|email|e_mail|phone|ssn|account|user|customer|employee|person|member|(?:first|last|full|given|family)[_\s-]?name|surname)([_\s-]|$)/i;
+const COUNT_LIKE = /^(count|cnt|n|num|n_[a-z_]+|[a-z_]+_count|number_of_[a-z_]+|num_[a-z_]+|count_[a-z_]+|cnt_[a-z_]+|[a-z_]+_cnt|group_size|size)$/i;
+function compile(pattern) {
+    try {
+        return new RegExp(pattern, "i");
+    }
+    catch {
+        return new RegExp(pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i");
+    }
+}
+function cellStrings(rows) {
+    const out = [];
+    for (const row of rows) {
+        const values = Array.isArray(row) ? row : row && typeof row === "object" ? Object.values(row) : [row];
+        for (const value of values)
+            if (typeof value === "string")
+                out.push(value);
+    }
+    return out;
+}
+function columnValues(table, column) {
+    const index = table.columns.indexOf(column);
+    return table.rows.map((row) => Array.isArray(row) ? row[index] : row && typeof row === "object" ? row[column] : undefined);
+}
+function actualShapeFits(expected, table) {
+    switch (expected) {
+        case "scalar": return table.rows.length === 1 && table.columns.length === 1;
+        case "series": return table.columns.length >= 2;
+        case "table": return true;
+        // A batch callee answers a narrative slot with the rows it grounded the prose in plus the prose
+        // as `summary`; the prose is what crosses (see the table branch of `verifyEgress`).
+        case "narrative": return typeof table.summary === "string" && table.summary.trim().length > 0;
+    }
+}
+function identifierLikeKeys(table) {
+    return table.columns.filter((column) => IDENTIFIER_LIKE.test(column) && columnValues(table, column).some((value) => typeof value !== "number"));
+}
+function groupCount(table) {
+    const counts = table.columns.filter((column) => COUNT_LIKE.test(column));
+    return counts.length > 0 ? table.rows.length : table.rows.length;
+}
+/** Smallest group size the answer itself reports, or undefined when it carries no group metadata. */
+function smallestGroup(table) {
+    const counts = table.columns.filter((column) => COUNT_LIKE.test(column));
+    const values = counts.flatMap((column) => columnValues(table, column)).filter((value) => typeof value === "number" && Number.isFinite(value));
+    return values.length ? Math.min(...values) : undefined;
+}
+/**
+ * The free text the callee's model wrote on an entry. It is model output, not data: it is scanned
+ * like the cells before the judge, and after a non-pass verdict none of it crosses (see `redactColumns`).
+ * Keys outside the declared entry shape are never scanned because they never cross: every disclosed
+ * answer is rebuilt field by field.
+ */
+function modelText(answer) {
+    return [answer.summary, answer.text, answer.unit].filter((value) => typeof value === "string");
+}
+/**
+ * The policy's sensitive-column patterns and the PII patterns, applied to free text. In prose a
+ * column pattern must match as a whole word ("phone" hits "contact phone", not "iPhone"); column
+ * names are still matched exactly as written.
+ */
+function textReason(texts, policy) {
+    const sensitive = policy.sensitive_column_patterns.map(compile).map((pattern) => new RegExp(`\\b(?:${pattern.source})\\b`, "i"));
+    if (texts.some((text) => sensitive.some((pattern) => pattern.test(text))))
+        return "sensitive_column";
+    const pii = piiPatterns(policy);
+    if (texts.some((text) => hasPii(text, pii)))
+        return "pii_pattern";
+    return undefined;
+}
+function deterministic(slot, table, policy) {
+    if (!policy.allowed_shapes.includes(slot.expected_shape) || !actualShapeFits(slot.expected_shape, table))
+        return "shape_mismatch";
+    const limit = Math.min(policy.max_rows, slot.max_rows ?? Number.POSITIVE_INFINITY);
+    if (table.rows.length > limit)
+        return "row_limit";
+    const sensitive = policy.sensitive_column_patterns.map(compile);
+    if (table.columns.some((column) => sensitive.some((pattern) => pattern.test(column))))
+        return "sensitive_column";
+    const pii = piiPatterns(policy);
+    if (cellStrings(table.rows).some((cell) => hasPii(cell, pii)))
+        return "pii_pattern";
+    const inText = textReason(modelText(table), policy);
+    if (inText)
+        return inText;
+    if (policy.min_group_size > 1 && table.rows.length > 0) {
+        if (identifierLikeKeys(table).length > 0)
+            return "group_size";
+        const smallest = smallestGroup(table);
+        if (smallest !== undefined && smallest < policy.min_group_size)
+            return "group_size";
+    }
+    return undefined;
+}
+function deterministicNarrative(slot, text, policy, unit) {
+    if (slot.expected_shape !== "narrative" || !policy.allowed_shapes.includes("narrative"))
+        return "shape_mismatch";
+    return textReason(unit !== undefined ? [text, unit] : [text], policy);
+}
+function extractJsonObject(text) {
+    const start = text.indexOf("{");
+    const end = text.lastIndexOf("}");
+    if (start < 0 || end <= start)
+        throw new Error("no JSON object");
+    return JSON.parse(text.slice(start, end + 1));
+}
+async function consultJudge(judge, input, policy, parent) {
+    if (!judge)
+        return { verdict: "refuse", reason: "judge_unavailable" };
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), policy.judge_timeout_ms);
+    const abort = () => controller.abort();
+    parent?.addEventListener("abort", abort, { once: true });
+    if (parent?.aborted)
+        controller.abort();
+    try {
+        const raw = await Promise.race([
+            judge(input, controller.signal),
+            new Promise((_, reject) => controller.signal.addEventListener("abort", () => reject(new Error("judge timed out")), { once: true })),
+        ]);
+        const value = typeof raw === "string" ? extractJsonObject(raw) : raw;
+        const parsed = judgeOutputSchema.safeParse(value);
+        if (!parsed.success)
+            return { verdict: "refuse", reason: "judge_invalid" };
+        if (parsed.data.verdict === "refuse")
+            return { verdict: "refuse", reason: "judge_refused" };
+        if (parsed.data.verdict === "redact") {
+            if (!parsed.data.redact_columns?.length)
+                return { verdict: "refuse", reason: "judge_invalid" };
+            return { verdict: "redact", redact_columns: parsed.data.redact_columns };
+        }
+        return { verdict: "pass" };
+    }
+    catch {
+        return { verdict: "refuse", reason: controller.signal.aborted ? "judge_unavailable" : "judge_invalid" };
+    }
+    finally {
+        clearTimeout(timer);
+        parent?.removeEventListener("abort", abort);
+    }
+}
+/** A host-written, value-free description of a redacted table: the row count and the surviving column names. */
+function neutralSummary(columns, rowCount) {
+    return `${rowCount} ${rowCount === 1 ? "row" : "rows"}; columns: ${columns.join(", ")}.`;
+}
+/**
+ * Drops the judge's columns and rebuilds the entry from the surviving columns and rows alone. The
+ * callee's `summary`, `text`, `unit` and every other field are model-written or undeclared and are
+ * not carried, because the redacted values may be named in them; `summary` becomes {@link neutralSummary}.
+ */
+function isPlainObject(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+function redactColumns(table, columns) {
+    const drop = new Set(columns);
+    if (columns.some((column) => !table.columns.includes(column)))
+        return undefined;
+    const keep = table.columns.filter((column) => !drop.has(column));
+    if (keep.length === 0)
+        return undefined;
+    // A row that is neither positional nor keyed cannot be projected, so the redaction cannot be shown to hold.
+    if (!table.rows.every((row) => Array.isArray(row) || isPlainObject(row)))
+        return undefined;
+    const rows = table.rows.map((row) => Array.isArray(row)
+        ? keep.map((column) => row[table.columns.indexOf(column)])
+        : Object.fromEntries(keep.map((column) => [column, row[column]])));
+    return { columns: keep, rows, summary: neutralSummary(keep, rows.length) };
+}
+/** Redacted string values shorter than this would match almost any text, so they are not searched for. */
+const LEAK_MIN_LENGTH = 3;
+/**
+ * Post-redaction consistency: no string value of a redacted column may survive in anything that
+ * crosses (the entry's free text, the surviving column names, the surviving string cells).
+ * Numeric values are not searched for: digits recur in counts and amounts by coincidence.
+ */
+function redactionLeaks(original, dropped, redacted) {
+    const values = dropped.flatMap((column) => columnValues(original, column))
+        .filter((value) => typeof value === "string")
+        .map((value) => value.trim().toLowerCase())
+        .filter((value) => value.length >= LEAK_MIN_LENGTH);
+    if (values.length === 0)
+        return false;
+    const crossing = [...modelText(redacted), ...redacted.columns, ...cellStrings(redacted.rows)].map((text) => text.toLowerCase());
+    return values.some((value) => crossing.some((text) => text.includes(value)));
+}
+/** A refused slot crosses as its id, the status and the reason category, nothing else. */
+function refusedAnswer(slot, reason) {
+    return { slot_id: slot.slot_id, status: "refused", reason_category: reason };
+}
+/** The disclosed shape of a table: columns and rows only. `definition`, SQL and every unknown key are dropped by construction. */
+function discloseTable(slot, table, status) {
+    const value = slot.expected_shape === "scalar" ? columnValues(table, table.columns[0])[0] : undefined;
+    return { slot_id: slot.slot_id, status, shape: slot.expected_shape, columns: [...table.columns], rows: structuredClone(table.rows),
+        // Only the planner-declared unit crosses; the callee model's `unit` is model text the judge never sees.
+        ...(value !== undefined ? { value } : {}), ...(slot.unit !== undefined ? { unit: slot.unit } : {}),
+        ...(table.summary !== undefined ? { summary: table.summary } : {}) };
+}
+function provenanceOf(slot, table) {
+    const definition = table.definition && typeof table.definition === "object" ? table.definition : undefined;
+    return { slot_id: slot.slot_id, ...(table.definition !== undefined ? { definition: structuredClone(table.definition) } : {}),
+        ...(typeof definition?.sql === "string" ? { sql: definition.sql } : {}),
+        ...(Array.isArray(definition?.source_tables) ? { source_tables: definition.source_tables } : {}),
+        row_count: table.rows?.length ?? 0, columns: [...(table.columns ?? [])], ...(typeof table.verified === "boolean" ? { verified: table.verified } : {}) };
+}
+/** Reads the slot declarations from the alias-call input; absent slots mean one implicit table slot for the request text. */
+export function readSlots(request) {
+    // The preamble is untrusted planner text either way; an object (the Hub `plan_report` shape) is serialised for the judge.
+    const rawPreamble = request.input["preamble"];
+    const preamble = typeof rawPreamble === "string" ? rawPreamble : rawPreamble !== undefined && rawPreamble !== null ? JSON.stringify(rawPreamble) : undefined;
+    // `input.slots` is this harness's declaration key; `input.questions` is the Hub `plan_report` call shape. Same entries.
+    const declared = request.input["slots"] !== undefined ? request.input["slots"] : request.input["questions"];
+    if (declared === undefined) {
+        return { slots: [{ slot_id: "answer", expected_shape: "table", question: request.request }], implicit: true, ...(preamble !== undefined ? { preamble } : {}) };
+    }
+    const parsed = slotsSchema.safeParse(declared);
+    if (!parsed.success)
+        return { error: "invalid_request" };
+    return { slots: parsed.data, implicit: false, ...(preamble !== undefined ? { preamble } : {}) };
+}
+/**
+ * What crosses for a per-slot child that failed or was refused as a whole: every declared slot
+ * as refused with the category that says what happened (`callee_error` for a child that failed
+ * with `callee_failed`, `callee_refused` for a refused child), so the caller can still lay out
+ * the report with unavailable cells. Only slot ids, the status and the category cross; nothing
+ * the child produced does. Undefined for a request without slots, which keeps the raw result.
+ */
+export function wholeChildDisclosure(request, reason) {
+    const read = readSlots(request);
+    if ("error" in read || read.implicit)
+        return undefined;
+    return { status: "ok", output: { kind: "value", value: { answers: read.slots.map((slot) => refusedAnswer(slot, reason)) } }, provenance: { verified: false } };
+}
+function classify(value) {
+    const table = tableSchema.safeParse(value);
+    if (table.success)
+        return { kind: "table", table: table.data };
+    const narrative = narrativeSchema.safeParse(value);
+    return narrative.success ? { kind: "narrative", narrative: narrative.data } : undefined;
+}
+function answersOf(value, slots) {
+    const map = new Map();
+    const single = classify(value);
+    if (single) {
+        if (slots.length !== 1)
+            return undefined;
+        map.set(slots[0].slot_id, single);
+        return map;
+    }
+    const batch = batchSchema.safeParse(value);
+    if (!batch.success)
+        return undefined;
+    const list = Array.isArray(batch.data) ? batch.data : batch.data.answers;
+    list.forEach((item, index) => {
+        const answer = classify(item);
+        const claimed = item && typeof item === "object" ? item.slot_id : undefined;
+        const id = typeof claimed === "string" ? claimed : slots[index]?.slot_id;
+        if (answer && id !== undefined && slots.some((slot) => slot.slot_id === id) && !map.has(id))
+            map.set(id, answer);
+    });
+    return map;
+}
+/** Slot ids the callee itself marked unanswerable or refused; only the category crosses, never the callee's reason text. */
+function declinedOf(value) {
+    const list = Array.isArray(value) ? value : value && typeof value === "object" && Array.isArray(value.answers) ? value.answers : [];
+    const declined = new Set();
+    for (const item of list) {
+        const parsed = unavailableEntrySchema.safeParse(item);
+        if (parsed.success)
+            declined.add(parsed.data.slot_id);
+    }
+    return declined;
+}
+/**
+ * Verifies one callee result against the disclosure policy, slot by slot,
+ * and returns what the caller may see plus the host-side decisions and
+ * provenance. Deterministic checks run first; only a slot that passes them
+ * reaches the judge. On `pass` and `redact` the disclosed answer is rebuilt
+ * from columns and rows alone, so `definition`, SQL and any other key the
+ * callee attached never cross. Text the callee's model wrote (`summary`,
+ * `text`, `unit`) is scanned before the judge, crosses only on `pass`, and on
+ * `redact` is replaced by a host-written sentence naming the row count and
+ * the surviving columns.
+ */
+export async function verifyEgress(request, result, options) {
+    const read = readSlots(request);
+    if ("error" in read) {
+        return { disclosed: { status: "refused", code: "callee_refused", message: `egress refused: ${read.error}` },
+            decisions: [{ slot_id: "*", status: "refused", reason_category: read.error, judge: "skipped", row_count: 0 }], provenance: [] };
+    }
+    const { slots, implicit, preamble } = read;
+    if (result.status === "refused") {
+        const decisions = slots.map((slot) => ({ slot_id: slot.slot_id, status: "refused", reason_category: "callee_refused", judge: "skipped", row_count: 0 }));
+        return { disclosed: wholeChildDisclosure(request, "callee_refused") ?? result, decisions, provenance: [] };
+    }
+    if (result.status === "error") {
+        const decisions = slots.map((slot) => ({ slot_id: slot.slot_id, status: "refused", reason_category: "callee_error", judge: "skipped", row_count: 0 }));
+        const unavailable = result.code === "callee_failed" ? wholeChildDisclosure(request, "callee_error") : undefined;
+        return { disclosed: unavailable ?? result, decisions, provenance: [] };
+    }
+    const answers = result.output.kind === "value" ? answersOf(result.output.value, slots) : undefined;
+    const declinedByCallee = result.output.kind === "value" ? declinedOf(result.output.value) : new Set();
+    const decisions = [];
+    const provenance = [];
+    const disclosed = [];
+    for (const slot of slots) {
+        const answer = answers?.get(slot.slot_id);
+        if (!answer) {
+            const reason = declinedByCallee.has(slot.slot_id) ? "unanswerable" : "invalid_answer";
+            decisions.push({ slot_id: slot.slot_id, status: "refused", reason_category: reason, judge: "skipped", row_count: 0 });
+            disclosed.push(refusedAnswer(slot, reason));
+            continue;
+        }
+        if (answer.kind === "narrative") {
+            const text = answer.narrative.text;
+            const reason = deterministicNarrative(slot, text, options.policy, answer.narrative.unit);
+            provenance.push(provenanceOf(slot, answer.narrative));
+            if (reason) {
+                decisions.push({ slot_id: slot.slot_id, status: "refused", reason_category: reason, judge: "skipped", row_count: 0 });
+                disclosed.push(refusedAnswer(slot, reason));
+                continue;
+            }
+            const judged = await consultJudge(options.judge, { policy: options.policy, untrusted_question: slot.question, ...(preamble !== undefined ? { untrusted_preamble: preamble } : {}),
+                expected_shape: slot.expected_shape, answer: { columns: [], rows: [], text }, metadata: { row_count: 0, group_count: 0, identifier_like_keys: [], columns_touched: [] } }, options.policy, options.signal);
+            if (judged.verdict !== "pass") {
+                // A narrative answer has no columns to drop: a redact verdict on it cannot be carried through.
+                const reason = "reason" in judged ? judged.reason : "redact_leak";
+                decisions.push({ slot_id: slot.slot_id, status: "refused", reason_category: reason, judge: judged.verdict, row_count: 0 });
+                disclosed.push(refusedAnswer(slot, reason));
+                continue;
+            }
+            decisions.push({ slot_id: slot.slot_id, status: "ok", judge: "pass", row_count: 0 });
+            disclosed.push({ slot_id: slot.slot_id, status: "ok", shape: "narrative", text, ...(slot.unit !== undefined ? { unit: slot.unit } : {}) });
+            continue;
+        }
+        provenance.push(provenanceOf(slot, answer.table));
+        let table = answer.table;
+        const reason = deterministic(slot, table, options.policy);
+        if (reason) {
+            decisions.push({ slot_id: slot.slot_id, status: "refused", reason_category: reason, judge: "skipped", row_count: table.rows.length });
+            disclosed.push(refusedAnswer(slot, reason));
+            continue;
+        }
+        const judged = await consultJudge(options.judge, { policy: options.policy, untrusted_question: slot.question, ...(preamble !== undefined ? { untrusted_preamble: preamble } : {}),
+            expected_shape: slot.expected_shape, answer: { columns: table.columns, rows: table.rows, ...(table.summary !== undefined ? { summary: table.summary } : {}) },
+            metadata: { row_count: table.rows.length, group_count: groupCount(table), identifier_like_keys: identifierLikeKeys(table), columns_touched: [...table.columns] } }, options.policy, options.signal);
+        if (judged.verdict === "refuse") {
+            const reasonCategory = "reason" in judged ? judged.reason : "judge_refused";
+            decisions.push({ slot_id: slot.slot_id, status: "refused", reason_category: reasonCategory, judge: "refuse", row_count: table.rows.length });
+            disclosed.push(refusedAnswer(slot, reasonCategory));
+            continue;
+        }
+        let status = "ok";
+        if (judged.verdict === "redact") {
+            const dropped = judged.redact_columns ?? [];
+            const redacted = redactColumns(table, dropped);
+            const again = !redacted ? "judge_invalid" : deterministic(slot, redacted, options.policy)
+                ?? (redactionLeaks(table, dropped, redacted) ? "redact_leak" : undefined)
+                // A narrative slot's answer is the model's prose itself; after a redact verdict no model text crosses.
+                ?? (slot.expected_shape === "narrative" ? "redact_leak" : undefined);
+            if (!redacted || again) {
+                const reasonCategory = again ?? "judge_invalid";
+                decisions.push({ slot_id: slot.slot_id, status: "refused", reason_category: reasonCategory, judge: "redact", row_count: table.rows.length });
+                disclosed.push(refusedAnswer(slot, reasonCategory));
+                continue;
+            }
+            table = redacted;
+            status = "partial";
+        }
+        if (slot.expected_shape === "narrative") {
+            // Narrowing: only the prose crosses for a narrative slot, never the rows it was grounded in.
+            const text = table.summary.trim();
+            const textReason = deterministicNarrative(slot, text, options.policy);
+            if (textReason) {
+                decisions.push({ slot_id: slot.slot_id, status: "refused", reason_category: textReason, judge: judged.verdict, row_count: table.rows.length });
+                disclosed.push(refusedAnswer(slot, textReason));
+                continue;
+            }
+            decisions.push({ slot_id: slot.slot_id, status, judge: judged.verdict, row_count: table.rows.length });
+            disclosed.push({ slot_id: slot.slot_id, status, shape: "narrative", text, ...(slot.unit !== undefined ? { unit: slot.unit } : {}) });
+            continue;
+        }
+        decisions.push({ slot_id: slot.slot_id, status, judge: judged.verdict, row_count: table.rows.length });
+        disclosed.push(discloseTable(slot, table, status));
+    }
+    const anyDisclosed = disclosed.some((answer) => answer.status !== "refused");
+    if (implicit) {
+        const only = disclosed[0];
+        if (only.status === "refused") {
+            return { disclosed: { status: "refused", code: "callee_refused", message: `egress refused: ${only.reason_category}` }, decisions, provenance };
+        }
+        // A single implicit slot keeps the tabular value contract callers already consume, minus definition/SQL.
+        return { disclosed: { status: "ok", output: { kind: "value", value: { columns: only.columns, rows: only.rows, verified: true,
+                        ...(only.summary !== undefined ? { summary: only.summary } : {}), egress: { status: only.status } } }, provenance: { verified: true } }, decisions, provenance };
+    }
+    return { disclosed: { status: "ok", output: { kind: "value", value: { answers: disclosed } }, provenance: { verified: anyDisclosed } }, decisions, provenance };
+}

package/dist-server/harness/components/in-process.d.ts

@@ -0,0 +1,7 @@
+import type { InProcessOptions } from "../route/types.js";
+import type { RunAgentResult } from "../session/types.js";
+import { type ExecutionPlan } from "./runner.js";
+/** Executable format 0.2 path; never flattened into the legacy agent tool union. */
+export declare function runInProcessComponents(plan: ExecutionPlan, options: InProcessOptions): Promise<RunAgentResult>;
+/** `answer_query` when the plan has it, else the plan's single entry; a multi-entry plan without `answer_query` keeps the historical default and fails as before. */
+export declare function defaultEntry(plan: ExecutionPlan): string;