modelrig 0.8.1 → 0.9.0

package/dist/run/dispatch.js

@@ -16,13 +16,17 @@ exports.jsonModeCoaching = jsonModeCoaching;
 exports.buildAdapterRequest = buildAdapterRequest;
 exports.buildRepairAdapterRequest = buildRepairAdapterRequest;
 exports.dispatchCandidate = dispatchCandidate;
+exports.buildRunGuards = buildRunGuards;
 exports.buildDispatchMaybeMasked = buildDispatchMaybeMasked;
 exports.emitToolCallResult = emitToolCallResult;
+const provider_1 = require("../types/provider");
 const node_crypto_1 = require("node:crypto");
 const attempt_meta_1 = require("../telemetry/attempt-meta");
 const cache_stamp_1 = require("./cache-stamp");
 const cache_handle_1 = require("./cache-handle");
 const seam_1 = require("../mask/seam");
+const grounding_1 = require("./grounding");
+const screen_1 = require("../screen/screen");
 /** Assemble the recorder's `metaInputs` from a completed dispatch (WI-1) — the
  * adapter's native meta plus the rendered request (system+user+schema, hashed)
  * and the output text (hashed). One helper so the routed lane's several record
@@ -181,36 +185,114 @@ async function dispatchCandidate(adapter, req, onDelta) {
         },
     });
 }
+/** Build the per-run guards for a route (called ONCE at run start). The mask
+ * vault is run-scoped (shared across attempts); the screen policy is resolved at
+ * load and reused. Null members ⇒ that guard is inert (byte-identical). */
+function buildRunGuards(route, newVault) {
+    return {
+        mask: route.mask !== undefined ? { policy: route.mask, vault: newVault() } : null,
+        screen: route.screen ?? null,
+    };
+}
+function invariantResult(parts, why) {
+    return {
+        ok: false,
+        failure: { class: "invariant_violation", message: why, provider: parts.candidate.provider, model: parts.candidate.model },
+    };
+}
 /**
- * Build the primary AdapterRequest, mask its outgoing user slot when the route
- * has an active policy (spec §1.2 — "rewrites the AdapterRequest before dispatch
- * and rehydrates the AdapterResult after"), dispatch, and time it. With no mask
- * context this is byte-identical to `buildAdapterRequest` + `dispatchCandidate`
- * (the golden test). The trusted system slot is never masked (B3 keeps untrusted
- * content in the user path).
+ * Assemble the untrusted block, SCREEN it (spec §4 — the request-side seam),
+ * MASK the user slot (CS-1, screening runs BEFORE masking so mask tokens never
+ * confuse a detector), dispatch, and apply the output-side screen (canary /
+ * citations / Unicode strip + quarantine drop-count). With both guards null this
+ * is byte-identical to `buildAdapterRequest(assembled)` + `dispatchCandidate`
+ * (the golden test) — the untrusted-block assembly moved here from run.ts so the
+ * loop stays under the LOC cap (spec §10(i)). The trusted system slot is never
+ * masked (B3 keeps untrusted content in the user path).
  */
-async function buildDispatchMaybeMasked(adapter, parts, onDelta, mask) {
-    const built = buildAdapterRequest(parts);
-    if (mask === null) {
-        const started = Date.now();
-        const result = await dispatchCandidate(adapter, built, onDelta);
-        return { request: built, result, latencyMs: Date.now() - started, seam: null };
+async function buildDispatchMaybeMasked(adapter, parts, onDelta, guards) {
+    const provider = parts.candidate.provider;
+    // The untrusted segments this route+input contribute (search / x-trust
+    // variable / proxy_user). Empty on a plain route ⇒ empty appends below.
+    const segments = (0, grounding_1.collectUntrustedSegments)(parts.route, parts.opts.input, parts.injectedSources ?? null, parts.opts.proxyTrust);
+    // Request-side screening (spec §4.2/§4.3). A `block` outcome fails closed
+    // pre-dispatch (no request sent). `strip` filters segments; `quarantine` gates
+    // tool calls below. Screening runs on the RAW untrusted content, before mask.
+    const screenSeam = guards.screen !== null ? (0, screen_1.createScreenSeam)(guards.screen) : null;
+    let keep = segments;
+    let quarantine = false;
+    if (screenSeam !== null) {
+        const decided = await screenSeam.screenRequest(segments);
+        if (decided.kind === "block") {
+            return {
+                request: buildAdapterRequest(parts),
+                result: invariantResult(parts, "screening resolved block (untrusted content matched an enforce rule)"),
+                latencyMs: 0,
+                seam: null,
+                screenRefusal: "block",
+                screenReceipt: screenSeam.receipt(),
+            };
+        }
+        keep = decided.keepSegments;
+        quarantine = decided.quarantine;
     }
-    const seam = (0, seam_1.createMaskSeam)(mask.policy, mask.vault);
-    const outcome = seam.maskRequest(built);
-    if (outcome.kind !== "ok") {
-        // Fail closed: no request is sent. The run loop refuses pre-dispatch.
-        return {
-            request: built,
-            result: { ok: false, failure: { class: "invariant_violation", message: `masking failed closed (${outcome.kind})`, provider: parts.candidate.provider, model: parts.candidate.model } },
-            latencyMs: 0,
-            seam,
-            maskRefusal: outcome.kind,
-        };
+    // Assemble the (post-strip) untrusted appends + the optional canary into the
+    // trusted system slot. Screening-OFF ⇒ `keep === segments` ⇒ byte-identical.
+    const { systemAppend, userAppend } = (0, grounding_1.assembleUntrustedAppends)(keep, provider);
+    const canaryAppend = screenSeam?.canaryToken != null ? `\n\n${screenSeam.canaryToken}` : "";
+    const assembledParts = {
+        ...parts,
+        systemPrompt: parts.systemPrompt + systemAppend + canaryAppend,
+        userDirective: parts.userDirective + userAppend,
+    };
+    let built = buildAdapterRequest(assembledParts);
+    // Quarantine (spec §4.2): prevent the flagged turn from actuating a tool call
+    // via `tool_choice: "none"` where the served model supports it; otherwise fall
+    // back to dropping + counting tool calls in the response (A7, honest).
+    const capable = (0, provider_1.toolChoiceNoneCapable)(provider);
+    if (quarantine && capable)
+        built = { ...built, toolChoice: "none" };
+    // Mask the (screened) user slot. Fail-closed refusal is unchanged (CS-1 §9).
+    let request = built;
+    let seam = null;
+    if (guards.mask !== null) {
+        seam = (0, seam_1.createMaskSeam)(guards.mask.policy, guards.mask.vault);
+        const outcome = seam.maskRequest(built);
+        if (outcome.kind !== "ok") {
+            return {
+                request: built,
+                result: invariantResult(parts, `masking failed closed (${outcome.kind})`),
+                latencyMs: 0,
+                seam,
+                maskRefusal: outcome.kind,
+                ...(screenSeam !== null ? { screenReceipt: screenSeam.receipt() } : {}),
+            };
+        }
+        request = outcome.request;
     }
     const started = Date.now();
-    const result = await dispatchCandidate(adapter, outcome.request, onDelta);
-    return { request: outcome.request, result, latencyMs: Date.now() - started, seam };
+    let result = await dispatchCandidate(adapter, request, onDelta);
+    const latencyMs = Date.now() - started;
+    // Output-side screening (spec §2.3): strip Unicode tags, allowlist citations,
+    // detect canary leak, and — on a quarantined turn without tool_choice parity —
+    // DROP + COUNT any tool calls the model emitted (A7).
+    if (screenSeam !== null && result.ok) {
+        if (quarantine && result.toolCalls !== undefined && result.toolCalls.length > 0) {
+            screenSeam.noteQuarantineDrop(result.toolCalls.length);
+            result = { ...result, toolCalls: [] };
+        }
+        const injectedUrls = (parts.injectedSources ?? []).map((s) => s.url);
+        const cleaned = screenSeam.screenResponse(result.text, injectedUrls);
+        if (cleaned !== result.text)
+            result = { ...result, text: cleaned };
+    }
+    return {
+        request,
+        result,
+        latencyMs,
+        seam,
+        ...(screenSeam !== null ? { screenReceipt: screenSeam.receipt() } : {}),
+    };
 }
 /**
  * Record a tool-call turn and build its RunResult (spec §4.4). A tool call is

package/dist/run/grounding.d.ts

@@ -16,6 +16,7 @@
  */
 import type { RouteBundle } from "../types/route";
 import { type ProviderId } from "../types/provider";
+import { type ContentSegment } from "../screen/provenance";
 export interface SearchResultItem {
     readonly title: string;
     readonly url: string;
@@ -85,11 +86,36 @@ export declare const SEARCH_SNIPPET_MAX_CHARS = 500;
  * untrusted-input policy sentence is owned by the provenance assembler and added
  * to the system slot via `untrustedSystemAppend` — screening F2, single owner). */
 export declare function groundingSystemAppend(assembly: RouteBundle["groundingAssembly"], results: readonly SearchResultItem[], retrievedAt: string): string;
+/** S3 (SC-0, spec §11.3): the effective system-slot removal set for the template
+ * renderer = `keys(variableTrust)` ∪ `proxyTrust`, expressed in the SAME shape the
+ * x-trust removal path consumes (`Record<name, "untrusted">`, routes/template.ts).
+ * A name in `proxyTrust` therefore renders EMPTY in the trusted system slot,
+ * reusing that path rather than forking it. Absent/empty `proxyTrust` ⇒ the
+ * `variableTrust` reference is returned UNCHANGED, so the render is byte-identical. */
+export declare function systemSlotRemoval(variableTrust: Readonly<Record<string, "untrusted">> | undefined, proxyTrust: readonly string[] | undefined): Readonly<Record<string, "untrusted">> | undefined;
+/** Screening S1 + S2 (SC-0 B3) + S3 (SC-0): the untrusted segments a route+input
+ * contribute — (a) each name in `proxyTrust` present in input, tagged
+ * `proxy_user` (S3); (b) each `x-trust: untrusted` variable (S2), tagged
+ * `variable`; and (c), when `grounding.assembly: spotlight`, the search results
+ * (S1), tagged `search`. Shared by the system- and user-slot builders so the two
+ * slots agree on "is anything untrusted present" (screening F2). Empty ⇒ nothing
+ * untrusted (byte-identical default — `proxyTrust` is unset in S3). */
+export declare function collectUntrustedSegments(route: Pick<RouteBundle, "groundingAssembly" | "variableTrust">, input: Record<string, unknown>, injectedSources: readonly SearchResultItem[] | null, proxyTrust?: readonly string[]): ContentSegment[];
 /** Screening S1 + S2 (SC-0 B3): the USER-slot untrusted block appended after the
  * user directive. Assembles the untrusted segments into a single spotlighted,
  * JSON-encoded, delimiter-wrapped block via the provenance assembler. Returns ""
  * when there is nothing untrusted (byte-identical default). */
-export declare function untrustedUserBlock(route: Pick<RouteBundle, "groundingAssembly" | "variableTrust">, input: Record<string, unknown>, injectedSources: readonly SearchResultItem[] | null, provider: ProviderId): string;
+export declare function untrustedUserBlock(route: Pick<RouteBundle, "groundingAssembly" | "variableTrust">, input: Record<string, unknown>, injectedSources: readonly SearchResultItem[] | null, provider: ProviderId, proxyTrust?: readonly string[]): string;
+/** SC-1a: assemble a GIVEN segment list into the {systemAppend, userAppend} the
+ * dispatch helper appends. Byte-identical to `untrustedSystemAppend` +
+ * `untrustedUserBlock` when `segments` is the full collected set (same
+ * assemblePrompt calls, same nonce semantics) — so the screening-OFF path stays
+ * golden. The screening path passes the POST-strip `keepSegments`, so a stripped
+ * segment vanishes from both slots. Returns empty appends for an empty list. */
+export declare function assembleUntrustedAppends(segments: readonly ContentSegment[], provider: ProviderId): {
+    readonly systemAppend: string;
+    readonly userAppend: string;
+};
 /** Screening F2 (SC-0 B3): the SYSTEM-slot untrusted-input policy sentence. The
  * provenance assembler is the SINGLE owner of this sentence (spec §2.2); this
  * surfaces its system-slot output whenever ANY untrusted segment is delivered —
@@ -97,5 +123,5 @@ export declare function untrustedUserBlock(route: Pick<RouteBundle, "groundingAs
  * template still gets its "this is data" framing. Returns "" when there is
  * nothing untrusted (byte-identical default). The assembler's system slot does
  * not depend on the nonce or the block shape, so fixed placeholders suffice. */
-export declare function untrustedSystemAppend(route: Pick<RouteBundle, "groundingAssembly" | "variableTrust">, input: Record<string, unknown>, injectedSources: readonly SearchResultItem[] | null): string;
+export declare function untrustedSystemAppend(route: Pick<RouteBundle, "groundingAssembly" | "variableTrust">, input: Record<string, unknown>, injectedSources: readonly SearchResultItem[] | null, proxyTrust?: readonly string[]): string;
 //# sourceMappingURL=grounding.d.ts.map

package/dist/run/grounding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grounding.d.ts","sourceRoot":"","sources":["../../src/run/grounding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGvE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC9C,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACzF;AAED,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;uDACmD;IACnD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IAC5C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,sDAAsD;IACtD,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACjC;AAaD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,kBAAkB,GAAG,cAAc,CAoCrF;AAED;gEACgE;AAChE,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAYtG;AAED,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAWD;;;;;;mFAMmF;AACnF,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,gBAAgB,EAAE,GACnC,WAAW,EAAE,CAYf;AAED;kFACkF;AAClF,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,gBAAgB,EAAE,GACnC,MAAM,CAGR;AAED;;kFAEkF;AAClF,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,gBAAgB,EAAE,GACnC;IAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IAAC,SAAS,EAAE;QAAE,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAKxE;AAED;mDACmD;AACnD,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAM5C;;;;mFAImF;AACnF,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,WAAW,CAAC,mBAAmB,CAAC,EAC1C,OAAO,EAAE,SAAS,gBAAgB,EAAE,EACpC,WAAW,EAAE,MAAM,GAClB,MAAM,CAGR;AAiCD;;;+DAG+D;AAC/D,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,mBAAmB,GAAG,eAAe,CAAC,EAC/D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,eAAe,EAAE,SAAS,gBAAgB,EAAE,GAAG,IAAI,EACnD,QAAQ,EAAE,UAAU,GACnB,MAAM,CAKR;AAED;;;;;;gFAMgF;AAChF,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,mBAAmB,GAAG,eAAe,CAAC,EAC/D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,eAAe,EAAE,SAAS,gBAAgB,EAAE,GAAG,IAAI,GAClD,MAAM,CAKR"}
+{"version":3,"file":"grounding.d.ts","sourceRoot":"","sources":["../../src/run/grounding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC9C,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACzF;AAED,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;uDACmD;IACnD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IAC5C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,sDAAsD;IACtD,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACjC;AAaD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,kBAAkB,GAAG,cAAc,CAoCrF;AAED;gEACgE;AAChE,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAYtG;AAED,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAWD;;;;;;mFAMmF;AACnF,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,gBAAgB,EAAE,GACnC,WAAW,EAAE,CAYf;AAED;kFACkF;AAClF,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,gBAAgB,EAAE,GACnC,MAAM,CAGR;AAED;;kFAEkF;AAClF,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,gBAAgB,EAAE,GACnC;IAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IAAC,SAAS,EAAE;QAAE,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAKxE;AAED;mDACmD;AACnD,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAM5C;;;;mFAImF;AACnF,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,WAAW,CAAC,mBAAmB,CAAC,EAC1C,OAAO,EAAE,SAAS,gBAAgB,EAAE,EACpC,WAAW,EAAE,MAAM,GAClB,MAAM,CAGR;AAED;;;;;uFAKuF;AACvF,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,GAAG,SAAS,EAChE,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GACxC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,GAAG,SAAS,CAKnD;AAED;;;;;;uEAMuE;AACvE,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,mBAAmB,GAAG,eAAe,CAAC,EAC/D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,eAAe,EAAE,SAAS,gBAAgB,EAAE,GAAG,IAAI,EACnD,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,GAC7B,cAAc,EAAE,CA8BlB;AAED;;;+DAG+D;AAC/D,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,mBAAmB,GAAG,eAAe,CAAC,EAC/D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,eAAe,EAAE,SAAS,gBAAgB,EAAE,GAAG,IAAI,EACnD,QAAQ,EAAE,UAAU,EACpB,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,GAC7B,MAAM,CAKR;AAED;;;;;gFAKgF;AAChF,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,SAAS,cAAc,EAAE,EACnC,QAAQ,EAAE,UAAU,GACnB;IAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAKhE;AAED;;;;;;gFAMgF;AAChF,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,mBAAmB,GAAG,eAAe,CAAC,EAC/D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,eAAe,EAAE,SAAS,gBAAgB,EAAE,GAAG,IAAI,EACnD,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,GAC7B,MAAM,CAKR"}

package/dist/run/grounding.js

@@ -24,7 +24,10 @@ exports.extractCitations = extractCitations;
 exports.countDroppedCitations = countDroppedCitations;
 exports.groundingMeta = groundingMeta;
 exports.groundingSystemAppend = groundingSystemAppend;
+exports.systemSlotRemoval = systemSlotRemoval;
+exports.collectUntrustedSegments = collectUntrustedSegments;
 exports.untrustedUserBlock = untrustedUserBlock;
+exports.assembleUntrustedAppends = assembleUntrustedAppends;
 exports.untrustedSystemAppend = untrustedSystemAppend;
 const node_crypto_1 = require("node:crypto");
 const provider_1 = require("../types/provider");
@@ -141,17 +144,45 @@ function groundingSystemAppend(assembly, results, retrievedAt) {
         return "";
     return searchInjectionBlock(results, retrievedAt); // legacy default — byte-identical
 }
-/** Screening S1 + S2 (SC-0 B3): the untrusted segments a route+input contribute
- * — (a) each `x-trust: untrusted` variable (S2) and (b), when
- * `grounding.assembly: spotlight`, the search results (S1). Shared by the system-
- * and user-slot builders so the two slots agree on "is anything untrusted
- * present" (screening F2). Empty ⇒ nothing untrusted (byte-identical default). */
-function collectUntrustedSegments(route, input, injectedSources) {
+/** S3 (SC-0, spec §11.3): the effective system-slot removal set for the template
+ * renderer = `keys(variableTrust)` ∪ `proxyTrust`, expressed in the SAME shape the
+ * x-trust removal path consumes (`Record<name, "untrusted">`, routes/template.ts).
+ * A name in `proxyTrust` therefore renders EMPTY in the trusted system slot,
+ * reusing that path rather than forking it. Absent/empty `proxyTrust` ⇒ the
+ * `variableTrust` reference is returned UNCHANGED, so the render is byte-identical. */
+function systemSlotRemoval(variableTrust, proxyTrust) {
+    if (proxyTrust === undefined || proxyTrust.length === 0)
+        return variableTrust;
+    const merged = { ...(variableTrust ?? {}) };
+    for (const name of proxyTrust)
+        merged[name] = "untrusted";
+    return merged;
+}
+/** Screening S1 + S2 (SC-0 B3) + S3 (SC-0): the untrusted segments a route+input
+ * contribute — (a) each name in `proxyTrust` present in input, tagged
+ * `proxy_user` (S3); (b) each `x-trust: untrusted` variable (S2), tagged
+ * `variable`; and (c), when `grounding.assembly: spotlight`, the search results
+ * (S1), tagged `search`. Shared by the system- and user-slot builders so the two
+ * slots agree on "is anything untrusted present" (screening F2). Empty ⇒ nothing
+ * untrusted (byte-identical default — `proxyTrust` is unset in S3). */
+function collectUntrustedSegments(route, input, injectedSources, proxyTrust) {
     const segments = [];
+    // S3: each per-call proxyTrust name present in input is `proxy_user` untrusted
+    // content — the request-side isolation seam for the slug/proxy lane.
+    const proxyNames = new Set(proxyTrust ?? []);
+    for (const name of proxyNames) {
+        const value = input[name];
+        if (value === undefined)
+            continue;
+        const text = typeof value === "string" ? value : JSON.stringify(value);
+        segments.push({ source: "proxy_user", tier: "untrusted", text });
+    }
     // S2: each variable annotated `x-trust: untrusted` moves out of the system slot.
     for (const [name, trust] of Object.entries(route.variableTrust ?? {})) {
         if (trust !== "untrusted")
             continue;
+        if (proxyNames.has(name))
+            continue; // proxy_user takes precedence — never double-emit
         const value = input[name];
         if (value === undefined)
             continue;
@@ -173,13 +204,26 @@ function collectUntrustedSegments(route, input, injectedSources) {
  * user directive. Assembles the untrusted segments into a single spotlighted,
  * JSON-encoded, delimiter-wrapped block via the provenance assembler. Returns ""
  * when there is nothing untrusted (byte-identical default). */
-function untrustedUserBlock(route, input, injectedSources, provider) {
-    const segments = collectUntrustedSegments(route, input, injectedSources);
+function untrustedUserBlock(route, input, injectedSources, provider, proxyTrust) {
+    const segments = collectUntrustedSegments(route, input, injectedSources, proxyTrust);
     if (segments.length === 0)
         return "";
     const assembled = (0, provenance_1.assemblePrompt)(segments, { nonce: (0, node_crypto_1.randomUUID)(), untrustedBlock: (0, provider_1.untrustedBlockFor)(provider) });
     return `\n\n${assembled.user}`;
 }
+/** SC-1a: assemble a GIVEN segment list into the {systemAppend, userAppend} the
+ * dispatch helper appends. Byte-identical to `untrustedSystemAppend` +
+ * `untrustedUserBlock` when `segments` is the full collected set (same
+ * assemblePrompt calls, same nonce semantics) — so the screening-OFF path stays
+ * golden. The screening path passes the POST-strip `keepSegments`, so a stripped
+ * segment vanishes from both slots. Returns empty appends for an empty list. */
+function assembleUntrustedAppends(segments, provider) {
+    if (segments.length === 0)
+        return { systemAppend: "", userAppend: "" };
+    const sys = (0, provenance_1.assemblePrompt)(segments, { nonce: "", untrustedBlock: "user_json" }).system;
+    const { user } = (0, provenance_1.assemblePrompt)(segments, { nonce: (0, node_crypto_1.randomUUID)(), untrustedBlock: (0, provider_1.untrustedBlockFor)(provider) });
+    return { systemAppend: sys === "" ? "" : `\n\n${sys}`, userAppend: `\n\n${user}` };
+}
 /** Screening F2 (SC-0 B3): the SYSTEM-slot untrusted-input policy sentence. The
  * provenance assembler is the SINGLE owner of this sentence (spec §2.2); this
  * surfaces its system-slot output whenever ANY untrusted segment is delivered —
@@ -187,8 +231,8 @@ function untrustedUserBlock(route, input, injectedSources, provider) {
  * template still gets its "this is data" framing. Returns "" when there is
  * nothing untrusted (byte-identical default). The assembler's system slot does
  * not depend on the nonce or the block shape, so fixed placeholders suffice. */
-function untrustedSystemAppend(route, input, injectedSources) {
-    const segments = collectUntrustedSegments(route, input, injectedSources);
+function untrustedSystemAppend(route, input, injectedSources, proxyTrust) {
+    const segments = collectUntrustedSegments(route, input, injectedSources, proxyTrust);
     if (segments.length === 0)
         return "";
     const { system } = (0, provenance_1.assemblePrompt)(segments, { nonce: "", untrustedBlock: "user_json" });

package/dist/run/record-attempt.d.ts

@@ -38,6 +38,10 @@ export interface RecordAttemptDeps {
      * dropped candidate's later rows carry no customer key (they dispatched
      * uncached), exactly matching the request builder's suppression. */
     readonly droppedCacheHandle: ReadonlySet<string>;
+    /** LRE-2: the drawn A/B arm (RunOptions.arm) — stamped onto every row's
+     * `meta.arm` so the A/B readout groups `inferences` by arm. Absent ⇒ no `arm`
+     * key on `meta` (byte-identical to a non-experiment run). */
+    readonly arm?: string;
 }
 /**
  * Classify a recorded row's ladder rung (R1 review, F1). `primaryDispatched`

package/dist/run/record-attempt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"record-attempt.d.ts","sourceRoot":"","sources":["../../src/run/record-attempt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,KAAK,EAAgB,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGtF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAGpD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B;;;gDAG4C;IAC5C,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,kFAAkF;IAClF,QAAQ,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC;;qFAEiF;IACjF,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IACrC;;;wEAGoE;IACpE,QAAQ,CAAC,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAClD;AAED;;;;;GAKG;AACH,wBAAgB,MAAM,CACpB,OAAO,EAAE,gBAAgB,EACzB,WAAW,EAAE,OAAO,EACpB,cAAc,EAAE,MAAM,GAAG,IAAI,EAC7B,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,GAC7B,aAAa,CAUf;AAED;;yCAEyC;AACzC,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,CAAC,OAAO,EAAE,gBAAgB,KAAK,MAAM,CA8HlG"}
+{"version":3,"file":"record-attempt.d.ts","sourceRoot":"","sources":["../../src/run/record-attempt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,KAAK,EAAgB,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGtF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAGpD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B;;;gDAG4C;IAC5C,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,kFAAkF;IAClF,QAAQ,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC;;qFAEiF;IACjF,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IACrC;;;wEAGoE;IACpE,QAAQ,CAAC,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjD;;iEAE6D;IAC7D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,MAAM,CACpB,OAAO,EAAE,gBAAgB,EACzB,WAAW,EAAE,OAAO,EACpB,cAAc,EAAE,MAAM,GAAG,IAAI,EAC7B,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,GAC7B,aAAa,CAUf;AAED;;yCAEyC;AACzC,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,CAAC,OAAO,EAAE,gBAAgB,KAAK,MAAM,CAkIlG"}

package/dist/run/record-attempt.js

@@ -99,6 +99,10 @@ function createRecordAttempt(deps) {
         // meta (metaInputs) plus THIS row's provider/model/usage.
         const meta = (0, attempt_meta_1.summarizeAttemptMeta)({
             ...(attempt.metaInputs ?? {}),
+            ...(deps.arm !== undefined ? { arm: deps.arm } : {}),
+            // SC-1a (spec §5, §8): the counts-only screen receipt rides meta.screen —
+            // ZERO migration. The single producer passes it through verbatim.
+            ...(attempt.screen !== undefined ? { screen: attempt.screen } : {}),
             provider: attempt.candidate.provider,
             model: attempt.candidate.model,
             usage: {

package/dist/run/routing-docs.js

@@ -96,7 +96,7 @@ exports.ROUTING_BOUNDARY = [
         id: "B7",
         status: "by_design",
         capability: "Automatic model swap",
-        statement: "Nothing changes what serves a route without a bake-off and an explicit human approval (`modelrig swap execute <id> --approve`).",
+        statement: "No automated change to what serves a route happens without a bake-off and human approval (`modelrig swap execute <id> --approve`); you (or your agent) can change it directly at any time — instant, versioned, reversible.",
         tracking: "optimization-loop.md — human-approved swaps only",
         // No file tripwire: the P6 never-silent-swap invariant is covered by its
         // own dev-rule tests (spec §5.3).

package/dist/run/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/run/run.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAMrD,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,mBAAmB,CAAC;AAGvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAS3D,OAAO,KAAK,EAAE,cAAc,EAAoC,MAAM,aAAa,CAAC;AAUpF,OAAO,KAAK,EAAe,eAAe,EAAE,MAAM,YAAY,CAAC;AAQ/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEtE,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACxD,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;IACxC,+EAA+E;IAC/E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;gDAE4C;IAC5C,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACvC;2EACuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IACxC;;0BAEsB;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IACxC,qDAAqD;IACrD,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C;;;mFAG+E;IAC/E,QAAQ,CAAC,aAAa,CAAC,EAAE,eAAe,CAAC;IACzC;;;;;uDAKmD;IACnD,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAChD;;;;2EAIuE;IACvE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAsBD,wBAAsB,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAwkBhG"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/run/run.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAMrD,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,mBAAmB,CAAC;AAGvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAS3D,OAAO,KAAK,EAAE,cAAc,EAAoC,MAAM,aAAa,CAAC;AAWpF,OAAO,KAAK,EAAa,eAAe,EAAE,MAAM,YAAY,CAAC;AAS7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEtE,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACxD,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;IACxC,+EAA+E;IAC/E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;gDAE4C;IAC5C,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACvC;2EACuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IACxC;;0BAEsB;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IACxC,qDAAqD;IACrD,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C;;;mFAG+E;IAC/E,QAAQ,CAAC,aAAa,CAAC,EAAE,eAAe,CAAC;IACzC;;;;;uDAKmD;IACnD,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAChD;;;;2EAIuE;IACvE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAsBD,wBAAsB,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAmkBhG"}

package/dist/run/run.js

@@ -96,18 +96,16 @@ async function run(deps, routeName, opts) {
         autoStepKey,
         cache: opts.cache,
         droppedCacheHandle,
-        ladder,
+        ladder, ...(opts.arm !== undefined ? { arm: opts.arm } : {}),
     });
-    function failRun(candidate, failure, latencyMs) {
+    function failRun(candidate, failure, latencyMs, screen) {
+        // N1 (spec §5, SC-1b req 2): a pre-dispatch enforce `block` must still record
+        // its counts-only screen receipt on `meta.screen`, or screen-stats misses
+        // every pre-dispatch block. Absent ⇒ no key ⇒ byte-identical to a plain fail.
         recordAttempt({
-            candidate,
-            servedTier: route.policy.tier,
-            tokensIn: 0,
-            tokensOut: 0,
-            tokensCached: 0,
-            costUsd: 0,
-            latencyMs,
-            failure,
+            candidate, servedTier: route.policy.tier, tokensIn: 0, tokensOut: 0,
+            tokensCached: 0, costUsd: 0, latencyMs, failure,
+            ...(screen !== undefined ? { screen } : {}),
         });
         throw new failures_1.RigFailureError(failure);
     }
@@ -262,7 +260,7 @@ async function run(deps, routeName, opts) {
     // retries; cost accrues to the envelope and its own telemetry row.
     let searchResponse = null;
     let injectedSources = null;
-    const maskCtx = route.mask !== undefined ? { policy: route.mask, vault: (0, vault_1.createRunVault)() } : null; // CS-1: run-scoped vault; null ⇒ byte-identical
+    const guards = (0, dispatch_1.buildRunGuards)(route, vault_1.createRunVault); // CS-1 mask (run-scoped vault) + SC-1a screen; both null ⇒ byte-identical
     while (candidate !== null) {
         // Runtime layer of the candidate-set invariant: even a compromised
         // iterator cannot reach an adapter with a pair outside the declared list.
@@ -291,7 +289,7 @@ async function run(deps, routeName, opts) {
         const flags = deps.capabilities(candidate.provider, candidate.model);
         let systemPrompt = (0, template_1.renderTemplate)(route.systemTemplate, {
             variables: opts.input,
-            capabilities: flags, variableTrust: route.variableTrust,
+            capabilities: flags, variableTrust: (0, grounding_1.systemSlotRemoval)(route.variableTrust, opts.proxyTrust),
         });
         // Variant augmentation (WS1): appended after capability-conditionals,
         // before json coaching — promptAppend first, then the reasoning scaffold.
@@ -364,19 +362,16 @@ async function run(deps, routeName, opts) {
         // CE-1 (spec §2.2, run/cache-handle.ts): `suppressed` drops the customer handle after a cache_invalid.
         const candidateKey = `${candidate.provider} ${candidate.model}`;
         const suppressed = droppedCacheHandle.has(candidateKey);
-        // Build + mask (spec §1.2 — user slot only) + dispatch as one seam; null mask ⇒ byte-identical.
+        // Assemble untrusted block + screen (spec §4) + mask (spec §1.2 — user slot)
+        // + dispatch as ONE seam; both guards null ⇒ byte-identical. The untrusted
+        // appends + screening live in the seam so run.ts stays under the LOC cap.
         const dispatched = await (0, dispatch_1.buildDispatchMaybeMasked)(adapter, {
-            route,
-            candidate,
-            systemPrompt: systemPrompt + (0, grounding_1.untrustedSystemAppend)(route, opts.input, injectedSources),
-            userDirective: USER_DIRECTIVE + (0, grounding_1.untrustedUserBlock)(route, opts.input, injectedSources, candidate.provider),
-            nativeGrounded,
-            opts,
-            suppressCustomerCache: suppressed,
-        }, deps.onStreamDelta, maskCtx);
-        if (!dispatched.result.ok && dispatched.maskRefusal !== undefined)
-            failRun(candidate, dispatched.result.failure, 0);
-        const { result, latencyMs, seam: maskSeam } = dispatched;
+            route, candidate, systemPrompt, userDirective: USER_DIRECTIVE,
+            nativeGrounded, opts, suppressCustomerCache: suppressed, injectedSources,
+        }, deps.onStreamDelta, guards);
+        if (!dispatched.result.ok && (dispatched.maskRefusal !== undefined || dispatched.screenRefusal !== undefined))
+            failRun(candidate, dispatched.result.failure, 0, dispatched.screenReceipt);
+        const { result, latencyMs, seam: maskSeam, screenReceipt } = dispatched;
         if (result.ok) {
             const { costUsd, envelopeChargeUsd, pricingMissing } = (0, cost_1.attemptCost)(candidate.provider, candidate.model, result.usage, unpricedRatePerTok);
             guard?.settle(envelopeChargeUsd);
@@ -426,14 +421,14 @@ async function run(deps, routeName, opts) {
                 const acceptTags = gate !== null ? (0, quality_gate_1.qualityTags)(gate) : undefined;
                 const output = maskSeam !== null ? maskSeam.rehydrateOutput(outcome.parsed) : outcome.parsed; // rehydrate post-validate (spec §5)
                 const maskReceipt = maskSeam?.receipt(); // read AFTER rehydrate so counts are final
-                const inferenceId = recordAttempt({ ...(0, accept_1.successAttemptRow)(candidate, result.usage, costUsd, latencyMs, pricingMissing, null, metaInputs, acceptTags), ...(maskReceipt !== undefined ? { mask: maskReceipt } : {}) });
+                const inferenceId = recordAttempt({ ...(0, accept_1.successAttemptRow)(candidate, result.usage, costUsd, latencyMs, pricingMissing, null, metaInputs, acceptTags), ...(maskReceipt !== undefined ? { mask: maskReceipt } : {}), ...(screenReceipt !== undefined ? { screen: screenReceipt } : {}) });
                 captureAttempt(inferenceId, result.text);
                 const meta = (0, accept_1.buildSuccessMeta)({
                     inferenceId, route, candidate, usage: result.usage, costUsd, latencyMs,
                     attemptsByClass: ledger.snapshot(), servedVariant, callId: ladder.callId,
                     ...(injectedSources !== null ? (0, grounding_1.groundingMeta)(result.text, injectedSources) : {}),
                     ...(gate !== null ? { quality: { score: gate.score, verdict: "pass", judgedBy: null } } : {}),
-                    ...(maskReceipt !== undefined ? { mask: maskReceipt } : {}),
+                    ...(maskReceipt !== undefined ? { mask: maskReceipt } : {}), ...(screenReceipt !== undefined ? { screen: screenReceipt } : {}),
                 });
                 return { output, meta };
             }

package/dist/savings/odometer.d.ts

@@ -23,6 +23,10 @@ export interface SwapSavings {
     readonly actualUsdPerConformant: number | null;
     readonly baselineUsdPerConformant: number;
     readonly verifiedUsd: number;
+    /** N4 (spec §4.4): this row is a cost-raising up-swap — a quality investment,
+     * EXCLUDED from the verified-savings sum (`verifiedUsd` forced to 0) but still
+     * present in the audit trail. Absent/false ⇒ an ordinary cost-reducing swap. */
+    readonly upSwap?: boolean;
 }
 export interface Odometer {
     readonly totalVerifiedUsd: number;

package/dist/savings/odometer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"odometer.d.ts","sourceRoot":"","sources":["../../src/savings/odometer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;CAC1C;AAED,wBAAgB,eAAe,CAC7B,KAAK,EAAE,SAAS,eAAe,EAAE,EACjC,IAAI,EAAE,SAAS,YAAY,EAAE,GAC5B,QAAQ,CAoDV"}
+{"version":3,"file":"odometer.d.ts","sourceRoot":"","sources":["../../src/savings/odometer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;oFAEgF;IAChF,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAaD,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;CAC1C;AAED,wBAAgB,eAAe,CAC7B,KAAK,EAAE,SAAS,eAAe,EAAE,EACjC,IAAI,EAAE,SAAS,YAAY,EAAE,GAC5B,QAAQ,CA2DV"}

package/dist/savings/odometer.js

@@ -15,8 +15,24 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.computeOdometer = computeOdometer;
+/** Classify a swap as an up-swap (cost-raising) from its baseline jsonb — zero
+ * DDL. Prefer the recorded `swap_direction`; fall back to comparing the recorded
+ * to-cost against the from-cost (the odometer read "sums only rows where to ≤
+ * from", spec §4.4). A pre-N4 row carries neither and is a down-swap by default. */
+function isUpSwap(baseline) {
+    if (baseline.swap_direction === "up")
+        return true;
+    if (baseline.swap_direction === "down" || baseline.swap_direction === "lateral")
+        return false;
+    const to = baseline.to_effective_usd_per_1k_conformant;
+    return typeof to === "number" && Number.isFinite(to) && to > baseline.effective_usd_per_1k_conformant;
+}
 function computeOdometer(swaps, rows) {
     const perSwap = swaps.map((swap) => {
+        // N4: a cost-raising up-swap is a QUALITY investment — it contributes 0 to
+        // the verified-savings figure (never a negative saving that would deflate the
+        // headline; L5 never-round-in-our-favor) while staying in the audit trail.
+        const up = isUpSwap(swap.baseline);
         const from = Date.parse(swap.executedAt);
         const until = swap.revertedAt !== null ? Date.parse(swap.revertedAt) : Number.POSITIVE_INFINITY;
         const window = rows.filter((r) => {
@@ -49,6 +65,7 @@ function computeOdometer(swaps, rows) {
                 actualUsdPerConformant: null,
                 baselineUsdPerConformant: baselinePerConformant,
                 verifiedUsd: 0,
+                ...(up ? { upSwap: true } : {}),
             };
         }
         const actualPerConformant = spentUsd / conformant;
@@ -60,7 +77,9 @@ function computeOdometer(swaps, rows) {
             conformantVolume: conformant,
             actualUsdPerConformant: actualPerConformant,
             baselineUsdPerConformant: baselinePerConformant,
-            verifiedUsd: (baselinePerConformant - actualPerConformant) * conformant,
+            // Up-swap: excluded from the savings sum (0), never shown as a negative.
+            verifiedUsd: up ? 0 : (baselinePerConformant - actualPerConformant) * conformant,
+            ...(up ? { upSwap: true } : {}),
         };
     });
     return {

package/dist/savings/swap-execute.d.ts

@@ -53,6 +53,13 @@ export interface SwapExecuteResult {
     readonly cacheVerdict: CacheVerdict | null;
     /** The [Briefing §30] one-line explanation for the approval prompt, or null. */
     readonly cacheExplanation: string | null;
+    /** N4 (spec §4.3): the swap's direction, surfaced so the `--approve` prompt
+     * shows the cost is going UP before the human says yes. NO gate change — the
+     * human decision stays the only gate (invariant `no-silent-promotion`). */
+    readonly swapDirection: "up" | "down" | "lateral";
+    /** Signed effective-cost delta (winner − incumbent, $/1k conformant); null when
+     * a cost could not be computed. Positive on an up-swap. */
+    readonly costDelta: number | null;
 }
 export declare function executeSwap(deps: SwapExecuteDeps): Promise<SwapExecuteResult>;
 //# sourceMappingURL=swap-execute.d.ts.map

package/dist/savings/swap-execute.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"swap-execute.d.ts","sourceRoot":"","sources":["../../src/savings/swap-execute.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACzC,OAAO,KAAK,EAAgB,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD;;;;mCAImC;AACnC,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,YAAY,GAAG,IAAI,CAmB9F;AASD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE;QAClB,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;QAChD,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAChF,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE;QAAE,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IAClE,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,WAAW,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,MAAM,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;iFAE6E;IAC7E,QAAQ,CAAC,YAAY,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3C,gFAAgF;IAChF,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAwGnF"}
+{"version":3,"file":"swap-execute.d.ts","sourceRoot":"","sources":["../../src/savings/swap-execute.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACzC,OAAO,KAAK,EAAgB,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD;;;;mCAImC;AACnC,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,YAAY,GAAG,IAAI,CAmB9F;AASD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE;QAClB,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;QAChD,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAChF,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE;QAAE,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IAClE,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,WAAW,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,MAAM,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;iFAE6E;IAC7E,QAAQ,CAAC,YAAY,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3C,gFAAgF;IAChF,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC;;+EAE2E;IAC3E,QAAQ,CAAC,aAAa,EAAE,IAAI,GAAG,MAAM,GAAG,SAAS,CAAC;IAClD;+DAC2D;IAC3D,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAKD,wBAAsB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAwInF"}