modelrig 0.7.0 → 0.8.1

package/dist/routes/loader.js

@@ -5,7 +5,7 @@
  * resolves schema/prompt paths relative to the bundle file, freezes.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RouteConfigError = exports.unreferencedTrialCandidatesWarning = exports.arrayRootSchemaWarning = void 0;
+exports.RouteConfigError = exports.untrustedShapedVariableWarning = exports.unreferencedTrialCandidatesWarning = exports.arrayRootSchemaWarning = void 0;
 exports.loadRoutesWithExtra = loadRoutesWithExtra;
 exports.mergeLoadedRoutes = mergeLoadedRoutes;
 exports.validateRoutesDir = validateRoutesDir;
@@ -15,16 +15,18 @@ const node_path_1 = require("node:path");
 const yaml_1 = require("yaml");
 const failures_1 = require("../types/failures");
 const fingerprint_1 = require("../registry/fingerprint");
-const template_1 = require("./template");
 const cache_lint_1 = require("./cache-lint");
 const sampling_config_1 = require("./sampling-config");
 const loader_warnings_1 = require("./loader-warnings");
+const screen_loader_1 = require("./screen-loader");
+const mask_loader_1 = require("./mask-loader");
 const objective_loader_1 = require("./objective-loader");
 // Re-exported so existing importers of "./loader" keep resolving these advisories
 // (they live in ./loader-warnings to hold loader.ts under the 700-LOC cap).
 var loader_warnings_2 = require("./loader-warnings");
 Object.defineProperty(exports, "arrayRootSchemaWarning", { enumerable: true, get: function () { return loader_warnings_2.arrayRootSchemaWarning; } });
 Object.defineProperty(exports, "unreferencedTrialCandidatesWarning", { enumerable: true, get: function () { return loader_warnings_2.unreferencedTrialCandidatesWarning; } });
+Object.defineProperty(exports, "untrustedShapedVariableWarning", { enumerable: true, get: function () { return loader_warnings_2.untrustedShapedVariableWarning; } });
 /**
  * Structured config error thrown for any invalid bundle (never a raw Error).
  * Load-time problems are deliberately NOT RigFailures — the failure taxonomy
@@ -389,19 +391,26 @@ function loadBundleFile(filePath) {
         }
     }
     let groundingQuery;
+    let groundingAssembly;
     if (doc.grounding !== undefined) {
         if (!isRecord(doc.grounding) || typeof doc.grounding.query !== "string" || doc.grounding.query === "") {
             problems.push("grounding must be an object {query: <template string>}");
         }
         else {
             groundingQuery = doc.grounding.query;
+            groundingAssembly = (0, screen_loader_1.parseGroundingAssembly)(doc.grounding, problems); // S1 (SC-0 B3)
         }
     }
     // RB-1 (near-optimal spec §3): objective knob, reference arm + judge, value
     // checks — all additive; candidate-set invariant enforced in parseRb1Fields.
     const rb1 = (0, objective_loader_1.parseRb1Fields)(doc, route, candidates, problems);
+    // CS-1 Proven Masking (spec §3): resolve the `mask:` block + its local
+    // dictionary here so an unreadable dictionary or unknown type is a LOAD error.
+    // Absent / `mode: off` ⇒ undefined ⇒ byte-identical (the golden test).
+    const mask = (0, mask_loader_1.parseMaskBlock)(doc.mask, bundleDir, problems);
     let systemTemplate = "";
     let variables = [];
+    let variableTrust;
     if (!isRecord(doc.prompt) || typeof doc.prompt.system !== "string") {
         problems.push("prompt.system must be a relative path");
     }
@@ -413,30 +422,12 @@ function loadBundleFile(filePath) {
         else {
             systemTemplate = (0, node_fs_1.readFileSync)(promptPath, "utf8");
         }
-        const rawVars = doc.prompt.variables ?? [];
-        if (!Array.isArray(rawVars) || rawVars.some((v) => typeof v !== "string")) {
-            problems.push("prompt.variables must be a list of strings");
-        }
-        else {
-            variables = rawVars;
-        }
-    }
-    if (systemTemplate !== "") {
-        const declared = new Set(variables);
-        for (const ref of (0, template_1.scanTemplateVariables)(systemTemplate)) {
-            if (!declared.has(ref)) {
-                problems.push(`template references undeclared variable "${ref}" (declare it in prompt.variables)`);
-            }
-        }
-    }
-    if (groundingQuery !== undefined) {
-        const declared = new Set(variables);
-        for (const ref of (0, template_1.scanTemplateVariables)(groundingQuery)) {
-            if (!declared.has(ref)) {
-                problems.push(`grounding.query references undeclared variable "${ref}"`);
-            }
-        }
+        // Screening S2 (SC-0 B3): parse names + optional per-variable x-trust.
+        const parsed = (0, screen_loader_1.parseVariables)(doc.prompt.variables ?? [], problems);
+        variables = parsed.names;
+        variableTrust = parsed.trust;
     }
+    (0, screen_loader_1.pushUndeclaredVariableProblems)(systemTemplate, groundingQuery, variables, problems);
     if (problems.length > 0) {
         throw new RouteConfigError("invalid route bundle", { file: filePath, problems });
     }
@@ -466,6 +457,11 @@ function loadBundleFile(filePath) {
     const trialWarning = (0, loader_warnings_1.unreferencedTrialCandidatesWarning)(route, candidates, variants);
     if (trialWarning !== null)
         console.warn(`modelrig: ${trialWarning}`);
+    // Screening S2 (SC-0 B3, spec §2.4): advisory when an untrusted-shaped variable
+    // renders in the system slot without an `x-trust: untrusted` annotation.
+    const xTrustWarning = (0, loader_warnings_1.untrustedShapedVariableWarning)(route, variables, variableTrust);
+    if (xTrustWarning !== null)
+        console.warn(`modelrig: ${xTrustWarning}`);
     return Object.freeze({
         route: route,
         version: version,
@@ -481,6 +477,9 @@ function loadBundleFile(filePath) {
         capture: capture === true,
         cache,
         ...(groundingQuery !== undefined ? { groundingQuery } : {}),
+        ...(groundingAssembly !== undefined ? { groundingAssembly } : {}),
+        ...(variableTrust !== undefined ? { variableTrust } : {}),
+        ...(mask !== undefined ? { mask } : {}),
         // Network-effect instrumentation (spec WS6): computed once at load,
         // stamped on every telemetry row for this route.
         fingerprintCell: (0, fingerprint_1.fingerprintSchema)(outputSchema)?.cellKey ?? null,

package/dist/routes/mask-loader.d.ts

@@ -0,0 +1,18 @@
+/**
+ * CS-1 mask-block parsing (Proven Masking, spec §3) — extracted from loader.ts to
+ * keep it under the 700-LOC cap (same discipline as screen-loader.ts /
+ * objective-loader.ts). Validates the `mask:` block shape, parses it, and
+ * resolves its dictionary relative to the bundle dir. An unreadable dictionary or
+ * an unknown type is a LOAD problem (pushed into the shared `problems[]`), never a
+ * runtime surprise.
+ */
+import type { ResolvedMaskPolicy } from "../mask/types";
+/**
+ * Parse + resolve the optional `mask:` block. Returns the resolved policy, or
+ * `undefined` when the block is absent OR `mode: off` (both ⇒ byte-identical, no
+ * masking). Pushes teaching-style problems for a malformed block or an
+ * unreadable/invalid dictionary. `bundleDir` is where a relative dictionary path
+ * resolves from (the routes dir, same as schema/prompt paths).
+ */
+export declare function parseMaskBlock(raw: unknown, bundleDir: string, problems: string[]): ResolvedMaskPolicy | undefined;
+//# sourceMappingURL=mask-loader.d.ts.map

package/dist/routes/mask-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mask-loader.d.ts","sourceRoot":"","sources":["../../src/routes/mask-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAAE,GACjB,kBAAkB,GAAG,SAAS,CAehC"}

package/dist/routes/mask-loader.js

@@ -0,0 +1,39 @@
+"use strict";
+/**
+ * CS-1 mask-block parsing (Proven Masking, spec §3) — extracted from loader.ts to
+ * keep it under the 700-LOC cap (same discipline as screen-loader.ts /
+ * objective-loader.ts). Validates the `mask:` block shape, parses it, and
+ * resolves its dictionary relative to the bundle dir. An unreadable dictionary or
+ * an unknown type is a LOAD problem (pushed into the shared `problems[]`), never a
+ * runtime surprise.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseMaskBlock = parseMaskBlock;
+const policy_1 = require("../mask/policy");
+/**
+ * Parse + resolve the optional `mask:` block. Returns the resolved policy, or
+ * `undefined` when the block is absent OR `mode: off` (both ⇒ byte-identical, no
+ * masking). Pushes teaching-style problems for a malformed block or an
+ * unreadable/invalid dictionary. `bundleDir` is where a relative dictionary path
+ * resolves from (the routes dir, same as schema/prompt paths).
+ */
+function parseMaskBlock(raw, bundleDir, problems) {
+    if (raw === undefined)
+        return undefined;
+    const shapeProblems = (0, policy_1.validateMaskPolicyShape)(raw);
+    if (shapeProblems.length > 0) {
+        for (const p of shapeProblems)
+            problems.push(`mask: ${p}`);
+        return undefined;
+    }
+    const policy = (0, policy_1.parseMaskPolicy)(raw);
+    if (policy.mode === "off")
+        return undefined; // off ⇒ no masking, byte-identical
+    try {
+        return (0, policy_1.resolveMaskPolicy)(policy, bundleDir);
+    }
+    catch (err) {
+        problems.push(err instanceof Error ? err.message : String(err));
+        return undefined;
+    }
+}

package/dist/routes/objective-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"objective-loader.d.ts","sourceRoot":"","sources":["../../src/routes/objective-loader.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EAGb,cAAc,EACd,UAAU,EACX,MAAM,gBAAgB,CAAC;AAExB;;2EAE2E;AAC3E,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,SAAS,aAAa,EAAE,EACpC,QAAQ,EAAE,MAAM,EAAE,GACjB;IAAE,SAAS,CAAC,EAAE,cAAc,CAAC;IAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IAAC,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAA;CAAE,CAe9F;AAoCD;mEACmE;AACnE,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,cAAc,GAAG,SAAS,CAwC3F;AAqCD;;2EAE2E;AAC3E,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,OAAO,EACZ,UAAU,EAAE,SAAS,aAAa,EAAE,EACpC,QAAQ,EAAE,MAAM,EAAE,GACjB,aAAa,GAAG,SAAS,CA+E3B;AAED;uCACuC;AACvC,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,UAAU,EAAE,GAAG,SAAS,CAqCpG;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAUvG"}
+{"version":3,"file":"objective-loader.d.ts","sourceRoot":"","sources":["../../src/routes/objective-loader.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EAGb,cAAc,EACd,UAAU,EACX,MAAM,gBAAgB,CAAC;AAExB;;2EAE2E;AAC3E,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,SAAS,aAAa,EAAE,EACpC,QAAQ,EAAE,MAAM,EAAE,GACjB;IAAE,SAAS,CAAC,EAAE,cAAc,CAAC;IAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IAAC,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAA;CAAE,CAe9F;AAoCD;mEACmE;AACnE,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,cAAc,GAAG,SAAS,CAqD3F;AAqCD;;2EAE2E;AAC3E,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,OAAO,EACZ,UAAU,EAAE,SAAS,aAAa,EAAE,EACpC,QAAQ,EAAE,MAAM,EAAE,GACjB,aAAa,GAAG,SAAS,CAwE3B;AAiCD;uCACuC;AACvC,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,UAAU,EAAE,GAAG,SAAS,CAqCpG;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAUvG"}

package/dist/routes/objective-loader.js

@@ -103,11 +103,25 @@ function parseObjective(raw, problems) {
     if (mode === "balanced" && lambda === undefined) {
         problems.push("objective.mode: balanced requires objective.lambda");
     }
+    // N5: the pairwise-aware gate knob — additive & optional, default off.
+    let pairwiseAware;
+    if (raw.pairwise_aware !== undefined) {
+        if (typeof raw.pairwise_aware !== "boolean") {
+            problems.push("objective.pairwise_aware must be a boolean");
+        }
+        else {
+            pairwiseAware = raw.pairwise_aware;
+        }
+    }
+    if (pairwiseAware === true && mode === "cost-first") {
+        problems.push("objective.pairwise_aware applies to quality-first (cost-first keeps the legacy gate)");
+    }
     return Object.freeze({
         mode: mode,
         ...(maxRegret !== undefined ? { maxRegret } : {}),
         ...(priceCeiling !== undefined ? { priceCeiling } : {}),
         ...(lambda !== undefined ? { lambda } : {}),
+        ...(pairwiseAware !== undefined ? { pairwiseAware } : {}),
     });
 }
 const PROVIDERS = new Set([
@@ -194,25 +208,18 @@ function parseBakeoffConfig(raw, candidates, problems) {
             referenceEnvelopeUsd = raw.reference_envelope_usd;
         }
     }
-    let judge;
-    if (raw.judge !== undefined && raw.judge !== null) {
-        if (!isRecord(raw.judge)) {
-            problems.push("bakeoff.judge must be an object { model, max_samples }");
+    const judge = parseJudgeSpec(raw.judge, "bakeoff.judge", declared, problems);
+    // N5: pairwise-vs-reference judge (same #223 F3 candidate-set rule as the
+    // value-accuracy judge). `bakeoff.pairwise.judge: { model, max_samples }`.
+    let pairwise;
+    if (raw.pairwise !== undefined && raw.pairwise !== null) {
+        if (!isRecord(raw.pairwise)) {
+            problems.push("bakeoff.pairwise must be an object { judge? }");
         }
         else {
-            const model = parseModelRef(raw.judge.model, "bakeoff.judge.model", problems);
-            const maxSamples = raw.judge.max_samples;
-            if (typeof maxSamples !== "number" || !Number.isInteger(maxSamples) || maxSamples < 1) {
-                problems.push("bakeoff.judge.max_samples must be a positive integer");
-            }
-            if (model !== null && !declared(model)) {
-                // #223 F3: the judge model must be a declared candidate.
-                problems.push(`bakeoff.judge.model (${model.provider}/${model.model}) is not a declared candidate ` +
-                    "(a judge model must be one of the route's declared candidates, #223 F3)");
-            }
-            else if (model !== null && typeof maxSamples === "number" && Number.isInteger(maxSamples) && maxSamples >= 1) {
-                judge = { model, maxSamples };
-            }
+            const pwJudge = parseJudgeSpec(raw.pairwise.judge, "bakeoff.pairwise.judge", declared, problems);
+            if (pwJudge !== undefined)
+                pairwise = { judge: pwJudge };
         }
     }
     const out = {
@@ -220,9 +227,36 @@ function parseBakeoffConfig(raw, candidates, problems) {
         ...(referenceAllowExternal ? { referenceAllowExternal: true } : {}),
         ...(referenceEnvelopeUsd !== undefined ? { referenceEnvelopeUsd } : {}),
         ...(judge !== undefined ? { judge } : {}),
+        ...(pairwise !== undefined ? { pairwise } : {}),
     };
     return Object.freeze(out);
 }
+/** Parse a `{ model, max_samples }` judge spec (shared by `bakeoff.judge` and
+ * `bakeoff.pairwise.judge`). Enforces #223 F3: the judge model must be a declared
+ * candidate. Returns the parsed spec, or undefined when absent/invalid (problems
+ * pushed). */
+function parseJudgeSpec(raw, field, declared, problems) {
+    if (raw === undefined || raw === null)
+        return undefined;
+    if (!isRecord(raw)) {
+        problems.push(`${field} must be an object { model, max_samples }`);
+        return undefined;
+    }
+    const model = parseModelRef(raw.model, `${field}.model`, problems);
+    const maxSamples = raw.max_samples;
+    const maxOk = typeof maxSamples === "number" && Number.isInteger(maxSamples) && maxSamples >= 1;
+    if (!maxOk)
+        problems.push(`${field}.max_samples must be a positive integer`);
+    if (model !== null && !declared(model)) {
+        // #223 F3: the judge model must be a declared candidate.
+        problems.push(`${field}.model (${model.provider}/${model.model}) is not a declared candidate ` +
+            "(a judge model must be one of the route's declared candidates, #223 F3)");
+        return undefined;
+    }
+    if (model !== null && maxOk)
+        return { model, maxSamples: maxSamples };
+    return undefined;
+}
 /** Parse `value_checks:` — a list of {path, expect}. `path` is a JSON pointer;
  * `expect` is a literal or {regex}. */
 function parseValueChecks(raw, problems) {

package/dist/routes/screen-loader.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Screening route-bundle parsing (SC-0 B3) — extracted from loader.ts to keep it
+ * under the 700-LOC cap (same discipline as loader-warnings.ts / objective-loader.ts).
+ * Pure functions that push into the shared `problems[]`; unit-tested directly.
+ * Spec: docs/ModelRig/screening/spec.md §2.4 (S1 assembly knob, S2 x-trust).
+ */
+/** Push a problem for every `{{var}}` referenced in the system template or the
+ * grounding query that was not declared in `prompt.variables`. Colocated with
+ * the variable parser it validates. */
+export declare function pushUndeclaredVariableProblems(systemTemplate: string, groundingQuery: string | undefined, variables: readonly string[], problems: string[]): void;
+/** Parse `prompt.variables` — each entry is a bare name (semi, stays in the
+ * system slot — the default) or `{name, "x-trust": "untrusted"}` (spotlighted out
+ * of the system slot, S2). Returns the declared names and, when any variable is
+ * annotated, the trust map. Backward-compatible with a plain list of strings. */
+export declare function parseVariables(rawVars: unknown, problems: string[]): {
+    readonly names: string[];
+    readonly trust?: Record<string, "untrusted">;
+};
+/** Parse the optional `grounding.assembly` knob (S1). `legacy` (default, absent)
+ * = byte-identical system-prompt injection; `spotlight` = untrusted user-slot
+ * block via the provenance assembler. The flip is bake-off-gated (spec §2.4). */
+export declare function parseGroundingAssembly(grounding: Record<string, unknown>, problems: string[]): "legacy" | "spotlight" | undefined;
+//# sourceMappingURL=screen-loader.d.ts.map

package/dist/routes/screen-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"screen-loader.d.ts","sourceRoot":"","sources":["../../src/routes/screen-loader.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH;;uCAEuC;AACvC,wBAAgB,8BAA8B,CAC5C,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,QAAQ,EAAE,MAAM,EAAE,GACjB,IAAI,CAcN;AAED;;;iFAGiF;AACjF,wBAAgB,cAAc,CAC5B,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAAE,GACjB;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;CAAE,CAwB5E;AAED;;iFAEiF;AACjF,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClC,QAAQ,EAAE,MAAM,EAAE,GACjB,QAAQ,GAAG,WAAW,GAAG,SAAS,CAQpC"}

package/dist/routes/screen-loader.js

@@ -0,0 +1,79 @@
+"use strict";
+/**
+ * Screening route-bundle parsing (SC-0 B3) — extracted from loader.ts to keep it
+ * under the 700-LOC cap (same discipline as loader-warnings.ts / objective-loader.ts).
+ * Pure functions that push into the shared `problems[]`; unit-tested directly.
+ * Spec: docs/ModelRig/screening/spec.md §2.4 (S1 assembly knob, S2 x-trust).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pushUndeclaredVariableProblems = pushUndeclaredVariableProblems;
+exports.parseVariables = parseVariables;
+exports.parseGroundingAssembly = parseGroundingAssembly;
+const template_1 = require("./template");
+function isRecord(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/** Push a problem for every `{{var}}` referenced in the system template or the
+ * grounding query that was not declared in `prompt.variables`. Colocated with
+ * the variable parser it validates. */
+function pushUndeclaredVariableProblems(systemTemplate, groundingQuery, variables, problems) {
+    const declared = new Set(variables);
+    if (systemTemplate !== "") {
+        for (const ref of (0, template_1.scanTemplateVariables)(systemTemplate)) {
+            if (!declared.has(ref)) {
+                problems.push(`template references undeclared variable "${ref}" (declare it in prompt.variables)`);
+            }
+        }
+    }
+    if (groundingQuery !== undefined) {
+        for (const ref of (0, template_1.scanTemplateVariables)(groundingQuery)) {
+            if (!declared.has(ref))
+                problems.push(`grounding.query references undeclared variable "${ref}"`);
+        }
+    }
+}
+/** Parse `prompt.variables` — each entry is a bare name (semi, stays in the
+ * system slot — the default) or `{name, "x-trust": "untrusted"}` (spotlighted out
+ * of the system slot, S2). Returns the declared names and, when any variable is
+ * annotated, the trust map. Backward-compatible with a plain list of strings. */
+function parseVariables(rawVars, problems) {
+    if (!Array.isArray(rawVars)) {
+        problems.push("prompt.variables must be a list of strings or {name, x-trust} objects");
+        return { names: [] };
+    }
+    const names = [];
+    const trust = {};
+    for (const v of rawVars) {
+        if (typeof v === "string") {
+            names.push(v);
+        }
+        else if (isRecord(v) && typeof v.name === "string") {
+            names.push(v.name);
+            if (v["x-trust"] !== undefined) {
+                if (v["x-trust"] !== "untrusted") {
+                    problems.push(`prompt.variables "${v.name}": x-trust must be "untrusted" when set`);
+                }
+                else {
+                    trust[v.name] = "untrusted";
+                }
+            }
+        }
+        else {
+            problems.push('prompt.variables entries must be a string or {name, "x-trust"?: "untrusted"}');
+        }
+    }
+    return Object.keys(trust).length > 0 ? { names, trust } : { names };
+}
+/** Parse the optional `grounding.assembly` knob (S1). `legacy` (default, absent)
+ * = byte-identical system-prompt injection; `spotlight` = untrusted user-slot
+ * block via the provenance assembler. The flip is bake-off-gated (spec §2.4). */
+function parseGroundingAssembly(grounding, problems) {
+    const asm = grounding.assembly;
+    if (asm === undefined)
+        return undefined;
+    if (asm !== "legacy" && asm !== "spotlight") {
+        problems.push('grounding.assembly must be "legacy" or "spotlight"');
+        return undefined;
+    }
+    return asm;
+}

package/dist/routes/template.d.ts

@@ -10,6 +10,16 @@ import type { CapabilityFlag } from "../types/provider";
 export interface RenderContext {
     readonly variables: Record<string, unknown>;
     readonly capabilities: ReadonlySet<CapabilityFlag>;
+    /** Screening S2 (SC-0 B3): variables annotated `x-trust: untrusted` are
+     * removed from the (trusted) system slot — their `{{var}}` renders empty —
+     * and delivered instead as a spotlighted untrusted user-slot block (see
+     * run/grounding.ts `untrustedUserBlock`). The untrusted-input policy sentence
+     * for the system slot is NOT emitted here: the provenance assembler owns it as
+     * a single source (run/grounding.ts `untrustedSystemAppend`, screening F2), so
+     * it fires exactly once whenever any untrusted segment is delivered — including
+     * an x-trust variable that is not referenced in this template. Absent ⇒ every
+     * variable renders in place (default). */
+    readonly variableTrust?: Readonly<Record<string, "untrusted">>;
 }
 export declare function renderTemplate(template: string, ctx: RenderContext): string;
 /** Distinct {{var}} names referenced anywhere in the template (loader

package/dist/routes/template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"template.d.ts","sourceRoot":"","sources":["../../src/routes/template.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,cAAc,CAAC,CAAC;CACpD;AAuFD,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,GAAG,MAAM,CAE3E;AAED;+DAC+D;AAC/D,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAIzE"}
+{"version":3,"file":"template.d.ts","sourceRoot":"","sources":["../../src/routes/template.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,cAAc,CAAC,CAAC;IACnD;;;;;;;;8CAQ0C;IAC1C,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;CAChE;AAkGD,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,GAAG,MAAM,CAM3E;AAED;+DAC+D;AAC/D,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAIzE"}

package/dist/routes/template.js

@@ -69,12 +69,19 @@ function resolveConditionals(template, capabilities) {
     }
     return out + template.slice(cursor);
 }
-/** Pass 2: substitute {{var}} from ctx.variables; missing variables throw. */
-function substituteVariables(template, variables) {
+/** Pass 2: substitute {{var}} from ctx.variables; missing variables throw. A
+ * variable annotated `x-trust: untrusted` renders EMPTY here — the
+ * security-critical system-slot removal — because it is spotlighted into the
+ * user slot instead. The paired policy sentence for the system slot is emitted
+ * by the provenance assembler, not here (screening F2, single owner). */
+function substituteVariables(template, variables, variableTrust) {
     return template.replace(VAR_TAG, (_match, name) => {
         if (!(name in variables)) {
             throw new Error(`template error: missing variable "${name}"`);
         }
+        if (variableTrust?.[name] === "untrusted") {
+            return "";
+        }
         const value = variables[name];
         if (typeof value === "string")
             return value;
@@ -82,7 +89,7 @@ function substituteVariables(template, variables) {
     });
 }
 function renderTemplate(template, ctx) {
-    return substituteVariables(resolveConditionals(template, ctx.capabilities), ctx.variables);
+    return substituteVariables(resolveConditionals(template, ctx.capabilities), ctx.variables, ctx.variableTrust);
 }
 /** Distinct {{var}} names referenced anywhere in the template (loader
  * validation: every reference must be a declared variable). */

package/dist/run/accept.d.ts

@@ -34,8 +34,12 @@ export interface SuccessMetaInput {
     readonly callId: string;
     /** Grounding-inject citations, when the search rung served this run. */
     readonly citations?: RunMeta["citations"];
+    /** Grounding hygiene counters (SC-0 B3 S5) — dropped-citation count. */
+    readonly grounding?: RunMeta["grounding"];
     /** Q1 quality verdict, when a gate ran on this run. */
     readonly quality?: RunMeta["quality"];
+    /** CS-1 mask receipt (spec §6) — counts-only, when the route masks. */
+    readonly mask?: RunMeta["mask"];
 }
 /** The validated `RunMeta` for the accept path — `repairedBy` is null here (the
  * repair path builds its own meta), `validated` is always true. */

package/dist/run/accept.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"accept.d.ts","sourceRoot":"","sources":["../../src/run/accept.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE;;;iDAGiD;AACjD,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,YAAY,EACvB,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,OAAO,EACvB,OAAO,EAAE,UAAU,GAAG,IAAI,EAC1B,UAAU,EAAE,iBAAiB,EAC7B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC,gBAAgB,CAiBlB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IAChE,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1C,uDAAuD;IACvD,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;CACvC;AAED;mEACmE;AACnE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAuBjE"}
+{"version":3,"file":"accept.d.ts","sourceRoot":"","sources":["../../src/run/accept.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE;;;iDAGiD;AACjD,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,YAAY,EACvB,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,OAAO,EACvB,OAAO,EAAE,UAAU,GAAG,IAAI,EAC1B,UAAU,EAAE,iBAAiB,EAC7B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC,gBAAgB,CAiBlB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IAChE,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1C,wEAAwE;IACxE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1C,uDAAuD;IACvD,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACtC,uEAAuE;IACvE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;CACjC;AAED;mEACmE;AACnE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAyBjE"}

package/dist/run/accept.js

@@ -60,6 +60,8 @@ function buildSuccessMeta(input) {
         repairedBy: null,
         callId: input.callId,
         ...(input.citations !== undefined ? { citations: input.citations } : {}),
+        ...(input.grounding !== undefined ? { grounding: input.grounding } : {}),
         ...(input.quality !== undefined ? { quality: input.quality } : {}),
+        ...(input.mask !== undefined ? { mask: input.mask } : {}),
     };
 }

package/dist/run/dispatch.d.ts

@@ -14,6 +14,9 @@ import type { RouteBundle, RunMeta, RunOptions, RunResult, RunTags } from "../ty
 import type { TelemetryRung, TelemetryStore } from "../types/telemetry";
 import type { AttemptMetaSource } from "../telemetry/attempt-meta";
 import type { LadderKeyMinter } from "./ladder-key";
+import type { MaskReceipt, ResolvedMaskPolicy } from "../mask/types";
+import type { RunVault } from "../mask/vault";
+import { type MaskSeam } from "../mask/seam";
 /** One telemetry attempt row's inputs — shared with run.ts's recordAttempt so
  * the tool-call helper here can record through the same closure. */
 export interface AttemptTelemetry {
@@ -49,6 +52,10 @@ export interface AttemptTelemetry {
      * `quality` / `quality_score` here). Never carries `rung` — the recorder
      * stamps that last so a caller cannot override it. */
     readonly extraTags?: Record<string, string>;
+    /** CS-1 Proven Masking receipt (spec §6) — the counts-only mask summary for
+     * this attempt, written to `inferences.mask` by record-attempt.ts. Present
+     * only on a masked route; NEVER a matched value. Additive & optional. */
+    readonly mask?: MaskReceipt;
 }
 /** Assemble the recorder's `metaInputs` from a completed dispatch (WI-1) — the
  * adapter's native meta plus the rendered request (system+user+schema, hashed)
@@ -105,6 +112,34 @@ export declare function buildRepairAdapterRequest(route: RouteBundle, candidate:
  * buffered `call()`.
  */
 export declare function dispatchCandidate(adapter: ProviderAdapter, req: AdapterRequest, onDelta?: StreamDeltaSink): Promise<AdapterResult>;
+/** The active mask context for one run: the route's resolved policy + the
+ * run-scoped vault (shared across attempts so a value keeps one token). */
+export interface MaskContext {
+    readonly policy: ResolvedMaskPolicy;
+    readonly vault: RunVault;
+}
+/** The outcome of a build+mask+dispatch (CS-1 seam, spec §1.2). Carries the
+ * (possibly masked) request, the adapter result, measured latency, and the
+ * per-attempt {@link MaskSeam} the run loop uses to rehydrate the response and
+ * build the receipt. `maskRefusal` is set when masking FAILED CLOSED
+ * pre-dispatch (`block` found a match, or a detector threw in mask/block) — no
+ * request was sent, and the run loop fails the run with `invariant_violation`. */
+export interface DispatchOutcome {
+    readonly request: AdapterRequest;
+    readonly result: AdapterResult;
+    readonly latencyMs: number;
+    readonly seam: MaskSeam | null;
+    readonly maskRefusal?: "blocked" | "error";
+}
+/**
+ * Build the primary AdapterRequest, mask its outgoing user slot when the route
+ * has an active policy (spec §1.2 — "rewrites the AdapterRequest before dispatch
+ * and rehydrates the AdapterResult after"), dispatch, and time it. With no mask
+ * context this is byte-identical to `buildAdapterRequest` + `dispatchCandidate`
+ * (the golden test). The trusted system slot is never masked (B3 keeps untrusted
+ * content in the user path).
+ */
+export declare function buildDispatchMaybeMasked(adapter: ProviderAdapter, parts: PrimaryRequestParts, onDelta: StreamDeltaSink | undefined, mask: MaskContext | null): Promise<DispatchOutcome>;
 export interface ToolCallResultParts {
     readonly route: RouteBundle;
     readonly candidate: CandidateRef;

package/dist/run/dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../src/run/dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,aAAa,EACb,YAAY,EACZ,eAAe,EACf,cAAc,EACf,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC3F,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAInE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD;oEACoE;AACpE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;6DACyD;IACzD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;0BACsB;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI,CAAC;IACpC,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC;;gEAE4D;IAC5D,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC;IAC9B;;;uFAGmF;IACnF,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC;IACxC;;0DAEsD;IACtD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C;AAED;;;+DAG+D;AAC/D,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;CAC5C,GAAG,iBAAiB,CAWpB;AAED;gEACgE;AAChE,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,gBAAgB,KAAK,MAAM,CAAC;AAElE;;4EAE4E;AAC5E,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,cAAc,EACzB,KAAK,EAAE,WAAW,EAClB,aAAa,EAAE,OAAO,EACtB,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,gBAAgB,EAAE,MAAM,EACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,eAAe,GACtB,IAAI,CAoCN;AAED;;8EAE8E;AAC9E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAYvD;AAED;;0CAE0C;AAC1C,MAAM,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,KAAK,IAAI,CAAC;AAEzE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B;;oEAEgE;IAChE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;CAC1C;AAED;uDACuD;AACvD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc,CAgC9E;AAED;4CAC4C;AAC5C,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,WAAW,EAClB,SAAS,EAAE,YAAY,EACvB,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,MAAM,GACtB,cAAc,CAmBhB;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE,cAAc,EACnB,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,aAAa,CAAC,CAuBxB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACrD,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;kDAC8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC;CACzC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,mBAAmB,GAAG,SAAS,CAiD/F"}
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../src/run/dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,aAAa,EACb,YAAY,EACZ,eAAe,EACf,cAAc,EACf,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC3F,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAInE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,cAAc,CAAC;AAE7D;oEACoE;AACpE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;6DACyD;IACzD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;0BACsB;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI,CAAC;IACpC,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC;;gEAE4D;IAC5D,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC;IAC9B;;;uFAGmF;IACnF,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC;IACxC;;0DAEsD;IACtD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C;;6EAEyE;IACzE,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC;CAC7B;AAED;;;+DAG+D;AAC/D,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;CAC5C,GAAG,iBAAiB,CAWpB;AAED;gEACgE;AAChE,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,gBAAgB,KAAK,MAAM,CAAC;AAElE;;4EAE4E;AAC5E,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,cAAc,EACzB,KAAK,EAAE,WAAW,EAClB,aAAa,EAAE,OAAO,EACtB,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,gBAAgB,EAAE,MAAM,EACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,eAAe,GACtB,IAAI,CAoCN;AAED;;8EAE8E;AAC9E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAYvD;AAED;;0CAE0C;AAC1C,MAAM,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,KAAK,IAAI,CAAC;AAEzE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B;;oEAEgE;IAChE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;CAC1C;AAED;uDACuD;AACvD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc,CAgC9E;AAED;4CAC4C;AAC5C,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,WAAW,EAClB,SAAS,EAAE,YAAY,EACvB,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,MAAM,GACtB,cAAc,CAmBhB;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE,cAAc,EACnB,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,aAAa,CAAC,CAuBxB;AAED;2EAC2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;kFAKkF;AAClF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC;CAC5C;AAED;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,eAAe,GAAG,SAAS,EACpC,IAAI,EAAE,WAAW,GAAG,IAAI,GACvB,OAAO,CAAC,eAAe,CAAC,CAsB1B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACrD,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;kDAC8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC;CACzC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,mBAAmB,GAAG,SAAS,CAiD/F"}

package/dist/run/dispatch.js

@@ -16,11 +16,13 @@ exports.jsonModeCoaching = jsonModeCoaching;
 exports.buildAdapterRequest = buildAdapterRequest;
 exports.buildRepairAdapterRequest = buildRepairAdapterRequest;
 exports.dispatchCandidate = dispatchCandidate;
+exports.buildDispatchMaybeMasked = buildDispatchMaybeMasked;
 exports.emitToolCallResult = emitToolCallResult;
 const node_crypto_1 = require("node:crypto");
 const attempt_meta_1 = require("../telemetry/attempt-meta");
 const cache_stamp_1 = require("./cache-stamp");
 const cache_handle_1 = require("./cache-handle");
+const seam_1 = require("../mask/seam");
 /** Assemble the recorder's `metaInputs` from a completed dispatch (WI-1) — the
  * adapter's native meta plus the rendered request (system+user+schema, hashed)
  * and the output text (hashed). One helper so the routed lane's several record
@@ -179,6 +181,37 @@ async function dispatchCandidate(adapter, req, onDelta) {
         },
     });
 }
+/**
+ * Build the primary AdapterRequest, mask its outgoing user slot when the route
+ * has an active policy (spec §1.2 — "rewrites the AdapterRequest before dispatch
+ * and rehydrates the AdapterResult after"), dispatch, and time it. With no mask
+ * context this is byte-identical to `buildAdapterRequest` + `dispatchCandidate`
+ * (the golden test). The trusted system slot is never masked (B3 keeps untrusted
+ * content in the user path).
+ */
+async function buildDispatchMaybeMasked(adapter, parts, onDelta, mask) {
+    const built = buildAdapterRequest(parts);
+    if (mask === null) {
+        const started = Date.now();
+        const result = await dispatchCandidate(adapter, built, onDelta);
+        return { request: built, result, latencyMs: Date.now() - started, seam: null };
+    }
+    const seam = (0, seam_1.createMaskSeam)(mask.policy, mask.vault);
+    const outcome = seam.maskRequest(built);
+    if (outcome.kind !== "ok") {
+        // Fail closed: no request is sent. The run loop refuses pre-dispatch.
+        return {
+            request: built,
+            result: { ok: false, failure: { class: "invariant_violation", message: `masking failed closed (${outcome.kind})`, provider: parts.candidate.provider, model: parts.candidate.model } },
+            latencyMs: 0,
+            seam,
+            maskRefusal: outcome.kind,
+        };
+    }
+    const started = Date.now();
+    const result = await dispatchCandidate(adapter, outcome.request, onDelta);
+    return { request: outcome.request, result, latencyMs: Date.now() - started, seam };
+}
 /**
  * Record a tool-call turn and build its RunResult (spec §4.4). A tool call is
  * NOT a schema-validated JSON turn: it records a normal (non-failure) telemetry