@colophon-claims/verify 0.1.0 → 0.2.1

package/dist/profile/task-selection.js

@@ -0,0 +1,140 @@
+/**
+ * Task-selection provenance, verified against the records that carry it (issue #2980).
+ *
+ * The declaration is a closed-vocabulary value sealed into the Run record's
+ * `task-selection/v1` extension. Sealing makes it unforgeable after the lock; it does not make it
+ * true. What remains for a cold verifier is the part sealing cannot settle: whether the *other*
+ * sealed records are consistent with what the declaration asserts.
+ *
+ * In this record model the *selection is the Benchmark record itself*: the Run seals a Benchmark
+ * digest, and `expectedCellSet` is the full cartesian product `items x arms x replicates`, so the
+ * Matrix always covers every Benchmark item exactly. Comparing the Matrix's task digests against
+ * the Benchmark's items — the first thing this module tried — is therefore dead code. What is left
+ * is the Benchmark's own reveal policy and whether anyone declared the set at all.
+ *
+ * These checks are refusals, not endorsements, and the asymmetry is the point: each one names a
+ * declaration the records positively contradict. None of them can establish that a declaration is
+ * TRUE, because the bundle carries no independent witness of an upstream set. `assertTaskSelection-
+ * Consistency` below says exactly where that boundary falls and why the tempting rule on the other
+ * side of it is unsound.
+ */
+import { compareCalendarStrictRfc3339Instants, readTaskSelectionMode, } from "@jinn-network/benchmarking-records";
+import { refuse } from "./errors.js";
+/** The verification path every refusal here is reported under. Adding a new named check would be a
+ * bundle-format bump — the claim pins the check list byte-for-byte — so these refusals join the
+ * existing `claim-consistency` check, which is exactly the question they answer. */
+const PATH = "claim-consistency";
+/**
+ * Whether the Benchmark's items were PROVABLY still withheld when the Run sealed against them.
+ *
+ * Deliberately one-directional, and the reason is a real trap. The only instant a cold verifier
+ * can read out of a sealed Run is `closeAt`, which is the run's CLOSE, not its lock —
+ * `closeAt = lockedAt + policy.closeAfterMs` with a strictly positive interval (24h by default),
+ * and `lockedAt` lives only in product-local state that no bundle carries. So `notBefore <= closeAt`
+ * establishes nothing about the lock: a schedule opening twelve hours into a twenty-four-hour run
+ * satisfies it while the items were plainly withheld at the lock. Only the far side is safe —
+ * `notBefore >= closeAt > lockedAt` proves withholding — so that is the only comparison made.
+ *
+ * The comparator is the records package's own, not `Date.parse`, and that is a correctness
+ * requirement rather than a preference. These fields are validated by `isCalendarStrictRfc3339`,
+ * which accepts leap seconds; V8's `Date.parse` returns `NaN` for exactly those spellings, and
+ * `NaN >= x` is `false`. Left on `Date.parse`, a claimant could seal
+ * `notBefore: "2026-12-31T23:59:60Z"` — items withheld past the run's end — declare
+ * `fixed-public-set`, and have both this check and the producer's pre-lock gate wave it through.
+ * An uncomparable pair fails CLOSED for the same reason: it cannot arise from schema-valid records,
+ * so treating it as proof of withholding costs nothing and removes the fail-open shape entirely.
+ *
+ * A `scheduled` reveal with no `notBefore` fails closed on the same principle. The Benchmark schema
+ * leaves `notBefore` optional under every policy, so `{ "policy": "scheduled" }` seals cleanly while
+ * announcing no instant at which the items become readable — strictly more withheld than
+ * `after-run`, which at least names the run's end. Reading it as open would hand a claimant a
+ * one-key evasion of the only reveal-policy teeth `fixed-public-set` has: delete the field, and a
+ * privately assembled set passes the check that `after-run` fails.
+ */
+function withheldAtLock(benchmark, closeAt) {
+    const { policy, notBefore } = benchmark.reveal;
+    if (policy === "after-run")
+        return true;
+    if (policy !== "scheduled")
+        return false;
+    if (notBefore === undefined)
+        return true;
+    const order = compareCalendarStrictRfc3339Instants(notBefore, closeAt);
+    return order === undefined || order >= 0;
+}
+/**
+ * The declared mode, refusing rather than throwing raw on bytes the Run schema would not have
+ * sealed. Exported so any reader that resolves the mode does so through this refusal posture
+ * rather than re-deriving it with its own error handling. No presentation asset consumes it today
+ * -- the report face renders nothing for task selection until issue #3416 -- so its only callers
+ * are `taskSelectionContradiction` below and its own tests.
+ */
+export function declaredTaskSelectionMode(runRecord) {
+    try {
+        return readTaskSelectionMode(runRecord);
+    }
+    catch (cause) {
+        refuse("record-integrity", PATH, `the Run's declared task selection is not one of the recorded selection modes: ${cause instanceof Error ? cause.message : String(cause)}`);
+    }
+}
+/**
+ * The way the sealed records contradict a declared task-selection mode, or `undefined` when they
+ * do not. Pure, and shared deliberately: the producer calls it BEFORE the lock so a contradiction
+ * is a draft-validation refusal the claimant can still act on, and the cold verifier calls it after
+ * the fact through {@link assertTaskSelectionConsistency}. One rule, two postures — a second copy
+ * would be free to drift into refusing at publish what it accepted at lock, which is the worst
+ * possible place to disagree.
+ *
+ * Two contradictions, both provable from bundle bytes:
+ *
+ * 1. **`fixed-public-set` over an undeclared set.** A set nobody declared is not a publicly
+ *    declared set, so the Benchmark record must at least name an `author`.
+ * 2. **Reveal policy that cannot coexist with the mode.** `fixed-public-set` is refused when the
+ *    items were provably withheld at the lock; `drawn-post-lock` is refused when they were
+ *    `immediate` — open the moment the record existed, so the Run sealed against a set the
+ *    claimant could already read, and nothing was drawn afterwards.
+ *
+ * What this deliberately does NOT do is decide the stronger modes from `benchmark.author` versus
+ * `run.owner`. That rule looks decisive and is not: `author` is a self-declaration the design spec
+ * marks non-authoritative, and every task-set intake in this product re-authors the Benchmark under
+ * the workspace's own key (`intake/workspace-authored.ts`), which is also the Run's owner. Enforcing
+ * on it would refuse every bundle this product can produce, making two of the three vocabulary
+ * values dead letters.
+ *
+ * So the honest boundary: these checks catch declarations the records positively contradict, but
+ * none can prove a `fixed-public-set` claim TRUE — the bundle carries no independent witness of the
+ * upstream set. `PUBLIC-BUNDLE.md` says so in the same words, because a gap a reader can see is
+ * worth more than one a rule pretends to close.
+ *
+ * `claimant-chosen` is unconstrained on purpose. It asserts nothing about anyone but the claimant,
+ * so nothing can contradict it, and constraining it would only make the honest answer the
+ * expensive one.
+ */
+export function taskSelectionContradiction(input) {
+    const { benchmarkRecord, runRecord } = input;
+    const declared = declaredTaskSelectionMode(runRecord);
+    if (declared === undefined || declared === "claimant-chosen")
+        return undefined;
+    if (declared === "fixed-public-set") {
+        if (benchmarkRecord.author === undefined) {
+            return "task selection is declared fixed-public-set but the Benchmark record names no author,"
+                + " so the set it describes was never publicly declared by anyone";
+        }
+        if (withheldAtLock(benchmarkRecord, runRecord.closeAt)) {
+            return "task selection is declared fixed-public-set but the Benchmark's reveal policy withholds"
+                + " its items past the end of the run, so they were not public when the run was locked";
+        }
+        return undefined;
+    }
+    if (benchmarkRecord.reveal.policy === "immediate") {
+        return "task selection is declared drawn-post-lock but the Benchmark reveals its items"
+            + " immediately, so the run was locked against a set the claimant could already read";
+    }
+    return undefined;
+}
+/** The cold verifier's posture over {@link taskSelectionContradiction}: a typed record refusal. */
+export function assertTaskSelectionConsistency(input) {
+    const contradiction = taskSelectionContradiction(input);
+    if (contradiction !== undefined)
+        refuse("record-integrity", PATH, contradiction);
+}

package/dist/reader-instructions.d.ts

@@ -20,7 +20,36 @@ export declare const PUBLIC_BUNDLE_V6_COMPATIBLE_VERIFICATION_COMMAND: "npx @col
  * `EVIDENCE_NATIVE_BUNDLE_V5_CHECKS`.
  */
 export declare const PUBLIC_BUNDLE_V6_CHECKS: readonly ["manifest", "evidence-closure", "trust", "matrix-rederivation", "report-verification", "claim-consistency", "integrity-anchors"];
-/** Every current format stamps the same first public 0.1 line. */
+/**
+ * The anchored binary-qualification closure runs exactly the anchored list (issue #3205): the
+ * qualification projection changes what `evidence-closure` and `claim-consistency` examine, not
+ * which checks run.
+ */
+export declare const PUBLIC_BUNDLE_V7_CHECKS: readonly ["manifest", "evidence-closure", "trust", "matrix-rederivation", "report-verification", "claim-consistency", "integrity-anchors"];
+/**
+ * Unlike every earlier closure, this one does NOT stamp the first public 0.1 line: no released
+ * verifier before 0.2.1 understands `benchmark-product-public-bundle/7`, and a claim naming a
+ * reader that cannot read it would be an instruction to fail. 0.2.1 is also the line that carries
+ * the prompted-screening admission surface a binary claim may need.
+ */
+export declare const PUBLIC_BUNDLE_V7_VERIFICATION_COMMAND: "npx @colophon-claims/verify@0.2.1 <bundle-dir>";
+export declare const PUBLIC_BUNDLE_V7_COMPATIBLE_VERIFICATION_COMMAND: "npx @colophon-claims/verify@0.2 <bundle-dir>";
+/**
+ * The disclosed closure's check list (disclosure-specification-record design §7, issue #2839): v7's
+ * seven plus `disclosure-specification`, **last**. It runs after `claim-consistency` because the
+ * claim's `disclosure` section is among the things it compares, and it is **always present** on this
+ * format — a disclosed bundle whose record was stripped is a closure failure, not a shorter list.
+ */
+export declare const PUBLIC_BUNDLE_V8_CHECKS: readonly ["manifest", "evidence-closure", "trust", "matrix-rederivation", "report-verification", "claim-consistency", "integrity-anchors", "disclosure-specification"];
+/**
+ * Like v7 and for the same reason: no released reader before 0.2.1 understands
+ * `benchmark-product-public-bundle/8`, and a claim naming a reader that cannot read it would be an
+ * instruction to fail. The disclosed closure ships in the same unpublished 0.2.1 line as v7, so it
+ * pins that line rather than minting a third.
+ */
+export declare const PUBLIC_BUNDLE_V8_VERIFICATION_COMMAND: "npx @colophon-claims/verify@0.2.1 <bundle-dir>";
+export declare const PUBLIC_BUNDLE_V8_COMPATIBLE_VERIFICATION_COMMAND: "npx @colophon-claims/verify@0.2 <bundle-dir>";
+/** Every format through v6 stamps the same first public 0.1 line; v7 is the first that cannot. */
 export declare const PUBLIC_BUNDLE_VERIFICATION_INSTRUCTIONS: {
     readonly "benchmark-product-public-bundle/2": {
         readonly command: "npx @colophon-claims/verify@0.1.0 <bundle-dir>";
@@ -38,4 +67,12 @@ export declare const PUBLIC_BUNDLE_VERIFICATION_INSTRUCTIONS: {
         readonly command: "npx @colophon-claims/verify@0.1.0 <bundle-dir>";
         readonly compatibleCommand: "npx @colophon-claims/verify@0.1 <bundle-dir>";
     };
+    readonly "benchmark-product-public-bundle/7": {
+        readonly command: "npx @colophon-claims/verify@0.2.1 <bundle-dir>";
+        readonly compatibleCommand: "npx @colophon-claims/verify@0.2 <bundle-dir>";
+    };
+    readonly "benchmark-product-public-bundle/8": {
+        readonly command: "npx @colophon-claims/verify@0.2.1 <bundle-dir>";
+        readonly compatibleCommand: "npx @colophon-claims/verify@0.2 <bundle-dir>";
+    };
 };

package/dist/reader-instructions.js

@@ -30,7 +30,39 @@ export const PUBLIC_BUNDLE_V6_CHECKS = [
     ...PUBLIC_BUNDLE_VERIFICATION_CHECKS,
     "integrity-anchors",
 ];
-/** Every current format stamps the same first public 0.1 line. */
+/**
+ * The anchored binary-qualification closure runs exactly the anchored list (issue #3205): the
+ * qualification projection changes what `evidence-closure` and `claim-consistency` examine, not
+ * which checks run.
+ */
+export const PUBLIC_BUNDLE_V7_CHECKS = PUBLIC_BUNDLE_V6_CHECKS;
+/**
+ * Unlike every earlier closure, this one does NOT stamp the first public 0.1 line: no released
+ * verifier before 0.2.1 understands `benchmark-product-public-bundle/7`, and a claim naming a
+ * reader that cannot read it would be an instruction to fail. 0.2.1 is also the line that carries
+ * the prompted-screening admission surface a binary claim may need.
+ */
+export const PUBLIC_BUNDLE_V7_VERIFICATION_COMMAND = "npx @colophon-claims/verify@0.2.1 <bundle-dir>";
+export const PUBLIC_BUNDLE_V7_COMPATIBLE_VERIFICATION_COMMAND = "npx @colophon-claims/verify@0.2 <bundle-dir>";
+/**
+ * The disclosed closure's check list (disclosure-specification-record design §7, issue #2839): v7's
+ * seven plus `disclosure-specification`, **last**. It runs after `claim-consistency` because the
+ * claim's `disclosure` section is among the things it compares, and it is **always present** on this
+ * format — a disclosed bundle whose record was stripped is a closure failure, not a shorter list.
+ */
+export const PUBLIC_BUNDLE_V8_CHECKS = [
+    ...PUBLIC_BUNDLE_V7_CHECKS,
+    "disclosure-specification",
+];
+/**
+ * Like v7 and for the same reason: no released reader before 0.2.1 understands
+ * `benchmark-product-public-bundle/8`, and a claim naming a reader that cannot read it would be an
+ * instruction to fail. The disclosed closure ships in the same unpublished 0.2.1 line as v7, so it
+ * pins that line rather than minting a third.
+ */
+export const PUBLIC_BUNDLE_V8_VERIFICATION_COMMAND = PUBLIC_BUNDLE_V7_VERIFICATION_COMMAND;
+export const PUBLIC_BUNDLE_V8_COMPATIBLE_VERIFICATION_COMMAND = PUBLIC_BUNDLE_V7_COMPATIBLE_VERIFICATION_COMMAND;
+/** Every format through v6 stamps the same first public 0.1 line; v7 is the first that cannot. */
 export const PUBLIC_BUNDLE_VERIFICATION_INSTRUCTIONS = {
     [BUNDLE_FORMAT]: {
         command: PUBLIC_BUNDLE_VERIFICATION_COMMAND,
@@ -48,5 +80,13 @@ export const PUBLIC_BUNDLE_VERIFICATION_INSTRUCTIONS = {
         command: PUBLIC_BUNDLE_V6_VERIFICATION_COMMAND,
         compatibleCommand: PUBLIC_BUNDLE_V6_COMPATIBLE_VERIFICATION_COMMAND,
     },
+    [BUNDLE_V7_FORMAT]: {
+        command: PUBLIC_BUNDLE_V7_VERIFICATION_COMMAND,
+        compatibleCommand: PUBLIC_BUNDLE_V7_COMPATIBLE_VERIFICATION_COMMAND,
+    },
+    [BUNDLE_V8_FORMAT]: {
+        command: PUBLIC_BUNDLE_V8_VERIFICATION_COMMAND,
+        compatibleCommand: PUBLIC_BUNDLE_V8_COMPATIBLE_VERIFICATION_COMMAND,
+    },
 };
-import { BUNDLE_FORMAT, BUNDLE_V4_FORMAT, BUNDLE_V5_FORMAT, BUNDLE_V6_FORMAT } from "./manifest.js";
+import { BUNDLE_FORMAT, BUNDLE_V4_FORMAT, BUNDLE_V5_FORMAT, BUNDLE_V6_FORMAT, BUNDLE_V7_FORMAT, BUNDLE_V8_FORMAT, } from "./manifest.js";

package/dist/schema.d.ts

@@ -6,9 +6,9 @@ export declare const BUNDLE_ASSEMBLY_FORMAT: "benchmark-product-assembly/2";
 export declare const BUNDLE_V4_TRUST_FORMAT: "benchmark-product-public-trust/4";
 export declare const BUNDLE_V4_EVIDENCE_FORMAT: "benchmark-product-evidence-catalog/4";
 export declare const BUNDLE_QUALIFICATION_FORMAT: "benchmark-product-binary-qualification/1";
-export declare const BUNDLE_V4_EVIDENCE_ROLES: readonly ["task", "runtime-selection", "evaluation-spec", "admission-receipt", "solve-submission", "run-pinning-evidence", "evaluation-submission", "solve-delivery", "solve-output", "evaluation-task", "evaluation-delivery", "verdict", "item-bank", "source-manifest", "admission-index", "admission-manifest", "replacement-ledger", "source-item", "judge-instrument", "analysis-context", "label-resolution", "human-review-evaluation-spec", "human-review-form", "human-review-packet", "human-review-response", "human-review-verdict", "reviewer-roster", "review-visibility-receipt", "review-reveal-receipt", "operator-assertion", "snapshot-probe", "screening-table", "screening-reveal-receipt", "screening-instrument", "screening-sampling-script", "screening-raw-outputs"];
+export declare const BUNDLE_V4_EVIDENCE_ROLES: readonly ["task", "runtime-selection", "evaluation-spec", "admission-receipt", "solve-submission", "run-pinning-evidence", "evaluation-submission", "solve-delivery", "solve-output", "evaluation-task", "evaluation-delivery", "verdict", "item-bank", "source-manifest", "admission-index", "admission-manifest", "replacement-ledger", "source-item", "judge-instrument", "analysis-context", "label-resolution", "human-review-evaluation-spec", "human-review-form", "human-review-packet", "human-review-response", "human-review-verdict", "reviewer-roster", "review-visibility-receipt", "review-reveal-receipt", "operator-assertion", "snapshot-probe", "screening-table", "screening-reveal-receipt", "screening-instrument", "screening-sampling-script", "screening-raw-outputs", "screening-prompt", "screening-procedure", "screening-pool", "screening-sample-commitment", "screening-transcript", "disclosure-specification"];
 export type BundleV4EvidenceRole = (typeof BUNDLE_V4_EVIDENCE_ROLES)[number];
-export declare const BUNDLE_V4_ADMISSION_EVIDENCE_ROLES: readonly ["admission-manifest", "replacement-ledger", "source-item", "label-resolution", "analysis-context", "human-review-evaluation-spec", "human-review-form", "human-review-packet", "human-review-response", "human-review-verdict", "reviewer-roster", "review-visibility-receipt", "review-reveal-receipt", "operator-assertion", "screening-table", "screening-reveal-receipt", "screening-instrument", "screening-sampling-script", "screening-raw-outputs"];
+export declare const BUNDLE_V4_ADMISSION_EVIDENCE_ROLES: readonly ["admission-manifest", "replacement-ledger", "source-item", "label-resolution", "analysis-context", "human-review-evaluation-spec", "human-review-form", "human-review-packet", "human-review-response", "human-review-verdict", "reviewer-roster", "review-visibility-receipt", "review-reveal-receipt", "operator-assertion", "screening-table", "screening-reveal-receipt", "screening-instrument", "screening-sampling-script", "screening-raw-outputs", "screening-prompt", "screening-procedure", "screening-pool", "screening-sample-commitment", "screening-transcript"];
 export declare const BundleTrustSchema: z.ZodObject<{
     format: z.ZodLiteral<"benchmark-product-public-trust/2">;
     selfRun: z.ZodObject<{
@@ -100,6 +100,7 @@ export declare const BundleV4EvidenceCatalogSchema: z.ZodObject<{
     records: z.ZodArray<z.ZodObject<{
         sha256: z.ZodString;
         roles: z.ZodArray<z.ZodEnum<{
+            "disclosure-specification": "disclosure-specification";
             task: "task";
             "runtime-selection": "runtime-selection";
             "evaluation-spec": "evaluation-spec";
@@ -136,6 +137,11 @@ export declare const BundleV4EvidenceCatalogSchema: z.ZodObject<{
             "screening-instrument": "screening-instrument";
             "screening-sampling-script": "screening-sampling-script";
             "screening-raw-outputs": "screening-raw-outputs";
+            "screening-prompt": "screening-prompt";
+            "screening-procedure": "screening-procedure";
+            "screening-pool": "screening-pool";
+            "screening-sample-commitment": "screening-sample-commitment";
+            "screening-transcript": "screening-transcript";
         }>>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
@@ -197,6 +203,11 @@ export declare const BundleQualificationSchema: z.ZodObject<{
             "screening-instrument": "screening-instrument";
             "screening-sampling-script": "screening-sampling-script";
             "screening-raw-outputs": "screening-raw-outputs";
+            "screening-prompt": "screening-prompt";
+            "screening-procedure": "screening-procedure";
+            "screening-pool": "screening-pool";
+            "screening-sample-commitment": "screening-sample-commitment";
+            "screening-transcript": "screening-transcript";
         }>>;
     }, z.core.$strict>>;
     reachableSha256s: z.ZodArray<z.ZodString>;

package/dist/schema.js

@@ -52,6 +52,22 @@ export const BUNDLE_V4_EVIDENCE_ROLES = [
     "screening-instrument",
     "screening-sampling-script",
     "screening-raw-outputs",
+    "screening-prompt",
+    "screening-procedure",
+    "screening-pool",
+    "screening-sample-commitment",
+    "screening-transcript",
+    // Appended at the very end (disclosure-specification-record design §6.2, issue #2839). Appending
+    // is the ONLY additive move available here: this array's index order is the frozen role-ordering
+    // map used by both the catalog schema's ordering refinement and the bundle writer, so inserting
+    // anywhere earlier would re-order existing bundles' role arrays and move their bytes. The /2
+    // catalog is a SEPARATE constant (`BUNDLE_EVIDENCE_ROLES` below) and is untouched by this append.
+    //
+    // The token is admitted on every v4-graph closure, because the enum is one shared constant and
+    // there is no per-closure role vocabulary. What keeps a disclosure record off an earlier closure
+    // is that nothing DERIVES the role there: off `/8` the Report extension is never read, so the
+    // evidence closure's own size and per-digest guards refuse the record as unreachable (§6.5.2).
+    "disclosure-specification",
 ];
 export const BUNDLE_V4_ADMISSION_EVIDENCE_ROLES = [
     "admission-manifest", "replacement-ledger", "source-item", "label-resolution",
@@ -68,6 +84,11 @@ export const BUNDLE_V4_ADMISSION_EVIDENCE_ROLES = [
     "screening-instrument",
     "screening-sampling-script",
     "screening-raw-outputs",
+    "screening-prompt",
+    "screening-procedure",
+    "screening-pool",
+    "screening-sample-commitment",
+    "screening-transcript",
 ];
 const PublicKeySchema = z.object({
     keyId: z.string().min(1),
@@ -205,6 +226,12 @@ const PrefixedSha256Schema = z.string().regex(/^sha256:[a-f0-9]{64}$/u);
 const IDENTIFIER_NAME = /^[A-Za-z][A-Za-z0-9._-]{0,63}$/u;
 export const BundleQualificationSchema = z.strictObject({
     format: z.literal(BUNDLE_QUALIFICATION_FORMAT),
+    // Deliberately NOT widened when a later closure allocates a new claim id (issue #3205's
+    // claim-package/5; the same resolution the disclosure-record design reached in its §6.5.1).
+    // This field names WHICH CLAIM PROJECTION SHAPE the qualification graph was built for, and the
+    // anchors section changes nothing about that graph: the qualification projection under /5 is
+    // byte-identical to the one under /2. Widening the literal would make this schema co-vary with
+    // an unrelated section, and would need widening again for every future closure.
     claimSchema: z.literal("benchmark-product.claim-package/2"),
     sourceManifestSha256: PrefixedSha256Schema,
     admissionManifestSha256: PrefixedSha256Schema,
@@ -317,12 +344,11 @@ export const BundleQualificationSchema = z.strictObject({
         "human-review-packet", "human-review-response", "human-review-verdict", "reviewer-roster",
         "review-visibility-receipt", "review-reveal-receipt",
     ];
-    const screeningEvidenceRoles = [
-        "screening-table",
-        "screening-reveal-receipt",
-        "screening-instrument",
-        "screening-sampling-script",
-        "screening-raw-outputs",
+    const commonScreeningEvidenceRoles = ["screening-table", "screening-reveal-receipt", "screening-sampling-script"];
+    const legacyScreeningEvidenceRoles = ["screening-instrument", "screening-raw-outputs"];
+    const promptedScreeningEvidenceRoles = [
+        "screening-prompt", "screening-procedure", "screening-pool",
+        "screening-sample-commitment", "screening-transcript",
     ];
     if (qualification.truthAdmission === "two-human-unanimous") {
         if (humanEvidenceRoles.some((role) => (roleCounts.get(role) ?? 0) === 0)
@@ -340,10 +366,15 @@ export const BundleQualificationSchema = z.strictObject({
         // silently inheriting the screened one's evidence rules.
     }
     else if (qualification.truthAdmission === "screened-operator-sampled") {
-        if (screeningEvidenceRoles.some((role) => (roleCounts.get(role) ?? 0) !== 1)
+        const legacyRoleSet = legacyScreeningEvidenceRoles.every((role) => roleCounts.get(role) === 1)
+            && promptedScreeningEvidenceRoles.every((role) => roleCounts.get(role) === 0);
+        const promptedRoleSet = promptedScreeningEvidenceRoles.every((role) => roleCounts.get(role) === 1)
+            && legacyScreeningEvidenceRoles.every((role) => roleCounts.get(role) === 0);
+        if (commonScreeningEvidenceRoles.some((role) => (roleCounts.get(role) ?? 0) !== 1)
+            || (!legacyRoleSet && !promptedRoleSet)
             || humanEvidenceRoles.some((role) => (roleCounts.get(role) ?? 0) !== 0)
             || (roleCounts.get("operator-assertion") ?? 0) !== 0) {
-            ctx.addIssue({ code: "custom", path: ["admissionRecords"], message: "screened admission must carry exactly one of every screening record and no human-review evidence or operator assertion" });
+            ctx.addIssue({ code: "custom", path: ["admissionRecords"], message: "screened admission must carry exactly one complete legacy-v1 or prompted-v2 screening record set and no human-review evidence or operator assertion" });
         }
         const screeningInstrument = qualification.admissionRecords.find((entry) => (entry.roles.includes("screening-instrument")));
         if (screeningInstrument !== undefined

package/dist/signers.d.ts

@@ -0,0 +1,48 @@
+import type { BundleTrust, BundleV4Trust } from "./schema.js";
+/**
+ * Who signed, in reader terms. The bundle's own identifiers select signatures and join records,
+ * so they stay exact on the machine surface; the human surface is given the role instead
+ * (issue #3024).
+ */
+export type PublicBundleSignerRole = "publisher" | "automated-grader" | "human-reviewer" | "label-admission";
+export interface PublicBundleSigner {
+    readonly role: PublicBundleSignerRole;
+    /** The load-bearing signer identity, verbatim. Machine surface only. */
+    readonly identity: string;
+    /** The exact key the signature selection resolved to. Machine surface only. */
+    readonly keyId: string;
+    /**
+     * `same-operator` where the bundle itself declares that the key is workspace-minted under the
+     * publisher's own custody; `undeclared` where it makes no custody statement. Never a claim that
+     * a signer is an independent party -- no bundle format can establish that.
+     */
+    readonly custody: "same-operator" | "undeclared";
+}
+/**
+ * Signers of a v2/v4/v6/v7 bundle, read from its already-authenticated `trust/public-keys.json`
+ * and the Matrix verdict closure the `trust` check validated it against.
+ *
+ * Every group this returns is ground-truthed rather than merely declared: `trust.evaluators` is
+ * pinned to exactly the union of the Matrix-referenced evaluators and the admission reviewers, and
+ * each reviewer binding to the authenticated signed review closure. That union is why the two roles
+ * are read from the two sets separately -- an identity that both graded cells and signed reviews is
+ * in both, and classifying reviewer-first would print one fewer grader than actually graded. Both
+ * trust grammars pin `selfRun.custody: "workspace-minted"` and `partyIndependence:
+ * "not-established"`, so same-operator custody is a fact of the parsed record, not an inference.
+ *
+ * Admission authorities are deliberately absent: the v4 grammar pins every authority keyId to the
+ * report key, so listing them would count the publisher's one key twice under two headings.
+ */
+export declare function legacyBundleSigners(trust: BundleTrust | BundleV4Trust, verdictEvaluators: ReadonlySet<string>): readonly PublicBundleSigner[];
+/**
+ * Signers of a v5 evidence-native bundle, read from the same authenticated `claim-package.json`
+ * bytes the closure verified.
+ *
+ * `claim.trust.signers` is a publisher-written declaration used by the closure only as a lookup
+ * table: a surplus entry there is never contradicted, because no signature ever selects it. So this
+ * keeps only the keys that actually carried a signature the closure accepted
+ * (`verifiedSignerKeyIds`). Without that filter a bundle could declare a human reviewer, or a dozen
+ * graders, that signed nothing and have the checker print them as fact. The claim package declares
+ * no custody, so nothing here upgrades a signer to same-operator either.
+ */
+export declare function evidenceNativeBundleSigners(claimPackageBytes: Uint8Array, verifiedSignerKeyIds: readonly string[]): readonly PublicBundleSigner[];

package/dist/signers.js

@@ -0,0 +1,77 @@
+import { parseEvidenceNativeClaimPackageV3 } from "@jinn-network/benchmarking-protocol";
+function deduplicate(signers) {
+    const seen = new Set();
+    return signers.filter((signer) => {
+        const key = `${signer.role} ${signer.keyId}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+/**
+ * Signers of a v2/v4/v6/v7 bundle, read from its already-authenticated `trust/public-keys.json`
+ * and the Matrix verdict closure the `trust` check validated it against.
+ *
+ * Every group this returns is ground-truthed rather than merely declared: `trust.evaluators` is
+ * pinned to exactly the union of the Matrix-referenced evaluators and the admission reviewers, and
+ * each reviewer binding to the authenticated signed review closure. That union is why the two roles
+ * are read from the two sets separately -- an identity that both graded cells and signed reviews is
+ * in both, and classifying reviewer-first would print one fewer grader than actually graded. Both
+ * trust grammars pin `selfRun.custody: "workspace-minted"` and `partyIndependence:
+ * "not-established"`, so same-operator custody is a fact of the parsed record, not an inference.
+ *
+ * Admission authorities are deliberately absent: the v4 grammar pins every authority keyId to the
+ * report key, so listing them would count the publisher's one key twice under two headings.
+ */
+export function legacyBundleSigners(trust, verdictEvaluators) {
+    const reviewers = new Set("admission" in trust ? trust.admission.reviewers.map((entry) => entry.evaluator) : []);
+    return deduplicate([
+        { role: "publisher", identity: trust.report.author, keyId: trust.report.keyId, custody: "same-operator" },
+        ...trust.evaluators.flatMap((entry) => {
+            const roles = [];
+            // The trust set equals verdicts + reviewers, so "in neither" is unreachable; if a future
+            // widening makes it reachable, a signer must still be shown rather than silently dropped.
+            if (verdictEvaluators.has(entry.evaluator) || !reviewers.has(entry.evaluator))
+                roles.push("automated-grader");
+            if (reviewers.has(entry.evaluator))
+                roles.push("human-reviewer");
+            return roles.map((role) => ({
+                role,
+                identity: entry.evaluator,
+                keyId: entry.keyId,
+                custody: "same-operator",
+            }));
+        }),
+    ]);
+}
+// Keyed to the purpose union rather than to `string`, so a protocol widening is a build failure
+// here instead of an `undefined` role reaching the reader's screen.
+const EVIDENCE_NATIVE_PURPOSE_ROLES = {
+    report: "publisher",
+    "automated-evaluator": "automated-grader",
+    "human-reviewer": "human-reviewer",
+    "label-admission": "label-admission",
+};
+/**
+ * Signers of a v5 evidence-native bundle, read from the same authenticated `claim-package.json`
+ * bytes the closure verified.
+ *
+ * `claim.trust.signers` is a publisher-written declaration used by the closure only as a lookup
+ * table: a surplus entry there is never contradicted, because no signature ever selects it. So this
+ * keeps only the keys that actually carried a signature the closure accepted
+ * (`verifiedSignerKeyIds`). Without that filter a bundle could declare a human reviewer, or a dozen
+ * graders, that signed nothing and have the checker print them as fact. The claim package declares
+ * no custody, so nothing here upgrades a signer to same-operator either.
+ */
+export function evidenceNativeBundleSigners(claimPackageBytes, verifiedSignerKeyIds) {
+    const verified = new Set(verifiedSignerKeyIds);
+    return deduplicate(parseEvidenceNativeClaimPackageV3(claimPackageBytes).trust.signers
+        .filter((signer) => verified.has(signer.keyId))
+        .map((signer) => ({
+        role: EVIDENCE_NATIVE_PURPOSE_ROLES[signer.purpose],
+        identity: signer.identity,
+        keyId: signer.keyId,
+        custody: "undeclared",
+    })));
+}

package/dist/verify.d.ts

@@ -1,15 +1,21 @@
 import { type EvidenceNativePortableBundleVerification } from "@jinn-network/benchmarking-evidence";
+import { type PublicBundleSigner } from "./signers.js";
 import { type InspectRuntimeMethodDisclosure } from "./profile/inspect-disclosure.js";
 import { type PublicComparisonView } from "./comparison.js";
 import { type VerifiedBundleSnapshot, type VerifyBundleSnapshotDeps } from "./manifest.js";
+import { type DisclosureSpecificationReport } from "./profile/disclosure.js";
 import { type IntegrityAnchorsReport, type PublicBundleAnchorTrustMaterial } from "./anchor/check.js";
 import { type BinaryItemBankEntry, type BinarySourceManifestEntry } from "./admission/intake.js";
 export type PublicBundleVerificationCheck = "manifest" | "evidence-closure" | "trust" | "matrix-rederivation" | "report-verification" | "claim-consistency"
-/** Always present for `benchmark-product-public-bundle/6`, never for any earlier closure
- * (anchor-evidence design §8, §12). */
- | "integrity-anchors";
-export interface LegacyPublicBundleVerificationResult {
-    readonly format: "benchmark-product-public-bundle/2" | "benchmark-product-public-bundle/4" | "benchmark-product-public-bundle/6";
+/** Always present for the anchored closures, `benchmark-product-public-bundle/6`, `/7`, and `/8`,
+ * never for any earlier one (anchor-evidence design §8, §12). */
+ | "integrity-anchors"
+/** Always present for `benchmark-product-public-bundle/8`, never for any earlier closure
+ * (disclosure-specification-record design §7, issue #2839). Runs last: the claim's `disclosure`
+ * section is among the things it depends on having already been byte-compared. */
+ | "disclosure-specification";
+export interface LegacyPublicBundleVerificationResult extends PublicBundleSignerDisclosure {
+    readonly format: "benchmark-product-public-bundle/2" | "benchmark-product-public-bundle/4" | "benchmark-product-public-bundle/6" | "benchmark-product-public-bundle/7" | "benchmark-product-public-bundle/8";
     readonly identity: string;
     readonly checks: readonly PublicBundleVerificationCheck[];
     readonly benchmarkSha256: string;
@@ -22,6 +28,10 @@ export interface LegacyPublicBundleVerificationResult {
      * subject's context outcome (anchor-evidence design §8). Statuses are disclosed facts, not a
      * summary — nothing here is folded into a single verified badge. */
     readonly anchors?: IntegrityAnchorsReport;
+    /** Present exactly for the disclosed closure (issue #2839, design §7 step 11): the sealed record's
+     * identity and all six variables' statuses. Statuses are DISCLOSED FACTS, never folded into a
+     * single badge and never counted — the same posture `anchors` takes, and for the same reason. */
+    readonly disclosure?: DisclosureSpecificationReport;
     readonly qualification?: {
         readonly publicationGrade: boolean;
         readonly truthAdmission: "two-human-unanimous" | "operator-only" | "screened-operator-sampled";
@@ -32,7 +42,11 @@ export interface LegacyPublicBundleVerificationResult {
         readonly exclusionCount: number;
     };
 }
-export type PublicBundleVerificationResult = LegacyPublicBundleVerificationResult | EvidenceNativePortableBundleVerification;
+/** Who signed the bundle, with the identifiers the human surface deliberately does not print. */
+export interface PublicBundleSignerDisclosure {
+    readonly signers?: readonly PublicBundleSigner[];
+}
+export type PublicBundleVerificationResult = LegacyPublicBundleVerificationResult | (EvidenceNativePortableBundleVerification & PublicBundleSignerDisclosure);
 export interface VerifyPublicBundleDeps extends VerifyBundleSnapshotDeps {
     /**
      * Trust material for the `integrity-anchors` check (anchor-evidence design §8 step 3): timestamp