@colophon-claims/verify 0.0.0 → 0.1.0

package/dist/profile/inspect-manifest.js

@@ -0,0 +1,397 @@
+import { z } from "zod";
+import { VerdictRuleSchema } from "@jinn-network/task-execution-profiles";
+export const INSPECT_ADAPTER_ID = "inspect";
+export const SUPPORTED_INSPECT_VERSION = "0.3.255";
+export const SUPPORTED_INSPECT_WHEEL_SHA256 = "958e773a8d0cc8873314e3f96d1143cbb4e0b9e4bacc2cbec6b4d5576ceecf2c";
+export const SUPPORTED_INSPECT_EVALS_VERSION = "0.16.0";
+export const SUPPORTED_OPENAI_SDK_VERSION = "2.53.0";
+export const SUPPORTED_OCI_PYTHON_VERSION = "3.11.9";
+export const SUPPORTED_OCI_PLATFORM = "linux/amd64";
+export const INSPECT_SELECTION_SCHEMA = "jinn.network/benchmark-product/inspect-selection/1";
+export const INSPECT_SANDBOX_SELECTION_SCHEMA = "jinn.network/benchmark-product/inspect-selection/2";
+export const INSPECT_MULTI_SCORER_SELECTION_SCHEMA = "jinn.network/benchmark-product/inspect-selection/3";
+export const INSPECT_MULTI_SCORER_SANDBOX_SELECTION_SCHEMA = "jinn.network/benchmark-product/inspect-selection/4";
+export const INSPECT_SANDBOX_PROTOCOL = "jinn.network/inspect-sandbox-host/1";
+export const INSPECT_SANDBOX_PROVIDER = "jinn-oci";
+export const INSPECT_SANDBOX_PACKAGE_VERSION = "0.1.0";
+export const INSPECT_ARM_REQUIREMENT_KEY = "jinn.network/inspect-arm";
+const Sha256Schema = z.string().regex(/^[a-f0-9]{64}$/);
+const JsonScalarSchema = z.union([z.string(), z.number().finite(), z.boolean(), z.null()]);
+const SafeJsonSchema = z.lazy(() => z.union([
+    JsonScalarSchema,
+    z.array(SafeJsonSchema),
+    z.record(z.string(), SafeJsonSchema),
+]));
+const PublicMeasurementNameSchema = z.string().regex(/^[A-Za-z][A-Za-z0-9._-]{0,63}$/);
+export const InspectScoreProjectionSchema = z.object({
+    measurementName: PublicMeasurementNameSchema,
+    scorerName: z.string().min(1),
+    subScoreKey: z.string().min(1).optional(),
+    passValue: JsonScalarSchema,
+}).strict();
+function verdictRuleMeasurements(rule, names = new Set()) {
+    if ("threshold" in rule)
+        names.add(rule.threshold.measurement);
+    else if ("all" in rule)
+        rule.all.forEach((child) => verdictRuleMeasurements(child, names));
+    else if ("any" in rule)
+        rule.any.forEach((child) => verdictRuleMeasurements(child, names));
+    else if ("not" in rule)
+        verdictRuleMeasurements(rule.not, names);
+    else if ("inconclusiveWhen" in rule)
+        verdictRuleMeasurements(rule.inconclusiveWhen, names);
+    return names;
+}
+function validateScoringPolicy(scoring, context) {
+    const projectionNames = scoring.projections.map((projection) => projection.measurementName);
+    if (new Set(projectionNames).size !== projectionNames.length) {
+        context.addIssue({ code: "custom", path: ["projections"], message: "measurement names must be unique" });
+    }
+    const referencedNames = verdictRuleMeasurements(scoring.verdictRule);
+    const projected = new Set(projectionNames);
+    if (referencedNames.size !== projected.size
+        || [...referencedNames].some((name) => !projected.has(name))) {
+        context.addIssue({
+            code: "custom",
+            path: ["verdictRule"],
+            message: "verdictRule measurement references must exactly match the configured projections",
+        });
+    }
+}
+export const InspectScoringRequestSchema = z.object({
+    projections: z.array(InspectScoreProjectionSchema).min(1),
+    verdictRule: VerdictRuleSchema,
+}).strict().superRefine(validateScoringPolicy);
+export const InspectArmConfigurationSchema = z.object({
+    armId: z.string().regex(/^[A-Za-z0-9_-]{1,64}$/),
+    model: z.string().min(1),
+    modelArgs: z.record(z.string(), SafeJsonSchema).optional(),
+    modelRoles: z.record(z.string(), z.string().min(1)).optional(),
+    provider: z.object({
+        surface: z.literal("openai-responses"),
+        upstreamModel: z.literal("gpt-5.6-luna"),
+        reasoningEffort: z.enum(["none", "low"]),
+        maxOutputTokens: z.literal(128),
+        store: z.literal(false),
+        background: z.literal(false),
+        stream: z.literal(false),
+        serviceTier: z.literal("default"),
+        tools: z.tuple([]),
+        fallbackModels: z.tuple([]),
+        retries: z.literal(0),
+        persistedConversation: z.literal(false),
+        metadata: z.null(),
+        promptCacheIdentifier: z.null(),
+    }).strict().optional(),
+}).superRefine((arm, context) => {
+    if (arm.provider === undefined)
+        return;
+    if (arm.model !== "jinn-openai/gpt-5.6-luna") {
+        context.addIssue({ code: "custom", path: ["model"], message: "provider-backed arms require jinn-openai/gpt-5.6-luna" });
+    }
+    if (arm.modelArgs !== undefined || arm.modelRoles !== undefined) {
+        context.addIssue({ code: "custom", message: "provider-backed arms refuse modelArgs and modelRoles outside the sealed generation block" });
+    }
+});
+export const InspectRunOptionsSchema = z.object({
+    sampleId: z.union([z.string().min(1), z.number().int()]).optional(),
+    maxSamples: z.number().int().positive().optional(),
+    maxSubprocesses: z.number().int().positive().optional(),
+    maxSandboxes: z.number().int().positive().optional(),
+    retryOnError: z.number().int().nonnegative().optional(),
+    failOnError: z.union([z.boolean(), z.number().int().nonnegative()]).optional(),
+    messageLimit: z.number().int().positive().optional(),
+    tokenLimit: z.union([z.number().int().positive(), z.string().min(1)]).optional(),
+    timeLimit: z.number().int().positive().optional(),
+}).strict();
+const InspectOciIsolationSchema = z.object({
+    readOnlyRoot: z.literal(true),
+    network: z.enum(["none", "broker-only"]),
+    capabilities: z.tuple([]),
+    noNewPrivileges: z.literal(true),
+    cpuCount: z.number().positive(),
+    memoryBytes: z.number().int().positive(),
+    pidsLimit: z.number().int().positive(),
+    scratchBytes: z.number().int().positive(),
+    user: z.string().regex(/^[0-9]+:[0-9]+$/),
+    mounts: z.union([
+        z.tuple([
+            z.literal("project:ro"),
+            z.literal("dataset-cache:ro"),
+            z.literal("attempt-input:ro"),
+            z.literal("attempt-output:rw"),
+        ]),
+        z.tuple([
+            z.literal("project:ro"),
+            z.literal("dataset-cache:ro"),
+            z.literal("attempt-input:ro"),
+            z.literal("attempt-output:rw"),
+            z.literal("broker-capability:ro"),
+        ]),
+    ]),
+}).strict();
+const InspectBrokerPolicySchema = z.object({
+    protocol: z.literal("jinn.network/model-broker/1"),
+    requestEndpoint: z.literal("https://api.openai.com/v1/responses"),
+    network: z.literal("bridge-plus-private-internal"),
+    secretMount: z.literal("credential-volume:/run/secrets:ro"),
+    capabilityMount: z.literal("capability-volume:/run/jinn:ro"),
+    readOnlyRoot: z.literal(true),
+    capabilities: z.tuple([]),
+    noNewPrivileges: z.literal(true),
+    cpuCount: z.literal(1),
+    memoryBytes: z.literal(268_435_456),
+    pidsLimit: z.literal(32),
+    scratchBytes: z.literal(67_108_864),
+}).strict();
+export const InspectSandboxPolicySchema = z.object({
+    provider: z.literal(INSPECT_SANDBOX_PROVIDER),
+    platform: z.literal(SUPPORTED_OCI_PLATFORM),
+    user: z.literal("65532:65532"),
+    readOnlyRoot: z.literal(true),
+    network: z.literal("none"),
+    capabilities: z.tuple([]),
+    noNewPrivileges: z.literal(true),
+    cpuCount: z.literal(1),
+    memoryBytes: z.literal(536_870_912),
+    pidsLimit: z.literal(32),
+    scratchBytes: z.literal(268_435_456),
+    maxEnvironments: z.literal(1),
+    maxOperations: z.literal(64),
+    commandTimeoutSeconds: z.literal(30),
+    totalTimeoutSeconds: z.literal(120),
+    maxInputBytes: z.literal(16 * 1024 * 1024),
+    maxOutputBytes: z.literal(20 * 1024 * 1024),
+    maxReadFileBytes: z.literal(100 * 1024 * 1024),
+}).strict();
+const InspectSandboxRuntimeSchema = z.object({
+    protocol: z.literal(INSPECT_SANDBOX_PROTOCOL),
+    provider: z.literal(INSPECT_SANDBOX_PROVIDER),
+    packageVersion: z.literal(INSPECT_SANDBOX_PACKAGE_VERSION),
+    providerSourceSha256: Sha256Schema,
+    controllerSourceSha256: Sha256Schema,
+    imageDigest: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+    platform: z.literal(SUPPORTED_OCI_PLATFORM),
+    policySha256: Sha256Schema,
+    policy: InspectSandboxPolicySchema,
+}).strict();
+export const InspectOciRuntimeIdentitySchema = z.object({
+    kind: z.literal("oci"),
+    imageDigest: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+    platform: z.literal(SUPPORTED_OCI_PLATFORM),
+    inspectEvalsVersion: z.literal(SUPPORTED_INSPECT_EVALS_VERSION),
+    openaiSdkVersion: z.literal(SUPPORTED_OPENAI_SDK_VERSION),
+    workerSourceSha256: Sha256Schema,
+    runtimeHostSourceSha256: Sha256Schema,
+    brokerSourceSha256: Sha256Schema,
+    modelProviderSourceSha256: Sha256Schema,
+    dockerExecutableSha256: Sha256Schema,
+    dockerEngineVersion: z.string().min(1),
+    dockerApiVersion: z.string().min(1),
+    datasetCacheSha256: Sha256Schema,
+    isolation: InspectOciIsolationSchema,
+    broker: InspectBrokerPolicySchema.optional(),
+    sandbox: InspectSandboxRuntimeSchema.optional(),
+}).strict();
+const InspectResolvedSandboxSchema = z.object({
+    type: z.literal(INSPECT_SANDBOX_PROVIDER),
+    config: z.object({
+        schema: z.literal("jinn.network/benchmark-product/inspect-sandbox/1"),
+        imageDigest: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+        platform: z.literal(SUPPORTED_OCI_PLATFORM),
+        policySha256: Sha256Schema,
+    }).strict(),
+}).strict();
+const InspectDeclaredSandboxSchema = z.object({
+    type: z.literal("docker"),
+    config: z.null(),
+}).strict();
+const InspectSelectionManifestBaseFields = {
+    runtime: z.object({
+        adapterVersion: z.literal("1"),
+        workerSha256: Sha256Schema,
+        inspectVersion: z.literal(SUPPORTED_INSPECT_VERSION),
+        inspectWheelSha256: z.literal(SUPPORTED_INSPECT_WHEEL_SHA256),
+        pythonVersion: z.string().regex(/^3\.1[1-9](?:\.|$)/),
+        pythonExecutableSha256: Sha256Schema,
+        pythonEnvironmentSha256: Sha256Schema,
+        inspectDistributionSha256: Sha256Schema,
+        execution: InspectOciRuntimeIdentitySchema.optional(),
+    }).superRefine((runtime, context) => {
+        if (runtime.execution === undefined)
+            return;
+        if (runtime.pythonVersion !== SUPPORTED_OCI_PYTHON_VERSION) {
+            context.addIssue({ code: "custom", path: ["pythonVersion"], message: `OCI execution requires Python ${SUPPORTED_OCI_PYTHON_VERSION}` });
+        }
+        if (runtime.execution.workerSourceSha256 !== runtime.workerSha256) {
+            context.addIssue({ code: "custom", path: ["execution", "workerSourceSha256"], message: "OCI worker source digest must match the executed worker" });
+        }
+    }),
+    task: z.object({
+        reference: z.string().min(1),
+        args: z.record(z.string(), SafeJsonSchema),
+        resolvedName: z.string().min(1),
+        resolvedVersion: z.string().nullable(),
+        declaredSandbox: InspectDeclaredSandboxSchema.optional(),
+        resolvedSandbox: z.union([z.null(), InspectResolvedSandboxSchema]),
+        source: z.object({
+            kind: z.enum(["project-file", "installed-package"]),
+            path: z.string().min(1),
+            sha256: Sha256Schema,
+            projectTreeSha256: Sha256Schema.optional(),
+            distribution: z.object({
+                name: z.string().min(1),
+                version: z.string().min(1),
+                sha256: Sha256Schema,
+            }).optional(),
+        }).superRefine((source, context) => {
+            if (source.kind === "project-file" && source.projectTreeSha256 === undefined) {
+                context.addIssue({ code: "custom", message: "project-file sources require a project tree digest" });
+            }
+            if (source.kind === "installed-package" && source.distribution === undefined) {
+                context.addIssue({ code: "custom", message: "installed-package sources require distribution identity" });
+            }
+        }),
+        dataset: z.object({
+            name: z.string().nullable(),
+            location: z.string().nullable(),
+            samples: z.number().int().nonnegative().nullable(),
+            selectedSampleId: z.union([z.string().min(1), z.number().int()]).optional(),
+            orderedSampleSha256: Sha256Schema.optional(),
+        }),
+    }),
+    arms: z.array(InspectArmConfigurationSchema).min(2),
+    runOptions: InspectRunOptionsSchema,
+};
+const LegacyInspectSelectionManifestSchema = z.object({
+    schema: z.union([z.literal(INSPECT_SELECTION_SCHEMA), z.literal(INSPECT_SANDBOX_SELECTION_SCHEMA)]),
+    ...InspectSelectionManifestBaseFields,
+    scorer: z.object({
+        name: z.string().min(1),
+        passValue: JsonScalarSchema,
+        definition: SafeJsonSchema,
+    }).strict(),
+}).strict();
+const ResolvedInspectScoringSchema = z.object({
+    projections: z.array(InspectScoreProjectionSchema).min(1),
+    verdictRule: VerdictRuleSchema,
+    inspectMetrics: SafeJsonSchema.nullable(),
+    inspectEpochReducers: z.array(z.string().min(1)).nullable(),
+}).strict().superRefine(validateScoringPolicy);
+const MultiScorerInspectSelectionManifestSchema = z.object({
+    schema: z.union([
+        z.literal(INSPECT_MULTI_SCORER_SELECTION_SCHEMA),
+        z.literal(INSPECT_MULTI_SCORER_SANDBOX_SELECTION_SCHEMA),
+    ]),
+    ...InspectSelectionManifestBaseFields,
+    scorers: z.array(z.object({
+        name: z.string().min(1),
+        definition: SafeJsonSchema,
+    }).strict()).min(1),
+    scoring: ResolvedInspectScoringSchema,
+}).strict().superRefine((manifest, context) => {
+    const scorerNames = manifest.scorers.map((scorer) => scorer.name);
+    if (new Set(scorerNames).size !== scorerNames.length) {
+        context.addIssue({ code: "custom", path: ["scorers"], message: "resolved Inspect scorer names must be distinct" });
+    }
+    const knownScorers = new Set(scorerNames);
+    manifest.scoring.projections.forEach((projection, index) => {
+        if (!knownScorers.has(projection.scorerName)) {
+            context.addIssue({
+                code: "custom",
+                path: ["scoring", "projections", index, "scorerName"],
+                message: "projection must reference a resolved Inspect scorer",
+            });
+        }
+    });
+});
+export const InspectSelectionManifestSchema = z.union([
+    LegacyInspectSelectionManifestSchema,
+    MultiScorerInspectSelectionManifestSchema,
+]).superRefine((manifest, context) => {
+    const providerBacked = manifest.arms.some((arm) => arm.provider !== undefined);
+    const sandboxed = manifest.runtime.execution?.sandbox !== undefined;
+    const sandboxSchema = manifest.schema === INSPECT_SANDBOX_SELECTION_SCHEMA
+        || manifest.schema === INSPECT_MULTI_SCORER_SANDBOX_SELECTION_SCHEMA;
+    if (sandboxed !== sandboxSchema) {
+        context.addIssue({ code: "custom", path: ["schema"], message: "sandbox selections require their sandbox selection schema" });
+    }
+    if (sandboxed !== (manifest.task.resolvedSandbox !== null) || sandboxed !== (manifest.task.declaredSandbox !== undefined)) {
+        context.addIssue({ code: "custom", path: ["task", "resolvedSandbox"], message: "sandbox runtime, declared sandbox, and effective sandbox must be present together" });
+    }
+    if (sandboxed) {
+        const selected = manifest.runtime.execution?.sandbox;
+        const resolved = manifest.task.resolvedSandbox;
+        if (selected === undefined
+            || resolved === null
+            || resolved.config.imageDigest !== selected.imageDigest
+            || resolved.config.platform !== selected.platform
+            || resolved.config.policySha256 !== selected.policySha256) {
+            context.addIssue({ code: "custom", path: ["task", "resolvedSandbox"], message: "effective sandbox must match the sealed sandbox runtime" });
+        }
+    }
+    if (manifest.runtime.execution === undefined) {
+        if (providerBacked) {
+            context.addIssue({ code: "custom", path: ["runtime", "execution"], message: "provider-backed arms require OCI execution" });
+        }
+        return;
+    }
+    if (manifest.runOptions.sampleId === undefined) {
+        context.addIssue({ code: "custom", path: ["runOptions", "sampleId"], message: "OCI execution requires one exact sampleId" });
+    }
+    if (manifest.task.dataset.selectedSampleId !== manifest.runOptions.sampleId) {
+        context.addIssue({ code: "custom", path: ["task", "dataset", "selectedSampleId"], message: "selected dataset sample must match runOptions.sampleId" });
+    }
+    if (manifest.task.dataset.orderedSampleSha256 === undefined) {
+        context.addIssue({ code: "custom", path: ["task", "dataset", "orderedSampleSha256"], message: "OCI execution requires an ordered selected-sample digest" });
+    }
+    if (providerBacked && manifest.runtime.execution.isolation.network !== "broker-only") {
+        context.addIssue({ code: "custom", path: ["runtime", "execution", "isolation", "network"], message: "provider-backed arms require the broker-only OCI network" });
+    }
+    if (providerBacked && !manifest.runtime.execution.isolation.mounts.includes("broker-capability:ro")) {
+        context.addIssue({ code: "custom", path: ["runtime", "execution", "isolation", "mounts"], message: "provider-backed arms require the per-attempt broker capability mount" });
+    }
+    if (providerBacked && manifest.runtime.execution.broker === undefined) {
+        context.addIssue({ code: "custom", path: ["runtime", "execution", "broker"], message: "provider-backed arms require the sealed broker policy" });
+    }
+    if (!providerBacked && manifest.runtime.execution.broker !== undefined) {
+        context.addIssue({ code: "custom", path: ["runtime", "execution", "broker"], message: "credential-free OCI selections cannot carry a broker policy" });
+    }
+    if (providerBacked && manifest.runOptions.retryOnError !== 0) {
+        context.addIssue({ code: "custom", path: ["runOptions", "retryOnError"], message: "provider-backed arms require retryOnError: 0" });
+    }
+});
+export function isInspectMultiScorerSelection(manifest) {
+    return manifest.schema === INSPECT_MULTI_SCORER_SELECTION_SCHEMA
+        || manifest.schema === INSPECT_MULTI_SCORER_SANDBOX_SELECTION_SCHEMA;
+}
+const SECRETISH_KEY = /(?:^|[_-])(api[_-]?key|authorization|credential|password|private[_-]?key|secret|token)(?:$|[_-])/iu;
+const SECRETISH_VALUES = [
+    /(?:^|\s)sk-(?:proj-)?[A-Za-z0-9_-]{16,}(?:$|\s)/u,
+    /(?:^|\s)(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})(?:$|\s)/u,
+    /(?:^|\s)AKIA[A-Z0-9]{16}(?:$|\s)/u,
+    /-----BEGIN (?:EC |OPENSSH |RSA )?PRIVATE KEY-----/u,
+    /(?:^|\s)Bearer\s+[A-Za-z0-9._~-]{16,}(?:$|\s)/u,
+    /(?:^|\s)eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}(?:$|\s)/u,
+];
+/** Sealed runtime configuration is public-safe metadata, never a credential carrier. */
+export function assertNoSecretLikeConfiguration(value, path = "selection") {
+    if (typeof value === "string") {
+        if (SECRETISH_VALUES.some((pattern) => pattern.test(value))) {
+            throw new TypeError(`${path} contains a credential-shaped value and cannot be sealed into an Inspect selection`);
+        }
+        return;
+    }
+    if (Array.isArray(value)) {
+        value.forEach((entry, index) => assertNoSecretLikeConfiguration(entry, `${path}.${index}`));
+        return;
+    }
+    if (value === null || typeof value !== "object")
+        return;
+    for (const [key, entry] of Object.entries(value)) {
+        if (SECRETISH_KEY.test(key)) {
+            throw new TypeError(`${path}.${key} looks credential-bearing and cannot be sealed into an Inspect selection`);
+        }
+        assertNoSecretLikeConfiguration(entry, `${path}.${key}`);
+    }
+}

package/dist/profile/isolation.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Product-local isolation posture shared by venue capability advertisement and Matrix
+ * re-derivation. The local venue always retains its unrestricted native launchers; selecting
+ * an OCI Inspect runtime adds container execution rather than replacing those launchers.
+ */
+export declare const VENUE_ISOLATION_POLICY: "unrestricted";
+export declare const INSPECT_OCI_ISOLATION_POLICY: "oci-container";
+type VenueIsolationPolicy = typeof VENUE_ISOLATION_POLICY | typeof INSPECT_OCI_ISOLATION_POLICY;
+export interface VenueIsolationPosture {
+    readonly inventory: readonly VenueIsolationPolicy[];
+    readonly provisionerCapabilities: readonly string[];
+}
+/** Deduplicates into the product's stable policy order rather than caller or locale order. */
+export declare function deriveVenueIsolationPosture(policies: readonly VenueIsolationPolicy[]): VenueIsolationPosture;
+/**
+ * Converts the one policy sealed into a Run's submission baseline into the inventory of the
+ * product venue that can execute it. Unknown values gain no capability and therefore fall back
+ * to the native venue's conservative singleton inventory.
+ */
+export declare function venueIsolationPostureForPolicy(policy: unknown): VenueIsolationPosture;
+export {};

package/dist/profile/isolation.js

@@ -0,0 +1,31 @@
+/**
+ * Product-local isolation posture shared by venue capability advertisement and Matrix
+ * re-derivation. The local venue always retains its unrestricted native launchers; selecting
+ * an OCI Inspect runtime adds container execution rather than replacing those launchers.
+ */
+export const VENUE_ISOLATION_POLICY = "unrestricted";
+export const INSPECT_OCI_ISOLATION_POLICY = "oci-container";
+const POLICY_ORDER = [
+    VENUE_ISOLATION_POLICY,
+    INSPECT_OCI_ISOLATION_POLICY,
+];
+/** Deduplicates into the product's stable policy order rather than caller or locale order. */
+export function deriveVenueIsolationPosture(policies) {
+    const selected = new Set(policies);
+    const inventory = POLICY_ORDER.filter((policy) => selected.has(policy));
+    return {
+        inventory,
+        provisionerCapabilities: inventory.map((policy) => policy === VENUE_ISOLATION_POLICY ? "process" : policy),
+    };
+}
+/**
+ * Converts the one policy sealed into a Run's submission baseline into the inventory of the
+ * product venue that can execute it. Unknown values gain no capability and therefore fall back
+ * to the native venue's conservative singleton inventory.
+ */
+export function venueIsolationPostureForPolicy(policy) {
+    return deriveVenueIsolationPosture([
+        VENUE_ISOLATION_POLICY,
+        ...(policy === INSPECT_OCI_ISOLATION_POLICY ? [INSPECT_OCI_ISOLATION_POLICY] : []),
+    ]);
+}

package/dist/profile/pinning-evidence.d.ts

@@ -0,0 +1,41 @@
+import type { LocalCellPinningEvidence } from "@jinn-network/benchmarking-local";
+import { z } from "zod";
+/**
+ * Product-private evidence artifact stored by digest in the existing sealed-bytes CAS.
+ *
+ * This is not a Benchmarking record kind and carries no publication-tier semantics. It is the
+ * exact assembly input needed to recompute the Matrix pinning statuses. An artifact must carry
+ * at least one real fact; an empty object cannot become an evidence reference.
+ */
+export declare const RunPinningEvidenceSchema: z.ZodObject<{
+    submissionDigest: z.ZodString;
+    admission: z.ZodOptional<z.ZodObject<{
+        ready: z.ZodBoolean;
+        detail: z.ZodOptional<z.ZodString>;
+        checkedRequirementsDigest: z.ZodString;
+    }, z.core.$strict>>;
+    observations: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        axis: z.ZodEnum<{
+            harness: "harness";
+            model: "model";
+            loadout: "loadout";
+            isolation: "isolation";
+        }>;
+        value: z.ZodUnknown;
+        source: z.ZodEnum<{
+            "runtime-observation": "runtime-observation";
+            materialization: "materialization";
+            "admission-probe": "admission-probe";
+        }>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+export type RunPinningEvidence = z.infer<typeof RunPinningEvidenceSchema>;
+export interface VerifiedRunPinningCheck {
+    readonly ready: boolean;
+    readonly detail?: string;
+    readonly checkedRequirementsDigest: `sha256:${string}`;
+}
+export declare function canonicalRunPinningEvidenceBytes(check: VerifiedRunPinningCheck, submissionDigest: `sha256:${string}`): Uint8Array;
+export declare function parseRunPinningEvidenceArtifact(bytes: Uint8Array): RunPinningEvidence;
+export declare function pinningEvidenceFacts(artifact: RunPinningEvidence): LocalCellPinningEvidence;
+export declare function parseRunPinningEvidence(bytes: Uint8Array): LocalCellPinningEvidence;

package/dist/profile/pinning-evidence.js

@@ -0,0 +1,43 @@
+import { serializeCanonicalJson } from "@jinn-network/task-execution-protocol";
+import { z } from "zod";
+const Sha256RefSchema = z.string().regex(/^sha256:[a-f0-9]{64}$/u);
+const RunPinningCheckSchema = z.object({
+    ready: z.boolean(),
+    detail: z.string().optional(),
+    checkedRequirementsDigest: Sha256RefSchema,
+}).strict();
+const AxisObservationSchema = z.object({
+    axis: z.enum(["harness", "model", "loadout", "isolation"]),
+    value: z.unknown(),
+    source: z.enum(["runtime-observation", "materialization", "admission-probe"]),
+}).strict();
+/**
+ * Product-private evidence artifact stored by digest in the existing sealed-bytes CAS.
+ *
+ * This is not a Benchmarking record kind and carries no publication-tier semantics. It is the
+ * exact assembly input needed to recompute the Matrix pinning statuses. An artifact must carry
+ * at least one real fact; an empty object cannot become an evidence reference.
+ */
+export const RunPinningEvidenceSchema = z.object({
+    /** Exact accepted sealed Submission whose admission/observations this artifact describes. */
+    submissionDigest: Sha256RefSchema,
+    admission: RunPinningCheckSchema.optional(),
+    observations: z.array(AxisObservationSchema).min(1).optional(),
+}).strict().refine((evidence) => evidence.admission !== undefined || evidence.observations !== undefined, "run-pinning evidence must carry an admission check or an observation");
+export function canonicalRunPinningEvidenceBytes(check, submissionDigest) {
+    const evidence = RunPinningEvidenceSchema.parse({ submissionDigest, admission: check });
+    return serializeCanonicalJson(evidence);
+}
+export function parseRunPinningEvidenceArtifact(bytes) {
+    const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    return RunPinningEvidenceSchema.parse(value);
+}
+export function pinningEvidenceFacts(artifact) {
+    return {
+        ...(artifact.admission === undefined ? {} : { admission: artifact.admission }),
+        ...(artifact.observations === undefined ? {} : { observations: artifact.observations }),
+    };
+}
+export function parseRunPinningEvidence(bytes) {
+    return pinningEvidenceFacts(parseRunPinningEvidenceArtifact(bytes));
+}

package/dist/profile/ports.d.ts

@@ -0,0 +1,3 @@
+import { type MethodPorts } from "@jinn-network/benchmarking-aggregate";
+/** Public byte-resolver adapter used to re-verify a bundle-carried Report. */
+export declare function buildMethodPortsFromResolver(resolveBytes: (digest: string) => Uint8Array | undefined): MethodPorts;

package/dist/profile/ports.js

@@ -0,0 +1,11 @@
+import { BENCHMARKING_METHOD_REGISTRY } from "@jinn-network/benchmarking-aggregate";
+/** Public byte-resolver adapter used to re-verify a bundle-carried Report. */
+export function buildMethodPortsFromResolver(resolveBytes) {
+    return {
+        registry: BENCHMARKING_METHOD_REGISTRY,
+        resolveVerdictBytes: resolveBytes,
+        resolveRunBytes: resolveBytes,
+        resolveTaskBytes: resolveBytes,
+        resolveRecordBytes: resolveBytes,
+    };
+}

package/dist/profile/preview-log.d.ts

@@ -0,0 +1,4 @@
+export declare function previewDisclosureSummaryLine(summary: {
+    readonly previewCount: number;
+    readonly timestamps: readonly string[];
+}): string;

package/dist/profile/preview-log.js

@@ -0,0 +1,3 @@
+export function previewDisclosureSummaryLine(summary) {
+    return `${summary.previewCount} disposable preview rehearsal(s) of this benchmark ran before lock (at ${summary.timestamps.join(", ")}); preview results are rehearsal only and never entered official results.`;
+}

package/dist/profile/run-results.d.ts

@@ -0,0 +1,17 @@
+import type { MatrixCell, RunRecord } from "@jinn-network/benchmarking-records";
+import { type ClaimAnchor } from "./anchor-claims.js";
+export declare const LOCAL_VENUE_LIMITS: readonly string[];
+export declare function localVenueLimitsForRun(run: Pick<RunRecord, "policy">): readonly string[];
+/** `anchors` is the same derived section the producer used (anchor-evidence §7.4); the conditional
+ * copy is the same pure function on both sides, so claim-consistency stays an exact byte-compare. */
+export declare function buildLocalVenueHonesty(cells: readonly MatrixCell[], run: Pick<RunRecord, "policy">, anchors?: readonly ClaimAnchor[]): {
+    venue: "self-run";
+    preRegistration: "structural-and-append-order-only" | "structural-append-order-and-anchored-time";
+    limits: readonly string[];
+    unverifiableAxisCounts: {
+        harness: number;
+        model: number;
+        loadout: number;
+        isolation: number;
+    };
+};

package/dist/profile/run-results.js

@@ -0,0 +1,23 @@
+import { venueIsolationPostureForPolicy } from "./isolation.js";
+import { anchoredPreRegistration, anchoredVenueLimits } from "./anchor-claims.js";
+export const LOCAL_VENUE_LIMITS = [
+    "This is a local, self-run venue: the same operator controls task dispatch, execution, and evaluation.",
+    "Pre-registration here is a discipline enforced by this tool, not a proof against the run's own owner — nothing prevents the owner from having altered the record before publishing it.",
+    "Run pinning on the harness, model, and loadout axes is enforced by an admission gate at dispatch time. The isolation axis is vacuous: this venue's launchers admit only one isolation policy, so matching it proves nothing about containment strength.",
+    "Cost figures, where present, are self-reported by this venue and were never independently settled.",
+    "Distinct solver and evaluator identities prove agent-distinctness only — each evaluator identity is backed by its own workspace-minted signing key, whose verdict signature this product verifies — not that they are independent real-world parties.",
+];
+const MULTI = "Run pinning on the harness, model, and loadout axes is enforced by an admission gate at dispatch time. The isolation axis is unverifiable: this configured venue admits both unrestricted and OCI-container execution, so its multi-policy inventory cannot establish containment from admission alone.";
+export function localVenueLimitsForRun(run) {
+    return venueIsolationPostureForPolicy(run.policy.submissionBaseline?.isolationPolicy).inventory.length === 1 ? LOCAL_VENUE_LIMITS : [LOCAL_VENUE_LIMITS[0], LOCAL_VENUE_LIMITS[1], MULTI, ...LOCAL_VENUE_LIMITS.slice(3)];
+}
+/** `anchors` is the same derived section the producer used (anchor-evidence §7.4); the conditional
+ * copy is the same pure function on both sides, so claim-consistency stays an exact byte-compare. */
+export function buildLocalVenueHonesty(cells, run, anchors = []) {
+    const counts = { harness: 0, model: 0, loadout: 0, isolation: 0 };
+    for (const cell of cells)
+        for (const axis of Object.keys(counts))
+            if (cell.verification[axis] === "unverifiable")
+                counts[axis] += 1;
+    return { venue: "self-run", preRegistration: anchoredPreRegistration(anchors), limits: anchoredVenueLimits(localVenueLimitsForRun(run), anchors), unverifiableAxisCounts: counts };
+}

package/dist/profile/signing.d.ts

@@ -0,0 +1,10 @@
+import { type KeyObject } from "node:crypto";
+/** Derives the public did:key identifier from an Ed25519 SPKI. */
+export declare function didKeyFromEd25519PublicKey(publicKey: KeyObject): string;
+/** Fail-closed verification of the Report envelope against the bundle-carried author key. */
+export declare function verifyReportEnvelopeSignatures(envelopeBytes: Uint8Array, key: {
+    readonly keyId: string;
+    readonly publicKey: KeyObject;
+}): {
+    validSignerKeyids: readonly string[];
+};