pluribus-context 0.3.21 → 0.3.26

package/examples/context-input-evidence/convert-skill-log.mjs

@@ -0,0 +1,161 @@
+#!/usr/bin/env node
+import { createHash } from 'node:crypto';
+import { readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const inputPath = join(here, 'skill-invocation-log.jsonl');
+const receiptPath = join(here, 'skill-receipt.ndjson');
+const tracePath = join(here, 'skill-otel-trace.json');
+
+function sha256(value) {
+  return `sha256:${createHash('sha256').update(value).digest('hex')}`;
+}
+
+function parseJsonl(filePath) {
+  return readFileSync(filePath, 'utf8')
+    .trim()
+    .split('\n')
+    .filter(Boolean)
+    .map((line) => JSON.parse(line));
+}
+
+function attributeValue(value) {
+  if (typeof value === 'boolean') return { boolValue: value };
+  if (typeof value === 'number') return { intValue: value };
+  return { stringValue: String(value ?? '') };
+}
+
+function toOtelAttributes(attributes) {
+  return Object.entries(attributes).map(([key, value]) => ({
+    key,
+    value: attributeValue(value)
+  }));
+}
+
+const records = parseJsonl(inputPath);
+const session = records.find((record) => record.type === 'session.start');
+if (!session) {
+  throw new Error('skill-invocation-log.jsonl must contain a session.start record');
+}
+
+const skillRecords = records.filter((record) => record.type === 'skill.invoked');
+const duplicateGroups = new Map();
+
+for (const record of skillRecords) {
+  const deliveredHash = sha256(record.delivered_text);
+  const key = `${record.session_id ?? session.session_id}:${record.skill_id}:${record.activation}:${record.hook_event}:${deliveredHash}`;
+  duplicateGroups.set(key, (duplicateGroups.get(key) ?? 0) + 1);
+}
+
+const events = skillRecords.map((record) => {
+  const sourceBytesHash = sha256(record.source_text);
+  const deliveredHash = sha256(record.delivered_text);
+  const dedupeScope = 'conversation';
+  const dedupeKey = `${dedupeScope}:${record.skill_id}:${record.activation}:${record.hook_event}:${deliveredHash}`;
+  const duplicateCount = duplicateGroups.get(`${session.session_id}:${record.skill_id}:${record.activation}:${record.hook_event}:${deliveredHash}`) ?? 1;
+
+  return {
+    trace_id: 'demo-trace-skill-context-receipts',
+    span_id: session.session_id,
+    name: 'context.skill.invoked',
+    time: record.time,
+    attributes: {
+      'context.input.kind': 'skill',
+      'context.skill.id': record.skill_id,
+      'context.skill.name': record.skill_name,
+      'context.skill.plugin': record.plugin,
+      'context.input.source.path': record.source_path,
+      'context.input.source.bytes_hash': sourceBytesHash,
+      'context.input.delivered.hash': deliveredHash,
+      'session.id': session.session_id,
+      'gen_ai.conversation.id': session.conversation_id,
+      'context.input.loaded_by': record.activation.startsWith('hook_') ? 'hook' : 'skill-runtime',
+      'context.input.activation': record.activation,
+      'context.input.hook_event': record.hook_event,
+      'context.input.scope': record.plugin === 'repo-local-skills' ? 'repo' : 'plugin',
+      'context.input.applies_to': session.agent,
+      'context.input.why_loaded': record.trigger,
+      'context.input.expected_benefit': record.expected_benefit,
+      'context.input.eval_gap': record.eval_gap,
+      'context.input.duplicate.dedupe_key': dedupeKey,
+      'context.input.duplicate.dedupe_scope': dedupeScope,
+      'context.input.duplicate.suppression_policy': record.suppression_policy,
+      'context.input.duplicate.role': record.duplicate_role,
+      'context.input.duplicate.candidate_count': duplicateCount,
+      'privacy.raw_context_recorded': false,
+      'privacy.raw_prompt_recorded': false,
+      'privacy.raw_tool_args_recorded': false
+    }
+  };
+});
+
+writeFileSync(receiptPath, `${events.map((event) => JSON.stringify(event)).join('\n')}\n`);
+
+const trace = {
+  resourceSpans: [
+    {
+      resource: {
+        attributes: toOtelAttributes({
+          'service.name': 'pluribus-context-input-evidence',
+          'telemetry.sdk.language': 'javascript',
+          'pluribus.demo': 'skill-context-receipts'
+        })
+      },
+      scopeSpans: [
+        {
+          scope: { name: 'pluribus.context-input-evidence', version: '0.0.0-demo' },
+          spans: [
+            {
+              traceId: 'demo-trace-skill-context-receipts',
+              spanId: session.session_id,
+              name: 'agent.session',
+              kind: 'SPAN_KIND_INTERNAL',
+              startTimeUnixNano: '0',
+              endTimeUnixNano: '0',
+              attributes: toOtelAttributes({
+                'session.id': session.session_id,
+                'gen_ai.conversation.id': session.conversation_id,
+                'agent.name': session.agent,
+                'workspace.name': session.workspace,
+                'privacy.raw_context_recorded': false
+              }),
+              events: events.map((event) => ({
+                name: event.name,
+                timeUnixNano: '0',
+                attributes: toOtelAttributes(event.attributes)
+              }))
+            }
+          ]
+        }
+      ]
+    }
+  ]
+};
+
+writeFileSync(tracePath, `${JSON.stringify(trace, null, 2)}\n`);
+
+const selected = events.filter((event) => event.attributes['context.input.duplicate.role'] === 'selected').length;
+const suppressed = events.filter((event) => event.attributes['context.input.duplicate.role'] === 'suppressed').length;
+const rawLeakStrings = ['Weekly brief\nSummarize', 'After a commit, check tests', 'Post-commit review checklist loaded'];
+const traceText = JSON.stringify(trace);
+const receiptText = events.map((event) => JSON.stringify(event)).join('\n');
+const leaksRawText = rawLeakStrings.some((value) => traceText.includes(value) || receiptText.includes(value));
+
+const summary = {
+  schema: 'pluribus.skillContextReceipt.demo.v0',
+  eventCount: events.length,
+  selectedSkillLoads: selected,
+  suppressedDuplicateLoads: suppressed,
+  activations: [...new Set(events.map((event) => event.attributes['context.input.activation']))],
+  hookEvents: [...new Set(events.map((event) => event.attributes['context.input.hook_event']))],
+  includesExpectedBenefit: events.every((event) => Boolean(event.attributes['context.input.expected_benefit'])),
+  includesEvalGap: events.every((event) => Boolean(event.attributes['context.input.eval_gap'])),
+  rawTextCopiedToReceipt: leaksRawText,
+  receiptPath: 'examples/context-input-evidence/skill-receipt.ndjson',
+  tracePath: 'examples/context-input-evidence/skill-otel-trace.json',
+  lesson: 'Skill telemetry should prove invocation, activation, delivered identity, duplicate policy, expected benefit, and eval gaps without logging raw skill prompts.'
+};
+
+console.log(JSON.stringify(summary, null, 2));

package/examples/context-input-evidence/convert-skill-registry-log.mjs

@@ -0,0 +1,246 @@
+#!/usr/bin/env node
+import { createHash } from 'node:crypto';
+import { readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const inputPath = process.argv[2] ? resolve(process.argv[2]) : join(here, 'sample-skill-registry-log.jsonl');
+const receiptPath = process.argv[3] ? resolve(process.argv[3]) : join(here, 'skill-registry-receipt.ndjson');
+const tracePath = process.argv[4] ? resolve(process.argv[4]) : join(here, 'skill-registry-otel-trace.json');
+
+function sha256(value) {
+  return `sha256:${createHash('sha256').update(String(value)).digest('hex')}`;
+}
+
+function readJsonl(path) {
+  return readFileSync(path, 'utf8')
+    .trim()
+    .split('\n')
+    .filter(Boolean)
+    .map((line, index) => {
+      try {
+        return JSON.parse(line);
+      } catch (error) {
+        throw new Error(`Invalid JSONL at ${path}:${index + 1}: ${error.message}`);
+      }
+    });
+}
+
+function unixNano(isoTimestamp) {
+  return `${BigInt(Date.parse(isoTimestamp)) * 1_000_000n}`;
+}
+
+function otelValue(value) {
+  if (Array.isArray(value)) return { arrayValue: { values: value.map((item) => otelValue(item)) } };
+  if (typeof value === 'boolean') return { boolValue: value };
+  if (typeof value === 'number' && Number.isInteger(value)) return { intValue: String(value) };
+  if (typeof value === 'number') return { doubleValue: value };
+  if (typeof value === 'string') {
+    if (value === 'true' || value === 'false') return { boolValue: value === 'true' };
+    if (/^-?\d+$/.test(value)) return { intValue: value };
+    return { stringValue: value };
+  }
+  if (value == null) return { stringValue: '' };
+  return { stringValue: JSON.stringify(value) };
+}
+
+function attributesToOtel(attributes) {
+  return Object.entries(attributes).map(([key, value]) => ({ key, value: otelValue(value) }));
+}
+
+const records = readJsonl(inputPath);
+const index = records.find((record) => record.type === 'skill.index');
+if (!index) throw new Error(`No skill.index record found in ${inputPath}`);
+
+const sessionId = index.session_id ?? 'demo-session-skill-registry';
+const conversationId = index.conversation_id ?? sessionId;
+const traceId = sha256(`${sessionId}:trace`).replace('sha256:', '').slice(0, 32);
+const spanId = sha256(`${sessionId}:span`).replace('sha256:', '').slice(0, 16);
+
+const events = records.map((record) => {
+  const skillIdHash = record.skill_id ? sha256(record.skill_id) : undefined;
+  const baseAttributes = {
+    'session.id': sessionId,
+    'gen_ai.conversation.id': record.conversation_id ?? conversationId,
+    'context.skill.registry.scope': record.registry_scope ?? index.registry_scope ?? 'unknown',
+    'context.skill.privacy.raw_body_exported': false,
+    'context.skill.audit_gap': 'receipt proves registry/index/read/injection boundary, not semantic skill quality'
+  };
+
+  if (record.type === 'skill.index') {
+    return {
+      trace_id: traceId,
+      span_id: spanId,
+      name: 'context.skill.registry.index.loaded',
+      time: record.time,
+      attributes: {
+        ...baseAttributes,
+        'context.skill.index.strategy': record.index_strategy ?? 'unknown',
+        'context.skill.candidate_count': record.candidate_skill_count ?? 0,
+        'context.skill.indexed_count': record.indexed_skill_count ?? 0,
+        'context.skill.index.hash': sha256(`${sessionId}:skill-index:${record.indexed_skill_count ?? 0}:${record.index_strategy ?? 'unknown'}`),
+        'context.skill.index.token_bucket': record.index_token_bucket ?? 'unknown',
+        'context.skill.body.token_bucket': record.body_token_bucket ?? 'not_loaded',
+        'context.skill.cache.status': record.cache_status ?? 'unknown',
+        'context.skill.injection.policy': record.injection_policy ?? 'unknown'
+      }
+    };
+  }
+
+  if (record.type === 'skill.store') {
+    return {
+      trace_id: traceId,
+      span_id: spanId,
+      name: 'context.skill.registry.skill.stored',
+      time: record.time,
+      attributes: {
+        ...baseAttributes,
+        'context.skill.id_hash': skillIdHash,
+        'context.skill.source': record.source ?? 'unknown',
+        'context.skill.store.reason': record.store_reason ?? 'unknown',
+        'context.skill.body.hash': sha256(`${record.skill_id}:body:${record.body_token_bucket ?? 'unknown'}`),
+        'context.skill.body.token_bucket': record.body_token_bucket ?? 'unknown',
+        'context.skill.write.status': record.write_status ?? 'unknown'
+      }
+    };
+  }
+
+  if (record.type === 'skill.read') {
+    return {
+      trace_id: traceId,
+      span_id: spanId,
+      name: 'context.skill.registry.skill.read',
+      time: record.time,
+      attributes: {
+        ...baseAttributes,
+        'context.skill.id_hash': skillIdHash,
+        'context.skill.read.reason': record.read_reason ?? 'unknown',
+        'context.skill.body.hash': sha256(`${record.skill_id}:body:${record.body_token_bucket ?? 'unknown'}`),
+        'context.skill.body.token_bucket': record.body_token_bucket ?? 'unknown',
+        'context.skill.read.status': record.read_status ?? 'unknown'
+      }
+    };
+  }
+
+  if (record.type === 'skill.inject') {
+    return {
+      trace_id: traceId,
+      span_id: spanId,
+      name: 'context.skill.registry.skill.injected',
+      time: record.time,
+      attributes: {
+        ...baseAttributes,
+        'context.skill.id_hash': skillIdHash,
+        'context.skill.injection.reason': record.injection_reason ?? 'unknown',
+        'context.skill.delivered.hash': sha256(`${record.skill_id}:delivered:${record.delivered_token_bucket ?? 'unknown'}`),
+        'context.skill.delivered.token_bucket': record.delivered_token_bucket ?? 'unknown',
+        'context.skill.delivery.status': record.delivery_status ?? 'unknown',
+        'context.skill.suppressed_count': record.suppressed_count ?? 0
+      }
+    };
+  }
+
+  if (record.type === 'skill.reuse') {
+    const selectedCount = record.selected_count ?? 0;
+    const decisiveCount = record.decisive_count ?? 0;
+    const supportingCount = record.supporting_count ?? 0;
+    const unusedCount = record.unused_count ?? 0;
+    const unknownCount = record.unknown_count ?? 0;
+    const accountedCount = decisiveCount + supportingCount + unusedCount + unknownCount;
+    if (accountedCount !== selectedCount) {
+      throw new Error(`Invalid skill reuse accounting: selected_count (${selectedCount}) must equal decisive + supporting + unused + unknown (${accountedCount})`);
+    }
+
+    return {
+      trace_id: traceId,
+      span_id: spanId,
+      name: 'context.skill.registry.reuse.evaluated',
+      time: record.time,
+      attributes: {
+        ...baseAttributes,
+        'decision.id_hash': sha256(record.decision_id ?? 'unknown-decision'),
+        'context.skill.id_hash': skillIdHash,
+        'context.skill.selected_count': selectedCount,
+        'context.skill.suppressed_count': record.suppressed_count ?? 0,
+        'context.skill.relevance.decisive_count': decisiveCount,
+        'context.skill.relevance.supporting_count': supportingCount,
+        'context.skill.relevance.unused_count': unusedCount,
+        'context.skill.relevance.unknown_count': unknownCount,
+        'context.skill.relevance.accounted_count': accountedCount,
+        'context.skill.relevance.invariant': 'selected_count == decisive_count + supporting_count + unused_count + unknown_count',
+        'context.skill.relevance.outcome': record.outcome ?? 'unknown'
+      }
+    };
+  }
+
+  throw new Error(`Unsupported record type: ${record.type}`);
+});
+
+writeFileSync(receiptPath, `${events.map((event) => JSON.stringify(event)).join('\n')}\n`);
+
+const eventTimes = events.map((event) => Date.parse(event.time)).filter(Number.isFinite);
+const startTimeMs = Math.min(...eventTimes);
+const endTimeMs = Math.max(...eventTimes) + 1;
+
+const otlpTrace = {
+  resourceSpans: [
+    {
+      resource: {
+        attributes: attributesToOtel({
+          'service.name': 'pluribus-skill-registry-demo',
+          'service.version': '0.0.0-fixture',
+          'deployment.environment.name': 'local-fixture'
+        })
+      },
+      scopeSpans: [
+        {
+          scope: { name: 'pluribus.skill_registry.demo', version: '0.0.0-fixture' },
+          spans: [
+            {
+              traceId,
+              spanId,
+              parentSpanId: '',
+              name: 'agent.session',
+              kind: 1,
+              startTimeUnixNano: `${BigInt(startTimeMs) * 1_000_000n}`,
+              endTimeUnixNano: `${BigInt(endTimeMs) * 1_000_000n}`,
+              attributes: attributesToOtel({
+                'session.id': sessionId,
+                'gen_ai.conversation.id': conversationId,
+                'gen_ai.agent.name': index.agent ?? 'unknown',
+                'gen_ai.operation.name': 'agent_session'
+              }),
+              events: events.map((event) => ({
+                name: event.name,
+                timeUnixNano: unixNano(event.time),
+                attributes: attributesToOtel(event.attributes)
+              }))
+            }
+          ]
+        }
+      ]
+    }
+  ]
+};
+
+writeFileSync(tracePath, `${JSON.stringify(otlpTrace, null, 2)}\n`);
+
+const rawLeakNeedles = [
+  'Acme-Co',
+  'Stripe prod incident',
+  'webhook secret',
+  'sk_live_private_demo',
+  '/private/work/acme',
+  'customer payload'
+];
+const receiptText = readFileSync(receiptPath, 'utf8');
+const traceText = readFileSync(tracePath, 'utf8');
+for (const needle of rawLeakNeedles) {
+  if (receiptText.includes(needle) || traceText.includes(needle)) {
+    throw new Error(`Raw/private fixture content leaked into receipt or trace: ${needle}`);
+  }
+}
+
+console.log(`Wrote ${events.length} skill registry receipt events to ${receiptPath}`);
+console.log(`Wrote OTLP-style trace to ${tracePath}`);

package/examples/context-input-evidence/convert-skill-routing-log.mjs

@@ -0,0 +1,253 @@
+#!/usr/bin/env node
+import { createHash } from 'node:crypto';
+import { readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const inputPath = process.argv[2] ? resolve(process.argv[2]) : join(here, 'sample-skill-routing-log.jsonl');
+const receiptPath = process.argv[3] ? resolve(process.argv[3]) : join(here, 'skill-routing-receipt.ndjson');
+const tracePath = process.argv[4] ? resolve(process.argv[4]) : join(here, 'skill-routing-otel-trace.json');
+
+function sha256(value) {
+  return `sha256:${createHash('sha256').update(value ?? '').digest('hex')}`;
+}
+
+function hashRef(value) {
+  return sha256(value ?? '').slice(0, 19);
+}
+
+function readJsonl(path) {
+  return readFileSync(path, 'utf8')
+    .trim()
+    .split('\n')
+    .filter(Boolean)
+    .map((line, index) => {
+      try {
+        return JSON.parse(line);
+      } catch (error) {
+        throw new Error(`Invalid JSONL at ${path}:${index + 1}: ${error.message}`);
+      }
+    });
+}
+
+function unixNano(isoTimestamp) {
+  return `${BigInt(Date.parse(isoTimestamp)) * 1_000_000n}`;
+}
+
+function otelValue(value) {
+  if (typeof value === 'boolean') return { boolValue: value };
+  if (typeof value === 'number' && Number.isInteger(value)) return { intValue: String(value) };
+  if (typeof value === 'number') return { doubleValue: value };
+  if (value == null) return { stringValue: '' };
+  return { stringValue: String(value) };
+}
+
+function attributesToOtel(attributes) {
+  return Object.entries(attributes).map(([key, value]) => ({ key, value: otelValue(value) }));
+}
+
+function tokenBucket(value) {
+  if (value < 1_000) return 'under_1k';
+  if (value < 10_000) return 'under_10k';
+  if (value < 50_000) return 'under_50k';
+  return 'over_50k';
+}
+
+function scoreBucket(value) {
+  if (value >= 0.9) return 'gte_0_90';
+  if (value >= 0.75) return 'gte_0_75';
+  if (value >= 0.5) return 'gte_0_50';
+  return 'lt_0_50';
+}
+
+function rateBucket(value) {
+  if (value >= 0.95) return 'gte_0_95';
+  if (value >= 0.75) return 'gte_0_75';
+  if (value >= 0.5) return 'gte_0_50';
+  return 'lt_0_50';
+}
+
+const records = readJsonl(inputPath);
+const benchmark = records.find((record) => record.type === 'benchmark.start');
+const index = records.find((record) => record.type === 'skill.router.index.loaded');
+const cases = records.filter((record) => record.type === 'skill.router.case.evaluated');
+const bodyLoads = records.filter((record) => record.type === 'skill.body.loaded');
+const completed = records.find((record) => record.type === 'skill.router.benchmark.completed');
+
+if (!benchmark || !index || cases.length === 0 || !completed) {
+  throw new Error(`Expected benchmark.start, skill.router.index.loaded, skill.router.case.evaluated, and skill.router.benchmark.completed records in ${inputPath}`);
+}
+
+const traceSeed = `${benchmark.session_id}:${benchmark.benchmark_id}:skill-routing`;
+const traceId = sha256(traceSeed).replace('sha256:', '').slice(0, 32);
+const spanId = sha256(`${traceSeed}:span`).replace('sha256:', '').slice(0, 16);
+
+const indexEvent = {
+  trace_id: traceId,
+  span_id: spanId,
+  name: 'skill.router.index.loaded',
+  time: index.time,
+  attributes: {
+    'session.id': benchmark.session_id,
+    'gen_ai.conversation.id': benchmark.conversation_id,
+    'agent.name': benchmark.agent,
+    'skill.catalog.id_hash': hashRef(index.catalog_id),
+    'skill.catalog.skill_count': index.skill_names.length,
+    'skill.catalog.names_hash': sha256(index.skill_names.join('\n')),
+    'skill.router.startup_strategy': index.startup_strategy,
+    'skill.router.description_token_count_bucket': tokenBucket(index.description_token_count),
+    'skill.router.full_body_token_count_bucket': tokenBucket(index.full_body_token_count),
+    'skill.router.full_bodies_loaded_at_startup': false,
+    'privacy.raw_skill_descriptions_recorded': false,
+    'privacy.raw_skill_bodies_recorded': false
+  }
+};
+
+const caseEvents = cases.map((record) => ({
+  trace_id: traceId,
+  span_id: spanId,
+  name: 'skill.router.case.evaluated',
+  time: record.time,
+  attributes: {
+    'session.id': benchmark.session_id,
+    'gen_ai.conversation.id': benchmark.conversation_id,
+    'skill.router.benchmark.id_hash': hashRef(benchmark.benchmark_id),
+    'skill.router.case.id_hash': hashRef(record.case_id),
+    'skill.router.prompt_hash': sha256(record.raw_prompt),
+    'skill.router.expected_skill_hash': hashRef(record.expected_skill),
+    'skill.router.selected_skill_hash': hashRef(record.selected_skill),
+    'skill.router.top_k_hash': sha256(record.top_k.join('\n')),
+    'skill.router.match': record.match,
+    'skill.router.confidence_bucket': scoreBucket(record.confidence),
+    'skill.router.reason_hash': sha256(record.reason),
+    'privacy.raw_prompt_recorded': false,
+    'privacy.raw_selection_reason_recorded': false
+  }
+}));
+
+const bodyLoadEvents = bodyLoads.map((record) => ({
+  trace_id: traceId,
+  span_id: spanId,
+  name: 'skill.body.loaded',
+  time: record.time,
+  attributes: {
+    'session.id': benchmark.session_id,
+    'gen_ai.conversation.id': benchmark.conversation_id,
+    'skill.router.case.id_hash': hashRef(record.case_id),
+    'skill.name_hash': hashRef(record.skill),
+    'skill.body.hash': sha256(record.raw_skill_body),
+    'skill.body.load_reason': record.load_reason,
+    'skill.body.loaded_after_route': true,
+    'privacy.raw_skill_body_recorded': false
+  }
+}));
+
+const completedEvent = {
+  trace_id: traceId,
+  span_id: spanId,
+  name: 'skill.router.benchmark.completed',
+  time: completed.time,
+  attributes: {
+    'session.id': benchmark.session_id,
+    'gen_ai.conversation.id': benchmark.conversation_id,
+    'skill.router.benchmark.id_hash': hashRef(benchmark.benchmark_id),
+    'skill.router.golden_set_hash': hashRef(benchmark.golden_set),
+    'skill.router.records_total': completed.records_total,
+    'skill.router.usable_records': completed.usable_records,
+    'skill.router.format_failures': completed.format_failures,
+    'skill.router.top1_rate_bucket': rateBucket(completed.top1_rate),
+    'skill.router.top2_rate_bucket': rateBucket(completed.top2_rate),
+    'skill.router.model_results_hash': sha256(JSON.stringify(completed.model_results)),
+    'skill.router.next_action_hash': sha256(completed.next_action),
+    'skill.router.audit_gap': 'receipt_proves_routing_boundary_not_task_effectiveness',
+    'privacy.raw_benchmark_prompts_recorded': false,
+    'privacy.raw_skill_text_recorded': false
+  }
+};
+
+const events = [indexEvent, ...caseEvents, ...bodyLoadEvents, completedEvent]
+  .sort((left, right) => Date.parse(left.time) - Date.parse(right.time));
+
+writeFileSync(receiptPath, `${events.map((event) => JSON.stringify(event)).join('\n')}\n`);
+
+const trace = {
+  resourceSpans: [
+    {
+      resource: {
+        attributes: attributesToOtel({
+          'service.name': 'pluribus-skill-routing-receipt-demo',
+          'service.version': '0.0.0-fixture',
+          'deployment.environment.name': 'local-fixture'
+        })
+      },
+      scopeSpans: [
+        {
+          scope: {
+            name: 'pluribus.context_input_evidence.skill_routing_demo',
+            version: '0.0.0-fixture'
+          },
+          spans: [
+            {
+              traceId,
+              spanId,
+              parentSpanId: '',
+              name: 'agent.session.skill.routing_benchmark',
+              kind: 1,
+              startTimeUnixNano: unixNano(benchmark.time),
+              endTimeUnixNano: unixNano(completed.time),
+              attributes: attributesToOtel({
+                'session.id': benchmark.session_id,
+                'gen_ai.conversation.id': benchmark.conversation_id,
+                'agent.name': benchmark.agent,
+                'workspace.name': benchmark.workspace,
+                'gen_ai.request.model': benchmark.model,
+                'skill.router.version_hash': hashRef(benchmark.router_version),
+                'skill.router.case_count': cases.length
+              }),
+              events: events.map((event) => ({
+                name: event.name,
+                timeUnixNano: unixNano(event.time),
+                attributes: attributesToOtel(event.attributes)
+              }))
+            }
+          ]
+        }
+      ]
+    }
+  ]
+};
+
+writeFileSync(tracePath, `${JSON.stringify(trace, null, 2)}\n`);
+
+const forbiddenRawStrings = [
+  'private activation prompts',
+  'internal corpus notes',
+  'unpublished skill body drafts',
+  'private draft description',
+  'private task: agent is losing the goal',
+  'private task: keep tool outputs out of prompt',
+  'private task: reconcile persistent agent memories',
+  'private SKILL.md body draft',
+  'operator notes',
+  'internal evaluation hints',
+  'split compression vs memory-consolidation activation examples'
+];
+const exportedText = `${events.map((event) => JSON.stringify(event)).join('\n')}\n${JSON.stringify(trace)}`;
+const rawTextCopiedToReceipt = forbiddenRawStrings.some((value) => exportedText.includes(value));
+
+const summary = {
+  schema: 'pluribus.skillRoutingReceipt.demo.v0',
+  eventCount: events.length,
+  evaluatedCases: cases.length,
+  loadedSkillBodies: bodyLoads.length,
+  indexOnlyAtStartup: indexEvent.attributes['skill.router.full_bodies_loaded_at_startup'] === false,
+  top1RateBucket: completedEvent.attributes['skill.router.top1_rate_bucket'],
+  includesAuditGap: completedEvent.attributes['skill.router.audit_gap'],
+  rawTextCopiedToReceipt,
+  receiptPath: 'examples/context-input-evidence/skill-routing-receipt.ndjson',
+  tracePath: 'examples/context-input-evidence/skill-routing-otel-trace.json',
+  lesson: 'Skill routing benchmarks need privacy-safe receipts: prove which description index loaded, which skill was selected for each activation case, which body expanded after routing, and where routing accuracy stops short of task effectiveness.'
+};
+
+console.log(JSON.stringify(summary, null, 2));