driftproof 0.8.1 → 0.10.0

package/lib/judge.js

@@ -58,10 +58,31 @@ function rubricHash(rubric) {
   return sha256(JUDGE_SYSTEM + '\n---\n' + String(rubric || '').trim());
 }
 
-function clamp01(n) {
-  const x = Number(n);
-  if (!Number.isFinite(x)) return 0;
-  return Math.max(0, Math.min(1, x));
+// v0.6 (spec 026 AC-11): a digest over the grading TEMPLATE with its three
+// slots empty, recorded once per run as run.judge.prompt_template_hash. The
+// rubric_hash above binds a grade to the case's rubric; this binds every grade
+// of the run to the words around it. A different template is a different judge,
+// and `diff` computes no verdict across one.
+function promptTemplateHash() {
+  return sha256(JUDGE_SYSTEM + '\n---\n' + buildJudgePrompt({ task: '', response: '', rubric: '' }));
+}
+
+// The score a judge reply carries, or null when it carries none (spec 026
+// AC-3, F2). A non-numeric or non-finite value is not a score; a number outside
+// [0, 1] is on a scale the rubric did not ask for and is not clamped into one
+// (85 is not 1.0). This replaced clamp01, whose silent 0 for a non-finite value
+// scored an absent output as the worst possible one.
+// Stop reasons that mean the surface cut the reply at its output cap: the
+// Messages API's and the claude CLI's `max_tokens`, Chat Completions'
+// `length`. A cut reply is a partial answer (spec 026 AC-8, F4).
+const TRUNCATION_STOP_REASONS = new Set(['max_tokens', 'length']);
+function isTruncated(stopReason) { return TRUNCATION_STOP_REASONS.has(String(stopReason || '')); }
+
+function scoreOf(parsed) {
+  const x = Number(parsed && parsed.score);
+  if (!Number.isFinite(x)) return null;
+  if (x < 0 || x > 1) return null;
+  return x;
 }
 
 // Judge settings for the JUDGE model's surface. Determinism where the surface
@@ -78,25 +99,50 @@ function judgeSettings(samples, judgeModel) {
   return { samples, temperature: null, sampling: 'surface-controlled', surface };
 }
 
-// Grade one response once. Returns { score, reason, raw }.
+// Grade one response once. Returns { score, reason, raw, ... } for a measured
+// sample, or { unmeasured: true, reason, raw, ... } when the reply carries no
+// score: empty, unparseable, no numeric score, or a score outside [0, 1]. A
+// zero asserts a measurement ("the response satisfied none of the rubric");
+// each of these is the absence of one, and no sample enters any statistic
+// (spec 026 AC-3). The 2026-07 rule that an unparseable judge must never
+// silently pass is kept by the stronger rule: it never silently scores at all.
 // `raw` is the judge's verbatim output text (hashed into the receipt for
 // transcript auditability, and optionally retained under --keep-transcripts).
 async function gradeOnce({ task, response, rubric, model, timeoutMs, temperature, trusted = false }) {
   const prompt = buildJudgePrompt({ task, response, rubric });
-  const { text, attempts, usage } = await complete({ system: JUDGE_SYSTEM, prompt, model, maxTokens: 400, timeoutMs, temperature, trusted });
+  const out = await complete({ system: JUDGE_SYSTEM, prompt, model, maxTokens: 400, timeoutMs, temperature, trusted });
+  const { text, attempts, usage } = out;
+  const base = { raw: String(text || ''), attempts: attempts || 1, usage, reply: out };
+  // A judge reply cut at its output cap carries no complete grade.
+  if (isTruncated(out.stopReason)) {
+    return { ...base, unmeasured: true, reason: `judge output truncated at the output cap (stop_reason ${out.stopReason})` };
+  }
+  if (!String(text || '').trim()) {
+    return { ...base, unmeasured: true, reason: 'judge output empty (the surface returned no text)' };
+  }
   let parsed;
   try {
     parsed = extractJsonObject(text);
   } catch (_e) {
-    // Unsalvageable judge output → conservative 0 (a judge that can't be parsed
-    // must never silently "pass"), tagged so the caller can see it happened.
-    return { score: 0, reason: 'judge output unparseable', unparsed: true, raw: String(text || ''), attempts: attempts || 1, usage };
+    return { ...base, unmeasured: true, reason: 'judge output unparseable' };
   }
-  return { score: clamp01(parsed.score), reason: String(parsed.reason || '').slice(0, 300), raw: String(text || ''), attempts: attempts || 1, usage };
+  const score = scoreOf(parsed);
+  if (score === null) {
+    const x = parsed && parsed.score;
+    const reason = x === undefined || x === null ? 'judge output carries no numeric score'
+      : !Number.isFinite(Number(x)) ? `judge output carries no numeric score (score ${JSON.stringify(x)})`
+        : `judge score ${x} outside [0, 1]`;
+    return { ...base, unmeasured: true, reason };
+  }
+  return { ...base, score, reason: String(parsed.reason || '').slice(0, 300) };
 }
 
 // Grade a response N times and return the sampled distribution:
 //   { samples:[scores], mean, stddev, reason, judge_settings, model_id, rubric_hash }
+// or, when any sample is unmeasured, { unmeasured: true, reason, ... } with NO
+// samples: a partial sample set must never become a band, and a draw one of
+// whose judge samples carried no score is unmeasured as a whole (spec 026
+// AC-3). The remaining samples are not taken.
 // `mean` ± `stddev` is the per-case confidence band (raw spread of the N scores)
 // used by the borderline-outcome rule and per-case drift band-overlap logic.
 // NO DEFAULT TIMEOUT HERE (spec 017 AC-2). This defaulted to 120000, which
@@ -112,6 +158,7 @@ async function gradeSamples({ task, response, rubric, model, samples = 5, timeou
   const reasons = [];
   const rawTexts = [];
   const usages = [];
+  const replies = [];   // v0.6: what answered each judge call, for the runner's attestation
   let attemptsTotal = 0;
   for (let i = 0; i < samples; i++) {
     let r;
@@ -126,9 +173,18 @@ async function gradeSamples({ task, response, rubric, model, samples = 5, timeou
     }
     attemptsTotal += r.attempts || 1;
     usages.push(r.usage || null);
+    replies.push(r.reply || null);
+    rawTexts.push(r.raw || '');
+    if (r.unmeasured) {
+      return {
+        unmeasured: true, reason: r.reason, samples: [], mean: null, stddev: null,
+        sample_texts: rawTexts, sample_hashes: rawTexts.map((t) => sha256(t)),
+        judge_settings: settings, model_id: model, rubric_hash: rubricHash(rubric),
+        attempts: attemptsTotal, usage: sumUsage(usages), replies,
+      };
+    }
     scores.push(r.score);
     reasons.push(r.reason);
-    rawTexts.push(r.raw || '');
   }
   return {
     samples: scores,
@@ -149,7 +205,8 @@ async function gradeSamples({ task, response, rubric, model, samples = 5, timeou
     // EXCLUDED from every skill-value figure (lib/value.js): it is a cost we
     // impose to measure, not a cost of running the skill.
     usage: sumUsage(usages),
+    replies,
   };
 }
 
-module.exports = { gradeOnce, gradeSamples, judgeSettings, rubricHash, buildJudgePrompt, JUDGE_SYSTEM };
+module.exports = { gradeOnce, gradeSamples, judgeSettings, rubricHash, buildJudgePrompt, promptTemplateHash, scoreOf, isTruncated, TRUNCATION_STOP_REASONS, JUDGE_SYSTEM };

package/lib/models.js

@@ -66,6 +66,26 @@ function resolveRegistry(modelId) {
   return { id: canonical, entry, registered: !!entry };
 }
 
+// Spec 026 AC-10 (F6): an id that is not a model does not run. After alias
+// resolution the id must have the contract's model-id shape (letters, digits,
+// . _ -) and resolve in the registry; otherwise the run is refused before any
+// call, naming the id and the absolute path of the registry consulted
+// (DRIFTPROOF_REGISTRY when set, else the packaged config/models.json).
+// `registry: "unregistered"` stays a legal receipt value for IMPORTED receipts,
+// whose model field is another tool's word; a run of ours never writes it.
+const MODEL_ID_SHAPE = /^[A-Za-z0-9._-]+$/;
+function assertRegistered(modelId, role = 'model') {
+  const given = String(modelId == null ? '' : modelId);
+  const { id, registered } = MODEL_ID_SHAPE.test(given) ? resolveRegistry(given) : { id: given, registered: false };
+  if (!MODEL_ID_SHAPE.test(given) || !registered) {
+    const why = !MODEL_ID_SHAPE.test(given) ? 'is not a model id (letters, digits, . _ - only)' : 'is not in the model registry';
+    const e = new Error(`${role} "${given}"${id !== given ? ` (resolved "${id}")` : ''} ${why}: ${REGISTRY_PATH}. An unregistered model does not run; add a registry row (see config/models.json) or point DRIFTPROOF_REGISTRY at a registry that carries it.`);
+    e.code = 'UNREGISTERED_MODEL'; e.model = given; e.registry = REGISTRY_PATH;
+    throw e;
+  }
+  return id;
+}
+
 // The value stamped into receipt.run.registry.
 function registryStatus(modelId) {
   return resolveRegistry(modelId).registered ? 'registered' : 'unregistered';
@@ -140,23 +160,43 @@ function familyPredecessor(modelId) {
   return chooseFrom[0].id;
 }
 
-// Append a newly-discovered model id to the registry file (release trigger).
-// `firstSeen` is the first-seen date recorded as `released`. Idempotent: a no-op
-// if the id already exists. Returns the added entry (or null if already present).
-function addDiscoveredModel(id, { firstSeen = null, registryPath = REGISTRY_PATH } = {}) {
-  const raw = JSON.parse(fs.readFileSync(registryPath, 'utf8'));
-  if (raw.models.some((m) => m.id === id)) return null;
+// THE PRICE OF A MODEL NOBODY HAS PRICED YET.
+//
+// READ THIS BEFORE TRUSTING A NUMBER IT RETURNS. Nothing here reads a price
+// SOURCE. The family and the tier are inferred from the id, and the rate is
+// looked up in the table below, so the result is a GUESS whose only input is the
+// string. It is extracted into its own function, and named, because the guess
+// was being made silently inside a function whose job looked like registration.
+//
+// KNOWN DEFECT, spec 021 F-W2, deliberately NOT fixed here. The Anthropic branch
+// falls through to the OPUS rate of 5/25 for every family that is not `haiku` or
+// `sonnet`. Fable's published rate is 10/50, exactly twice opus, which is the
+// whole of the "the watcher read exactly half the snapshot on both fields"
+// observation of 2026-09-03: it is not a halving and not a misread, it is a
+// wrong-tier fallback. `DEFAULT_PRICE` above IS the conservative upper bound the
+// comment on this function used to claim, and it is not consulted. Recorded on
+// the spec 021 carry list, tagged 026, with the reason it is left alone.
+//
+// scripts/release-watch.js no longer registers anything, and records what this
+// returns as `price_verified: false` beside a source naming this function.
+function inferredPrice(id) {
   const family = familyOf(id);
   const provider = inferProviderFromId(id);
-  // Best-effort tier from family; unknown families default to frontier pricing.
-  // A newly-discovered id gets a CONSERVATIVE (upper-bound) price so the budget
-  // guard never under-projects an unknown model — exact rates are set by hand
-  // when the model is reviewed for a published run.
   const tier = /haiku|luna|mini|nano/.test(family) || /luna|mini|nano/.test(String(id)) ? 'cheap'
     : /sonnet|terra/.test(family) ? 'standard' : 'frontier';
   const price = provider === 'openai'
     ? (tier === 'cheap' ? { input: 1.0, output: 6.0 } : tier === 'standard' ? { input: 2.5, output: 15.0 } : { input: 5.0, output: 30.0 })
     : (family === 'haiku' ? { input: 1.0, output: 5.0 } : family === 'sonnet' ? { input: 3.0, output: 15.0 } : { input: 5.0, output: 25.0 });
+  return { family, provider, tier, price };
+}
+
+// Append a newly-discovered model id to the registry file (release trigger).
+// `firstSeen` is the first-seen date recorded as `released`. Idempotent: a no-op
+// if the id already exists. Returns the added entry (or null if already present).
+function addDiscoveredModel(id, { firstSeen = null, registryPath = REGISTRY_PATH } = {}) {
+  const raw = JSON.parse(fs.readFileSync(registryPath, 'utf8'));
+  if (raw.models.some((m) => m.id === id)) return null;
+  const { family, provider, tier, price } = inferredPrice(id);
   const entry = {
     id, family, provider, released: firstSeen,
     input_price: price.input, output_price: price.output, tier,
@@ -171,5 +211,6 @@ function addDiscoveredModel(id, { firstSeen = null, registryPath = REGISTRY_PATH
 module.exports = {
   loadRegistry, resolveRegistry, registryStatus, priceForModel, isJudgeEligible,
   assertJudgeEligible, providerForModel, providerConfig, inferProviderFromId,
-  familyOf, familyPredecessor, addDiscoveredModel, DEFAULT_PRICE, REGISTRY_PATH,
+  familyOf, familyPredecessor, addDiscoveredModel, inferredPrice, DEFAULT_PRICE, REGISTRY_PATH,
+  assertRegistered, MODEL_ID_SHAPE,
 };

package/lib/provider.js

@@ -9,6 +9,7 @@ const path = require('path');
 const cp = require('child_process');
 const { withRetry, withTimeout } = require('./json');
 const { stubComplete, stubEnabled } = require('./stub');
+const { readAnthropicApiResponse, readOpenaiApiResponse } = require('./usage');
 const {
   parseClaudeCliJson, parseCodexJsonl, parseAnthropicApiUsage, parseOpenaiApiUsage, normalizeUsage,
 } = require('./usage');
@@ -134,12 +135,17 @@ const CODEX_OVERHEAD_NOTE =
 async function complete({ system, prompt, model, maxTokens = 1024, timeoutMs = null, temperature = undefined, trusted = false }) {
   const surface = surfaceForModel(model);
   const provider = providerForSurface(surface);
-  // Offline stub surface: canned completion, zero model calls. The receipt still
-  // records the real surface/provider so a stub run is not mistaken for a genuine
-  // one at read time — only the generation/judge TEXT is canned.
+  // Offline stub surface: canned completion, zero model calls. The reply says
+  // so: surface `stub`, answeredBy `stub`, no model reported, no stop reason,
+  // no isolation (nothing was spawned). Spec 026 F1: the receipt used to record
+  // the REAL surface name here and read TESTED while the text was canned; now
+  // the receipt's surface, level and answered_by are derived from what this
+  // function returned, and a stub run reads UNVERIFIED with surface stub. The
+  // requested model's provider is still reported, so a reader knows what was
+  // asked for.
   if (stubEnabled()) {
     const s = stubComplete({ system, prompt });
-    return { ...s, usage: normalizeUsage(s.usage), wall_ms: (s.usage && s.usage.wall_ms) || 0, surface, provider, attempts: 1 };
+    return { ...s, usage: normalizeUsage(s.usage), wall_ms: (s.usage && s.usage.wall_ms) || 0, surface: 'stub', provider, attempts: 1, answeredBy: 'stub', reportedModels: null, stopReason: null, isolation: 'none' };
   }
 
   // Per-surface tolerance (see retryPolicyForSurface): a cli/subscription surface
@@ -177,7 +183,16 @@ async function complete({ system, prompt, model, maxTokens = 1024, timeoutMs = n
   try {
     const out = await withRetry(runner, { tries: policy.tries, baseDelayMs });
     const usage = normalizeUsage({ ...(out.usage || {}), wall_ms: wallMs });
-    return { ...out, usage, wall_ms: wallMs, surface, provider, attempts };
+    // v0.6 (spec 026 AC-1, AC-2, AC-8): a model surface answered; what it said
+    // served the call, why the reply stopped, and which spawn path was taken
+    // are what the lane could read, null where its surface reports nothing.
+    return {
+      ...out, usage, wall_ms: wallMs, surface, provider, attempts,
+      answeredBy: 'model',
+      reportedModels: Array.isArray(out.reportedModels) && out.reportedModels.length ? out.reportedModels : null,
+      stopReason: typeof out.stopReason === 'string' && out.stopReason ? out.stopReason : null,
+      isolation: out.isolation || 'none',
+    };
   } catch (e) {
     // Surface the attempt count so a persistently-failing call can be charged for
     // (and, for a timeout, marked failed_timeout by the runner instead of fatal).
@@ -202,7 +217,8 @@ async function completeAnthropicApi({ system, prompt, model, maxTokens, temperat
   if (temperature !== undefined) params.temperature = temperature;
   const resp = await client.messages.create(params);
   const text = (resp.content || []).filter((b) => b.type === 'text').map((b) => b.text).join('');
-  return { text, usage: parseAnthropicApiUsage(resp.usage) };
+  // v0.6: the response names the model that served it and why it stopped.
+  return { text, usage: parseAnthropicApiUsage(resp.usage), ...readAnthropicApiResponse(resp), isolation: 'none' };
 }
 
 // ── isolation: the eval-user hop (spec 022) ───────────────────────────────────
@@ -275,6 +291,10 @@ function isolatedEnv(user) {
   return { HOME: home, PATH: `${home}/.local/bin:/usr/bin:/bin` };
 }
 
+// The isolation a plan records into the receipt (run.answered_by.isolation,
+// spec 026 AC-2): the hop is `eval-user`, the legacy spawn `same-user`.
+function isolationOf(plan) { return plan && plan.mode === 'isolated' ? 'eval-user' : 'same-user'; }
+
 // The spawn plan for one CLI call: { mode, user, file, args, env }. Pure, so the
 // gate can inspect what WOULD be spawned. Untrusted → the hop; trusted → the
 // legacy same-user spawn exactly as it was (env inherited; the claude lane still
@@ -376,9 +396,10 @@ async function completeClaudeCli({ system, prompt, model, timeoutMs, trusted = f
     throw new Error(hop || `claude CLI exited ${r.code}: ${r.stderr.slice(0, 400)}`);
   }
   const parsed = parseClaudeCliJson(r.stdout);
-  if (!parsed) return { text: r.stdout.trim(), usage: null };
+  if (!parsed) return { text: r.stdout.trim(), usage: null, stopReason: null, reportedModels: null, isolation: isolationOf(plan) };
   if (parsed.isError) throw new Error(`claude CLI reported is_error: ${String(parsed.text || '').slice(0, 300)}`);
-  return { text: String(parsed.text || '').trim(), usage: parsed.usage };
+  // v0.6: the CLI's own stop_reason and the modelUsage map's canonical ids.
+  return { text: String(parsed.text || '').trim(), usage: parsed.usage, stopReason: parsed.stopReason, reportedModels: parsed.reportedModels, isolation: isolationOf(plan) };
 }
 
 // ── openai/api (Chat Completions-compatible) ───────────────────────────────────
@@ -418,7 +439,8 @@ async function completeOpenaiApi({ system, prompt, model, maxTokens, temperature
   let parsed;
   try { parsed = JSON.parse(raw); } catch (_e) { throw new Error(`openai/api: unparseable response: ${raw.slice(0, 200)}`); }
   const text = ((parsed.choices && parsed.choices[0] && parsed.choices[0].message && parsed.choices[0].message.content) || '');
-  return { text: String(text).trim(), usage: parseOpenaiApiUsage(parsed.usage) };
+  // v0.6: the response's model and the first choice's finish_reason.
+  return { text: String(text).trim(), usage: parseOpenaiApiUsage(parsed.usage), ...readOpenaiApiResponse(parsed), isolation: 'none' };
 }
 
 // Read the OpenAI provider config (base_url + api-key env) from the registry,
@@ -515,7 +537,9 @@ async function completeCodexCli({ system, prompt, model, timeoutMs, trusted = fa
     throw new Error(hop || `codex exec exited ${r.code}: ${String(r.stderr).slice(0, 400)}`);
   }
   const ev = parseCodexJsonl(r.stdout);
-  return { text: String(ev.text || '').trim(), usage: ev.usage };
+  // codex reports neither the serving model nor a stop reason on its stream;
+  // both read null and the receipt says the surface did not report them.
+  return { text: String(ev.text || '').trim(), usage: ev.usage, stopReason: ev.stopReason, reportedModels: ev.reportedModels, isolation: isolationOf(plan) };
 }
 
 module.exports = {
@@ -525,5 +549,5 @@ module.exports = {
   CODEX_OVERHEAD_NOTE, CODEX_EXEC_ARGS, buildCodexArgs, codexFinalArgs, codexAuthPresent,
   // spec 022 — the eval-user hop
   SUDO_BIN, EVAL_USER_DEFAULT, ISOLATED_ENV_ALLOWLIST, ISOLATED_WRAPPER, HOP_LABEL,
-  evalUser, isolatedEnv, buildSpawnPlan, runIsolated,
+  evalUser, isolatedEnv, buildSpawnPlan, runIsolated, isolationOf,
 };

package/lib/receipt.js

@@ -20,9 +20,30 @@ const SCHEMA_FILES = {
   // published v0.4 receipt asserts conformance by NUMBER, and the number has to
   // keep resolving to the schema it meant (AC-10).
   '0.4': 'receipt.v0.4.schema.json',
-  '0.5': 'receipt.schema.json',
+  // v0.5 moved the same way when v0.6 took the current pointer (spec 026): the
+  // six report-008 receipts assert v0.5 by number, and v0.6 is not additive for
+  // the validator (it requires the receipt to say what answered it), so the
+  // number has to keep resolving to the schema it meant.
+  '0.5': 'receipt.v0.5.schema.json',
+  '0.6': 'receipt.schema.json',
 };
 
+// THE BAND RULE, stated on every receipt (results.aggregates.band_rule, spec
+// 026 AC-6) so a reader recomputes the summary from the rows by the formula
+// it names rather than by guessing which of the two "bands" a receipt carries.
+// Per case, stddev is the spread of judge samples; per arm, it is this.
+const BAND_RULE = 'per arm: the sample standard deviation (n-1) of the per-case means across the included cases; the comparison band is the quadrature sum of the two arms; null where an arm has fewer than two included cases';
+
+// THE ONE PREDICATE for "this case did not complete" (spec 026 AC-3). Every
+// reader in lib/ and scripts/ asks this, never the failed_timeout literal: a
+// reader that excluded by that literal admitted a failed_unmeasured case (an
+// empty generation, a judge with no score) into its statistics as if it had
+// been measured. A case is failed when its case_status is present and is not
+// 'ok'; the status names what was observed, and both failure statuses are
+// recorded without fabricated samples or hashes.
+const FAILED_STATUSES = ['failed_timeout', 'failed_unmeasured'];
+function caseFailed(c) { return !!(c && c.case_status && c.case_status !== 'ok'); }
+
 const _validators = {};
 // Lazily compile the JSON Schema validator (ajv) for a given version. Kept lazy
 // so the library can be required without ajv present (pure hashing utilities).
@@ -80,6 +101,27 @@ function aggregate(caseResults) {
   return { case_count: caseResults.length, pass_count: passes, borderline_count: borderline, mean_score: band.mean, stddev: band.stddev };
 }
 
+// The comparison block from the two arms' aggregates. Every null it carries is
+// named: `delta_uncertainty_unavailable` is `no_cases` when an arm has no
+// included case (then every score is null too: the mean of nothing is not a
+// number) and `single_case` when an arm has one (a mean, no band). Otherwise
+// the block is numeric and the field is absent (spec 026 AC-7).
+function comparisonOf(aggWith, aggBase) {
+  const noCases = aggWith.case_count === 0 || aggBase.case_count === 0;
+  const single = !noCases && (aggWith.case_count < 2 || aggBase.case_count < 2);
+  const cmp = {
+    with_skill_score: aggWith.mean_score,
+    baseline_score: aggBase.mean_score,
+    delta: noCases ? null : round(aggWith.mean_score - aggBase.mean_score),
+    // Combined uncertainty of the delta: quadrature sum of the two aggregate
+    // bands. Diff uses this for the headline "within noise" vs real-move rule.
+    delta_uncertainty: noCases ? null : combineUncertainty(aggWith.stddev, aggBase.stddev),
+  };
+  if (noCases) cmp.delta_uncertainty_unavailable = 'no_cases';
+  else if (single) cmp.delta_uncertainty_unavailable = 'single_case';
+  return cmp;
+}
+
 // Assemble a full receipt from the runner's raw pieces, seal it, and return it.
 //   skill:   { name, version, contentHash }
 //   suite:   { format, suiteHash, caseCount }
@@ -109,7 +151,7 @@ function buildReceipt({ skill, suite, run, cases, economics = null, verification
   // The excluded case STAYS in `results.cases`. It is removed from the mean, not
   // from the record — deleting the evidence of a failure is a different and worse
   // defect than averaging over it.
-  const armUnusable = (c) => c.case_status === 'failed_timeout'
+  const armUnusable = (c) => caseFailed(c)
     || (c.mean == null && c.score == null);
   const excludedIds = new Map();
   for (const c of cases) {
@@ -183,25 +225,23 @@ function buildReceipt({ skill, suite, run, cases, economics = null, verification
       registry: run.registry || 'unregistered',
       transcripts: run.transcripts || 'hashes-only',
       judge: run.judge || { samples: 1, temperature: null, sampling: 'single', surface: run.surface },
+      // v0.6 (spec 026 AC-1, AC-2): what answered. Carried from the caller as
+      // given and never defaulted: a receipt that does not say what answered it
+      // is refused by the schema, which is the point.
+      ...(run.answered_by ? { answered_by: run.answered_by } : {}),
     },
     results: {
       cases,
       aggregates: {
         with_skill: aggWith,
         baseline: aggBase,
+        band_rule: BAND_RULE,
         // Present only when something was excluded, so a clean run's receipt is
         // unchanged and the archive does not acquire an empty field.
         ...(excludedCases.length ? { excluded_cases: excludedCases } : {}),
       },
     },
-    comparison: {
-      with_skill_score: aggWith.mean_score,
-      baseline_score: aggBase.mean_score,
-      delta: round(aggWith.mean_score - aggBase.mean_score),
-      // Combined uncertainty of the delta: quadrature sum of the two aggregate
-      // bands. Diff uses this for the headline "within noise" vs real-move rule.
-      delta_uncertainty: combineUncertainty(aggWith.stddev, aggBase.stddev),
-    },
+    comparison: comparisonOf(aggWith, aggBase),
     verification_level: verificationLevel,
     receipt_hash: '',
   };
@@ -226,5 +266,5 @@ function buildReceipt({ skill, suite, run, cases, economics = null, verification
 }
 
 module.exports = {
-  buildReceipt, sealReceipt, computeReceiptHash, verifyReceiptHash, validateReceipt,
+  buildReceipt, sealReceipt, computeReceiptHash, verifyReceiptHash, validateReceipt, BAND_RULE, comparisonOf, caseFailed, FAILED_STATUSES,
 };