driftproof 0.8.0 → 0.9.0

package/lib/diff.js

@@ -59,7 +59,10 @@ function withSkillBands(receipt) {
 // which is exactly the v0.1 weakness v0.2 fixes).
 function aggWithBand(receipt) {
   const a = receipt.results.aggregates.with_skill;
-  return { mean: a.mean_score, stddev: a.stddev || 0 };
+  // v0.6 (spec 026 AC-7): a null band is carried as null and rendered as what
+  // it is; a legacy receipt with no aggregate band keeps its 0 (the archive's
+  // rendering is unmoved, AC-16).
+  return { mean: a.mean_score, stddev: a.stddev === null ? null : (a.stddev || 0), cases: a.case_count };
 }
 
 function fmt(n) { return n == null ? 'n/a' : (n >= 0 ? '+' : '') + n.toFixed(3); }
@@ -81,11 +84,41 @@ function pct(n) { return n == null ? 'n/a' : n.toFixed(3); }
 // not from one case's draws).
 
 function bandStr(x) {
+  if (x && x.mean == null) return 'n/a (0 cases)';
+  if (x && x.stddev == null) return `${x.mean.toFixed(3)} ± n/a (${x.cases === 1 ? '1 case' : 'no band'})`;
   const label = x && x.source;
   return `${x.mean.toFixed(3)} ± ${x.stddev.toFixed(3)}${label ? ` (${label})` : ''}`;
 }
 function short(h) { return h ? String(h).slice(0, 12) : 'n/a'; }
 
+// ── THE JUDGE IS PART OF THE INSTRUMENT (spec 026 AC-12, A4) ─────────────────
+// Two receipts graded by different judges are two measurements with different
+// instruments, and a verdict across them says nothing about the skill.
+// lib/reuse.js's triage already says a changed judge means regrade; the
+// differ did not ask. It asks here: run.judge.model_id (on canonical ids, so
+// an alias and its dated form are one judge), run.judge.prompt_template_hash,
+// run.judge.temperature, and every shared case's judge.rubric_hash. A field
+// that differs names itself in the caveats and suppresses every per-case
+// verdict. A pre-v0.6 receipt carries no template hash: the report says the
+// template is unrecorded on that side and still compares the rest.
+const canonicalJudgeId = (id) => String(id == null ? '' : id).replace(/-\d{8}$/, '');
+function judgeDiffers(a, b, ids, aB, bB) {
+  const ja = (a.run && a.run.judge) || {}; const jb = (b.run && b.run.judge) || {};
+  const problems = [];
+  const idA = ja.model_id || (a.results.cases.find((c) => c.judge && c.judge.model_id) || { judge: {} }).judge.model_id;
+  const idB = jb.model_id || (b.results.cases.find((c) => c.judge && c.judge.model_id) || { judge: {} }).judge.model_id;
+  if (idA && idB && canonicalJudgeId(idA) !== canonicalJudgeId(idB)) problems.push(`run.judge.model_id differs (${idA} vs ${idB})`);
+  const unrecorded = [];
+  if (!ja.prompt_template_hash) unrecorded.push('A'); if (!jb.prompt_template_hash) unrecorded.push('B');
+  if (ja.prompt_template_hash && jb.prompt_template_hash && ja.prompt_template_hash !== jb.prompt_template_hash) problems.push(`run.judge.prompt_template_hash differs (${short(ja.prompt_template_hash)} vs ${short(jb.prompt_template_hash)}): the grading template is a different judge`);
+  if (ja.temperature !== undefined && jb.temperature !== undefined && ja.temperature !== jb.temperature) problems.push(`run.judge.temperature differs (${ja.temperature} vs ${jb.temperature})`);
+  const rubricA = Object.fromEntries(a.results.cases.filter((c) => c.mode === 'with_skill' && c.judge).map((c) => [c.id, c.judge.rubric_hash]));
+  const rubricB = Object.fromEntries(b.results.cases.filter((c) => c.mode === 'with_skill' && c.judge).map((c) => [c.id, c.judge.rubric_hash]));
+  const moved = ids.filter((id) => rubricA[id] && rubricB[id] && rubricA[id] !== rubricB[id]);
+  if (moved.length) problems.push(`judge.rubric_hash differs on ${moved.length} shared case(s) (${moved.slice(0, 3).map((x) => `\`${x}\``).join(', ')}${moved.length > 3 ? ', …' : ''})`);
+  return { problems, unrecorded };
+}
+
 // The headline is a SUMMARY of the per-case band-overlap verdicts — the credibility
 // core lives per case (judge-sample bands), and the headline just aggregates it.
 // It deliberately does NOT run a separate band test on the aggregate mean: the
@@ -146,9 +179,15 @@ function buildDriftReport(a, b, { labelA = 'A', labelB = 'B', mode = 'release' }
   // improvement verdicts are never computed from evidence we did not run.
   const levelOf = (r) => r.verification_level || 'TESTED';
   const belowTested = [[labelA, a], [labelB, b]].filter(([, r]) => levelOf(r) !== 'TESTED');
+  // Spec 026 AC-4: an INCOMPLETE receipt on either side computes no per-case
+  // verdict. RECEIPT.md has said so since v0.3.1; the differ did not ask.
+  const incompleteSides = [[labelA, a], [labelB, b]].filter(([, r]) => r.run && r.run.status === 'incomplete');
+  // Spec 026 AC-12: a different judge on either side suppresses the verdict.
+  const judge = judgeDiffers(a, b, ids, aB, bB);
+  const judgeProblem = judge.problems.length ? judge.problems.join('; ') : null;
   // A REFUSAL IS A RESULT, and it suppresses the verdict exactly as an
   // untested input does: no delta is asserted, and the reason travels with it.
-  const measured = belowTested.length === 0 && !refusal;
+  const measured = belowTested.length === 0 && !refusal && incompleteSides.length === 0 && !judgeProblem;
 
   const perCase = ids.map((id) => {
     const before = aB[id] || null;
@@ -250,6 +289,15 @@ function buildDriftReport(a, b, { labelA = 'A', labelB = 'B', mode = 'release' }
   if (belowTested.length) {
     warnings.push(`verdicts NOT computed — ${belowTested.map(([l, r]) => `${l} is ${levelOf(r)}${r.run && r.run.source ? ` (${r.run.source})` : ''}`).join('; ')}. Drift verdicts require TESTED receipts on both sides; declared numbers are shown as context only (see /interop.html).`);
   }
+  if (incompleteSides.length) {
+    warnings.push(`verdicts NOT computed — ${incompleteSides.map(([l, r]) => `${l} is incomplete (run.status incomplete; it excluded ${r.run.failed_case_count || 0} case(s) whose arm could not be measured)`).join('; ')}. A receipt with an unmeasured arm is not evidence for a per-case verdict; its aggregates are shown as context only.`);
+  }
+  if (judgeProblem) {
+    warnings.push(`verdicts NOT computed — the two receipts were graded by different judges: ${judgeProblem}. A verdict across two instruments says nothing about the skill; regrade one side with the other's judge (lib/reuse.js triage: regrade).`);
+  }
+  if (judge.unrecorded.length) {
+    warnings.push(`judge template unrecorded on ${judge.unrecorded.map((x) => (x === 'A' ? labelA : labelB)).join(' and ')} (a pre-v0.6 receipt carries no run.judge.prompt_template_hash); the judge model id and the rubric hashes are compared, the template is not.`);
+  }
   // Cross-provider / cross-surface disclosure (Phase 6). A comparison across
   // providers is a skill-DURABILITY comparison across substrates, not model drift
   // over time; across surfaces, sampling control differs. Both are flagged so a
@@ -281,7 +329,11 @@ function buildDriftReport(a, b, { labelA = 'A', labelB = 'B', mode = 'release' }
     // THE HEADLINE NAMES THE CAUSE THAT ACTUALLY APPLIES. `belowTested.length`
     // was printed unconditionally, so a refused pair got "0 receipt(s) below
     // TESTED" — a statement measurably false of the receipts it was given.
-    if (refusal) {
+    if (incompleteSides.length) {
+      // An incomplete side is a fact about that receipt alone (spec 026 AC-4)
+      // and leads whatever else is wrong with the pair.
+      L.push(`**NOT MEASURED — ${incompleteSides.map(([l]) => l).join(' and ')} incomplete: a case's arm could not be measured, so no per-case verdict is computed.**`);
+    } else if (refusal) {
       // The reason is a complete sentence and already ends by saying no verdict
       // is asserted; prefixing that again produced "REFUSED — no verdict is
       // asserted. the baseline arm did not reproduce…" — a duplicated clause and
@@ -289,6 +341,8 @@ function buildDriftReport(a, b, { labelA = 'A', labelB = 'B', mode = 'release' }
       L.push(`**REFUSED — ${refusal.reason}**`);
     } else if (belowTested.length) {
       L.push(`**NOT MEASURED — ${belowTested.length} receipt(s) below TESTED. Drift verdicts require TESTED receipts on both sides; the declared numbers above are context, not band-verified evidence.**`);
+    } else if (judgeProblem) {
+      L.push(`**NOT MEASURED — different judges: ${judgeProblem}. No verdict crosses two instruments.**`);
     } else {
       L.push('**NOT MEASURED — no verdict is asserted.**');
     }
@@ -327,4 +381,4 @@ function buildDriftReport(a, b, { labelA = 'A', labelB = 'B', mode = 'release' }
   };
 }
 
-module.exports = { buildDriftReport, withSkillBands, revisionPairProblem };
+module.exports = { buildDriftReport, withSkillBands, revisionPairProblem, judgeDiffers };

package/lib/importers.js

@@ -17,7 +17,7 @@
 // compatibility contract) are documented in docs/interop.md.
 
 const { RECEIPT_SCHEMA_VERSION, RUNNER_VERSION, SUITE_FORMAT } = require('../config');
-const { sealReceipt } = require('./receipt');
+const { sealReceipt, BAND_RULE } = require('./receipt');
 const { mean, stddev, round, combineUncertainty, aggregateBands } = require('./stats');
 const { outcomeFor } = require('./run');
 const { inferProvider } = require('./provider');
@@ -64,11 +64,16 @@ function importedReceipt({ tool, skillName, skillVersion, suiteFormat, caseCount
       date_utc: dateUtc,
       registry: registryStatus(modelId),
       transcripts: 'none',
-      judge: judgeBlock,
+      // v0.6: the source tool's grader is the judge that ran; its template is
+      // not ours to hash (null, the one place the schema allows it).
+      judge: { ...judgeBlock, model_id: (cases.find((c) => c.judge && c.judge.model_id) || { judge: { model_id: 'unknown' } }).judge.model_id, prompt_template_hash: null },
+      // v0.6 (spec 026 AC-1): what answered. An external tool's harness did;
+      // nothing here attested a model, and nothing was spawned by us.
+      answered_by: { kind: 'external', attested: false, reported_model: null, reported_models: null, isolation: 'none' },
     },
     results: {
       cases,
-      aggregates: { with_skill: aggregateMode(withSkill), baseline: aggregateMode(baseline) },
+      aggregates: { with_skill: aggregateMode(withSkill), baseline: aggregateMode(baseline), band_rule: BAND_RULE },
     },
     comparison,
     verification_level: 'DECLARED',

package/lib/judge.js

@@ -58,10 +58,31 @@ function rubricHash(rubric) {
   return sha256(JUDGE_SYSTEM + '\n---\n' + String(rubric || '').trim());
 }
 
-function clamp01(n) {
-  const x = Number(n);
-  if (!Number.isFinite(x)) return 0;
-  return Math.max(0, Math.min(1, x));
+// v0.6 (spec 026 AC-11): a digest over the grading TEMPLATE with its three
+// slots empty, recorded once per run as run.judge.prompt_template_hash. The
+// rubric_hash above binds a grade to the case's rubric; this binds every grade
+// of the run to the words around it. A different template is a different judge,
+// and `diff` computes no verdict across one.
+function promptTemplateHash() {
+  return sha256(JUDGE_SYSTEM + '\n---\n' + buildJudgePrompt({ task: '', response: '', rubric: '' }));
+}
+
+// The score a judge reply carries, or null when it carries none (spec 026
+// AC-3, F2). A non-numeric or non-finite value is not a score; a number outside
+// [0, 1] is on a scale the rubric did not ask for and is not clamped into one
+// (85 is not 1.0). This replaced clamp01, whose silent 0 for a non-finite value
+// scored an absent output as the worst possible one.
+// Stop reasons that mean the surface cut the reply at its output cap: the
+// Messages API's and the claude CLI's `max_tokens`, Chat Completions'
+// `length`. A cut reply is a partial answer (spec 026 AC-8, F4).
+const TRUNCATION_STOP_REASONS = new Set(['max_tokens', 'length']);
+function isTruncated(stopReason) { return TRUNCATION_STOP_REASONS.has(String(stopReason || '')); }
+
+function scoreOf(parsed) {
+  const x = Number(parsed && parsed.score);
+  if (!Number.isFinite(x)) return null;
+  if (x < 0 || x > 1) return null;
+  return x;
 }
 
 // Judge settings for the JUDGE model's surface. Determinism where the surface
@@ -78,25 +99,50 @@ function judgeSettings(samples, judgeModel) {
   return { samples, temperature: null, sampling: 'surface-controlled', surface };
 }
 
-// Grade one response once. Returns { score, reason, raw }.
+// Grade one response once. Returns { score, reason, raw, ... } for a measured
+// sample, or { unmeasured: true, reason, raw, ... } when the reply carries no
+// score: empty, unparseable, no numeric score, or a score outside [0, 1]. A
+// zero asserts a measurement ("the response satisfied none of the rubric");
+// each of these is the absence of one, and no sample enters any statistic
+// (spec 026 AC-3). The 2026-07 rule that an unparseable judge must never
+// silently pass is kept by the stronger rule: it never silently scores at all.
 // `raw` is the judge's verbatim output text (hashed into the receipt for
 // transcript auditability, and optionally retained under --keep-transcripts).
-async function gradeOnce({ task, response, rubric, model, timeoutMs, temperature }) {
+async function gradeOnce({ task, response, rubric, model, timeoutMs, temperature, trusted = false }) {
   const prompt = buildJudgePrompt({ task, response, rubric });
-  const { text, attempts, usage } = await complete({ system: JUDGE_SYSTEM, prompt, model, maxTokens: 400, timeoutMs, temperature });
+  const out = await complete({ system: JUDGE_SYSTEM, prompt, model, maxTokens: 400, timeoutMs, temperature, trusted });
+  const { text, attempts, usage } = out;
+  const base = { raw: String(text || ''), attempts: attempts || 1, usage, reply: out };
+  // A judge reply cut at its output cap carries no complete grade.
+  if (isTruncated(out.stopReason)) {
+    return { ...base, unmeasured: true, reason: `judge output truncated at the output cap (stop_reason ${out.stopReason})` };
+  }
+  if (!String(text || '').trim()) {
+    return { ...base, unmeasured: true, reason: 'judge output empty (the surface returned no text)' };
+  }
   let parsed;
   try {
     parsed = extractJsonObject(text);
   } catch (_e) {
-    // Unsalvageable judge output → conservative 0 (a judge that can't be parsed
-    // must never silently "pass"), tagged so the caller can see it happened.
-    return { score: 0, reason: 'judge output unparseable', unparsed: true, raw: String(text || ''), attempts: attempts || 1, usage };
+    return { ...base, unmeasured: true, reason: 'judge output unparseable' };
   }
-  return { score: clamp01(parsed.score), reason: String(parsed.reason || '').slice(0, 300), raw: String(text || ''), attempts: attempts || 1, usage };
+  const score = scoreOf(parsed);
+  if (score === null) {
+    const x = parsed && parsed.score;
+    const reason = x === undefined || x === null ? 'judge output carries no numeric score'
+      : !Number.isFinite(Number(x)) ? `judge output carries no numeric score (score ${JSON.stringify(x)})`
+        : `judge score ${x} outside [0, 1]`;
+    return { ...base, unmeasured: true, reason };
+  }
+  return { ...base, score, reason: String(parsed.reason || '').slice(0, 300) };
 }
 
 // Grade a response N times and return the sampled distribution:
 //   { samples:[scores], mean, stddev, reason, judge_settings, model_id, rubric_hash }
+// or, when any sample is unmeasured, { unmeasured: true, reason, ... } with NO
+// samples: a partial sample set must never become a band, and a draw one of
+// whose judge samples carried no score is unmeasured as a whole (spec 026
+// AC-3). The remaining samples are not taken.
 // `mean` ± `stddev` is the per-case confidence band (raw spread of the N scores)
 // used by the borderline-outcome rule and per-case drift band-overlap logic.
 // NO DEFAULT TIMEOUT HERE (spec 017 AC-2). This defaulted to 120000, which
@@ -104,17 +150,20 @@ async function gradeOnce({ task, response, rubric, model, timeoutMs, temperature
 // JUDGE calls timed out on the api policy while running on a CLI surface, which
 // is the second shadowing site and the one #007's prep session had not found.
 // Passing `undefined` through lets lib/provider.js resolve the declared policy.
-async function gradeSamples({ task, response, rubric, model, samples = 5, timeoutMs }) {
+// `trusted` (spec 022) is plumbed to complete() untouched: the judge takes the
+// same spawn path as the generation it grades, so --trusted-skill is whole-run.
+async function gradeSamples({ task, response, rubric, model, samples = 5, timeoutMs, trusted = false }) {
   const settings = judgeSettings(samples, model);
   const scores = [];
   const reasons = [];
   const rawTexts = [];
   const usages = [];
+  const replies = [];   // v0.6: what answered each judge call, for the runner's attestation
   let attemptsTotal = 0;
   for (let i = 0; i < samples; i++) {
     let r;
     try {
-      r = await gradeOnce({ task, response, rubric, model, timeoutMs, temperature: settings.temperature === null ? undefined : settings.temperature });
+      r = await gradeOnce({ task, response, rubric, model, timeoutMs, temperature: settings.temperature === null ? undefined : settings.temperature, trusted });
     } catch (e) {
       // A judge sample that persistently failed (e.g. timed out after retries):
       // tag the error so the runner can charge for the spend and mark the whole
@@ -124,9 +173,18 @@ async function gradeSamples({ task, response, rubric, model, samples = 5, timeou
     }
     attemptsTotal += r.attempts || 1;
     usages.push(r.usage || null);
+    replies.push(r.reply || null);
+    rawTexts.push(r.raw || '');
+    if (r.unmeasured) {
+      return {
+        unmeasured: true, reason: r.reason, samples: [], mean: null, stddev: null,
+        sample_texts: rawTexts, sample_hashes: rawTexts.map((t) => sha256(t)),
+        judge_settings: settings, model_id: model, rubric_hash: rubricHash(rubric),
+        attempts: attemptsTotal, usage: sumUsage(usages), replies,
+      };
+    }
     scores.push(r.score);
     reasons.push(r.reason);
-    rawTexts.push(r.raw || '');
   }
   return {
     samples: scores,
@@ -147,7 +205,8 @@ async function gradeSamples({ task, response, rubric, model, samples = 5, timeou
     // EXCLUDED from every skill-value figure (lib/value.js): it is a cost we
     // impose to measure, not a cost of running the skill.
     usage: sumUsage(usages),
+    replies,
   };
 }
 
-module.exports = { gradeOnce, gradeSamples, judgeSettings, rubricHash, buildJudgePrompt, JUDGE_SYSTEM };
+module.exports = { gradeOnce, gradeSamples, judgeSettings, rubricHash, buildJudgePrompt, promptTemplateHash, scoreOf, isTruncated, TRUNCATION_STOP_REASONS, JUDGE_SYSTEM };

package/lib/models.js

@@ -66,6 +66,26 @@ function resolveRegistry(modelId) {
   return { id: canonical, entry, registered: !!entry };
 }
 
+// Spec 026 AC-10 (F6): an id that is not a model does not run. After alias
+// resolution the id must have the contract's model-id shape (letters, digits,
+// . _ -) and resolve in the registry; otherwise the run is refused before any
+// call, naming the id and the absolute path of the registry consulted
+// (DRIFTPROOF_REGISTRY when set, else the packaged config/models.json).
+// `registry: "unregistered"` stays a legal receipt value for IMPORTED receipts,
+// whose model field is another tool's word; a run of ours never writes it.
+const MODEL_ID_SHAPE = /^[A-Za-z0-9._-]+$/;
+function assertRegistered(modelId, role = 'model') {
+  const given = String(modelId == null ? '' : modelId);
+  const { id, registered } = MODEL_ID_SHAPE.test(given) ? resolveRegistry(given) : { id: given, registered: false };
+  if (!MODEL_ID_SHAPE.test(given) || !registered) {
+    const why = !MODEL_ID_SHAPE.test(given) ? 'is not a model id (letters, digits, . _ - only)' : 'is not in the model registry';
+    const e = new Error(`${role} "${given}"${id !== given ? ` (resolved "${id}")` : ''} ${why}: ${REGISTRY_PATH}. An unregistered model does not run; add a registry row (see config/models.json) or point DRIFTPROOF_REGISTRY at a registry that carries it.`);
+    e.code = 'UNREGISTERED_MODEL'; e.model = given; e.registry = REGISTRY_PATH;
+    throw e;
+  }
+  return id;
+}
+
 // The value stamped into receipt.run.registry.
 function registryStatus(modelId) {
   return resolveRegistry(modelId).registered ? 'registered' : 'unregistered';
@@ -140,23 +160,43 @@ function familyPredecessor(modelId) {
   return chooseFrom[0].id;
 }
 
-// Append a newly-discovered model id to the registry file (release trigger).
-// `firstSeen` is the first-seen date recorded as `released`. Idempotent: a no-op
-// if the id already exists. Returns the added entry (or null if already present).
-function addDiscoveredModel(id, { firstSeen = null, registryPath = REGISTRY_PATH } = {}) {
-  const raw = JSON.parse(fs.readFileSync(registryPath, 'utf8'));
-  if (raw.models.some((m) => m.id === id)) return null;
+// THE PRICE OF A MODEL NOBODY HAS PRICED YET.
+//
+// READ THIS BEFORE TRUSTING A NUMBER IT RETURNS. Nothing here reads a price
+// SOURCE. The family and the tier are inferred from the id, and the rate is
+// looked up in the table below, so the result is a GUESS whose only input is the
+// string. It is extracted into its own function, and named, because the guess
+// was being made silently inside a function whose job looked like registration.
+//
+// KNOWN DEFECT, spec 021 F-W2, deliberately NOT fixed here. The Anthropic branch
+// falls through to the OPUS rate of 5/25 for every family that is not `haiku` or
+// `sonnet`. Fable's published rate is 10/50, exactly twice opus, which is the
+// whole of the "the watcher read exactly half the snapshot on both fields"
+// observation of 2026-09-03: it is not a halving and not a misread, it is a
+// wrong-tier fallback. `DEFAULT_PRICE` above IS the conservative upper bound the
+// comment on this function used to claim, and it is not consulted. Recorded on
+// the spec 021 carry list, tagged 026, with the reason it is left alone.
+//
+// scripts/release-watch.js no longer registers anything, and records what this
+// returns as `price_verified: false` beside a source naming this function.
+function inferredPrice(id) {
   const family = familyOf(id);
   const provider = inferProviderFromId(id);
-  // Best-effort tier from family; unknown families default to frontier pricing.
-  // A newly-discovered id gets a CONSERVATIVE (upper-bound) price so the budget
-  // guard never under-projects an unknown model — exact rates are set by hand
-  // when the model is reviewed for a published run.
   const tier = /haiku|luna|mini|nano/.test(family) || /luna|mini|nano/.test(String(id)) ? 'cheap'
     : /sonnet|terra/.test(family) ? 'standard' : 'frontier';
   const price = provider === 'openai'
     ? (tier === 'cheap' ? { input: 1.0, output: 6.0 } : tier === 'standard' ? { input: 2.5, output: 15.0 } : { input: 5.0, output: 30.0 })
     : (family === 'haiku' ? { input: 1.0, output: 5.0 } : family === 'sonnet' ? { input: 3.0, output: 15.0 } : { input: 5.0, output: 25.0 });
+  return { family, provider, tier, price };
+}
+
+// Append a newly-discovered model id to the registry file (release trigger).
+// `firstSeen` is the first-seen date recorded as `released`. Idempotent: a no-op
+// if the id already exists. Returns the added entry (or null if already present).
+function addDiscoveredModel(id, { firstSeen = null, registryPath = REGISTRY_PATH } = {}) {
+  const raw = JSON.parse(fs.readFileSync(registryPath, 'utf8'));
+  if (raw.models.some((m) => m.id === id)) return null;
+  const { family, provider, tier, price } = inferredPrice(id);
   const entry = {
     id, family, provider, released: firstSeen,
     input_price: price.input, output_price: price.output, tier,
@@ -171,5 +211,6 @@ function addDiscoveredModel(id, { firstSeen = null, registryPath = REGISTRY_PATH
 module.exports = {
   loadRegistry, resolveRegistry, registryStatus, priceForModel, isJudgeEligible,
   assertJudgeEligible, providerForModel, providerConfig, inferProviderFromId,
-  familyOf, familyPredecessor, addDiscoveredModel, DEFAULT_PRICE, REGISTRY_PATH,
+  familyOf, familyPredecessor, addDiscoveredModel, inferredPrice, DEFAULT_PRICE, REGISTRY_PATH,
+  assertRegistered, MODEL_ID_SHAPE,
 };