modelrig 0.7.0 → 0.8.1

package/dist/mask/seam.js

@@ -0,0 +1,120 @@
+"use strict";
+/**
+ * CS-1 — the dispatch seam (WIRED 2026-08-24, CS-1 Chunk A). Spec §1.2, §9.
+ *
+ * "A per-route mask policy rewrites the `AdapterRequest` before dispatch and
+ * rehydrates the `AdapterResult` after, inside the customer's process. Adapters
+ * are untouched." (spec §1.2). This module IS that seam: {@link createMaskSeam}
+ * returns a small stateful object the run loop drives —
+ *   1. `maskRequest(req)` masks the outgoing USER slot (trusted system slot is
+ *      never touched — B3 keeps untrusted content in the user path) and returns
+ *      a discriminated outcome so the loop can FAIL CLOSED pre-dispatch;
+ *   2. `rehydrateText` / `rehydrateOutput` restore tokens in the response;
+ *   3. `receipt()` produces the counts-only {@link MaskReceipt} via the single
+ *      producer.
+ *
+ * Fail-closed matrix (spec §9): in `mask`/`block`, a detector throw ⇒ `error`
+ * outcome (loop refuses pre-dispatch, no request sent); `block` with any finding
+ * ⇒ `blocked` outcome (refuse, receipt `blocked:true`). In `detect`, a throw
+ * warns once and sends verbatim with `error:true`. `off` ⇒ the seam is inert and
+ * the run loop never builds one (byte-identical).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMaskSeam = createMaskSeam;
+exports.resetMaskWarningsForTest = resetMaskWarningsForTest;
+const apply_1 = require("./apply");
+const receipt_1 = require("./receipt");
+let warnedDetectError = false;
+/** Create the per-run dispatch seam for an ACTIVE policy (mode !== "off"). The
+ * vault is shared across every attempt/candidate of one `rig.run()` so a value
+ * keeps one token for the whole run. */
+function createMaskSeam(resolved, vault) {
+    const mode = resolved.policy.mode;
+    const stream = resolved.policy.stream ?? (mode === "off" ? null : "buffered");
+    const rehydrateOn = resolved.policy.rehydrate ?? mode === "mask";
+    const findings = new Map();
+    let tokensIssued = 0;
+    let rehydrated = 0;
+    let unresolved = 0;
+    let blocked = false;
+    let errored = false;
+    const mergeFindings = (into, from) => {
+        for (const [type, count] of from)
+            into.set(type, (into.get(type) ?? 0) + count);
+    };
+    return {
+        maskRequest(req) {
+            try {
+                // Detect once against the outgoing user content.
+                const scan = (0, apply_1.maskText)(req.userPrompt, resolved, vault);
+                if (mode === "block") {
+                    if (scan.findings.size > 0) {
+                        mergeFindings(findings, scan.findings);
+                        blocked = true;
+                        return { kind: "blocked" };
+                    }
+                    // No finding ⇒ send verbatim (count is zero). Fall through as ok.
+                    return { kind: "ok", request: req };
+                }
+                if (mode === "detect") {
+                    // Count only; send the ORIGINAL text verbatim (spec §3 mode semantics).
+                    mergeFindings(findings, scan.findings);
+                    return { kind: "ok", request: req };
+                }
+                // mode === "mask": substitute tokens into the outgoing request.
+                mergeFindings(findings, scan.findings);
+                tokensIssued += scan.tokensIssued;
+                return { kind: "ok", request: { ...req, userPrompt: scan.text } };
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                if (mode === "detect") {
+                    // Warn once, send verbatim, receipt records error:true (spec §9).
+                    errored = true;
+                    if (!warnedDetectError) {
+                        warnedDetectError = true;
+                        // eslint-disable-next-line no-console
+                        console.warn(`[modelrig mask] detector error in detect mode — sending verbatim (counts only): ${message}`);
+                    }
+                    return { kind: "ok", request: req };
+                }
+                // mask/block: fail closed — no request is sent.
+                errored = true;
+                return { kind: "error", message };
+            }
+        },
+        rehydrateText(text) {
+            if (!rehydrateOn)
+                return text;
+            const r = (0, apply_1.rehydrateText)(text, vault);
+            rehydrated += r.rehydrated;
+            unresolved += r.unresolved;
+            return r.text;
+        },
+        rehydrateOutput(value) {
+            if (!rehydrateOn)
+                return value;
+            const r = (0, apply_1.rehydrateValue)(value, vault);
+            rehydrated += r.rehydrated;
+            unresolved += r.unresolved;
+            return r.value;
+        },
+        receipt() {
+            return (0, receipt_1.summarizeMask)({
+                policyHash: resolved.policyHash,
+                mode,
+                blocked,
+                findings,
+                tokensIssued,
+                rehydrated,
+                unresolved,
+                stream,
+                ...(errored ? { error: true } : {}),
+            });
+        },
+    };
+}
+/** Test-only: reset the once-per-process detect-error warning latch. */
+function resetMaskWarningsForTest() {
+    warnedDetectError = false;
+}

package/dist/mask/types.d.ts

@@ -0,0 +1,81 @@
+/**
+ * CS-1 Proven Masking — types (ARCHITECT SCAFFOLD, 2026-08-22; nothing wired).
+ *
+ * Spec: docs/ModelRig/control-spike/spec.md §3 (policy), §5 (tokens/vault),
+ * §6 (receipt). The load-bearing invariant, inherited from scrub v1
+ * (src/artifacts/scrub.ts): a receipt carries COUNTS BY TYPE — never a matched
+ * value — and the vault/dictionary never leave the process.
+ */
+import type { ScrubDetectorType } from "../artifacts/scrub";
+import type { DetectionSpan } from "../detect/detector";
+export type MaskMode = "off" | "detect" | "mask" | "block";
+export type MaskStreamMode = "buffered" | "final-only";
+/** Customer-typed entity types (dictionary / field rules) plus the scrub v1
+ * deterministic types. Open string union so customers can name their own
+ * (`project`, `account`, …) — the type only ever appears as a COUNT label. */
+export type MaskEntityType = ScrubDetectorType | (string & {});
+export interface MaskDictionaryEntry {
+    readonly term: string;
+    readonly type: MaskEntityType;
+    /** Default false (case-insensitive, word-boundary). */
+    readonly caseSensitive?: boolean;
+}
+/** JSON-pointer rule into the routed lane's `input` object (spec §3; ignored
+ * by the raw lane with a once-per-process warning). */
+export interface MaskFieldRule {
+    readonly path: string;
+    readonly type: MaskEntityType;
+}
+export interface MaskTolerance {
+    readonly value_accuracy_delta_max: number;
+    readonly conformance_delta_max: number;
+}
+/** The `mask:` block of a route bundle (spec §3). Absent ⇒ masking off and
+ * byte-identical behaviour. */
+export interface MaskPolicy {
+    readonly mode: MaskMode;
+    readonly types: readonly ScrubDetectorType[];
+    /** Local path, relative to the routes dir. Loaded at route load; NEVER
+     * uploaded. Only its hash contributes to `policy_hash`. */
+    readonly dictionary?: string;
+    readonly fields?: readonly MaskFieldRule[];
+    readonly rehydrate?: boolean;
+    readonly stream?: MaskStreamMode;
+    readonly tolerance?: MaskTolerance;
+}
+/** A resolved, validated policy with the dictionary loaded (spec §3). */
+export interface ResolvedMaskPolicy {
+    readonly policy: MaskPolicy;
+    readonly entries: readonly MaskDictionaryEntry[];
+    /** sha256 over the normalized policy + dictionary BYTES (not entries). */
+    readonly policyHash: string;
+}
+/** One detected span in a text, before token substitution. A `DetectionSpan`
+ * (shared Detector interface, screening review A1): `start`/`end`/`confidence`
+ * are inherited; CS-1's field/dictionary/scrub detectors report `confidence: 1`
+ * (deterministic). `type` narrows the shared `DetectionType` to the mask entity
+ * union so CS-1 Chunk A builds directly against `src/detect/detector.ts`. */
+export interface MaskSpan extends DetectionSpan {
+    readonly type: MaskEntityType;
+}
+/** A finding is a COUNT by type — never a value. */
+export interface MaskFinding {
+    readonly type: MaskEntityType;
+    readonly count: number;
+}
+/** Persisted on `inferences.mask` (additive nullable jsonb). COUNTS ONLY. */
+export interface MaskReceipt {
+    readonly policy_hash: string;
+    readonly mode: MaskMode;
+    readonly blocked: boolean;
+    readonly findings: readonly MaskFinding[];
+    readonly tokens_issued: number;
+    readonly rehydrated: number;
+    readonly unresolved: number;
+    readonly stream: MaskStreamMode | null;
+    /** v1 gap made visible, not silent (spec §9). */
+    readonly tool_calls_unmasked?: number;
+    /** Detector threw in `detect` mode (spec §9) — additive. */
+    readonly error?: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/mask/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/mask/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;AAC3D,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,YAAY,CAAC;AAEvD;;8EAE8E;AAC9E,MAAM,MAAM,cAAc,GAAG,iBAAiB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE/D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,uDAAuD;IACvD,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AAED;uDACuD;AACvD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;CAC/B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;CACxC;AAED;+BAC+B;AAC/B,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC7C;+DAC2D;IAC3D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAC3C,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;CACpC;AAED,yEAAyE;AACzE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACjD,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;6EAI6E;AAC7E,MAAM,WAAW,QAAS,SAAQ,aAAa;IAC7C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;CAC/B;AAED,oDAAoD;AACpD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,6EAA6E;AAC7E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;IAC1C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;IACvC,iDAAiD;IACjD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B"}

package/dist/mask/types.js

@@ -0,0 +1,10 @@
+"use strict";
+/**
+ * CS-1 Proven Masking — types (ARCHITECT SCAFFOLD, 2026-08-22; nothing wired).
+ *
+ * Spec: docs/ModelRig/control-spike/spec.md §3 (policy), §5 (tokens/vault),
+ * §6 (receipt). The load-bearing invariant, inherited from scrub v1
+ * (src/artifacts/scrub.ts): a receipt carries COUNTS BY TYPE — never a matched
+ * value — and the vault/dictionary never leave the process.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/mask/vault.d.ts

@@ -0,0 +1,50 @@
+/**
+ * CS-1 — run-scoped token vault (WIRED 2026-08-24, CS-1 Chunk A). Spec §5.
+ *
+ * Token grammar: `<TYPE_n>` — TYPE uppercased, n per-type 1-based in
+ * first-seen order within a run (deterministic across replays). The vault is
+ * created once per `rig.run()` invocation and threaded through the dispatch
+ * seam; `runRaw`/replay outside a run gets a per-call vault. Dropped at run end
+ * (it is a plain in-process object — GC reclaims it, nothing persists it).
+ *
+ * INVARIANT (P6 sibling; named test provenance-no-leak / mask receipt invariant):
+ * vault contents are never reachable from telemetry, exporter, OTLP emitter,
+ * capture writer, artifact uploader, logs, or failure text. This module is the
+ * ONLY holder of the token→original mapping, and it exposes no enumeration of
+ * originals — `resolve` answers one known token at a time, `size` is a count.
+ */
+import type { MaskEntityType } from "./types";
+export interface RunVault {
+    /** Issue (or reuse, via the reverse map) the token for an original value. */
+    issue(type: MaskEntityType, original: string): string;
+    /** Resolve a token back to its original, or null when unknown. */
+    resolve(token: string): string | null;
+    /** Distinct tokens issued so far (feeds `tokens_issued`). */
+    size(): number;
+}
+/**
+ * The TYPE portion of a token (`<TYPE_n>`). An entity type is a free-string
+ * union (`email`, `person`, `project`, …); the token grammar allows only
+ * `[A-Z_]` (see {@link MASK_TOKEN_PATTERN}), so uppercase and fold every
+ * non-letter run to a single `_`. Deterministic and collision-stable enough for
+ * a receipt label — the value never travels, only the type does.
+ */
+export declare function tokenTypeLabel(type: MaskEntityType): string;
+/**
+ * Map-backed run vault. Idempotence (spec §5): the same original value always
+ * maps to the same token within a run, keyed by the value itself — so
+ * `<PERSON_1>` denotes the same person across every step, and a deterministic
+ * detection order gives a replay identical masked text (required for the
+ * masked arm to be meaningful). The FIRST detected type for a value wins its
+ * token; a later re-detection under a different type reuses the same token.
+ */
+export declare function createRunVault(): RunVault;
+/** Token regex shared by apply.ts (rehydration) and the stream hold-back
+ * buffer. Matches the `<TYPE_n>` grammar exactly. */
+export declare const MASK_TOKEN_PATTERN: RegExp;
+/** Upper bound on a token's rendered length, used by the stream hold-back
+ * buffer to decide when a held `<…` prefix cannot become a token. A type label
+ * is bounded in practice (dictionary/field/scrub types are short words); this
+ * cap is generous so the buffer never holds unboundedly on a stray `<`. */
+export declare const MAX_TOKEN_LENGTH = 64;
+//# sourceMappingURL=vault.d.ts.map

package/dist/mask/vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../src/mask/vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,MAAM,WAAW,QAAQ;IACvB,6EAA6E;IAC7E,KAAK,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IACtD,kEAAkE;IAClE,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACtC,6DAA6D;IAC7D,IAAI,IAAI,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAQ3D;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,IAAI,QAAQ,CA4BzC;AAED;qDACqD;AACrD,eAAO,MAAM,kBAAkB,QAAmB,CAAC;AAEnD;;;2EAG2E;AAC3E,eAAO,MAAM,gBAAgB,KAAK,CAAC"}

package/dist/mask/vault.js

@@ -0,0 +1,81 @@
+"use strict";
+/**
+ * CS-1 — run-scoped token vault (WIRED 2026-08-24, CS-1 Chunk A). Spec §5.
+ *
+ * Token grammar: `<TYPE_n>` — TYPE uppercased, n per-type 1-based in
+ * first-seen order within a run (deterministic across replays). The vault is
+ * created once per `rig.run()` invocation and threaded through the dispatch
+ * seam; `runRaw`/replay outside a run gets a per-call vault. Dropped at run end
+ * (it is a plain in-process object — GC reclaims it, nothing persists it).
+ *
+ * INVARIANT (P6 sibling; named test provenance-no-leak / mask receipt invariant):
+ * vault contents are never reachable from telemetry, exporter, OTLP emitter,
+ * capture writer, artifact uploader, logs, or failure text. This module is the
+ * ONLY holder of the token→original mapping, and it exposes no enumeration of
+ * originals — `resolve` answers one known token at a time, `size` is a count.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_TOKEN_LENGTH = exports.MASK_TOKEN_PATTERN = void 0;
+exports.tokenTypeLabel = tokenTypeLabel;
+exports.createRunVault = createRunVault;
+/**
+ * The TYPE portion of a token (`<TYPE_n>`). An entity type is a free-string
+ * union (`email`, `person`, `project`, …); the token grammar allows only
+ * `[A-Z_]` (see {@link MASK_TOKEN_PATTERN}), so uppercase and fold every
+ * non-letter run to a single `_`. Deterministic and collision-stable enough for
+ * a receipt label — the value never travels, only the type does.
+ */
+function tokenTypeLabel(type) {
+    const folded = type
+        .toUpperCase()
+        .replace(/[^A-Z]+/g, "_")
+        .replace(/^_+|_+$/g, "");
+    // A type of all-symbols (or empty) degrades to a stable sentinel rather than
+    // producing an ungrammatical `<_1>` — keeps every token matchable.
+    return folded === "" ? "ENTITY" : folded;
+}
+/**
+ * Map-backed run vault. Idempotence (spec §5): the same original value always
+ * maps to the same token within a run, keyed by the value itself — so
+ * `<PERSON_1>` denotes the same person across every step, and a deterministic
+ * detection order gives a replay identical masked text (required for the
+ * masked arm to be meaningful). The FIRST detected type for a value wins its
+ * token; a later re-detection under a different type reuses the same token.
+ */
+function createRunVault() {
+    // token -> original (the resolve direction).
+    const forward = new Map();
+    // original -> token (the idempotence direction).
+    const reverse = new Map();
+    // per-type 1-based counter (first-seen order).
+    const counters = new Map();
+    return {
+        issue(type, original) {
+            const existing = reverse.get(original);
+            if (existing !== undefined)
+                return existing;
+            const label = tokenTypeLabel(type);
+            const n = (counters.get(label) ?? 0) + 1;
+            counters.set(label, n);
+            const token = `<${label}_${n}>`;
+            forward.set(token, original);
+            reverse.set(original, token);
+            return token;
+        },
+        resolve(token) {
+            const original = forward.get(token);
+            return original === undefined ? null : original;
+        },
+        size() {
+            return forward.size;
+        },
+    };
+}
+/** Token regex shared by apply.ts (rehydration) and the stream hold-back
+ * buffer. Matches the `<TYPE_n>` grammar exactly. */
+exports.MASK_TOKEN_PATTERN = /<[A-Z_]+_\d+>/g;
+/** Upper bound on a token's rendered length, used by the stream hold-back
+ * buffer to decide when a held `<…` prefix cannot become a token. A type label
+ * is bounded in practice (dictionary/field/scrub types are short words); this
+ * cap is generous so the buffer never holds unboundedly on a stray `<`. */
+exports.MAX_TOKEN_LENGTH = 64;

package/dist/receipts/types.d.ts

@@ -0,0 +1,65 @@
+export type ReceiptKind = "bakeoff" | "regret" | "masking-proof" | "run" | "egress" | "disclosure" | "statement" | "fact-sheet" | "launch-report";
+/** The kinds RP-1 ships producers for. Others land with their own missions. */
+export declare const RECEIPT_KINDS: readonly ReceiptKind[];
+export type MeasuredValue = number | string | boolean | null;
+export interface ReceiptV1 {
+    readonly v: 1;
+    readonly id: string;
+    readonly kind: ReceiptKind;
+    readonly issued_at: string;
+    readonly issuer: {
+        readonly org_alias: string;
+    };
+    readonly subject: {
+        readonly route_alias?: string;
+        readonly task_alias?: string;
+        readonly pipeline_alias?: string;
+        readonly window?: {
+            readonly from: string;
+            readonly to: string;
+        };
+    };
+    readonly measured: Readonly<Record<string, MeasuredValue>>;
+    readonly policy_hashes?: Readonly<Record<string, string>>;
+    readonly models?: readonly {
+        readonly provider: string;
+        readonly model: string;
+        readonly snapshot?: string;
+    }[];
+    readonly evidence_refs?: readonly string[];
+    readonly honest_limits: readonly string[];
+    readonly aliases: Readonly<Record<string, "aliased">>;
+    readonly hash: string;
+    readonly signature: {
+        readonly alg: "ed25519";
+        readonly key_id: string;
+        readonly sig: string;
+    };
+}
+/** The unsigned body (everything but hash + signature). */
+export type ReceiptBody = Omit<ReceiptV1, "hash" | "signature">;
+/**
+ * The classification gate (RP-1 invariant). True only when EVERY field that
+ * reaches the public object is safe to publish:
+ *  - `measured` keys are safe identifiers and none names a tenant id; values
+ *    are number|boolean|null|safe-string (never free text / content),
+ *  - issuer/subject aliases + window bounds are safe strings,
+ *  - policy_hashes / models / evidence_refs are safe strings,
+ *  - every `aliases` value is the literal marker "aliased" (the mapping never
+ *    leaves the org — only the fact that a field was aliased does),
+ *  - `honest_limits` are curated prose lines (verbatim from the producing spec)
+ *    — strings, exempt from the no-whitespace rule by design.
+ * Anything failing ⇒ the receipt is NOT published (fail-closed).
+ */
+export declare function isReceiptSafe(body: ReceiptBody): boolean;
+/**
+ * JCS-style canonicalization: object keys sorted recursively, arrays left in
+ * order (order is semantic), no whitespace, UTF-8. Reuses the SDK's one
+ * canonical-JSON serializer (`canonicalJson`) so the receipt hash can never
+ * drift from the rest of the codebase's notion of "byte-identical JSON".
+ */
+export declare function canonicalizeReceipt(body: ReceiptBody): string;
+/** sha256 hex over the canonical body, self-describing (`sha256:<hex>`) — the
+ * same content-hash shape the artifacts table's CHECK enforces. */
+export declare function hashReceipt(body: ReceiptBody): string;
+//# sourceMappingURL=types.d.ts.map

package/dist/receipts/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/receipts/types.ts"],"names":[],"mappings":"AAgBA,MAAM,MAAM,WAAW,GACnB,SAAS,GAAG,QAAQ,GAAG,eAAe,GAAG,KAAK,GAAG,QAAQ,GACzD,YAAY,GAAG,WAAW,GAAG,YAAY,GAAG,eAAe,CAAC;AAEhE,+EAA+E;AAC/E,eAAO,MAAM,aAAa,EAAE,SAAS,WAAW,EAG/C,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;AAE7D,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IACd,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,MAAM,CAAC,EAAE;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KAClE,CAAC;IACF,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;IAC3D,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC/G,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CAChG;AAED,2DAA2D;AAC3D,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,CAAC,CAAC;AAwBhE;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAiDxD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAE7D;AAED;mEACmE;AACnE,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAErD"}

package/dist/receipts/types.js

@@ -0,0 +1,134 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RECEIPT_KINDS = void 0;
+exports.isReceiptSafe = isReceiptSafe;
+exports.canonicalizeReceipt = canonicalizeReceipt;
+exports.hashReceipt = hashReceipt;
+/**
+ * RP-0/RP-1 Receipt@v1 — the ONE published-document shape, plus the three pure
+ * operations the whole receipts feature is built on: canonicalize, hash, and the
+ * classification gate. WIRED by RP-1 (2026-08-23); reachable ONLY via the
+ * `modelrig/receipts` package sub-path export (never re-exported from index.ts).
+ *
+ * Spec: docs/ModelRig/receipts-reach/spec.md (RP-0 shape + classification rule).
+ * Invariant (property-tested): `measured` holds numbers/booleans/enums/hashes/
+ * identifiers only (WI-1's metadata-safe rule, `isMetaSafeString`) — never
+ * content, raw confidence, dictionary values, or tenant ids. This module is
+ * PURE: no env, no crypto keys, no I/O — signing lives in the server package.
+ */
+const node_crypto_1 = require("node:crypto");
+const attempt_meta_1 = require("../telemetry/attempt-meta");
+const diff_1 = require("../verify/diff");
+/** The kinds RP-1 ships producers for. Others land with their own missions. */
+exports.RECEIPT_KINDS = [
+    "bakeoff", "regret", "masking-proof", "run", "egress",
+    "disclosure", "statement", "fact-sheet", "launch-report",
+];
+/**
+ * Keys that would carry a tenant identifier and so must NEVER appear in
+ * `measured` (aliases only, spec RP-0 classification rule). Matched
+ * case-insensitively against each measured key.
+ */
+// N1: `org_id` is the ONE tenant name (its banned synonym is forbidden
+// everywhere, so it is not spelled here). These keys must never carry a value
+// in `measured` — aliases only (spec RP-0 classification rule).
+const BANNED_MEASURED_KEYS = new Set([
+    "org_id", "project_id", "tenant_id", "tenant",
+    "subject", "user_id", "owner_id", "account_id", "email",
+]);
+/** A `measured` value is publishable iff it is a finite number, a boolean,
+ * null, or a metadata-safe string (≤128 chars, no whitespace). No free text. */
+function isSafeMeasuredValue(v) {
+    if (v === null)
+        return true;
+    if (typeof v === "boolean")
+        return true;
+    if (typeof v === "number")
+        return Number.isFinite(v);
+    return (0, attempt_meta_1.isMetaSafeString)(v);
+}
+/**
+ * The classification gate (RP-1 invariant). True only when EVERY field that
+ * reaches the public object is safe to publish:
+ *  - `measured` keys are safe identifiers and none names a tenant id; values
+ *    are number|boolean|null|safe-string (never free text / content),
+ *  - issuer/subject aliases + window bounds are safe strings,
+ *  - policy_hashes / models / evidence_refs are safe strings,
+ *  - every `aliases` value is the literal marker "aliased" (the mapping never
+ *    leaves the org — only the fact that a field was aliased does),
+ *  - `honest_limits` are curated prose lines (verbatim from the producing spec)
+ *    — strings, exempt from the no-whitespace rule by design.
+ * Anything failing ⇒ the receipt is NOT published (fail-closed).
+ */
+function isReceiptSafe(body) {
+    if (body.v !== 1)
+        return false;
+    if (!exports.RECEIPT_KINDS.includes(body.kind))
+        return false;
+    if (!(0, attempt_meta_1.isMetaSafeString)(body.issued_at))
+        return false;
+    if (!(0, attempt_meta_1.isMetaSafeString)(body.issuer.org_alias))
+        return false;
+    const s = body.subject;
+    for (const alias of [s.route_alias, s.task_alias, s.pipeline_alias]) {
+        if (alias !== undefined && !(0, attempt_meta_1.isMetaSafeString)(alias))
+            return false;
+    }
+    if (s.window !== undefined) {
+        if (!(0, attempt_meta_1.isMetaSafeString)(s.window.from) || !(0, attempt_meta_1.isMetaSafeString)(s.window.to))
+            return false;
+    }
+    for (const [key, value] of Object.entries(body.measured)) {
+        if (!(0, attempt_meta_1.isMetaSafeString)(key))
+            return false;
+        if (BANNED_MEASURED_KEYS.has(key.toLowerCase()))
+            return false;
+        if (!isSafeMeasuredValue(value))
+            return false;
+    }
+    if (body.policy_hashes !== undefined) {
+        for (const [key, value] of Object.entries(body.policy_hashes)) {
+            if (!(0, attempt_meta_1.isMetaSafeString)(key) || !(0, attempt_meta_1.isMetaSafeString)(value))
+                return false;
+        }
+    }
+    if (body.models !== undefined) {
+        for (const m of body.models) {
+            if (!(0, attempt_meta_1.isMetaSafeString)(m.provider) || !(0, attempt_meta_1.isMetaSafeString)(m.model))
+                return false;
+            if (m.snapshot !== undefined && !(0, attempt_meta_1.isMetaSafeString)(m.snapshot))
+                return false;
+        }
+    }
+    if (body.evidence_refs !== undefined) {
+        for (const ref of body.evidence_refs) {
+            if (!(0, attempt_meta_1.isMetaSafeString)(ref))
+                return false;
+        }
+    }
+    for (const [key, marker] of Object.entries(body.aliases)) {
+        if (!(0, attempt_meta_1.isMetaSafeString)(key))
+            return false;
+        if (marker !== "aliased")
+            return false;
+    }
+    for (const line of body.honest_limits) {
+        if (typeof line !== "string" || line.length === 0)
+            return false;
+    }
+    return true;
+}
+/**
+ * JCS-style canonicalization: object keys sorted recursively, arrays left in
+ * order (order is semantic), no whitespace, UTF-8. Reuses the SDK's one
+ * canonical-JSON serializer (`canonicalJson`) so the receipt hash can never
+ * drift from the rest of the codebase's notion of "byte-identical JSON".
+ */
+function canonicalizeReceipt(body) {
+    return (0, diff_1.canonicalJson)(body);
+}
+/** sha256 hex over the canonical body, self-describing (`sha256:<hex>`) — the
+ * same content-hash shape the artifacts table's CHECK enforces. */
+function hashReceipt(body) {
+    return `sha256:${(0, node_crypto_1.createHash)("sha256").update(canonicalizeReceipt(body), "utf8").digest("hex")}`;
+}

package/dist/routes/loader-warnings.d.ts

@@ -25,4 +25,12 @@ export declare function arrayRootSchemaWarning(route: string, outputSchema: obje
  * warning line, or null when every trial candidate is referenced.
  */
 export declare function unreferencedTrialCandidatesWarning(route: string, candidates: readonly CandidateSpec[], variants: readonly RouteVariant[]): string | null;
+/**
+ * Screening S2 (SC-0 B3, spec §2.4): a non-fatal advisory when a variable whose
+ * NAME looks like third-party/untrusted content renders in the trusted system
+ * slot WITHOUT an `x-trust: untrusted` annotation. Deterministic behaviour is
+ * unchanged — the move out of the system slot is opt-in and bake-off-gated per
+ * route. Pure; unit-tested directly. Returns the warning line, or null.
+ */
+export declare function untrustedShapedVariableWarning(route: string, variables: readonly string[], variableTrust: Readonly<Record<string, "untrusted">> | undefined): string | null;
 //# sourceMappingURL=loader-warnings.d.ts.map

package/dist/routes/loader-warnings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader-warnings.d.ts","sourceRoot":"","sources":["../../src/routes/loader-warnings.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAElE;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAWhG;AAED;;;;;;;;;GASG;AACH,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,SAAS,aAAa,EAAE,EACpC,QAAQ,EAAE,SAAS,YAAY,EAAE,GAChC,MAAM,GAAG,IAAI,CAef"}
+{"version":3,"file":"loader-warnings.d.ts","sourceRoot":"","sources":["../../src/routes/loader-warnings.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAElE;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAWhG;AAED;;;;;;;;;GASG;AACH,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,SAAS,aAAa,EAAE,EACpC,QAAQ,EAAE,SAAS,YAAY,EAAE,GAChC,MAAM,GAAG,IAAI,CAef;AAQD;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,GAAG,SAAS,GAC/D,MAAM,GAAG,IAAI,CAWf"}

package/dist/routes/loader-warnings.js

@@ -7,6 +7,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.arrayRootSchemaWarning = arrayRootSchemaWarning;
 exports.unreferencedTrialCandidatesWarning = unreferencedTrialCandidatesWarning;
+exports.untrustedShapedVariableWarning = untrustedShapedVariableWarning;
 /**
  * CE-2 A5 co-item: warn (non-fatal) when a route's output schema has an ARRAY
  * root. OpenAI strict structured output (`response_format: json_schema`, strict)
@@ -54,3 +55,25 @@ function unreferencedTrialCandidatesWarning(route, candidates, variants) {
         `variant that narrows to it. Add a variant (e.g. { name: "trial-${dangling[0].replace("/", "-")}", ` +
         `candidates: [<that candidate>] }) to bake it off, or remove the dangling declaration.`);
 }
+/** Names that look like caller- or third-party-supplied content — the shapes
+ * that, rendered into the trusted system slot, carry an injection risk (spec
+ * §2.4). Deliberately conservative to keep the advisory high-signal. */
+const UNTRUSTED_SHAPED_NAME = /(^|_)(document|documents|doc|content|contents|message|messages|scraped|scrape|webpage|webpages|html|email|emails|comment|comments|review|reviews|transcript|transcripts|attachment|attachments|snippet|snippets|userinput|user_input|thirdparty|third_party|external)($|_)/i;
+/**
+ * Screening S2 (SC-0 B3, spec §2.4): a non-fatal advisory when a variable whose
+ * NAME looks like third-party/untrusted content renders in the trusted system
+ * slot WITHOUT an `x-trust: untrusted` annotation. Deterministic behaviour is
+ * unchanged — the move out of the system slot is opt-in and bake-off-gated per
+ * route. Pure; unit-tested directly. Returns the warning line, or null.
+ */
+function untrustedShapedVariableWarning(route, variables, variableTrust) {
+    const annotated = new Set(Object.keys(variableTrust ?? {}));
+    const flagged = variables.filter((v) => UNTRUSTED_SHAPED_NAME.test(v) && !annotated.has(v));
+    if (flagged.length === 0)
+        return null;
+    return (`route "${route}" declares variable(s) [${flagged.join(", ")}] whose names look like ` +
+        `third-party/untrusted content, but they render in the trusted system slot. If the value is ` +
+        `caller- or externally-supplied, annotate it \`{ name: "${flagged[0]}", x-trust: untrusted }\` in ` +
+        `prompt.variables so the provenance assembler spotlights it out of the system prompt (screening S2). ` +
+        `This is advisory — the route loads and behaves identically until you opt in (bake-off-gated).`);
+}

package/dist/routes/loader.d.ts

@@ -4,7 +4,7 @@
  * resolves schema/prompt paths relative to the bundle file, freezes.
  */
 import type { RouteBundle } from "../types/route";
-export { arrayRootSchemaWarning, unreferencedTrialCandidatesWarning } from "./loader-warnings";
+export { arrayRootSchemaWarning, unreferencedTrialCandidatesWarning, untrustedShapedVariableWarning } from "./loader-warnings";
 /**
  * Structured config error thrown for any invalid bundle (never a raw Error).
  * Load-time problems are deliberately NOT RigFailures — the failure taxonomy

package/dist/routes/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/routes/loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,KAAK,EAKV,WAAW,EAGZ,MAAM,gBAAgB,CAAC;AAUxB,OAAO,EAAE,sBAAsB,EAAE,kCAAkC,EAAE,MAAM,mBAAmB,CAAC;AAE/F;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;gBAEzB,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAO;CAOxF;AAiCD,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAAC;IAChC,IAAI,IAAI,SAAS,WAAW,EAAE,CAAC;CAChC;AAucD;;;;;;;GAOG;AACH;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,YAAY,CAItF;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,GAAG,YAAY,CAyB1F;AAED;;yBAEyB;AACzB,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,EAAE,CA6CtE;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,YAAY,CA2C1D"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/routes/loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,KAAK,EAKV,WAAW,EAGZ,MAAM,gBAAgB,CAAC;AAWxB,OAAO,EAAE,sBAAsB,EAAE,kCAAkC,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAE/H;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;gBAEzB,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAO;CAOxF;AAiCD,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAAC;IAChC,IAAI,IAAI,SAAS,WAAW,EAAE,CAAC;CAChC;AAscD;;;;;;;GAOG;AACH;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,YAAY,CAItF;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,GAAG,YAAY,CAyB1F;AAED;;yBAEyB;AACzB,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,EAAE,CA6CtE;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,YAAY,CA2C1D"}