modelrig 0.0.1 → 0.2.0

package/dist/verify/capture.js

@@ -0,0 +1,180 @@
+"use strict";
+/**
+ * The capture step — records N invocations of the ORIGINAL call site's
+ * inputs/outputs LOCALLY (spec §9 Tier-2 verify). Two surfaces:
+ *
+ *  - `captureOriginal(site, originalFn, inputs)` — invoke the original call
+ *    (a black-box function the skill/harness wraps around the customer's real
+ *    call) once per input and record the I/O into a fixture. Honest refusal is
+ *    built in: a streaming or dynamically-assembled-prompt call site is REFUSED
+ *    up front (those are T0/T1 territory), and an input the original throws on
+ *    is recorded as a per-input refusal, never a lost sample.
+ *  - `openShadowCaptureStore(dbPath)` — a durable local SQLite buffer for the
+ *    same captures, the same posture as telemetry/capture.ts: a plain
+ *    better-sqlite3 handle with record/readAll/close and NO network or upload
+ *    accessor. Captures stay in the SDK process; nothing here uploads.
+ *
+ * The portable `ShadowCaptureFixture` (JSON) is the hand-off the CLI reads and
+ * the skill embeds context from — the only thing that leaves this module, and
+ * only to local disk.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.captureOriginal = captureOriginal;
+exports.openShadowCaptureStore = openShadowCaptureStore;
+exports.serializeFixture = serializeFixture;
+exports.parseFixture = parseFixture;
+const better_sqlite3_1 = __importDefault(require("better-sqlite3"));
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+/**
+ * Capture N original invocations into a fixture. Streaming/dynamic sites are
+ * refused before any call; per-input failures become `uncapturable` refusals.
+ */
+async function captureOriginal(site, originalFn, inputs, opts = {}) {
+    const capturedAt = (opts.now ?? (() => new Date().toISOString()))();
+    const nd = site.nondeterministicPaths;
+    const upfront = refuseUpFront(site);
+    if (upfront !== null) {
+        return {
+            callSiteId: site.callSiteId,
+            original: site.original,
+            capturedAt,
+            samples: [],
+            refusals: [upfront],
+            ...(nd !== undefined ? { nondeterministicPaths: nd } : {}),
+        };
+    }
+    const samples = [];
+    const refusals = [];
+    for (const input of inputs) {
+        try {
+            const output = await originalFn(input);
+            samples.push({ input, output });
+        }
+        catch (err) {
+            refusals.push({
+                reason: "uncapturable",
+                detail: `input ${JSON.stringify(input)} could not be captured: ` +
+                    (err instanceof Error ? err.message : String(err)),
+            });
+        }
+    }
+    return {
+        callSiteId: site.callSiteId,
+        original: site.original,
+        capturedAt,
+        samples,
+        ...(refusals.length > 0 ? { refusals } : {}),
+        ...(nd !== undefined ? { nondeterministicPaths: nd } : {}),
+    };
+}
+function refuseUpFront(site) {
+    if (site.streaming === true) {
+        return {
+            reason: "streaming",
+            detail: `call site ${site.callSiteId} streams tokens — a streaming call has no single ` +
+                "terminal output to replay against; per the batch-first deferral this is T0/T1 territory",
+        };
+    }
+    if (site.dynamicPrompt === true) {
+        return {
+            reason: "dynamic-prompt",
+            detail: `call site ${site.callSiteId} assembles its prompt dynamically — it does not map to a ` +
+                "stable template + variables, so it cannot be replayed through a task route (T0/T1 territory)",
+        };
+    }
+    return null;
+}
+const SHADOW_SQL = `
+CREATE TABLE IF NOT EXISTS shadow_captures (
+  call_site_id TEXT NOT NULL,
+  seq          INTEGER NOT NULL,
+  provider     TEXT NOT NULL,
+  model        TEXT NOT NULL,
+  input_json   TEXT NOT NULL,
+  output_text  TEXT NOT NULL,
+  PRIMARY KEY (call_site_id, seq)
+);
+`;
+/**
+ * A separate better-sqlite3 handle — deliberately NOT wired to any exporter or
+ * upload path. Shadow captures are original-call outputs used only to prove
+ * equivalence locally; nothing here ever leaves the machine (the SDK's
+ * export-isolation posture, extended to the verifier).
+ */
+function openShadowCaptureStore(dbPath) {
+    (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(dbPath), { recursive: true });
+    const db = new better_sqlite3_1.default(dbPath);
+    db.pragma("journal_mode = WAL");
+    db.exec(SHADOW_SQL);
+    const nextSeq = db.prepare("SELECT COALESCE(MAX(seq), -1) + 1 AS n FROM shadow_captures WHERE call_site_id = ?");
+    const insert = db.prepare(`
+    INSERT INTO shadow_captures (call_site_id, seq, provider, model, input_json, output_text)
+    VALUES (@call_site_id, @seq, @provider, @model, @input_json, @output_text)
+  `);
+    const selectAll = db.prepare("SELECT input_json, output_text FROM shadow_captures WHERE call_site_id = ? ORDER BY seq ASC");
+    return {
+        record(row) {
+            const seq = nextSeq.get(row.callSiteId).n;
+            insert.run({
+                call_site_id: row.callSiteId,
+                seq,
+                provider: row.provider,
+                model: row.model,
+                input_json: JSON.stringify(row.input),
+                output_text: row.output,
+            });
+        },
+        readAll(callSiteId) {
+            return selectAll.all(callSiteId).map((r) => ({
+                input: JSON.parse(r.input_json),
+                output: r.output_text,
+            }));
+        },
+        close() {
+            db.close();
+        },
+    };
+}
+// ── Portable fixture JSON (the CLI hand-off) ─────────────────────────────────
+function serializeFixture(fixture) {
+    return `${JSON.stringify(fixture, null, 2)}\n`;
+}
+/** A non-null, non-array object (the shape a JSON `{...}` decodes to). */
+function isPlainObject(v) {
+    return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+/** Parse + shape-validate a fixture (errors teach — the CLI surfaces them). */
+function parseFixture(json) {
+    let raw;
+    try {
+        raw = JSON.parse(json);
+    }
+    catch (err) {
+        throw new Error(`capture fixture is not valid JSON: ${err.message}`);
+    }
+    if (raw === null || typeof raw !== "object") {
+        throw new Error("capture fixture must be a JSON object");
+    }
+    const o = raw;
+    if (typeof o.callSiteId !== "string")
+        throw new Error('capture fixture is missing "callSiteId"');
+    const original = o.original;
+    if (!isPlainObject(original) || typeof original.provider !== "string" || typeof original.model !== "string") {
+        throw new Error('capture fixture is missing a valid "original" { provider, model }');
+    }
+    if (!Array.isArray(o.samples))
+        throw new Error('capture fixture is missing a "samples" array');
+    for (const [i, s] of o.samples.entries()) {
+        const sample = s;
+        // `input` must be a plain object of template variables — null and arrays
+        // pass a bare `typeof === "object"` check but break render/replay downstream.
+        if (!isPlainObject(sample) || typeof sample.output !== "string" || !isPlainObject(sample.input)) {
+            throw new Error(`capture fixture sample ${i} must be { input: object, output: string }`);
+        }
+    }
+    return raw;
+}

package/dist/verify/cli-run.d.ts

@@ -0,0 +1,23 @@
+/**
+ * `modelrig verify-swap` runner — reads a local capture fixture, replays it
+ * through the drafted same-model route, and writes BOTH report forms: the
+ * machine-readable JSON (the skill parses it) and the human-readable Markdown
+ * (the Tier-2 PR embeds it). Lives here (not cli.ts) for the LOC cap (P1),
+ * beside the report renderer it drives — same split as bakeoff/report.ts.
+ *
+ * Exit code is the gate the skill reads: 0 = equivalent / equivalent-modulo,
+ * 1 = DIVERGENT (do not merge), 2 = REFUSED (not a Tier-2 replacement — a
+ * correct outcome that needs a human's T0/T1 rethink, not a merge).
+ */
+import type { RigConfig } from "../config";
+export interface VerifySwapCliOptions {
+    readonly route: string;
+    readonly fixturePath: string;
+    readonly envelopeUsd?: number;
+    /** Print the machine-readable JSON to stdout instead of the Markdown. */
+    readonly asJson?: boolean;
+    /** Also write the Markdown report to this path (the PR body source). */
+    readonly outPath?: string;
+}
+export declare function runVerifySwapCli(config: RigConfig, opts: VerifySwapCliOptions): Promise<number>;
+//# sourceMappingURL=cli-run.d.ts.map

package/dist/verify/cli-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-run.d.ts","sourceRoot":"","sources":["../../src/verify/cli-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAM3C,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,wEAAwE;IACxE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAQD,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,MAAM,CAAC,CA+BjB"}

package/dist/verify/cli-run.js

@@ -0,0 +1,57 @@
+"use strict";
+/**
+ * `modelrig verify-swap` runner — reads a local capture fixture, replays it
+ * through the drafted same-model route, and writes BOTH report forms: the
+ * machine-readable JSON (the skill parses it) and the human-readable Markdown
+ * (the Tier-2 PR embeds it). Lives here (not cli.ts) for the LOC cap (P1),
+ * beside the report renderer it drives — same split as bakeoff/report.ts.
+ *
+ * Exit code is the gate the skill reads: 0 = equivalent / equivalent-modulo,
+ * 1 = DIVERGENT (do not merge), 2 = REFUSED (not a Tier-2 replacement — a
+ * correct outcome that needs a human's T0/T1 rethink, not a merge).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runVerifySwapCli = runVerifySwapCli;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const index_1 = require("../index");
+const capture_1 = require("./capture");
+const report_1 = require("./report");
+function exitFor(report) {
+    if (report.overall === "divergent")
+        return 1;
+    if (report.overall === "refused")
+        return 2;
+    return 0;
+}
+async function runVerifySwapCli(config, opts) {
+    const fixture = (0, capture_1.parseFixture)((0, node_fs_1.readFileSync)(opts.fixturePath, "utf8"));
+    const rig = (0, index_1.createRig)(config);
+    try {
+        const report = await rig.verifySwap(opts.route, fixture, {
+            ...(opts.envelopeUsd !== undefined ? { envelopeUsd: opts.envelopeUsd } : {}),
+        });
+        // Persist both forms next to the telemetry db (captures never travel; the
+        // report is aggregate + local).
+        const outDir = (0, node_path_1.join)((0, node_path_1.dirname)(config.telemetryDbPath), "verify");
+        (0, node_fs_1.mkdirSync)(outDir, { recursive: true });
+        const stem = (0, node_path_1.join)(outDir, `${report.route}@${report.routeVersion}`);
+        (0, node_fs_1.writeFileSync)(`${stem}.json`, `${JSON.stringify(report, null, 2)}\n`);
+        const markdown = (0, report_1.renderReportMarkdown)(report);
+        (0, node_fs_1.writeFileSync)(`${stem}.md`, markdown);
+        if (opts.outPath !== undefined) {
+            (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(opts.outPath), { recursive: true });
+            (0, node_fs_1.writeFileSync)(opts.outPath, markdown);
+        }
+        if (opts.asJson)
+            console.log(JSON.stringify(report, null, 2));
+        else
+            console.log(markdown);
+        console.log(`report → ${stem}.json · ${stem}.md` + (opts.outPath !== undefined ? ` · ${opts.outPath}` : ""));
+        return exitFor(report);
+    }
+    finally {
+        // One-shot CLI: await the settled drain so the exporter's final batch lands.
+        await rig.close();
+    }
+}

package/dist/verify/diff.d.ts

@@ -0,0 +1,48 @@
+/**
+ * The diff engine — the honest verdict vocabulary that makes the verifier's
+ * report trustworthy. Pure (no adapters, no run loop): it compares an
+ * original output against a routed one and returns one of three verdicts.
+ *
+ * Design decision (flagged for architect review): the routed output arrives
+ * as PARSED JSON — `run()` only returns after the output validated against the
+ * route schema (or it throws), so a routed sample is guaranteed schema-
+ * conformant and JSON. We therefore compare STRUCTURE, not raw bytes. For JSON,
+ * key order and whitespace are not behavior, so "byte-identical where
+ * deterministic" is operationalized as CANONICAL identity (sorted-key
+ * serialization). Structured-field equality — with declared nondeterministic
+ * fields excluded — is the fallback, exactly as the spec's §6 evaluation
+ * contract prescribes.
+ */
+import type { SampleDiff } from "./types";
+/** Deterministic JSON serialization: object keys sorted recursively, arrays
+ * left in order (order is semantic). The operative notion of "byte-identical"
+ * for JSON outputs. */
+export declare function canonicalJson(value: unknown): string;
+export interface Divergence {
+    /** JSON-pointer path to the first differing node. */
+    readonly path: string;
+    readonly originalValue: unknown;
+    readonly routedValue: unknown;
+}
+/**
+ * First point at which `original` and `routed` structurally differ, in a
+ * stable depth-first order, or null when they are deep-equal after masking the
+ * declared nondeterministic paths. Object keys are visited in sorted order so
+ * the "first" differing field is deterministic across runs.
+ */
+export declare function firstDivergence(original: unknown, routed: unknown, nondeterministicPaths: readonly string[], path?: string): Divergence | null;
+/**
+ * Diff an original output (raw text) against a routed output (already parsed by
+ * `run()`), returning the verdict. `routedParsed` is guaranteed schema-
+ * conformant JSON by the run loop; `originalText` is whatever the original call
+ * site emitted.
+ *
+ *  - byte / canonical identity ⇒ `equivalent`
+ *  - structurally equal after masking declared nd-paths ⇒
+ *    `equivalent-modulo-nondeterminism`
+ *  - a real structured field differs ⇒ `divergent` (first field named)
+ *  - the original is not JSON ⇒ `divergent` (a free-text call site — this
+ *    isn't route-shaped work; T0/T1 territory, honestly flagged not forced)
+ */
+export declare function diffOutputs(originalText: string, routedParsed: unknown, routedText: string, nondeterministicPaths: readonly string[]): SampleDiff;
+//# sourceMappingURL=diff.d.ts.map

package/dist/verify/diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.d.ts","sourceRoot":"","sources":["../../src/verify/diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C;;uBAEuB;AACvB,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD;AAcD,MAAM,WAAW,UAAU;IACzB,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAQD;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,OAAO,EACjB,MAAM,EAAE,OAAO,EACf,qBAAqB,EAAE,SAAS,MAAM,EAAE,EACxC,IAAI,SAAK,GACR,UAAU,GAAG,IAAI,CAuCnB;AAwBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CACzB,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,OAAO,EACrB,UAAU,EAAE,MAAM,EAClB,qBAAqB,EAAE,SAAS,MAAM,EAAE,GACvC,UAAU,CAyCZ"}

package/dist/verify/diff.js

@@ -0,0 +1,157 @@
+"use strict";
+/**
+ * The diff engine — the honest verdict vocabulary that makes the verifier's
+ * report trustworthy. Pure (no adapters, no run loop): it compares an
+ * original output against a routed one and returns one of three verdicts.
+ *
+ * Design decision (flagged for architect review): the routed output arrives
+ * as PARSED JSON — `run()` only returns after the output validated against the
+ * route schema (or it throws), so a routed sample is guaranteed schema-
+ * conformant and JSON. We therefore compare STRUCTURE, not raw bytes. For JSON,
+ * key order and whitespace are not behavior, so "byte-identical where
+ * deterministic" is operationalized as CANONICAL identity (sorted-key
+ * serialization). Structured-field equality — with declared nondeterministic
+ * fields excluded — is the fallback, exactly as the spec's §6 evaluation
+ * contract prescribes.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalJson = canonicalJson;
+exports.firstDivergence = firstDivergence;
+exports.diffOutputs = diffOutputs;
+/** Deterministic JSON serialization: object keys sorted recursively, arrays
+ * left in order (order is semantic). The operative notion of "byte-identical"
+ * for JSON outputs. */
+function canonicalJson(value) {
+    return JSON.stringify(sortKeys(value));
+}
+function sortKeys(value) {
+    if (Array.isArray(value))
+        return value.map(sortKeys);
+    if (value !== null && typeof value === "object") {
+        const out = {};
+        for (const key of Object.keys(value).sort()) {
+            out[key] = sortKeys(value[key]);
+        }
+        return out;
+    }
+    return value;
+}
+/** True when `path` is exactly, or nested under, any declared nondeterministic
+ * path. `/meta` masks `/meta` and `/meta/gen`; it never masks `/metadata`. */
+function isMasked(path, nondeterministicPaths) {
+    return nondeterministicPaths.some((nd) => path === nd || path.startsWith(`${nd}/`));
+}
+/**
+ * First point at which `original` and `routed` structurally differ, in a
+ * stable depth-first order, or null when they are deep-equal after masking the
+ * declared nondeterministic paths. Object keys are visited in sorted order so
+ * the "first" differing field is deterministic across runs.
+ */
+function firstDivergence(original, routed, nondeterministicPaths, path = "") {
+    const here = path === "" ? "" : path;
+    if (isMasked(here || "/", nondeterministicPaths))
+        return null;
+    if (Array.isArray(original) || Array.isArray(routed)) {
+        if (!Array.isArray(original) || !Array.isArray(routed) || original.length !== routed.length) {
+            return { path: here || "/", originalValue: original, routedValue: routed };
+        }
+        for (let i = 0; i < original.length; i += 1) {
+            const d = firstDivergence(original[i], routed[i], nondeterministicPaths, `${here}/${i}`);
+            if (d !== null)
+                return d;
+        }
+        return null;
+    }
+    if (isObject(original) || isObject(routed)) {
+        if (!isObject(original) || !isObject(routed)) {
+            return { path: here || "/", originalValue: original, routedValue: routed };
+        }
+        const keys = [...new Set([...Object.keys(original), ...Object.keys(routed)])].sort();
+        for (const key of keys) {
+            const childPath = `${here}/${escapePointer(key)}`;
+            if (isMasked(childPath, nondeterministicPaths))
+                continue;
+            const inO = Object.prototype.hasOwnProperty.call(original, key);
+            const inR = Object.prototype.hasOwnProperty.call(routed, key);
+            if (!inO || !inR) {
+                return { path: childPath, originalValue: original[key], routedValue: routed[key] };
+            }
+            const d = firstDivergence(original[key], routed[key], nondeterministicPaths, childPath);
+            if (d !== null)
+                return d;
+        }
+        return null;
+    }
+    // Scalars (incl. null): a strict, type-aware compare.
+    if (original !== routed) {
+        return { path: here || "/", originalValue: original, routedValue: routed };
+    }
+    return null;
+}
+function isObject(v) {
+    return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+/** RFC-6901 escaping for a path segment (`~`→`~0`, `/`→`~1`). */
+function escapePointer(key) {
+    return key.replace(/~/g, "~0").replace(/\//g, "~1");
+}
+function shortValue(v) {
+    const s = typeof v === "string" ? v : JSON.stringify(v);
+    return s !== undefined && s.length > 60 ? `${s.slice(0, 57)}…` : String(s);
+}
+function tryParse(text) {
+    try {
+        return { ok: true, value: JSON.parse(text) };
+    }
+    catch {
+        return { ok: false };
+    }
+}
+/**
+ * Diff an original output (raw text) against a routed output (already parsed by
+ * `run()`), returning the verdict. `routedParsed` is guaranteed schema-
+ * conformant JSON by the run loop; `originalText` is whatever the original call
+ * site emitted.
+ *
+ *  - byte / canonical identity ⇒ `equivalent`
+ *  - structurally equal after masking declared nd-paths ⇒
+ *    `equivalent-modulo-nondeterminism`
+ *  - a real structured field differs ⇒ `divergent` (first field named)
+ *  - the original is not JSON ⇒ `divergent` (a free-text call site — this
+ *    isn't route-shaped work; T0/T1 territory, honestly flagged not forced)
+ */
+function diffOutputs(originalText, routedParsed, routedText, nondeterministicPaths) {
+    // True byte-identity first — the strongest, cheapest signal.
+    if (originalText === routedText) {
+        return { verdict: "equivalent", firstDivergentPath: null, detail: "byte-identical output" };
+    }
+    const parsedOriginal = tryParse(originalText);
+    if (!parsedOriginal.ok) {
+        return {
+            verdict: "divergent",
+            firstDivergentPath: null,
+            detail: "original output is not JSON — this is a free-text call site; equivalence is not " +
+                "provable through a task route (T0/T1 territory, not a Tier-2 replacement)",
+        };
+    }
+    // Canonical identity: for JSON, key order and whitespace are not behavior.
+    if (canonicalJson(parsedOriginal.value) === canonicalJson(routedParsed)) {
+        return { verdict: "equivalent", firstDivergentPath: null, detail: "canonically identical JSON" };
+    }
+    const d = firstDivergence(parsedOriginal.value, routedParsed, nondeterministicPaths);
+    if (d === null) {
+        return {
+            verdict: "equivalent-modulo-nondeterminism",
+            firstDivergentPath: null,
+            detail: nondeterministicPaths.length > 0
+                ? `structurally equal after excluding nondeterministic field(s): ${nondeterministicPaths.join(", ")}`
+                : "structurally equal (serialization differs only)",
+        };
+    }
+    return {
+        verdict: "divergent",
+        firstDivergentPath: d.path,
+        detail: `structured field ${d.path} differs: original=${shortValue(d.originalValue)} ` +
+            `routed=${shortValue(d.routedValue)}`,
+    };
+}

package/dist/verify/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Shadow-equivalence verifier (Expansion §9, autonomy-ladder Tier 2) — the
+ * public barrel. Proves a same-model call replacement is behavior-preserving
+ * before a human merges the Tier-2 PR: capture (local) → replay through the
+ * routed replacement (reusing the run loop) → diff (honest verdict vocabulary)
+ * → report (machine + human). Refusing an uncapturable call site is a correct
+ * output, never a failure.
+ */
+export { verifySwap } from "./verify";
+export type { VerifySwapRequest } from "./verify";
+export { diffOutputs, firstDivergence, canonicalJson } from "./diff";
+export type { Divergence } from "./diff";
+export { captureOriginal, openShadowCaptureStore, parseFixture, serializeFixture, } from "./capture";
+export type { OriginalCallSite, OriginalCallFn, CaptureOptions, ShadowCaptureStore, ShadowCaptureRecord, } from "./capture";
+export { renderReportMarkdown } from "./report";
+export type { ShadowCapture, ShadowCaptureFixture, CaptureRefusal, SampleVerdict, EquivalenceVerdict, SampleDiff, SampleReport, EquivalenceReport, } from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/verify/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/verify/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,YAAY,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACrE,YAAY,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACzC,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,YAAY,EACZ,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAChD,YAAY,EACV,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,iBAAiB,GAClB,MAAM,SAAS,CAAC"}

package/dist/verify/index.js

@@ -0,0 +1,24 @@
+"use strict";
+/**
+ * Shadow-equivalence verifier (Expansion §9, autonomy-ladder Tier 2) — the
+ * public barrel. Proves a same-model call replacement is behavior-preserving
+ * before a human merges the Tier-2 PR: capture (local) → replay through the
+ * routed replacement (reusing the run loop) → diff (honest verdict vocabulary)
+ * → report (machine + human). Refusing an uncapturable call site is a correct
+ * output, never a failure.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderReportMarkdown = exports.serializeFixture = exports.parseFixture = exports.openShadowCaptureStore = exports.captureOriginal = exports.canonicalJson = exports.firstDivergence = exports.diffOutputs = exports.verifySwap = void 0;
+var verify_1 = require("./verify");
+Object.defineProperty(exports, "verifySwap", { enumerable: true, get: function () { return verify_1.verifySwap; } });
+var diff_1 = require("./diff");
+Object.defineProperty(exports, "diffOutputs", { enumerable: true, get: function () { return diff_1.diffOutputs; } });
+Object.defineProperty(exports, "firstDivergence", { enumerable: true, get: function () { return diff_1.firstDivergence; } });
+Object.defineProperty(exports, "canonicalJson", { enumerable: true, get: function () { return diff_1.canonicalJson; } });
+var capture_1 = require("./capture");
+Object.defineProperty(exports, "captureOriginal", { enumerable: true, get: function () { return capture_1.captureOriginal; } });
+Object.defineProperty(exports, "openShadowCaptureStore", { enumerable: true, get: function () { return capture_1.openShadowCaptureStore; } });
+Object.defineProperty(exports, "parseFixture", { enumerable: true, get: function () { return capture_1.parseFixture; } });
+Object.defineProperty(exports, "serializeFixture", { enumerable: true, get: function () { return capture_1.serializeFixture; } });
+var report_1 = require("./report");
+Object.defineProperty(exports, "renderReportMarkdown", { enumerable: true, get: function () { return report_1.renderReportMarkdown; } });

package/dist/verify/report.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Report rendering — the shadow-equivalence report the skill's Tier-2 PR
+ * embeds. Two forms, one source: the machine-readable form is the
+ * `EquivalenceReport` object serialized as JSON (stable, `schemaVersion: 1`);
+ * the human-readable form is the Markdown below, written for a PR reviewer who
+ * must decide whether the same-model replacement is safe to merge.
+ *
+ * The rendering never editorializes the verdict — it prints exactly what the
+ * diff decided, always alongside the plumbing-not-model-choice guarantee so a
+ * reader cannot mistake equivalence for a model-quality claim.
+ */
+import type { EquivalenceReport } from "./types";
+export declare function renderReportMarkdown(report: EquivalenceReport): string;
+//# sourceMappingURL=report.d.ts.map

package/dist/verify/report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../src/verify/report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAoC,MAAM,SAAS,CAAC;AAwCnF,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CA+CtE"}

package/dist/verify/report.js

@@ -0,0 +1,88 @@
+"use strict";
+/**
+ * Report rendering — the shadow-equivalence report the skill's Tier-2 PR
+ * embeds. Two forms, one source: the machine-readable form is the
+ * `EquivalenceReport` object serialized as JSON (stable, `schemaVersion: 1`);
+ * the human-readable form is the Markdown below, written for a PR reviewer who
+ * must decide whether the same-model replacement is safe to merge.
+ *
+ * The rendering never editorializes the verdict — it prints exactly what the
+ * diff decided, always alongside the plumbing-not-model-choice guarantee so a
+ * reader cannot mistake equivalence for a model-quality claim.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderReportMarkdown = renderReportMarkdown;
+const VERDICT_LABEL = {
+    equivalent: "EQUIVALENT",
+    "equivalent-modulo-nondeterminism": "EQUIVALENT (modulo nondeterminism)",
+    divergent: "DIVERGENT",
+    refused: "REFUSED",
+};
+/** The one-line headline a reviewer reads first. */
+function headline(report) {
+    const label = VERDICT_LABEL[report.overall];
+    switch (report.overall) {
+        case "equivalent":
+            return `✅ **${label}** — all ${report.n} replayed input(s) reproduced the original output.`;
+        case "equivalent-modulo-nondeterminism":
+            return `🟡 **${label}** — all ${report.n} input(s) matched once declared nondeterministic fields were excluded.`;
+        case "divergent":
+            return `❌ **${label}** — ${report.counts.divergent} of ${report.n} input(s) did not reproduce; do not merge.`;
+        case "refused":
+            return `⛔ **${label}** — not a Tier-2 replacement. ${report.refusalReason ?? ""}`.trim();
+    }
+}
+/** Escape `|` so a field value never breaks the markdown table (the report is
+ * embedded in a PR body — a stray pipe from an odd JSON key must not corrupt it). */
+function cell(text) {
+    return text.replace(/\|/g, "\\|");
+}
+function sampleRow(s) {
+    const detail = s.failureClass !== null
+        ? `replay failed (${s.failureClass})`
+        : s.firstDivergentPath !== null
+            ? `first differs at \`${cell(s.firstDivergentPath)}\``
+            : cell(s.detail);
+    return `| ${s.index} | ${s.verdict} | ${cell(s.servedModel ?? "—")} | $${s.costUsd.toFixed(4)} | ${detail} |`;
+}
+function renderReportMarkdown(report) {
+    const lines = [];
+    lines.push("## Shadow-equivalence verification");
+    lines.push("");
+    lines.push(headline(report));
+    lines.push("");
+    lines.push(`- **Call site:** \`${report.callSiteId}\``);
+    lines.push(`- **Route:** \`${report.route}@${report.routeVersion}\``);
+    lines.push(`- **Pinned model:** \`${report.pinnedModel}\` (original == replacement)`);
+    lines.push(`- **Ran at:** ${report.ranAt}`);
+    lines.push(`- **Tally:** ${report.counts.equivalent} equivalent · ` +
+        `${report.counts.equivalentModulo} modulo-nondeterminism · ${report.counts.divergent} divergent`);
+    lines.push("");
+    lines.push(`> ${report.guarantee}`);
+    lines.push("");
+    if (report.samples.length > 0) {
+        lines.push("| # | verdict | served model | cost | detail |");
+        lines.push("|---|---------|--------------|------|--------|");
+        for (const s of report.samples)
+            lines.push(sampleRow(s));
+        lines.push("");
+    }
+    if (report.refusals.length > 0) {
+        lines.push("### Refusals (honest, not failures)");
+        lines.push("");
+        for (const r of report.refusals)
+            lines.push(`- **${r.reason}** — ${r.detail}`);
+        lines.push("");
+        lines.push("Refused call sites are T0/T1 territory (gateway-pointing or instrumentation), " +
+            "not same-model call replacement — this is a correct outcome, not a gap.");
+        lines.push("");
+    }
+    lines.push(report.overall === "divergent"
+        ? "**Rollback is git-native:** revert this PR to restore the original call byte-for-byte."
+        : report.overall === "refused"
+            ? "No change is proposed for this call site."
+            : "Safe to merge on this evidence: the routed replacement preserves behavior. " +
+                "Rollback stays git-native (revert this PR) — same-model means it is also a route-YAML flip.");
+    lines.push("");
+    return lines.join("\n");
+}