openpond-sdk 0.5.6 → 0.5.8

package/dist/training-bundle.js

@@ -0,0 +1,619 @@
+import {
+  learningVerifierModule,
+  projectLearningBatchGraders,
+  resolvePortableTasksetRewardExecution
+} from "./chunk-ARUJ3FJT.js";
+import {
+  LearningBatchDatasetSourceRefSchema,
+  TasksetSchema,
+  computeTasksetHash
+} from "./chunk-QFT2MCIC.js";
+import "./chunk-4IDTRFW2.js";
+import "./chunk-S7I45WJQ.js";
+import {
+  TRAINING_EVALUATION_SOURCE_PATH,
+  TrainingEvaluationSourceSchema,
+  assertTrainingEvaluationIsolation,
+  parseAndVerifyTrainingInputArtifactUpload,
+  parseAndVerifyTrainingJobSubmission,
+  trainingEvaluationSourceRef,
+  trainingInputArtifactUploadHash,
+  trainingJobSubmissionHash
+} from "./chunk-F5JBFRAH.js";
+import {
+  HarnessSourceSelectionSchema,
+  validateHarnessSourcePackage
+} from "./chunk-UKVK7MRJ.js";
+import {
+  ImmutableReleaseRefSchema,
+  ReleaseHashSchema,
+  ReleaseIdSchema,
+  ReleaseTimestampSchema,
+  canonicalJson,
+  contentHash,
+  sha256
+} from "./chunk-QUOW6URQ.js";
+import "./chunk-ZNFOVV7B.js";
+
+// src/training-bundle.ts
+import { compileBoundGraders } from "@openpond/evals/rewards";
+import { verifyLearningTextAsset as verifyLearningTextAsset2 } from "@openpond/evals/learning";
+
+// src/training-bundle-contracts.ts
+import { z } from "zod";
+var ScopedSecretDeclarationSchema = z.object({
+  id: ReleaseIdSchema,
+  purpose: z.string().trim().min(1).max(500),
+  audience: z.enum([
+    "orchestrator",
+    "environment",
+    "privileged_scorer",
+    "trainer",
+    "infrastructure"
+  ]),
+  required: z.boolean(),
+  ttlSeconds: z.number().int().positive().max(86400),
+  scopes: z.array(z.string().trim().min(1).max(500)).max(100).default([])
+}).strict();
+var OpaqueSecretLeaseRefSchema = z.object({
+  declarationId: ReleaseIdSchema,
+  leaseRef: z.string().trim().min(8).max(1e3),
+  audience: ScopedSecretDeclarationSchema.shape.audience,
+  expiresAt: ReleaseTimestampSchema
+}).strict();
+var HarnessRuntimeTargetBindingSchema = z.object({
+  adapterId: ReleaseIdSchema,
+  placement: z.enum(["local", "remote", "colocated", "provider_native"]),
+  capabilityReceipt: ReleaseHashSchema,
+  runtimeVersion: z.string().trim().min(1).max(200),
+  dataPlane: z.object({
+    provider: ReleaseIdSchema,
+    dataPlaneId: ReleaseIdSchema,
+    cellId: ReleaseIdSchema,
+    runnerPoolId: ReleaseIdSchema,
+    runtimeImageDigest: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+    capabilityReceipt: ReleaseHashSchema
+  }).strict().nullable()
+}).strict();
+var ComputeTargetBindingSchema = z.object({
+  adapterId: ReleaseIdSchema,
+  kind: z.enum(["local", "ssh", "managed", "custom"]),
+  deviceOrPool: z.string().trim().min(1).max(1e3),
+  capabilityReceipt: ReleaseHashSchema,
+  provider: ReleaseIdSchema.nullable()
+}).strict();
+var TrainingEngineBindingSchema = z.object({
+  adapterId: ReleaseIdSchema,
+  workerVersion: z.string().trim().min(1).max(200),
+  workerImageDigest: z.string().regex(/^sha256:[a-f0-9]{64}$/).nullable(),
+  upstreamRevision: z.string().trim().min(1).max(500),
+  capabilityReceipt: ReleaseHashSchema
+}).strict();
+var HarnessRunManifestContentSchema = z.object({
+  schemaVersion: z.literal("openpond.harnessRunManifest.v1"),
+  id: ReleaseIdSchema,
+  harnessRelease: ImmutableReleaseRefSchema,
+  datasetRelease: ImmutableReleaseRefSchema,
+  evidenceSets: z.array(ImmutableReleaseRefSchema).max(1e4),
+  model: z.object({
+    source: z.string().trim().min(1).max(200),
+    revision: z.string().trim().min(1).max(500),
+    artifactHash: ReleaseHashSchema.nullable(),
+    tokenizerRevision: z.string().trim().min(1).max(500),
+    chatTemplateHash: ReleaseHashSchema
+  }).strict(),
+  recipe: z.object({
+    method: z.string().trim().min(1).max(100),
+    version: z.string().trim().min(1).max(200),
+    configHash: ReleaseHashSchema
+  }).strict(),
+  runtimeTarget: HarnessRuntimeTargetBindingSchema,
+  computeTarget: ComputeTargetBindingSchema,
+  engine: TrainingEngineBindingSchema,
+  resolvedBundleHash: ReleaseHashSchema,
+  secretLeaseRefs: z.array(OpaqueSecretLeaseRefSchema).max(1e3),
+  approval: z.object({
+    approvalHash: ReleaseHashSchema,
+    approvedAt: ReleaseTimestampSchema,
+    maximumSpendUsd: z.number().nonnegative().nullable()
+  }).strict(),
+  createdAt: ReleaseTimestampSchema
+}).strict();
+var HarnessRunManifestSchema = HarnessRunManifestContentSchema.extend({
+  contentHash: ReleaseHashSchema
+}).strict();
+var ResolvedTrainingBundleContentSchema = z.object({
+  schemaVersion: z.literal("openpond.resolvedTrainingBundle.v1"),
+  projection: z.literal("trainer"),
+  harnessRelease: ImmutableReleaseRefSchema,
+  datasetRelease: ImmutableReleaseRefSchema,
+  evidenceSetRelease: ImmutableReleaseRefSchema.nullable(),
+  files: z.array(
+    z.object({
+      path: z.string().trim().min(1).max(2e3),
+      sha256: ReleaseHashSchema,
+      sizeBytes: z.number().int().nonnegative()
+    }).strict()
+  ).max(1e5)
+}).strict();
+var ResolvedTrainingBundleManifestSchema = ResolvedTrainingBundleContentSchema.extend({
+  contentHash: ReleaseHashSchema
+}).strict();
+
+// src/training-privacy.ts
+var SECRET_PATTERNS = [
+  { label: "OpenAI-style API key", pattern: /\bsk-[A-Za-z0-9_-]{16,}\b/g },
+  { label: "OpenPond API key", pattern: /\bopk_[A-Za-z0-9_-]{12,}\b/g },
+  { label: "private key", pattern: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/g },
+  { label: "credential assignment", pattern: /\b(?:api[_-]?key|password|secret|token)\s*[:=]\s*["']?[^\s"']{8,}/gi }
+];
+var EMAIL_PATTERN = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi;
+var PHONE_PATTERN = /\b(?:\+?1[-.\s]?)?\(?\d{3}\)?[-.\s]\d{3}[-.\s]\d{4}\b/g;
+function scanAndRedactEvidence(text) {
+  const findings = [];
+  let redacted = text;
+  for (const item of SECRET_PATTERNS) {
+    item.pattern.lastIndex = 0;
+    if (item.pattern.test(redacted)) findings.push(item.label);
+    item.pattern.lastIndex = 0;
+    redacted = redacted.replace(item.pattern, `[REDACTED ${item.label}]`);
+  }
+  EMAIL_PATTERN.lastIndex = 0;
+  const hasEmail = EMAIL_PATTERN.test(redacted);
+  EMAIL_PATTERN.lastIndex = 0;
+  if (hasEmail) findings.push("email address");
+  redacted = redacted.replace(EMAIL_PATTERN, "[REDACTED email]");
+  PHONE_PATTERN.lastIndex = 0;
+  const hasPhone = PHONE_PATTERN.test(redacted);
+  PHONE_PATTERN.lastIndex = 0;
+  if (hasPhone) findings.push("phone number");
+  redacted = redacted.replace(PHONE_PATTERN, "[REDACTED phone]");
+  return {
+    secretStatus: findings.some((finding) => !finding.includes("email") && !finding.includes("phone")) ? "blocked" : "passed",
+    piiStatus: hasEmail || hasPhone ? "review" : "passed",
+    findings,
+    redacted
+  };
+}
+
+// src/training-learning-batch.ts
+import { compileTaskBatch, learningRef, taskBatchPackageMetadata, verifyLearningTextAsset } from "@openpond/evals";
+function materializeLearningBatchTaskset(input) {
+  const release = compileTaskBatch(input);
+  const metadata = taskBatchPackageMetadata(release);
+  if (release.environment.kind !== "text" || release.tools.length || release.tasks.some((task) => task.artifactRefs.length)) throw new Error("This learning batch requires an environment or asset adapter before training preparation.");
+  const sourceId = input.source.id;
+  const signals = { demonstrations: [], preferences: [], corrections: [], feedback: [], rewards: [], labels: [] };
+  const fixtures = [];
+  for (const admission of metadata.admissions) {
+    const evidence = input.evidence.find((item) => item.id === admission.evidence.id);
+    const decision = input.decisions.find((item) => item.id === admission.decision.id);
+    if (input.batch.purpose === "reward_training" && decision.grade?.training.status === "scored") signals.rewards.push({
+      id: `reward-${admission.taskId}`,
+      taskId: admission.taskId,
+      kind: "reward",
+      task: input.definition.instructions,
+      rules: [{ id: input.binding.id, points: 1, condition: "Execute the released Reward binding with its declared normalization, weights and gates." }],
+      otherwisePoints: 0,
+      executable: true,
+      approved: true,
+      confidence: 1,
+      sourceRefs: [sourceId],
+      artifactRef: input.binding.id,
+      metadata: { rewardBinding: learningRef(input.binding), evidence: admission.evidence, decision: admission.decision }
+    });
+    if (admission.supervisedTarget !== null) signals.demonstrations.push({ kind: "demonstration", id: `demo-${admission.taskId}`, taskId: admission.taskId, sourceRefs: [sourceId], artifactRef: admission.decision.id, approved: true, confidence: 1, prompt: null, response: JSON.stringify(admission.supervisedTarget), metadata: { evidence: admission.evidence, decision: admission.decision, targetGradeHash: decision.targetGrade?.contentHash } });
+    for (const [kind, output, grade] of [["observed", evidence.submission.observedOutput, decision.grade], ["target", decision.approvedTarget, decision.targetGrade]]) {
+      const outcome = fixtureOutcome(grade);
+      if (output === null || outcome === null) continue;
+      fixtures.push({ id: `fixture-${kind}-${admission.taskId}`, taskId: admission.taskId, label: outcome.passed ? "positive" : "negative", output, infrastructureError: null, expectedPassed: outcome.passed, expectedRewardEligible: outcome.rewardEligible, metadata: { gradeReceiptHash: grade.contentHash, evidence: admission.evidence, decision: admission.decision } });
+    }
+  }
+  if (!fixtures.length) throw new Error("Grade at least one reviewed response before preparing this batch. Grader fixtures must come from actual receipts.");
+  const graders = projectLearningBatchGraders(input.binding, input.rewards, input.assets);
+  const generatedFiles = [];
+  for (const grader of release.graders) {
+    if (grader.kind !== "custom_verifier") continue;
+    const asset = input.assets?.find((asset2) => asset2.id === grader.verifierRef.id);
+    if (!asset) throw new Error(`Reward ${grader.id} is missing its immutable verifier source.`);
+    const module = learningVerifierModule(grader.verifierRef.contentHash);
+    if (!generatedFiles.some((file) => file.path === module)) generatedFiles.push({ path: module, role: "verifier", content: verifyLearningTextAsset(asset, grader.verifierRef) });
+  }
+  const taskset = TasksetSchema.parse({
+    schemaVersion: "openpond.taskset.v1",
+    id: `learning-${contentHash([input.profileId, input.batch.contentHash]).slice(0, 40)}`,
+    revision: 1,
+    profileId: input.profileId,
+    profileRelease: null,
+    createImproveRunId: null,
+    name: `${input.definition.name} \xB7 ${input.batch.examples.length} approved examples`,
+    objective: input.definition.instructions,
+    purpose: "general",
+    benchmark: null,
+    status: "needs_review",
+    sourceRefs: [input.source],
+    datasetArtifact: null,
+    policy: release.policy,
+    environment: { protocolVersion: "openpond.taskEnvironment.v1", kind: "chat", entrypoint: "openpond.text.v1", stateful: false, deterministicSeeds: release.environment.deterministicSeeds, toolNames: [], lifecycle: ["create", "reset", "step", "grade", "cleanup"], defaultTimeoutMs: release.environment.defaultTimeoutMs, networkPolicy: release.environment.networkPolicy, metadata: { portableEnvironment: release.environment } },
+    capabilities: { schemaVersion: "openpond.tasksetCapabilities.v1", taskKind: "chat", supportedSignals: signals.demonstrations.length ? ["demonstration", "reward"] : ["reward"], compatibleMethods: input.batch.purpose === "supervised_training" ? ["sft"] : input.batch.purpose === "reward_training" ? ["grpo", "ppo"] : ["none"], rewardKinds: ["deterministic"], requiresTools: false, requiresState: false, requiresPrivilegedGrading: true, environmentPlacements: ["local", "remote"], exportable: true, portabilityBlockers: [] },
+    tasks: release.tasks.map(({ artifactRefs: _assets, ...task }) => ({ ...task, schemaVersion: "openpond.taskData.v1", sourceRefs: [sourceId], metadata: { admission: metadata.admissions.find((entry) => entry.taskId === task.id), exampleOrigin: input.evidence.find((evidence) => evidence.id === task.id)?.correctionFeedbackId ? "corrected" : "extracted" } })),
+    graders,
+    graderFixtures: fixtures,
+    learningSignals: signals,
+    authoringProvenance: { schemaVersion: "openpond.taskAuthoringProvenance.v1", model: null, modelConfig: {}, skillHash: contentHash("openpond-learning-batch-v1"), promptTemplateVersion: "learning-batch-v1", buildIntent: input.batch.purpose === "supervised_training" ? "demonstrations" : "verifiable_reward", buildSpecification: null, evidenceHashes: input.batch.examples.map((entry) => entry.evidence.contentHash), tasksetSdkVersion: "learning-batch-v1", sourceCommit: null, repairHistory: [], createdAt: input.batch.sealedAt },
+    readiness: null,
+    contentHash: "00000000",
+    createdAt: input.batch.sealedAt,
+    updatedAt: input.batch.sealedAt,
+    metadata: { learning: metadata, learningRelease: learningRef(release), trainingMethod: input.batch.purpose === "supervised_training" ? "sft" : input.batch.purpose === "reward_training" ? "grpo" : "none", tasksetOutputContract: { mode: "structured_json", jsonSchema: input.definition.outputSchema, renderer: null } }
+  });
+  return { taskset: TasksetSchema.parse({ ...taskset, contentHash: computeTasksetHash(taskset) }), release, generatedFiles };
+}
+function fixtureOutcome(grade) {
+  if (!grade) return null;
+  const outcome = grade.training.status === "not_configured" ? grade.evaluation : grade.training;
+  if (outcome.status !== "scored") return null;
+  return { passed: outcome.passed === true, rewardEligible: grade.training.status === "scored" };
+}
+function prepareReviewedLearningBatch(input) {
+  const scan = scanAndRedactEvidence(JSON.stringify({
+    tasks: input.evidence.map((item) => item.submission),
+    targets: input.decisions.map((item) => item.approvedTarget),
+    definition: input.definition
+  }));
+  if (scan.secretStatus !== "passed" || scan.piiStatus !== "passed") throw new Error(`Learning batch contains unresolved data findings (${scan.findings.join(", ")}). Correct the source examples and seal a revised batch before training.`);
+  const source = LearningBatchDatasetSourceRefSchema.parse({
+    schemaVersion: "openpond.learningBatchDatasetSource.v1",
+    kind: "learning_batch",
+    id: `batch-source-${input.batch.contentHash.slice(0, 40)}`,
+    profileId: input.profileId,
+    title: input.definition.name,
+    sourceHash: input.batch.contentHash,
+    occurredAt: input.batch.sealedAt,
+    batch: learningRef(input.batch),
+    taskDefinition: input.batch.taskDefinition,
+    admittedBy: input.batch.sealedBy,
+    licensingStatus: "approved",
+    secretScanStatus: scan.secretStatus,
+    piiScanStatus: scan.piiStatus,
+    metadata: { admission: input.admissionContext ?? "explicit_local_batch_review", privacyScanner: "openpond-evidence-v1", findings: scan.findings }
+  });
+  return materializeLearningBatchTaskset({ ...input, source });
+}
+
+// src/managed-training-preparation.ts
+import { z as z2 } from "zod";
+async function prepareManagedTrainingSubmission(raw) {
+  const input = structuredClone(raw);
+  const { project, recipe, taskset, approval } = input;
+  const manifest = HarnessRunManifestSchema.parse(input.manifest);
+  const bundle = ResolvedTrainingBundleManifestSchema.parse(input.bundleManifest);
+  const { contentHash: manifestHash, ...manifestContent } = manifest;
+  const { contentHash: bundleHash, ...bundleContent } = bundle;
+  if (contentHash(manifestContent) !== manifestHash || contentHash(bundleContent) !== bundleHash || manifest.resolvedBundleHash !== bundleHash || contentHash(manifest.harnessRelease) !== contentHash(bundle.harnessRelease) || contentHash(manifest.datasetRelease) !== contentHash(bundle.datasetRelease) || contentHash(manifest.evidenceSets) !== contentHash(bundle.evidenceSetRelease ? [bundle.evidenceSetRelease] : [])) {
+    throw new Error("The managed training manifest or resolved bundle changed.");
+  }
+  if (!project.hosted || project.hosted.syncedSourceRevision !== project.revision || project.hosted.portableProjectId !== project.id) throw new Error("Sync the exact Model Project revision before preparing managed training.");
+  const baseModel = project.trainingSetup.baseModel;
+  if (!baseModel || baseModel.modelId !== manifest.model.source || baseModel.revision !== manifest.model.revision || baseModel.tokenizerRevision !== manifest.model.tokenizerRevision || baseModel.chatTemplateHash !== manifest.model.chatTemplateHash) {
+    throw new Error("The synced Model Project base Model does not match the Run manifest.");
+  }
+  if (recipe.method !== "grpo" || contentHash(recipe) !== manifest.recipe.configHash || approval.approvalHash !== manifest.approval.approvalHash || approval.maximumSpendUsd !== manifest.approval.maximumSpendUsd) {
+    throw new Error("Managed training requires the exact approved GRPO recipe and spend ceiling.");
+  }
+  const limits = z2.object({ wallTimeMs: z2.number().positive() }).parse(recipe.resourceLimits);
+  if (input.idempotencyKey !== void 0) z2.string().trim().min(16).max(191).parse(input.idempotencyKey);
+  const files = verifyFiles(bundle, input.files);
+  const evaluationSource = TrainingEvaluationSourceSchema.parse(input.evaluationSource);
+  const evaluationFile = files.find((file) => file.path === TRAINING_EVALUATION_SOURCE_PATH);
+  if (!evaluationFile || contentHash(JSON.parse(Buffer.from(evaluationFile.content, "base64").toString("utf8"))) !== contentHash(evaluationSource)) {
+    throw new Error("The evaluation source differs from the immutable training bundle.");
+  }
+  const evaluation = await trainingEvaluationSourceRef(evaluationSource);
+  const payload = {
+    schemaVersion: "openpond.managedRlPortableSubmission.v1",
+    sourceRunRef: `openpond:model-run:${manifest.id}`,
+    name: `OpenPond Managed \xB7 ${project.id}`.slice(0, 191),
+    idempotencyKey: input.idempotencyKey ?? `openpond-managed:${manifestHash}`.slice(0, 191),
+    modelProject: { id: project.hosted.projectId, portableProjectId: project.hosted.portableProjectId },
+    manifest,
+    sourceTaskset: taskset,
+    modelImprovementQualification: input.modelImprovementQualification ?? null,
+    recipe,
+    resolvedBundle: { manifest: bundle, files },
+    validationTasks: evaluationSource.tasks,
+    validationAssets: evaluationSource.assets
+  };
+  const artifactContent = {
+    schemaVersion: "openpond.trainingInputArtifactUpload.v2",
+    kind: "portable_training_bundle",
+    idempotencyKey: `stage:${input.idempotencyKey ?? manifestHash}`,
+    sourceManifest: { id: manifest.id, contentHash: manifestHash },
+    payload
+  };
+  const artifact = await parseAndVerifyTrainingInputArtifactUpload({ ...artifactContent, contentHash: await trainingInputArtifactUploadHash(artifactContent) });
+  const jobContent = {
+    schemaVersion: "openpond.trainingJobSubmission.v2",
+    idempotencyKey: input.idempotencyKey ?? `openpond-training-v2:${manifestHash}`,
+    name: `OpenPond Managed \xB7 ${project.id}`.slice(0, 200),
+    source: {
+      modelProject: { id: project.hosted.projectId, portableProjectId: project.hosted.portableProjectId, revision: project.revision, contentHash: project.hosted.etag },
+      harnessRunManifest: artifactContent.sourceManifest,
+      harnessRelease: manifest.harnessRelease,
+      taskset,
+      tasksetRelease: { id: taskset.id, contentHash: taskset.contentHash },
+      dataset: bundle.datasetRelease,
+      evaluation,
+      evidenceSets: bundle.evidenceSetRelease ? [bundle.evidenceSetRelease] : []
+    },
+    job: { kind: "policy_optimize", baseModel, recipe, rewardSource: input.rewardSource, resumeFrom: input.resumeFrom },
+    requestedCapabilities: [
+      { id: "managed_rl.policy.grpo", version: "1", required: true },
+      { id: `managed_rl.rollouts.${manifest.runtimeTarget.placement}`, version: "1", required: true },
+      ...project.trainingSetup.managedGpuRequirement === "h100_hbm3" ? [{ id: "managed_rl.gpu.h100_hbm3", version: "1", required: true }] : []
+    ],
+    placementObjective: project.trainingSetup.managedGpuPlacementObjective,
+    budget: { maximumSpendUsd: approval.maximumSpendUsd, maximumWallSeconds: Math.ceil(limits.wallTimeMs / 1e3) },
+    approval: { ...approval, approvedAt: manifest.approval.approvedAt, exportApproved: true }
+  };
+  const submission = await parseAndVerifyTrainingJobSubmission({ ...jobContent, contentHash: await trainingJobSubmissionHash(jobContent) });
+  return { artifact, submission };
+}
+function verifyFiles(bundle, files) {
+  if (files.length !== bundle.files.length || new Set(files.map((file) => file.path)).size !== files.length) throw new Error("The managed bundle file inventory changed.");
+  const indexed = new Map(files.map((file) => [file.path, file]));
+  return bundle.files.map((expected) => {
+    const file = indexed.get(expected.path);
+    if (!file || file.path.includes("\\") || file.path.includes("\0") || file.path.split("/").some((part) => !part || part === "." || part === "..") || file.path === "bundle-manifest.json" || file.encoding !== "base64") throw new Error("The managed bundle contains an invalid file.");
+    const bytes2 = Buffer.from(file.content, "base64");
+    if (bytes2.toString("base64") !== file.content || file.sha256 !== expected.sha256 || file.sizeBytes !== expected.sizeBytes || bytes2.byteLength !== expected.sizeBytes || sha256(bytes2) !== expected.sha256) throw new Error(`Managed training bundle file ${file.path} changed before upload.`);
+    return file;
+  });
+}
+
+// src/training-bundle.ts
+function buildTasksetTrainingBundle(input) {
+  const { taskset, modelProject, harnessRelease, tasksetRelease } = input;
+  const setup = modelProject.trainingSetup;
+  const releasedHarness = ImmutableReleaseRefSchema.parse(harnessRelease);
+  const releasedTaskset = ImmutableReleaseRefSchema.parse(tasksetRelease);
+  void input.openpondRelease;
+  void input.workerProtocol;
+  const actualTasksetHash = computeTasksetHash(taskset);
+  if (actualTasksetHash !== taskset.contentHash) {
+    throw new Error(
+      "Taskset authoring state changed after its release was selected."
+    );
+  }
+  if (!setup.baseModel?.revision || !setup.baseModel.tokenizerRevision || !setup.baseModel.chatTemplateHash || !setup.recipe || !setup.tasksetRef || setup.tasksetRef.id !== taskset.id || setup.tasksetRef.contentHash !== taskset.contentHash) {
+    throw new Error(
+      "Model Run must bind an exact Taskset, Model revision, tokenizer, chat template, and Recipe."
+    );
+  }
+  const profileRelease = taskset.profileRelease ?? {
+    id: `profile_${taskset.profileId}`,
+    revision: taskset.revision,
+    contentHash: contentHash({
+      profileId: taskset.profileId,
+      sourceCommit: taskset.authoringProvenance.sourceCommit,
+      skillHash: taskset.authoringProvenance.skillHash
+    })
+  };
+  const assets = /* @__PURE__ */ new Map();
+  if (input.evaluationSource) {
+    const evaluation = TrainingEvaluationSourceSchema.parse(input.evaluationSource);
+    if (contentHash(evaluation.taskset) !== contentHash(setup.evaluationTasksetRef)) {
+      throw new Error("The evaluation source differs from the prepared Model configuration.");
+    }
+    assertTrainingEvaluationIsolation(taskset.tasks.filter((task) => task.split === "train"), evaluation.tasks);
+    assets.set(TRAINING_EVALUATION_SOURCE_PATH, new TextEncoder().encode(canonicalJson(evaluation)));
+  } else if (setup.evaluationTasksetRef) {
+    throw new Error("The prepared Model requires its pinned evaluation source bytes.");
+  }
+  const harnessSource = input.harnessSource ? validateHarnessSourcePackage(input.harnessSource, releasedHarness) : null;
+  if (setup.harnessRelease && !harnessSource) {
+    throw new Error("A selected Harness requires its complete immutable source package.");
+  }
+  if (harnessSource && (!setup.harnessRelease || setup.harnessRelease.id !== releasedHarness.id || setup.harnessRelease.contentHash !== releasedHarness.contentHash)) {
+    throw new Error("Harness source differs from the Model's explicit selection.");
+  }
+  if (harnessSource) {
+    const leavesLocalHost = input.runtime.placement !== "local" || input.compute.kind !== "local";
+    if (leavesLocalHost && (!harnessSource.agentSnapshot.portability.portable || harnessSource.harnessRelease.files.some((file) => file.visibility === "host_private"))) {
+      throw new Error("The selected Harness contains source that cannot leave its local host.");
+    }
+    addJsonAsset(assets, "harness/source-package.json", harnessSource);
+  }
+  addJsonAsset(assets, "harness/execution.json", HarnessSourceSelectionSchema.parse({
+    schemaVersion: "openpond.harnessSourceSelection.v1",
+    mode: harnessSource ? "selected_release" : "taskset_owned",
+    harnessRelease: releasedHarness,
+    sourcePackageHash: harnessSource?.contentHash ?? null
+  }));
+  const rewardExecution = resolvePortableTasksetRewardExecution(taskset, input.rewardExecution);
+  if (rewardExecution) {
+    const verifierAssets = input.verifierAssets ?? [];
+    const references = compileBoundGraders(rewardExecution.binding, rewardExecution.rewards).flatMap((grader) => grader.kind === "custom_verifier" ? [grader.verifierRef] : []);
+    const expected = new Set(references.map((reference) => reference.id));
+    if (new Set(verifierAssets.map((asset) => asset.id)).size !== verifierAssets.length || verifierAssets.some((asset) => !expected.has(asset.id))) throw new Error("Unexpected or duplicate private verifier asset.");
+    for (const reference of references) {
+      const asset = verifierAssets.find((asset2) => asset2.id === reference.id);
+      if (!asset || reference.visibility !== "verifier") throw new Error("Training bundle requires its private verifier asset.");
+      verifyLearningTextAsset2(asset, reference);
+    }
+    addJsonAsset(assets, "reward-binding.json", { kind: "reward_binding_v1", binding: rewardExecution.binding, rewards: rewardExecution.rewards, assets: verifierAssets });
+  } else if (input.verifierAssets?.length) {
+    throw new Error("Private verifier assets require a published Reward binding.");
+  }
+  addJsonAsset(assets, "environment.json", {
+    schemaVersion: "openpond.harnessEnvironment.v1",
+    environment: taskset.environment,
+    capabilities: taskset.capabilities,
+    policy: taskset.policy,
+    outputContract: taskset.metadata.tasksetOutputContract?.mode === "text" ? null : taskset.metadata.tasksetOutputContract ?? null
+  });
+  addJsonAsset(assets, "graders.json", {
+    schemaVersion: "openpond.harnessGraders.v1",
+    graders: taskset.graders,
+    fixtures: taskset.graderFixtures
+  });
+  addJsonAsset(assets, "tool-contract.json", {
+    schemaVersion: "openpond.harnessToolContract.v1",
+    toolNames: taskset.environment.toolNames,
+    actionBindings: taskset.environment.actionBindings ?? [],
+    capabilities: taskset.capabilities,
+    connectedAppScopes: taskset.policy.connectedAppScopes
+  });
+  const trainTasks = taskset.tasks.filter((task) => task.split === "train");
+  if (trainTasks.length > 0) {
+    addJsonAsset(assets, "dataset/train.json", {
+      schemaVersion: "openpond.datasetSplit.v1",
+      split: "train",
+      tasks: trainTasks
+    });
+    addTasksetAssets({
+      assets,
+      tasks: trainTasks,
+      tasksetAssetBytes: input.tasksetAssetBytes ?? /* @__PURE__ */ new Map()
+    });
+  } else if (taskset.datasetArtifact) {
+    addJsonAsset(assets, "dataset/artifact.json", taskset.datasetArtifact);
+  } else {
+    throw new Error("Taskset has no training dataset.");
+  }
+  const approvedSignals = Object.values(taskset.learningSignals).flat().filter((signal) => signal.approved);
+  for (const signal of approvedSignals) {
+    const value = bytes(signal);
+    assets.set(`evidence/signals/${sha256(value)}.json`, value);
+  }
+  const datasetRelease = {
+    id: `dataset_${taskset.id}_r${taskset.revision}`,
+    contentHash: contentHash({
+      taskset: releasedTaskset,
+      sourceRefs: taskset.sourceRefs,
+      datasetArtifact: taskset.datasetArtifact ?? null,
+      trainTasks
+    })
+  };
+  const evidenceSetRelease = approvedSignals.length > 0 ? {
+    id: `evidence_${taskset.id}_r${taskset.revision}`,
+    contentHash: contentHash({
+      taskset: releasedTaskset,
+      harnessRelease: releasedHarness,
+      datasetRelease,
+      profileRelease,
+      signals: approvedSignals
+    })
+  } : null;
+  const bundleContent = ResolvedTrainingBundleContentSchema.parse({
+    schemaVersion: "openpond.resolvedTrainingBundle.v1",
+    projection: "trainer",
+    harnessRelease: releasedHarness,
+    datasetRelease,
+    evidenceSetRelease,
+    files: [...assets.entries()].sort(([left], [right]) => left.localeCompare(right)).map(([assetPath, value]) => ({
+      path: assetPath,
+      sha256: sha256(value),
+      sizeBytes: value.byteLength
+    }))
+  });
+  const resolvedBundleManifest = ResolvedTrainingBundleManifestSchema.parse({
+    ...bundleContent,
+    contentHash: contentHash(bundleContent)
+  });
+  const manifestContent = HarnessRunManifestContentSchema.parse({
+    schemaVersion: "openpond.harnessRunManifest.v1",
+    id: `manifest_${input.modelRunId}_${input.approval.approvalHash.slice(0, 16)}`,
+    harnessRelease,
+    datasetRelease,
+    evidenceSets: evidenceSetRelease ? [evidenceSetRelease] : [],
+    model: {
+      source: setup.baseModel.modelId,
+      revision: setup.baseModel.revision,
+      artifactHash: null,
+      tokenizerRevision: setup.baseModel.tokenizerRevision,
+      chatTemplateHash: setup.baseModel.chatTemplateHash
+    },
+    recipe: {
+      method: setup.recipe.method,
+      version: "openpond.trainingRecipe.v1",
+      configHash: contentHash(setup.recipe)
+    },
+    runtimeTarget: input.runtime,
+    computeTarget: input.compute,
+    engine: input.engine,
+    resolvedBundleHash: resolvedBundleManifest.contentHash,
+    secretLeaseRefs: input.secretLeaseRefs ?? [],
+    approval: input.approval,
+    createdAt: modelProject.updatedAt
+  });
+  const manifest = HarnessRunManifestSchema.parse({
+    ...manifestContent,
+    contentHash: contentHash(manifestContent)
+  });
+  return {
+    manifest,
+    resolvedBundleManifest,
+    assets,
+    profileRelease,
+    harnessRelease: releasedHarness,
+    tasksetRelease: releasedTaskset,
+    datasetRelease,
+    evidenceSetRelease
+  };
+}
+function addTasksetAssets(input) {
+  const expected = /* @__PURE__ */ new Set();
+  for (const task of input.tasks) {
+    for (const asset of task.assets ?? []) {
+      if (expected.has(asset.artifactRef)) {
+        throw new Error(
+          `Training asset path ${asset.artifactRef} is shared by multiple tasks.`
+        );
+      }
+      expected.add(asset.artifactRef);
+      const value = input.tasksetAssetBytes.get(asset.artifactRef);
+      if (!value) {
+        throw new Error(
+          `Resolved Training Bundle is missing Work asset ${asset.artifactRef}.`
+        );
+      }
+      if (value.byteLength !== asset.sizeBytes || sha256(value) !== asset.sha256) {
+        throw new Error(
+          `Resolved Training Bundle Work asset ${asset.artifactRef} failed immutable verification.`
+        );
+      }
+      input.assets.set(asset.artifactRef, value);
+    }
+  }
+  for (const assetPath of input.tasksetAssetBytes.keys()) {
+    if (!expected.has(assetPath)) {
+      throw new Error(
+        `Resolved Training Bundle received unexpected Work asset ${assetPath}.`
+      );
+    }
+  }
+}
+function addJsonAsset(assets, assetPath, value) {
+  assets.set(assetPath, bytes(value));
+}
+function bytes(value) {
+  return Buffer.from(canonicalJson(value), "utf8");
+}
+export {
+  ComputeTargetBindingSchema,
+  HarnessRunManifestContentSchema,
+  HarnessRunManifestSchema,
+  HarnessRuntimeTargetBindingSchema,
+  OpaqueSecretLeaseRefSchema,
+  ResolvedTrainingBundleContentSchema,
+  ResolvedTrainingBundleManifestSchema,
+  ScopedSecretDeclarationSchema,
+  TrainingEngineBindingSchema,
+  buildTasksetTrainingBundle,
+  materializeLearningBatchTaskset,
+  prepareManagedTrainingSubmission,
+  prepareReviewedLearningBatch,
+  scanAndRedactEvidence
+};
+//# sourceMappingURL=training-bundle.js.map