@colophon-claims/verify 0.1.0 → 0.2.1

package/dist/profile/disclosure.d.ts

@@ -0,0 +1,273 @@
+/**
+ * The disclosed closure's projection and check (disclosure-specification-record design §6.4, §6.6,
+ * §7; issue #2839).
+ *
+ * This module is **single-sourced, not mirrored**, exactly as `anchor-claims.ts` is: `@colophon-
+ * claims/core` already depends on this package, so the producer and the standalone verifier call
+ * ONE `deriveDisclosureSpecification`. The claim-consistency byte-compare then compares one
+ * function's output over two byte sets rather than two implementations' guesses.
+ *
+ * The one posture that matters more than any mechanism here (design R4):
+ *
+ *   **The verifier AUTHENTICATES measurements and CARRIES assertions.**
+ *
+ * A `measured-here` variable must cite records the bundle actually carries, under a role admissible
+ * for the citation. A `disclosed-by-publisher` variable is checked for internal well-formedness and
+ * for nothing else — no lookup, no fetch, no cross-check against the Matrix or the Report, no status
+ * upgrade or downgrade. An assertion that turns out to be false is a false assertion in a valid
+ * record; that is the correct outcome and the honest one, and a verifier that refused it would be
+ * claiming a power it does not have.
+ *
+ * What this check deliberately does NOT do (design §8, each one a thing a well-meaning implementer
+ * would add):
+ *
+ * - It does not reconcile against `Report.disclosures.perSubject[].pinning`. Those counts answer
+ *   "how well did each executed axis pin"; this record answers "which variables were executed at
+ *   all". Two surfaces restating one fact are two surfaces that can disagree.
+ * - It does not infer a status from the bundle. A bundle that plainly executed a judge model does
+ *   not license marking `judge-model` as `measured-here` if the record says otherwise.
+ * - It does not fetch anything, ever. A verifier that reached the network would make its own result
+ *   depend on when it ran.
+ * - It does not rank, score, compare, or aggregate. There is no disclosure-completeness score:
+ *   counting statuses would create a number publishers optimize against, and a six-of-six record
+ *   with six vague assertions would outscore a two-of-six record with two proofs.
+ */
+import { z } from "zod";
+import { SIX_VARIABLE_DISCLOSURE_SPECIFICATION, type DisclosureEvidenceRole, type DisclosureVariableEntry, type DisclosureVariableKey, type DisclosureVariableStatus } from "@jinn-network/benchmarking-records";
+import type { BundleV4EvidenceRole } from "../schema.js";
+/** The evidence-catalog role a disclosure-specification record carries, and the ONLY one it may
+ * carry: a record bearing this token together with any second role refuses (§7 step 1). */
+export declare const DISCLOSURE_SPECIFICATION_BUNDLE_ROLE: "disclosure-specification";
+/**
+ * §6.4's binding profile: which of this carrier's evidence roles satisfy which of the standard's two
+ * portable disclosure roles. Jinn-side mapping, deliberately NOT part of the portable record — the
+ * mapping from the standard's roles onto a specific carrier's record roles is the carrier's business.
+ *
+ * v1 deliberately does not narrow the admissible set per variable. Which record species fixes
+ * `judge-model` depends on the judge profile packet P0 is freezing, and encoding a guess here would
+ * put this module in P0's lane. Reserved as a v2 tightening once P0's record vocabulary merges.
+ */
+export declare const DISCLOSURE_ROLE_BINDING: Readonly<Record<DisclosureEvidenceRole, readonly BundleV4EvidenceRole[]>>;
+/** The claim package's `disclosure` section (§6.6). Every variable entry is its record entry
+ * VERBATIM: nothing is summarized, counted, ranked, or reworded (R5). */
+export interface ClaimDisclosureSection {
+    readonly recordSha256: string;
+    /** The literal standard identifier, not any string: this section names the standard the record
+     * claims compliance with, and a section naming a different one is not this record's projection. */
+    readonly specification: typeof SIX_VARIABLE_DISCLOSURE_SPECIFICATION;
+    readonly subjectSha256: string;
+    readonly variables: Readonly<Record<DisclosureVariableKey, DisclosureVariableEntry>>;
+}
+/**
+ * The claim section's own grammar, single-sourced from the record's schema so the section cannot
+ * describe a variable entry the record could not have carried. It is a second line of defense
+ * rather than the primary one: `assertClaimConsistency`'s whole-claim byte-compare against the
+ * rebuilt claim is what actually proves the section is this record's projection.
+ */
+export declare const ClaimDisclosureSectionSchema: z.ZodObject<{
+    recordSha256: z.ZodString;
+    specification: z.ZodLiteral<"https://spec.jinn.network/disclosure/six-variable/v1">;
+    subjectSha256: z.ZodString;
+    variables: z.ZodObject<{
+        "ingestion-model": z.ZodDiscriminatedUnion<[z.ZodObject<{
+            status: z.ZodLiteral<"measured-here">;
+            statement: z.ZodString;
+            evidence: z.ZodArray<z.ZodObject<{
+                role: z.ZodEnum<{
+                    "pinned-configuration": "pinned-configuration";
+                    "execution-observation": "execution-observation";
+                }>;
+                digest: z.ZodObject<{
+                    sha256: z.ZodString;
+                }, z.core.$strict>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            status: z.ZodLiteral<"disclosed-by-publisher">;
+            statement: z.ZodString;
+            sources: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                uri: z.ZodString;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>, z.ZodObject<{
+            status: z.ZodLiteral<"undisclosed">;
+            reason: z.ZodEnum<{
+                "not-stated": "not-stated";
+                "stated-without-identifiers": "stated-without-identifiers";
+                "outside-this-experiment": "outside-this-experiment";
+            }>;
+        }, z.core.$strict>], "status">;
+        "retrieval-config": z.ZodDiscriminatedUnion<[z.ZodObject<{
+            status: z.ZodLiteral<"measured-here">;
+            statement: z.ZodString;
+            evidence: z.ZodArray<z.ZodObject<{
+                role: z.ZodEnum<{
+                    "pinned-configuration": "pinned-configuration";
+                    "execution-observation": "execution-observation";
+                }>;
+                digest: z.ZodObject<{
+                    sha256: z.ZodString;
+                }, z.core.$strict>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            status: z.ZodLiteral<"disclosed-by-publisher">;
+            statement: z.ZodString;
+            sources: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                uri: z.ZodString;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>, z.ZodObject<{
+            status: z.ZodLiteral<"undisclosed">;
+            reason: z.ZodEnum<{
+                "not-stated": "not-stated";
+                "stated-without-identifiers": "stated-without-identifiers";
+                "outside-this-experiment": "outside-this-experiment";
+            }>;
+        }, z.core.$strict>], "status">;
+        "answer-model": z.ZodDiscriminatedUnion<[z.ZodObject<{
+            status: z.ZodLiteral<"measured-here">;
+            statement: z.ZodString;
+            evidence: z.ZodArray<z.ZodObject<{
+                role: z.ZodEnum<{
+                    "pinned-configuration": "pinned-configuration";
+                    "execution-observation": "execution-observation";
+                }>;
+                digest: z.ZodObject<{
+                    sha256: z.ZodString;
+                }, z.core.$strict>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            status: z.ZodLiteral<"disclosed-by-publisher">;
+            statement: z.ZodString;
+            sources: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                uri: z.ZodString;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>, z.ZodObject<{
+            status: z.ZodLiteral<"undisclosed">;
+            reason: z.ZodEnum<{
+                "not-stated": "not-stated";
+                "stated-without-identifiers": "stated-without-identifiers";
+                "outside-this-experiment": "outside-this-experiment";
+            }>;
+        }, z.core.$strict>], "status">;
+        "answer-prompt": z.ZodDiscriminatedUnion<[z.ZodObject<{
+            status: z.ZodLiteral<"measured-here">;
+            statement: z.ZodString;
+            evidence: z.ZodArray<z.ZodObject<{
+                role: z.ZodEnum<{
+                    "pinned-configuration": "pinned-configuration";
+                    "execution-observation": "execution-observation";
+                }>;
+                digest: z.ZodObject<{
+                    sha256: z.ZodString;
+                }, z.core.$strict>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            status: z.ZodLiteral<"disclosed-by-publisher">;
+            statement: z.ZodString;
+            sources: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                uri: z.ZodString;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>, z.ZodObject<{
+            status: z.ZodLiteral<"undisclosed">;
+            reason: z.ZodEnum<{
+                "not-stated": "not-stated";
+                "stated-without-identifiers": "stated-without-identifiers";
+                "outside-this-experiment": "outside-this-experiment";
+            }>;
+        }, z.core.$strict>], "status">;
+        "judge-model": z.ZodDiscriminatedUnion<[z.ZodObject<{
+            status: z.ZodLiteral<"measured-here">;
+            statement: z.ZodString;
+            evidence: z.ZodArray<z.ZodObject<{
+                role: z.ZodEnum<{
+                    "pinned-configuration": "pinned-configuration";
+                    "execution-observation": "execution-observation";
+                }>;
+                digest: z.ZodObject<{
+                    sha256: z.ZodString;
+                }, z.core.$strict>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            status: z.ZodLiteral<"disclosed-by-publisher">;
+            statement: z.ZodString;
+            sources: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                uri: z.ZodString;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>, z.ZodObject<{
+            status: z.ZodLiteral<"undisclosed">;
+            reason: z.ZodEnum<{
+                "not-stated": "not-stated";
+                "stated-without-identifiers": "stated-without-identifiers";
+                "outside-this-experiment": "outside-this-experiment";
+            }>;
+        }, z.core.$strict>], "status">;
+        "judge-prompt": z.ZodDiscriminatedUnion<[z.ZodObject<{
+            status: z.ZodLiteral<"measured-here">;
+            statement: z.ZodString;
+            evidence: z.ZodArray<z.ZodObject<{
+                role: z.ZodEnum<{
+                    "pinned-configuration": "pinned-configuration";
+                    "execution-observation": "execution-observation";
+                }>;
+                digest: z.ZodObject<{
+                    sha256: z.ZodString;
+                }, z.core.$strict>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            status: z.ZodLiteral<"disclosed-by-publisher">;
+            statement: z.ZodString;
+            sources: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                uri: z.ZodString;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>, z.ZodObject<{
+            status: z.ZodLiteral<"undisclosed">;
+            reason: z.ZodEnum<{
+                "not-stated": "not-stated";
+                "stated-without-identifiers": "stated-without-identifiers";
+                "outside-this-experiment": "outside-this-experiment";
+            }>;
+        }, z.core.$strict>], "status">;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare class DisclosureProjectionError extends Error {
+    constructor(message: string);
+}
+/**
+ * The one shared projection, called by BOTH the workspace producer and the standalone verifier.
+ *
+ * It carries only facts embedded in the record's own bytes, plus the record's digest — which is the
+ * digest of the very bytes handed in, never a separately supplied one. It exists at all so a reader
+ * of `claim-package.json` alone sees all six statuses without opening an evidence record, and so
+ * `assertClaimConsistency`'s existing whole-claim byte-compare covers the disclosure without a
+ * second bespoke comparison.
+ */
+export declare function deriveDisclosureSpecification(recordBytes: Uint8Array): ClaimDisclosureSection;
+/** The disclosed statuses, surfaced on the verification result (§7 step 11). Disclosed facts, never
+ * folded into a single badge — the same posture `anchors` takes. */
+export interface DisclosureSpecificationReport {
+    readonly recordSha256: string;
+    readonly specification: string;
+    readonly subjectSha256: string;
+    readonly statuses: Readonly<Record<DisclosureVariableKey, DisclosureVariableStatus>>;
+}
+export interface AssertDisclosureSpecificationInput {
+    /** The Report extension's descriptor digest — what the carrier says the record is. */
+    readonly extensionDigestSha256: string;
+    /** Every evidence-catalog record's declared roles, keyed by record digest. */
+    readonly catalogRoles: ReadonlyMap<string, ReadonlySet<string>>;
+    /** The exact carried bytes for every evidence record, keyed by digest. */
+    readonly recordBytes: ReadonlyMap<string, Uint8Array>;
+    /** The bundle's own Matrix digest — the record's one legal subject (R1). */
+    readonly matrixSha256: string;
+    /** The verified Report's author IRI. */
+    readonly reportAuthor: string;
+    /** Refuses with the verifier's own typed refusal, so this module raises no error class of its own
+     * at the call boundary and every path lands in the caller's issue shape. */
+    readonly refuse: (path: string, message: string) => never;
+}
+/**
+ * §7 steps 1–8: authenticate what the Report extension names.
+ *
+ * Step 9 (claim-id pairing) and step 10 (projection equality) live in `verify.ts` and
+ * `assertClaimConsistency` respectively, because both compare against documents this function is
+ * deliberately not handed — keeping this function a statement about the RECORD and its evidence.
+ */
+export declare function assertDisclosureSpecification(input: AssertDisclosureSpecificationInput): DisclosureSpecificationReport;

package/dist/profile/disclosure.js

@@ -0,0 +1,240 @@
+/**
+ * The disclosed closure's projection and check (disclosure-specification-record design §6.4, §6.6,
+ * §7; issue #2839).
+ *
+ * This module is **single-sourced, not mirrored**, exactly as `anchor-claims.ts` is: `@colophon-
+ * claims/core` already depends on this package, so the producer and the standalone verifier call
+ * ONE `deriveDisclosureSpecification`. The claim-consistency byte-compare then compares one
+ * function's output over two byte sets rather than two implementations' guesses.
+ *
+ * The one posture that matters more than any mechanism here (design R4):
+ *
+ *   **The verifier AUTHENTICATES measurements and CARRIES assertions.**
+ *
+ * A `measured-here` variable must cite records the bundle actually carries, under a role admissible
+ * for the citation. A `disclosed-by-publisher` variable is checked for internal well-formedness and
+ * for nothing else — no lookup, no fetch, no cross-check against the Matrix or the Report, no status
+ * upgrade or downgrade. An assertion that turns out to be false is a false assertion in a valid
+ * record; that is the correct outcome and the honest one, and a verifier that refused it would be
+ * claiming a power it does not have.
+ *
+ * What this check deliberately does NOT do (design §8, each one a thing a well-meaning implementer
+ * would add):
+ *
+ * - It does not reconcile against `Report.disclosures.perSubject[].pinning`. Those counts answer
+ *   "how well did each executed axis pin"; this record answers "which variables were executed at
+ *   all". Two surfaces restating one fact are two surfaces that can disagree.
+ * - It does not infer a status from the bundle. A bundle that plainly executed a judge model does
+ *   not license marking `judge-model` as `measured-here` if the record says otherwise.
+ * - It does not fetch anything, ever. A verifier that reached the network would make its own result
+ *   depend on when it ran.
+ * - It does not rank, score, compare, or aggregate. There is no disclosure-completeness score:
+ *   counting statuses would create a number publishers optimize against, and a six-of-six record
+ *   with six vague assertions would outscore a two-of-six record with two proofs.
+ */
+import { createHash } from "node:crypto";
+import { z } from "zod";
+import { DISCLOSURE_VARIABLE_KEYS, DisclosureVariablesSchema, MATRIX_RECORD_KIND, SIX_VARIABLE_DISCLOSURE_SPECIFICATION, parseDisclosureSpecification, } from "@jinn-network/benchmarking-records";
+/** The evidence-catalog role a disclosure-specification record carries, and the ONLY one it may
+ * carry: a record bearing this token together with any second role refuses (§7 step 1). */
+export const DISCLOSURE_SPECIFICATION_BUNDLE_ROLE = "disclosure-specification";
+/**
+ * §6.4's binding profile: which of this carrier's evidence roles satisfy which of the standard's two
+ * portable disclosure roles. Jinn-side mapping, deliberately NOT part of the portable record — the
+ * mapping from the standard's roles onto a specific carrier's record roles is the carrier's business.
+ *
+ * v1 deliberately does not narrow the admissible set per variable. Which record species fixes
+ * `judge-model` depends on the judge profile packet P0 is freezing, and encoding a guess here would
+ * put this module in P0's lane. Reserved as a v2 tightening once P0's record vocabulary merges.
+ */
+export const DISCLOSURE_ROLE_BINDING = {
+    "pinned-configuration": [
+        "task",
+        "item-bank",
+        "source-item",
+        "evaluation-spec",
+        "judge-instrument",
+        "runtime-selection",
+        "admission-manifest",
+    ],
+    "execution-observation": [
+        "run-pinning-evidence",
+        "solve-submission",
+        "solve-delivery",
+        "solve-output",
+        "evaluation-submission",
+        "evaluation-delivery",
+        "verdict",
+    ],
+};
+/**
+ * The claim section's own grammar, single-sourced from the record's schema so the section cannot
+ * describe a variable entry the record could not have carried. It is a second line of defense
+ * rather than the primary one: `assertClaimConsistency`'s whole-claim byte-compare against the
+ * rebuilt claim is what actually proves the section is this record's projection.
+ */
+export const ClaimDisclosureSectionSchema = z.strictObject({
+    recordSha256: z.string().regex(/^[a-f0-9]{64}$/u),
+    specification: z.literal(SIX_VARIABLE_DISCLOSURE_SPECIFICATION),
+    subjectSha256: z.string().regex(/^[a-f0-9]{64}$/u),
+    variables: DisclosureVariablesSchema,
+});
+export class DisclosureProjectionError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "DisclosureProjectionError";
+    }
+}
+function sha256Hex(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
+/**
+ * The one shared projection, called by BOTH the workspace producer and the standalone verifier.
+ *
+ * It carries only facts embedded in the record's own bytes, plus the record's digest — which is the
+ * digest of the very bytes handed in, never a separately supplied one. It exists at all so a reader
+ * of `claim-package.json` alone sees all six statuses without opening an evidence record, and so
+ * `assertClaimConsistency`'s existing whole-claim byte-compare covers the disclosure without a
+ * second bespoke comparison.
+ */
+export function deriveDisclosureSpecification(recordBytes) {
+    let record;
+    try {
+        record = parseDisclosureSpecification(recordBytes);
+    }
+    catch (cause) {
+        throw new DisclosureProjectionError(`disclosure-specification record is not a valid sealed record: ${cause instanceof Error ? cause.message : String(cause)}`);
+    }
+    return {
+        recordSha256: sha256Hex(recordBytes),
+        specification: record.specification,
+        subjectSha256: record.subject.digest.sha256,
+        // Verbatim, in the frozen key order. Building the object key by key rather than spreading
+        // `record.variables` is what makes the order a property of this function rather than of
+        // whatever order the record's own bytes happened to carry.
+        variables: Object.fromEntries(DISCLOSURE_VARIABLE_KEYS.map((key) => [key, record.variables[key]])),
+    };
+}
+/**
+ * §7 steps 1–8: authenticate what the Report extension names.
+ *
+ * Step 9 (claim-id pairing) and step 10 (projection equality) live in `verify.ts` and
+ * `assertClaimConsistency` respectively, because both compare against documents this function is
+ * deliberately not handed — keeping this function a statement about the RECORD and its evidence.
+ */
+export function assertDisclosureSpecification(input) {
+    // Explicitly annotated so TypeScript's control-flow analysis treats every call below as
+    // terminating; a destructured member with an inferred type does not narrow through `never`.
+    const refuse = input.refuse;
+    // ── Step 1: carrier binding, in exact one-to-one correspondence ─────────────────────────────
+    //
+    // The extension's digest must resolve to EXACTLY ONE catalog record — none and two both refuse —
+    // and that record's declared roles must be exactly the one disclosure role. Conversely any catalog
+    // record bearing the role that the extension does not name refuses: without the second direction,
+    // a second disclosure record could ride along with nothing checking it.
+    const bearers = [...input.catalogRoles]
+        .filter(([, roles]) => roles.has(DISCLOSURE_SPECIFICATION_BUNDLE_ROLE))
+        .map(([digest]) => digest);
+    if (bearers.length !== 1 || bearers[0] !== input.extensionDigestSha256) {
+        refuse("disclosure-specification", bearers.length === 0
+            ? "the Report names a disclosure-specification record that no evidence-catalog record carries"
+            : bearers.length > 1
+                ? "the evidence catalog carries more than one disclosure-specification record; the Report names exactly one"
+                : "the evidence catalog's disclosure-specification record is not the one the Report extension names");
+    }
+    const declared = input.catalogRoles.get(input.extensionDigestSha256);
+    if (declared === undefined || declared.size !== 1) {
+        refuse("disclosure-specification", "the disclosure-specification record must declare exactly that one role and no second");
+    }
+    // ── Step 2: exact bytes ────────────────────────────────────────────────────────────────────
+    //
+    // The digest equality with the catalog entry is already established upstream (the bundle walk
+    // recomputes every `records/<sha256>.bin`), so what is proved here is that those bytes parse
+    // strictly AND are the one exact canonical encoding of what they parse to.
+    const bytes = input.recordBytes.get(input.extensionDigestSha256);
+    if (bytes === undefined) {
+        refuse("disclosure-specification", "the bundle does not carry the disclosure-specification record it names");
+    }
+    const record = (() => {
+        try {
+            return parseDisclosureSpecification(bytes);
+        }
+        catch (cause) {
+            refuse(`records/${input.extensionDigestSha256}.bin`, `disclosure-specification record is invalid: ${cause instanceof Error ? cause.message : String(cause)}`);
+        }
+    })();
+    // ── Step 3: subject binding (R1) ───────────────────────────────────────────────────────────
+    //
+    // The Matrix rather than the Report, because the Report cannot name its own digest inside its own
+    // signed payload, and because the record must be sealable before the Report is (§5).
+    if (record.subject.kind !== MATRIX_RECORD_KIND) {
+        refuse("disclosure-specification", `the record's subject kind must be ${MATRIX_RECORD_KIND}`);
+    }
+    if (record.subject.digest.sha256 !== input.matrixSha256) {
+        refuse("disclosure-specification", "the record's subject digest is not this bundle's Matrix digest");
+    }
+    if (record.specification !== SIX_VARIABLE_DISCLOSURE_SPECIFICATION) {
+        refuse("disclosure-specification", `the record must claim ${SIX_VARIABLE_DISCLOSURE_SPECIFICATION}`);
+    }
+    // ── Step 4: author binding ─────────────────────────────────────────────────────────────────
+    //
+    // A disclosure record asserting under one identity inside a bundle signed by another is a carrier
+    // mismatch, not an extra fact.
+    if (record.author !== input.reportAuthor) {
+        refuse("disclosure-specification", "the record's author is not the bundle's verified Report author");
+    }
+    // ── Step 5: vocabulary completeness (R2) ───────────────────────────────────────────────────
+    //
+    // Structural via the strict object; restated so the refusal names the KEY rather than a schema
+    // path a reader would have to decode.
+    for (const key of DISCLOSURE_VARIABLE_KEYS) {
+        if (record.variables[key] === undefined) {
+            refuse("disclosure-specification", `the record does not state the variable "${key}"`);
+        }
+    }
+    for (const key of Object.keys(record.variables)) {
+        if (!DISCLOSURE_VARIABLE_KEYS.includes(key)) {
+            refuse("disclosure-specification", `the record states an unknown variable "${key}"; the six-variable set is closed`);
+        }
+    }
+    // ── Steps 6–8: authenticate measurements, carry assertions, and let undisclosed carry nothing ─
+    const statuses = {};
+    for (const key of DISCLOSURE_VARIABLE_KEYS) {
+        const entry = record.variables[key];
+        statuses[key] = entry.status;
+        if (entry.status === "measured-here") {
+            // Step 6. THE WHOLE SUBSTANCE of "variables the venue actually ran must match actual pinning
+            // evidence in the bundle": no measured-here variable may cite a record the bundle does not
+            // carry, and a citation resolving to bytes of the wrong species is as bad as a dangling one.
+            for (const citation of entry.evidence) {
+                const cited = input.catalogRoles.get(citation.digest.sha256);
+                if (cited === undefined) {
+                    refuse("disclosure-specification", `"${key}" is measured here but cites ${citation.digest.sha256}, which this bundle does not carry`);
+                }
+                const citedRoles = cited;
+                const admissible = DISCLOSURE_ROLE_BINDING[citation.role];
+                if (!admissible.some((role) => citedRoles.has(role))) {
+                    refuse("disclosure-specification", `"${key}" cites ${citation.digest.sha256} as ${citation.role}, but that record's bundle roles are`
+                        + ` outside the admissible set for it`);
+                }
+            }
+            continue;
+        }
+        if (entry.status === "disclosed-by-publisher") {
+            // Step 7. Internal consistency ONLY. The schema has already established the statement bound
+            // and the sorted, unique, absolute-IRI source list; there is nothing further to check here and
+            // — R4 — nothing further this verifier is entitled to check. Restated as a branch so a later
+            // reader sees the deliberate emptiness rather than an omission.
+            continue;
+        }
+        // Step 8. Structural via the union; restated so the refusal would name the variable. Reaching
+        // this branch at all means the entry is `undisclosed`, which by construction carries a reason
+        // token and nothing else.
+    }
+    return {
+        recordSha256: input.extensionDigestSha256,
+        specification: record.specification,
+        subjectSha256: record.subject.digest.sha256,
+        statuses: statuses,
+    };
+}

package/dist/profile/pinning-evidence.d.ts

@@ -16,8 +16,8 @@ export declare const RunPinningEvidenceSchema: z.ZodObject<{
     }, z.core.$strict>>;
     observations: z.ZodOptional<z.ZodArray<z.ZodObject<{
         axis: z.ZodEnum<{
-            harness: "harness";
             model: "model";
+            harness: "harness";
             loadout: "loadout";
             isolation: "isolation";
         }>;

package/dist/profile/run-results.d.ts

@@ -1,10 +1,16 @@
 import type { MatrixCell, RunRecord } from "@jinn-network/benchmarking-records";
 import { type ClaimAnchor } from "./anchor-claims.js";
+import type { VerifiedRunBinding } from "../binding/beacon-binding.js";
 export declare const LOCAL_VENUE_LIMITS: readonly string[];
 export declare function localVenueLimitsForRun(run: Pick<RunRecord, "policy">): readonly string[];
 /** `anchors` is the same derived section the producer used (anchor-evidence §7.4); the conditional
- * copy is the same pure function on both sides, so claim-consistency stays an exact byte-compare. */
-export declare function buildLocalVenueHonesty(cells: readonly MatrixCell[], run: Pick<RunRecord, "policy">, anchors?: readonly ClaimAnchor[]): {
+ * copy is the same pure function on both sides, so claim-consistency stays an exact byte-compare.
+ *
+ * `binding` is the run's verified `beacon-binding/1` record (issue #2976) and obeys the same rule:
+ * omitting it is the identity, so every run that carries no binding keeps its exact limits bytes.
+ * It is only ever passed by a caller that can show BOTH sides the same binding — today that means
+ * it is not passed, because the public bundle carries no binding record yet. */
+export declare function buildLocalVenueHonesty(cells: readonly MatrixCell[], run: Pick<RunRecord, "policy">, anchors?: readonly ClaimAnchor[], binding?: VerifiedRunBinding): {
     venue: "self-run";
     preRegistration: "structural-and-append-order-only" | "structural-append-order-and-anchored-time";
     limits: readonly string[];

package/dist/profile/run-results.js

@@ -1,5 +1,6 @@
 import { venueIsolationPostureForPolicy } from "./isolation.js";
 import { anchoredPreRegistration, anchoredVenueLimits } from "./anchor-claims.js";
+import { runBoundVenueLimits } from "../binding/report-face.js";
 export const LOCAL_VENUE_LIMITS = [
     "This is a local, self-run venue: the same operator controls task dispatch, execution, and evaluation.",
     "Pre-registration here is a discipline enforced by this tool, not a proof against the run's own owner — nothing prevents the owner from having altered the record before publishing it.",
@@ -12,12 +13,17 @@ export function localVenueLimitsForRun(run) {
     return venueIsolationPostureForPolicy(run.policy.submissionBaseline?.isolationPolicy).inventory.length === 1 ? LOCAL_VENUE_LIMITS : [LOCAL_VENUE_LIMITS[0], LOCAL_VENUE_LIMITS[1], MULTI, ...LOCAL_VENUE_LIMITS.slice(3)];
 }
 /** `anchors` is the same derived section the producer used (anchor-evidence §7.4); the conditional
- * copy is the same pure function on both sides, so claim-consistency stays an exact byte-compare. */
-export function buildLocalVenueHonesty(cells, run, anchors = []) {
+ * copy is the same pure function on both sides, so claim-consistency stays an exact byte-compare.
+ *
+ * `binding` is the run's verified `beacon-binding/1` record (issue #2976) and obeys the same rule:
+ * omitting it is the identity, so every run that carries no binding keeps its exact limits bytes.
+ * It is only ever passed by a caller that can show BOTH sides the same binding — today that means
+ * it is not passed, because the public bundle carries no binding record yet. */
+export function buildLocalVenueHonesty(cells, run, anchors = [], binding) {
     const counts = { harness: 0, model: 0, loadout: 0, isolation: 0 };
     for (const cell of cells)
         for (const axis of Object.keys(counts))
             if (cell.verification[axis] === "unverifiable")
                 counts[axis] += 1;
-    return { venue: "self-run", preRegistration: anchoredPreRegistration(anchors), limits: anchoredVenueLimits(localVenueLimitsForRun(run), anchors), unverifiableAxisCounts: counts };
+    return { venue: "self-run", preRegistration: anchoredPreRegistration(anchors), limits: runBoundVenueLimits(anchoredVenueLimits(localVenueLimitsForRun(run), anchors), binding), unverifiableAxisCounts: counts };
 }

package/dist/profile/task-selection.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Task-selection provenance, verified against the records that carry it (issue #2980).
+ *
+ * The declaration is a closed-vocabulary value sealed into the Run record's
+ * `task-selection/v1` extension. Sealing makes it unforgeable after the lock; it does not make it
+ * true. What remains for a cold verifier is the part sealing cannot settle: whether the *other*
+ * sealed records are consistent with what the declaration asserts.
+ *
+ * In this record model the *selection is the Benchmark record itself*: the Run seals a Benchmark
+ * digest, and `expectedCellSet` is the full cartesian product `items x arms x replicates`, so the
+ * Matrix always covers every Benchmark item exactly. Comparing the Matrix's task digests against
+ * the Benchmark's items — the first thing this module tried — is therefore dead code. What is left
+ * is the Benchmark's own reveal policy and whether anyone declared the set at all.
+ *
+ * These checks are refusals, not endorsements, and the asymmetry is the point: each one names a
+ * declaration the records positively contradict. None of them can establish that a declaration is
+ * TRUE, because the bundle carries no independent witness of an upstream set. `assertTaskSelection-
+ * Consistency` below says exactly where that boundary falls and why the tempting rule on the other
+ * side of it is unsound.
+ */
+import { type BenchmarkRecord, type RunRecord, type TaskSelectionMode } from "@jinn-network/benchmarking-records";
+export interface TaskSelectionConsistencyInput {
+    readonly benchmarkRecord: BenchmarkRecord;
+    readonly runRecord: RunRecord;
+}
+/**
+ * The declared mode, refusing rather than throwing raw on bytes the Run schema would not have
+ * sealed. Exported so any reader that resolves the mode does so through this refusal posture
+ * rather than re-deriving it with its own error handling. No presentation asset consumes it today
+ * -- the report face renders nothing for task selection until issue #3416 -- so its only callers
+ * are `taskSelectionContradiction` below and its own tests.
+ */
+export declare function declaredTaskSelectionMode(runRecord: RunRecord): TaskSelectionMode | undefined;
+/**
+ * The way the sealed records contradict a declared task-selection mode, or `undefined` when they
+ * do not. Pure, and shared deliberately: the producer calls it BEFORE the lock so a contradiction
+ * is a draft-validation refusal the claimant can still act on, and the cold verifier calls it after
+ * the fact through {@link assertTaskSelectionConsistency}. One rule, two postures — a second copy
+ * would be free to drift into refusing at publish what it accepted at lock, which is the worst
+ * possible place to disagree.
+ *
+ * Two contradictions, both provable from bundle bytes:
+ *
+ * 1. **`fixed-public-set` over an undeclared set.** A set nobody declared is not a publicly
+ *    declared set, so the Benchmark record must at least name an `author`.
+ * 2. **Reveal policy that cannot coexist with the mode.** `fixed-public-set` is refused when the
+ *    items were provably withheld at the lock; `drawn-post-lock` is refused when they were
+ *    `immediate` — open the moment the record existed, so the Run sealed against a set the
+ *    claimant could already read, and nothing was drawn afterwards.
+ *
+ * What this deliberately does NOT do is decide the stronger modes from `benchmark.author` versus
+ * `run.owner`. That rule looks decisive and is not: `author` is a self-declaration the design spec
+ * marks non-authoritative, and every task-set intake in this product re-authors the Benchmark under
+ * the workspace's own key (`intake/workspace-authored.ts`), which is also the Run's owner. Enforcing
+ * on it would refuse every bundle this product can produce, making two of the three vocabulary
+ * values dead letters.
+ *
+ * So the honest boundary: these checks catch declarations the records positively contradict, but
+ * none can prove a `fixed-public-set` claim TRUE — the bundle carries no independent witness of the
+ * upstream set. `PUBLIC-BUNDLE.md` says so in the same words, because a gap a reader can see is
+ * worth more than one a rule pretends to close.
+ *
+ * `claimant-chosen` is unconstrained on purpose. It asserts nothing about anyone but the claimant,
+ * so nothing can contradict it, and constraining it would only make the honest answer the
+ * expensive one.
+ */
+export declare function taskSelectionContradiction(input: TaskSelectionConsistencyInput): string | undefined;
+/** The cold verifier's posture over {@link taskSelectionContradiction}: a typed record refusal. */
+export declare function assertTaskSelectionConsistency(input: TaskSelectionConsistencyInput): void;