fidelis 0.1.0 → 0.1.2

package/dist/auditor.d.ts

@@ -32,6 +32,8 @@ export declare class Auditor {
     }): boolean;
     /** A turn that failed or was interrupted has no completed boundary to audit: nothing is running any more. */
     executionEnded(sessionID: string): void;
+    /** The agent never received the correction, so nothing is being corrected. */
+    deliveryFailed(sessionID: string, reason: string): void;
     /** Merge host events with the ledger so compaction cannot erase evidence the audit still needs. */
     retain(sessionID: string, events: ExecEvent[]): ExecEvent[];
     complete(sessionID: string, input: CompletionInput): Promise<Outcome>;

package/dist/auditor.js

@@ -1,7 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { consentProblem } from "./config.js";
 import { getChecklist, resolveSources } from "./compiler.js";
-import { judge } from "./judge.js";
+import { judge, LEDGER_MARK } from "./judge.js";
 import { transition } from "./machine.js";
 import { redact } from "./redact.js";
 import { canonical, sha256 } from "./store.js";
@@ -69,6 +69,15 @@ export class Auditor {
                 state.state = "READY";
         }, "ended");
     }
+    /** The agent never received the correction, so nothing is being corrected. */
+    deliveryFailed(sessionID, reason) {
+        this.save(sessionID, (state) => {
+            if (state.state !== "CORRECTING")
+                return;
+            state.state = "AUDIT_INCOMPLETE";
+            state.reason = `The correction could not be delivered: ${reason}`;
+        }, "incomplete");
+    }
     /** Merge host events with the ledger so compaction cannot erase evidence the audit still needs. */
     retain(sessionID, events) {
         const store = this.o.store;
@@ -77,8 +86,13 @@ export class Auditor {
         for (const event of events)
             merged.set(event.id, event);
         const ordered = [...merged.values()].sort((a, b) => (a.at ?? 0) - (b.at ?? 0) || a.seq - b.seq).map((event, seq) => ({ ...event, seq }));
-        const clipField = (value) => (value === undefined ? undefined : redact(raw ? value : value.slice(0, LEDGER_CLIP)));
-        store.writeLedger(sessionID, ordered.slice(-LEDGER_MAX).map((event) => ({ ...event, text: clipField(event.text), output: clipField(event.output), input: event.input === undefined ? undefined : JSON.parse(redact(JSON.stringify(event.input))) })));
+        const clipField = (value) => {
+            if (value === undefined)
+                return undefined;
+            const clean = redact(value);
+            return raw || clean.length <= LEDGER_CLIP ? clean : clean.slice(0, LEDGER_CLIP) + LEDGER_MARK;
+        };
+        store.writeLedger(sessionID, ordered.slice(-LEDGER_MAX).map((event) => ({ ...event, text: clipField(event.text), output: clipField(event.output), input: clipField(typeof event.input === "string" || event.input === undefined ? event.input : JSON.stringify(event.input)) })));
         return ordered;
     }
     async complete(sessionID, input) {
@@ -110,6 +124,11 @@ export class Auditor {
         }, "auditing");
         if (skip)
             return skip;
+        // Spend is saved as it happens, so a superseded audit still counts against the session.
+        const charge = (costUSD) => {
+            if (costUSD)
+                this.save(sessionID, (state) => void (state.spentUSD += costUSD), "usage");
+        };
         const metrics = { cacheHit: false, compilerCalls: 0, judgeCalls: 0, tokens: 0, costUSD: 0, latencyMs: 0, uncertain: 0 };
         const finish = (event, reason, findings, extra = {}) => {
             metrics.latencyMs = Date.now() - started;
@@ -127,7 +146,6 @@ export class Auditor {
                 state.findings = findings;
                 state.lastAuditID = auditID;
                 state.boundaries = [...state.boundaries, boundaryID].slice(-MAX_TRACKED);
-                state.spentUSD += metrics.costUSD;
             }, event);
             if (!current)
                 return null;
@@ -167,6 +185,7 @@ export class Auditor {
         metrics.compilerCalls = compiled.calls;
         metrics.tokens = compiled.tokens;
         metrics.costUSD = compiled.costUSD;
+        charge(compiled.costUSD);
         if (!compiled.checklist)
             return incomplete(compileConsent && !compiled.cacheHit ? compileConsent : (compiled.reason ?? "Checklist unavailable."));
         this.save(sessionID, (state) => void (state.phase = "judging"), "judging");
@@ -177,18 +196,33 @@ export class Auditor {
             return incomplete("No decision model is available.");
         let verdict;
         try {
-            verdict = await judge({ checklist: compiled.checklist, evidence: input.evidence, prior: begin.findings.filter((finding) => finding.status === "VIOLATED"), model: this.o.judge, config });
+            verdict = await judge({
+                checklist: compiled.checklist,
+                evidence: input.evidence,
+                prior: begin.findings.filter((finding) => finding.status === "VIOLATED"),
+                model: this.o.judge,
+                config,
+                stopReason: () => {
+                    const current = store.read(sessionID);
+                    if (current.audit?.id !== auditID)
+                        return "the audit was superseded by a newer turn";
+                    return config.maxAuditCostUSD !== null && current.spentUSD >= config.maxAuditCostUSD ? "the audit budget is exhausted" : null;
+                },
+                onUsage: (tokens, costUSD) => {
+                    metrics.tokens += tokens;
+                    metrics.costUSD += costUSD;
+                    charge(costUSD);
+                },
+            });
         }
         catch (error) {
             return incomplete(`Judge failed: ${error.message}`);
         }
         metrics.judgeCalls = verdict.calls;
-        metrics.tokens += verdict.tokens;
-        metrics.costUSD += verdict.costUSD;
-        return this.route(verdict.findings, verdict.waiting, begin, auditID, finish, stale, incomplete);
+        return this.route(verdict.findings, verdict.waiting, compiled.checklist.dropped.length, begin, auditID, finish, stale, incomplete);
     }
     /** Deterministic routing. Model output only suggests; these branches decide. */
-    route(findings, waiting, begin, auditID, finish, stale, incomplete) {
+    route(findings, waiting, dropped, begin, auditID, finish, stale, incomplete) {
         const violated = findings.filter((finding) => finding.status === "VIOLATED");
         const open = violated.filter((finding) => !finding.resolved);
         const forUser = open.filter((finding) => finding.repair === "user");
@@ -219,6 +253,9 @@ export class Auditor {
         const unknown = findings.filter((finding) => finding.status === "UNKNOWN");
         if (unknown.length)
             return incomplete(`${unknown.length} rule(s) could not be assessed.`, findings);
+        // A rule the compiler produced but validation rejected was never judged, so this cannot be a clean pass.
+        if (dropped)
+            return incomplete(`${dropped} compiled rule(s) failed validation and were not assessed.`, findings);
         const reason = violated.length ? `${violated.length} violation(s) on record, repaired or acknowledged after correction.` : undefined;
         const state = finish("clean", reason, findings);
         return state ? { action: "none", state, reason, notice: violated.length ? `Fidelis findings:\n${userNotice(violated)}` : undefined } : stale();

package/dist/compiler.js

@@ -107,7 +107,7 @@ export async function getChecklist(input) {
     const fingerprint = checklistFingerprint(host, sources, config, prompt);
     const cached = config.cacheChecklist ? store.getChecklist(fingerprint) : undefined;
     const miss = { cacheHit: false, calls: 1, tokens: 0, costUSD: 0 };
-    if (cached?.schema === SCHEMA_VERSION)
+    if (cached?.schema === SCHEMA_VERSION && cached.dropped.length === 0)
         return { checklist: cached, cacheHit: true, calls: 0, tokens: 0, costUSD: 0 };
     if (!generate)
         return { ...miss, calls: 0, reason: "No compiler model is available." };
@@ -118,14 +118,17 @@ export async function getChecklist(input) {
         miss.tokens = output.tokens ?? 0;
         miss.costUSD = output.costUSD ?? 0;
         const raw = parseJson(output.text);
-        const confidence = typeof raw?.confidence === "number" ? raw.confidence : 1;
+        const confidence = raw?.confidence;
+        if (typeof confidence !== "number" || !(confidence >= 0 && confidence <= 1))
+            return { ...miss, reason: "Compiler output has no valid confidence." };
         const { rules, dropped } = validateRules(raw, sources);
         if (confidence < MIN_CONFIDENCE)
             return { ...miss, reason: `Compiler confidence ${confidence} is too low.` };
         if (rules.length === 0)
             return { ...miss, reason: `Compiler produced no valid rules from the instructions (${dropped.length} rejected).` };
         const checklist = { schema: SCHEMA_VERSION, fingerprint, model: config.compilerModel, compiledAt: Date.now(), rules, dropped };
-        if (config.cacheChecklist)
+        // Only a fully validated checklist is reused; a partial one is retried on the next turn.
+        if (config.cacheChecklist && dropped.length === 0)
             store.putChecklist(checklist);
         return { ...miss, checklist };
     }

package/dist/judge.d.ts

@@ -1,5 +1,7 @@
 import type { Checklist, Config, Evidence, Finding } from "./types.ts";
 import { type DecisionModel } from "./providers.ts";
+/** Marks text the ledger cut. An event read back from it can no longer prove what it does not show. */
+export declare const LEDGER_MARK = "\u2026[clipped in ledger]";
 export declare class EvidenceTooLarge extends Error {
 }
 /**
@@ -25,4 +27,6 @@ export declare function judge(input: {
     prior: Finding[];
     model: DecisionModel;
     config: Config;
+    stopReason?: () => string | null;
+    onUsage?: (tokens: number, costUSD: number) => void;
 }): Promise<JudgeResult>;

package/dist/judge.js

@@ -8,11 +8,16 @@ const MIN_SATISFIED = 0.6;
 const CLIP_STEPS = [2000, 500, 120];
 const HISTORY_CLIP = 120;
 const HISTORY_SHARE = 0.3;
+/** Marks text the ledger cut. An event read back from it can no longer prove what it does not show. */
+export const LEDGER_MARK = "…[clipped in ledger]";
 export class EvidenceTooLarge extends Error {
 }
+const ledgerClipped = (event) => [event.text, event.output, event.input].some((value) => typeof value === "string" && value.includes(LEDGER_MARK));
 function clip(text, limit) {
     return text.length <= limit ? text : `${text.slice(0, limit)}…[clipped ${text.length - limit} chars]`;
 }
+/** Redact whole values before clipping: a cut secret no longer matches its pattern. */
+const safeClip = (text, limit) => clip(redact(text), limit);
 function eventLine(event, limit) {
     const parts = [`#${event.seq} id=${event.id} ${event.kind}`];
     if (event.actor)
@@ -22,12 +27,12 @@ function eventLine(event, limit) {
     if (event.status)
         parts.push(`status=${event.status}`);
     if (event.input !== undefined)
-        parts.push(`input=${clip(typeof event.input === "string" ? event.input : JSON.stringify(event.input), limit)}`);
+        parts.push(`input=${safeClip(typeof event.input === "string" ? event.input : JSON.stringify(event.input), limit)}`);
     if (event.output)
-        parts.push(`output=${clip(event.output, limit)}`);
+        parts.push(`output=${safeClip(event.output, limit)}`);
     if (event.text)
-        parts.push(`text=${clip(event.text, limit)}`);
-    return redact(parts.join(" "));
+        parts.push(`text=${safeClip(event.text, limit)}`);
+    return parts.join(" ");
 }
 /**
  * The turn is clipped loudly and never loses an event: over budget means an incomplete audit. Older context may be
@@ -37,27 +42,34 @@ export function digest(evidence, prior, budgetChars, rawIDs = new Set(), preambl
     const history = evidence.history ?? [];
     const historyLines = [];
     let used = 0;
+    let full = false;
     for (const event of [...history].reverse()) {
-        const line = eventLine(event, HISTORY_CLIP);
-        if (used + line.length > budgetChars * HISTORY_SHARE)
-            break;
-        used += line.length;
+        // A restored span always goes in: the recheck is only valid if the judge really sees it. Over budget fails below.
+        const restored = rawIDs.has(event.id);
+        const line = eventLine(event, restored ? budgetChars : HISTORY_CLIP);
+        if (!restored && (full || used + line.length > budgetChars * HISTORY_SHARE)) {
+            full = true;
+            continue;
+        }
+        if (!restored)
+            used += line.length;
         historyLines.unshift(line);
     }
     const omitted = history.length - historyLines.length;
-    const complete = evidence.complete && omitted === 0;
-    const gaps = [...evidence.gaps, ...(omitted ? [`${omitted} older events omitted to fit the budget`] : [])];
+    const clippedInLedger = [...history, ...evidence.events].some(ledgerClipped);
+    const complete = evidence.complete && omitted === 0 && !clippedInLedger;
+    const gaps = [...evidence.gaps, ...(omitted ? [`${omitted} older events omitted to fit the budget`] : []), ...(clippedInLedger ? ["some retained events were clipped after the host compacted them"] : [])];
     const head = [
         preamble,
         `Evidence source: ${complete ? "known complete" : `INCOMPLETE (${gaps.join("; ") || "unknown gaps"})`}.`,
-        `Current user request: ${redact(clip(evidence.userRequest, 4000))}`,
+        `Current user request: ${safeClip(evidence.userRequest, 4000)}`,
         prior.length ? `Unresolved findings from the previous audit of this turn: ${prior.map((finding) => `${finding.ruleID}: ${clip(finding.quote, 200)}`).join(" | ")}` : "",
         historyLines.length ? `Earlier turns, context only${omitted ? ` (${omitted} older events omitted)` : ""}:\n${historyLines.join("\n")}` : "",
         "Events of the turn under audit:",
     ].filter(Boolean);
     for (const limit of CLIP_STEPS) {
         const lines = evidence.events.map((event) => eventLine(event, rawIDs.has(event.id) ? budgetChars : limit));
-        const text = [...head, ...lines, `Final reply: ${redact(clip(evidence.finalReply, 8000))}`].join("\n");
+        const text = [...head, ...lines, `Final reply: ${redact(evidence.finalReply)}`].join("\n");
         if (text.length <= budgetChars)
             return { text, clipped: limit !== CLIP_STEPS[0] || text.includes("…[clipped"), complete };
     }
@@ -78,11 +90,15 @@ export async function judge(input) {
     const ask = async (state, questions) => {
         const answers = {};
         for (let index = 0; index < questions.length; index += CHUNK) {
+            const stop = input.stopReason?.();
+            if (stop)
+                throw new Error(stop);
             const decisions = await withRetry(() => model.ask(state, questions.slice(index, index + CHUNK)), config);
             Object.assign(answers, decisions.answers);
             result.calls += 1;
             result.tokens += decisions.tokens ?? 0;
             result.costUSD += decisions.costUSD ?? 0;
+            input.onUsage?.(decisions.tokens ?? 0, decisions.costUSD ?? 0);
         }
         return answers;
     };
@@ -111,7 +127,10 @@ export async function judge(input) {
         { type: "predicate", name: "turn_waiting", instructions: QUESTIONS.waiting },
         ...open.flatMap((rule, i) => [predicate(`r${i}_applies`, rule, QUESTIONS.applies), predicate(`r${i}_deadline`, rule, QUESTIONS.deadline)]),
     ]);
-    result.waiting = (scope.turn_waiting?.p ?? 0) >= 0.5;
+    const waiting = scope.turn_waiting?.p;
+    if (typeof waiting !== "number")
+        throw new Error("the model did not answer whether the agent is waiting for the user");
+    result.waiting = waiting >= 0.5;
     const applying = new Set(open.filter((_, i) => (scope[`r${i}_applies`]?.p ?? 1) >= 0.5).map((rule) => rule.id));
     const candidates = [];
     open.forEach((rule, i) => {
@@ -121,7 +140,7 @@ export async function judge(input) {
             return void done.set(rule.id, finding(rule, "UNKNOWN", "The decision model gave no answer.", { uncertainty: scope[`r${i}_applies`]?.error ?? scope[`r${i}_deadline`]?.error ?? "missing answer" }));
         if (applies < 0.5)
             return void done.set(rule.id, finding(rule, "NOT_APPLICABLE", "Does not govern this turn.", { probability: applies }));
-        if (rule.supersededBy && applying.has(rule.supersededBy))
+        if (rule.supersedable && rule.supersededBy && applying.has(rule.supersededBy))
             return void done.set(rule.id, finding(rule, "NOT_APPLICABLE", `Superseded by applicable rule ${rule.supersededBy}.`));
         if (deadline < 0.5)
             return void done.set(rule.id, finding(rule, "PENDING", "Its deadline has not occurred at this boundary.", { probability: deadline }));
@@ -140,23 +159,29 @@ export async function judge(input) {
         instructions: `${ruleText(rule)}\nQuestion: ${text}`,
         choices: events.map((event) => ({ value: event.id, description: clip(eventLine(event, 160), 240) })),
     });
-    // Ambiguous verdicts get one recheck with the disputed spans unclipped.
-    const ambiguous = candidates.filter(({ i }) => {
+    // A verdict resting on clipped evidence gets one recheck with the disputed span in full:
+    // ambiguous ones, and any breach that rests on absence, since the proof may sit in the clipped part.
+    const disputed = candidates.filter(({ i }) => {
         const p = verdict[`r${i}_violated`]?.p ?? 0;
-        return p >= 0.5 && p < config.minViolationConfidence;
+        return p >= 0.5 && (p < config.minViolationConfidence || (verdict[`r${i}_absence`]?.p ?? 1) >= 0.5);
     });
-    if (first.clipped && ambiguous.length && inTurn.length) {
-        const spans = await ask(first.text, ambiguous.map(({ rule, i }) => cite(`r${i}_span`, rule, "Which event most directly bears on whether this rule was breached?")));
-        const raw = new Set(ambiguous.flatMap(({ i }) => spans[`r${i}_span`]?.choice ?? []));
+    const rechecked = new Set();
+    if (first.clipped && disputed.length && inTurn.length) {
+        const spans = await ask(first.text, disputed.map(({ rule, i }) => cite(`r${i}_span`, rule, "Which event's full content most directly bears on whether this rule was breached?", everywhere)));
+        const restored = disputed.filter(({ i }) => knownAnywhere.has(spans[`r${i}_span`]?.choice ?? ""));
+        const raw = new Set(restored.map(({ i }) => spans[`r${i}_span`].choice));
         try {
-            const again = await ask(digest(evidence, prior, budget * 2, raw, preamble).text, ambiguous.map(({ rule, i }) => predicate(`r${i}_violated`, rule, QUESTIONS.violated)));
+            const again = await ask(digest(evidence, prior, budget * 2, raw, preamble).text, restored.map(({ rule, i }) => predicate(`r${i}_violated`, rule, QUESTIONS.violated)));
             Object.assign(verdict, again);
+            for (const { i } of restored)
+                rechecked.add(i);
         }
         catch (error) {
             if (!(error instanceof EvidenceTooLarge))
                 throw error;
         }
     }
+    const reported = new Set(prior.map((finding) => finding.ruleID));
     const breached = [];
     const complied = [];
     for (const candidate of candidates) {
@@ -165,9 +190,11 @@ export async function judge(input) {
         const satisfied = verdict[`r${i}_satisfied`]?.p ?? 0;
         if (violated === undefined)
             done.set(rule.id, finding(rule, "UNKNOWN", "The decision model gave no answer.", { uncertainty: verdict[`r${i}_violated`]?.error ?? "missing answer" }));
-        else if (violated >= config.minViolationConfidence) {
-            if ((verdict[`r${i}_absence`]?.p ?? 1) >= 0.5 && !first.complete)
-                done.set(rule.id, finding(rule, "UNKNOWN", "The breach rests only on missing events and the evidence source is incomplete.", { probability: violated, uncertainty: "incomplete evidence" }));
+        // A breach an earlier audit of this turn already proved stays on the repair path even if this verdict is less sure.
+        else if (violated >= config.minViolationConfidence || (violated >= 0.5 && reported.has(rule.id))) {
+            const unprovable = !first.complete || (first.clipped && !rechecked.has(i));
+            if ((verdict[`r${i}_absence`]?.p ?? 1) >= 0.5 && unprovable)
+                done.set(rule.id, finding(rule, "UNKNOWN", "The breach rests only on missing events and the evidence is incomplete.", { probability: violated, uncertainty: "incomplete evidence" }));
             else
                 breached.push(candidate);
         }
@@ -179,7 +206,6 @@ export async function judge(input) {
             done.set(rule.id, finding(rule, "UNKNOWN", "Neither compliance nor a breach is supported by the evidence.", { probability: satisfied, uncertainty: "insufficient evidence" }));
     }
     // Stage 3: evidence and repair routing, asked only for what needs them.
-    const reported = new Set(prior.map((finding) => finding.ruleID));
     const detail = everywhere.length
         ? await ask(first.text, [
             ...breached.flatMap(({ rule, i }) => [

package/dist/redact.js

@@ -1,5 +1,5 @@
 const PATTERNS = [
-    [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, "[REDACTED PRIVATE KEY]"],
+    [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g, "[REDACTED PRIVATE KEY]"],
     [/\b(sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|npm_[A-Za-z0-9]{20,}|xox[abprs]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{30,})\b/g, "[REDACTED TOKEN]"],
     [/\b(authorization\s*[:=]\s*(?:bearer\s+)?)[^\s"']+/gi, "$1[REDACTED]"],
     [/\b(bearer\s+)[A-Za-z0-9._~+/-]{16,}=*/gi, "$1[REDACTED]"],

package/dist/store.d.ts

@@ -20,5 +20,8 @@ export declare class Store {
     /** Evidence that must survive host compaction. Holds redacted, clipped events by default. */
     readLedger(sessionID: string): ExecEvent[];
     writeLedger(sessionID: string, events: ExecEvent[]): void;
+    /** Lazily loaded instruction files, which the host may not show again after compaction. */
+    readNested(sessionID: string): Record<string, string>;
+    writeNested(sessionID: string, nested: Record<string, string>): void;
     cleanup(retentionDays: number, now?: number): void;
 }

package/dist/store.js

@@ -142,6 +142,13 @@ export class Store {
     writeLedger(sessionID, events) {
         writeAtomic(join(this.sessionDir(sessionID), "ledger.json"), JSON.stringify(events));
     }
+    /** Lazily loaded instruction files, which the host may not show again after compaction. */
+    readNested(sessionID) {
+        return readJson(join(this.sessionDir(sessionID), "nested.json")) ?? {};
+    }
+    writeNested(sessionID, nested) {
+        writeAtomic(join(this.sessionDir(sessionID), "nested.json"), JSON.stringify(nested));
+    }
     cleanup(retentionDays, now = Date.now()) {
         const cutoff = now - retentionDays * 86_400_000;
         const prune = (dir) => {

package/package.json

@@ -1,12 +1,28 @@
 {
   "name": "fidelis",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Harness-agnostic AI agent auditor core: checklist compiler, judge pipeline and session state machine.",
   "type": "module",
   "license": "MIT",
-  "repository": { "type": "git", "url": "git+https://github.com/insign/fidelis.git", "directory": "packages/core" },
-  "exports": { ".": { "types": "./dist/index.d.ts", "import": "./dist/index.js" } },
-  "files": ["dist", "README.md"],
-  "publishConfig": { "access": "public" },
-  "engines": { "node": ">=22.18" }
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/insign/fidelis.git",
+    "directory": "packages/core"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=22.18"
+  }
 }