modelrig 0.4.0 → 0.6.0

package/dist/artifacts/run-context.js

@@ -20,11 +20,60 @@
  * v1 wire, zero new rows, zero behaviour change (spec §1.4).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.resetRunMetaWarningsForTest = resetRunMetaWarningsForTest;
 exports.getActiveRunContext = getActiveRunContext;
+exports.isValidStepKey = isValidStepKey;
+exports.resolveStepKey = resolveStepKey;
+exports.resetStepKeyWarningsForTest = resetStepKeyWarningsForTest;
 exports.createRunNamespace = createRunNamespace;
 const node_async_hooks_1 = require("node:async_hooks");
 const node_crypto_1 = require("node:crypto");
 const otel_map_1 = require("../telemetry/otel-map");
+const attempt_meta_1 = require("../telemetry/attempt-meta");
+const attempt_meta_2 = require("../telemetry/attempt-meta");
+/** Once-per-process latch for the run-envelope sanitize warning (Ruling A,
+ * PR #262). Mirrors {@link warnedStepKeys}: a dropped field is named ONCE, so a
+ * mislabelled `actor` teaches without spamming the run loop. */
+const warnedRunMetaFields = new Set();
+/**
+ * Build a run's `RunMeta@v1` (spec §3): the caller's envelope with
+ * `pipeline_sha` auto-filled from git when unset, then SANITIZED at the same
+ * boundary the wire is (Ruling A, PR #262) — every string field must be an
+ * enum/identifier/hash (≤128 chars, no whitespace), so a free-text `actor`
+ * ("Jane Doe") is DROPPED, counted, and named in one once-per-process warning,
+ * never smuggled into `runs.meta`. Returns null only when the caller supplied no
+ * meta AND no sha resolves — a plain `run.start()` in a git tree still stamps the
+ * sha. NEVER throws (resolvePipelineSha + sanitizeMetaForWire are both safe); the
+ * recorded run row is byte-identical to the un-sanitized path for a clean envelope.
+ */
+function buildRunMeta(meta) {
+    const sha = meta?.pipeline_sha ?? (0, attempt_meta_2.resolvePipelineSha)();
+    if (meta === undefined && sha === undefined)
+        return null;
+    const merged = {
+        v: 1,
+        ...(meta ?? {}),
+        ...(sha !== undefined ? { pipeline_sha: sha } : {}),
+    };
+    const { meta: cleaned, dropped } = (0, attempt_meta_1.sanitizeMetaForWire)(merged);
+    if (dropped > 0) {
+        // RunMeta is flat, so a dropped string is a named top-level field (e.g.
+        // `actor`). Name each once — instrumentation teaches, never throws.
+        for (const key of Object.keys(merged)) {
+            if (typeof merged[key] === "string" && (cleaned === undefined || !(key in cleaned)) && !warnedRunMetaFields.has(key)) {
+                warnedRunMetaFields.add(key);
+                const tip = key === "actor" ? " `actor` must be an opaque identifier, not a display name." : "";
+                console.warn(`[modelrig run] RunMeta.${key} is not metadata-safe (an enum/identifier/hash: ≤128 chars, no ` +
+                    `whitespace) — dropped from runs.meta.${tip}`);
+            }
+        }
+    }
+    return (cleaned ?? { v: 1 });
+}
+/** Test-only: clear the once-per-process RunMeta-sanitize warning latch. */
+function resetRunMetaWarningsForTest() {
+    warnedRunMetaFields.clear();
+}
 const storage = new node_async_hooks_1.AsyncLocalStorage();
 /** The active run context, or null when none is set (namespace disabled, or no
  * run.start on this async path). Read by the run loop's auto-step seam. */
@@ -32,6 +81,38 @@ function getActiveRunContext() {
     const ctx = storage.getStore();
     return ctx !== undefined && !ctx.ended ? ctx : null;
 }
+/** Valid ground-truth step key (G1 spec §3): a caller-supplied `stepKey` (either
+ * lane) or a `tags.step` used as one. Auto-minted keys (`label#seq`) may contain
+ * a `/` from a route slug or `provider/model` label and are NOT validated — the
+ * regex gates only what a customer types. */
+const STEP_KEY_PATTERN = /^[A-Za-z0-9_.:#-]{1,128}$/;
+/** True when `key` is a valid caller-supplied step key (spec §3). */
+function isValidStepKey(key) {
+    return STEP_KEY_PATTERN.test(key);
+}
+const warnedStepKeys = new Set();
+/** Resolve a ground-truth step key for either lane (spec §3): an explicit
+ * caller-supplied key wins, then the `tags.step` convention, else a freshly
+ * minted auto key. A caller key is validated `[A-Za-z0-9_.:#-]{1,128}`; an
+ * invalid one is warned (once per bad value) and DROPPED to the auto key —
+ * instrumentation never throws a telemetry-label error into customer code. */
+function resolveStepKey(explicit, tagStep, auto) {
+    const candidate = explicit ?? tagStep;
+    if (candidate === undefined)
+        return auto();
+    if (isValidStepKey(candidate))
+        return candidate;
+    if (!warnedStepKeys.has(candidate)) {
+        warnedStepKeys.add(candidate);
+        console.warn(`[modelrig artifacts] invalid stepKey "${candidate}" (allowed [A-Za-z0-9_.:#-], 1-128 chars) — ` +
+            "grouped under an auto-generated key instead.");
+    }
+    return auto();
+}
+/** Test-only: clear the once-per-process invalid-stepKey warning latch. */
+function resetStepKeyWarningsForTest() {
+    warnedStepKeys.clear();
+}
 function warnOnce(scope, err) {
     console.warn(`[modelrig artifacts] ${scope} buffer write failed (dropped, run unaffected): ` +
         `${err instanceof Error ? err.message : String(err)}`);
@@ -67,6 +148,9 @@ function createRunNamespace(deps) {
         const attemptByStep = new Map();
         const loaded = new Set();
         let stepSeq = 0;
+        // The ambient step key (G1): the last step minted or emitted in this run,
+        // which an artifact.save without an explicit stepKey attaches to.
+        let lastStepKey = null;
         return {
             runId,
             traceId,
@@ -84,9 +168,16 @@ function createRunNamespace(deps) {
             },
             nextStepKey(label) {
                 stepSeq += 1;
-                return `${label}#${stepSeq}`;
+                lastStepKey = `${label}#${stepSeq}`;
+                return lastStepKey;
+            },
+            currentStepKey() {
+                return lastStepKey;
             },
             emitGroundTruthStep(input) {
+                // A caller-supplied key on the raw lane never minted through nextStepKey;
+                // record it as the ambient step so artifacts saved around this call join it.
+                lastStepKey = input.stepKey;
                 const attemptNo = (attemptByStep.get(input.stepKey) ?? 0) + 1;
                 attemptByStep.set(input.stepKey, attemptNo);
                 try {
@@ -122,6 +213,9 @@ function createRunNamespace(deps) {
             startedAt: new Date().toISOString(),
             endedAt: null,
             status: "running",
+            // WI-1 (spec §3): the run envelope, git-sha auto-filled. endContext spreads
+            // ...ctx.startRow, so the terminal projection re-exports the same meta.
+            meta: buildRunMeta(opts.meta),
         };
         const traceId = opts.traceparent !== undefined
             ? ((0, otel_map_1.parseTraceparent)(opts.traceparent)?.traceId ?? null)

package/dist/artifacts/scrub.d.ts

@@ -20,7 +20,17 @@
  * `detect` result as a guarantee of no PII.
  *
  * NEVER logs a matched value. Findings are `{type, count}` only.
+ *
+ * ── SHARED DETECTOR INTERFACE (screening review A1, 2026-08-22) ─────────────
+ * The same patterns are ALSO exposed as span-producing `Detector`s
+ * (`detectSpans`, `scrubDetectors`) so the mask (CS-1) and screen (SC-1) lanes
+ * reuse this ONE corpus instead of twinning it (spec docs/ModelRig/screening §3;
+ * S1: extend, don't twin). `scrubContent`'s behaviour is unchanged — the span
+ * exports are additive and share the same DETECTORS table, so a matched value
+ * never leaves the process there either (a span is offsets + type + confidence,
+ * never a value).
  */
+import type { DetectionSpan, Detector } from "../detect/detector";
 export type ScrubMode = "off" | "detect" | "redact" | "block";
 /** A finding is a COUNT by type — never a value (the load-bearing invariant). */
 export interface ScrubFinding {
@@ -57,4 +67,20 @@ export declare function luhnValid(digits: string): boolean;
  * Never returns or logs a matched value.
  */
 export declare function scrubContent(text: string, mode: ScrubMode): ScrubResult;
+/**
+ * Detect scrub v1 spans across ALL patterns, sorted by start offset. Deterministic
+ * (confidence 1). Offsets index into the exact `text` passed. Overlap resolution
+ * (e.g. PAN vs phone) is the CONSUMER's job (CS-1 §4 "earlier stages win") — this
+ * reports every pattern's raw hits, never a value.
+ */
+export declare function detectSpans(text: string): DetectionSpan[];
+/**
+ * The scrub v1 patterns presented as the shared `Detector` contract
+ * (`src/detect/detector.ts`) — one detector per type, `kind: "deterministic"`,
+ * `confidence: 1`. The mask (CS-1) and screen (SC-1) lanes consume these so all
+ * three policies (`mask` / `scrub` / `screen`) run over ONE detection engine.
+ * The `source`/`tier` on the input are ignored by the deterministic PII patterns
+ * (they scan any tier); a tier-aware detector would branch on them.
+ */
+export declare function scrubDetectors(): Detector[];
 //# sourceMappingURL=scrub.d.ts.map

package/dist/artifacts/scrub.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scrub.d.ts","sourceRoot":"","sources":["../../src/artifacts/scrub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE9D,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,GAAG,OAAO,GAAG,KAAK,CAAC;AAE1E,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAC;IAC3C;iEAC6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;0EAG0E;AAC1E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAC;CAC5C;AAED;;kFAEkF;AAClF,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,GAAG,YAAY,CAEjF;AAWD,8EAA8E;AAC9E,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAejD;AA0CD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,WAAW,CA6CvE"}
+{"version":3,"file":"scrub.d.ts","sourceRoot":"","sources":["../../src/artifacts/scrub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAkB,aAAa,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAElF,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE9D,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,GAAG,OAAO,GAAG,KAAK,CAAC;AAE1E,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAC;IAC3C;iEAC6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;0EAG0E;AAC1E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAC;CAC5C;AAED;;kFAEkF;AAClF,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,GAAG,YAAY,CAEjF;AAaD,8EAA8E;AAC9E,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAejD;AA0CD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,WAAW,CA6CvE;AAqBD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,EAAE,CAIzD;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,IAAI,QAAQ,EAAE,CAS3C"}

package/dist/artifacts/scrub.js

@@ -21,11 +21,22 @@
  * `detect` result as a guarantee of no PII.
  *
  * NEVER logs a matched value. Findings are `{type, count}` only.
+ *
+ * ── SHARED DETECTOR INTERFACE (screening review A1, 2026-08-22) ─────────────
+ * The same patterns are ALSO exposed as span-producing `Detector`s
+ * (`detectSpans`, `scrubDetectors`) so the mask (CS-1) and screen (SC-1) lanes
+ * reuse this ONE corpus instead of twinning it (spec docs/ModelRig/screening §3;
+ * S1: extend, don't twin). `scrubContent`'s behaviour is unchanged — the span
+ * exports are additive and share the same DETECTORS table, so a matched value
+ * never leaves the process there either (a span is offsets + type + confidence,
+ * never a value).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.summarizeScrub = summarizeScrub;
 exports.luhnValid = luhnValid;
 exports.scrubContent = scrubContent;
+exports.detectSpans = detectSpans;
+exports.scrubDetectors = scrubDetectors;
 /** Build the persisted summary from a scrub result. The only producer of the
  * `artifacts.scrub` value, so the counts-not-values invariant lives in one
  * place — it simply forwards `ScrubResult.findings`, which are already counts. */
@@ -137,3 +148,45 @@ function scrubContent(text, mode) {
     // detect (or block with no findings): upload verbatim, report counts.
     return { findings, text, blocked: false };
 }
+// ── Shared Detector interface (screening review A1) ─────────────────────────
+// Span-producing views over the SAME `DETECTORS` table. Additive: `scrubContent`
+// above is untouched, and these never surface a matched value (a span is offsets
+// + type + confidence, per the load-bearing invariant).
+/** Spans for one pattern in `text` — offsets + type + confidence 1. A fresh
+ * RegExp per call keeps the /g `lastIndex` from leaking across calls. */
+function spansForPattern(det, text) {
+    const re = new RegExp(det.re.source, det.re.flags);
+    const spans = [];
+    for (const m of text.matchAll(re)) {
+        const value = m[0];
+        if (det.accept && !det.accept(value))
+            continue;
+        const start = m.index ?? 0;
+        spans.push({ start, end: start + value.length, type: det.type, confidence: 1 });
+    }
+    return spans;
+}
+/**
+ * Detect scrub v1 spans across ALL patterns, sorted by start offset. Deterministic
+ * (confidence 1). Offsets index into the exact `text` passed. Overlap resolution
+ * (e.g. PAN vs phone) is the CONSUMER's job (CS-1 §4 "earlier stages win") — this
+ * reports every pattern's raw hits, never a value.
+ */
+function detectSpans(text) {
+    return DETECTORS.flatMap((det) => spansForPattern(det, text)).sort((a, b) => a.start - b.start || a.end - b.end);
+}
+/**
+ * The scrub v1 patterns presented as the shared `Detector` contract
+ * (`src/detect/detector.ts`) — one detector per type, `kind: "deterministic"`,
+ * `confidence: 1`. The mask (CS-1) and screen (SC-1) lanes consume these so all
+ * three policies (`mask` / `scrub` / `screen`) run over ONE detection engine.
+ * The `source`/`tier` on the input are ignored by the deterministic PII patterns
+ * (they scan any tier); a tier-aware detector would branch on them.
+ */
+function scrubDetectors() {
+    return DETECTORS.map((det) => ({
+        id: `scrub:${det.type}@v1`,
+        kind: "deterministic",
+        detect: (input) => Promise.resolve(spansForPattern(det, input.text)),
+    }));
+}

package/dist/artifacts/step.d.ts

@@ -14,6 +14,15 @@
  * active run context (chunk B attributes artifact save/load lineage to it) and
  * runs the body; it does not persist a row until it has a valid reference.
  *
+ * ── AMBIENT STEP KEY (G1) ─────────────────────────────────────────────────
+ * Entering a `@step` / `step()` scope MINTS a unique key (`label#n`) and sets it
+ * as the run context's AMBIENT step. An `artifact.save` with no explicit
+ * `stepKey` attaches to that ambient key — not only for saves INSIDE the scope,
+ * but for every save AFTER it too, until the next step mints a new ambient key
+ * (the ambient key is a running "most recent step", not a lexical bracket). So a
+ * post-step save lands on the step just run; to detach it, open the next step or
+ * pass an explicit `stepKey`.
+ *
  * Instrumentation never changes the wrapped function's return value, and never
  * throws into it — a disabled or absent run context just runs the body.
  */

package/dist/artifacts/step.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"step.d.ts","sourceRoot":"","sources":["../../src/artifacts/step.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH;;;;GAIG;AACH,wBAAgB,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAOnD"}
+{"version":3,"file":"step.d.ts","sourceRoot":"","sources":["../../src/artifacts/step.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH;;;;GAIG;AACH,wBAAgB,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAOnD"}

package/dist/artifacts/step.js

@@ -15,6 +15,15 @@
  * active run context (chunk B attributes artifact save/load lineage to it) and
  * runs the body; it does not persist a row until it has a valid reference.
  *
+ * ── AMBIENT STEP KEY (G1) ─────────────────────────────────────────────────
+ * Entering a `@step` / `step()` scope MINTS a unique key (`label#n`) and sets it
+ * as the run context's AMBIENT step. An `artifact.save` with no explicit
+ * `stepKey` attaches to that ambient key — not only for saves INSIDE the scope,
+ * but for every save AFTER it too, until the next step mints a new ambient key
+ * (the ambient key is a running "most recent step", not a lexical bracket). So a
+ * post-step save lands on the step just run; to detach it, open the next step or
+ * pass an explicit `stepKey`.
+ *
  * Instrumentation never changes the wrapped function's return value, and never
  * throws into it — a disabled or absent run context just runs the body.
  */

package/dist/bakeoff/engine.d.ts

@@ -12,8 +12,14 @@
  */
 import type { CaptureStore } from "../telemetry/capture";
 import type { RunDeps } from "../run/run";
+import type { CandidateSpec, ObjectiveMode, RouteBundle } from "../types/route";
+import type { QualityGate } from "../types/quality";
 import type { ArmSamples, KeepOutputsMode } from "./samples";
-import type { BakeoffArtifact, VariantMetrics } from "./types";
+import type { BakeoffArtifact, BakeoffObjective, VariantMetrics } from "./types";
+/** The arm name carrying the reference (ceiling) metrics. Reserved — a user
+ * variant may not be named this (they cannot start a name with "__"; and it is
+ * never in `req.variants`). */
+export declare const REFERENCE_ARM = "__reference__";
 /** Sink for retained review samples (addendum A3). The engine assembles the
  * arms to persist (incumbent + winner, or all); the caller — createRig with
  * the service-role config — does the truncation + PostgREST insert. Keeps
@@ -34,11 +40,40 @@ export interface BakeoffRequest {
      * winning challenger; "all" = every arm. Undefined = keep nothing (the
      * default pure-metrics path). Requires a samplesSink to persist. */
     readonly keepOutputs?: KeepOutputsMode;
+    /** RB-1: objective-mode override (CLI `--objective`). Absent ⇒ the route's
+     * `objective.mode`, else quality-first (spec §3 default). */
+    readonly objectiveMode?: ObjectiveMode;
+    /** RB-1: resolver for `reference: auto` → a concrete declared candidate. The
+     * rig injects a registry-backed resolver (bakeoff/reference.ts); absent ⇒ an
+     * `auto` reference cannot be resolved and no reference arm runs. */
+    readonly resolveReferenceAuto?: (route: RouteBundle) => CandidateSpec | null;
+    /** RB-1: eval-case expected values keyed by captureId (from-eval-cases path);
+     * feeds quality tier 1. */
+    readonly expected?: ReadonlyMap<string, {
+        readonly value: unknown;
+    }>;
+    /** Q1 quality gate (spec §4.2): scored on every replayed sample to populate
+     * valueAccuracy + the quality pass rate, unlocking computeProposal's cost-first
+     * third clause. A function, so it rides `rig.bakeoff` (programmatic) only — the
+     * `modelrig bakeoff` CLI cannot carry one until Q2's declared judge. When a
+     * route also declares a `bakeoff.judge`, the SDK gate wins the value tier (both
+     * are caller-quality signals; F5 deterministic checks still run first). */
+    readonly qualityGate?: QualityGate;
 }
 export declare function runBakeoff(deps: RunDeps, captures: CaptureStore, req: BakeoffRequest, samplesSink?: BakeoffSamplesSink): Promise<BakeoffArtifact>;
-/** Winner among gate-passing challengers; null when nobody beats the
- * incumbent. Exported for direct unit testing. */
-export declare function computeProposal(requested: readonly string[], metrics: readonly VariantMetrics[]): BakeoffArtifact["proposal"];
+/** Objective context for the gate (RB-1). Absent ⇒ the legacy cost-first path
+ * (byte-identical to pre-RB-1, so the existing goldens hold). */
+export interface ProposalContext {
+    readonly objective?: BakeoffObjective;
+    /** The reference arm's name — excluded from the challenger set. */
+    readonly referenceVariant?: string;
+}
+/**
+ * Winner among gate-passing challengers; null when nobody beats the incumbent.
+ * Exported for direct unit testing. `ctx` absent OR `ctx.objective` absent ⇒ the
+ * legacy cost-first gate (goldens). Otherwise per the objective's mode.
+ */
+export declare function computeProposal(requested: readonly string[], metrics: readonly VariantMetrics[], ctx?: ProposalContext): BakeoffArtifact["proposal"];
 export interface BakeoffMirrorConfig {
     readonly supabaseUrl: string;
     readonly serviceRoleKey: string;
@@ -49,4 +84,11 @@ export interface BakeoffMirrorConfig {
  * Same PostgREST transport pattern as the telemetry exporter; captures have
  * no cloud surface — ONLY aggregate metrics travel. */
 export declare function mirrorBakeoff(artifact: BakeoffArtifact, config: BakeoffMirrorConfig): Promise<void>;
+/**
+ * The proposal-evidence jsonb for a bake-off artifact (near-optimal spec §4.6) —
+ * the winning variant, the RB-1 objective/reference/regret/quality_metric, and a
+ * per-arm matrix (with per-arm regret). Built here so the CLI stays thin; the PR
+ * body reads these fields back off `proposal.evidence`. ZERO DDL — freeform jsonb.
+ */
+export declare function bakeoffEvidence(artifact: BakeoffArtifact, spentUsd: number): Record<string, unknown>;
 //# sourceMappingURL=engine.d.ts.map

package/dist/bakeoff/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/bakeoff/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAO1C,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE/D;;;gFAGgF;AAChF,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,CAAC;CACtC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAgBpB,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC;;wEAEoE;IACpE,QAAQ,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC;CACxC;AAED,wBAAsB,UAAU,CAC9B,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,YAAY,EACtB,GAAG,EAAE,cAAc,EACnB,WAAW,CAAC,EAAE,kBAAkB,GAC/B,OAAO,CAAC,eAAe,CAAC,CA2E1B;AAED;kDACkD;AAClD,wBAAgB,eAAe,CAC7B,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,OAAO,EAAE,SAAS,cAAc,EAAE,GACjC,eAAe,CAAC,UAAU,CAAC,CA4B7B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACjC;AAED;;uDAEuD;AACvD,wBAAsB,aAAa,CACjC,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,IAAI,CAAC,CA6Bf"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/bakeoff/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAG1C,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAgB,MAAM,gBAAgB,CAAC;AAM9F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAmC,cAAc,EAAE,MAAM,SAAS,CAAC;AAElH;;+BAE+B;AAC/B,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAE7C;;;gFAGgF;AAChF,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,CAAC;CACtC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAgBpB,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC;;wEAEoE;IACpE,QAAQ,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC;IACvC;iEAC6D;IAC7D,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC;;wEAEoE;IACpE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,aAAa,GAAG,IAAI,CAAC;IAC7E;+BAC2B;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACrE;;;;;+EAK2E;IAC3E,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;CACpC;AAsBD,wBAAsB,UAAU,CAC9B,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,YAAY,EACtB,GAAG,EAAE,cAAc,EACnB,WAAW,CAAC,EAAE,kBAAkB,GAC/B,OAAO,CAAC,eAAe,CAAC,CAiJ1B;AAsCD;iEACiE;AACjE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC;IACtC,mEAAmE;IACnE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAoBD;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,OAAO,EAAE,SAAS,cAAc,EAAE,EAClC,GAAG,CAAC,EAAE,eAAe,GACpB,eAAe,CAAC,UAAU,CAAC,CA4G7B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACjC;AAED;;uDAEuD;AACvD,wBAAsB,aAAa,CACjC,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,IAAI,CAAC,CA6Bf;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA2BpG"}