chainlesschain 0.166.103 → 0.166.105

package/src/lib/decision-layer/runtime.js

@@ -12,12 +12,17 @@ import {
   SKILL_DECISION_OBSERVATION_SCHEMA,
 } from "./contracts.js";
 import { captureDecisionProviderAuthority } from "./provider-authority.js";
+import {
+  AGENT_EVOLUTION_INGRESS_FAILED_CODE,
+  captureAgentEvolutionIngress,
+} from "../evolution/agent-evolution-ingress.js";
 
 export const SKILL_DECISION_RUNTIME_SCHEMA =
   "chainlesschain.skill-decision-runtime/v1";
 
 const RUNTIMES = new WeakSet();
 const DEFAULT_TIMEOUT_MS = 800;
+const DEFAULT_BOUNDARY_TIMEOUT_MS = 30_000;
 
 function requiredText(value, label, maximum = 256) {
   if (
@@ -36,6 +41,53 @@ function timeoutSignal(signal, timeoutMs) {
   return signal ? AbortSignal.any([signal, deadline]) : deadline;
 }
 
+function settleBeforeAbort(value, signal) {
+  const pending = Promise.resolve(value);
+  if (!signal) return pending;
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const finish = (settle, result) => {
+      if (settled) return;
+      settled = true;
+      signal.removeEventListener("abort", onAbort);
+      settle(result);
+    };
+    const onAbort = () => finish(reject, signal.reason);
+    pending.then(
+      (result) => finish(resolve, result),
+      (error) => finish(reject, error),
+    );
+    if (signal.aborted) {
+      onAbort();
+      return;
+    }
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+
+async function waitForGovernedPhase(value, signal, timeoutMs, onTimeout) {
+  const phaseSignal = timeoutSignal(signal, timeoutMs);
+  try {
+    return await settleBeforeAbort(value, phaseSignal);
+  } catch (error) {
+    if (signal?.aborted) throw signal.reason;
+    if (
+      phaseSignal.aborted &&
+      phaseSignal.reason === error &&
+      error?.name === "TimeoutError"
+    ) {
+      throw onTimeout(error);
+    }
+    throw error;
+  }
+}
+
+function admissionTimeoutError(cause) {
+  const error = new Error("Skill decision admission timed out", { cause });
+  error.code = AGENT_EVOLUTION_INGRESS_FAILED_CODE;
+  return error;
+}
+
 function projectUnavailable(error) {
   if (error?.name === "TimeoutError") return "provider-timeout";
   if (error?.code === "CC_DECISION_USAGE_UNKNOWN_BLOCKED") {
@@ -66,7 +118,7 @@ function asPersistenceError(error) {
     return markRuntimeLedgerPersistenceError(error);
   } catch {
     return markRuntimeLedgerPersistenceError(
-      new Error("decision observation persistence failed", { cause: error }),
+      new Error("decision persistence failed", { cause: error }),
     );
   }
 }
@@ -76,12 +128,14 @@ export function createSkillDecisionRuntime({
   tenantId = null,
   sessionId = null,
   provider = null,
+  evolutionIngress = null,
   persist = null,
   observe = null,
   sessionBudget = null,
   initialUsageUnknown = false,
   thresholds = {},
   timeoutMs = DEFAULT_TIMEOUT_MS,
+  boundaryTimeoutMs = DEFAULT_BOUNDARY_TIMEOUT_MS,
   idGenerator = () => randomUUID(),
   now = () => new Date(),
 } = {}) {
@@ -95,17 +149,36 @@ export function createSkillDecisionRuntime({
       "decision timeout must be an integer from 50 to 30000 ms",
     );
   }
+  if (
+    !Number.isSafeInteger(boundaryTimeoutMs) ||
+    boundaryTimeoutMs < 50 ||
+    boundaryTimeoutMs > 30_000
+  ) {
+    throw new TypeError(
+      "decision boundary timeout must be an integer from 50 to 30000 ms",
+    );
+  }
   if (typeof idGenerator !== "function" || typeof now !== "function") {
     throw new TypeError("decision runtime generators must be functions");
   }
   let providerAuthority = null;
   let boundTenantId = null;
   let boundSessionId = null;
+  let ingress = null;
   let unknownUsageSeen = initialUsageUnknown === true;
+  const unsettledUsageCalls = new Set();
+  let usageCallInFlight = false;
+  let usagePersistenceFailure = null;
+  let observationPersistenceFailure = null;
   if (normalizedMode !== "off") {
     providerAuthority = captureDecisionProviderAuthority(provider);
     boundTenantId = requiredText(tenantId, "tenantId");
     boundSessionId = requiredText(sessionId, "sessionId");
+    if (evolutionIngress !== null) {
+      ingress = captureAgentEvolutionIngress(evolutionIngress, {
+        tenantId: boundTenantId,
+      });
+    }
     if (typeof persist !== "function" || typeof observe !== "function") {
       throw new TypeError(
         "enabled decision runtime requires usage and observation persistence",
@@ -118,13 +191,33 @@ export function createSkillDecisionRuntime({
     try {
       await observe(observation);
     } catch (error) {
-      throw asPersistenceError(error);
+      observationPersistenceFailure ??= asPersistenceError(error);
+      throw observationPersistenceFailure;
     }
   };
 
   const persistDecisionUsage = async (type, event) => {
-    await persist(type, event);
-    if (type === "model_usage_unknown") unknownUsageSeen = true;
+    if (usagePersistenceFailure !== null) throw usagePersistenceFailure;
+    try {
+      await waitForGovernedPhase(
+        persist(type, event),
+        null,
+        boundaryTimeoutMs,
+        (cause) =>
+          new Error("Skill decision usage persistence timed out", { cause }),
+      );
+    } catch (error) {
+      usagePersistenceFailure ??= asPersistenceError(error);
+      throw usagePersistenceFailure;
+    }
+    if (type === "model_usage_started") {
+      unsettledUsageCalls.add(event.callId);
+    } else if (type === "model_usage_unknown") {
+      unknownUsageSeen = true;
+      unsettledUsageCalls.delete(event.callId);
+    } else if (type === "token_usage") {
+      unsettledUsageCalls.delete(event.callId);
+    }
   };
 
   const runtime = Object.freeze({
@@ -148,6 +241,10 @@ export function createSkillDecisionRuntime({
         });
       }
       if (signal?.aborted) throw signal.reason;
+      if (usagePersistenceFailure !== null) throw usagePersistenceFailure;
+      if (observationPersistenceFailure !== null) {
+        throw observationPersistenceFailure;
+      }
       const decisionId = `skill-${requiredText(idGenerator(), "decisionId")}`;
       const request = createSkillDecisionRequest({
         decisionId,
@@ -167,11 +264,41 @@ export function createSkillDecisionRuntime({
       }
       let outcome;
       let requestSignal = null;
-      if (unknownUsageSeen) {
+      let admissionReceipt = null;
+      if (unknownUsageSeen || unsettledUsageCalls.size > 0) {
         outcome = unavailableOutcome("provider-usage-unknown-blocked");
       } else {
         try {
-          const { result: raw, settlement } = await runMeteredDirectModelCall({
+          // Admission is not provider work: a refusal must not create an
+          // unknown-charge ledger row or consume the provider's budget turn.
+          const admission =
+            ingress === null
+              ? null
+              : await waitForGovernedPhase(
+                  ingress.prepareSkillDecisionRequest(request),
+                  signal,
+                  boundaryTimeoutMs,
+                  admissionTimeoutError,
+                );
+          signal?.throwIfAborted();
+          admissionReceipt = admission?.receipt ?? null;
+          // Keep local content identities out of the provider capability. Only
+          // the authenticated projection is available for governed dispatch.
+          const providerRequest =
+            admission === null
+              ? request
+              : Object.freeze({ payload: admission.payload });
+          if (
+            unknownUsageSeen ||
+            unsettledUsageCalls.size > 0 ||
+            usageCallInFlight
+          ) {
+            const error = new Error("decision usage recovery is required");
+            error.code = "CC_DECISION_USAGE_UNKNOWN_BLOCKED";
+            throw error;
+          }
+          usageCallInFlight = true;
+          const meteredCall = runMeteredDirectModelCall({
             sessionId: boundSessionId,
             persist: persistDecisionUsage,
             provider: providerAuthority.provider,
@@ -180,18 +307,36 @@ export function createSkillDecisionRuntime({
             operationId: `decision:${decisionId}`,
             sessionBudget,
             includeSettlement: true,
+            dispatchSignal: signal ?? null,
             call: () => {
               if (unknownUsageSeen) {
                 const error = new Error("decision usage recovery is required");
                 error.code = "CC_DECISION_USAGE_UNKNOWN_BLOCKED";
                 throw error;
               }
+              // timeoutMs remains the provider-call deadline. Admission uses
+              // its own authority lifecycle and checks caller cancellation.
               requestSignal = timeoutSignal(signal, timeoutMs);
-              return providerAuthority.decide(request, {
-                signal: requestSignal,
-              });
+              requestSignal.throwIfAborted();
+              return settleBeforeAbort(
+                providerAuthority.decide(providerRequest, {
+                  signal: requestSignal,
+                }),
+                requestSignal,
+              );
             },
           });
+          let meteredResult;
+          try {
+            meteredResult = await meteredCall;
+          } finally {
+            usageCallInFlight = false;
+          }
+          const { result: raw, settlement } = meteredResult;
+          // A provider may resolve successfully after ignoring cancellation or
+          // its deadline. Usage is settled above; the late answer is unusable.
+          signal?.throwIfAborted();
+          requestSignal?.throwIfAborted();
           if (settlement !== "known") {
             // The metered call already persisted model_usage_unknown. Without a
             // budget root it may return the answer; never expose that answer.
@@ -254,6 +399,7 @@ export function createSkillDecisionRuntime({
         reasonCode: outcome.reasonCode,
         selectedDigest: outcome.selectedDigest,
         resultDigest: outcome.resultDigest,
+        ...(admissionReceipt === null ? {} : { admissionReceipt }),
         startedAt: startedAt.toISOString(),
         finishedAt: finishedAt.toISOString(),
         latencyMs: Math.max(0, finishedAt.getTime() - startedAt.getTime()),
@@ -265,7 +411,31 @@ export function createSkillDecisionRuntime({
           observationCore,
         ),
       });
-      await writeObservation(observation);
+      try {
+        await waitForGovernedPhase(
+          writeObservation(observation),
+          signal,
+          boundaryTimeoutMs,
+          (cause) =>
+            asPersistenceError(
+              new Error("Skill decision observation timed out", { cause }),
+            ),
+        );
+      } catch (error) {
+        if (error?.runtimeLedgerPersistence === true) {
+          observationPersistenceFailure ??= error;
+        } else if (signal?.aborted) {
+          // The caller stops waiting before the durable observer acknowledges
+          // the write. Its eventual outcome is unknown to this runtime.
+          observationPersistenceFailure ??= asPersistenceError(
+            new Error("Skill decision observation completion is unknown", {
+              cause: error,
+            }),
+          );
+        }
+        throw error;
+      }
+      signal?.throwIfAborted();
       return Object.freeze({
         schema: SKILL_DECISION_OBSERVATION_SCHEMA,
         decisionId,

package/src/lib/direct-model-usage.js

@@ -54,6 +54,8 @@ function unknownUsageEvent({
  * Meter one direct provider call that runs outside agentLoop. The started row is
  * durable before the callback resumes into provider work; every outcome then
  * settles known or unknown without persisting prompts, responses, or errors.
+ * A dispatch signal closes an acknowledged, canceled pre-dispatch intent with
+ * locally proven zero usage; cancellation after dispatch remains unknown.
  * Opt-in includeSettlement returns that persisted status with the raw result.
  */
 export async function runMeteredDirectModelCall({
@@ -65,11 +67,20 @@ export async function runMeteredDirectModelCall({
   operationId = undefined,
   sessionBudget = null,
   includeSettlement = false,
+  dispatchSignal = null,
   call,
 }) {
   if (typeof call !== "function") {
     throw new TypeError("metered direct model call requires a callback");
   }
+  if (
+    dispatchSignal !== null &&
+    (typeof dispatchSignal.aborted !== "boolean" ||
+      typeof dispatchSignal.throwIfAborted !== "function")
+  ) {
+    throw new TypeError("metered direct model dispatch signal is invalid");
+  }
+  dispatchSignal?.throwIfAborted();
   const callId = `direct-${randomUUID()}`;
   if (typeof sessionBudget?.consumeTurn === "function") {
     const admission = sessionBudget.consumeTurn({ id: callId });
@@ -84,6 +95,7 @@ export async function runMeteredDirectModelCall({
     if (includeSettlement) {
       throw new TypeError("direct model settlement requires a session");
     }
+    dispatchSignal?.throwIfAborted();
     return call();
   }
   if (typeof persist !== "function") {
@@ -102,6 +114,28 @@ export async function runMeteredDirectModelCall({
     { callId, provider, model, source, operationId },
     `direct model call ${source}`,
   );
+  if (dispatchSignal?.aborted) {
+    // A durable intent exists, but no provider callback has run. Close it as
+    // a locally proven zero-charge call instead of inventing unknown usage.
+    const notDispatched = {
+      ...projectRuntimeTokenUsage({
+        callId,
+        provider,
+        model,
+        source,
+        operationId,
+        usage: { input_tokens: 0, output_tokens: 0 },
+      }),
+      settlementOrigin: "local-no-dispatch",
+    };
+    await persistUsageEvent(persist, "token_usage", notDispatched);
+    recordSessionBudgetUsage(
+      sessionBudget,
+      { callId, usage: null },
+      `direct model call ${source} canceled before dispatch`,
+    );
+    throw dispatchSignal.reason;
+  }
   let result;
   let settlement = "unknown";
   const returnSettled = (status) =>

package/src/lib/evolution/agent-evolution-ingress.js

@@ -5,6 +5,7 @@ import evolutionRun from "@chainlesschain/session-core/evolution-run";
 import { EvolutionEvidenceArtifactAdapter } from "./evolution-evidence-artifact-adapter.js";
 import {
   EVOLUTION_AGENT_MODEL_PROJECTION_RULESET_DIGEST,
+  EVOLUTION_SKILL_DECISION_PROJECTION_RULESET_DIGEST,
   EVOLUTION_PROJECTION_RULESET_DIGEST,
 } from "./evolution-evidence-projector.js";
 import { EvolutionRunLedgerAdapter } from "./evolution-run-ledger-adapter.js";
@@ -15,6 +16,10 @@ import {
   snapshotAgentModelRequest,
   buildAgentModelRequest,
 } from "./agent-model-projection.js";
+import {
+  snapshotSkillDecisionRequest,
+  buildSkillDecisionPayload,
+} from "./skill-decision-projection.js";
 
 const { EVOLUTION_RUN_EVENT_SCHEMA, EVENT_TYPES } = evolutionRun;
 
@@ -265,6 +270,7 @@ export function createAgentEvolutionIngress({
     options = {},
     modelRequest = null,
     cacheRecord = false,
+    skillDecisionRequest = null,
   ) =>
     guardIngress(
       serialize(async () => {
@@ -304,7 +310,7 @@ export function createAgentEvolutionIngress({
               ),
               responseEvent: clone(lastModelResponse.event),
             }
-          : (modelRequest ?? clone(evidence));
+          : (skillDecisionRequest?.payload ?? modelRequest ?? clone(evidence));
         const sourceEnvelope = await issueSourceEnvelope(
           Object.freeze({
             schema: AGENT_EVOLUTION_INGRESS_SCHEMA,
@@ -321,12 +327,17 @@ export function createAgentEvolutionIngress({
           payload,
         };
         const persisted =
-          modelRequest === null
-            ? await evidenceAdapter.projectAndPersist(projectionInput)
-            : await EvolutionEvidenceArtifactAdapter.prototype.projectAndPersistAgentModelRequest.call(
+          skillDecisionRequest !== null
+            ? await EvolutionEvidenceArtifactAdapter.prototype.projectAndPersistSkillDecisionRequest.call(
                 evidenceAdapter,
                 projectionInput,
-              );
+              )
+            : modelRequest === null
+              ? await evidenceAdapter.projectAndPersist(projectionInput)
+              : await EvolutionEvidenceArtifactAdapter.prototype.projectAndPersistAgentModelRequest.call(
+                  evidenceAdapter,
+                  projectionInput,
+                );
         if (
           persisted?.tenantId !== descriptor.tenantId ||
           persisted.evidenceId == null ||
@@ -353,6 +364,13 @@ export function createAgentEvolutionIngress({
             evidenceKind: kind,
             occurredAt,
             derivationManifestDigest: persisted.manifest.digest,
+            ...(skillDecisionRequest === null
+              ? {}
+              : {
+                  decisionId: skillDecisionRequest.decisionId,
+                  requestDigest: skillDecisionRequest.requestDigest,
+                  candidateSetDigest: skillDecisionRequest.candidateSetDigest,
+                }),
           },
         });
         if (kind === "model-input") {
@@ -370,7 +388,8 @@ export function createAgentEvolutionIngress({
             eventId,
             artifact: persisted,
           });
-        if (modelRequest === null) return appended;
+        if (modelRequest === null && skillDecisionRequest === null)
+          return appended;
         // Resolve the published manifest and every attested component afresh.
         // The prototype call requires the real adapter's private state; an
         // instance-shaped facade cannot mint model-visible input.
@@ -383,7 +402,9 @@ export function createAgentEvolutionIngress({
           resolved.verification.verified !== true ||
           resolved.verification.tenantId !== descriptor.tenantId ||
           resolved.bundle.modelProjection.rulesetDigest !==
-            EVOLUTION_AGENT_MODEL_PROJECTION_RULESET_DIGEST ||
+            (skillDecisionRequest === null
+              ? EVOLUTION_AGENT_MODEL_PROJECTION_RULESET_DIGEST
+              : EVOLUTION_SKILL_DECISION_PROJECTION_RULESET_DIGEST) ||
           resolved.bundle.modelProjection.evidenceId !== persisted.evidenceId
         ) {
           throw new Error("Agent model projection readback is unbound");
@@ -396,6 +417,26 @@ export function createAgentEvolutionIngress({
           throw new Error("Agent model projection Run frontier changed");
         }
         if (admissionFailure !== null) throw admissionFailure;
+        if (skillDecisionRequest !== null) {
+          return Object.freeze({
+            payload: buildSkillDecisionPayload(
+              skillDecisionRequest.payload,
+              resolved.bundle.modelProjection,
+            ),
+            receipt: Object.freeze({
+              tenantId: descriptor.tenantId,
+              runId: descriptor.runId,
+              eventId,
+              evidenceId: persisted.evidenceId,
+              requestDigest: skillDecisionRequest.requestDigest,
+              candidateSetDigest: skillDecisionRequest.candidateSetDigest,
+              manifestDigest: persisted.manifest.digest,
+              projectionDigest:
+                resolved.bundle.modelProjection.projectionDigest,
+              rulesetDigest: resolved.bundle.modelProjection.rulesetDigest,
+            }),
+          });
+        }
         return buildAgentModelRequest(
           modelRequest,
           resolved.bundle.modelProjection,
@@ -522,6 +563,21 @@ export function createAgentEvolutionIngress({
       return response;
     },
     start: () => guardIngress(serialize(() => appendStarted())),
+    prepareSkillDecisionRequest: (request) => {
+      if (admissionFailure !== null) return Promise.reject(admissionFailure);
+      let snapshot;
+      try {
+        snapshot = snapshotSkillDecisionRequest(request);
+        if (snapshot.binding.tenantId !== descriptor.tenantId)
+          throw new TypeError(
+            "Skill decision request belongs to another tenant",
+          );
+      } catch (error) {
+        admissionFailure = ingressFailure(error);
+        return Promise.reject(admissionFailure);
+      }
+      return ingest("skill-decision-input", null, {}, null, false, snapshot);
+    },
     prepareModelRequest: (request) => {
       if (admissionFailure !== null) return Promise.reject(admissionFailure);
       let snapshot;

package/src/lib/evolution/evolution-evidence-artifact-adapter.js

@@ -340,6 +340,7 @@ export class EvolutionEvidenceArtifactAdapter {
   #ttlMs;
   #project;
   #projectAgentModel;
+  #projectSkillDecision;
   #verify;
   #ports;
   #resolveManifestRef;
@@ -385,6 +386,11 @@ export class EvolutionEvidenceArtifactAdapter {
       "projectAgentModelRequest",
       "projector",
     );
+    this.#projectSkillDecision = captureMethod(
+      projector,
+      "projectSkillDecisionRequest",
+      "projector",
+    );
     this.#verify = captureMethod(bundleVerifier, "verify", "bundleVerifier");
     this.#ports = artifactPorts;
     this.#resolveManifestRef =
@@ -411,6 +417,10 @@ export class EvolutionEvidenceArtifactAdapter {
     return this.#persist(await this.#projectAgentModel(input));
   }
 
+  async projectAndPersistSkillDecisionRequest(input) {
+    return this.#persist(await this.#projectSkillDecision(input));
+  }
+
   async #persist(bundle) {
     const verification = await this.#verify(bundle);
     if (

package/src/lib/evolution/evolution-evidence-projector.js

@@ -14,6 +14,7 @@ import {
   projectAgentOpaqueTransportBlock,
   snapshotAgentModelRequest,
 } from "./agent-model-projection.js";
+import { snapshotSkillDecisionPayload } from "./skill-decision-projection.js";
 import {
   createEvidenceJsonTextBoundary,
   EVIDENCE_JSON_POLICY,
@@ -523,7 +524,24 @@ export const EVOLUTION_AGENT_MODEL_PROJECTION_RULESET_DIGEST = `sha256:${createH
     "utf8",
   )
   .digest("hex")}`;
+const SKILL_DECISION_RULESET = Object.freeze({
+  ...AGENT_MODEL_RULESET_V2,
+  schema: "chainlesschain.evolution-skill-decision-projection-rules/v1",
+  version: 1,
+  protocol: "skill-routing-state-and-questions/v1",
+  maxInputBytes: 256 * 1024,
+});
+export const EVOLUTION_SKILL_DECISION_PROJECTION_RULESET_DIGEST = `sha256:${createHash(
+  "sha256",
+)
+  .update(
+    `${SKILL_DECISION_RULESET.schema}\0${JSON.stringify(SKILL_DECISION_RULESET)}`,
+    "utf8",
+  )
+  .digest("hex")}`;
+
 const SUPPORTED_RULESETS = new Map([
+  [EVOLUTION_SKILL_DECISION_PROJECTION_RULESET_DIGEST, SKILL_DECISION_RULESET],
   [RULESET_DIGEST, RULESET],
   [RAW_RULESET_V3_DIGEST, RAW_RULESET_V3],
   [AGENT_MODEL_RULESET_V1_DIGEST, AGENT_MODEL_RULESET_V1],
@@ -601,7 +619,8 @@ const AGENT_VALUE_PATTERNS = Object.freeze([
 ]);
 
 function valuePatterns(ruleset) {
-  return ruleset === AGENT_MODEL_RULESET ||
+  return ruleset === SKILL_DECISION_RULESET ||
+    ruleset === AGENT_MODEL_RULESET ||
     ruleset === AGENT_MODEL_RULESET_V2 ||
     ruleset === AGENT_MODEL_RULESET_V1
     ? AGENT_VALUE_PATTERNS
@@ -3101,6 +3120,18 @@ function validateBundleIntegrity(bundle) {
     );
   }
   if (model.content !== null) {
+    if (ruleset === SKILL_DECISION_RULESET) {
+      snapshotSkillDecisionPayload(model.content);
+      if (
+        model.truncated ||
+        (model.redactionSummary.byType["content-truncation"] ?? 0) > 0
+      ) {
+        throw projectionError(
+          EVOLUTION_PROJECTION_INVALID_CODE,
+          "Skill decision projection cannot be truncated",
+        );
+      }
+    }
     if (
       ruleset === AGENT_MODEL_RULESET ||
       ruleset === AGENT_MODEL_RULESET_V2 ||
@@ -3368,6 +3399,10 @@ export class EvolutionEvidenceProjector {
     return this.#project(input, AGENT_MODEL_RULESET);
   }
 
+  projectSkillDecisionRequest(input) {
+    return this.#project(input, SKILL_DECISION_RULESET);
+  }
+
   async #project(input, ruleset) {
     assertExactRecord(input, INPUT_KEYS, "evidence projection input");
     if (
@@ -3381,9 +3416,11 @@ export class EvolutionEvidenceProjector {
       );
     }
     const payload =
-      ruleset === AGENT_MODEL_RULESET
-        ? snapshotAgentModelRequest(input.payload)
-        : cloneCanonical(input.payload);
+      ruleset === SKILL_DECISION_RULESET
+        ? snapshotSkillDecisionPayload(input.payload)
+        : ruleset === AGENT_MODEL_RULESET
+          ? snapshotAgentModelRequest(input.payload)
+          : cloneCanonical(input.payload);
     const sourceInputDigest = digest(
       payload,
       "chainlesschain.evolution-raw-plaintext/v2",
@@ -3627,9 +3664,11 @@ export class EvolutionEvidenceProjector {
     const modelProjection = buildModelProjection(
       rawRecord,
       sanitized,
-      ruleset === AGENT_MODEL_RULESET
-        ? EVOLUTION_AGENT_MODEL_PROJECTION_RULESET_DIGEST
-        : RAW_RULESET_V3_DIGEST,
+      ruleset === SKILL_DECISION_RULESET
+        ? EVOLUTION_SKILL_DECISION_PROJECTION_RULESET_DIGEST
+        : ruleset === AGENT_MODEL_RULESET
+          ? EVOLUTION_AGENT_MODEL_PROJECTION_RULESET_DIGEST
+          : RAW_RULESET_V3_DIGEST,
     );
     const trustedSanitized = source.compilable
       ? sanitizePayload(