@actuarial-ts/compliance 0.7.0 → 0.7.1

package/README.md

@@ -3,14 +3,14 @@
 Documentation, judgment, provenance, and reproducibility primitives for actuarial-ts. The package is designed to support compliance work under applicable ASOPs; it neither determines compliance nor replaces the actuary’s review.
 
 ```bash
-npm install @actuarial-ts/compliance@0.7.0 @actuarial-ts/core@0.7.0 @actuarial-ts/data@0.7.0 @actuarial-ts/interchange@0.7.0
+npm install @actuarial-ts/compliance@0.7.1 @actuarial-ts/core@0.7.1 @actuarial-ts/data@0.7.1 @actuarial-ts/interchange@0.7.1
 ```
 
 Node 20+, ESM.
 
 ## Diagnostic provenance
 
-`createDiagnosticRunIdentity` accepts only an owner-authenticated, completed data-package run. It does not accept caller-restated formulas, filters, review status, or result identities.
+The example below uses eager provenance. `createDiagnosticRunIdentity` accepts only an owner-authenticated, completed eager data-package run. It does not accept caller-restated formulas, filters, review status, or result identities. Compact runs use the separate workflow below.
 
 ```ts
 import { createBundle, createDiagnosticRunIdentity } from "@actuarial-ts/compliance";
@@ -59,11 +59,48 @@ Material host judgments worth recording in the assumption ledger include amount
 
 The package also provides estimate metadata, assumption ledgers, ASOP No. 41 draft disclosure generation, ASOP No. 56 model cards, actual-versus-expected roll-forward, and canonical reproducibility bundles.
 
-See the [formula catalog](https://github.com/yerromnitsuj/actng/blob/v0.7.0/docs/reference/diagnostic-formulas.md) and [migration guide](https://github.com/yerromnitsuj/actng/blob/v0.7.0/docs/migrations/0.6-generalized-diagnostics.md).
+See the [formula catalog](https://github.com/yerromnitsuj/actng/blob/v0.7.1/docs/reference/diagnostic-formulas.md) and [migration guide](https://github.com/yerromnitsuj/actng/blob/v0.7.1/docs/migrations/0.6-generalized-diagnostics.md).
 
 ## Compact provenance and replay streams
 
-Version 0.7.0 adds separately authenticated compact provenance and a versioned replay stream. They retain complete audit evidence while avoiding archive-sized identity objects/strings; this is not a dataset-capacity certification. In the source checkout, `docs/reference/diagnostic-replay-stream.md` describes the APIs, host resource limits, wire version, independent verification, and assurance boundaries; that reference document is not part of the npm package. Existing eager provenance and interchange BundleDoc APIs remain unchanged.
+Introduced in 0.7.0, this separate path retains complete audit evidence without
+requiring expanded manifest/result objects or one archive-sized identity string.
+It does not certify dataset capacity or total application memory use. Existing
+eager provenance and interchange `BundleDoc` APIs remain available.
+
+| Step | Public API and host responsibility |
+|---|---|
+| Produce a genuine completed run | Use the compact validated gateway in `@actuarial-ts/data`; handle both review and metric blocks. |
+| Hash actual artifact bytes | `digestDiagnosticArtifactChunks` returns an authenticated computed digest. Keep a repeatable byte source; hashes without retained original bytes must remain caller-declared. |
+| Bind run and artifact evidence | `createCompactDiagnosticRunIdentity` accepts the completed compact run, genuine computed receipts or explicitly declared evidence, and complete preparation lineage. |
+| Write complete replay evidence | Consume `writeDiagnosticReplayStream` into a temporary host destination and publish it only after successful completion. `openArtifact` must reopen the bytes matching each computed digest. |
+| Independently verify | `verifyDiagnosticReplayStream` requires explicit host resource limits, reruns the recorded input, and compares complete canonical evidence before issuing a receipt. Success requires the trailer and EOF. |
+
+The host owns file/network I/O, pending-I/O cancellation, retention, and access
+control. Supply the same abort signal to host I/O and the SDK. Cancellation is
+cooperative between chunks/phases, not interruption of synchronous calculation.
+Use summaries/pages for routine views; materializing all findings or identity
+documents afterward can erase the representation's memory benefit.
+
+`VerifiedCompactDiagnosticRunProvenance` is a distinct owner-authenticated
+object, not an eager `VerifiedDiagnosticRunProvenance` or a serializable
+authorization token. It cannot be cast into `createBundle`, the eager verifier,
+or the current diagnostic agent executor. The stream format is
+`diagnostic-replay/1`, separate from interchange wire `1.1.0`; it is not a
+single JSON document or a `BundleDoc`.
+
+Replay identities include the producing SDK's engine versions. Preserve those
+exact package versions with stored evidence and use a matching runtime for
+verification. Stream version 1 does not guarantee cross-SDK-version replay;
+in particular, a patch upgrade must not be assumed to verify an older stream.
+Successful replay establishes internal reproducibility, not source authenticity,
+a digital signature, correct claim-level capping, or actuarial correctness.
+
+The runnable [compact adoption guide](https://github.com/yerromnitsuj/actng/blob/v0.7.1/docs/migrations/0.7-compact-diagnostics.md)
+and complete [replay reference](https://github.com/yerromnitsuj/actng/blob/v0.7.1/docs/reference/diagnostic-replay-stream.md)
+document ownership, artifact bytes, paging, framing, resource limits, and
+assurance boundaries. These repository guides are linked here for npm users;
+the guide files themselves are not shipped inside the package.
 
 ## License
 

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const COMPLIANCE_PACKAGE_VERSION = "0.7.0";
+export declare const COMPLIANCE_PACKAGE_VERSION = "0.7.1";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,2 +1,2 @@
-export const COMPLIANCE_PACKAGE_VERSION = "0.7.0";
+export const COMPLIANCE_PACKAGE_VERSION = "0.7.1";
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actuarial-ts/compliance",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "ASOP-compliance-support layer for the actuarial-ts SDK: estimate metadata, assumption ledger, disclosures, model cards, diagnostics provenance, reproducibility bundles, and actual-vs-expected roll-forward. Responsibility for compliance remains with the credentialed actuary.",
   "license": "Apache-2.0",
   "type": "module",
@@ -47,9 +47,9 @@
     "prepublishOnly": "node ../../tools/release/verify-release-attestation.mjs @actuarial-ts/compliance"
   },
   "dependencies": {
-    "@actuarial-ts/core": "^0.7.0",
-    "@actuarial-ts/data": "^0.7.0",
-    "@actuarial-ts/interchange": "^0.7.0"
+    "@actuarial-ts/core": "^0.7.1",
+    "@actuarial-ts/data": "^0.7.1",
+    "@actuarial-ts/interchange": "^0.7.1"
   },
   "devDependencies": {
     "@types/node": "^22.10.5",

package/src/version.ts

@@ -1 +1 @@
-export const COMPLIANCE_PACKAGE_VERSION = "0.7.0";
+export const COMPLIANCE_PACKAGE_VERSION = "0.7.1";