modelrig 0.8.0 → 0.9.0

package/dist/init/observe.js

@@ -16,8 +16,8 @@
  * agent (or human) to apply with judgment, one step at a time.
  *
  * Observe is deliberately NOT migration: it drafts no routes, reroutes no
- * model calls, and changes no behaviour. With `MODELRIG_ARTIFACTS` off the
- * pipeline is byte-for-byte identical (instrumentation.md).
+ * model calls, and changes no behaviour. With no control plane configured (or the
+ * org capture posture `off`) the pipeline is byte-for-byte identical (instrumentation.md).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.stepKeyFor = stepKeyFor;
@@ -49,8 +49,8 @@ function seamContent() {
  * deleted seam) so it always matches the current SDK. It records each pipeline
  * run as a run -> step -> artifact chain you click through in the console.
  *
- * Observe-only: no routes move, no model calls are rerouted. With
- * MODELRIG_ARTIFACTS off (or no control plane configured) every call here is
+ * Observe-only: no routes move, no model calls are rerouted. With no control
+ * plane configured (or the org capture posture set to off) every call here is
  * inert and your pipeline behaves byte-for-byte as before. Nothing here ever
  * throws into your pipeline — a telemetry write that fails is logged and
  * dropped (instrumentation.md, "Never throws into your pipeline").
@@ -99,7 +99,7 @@ export function recordStep(
   const parsed = rig.artifacts.artifact.save(work.json, { name: \`\${stepKey}.output\`, type: "step_output", task: stepKey, stepKey });
   if (p && parsed) rig.artifacts.artifact.link(parsed, p, "derived_from");
   if (raw && parsed) rig.artifacts.artifact.link(parsed, raw, "derived_from");
-  if (parsed) rig.artifacts.artifact.evaluate(parsed, { evaluator: "schema-check", kind: "deterministic", passed: work.conforms });
+  if (parsed) rig.grade({ kind: "artifact", id: parsed.id }, { score: work.conforms ? 1 : 0, kind: "deterministic", grader: "schema-check" });
 }
 `;
 }
@@ -146,10 +146,14 @@ function buildObserveMarkdown(plans, seamPath, result, path) {
         "each is proposed as one instrumented **step**. Apply the diffs one step at a time — a step",
         "you do not understand yet is a step you can leave for later.",
         "",
-        "## 1. Turn the namespace on",
+        "## 1. Point at the console (one step, once)",
+        "",
+        "Capture is **on by default** — one API key turns everything on, and you opt out later in",
+        "your **account settings** (the org capture posture), never with an env var. There is no",
+        "capture flag to set: once `MODELRIG_API_KEY` is present the run/step/artifact namespace is on.",
         "",
         "```bash",
-        "export MODELRIG_ARTIFACTS=1                 # enable the artifact namespace",
+        "export MODELRIG_API_KEY=<key>               # mint at https://app.modelrig.ai (/keys)",
         "# export MODELRIG_ARTIFACT_STEPS=step_a,step_b   # optional: instrument a subset",
         "```",
         "",

package/dist/mask/arm.d.ts

@@ -0,0 +1,112 @@
+/**
+ * CS-1 Chunk B — the masked-vs-unmasked value-accuracy arm (spec §7).
+ *
+ * Chunk A proved the load-bearing property: no detected span leaves (proof.ts,
+ * leakage-only, offline over captures). Chunk B answers the customer's second
+ * question — "did masking change the answer?" — by replaying the route's
+ * captures twice against the INCUMBENT model only:
+ *   - control    = the route with masking OFF (byte-identical to pre-CS-1)
+ *   - treatment  = the route's real `mask:` policy (mask → dispatch → rehydrate)
+ * and diffing per-sample quality with a paired-bootstrap CI, then gating
+ * promotion on the policy's `tolerance` block (value_accuracy_delta_max /
+ * conformance_delta_max). PR-as-actuator: a `mask.mode` promotion is a route
+ * bundle change whose PR body is this report — no silent promotion.
+ *
+ * RB-1 fence: this module ONLY CALLS the RB-1 replay/stats primitives
+ * (`replayVariant`, `pairedRegret`, `aggregateVariantMetrics`, `wilson95`). It
+ * does not restructure `engine.ts`/`replay.ts`/`stats.ts`. The mask arm is a
+ * standalone report (it composes the Chunk-A leak proof + the Chunk-B Δ), not a
+ * restructured `BakeoffArtifact` — flagged for the architect (P2).
+ *
+ * Counts-never-values: every field emitted here is a number, an enum, a policy
+ * hash, or a capture id — never a matched value (asserted by the
+ * receipt-invariant property test, extended in Chunk B to this report).
+ */
+import type { CaptureStore } from "../telemetry/capture";
+import type { LoadedRoutes } from "../routes/loader";
+import type { RunDeps } from "../run/run";
+import { type ReplaySampleResult } from "../bakeoff/replay";
+import type { ResolvedMaskPolicy, MaskTolerance } from "./types";
+import { type MaskArmProof } from "./proof";
+/** Minimum paired samples before the separation gate may say "promotable"
+ * (mirrors engine.ts's `nPaired >= 10` floor — a Δ over <10 pairs is noise). */
+export declare const MASK_ARM_MIN_PAIRED = 10;
+/** A single fixture whose quality dropped most under masking — id + magnitude
+ * only (spec §7.2 "the per-fixture worst offenders (fixture ids + types, never
+ * values)"). */
+export interface MaskArmOffender {
+    readonly captureId: string;
+    readonly qualityDrop: number;
+}
+/** The masked-vs-unmasked Δ (spec §7). All counts/rates/CIs — never a value. */
+export interface MaskArmDelta {
+    readonly policyHash: string;
+    readonly nPaired: number;
+    readonly controlValueAccuracyMean: number | null;
+    readonly treatmentValueAccuracyMean: number | null;
+    /** mean q(control) − q(treatment): how much masking dropped quality. */
+    readonly valueAccuracyDelta: number;
+    readonly valueAccuracyDeltaCi95: readonly [number, number];
+    readonly controlConformRate: number;
+    readonly treatmentConformRate: number;
+    readonly conformanceDelta: number;
+    readonly conformanceDeltaCi95: readonly [number, number];
+    readonly tolerance: MaskTolerance | null;
+    /** value-accuracy Δ CI upper bound within tolerance (CI not excluding zero harm). */
+    readonly valueAccuracyOk: boolean;
+    readonly conformanceOk: boolean;
+    /** promotable ⇒ gate clears AND enough pairs AND no leak (set by the caller). */
+    readonly promotable: boolean;
+    readonly worstOffenders: readonly MaskArmOffender[];
+}
+/** The masked-arm report — a bake-off report of `kind: mask-policy` (spec §7.1),
+ * the artifact that (a) renders as the promotion PR body, (b) maps to a
+ * `Receipt@v1 kind: masking-proof` (RP-0), (c) feeds the console Control card. */
+export interface MaskArmReport {
+    readonly kind: "mask-policy";
+    readonly route: string;
+    readonly routeVersion: number;
+    readonly ranAt: string;
+    readonly policyHash: string;
+    readonly replayN: number;
+    readonly models: readonly {
+        readonly provider: string;
+        readonly model: string;
+    }[];
+    /** Chunk-A leak proof over the same captures — the load-bearing invariant. */
+    readonly proof: MaskArmProof;
+    /** Chunk-B value-accuracy Δ. */
+    readonly delta: MaskArmDelta;
+}
+/** Wrap a `LoadedRoutes` so the target route resolves with masking stripped —
+ * the control (unmasked) arm. Only `.mask` is cleared, and only for `route`;
+ * every other field and route is untouched, so the control arm is byte-identical
+ * to the pre-CS-1 path (the golden). */
+export declare function stripMaskFromRoutes(routes: LoadedRoutes, route: string): LoadedRoutes;
+/**
+ * Compute the masked-vs-unmasked Δ from two replay passes over the SAME captures
+ * (same incumbent model; masking the only difference). Pure — reuses stats.ts.
+ * `pairedRegret(treatment, control)` yields mean q(control) − q(treatment), i.e.
+ * the quality DROP caused by masking, with a seeded paired-bootstrap CI.
+ */
+export declare function computeMaskArmDelta(policy: ResolvedMaskPolicy, control: readonly ReplaySampleResult[], treatment: readonly ReplaySampleResult[]): MaskArmDelta;
+export interface MaskArmBakeoffRequest {
+    readonly route: string;
+    readonly replayLast: number;
+    readonly envelopeUsd: number;
+    /** Injectable clock for deterministic `ranAt` in tests. */
+    readonly now?: () => Date;
+}
+/**
+ * Run the full masked-arm bake-off: replay the incumbent twice (control =
+ * unmasked, treatment = masked), diff, gate, and compose the report with the
+ * Chunk-A leak proof over the same captures. Real (billed) dispatches — the
+ * live run over the demo-rig / InferWealth corpus is deferred to a
+ * provider-keyed session; unit tests drive it with a fake adapter.
+ */
+export declare function runMaskArmBakeoff(deps: RunDeps, captures: CaptureStore, req: MaskArmBakeoffRequest): Promise<MaskArmReport>;
+/** Render the masked-arm report as counts-only Markdown — the promotion PR body
+ * (spec §7.3) and the verification-doc artifact. Extends `formatMaskArmReport`
+ * (the Chunk-A leak block) with the Chunk-B Δ + separation gate. */
+export declare function formatMaskArmReportFull(report: MaskArmReport): string;
+//# sourceMappingURL=arm.d.ts.map

package/dist/mask/arm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"arm.d.ts","sourceRoot":"","sources":["../../src/mask/arm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAiB,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAA4B,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AAItE;mFACmF;AACnF,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAItC;;gBAEgB;AAChB,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,gFAAgF;AAChF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjD,QAAQ,CAAC,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IACnD,wEAAwE;IACxE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,sBAAsB,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3D,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,oBAAoB,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzD,QAAQ,CAAC,SAAS,EAAE,aAAa,GAAG,IAAI,CAAC;IACzC,qFAAqF;IACrF,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,iFAAiF;IACjF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,SAAS,eAAe,EAAE,CAAC;CACrD;AAED;;kFAEkF;AAClF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAClF,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,gCAAgC;IAChC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;CAC9B;AAED;;;wCAGwC;AACxC,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,GAAG,YAAY,CAOrF;AAaD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,EAAE,SAAS,kBAAkB,EAAE,EACtC,SAAS,EAAE,SAAS,kBAAkB,EAAE,GACvC,YAAY,CA0Cd;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,YAAY,EACtB,GAAG,EAAE,qBAAqB,GACzB,OAAO,CAAC,aAAa,CAAC,CA0CxB;AAMD;;oEAEoE;AACpE,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CA8BrE"}

package/dist/mask/arm.js

@@ -0,0 +1,179 @@
+"use strict";
+/**
+ * CS-1 Chunk B — the masked-vs-unmasked value-accuracy arm (spec §7).
+ *
+ * Chunk A proved the load-bearing property: no detected span leaves (proof.ts,
+ * leakage-only, offline over captures). Chunk B answers the customer's second
+ * question — "did masking change the answer?" — by replaying the route's
+ * captures twice against the INCUMBENT model only:
+ *   - control    = the route with masking OFF (byte-identical to pre-CS-1)
+ *   - treatment  = the route's real `mask:` policy (mask → dispatch → rehydrate)
+ * and diffing per-sample quality with a paired-bootstrap CI, then gating
+ * promotion on the policy's `tolerance` block (value_accuracy_delta_max /
+ * conformance_delta_max). PR-as-actuator: a `mask.mode` promotion is a route
+ * bundle change whose PR body is this report — no silent promotion.
+ *
+ * RB-1 fence: this module ONLY CALLS the RB-1 replay/stats primitives
+ * (`replayVariant`, `pairedRegret`, `aggregateVariantMetrics`, `wilson95`). It
+ * does not restructure `engine.ts`/`replay.ts`/`stats.ts`. The mask arm is a
+ * standalone report (it composes the Chunk-A leak proof + the Chunk-B Δ), not a
+ * restructured `BakeoffArtifact` — flagged for the architect (P2).
+ *
+ * Counts-never-values: every field emitted here is a number, an enum, a policy
+ * hash, or a capture id — never a matched value (asserted by the
+ * receipt-invariant property test, extended in Chunk B to this report).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MASK_ARM_MIN_PAIRED = void 0;
+exports.stripMaskFromRoutes = stripMaskFromRoutes;
+exports.computeMaskArmDelta = computeMaskArmDelta;
+exports.runMaskArmBakeoff = runMaskArmBakeoff;
+exports.formatMaskArmReportFull = formatMaskArmReportFull;
+const replay_1 = require("../bakeoff/replay");
+const stats_1 = require("../bakeoff/stats");
+const proof_1 = require("./proof");
+/** Slack for a floating-point threshold comparison — mirrors engine.ts's gate EPS. */
+const GATE_EPS = 1e-9;
+/** Minimum paired samples before the separation gate may say "promotable"
+ * (mirrors engine.ts's `nPaired >= 10` floor — a Δ over <10 pairs is noise). */
+exports.MASK_ARM_MIN_PAIRED = 10;
+/** How many worst-offending fixtures the report lists (ids + drop, never values). */
+const WORST_OFFENDERS = 5;
+/** Wrap a `LoadedRoutes` so the target route resolves with masking stripped —
+ * the control (unmasked) arm. Only `.mask` is cleared, and only for `route`;
+ * every other field and route is untouched, so the control arm is byte-identical
+ * to the pre-CS-1 path (the golden). */
+function stripMaskFromRoutes(routes, route) {
+    const strip = (b) => b.route === route && b.mask !== undefined ? { ...b, mask: undefined } : b;
+    return {
+        get: (r) => strip(routes.get(r)),
+        list: () => routes.list().map(strip),
+    };
+}
+/** Per-sample quality forced to conformance only (value score dropped), so the
+ * shared `pairedRegret` bootstrap yields a conformance-specific Δ CI. */
+function conformanceOnly(s) {
+    return { ...s, valueAccuracy: null };
+}
+function meanOrNull(xs) {
+    const nums = xs.filter((x) => x !== null);
+    return nums.length === 0 ? null : nums.reduce((a, b) => a + b, 0) / nums.length;
+}
+/**
+ * Compute the masked-vs-unmasked Δ from two replay passes over the SAME captures
+ * (same incumbent model; masking the only difference). Pure — reuses stats.ts.
+ * `pairedRegret(treatment, control)` yields mean q(control) − q(treatment), i.e.
+ * the quality DROP caused by masking, with a seeded paired-bootstrap CI.
+ */
+function computeMaskArmDelta(policy, control, treatment) {
+    const va = (0, stats_1.pairedRegret)(treatment, control);
+    const conf = (0, stats_1.pairedRegret)(treatment.map(conformanceOnly), control.map(conformanceOnly));
+    const controlMetrics = (0, stats_1.aggregateVariantMetrics)("control", control);
+    const treatmentMetrics = (0, stats_1.aggregateVariantMetrics)("masked", treatment);
+    const tolerance = policy.policy.tolerance ?? null;
+    const valueAccuracyOk = tolerance === null ? false : va.regretCi95[1] <= tolerance.value_accuracy_delta_max + GATE_EPS;
+    const conformanceOk = tolerance === null ? false : conf.regretMean <= tolerance.conformance_delta_max + GATE_EPS;
+    const promotable = valueAccuracyOk && conformanceOk && va.nPaired >= exports.MASK_ARM_MIN_PAIRED;
+    // Worst offenders: per-capture quality drop q(control) − q(treatment), the
+    // fixtures masking hurt most — ids + magnitude only (spec §7.2).
+    const controlByCapture = new Map(control.map((s) => [s.captureId, s]));
+    const drops = [];
+    for (const t of treatment) {
+        const c = controlByCapture.get(t.captureId);
+        if (c === undefined)
+            continue;
+        const drop = (c.valueAccuracy ?? (c.conform ? 1 : 0)) - (t.valueAccuracy ?? (t.conform ? 1 : 0));
+        if (drop > 0)
+            drops.push({ captureId: t.captureId, qualityDrop: drop });
+    }
+    drops.sort((a, b) => b.qualityDrop - a.qualityDrop);
+    return {
+        policyHash: policy.policyHash,
+        nPaired: va.nPaired,
+        controlValueAccuracyMean: meanOrNull(control.map((s) => s.valueAccuracy)),
+        treatmentValueAccuracyMean: meanOrNull(treatment.map((s) => s.valueAccuracy)),
+        valueAccuracyDelta: va.regretMean,
+        valueAccuracyDeltaCi95: va.regretCi95,
+        controlConformRate: controlMetrics.conformRate,
+        treatmentConformRate: treatmentMetrics.conformRate,
+        conformanceDelta: conf.regretMean,
+        conformanceDeltaCi95: conf.regretCi95,
+        tolerance,
+        valueAccuracyOk,
+        conformanceOk,
+        promotable,
+        worstOffenders: drops.slice(0, WORST_OFFENDERS),
+    };
+}
+/**
+ * Run the full masked-arm bake-off: replay the incumbent twice (control =
+ * unmasked, treatment = masked), diff, gate, and compose the report with the
+ * Chunk-A leak proof over the same captures. Real (billed) dispatches — the
+ * live run over the demo-rig / InferWealth corpus is deferred to a
+ * provider-keyed session; unit tests drive it with a fake adapter.
+ */
+async function runMaskArmBakeoff(deps, captures, req) {
+    const bundle = deps.routes.get(req.route);
+    if (bundle.mask === undefined) {
+        throw new Error(`route "${req.route}" has no active mask: policy (mode: mask) — add one before running the masked arm`);
+    }
+    const policy = bundle.mask;
+    const replayReq = {
+        route: req.route,
+        variant: "default",
+        lastN: req.replayLast,
+        envelopeUsd: req.envelopeUsd,
+    };
+    // Treatment: the route as configured (masking ON). Control: masking stripped.
+    const treatment = await (0, replay_1.replayVariant)(deps, captures, replayReq);
+    const control = await (0, replay_1.replayVariant)({ ...deps, routes: stripMaskFromRoutes(deps.routes, req.route) }, captures, replayReq);
+    // The Chunk-A leak proof over the same captures — the invariant that gates all.
+    const proof = (0, proof_1.proveMaskArmFromCaptures)(captures.readLast(req.route, req.replayLast), policy);
+    const baseDelta = computeMaskArmDelta(policy, control, treatment);
+    // A leak voids promotion regardless of the Δ (fail closed on the invariant).
+    const delta = { ...baseDelta, promotable: baseDelta.promotable && proof.proven };
+    const incumbent = bundle.candidates[0];
+    return {
+        kind: "mask-policy",
+        route: req.route,
+        routeVersion: bundle.version,
+        ranAt: (req.now ?? (() => new Date()))().toISOString(),
+        policyHash: policy.policyHash,
+        replayN: proof.samples,
+        models: incumbent !== undefined ? [{ provider: incumbent.provider, model: incumbent.model }] : [],
+        proof,
+        delta,
+    };
+}
+function pct(x) {
+    return (x * 100).toFixed(2);
+}
+/** Render the masked-arm report as counts-only Markdown — the promotion PR body
+ * (spec §7.3) and the verification-doc artifact. Extends `formatMaskArmReport`
+ * (the Chunk-A leak block) with the Chunk-B Δ + separation gate. */
+function formatMaskArmReportFull(report) {
+    const d = report.delta;
+    const lines = [];
+    lines.push(`### Masked-arm report — kind: mask-policy — route \`${report.route}\` v${report.routeVersion}`);
+    lines.push("");
+    lines.push(`- policy: \`${report.policyHash.slice(0, 12)}…\``);
+    lines.push(`- samples (leak proof): ${report.proof.samples}`);
+    lines.push(`- paired samples (Δ arm): ${d.nPaired}`);
+    lines.push(`- masked-arm leaks: ${report.proof.maskedLeaks.reduce((a, f) => a + f.count, 0)} (${report.proof.proven ? "PROVEN none" : "LEAK"})`);
+    lines.push("");
+    lines.push("| metric | control (unmasked) | masked (treatment) | Δ | CI 95% | budget | within |");
+    lines.push("|---|---|---|---|---|---|---|");
+    const vaBudget = d.tolerance !== null ? d.tolerance.value_accuracy_delta_max.toFixed(3) : "—";
+    const confBudget = d.tolerance !== null ? d.tolerance.conformance_delta_max.toFixed(3) : "—";
+    lines.push(`| value_accuracy | ${d.controlValueAccuracyMean === null ? "n/a" : d.controlValueAccuracyMean.toFixed(3)} | ${d.treatmentValueAccuracyMean === null ? "n/a" : d.treatmentValueAccuracyMean.toFixed(3)} | ${d.valueAccuracyDelta.toFixed(3)} | [${d.valueAccuracyDeltaCi95[0].toFixed(3)}, ${d.valueAccuracyDeltaCi95[1].toFixed(3)}] | ${vaBudget} | ${d.valueAccuracyOk ? "yes" : "NO"} |`);
+    lines.push(`| conformance | ${pct(d.controlConformRate)}% | ${pct(d.treatmentConformRate)}% | ${d.conformanceDelta.toFixed(3)} | [${d.conformanceDeltaCi95[0].toFixed(3)}, ${d.conformanceDeltaCi95[1].toFixed(3)}] | ${confBudget} | ${d.conformanceOk ? "yes" : "NO"} |`);
+    lines.push("");
+    lines.push(`**Gate: ${d.promotable ? "promotable" : "blocked-by-evidence"}** (n_paired ${d.nPaired}${d.nPaired < exports.MASK_ARM_MIN_PAIRED ? ` &lt; ${exports.MASK_ARM_MIN_PAIRED} floor` : ""}). PR-as-actuator — promotion is a route-bundle PR, never silent.`);
+    if (d.worstOffenders.length > 0) {
+        lines.push("");
+        lines.push("Worst-offending fixtures (ids + quality drop, never values):");
+        for (const o of d.worstOffenders)
+            lines.push(`- \`${o.captureId}\` · −${o.qualityDrop.toFixed(3)}`);
+    }
+    return lines.join("\n");
+}

package/dist/mask/index.d.ts

@@ -18,4 +18,6 @@ export { createMaskSeam, resetMaskWarningsForTest } from "./seam";
 export type { MaskSeam, MaskRequestOutcome } from "./seam";
 export { proveMaskedArm, formatMaskArmReport, proveMaskArmFromCaptures, collectStringLeaves } from "./proof";
 export type { MaskArmProof } from "./proof";
+export { runMaskArmBakeoff, computeMaskArmDelta, formatMaskArmReportFull, stripMaskFromRoutes, MASK_ARM_MIN_PAIRED, } from "./arm";
+export type { MaskArmReport, MaskArmDelta, MaskArmOffender, MaskArmBakeoffRequest } from "./arm";
 //# sourceMappingURL=index.d.ts.map

package/dist/mask/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mask/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,cAAc,SAAS,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AACxG,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC5D,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC/F,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EACL,QAAQ,EACR,SAAS,EACT,aAAa,EACb,cAAc,EACd,sBAAsB,GACvB,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,QAAQ,CAAC;AAClE,YAAY,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAC7G,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mask/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,cAAc,SAAS,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AACxG,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC5D,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC/F,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EACL,QAAQ,EACR,SAAS,EACT,aAAa,EACb,cAAc,EACd,sBAAsB,GACvB,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,QAAQ,CAAC;AAClE,YAAY,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAC7G,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,OAAO,CAAC;AACf,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,OAAO,CAAC"}

package/dist/mask/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.collectStringLeaves = exports.proveMaskArmFromCaptures = exports.formatMaskArmReport = exports.proveMaskedArm = exports.resetMaskWarningsForTest = exports.createMaskSeam = exports.rollupFindings = exports.summarizeMask = exports.createStreamRehydrator = exports.rehydrateValue = exports.rehydrateText = exports.maskInput = exports.maskText = exports.tokenTypeLabel = exports.MAX_TOKEN_LENGTH = exports.MASK_TOKEN_PATTERN = exports.createRunVault = exports.resolveFieldTargets = exports.detectSpans = exports.parseDictionary = exports.parseMaskPolicy = exports.validateMaskPolicyShape = exports.resolveMaskPolicy = void 0;
+exports.MASK_ARM_MIN_PAIRED = exports.stripMaskFromRoutes = exports.formatMaskArmReportFull = exports.computeMaskArmDelta = exports.runMaskArmBakeoff = exports.collectStringLeaves = exports.proveMaskArmFromCaptures = exports.formatMaskArmReport = exports.proveMaskedArm = exports.resetMaskWarningsForTest = exports.createMaskSeam = exports.rollupFindings = exports.summarizeMask = exports.createStreamRehydrator = exports.rehydrateValue = exports.rehydrateText = exports.maskInput = exports.maskText = exports.tokenTypeLabel = exports.MAX_TOKEN_LENGTH = exports.MASK_TOKEN_PATTERN = exports.createRunVault = exports.resolveFieldTargets = exports.detectSpans = exports.parseDictionary = exports.parseMaskPolicy = exports.validateMaskPolicyShape = exports.resolveMaskPolicy = void 0;
 /**
  * CS-1 Proven Masking — module surface (WIRED 2026-08-24, CS-1 Chunk A).
  * Wired into the SDK via the run/dispatch seam (src/run/run.ts) and the route
@@ -52,3 +52,9 @@ Object.defineProperty(exports, "proveMaskedArm", { enumerable: true, get: functi
 Object.defineProperty(exports, "formatMaskArmReport", { enumerable: true, get: function () { return proof_1.formatMaskArmReport; } });
 Object.defineProperty(exports, "proveMaskArmFromCaptures", { enumerable: true, get: function () { return proof_1.proveMaskArmFromCaptures; } });
 Object.defineProperty(exports, "collectStringLeaves", { enumerable: true, get: function () { return proof_1.collectStringLeaves; } });
+var arm_1 = require("./arm");
+Object.defineProperty(exports, "runMaskArmBakeoff", { enumerable: true, get: function () { return arm_1.runMaskArmBakeoff; } });
+Object.defineProperty(exports, "computeMaskArmDelta", { enumerable: true, get: function () { return arm_1.computeMaskArmDelta; } });
+Object.defineProperty(exports, "formatMaskArmReportFull", { enumerable: true, get: function () { return arm_1.formatMaskArmReportFull; } });
+Object.defineProperty(exports, "stripMaskFromRoutes", { enumerable: true, get: function () { return arm_1.stripMaskFromRoutes; } });
+Object.defineProperty(exports, "MASK_ARM_MIN_PAIRED", { enumerable: true, get: function () { return arm_1.MASK_ARM_MIN_PAIRED; } });

package/dist/mask/mask-policy-cli.d.ts

@@ -1,11 +1,19 @@
 /**
  * CS-1 — `modelrig bakeoff --mask-policy <route>` handler (spec §7). Extracted
- * from cli.ts to keep it under the 700-LOC cap. Reads the route's replay
- * captures and proves, via the shared detector, that masking leaves NO detected
- * span in the masked arm (the proof is the artifact). Exit 1 if any span leaked.
+ * from cli.ts to keep it under the 700-LOC cap.
+ *
+ * Chunk A: prove, via the shared detector, that masking leaves NO detected span
+ * in the masked arm (offline over captures — no dispatch). Chunk B COMPLETES the
+ * command: replay the route's captures twice against the incumbent — unmasked
+ * (control) vs masked (treatment) — and report the value-accuracy Δ + CI + the
+ * separation gate against the policy's `tolerance` block. Exit 1 ONLY when a
+ * detected span leaks (the load-bearing invariant); a blocked-by-evidence Δ is a
+ * valid report — promotion is a route-bundle PR, never a silent CLI side effect.
+ *
+ * `--leak-only` runs just the Chunk-A offline proof (no billed dispatch).
  * Additive — it does NOT touch the RB-1 replay engine (RB-1 fence).
  */
 import type { RigConfig } from "../config";
 import type { Flags } from "../cli";
-export declare function runMaskPolicyProofCli(config: RigConfig, flags: Flags, route: string): number;
+export declare function runMaskPolicyProofCli(config: RigConfig, flags: Flags, route: string): Promise<number>;
 //# sourceMappingURL=mask-policy-cli.d.ts.map

package/dist/mask/mask-policy-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mask-policy-cli.d.ts","sourceRoot":"","sources":["../../src/mask/mask-policy-cli.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAMpC,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAgB5F"}
+{"version":3,"file":"mask-policy-cli.d.ts","sourceRoot":"","sources":["../../src/mask/mask-policy-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAQpC,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,SAAS,EACjB,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CAkCjB"}

package/dist/mask/mask-policy-cli.js

@@ -1,18 +1,28 @@
 "use strict";
 /**
  * CS-1 — `modelrig bakeoff --mask-policy <route>` handler (spec §7). Extracted
- * from cli.ts to keep it under the 700-LOC cap. Reads the route's replay
- * captures and proves, via the shared detector, that masking leaves NO detected
- * span in the masked arm (the proof is the artifact). Exit 1 if any span leaked.
+ * from cli.ts to keep it under the 700-LOC cap.
+ *
+ * Chunk A: prove, via the shared detector, that masking leaves NO detected span
+ * in the masked arm (offline over captures — no dispatch). Chunk B COMPLETES the
+ * command: replay the route's captures twice against the incumbent — unmasked
+ * (control) vs masked (treatment) — and report the value-accuracy Δ + CI + the
+ * separation gate against the policy's `tolerance` block. Exit 1 ONLY when a
+ * detected span leaks (the load-bearing invariant); a blocked-by-evidence Δ is a
+ * valid report — promotion is a route-bundle PR, never a silent CLI side effect.
+ *
+ * `--leak-only` runs just the Chunk-A offline proof (no billed dispatch).
  * Additive — it does NOT touch the RB-1 replay engine (RB-1 fence).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runMaskPolicyProofCli = runMaskPolicyProofCli;
+const index_1 = require("../index");
 const loader_1 = require("../routes/loader");
 const rawonly_1 = require("../run/rawonly");
 const capture_1 = require("../telemetry/capture");
 const proof_1 = require("./proof");
-function runMaskPolicyProofCli(config, flags, route) {
+const arm_1 = require("./arm");
+async function runMaskPolicyProofCli(config, flags, route) {
     const bundle = (0, loader_1.loadRoutes)((0, rawonly_1.requireRoutesDir)(config, "modelrig bakeoff")).get(route);
     if (bundle.mask === undefined) {
         throw new Error(`route "${route}" has no active mask: policy (mode: mask) — add one before proving the masked arm`);
@@ -21,13 +31,28 @@ function runMaskPolicyProofCli(config, flags, route) {
     const n = nRaw !== undefined ? Number(nRaw) : 25;
     if (!Number.isInteger(n) || n < 1)
         throw new Error("--replay-last must be a positive integer");
-    const captures = (0, capture_1.openCaptureStore)(config.telemetryDbPath);
+    // --leak-only: the offline invariant proof, NO billed dispatch (Chunk-A behaviour).
+    if (flags.bare.has("leak-only")) {
+        const captures = (0, capture_1.openCaptureStore)(config.telemetryDbPath);
+        try {
+            const proof = (0, proof_1.proveMaskArmFromCaptures)(captures.readLast(route, n), bundle.mask);
+            console.log((0, proof_1.formatMaskArmReport)(proof));
+            return proof.proven ? 0 : 1;
+        }
+        finally {
+            captures.close();
+        }
+    }
+    // Full masked-arm bake-off (spec §7): leak proof + value-accuracy Δ over the
+    // incumbent (real, billed replays). Live runs over the demo-rig / InferWealth
+    // corpus are deferred to a provider-keyed session (verification doc).
+    const rig = (0, index_1.createRig)(config);
     try {
-        const proof = (0, proof_1.proveMaskArmFromCaptures)(captures.readLast(route, n), bundle.mask);
-        console.log((0, proof_1.formatMaskArmReport)(proof));
-        return proof.proven ? 0 : 1;
+        const report = await rig.maskArm(route, { replayLast: n });
+        console.log((0, arm_1.formatMaskArmReportFull)(report));
+        return report.proof.proven ? 0 : 1;
     }
     finally {
-        captures.close();
+        await rig.close();
     }
 }

package/dist/query/grammar.d.ts

@@ -33,8 +33,8 @@
 import type { Classification, ColumnSource } from "./columns";
 export { describeAnalyticsSchema, evaluateAnalyticsQuery, planAnalyticsRead, ANALYTICS_SCAN_CAP, selectableColumnsAreMetaSafe, } from "./analytics";
 export type { AnalyticsSchema, AnalyticsSchemaField, AnalyticsResult, AnalyticsReadPlan, AnalyticsRow } from "./analytics";
-export { SAVED_QUERIES, savedQueryById, sinceIsoFor } from "./saved";
-export type { SavedQuery } from "./saved";
+export { SAVED_QUERIES, savedQueryById, sinceIsoFor, LAUNCH_COHORT_QUERIES, cohortQueryById } from "./saved";
+export type { SavedQuery, CohortQuery } from "./saved";
 export { DIMENSION_COLUMNS, METRIC_COLUMNS, RESERVED_DIMENSION_NAMES } from "./columns";
 export type { ColumnDef, Classification, ColumnSource } from "./columns";
 export declare class QueryGrammarError extends Error {

package/dist/query/grammar.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grammar.d.ts","sourceRoot":"","sources":["../../src/query/grammar.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAa,YAAY,EAAE,MAAM,WAAW,CAAC;AAKzE,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3H,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACrE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AACxF,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzE,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,OAAO,EAAE,MAAM;CAI5B;AAED,4CAA4C;AAC5C,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;CAAE,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;CACjD;AAID,MAAM,MAAM,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AAElD;6DAC6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9G,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AA8ID;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAgIlD;AAuBD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,aAAa,CAqC5E"}
+{"version":3,"file":"grammar.d.ts","sourceRoot":"","sources":["../../src/query/grammar.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAa,YAAY,EAAE,MAAM,WAAW,CAAC;AAKzE,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3H,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC7G,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AACxF,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzE,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,OAAO,EAAE,MAAM;CAI5B;AAED,4CAA4C;AAC5C,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;CAAE,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;CACjD;AAID,MAAM,MAAM,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AAElD;6DAC6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9G,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AA8ID;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAgIlD;AAuBD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,aAAa,CAqC5E"}

package/dist/query/grammar.js

@@ -32,7 +32,7 @@
  * enum/number/boolean/hash/identifier/timestamp (columns.ts), never content.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.QueryGrammarError = exports.RESERVED_DIMENSION_NAMES = exports.METRIC_COLUMNS = exports.DIMENSION_COLUMNS = exports.sinceIsoFor = exports.savedQueryById = exports.SAVED_QUERIES = exports.selectableColumnsAreMetaSafe = exports.ANALYTICS_SCAN_CAP = exports.planAnalyticsRead = exports.evaluateAnalyticsQuery = exports.describeAnalyticsSchema = void 0;
+exports.QueryGrammarError = exports.RESERVED_DIMENSION_NAMES = exports.METRIC_COLUMNS = exports.DIMENSION_COLUMNS = exports.cohortQueryById = exports.LAUNCH_COHORT_QUERIES = exports.sinceIsoFor = exports.savedQueryById = exports.SAVED_QUERIES = exports.selectableColumnsAreMetaSafe = exports.ANALYTICS_SCAN_CAP = exports.planAnalyticsRead = exports.evaluateAnalyticsQuery = exports.describeAnalyticsSchema = void 0;
 exports.parseQuery = parseQuery;
 exports.compileQuery = compileQuery;
 const columns_1 = require("./columns");
@@ -48,6 +48,8 @@ var saved_1 = require("./saved");
 Object.defineProperty(exports, "SAVED_QUERIES", { enumerable: true, get: function () { return saved_1.SAVED_QUERIES; } });
 Object.defineProperty(exports, "savedQueryById", { enumerable: true, get: function () { return saved_1.savedQueryById; } });
 Object.defineProperty(exports, "sinceIsoFor", { enumerable: true, get: function () { return saved_1.sinceIsoFor; } });
+Object.defineProperty(exports, "LAUNCH_COHORT_QUERIES", { enumerable: true, get: function () { return saved_1.LAUNCH_COHORT_QUERIES; } });
+Object.defineProperty(exports, "cohortQueryById", { enumerable: true, get: function () { return saved_1.cohortQueryById; } });
 var columns_2 = require("./columns");
 Object.defineProperty(exports, "DIMENSION_COLUMNS", { enumerable: true, get: function () { return columns_2.DIMENSION_COLUMNS; } });
 Object.defineProperty(exports, "METRIC_COLUMNS", { enumerable: true, get: function () { return columns_2.METRIC_COLUMNS; } });

package/dist/query/saved.d.ts

@@ -23,4 +23,17 @@ export declare const SAVED_QUERIES: readonly SavedQuery[];
 export declare function savedQueryById(id: string): SavedQuery | null;
 /** The ISO lower bound for a trailing window of `windowDays` ending at `now`. */
 export declare function sinceIsoFor(windowDays: number, now: Date): string;
+export interface CohortQuery {
+    readonly id: string;
+    readonly title: string;
+    readonly description: string;
+    /** The trailing window this measure asks over, in days. */
+    readonly windowDays: number;
+    /** Reference SQL over the control plane, `ts`/`created_at` bound filled in.
+     * Operator-run (service role); NOT the metadata-safe `/query` grammar. */
+    sql(sinceIso: string): string;
+}
+export declare const LAUNCH_COHORT_QUERIES: readonly CohortQuery[];
+/** Look up a launch cohort question by id, or null. */
+export declare function cohortQueryById(id: string): CohortQuery | null;
 //# sourceMappingURL=saved.d.ts.map

package/dist/query/saved.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"saved.d.ts","sourceRoot":"","sources":["../../src/query/saved.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,8DAA8D;IAC9D,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;CACnC;AAED,eAAO,MAAM,aAAa,EAAE,SAAS,UAAU,EA8B9C,CAAC;AAEF,+CAA+C;AAC/C,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAE5D;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,MAAM,CAEjE"}
+{"version":3,"file":"saved.d.ts","sourceRoot":"","sources":["../../src/query/saved.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,8DAA8D;IAC9D,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;CACnC;AAED,eAAO,MAAM,aAAa,EAAE,SAAS,UAAU,EA8B9C,CAAC;AAEF,+CAA+C;AAC/C,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAE5D;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,MAAM,CAEjE;AAaD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;8EAC0E;IAC1E,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;CAC/B;AAED,eAAO,MAAM,qBAAqB,EAAE,SAAS,WAAW,EA0EvD,CAAC;AAEF,uDAAuD;AACvD,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAE9D"}