modelrig 0.6.0 → 0.8.0

package/dist/bakeoff/types.d.ts

@@ -5,6 +5,9 @@
  * value accuracy, paired regret vs a reference arm, and an objective-aware gate.
  */
 import type { ObjectiveMode } from "../types/route";
+import type { PairwiseStats } from "./pairwise";
+import type { DisagreementReport } from "./disagreement";
+import type { MaskArmProof } from "../mask/proof";
 /** Which quality metric an arm's numbers are on (spec §2): value accuracy when a
  * golden / value check / judge scored it, else schema conformance. */
 export type QualityMetric = "value_accuracy" | "conformance";
@@ -57,6 +60,11 @@ export interface VariantMetrics {
     readonly regret?: RegretStats | null;
     /** RB-1: the reference arm hit its envelope — regret is on the paired subset. */
     readonly referencePartial?: boolean;
+    /** N5: this arm's pairwise standing vs the reference (win rate + seeded CI).
+     * Null on the reference arm and when no pairwise signal was decidable. A
+     * REPORTED signal beside regret; gates a proposal only when the route sets
+     * `objective.pairwiseAware`. */
+    readonly pairwise?: PairwiseStats | null;
 }
 /** RB-1: the resolved objective recorded on the artifact (evidence + report). */
 export interface BakeoffObjective {
@@ -67,6 +75,9 @@ export interface BakeoffObjective {
         readonly usdPerRun?: number;
     } | null;
     readonly lambda: number | null;
+    /** N5: the pairwise-aware gate knob (default false). Recorded on the artifact so
+     * the report/PR body/evidence say whether pairwise gated the proposal. */
+    readonly pairwiseAware?: boolean;
 }
 /** RB-1: the resolved reference arm recorded on the artifact. */
 export interface BakeoffReference {
@@ -104,5 +115,18 @@ export interface BakeoffArtifact {
     readonly reference?: BakeoffReference | null;
     /** RB-1: the metric the bake-off's quality numbers are on. */
     readonly qualityMetric?: QualityMetric;
+    /** N6: verdict-disagreement candidates mined from this bake-off's replay set —
+     * a ranked list of already-captured pointers an operator MAY promote to eval
+     * cases (never auto-promoted). Rides the LOCAL artifact only (captureIds are not
+     * mirrored). Absent on a pre-N5/N6 artifact or when no reference/arm signal
+     * disagreed. */
+    readonly disagreement?: DisagreementReport;
+    /** CS-1 Proven Masking (spec §7) — the masked-arm proof for a `--mask-policy`
+     * run: the Detector finds no span in the masked arm (`proven: true`), with the
+     * unmasked arm's detections as the Δ the mask removed. Counts by type only,
+     * never a value. Additive & optional (RB-1 fence — rides the matrix jsonb
+     * wholesale, does NOT restructure the replay engine); absent on an ordinary
+     * bake-off. The Chunk-B masked-vs-unmasked Δ-value-accuracy arm extends this. */
+    readonly maskArm?: MaskArmProof;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/bakeoff/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/bakeoff/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpD;sEACsE;AACtE,MAAM,MAAM,aAAa,GAAG,gBAAgB,GAAG,aAAa,CAAC;AAE7D;;8CAE8C;AAC9C,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,qEAAqE;IACrE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,wFAAwF;IACxF,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,+EAA+E;IAC/E,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAC;IAC7C;;sFAEkF;IAClF,QAAQ,CAAC,eAAe,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAC3D;;sEAEkE;IAClE,QAAQ,CAAC,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjD;6EACyE;IACzE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;iFAC6E;IAC7E,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,iEAAiE;IACjE,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,qDAAqD;IACrD,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B;;6DAEyD;IACzD,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;qCACiC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACrC,iFAAiF;IACjF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CACrC;AAED,iFAAiF;AACjF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC1F,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,iEAAiE;AACjE,MAAM,WAAW,gBAAgB;IAC/B,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,wBAAwB;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;IAC7C;;8EAE0E;IAC1E,QAAQ,CAAC,QAAQ,EACb;QACE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;QACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;KACtC,GACD,IAAI,CAAC;IACT,sEAAsE;IACtE,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC;IACtC,gFAAgF;IAChF,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;CACxC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/bakeoff/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD;sEACsE;AACtE,MAAM,MAAM,aAAa,GAAG,gBAAgB,GAAG,aAAa,CAAC;AAE7D;;8CAE8C;AAC9C,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,qEAAqE;IACrE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,wFAAwF;IACxF,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,+EAA+E;IAC/E,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAC;IAC7C;;sFAEkF;IAClF,QAAQ,CAAC,eAAe,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAC3D;;sEAEkE;IAClE,QAAQ,CAAC,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjD;6EACyE;IACzE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;iFAC6E;IAC7E,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,iEAAiE;IACjE,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,qDAAqD;IACrD,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B;;6DAEyD;IACzD,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;qCACiC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACrC,iFAAiF;IACjF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC;;;oCAGgC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;CAC1C;AAED,iFAAiF;AACjF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC1F,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;8EAC0E;IAC1E,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,iEAAiE;AACjE,MAAM,WAAW,gBAAgB;IAC/B,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,wBAAwB;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;IAC7C;;8EAE0E;IAC1E,QAAQ,CAAC,QAAQ,EACb;QACE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;QACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;KACtC,GACD,IAAI,CAAC;IACT,sEAAsE;IACtE,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC;IACtC,gFAAgF;IAChF,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC;;;;oBAIgB;IAChB,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAC3C;;;;;qFAKiF;IACjF,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;CACjC"}

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;GAgBG;AAgDH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACpC;AAeD,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,KAAK,CAuBxD;AAqhBD,wBAAsB,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAuCnE"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;GAgBG;AAiDH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACpC;AAeD,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,KAAK,CAuBxD;AAohBD,wBAAsB,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAuCnE"}

package/dist/cli.js

@@ -30,7 +30,7 @@ const failures_1 = require("./types/failures");
 const failures_teaching_1 = require("./types/failures-teaching");
 const config_1 = require("./config");
 const index_1 = require("./index");
-const status_1 = require("./status");
+const status_cli_1 = require("./status-cli");
 const engine_1 = require("./bakeoff/engine");
 const samples_1 = require("./bakeoff/samples");
 const report_1 = require("./bakeoff/report");
@@ -48,6 +48,7 @@ function objectiveOf(flags) {
 const cli_run_1 = require("./verify/cli-run");
 const loader_1 = require("./routes/loader");
 const rawonly_1 = require("./run/rawonly");
+const mask_policy_cli_1 = require("./mask/mask-policy-cli");
 const validate_cli_1 = require("./validate-cli");
 const store_1 = require("./telemetry/store");
 const budget_1 = require("./watch/budget");
@@ -236,6 +237,11 @@ async function cmdBakeoff(flags) {
             throw new Error("--budget-usd must be positive");
         return (0, report_1.runEvalCaseBakeoffCli)(config, evalTask, vs, env, keepOutputsMode(flags), flags.bare.has("json"), objectiveOf(flags));
     }
+    // CS-1 (spec §7): --mask-policy proves no detected span leaves the masked arm
+    // (additive early-return; does not touch the RB-1 replay engine). Handler in mask/.
+    const maskPolicyRoute = flags.named.get("mask-policy");
+    if (maskPolicyRoute !== undefined)
+        return (0, mask_policy_cli_1.runMaskPolicyProofCli)(config, flags, maskPolicyRoute);
     const route = flags.named.get("route");
     const variantsRaw = flags.named.get("variants");
     const lastRaw = flags.named.get("replay-last");
@@ -486,13 +492,6 @@ async function cmdServe() {
     // The server owns the process from here (it holds the listener open).
     return 0;
 }
-/** `modelrig status` — print the runtime posture (§2): export mode, artifact
- * namespace on/off + WHY, content custody, OTLP. Reads config only (no rig, no
- * routes dir), so it works anywhere the env is set. */
-function cmdStatus() {
-    console.log((0, status_1.formatStatusReport)((0, status_1.buildRigStatus)((0, config_1.loadConfigFromEnv)())));
-    return 0;
-}
 /** `modelrig judge <run>` — E5 V.4: explicitly ask the bounded model-judge to
  * score a run. Goes through the API boundary (T12: the CLI never holds a DB
  * client) — POST /v1/runs/:id/judge on the configured server, authed with a
@@ -544,6 +543,7 @@ const USAGE = [
     "  modelrig serve                       (needs the modelrig-server package)",
     "  modelrig bakeoff --route <route> --variants a,b,c --replay-last N [--budget-usd usd] [--objective quality-first|balanced|cost-first] [--keep-outputs[=all]] [--json] [--no-mirror]",
     "  modelrig bakeoff --from-proposal <id> [--replay-last N] [--keep-outputs[=all]] [--json]",
+    "  modelrig bakeoff --mask-policy <route> [--replay-last N]   (CS-1: prove the masked arm leaks no detected span)",
     "  modelrig watch run [--events fixtures.json] [--json]",
     "  modelrig verify-swap --route <route> --captures <fixture.json> [--budget-usd usd] [--out report.md] [--json]",
     "  modelrig swap execute <proposalId> --approve [--approved-by name]",
@@ -564,7 +564,7 @@ async function main(argv) {
     const flags = parseArgs(rest);
     switch (command) {
         case "status":
-            return cmdStatus();
+            return (0, status_cli_1.runStatusCli)();
         case "validate":
             return (0, validate_cli_1.runValidateCli)();
         case "bakeoff":

package/dist/mask/apply.d.ts

@@ -0,0 +1,80 @@
+/**
+ * CS-1 — apply/rehydrate (WIRED 2026-08-24, CS-1 Chunk A). Spec §5, §9.
+ *
+ * Seams (plan step 4): the run loop's dispatch seam masks the outgoing
+ * `AdapterRequest.userPrompt` with {@link maskText} and rehydrates the
+ * `AdapterResult` with {@link rehydrateText} / {@link rehydrateValue}
+ * (structured rehydration runs AFTER src/run/validate.ts so schema validation
+ * sees exactly what the model produced). Field rules mask the routed input
+ * object pre-render with {@link maskInput}. All functions are PURE over
+ * (text/value, resolved policy, vault) — the vault is the only mutable state and
+ * it never leaves the process.
+ *
+ * COUNTS-NEVER-VALUES: the returned `findings` are counts by type; the masked
+ * text carries tokens, not values; and no function returns or logs a matched
+ * value (the load-bearing invariant, inherited from scrub v1 and asserted by the
+ * receipt-invariant property test).
+ */
+import type { ResolvedMaskPolicy } from "./types";
+import { type RunVault } from "./vault";
+export interface MaskedText {
+    readonly text: string;
+    readonly findings: ReadonlyMap<string, number>;
+    readonly tokensIssued: number;
+}
+/**
+ * Mask free text (raw lane + rendered prompts): detect dictionary + deterministic
+ * spans (narrowed to the policy types), then substitute tokens RIGHT-TO-LEFT so
+ * earlier offsets stay valid as later ones are replaced. Idempotent via the
+ * vault — a value already tokenized in this run reuses its token.
+ */
+export declare function maskText(text: string, policy: ResolvedMaskPolicy, vault: RunVault): MaskedText;
+/**
+ * Mask the routed lane's `input` object by the policy's FIELD RULES only (spec
+ * §4 order: field rules run before dictionary/deterministic, which mask the
+ * rendered text via {@link maskText}). Each targeted string leaf becomes ONE
+ * token of the rule's type — the mechanism that catches free-text names the
+ * deterministic detectors and dictionary cannot. Returns a NEW object; never
+ * mutates. Non-string leaves are ignored (a once-per-process warning is emitted
+ * by the routed-lane seam, not here — this stays pure).
+ */
+export declare function maskInput<T>(input: T, policy: ResolvedMaskPolicy, vault: RunVault): {
+    input: T;
+    findings: ReadonlyMap<string, number>;
+    tokensIssued: number;
+};
+export interface Rehydrated {
+    readonly rehydrated: number;
+    readonly unresolved: number;
+}
+/** Rehydrate plain text: replace every `<TYPE_n>` token with its original;
+ * unknown tokens (model-invented, never issued) are left verbatim and counted
+ * as `unresolved`. */
+export declare function rehydrateText(text: string, vault: RunVault): {
+    text: string;
+    rehydrated: number;
+    unresolved: number;
+};
+/** Rehydrate every string leaf of a structured value (post-validate). Returns a
+ * NEW value; never mutates. Counts occurrences across all leaves. */
+export declare function rehydrateValue<T>(value: T, vault: RunVault): {
+    value: T;
+    rehydrated: number;
+    unresolved: number;
+};
+/**
+ * Streaming hold-back buffer (spec §5): emits text as it arrives but never emits
+ * a partial `<…` prefix that could still become a token, until it is proven not
+ * to be one (bounded by {@link MAX_TOKEN_LENGTH}). `final-only` mode bypasses
+ * delta rehydration (the caller rehydrates the assembled final text instead).
+ */
+export interface StreamRehydrator {
+    push(delta: string): string;
+    flush(): string;
+    counts(): {
+        rehydrated: number;
+        unresolved: number;
+    };
+}
+export declare function createStreamRehydrator(vault: RunVault): StreamRehydrator;
+//# sourceMappingURL=apply.d.ts.map

package/dist/mask/apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../src/mask/apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,KAAK,EAAkB,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAwC,KAAK,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE9E,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAOD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,QAAQ,GAAG,UAAU,CAmB9F;AAsBD;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,CAAC,EACzB,KAAK,EAAE,CAAC,EACR,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,QAAQ,GACd;IAAE,KAAK,EAAE,CAAC,CAAC;IAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAiB3E;AAaD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;sBAEsB;AACtB,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAarH;AAED;qEACqE;AACrE,wBAAgB,cAAc,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,GAAG;IAAE,KAAK,EAAE,CAAC,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAmBjH;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,KAAK,IAAI,MAAM,CAAC;IAChB,MAAM,IAAI;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,QAAQ,GAAG,gBAAgB,CAqExE"}

package/dist/mask/apply.js

@@ -0,0 +1,228 @@
+"use strict";
+/**
+ * CS-1 — apply/rehydrate (WIRED 2026-08-24, CS-1 Chunk A). Spec §5, §9.
+ *
+ * Seams (plan step 4): the run loop's dispatch seam masks the outgoing
+ * `AdapterRequest.userPrompt` with {@link maskText} and rehydrates the
+ * `AdapterResult` with {@link rehydrateText} / {@link rehydrateValue}
+ * (structured rehydration runs AFTER src/run/validate.ts so schema validation
+ * sees exactly what the model produced). Field rules mask the routed input
+ * object pre-render with {@link maskInput}. All functions are PURE over
+ * (text/value, resolved policy, vault) — the vault is the only mutable state and
+ * it never leaves the process.
+ *
+ * COUNTS-NEVER-VALUES: the returned `findings` are counts by type; the masked
+ * text carries tokens, not values; and no function returns or logs a matched
+ * value (the load-bearing invariant, inherited from scrub v1 and asserted by the
+ * receipt-invariant property test).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.maskText = maskText;
+exports.maskInput = maskInput;
+exports.rehydrateText = rehydrateText;
+exports.rehydrateValue = rehydrateValue;
+exports.createStreamRehydrator = createStreamRehydrator;
+const detect_1 = require("./detect");
+const vault_1 = require("./vault");
+/** Bump a type's running count in a findings map (local, mutable accumulator). */
+function bump(findings, type) {
+    findings.set(type, (findings.get(type) ?? 0) + 1);
+}
+/**
+ * Mask free text (raw lane + rendered prompts): detect dictionary + deterministic
+ * spans (narrowed to the policy types), then substitute tokens RIGHT-TO-LEFT so
+ * earlier offsets stay valid as later ones are replaced. Idempotent via the
+ * vault — a value already tokenized in this run reuses its token.
+ */
+function maskText(text, policy, vault) {
+    const spans = (0, detect_1.detectSpans)(text, policy);
+    const findings = new Map();
+    const before = vault.size();
+    if (spans.length === 0) {
+        return { text, findings, tokensIssued: 0 };
+    }
+    // Issue tokens LEFT→RIGHT so numbering follows first-seen (reading) order
+    // (spec §5), then substitute RIGHT→LEFT so earlier offsets stay valid.
+    const tokens = spans.map((span) => {
+        const token = vault.issue(span.type, text.slice(span.start, span.end));
+        bump(findings, span.type);
+        return token;
+    });
+    let out = text;
+    for (let i = spans.length - 1; i >= 0; i--) {
+        out = out.slice(0, spans[i].start) + tokens[i] + out.slice(spans[i].end);
+    }
+    return { text: out, findings, tokensIssued: vault.size() - before };
+}
+/** Deep-clone a JSON-shaped value so masking never mutates the caller's input. */
+function clone(value) {
+    return JSON.parse(JSON.stringify(value));
+}
+/** Set the string at a JSON-pointer path (as reference tokens) to `token`. */
+function setAtPointer(root, path, token) {
+    const tokens = path.replace(/^\//, "").split("/").map((t) => t.replace(/~1/g, "/").replace(/~0/g, "~"));
+    let node = root;
+    for (let i = 0; i < tokens.length - 1; i++) {
+        if (node === null || typeof node !== "object")
+            return;
+        node = Array.isArray(node) ? node[Number(tokens[i])] : node[tokens[i]];
+    }
+    const last = tokens[tokens.length - 1];
+    if (node !== null && typeof node === "object") {
+        if (Array.isArray(node))
+            node[Number(last)] = token;
+        else
+            node[last] = token;
+    }
+}
+/**
+ * Mask the routed lane's `input` object by the policy's FIELD RULES only (spec
+ * §4 order: field rules run before dictionary/deterministic, which mask the
+ * rendered text via {@link maskText}). Each targeted string leaf becomes ONE
+ * token of the rule's type — the mechanism that catches free-text names the
+ * deterministic detectors and dictionary cannot. Returns a NEW object; never
+ * mutates. Non-string leaves are ignored (a once-per-process warning is emitted
+ * by the routed-lane seam, not here — this stays pure).
+ */
+function maskInput(input, policy, vault) {
+    const targets = (0, detect_1.resolveFieldTargets)(input, policy);
+    const findings = new Map();
+    if (targets.length === 0) {
+        return { input, findings, tokensIssued: 0 };
+    }
+    const before = vault.size();
+    const copy = clone(input);
+    for (const target of targets) {
+        // Re-read the concrete leaf from the clone so the token is stable per value.
+        const value = readAtPointer(copy, target.path);
+        if (typeof value !== "string" || value === "")
+            continue;
+        const token = vault.issue(target.type, value);
+        setAtPointer(copy, target.path, token);
+        bump(findings, target.type);
+    }
+    return { input: copy, findings, tokensIssued: vault.size() - before };
+}
+/** Read the value at a JSON-pointer path (reference-token form). */
+function readAtPointer(root, path) {
+    const tokens = path.replace(/^\//, "").split("/").map((t) => t.replace(/~1/g, "/").replace(/~0/g, "~"));
+    let node = root;
+    for (const t of tokens) {
+        if (node === null || typeof node !== "object")
+            return undefined;
+        node = Array.isArray(node) ? node[Number(t)] : node[t];
+    }
+    return node;
+}
+/** Rehydrate plain text: replace every `<TYPE_n>` token with its original;
+ * unknown tokens (model-invented, never issued) are left verbatim and counted
+ * as `unresolved`. */
+function rehydrateText(text, vault) {
+    let rehydrated = 0;
+    let unresolved = 0;
+    const out = text.replace(new RegExp(vault_1.MASK_TOKEN_PATTERN.source, "g"), (token) => {
+        const original = vault.resolve(token);
+        if (original === null) {
+            unresolved += 1;
+            return token;
+        }
+        rehydrated += 1;
+        return original;
+    });
+    return { text: out, rehydrated, unresolved };
+}
+/** Rehydrate every string leaf of a structured value (post-validate). Returns a
+ * NEW value; never mutates. Counts occurrences across all leaves. */
+function rehydrateValue(value, vault) {
+    let rehydrated = 0;
+    let unresolved = 0;
+    const walk = (node) => {
+        if (typeof node === "string") {
+            const r = rehydrateText(node, vault);
+            rehydrated += r.rehydrated;
+            unresolved += r.unresolved;
+            return r.text;
+        }
+        if (Array.isArray(node))
+            return node.map(walk);
+        if (node !== null && typeof node === "object") {
+            const out = {};
+            for (const [k, v] of Object.entries(node))
+                out[k] = walk(v);
+            return out;
+        }
+        return node;
+    };
+    return { value: walk(value), rehydrated, unresolved };
+}
+function createStreamRehydrator(vault) {
+    let held = "";
+    let rehydrated = 0;
+    let unresolved = 0;
+    /** Rehydrate the complete-token portion of `held`, returning [emit, remainder]
+     * where remainder is a trailing partial `<…` that may still complete. */
+    const drain = (buf, forceFlush) => {
+        let emit = "";
+        let i = 0;
+        while (i < buf.length) {
+            const lt = buf.indexOf("<", i);
+            if (lt === -1) {
+                emit += buf.slice(i);
+                i = buf.length;
+                break;
+            }
+            emit += buf.slice(i, lt);
+            const close = buf.indexOf(">", lt);
+            if (close === -1) {
+                // No closing '>' yet. If the partial already exceeds a token's max
+                // length it cannot be a token — release it. Else hold it back.
+                const partial = buf.slice(lt);
+                if (forceFlush || partial.length > vault_1.MAX_TOKEN_LENGTH) {
+                    emit += partial;
+                    i = buf.length;
+                }
+                else {
+                    return { emit, keep: partial };
+                }
+                break;
+            }
+            const candidate = buf.slice(lt, close + 1);
+            const isToken = new RegExp(`^${vault_1.MASK_TOKEN_PATTERN.source}$`).test(candidate);
+            if (isToken) {
+                const original = vault.resolve(candidate);
+                if (original === null) {
+                    unresolved += 1;
+                    emit += candidate;
+                }
+                else {
+                    rehydrated += 1;
+                    emit += original;
+                }
+                i = close + 1;
+            }
+            else {
+                // A '<' that is not the start of a token — emit it and keep scanning
+                // from just after it (the next '<' may still open one).
+                emit += "<";
+                i = lt + 1;
+            }
+        }
+        return { emit, keep: "" };
+    };
+    return {
+        push(delta) {
+            held += delta;
+            const { emit, keep } = drain(held, false);
+            held = keep;
+            return emit;
+        },
+        flush() {
+            const { emit } = drain(held, true);
+            held = "";
+            return emit;
+        },
+        counts() {
+            return { rehydrated, unresolved };
+        },
+    };
+}

package/dist/mask/detect.d.ts

@@ -0,0 +1,38 @@
+/**
+ * CS-1 — detection (WIRED 2026-08-24, CS-1 Chunk A). Spec §4.
+ *
+ * Order: field rules (structured, exact — resolved by {@link resolveFieldTargets}
+ * against the routed input) → dictionary (longest-match-first, word-boundary,
+ * case-insensitive default) → deterministic detectors REUSED from
+ * src/artifacts/scrub.ts (`detectSpans` there — S1: extend, don't twin;
+ * `scrubContent` behaviour is untouched). Earlier stages win on overlap.
+ * Secret-shaped values are NOT a detector here (src/tenancy/scrub.ts already runs
+ * at emission boundaries; spec §4.4).
+ *
+ * SHARED INTERFACE (screening review A1): `MaskSpan` extends `DetectionSpan`
+ * (src/detect/detector.ts). The deterministic pass consumes scrub v1's shared
+ * span corpus; the dictionary pass produces spans of the SAME shape (offsets +
+ * type + confidence 1). No matched value is ever returned or logged — a span is
+ * offsets only.
+ */
+import type { MaskSpan, ResolvedMaskPolicy } from "./types";
+/**
+ * Detect spans in free text (raw lane + rendered prompts): dictionary pass +
+ * deterministic pass (scrub v1, narrowed to `policy.types`), resolved to a
+ * non-overlapping set with earlier stages winning. Pure and deterministic.
+ */
+export declare function detectSpans(text: string, policy: ResolvedMaskPolicy): readonly MaskSpan[];
+/** One resolved field target: the JSON pointer that reached a string leaf and
+ * the entity type the rule assigns it. Never carries the value. */
+export interface FieldTarget {
+    readonly path: string;
+    readonly type: string;
+}
+/**
+ * Resolve the policy's field rules against the routed lane's `input` object,
+ * returning the (concrete-path, type) pair for every STRING leaf a rule reaches.
+ * A `*` segment expands over array indices and object keys. Non-string leaves
+ * are silently skipped (the routed-lane masking path warns once per process).
+ */
+export declare function resolveFieldTargets(input: unknown, policy: ResolvedMaskPolicy): readonly FieldTarget[];
+//# sourceMappingURL=detect.d.ts.map

package/dist/mask/detect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect.d.ts","sourceRoot":"","sources":["../../src/mask/detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,KAAK,EAAuB,QAAQ,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAwDjF;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,SAAS,QAAQ,EAAE,CAyBzF;AAED;mEACmE;AACnE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAwDD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,kBAAkB,GACzB,SAAS,WAAW,EAAE,CAQxB"}

package/dist/mask/detect.js

@@ -0,0 +1,167 @@
+"use strict";
+/**
+ * CS-1 — detection (WIRED 2026-08-24, CS-1 Chunk A). Spec §4.
+ *
+ * Order: field rules (structured, exact — resolved by {@link resolveFieldTargets}
+ * against the routed input) → dictionary (longest-match-first, word-boundary,
+ * case-insensitive default) → deterministic detectors REUSED from
+ * src/artifacts/scrub.ts (`detectSpans` there — S1: extend, don't twin;
+ * `scrubContent` behaviour is untouched). Earlier stages win on overlap.
+ * Secret-shaped values are NOT a detector here (src/tenancy/scrub.ts already runs
+ * at emission boundaries; spec §4.4).
+ *
+ * SHARED INTERFACE (screening review A1): `MaskSpan` extends `DetectionSpan`
+ * (src/detect/detector.ts). The deterministic pass consumes scrub v1's shared
+ * span corpus; the dictionary pass produces spans of the SAME shape (offsets +
+ * type + confidence 1). No matched value is ever returned or logged — a span is
+ * offsets only.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectSpans = detectSpans;
+exports.resolveFieldTargets = resolveFieldTargets;
+const scrub_1 = require("../artifacts/scrub");
+/** Detection stage priority — a lower number wins on overlap (spec §4: field →
+ * dictionary → deterministic). Field spans are resolved structurally (they index
+ * a value the field rule owns), so within free text only dictionary+deterministic
+ * compete; the priority is kept explicit so a future field-in-text pass slots in. */
+const PRIORITY_DICTIONARY = 1;
+const PRIORITY_DETERMINISTIC = 2;
+/** Escape a literal string for use inside a RegExp (dictionary terms are
+ * literals, never patterns). */
+function escapeRegExp(literal) {
+    return literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/** Spans for one dictionary entry across `text`. Word-boundary matched;
+ * case-insensitive unless the entry opts into `caseSensitive`. Confidence 1
+ * (deterministic). Never returns the matched substring. */
+function dictionaryEntrySpans(entry, text) {
+    const flags = entry.caseSensitive === true ? "g" : "gi";
+    // \b word boundaries keep "Acme" from matching inside "Acmex"; the term is
+    // escaped so punctuation in a term (e.g. "A.C.M.E.") is treated literally.
+    const re = new RegExp(`\\b${escapeRegExp(entry.term)}\\b`, flags);
+    const spans = [];
+    for (const m of text.matchAll(re)) {
+        const start = m.index ?? 0;
+        spans.push({ start, end: start + m[0].length, type: entry.type, confidence: 1 });
+    }
+    return spans;
+}
+/** Resolve a set of candidate spans (already tagged with a stage priority) to a
+ * non-overlapping set where an earlier stage always wins, and within a stage a
+ * longer (then earlier) match wins. Deterministic given the input order. */
+function resolveNonOverlapping(candidates) {
+    // Sort so the winner of any overlap is visited first: by priority asc, then
+    // longer span, then earlier start. A greedy sweep then drops anything that
+    // overlaps an already-accepted interval.
+    const ordered = [...candidates].sort((a, b) => {
+        if (a.priority !== b.priority)
+            return a.priority - b.priority;
+        const lenA = a.span.end - a.span.start;
+        const lenB = b.span.end - b.span.start;
+        if (lenA !== lenB)
+            return lenB - lenA;
+        return a.span.start - b.span.start;
+    });
+    const accepted = [];
+    for (const { span } of ordered) {
+        const overlaps = accepted.some((k) => span.start < k.end && k.start < span.end);
+        if (!overlaps)
+            accepted.push(span);
+    }
+    // Return in reading order (by start) so masking/rehydration walk left→right.
+    return accepted.sort((a, b) => a.start - b.start || a.end - b.end);
+}
+/**
+ * Detect spans in free text (raw lane + rendered prompts): dictionary pass +
+ * deterministic pass (scrub v1, narrowed to `policy.types`), resolved to a
+ * non-overlapping set with earlier stages winning. Pure and deterministic.
+ */
+function detectSpans(text, policy) {
+    const candidates = [];
+    // Dictionary pass — longest term first is handled by resolveNonOverlapping's
+    // length tiebreak, so entries need no pre-sort.
+    for (const entry of policy.entries) {
+        for (const span of dictionaryEntrySpans(entry, text)) {
+            candidates.push({ span, priority: PRIORITY_DICTIONARY });
+        }
+    }
+    // Deterministic pass — scrub v1's shared corpus, narrowed to the policy's
+    // declared types (a route that masks only emails does not tokenize phones).
+    if (policy.policy.types.length > 0) {
+        const allow = new Set(policy.policy.types);
+        for (const span of (0, scrub_1.detectSpans)(text)) {
+            if (!allow.has(span.type))
+                continue;
+            candidates.push({
+                span: { start: span.start, end: span.end, type: span.type, confidence: span.confidence },
+                priority: PRIORITY_DETERMINISTIC,
+            });
+        }
+    }
+    return resolveNonOverlapping(candidates);
+}
+/** Split a JSON pointer into its reference tokens, decoding `~1`→`/` and
+ * `~0`→`~` (RFC 6901). A leading empty token (from the initial `/`) is dropped. */
+function pointerTokens(path) {
+    if (path === "" || path === "/")
+        return [];
+    return path
+        .replace(/^\//, "")
+        .split("/")
+        .map((t) => t.replace(/~1/g, "/").replace(/~0/g, "~"));
+}
+/** Walk one field rule against `input`, expanding a single `*` wildcard segment
+ * over array indices / object keys. Collects the concrete pointer of every
+ * STRING leaf reached (non-string leaves are ignored — the caller warns once).
+ * Recursive over the remaining tokens so multiple wildcards compose. */
+function walkFieldRule(node, tokens, type, prefix, out) {
+    if (tokens.length === 0) {
+        if (typeof node === "string")
+            out.push({ path: prefix, type });
+        return;
+    }
+    const [head, ...rest] = tokens;
+    if (node === null || typeof node !== "object")
+        return;
+    if (head === "*") {
+        if (Array.isArray(node)) {
+            node.forEach((child, i) => walkFieldRule(child, rest, type, `${prefix}/${i}`, out));
+        }
+        else {
+            for (const [k, child] of Object.entries(node)) {
+                walkFieldRule(child, rest, type, `${prefix}/${escapePointerToken(k)}`, out);
+            }
+        }
+        return;
+    }
+    if (Array.isArray(node)) {
+        const idx = Number(head);
+        if (Number.isInteger(idx) && idx >= 0 && idx < node.length) {
+            walkFieldRule(node[idx], rest, type, `${prefix}/${head}`, out);
+        }
+        return;
+    }
+    if (Object.prototype.hasOwnProperty.call(node, head)) {
+        walkFieldRule(node[head], rest, type, `${prefix}/${escapePointerToken(head)}`, out);
+    }
+}
+/** Encode a raw object key back into a JSON-pointer reference token. */
+function escapePointerToken(token) {
+    return token.replace(/~/g, "~0").replace(/\//g, "~1");
+}
+/**
+ * Resolve the policy's field rules against the routed lane's `input` object,
+ * returning the (concrete-path, type) pair for every STRING leaf a rule reaches.
+ * A `*` segment expands over array indices and object keys. Non-string leaves
+ * are silently skipped (the routed-lane masking path warns once per process).
+ */
+function resolveFieldTargets(input, policy) {
+    const fields = policy.policy.fields;
+    if (fields === undefined || fields.length === 0)
+        return [];
+    const out = [];
+    for (const rule of fields) {
+        walkFieldRule(input, pointerTokens(rule.path), rule.type, "", out);
+    }
+    return out;
+}