bridgebench 3.1.0-alpha.0 → 3.1.0-alpha.2

package/dist/{tasks-CpaCJ6JE.d.cts → tasks-BmhWuMBD.d.ts}

@@ -1,9 +1,9 @@
 import { z } from 'zod';
 
 declare const METHODOLOGY_VERSION = "arena-v0.3.0";
-declare const BenchmarkCategorySchema: z.ZodEnum<["reasoning", "hallucination"]>;
+declare const BenchmarkCategorySchema: z.ZodEnum<["reasoning", "hallucination", "security", "bullshit", "refactoring", "debugging", "generation", "speed"]>;
 type BenchmarkCategory = z.infer<typeof BenchmarkCategorySchema>;
-declare const CATEGORIES: ["reasoning", "hallucination"];
+declare const CATEGORIES: ["reasoning", "hallucination", "security", "bullshit", "refactoring", "debugging", "generation", "speed"];
 declare const CATEGORY_CLUSTERS: Record<BenchmarkCategory, readonly string[]>;
 declare const CATEGORY_META: Record<BenchmarkCategory, {
     label: string;
@@ -16,21 +16,21 @@ declare const TaskArtifactSchema: z.ZodObject<{
     label: z.ZodString;
     content: z.ZodString;
 }, "strict", z.ZodTypeAny, {
-    type: "code" | "log" | "config" | "spec" | "diff" | "table" | "note";
     id: string;
-    content: string;
+    type: "code" | "log" | "config" | "spec" | "diff" | "table" | "note";
     label: string;
+    content: string;
 }, {
-    type: "code" | "log" | "config" | "spec" | "diff" | "table" | "note";
     id: string;
-    content: string;
+    type: "code" | "log" | "config" | "spec" | "diff" | "table" | "note";
     label: string;
+    content: string;
 }>;
 type TaskArtifact = z.infer<typeof TaskArtifactSchema>;
 declare const TaskPublicSchema: z.ZodObject<{
     id: z.ZodString;
     version: z.ZodString;
-    category: z.ZodEnum<["reasoning", "hallucination"]>;
+    category: z.ZodEnum<["reasoning", "hallucination", "security", "bullshit", "refactoring", "debugging", "generation", "speed"]>;
     cluster: z.ZodString;
     difficulty: z.ZodEnum<["hard", "expert"]>;
     title: z.ZodString;
@@ -42,47 +42,47 @@ declare const TaskPublicSchema: z.ZodObject<{
         label: z.ZodString;
         content: z.ZodString;
     }, "strict", z.ZodTypeAny, {
-        type: "code" | "log" | "config" | "spec" | "diff" | "table" | "note";
         id: string;
-        content: string;
+        type: "code" | "log" | "config" | "spec" | "diff" | "table" | "note";
         label: string;
+        content: string;
     }, {
-        type: "code" | "log" | "config" | "spec" | "diff" | "table" | "note";
         id: string;
-        content: string;
+        type: "code" | "log" | "config" | "spec" | "diff" | "table" | "note";
         label: string;
+        content: string;
     }>, "many">;
     tags: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
 }, "strict", z.ZodTypeAny, {
     id: string;
     version: string;
-    category: "reasoning" | "hallucination";
+    category: "reasoning" | "hallucination" | "security" | "bullshit" | "refactoring" | "debugging" | "generation" | "speed";
     cluster: string;
     difficulty: "hard" | "expert";
     title: string;
     summary: string;
     prompt: string;
     artifacts: {
-        type: "code" | "log" | "config" | "spec" | "diff" | "table" | "note";
         id: string;
-        content: string;
+        type: "code" | "log" | "config" | "spec" | "diff" | "table" | "note";
         label: string;
+        content: string;
     }[];
     tags: string[];
 }, {
     id: string;
     version: string;
-    category: "reasoning" | "hallucination";
+    category: "reasoning" | "hallucination" | "security" | "bullshit" | "refactoring" | "debugging" | "generation" | "speed";
     cluster: string;
     difficulty: "hard" | "expert";
     title: string;
     summary: string;
     prompt: string;
     artifacts: {
-        type: "code" | "log" | "config" | "spec" | "diff" | "table" | "note";
         id: string;
-        content: string;
+        type: "code" | "log" | "config" | "spec" | "diff" | "table" | "note";
         label: string;
+        content: string;
     }[];
     tags?: string[] | undefined;
 }>;
@@ -100,14 +100,14 @@ declare const TaskPrivateSchema: z.ZodObject<{
         completeness: z.ZodString;
     }, "strict", z.ZodTypeAny, {
         correctness: string;
+        evidenceGrounding: string;
         constraintHandling: string;
         completeness: string;
-        evidenceGrounding: string;
     }, {
         correctness: string;
+        evidenceGrounding: string;
         constraintHandling: string;
         completeness: string;
-        evidenceGrounding: string;
     }>;
 }, "strict", z.ZodTypeAny, {
     id: string;
@@ -117,9 +117,9 @@ declare const TaskPrivateSchema: z.ZodObject<{
     disqualifyingErrors: string[];
     rubric: {
         correctness: string;
+        evidenceGrounding: string;
         constraintHandling: string;
         completeness: string;
-        evidenceGrounding: string;
     };
 }, {
     id: string;
@@ -128,9 +128,9 @@ declare const TaskPrivateSchema: z.ZodObject<{
     requiredEvidence: string[];
     rubric: {
         correctness: string;
+        evidenceGrounding: string;
         constraintHandling: string;
         completeness: string;
-        evidenceGrounding: string;
     };
     disqualifyingErrors?: string[] | undefined;
 }>;
@@ -147,5 +147,7 @@ type CompleteArenaTask = ArenaTask & {
     private: TaskPrivate;
     privateHash: string;
 };
+/** Narrow a task to one carrying its hidden reference (present for every judged category). */
+declare function isCompleteArenaTask(task: ArenaTask): task is CompleteArenaTask;
 
-export { type ArenaTask as A, type BenchmarkCategory as B, CATEGORIES as C, METHODOLOGY_VERSION as M, type TaskArtifact as T, BenchmarkCategorySchema as a, CATEGORY_CLUSTERS as b, CATEGORY_META as c, type CompleteArenaTask as d, TaskArtifactSchema as e, type TaskPrivate as f, TaskPrivateSchema as g, type TaskPublic as h, TaskPublicSchema as i };
+export { type ArenaTask as A, type BenchmarkCategory as B, CATEGORIES as C, METHODOLOGY_VERSION as M, type TaskArtifact as T, BenchmarkCategorySchema as a, CATEGORY_CLUSTERS as b, CATEGORY_META as c, type CompleteArenaTask as d, TaskArtifactSchema as e, type TaskPrivate as f, TaskPrivateSchema as g, type TaskPublic as h, TaskPublicSchema as i, isCompleteArenaTask as j };

package/dist/tasks.cjs

@@ -7,8 +7,8 @@
 
 
 
-var _chunk4TWPCPRPcjs = require('./chunk-4TWPCPRP.cjs');
-require('./chunk-CIXITJW6.cjs');
+var _chunkQMOPRKWDcjs = require('./chunk-QMOPRKWD.cjs');
+require('./chunk-X3LPZGHS.cjs');
 
 
 
@@ -18,5 +18,4 @@ require('./chunk-CIXITJW6.cjs');
 
 
 
-exports.TASKS_PER_CATEGORY = _chunk4TWPCPRPcjs.TASKS_PER_CATEGORY; exports.TASKS_PER_CLUSTER = _chunk4TWPCPRPcjs.TASKS_PER_CLUSTER; exports.TaskLoader = _chunk4TWPCPRPcjs.TaskLoader; exports.buildCompetitorPrompt = _chunk4TWPCPRPcjs.buildCompetitorPrompt; exports.competitorPromptPolicyHash = _chunk4TWPCPRPcjs.competitorPromptPolicyHash; exports.defaultTaskRoot = _chunk4TWPCPRPcjs.defaultTaskRoot; exports.mergePrivateHalves = _chunk4TWPCPRPcjs.mergePrivateHalves; exports.validatePublicTaskFile = _chunk4TWPCPRPcjs.validatePublicTaskFile;
-//# sourceMappingURL=tasks.cjs.map
+exports.TASKS_PER_CATEGORY = _chunkQMOPRKWDcjs.TASKS_PER_CATEGORY; exports.TASKS_PER_CLUSTER = _chunkQMOPRKWDcjs.TASKS_PER_CLUSTER; exports.TaskLoader = _chunkQMOPRKWDcjs.TaskLoader; exports.buildCompetitorPrompt = _chunkQMOPRKWDcjs.buildCompetitorPrompt; exports.competitorPromptPolicyHash = _chunkQMOPRKWDcjs.competitorPromptPolicyHash; exports.defaultTaskRoot = _chunkQMOPRKWDcjs.defaultTaskRoot; exports.mergePrivateHalves = _chunkQMOPRKWDcjs.mergePrivateHalves; exports.validatePublicTaskFile = _chunkQMOPRKWDcjs.validatePublicTaskFile;

package/dist/tasks.d.cts

@@ -1,4 +1,4 @@
-import { f as TaskPrivate, B as BenchmarkCategory, d as CompleteArenaTask, A as ArenaTask } from './tasks-CpaCJ6JE.cjs';
+import { f as TaskPrivate, B as BenchmarkCategory, d as CompleteArenaTask, A as ArenaTask } from './tasks-BmhWuMBD.cjs';
 import 'zod';
 
 declare const TASKS_PER_CATEGORY = 12;

package/dist/tasks.d.ts

@@ -1,4 +1,4 @@
-import { f as TaskPrivate, B as BenchmarkCategory, d as CompleteArenaTask, A as ArenaTask } from './tasks-CpaCJ6JE.js';
+import { f as TaskPrivate, B as BenchmarkCategory, d as CompleteArenaTask, A as ArenaTask } from './tasks-BmhWuMBD.js';
 import 'zod';
 
 declare const TASKS_PER_CATEGORY = 12;

package/dist/tasks.js

@@ -7,8 +7,8 @@ import {
   defaultTaskRoot,
   mergePrivateHalves,
   validatePublicTaskFile
-} from "./chunk-JTVNKSMO.js";
-import "./chunk-UECBSKTD.js";
+} from "./chunk-DVMGL3L7.js";
+import "./chunk-AY45YLYL.js";
 export {
   TASKS_PER_CATEGORY,
   TASKS_PER_CLUSTER,
@@ -19,4 +19,3 @@ export {
   mergePrivateHalves,
   validatePublicTaskFile
 };
-//# sourceMappingURL=tasks.js.map

package/docs/README.md

@@ -1,25 +1,45 @@
 # BridgeBench documentation
 
-Start with the contract, then follow the workflow you need.
+Choose the path that matches what you are trying to verify or change.
 
-## Protocol
+## Review a benchmark result
 
-- [Methodology](methodology.md) — scheduling, blind judging, outcomes, and Elo.
-- [Replay Elo](replay-elo.md) — verify a journal and reproduce its ladder.
-- [Private packs](private-packs.md) — hidden-reference data flow and contamination controls.
+1. [Reviewing BridgeBench](reviewing-bridgebench.md) — the guided path from a
+   public task through votes, journal evidence, and replayed Elo.
+2. [Methodology](methodology.md) — the canonical scheduling, execution,
+   anonymization, voting, failure, and scoring contract.
+3. [Replay the Elo](replay-elo.md) — reproduce a ladder and validate every
+   journal transition.
+4. [Private packs](private-packs.md) — understand hidden references,
+   contamination controls, retirement, and the external trust boundary.
 
-## Contributing
+Use the [glossary](glossary.md) whenever a contract term is unfamiliar.
 
-- [Task authoring](task-authoring.md) — public schema, private schema, clusters, and validation.
-- [Glossary](glossary.md) — the terms used by the engine, CLI, and published reports.
-- [Repository contribution guide](../CONTRIBUTING.md) — local checks and pull-request expectations.
+## Contribute
 
-## Canonical sources
+- [Task authoring](task-authoring.md) — public/private schemas, arena clusters,
+  balance invariants, and proposal workflow.
+- [Repository contribution guide](../CONTRIBUTING.md) — local checks,
+  pull-request expectations, task proposals, and audit reports.
+- [Security policy](../SECURITY.md) — report vulnerabilities privately.
+
+## Operate and release
+
+- [Operator guide](operator-guide.md) — paid runs, results, dashboard, triage,
+  resume, and publishing.
+- [Private packs](private-packs.md) — required reading before handling active
+  hidden references.
+- [Release guide](../RELEASING.md) — npm trusted publishing and tag workflow.
+
+## Canonical executable sources
 
 - Model roster and request policy: [`src/models.ts`](../src/models.ts)
-- Category and methodology constants: [`src/types.ts`](../src/types.ts)
+- Category and methodology constants:
+  [`src/contracts/categories.ts`](../src/contracts/categories.ts)
 - Task-pack invariants: [`src/tasks.ts`](../src/tasks.ts)
 - Journal verification: [`src/verification.ts`](../src/verification.ts)
+- Elo implementation: [`src/elo.ts`](../src/elo.ts)
 - CLI workflows: `npm run arena -- --help` and `npm run tasks -- --help`
 
-When prose and executable validation disagree, treat the code as the current behavior and open an issue to repair the documentation.
+When prose and executable validation disagree, treat the executable contract
+as current behavior and open an issue to repair the documentation.

package/docs/methodology.md

@@ -2,6 +2,20 @@
 
 Every ranking BridgeBench publishes is the fold of an append-only match journal. This document specifies the full protocol that produces a journal line, so any published ladder can be audited or reproduced. The engine stamps every line with `methodologyVersion` (currently `arena-v0.3.0`, `src/contracts/categories.ts`); results from different methodology versions never mix silently.
 
+## What this contract establishes
+
+| Control | What it establishes | Deliberate limit |
+| --- | --- | --- |
+| Versioned run manifest and seeded scheduler | The planned roster, tasks, policies, ordering inputs, and schedule are reproducible | Model responses are not expected to be byte-identical across new API calls |
+| Byte-identical public context | Both competitors receive the same task evidence | Provider routing and model runtime behavior remain external dependencies |
+| Redaction, per-judge permutation, and isolated votes | Recorded decisions follow the benchmark's anonymity and position-bias controls | Model judges can still have shared biases or make a poor qualitative choice |
+| Task hashes and append-only journal | Claimed inputs can be tied to each line and inconsistent drift detected | The files do not authenticate the publisher or prevent a coordinated rewrite; active hidden references remain unavailable until retirement |
+| Fail-closed verifier | Schema, ordering, panel outcome, points, costs, manifests, and Elo replay consistently | Internal consistency does not independently prove semantic answer quality |
+
+The benchmark is reproducible at the **evidence and scoring** layer, not by
+promising deterministic model prose. [Reviewing BridgeBench](reviewing-bridgebench.md)
+walks through those guarantees and limitations using the bundled fixtures.
+
 ## Run identity and scheduling
 
 A **run** is deterministic from a versioned manifest:

package/docs/operator-guide.md

@@ -0,0 +1,178 @@
+# Operating BridgeBench
+
+This guide covers paid arena runs, local result custody, the dashboard,
+triage, and publishing. Reviewers do not need any of this setup; use
+[Reviewing BridgeBench](reviewing-bridgebench.md) for the credential-free path.
+
+## Requirements and private inputs
+
+Use Node.js 20.19 or newer and npm 10 or newer.
+
+A judged run requires:
+
+1. `OPENROUTER_API_KEY` in the operator process environment;
+2. `BRIDGEBENCH_PRIVATE_DIR` pointing to the separate private-pack checkout.
+
+Keep both values out of source, shell output, screenshots, issue reports, and
+logs. Set an account-level OpenRouter spending limit before a paid run.
+BridgeBench validates the selected model IDs, canonical slugs, and judge
+structured-output support before spending.
+
+The private overlay mirrors the public task layout:
+
+```text
+<private-checkout>/
+└── tasks/
+    ├── reasoning/private/<task-id>.yaml
+    └── hallucination/private/<task-id>.yaml
+```
+
+See [Private packs](private-packs.md) for resolution order, data flow,
+contamination controls, rotation, and retirement.
+
+## Model transport and roster
+
+Every competitor and judge request uses OpenRouter with exact, pinned slugs;
+`latest` aliases are prohibited. The benchmark therefore measures model
+behavior through one aggregator's routing rather than direct provider APIs.
+
+The canonical roster and request policies live in
+[`src/models.ts`](../src/models.ts). Judges are never eligible competitors.
+OpenRouter generation records can be retrieved later with
+`npm run arena -- generation <id>` for independent cost, token, and routing
+checks.
+
+## Run an arena
+
+Default category runs:
+
+```bash
+npm run arena -- run --category reasoning
+npm run arena -- run --category hallucination
+```
+
+Set an explicit schedule and stop boundary:
+
+```bash
+npm run arena -- run \
+  --category hallucination \
+  --matches 24 \
+  --seed july-calibration \
+  --max-cost-usd 40
+```
+
+Use repeated `--competitor` flags to select an explicit roster of at least two
+unique, enabled competitors:
+
+```bash
+npm run arena -- run \
+  --category reasoning \
+  --competitor openai/gpt-5.6-sol \
+  --competitor anthropic/claude-fable-5
+```
+
+Without `--competitor`, the run uses every enabled competitor. Press Ctrl-C
+once to request cancellation: active calls abort, completed matches remain
+journaled, and the exact schedule can resume.
+
+## Run identity and resume
+
+Category, seed, match count, sorted roster, task hashes, request policies,
+prompt-policy hashes, methodology, and engine version define the run manifest.
+The run ID is derived from that canonical manifest.
+
+Resume only the matching schedule:
+
+```bash
+npm run arena -- run \
+  --category hallucination \
+  --matches 24 \
+  --seed july-calibration \
+  --max-cost-usd 40 \
+  --resume
+```
+
+Journaled match IDs are skipped exactly. Repeating a completed schedule without
+`--resume` is rejected.
+
+## Local result custody
+
+Results are ignored by Git and isolated by arena:
+
+```text
+results/<category>/journal.jsonl       append-only execution record
+results/<category>/runs/<run-id>.json versioned run manifest
+results/<category>/snapshot.json       verified derived view
+results/<category>/leaderboard.md      verified derived view
+results/<category>/logs/               structured redacted logs
+```
+
+The journal is authoritative. Verify it before rebuilding or publishing:
+
+```bash
+npm run arena -- verify --category reasoning
+npm run report
+```
+
+Reports, resume state, and publishing all use the same fail-closed verifier.
+
+## Local dashboard
+
+```bash
+npm run dashboard
+```
+
+Open [http://127.0.0.1:4317](http://127.0.0.1:4317). The dashboard provides:
+
+- **Arena** — run configuration and live competitor/judge progress;
+- **Leaderboard** — the verified per-category ladder;
+- **Matches** — public task context, full responses, votes, and rationales.
+
+The control plane binds only to `127.0.0.1`. The API key remains in the server
+process and is never serialized to the browser. Mutations require a same-origin
+JSON request, only one run can be active, and model output is escaped text.
+
+## Triage and continuous improvement
+
+Every run writes a structured, key-redacted JSONL log. The triage command
+checks for failed requests, suspiciously fast responses, truncation, judge
+abstentions, and other anomalies. A health stop halts a run that is mostly
+producing failures.
+
+```bash
+npm run arena -- run --debug
+npm run triage
+npm run arena -- generation gen-...
+```
+
+Use the loop: run → read the health report → inspect the run log and provider
+record → fix the task, prompt, or policy → use a fresh seed → compare reports.
+Do not overwrite or hand-edit a journal to repair an outcome.
+
+## Publish
+
+An explicit API target and category are required. Configure
+`BRIDGEBENCH_API_URL` and `BRIDGEBENCH_ADMIN_KEY` privately before invoking:
+
+```bash
+npm run tasks -- publish --category hallucination
+npm run arena -- publish --category reasoning
+```
+
+`tasks publish` may send both task halves to the private API store.
+`arena publish` syncs verified journal evidence. Never place active hidden
+references or admin credentials in command output, commits, or issue reports.
+
+Package releases follow [RELEASING.md](../RELEASING.md). A release must pass
+the public-clone quality gate and contamination check before npm publishing.
+
+## Operating guardrails
+
+- Use pinned model slugs and a fixed, recorded roster.
+- Set a budget cap and account-level provider limit before paid work.
+- Treat competitor responses as adversarial input; never execute their code or
+  commands.
+- Stop and rotate a pack if an active hidden reference leaks.
+- Keep categories in separate journals and Elo ladders.
+- Preserve append order; never edit a journal in place.
+- Publish retired private halves so their recorded hashes become auditable.

package/docs/replay-elo.md

@@ -1,6 +1,9 @@
 # Replay the Elo yourself
 
-A BridgeBench ladder is not a claim — it is the fold of a journal you can re-run. This is the recipe.
+A BridgeBench ladder is not a claim — it is the fold of a journal you can
+re-run. This is the rating recipe. Start with
+[Reviewing BridgeBench](reviewing-bridgebench.md) if you want the complete
+task-to-result walkthrough first.
 
 ## What you need
 
@@ -16,6 +19,10 @@ npm run arena -- verify \
   --journal test/fixtures/journals/valid.jsonl
 ```
 
+`npm run review` runs this replay together with public-pack and documentation
+validation. The synthetic line proves the verifier mechanism; it is not a
+published model-quality claim.
+
 For a downloaded journal, place its run manifests in a sibling `runs/` directory or pass `--manifests-dir <path>`.
 
 ## The journal line, abridged
@@ -76,4 +83,7 @@ With the repo checked out, `npm run report` verifies the journal before rebuildi
 - **Judging**: each vote carries the judge's rationale and resolved winner; `agreement` must match the winner-vote count (three `unanimous`, exactly two `split`).
 - **Cost/token accounting**: every response carries its OpenRouter generation ID; `npm run arena -- generation <id>` fetches the provider's own record.
 
-If any of it doesn't reproduce, open an issue with the line number.
+If any of it doesn't reproduce, open a
+[ladder audit report](https://github.com/bridge-mind/bridgebench/issues/new?template=audit-report.yml)
+with the journal source, first failing line, verifier output, and reproduction
+command.

package/docs/reviewing-bridgebench.md

@@ -0,0 +1,173 @@
+# Reviewing BridgeBench
+
+BridgeBench is designed so a technical reviewer can trace a ranking from the
+public task through the match evidence and replay the rating math without
+running a model or receiving private credentials.
+
+This guide is the shortest complete review path. The
+[methodology](methodology.md) remains the canonical protocol.
+
+## Review in one command
+
+From a fresh clone:
+
+```bash
+npm ci
+npm run review
+```
+
+The command is offline and requires no API key or private overlay.
+
+| Check | Evidence used | Failure means |
+| --- | --- | --- |
+| Documentation | Local Markdown files and `package.json` | A link, heading, documented command, fixture path, or docs navigation path drifted |
+| Public task packs | All files under `tasks/*/public/` | A schema, category, cluster balance, filename, uniqueness, or prompt-budget invariant failed |
+| Journal structure | `test/fixtures/journals/valid.jsonl` | The match no longer satisfies the current journal contract |
+| Run identity | The matching manifest under `test/fixtures/journals/runs/` | The journal line is not bound to the expected schedule and policy inputs |
+| Outcome and Elo | Recorded votes, winner, point, and ratings | The majority outcome or rating transition does not replay exactly |
+
+The included journal is deliberately synthetic. It proves that the public
+audit mechanism works; it is not presented as evidence about a real model.
+
+## Follow one match
+
+Use these complementary examples:
+
+- [`stateful-retry-budget.yaml`](../tasks/reasoning/public/stateful-retry-budget.yaml)
+  is a real public task and shows the exact task shape competitors receive.
+- [`valid.jsonl`](../test/fixtures/journals/valid.jsonl) is the compact,
+  deterministic match used by the verifier.
+- [The matching run manifest](../test/fixtures/journals/runs/run-bcdf984dc74998a7c083.json)
+  binds the fixture to its seed, roster, task hashes, prompt policies,
+  methodology, and engine version.
+
+The real task and synthetic match are intentionally separate. Public tasks
+evolve as packs rotate; the verifier fixture stays small and deterministic so
+contract regressions are obvious.
+
+### Task and run identity
+
+Production `task` objects record the task ID, version, category, cluster, and
+the SHA-256 hashes of the exact public and private YAML used for the match. The
+`runManifestHash` binds the journal line to the versioned run manifest. This
+small synthetic fixture uses obvious `public-fixture` and `private-fixture`
+stand-ins so it tests the contract without pretending to contain a production
+task.
+
+This lets a reviewer detect task or policy drift without trusting a
+leaderboard snapshot.
+
+### Competitor evidence
+
+`competitors.responseA` and `competitors.responseB` retain:
+
+- the complete response text;
+- success or failure status;
+- generation ID;
+- token counts, cost, latency, and finish reason.
+
+Both competitors receive the same public task context. A single exhausted
+competitor failure is a forfeit; two failures produce a no-contest.
+
+### Blind panel evidence
+
+`panel.votes` contains all three structured verdicts, including each rationale,
+criteria assessment, resolved winner, and completion metadata. Judges receive
+anonymous answers in independently permuted A/B order. They never receive
+ratings, costs, other votes, or the competitors' canonical identities.
+
+Two valid votes for the same competitor decide the match. The recorded
+`agreement` must match the vote count.
+
+### Point and Elo
+
+Every decided match awards one point and one Elo update. Ratings start at 1000
+and use K=32. The fixture starts both competitors at 1000, records a unanimous
+win for model A, and therefore moves the ratings to 1016 and 984.
+
+`arena verify` recomputes the outcome and the `eloBefore`/`eloAfter` transition
+in journal order. Read [Replay the Elo](replay-elo.md) for the formula and
+per-line checks.
+
+## Inspect the bundled match visually
+
+The localhost dashboard can load a separate deterministic fixture so you can
+inspect the public task, responses, judge rationales, and leaderboard without
+an API key.
+
+macOS or Linux:
+
+```bash
+BRIDGEBENCH_RESULTS_DIR=test/fixtures/dashboard-results npm run dashboard
+```
+
+PowerShell:
+
+```powershell
+$env:BRIDGEBENCH_RESULTS_DIR = "test/fixtures/dashboard-results"
+npm run dashboard
+```
+
+Open [http://127.0.0.1:4317](http://127.0.0.1:4317), then use **Leaderboard**
+and **Matches**. Treat the fixture as review-only and do not start a run; this
+command does not place the dashboard itself into a read-only mode. The
+dashboard binds to localhost, keeps API credentials in the server process, and
+renders model output as escaped text.
+
+## Audit a published ladder
+
+1. Download the category journal from
+   [bridgebench.ai](https://bridgebench.ai) and obtain its matching `runs/`
+   manifests.
+2. Keep the manifests in a sibling `runs/` directory or pass
+   `--manifests-dir <path>`.
+3. Verify the journal:
+
+   ```bash
+   npm run arena -- verify --category reasoning --journal ./journal.jsonl
+   ```
+
+4. Inspect the first failing line if verification stops.
+5. Compare each journaled `publicHash` with the raw public task YAML. After a
+   pack retires, compare `privateHash` with the published private half too.
+6. Review votes and rationales qualitatively; deterministic verification
+   cannot decide whether a judge's preference was substantively correct.
+
+To rebuild local derived views after verification, place the journal and
+manifests under `results/<category>/` and run `npm run report`.
+
+## What the evidence proves
+
+| Evidence or control | What it supports | What it cannot establish |
+| --- | --- | --- |
+| Seeded scheduler and run manifest | The planned schedule, roster, policies, versions, and task hashes are bound to a stable run ID | That a new model call will return byte-identical prose |
+| Public/private task hashes | The exact task halves used by a match can be identified and drift detected | The contents or quality of an active hidden reference before retirement |
+| Blind structured votes | The recorded winner follows the visible panel votes and anonymity controls | That model judges are unbiased or selected the objectively best answer |
+| Append-only journal verification | Schema, ordering, majority outcome, point, cost totals, and Elo transitions are internally consistent | Publisher identity, an external timestamp, or protection against a coordinated journal-and-manifest rewrite |
+| OpenRouter generation IDs | Provider routing and accounting can be cross-checked with the transport record | Direct-provider equivalence or provider retention behavior |
+| Published retired references | The hidden half can eventually be hashed and reviewed against the journal | That no third party retained an active reference while it was in use |
+
+BridgeBench measures models through OpenRouter, not through direct provider
+APIs. Active hidden references travel to the configured model judges and may
+be stored in the private BridgeBench API. Withholding them reduces
+contamination risk; it does not prove non-retention or prevent all leakage.
+See [Private packs](private-packs.md) for the complete trust boundary and
+incident procedure.
+
+## Reviewer completion checklist
+
+A review is complete when you can answer:
+
+- What does each arena measure, and which claims are out of scope?
+- Did both competitors receive identical public evidence?
+- How were identities hidden and answer order balanced?
+- Do the recorded votes support the winner?
+- Do the point and Elo transitions replay from the journal?
+- Can the task and run inputs be tied to their recorded hashes?
+- Which conclusions still depend on hidden references or model-judge quality?
+
+If a published result does not reproduce, use the
+[ladder audit report](https://github.com/bridge-mind/bridgebench/issues/new?template=audit-report.yml)
+and include the journal source, first failing line, verifier output, and exact
+reproduction command. Never include credentials, active hidden references, or
+private filesystem paths.