@colophon-claims/verify 0.0.0 → 0.2.0

package/dist/admission/contracts.js

@@ -0,0 +1,459 @@
+// SPDX-License-Identifier: Apache-2.0
+import { z } from "zod";
+import { BINARY_JUDGMENT_TIMESTAMP_PATTERN, compareCodeUnitStrings, } from "@jinn-network/task-execution-profiles";
+export const HUMAN_REVIEW_PACKET_PROTOCOL = "https://spec.jinn.network/binary-judgment/human-review-packet/v1";
+export const HUMAN_REVIEW_RESPONSE_PROTOCOL = "https://spec.jinn.network/binary-judgment/human-review-response/v1";
+export const HUMAN_REVIEW_VISIBILITY_RECEIPT_PROTOCOL = "https://spec.jinn.network/binary-judgment/visibility-receipt/v1";
+export const HUMAN_REVIEW_ROSTER_PROTOCOL = "https://spec.jinn.network/binary-judgment/reviewer-roster/v1";
+export const HUMAN_REVIEW_REVEAL_RECEIPT_PROTOCOL = "https://spec.jinn.network/binary-judgment/reveal-receipt/v1";
+export const HUMAN_REVIEW_REPLACEMENT_LEDGER_PROTOCOL = "https://spec.jinn.network/binary-judgment/replacement-ledger/v1";
+export const HUMAN_REVIEW_OPERATOR_ASSERTION_PROTOCOL = "https://spec.jinn.network/binary-judgment/operator-truth-assertion/v1";
+export const BINARY_JUDGMENT_ADMISSION_MANIFEST_PROTOCOL = "https://spec.jinn.network/binary-judgment/admission-manifest/v1";
+// screened-operator-sampled admission branch (spec §6.1, §6.3, §6.6; packet P6).
+export const SCREENING_TABLE_PROTOCOL = "https://spec.jinn.network/binary-judgment/screening-table/v1";
+export const PROMPTED_SCREENING_PROCEDURE_PROTOCOL = "https://spec.jinn.network/binary-judgment/prompted-screening-procedure/v1";
+export const SCREENING_POOL_PROTOCOL = "https://spec.jinn.network/binary-judgment/screening-pool/v1";
+export const SCREENING_SAMPLE_COMMITMENT_PROTOCOL = "https://spec.jinn.network/binary-judgment/screening-sample-commitment/v1";
+export const SCREENING_TABLE_V2_PROTOCOL = "https://spec.jinn.network/binary-judgment/screening-table/v2";
+export const SCREENING_REVEAL_RECEIPT_PROTOCOL = "https://spec.jinn.network/binary-judgment/screening-reveal-receipt/v1";
+export const HUMAN_REVIEW_PACKET_MEDIA_TYPE = "application/vnd.jinn.binary-judgment.human-review-packet.v1+json";
+export const HUMAN_REVIEW_RESPONSE_MEDIA_TYPE = "application/vnd.jinn.binary-judgment.human-review-response.v1+json";
+export const HUMAN_REVIEW_VISIBILITY_RECEIPT_MEDIA_TYPE = "application/vnd.jinn.binary-judgment.visibility-receipt.v1+json";
+export const HUMAN_REVIEW_ROSTER_MEDIA_TYPE = "application/vnd.jinn.binary-judgment.reviewer-roster.v1+json";
+export const HUMAN_REVIEW_REVEAL_RECEIPT_MEDIA_TYPE = "application/vnd.jinn.binary-judgment.reveal-receipt.v1+json";
+export const HUMAN_REVIEW_OPERATOR_ASSERTION_MEDIA_TYPE = "application/vnd.jinn.binary-judgment.operator-truth-assertion.v1+json";
+// screened-operator-sampled admission branch (spec §6.3, §6.6; packet P6).
+export const SCREENING_TABLE_MEDIA_TYPE = "application/vnd.jinn.binary-judgment.screening-table.v1+json";
+export const SCREENING_TABLE_V2_MEDIA_TYPE = "application/vnd.jinn.binary-judgment.screening-table.v2+json";
+export const SCREENING_REVEAL_RECEIPT_MEDIA_TYPE = "application/vnd.jinn.binary-judgment.screening-reveal-receipt.v1+json";
+const DigestSchema = z.string().regex(/^sha256:[0-9a-f]{64}$/u);
+const TimestampSchema = z.string().datetime({ offset: true });
+const IdentitySchema = z.string().min(1).max(256);
+const EvaluatorIdentitySchema = IdentitySchema.regex(/^(?:https?:\/\/|urn:)[^\s]+$/u);
+// §3.1 rule 1: one identifier dialect, not two. Shared shape with `candidateClass`.
+const IDENTIFIER_NAME = /^[A-Za-z][A-Za-z0-9._-]{0,63}$/u;
+const CandidateClassSchema = z.string().regex(IDENTIFIER_NAME);
+const BinaryJudgmentTruthLabelSchema = z.enum(["CORRECT", "WRONG"]);
+const BinaryJudgmentStratumSchema = z.string().regex(IDENTIFIER_NAME);
+/**
+ * RFC 3339 instant SHAPE, seconds precision, no fractional part. The pattern is imported from the
+ * profiles package rather than restated, so this mirrored payload copy cannot drift from the
+ * canonical one it mirrors.
+ */
+const BinaryJudgmentTimestampShapeSchema = z.string().regex(new RegExp(BINARY_JUDGMENT_TIMESTAMP_PATTERN, "u"));
+const BinaryJudgmentPayloadSchema = z.strictObject({
+    itemId: z.string().regex(/^urn:uuid:[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u),
+    question: z.string(),
+    referenceAnswer: z.string(),
+    candidateAnswer: z.string(),
+    evidence: z.string().optional(),
+    provenance: z.strictObject({
+        sourceCommitment: DigestSchema,
+        timestamp: BinaryJudgmentTimestampShapeSchema,
+    }),
+    sources: z.array(z.strictObject({
+        digest: z.strictObject({ sha256: z.string().regex(/^[0-9a-f]{64}$/u) }),
+    })).min(1),
+});
+const ConflictListSchema = z.array(z.string().min(1)).superRefine((values, ctx) => {
+    for (let index = 1; index < values.length; index += 1) {
+        if (compareCodeUnitStrings(values[index - 1], values[index]) >= 0) {
+            ctx.addIssue({ code: "custom", message: "conflicts must be sorted and unique" });
+            return;
+        }
+    }
+});
+const SortedUniqueDigestListSchema = z.array(DigestSchema).superRefine((values, ctx) => {
+    for (let index = 1; index < values.length; index += 1) {
+        if (compareCodeUnitStrings(values[index - 1], values[index]) >= 0) {
+            ctx.addIssue({ code: "custom", message: "digest references must be sorted and unique" });
+            return;
+        }
+    }
+});
+const SortedUniqueDigestPairSchema = z.tuple([DigestSchema, DigestSchema]).superRefine((values, ctx) => {
+    if (compareCodeUnitStrings(values[0], values[1]) >= 0)
+        ctx.addIssue({ code: "custom", message: "digest references must be sorted and unique" });
+});
+export const HUMAN_REVIEW_OMITTED_FIELDS = [
+    "instrumentIdentity", "candidateClass", "stratum", "otherReview", "postRunOutcomes",
+];
+export const HumanReviewPacketSchema = z.strictObject({
+    protocol: z.literal(HUMAN_REVIEW_PACKET_PROTOCOL),
+    itemSha256: DigestSchema,
+    item: BinaryJudgmentPayloadSchema,
+    evaluationSpecSha256: DigestSchema,
+    reviewerId: EvaluatorIdentitySchema,
+    form: z.strictObject({
+        question: z.literal("Is the candidate answer correct relative to the question and reference answer?"),
+        labels: z.tuple([z.literal("CORRECT"), z.literal("WRONG"), z.literal("indeterminate")]),
+        completeReviewRequired: z.literal(true),
+    }),
+});
+export const HumanReviewVisibilityReceiptSchema = z.strictObject({
+    protocol: z.literal(HUMAN_REVIEW_VISIBILITY_RECEIPT_PROTOCOL),
+    packetSha256: DigestSchema,
+    itemSha256: DigestSchema,
+    reviewerId: EvaluatorIdentitySchema,
+    omittedFields: z.tuple(HUMAN_REVIEW_OMITTED_FIELDS.map((value) => z.literal(value))),
+    issuedAt: TimestampSchema,
+});
+export const HumanReviewResponseSchema = z.strictObject({
+    protocol: z.literal(HUMAN_REVIEW_RESPONSE_PROTOCOL),
+    packetSha256: DigestSchema,
+    visibilityReceiptSha256: DigestSchema,
+    itemSha256: DigestSchema,
+    evaluatorId: EvaluatorIdentitySchema,
+    label: z.union([BinaryJudgmentTruthLabelSchema, z.literal("indeterminate")]),
+    complete: z.boolean(),
+    completedAt: TimestampSchema,
+});
+export const ReviewerDeclarationSchema = z.strictObject({
+    evaluatorId: EvaluatorIdentitySchema,
+    keyId: IdentitySchema,
+    personId: IdentitySchema,
+    role: IdentitySchema,
+    conflicts: ConflictListSchema,
+});
+export const HumanReviewRosterSchema = z.strictObject({
+    protocol: z.literal(HUMAN_REVIEW_ROSTER_PROTOCOL),
+    itemSha256: DigestSchema,
+    reviewers: z.tuple([ReviewerDeclarationSchema, ReviewerDeclarationSchema]),
+    attestedBy: IdentitySchema,
+    attestorKeyId: IdentitySchema,
+    attestorRole: z.literal("roster-attestor"),
+    attestedAt: TimestampSchema,
+});
+export const HumanReviewRevealReceiptSchema = z.strictObject({
+    protocol: z.literal(HUMAN_REVIEW_REVEAL_RECEIPT_PROTOCOL),
+    draftId: IdentitySchema,
+    itemSha256: DigestSchema,
+    truthFrozenAt: TimestampSchema,
+    judgeExecutionState: z.literal("not-started"),
+    attestedBy: IdentitySchema,
+    attestorKeyId: IdentitySchema,
+    attestorRole: z.literal("truth-reveal-attestor"),
+});
+/**
+ * `screening-reveal-receipt/v1` (spec §6.6): a bank-scoped sibling of `HumanReviewRevealReceiptSchema`
+ * above. Same ordering primitive, same attestor role, same `judgeExecutionState: "not-started"`
+ * gate — differing only in subject: the bank (`screeningTableSha256`), not an item (`itemSha256`).
+ * `AdmissionAuthorityRole` (`verify/src/admission/verification.ts`) is deliberately unchanged: this
+ * reuses `truth-reveal-attestor` rather than minting a new role.
+ */
+export const ScreeningRevealReceiptSchema = z.strictObject({
+    protocol: z.literal(SCREENING_REVEAL_RECEIPT_PROTOCOL),
+    draftId: IdentitySchema,
+    screeningTableSha256: DigestSchema,
+    truthFrozenAt: TimestampSchema,
+    judgeExecutionState: z.literal("not-started"),
+    attestedBy: IdentitySchema,
+    attestorKeyId: IdentitySchema,
+    attestorRole: z.literal("truth-reveal-attestor"),
+});
+/**
+ * One row of the `screening-table/v1` record (spec §6.3). `handVerdict` is present if and only if
+ * `handChecked === true`; both directions refuse. `handVerdict` deliberately does not reuse
+ * `BinaryJudgmentTruthLabelSchema` — the hand-check outcome space is confirm-or-exclude only, with
+ * no label corrections.
+ */
+export const ScreeningRowSchema = z.strictObject({
+    itemSha256: DigestSchema,
+    intendedLabel: BinaryJudgmentTruthLabelSchema,
+    screeningVerdict: z.union([BinaryJudgmentTruthLabelSchema, z.literal("indeterminate")]),
+    handChecked: z.boolean(),
+    handVerdict: z.enum(["confirm", "exclude"]).optional(),
+}).superRefine((row, ctx) => {
+    if (row.handChecked && row.handVerdict === undefined) {
+        ctx.addIssue({ code: "custom", path: ["handVerdict"], message: "handVerdict is required when handChecked is true" });
+    }
+    if (!row.handChecked && row.handVerdict !== undefined) {
+        ctx.addIssue({ code: "custom", path: ["handVerdict"], message: "handVerdict must be absent when handChecked is false" });
+    }
+});
+/**
+ * `screening-table/v1` (spec §6.3): one signed record per bank. Every derived quantity (the
+ * flagged set, the sample, the exclusions, the agreement rate) is a *view* of this table, never a
+ * stored field that can disagree with it — those recomputations live in `screening-sample.ts` and
+ * its siblings, not here. `screeningModel` is deliberately absent: it is derivable from
+ * `screeningInstrumentSha256`, and a second copy is a second thing to drift. The table is signed
+ * once, over the whole record, on the existing DSSE signing path used by the other admission
+ * records (`sealRoleEvidence`), not the ledger's non-DSSE path.
+ */
+export const ScreeningTableSchema = z.strictObject({
+    protocol: z.literal(SCREENING_TABLE_PROTOCOL),
+    draftId: IdentitySchema,
+    screeningInstrumentSha256: DigestSchema,
+    sampleSeed: z.string().min(1),
+    // Positive integer, `1 <= sampleSize`. The `<= rows.length` half is a verifier recomputation
+    // (spec §6.5 check (0)) owned elsewhere; this schema owns only the positivity.
+    sampleSize: z.number().int().positive(),
+    samplingScriptSha256: DigestSchema,
+    // Digest-bound opaque sidecar; the verifier resolves and hashes its exact bytes but never parses
+    // or interprets their content (spec §6.5).
+    rawOutputsSha256: DigestSchema,
+    rows: z.array(ScreeningRowSchema),
+    sealedAt: TimestampSchema,
+}).superRefine((table, ctx) => {
+    if (table.rows.length === 0) {
+        ctx.addIssue({ code: "custom", path: ["rows"], message: "rows must be non-empty" });
+        return;
+    }
+    for (let index = 1; index < table.rows.length; index += 1) {
+        if (compareCodeUnitStrings(table.rows[index - 1].itemSha256, table.rows[index].itemSha256) >= 0) {
+            ctx.addIssue({ code: "custom", path: ["rows"], message: "rows must be sorted by itemSha256 and unique" });
+            return;
+        }
+    }
+});
+export const PROMPTED_SCREENING_PROFILE = "prompted-codex-screening/v1";
+export const PROMPTED_SCREENING_LIMITATIONS = [
+    "prompt-compliance-not-machine-verified",
+    "provider-execution-not-machine-verified",
+    "transcript-provenance-not-machine-verified",
+    "mutable-model-alias-weights-not-machine-verified",
+];
+const PromptedAgentSchema = (alias, model, reasoningEffort, maxBatchSize) => z.strictObject({
+    alias: z.literal(alias),
+    model: z.literal(model),
+    reasoningEffort: z.literal(reasoningEffort),
+    maxBatchSize: z.literal(maxBatchSize),
+});
+/** Closed, machine-checkable orchestration metadata. Prompt and transcript bytes stay opaque. */
+export const PromptedScreeningProcedureV1Schema = z.strictObject({
+    protocol: z.literal(PROMPTED_SCREENING_PROCEDURE_PROTOCOL),
+    procedureId: z.literal(PROMPTED_SCREENING_PROFILE),
+    coordinatorPromptSha256: DigestSchema,
+    coordinator: z.strictObject({
+        alias: z.literal("Sol"),
+        model: z.literal("gpt-5.6-sol"),
+        reasoningEffort: z.literal("high"),
+        mayOrchestrate: z.literal(true),
+    }),
+    judgmentAgents: z.tuple([
+        PromptedAgentSchema("Luna", "gpt-5.6-luna", "medium", 32),
+        PromptedAgentSchema("Terra", "gpt-5.6-terra", "high", 16),
+        PromptedAgentSchema("Sol", "gpt-5.6-sol", "high", 8),
+    ]),
+    toolPolicy: z.strictObject({
+        coordinator: z.literal("orchestration-only"),
+        judgmentAgents: z.strictObject({
+            web: z.literal(false),
+            shell: z.literal(false),
+            repository: z.literal(false),
+            search: z.literal(false),
+        }),
+    }),
+    output: z.strictObject({
+        alphabet: z.tuple([z.literal("CORRECT"), z.literal("WRONG"), z.literal("UNSURE")]),
+        invalidOutputDecision: z.literal("UNSURE"),
+    }),
+    retry: z.strictObject({
+        maxRetries: z.literal(1),
+        onlyWhen: z.literal("infrastructure-failure-with-no-model-output"),
+        prompt: z.literal("identical"),
+    }),
+    transcriptSha256: DigestSchema,
+    sealedAt: TimestampSchema,
+});
+export const SCREENING_POOL_CANDIDATE_CLASSES = ["correct", "specific-wrong", "vague-topical-wrong"];
+export const SCREENING_POOL_STRATA = ["category-1", "category-2", "category-3", "category-4"];
+const ScreeningPoolCommonItemSchema = z.strictObject({
+    itemSha256: DigestSchema,
+    intendedLabel: BinaryJudgmentTruthLabelSchema,
+    candidateClass: z.enum(SCREENING_POOL_CANDIDATE_CLASSES),
+    stratum: z.enum(SCREENING_POOL_STRATA),
+    poolPosition: z.number().int().positive(),
+    slotId: z.string().regex(/^slot-[0-9]{3}$/u),
+});
+export const ScreeningPoolItemSchema = z.discriminatedUnion("poolKind", [
+    ScreeningPoolCommonItemSchema.extend({ poolKind: z.literal("main") }),
+    ScreeningPoolCommonItemSchema.extend({ poolKind: z.literal("reserve"), reserveOrder: z.number().int().positive() }),
+]);
+/** The complete, ordered 240-main plus 424-reserve candidate universe. */
+export const ScreeningPoolV1Schema = z.strictObject({
+    protocol: z.literal(SCREENING_POOL_PROTOCOL),
+    draftId: IdentitySchema,
+    identityCommitmentSha256: DigestSchema,
+    items: z.array(ScreeningPoolItemSchema).length(664),
+    sealedAt: TimestampSchema,
+}).superRefine((pool, ctx) => {
+    const slots = new Map();
+    const identities = new Set();
+    for (const [index, item] of pool.items.entries()) {
+        if (item.poolPosition !== index + 1)
+            ctx.addIssue({ code: "custom", path: ["items", index, "poolPosition"], message: "poolPosition must be contiguous and match array order" });
+        if (identities.has(item.itemSha256))
+            ctx.addIssue({ code: "custom", path: ["items", index, "itemSha256"], message: "itemSha256 must be unique" });
+        identities.add(item.itemSha256);
+        const expectedLabel = item.candidateClass === "correct" ? "CORRECT" : "WRONG";
+        if (item.intendedLabel !== expectedLabel)
+            ctx.addIssue({ code: "custom", path: ["items", index, "intendedLabel"], message: "intendedLabel does not derive from candidateClass" });
+        slots.set(item.slotId, [...(slots.get(item.slotId) ?? []), item]);
+    }
+    const mains = pool.items.filter((item) => item.poolKind === "main");
+    if (mains.length !== 240 || slots.size !== 240)
+        ctx.addIssue({ code: "custom", path: ["items"], message: "pool must contain exactly 240 main slots" });
+    const expectedSlotIds = Array.from({ length: 240 }, (_, index) => `slot-${(index + 1).toString().padStart(3, "0")}`);
+    const actualSlotIds = [...slots.keys()].sort(compareCodeUnitStrings);
+    if (actualSlotIds.length !== expectedSlotIds.length || actualSlotIds.some((value, index) => value !== expectedSlotIds[index]))
+        ctx.addIssue({ code: "custom", path: ["items"], message: "slot lineage must be exactly slot-001 through slot-240" });
+    for (const [slotId, items] of slots) {
+        const main = items.filter((item) => item.poolKind === "main");
+        if (main.length !== 1) {
+            ctx.addIssue({ code: "custom", path: ["items"], message: `${slotId} must contain exactly one main item` });
+            continue;
+        }
+        const reserves = items.filter((item) => item.poolKind === "reserve").sort((a, b) => a.reserveOrder - b.reserveOrder);
+        for (const [index, reserve] of reserves.entries()) {
+            if (reserve.reserveOrder !== index + 1)
+                ctx.addIssue({ code: "custom", path: ["items"], message: `${slotId} reserveOrder must be contiguous` });
+            if (reserve.poolPosition <= main[0].poolPosition)
+                ctx.addIssue({ code: "custom", path: ["items"], message: `${slotId} reserves must follow their main item in pool order` });
+            if (reserve.candidateClass !== main[0].candidateClass || reserve.stratum !== main[0].stratum || reserve.intendedLabel !== main[0].intendedLabel)
+                ctx.addIssue({ code: "custom", path: ["items"], message: `${slotId} reserves must preserve class, stratum, and intended label` });
+        }
+    }
+    for (const candidateClass of SCREENING_POOL_CANDIDATE_CLASSES)
+        for (const stratum of SCREENING_POOL_STRATA) {
+            if (mains.filter((item) => item.candidateClass === candidateClass && item.stratum === stratum).length !== 20)
+                ctx.addIssue({ code: "custom", path: ["items"], message: `main pool must contain 20 ${candidateClass}/${stratum} items` });
+        }
+});
+export const ScreeningSampleCommitmentV1Schema = z.strictObject({
+    protocol: z.literal(SCREENING_SAMPLE_COMMITMENT_PROTOCOL),
+    draftId: IdentitySchema,
+    poolSha256: DigestSchema,
+    poolIdentityCommitmentSha256: DigestSchema,
+    samplingProcedure: z.literal("screening-sample/1"),
+    sampleSeed: z.string().min(1),
+    sampleSize: z.literal(72),
+    sampleItemSha256s: z.array(DigestSchema).length(72).superRefine((values, ctx) => {
+        for (let index = 1; index < values.length; index += 1) {
+            if (compareCodeUnitStrings(values[index - 1], values[index]) >= 0)
+                ctx.addIssue({ code: "custom", message: "sample identities must be sorted and unique" });
+        }
+    }),
+    committedAt: TimestampSchema,
+});
+const ScreeningDecisionSchema = z.enum(["CORRECT", "WRONG", "UNSURE"]);
+const RitsuScreeningDecisionSchema = z.discriminatedUnion("checked", [
+    z.strictObject({ checked: z.literal(false) }),
+    z.strictObject({ checked: z.literal(true), verdict: z.enum(["confirm", "exclude"]), decidedAt: TimestampSchema }),
+]);
+export const PromptedScreeningRowV2Schema = z.strictObject({
+    itemSha256: DigestSchema,
+    intendedLabel: BinaryJudgmentTruthLabelSchema,
+    screeningVerdict: ScreeningDecisionSchema,
+    terraReviewVerdict: ScreeningDecisionSchema.optional(),
+    solReviewVerdict: ScreeningDecisionSchema.optional(),
+    ritsuDecision: RitsuScreeningDecisionSchema,
+});
+/** Signed authority decision table for the prompted Codex procedure. */
+export const ScreeningTableV2Schema = z.strictObject({
+    protocol: z.literal(SCREENING_TABLE_V2_PROTOCOL),
+    draftId: IdentitySchema,
+    procedureSha256: DigestSchema,
+    coordinatorPromptSha256: DigestSchema,
+    poolSha256: DigestSchema,
+    sampleCommitmentSha256: DigestSchema,
+    samplingScriptSha256: DigestSchema,
+    transcriptSha256: DigestSchema,
+    operator: z.literal("Ritsu"),
+    rows: z.array(PromptedScreeningRowV2Schema).length(664),
+    sealedAt: TimestampSchema,
+}).superRefine((table, ctx) => {
+    for (let index = 1; index < table.rows.length; index += 1) {
+        if (compareCodeUnitStrings(table.rows[index - 1].itemSha256, table.rows[index].itemSha256) >= 0) {
+            ctx.addIssue({ code: "custom", path: ["rows"], message: "rows must be sorted by itemSha256 and unique" });
+            return;
+        }
+    }
+});
+// The two-human-review reasons (unchanged) and the screened-branch reasons this packet adds
+// (spec §6.4; packet P6). This is one of four widened copies of the closed reason vocabulary
+// (the other three: verify/src/schema.ts's exclusions[].reason, verify/src/admission/
+// verification.ts's VerifiedBinaryJudgmentAdmissionExclusion.reason, and
+// core/src/operations/human-review.ts's HumanAdmissionExclusionSummary.reason) — duplicated
+// with a comment at each site rather than imported, matching this package's existing pattern for
+// shared closed vocabularies (e.g. IDENTIFIER_NAME above) and its standalone-verifier posture.
+// Two further sites carry the vocabulary but are deliberately left narrow: human-review.ts's
+// exclusion-reason derivation ternary and its downstream type guard structurally cannot produce
+// a screening-* value without the screened branch's own construction logic (out of scope, see
+// this packet's report), so widening their literal sets would be inert. A seventh site,
+// verification.ts's `expectedExclusionReason` (recomputation logic, S3's), is out of scope too.
+const HUMAN_REVIEW_LEDGER_REASONS = ["review-disagreement", "review-indeterminate", "review-incomplete"];
+// Derived from §6.4's admission rule (`admitted := handChecked ? (handVerdict === "confirm") :
+// agreed`): a row is excluded because the screen disagreed with the intended label, because the
+// screen's verdict was indeterminate, or because the operator's hand check excluded it (including
+// the R-3 tie-break: a screen-agreed row the hand check overrode).
+const SCREENING_LEDGER_REASONS = ["screening-disagreement", "screening-indeterminate", "screening-hand-excluded"];
+export const HumanReviewReplacementLedgerEntrySchema = z.strictObject({
+    excludedItemSha256: DigestSchema,
+    replacementItemSha256: DigestSchema,
+    candidateClass: CandidateClassSchema,
+    stratum: BinaryJudgmentStratumSchema,
+    excludedPoolPosition: z.number().int().positive(),
+    replacementPoolPosition: z.number().int().positive(),
+    reason: z.enum([...HUMAN_REVIEW_LEDGER_REASONS, ...SCREENING_LEDGER_REASONS]),
+    // Per-item two-human apparatus (spec §6.9 deliberately drops it for the screened branch):
+    // present if and only if `reason` is one of the three two-human reasons above.
+    reviewVerdictSha256s: SortedUniqueDigestPairSchema.optional(),
+    visibilityReceiptSha256s: SortedUniqueDigestPairSchema.optional(),
+    reviewerRosterSha256: DigestSchema.optional(),
+    revealReceiptSha256: DigestSchema.optional(),
+}).superRefine((entry, ctx) => {
+    const isTwoHuman = HUMAN_REVIEW_LEDGER_REASONS.includes(entry.reason);
+    const twoHumanFields = [
+        ["reviewVerdictSha256s", entry.reviewVerdictSha256s],
+        ["visibilityReceiptSha256s", entry.visibilityReceiptSha256s],
+        ["reviewerRosterSha256", entry.reviewerRosterSha256],
+        ["revealReceiptSha256", entry.revealReceiptSha256],
+    ];
+    for (const [field, value] of twoHumanFields) {
+        if (isTwoHuman && value === undefined) {
+            ctx.addIssue({ code: "custom", path: [field], message: `${field} is required for a two-human-review reason` });
+        }
+        if (!isTwoHuman && value !== undefined) {
+            ctx.addIssue({ code: "custom", path: [field], message: `${field} must be absent for a screening reason` });
+        }
+    }
+});
+export const HumanReviewReplacementLedgerSchema = z.strictObject({
+    protocol: z.literal(HUMAN_REVIEW_REPLACEMENT_LEDGER_PROTOCOL),
+    draftId: IdentitySchema,
+    entries: z.array(HumanReviewReplacementLedgerEntrySchema),
+    sealedAt: TimestampSchema,
+});
+export const HumanReviewOperatorAssertionSchema = z.strictObject({
+    protocol: z.literal(HUMAN_REVIEW_OPERATOR_ASSERTION_PROTOCOL),
+    itemSha256: DigestSchema,
+    truthLabel: BinaryJudgmentTruthLabelSchema,
+    assertedBy: IdentitySchema,
+    assertedAt: TimestampSchema,
+    attestorKeyId: IdentitySchema,
+    attestorRole: z.literal("operator-truth-attestor"),
+    limitation: z.literal("operator-only-not-publication-grade"),
+});
+export const BinaryJudgmentAdmissionManifestSchema = z.strictObject({
+    protocol: z.literal(BINARY_JUDGMENT_ADMISSION_MANIFEST_PROTOCOL),
+    draftId: IdentitySchema,
+    truthAdmission: z.enum(["two-human-unanimous", "operator-only", "screened-operator-sampled"]),
+    labelResolutionSha256s: SortedUniqueDigestListSchema,
+    analysisContextSha256s: SortedUniqueDigestListSchema,
+    excludedItemSha256s: SortedUniqueDigestListSchema,
+    replacementLedgerSha256: DigestSchema,
+    // Present if and only if truthAdmission === "screened-operator-sampled" (spec §6.8). Existing
+    // two-human-unanimous and operator-only manifests stay byte-identical: this key is absent for
+    // both, exactly as it is today.
+    screeningTableSha256: DigestSchema.optional(),
+    admittedAt: TimestampSchema,
+}).superRefine((manifest, ctx) => {
+    const isScreened = manifest.truthAdmission === "screened-operator-sampled";
+    if (isScreened && manifest.screeningTableSha256 === undefined) {
+        ctx.addIssue({ code: "custom", path: ["screeningTableSha256"], message: "screeningTableSha256 is required for screened-operator-sampled admission" });
+    }
+    if (!isScreened && manifest.screeningTableSha256 !== undefined) {
+        ctx.addIssue({ code: "custom", path: ["screeningTableSha256"], message: "screeningTableSha256 must be absent outside screened-operator-sampled admission" });
+    }
+});

package/dist/admission/index.d.ts

@@ -0,0 +1,5 @@
+export * from "./application.js";
+export * from "./contracts.js";
+export * from "./intake.js";
+export * from "./screening-sample.js";
+export * from "./verification.js";

package/dist/admission/index.js

@@ -0,0 +1,5 @@
+export * from "./application.js";
+export * from "./contracts.js";
+export * from "./intake.js";
+export * from "./screening-sample.js";
+export * from "./verification.js";

package/dist/admission/intake.d.ts

@@ -0,0 +1,75 @@
+import { z } from "zod";
+export declare const BINARY_ITEM_BANK_ENTRY_PROTOCOL: "https://spec.jinn.network/binary-judgment/item-bank-entry/v1";
+export declare const BINARY_SOURCE_MANIFEST_ENTRY_PROTOCOL: "https://spec.jinn.network/binary-judgment/source-manifest-entry/v1";
+export declare const BINARY_ADMISSION_INDEX_ENTRY_PROTOCOL: "https://spec.jinn.network/binary-judgment/admission-index-entry/v1";
+export declare const BINARY_ITEM_BANK_INTAKE_EXTENSION: "https://product.jinn.network/extensions/binary-judgment-intake/v1";
+export declare const BinaryItemBankEntrySchema: z.ZodObject<{
+    protocol: z.ZodLiteral<"https://spec.jinn.network/binary-judgment/item-bank-entry/v1">;
+    item: z.ZodObject<{
+        itemId: z.ZodString;
+        question: z.ZodString;
+        referenceAnswer: z.ZodString;
+        candidateAnswer: z.ZodString;
+        evidence: z.ZodOptional<z.ZodString>;
+        provenance: z.ZodObject<{
+            sourceCommitment: z.ZodPipe<z.ZodString, z.ZodTransform<`sha256:${string}`, string>>;
+            timestamp: z.ZodString;
+        }, z.core.$strict>;
+        sources: z.ZodArray<z.ZodObject<{
+            digest: z.ZodObject<{
+                sha256: z.ZodString;
+            }, z.core.$strict>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type BinaryItemBankEntry = z.infer<typeof BinaryItemBankEntrySchema>;
+export declare const BinarySourceManifestEntrySchema: z.ZodObject<{
+    protocol: z.ZodLiteral<"https://spec.jinn.network/binary-judgment/source-manifest-entry/v1">;
+    provenanceSha256: z.ZodPipe<z.ZodString, z.ZodTransform<`sha256:${string}`, string>>;
+    source: z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        uri: z.ZodString;
+        digest: z.ZodObject<{
+            sha256: z.ZodString;
+        }, z.core.$strict>;
+        mediaType: z.ZodOptional<z.ZodString>;
+        downloadLocation: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    license: z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        uri: z.ZodString;
+        digest: z.ZodObject<{
+            sha256: z.ZodString;
+        }, z.core.$strict>;
+        mediaType: z.ZodOptional<z.ZodString>;
+        downloadLocation: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    attribution: z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        uri: z.ZodString;
+        digest: z.ZodObject<{
+            sha256: z.ZodString;
+        }, z.core.$strict>;
+        mediaType: z.ZodOptional<z.ZodString>;
+        downloadLocation: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    publishedAt: z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+}, z.core.$strict>;
+export type BinarySourceManifestEntry = z.infer<typeof BinarySourceManifestEntrySchema>;
+export declare const BinaryAdmissionIndexEntrySchema: z.ZodObject<{
+    protocol: z.ZodLiteral<"https://spec.jinn.network/binary-judgment/admission-index-entry/v1">;
+    admissionManifestSha256: z.ZodPipe<z.ZodString, z.ZodTransform<`sha256:${string}`, string>>;
+    itemSha256: z.ZodPipe<z.ZodString, z.ZodTransform<`sha256:${string}`, string>>;
+    labelResolutionSha256: z.ZodPipe<z.ZodString, z.ZodTransform<`sha256:${string}`, string>>;
+    analysisContextSha256: z.ZodPipe<z.ZodString, z.ZodTransform<`sha256:${string}`, string>>;
+}, z.core.$strict>;
+export type BinaryAdmissionIndexEntry = z.infer<typeof BinaryAdmissionIndexEntrySchema>;
+export declare const BinaryItemBankIntakeExtensionSchema: z.ZodObject<{
+    profile: z.ZodLiteral<"https://spec.jinn.network/task-profiles/binary-judgment/2.0">;
+    itemBankSha256: z.ZodPipe<z.ZodString, z.ZodTransform<`sha256:${string}`, string>>;
+    sourceManifestSha256: z.ZodPipe<z.ZodString, z.ZodTransform<`sha256:${string}`, string>>;
+    admissionIndexSha256: z.ZodPipe<z.ZodString, z.ZodTransform<`sha256:${string}`, string>>;
+    admissionManifestSha256: z.ZodPipe<z.ZodString, z.ZodTransform<`sha256:${string}`, string>>;
+    replacementLedgerSha256: z.ZodPipe<z.ZodString, z.ZodTransform<`sha256:${string}`, string>>;
+}, z.core.$strict>;
+export type BinaryItemBankIntakeExtension = z.infer<typeof BinaryItemBankIntakeExtensionSchema>;

package/dist/admission/intake.js

@@ -0,0 +1,70 @@
+// SPDX-License-Identifier: Apache-2.0
+import { z } from "zod";
+import { isCalendarStrictRfc3339 } from "@jinn-network/benchmarking-records";
+import { BINARY_JUDGMENT_TIMESTAMP_PATTERN } from "@jinn-network/task-execution-profiles";
+export const BINARY_ITEM_BANK_ENTRY_PROTOCOL = "https://spec.jinn.network/binary-judgment/item-bank-entry/v1";
+export const BINARY_SOURCE_MANIFEST_ENTRY_PROTOCOL = "https://spec.jinn.network/binary-judgment/source-manifest-entry/v1";
+export const BINARY_ADMISSION_INDEX_ENTRY_PROTOCOL = "https://spec.jinn.network/binary-judgment/admission-index-entry/v1";
+export const BINARY_ITEM_BANK_INTAKE_EXTENSION = "https://product.jinn.network/extensions/binary-judgment-intake/v1";
+const DigestSchema = z.string().regex(/^sha256:[0-9a-f]{64}$/u).transform((value) => value);
+const Sha256HexSchema = z.string().regex(/^[0-9a-f]{64}$/u);
+/**
+ * RFC 3339 instant SHAPE, seconds precision, no fractional part. The pattern itself is imported
+ * from the profiles package rather than restated, so the payload contract and this manifest row
+ * cannot drift apart. Shape only: calendar strictness is the `publishedAt` refinement below.
+ */
+const BinaryJudgmentTimestampShapeSchema = z.string().regex(new RegExp(BINARY_JUDGMENT_TIMESTAMP_PATTERN, "u"));
+const ItemPayloadSchema = z.strictObject({
+    itemId: z.string().regex(/^urn:uuid:[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u),
+    question: z.string(),
+    referenceAnswer: z.string(),
+    candidateAnswer: z.string(),
+    evidence: z.string().optional(),
+    provenance: z.strictObject({
+        sourceCommitment: DigestSchema,
+        timestamp: BinaryJudgmentTimestampShapeSchema,
+    }),
+    sources: z.array(z.strictObject({ digest: z.strictObject({ sha256: Sha256HexSchema }) })).min(1),
+});
+const SourceDescriptorSchema = z.strictObject({
+    name: z.string().min(1).optional(),
+    uri: z.string().min(1),
+    digest: z.strictObject({ sha256: Sha256HexSchema }),
+    mediaType: z.string().min(1).optional(),
+    downloadLocation: z.string().min(1).optional(),
+});
+export const BinaryItemBankEntrySchema = z.strictObject({
+    protocol: z.literal(BINARY_ITEM_BANK_ENTRY_PROTOCOL),
+    item: ItemPayloadSchema,
+});
+export const BinarySourceManifestEntrySchema = z.strictObject({
+    protocol: z.literal(BINARY_SOURCE_MANIFEST_ENTRY_PROTOCOL),
+    provenanceSha256: DigestSchema,
+    source: SourceDescriptorSchema,
+    license: SourceDescriptorSchema,
+    attribution: SourceDescriptorSchema,
+    // The source publication instant lives on the source row, not the item: two items drawn from
+    // one source then structurally carry the same cluster key (provenanceSha256) and the same
+    // publishedAt, instead of a rule someone has to check by hand. A per-item timestamp would let a
+    // bank author encode an ordering that correlates with the label.
+    publishedAt: BinaryJudgmentTimestampShapeSchema.refine(isCalendarStrictRfc3339, "publishedAt must be a calendar-strict RFC 3339 instant at seconds precision"),
+}).superRefine((entry, ctx) => {
+    if (`sha256:${entry.source.digest.sha256}` !== entry.provenanceSha256) {
+        ctx.addIssue({ code: "custom", path: ["source", "digest", "sha256"], message: "source digest must equal provenanceSha256" });
+    }
+});
+export const BinaryAdmissionIndexEntrySchema = z.strictObject({
+    protocol: z.literal(BINARY_ADMISSION_INDEX_ENTRY_PROTOCOL),
+    admissionManifestSha256: DigestSchema,
+    itemSha256: DigestSchema,
+    labelResolutionSha256: DigestSchema,
+    analysisContextSha256: DigestSchema,
+});
+export const BinaryItemBankIntakeExtensionSchema = z.strictObject({
+    profile: z.literal("https://spec.jinn.network/task-profiles/binary-judgment/2.0"),
+    itemBankSha256: DigestSchema,
+    sourceManifestSha256: DigestSchema,
+    admissionIndexSha256: DigestSchema,
+    admissionManifestSha256: DigestSchema,
+    replacementLedgerSha256: DigestSchema,
+});

package/dist/admission/result-evaluation.d.ts

@@ -0,0 +1,18 @@
+export interface AdmissionVerdictStatementView {
+    readonly evaluatorId: string;
+    readonly verdict: "pass" | "fail" | "inconclusive";
+    readonly evaluationSpecificationSha256: string;
+    readonly measurements: Readonly<Record<string, boolean | number | string>>;
+    readonly evaluatedAt: string;
+    readonly evidence?: readonly {
+        readonly name: string;
+        readonly sha256: string;
+        readonly mediaType?: string;
+    }[];
+    readonly limitations?: readonly string[];
+}
+export declare function readAdmissionVerdictEnvelope(envelopeBytes: Uint8Array): AdmissionVerdictStatementView;
+export declare function readOrderedAdmissionVerdictMeasurements(envelopeBytes: Uint8Array): readonly {
+    readonly name: string;
+    readonly value: boolean | number | string;
+}[];