onto-mcp 0.4.11 → 0.4.13

package/dist/core-runtime/discovery/synthesize-cert-sampler.js

@@ -0,0 +1,336 @@
+/**
+ * S1 — deterministic stratified sampler for the B4 `synthesize-cert/v1` bench
+ * (design 20260706-b4-r8-harness-design v3 §3/§4/§15.1).
+ *
+ * Everything here is pure and deterministic — the orchestrator script does the
+ * I/O (observe → buildColumnLeaves → reduceColumnLeavesWithTrace →
+ * classifyFrontier per column) and hands the per-fixture candidate universe in.
+ * Two responsibilities live here because they must not drift apart:
+ *
+ *  1. TWO-LAYER INPUT IDENTITY (§4 · round-2 R2-IND-1):
+ *     - `deterministic_facts_sha256` — hash of the node's LLM-independent facts
+ *       (node_ref + sorted format_clusters + canonical value_shape_seams,
+ *       child_summaries EXCLUDED). Computable BEFORE the reference child
+ *       authoring spend, so sampling/scope/floor pre-checks run pre-spend
+ *       (§3 sequencing).
+ *     - `input_sha256` — hash of the FULL frozen SemanticSynthesisInput packet
+ *       (child_summaries included). The same-input comparison key: every arm
+ *       runs the identical frozen packet, so baseline/candidate rows share it.
+ *     Both hashes canonicalize through ONE serializer, and both run the shipped
+ *     `assertSynthesisInputBounded` source-safe envelope first, so a smuggled
+ *     extra field can never be silently hash-invisible.
+ *
+ *  2. HONEST DETERMINISTIC SELECTION (§3, cherry-pick 금지): per
+ *     (fixture × possessed stratum), over-provision K inputs with a seeded,
+ *     content-blind rule — merge strata order by subtree leaf count ascending
+ *     (a DISCLOSED cost bias; seed tie-break), leaf strata stride-sample the
+ *     stable-key order — and record provenance (pool size, seed, stride, rank,
+ *     selected-vs-nearest-unselected) for the R7 representativeness audit.
+ *
+ * The pre-spend floor gate is part of the sample result (not a separate call a
+ * caller could forget): `floor_violations` re-uses the shipped
+ * `synthesizeCertManifestFloorViolations` plus a pre-spend prediction of the
+ * record validator's `stratum_global_floor`, so an under-provisioned manifest
+ * is rejected before any paid call. Structural integrity failures (a candidate
+ * whose key/hash lies, an input_id collision) THROW instead — those are
+ * harness bugs, not sampling outcomes.
+ */
+import { createHash } from "node:crypto";
+import { reduceNodeKey, } from "../reconstruct/comprehension-reduce.js";
+import { assertReduceTopologyIsTree, assertSynthesisInputBounded, buildSynthesisInputForNode, computeSubtreeLeafCounts, } from "../reconstruct/comprehension-semantic-map.js";
+import { synthesizeCertManifestFloorViolations, SYNTHESIZE_CERT_FLOORS, } from "./synthesize-cert-record.js";
+/** Folded into every stratum seed — editing the sampler's selection rule must
+ * ship with a version bump so a re-run cannot silently claim the old picks. */
+export const SYNTHESIZE_CERT_SAMPLER_VERSION = "synthesize-cert-sampler/v1";
+/** §3 over-provisioning: at a pessimistic decisive rate of 0.4, K×reps(3)×0.4 =
+ * 6 ≥ the per-stratum decisive floor (5), so a stratum survives real losses. */
+export const SYNTHESIZE_CERT_DEFAULT_PER_STRATUM_K = 5;
+const sha256Hex = (text) => createHash("sha256").update(text).digest("hex");
+/** Same projection format as the record module's internal stratum key (kept a
+ * one-line local; the record module's helper is private and that file is the
+ * frozen evidence contract). */
+const stratumKey = (s) => `seam=${s.seam}|merge=${s.merge}`;
+const cmpStr = (x, y) => (x < y ? -1 : x > y ? 1 : 0);
+/** Fixed-key-order canonical shape shared by BOTH identity hashes: sorted
+ * clusters, canonically-sorted re-keyed seams, re-keyed node_ref. Child
+ * summaries (when included) keep their packet order — they are positional
+ * prompt content, and the builder's order is already deterministic. */
+function canonicalPacketShape(packet, includeChildren) {
+    const r = packet.node_ref;
+    const seams = packet.value_shape_seams
+        .map((s) => ({ row: s.row, prev_shape: s.prev_shape, new_shape: s.new_shape }))
+        .sort((x, y) => x.row - y.row || cmpStr(x.prev_shape, y.prev_shape) || cmpStr(x.new_shape, y.new_shape));
+    return {
+        node_ref: { sheet: r.sheet, column_index: r.column_index, row_start: r.row_start, row_end: r.row_end },
+        format_clusters: [...packet.format_clusters].sort(),
+        value_shape_seams: seams,
+        ...(includeChildren
+            ? { child_summaries: packet.child_summaries.map((c) => ({ key: c.key, summary: c.summary })) }
+            : {}),
+    };
+}
+/** `deterministic_facts_sha256` (§4): child-independent by construction — the
+ * facts are wrapped with child_summaries=[] to reuse the shipped source-safe
+ * envelope guard, then hashed WITHOUT the child field. */
+export function synthesizeCertDeterministicFactsSha256(facts) {
+    const probe = {
+        node_ref: facts.node_ref,
+        format_clusters: facts.format_clusters,
+        value_shape_seams: facts.value_shape_seams,
+        child_summaries: [],
+    };
+    assertSynthesisInputBounded(probe);
+    return sha256Hex(JSON.stringify(canonicalPacketShape(probe, false)));
+}
+/** `input_sha256` (§4): identity of the FULL frozen packet (child_summaries
+ * included) — the same-input comparison key across arms. The exact-key envelope
+ * guard runs first so an extra/smuggled field fails closed instead of being
+ * silently excluded from the hash. */
+export function synthesizeCertInputSha256(packet) {
+    assertSynthesisInputBounded(packet);
+    return sha256Hex(JSON.stringify(canonicalPacketShape(packet, true)));
+}
+/**
+ * Enumerates the sampler universe for ONE column pipeline: every non-subsumed
+ * node, stratum-tagged (merge = accumulating mode; seam = the packet's canonical
+ * value_shape_seams are non-empty). The deterministic facts come through the
+ * SINGLE-SOURCE `buildSynthesisInputForNode` (with placeholder child summaries,
+ * discarded) so the facts hashed here are exactly the fields the frozen packet
+ * will carry — the two cannot drift.
+ */
+export function collectSynthesizeCertCandidates(args) {
+    const { trace, nodesByKey, modes, sheetIndex } = args;
+    if (!Number.isSafeInteger(sheetIndex) || sheetIndex < 0) {
+        throw new Error(`synthesize-cert-sampler: sheetIndex must be a non-negative safe integer, got ${sheetIndex}`);
+    }
+    assertReduceTopologyIsTree(trace);
+    const leafCounts = computeSubtreeLeafCounts(trace);
+    const out = [];
+    for (const [key, tnode] of trace.nodes) {
+        const mode = modes.get(key);
+        if (mode === undefined) {
+            throw new Error(`synthesize-cert-sampler: no frontier mode for ${key} — modes must cover the trace`);
+        }
+        if (mode === "subsumed")
+            continue;
+        // Placeholder child summaries: buildSynthesisInputForNode requires a summary
+        // per consumed child; the facts we keep exclude child_summaries entirely.
+        const consumed = tnode.child_keys.filter((k) => modes.get(k) !== "subsumed");
+        const packetShape = buildSynthesisInputForNode(trace, nodesByKey, modes, key, new Map(consumed.map((k) => [k, ""])));
+        const facts = {
+            node_ref: packetShape.node_ref,
+            format_clusters: packetShape.format_clusters,
+            value_shape_seams: packetShape.value_shape_seams,
+        };
+        const leafCount = leafCounts.get(key);
+        if (leafCount === undefined) {
+            throw new Error(`synthesize-cert-sampler: no leaf count for ${key} (impossible)`);
+        }
+        out.push({
+            node_key: key,
+            node_ref: packetShape.node_ref,
+            sheet_index: sheetIndex,
+            stratum: { seam: facts.value_shape_seams.length > 0, merge: mode === "accumulating" },
+            subtree_leaf_count: leafCount,
+            deterministic_facts: facts,
+            deterministic_facts_sha256: synthesizeCertDeterministicFactsSha256(facts),
+        });
+    }
+    out.sort((a, b) => cmpStr(a.node_key, b.node_key));
+    return out;
+}
+function buildInputId(fixtureId, c) {
+    const r = c.node_ref;
+    return `${fixtureId.slice(0, 8)}-s${c.sheet_index}-c${r.column_index}-r${r.row_start}_${r.row_end}`;
+}
+/** Nearest unselected pool index for a selected index (scan outward; ties →
+ * earlier index). Returns -1 when every pool member was selected. */
+function nearestUnselectedIndex(selected, index, poolSize) {
+    for (let dist = 1; dist < poolSize; dist += 1) {
+        const lo = index - dist;
+        if (lo >= 0 && !selected.has(lo))
+            return lo;
+        const hi = index + dist;
+        if (hi < poolSize && !selected.has(hi))
+            return hi;
+    }
+    return -1;
+}
+export function sampleStratifiedManifest(fixtures, opts) {
+    const perStratumK = opts?.perStratumK ?? SYNTHESIZE_CERT_DEFAULT_PER_STRATUM_K;
+    const declaredReps = opts?.declaredReps ?? SYNTHESIZE_CERT_FLOORS.minRepsPerFixtureArm;
+    if (!Number.isSafeInteger(perStratumK) || perStratumK < 1) {
+        throw new Error(`synthesize-cert-sampler: perStratumK must be a positive safe integer, got ${perStratumK}`);
+    }
+    if (!Number.isSafeInteger(declaredReps) || declaredReps < 1) {
+        throw new Error(`synthesize-cert-sampler: declaredReps must be a positive safe integer, got ${declaredReps}`);
+    }
+    const manifest = [];
+    const provenance = [];
+    const seenFixtureIds = new Set();
+    for (const fixture of fixtures) {
+        // fixture_id must be the workbook's real content sha (64-hex): the input_id
+        // prefix and the whitespace-free id guarantee both derive from it.
+        if (!/^[0-9a-f]{64}$/.test(fixture.fixture_id)) {
+            throw new Error(`synthesize-cert-sampler: fixture_id must be a lowercase sha256 hex (workbook content identity), got '${fixture.fixture_id}'`);
+        }
+        if (seenFixtureIds.has(fixture.fixture_id)) {
+            throw new Error(`synthesize-cert-sampler: duplicate fixture_id ${fixture.fixture_id}`);
+        }
+        seenFixtureIds.add(fixture.fixture_id);
+        // Candidate integrity — a candidate whose declared identity lies is a
+        // harness bug, fail-closed (§3 정직 선정 rests on these being real).
+        const seenNodeKeys = new Set();
+        for (const c of fixture.candidates) {
+            if (reduceNodeKey(c.node_ref) !== c.node_key) {
+                throw new Error(`synthesize-cert-sampler: candidate node_key '${c.node_key}' != reduceNodeKey(node_ref) '${reduceNodeKey(c.node_ref)}'`);
+            }
+            if (seenNodeKeys.has(c.node_key)) {
+                throw new Error(`synthesize-cert-sampler: duplicate candidate node_key '${c.node_key}' in fixture ${fixture.fixture_id}`);
+            }
+            seenNodeKeys.add(c.node_key);
+            if (synthesizeCertDeterministicFactsSha256(c.deterministic_facts) !== c.deterministic_facts_sha256) {
+                throw new Error(`synthesize-cert-sampler: candidate ${c.node_key} deterministic_facts_sha256 does not recompute from its facts`);
+            }
+            if (c.stratum.seam !== (c.deterministic_facts.value_shape_seams.length > 0)) {
+                throw new Error(`synthesize-cert-sampler: candidate ${c.node_key} seam flag disagrees with its value_shape_seams`);
+            }
+            if (!Number.isSafeInteger(c.sheet_index) || c.sheet_index < 0) {
+                throw new Error(`synthesize-cert-sampler: candidate ${c.node_key} sheet_index invalid`);
+            }
+            if (!Number.isSafeInteger(c.subtree_leaf_count) || c.subtree_leaf_count < 1) {
+                throw new Error(`synthesize-cert-sampler: candidate ${c.node_key} subtree_leaf_count invalid`);
+            }
+        }
+        // Group by possessed stratum, stable-key order (§3-1).
+        const pools = new Map();
+        for (const c of [...fixture.candidates].sort((a, b) => cmpStr(a.node_key, b.node_key))) {
+            const k = stratumKey(c.stratum);
+            const pool = pools.get(k) ?? [];
+            pool.push(c);
+            pools.set(k, pool);
+        }
+        for (const [poolKey, pool] of [...pools.entries()].sort((a, b) => cmpStr(a[0], b[0]))) {
+            const stratum = pool[0].stratum;
+            const seed = sha256Hex(`${fixture.fixture_id}|${poolKey}|${SYNTHESIZE_CERT_SAMPLER_VERSION}`);
+            const isMerge = stratum.merge;
+            // merge: order by subtree leaf count ascending (disclosed content-blind
+            // cost bias, §3-2), seed tie-break, node_key as the final total order.
+            const ordered = isMerge
+                ? [...pool].sort((a, b) => a.subtree_leaf_count - b.subtree_leaf_count ||
+                    cmpStr(sha256Hex(`${seed}|${a.node_key}`), sha256Hex(`${seed}|${b.node_key}`)) ||
+                    cmpStr(a.node_key, b.node_key))
+                : pool; // leaf strata: stable-key order (already sorted).
+            const takeAll = ordered.length <= perStratumK;
+            let stride = null;
+            let pickedIndices;
+            if (takeAll) {
+                pickedIndices = ordered.map((_, i) => i);
+            }
+            else if (isMerge) {
+                pickedIndices = Array.from({ length: perStratumK }, (_, i) => i); // smallest-K cost bound
+            }
+            else {
+                // Seeded stride over the stable-key order: spreads picks across the
+                // pool instead of clustering at its head. offset+ (K-1)·stride ≤ N-1.
+                stride = Math.floor(ordered.length / perStratumK);
+                const offset = parseInt(seed.slice(0, 12), 16) % stride;
+                pickedIndices = Array.from({ length: perStratumK }, (_, i) => offset + i * stride);
+            }
+            const selectedSet = new Set(pickedIndices);
+            pickedIndices.forEach((poolIndex, rank) => {
+                const c = ordered[poolIndex];
+                const nearest = nearestUnselectedIndex(selectedSet, poolIndex, ordered.length);
+                manifest.push({
+                    fixture_id: fixture.fixture_id,
+                    input_id: buildInputId(fixture.fixture_id, c),
+                    node_key: c.node_key,
+                    sheet_index: c.sheet_index,
+                    stratum: c.stratum,
+                    subtree_leaf_count: c.subtree_leaf_count,
+                    deterministic_facts: c.deterministic_facts,
+                    deterministic_facts_sha256: c.deterministic_facts_sha256,
+                    sampling_rank: rank,
+                    nearest_unselected_id: nearest === -1 ? null : buildInputId(fixture.fixture_id, ordered[nearest]),
+                });
+            });
+            provenance.push({
+                fixture_id: fixture.fixture_id,
+                stratum,
+                pool_size: ordered.length,
+                selected_count: pickedIndices.length,
+                seed,
+                ordering: isMerge ? "subtree_leaf_count_asc" : "stable_key_stride",
+                stride,
+            });
+        }
+    }
+    // §3 E: whitespace-free + globally unique input_ids, asserted before freeze.
+    const seenInputIds = new Set();
+    for (const entry of manifest) {
+        if (!/^\S+$/.test(entry.input_id)) {
+            throw new Error(`synthesize-cert-sampler: input_id '${entry.input_id}' contains whitespace or is empty`);
+        }
+        if (seenInputIds.has(entry.input_id)) {
+            throw new Error(`synthesize-cert-sampler: input_id collision '${entry.input_id}' — ids must be globally unique`);
+        }
+        seenInputIds.add(entry.input_id);
+    }
+    // Pre-spend floor gate (§3 sequencing): deterministic-facts scope — the
+    // input_sha256 slot carries deterministic_facts_sha256 because the frozen
+    // packet sha does not exist yet; the floor lint never reads the sha.
+    const floorViolations = synthesizeCertManifestFloorViolations({
+        inputManifest: manifest.map((e) => ({
+            fixture_id: e.fixture_id,
+            input_id: e.input_id,
+            input_sha256: e.deterministic_facts_sha256,
+            stratum: e.stratum,
+        })),
+        declaredReps,
+    });
+    // Pre-spend prediction of the record validator's stratum_global_floor: every
+    // 2×2 stratum must be floor-reachable (inputs × reps ≥ decisive floor) in at
+    // least ONE fixture — a manifest missing a stratum entirely passes the
+    // possessed-strata lint above but is guaranteed to fail post-spend.
+    const selectedByFixtureStratum = new Map();
+    for (const e of manifest) {
+        const k = `${e.fixture_id} ${stratumKey(e.stratum)}`;
+        selectedByFixtureStratum.set(k, (selectedByFixtureStratum.get(k) ?? 0) + 1);
+    }
+    for (const combo of [
+        { seam: false, merge: false },
+        { seam: false, merge: true },
+        { seam: true, merge: false },
+        { seam: true, merge: true },
+    ]) {
+        const reachable = fixtures.some((fx) => (selectedByFixtureStratum.get(`${fx.fixture_id} ${stratumKey(combo)}`) ?? 0) * declaredReps >=
+            SYNTHESIZE_CERT_FLOORS.minDecisivePerStratumArm);
+        if (!reachable) {
+            floorViolations.push({
+                code: "stratum_global_floor",
+                message: `stratum ${stratumKey(combo)} is floor-reachable in no fixture (inputs x reps < ${SYNTHESIZE_CERT_FLOORS.minDecisivePerStratumArm} everywhere) — the record WILL fail stratum_global_floor; do not spend`,
+                subject_id: null,
+            });
+        }
+    }
+    const manifestIdentitySha256 = sha256Hex(JSON.stringify([...manifest]
+        .sort((a, b) => cmpStr(a.input_id, b.input_id))
+        .map((e) => ({
+        fixture_id: e.fixture_id,
+        input_id: e.input_id,
+        node_key: e.node_key,
+        stratum: { seam: e.stratum.seam, merge: e.stratum.merge },
+        deterministic_facts_sha256: e.deterministic_facts_sha256,
+        sampling_rank: e.sampling_rank,
+        nearest_unselected_id: e.nearest_unselected_id,
+    }))));
+    return {
+        manifest,
+        provenance,
+        floor_violations: floorViolations,
+        manifest_identity_sha256: manifestIdentitySha256,
+        sampler_version: SYNTHESIZE_CERT_SAMPLER_VERSION,
+        per_stratum_k: perStratumK,
+        declared_reps: declaredReps,
+    };
+}

package/dist/core-runtime/effort-calibration-ingest.js

@@ -0,0 +1,326 @@
+/**
+ * Effort-calibration ingestion (P4) — turn an existing benchmark report's JSON
+ * into the `EffortSweepRun[]` the sweep aggregator consumes. Pure: no LLM calls
+ * and no IO. The benchmark scripts already run the (paid, live) sweep and write
+ * the report; this module only re-reads that record, so the calibration report
+ * is produced deterministically and is unit-testable against captured output.
+ *
+ * Honesty rule (carried from the sweep aggregator): a run that produced no
+ * quality verdict — a failed run with no gate — is emitted as an unjudged
+ * (passed=null, qualityScore=null) sweep run, NOT dropped. Dropping failures
+ * would let an effort look viable on a single surviving pass; counting them as
+ * non-passing in the denominator keeps the quorum honest.
+ *
+ * Pipeline asymmetry, mirrored from the two benchmark harnesses:
+ *  - review: one unit-sweep invocation varies one unit's effort internally, so
+ *    each run self-describes its (unit, effort); the baseline run (all units at
+ *    base_effort) is the shared base-effort point for every swept unit.
+ *  - reconstruct: one invocation pins one effort knob (global author --effort or
+ *    --judge-effort), so the (stage, effort) of a report is the knob that was
+ *    pinned; the sweep is several invocations, one report per effort point.
+ *
+ * Cost is intentionally NOT populated here. Per-stage cost is reporting-only
+ * (the frontier decision ignores it) and correct attribution needs a verified
+ * mapping that this stage cannot prove: review's swept stage ids live in the
+ * execution namespace (e.g. `finding_ledger`, `synthesis_response`, `lens`)
+ * while per-unit telemetry uses runtime ids (`finding-ledger`, `synthesize`,
+ * per-lens ids), and a reconstruct report's `totals` is the whole-pipeline cost,
+ * not the swept stage's. The optional `cost` field stays in the sweep/frontier
+ * layer; populating it correctly is deferred to P4b, when real multi-effort
+ * sweep data exists to verify the per-stage unit-telemetry attribution.
+ */
+import { modelProviderFromRuntimeProvider, profileDerivedRouteIdentity, routeHintMatches, routeToken, witnessedReconstructRouteIdentity, worstRouteCompleteness, } from "./route-identity.js";
+import { reviewRunGateSignal } from "./effort-calibration-review.js";
+import { reconstructRunGateSignal } from "./effort-calibration-reconstruct.js";
+const UNJUDGED = { passed: null, qualityScore: null };
+/** Only a unit-sweep baseline case is the shared base-effort point per unit. */
+const UNIT_SWEEP_BASE_PREFIX = "unit-sweep-base";
+/**
+ * Ingest a review unit-sweep benchmark report into sweep runs. Candidate runs
+ * map to their swept unit at its varied effort; each unit-sweep BASELINE run
+ * becomes the base-effort point for EVERY swept unit (the units observed across
+ * candidate runs), since "unit X at base, others at base" is exactly the
+ * baseline. Only `unit-sweep-base-*` runs are treated as baselines: a report may
+ * also carry non-unit-sweep cases (e.g. `all-high`) that share `base_effort` but
+ * vary every unit at once, and replicating those would contaminate the
+ * single-variable frontier. Runs without a quality gate (failures) are emitted
+ * unjudged; runs that are neither a candidate nor a unit-sweep baseline are
+ * skipped (nothing single-variable to attribute).
+ */
+export function ingestReviewReport(report) {
+    const runs = report.runs ?? [];
+    const sweptUnits = [
+        ...new Set(runs
+            .map((r) => r.varied_unit_id)
+            .filter((id) => typeof id === "string")),
+    ];
+    // The base-effort sample is the frontier's reference point; a candidate-only
+    // report (e.g. run with --unit-sweep-candidate-only) omits it, so the frontier
+    // would recommend an effort purely because the baseline was never measured.
+    const hasBaseline = runs.some((r) => r.base_effort && r.case_id?.startsWith(UNIT_SWEEP_BASE_PREFIX));
+    if (sweptUnits.length > 0 && !hasBaseline) {
+        throw new Error("review report has unit-sweep candidates but no unit-sweep baseline (base-effort sample missing; was it run with --unit-sweep-candidate-only?)");
+    }
+    // Points (stage|effort) with at least one completed (gated) run. Failed runs
+    // carry no quality gate or route telemetry, so they are attributed only to a
+    // point that also has completed evidence — three failures alone must not stamp
+    // a unit-effort on a route no retained run proved executed there.
+    const completedPoints = new Set();
+    for (const run of runs) {
+        if (!run.semantic_quality_gate)
+            continue;
+        if (run.varied_unit_id && run.varied_effort) {
+            completedPoints.add(`${run.varied_unit_id}|${run.varied_effort}`);
+        }
+        else if (run.base_effort && run.case_id?.startsWith(UNIT_SWEEP_BASE_PREFIX)) {
+            for (const unit of sweptUnits)
+                completedPoints.add(`${unit}|${run.base_effort}`);
+        }
+    }
+    const out = [];
+    for (const run of runs) {
+        const gated = Boolean(run.semantic_quality_gate);
+        const gate = run.semantic_quality_gate
+            ? reviewRunGateSignal(run.semantic_quality_gate)
+            : { ...UNJUDGED };
+        if (run.varied_unit_id && run.varied_effort) {
+            if (gated || completedPoints.has(`${run.varied_unit_id}|${run.varied_effort}`)) {
+                out.push({ stage: run.varied_unit_id, effort: run.varied_effort, gate });
+            }
+        }
+        else if (run.base_effort && run.case_id?.startsWith(UNIT_SWEEP_BASE_PREFIX)) {
+            for (const unit of sweptUnits) {
+                if (gated || completedPoints.has(`${unit}|${run.base_effort}`)) {
+                    out.push({ stage: unit, effort: run.base_effort, gate });
+                }
+            }
+        }
+    }
+    return out;
+}
+/** The answer-support judge's LLM step; no-call-exempt, so it can early-exit. */
+export const JUDGE_STEP_ID = "answer_support_judgment";
+/**
+ * Whether the answer-support judge actually ran an LLM call at `effort` in this
+ * run. The judge is no-call-exempt: it early-exits (no convergent evidence
+ * clusters) or degrades to an inherited config, in which case it leaves no
+ * `answer_support_judgment` telemetry at the requested effort — so a judge
+ * sample must be backed by real judge telemetry, not just the requested knob.
+ */
+function judgeExercisedAt(run, effort) {
+    return (run.units ?? []).some((u) => u.step_id === JUDGE_STEP_ID &&
+        u.effort === effort &&
+        (u.llm_call_count ?? 0) >= 1);
+}
+/**
+ * Whether a completed run's telemetry shows the swept stage actually ran at
+ * `effort` — the requested knob is never trusted over telemetry. The author
+ * stage always runs, so its `metadata.applied_effort` must equal the point (a
+ * route that ignored the pin, or a recovery de-escalation, is not an `effort`
+ * sample). The judge stage must show an answer_support_judgment call at that
+ * effort. Runs that don't match are not evidence for this frontier point.
+ */
+function appliedEffortMatches(run, stage, effort) {
+    return stage === "judge"
+        ? judgeExercisedAt(run, effort)
+        : run.metadata?.applied_effort === effort;
+}
+/**
+ * Derive the (stage, effort) a reconstruct report pinned. A judge override marks
+ * a judge-stage report ONLY when it pins a judge EFFORT; a model-only override
+ * (effort null/absent) varied the judge model, not an effort, so there is no
+ * effort point to calibrate and this returns null (the caller must pass an
+ * explicit tag) rather than mislabeling it as author. Without a judge override
+ * it is an author-stage report at the pinned `requested_effort`, falling back to
+ * the first run's telemetry `applied_effort` when the settings chain governed
+ * the effort. Returns null when no effort can be attributed.
+ */
+export function deriveReconstructTag(report) {
+    const judgeOverride = report.requested_judge_override;
+    if (judgeOverride) {
+        return judgeOverride.effort
+            ? { stage: "judge", effort: judgeOverride.effort }
+            : null;
+    }
+    if (report.requested_effort) {
+        return { stage: "author", effort: report.requested_effort };
+    }
+    const applied = report.runs?.[0]?.metadata?.applied_effort;
+    if (applied)
+        return { stage: "author", effort: applied };
+    return null;
+}
+/**
+ * Ingest a reconstruct benchmark report into sweep runs for one (stage, effort)
+ * point. The point is the explicit `tag` when given, else derived from the
+ * report's pinned knob. A completed run only contributes a sample when its
+ * telemetry shows the swept stage actually ran at that effort (author:
+ * applied_effort matches; judge: an answer_support_judgment call at that effort),
+ * so a pin the route ignored, a recovery de-escalation, or a judge early-exit
+ * does not fabricate a sample. Their golden gate is then distilled. Failed runs
+ * (no telemetry) are emitted unjudged for the author stage only — they cannot
+ * prove the judge ran. Throws when no tag can be determined.
+ */
+export function ingestReconstructReport(report, tag) {
+    const point = tag ?? deriveReconstructTag(report);
+    if (!point) {
+        throw new Error("reconstruct report pins no effort (no judge override, requested_effort, or applied_effort); pass an explicit stage:effort tag");
+    }
+    const out = [];
+    for (const run of report.runs ?? []) {
+        if (!appliedEffortMatches(run, point.stage, point.effort)) {
+            continue; // telemetry doesn't show this stage running at this effort
+        }
+        out.push({
+            stage: point.stage,
+            effort: point.effort,
+            gate: reconstructRunGateSignal(run.quality_gate),
+        });
+    }
+    // Failed runs carry no telemetry, so attribute them only to the author stage
+    // (which always runs) AND only when at least one completed run was retained at
+    // this point — that retained run's telemetry is what proves the model/route/
+    // effort. A source whose runs all failed proves no route/effort, so its
+    // failures are not turned into route-keyed samples.
+    if (point.stage === "author" && out.length > 0) {
+        const failedCount = report.reconstruct_extension?.failed_runs?.length ?? 0;
+        for (let i = 0; i < failedCount; i++) {
+            out.push({ stage: "author", effort: point.effort, gate: { ...UNJUDGED } });
+        }
+    }
+    return out;
+}
+// ---------------------------------------------------------------------------
+// Route derivation (S1.3 — CLI consumer of the witnessed route identity)
+// ---------------------------------------------------------------------------
+/**
+ * Derive one reconstruct run's RouteIdentity. Prefers the harness-surfaced
+ * witnessed `route_identity` (S1.1/S1.2). A legacy report that predates route
+ * witnessing carries only the provider-only `provider_route`; that string is
+ * degraded through the witnessed constructor (adapter unknown → route_completeness
+ * `provider_only`, or `under_determined` for an unknown brand) so the CLI records
+ * an honest, degraded identity instead of failing (design §10). Returns null when
+ * neither is present (no route evidence on this run).
+ */
+export function reconstructRunRouteIdentity(run) {
+    const witnessed = run.metadata?.route_identity;
+    if (witnessed)
+        return witnessed;
+    const providerRoute = run.metadata?.provider_route;
+    if (providerRoute == null)
+        return null;
+    return witnessedReconstructRouteIdentity({
+        provider: providerRoute,
+        executionAdapter: null,
+        declaredBillingMode: null,
+        effectiveBaseUrl: null,
+    });
+}
+/**
+ * Derive one review run's RouteIdentity from its (already structurally rich)
+ * runtime_route projection. Review has no result-level witness — the route is
+ * resolved from settings/profile — so provenance is profile_derived (design §4).
+ * A legacy report that carries only the provider-level `runtime_provider` token
+ * (no `model_provider`) falls back to the brand mapping, degrading to
+ * provider_only — symmetric with the reconstruct legacy path (design §10) rather
+ * than discarding the recoverable brand. Returns null when the run carries no
+ * route projection at all.
+ */
+export function reviewRunRouteIdentity(run) {
+    const route = run.review_profile?.runtime_route;
+    if (!route)
+        return null;
+    return profileDerivedRouteIdentity({
+        executionAdapter: route.execution_adapter ?? null,
+        modelProvider: route.model_provider ?? modelProviderFromRuntimeProvider(route.runtime_provider),
+        billingMode: route.billing_mode ?? null,
+        effectiveBaseUrl: route.base_url ?? null,
+        realization: route.artifact_generation_realization ?? null,
+    });
+}
+/**
+ * The route identities of the reconstruct runs that ACTUALLY feed the frontier —
+ * the same runs `ingestReconstructReport` retains (telemetry shows the swept
+ * stage ran at the point). Route evidence is collected from these retained
+ * samples only, never from runs whose applied effort / judge mismatch dropped
+ * them, so a discarded wrong-route run can't taint route_completeness or add a
+ * phantom route (finding: derive route evidence from retained samples). A
+ * retained run that carries no route witness contributes null (kept, not
+ * dropped, so the summary can downgrade for it). Failed runs carry no telemetry
+ * and assert no route, so they are excluded.
+ */
+export function reconstructRetainedRouteIdentities(report, tag) {
+    const point = tag ?? deriveReconstructTag(report);
+    if (!point)
+        return [];
+    const out = [];
+    for (const run of report.runs ?? []) {
+        if (!appliedEffortMatches(run, point.stage, point.effort))
+            continue;
+        out.push(retainedRunRouteIdentity(run, point));
+    }
+    return out;
+}
+/**
+ * The route identity that backs a retained sample at `point`. For an author
+ * point the run-level metadata route (= the first author unit) is the swept
+ * unit's route. For a JUDGE point the swept unit is the answer_support_judgment
+ * call, which may run on a different route than the author, so its OWN
+ * route_identity is read; a judge unit that ran without a route witness yields
+ * null (the route is undetermined, never silently the author's).
+ */
+function retainedRunRouteIdentity(run, point) {
+    if (point.stage === "judge") {
+        const judgeUnit = (run.units ?? []).find((u) => u.step_id === JUDGE_STEP_ID &&
+            u.effort === point.effort &&
+            (u.llm_call_count ?? 0) >= 1);
+        return judgeUnit?.route_identity ?? null;
+    }
+    return reconstructRunRouteIdentity(run);
+}
+/**
+ * The route identities of the review runs that feed the frontier — the gated
+ * (completed) candidate and unit-sweep baseline runs, mirroring
+ * `ingestReviewReport`'s attribution. Failed runs carry no quality gate or route
+ * telemetry, so only gated runs are sampled. A gated run missing its route
+ * projection contributes null (so the summary can downgrade for it).
+ */
+export function reviewRetainedRouteIdentities(report) {
+    const out = [];
+    for (const run of report.runs ?? []) {
+        if (!run.semantic_quality_gate)
+            continue;
+        const isCandidate = Boolean(run.varied_unit_id && run.varied_effort);
+        const isBaseline = Boolean(run.base_effort && run.case_id?.startsWith(UNIT_SWEEP_BASE_PREFIX));
+        if (!isCandidate && !isBaseline)
+            continue;
+        out.push(reviewRunRouteIdentity(run));
+    }
+    return out;
+}
+export function summarizeDerivedRoutes(derived, declaredRouteHint) {
+    // A null among contributing runs is a retained sample with no route witness —
+    // the profile cannot claim a complete route while including it (design §10).
+    const hasMissingWitness = derived.some((id) => id === null);
+    const byKey = new Map();
+    for (const identity of derived) {
+        if (!identity)
+            continue;
+        const key = JSON.stringify([routeToken(identity), identity.effective_base_url ?? null]);
+        if (!byKey.has(key))
+            byKey.set(key, identity);
+    }
+    const identities = [...byKey.values()];
+    const tokens = identities.map((id) => id.effective_base_url
+        ? `${routeToken(id)}@${id.effective_base_url}`
+        : routeToken(id));
+    const completeness = identities.length === 0 || hasMissingWitness
+        ? "under_determined"
+        : worstRouteCompleteness(identities.map((id) => id.route_completeness));
+    return {
+        identities,
+        tokens,
+        completeness,
+        hintCorroborated: identities.some((id) => routeHintMatches(declaredRouteHint, id)),
+    };
+}