openpond-sdk 0.5.26 → 0.5.28

package/TASKSETS.md

@@ -186,10 +186,26 @@ reseals the environment before publication, while historical revisions keep
 their original executable files.
 
 These pure helpers require the host to persist draft files and commit publication,
-Model selection and retry receipts atomically. Bound Reward packages and reviewed
-batches use their respective authoring graphs and are rejected by this ordinary
-package compiler. Draft persistence, HTTP operations and editor controls are host
-integration work.
+Model selection and retry receipts atomically. Bound Reward packages use the same
+draft workflow with `authoringGraph: "bound"` in their retained preparation.
+Pass the original `source` package to `publishModelTasksetDraftPackage` or
+`compileModelTasksetDraftWorkspace` for these drafts. Task edits preserve the
+exact saved Reward, task format and private dependency graph; changing graders
+requires publishing/selecting a Reward through its own editor. Unchanged
+environment execution retains its release. Publication creates an owned revision
+and clears package qualification; it never changes the original source. Reviewed
+batches still require their review/regrading workflow.
+
+`bindOrdinaryModelTasksetReward({ owner, source, rewardBinding, rewards, assets })`
+prepares a complete model-owned package when a user selects a saved Reward for an
+ordinary collection. The source must include collection instructions. This keeps
+task envelopes, per-task output contracts, binary files, private context and tools
+intact. Its model resources explicitly declare `instructionMode: "per_task"` so
+task-specific context is preserved independently of the collection instruction.
+The selected Reward's private assets must resolve exactly. Hosts commit the new
+package and Model selection with their CAS and retry receipt, regenerate stale
+recipes, and advance an evaluation selection that referred to the edited source.
+An independently selected evaluation package remains pinned.
 
 ## Shared draft documents and compilation
 

package/dist/{chunk-S7I45WJQ.js → chunk-2U54EOXJ.js}

@@ -25,7 +25,8 @@ var ModelTasksetDraftPreparationSchema = z.object({
   sourceTasksetRef: LearningRevisionRefSchema,
   tasksetId: IdSchema,
   tasksetRevision: z.number().int().positive(),
-  lineage: ModelTasksetAuthoringSchema
+  lineage: ModelTasksetAuthoringSchema,
+  authoringGraph: z.literal("bound").optional()
 }).strict();
 var TasksetDraftFilePathSchema = z.string().min(1).max(1024).refine((value) => !value.includes("\\") && !value.includes(":") && !value.includes("\0") && !value.startsWith("/") && !value.split("/").some((part) => !part || part === "." || part === ".." || part.startsWith(".env")), "Use a relative Taskset file path without environment files.");
 var TasksetDraftFileInfoSchema = z.object({
@@ -54,4 +55,4 @@ export {
   TasksetDraftFileSchema,
   TasksetDraftFileMutationSchema
 };
-//# sourceMappingURL=chunk-S7I45WJQ.js.map
+//# sourceMappingURL=chunk-2U54EOXJ.js.map

package/dist/chunk-2U54EOXJ.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/model-taskset-authoring-contracts.ts"],
+  "sourcesContent": ["import { z } from \"zod\";\nimport { LearningRevisionRefSchema } from \"@openpond/evals/learning\";\n\nconst IdSchema = LearningRevisionRefSchema.shape.id;\nconst HashSchema = z.string().regex(/^[a-f0-9]{64}$/);\nexport const ModelTasksetAuthoringOwnerSchema = z.object({ scopeId: IdSchema, modelId: IdSchema }).strict();\n\n/** Ordinary authoring preserves its own lineage without inventing a Reward\n * binding or replacing an admitted learning graph. Hosts authorize the owner. */\nexport const ModelTasksetAuthoringSchema = z.object({\n  schemaVersion: z.literal(\"openpond.modelTasksetAuthoring.v1\"),\n  owner: ModelTasksetAuthoringOwnerSchema,\n  root: LearningRevisionRefSchema,\n  parent: LearningRevisionRefSchema,\n}).strict();\n\nexport const ModelTasksetDraftRequestSchema = z.object({\n  schemaVersion: z.literal(\"openpond.modelTasksetDraftRequest.v1\"),\n  operationId: IdSchema,\n  modelId: IdSchema,\n  expectedModelRevision: z.number().int().positive(),\n  sourcePackageHash: HashSchema,\n}).strict();\nexport type ModelTasksetDraftRequest = z.infer<typeof ModelTasksetDraftRequestSchema>;\n\n/** Persist this preparation before materializing the editable workspace. */\nexport const ModelTasksetDraftPreparationSchema = z.object({\n  schemaVersion: z.literal(\"openpond.modelTasksetDraftPreparation.v1\"),\n  draftId: IdSchema,\n  requestHash: HashSchema,\n  sourcePackageHash: HashSchema,\n  sourceTasksetRef: LearningRevisionRefSchema,\n  tasksetId: IdSchema,\n  tasksetRevision: z.number().int().positive(),\n  lineage: ModelTasksetAuthoringSchema,\n  authoringGraph: z.literal(\"bound\").optional(),\n}).strict();\nexport type ModelTasksetDraftPreparation = z.infer<typeof ModelTasksetDraftPreparationSchema>;\n\nexport const TasksetDraftFilePathSchema = z.string().min(1).max(1024).refine(value =>\n  !value.includes(\"\\\\\") && !value.includes(\":\") && !value.includes(\"\\0\") && !value.startsWith(\"/\")\n  && !value.split(\"/\").some(part => !part || part === \".\" || part === \"..\" || part.startsWith(\".env\")), \"Use a relative Taskset file path without environment files.\");\nexport const TasksetDraftFileInfoSchema = z.object({\n  path: TasksetDraftFilePathSchema,\n  sizeBytes: z.number().int().nonnegative(),\n  writable: z.boolean(),\n}).strict();\nexport const TasksetDraftFileContentSchema = z.object({ encoding: z.enum([\"utf8\", \"base64\"]), data: z.string().max(8_000_000) }).strict();\nexport const TasksetDraftFileSchema = TasksetDraftFileInfoSchema.extend({ contentHash: HashSchema, content: TasksetDraftFileContentSchema }).strict();\nexport const TasksetDraftFileMutationSchema = z.object({\n  draftId: IdSchema,\n  expectedDraftRevision: z.number().int().positive(),\n  path: TasksetDraftFilePathSchema,\n  expectedFileHash: HashSchema.nullable(),\n  content: TasksetDraftFileContentSchema.nullable(),\n}).strict();\nexport type TasksetDraftFileInfo = z.infer<typeof TasksetDraftFileInfoSchema>;\nexport type TasksetDraftFile = z.infer<typeof TasksetDraftFileSchema>;\nexport type TasksetDraftFileMutation = z.infer<typeof TasksetDraftFileMutationSchema>;\n"],
+  "mappings": ";AAAA,SAAS,SAAS;AAClB,SAAS,iCAAiC;AAE1C,IAAM,WAAW,0BAA0B,MAAM;AACjD,IAAM,aAAa,EAAE,OAAO,EAAE,MAAM,gBAAgB;AAC7C,IAAM,mCAAmC,EAAE,OAAO,EAAE,SAAS,UAAU,SAAS,SAAS,CAAC,EAAE,OAAO;AAInG,IAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,eAAe,EAAE,QAAQ,mCAAmC;AAAA,EAC5D,OAAO;AAAA,EACP,MAAM;AAAA,EACN,QAAQ;AACV,CAAC,EAAE,OAAO;AAEH,IAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,eAAe,EAAE,QAAQ,sCAAsC;AAAA,EAC/D,aAAa;AAAA,EACb,SAAS;AAAA,EACT,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACjD,mBAAmB;AACrB,CAAC,EAAE,OAAO;AAIH,IAAM,qCAAqC,EAAE,OAAO;AAAA,EACzD,eAAe,EAAE,QAAQ,0CAA0C;AAAA,EACnE,SAAS;AAAA,EACT,aAAa;AAAA,EACb,mBAAmB;AAAA,EACnB,kBAAkB;AAAA,EAClB,WAAW;AAAA,EACX,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC3C,SAAS;AAAA,EACT,gBAAgB,EAAE,QAAQ,OAAO,EAAE,SAAS;AAC9C,CAAC,EAAE,OAAO;AAGH,IAAM,6BAA6B,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,OAAO,WAC3E,CAAC,MAAM,SAAS,IAAI,KAAK,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,SAAS,IAAI,KAAK,CAAC,MAAM,WAAW,GAAG,KAC5F,CAAC,MAAM,MAAM,GAAG,EAAE,KAAK,UAAQ,CAAC,QAAQ,SAAS,OAAO,SAAS,QAAQ,KAAK,WAAW,MAAM,CAAC,GAAG,6DAA6D;AAC9J,IAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,MAAM;AAAA,EACN,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,UAAU,EAAE,QAAQ;AACtB,CAAC,EAAE,OAAO;AACH,IAAM,gCAAgC,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,QAAQ,QAAQ,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,GAAS,EAAE,CAAC,EAAE,OAAO;AACjI,IAAM,yBAAyB,2BAA2B,OAAO,EAAE,aAAa,YAAY,SAAS,8BAA8B,CAAC,EAAE,OAAO;AAC7I,IAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,SAAS;AAAA,EACT,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACjD,MAAM;AAAA,EACN,kBAAkB,WAAW,SAAS;AAAA,EACtC,SAAS,8BAA8B,SAAS;AAClD,CAAC,EAAE,OAAO;",
+  "names": []
+}

package/dist/{chunk-GFVMIDP5.js → chunk-B3CH4V35.js}

@@ -1,3 +1,11 @@
+import {
+  ModelTasksetAuthoringSchema
+} from "./chunk-2U54EOXJ.js";
+import {
+  ImmutableAssetRefSchema,
+  contentHash,
+  sha256
+} from "./chunk-QUOW6URQ.js";
 import {
   ModelProjectVersionedRefSchema,
   canonicalJson
@@ -25,8 +33,8 @@ var ModelStarterEnvironmentAttemptSchema = /* @__PURE__ */ (() => z.object({
 function verifyModelStarterEnvironmentAttempt(value, context) {
   assertBoundedTaskJson(value, 16777216);
   const result = ModelStarterEnvironmentAttemptSchema.parse(value);
-  const { contentHash, ...content } = result;
-  if (sealLearningContent(content).contentHash !== contentHash || result.taskId !== context.taskId || result.snapshot && (!equal(result.snapshot.definition, context.javascript) || result.snapshot.inputHash !== sealLearningContent(context.input).contentHash || result.snapshot.seed !== context.seed || result.snapshot.finalStateHash !== sealLearningContent(result.snapshot.state).contentHash)) throw new Error("Starter environment attempt differs from its admitted task or recorded bytes.");
+  const { contentHash: contentHash2, ...content } = result;
+  if (sealLearningContent(content).contentHash !== contentHash2 || result.taskId !== context.taskId || result.snapshot && (!equal(result.snapshot.definition, context.javascript) || result.snapshot.inputHash !== sealLearningContent(context.input).contentHash || result.snapshot.seed !== context.seed || result.snapshot.finalStateHash !== sealLearningContent(result.snapshot.state).contentHash)) throw new Error("Starter environment attempt differs from its admitted task or recorded bytes.");
   return result;
 }
 var ModelStarterExecutionSchema = z.object({
@@ -61,8 +69,8 @@ function equal(left, right) {
 function assertExecutionIntegrity(execution) {
   assertJavaScriptEnvironmentDefinition(execution.javascript);
   for (const resource of [execution.environment, execution.verifierSet]) {
-    const { contentHash, ...content } = resource;
-    if (sealLearningContent(content).contentHash !== contentHash) throw new Error(`Starter execution resource integrity failed: ${resource.id}.`);
+    const { contentHash: contentHash2, ...content } = resource;
+    if (sealLearningContent(content).contentHash !== contentHash2) throw new Error(`Starter execution resource integrity failed: ${resource.id}.`);
   }
   if (!equal(execution.environment.metadata.javascriptEnvironment, learningRef(execution.javascript))) throw new Error("Starter execution resources differ from its declared task context.");
 }
@@ -145,13 +153,18 @@ var ModelTasksetPackageSchema = z3.object({
   rewards: z3.array(RewardReleaseSchema).min(1).max(100),
   assets: z3.array(LearningTextAssetSchema).max(1e3),
   executionResources: ModelTasksetExecutionResourcesSchema.optional(),
-  execution: ModelStarterExecutionSchema.optional()
+  execution: ModelStarterExecutionSchema.optional(),
+  instructionMode: z3.literal("per_task").optional()
 }).strict();
 var same = (left, right) => sealLearningContent3({ value: left }).contentHash === sealLearningContent3({ value: right }).contentHash;
 var identity = (owner, root) => `model-taskset-${sealLearningContent3({ owner, root }).contentHash}`;
 function deriveModelTaskset(input) {
+  return compileModelTasksetReward({ ...input, source: validateModelTasksetPackage(input.source) });
+}
+function compileModelTasksetReward(input) {
   const owner = OwnerSchema.parse(input.owner);
-  const source = validateModelTasksetPackage(input.source);
+  const source = input.source;
+  const edited = input.edits ?? source;
   const previous = source.taskset.metadata.modelTasksetDerivation === void 0 ? null : ModelTasksetDerivationSchema.parse(source.taskset.metadata.modelTasksetDerivation);
   if (previous && source.taskset.id !== identity(previous.owner, previous.root)) throw new Error("Derived Taskset identity differs from its ownership lineage.");
   const owned = previous && same(previous.owner, owner);
@@ -162,13 +175,13 @@ function deriveModelTaskset(input) {
   const rewards = input.rewards.map((reward) => RewardReleaseSchema.parse(reward));
   const graders = compileBoundGraders(rewardBinding, rewards);
   if (rewardBinding.recipeRef) throw new Error("Resolve the Reward recipe into one standalone binding before deriving a Taskset.");
-  const policy = { ...source.taskset.policy, hiddenGraderRefs: graders.filter((grader) => grader.privileged).map((grader) => grader.id) };
-  const previousResources = source.executionResources ?? source.execution;
+  const policy = { ...edited.taskset.policy, hiddenGraderRefs: graders.filter((grader) => grader.privileged).map((grader) => grader.id) };
+  const previousResources = edited.executionResources ?? edited.execution;
   const environment = previousResources?.environment ?? createEnvironmentRelease({
     schemaVersion: "openpond.environmentRelease.v1",
     id: `${id}-environment`,
     revision: 1,
-    contract: source.taskset.environment,
+    contract: edited.taskset.environment,
     actionSchemaRef: null,
     observationSchemaRef: null,
     stateSchemaRef: null,
@@ -181,17 +194,17 @@ function deriveModelTaskset(input) {
     id: `${id}-verifiers`,
     revision,
     graders,
-    isolation: previousResources?.verifierSet.isolation ?? { processBoundary: "isolated_process", networkPolicy: "none", defaultTimeoutMs: Math.min(source.taskset.environment.defaultTimeoutMs, 3e5) },
+    isolation: previousResources?.verifierSet.isolation ?? { processBoundary: "isolated_process", networkPolicy: "none", defaultTimeoutMs: Math.min(edited.taskset.environment.defaultTimeoutMs, 3e5) },
     calibrationReceiptRefs: [],
     metadata: previousResources ? { sourceVerifierSet: learningRef2(previousResources.verifierSet) } : {}
   });
   const executionResources = { environment, verifierSet };
-  const execution = source.execution ? { ...source.execution, verifierSet } : void 0;
-  const { contentHash: _taskHash, ...taskContent } = source.taskset;
-  const { contentHash: _definitionHash, ...definitionContent } = source.taskDefinition;
+  const execution = edited.execution ? { ...edited.execution, verifierSet } : void 0;
+  const { contentHash: _taskHash, ...taskContent } = edited.taskset;
+  const { contentHash: _definitionHash, ...definitionContent } = edited.taskDefinition;
   const taskExecution = { ...definitionContent.execution, policy, environmentRelease: { id: environment.id, contentHash: environment.contentHash }, verifierSetRelease: { id: verifierSet.id, contentHash: verifierSet.contentHash } };
   const taskDefinition = TaskDefinitionSchema.parse(sealLearningContent3({ ...definitionContent, id: `${id}-definition`, revision, rewardBinding: learningRef2(rewardBinding), execution: taskExecution }));
-  const authoring = source.taskset.metadata.starterAuthoring;
+  const authoring = source.taskset.metadata.starterAuthoring ?? source.taskset.metadata.ordinaryAuthoring;
   const graderFixtures = authoring && typeof authoring === "object" && !Array.isArray(authoring) && "graderFixtures" in authoring ? authoring.graderFixtures : void 0;
   const taskset = TasksetReleaseSchema.parse(sealLearningContent3({
     ...taskContent,
@@ -203,10 +216,11 @@ function deriveModelTaskset(input) {
       starter: { taskDefinition: learningRef2(taskDefinition), rewardBinding: learningRef2(rewardBinding) },
       rewardExecution: { binding: rewardBinding, rewards },
       ...graderFixtures === void 0 ? {} : { starterAuthoring: { graderFixtures } },
+      ...edited.taskset.metadata.environmentResources === void 0 ? {} : { environmentResources: edited.taskset.metadata.environmentResources },
       modelTasksetDerivation: { schemaVersion: "openpond.modelTasksetDerivation.v1", owner, root, parent: learningRef2(source.taskset) }
     }
   }));
-  return validateModelTasksetPackage({ taskset, taskDefinition, rewardBinding, rewards, assets: input.assets, executionResources, ...execution ? { execution } : {} });
+  return validateModelTasksetPackage({ taskset, taskDefinition, rewardBinding, rewards, assets: input.assets, executionResources, ...execution ? { execution } : {}, ...source.instructionMode ? { instructionMode: source.instructionMode } : {} });
 }
 function validateModelTasksetPackage(value) {
   const result = ModelTasksetPackageSchema.parse(value);
@@ -238,7 +252,7 @@ function validateModelTasksetPackage(value) {
   }
   for (const task of taskset.tasks) {
     if (taskDefinition.requiredOutputs && !same(task.requiredOutputs, taskDefinition.requiredOutputs)) throw new Error(`Taskset outputs differ from its reviewed definition: ${task.id}.`);
-    if (task.policyVisibleContext.instructions !== taskDefinition.instructions || !validateTaskValue(taskDefinition.inputSchema, task.input).valid || task.expectedOutput !== null && !validateTaskValue(taskDefinition.outputSchema, task.expectedOutput).valid) throw new Error(`Taskset task differs from its declared format: ${task.id}.`);
+    if (result.instructionMode !== "per_task" && task.policyVisibleContext.instructions !== taskDefinition.instructions || !validateTaskValue(taskDefinition.inputSchema, task.input).valid || task.expectedOutput !== null && !validateTaskValue(taskDefinition.outputSchema, task.expectedOutput).valid) throw new Error(`Taskset task differs from its declared format: ${task.id}.`);
     if (task.privilegedContextRef && !assets.some((asset) => asset.id === task.privilegedContextRef && asset.asset.visibility === "host_private")) throw new Error(`Taskset private context is missing: ${task.id}.`);
   }
   for (const reward of rewards) {
@@ -253,6 +267,275 @@ function validateModelTasksetPackage(value) {
   return result;
 }
 
+// src/taskset-package-learning.ts
+import { z as z4 } from "zod";
+import {
+  TaskBatchSchema,
+  TaskEvidenceSchema,
+  TaskAdmissionDecisionSchema,
+  LearningSourceSchema,
+  LearningTextAssetSchema as LearningTextAssetSchema2,
+  assertLearningContentHash as assertLearningContentHash2,
+  compileTaskBatch,
+  learningRef as learningRef3,
+  sameLearningRef as sameLearningRef2,
+  taskBatchPackageMetadata,
+  verifyLearningTextAsset as verifyLearningTextAsset4
+} from "@openpond/evals/learning";
+var TasksetPackageLearningResourcesSchema = z4.object({
+  batch: TaskBatchSchema,
+  evidence: z4.array(TaskEvidenceSchema).min(1).max(1e4),
+  decisions: z4.array(TaskAdmissionDecisionSchema).min(1).max(1e4),
+  sources: z4.array(LearningSourceSchema).min(1).max(1e4),
+  assets: z4.array(LearningTextAssetSchema2).max(1e3)
+}).strict();
+function learningPackageContextFiles(resources) {
+  return resources.evidence.filter((evidence) => evidence.submission.evaluatorContext !== null).map((evidence) => {
+    const text = canonicalJson(evidence.submission.evaluatorContext);
+    const bytes = new TextEncoder().encode(text);
+    return {
+      asset: {
+        id: `task-evidence:${evidence.contentHash}`,
+        path: `learning/context/${evidence.contentHash}.json`,
+        contentHash: sha256(bytes),
+        sizeBytes: bytes.byteLength,
+        mediaType: "application/json",
+        visibility: "host_private"
+      },
+      base64: btoa(Array.from(bytes, (byte) => String.fromCharCode(byte)).join(""))
+    };
+  });
+}
+function validateTasksetLearningResources(taskset, input) {
+  const resources = TasksetPackageLearningResourcesSchema.parse(input);
+  const metadata = taskBatchPackageMetadata(taskset);
+  if (!sameLearningRef2(learningRef3(resources.batch), metadata.batch)) throw new Error("Taskset learning batch differs from its admission metadata.");
+  for (const collection of [resources.evidence, resources.decisions, resources.sources, resources.assets]) {
+    const identities = /* @__PURE__ */ new Set();
+    for (const resource of collection) {
+      assertLearningContentHash2(resource);
+      const key = `${resource.id}:${resource.revision}`;
+      if (identities.has(key)) throw new Error("Taskset learning resource identities must be unique.");
+      identities.add(key);
+    }
+  }
+  if (resources.evidence.length !== resources.batch.examples.length || resources.decisions.length !== resources.batch.examples.length) throw new Error("Taskset learning snapshots must match the admitted batch inventory.");
+  for (const evidence of resources.evidence) {
+    const source = resources.sources.find((source2) => sameLearningRef2(learningRef3(source2), evidence.source));
+    if (!source || !sameLearningRef2(source.taskDefinition, learningRef3(metadata.definition))) throw new Error("Taskset evidence source differs from its task definition.");
+  }
+  if (resources.sources.some((source) => !resources.evidence.some((evidence) => sameLearningRef2(evidence.source, learningRef3(source))))) throw new Error("Taskset package includes an unrelated learning source.");
+  const rewardAssets = metadata.rewards.flatMap((reward) => [
+    ...reward.assets,
+    ...reward.implementation.kind === "custom_verifier" ? [reward.implementation.verifierRef] : reward.implementation.kind === "model_judge" || reward.implementation.kind === "human" ? [reward.implementation.rubricRef] : [],
+    ..."inputContract" in reward.implementation ? [reward.implementation.inputContract] : []
+  ]);
+  for (const ref of rewardAssets) {
+    const asset = resources.assets.find((asset2) => asset2.id === ref.id);
+    if (!asset) throw new Error("Taskset learning Reward asset is missing.");
+    verifyLearningTextAsset4(asset, ref);
+  }
+  if (resources.assets.some((asset) => !rewardAssets.some((ref) => ref.id === asset.id))) throw new Error("Taskset package includes an unrelated learning asset.");
+  const compiled = compileTaskBatch({
+    batch: resources.batch,
+    definition: metadata.definition,
+    binding: metadata.binding,
+    rewards: metadata.rewards,
+    evidence: resources.evidence,
+    decisions: resources.decisions
+  });
+  const compiledMetadata = taskBatchPackageMetadata(compiled);
+  if (contentHash(compiledMetadata) !== contentHash(metadata)) throw new Error("Taskset admission metadata differs from its reviewed snapshots.");
+  const execution = (release) => ({ policy: release.policy, environment: release.environment, tools: release.tools });
+  if (contentHash(execution(compiled)) !== contentHash(execution(taskset))) throw new Error("Taskset execution differs from its reviewed task definition.");
+  const taskContent = (task) => ({
+    id: task.id,
+    clusterKey: task.clusterKey,
+    split: task.split,
+    input: task.input,
+    expectedOutput: task.expectedOutput,
+    policyVisibleContext: task.policyVisibleContext,
+    privilegedContextRef: task.privilegedContextRef,
+    artifactRefs: task.artifactRefs,
+    requiredOutputs: task.requiredOutputs ?? [],
+    tags: task.tags
+  });
+  if (contentHash(compiled.tasks.map(taskContent)) !== contentHash(taskset.tasks.map(taskContent))) throw new Error("Taskset rows differ from their reviewed evidence.");
+  return resources;
+}
+
+// src/taskset-package-files.ts
+import { z as z5 } from "zod";
+var MAX_TASKSET_PACKAGE_BYTES = 64 * 1024 * 1024;
+var TasksetPackageFileSchema = z5.object({
+  asset: ImmutableAssetRefSchema,
+  base64: z5.string().max(Math.ceil(MAX_TASKSET_PACKAGE_BYTES / 3) * 4)
+}).strict();
+function decodeTasksetPackageFile(value) {
+  const file = TasksetPackageFileSchema.parse(value);
+  const raw = atob(file.base64);
+  if (btoa(raw) !== file.base64) throw new Error(`Taskset asset ${file.asset.id} has noncanonical base64.`);
+  const bytes = Uint8Array.from(raw, (character) => character.charCodeAt(0));
+  if (bytes.byteLength !== file.asset.sizeBytes || sha256(bytes) !== file.asset.contentHash) throw new Error(`Taskset asset ${file.asset.id} differs from its immutable bytes.`);
+  return bytes;
+}
+
+// src/taskset-package-execution.ts
+import { LearningTextAssetSchema as LearningTextAssetSchema3, sealLearningContent as sealLearningContent4 } from "@openpond/evals/learning";
+function resolveTasksetPackageExecution(input) {
+  if (input.taskset.environment.entrypoint !== "openpond.javascript-environment.v1") return null;
+  const byId = new Map(input.files.map((file) => [file.asset.id, file]));
+  const read = (id) => {
+    const file = byId.get(id);
+    if (!file) throw new Error(`Taskset environment asset is missing: ${id}.`);
+    if (file.asset.sizeBytes > 524288) throw new Error("Taskset environment source exceeds the authored asset limit.");
+    const text = new TextDecoder("utf-8", { fatal: true }).decode(decodeTasksetPackageFile(file));
+    return LearningTextAssetSchema3.parse(sealLearningContent4({ schemaVersion: "openpond.learningTextAsset.v1", id, revision: 1, asset: file.asset, text }));
+  };
+  let execution;
+  if (input.modelResources) {
+    if (!input.modelResources.execution) throw new Error("Bound Taskset JavaScript execution resources are missing.");
+    execution = ModelStarterExecutionSchema.parse(input.modelResources.execution);
+  } else {
+    const declaration = read(modelStarterExecutionAssetId(input.taskset));
+    if (declaration.asset.visibility !== "host_private" || declaration.asset.mediaType !== "application/json" || declaration.asset.path !== "environment/execution.json") throw new Error("Taskset execution declaration must be private JSON at environment/execution.json.");
+    execution = ModelStarterExecutionSchema.parse(JSON.parse(declaration.text));
+  }
+  const ids = /* @__PURE__ */ new Set([
+    execution.javascript.module.id,
+    ...[execution.environment.actionSchemaRef, execution.environment.observationSchemaRef, execution.environment.stateSchemaRef].flatMap((ref) => ref ? [ref.id] : []),
+    ...input.taskset.tasks.flatMap((task) => task.privilegedContextRef ? [task.privilegedContextRef] : [])
+  ]);
+  const assets = [...ids].map(read);
+  validateModelStarterExecution(execution, input.taskset, assets);
+  return { execution, assets };
+}
+function createTasksetPackageExecutionFile(execution) {
+  const asset = createModelStarterExecutionAsset(execution);
+  const bytes = new TextEncoder().encode(asset.text);
+  let raw = "";
+  for (const byte of bytes) raw += String.fromCharCode(byte);
+  return { asset: asset.asset, base64: btoa(raw) };
+}
+
+// src/taskset-package-contracts.ts
+import { z as z6 } from "zod";
+import { EnvironmentReleaseSchema as EnvironmentReleaseSchema3, VerifierSetReleaseSchema as VerifierSetReleaseSchema3, verifyEnvironmentRelease as verifyEnvironmentRelease3, verifyVerifierSetRelease as verifyVerifierSetRelease3 } from "@openpond/evals";
+import { assertTasksetRelease as assertTasksetRelease2, TasksetReleaseSchema as TasksetReleaseSchema2 } from "@openpond/evals/tasksets";
+import { assertBoundedTaskJson as assertBoundedTaskJson2 } from "@openpond/evals/task-schema";
+import { taskBatchPackageMetadata as taskBatchPackageMetadata2 } from "@openpond/evals/learning";
+
+// src/model-taskset-authoring-lineage.ts
+import { sameLearningRef as sameLearningRef3 } from "@openpond/evals/learning";
+function modelAuthoredTasksetId(lineage) {
+  return `model-authored-taskset-${contentHash({ owner: lineage.owner, root: lineage.root })}`;
+}
+function assertModelTasksetAuthoring(taskset) {
+  if (taskset.metadata.modelTasksetAuthoring === void 0) return null;
+  const lineage = ModelTasksetAuthoringSchema.parse(taskset.metadata.modelTasksetAuthoring);
+  if (taskset.id !== modelAuthoredTasksetId(lineage) || (taskset.revision === 1 ? !sameLearningRef3(lineage.parent, lineage.root) : lineage.parent.id !== taskset.id || lineage.parent.revision !== taskset.revision - 1)) {
+    throw new Error("Authored Taskset revision differs from its ownership lineage.");
+  }
+  return lineage;
+}
+
+// src/taskset-package-contracts.ts
+var BoundModelResourcesSchema = ModelTasksetPackageSchema.omit({ taskset: true, executionResources: true });
+var TasksetPackageContentSchema = z6.object({
+  schemaVersion: z6.literal("openpond.tasksetPackage.v1"),
+  taskset: TasksetReleaseSchema2,
+  environment: EnvironmentReleaseSchema3,
+  verifierSet: VerifierSetReleaseSchema3,
+  files: z6.array(TasksetPackageFileSchema).max(1e4),
+  modelResources: BoundModelResourcesSchema.optional(),
+  learningResources: TasksetPackageLearningResourcesSchema.optional()
+}).strict();
+var TasksetPackageSchema = TasksetPackageContentSchema.extend({ contentHash: z6.string().regex(/^[a-f0-9]{64}$/) }).strict();
+function tasksetPackageRewardBinding(value) {
+  return value.learningResources ? taskBatchPackageMetadata2(value.taskset).binding : value.modelResources?.rewardBinding ?? null;
+}
+function resolveTasksetPackageInstructions(value) {
+  if (value.learningResources) return taskBatchPackageMetadata2(value.taskset).definition.instructions;
+  if (value.modelResources) return value.modelResources.taskDefinition.instructions;
+  const authoring = z6.object({ instructions: z6.string().max(2e4).optional() }).passthrough().parse(value.taskset.metadata.ordinaryAuthoring ?? {});
+  return authoring.instructions ?? "";
+}
+function validateTasksetPackage(value) {
+  assertBoundedTaskJson2(value, MAX_TASKSET_PACKAGE_BYTES);
+  const result = TasksetPackageSchema.parse(value);
+  const { contentHash: hash, ...content } = result;
+  if (contentHash(content) !== hash) throw new Error("Taskset package content hash differs from its bytes.");
+  const { taskset, environment, verifierSet } = result;
+  assertTasksetRelease2(taskset);
+  const authoring = assertModelTasksetAuthoring(taskset);
+  if (authoring && (result.modelResources || result.learningResources)) throw new Error("Taskset package cannot declare competing authoring graphs.");
+  if (!verifyEnvironmentRelease3(environment) || !verifyVerifierSetRelease3(verifierSet) || !same2(taskset.environmentRelease, { id: environment.id, contentHash: environment.contentHash }) || !same2(taskset.verifierSetRelease, { id: verifierSet.id, contentHash: verifierSet.contentHash }) || !same2(taskset.environment, environment.contract) || !same2(taskset.graders, verifierSet.graders)) {
+    throw new Error("Taskset package execution releases do not match its Taskset.");
+  }
+  const files = /* @__PURE__ */ new Map();
+  for (const file of result.files) {
+    if (files.has(file.asset.id)) throw new Error(`Duplicate Taskset asset identity: ${file.asset.id}.`);
+    decodeTasksetPackageFile(file);
+    files.set(file.asset.id, file);
+  }
+  function requireAsset(ref) {
+    const file = files.get(ref.id);
+    if (!file || !same2(file.asset, ref)) throw new Error(`Taskset package asset is missing or mismatched: ${ref.id}.`);
+  }
+  for (const task of taskset.tasks) {
+    for (const asset of task.artifactRefs) requireAsset(asset);
+    for (const output of task.requiredOutputs ?? []) if (output.schemaRef) requireAsset(output.schemaRef);
+    if (task.privilegedContextRef && files.get(task.privilegedContextRef)?.asset.visibility !== "host_private") {
+      throw new Error(`Taskset package private context is missing: ${task.id}.`);
+    }
+  }
+  for (const ref of [environment.actionSchemaRef, environment.observationSchemaRef, environment.stateSchemaRef]) if (ref) requireAsset(ref);
+  for (const grader of taskset.graders) {
+    const ref = "verifierRef" in grader ? grader.verifierRef : "rubricRef" in grader ? grader.rubricRef : null;
+    if (ref) {
+      requireAsset(ref);
+      if (ref.visibility === "policy") throw new Error(`Taskset grader asset must be private: ${ref.id}.`);
+    }
+  }
+  if (taskset.metrics?.customAggregator) {
+    const aggregator = taskset.metrics.customAggregator;
+    const modules = result.files.filter((file) => file.asset.path === aggregator.module);
+    if (modules.length !== 1 || modules[0].asset.contentHash !== aggregator.contentHash || modules[0].asset.sizeBytes > 524288 || modules[0].asset.visibility === "policy") {
+      throw new Error("Taskset metric module is missing or mismatched, public, or exceeds the source limit.");
+    }
+  }
+  for (const declarations of [taskset.metadata.environmentResources, environment.metadata.resources]) {
+    if (declarations === void 0) continue;
+    for (const resource of z6.array(z6.object({ path: z6.string().min(1) }).passthrough()).parse(declarations)) {
+      if (!result.files.some((file) => file.asset.path === resource.path)) throw new Error(`Taskset environment resource is missing: ${resource.path}.`);
+    }
+  }
+  if (result.learningResources) {
+    if (result.modelResources) throw new Error("Taskset package cannot declare competing authoring graphs.");
+    const learning = validateTasksetLearningResources(taskset, result.learningResources);
+    for (const expected of learningPackageContextFiles(learning)) {
+      if (!same2(files.get(expected.asset.id), expected)) throw new Error("Taskset private context differs from its reviewed evidence.");
+    }
+    for (const asset of learning.assets) requireAsset(asset.asset);
+  } else if (result.modelResources) {
+    const model = validateModelTasksetPackage({ ...result.modelResources, taskset, executionResources: { environment, verifierSet } });
+    for (const asset of model.assets) requireAsset(asset.asset);
+  } else if (["starter", "rewardBinding", "rewardExecution", "modelTasksetDerivation", "learning"].some((key) => taskset.metadata[key] !== void 0)) {
+    throw new Error("Bound Taskset publication requires its complete model resources.");
+  }
+  resolveTasksetPackageExecution(result);
+  resolveTasksetPackageInstructions(result);
+  return result;
+}
+function createTasksetPackage(value) {
+  assertBoundedTaskJson2(value, MAX_TASKSET_PACKAGE_BYTES);
+  const content = TasksetPackageContentSchema.parse(value);
+  return validateTasksetPackage({ ...content, contentHash: contentHash(content) });
+}
+function same2(left, right) {
+  return contentHash({ value: left }) === contentHash({ value: right });
+}
+
 export {
   ModelStarterEnvironmentAttemptSchema,
   verifyModelStarterEnvironmentAttempt,
@@ -269,6 +552,23 @@ export {
   ModelTasksetDerivationSchema,
   ModelTasksetPackageSchema,
   deriveModelTaskset,
-  validateModelTasksetPackage
+  compileModelTasksetReward,
+  validateModelTasksetPackage,
+  TasksetPackageLearningResourcesSchema,
+  learningPackageContextFiles,
+  validateTasksetLearningResources,
+  modelAuthoredTasksetId,
+  assertModelTasksetAuthoring,
+  MAX_TASKSET_PACKAGE_BYTES,
+  TasksetPackageFileSchema,
+  decodeTasksetPackageFile,
+  resolveTasksetPackageExecution,
+  createTasksetPackageExecutionFile,
+  TasksetPackageContentSchema,
+  TasksetPackageSchema,
+  tasksetPackageRewardBinding,
+  resolveTasksetPackageInstructions,
+  validateTasksetPackage,
+  createTasksetPackage
 };
-//# sourceMappingURL=chunk-GFVMIDP5.js.map
+//# sourceMappingURL=chunk-B3CH4V35.js.map