modelrig 0.8.1 → 0.9.0

package/dist/screen/policy.js

@@ -0,0 +1,334 @@
+"use strict";
+/**
+ * Screening — policy loading & validation (WIRED 2026-08-25, SC-1a). Spec §4.1.
+ *
+ * Runs at ROUTE LOAD (same place `require:` / `mask:` are validated),
+ * synchronously — the route loader is sync, so the shape check, the detector
+ * build, and the hash are too. An unknown detector, an unknown action, or a
+ * `sources` key that LOOSENS a default tier is a LOAD error (teaching message,
+ * CE-2 fixHint style), never a runtime surprise (spec §4.1, §4.3 row 1).
+ *
+ * The single discipline shared with mask/policy.ts: validate the raw shape first
+ * (returns teaching strings, never throws), then parse, then resolve (builds
+ * detectors + the stable `policyHash`). A configured-but-unavailable optional
+ * classifier is NOT a load error — it degrades to T0 with `degraded: true`
+ * (spec §4.3); only a malformed policy fails the load.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateScreenPolicyShape = validateScreenPolicyShape;
+exports.parseScreenPolicy = parseScreenPolicy;
+exports.screenCacheDir = screenCacheDir;
+exports.classifierModelPath = classifierModelPath;
+exports.resolveScreenPolicy = resolveScreenPolicy;
+exports.policyHashOf = policyHashOf;
+const node_crypto_1 = require("node:crypto");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const provenance_1 = require("./provenance");
+const patterns_1 = require("./patterns");
+const safe_harbor_1 = require("../detect/safe-harbor");
+const sidecar_1 = require("./sidecar");
+const model_screen_1 = require("./model-screen");
+const MODES = new Set(["off", "detect", "enforce"]);
+const ACTIONS = new Set(["flag", "strip", "block", "quarantine"]);
+const TIERS = new Set(["trusted", "semi", "untrusted"]);
+const SOURCES = new Set([
+    "template",
+    "variable",
+    "search",
+    "tool_result",
+    "proxy_user",
+    "judge_meta",
+    "unknown",
+]);
+const CITATIONS = new Set(["allowlist", "off"]);
+/** Trust rank — HIGHER is MORE trusted. A `sources` override may only keep or
+ * LOWER a source's rank (tighten); RAISING it (loosening, e.g. search→semi) is a
+ * load error (spec §2.1 "may tighten … but never loosen"). */
+function trustRank(t) {
+    return t === "trusted" ? 2 : t === "semi" ? 1 : 0;
+}
+function isRecord(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/** A detector id is known iff it is the injection pack, a `classifier:` tier id,
+ * a SC-2 Safe Harbor id (`pii:<slug>@v1` / `safe-harbor@v1`), or a
+ * `sidecar:<digest>` id (SC-2 §3). The optional peer/weights (classifier) and
+ * the endpoint reachability (sidecar) decide AVAILABILITY at resolve/run time,
+ * not validity here — an id typo must still fail the load. */
+function isKnownDetectorId(id) {
+    return (id === patterns_1.PATTERNS_ID ||
+        id.startsWith("classifier:") ||
+        id.startsWith("sidecar:") ||
+        id.startsWith("model:screen@") ||
+        (0, safe_harbor_1.isSafeHarborId)(id));
+}
+/**
+ * Validate the raw YAML `screen:` block shape (used by the route loader and by
+ * `modelrig validate`). Returns teaching-style problem strings (CE-2 fixHint
+ * pattern) — EMPTY means valid. Never throws.
+ */
+function validateScreenPolicyShape(raw) {
+    const problems = [];
+    if (!isRecord(raw)) {
+        problems.push("screen must be a block with at least a `mode` (off|detect|enforce)");
+        return problems;
+    }
+    if (raw.mode !== undefined && (typeof raw.mode !== "string" || !MODES.has(raw.mode))) {
+        problems.push("screen.mode must be one of off | detect | enforce");
+    }
+    if (raw.sources !== undefined) {
+        if (!isRecord(raw.sources)) {
+            problems.push("screen.sources must be a map of content source → trust tier (trusted|semi|untrusted)");
+        }
+        else {
+            for (const [source, tier] of Object.entries(raw.sources)) {
+                if (!SOURCES.has(source)) {
+                    problems.push(`screen.sources key "${source}" is not a known content source — allowed: ${[...SOURCES].join(", ")}`);
+                    continue;
+                }
+                if (typeof tier !== "string" || !TIERS.has(tier)) {
+                    problems.push(`screen.sources.${source} must be trusted | semi | untrusted`);
+                    continue;
+                }
+                if (trustRank(tier) > trustRank((0, provenance_1.defaultTier)(source))) {
+                    problems.push(`screen.sources.${source}: "${tier}" LOOSENS the default tier "${(0, provenance_1.defaultTier)(source)}" — ` +
+                        "a source may only be tightened (made more untrusted), never loosened (spec §2.1).");
+                }
+            }
+        }
+    }
+    if (raw.detectors !== undefined) {
+        if (!Array.isArray(raw.detectors)) {
+            problems.push("screen.detectors must be a list of detector ids (e.g. patterns@v1, classifier:defender@int8)");
+        }
+        else {
+            for (const d of raw.detectors) {
+                if (typeof d !== "string" || !isKnownDetectorId(d)) {
+                    problems.push(`screen.detectors entry "${String(d)}" is not a known detector — allowed: patterns@v1, ` +
+                        "classifier:<name>, safe-harbor@v1 (or a pii:<slug>@v1 Safe Harbor id), sidecar:<digest>, model:screen@<model>");
+                }
+            }
+        }
+    }
+    if (raw.sidecar !== undefined)
+        validateSidecarShape(raw.sidecar, problems);
+    if (raw.on !== undefined) {
+        if (!isRecord(raw.on)) {
+            problems.push("screen.on must be a map of trust tier → action (flag|strip|block|quarantine)");
+        }
+        else {
+            for (const [tier, action] of Object.entries(raw.on)) {
+                if (!TIERS.has(tier)) {
+                    problems.push(`screen.on key "${tier}" is not a trust tier — allowed: trusted, semi, untrusted`);
+                }
+                else if (typeof action !== "string" || !ACTIONS.has(action)) {
+                    problems.push(`screen.on.${tier} must be one of flag | strip | block | quarantine`);
+                }
+            }
+        }
+    }
+    if (raw.threshold !== undefined && (typeof raw.threshold !== "number" || raw.threshold < 0 || raw.threshold > 1)) {
+        problems.push("screen.threshold must be a number in [0, 1] (default 0.8)");
+    }
+    if (raw.output !== undefined)
+        validateOutputShape(raw.output, problems);
+    return problems;
+}
+/** Validate the optional `screen.sidecar` block (SC-2 §3). A malformed sidecar
+ * is a LOAD error (teaching message) — a `phi` route that references a sidecar
+ * must have a real one. */
+function validateSidecarShape(sidecar, problems) {
+    if (!isRecord(sidecar)) {
+        problems.push("screen.sidecar must be a block { digest, endpoint, timeout_ms?, types? }");
+        return;
+    }
+    if (typeof sidecar.digest !== "string" || sidecar.digest === "") {
+        problems.push("screen.sidecar.digest must be a non-empty string (the customer's image/config digest)");
+    }
+    if (typeof sidecar.endpoint !== "string" || !/^https?:\/\//.test(sidecar.endpoint)) {
+        problems.push("screen.sidecar.endpoint must be an http(s) URL to your own de-id service");
+    }
+    if (sidecar.timeout_ms !== undefined && (typeof sidecar.timeout_ms !== "number" || sidecar.timeout_ms <= 0)) {
+        problems.push("screen.sidecar.timeout_ms must be a positive number of milliseconds");
+    }
+    if (sidecar.types !== undefined && (!Array.isArray(sidecar.types) || sidecar.types.some((t) => typeof t !== "string"))) {
+        problems.push("screen.sidecar.types must be a list of span type labels (strings)");
+    }
+}
+function validateOutputShape(output, problems) {
+    if (!isRecord(output)) {
+        problems.push("screen.output must be a block { canary?, strip_unicode_tags?, citations? }");
+        return;
+    }
+    if (output.canary !== undefined && typeof output.canary !== "boolean") {
+        problems.push("screen.output.canary must be a boolean");
+    }
+    if (output.strip_unicode_tags !== undefined && typeof output.strip_unicode_tags !== "boolean") {
+        problems.push("screen.output.strip_unicode_tags must be a boolean");
+    }
+    if (output.citations !== undefined && (typeof output.citations !== "string" || !CITATIONS.has(output.citations))) {
+        problems.push("screen.output.citations must be allowlist | off");
+    }
+}
+/** Parse a validated raw block into a typed {@link ScreenPolicy}. Assumes
+ * {@link validateScreenPolicyShape} already passed (caller checks first). */
+function parseScreenPolicy(raw) {
+    const output = {};
+    if (isRecord(raw.output)) {
+        if (typeof raw.output.canary === "boolean")
+            output.canary = raw.output.canary;
+        if (typeof raw.output.strip_unicode_tags === "boolean")
+            output.strip_unicode_tags = raw.output.strip_unicode_tags;
+        if (raw.output.citations === "allowlist" || raw.output.citations === "off")
+            output.citations = raw.output.citations;
+    }
+    return {
+        mode: raw.mode ?? "off",
+        ...(isRecord(raw.sources) ? { sources: raw.sources } : {}),
+        ...(Array.isArray(raw.detectors) ? { detectors: raw.detectors } : {}),
+        ...(isRecord(raw.on) ? { on: raw.on } : {}),
+        ...(typeof raw.threshold === "number" ? { threshold: raw.threshold } : {}),
+        ...(Object.keys(output).length > 0 ? { output } : {}),
+        ...(isRecord(raw.sidecar) ? { sidecar: parseSidecar(raw.sidecar) } : {}),
+    };
+}
+/** Parse a validated `screen.sidecar` block into the typed config (assumes
+ * {@link validateSidecarShape} passed). */
+function parseSidecar(raw) {
+    return {
+        digest: raw.digest,
+        endpoint: raw.endpoint,
+        ...(typeof raw.timeout_ms === "number" ? { timeout_ms: raw.timeout_ms } : {}),
+        ...(Array.isArray(raw.types) ? { types: raw.types } : {}),
+    };
+}
+/** Local cache dir for optional classifier weights (`modelrig screen pull`
+ * writes here; the resolver reads here). Weights are NEVER bundled or re-hosted
+ * (A3) — this is the customer's local store under the home dir. (A configurable
+ * location can ride RigConfig in SC-1b; env is read only in config.ts.) */
+function screenCacheDir() {
+    return (0, node_path_1.join)((0, node_os_1.homedir)(), ".modelrig", "screen");
+}
+/** The on-disk model path a classifier id resolves to in the local cache. */
+function classifierModelPath(id) {
+    return (0, node_path_1.join)(screenCacheDir(), `${id.replace(/[^a-zA-Z0-9._@-]/g, "_")}.onnx`);
+}
+/** Canonical JSON of a policy for hashing — keys sorted so a reformat never
+ * changes the hash. The hash pins WHAT screened this inference on the receipt. */
+function canonicalPolicy(policy) {
+    const norm = {
+        mode: policy.mode,
+        sources: policy.sources ?? {},
+        detectors: [...(policy.detectors ?? [patterns_1.PATTERNS_ID])].sort(),
+        on: policy.on ?? {},
+        threshold: policy.threshold ?? 0.8,
+        output: {
+            canary: policy.output?.canary ?? false,
+            strip_unicode_tags: policy.output?.strip_unicode_tags ?? false,
+            citations: policy.output?.citations ?? "off",
+        },
+        // Conditional so a policy WITHOUT a sidecar hashes exactly as before SC-2
+        // (no key added ⇒ byte-identical canonical JSON ⇒ unchanged policy_hash).
+        ...(policy.sidecar
+            ? {
+                sidecar: {
+                    digest: policy.sidecar.digest,
+                    endpoint: policy.sidecar.endpoint,
+                    timeout_ms: policy.sidecar.timeout_ms ?? null,
+                    types: policy.sidecar.types ? [...policy.sidecar.types].sort() : null,
+                },
+            }
+            : {}),
+    };
+    return JSON.stringify(norm, Object.keys(norm).sort());
+}
+function resolveScreenPolicy(policy, opts = {}) {
+    const detectors = [(0, patterns_1.createPatternDetector)()];
+    const detectorMeta = [{ id: patterns_1.PATTERNS_ID, version: "v1" }];
+    let degraded = false;
+    const configured = policy.detectors ?? [patterns_1.PATTERNS_ID];
+    for (const id of configured) {
+        if (id === patterns_1.PATTERNS_ID)
+            continue;
+        // SC-3 T3 model screen (spec-sc3 §2): a metered inference on the customer's
+        // provider. Built only when the dispatch layer injected the screen call;
+        // otherwise the optional tier is unavailable at load ⇒ degrade to the
+        // surviving detectors (never a load error), mirroring the classifier path.
+        if (id.startsWith("model:screen@")) {
+            const wiring = opts.modelScreen;
+            if (wiring === undefined) {
+                degraded = true;
+                continue;
+            }
+            const model = id.slice("model:screen@".length);
+            detectors.push((0, model_screen_1.createModelScreenDetector)({
+                id: (0, model_screen_1.modelScreenReceiptId)(id),
+                model,
+                dailyCap: wiring.dailyCap,
+                screenCall: wiring.call,
+                ...(wiring.flagConfidence !== undefined ? { flagConfidence: wiring.flagConfidence } : {}),
+                ...(wiring.meter !== undefined ? { meter: wiring.meter } : {}),
+                ...(wiring.now !== undefined ? { now: wiring.now } : {}),
+            }));
+            detectorMeta.push({ id: (0, model_screen_1.modelScreenReceiptId)(id), version: model });
+            continue;
+        }
+        // SC-2 deterministic Safe Harbor detectors (opt-in via the detectors list —
+        // NEVER the custody scrub floor). The pack expands to all ten; a single
+        // `pii:<slug>@v1` id resolves to one. Deterministic ⇒ always available.
+        if ((0, safe_harbor_1.isSafeHarborId)(id)) {
+            for (const det of (0, safe_harbor_1.safeHarborDetectorsFor)(id))
+                detectors.push(det);
+            for (const meta of (0, safe_harbor_1.safeHarborIdentities)(id))
+                detectorMeta.push(meta);
+            continue;
+        }
+        // The sidecar id is honoured via the `screen.sidecar` block below (its
+        // presence in `detectors` is the phi-gate signal; the endpoint rides the
+        // block), so a bare `sidecar:<digest>` id here is a no-op to avoid a double
+        // build.
+        if (id.startsWith("sidecar:"))
+            continue;
+        if (!id.startsWith("classifier:"))
+            continue;
+        try {
+            const det = (0, patterns_1.createClassifierDetector)({ id, modelPath: classifierModelPath(id), runtime: "onnx" });
+            detectors.push(det);
+            detectorMeta.push({ id, version: classifierVersion(id) });
+        }
+        catch (err) {
+            if (err instanceof patterns_1.ScreenDetectorUnavailableError) {
+                degraded = true; // spec §4.3: T0 only, receipt degraded — never a block.
+                continue;
+            }
+            throw err;
+        }
+    }
+    // SC-2 sidecar (spec-sc2 §3): the `screen.sidecar` block builds a
+    // `sidecar:<digest>` detector. Reachability is a RUNTIME condition — an
+    // unreachable/timed-out sidecar throws at detect(), which the shipped seam
+    // turns into the fail-closed matrix (degrade under detect, pre-dispatch block
+    // under enforce). No local availability check here (unlike a classifier's
+    // model file); the digest identity always appears so the phi-gate sees it.
+    if (policy.sidecar) {
+        const id = (0, sidecar_1.sidecarReceiptId)(policy.sidecar.digest);
+        detectors.push((0, sidecar_1.createSidecarDetector)({
+            id,
+            endpoint: policy.sidecar.endpoint,
+            ...(policy.sidecar.timeout_ms !== undefined ? { timeoutMs: policy.sidecar.timeout_ms } : {}),
+            ...(policy.sidecar.types !== undefined ? { types: policy.sidecar.types } : {}),
+        }));
+        detectorMeta.push({ id, version: "sidecar" });
+    }
+    return { policy, detectors, detectorMeta, policyHash: policyHashOf(policy), degraded };
+}
+/** sha256 over the canonical policy JSON — the `policy_hash` a receipt carries. */
+function policyHashOf(policy) {
+    return (0, node_crypto_1.createHash)("sha256").update(canonicalPolicy(policy)).digest("hex");
+}
+/** The version segment of a `classifier:name@version` id, or "unknown". */
+function classifierVersion(id) {
+    const at = id.lastIndexOf("@");
+    return at > 0 ? id.slice(at + 1) : "unknown";
+}

package/dist/screen/probe.d.ts

@@ -0,0 +1,118 @@
+/**
+ * SC-3 — `modelrig screen probe` core (spec-sc3 §3). Runs each configured
+ * `Detector` over (a) the license-clean LABELLED fixture corpora → TPR / FPR /
+ * latency, and (b) the org's BENIGN captures (the customer's own known-benign
+ * traffic) → the FP rate on your traffic, and populates the reserved
+ * `DetectorRegistryEntry.measured` shape (detect/detector.ts) — the "probed, not
+ * declared" doctrine (research §3.1 principle 6) applied to detectors.
+ *
+ * METRICS ONLY — NAMED LEAK INVARIANT, EXTENDED (spec-sc3 §3, acceptance b): the
+ * `measured` record holds numbers, a per-corpus DIGEST (a one-way hash, never
+ * content), a license label, and a detector version — and NOTHING ELSE. No
+ * fixture value, no captured content byte, and no matched span leaves the process
+ * into this record. A property test JSON-serializes the record over random
+ * content-bearing corpora and asserts none of that content appears.
+ *
+ * DETERMINISM (spec-sc3 §3): on a fixed corpus + fixed detector version the
+ * accuracy metrics (TPR/FPR/n) and the corpus digests are reproducible — corpora
+ * are evaluated in a stable (id-sorted) order, and the digest pins the exact
+ * inputs a published number was measured against. Latency is wall-clock by
+ * default; inject `clock` for a reproducible latency in tests.
+ */
+import type { ContentSource, Detector, DetectorRegistryEntry, TrustTier } from "../detect/detector";
+/** The default policy threshold a span must clear to count as a DETECTION (the
+ * same 0.8 the screen engine defaults to; a probe run may override it). */
+export declare const PROBE_DEFAULT_THRESHOLD = 0.8;
+/** One labelled fixture item. `positive: true` ⇒ the item SHOULD be flagged
+ * (a true injection/PII shape); `false` ⇒ a benign negative. */
+export interface LabelledItem {
+    readonly text: string;
+    readonly source: ContentSource;
+    readonly tier: TrustTier;
+    readonly positive: boolean;
+}
+/** A license-clean labelled corpus. `id` + `license` are PUBLIC labels (never
+ * content); the digest is computed over the items so a published number is
+ * verifiable against the exact inputs. */
+export interface LabelledCorpus {
+    readonly id: string;
+    /** SPDX-style license label — only license-clean corpora may be probed and
+     * published (spec-sc3 §3 / acceptance f). Recorded on the receipt. */
+    readonly license: string;
+    readonly items: readonly LabelledItem[];
+}
+/** A known-benign capture item (the org's own traffic). No label — every flag is
+ * a FALSE POSITIVE by construction, which is exactly the FP rate we want. */
+export interface BenignItem {
+    readonly text: string;
+    readonly source: ContentSource;
+    readonly tier: TrustTier;
+}
+/** Per-corpus measured metrics — counts + rates + a digest + a license. */
+export interface PerCorpusMetric {
+    readonly corpusId: string;
+    /** sha256 over the canonical item shapes — a HASH, never the content. */
+    readonly digest: string;
+    readonly license: string;
+    /** Total items evaluated. */
+    readonly n: number;
+    /** Positives / negatives in the corpus (so TPR/FPR are interpretable). */
+    readonly positives: number;
+    readonly negatives: number;
+    /** True-positive rate = detected among positives / positives (null if none). */
+    readonly tpr: number | null;
+    /** False-positive rate = detected among negatives / negatives (null if none). */
+    readonly fpr: number | null;
+    /** Total detector wall-time over this corpus, ms (integer). */
+    readonly latencyMs: number;
+}
+/** The org-benign FP measurement, or the teaching state when there is nothing to
+ * sample (a metadata-posture org has no captures — NOT an error, spec-sc3 §8). */
+export type OrgBenignMetric = {
+    readonly sampled: true;
+    readonly n: number;
+    readonly fpRate: number;
+    readonly sampledAt: string;
+} | {
+    readonly sampled: false;
+    readonly note: "no captures to sample";
+};
+/** The reserved `DetectorRegistryEntry.measured` payload SC-3 populates. Metrics
+ * only — the leak invariant is STRUCTURAL: every field is a number, a hash, a
+ * license label, a version, or an ISO date. */
+export interface ProbeMeasured {
+    readonly detectorId: string;
+    readonly detectorVersion: string;
+    readonly threshold: number;
+    readonly perCorpus: readonly PerCorpusMetric[];
+    readonly orgBenign: OrgBenignMetric;
+}
+export interface ProbeInput {
+    readonly detector: Detector;
+    /** The version label pinned on the receipt (e.g. "v1", "sidecar", a model id). */
+    readonly detectorVersion: string;
+    readonly corpora: readonly LabelledCorpus[];
+    /** The org's benign captures, when a capture source exists. Absent / empty ⇒
+     * the "no captures to sample" teaching state. */
+    readonly benign?: readonly BenignItem[];
+    /** Detection threshold (default {@link PROBE_DEFAULT_THRESHOLD}). */
+    readonly threshold?: number;
+    /** Injectable monotonic clock in ms (default performance.now) — for a
+     * reproducible latency in tests. */
+    readonly clock?: () => number;
+    /** Injectable wall clock (default Date) — for a reproducible `sampledAt`. */
+    readonly now?: () => Date;
+}
+/** Canonical, offset-stable digest of a corpus's item SHAPES. A one-way hash of
+ * the fixture inputs — recorded so a published metric is verifiable against the
+ * exact corpus, WITHOUT the corpus content ever entering the record. */
+export declare function digestCorpus(items: readonly LabelledItem[]): string;
+/**
+ * Probe one detector over the labelled corpora + the org benign captures →
+ * `ProbeMeasured`. Corpora are evaluated in a STABLE id-sorted order so the
+ * record is reproducible on a fixed corpus. Metrics only — never a value.
+ */
+export declare function probeDetector(input: ProbeInput): Promise<ProbeMeasured>;
+/** Populate the reserved `DetectorRegistryEntry.measured` shape from a probe. */
+export declare function buildRegistryEntry(detector: Detector, measured: ProbeMeasured): DetectorRegistryEntry;
+//# sourceMappingURL=probe.d.ts.map

package/dist/screen/probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.d.ts","sourceRoot":"","sources":["../../src/screen/probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,KAAK,EACV,aAAa,EAEb,QAAQ,EACR,qBAAqB,EACrB,SAAS,EACV,MAAM,oBAAoB,CAAC;AAE5B;2EAC2E;AAC3E,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAE3C;gEACgE;AAChE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED;;0CAE0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB;0EACsE;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAC;CACzC;AAED;6EAC6E;AAC7E,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;CAC1B;AAED,2EAA2E;AAC3E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6BAA6B;IAC7B,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,iFAAiF;IACjF,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;kFACkF;AAClF,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACnG;IAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAA;CAAE,CAAC;AAExE;;+CAE+C;AAC/C,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,CAAC;IAC/C,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;CACrC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,kFAAkF;IAClF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IAC5C;qDACiD;IACjD,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IACxC,qEAAqE;IACrE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;wCACoC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED;;wEAEwE;AACxE,wBAAgB,YAAY,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,GAAG,MAAM,CAGnE;AAuED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAiB7E;AAED,iFAAiF;AACjF,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,GAAG,qBAAqB,CAErG"}

package/dist/screen/probe.js

@@ -0,0 +1,132 @@
+"use strict";
+/**
+ * SC-3 — `modelrig screen probe` core (spec-sc3 §3). Runs each configured
+ * `Detector` over (a) the license-clean LABELLED fixture corpora → TPR / FPR /
+ * latency, and (b) the org's BENIGN captures (the customer's own known-benign
+ * traffic) → the FP rate on your traffic, and populates the reserved
+ * `DetectorRegistryEntry.measured` shape (detect/detector.ts) — the "probed, not
+ * declared" doctrine (research §3.1 principle 6) applied to detectors.
+ *
+ * METRICS ONLY — NAMED LEAK INVARIANT, EXTENDED (spec-sc3 §3, acceptance b): the
+ * `measured` record holds numbers, a per-corpus DIGEST (a one-way hash, never
+ * content), a license label, and a detector version — and NOTHING ELSE. No
+ * fixture value, no captured content byte, and no matched span leaves the process
+ * into this record. A property test JSON-serializes the record over random
+ * content-bearing corpora and asserts none of that content appears.
+ *
+ * DETERMINISM (spec-sc3 §3): on a fixed corpus + fixed detector version the
+ * accuracy metrics (TPR/FPR/n) and the corpus digests are reproducible — corpora
+ * are evaluated in a stable (id-sorted) order, and the digest pins the exact
+ * inputs a published number was measured against. Latency is wall-clock by
+ * default; inject `clock` for a reproducible latency in tests.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROBE_DEFAULT_THRESHOLD = void 0;
+exports.digestCorpus = digestCorpus;
+exports.probeDetector = probeDetector;
+exports.buildRegistryEntry = buildRegistryEntry;
+const node_crypto_1 = require("node:crypto");
+/** The default policy threshold a span must clear to count as a DETECTION (the
+ * same 0.8 the screen engine defaults to; a probe run may override it). */
+exports.PROBE_DEFAULT_THRESHOLD = 0.8;
+/** Canonical, offset-stable digest of a corpus's item SHAPES. A one-way hash of
+ * the fixture inputs — recorded so a published metric is verifiable against the
+ * exact corpus, WITHOUT the corpus content ever entering the record. */
+function digestCorpus(items) {
+    const canonical = items.map((it) => [it.source, it.tier, it.positive ? 1 : 0, it.text]);
+    return `sha256:${(0, node_crypto_1.createHash)("sha256").update(JSON.stringify(canonical), "utf8").digest("hex")}`;
+}
+/** Did the detector FLAG this input? True iff it returns ≥1 span at or above the
+ * threshold. The spans (offsets/types) are consumed here and discarded — only
+ * the boolean survives into a count. */
+async function flagged(detector, input, threshold) {
+    const spans = await detector.detect(input);
+    for (const s of spans)
+        if (s.confidence >= threshold)
+            return true;
+    return false;
+}
+/** Evaluate one labelled corpus → its metric. Latency is summed from `clock`. */
+async function evaluateCorpus(detector, corpus, threshold, clock) {
+    let positives = 0;
+    let negatives = 0;
+    let truePos = 0;
+    let falsePos = 0;
+    let latency = 0;
+    for (const item of corpus.items) {
+        const input = { text: item.text, source: item.source, tier: item.tier };
+        const t0 = clock();
+        const hit = await flagged(detector, input, threshold);
+        latency += clock() - t0;
+        if (item.positive) {
+            positives += 1;
+            if (hit)
+                truePos += 1;
+        }
+        else {
+            negatives += 1;
+            if (hit)
+                falsePos += 1;
+        }
+    }
+    return {
+        corpusId: corpus.id,
+        digest: digestCorpus(corpus.items),
+        license: corpus.license,
+        n: corpus.items.length,
+        positives,
+        negatives,
+        tpr: positives > 0 ? round(truePos / positives) : null,
+        fpr: negatives > 0 ? round(falsePos / negatives) : null,
+        latencyMs: Math.round(latency),
+    };
+}
+/** Evaluate the org's benign captures → the FP rate on your traffic. Any flag on
+ * a known-benign item is a false positive. */
+async function evaluateBenign(detector, benign, threshold, now) {
+    if (benign.length === 0)
+        return { sampled: false, note: "no captures to sample" };
+    let falsePos = 0;
+    for (const item of benign) {
+        const input = { text: item.text, source: item.source, tier: item.tier };
+        if (await flagged(detector, input, threshold))
+            falsePos += 1;
+    }
+    return { sampled: true, n: benign.length, fpRate: round(falsePos / benign.length), sampledAt: now().toISOString() };
+}
+function round(n, dp = 4) {
+    const f = 10 ** dp;
+    return Math.round(n * f) / f;
+}
+/**
+ * Probe one detector over the labelled corpora + the org benign captures →
+ * `ProbeMeasured`. Corpora are evaluated in a STABLE id-sorted order so the
+ * record is reproducible on a fixed corpus. Metrics only — never a value.
+ */
+async function probeDetector(input) {
+    const threshold = input.threshold ?? exports.PROBE_DEFAULT_THRESHOLD;
+    const clock = input.clock ?? (() => performanceNow());
+    const now = input.now ?? (() => new Date());
+    const ordered = [...input.corpora].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+    const perCorpus = [];
+    for (const corpus of ordered) {
+        perCorpus.push(await evaluateCorpus(input.detector, corpus, threshold, clock));
+    }
+    const orgBenign = await evaluateBenign(input.detector, input.benign ?? [], threshold, now);
+    return {
+        detectorId: input.detector.id,
+        detectorVersion: input.detectorVersion,
+        threshold,
+        perCorpus,
+        orgBenign,
+    };
+}
+/** Populate the reserved `DetectorRegistryEntry.measured` shape from a probe. */
+function buildRegistryEntry(detector, measured) {
+    return { detector: { id: detector.id, kind: detector.kind }, measured };
+}
+/** performance.now with a Date fallback — never throws if perf is unavailable. */
+function performanceNow() {
+    const perf = globalThis.performance;
+    return perf !== undefined ? perf.now() : Date.now();
+}

package/dist/screen/screen-cli.d.ts

@@ -0,0 +1,16 @@
+/**
+ * `modelrig screen …` (SC-1a, spec §9) — extracted from cli.ts to keep it under
+ * the 700-LOC cap (same discipline as mask-policy-cli.ts).
+ *
+ *   modelrig screen check <file|->   dry-run: scan content with the T0 pattern
+ *                                    pack and print COUNTS by type × source.
+ *                                    NEVER prints a matched value (spec §1.4).
+ *   modelrig screen pull <detector>  resolve the LOCAL cache path for an optional
+ *                                    classifier's weights and, with --url, fetch
+ *                                    them there. ModelRig never bundles or
+ *                                    re-hosts weights (A3).
+ */
+import type { Flags } from "../cli";
+/** Dispatch `modelrig screen <subcommand>`. */
+export declare function runScreenCli(flags: Flags): Promise<number>;
+//# sourceMappingURL=screen-cli.d.ts.map

package/dist/screen/screen-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"screen-cli.d.ts","sourceRoot":"","sources":["../../src/screen/screen-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AA4JpC,+CAA+C;AAC/C,wBAAsB,YAAY,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAahE"}