create-principles-disciple 1.82.0 → 1.83.0

package/core/dist/runtime-v2/evidence-triage/admission-events.d.ts

@@ -0,0 +1,126 @@
+/**
+ * Admission Events — PEAT-B2
+ *
+ * Structured event types for the pain evidence admission pipeline.
+ * These events make admission decisions observable without exposing raw data.
+ *
+ * Privacy boundary: events MUST NOT contain raw prompt, raw chat, raw trajectory,
+ * full local paths, file contents, env vars, tokens, or API keys.
+ *
+ * ERR checklist:
+ * - ERR-002: Every event has reason + nextAction.
+ * - ERR-009: Malformed input events include validation error details.
+ */
+import type { TriggerOutcome, TriggerDecision } from './trigger-controller.js';
+import type { SourceKind, TriageDecision } from './types.js';
+/**
+ * Base fields shared by all admission events.
+ */
+interface AdmissionEventBase {
+    /** Unique event ID */
+    readonly eventId: string;
+    /** ISO timestamp */
+    readonly timestamp: string;
+    /** Source kind that was evaluated */
+    readonly sourceKind: SourceKind;
+    /** Workspace reference (directory name only, no full path) */
+    readonly workspaceRef: string;
+    /** Session ID (may be truncated for privacy) */
+    readonly sessionId?: string;
+}
+/**
+ * Emitted when the admission controller makes a decision.
+ * This is the primary observability event for the admission pipeline.
+ */
+export interface AdmissionDecisionEvent extends AdmissionEventBase {
+    readonly eventType: 'admission_decision';
+    readonly triageDecision: TriageDecision;
+    readonly triggerOutcome: TriggerOutcome;
+    readonly reason: string;
+    readonly nextAction: string;
+    readonly shouldCreateDiagnosticTask: boolean;
+}
+/**
+ * Emitted when a diagnostic task is created as a result of admission.
+ */
+export interface DiagnosisTaskCreatedEvent extends AdmissionEventBase {
+    readonly eventType: 'diagnosis_task_created';
+    readonly painId: string;
+    readonly taskId: string;
+    readonly triggerOutcome: TriggerOutcome;
+}
+/**
+ * Emitted when evidence is recorded without triggering diagnosis.
+ */
+export interface EvidenceOnlyRecordedEvent extends AdmissionEventBase {
+    readonly eventType: 'evidence_only_recorded';
+    readonly triageDecision: TriageDecision;
+    readonly reason: string;
+    readonly nextAction: string;
+}
+/**
+ * Emitted when a signal is skipped or refused.
+ */
+export interface SkippedRefusedEvent extends AdmissionEventBase {
+    readonly eventType: 'skipped_refused';
+    readonly triggerOutcome: TriggerOutcome;
+    readonly reason: string;
+    readonly nextAction: string;
+}
+/**
+ * Union of all admission event types.
+ */
+export type AdmissionEvent = AdmissionDecisionEvent | DiagnosisTaskCreatedEvent | EvidenceOnlyRecordedEvent | SkippedRefusedEvent;
+/**
+ * Create an AdmissionDecisionEvent from a TriggerDecision.
+ *
+ * This is the canonical way to produce an admission event.
+ * The event contains no raw sensitive data — only structured metadata.
+ */
+export declare function createAdmissionDecisionEvent(decision: TriggerDecision, options: {
+    workspaceRef: string;
+    sessionId?: string;
+}): AdmissionDecisionEvent;
+/**
+ * Create a DiagnosisTaskCreatedEvent.
+ */
+export declare function createDiagnosisTaskCreatedEvent(opts: {
+    painId: string;
+    taskId: string;
+    decision: TriggerDecision;
+    workspaceRef: string;
+    sessionId?: string;
+}): DiagnosisTaskCreatedEvent;
+/**
+ * Create an EvidenceOnlyRecordedEvent.
+ */
+export declare function createEvidenceOnlyRecordedEvent(decision: TriggerDecision, options: {
+    workspaceRef: string;
+    sessionId?: string;
+}): EvidenceOnlyRecordedEvent;
+/**
+ * Create a SkippedRefusedEvent.
+ */
+export declare function createSkippedRefusedEvent(decision: TriggerDecision, options: {
+    workspaceRef: string;
+    sessionId?: string;
+}): SkippedRefusedEvent;
+/**
+ * Serialize an admission event to a JSONL-safe string.
+ *
+ * Privacy boundary: only structured fields are included.
+ * No raw prompt/chat/trajectory/file content/token/path secrets.
+ */
+export declare function serializeAdmissionEvent(event: AdmissionEvent): string;
+/**
+ * Validate that an admission event does not contain raw sensitive data.
+ *
+ * Returns true if the event passes privacy checks.
+ * This is a defense-in-depth check for tests and auditing.
+ */
+export declare function validateEventPrivacy(event: AdmissionEvent): {
+    valid: boolean;
+    violations: string[];
+};
+export {};
+//# sourceMappingURL=admission-events.d.ts.map

package/core/dist/runtime-v2/evidence-triage/admission-events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission-events.d.ts","sourceRoot":"","sources":["../../../src/runtime-v2/evidence-triage/admission-events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAI7D;;GAEG;AACH,UAAU,kBAAkB;IAC1B,sBAAsB;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oBAAoB;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qCAAqC;IACrC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,gDAAgD;IAChD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAuB,SAAQ,kBAAkB;IAChE,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,0BAA0B,EAAE,OAAO,CAAC;CAC9C;AAED;;GAEG;AACH,MAAM,WAAW,yBAA0B,SAAQ,kBAAkB;IACnE,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,yBAA0B,SAAQ,kBAAkB;IACnE,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;IAC7C,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,mBAAoB,SAAQ,kBAAkB;IAC7D,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,MAAM,cAAc,GACtB,sBAAsB,GACtB,yBAAyB,GACzB,yBAAyB,GACzB,mBAAmB,CAAC;AAUxB;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,eAAe,EACzB,OAAO,EAAE;IACP,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,sBAAsB,CAcxB;AAED;;GAEG;AACH,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE;IACJ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,eAAe,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,yBAAyB,CAY3B;AAED;;GAEG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,eAAe,EACzB,OAAO,EAAE;IACP,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,yBAAyB,CAY3B;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,eAAe,EACzB,OAAO,EAAE;IACP,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,mBAAmB,CAYrB;AAID;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAgCrE;AAID;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,cAAc,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAwBpG"}

package/core/dist/runtime-v2/evidence-triage/admission-events.js

@@ -0,0 +1,159 @@
+/**
+ * Admission Events — PEAT-B2
+ *
+ * Structured event types for the pain evidence admission pipeline.
+ * These events make admission decisions observable without exposing raw data.
+ *
+ * Privacy boundary: events MUST NOT contain raw prompt, raw chat, raw trajectory,
+ * full local paths, file contents, env vars, tokens, or API keys.
+ *
+ * ERR checklist:
+ * - ERR-002: Every event has reason + nextAction.
+ * - ERR-009: Malformed input events include validation error details.
+ */
+// ── Event Factory Functions ─────────────────────────────────────────────────
+let eventCounter = 0;
+function nextEventId() {
+    return `adm_${Date.now()}_${++eventCounter}`;
+}
+/**
+ * Create an AdmissionDecisionEvent from a TriggerDecision.
+ *
+ * This is the canonical way to produce an admission event.
+ * The event contains no raw sensitive data — only structured metadata.
+ */
+export function createAdmissionDecisionEvent(decision, options) {
+    return {
+        eventType: 'admission_decision',
+        eventId: nextEventId(),
+        timestamp: decision.decidedAt,
+        sourceKind: decision.sourceKind,
+        workspaceRef: options.workspaceRef,
+        sessionId: options.sessionId,
+        triageDecision: decision.triageDecision,
+        triggerOutcome: decision.outcome,
+        reason: decision.reason,
+        nextAction: decision.nextAction,
+        shouldCreateDiagnosticTask: decision.shouldCreateDiagnosticTask,
+    };
+}
+/**
+ * Create a DiagnosisTaskCreatedEvent.
+ */
+export function createDiagnosisTaskCreatedEvent(opts) {
+    return {
+        eventType: 'diagnosis_task_created',
+        eventId: nextEventId(),
+        timestamp: new Date().toISOString(),
+        sourceKind: opts.decision.sourceKind,
+        workspaceRef: opts.workspaceRef,
+        sessionId: opts.sessionId,
+        painId: opts.painId,
+        taskId: opts.taskId,
+        triggerOutcome: opts.decision.outcome,
+    };
+}
+/**
+ * Create an EvidenceOnlyRecordedEvent.
+ */
+export function createEvidenceOnlyRecordedEvent(decision, options) {
+    return {
+        eventType: 'evidence_only_recorded',
+        eventId: nextEventId(),
+        timestamp: decision.decidedAt,
+        sourceKind: decision.sourceKind,
+        workspaceRef: options.workspaceRef,
+        sessionId: options.sessionId,
+        triageDecision: decision.triageDecision,
+        reason: decision.reason,
+        nextAction: decision.nextAction,
+    };
+}
+/**
+ * Create a SkippedRefusedEvent.
+ */
+export function createSkippedRefusedEvent(decision, options) {
+    return {
+        eventType: 'skipped_refused',
+        eventId: nextEventId(),
+        timestamp: decision.decidedAt,
+        sourceKind: decision.sourceKind,
+        workspaceRef: options.workspaceRef,
+        sessionId: options.sessionId,
+        triggerOutcome: decision.outcome,
+        reason: decision.reason,
+        nextAction: decision.nextAction,
+    };
+}
+// ── Event Serialization ─────────────────────────────────────────────────────
+/**
+ * Serialize an admission event to a JSONL-safe string.
+ *
+ * Privacy boundary: only structured fields are included.
+ * No raw prompt/chat/trajectory/file content/token/path secrets.
+ */
+export function serializeAdmissionEvent(event) {
+    // Explicit field selection prevents accidental raw data leakage
+    const safe = {
+        eventType: event.eventType,
+        eventId: event.eventId,
+        timestamp: event.timestamp,
+        sourceKind: event.sourceKind,
+        workspaceRef: event.workspaceRef,
+        sessionId: event.sessionId,
+    };
+    if (event.eventType === 'admission_decision') {
+        safe.triageDecision = event.triageDecision;
+        safe.triggerOutcome = event.triggerOutcome;
+        safe.reason = event.reason;
+        safe.nextAction = event.nextAction;
+        safe.shouldCreateDiagnosticTask = event.shouldCreateDiagnosticTask;
+    }
+    else if (event.eventType === 'diagnosis_task_created') {
+        safe.painId = event.painId;
+        safe.taskId = event.taskId;
+        safe.triggerOutcome = event.triggerOutcome;
+    }
+    else if (event.eventType === 'evidence_only_recorded') {
+        safe.triageDecision = event.triageDecision;
+        safe.reason = event.reason;
+        safe.nextAction = event.nextAction;
+    }
+    else if (event.eventType === 'skipped_refused') {
+        safe.triggerOutcome = event.triggerOutcome;
+        safe.reason = event.reason;
+        safe.nextAction = event.nextAction;
+    }
+    return JSON.stringify(safe);
+}
+// ── Validation ──────────────────────────────────────────────────────────────
+/**
+ * Validate that an admission event does not contain raw sensitive data.
+ *
+ * Returns true if the event passes privacy checks.
+ * This is a defense-in-depth check for tests and auditing.
+ */
+export function validateEventPrivacy(event) {
+    const violations = [];
+    const serialized = JSON.stringify(event);
+    // Check for common sensitive patterns
+    if (/sk-[a-zA-Z0-9]{20,}/.test(serialized)) {
+        violations.push('potential_api_key_detected');
+    }
+    // Check for absolute paths in JSON-serialized form.
+    // JSON.stringify('C:\\Users\\admin') produces "C:\\\\Users\\\\admin" in the JSON string.
+    // At runtime, serialized.includes('Users\\') checks for Users followed by one backslash.
+    const hasWindowsPath = serialized.includes('Users\\') ||
+        /[A-Z]:\\[Uu]sers/.test(serialized);
+    if (hasWindowsPath) {
+        violations.push('absolute_windows_path_detected');
+    }
+    if (/\/home\/[a-z]/.test(serialized)) {
+        violations.push('absolute_unix_path_detected');
+    }
+    if (/"prompt"\s*:\s*"/.test(serialized) && serialized.length > 2000) {
+        violations.push('potential_raw_prompt_in_event');
+    }
+    return { valid: violations.length === 0, violations };
+}
+//# sourceMappingURL=admission-events.js.map

package/core/dist/runtime-v2/evidence-triage/admission-events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission-events.js","sourceRoot":"","sources":["../../../src/runtime-v2/evidence-triage/admission-events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA2EH,+EAA+E;AAE/E,IAAI,YAAY,GAAG,CAAC,CAAC;AAErB,SAAS,WAAW;IAClB,OAAO,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAyB,EACzB,OAGC;IAED,OAAO;QACL,SAAS,EAAE,oBAAoB;QAC/B,OAAO,EAAE,WAAW,EAAE;QACtB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,cAAc,EAAE,QAAQ,CAAC,OAAO;QAChC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,0BAA0B,EAAE,QAAQ,CAAC,0BAA0B;KAChE,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,+BAA+B,CAC7C,IAMC;IAED,OAAO;QACL,SAAS,EAAE,wBAAwB;QACnC,OAAO,EAAE,WAAW,EAAE;QACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU;QACpC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO;KACtC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,+BAA+B,CAC7C,QAAyB,EACzB,OAGC;IAED,OAAO;QACL,SAAS,EAAE,wBAAwB;QACnC,OAAO,EAAE,WAAW,EAAE;QACtB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;KAChC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAyB,EACzB,OAGC;IAED,OAAO;QACL,SAAS,EAAE,iBAAiB;QAC5B,OAAO,EAAE,WAAW,EAAE;QACtB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc,EAAE,QAAQ,CAAC,OAAO;QAChC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;KAChC,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAqB;IAC3D,gEAAgE;IAChE,MAAM,IAAI,GAA4B;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;IAEF,IAAI,KAAK,CAAC,SAAS,KAAK,oBAAoB,EAAE,CAAC;QAC7C,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;QAC3C,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACnC,IAAI,CAAC,0BAA0B,GAAG,KAAK,CAAC,0BAA0B,CAAC;IACrE,CAAC;SAAM,IAAI,KAAK,CAAC,SAAS,KAAK,wBAAwB,EAAE,CAAC;QACxD,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC7C,CAAC;SAAM,IAAI,KAAK,CAAC,SAAS,KAAK,wBAAwB,EAAE,CAAC;QACxD,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACrC,CAAC;SAAM,IAAI,KAAK,CAAC,SAAS,KAAK,iBAAiB,EAAE,CAAC;QACjD,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACrC,CAAC;IAED,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAqB;IACxD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAEzC,sCAAsC;IACtC,IAAI,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3C,UAAU,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,oDAAoD;IACpD,yFAAyF;IACzF,yFAAyF;IACzF,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC;QACnD,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,cAAc,EAAE,CAAC;QACnB,UAAU,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,UAAU,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QACpE,UAAU,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;AACxD,CAAC"}

package/core/dist/runtime-v2/evidence-triage/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Evidence Triage — PEAT-B1 → B2
+ *
+ * Public API for pre-diagnosis evidence triage and trigger control.
+ * Pure types and policy — no I/O, no plugin imports.
+ */
+export type { SourceKind, TriageDecision, TriageResult, TriageInput, } from './types.js';
+export { isSourceKind } from './types.js';
+export type { SourceDescriptor } from './source-descriptors.js';
+export { SOURCE_DESCRIPTORS, getSourceDescriptor } from './source-descriptors.js';
+export { evaluateTriage } from './triage-policy.js';
+export type { TriggerOutcome, TriggerDecision, TriggerControllerInput, } from './trigger-controller.js';
+export { evaluateTriggerController, shouldCreateTask, isAdmittedOutcome, isSkippedOutcome, } from './trigger-controller.js';
+export type { AdmissionDecisionEvent, DiagnosisTaskCreatedEvent, EvidenceOnlyRecordedEvent, SkippedRefusedEvent, AdmissionEvent, } from './admission-events.js';
+export { createAdmissionDecisionEvent, createDiagnosisTaskCreatedEvent, createEvidenceOnlyRecordedEvent, createSkippedRefusedEvent, serializeAdmissionEvent, validateEventPrivacy, } from './admission-events.js';
+//# sourceMappingURL=index.d.ts.map

package/core/dist/runtime-v2/evidence-triage/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/runtime-v2/evidence-triage/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,YAAY,EACV,UAAU,EACV,cAAc,EACd,YAAY,EACZ,WAAW,GACZ,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAG1C,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAGlF,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGpD,YAAY,EACV,cAAc,EACd,eAAe,EACf,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AAGjC,YAAY,EACV,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,mBAAmB,EACnB,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,EAC/B,+BAA+B,EAC/B,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC"}

package/core/dist/runtime-v2/evidence-triage/index.js

@@ -0,0 +1,13 @@
+/**
+ * Evidence Triage — PEAT-B1 → B2
+ *
+ * Public API for pre-diagnosis evidence triage and trigger control.
+ * Pure types and policy — no I/O, no plugin imports.
+ */
+export { isSourceKind } from './types.js';
+export { SOURCE_DESCRIPTORS, getSourceDescriptor } from './source-descriptors.js';
+// Triage policy
+export { evaluateTriage } from './triage-policy.js';
+export { evaluateTriggerController, shouldCreateTask, isAdmittedOutcome, isSkippedOutcome, } from './trigger-controller.js';
+export { createAdmissionDecisionEvent, createDiagnosisTaskCreatedEvent, createEvidenceOnlyRecordedEvent, createSkippedRefusedEvent, serializeAdmissionEvent, validateEventPrivacy, } from './admission-events.js';
+//# sourceMappingURL=index.js.map

package/core/dist/runtime-v2/evidence-triage/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/runtime-v2/evidence-triage/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAUH,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAI1C,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAElF,gBAAgB;AAChB,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAQpD,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AAUjC,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,EAC/B,+BAA+B,EAC/B,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC"}

package/core/dist/runtime-v2/evidence-triage/source-descriptors.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Source Descriptors — PEAT-B1
+ *
+ * Declarative policy mapping from SourceKind to default TriageDecision.
+ * This is pure data — no I/O, no plugin imports.
+ *
+ * Each descriptor defines:
+ * - kind: the SourceKind it describes
+ * - defaultDecision: the default triage decision
+ * - reason: why this default was chosen
+ * - nextAction: what should happen when this decision is applied
+ * - canUpgrade: whether the plugin adapter may upgrade the decision
+ *   (e.g., rulehost_block can be upgraded to 'admit' for unsafe actions)
+ *
+ * ERR checklist:
+ * - ERR-002: Every descriptor carries reason + nextAction.
+ * - ERR-005: Descriptors are data, not assumptions about callers.
+ */
+import type { SourceKind, TriageDecision } from './types.js';
+export interface SourceDescriptor {
+    readonly kind: SourceKind;
+    readonly defaultDecision: TriageDecision;
+    readonly reason: string;
+    readonly nextAction: string;
+    /**
+     * Whether the plugin adapter may upgrade this decision.
+     * When true, the adapter can override defaultDecision based on context
+     * (e.g., isUnsafeHighConfidence for rulehost_block).
+     */
+    readonly canUpgrade: boolean;
+}
+/**
+ * Source kind descriptors. Order does not matter — lookup is by kind.
+ *
+ * Design rationale per PRODUCT_IDENTITY.md and ADR-0014:
+ * - PD owns owner-relevant behavior evidence, not tool repair.
+ * - Manual/owner-reported pain has highest confidence.
+ * - Tool failures are infrastructure noise (OpenClaw's job, not PD's).
+ * - Empathy-inferred frustration must never silently create diagnosis.
+ * - GFI alone cannot trigger diagnosis (it's a session health metric).
+ */
+export declare const SOURCE_DESCRIPTORS: ReadonlyMap<SourceKind, SourceDescriptor>;
+/**
+ * Get the source descriptor for a given kind.
+ * Returns undefined if the kind is not registered (caller should treat as 'unknown').
+ */
+export declare function getSourceDescriptor(kind: SourceKind): SourceDescriptor | undefined;
+//# sourceMappingURL=source-descriptors.d.ts.map

package/core/dist/runtime-v2/evidence-triage/source-descriptors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-descriptors.d.ts","sourceRoot":"","sources":["../../../src/runtime-v2/evidence-triage/source-descriptors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAI7D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAID;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,UAAU,EAAE,gBAAgB,CA4FvE,CAAC;AAIH;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,UAAU,GAAG,gBAAgB,GAAG,SAAS,CAElF"}

package/core/dist/runtime-v2/evidence-triage/source-descriptors.js

@@ -0,0 +1,131 @@
+/**
+ * Source Descriptors — PEAT-B1
+ *
+ * Declarative policy mapping from SourceKind to default TriageDecision.
+ * This is pure data — no I/O, no plugin imports.
+ *
+ * Each descriptor defines:
+ * - kind: the SourceKind it describes
+ * - defaultDecision: the default triage decision
+ * - reason: why this default was chosen
+ * - nextAction: what should happen when this decision is applied
+ * - canUpgrade: whether the plugin adapter may upgrade the decision
+ *   (e.g., rulehost_block can be upgraded to 'admit' for unsafe actions)
+ *
+ * ERR checklist:
+ * - ERR-002: Every descriptor carries reason + nextAction.
+ * - ERR-005: Descriptors are data, not assumptions about callers.
+ */
+// ── Descriptor Registry ─────────────────────────────────────────────────────
+/**
+ * Source kind descriptors. Order does not matter — lookup is by kind.
+ *
+ * Design rationale per PRODUCT_IDENTITY.md and ADR-0014:
+ * - PD owns owner-relevant behavior evidence, not tool repair.
+ * - Manual/owner-reported pain has highest confidence.
+ * - Tool failures are infrastructure noise (OpenClaw's job, not PD's).
+ * - Empathy-inferred frustration must never silently create diagnosis.
+ * - GFI alone cannot trigger diagnosis (it's a session health metric).
+ */
+export const SOURCE_DESCRIPTORS = new Map([
+    ['owner_reported', {
+            kind: 'owner_reported',
+            defaultDecision: 'admit',
+            reason: 'Owner explicitly reported pain. Highest confidence signal.',
+            nextAction: 'none',
+            canUpgrade: false,
+        }],
+    ['agent_on_owner_request', {
+            kind: 'agent_on_owner_request',
+            defaultDecision: 'admit',
+            reason: 'Agent recorded pain at owner request. Owner intent preserved.',
+            nextAction: 'none',
+            canUpgrade: false,
+        }],
+    ['tool_failure', {
+            kind: 'tool_failure',
+            defaultDecision: 'evidence_only',
+            reason: 'Tool failure is infrastructure noise. PD does not own tool repair (ADR-0014).',
+            nextAction: 'store_as_evidence_for_later_correlation',
+            canUpgrade: false,
+        }],
+    ['dispatch_error', {
+            kind: 'dispatch_error',
+            defaultDecision: 'evidence_only',
+            reason: 'Dispatch/subagent routing error. Not a behavior pattern.',
+            nextAction: 'store_as_evidence_for_later_correlation',
+            canUpgrade: false,
+        }],
+    ['provider_failure', {
+            kind: 'provider_failure',
+            defaultDecision: 'health_only',
+            reason: 'LLM provider failure. Infrastructure health signal, not owner-relevant behavior.',
+            nextAction: 'record_in_health_telemetry',
+            canUpgrade: false,
+        }],
+    ['rate_limit', {
+            kind: 'rate_limit',
+            defaultDecision: 'health_only',
+            reason: 'LLM provider rate limit. Infrastructure health signal, not owner-relevant behavior.',
+            nextAction: 'record_in_health_telemetry',
+            canUpgrade: false,
+        }],
+    ['rulehost_block', {
+            kind: 'rulehost_block',
+            defaultDecision: 'evidence_only',
+            reason: 'RuleHost block is near-miss evidence. Default evidence-only.',
+            nextAction: 'store_as_evidence_for_later_correlation',
+            canUpgrade: true, // adapter can upgrade to 'admit' for high-confidence unsafe actions
+        }],
+    ['empathy_inferred', {
+            kind: 'empathy_inferred',
+            defaultDecision: 'owner_confirm',
+            reason: 'Empathy-inferred frustration. Never silently creates diagnosis (PRODUCT_IDENTITY: owner-governed).',
+            nextAction: 'request_owner_confirmation_before_diagnosis',
+            canUpgrade: false,
+        }],
+    ['semantic', {
+            kind: 'semantic',
+            defaultDecision: 'evidence_only',
+            reason: 'Keyword/detection match. Not explicit owner pain. Needs accumulation.',
+            nextAction: 'store_as_evidence_for_later_correlation',
+            canUpgrade: false,
+        }],
+    ['llm_paralysis', {
+            kind: 'llm_paralysis',
+            defaultDecision: 'evidence_only',
+            reason: 'Session health signal. GFI alone cannot create diagnosis.',
+            nextAction: 'store_as_evidence_for_later_correlation',
+            canUpgrade: false,
+        }],
+    ['subagent_error', {
+            kind: 'subagent_error',
+            defaultDecision: 'evidence_only',
+            reason: 'Subagent workflow failure. Not a behavior pattern by itself.',
+            nextAction: 'store_as_evidence_for_later_correlation',
+            canUpgrade: false,
+        }],
+    ['gfi_threshold', {
+            kind: 'gfi_threshold',
+            defaultDecision: 'evidence_only',
+            reason: 'Accumulated GFI. GFI alone cannot create diagnosis per acceptance criteria.',
+            nextAction: 'store_as_evidence_for_later_correlation',
+            canUpgrade: false,
+        }],
+    ['unknown', {
+            kind: 'unknown',
+            defaultDecision: 'evidence_only',
+            reason: 'Unclassified source. Conservative default.',
+            nextAction: 'classify_source_kind_and_store_as_evidence',
+            canUpgrade: false,
+        }],
+]);
+// ── Lookup ───────────────────────────────────────────────────────────────────
+/**
+ * Get the source descriptor for a given kind.
+ * Returns undefined if the kind is not registered (caller should treat as 'unknown').
+ */
+export function getSourceDescriptor(kind) {
+    return SOURCE_DESCRIPTORS.get(kind);
+}
+//# sourceMappingURL=source-descriptors.js.map

package/core/dist/runtime-v2/evidence-triage/source-descriptors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-descriptors.js","sourceRoot":"","sources":["../../../src/runtime-v2/evidence-triage/source-descriptors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAmBH,+EAA+E;AAE/E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA8C,IAAI,GAAG,CAA+B;IACjH,CAAC,gBAAgB,EAAE;YACjB,IAAI,EAAE,gBAAgB;YACtB,eAAe,EAAE,OAAO;YACxB,MAAM,EAAE,4DAA4D;YACpE,UAAU,EAAE,MAAM;YAClB,UAAU,EAAE,KAAK;SAClB,CAAC;IACF,CAAC,wBAAwB,EAAE;YACzB,IAAI,EAAE,wBAAwB;YAC9B,eAAe,EAAE,OAAO;YACxB,MAAM,EAAE,+DAA+D;YACvE,UAAU,EAAE,MAAM;YAClB,UAAU,EAAE,KAAK;SAClB,CAAC;IACF,CAAC,cAAc,EAAE;YACf,IAAI,EAAE,cAAc;YACpB,eAAe,EAAE,eAAe;YAChC,MAAM,EAAE,+EAA+E;YACvF,UAAU,EAAE,yCAAyC;YACrD,UAAU,EAAE,KAAK;SAClB,CAAC;IACF,CAAC,gBAAgB,EAAE;YACjB,IAAI,EAAE,gBAAgB;YACtB,eAAe,EAAE,eAAe;YAChC,MAAM,EAAE,0DAA0D;YAClE,UAAU,EAAE,yCAAyC;YACrD,UAAU,EAAE,KAAK;SAClB,CAAC;IACF,CAAC,kBAAkB,EAAE;YACnB,IAAI,EAAE,kBAAkB;YACxB,eAAe,EAAE,aAAa;YAC9B,MAAM,EAAE,kFAAkF;YAC1F,UAAU,EAAE,4BAA4B;YACxC,UAAU,EAAE,KAAK;SAClB,CAAC;IACF,CAAC,YAAY,EAAE;YACb,IAAI,EAAE,YAAY;YAClB,eAAe,EAAE,aAAa;YAC9B,MAAM,EAAE,qFAAqF;YAC7F,UAAU,EAAE,4BAA4B;YACxC,UAAU,EAAE,KAAK;SAClB,CAAC;IACF,CAAC,gBAAgB,EAAE;YACjB,IAAI,EAAE,gBAAgB;YACtB,eAAe,EAAE,eAAe;YAChC,MAAM,EAAE,8DAA8D;YACtE,UAAU,EAAE,yCAAyC;YACrD,UAAU,EAAE,IAAI,EAAE,oEAAoE;SACvF,CAAC;IACF,CAAC,kBAAkB,EAAE;YACnB,IAAI,EAAE,kBAAkB;YACxB,eAAe,EAAE,eAAe;YAChC,MAAM,EAAE,oGAAoG;YAC5G,UAAU,EAAE,6CAA6C;YACzD,UAAU,EAAE,KAAK;SAClB,CAAC;IACF,CAAC,UAAU,EAAE;YACX,IAAI,EAAE,UAAU;YAChB,eAAe,EAAE,eAAe;YAChC,MAAM,EAAE,uEAAuE;YAC/E,UAAU,EAAE,yCAAyC;YACrD,UAAU,EAAE,KAAK;SAClB,CAAC;IACF,CAAC,eAAe,EAAE;YAChB,IAAI,EAAE,eAAe;YACrB,eAAe,EAAE,eAAe;YAChC,MAAM,EAAE,2DAA2D;YACnE,UAAU,EAAE,yCAAyC;YACrD,UAAU,EAAE,KAAK;SAClB,CAAC;IACF,CAAC,gBAAgB,EAAE;YACjB,IAAI,EAAE,gBAAgB;YACtB,eAAe,EAAE,eAAe;YAChC,MAAM,EAAE,8DAA8D;YACtE,UAAU,EAAE,yCAAyC;YACrD,UAAU,EAAE,KAAK;SAClB,CAAC;IACF,CAAC,eAAe,EAAE;YAChB,IAAI,EAAE,eAAe;YACrB,eAAe,EAAE,eAAe;YAChC,MAAM,EAAE,6EAA6E;YACrF,UAAU,EAAE,yCAAyC;YACrD,UAAU,EAAE,KAAK;SAClB,CAAC;IACF,CAAC,SAAS,EAAE;YACV,IAAI,EAAE,SAAS;YACf,eAAe,EAAE,eAAe;YAChC,MAAM,EAAE,4CAA4C;YACpD,UAAU,EAAE,4CAA4C;YACxD,UAAU,EAAE,KAAK;SAClB,CAAC;CACH,CAAC,CAAC;AAEH,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAgB;IAClD,OAAO,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC"}

package/core/dist/runtime-v2/evidence-triage/triage-policy.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Triage Policy — PEAT-B1
+ *
+ * Pure policy evaluation for pre-diagnosis evidence triage.
+ * No I/O, no plugin imports, no side effects.
+ *
+ * This module evaluates a TriageInput against source descriptors
+ * and returns a TriageResult. The plugin adapter calls this function
+ * and uses the result to decide whether to proceed to diagnosis.
+ *
+ * ERR checklist:
+ * - ERR-001: No `as` casts. Input validated with runtime guards.
+ * - ERR-002: Every result carries structured reason + nextAction.
+ * - ERR-005: Input is unknown, validated field-by-field.
+ */
+import type { TriageInput, TriageResult } from './types.js';
+/**
+ * Evaluate triage policy for incoming evidence.
+ *
+ * This is the pure policy function. It does not:
+ * - Call PainDiagnosticGate
+ * - Write to event log or trajectory
+ * - Create diagnostic tasks
+ * - Import anything from the plugin layer
+ *
+ * It only reads source descriptors and applies policy rules.
+ *
+ * @param input - Triage input with source kind and context
+ * @returns Structured triage result with decision, reason, and nextAction
+ */
+export declare function evaluateTriage(input: TriageInput): TriageResult;
+//# sourceMappingURL=triage-policy.d.ts.map

package/core/dist/runtime-v2/evidence-triage/triage-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage-policy.d.ts","sourceRoot":"","sources":["../../../src/runtime-v2/evidence-triage/triage-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAA8B,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAuCxF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,YAAY,CAmC/D"}

package/core/dist/runtime-v2/evidence-triage/triage-policy.js

@@ -0,0 +1,95 @@
+/**
+ * Triage Policy — PEAT-B1
+ *
+ * Pure policy evaluation for pre-diagnosis evidence triage.
+ * No I/O, no plugin imports, no side effects.
+ *
+ * This module evaluates a TriageInput against source descriptors
+ * and returns a TriageResult. The plugin adapter calls this function
+ * and uses the result to decide whether to proceed to diagnosis.
+ *
+ * ERR checklist:
+ * - ERR-001: No `as` casts. Input validated with runtime guards.
+ * - ERR-002: Every result carries structured reason + nextAction.
+ * - ERR-005: Input is unknown, validated field-by-field.
+ */
+import { isSourceKind } from './types.js';
+import { getSourceDescriptor } from './source-descriptors.js';
+// ── Upgrade Rules ───────────────────────────────────────────────────────────
+/**
+ * Apply upgrade rules for upgradable source kinds.
+ *
+ * Currently only 'rulehost_block' can be upgraded:
+ * - If isUnsafeHighConfidence is true, upgrade from 'evidence_only' to 'admit'
+ *
+ * This is the ONLY place where context-dependent upgrades happen in core.
+ * The plugin adapter sets isUnsafeHighConfidence based on hook context.
+ */
+function applyUpgradeRules(input, defaultDecision) {
+    if (input.sourceKind === 'rulehost_block' && input.isUnsafeHighConfidence === true) {
+        return 'admit';
+    }
+    return defaultDecision;
+}
+function getUpgradeReason(sourceKind, decision, input) {
+    if (sourceKind === 'rulehost_block' && decision === 'admit') {
+        return `RuleHost blocked a high-confidence unsafe action (score=${input.score}). Upgrading to direct diagnosis.`;
+    }
+    // Should not reach here — fallback
+    return `Upgraded decision for ${sourceKind}: ${decision}`;
+}
+function getUpgradeNextAction(sourceKind, decision) {
+    if (sourceKind === 'rulehost_block' && decision === 'admit') {
+        return 'none';
+    }
+    return 'none';
+}
+// ── Evaluation ──────────────────────────────────────────────────────────────
+/**
+ * Evaluate triage policy for incoming evidence.
+ *
+ * This is the pure policy function. It does not:
+ * - Call PainDiagnosticGate
+ * - Write to event log or trajectory
+ * - Create diagnostic tasks
+ * - Import anything from the plugin layer
+ *
+ * It only reads source descriptors and applies policy rules.
+ *
+ * @param input - Triage input with source kind and context
+ * @returns Structured triage result with decision, reason, and nextAction
+ */
+export function evaluateTriage(input) {
+    // ERR-001: validate sourceKind with runtime guard
+    const sourceKind = isSourceKind(input.sourceKind) ? input.sourceKind : 'unknown';
+    // Look up descriptor
+    const descriptor = getSourceDescriptor(sourceKind);
+    if (!descriptor) {
+        // Fallback for unregistered kinds (should not happen with 'unknown' in registry)
+        return {
+            decision: 'evidence_only',
+            sourceKind: 'unknown',
+            reason: `Source kind '${sourceKind}' not found in descriptor registry. Conservative default.`,
+            nextAction: 'classify_source_kind_and_store_as_evidence',
+        };
+    }
+    // Apply upgrade rules for upgradable kinds
+    if (descriptor.canUpgrade) {
+        const upgraded = applyUpgradeRules(input, descriptor.defaultDecision);
+        if (upgraded !== descriptor.defaultDecision) {
+            return {
+                decision: upgraded,
+                sourceKind,
+                reason: getUpgradeReason(sourceKind, upgraded, input),
+                nextAction: getUpgradeNextAction(sourceKind, upgraded),
+            };
+        }
+    }
+    return {
+        decision: descriptor.defaultDecision,
+        sourceKind,
+        reason: descriptor.reason,
+        nextAction: descriptor.nextAction,
+    };
+}
+//# sourceMappingURL=triage-policy.js.map