thumbgate 1.34.3 → 1.37.1

package/scripts/claw-harness-production.js

@@ -0,0 +1,237 @@
+'use strict';
+
+/**
+ * Claw Harness Production Readiness — ThumbGate steal of the Microsoft Agent
+ * Framework "Making your claw production-ready" harness pattern
+ * (devblogs.microsoft.com/agent-framework, Part 4, Wes Steyn).
+ *
+ * The article's four production axes, mapped onto ThumbGate claw governance:
+ *
+ *   1. Define once, host many. The article splits one agent factory across
+ *      three thin hosts (console / hosted / evals) so every host runs the
+ *      SAME agent. -> buildHarness(host): one capability manifest, three
+ *      postures. No subtly different copies.
+ *
+ *   2. Governance screens prompts AND responses. Purview blocks disallowed
+ *      content, replaces it with a policy message, and logs the interaction
+ *      for audit. -> screenContent(): deterministic pattern screen over the
+ *      same two directions, opt-in per host, with an append-only audit trail.
+ *
+ *   3. Hosted builds turn off risky capabilities. The article disables file
+ *      access and shell on the hosted container (exfiltration/tampering/
+ *      persistence risk, "even behind a deny-list"); file access only via an
+ *      external governed store; CodeAct only inside an externally sandboxed
+ *      container. -> the hosted posture encodes exactly those defaults.
+ *
+ *   4. Evals on every change. Local function evaluators (fast, free,
+ *      CI-runnable) plus gated hosted evals; results feed the tuning loop.
+ *      -> runLocalEvals(): plain-function evaluators returning
+ *      { passed, total, failures }. No hosted dependency required.
+ *
+ * Honesty: this is deterministic policy logic. It does not run Azure,
+ * Foundry, or Purview; it encodes their risk decisions as enforceable
+ * manifests ThumbGate can gate on.
+ */
+
+const HOSTS = Object.freeze(['console', 'hosted', 'evals']);
+
+const PAN_PATTERN = /\b(?:\d[ -]?){13,16}\b/;
+const SECRET_PATTERNS = Object.freeze([
+  { id: 'aws-key', re: /\bAKIA[0-9A-Z]{16}\b/ },
+  { id: 'private-key-block', re: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/ },
+  { id: 'ghp-token', re: /\bghp_[A-Za-z0-9]{36}\b/ },
+]);
+
+/**
+ * Build the capability manifest for one host posture. One definition,
+ * three hosts — the article's core structural move.
+ *
+ * @param {string} host  console | hosted | evals
+ * @param {object} opts  { fileStore?: string, codeActSandboxed?: boolean }
+ */
+function buildHarness(host, opts) {
+  if (!HOSTS.includes(host)) {
+    return { error: `unknown host "${host}" — expected one of ${HOSTS.join(', ')}` };
+  }
+  const o = opts || {};
+  const base = {
+    host,
+    source: new URL('https://devblogs.microsoft.com/agent-framework/agent-harness-making-your-claw-production-ready/').href,
+    telemetry: { spans: true, tokenMetrics: true, export: host === 'hosted' ? 'auto' : 'manual' },
+    governance: { screenPrompts: true, screenResponses: true, audit: true },
+  };
+
+  if (host === 'hosted') {
+    // The article's deliberate divergence: shell and container-disk file
+    // access are OFF in a shared hosted environment.
+    return {
+      ...base,
+      capabilities: {
+        shell: false,
+        fileAccess: o.fileStore ? 'external-store' : false,
+        fileStore: o.fileStore || null,
+        codeAct: o.codeActSandboxed ? 'sandboxed-container' : false,
+        backgroundAgents: true,
+      },
+      notes: [
+        'shell disabled on hosted posture (exfiltration/tampering/persistence risk)',
+        o.fileStore
+          ? 'file access allowed ONLY through the external governed store'
+          : 'container-disk file access denied; supply a governed file store to enable',
+        o.codeActSandboxed
+          ? 'codeAct allowed: externally sandboxed container'
+          : 'codeAct disabled: not externally sandboxed',
+      ],
+    };
+  }
+
+  if (host === 'evals') {
+    return {
+      ...base,
+      capabilities: {
+        shell: false,
+        fileAccess: false,
+        codeAct: false,
+        backgroundAgents: false,
+      },
+      notes: ['evals posture: deterministic checks only; no side-effecting capabilities'],
+    };
+  }
+
+  // console: the development posture — capabilities on, telemetry wired by hand
+  return {
+    ...base,
+    capabilities: {
+      shell: true,
+      fileAccess: true,
+      codeAct: true,
+      backgroundAgents: true,
+    },
+    notes: ['console posture: full capabilities; wire your OTLP exporter yourself'],
+  };
+}
+
+/**
+ * Governance screen (the Purview analog): check one prompt or response
+ * against deterministic patterns. Blocked content is replaced with a policy
+ * message and the interaction is recorded for audit.
+ *
+ * @param {string} text
+ * @param {object} ctx { direction: 'prompt'|'response', audit?: Array }
+ */
+function screenContent(text, ctx) {
+  const direction = ctx && ctx.direction === 'response' ? 'response' : 'prompt';
+  const audit = ctx && Array.isArray(ctx.audit) ? ctx.audit : null;
+  const s = typeof text === 'string' ? text : '';
+
+  let hit = null;
+  if (PAN_PATTERN.test(s)) hit = { policy: 'pan', reason: 'looks like a card number' };
+  if (!hit) {
+    for (const p of SECRET_PATTERNS) {
+      if (p.re.test(s)) { hit = { policy: p.id, reason: 'credential pattern' }; break; }
+    }
+  }
+
+  const result = hit
+    ? {
+      decision: 'block',
+      policy: hit.policy,
+      reason: hit.reason,
+      replacement: '[BLOCKED BY POLICY: content screened and withheld]',
+      direction,
+    }
+    : { decision: 'pass', direction };
+
+  if (audit) {
+    audit.push({
+      at: new Date().toISOString(),
+      direction,
+      decision: result.decision,
+      policy: hit ? hit.policy : null,
+      // audit stores metadata, never the screened content itself
+      chars: s.length,
+    });
+  }
+  return result;
+}
+
+/**
+ * Local evals (the article's LocalEvaluator): plain function evaluators,
+ * fast, free, CI-runnable. Each evaluator gets { query, response } and
+ * returns a boolean.
+ */
+function runLocalEvals(cases, evaluators) {
+  const failures = [];
+  let passed = 0;
+  for (const item of cases || []) {
+    for (const ev of evaluators || []) {
+      const ok = Boolean(ev.fn({ query: item.query, response: item.response }));
+      if (ok) passed += 1;
+      else failures.push({ query: item.query, evaluator: ev.name });
+    }
+  }
+  const total = (cases || []).length * (evaluators || []).length;
+  return { passed, total, failures, passRate: total === 0 ? 1 : passed / total };
+}
+
+/**
+ * Telemetry rollup (the OTel source-name idea): spans in, one summary out.
+ */
+function rollupTelemetry(spans) {
+  const tools = new Map();
+  let tokens = 0;
+  for (const span of spans || []) {
+    const name = span.tool || span.name || 'unknown';
+    tools.set(name, (tools.get(name) || 0) + 1);
+    tokens += Number(span.tokens || 0);
+  }
+  return {
+    spanCount: (spans || []).length,
+    tokensTotal: tokens,
+    toolCalls: Object.fromEntries(tools),
+  };
+}
+
+function isCliEntrypoint() {
+  return require.main === module;
+}
+
+function main() {
+  const audit = [];
+  const harnesses = HOSTS.map((h) => buildHarness(h, { fileStore: 'blob://claw-files' }));
+  const screens = [
+    screenContent('what is my balance?', { direction: 'prompt', audit }),
+    screenContent('card 4111 1111 1111 1111 on file', { direction: 'prompt', audit }),
+    screenContent('use AKIAIOSFODNN7EXAMPLE for auth', { direction: 'response', audit }),
+  ];
+  const evals = runLocalEvals(
+    [
+      { query: 'Value MSFT', response: 'MSFT is valued at $3.2T' },
+      { query: 'Value MSFT', response: 'I cannot say' },
+      { query: 'hello', response: 'hi!' },
+    ],
+    [
+      { name: 'numeric_valuation', fn: ({ query, response }) => !/value msft/i.test(query) || /\d/.test(response) },
+    ],
+  );
+  const telemetry = rollupTelemetry([
+    { tool: 'read_file', tokens: 120 },
+    { tool: 'shell', tokens: 40 },
+    { tool: 'shell', tokens: 60 },
+  ]);
+  process.stdout.write(JSON.stringify({
+    honesty: 'deterministic policy logic; no Azure/Foundry/Purview runtime involved',
+    harnesses, screens, evals, telemetry,
+  }, null, 2) + '\n');
+}
+
+if (isCliEntrypoint()) main();
+
+module.exports = {
+  HOSTS,
+  buildHarness,
+  screenContent,
+  runLocalEvals,
+  rollupTelemetry,
+  isCliEntrypoint,
+};

package/scripts/cli-progress.js

@@ -0,0 +1,111 @@
+'use strict';
+
+/**
+ * Lightweight CLI progress for long-running commands (dashboard, cfo, north-star).
+ * TTY: spinner on stderr. Non-TTY / THUMBGATE_NO_PROGRESS=1: plain step lines.
+ */
+
+const SPINNER_FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
+
+function isProgressEnabled(stream = process.stderr, env = process.env) {
+  if (String(env.THUMBGATE_NO_PROGRESS || '').trim() === '1') return false;
+  if (String(env.CI || '').trim()) return false; // avoid noisy CI logs
+  return Boolean(stream && stream.isTTY);
+}
+
+function createCliProgress(options = {}) {
+  const stream = options.stream || process.stderr;
+  const env = options.env || process.env;
+  const enabled = options.enabled !== undefined
+    ? Boolean(options.enabled)
+    : isProgressEnabled(stream, env);
+
+  let label = '';
+  let frame = 0;
+  let timer = null;
+  let active = false;
+
+  function clearLine() {
+    if (!enabled || !stream.clearLine) return;
+    try {
+      stream.clearLine(0);
+      stream.cursorTo(0);
+    } catch { /* non-TTY fallback */ }
+  }
+
+  function paint() {
+    if (!enabled || !active) return;
+    const glyph = SPINNER_FRAMES[frame % SPINNER_FRAMES.length];
+    frame += 1;
+    clearLine();
+    stream.write(`${glyph} ${label}`);
+  }
+
+  function start(nextLabel) {
+    label = String(nextLabel || 'Working…');
+    active = true;
+    if (!enabled) {
+      stream.write(`[thumbgate] ${label}\n`);
+      return;
+    }
+    paint();
+    if (timer) clearInterval(timer);
+    timer = setInterval(paint, 80);
+    if (typeof timer.unref === 'function') timer.unref();
+  }
+
+  function update(nextLabel) {
+    label = String(nextLabel || label);
+    if (!enabled) {
+      stream.write(`[thumbgate] ${label}\n`);
+      return;
+    }
+    if (!active) {
+      start(label);
+      return;
+    }
+    paint();
+  }
+
+  function stop(finalLabel, { ok = true } = {}) {
+    if (timer) {
+      clearInterval(timer);
+      timer = null;
+    }
+    const text = finalLabel != null ? String(finalLabel) : label;
+    if (!enabled) {
+      if (text) stream.write(`[thumbgate] ${text}\n`);
+      active = false;
+      return;
+    }
+    clearLine();
+    if (text) {
+      const mark = ok ? '✓' : '✗';
+      stream.write(`${mark} ${text}\n`);
+    }
+    active = false;
+  }
+
+  function succeed(finalLabel) {
+    stop(finalLabel, { ok: true });
+  }
+
+  function fail(finalLabel) {
+    stop(finalLabel, { ok: false });
+  }
+
+  return {
+    enabled,
+    start,
+    update,
+    stop,
+    succeed,
+    fail,
+  };
+}
+
+module.exports = {
+  createCliProgress,
+  isProgressEnabled,
+  SPINNER_FRAMES,
+};

package/scripts/cli-schema.js

@@ -158,6 +158,13 @@ const CLI_COMMANDS = [
     description: 'Audit runtime isolation, bootstrap context, and permission tier',
     flags: [jsonFlag()],
   }),
+  discoveryCommand({
+    name: 'security-central',
+    aliases: ['security:central', 'agent-security-central'],
+    description:
+      'Free local Agent Security Central posture report (config drift, privileged coverage, policy variance, audit evidence)',
+    flags: [jsonFlag()],
+  }),
   discoveryCommand({
     name: 'harness-audit',
     aliases: ['harness'],
@@ -342,11 +349,31 @@ const CLI_COMMANDS = [
       { name: 'top-k', type: 'number', description: 'Retrieval k used for the baseline and candidate metrics' },
       { name: 'threshold-change', type: 'boolean', description: 'Mark that vector threshold or top-k routing changed' },
       { name: 'embedding-finetune', type: 'boolean', description: 'Mark that embedding fine-tuning or replacement is proposed' },
+      { name: 'embedding-model-change', type: 'boolean', description: 'Mark that the embedding provider or model is changing' },
+      { name: 'baseline-provider', type: 'string', description: 'Current embedding provider fingerprint (ollama, gemini, local, …)' },
+      { name: 'new-provider', type: 'string', description: 'Proposed embedding provider fingerprint' },
+      { name: 'baseline-model', type: 'string', description: 'Current embedding model id' },
+      { name: 'new-model', type: 'string', description: 'Proposed embedding model id' },
+      { name: 'baseline-dim', type: 'number', description: 'Current embedding output dimensionality' },
+      { name: 'new-dim', type: 'number', description: 'Proposed Matryoshka/truncated output dimensionality' },
+      { name: 'matryoshka-truncation', type: 'boolean', description: 'Mark that Matryoshka leading-dim truncation is proposed' },
       { name: 'structural-near-misses', type: 'boolean', description: 'Mark that negation or role-reversal near misses matter' },
       { name: 'verifier', type: 'boolean', description: 'Mark that a second-stage verifier or reranker is present' },
       { name: 'latency-ms', type: 'number', description: 'Observed end-to-end retrieval latency after verifier or reranker' },
       { name: 'latency-budget-ms', type: 'number', description: 'Workflow retrieval latency budget' },
       { name: 'agentic', type: 'boolean', description: 'Mark that retrieval output can trigger downstream agent actions' },
+      { name: 'hybrid-retrieval', type: 'boolean', description: 'Mark that dense+sparse hybrid retrieval is in use' },
+      { name: 'dense', type: 'boolean', description: 'Mark dense/embedding retrieval is measured' },
+      { name: 'sparse', type: 'boolean', description: 'Mark sparse/keyword retrieval is measured' },
+      { name: 'source-grounding', type: 'boolean', description: 'Mark that source citations are enforced' },
+      { name: 'acl-filter', type: 'boolean', description: 'Mark that access-control filtering is enforced' },
+      { name: 'scale-corpus-documents', type: 'number', description: 'Corpus size used for scale-wall governance' },
+      { name: 'input-tokens', type: 'number', description: 'Input tokens consumed by the operation' },
+      { name: 'output-tokens', type: 'number', description: 'Output tokens generated by the operation' },
+      { name: 'est-cost-usd', type: 'number', description: 'Estimated cost in USD for the operation' },
+      { name: 'model-cost-per-1k', type: 'number', description: 'Cost per 1000 tokens for the model used' },
+      { name: 'cost-delta-percent', type: 'number', description: 'Cost difference percentage if routed to alternative model' },
+      { name: 'recommended-model', type: 'string', description: 'Cost-optimal model recommendation (qwen, claude, gemini, etc.)' },
     ],
   }),
   discoveryCommand({
@@ -417,6 +444,136 @@ const CLI_COMMANDS = [
       { name: 'truncation-failures', type: 'boolean', description: 'Mark that failures may be truncation-related' },
     ],
   }),
+
+  discoveryCommand({
+    name: 'allowlist-bridge-honesty',
+    aliases: ['gitlab-sandbox-allowlist', 'allowlist-not-trust', 'trust-handoff-honesty'],
+    description: 'Audit allowlisted package registries/proxies as hops not trust boundaries (GitLab 2026-09 FORMAT steal; does not clone GitLab Duo)',
+    flags: [
+      jsonFlag(),
+      { name: 'strict', type: 'boolean', description: 'Exit non-zero on fail' },
+      { name: 'root', type: 'string', description: 'Repo root to scan (default cwd)' },
+      { name: 'allow-hosts', type: 'string', description: 'Comma-separated extra allowlisted hosts' },
+      { name: 'treat-allowlist-as-trust', type: 'boolean', description: 'Fail closed if bridge hosts are treated as trusted' },
+      { name: 'write', type: 'string', description: 'Privileged consumer path to classify as trust-handoff' },
+      { name: 'claimed-contained', type: 'boolean', description: 'Fail if a handoff write is claimed sandbox-contained' },
+      { name: 'evaluate-url', type: 'string', description: 'Probe egress evaluation against the allowlist' },
+      { name: 'clone-gitlab-duo', type: 'boolean', description: 'Refuse GitLab Duo sandbox SKU clone' },
+    ],
+  }),
+
+  discoveryCommand({
+    name: 'package-manager-honesty-doctor',
+    aliases: ['pm-honesty-doctor', 'pnpm12-honesty-doctor', 'lockfile-ci-parity-doctor'],
+    description: 'Audit lockfile/packageManager/CI install parity and fail-closed package-manager switches (InfoQ pnpm 12 process steal; does not migrate off npm)',
+    flags: [
+      jsonFlag(),
+      { name: 'strict', type: 'boolean', description: 'Exit non-zero on fail or actionable findings' },
+      { name: 'root', type: 'string', description: 'Repo root to scan (default cwd)' },
+      { name: 'propose-switch', type: 'string', description: 'Fail-closed checklist for switching to npm|pnpm|yarn|bun' },
+      { name: 'allow-ignore-scripts-gaps', type: 'boolean', description: 'Do not warn when CI installs omit --ignore-scripts' },
+    ],
+  }),
+
+  discoveryCommand({
+    name: 'openui-catalog-compose-honesty',
+    aliases: ['openui-honesty-doctor', 'catalog-compose-honesty', 'repair-before-compose-claim'],
+    description: 'OpenUI FORMAT steal: catalog-compose-only, root-first streaming, repair-before-claim (does not install @openuidev or clone Thesys Gateway)',
+    flags: [
+      jsonFlag(),
+      { name: 'strict', type: 'boolean', description: 'Exit non-zero on fail or actionable findings' },
+      { name: 'root', type: 'string', description: 'Repo root for relative paths (default cwd)' },
+      { name: 'catalog', type: 'string', description: 'Path to JSON component catalog' },
+      { name: 'stream', type: 'string', description: 'Path to line-oriented compose stream' },
+      { name: 'compose', type: 'string', description: 'Alias for --stream' },
+      { name: 'repair', type: 'boolean', description: 'Include dropped lines and repaired stream text' },
+      { name: 'claim-ready', type: 'boolean', description: 'Fail unless repair is clean (root + zero drops)' },
+    ],
+  }),
+
+
+  discoveryCommand({
+    name: 'intent-governed-execution',
+    aliases: ['governed-intent', 'cyberstrike-governed', 'intent-govern'],
+    description: 'Compose CyberStrikeAI intent→governed-execution FORMAT onto existing rails (HITL + evidence memory; does not clone CyberStrike/Eino)',
+    flags: [
+      jsonFlag(),
+      { name: 'strict', type: 'boolean', description: 'Exit non-zero unless status=ready' },
+      { name: 'intent', type: 'string', description: 'Natural-language intent to govern' },
+      { name: 'task', type: 'string', description: 'Alias for --intent' },
+      { name: 'class', type: 'string', description: 'Force intent class' },
+      { name: 'risk', type: 'string', description: 'Force risk low|medium|high|critical' },
+      { name: 'harness', type: 'string', description: 'Force gate harness' },
+      { name: 'profile', type: 'string', description: 'Force subagent profile' },
+      { name: 'approved', type: 'boolean', description: 'HITL already satisfied (human grant only)' },
+      { name: 'map-only', type: 'boolean', description: 'Print six-step governance map' },
+      { name: 'root', type: 'string', description: 'Repo root to probe' },
+    ],
+  }),
+  discoveryCommand({
+    name: 'jit-harness-compose',
+    aliases: ['jit-compose', 'jit-harness', 'harness-compose'],
+    description: 'Compose JIT-Agent four-module harness FORMAT (memory/planning/action/capability) onto existing ThumbGate rails — does not train or download JIT-Agent',
+    flags: [
+      jsonFlag(),
+      { name: 'strict', type: 'boolean', description: 'Exit non-zero unless status=ready' },
+      { name: 'task', type: 'string', description: 'Task text to classify and compose' },
+      { name: 'query', type: 'string', description: 'Alias for --task' },
+      { name: 'class', type: 'string', description: 'Force task class (code_edit|review|deploy|research|secure|routine|db_write|default)' },
+      { name: 'harness', type: 'string', description: 'Force gate harness name' },
+      { name: 'profile', type: 'string', description: 'Force subagent profile' },
+      { name: 'roles', type: 'string', description: 'Comma-separated switchyard roles' },
+      { name: 'toolName', type: 'string', description: 'Tool-name hint for harness-selector' },
+      { name: 'map-only', type: 'boolean', description: 'Print four-module rail map only' },
+      { name: 'root', type: 'string', description: 'Repo root to probe' },
+    ],
+  }),
+  discoveryCommand({
+    name: 'workspace-search-route',
+    aliases: ['zg-search-route', 'zvec-grep-route', 'search-route'],
+    description: 'Route a query to rg/fts/vector/hybrid/graph on existing rails (zg zvec-grep FORMAT steal; does not install @zvec/zvec-grep)',
+    flags: [
+      jsonFlag(),
+      { name: 'strict', type: 'boolean', description: 'Exit non-zero unless status=ready' },
+      { name: 'root', type: 'string', description: 'Repo root (default cwd)' },
+      { name: 'query', type: 'string', description: 'Query text to classify or execute' },
+      { name: 'route', type: 'string', description: 'Force route: hybrid|fts|vector|rg|graph' },
+      { name: 'rg', type: 'boolean', description: 'Force exact/regex route' },
+      { name: 'fts', type: 'boolean', description: 'Force BM25/lexical route' },
+      { name: 'vector', type: 'boolean', description: 'Force semantic/dense route' },
+      { name: 'hybrid', type: 'boolean', description: 'Force RRF hybrid route' },
+      { name: 'graph', type: 'boolean', description: 'Force Graphify AST route' },
+      { name: 'execute', type: 'boolean', description: 'Run the chosen local rail (best-effort)' },
+      { name: 'limit', type: 'number', description: 'Max hits when executing' },
+      { name: 'force-remote', type: 'boolean', description: 'Request remote embeddings (needs THUMBGATE_ALLOW_REMOTE_EMBED=1)' },
+      { name: 'map-only', type: 'boolean', description: 'Print route map only' },
+    ],
+  }),
+  discoveryCommand({
+    name: 'nvidia-specdecode-al-doctor',
+    aliases: ['specdecode-al-doctor', 'speculative-decoding-al-doctor', 'nvidia-speculative-decoding-doctor'],
+    description: 'Check speculative-decoding AL/D evidence: speedup ≤ AL/(1+ρD), attention D=128/G-1, tile alignment — maps to checkpoint-speculative-decoding-acceptance',
+    flags: [
+      jsonFlag(),
+      { name: 'strict', type: 'boolean', description: 'Exit non-zero on fail or actionable findings' },
+      { name: 'workload', type: 'string', description: 'Workload name' },
+      { name: 'model', type: 'string', description: 'Target model name' },
+      { name: 'speculative-decoding', type: 'boolean', description: 'Mark that a speculation path is active' },
+      { name: 'accept-length', type: 'number', description: 'Measured accept length AL' },
+      { name: 'draft-length', type: 'number', description: 'Draft length D' },
+      { name: 'draft-depth-ratio', type: 'number', description: 'Draft depth ratio ρ = L_draft / L_target' },
+      { name: 'claimed-speedup', type: 'number', description: 'Claimed speedup to compare against AL/(1+ρD)' },
+      { name: 'min-accept-length', type: 'number', description: 'Production AL floor (default 2)' },
+      { name: 'query-heads-per-kv', type: 'number', description: 'Attention group size G' },
+      { name: 'attention-dominated', type: 'boolean', description: 'Apply attention draft-length guidelines' },
+      { name: 'latency-region', type: 'string', description: 'Pareto region hint: low or throughput' },
+      { name: 'model-size', type: 'string', description: 'Target size hint: small, medium, or large' },
+      { name: 'repetitive', type: 'boolean', description: 'Prefer suffix/n-gram draft class' },
+      { name: 'next-accept-length', type: 'number', description: 'AL after raising D (Guideline 4 compare)' },
+      { name: 'next-draft-length', type: 'number', description: 'Candidate larger D (Guideline 4 compare)' },
+      { name: 'cache-coherence-eval', type: 'boolean', description: 'Rollback/coherence evidence present' },
+    ],
+  }),
   discoveryCommand({
     name: 'deepseek-v4-runtime-guardrails',
     aliases: ['sparse-attention-runtime-guardrails', 'deepseek-runtime-guardrails'],
@@ -434,7 +591,12 @@ const CLI_COMMANDS = [
       { name: 'prefix-cache', type: 'boolean', description: 'Mark that prefix caching is active' },
       { name: 'cache-coherence-eval', type: 'boolean', description: 'Mark that cache reuse and rollback coherence were evaluated' },
       { name: 'speculative-decoding', type: 'boolean', description: 'Mark that MTP, EAGLE, or another speculation path is active' },
-      { name: 'accept-length', type: 'number', description: 'Measured speculative decoding accept length' },
+      { name: 'accept-length', type: 'number', description: 'Measured speculative decoding accept length (AL)' },
+      { name: 'draft-length', type: 'number', description: 'Speculative draft length D (tokens proposed per target iteration)' },
+      { name: 'draft-depth-ratio', type: 'number', description: 'Draft depth ratio ρ = L_draft / L_target for AL/(1+ρD) speedup math' },
+      { name: 'claimed-speedup', type: 'number', description: 'Claimed speculation speedup to check against AL/(1+ρD)' },
+      { name: 'query-heads-per-kv', type: 'number', description: 'Attention group size G (query heads per KV head)' },
+      { name: 'attention-dominated', type: 'boolean', description: 'Mark that attention dominates decode (apply D=128/G-1 guidance)' },
       { name: 'kv-offload', type: 'boolean', description: 'Mark that KV cache offload or capacity extension is active' },
       { name: 'training', type: 'boolean', description: 'Mark that the rollout feeds RL, DPO, or fine-tuning' },
       { name: 'rollout-replay', type: 'boolean', description: 'Mark that rollout routing replay is captured' },