@colophon-claims/verify 0.2.0 → 0.2.1

package/dist/profile/disclosure.js

@@ -0,0 +1,240 @@
+/**
+ * The disclosed closure's projection and check (disclosure-specification-record design §6.4, §6.6,
+ * §7; issue #2839).
+ *
+ * This module is **single-sourced, not mirrored**, exactly as `anchor-claims.ts` is: `@colophon-
+ * claims/core` already depends on this package, so the producer and the standalone verifier call
+ * ONE `deriveDisclosureSpecification`. The claim-consistency byte-compare then compares one
+ * function's output over two byte sets rather than two implementations' guesses.
+ *
+ * The one posture that matters more than any mechanism here (design R4):
+ *
+ *   **The verifier AUTHENTICATES measurements and CARRIES assertions.**
+ *
+ * A `measured-here` variable must cite records the bundle actually carries, under a role admissible
+ * for the citation. A `disclosed-by-publisher` variable is checked for internal well-formedness and
+ * for nothing else — no lookup, no fetch, no cross-check against the Matrix or the Report, no status
+ * upgrade or downgrade. An assertion that turns out to be false is a false assertion in a valid
+ * record; that is the correct outcome and the honest one, and a verifier that refused it would be
+ * claiming a power it does not have.
+ *
+ * What this check deliberately does NOT do (design §8, each one a thing a well-meaning implementer
+ * would add):
+ *
+ * - It does not reconcile against `Report.disclosures.perSubject[].pinning`. Those counts answer
+ *   "how well did each executed axis pin"; this record answers "which variables were executed at
+ *   all". Two surfaces restating one fact are two surfaces that can disagree.
+ * - It does not infer a status from the bundle. A bundle that plainly executed a judge model does
+ *   not license marking `judge-model` as `measured-here` if the record says otherwise.
+ * - It does not fetch anything, ever. A verifier that reached the network would make its own result
+ *   depend on when it ran.
+ * - It does not rank, score, compare, or aggregate. There is no disclosure-completeness score:
+ *   counting statuses would create a number publishers optimize against, and a six-of-six record
+ *   with six vague assertions would outscore a two-of-six record with two proofs.
+ */
+import { createHash } from "node:crypto";
+import { z } from "zod";
+import { DISCLOSURE_VARIABLE_KEYS, DisclosureVariablesSchema, MATRIX_RECORD_KIND, SIX_VARIABLE_DISCLOSURE_SPECIFICATION, parseDisclosureSpecification, } from "@jinn-network/benchmarking-records";
+/** The evidence-catalog role a disclosure-specification record carries, and the ONLY one it may
+ * carry: a record bearing this token together with any second role refuses (§7 step 1). */
+export const DISCLOSURE_SPECIFICATION_BUNDLE_ROLE = "disclosure-specification";
+/**
+ * §6.4's binding profile: which of this carrier's evidence roles satisfy which of the standard's two
+ * portable disclosure roles. Jinn-side mapping, deliberately NOT part of the portable record — the
+ * mapping from the standard's roles onto a specific carrier's record roles is the carrier's business.
+ *
+ * v1 deliberately does not narrow the admissible set per variable. Which record species fixes
+ * `judge-model` depends on the judge profile packet P0 is freezing, and encoding a guess here would
+ * put this module in P0's lane. Reserved as a v2 tightening once P0's record vocabulary merges.
+ */
+export const DISCLOSURE_ROLE_BINDING = {
+    "pinned-configuration": [
+        "task",
+        "item-bank",
+        "source-item",
+        "evaluation-spec",
+        "judge-instrument",
+        "runtime-selection",
+        "admission-manifest",
+    ],
+    "execution-observation": [
+        "run-pinning-evidence",
+        "solve-submission",
+        "solve-delivery",
+        "solve-output",
+        "evaluation-submission",
+        "evaluation-delivery",
+        "verdict",
+    ],
+};
+/**
+ * The claim section's own grammar, single-sourced from the record's schema so the section cannot
+ * describe a variable entry the record could not have carried. It is a second line of defense
+ * rather than the primary one: `assertClaimConsistency`'s whole-claim byte-compare against the
+ * rebuilt claim is what actually proves the section is this record's projection.
+ */
+export const ClaimDisclosureSectionSchema = z.strictObject({
+    recordSha256: z.string().regex(/^[a-f0-9]{64}$/u),
+    specification: z.literal(SIX_VARIABLE_DISCLOSURE_SPECIFICATION),
+    subjectSha256: z.string().regex(/^[a-f0-9]{64}$/u),
+    variables: DisclosureVariablesSchema,
+});
+export class DisclosureProjectionError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "DisclosureProjectionError";
+    }
+}
+function sha256Hex(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
+/**
+ * The one shared projection, called by BOTH the workspace producer and the standalone verifier.
+ *
+ * It carries only facts embedded in the record's own bytes, plus the record's digest — which is the
+ * digest of the very bytes handed in, never a separately supplied one. It exists at all so a reader
+ * of `claim-package.json` alone sees all six statuses without opening an evidence record, and so
+ * `assertClaimConsistency`'s existing whole-claim byte-compare covers the disclosure without a
+ * second bespoke comparison.
+ */
+export function deriveDisclosureSpecification(recordBytes) {
+    let record;
+    try {
+        record = parseDisclosureSpecification(recordBytes);
+    }
+    catch (cause) {
+        throw new DisclosureProjectionError(`disclosure-specification record is not a valid sealed record: ${cause instanceof Error ? cause.message : String(cause)}`);
+    }
+    return {
+        recordSha256: sha256Hex(recordBytes),
+        specification: record.specification,
+        subjectSha256: record.subject.digest.sha256,
+        // Verbatim, in the frozen key order. Building the object key by key rather than spreading
+        // `record.variables` is what makes the order a property of this function rather than of
+        // whatever order the record's own bytes happened to carry.
+        variables: Object.fromEntries(DISCLOSURE_VARIABLE_KEYS.map((key) => [key, record.variables[key]])),
+    };
+}
+/**
+ * §7 steps 1–8: authenticate what the Report extension names.
+ *
+ * Step 9 (claim-id pairing) and step 10 (projection equality) live in `verify.ts` and
+ * `assertClaimConsistency` respectively, because both compare against documents this function is
+ * deliberately not handed — keeping this function a statement about the RECORD and its evidence.
+ */
+export function assertDisclosureSpecification(input) {
+    // Explicitly annotated so TypeScript's control-flow analysis treats every call below as
+    // terminating; a destructured member with an inferred type does not narrow through `never`.
+    const refuse = input.refuse;
+    // ── Step 1: carrier binding, in exact one-to-one correspondence ─────────────────────────────
+    //
+    // The extension's digest must resolve to EXACTLY ONE catalog record — none and two both refuse —
+    // and that record's declared roles must be exactly the one disclosure role. Conversely any catalog
+    // record bearing the role that the extension does not name refuses: without the second direction,
+    // a second disclosure record could ride along with nothing checking it.
+    const bearers = [...input.catalogRoles]
+        .filter(([, roles]) => roles.has(DISCLOSURE_SPECIFICATION_BUNDLE_ROLE))
+        .map(([digest]) => digest);
+    if (bearers.length !== 1 || bearers[0] !== input.extensionDigestSha256) {
+        refuse("disclosure-specification", bearers.length === 0
+            ? "the Report names a disclosure-specification record that no evidence-catalog record carries"
+            : bearers.length > 1
+                ? "the evidence catalog carries more than one disclosure-specification record; the Report names exactly one"
+                : "the evidence catalog's disclosure-specification record is not the one the Report extension names");
+    }
+    const declared = input.catalogRoles.get(input.extensionDigestSha256);
+    if (declared === undefined || declared.size !== 1) {
+        refuse("disclosure-specification", "the disclosure-specification record must declare exactly that one role and no second");
+    }
+    // ── Step 2: exact bytes ────────────────────────────────────────────────────────────────────
+    //
+    // The digest equality with the catalog entry is already established upstream (the bundle walk
+    // recomputes every `records/<sha256>.bin`), so what is proved here is that those bytes parse
+    // strictly AND are the one exact canonical encoding of what they parse to.
+    const bytes = input.recordBytes.get(input.extensionDigestSha256);
+    if (bytes === undefined) {
+        refuse("disclosure-specification", "the bundle does not carry the disclosure-specification record it names");
+    }
+    const record = (() => {
+        try {
+            return parseDisclosureSpecification(bytes);
+        }
+        catch (cause) {
+            refuse(`records/${input.extensionDigestSha256}.bin`, `disclosure-specification record is invalid: ${cause instanceof Error ? cause.message : String(cause)}`);
+        }
+    })();
+    // ── Step 3: subject binding (R1) ───────────────────────────────────────────────────────────
+    //
+    // The Matrix rather than the Report, because the Report cannot name its own digest inside its own
+    // signed payload, and because the record must be sealable before the Report is (§5).
+    if (record.subject.kind !== MATRIX_RECORD_KIND) {
+        refuse("disclosure-specification", `the record's subject kind must be ${MATRIX_RECORD_KIND}`);
+    }
+    if (record.subject.digest.sha256 !== input.matrixSha256) {
+        refuse("disclosure-specification", "the record's subject digest is not this bundle's Matrix digest");
+    }
+    if (record.specification !== SIX_VARIABLE_DISCLOSURE_SPECIFICATION) {
+        refuse("disclosure-specification", `the record must claim ${SIX_VARIABLE_DISCLOSURE_SPECIFICATION}`);
+    }
+    // ── Step 4: author binding ─────────────────────────────────────────────────────────────────
+    //
+    // A disclosure record asserting under one identity inside a bundle signed by another is a carrier
+    // mismatch, not an extra fact.
+    if (record.author !== input.reportAuthor) {
+        refuse("disclosure-specification", "the record's author is not the bundle's verified Report author");
+    }
+    // ── Step 5: vocabulary completeness (R2) ───────────────────────────────────────────────────
+    //
+    // Structural via the strict object; restated so the refusal names the KEY rather than a schema
+    // path a reader would have to decode.
+    for (const key of DISCLOSURE_VARIABLE_KEYS) {
+        if (record.variables[key] === undefined) {
+            refuse("disclosure-specification", `the record does not state the variable "${key}"`);
+        }
+    }
+    for (const key of Object.keys(record.variables)) {
+        if (!DISCLOSURE_VARIABLE_KEYS.includes(key)) {
+            refuse("disclosure-specification", `the record states an unknown variable "${key}"; the six-variable set is closed`);
+        }
+    }
+    // ── Steps 6–8: authenticate measurements, carry assertions, and let undisclosed carry nothing ─
+    const statuses = {};
+    for (const key of DISCLOSURE_VARIABLE_KEYS) {
+        const entry = record.variables[key];
+        statuses[key] = entry.status;
+        if (entry.status === "measured-here") {
+            // Step 6. THE WHOLE SUBSTANCE of "variables the venue actually ran must match actual pinning
+            // evidence in the bundle": no measured-here variable may cite a record the bundle does not
+            // carry, and a citation resolving to bytes of the wrong species is as bad as a dangling one.
+            for (const citation of entry.evidence) {
+                const cited = input.catalogRoles.get(citation.digest.sha256);
+                if (cited === undefined) {
+                    refuse("disclosure-specification", `"${key}" is measured here but cites ${citation.digest.sha256}, which this bundle does not carry`);
+                }
+                const citedRoles = cited;
+                const admissible = DISCLOSURE_ROLE_BINDING[citation.role];
+                if (!admissible.some((role) => citedRoles.has(role))) {
+                    refuse("disclosure-specification", `"${key}" cites ${citation.digest.sha256} as ${citation.role}, but that record's bundle roles are`
+                        + ` outside the admissible set for it`);
+                }
+            }
+            continue;
+        }
+        if (entry.status === "disclosed-by-publisher") {
+            // Step 7. Internal consistency ONLY. The schema has already established the statement bound
+            // and the sorted, unique, absolute-IRI source list; there is nothing further to check here and
+            // — R4 — nothing further this verifier is entitled to check. Restated as a branch so a later
+            // reader sees the deliberate emptiness rather than an omission.
+            continue;
+        }
+        // Step 8. Structural via the union; restated so the refusal would name the variable. Reaching
+        // this branch at all means the entry is `undisclosed`, which by construction carries a reason
+        // token and nothing else.
+    }
+    return {
+        recordSha256: input.extensionDigestSha256,
+        specification: record.specification,
+        subjectSha256: record.subject.digest.sha256,
+        statuses: statuses,
+    };
+}

package/dist/profile/run-results.d.ts

@@ -1,10 +1,16 @@
 import type { MatrixCell, RunRecord } from "@jinn-network/benchmarking-records";
 import { type ClaimAnchor } from "./anchor-claims.js";
+import type { VerifiedRunBinding } from "../binding/beacon-binding.js";
 export declare const LOCAL_VENUE_LIMITS: readonly string[];
 export declare function localVenueLimitsForRun(run: Pick<RunRecord, "policy">): readonly string[];
 /** `anchors` is the same derived section the producer used (anchor-evidence §7.4); the conditional
- * copy is the same pure function on both sides, so claim-consistency stays an exact byte-compare. */
-export declare function buildLocalVenueHonesty(cells: readonly MatrixCell[], run: Pick<RunRecord, "policy">, anchors?: readonly ClaimAnchor[]): {
+ * copy is the same pure function on both sides, so claim-consistency stays an exact byte-compare.
+ *
+ * `binding` is the run's verified `beacon-binding/1` record (issue #2976) and obeys the same rule:
+ * omitting it is the identity, so every run that carries no binding keeps its exact limits bytes.
+ * It is only ever passed by a caller that can show BOTH sides the same binding — today that means
+ * it is not passed, because the public bundle carries no binding record yet. */
+export declare function buildLocalVenueHonesty(cells: readonly MatrixCell[], run: Pick<RunRecord, "policy">, anchors?: readonly ClaimAnchor[], binding?: VerifiedRunBinding): {
     venue: "self-run";
     preRegistration: "structural-and-append-order-only" | "structural-append-order-and-anchored-time";
     limits: readonly string[];

package/dist/profile/run-results.js

@@ -1,5 +1,6 @@
 import { venueIsolationPostureForPolicy } from "./isolation.js";
 import { anchoredPreRegistration, anchoredVenueLimits } from "./anchor-claims.js";
+import { runBoundVenueLimits } from "../binding/report-face.js";
 export const LOCAL_VENUE_LIMITS = [
     "This is a local, self-run venue: the same operator controls task dispatch, execution, and evaluation.",
     "Pre-registration here is a discipline enforced by this tool, not a proof against the run's own owner — nothing prevents the owner from having altered the record before publishing it.",
@@ -12,12 +13,17 @@ export function localVenueLimitsForRun(run) {
     return venueIsolationPostureForPolicy(run.policy.submissionBaseline?.isolationPolicy).inventory.length === 1 ? LOCAL_VENUE_LIMITS : [LOCAL_VENUE_LIMITS[0], LOCAL_VENUE_LIMITS[1], MULTI, ...LOCAL_VENUE_LIMITS.slice(3)];
 }
 /** `anchors` is the same derived section the producer used (anchor-evidence §7.4); the conditional
- * copy is the same pure function on both sides, so claim-consistency stays an exact byte-compare. */
-export function buildLocalVenueHonesty(cells, run, anchors = []) {
+ * copy is the same pure function on both sides, so claim-consistency stays an exact byte-compare.
+ *
+ * `binding` is the run's verified `beacon-binding/1` record (issue #2976) and obeys the same rule:
+ * omitting it is the identity, so every run that carries no binding keeps its exact limits bytes.
+ * It is only ever passed by a caller that can show BOTH sides the same binding — today that means
+ * it is not passed, because the public bundle carries no binding record yet. */
+export function buildLocalVenueHonesty(cells, run, anchors = [], binding) {
     const counts = { harness: 0, model: 0, loadout: 0, isolation: 0 };
     for (const cell of cells)
         for (const axis of Object.keys(counts))
             if (cell.verification[axis] === "unverifiable")
                 counts[axis] += 1;
-    return { venue: "self-run", preRegistration: anchoredPreRegistration(anchors), limits: anchoredVenueLimits(localVenueLimitsForRun(run), anchors), unverifiableAxisCounts: counts };
+    return { venue: "self-run", preRegistration: anchoredPreRegistration(anchors), limits: runBoundVenueLimits(anchoredVenueLimits(localVenueLimitsForRun(run), anchors), binding), unverifiableAxisCounts: counts };
 }

package/dist/profile/task-selection.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Task-selection provenance, verified against the records that carry it (issue #2980).
+ *
+ * The declaration is a closed-vocabulary value sealed into the Run record's
+ * `task-selection/v1` extension. Sealing makes it unforgeable after the lock; it does not make it
+ * true. What remains for a cold verifier is the part sealing cannot settle: whether the *other*
+ * sealed records are consistent with what the declaration asserts.
+ *
+ * In this record model the *selection is the Benchmark record itself*: the Run seals a Benchmark
+ * digest, and `expectedCellSet` is the full cartesian product `items x arms x replicates`, so the
+ * Matrix always covers every Benchmark item exactly. Comparing the Matrix's task digests against
+ * the Benchmark's items — the first thing this module tried — is therefore dead code. What is left
+ * is the Benchmark's own reveal policy and whether anyone declared the set at all.
+ *
+ * These checks are refusals, not endorsements, and the asymmetry is the point: each one names a
+ * declaration the records positively contradict. None of them can establish that a declaration is
+ * TRUE, because the bundle carries no independent witness of an upstream set. `assertTaskSelection-
+ * Consistency` below says exactly where that boundary falls and why the tempting rule on the other
+ * side of it is unsound.
+ */
+import { type BenchmarkRecord, type RunRecord, type TaskSelectionMode } from "@jinn-network/benchmarking-records";
+export interface TaskSelectionConsistencyInput {
+    readonly benchmarkRecord: BenchmarkRecord;
+    readonly runRecord: RunRecord;
+}
+/**
+ * The declared mode, refusing rather than throwing raw on bytes the Run schema would not have
+ * sealed. Exported so any reader that resolves the mode does so through this refusal posture
+ * rather than re-deriving it with its own error handling. No presentation asset consumes it today
+ * -- the report face renders nothing for task selection until issue #3416 -- so its only callers
+ * are `taskSelectionContradiction` below and its own tests.
+ */
+export declare function declaredTaskSelectionMode(runRecord: RunRecord): TaskSelectionMode | undefined;
+/**
+ * The way the sealed records contradict a declared task-selection mode, or `undefined` when they
+ * do not. Pure, and shared deliberately: the producer calls it BEFORE the lock so a contradiction
+ * is a draft-validation refusal the claimant can still act on, and the cold verifier calls it after
+ * the fact through {@link assertTaskSelectionConsistency}. One rule, two postures — a second copy
+ * would be free to drift into refusing at publish what it accepted at lock, which is the worst
+ * possible place to disagree.
+ *
+ * Two contradictions, both provable from bundle bytes:
+ *
+ * 1. **`fixed-public-set` over an undeclared set.** A set nobody declared is not a publicly
+ *    declared set, so the Benchmark record must at least name an `author`.
+ * 2. **Reveal policy that cannot coexist with the mode.** `fixed-public-set` is refused when the
+ *    items were provably withheld at the lock; `drawn-post-lock` is refused when they were
+ *    `immediate` — open the moment the record existed, so the Run sealed against a set the
+ *    claimant could already read, and nothing was drawn afterwards.
+ *
+ * What this deliberately does NOT do is decide the stronger modes from `benchmark.author` versus
+ * `run.owner`. That rule looks decisive and is not: `author` is a self-declaration the design spec
+ * marks non-authoritative, and every task-set intake in this product re-authors the Benchmark under
+ * the workspace's own key (`intake/workspace-authored.ts`), which is also the Run's owner. Enforcing
+ * on it would refuse every bundle this product can produce, making two of the three vocabulary
+ * values dead letters.
+ *
+ * So the honest boundary: these checks catch declarations the records positively contradict, but
+ * none can prove a `fixed-public-set` claim TRUE — the bundle carries no independent witness of the
+ * upstream set. `PUBLIC-BUNDLE.md` says so in the same words, because a gap a reader can see is
+ * worth more than one a rule pretends to close.
+ *
+ * `claimant-chosen` is unconstrained on purpose. It asserts nothing about anyone but the claimant,
+ * so nothing can contradict it, and constraining it would only make the honest answer the
+ * expensive one.
+ */
+export declare function taskSelectionContradiction(input: TaskSelectionConsistencyInput): string | undefined;
+/** The cold verifier's posture over {@link taskSelectionContradiction}: a typed record refusal. */
+export declare function assertTaskSelectionConsistency(input: TaskSelectionConsistencyInput): void;

package/dist/profile/task-selection.js

@@ -0,0 +1,140 @@
+/**
+ * Task-selection provenance, verified against the records that carry it (issue #2980).
+ *
+ * The declaration is a closed-vocabulary value sealed into the Run record's
+ * `task-selection/v1` extension. Sealing makes it unforgeable after the lock; it does not make it
+ * true. What remains for a cold verifier is the part sealing cannot settle: whether the *other*
+ * sealed records are consistent with what the declaration asserts.
+ *
+ * In this record model the *selection is the Benchmark record itself*: the Run seals a Benchmark
+ * digest, and `expectedCellSet` is the full cartesian product `items x arms x replicates`, so the
+ * Matrix always covers every Benchmark item exactly. Comparing the Matrix's task digests against
+ * the Benchmark's items — the first thing this module tried — is therefore dead code. What is left
+ * is the Benchmark's own reveal policy and whether anyone declared the set at all.
+ *
+ * These checks are refusals, not endorsements, and the asymmetry is the point: each one names a
+ * declaration the records positively contradict. None of them can establish that a declaration is
+ * TRUE, because the bundle carries no independent witness of an upstream set. `assertTaskSelection-
+ * Consistency` below says exactly where that boundary falls and why the tempting rule on the other
+ * side of it is unsound.
+ */
+import { compareCalendarStrictRfc3339Instants, readTaskSelectionMode, } from "@jinn-network/benchmarking-records";
+import { refuse } from "./errors.js";
+/** The verification path every refusal here is reported under. Adding a new named check would be a
+ * bundle-format bump — the claim pins the check list byte-for-byte — so these refusals join the
+ * existing `claim-consistency` check, which is exactly the question they answer. */
+const PATH = "claim-consistency";
+/**
+ * Whether the Benchmark's items were PROVABLY still withheld when the Run sealed against them.
+ *
+ * Deliberately one-directional, and the reason is a real trap. The only instant a cold verifier
+ * can read out of a sealed Run is `closeAt`, which is the run's CLOSE, not its lock —
+ * `closeAt = lockedAt + policy.closeAfterMs` with a strictly positive interval (24h by default),
+ * and `lockedAt` lives only in product-local state that no bundle carries. So `notBefore <= closeAt`
+ * establishes nothing about the lock: a schedule opening twelve hours into a twenty-four-hour run
+ * satisfies it while the items were plainly withheld at the lock. Only the far side is safe —
+ * `notBefore >= closeAt > lockedAt` proves withholding — so that is the only comparison made.
+ *
+ * The comparator is the records package's own, not `Date.parse`, and that is a correctness
+ * requirement rather than a preference. These fields are validated by `isCalendarStrictRfc3339`,
+ * which accepts leap seconds; V8's `Date.parse` returns `NaN` for exactly those spellings, and
+ * `NaN >= x` is `false`. Left on `Date.parse`, a claimant could seal
+ * `notBefore: "2026-12-31T23:59:60Z"` — items withheld past the run's end — declare
+ * `fixed-public-set`, and have both this check and the producer's pre-lock gate wave it through.
+ * An uncomparable pair fails CLOSED for the same reason: it cannot arise from schema-valid records,
+ * so treating it as proof of withholding costs nothing and removes the fail-open shape entirely.
+ *
+ * A `scheduled` reveal with no `notBefore` fails closed on the same principle. The Benchmark schema
+ * leaves `notBefore` optional under every policy, so `{ "policy": "scheduled" }` seals cleanly while
+ * announcing no instant at which the items become readable — strictly more withheld than
+ * `after-run`, which at least names the run's end. Reading it as open would hand a claimant a
+ * one-key evasion of the only reveal-policy teeth `fixed-public-set` has: delete the field, and a
+ * privately assembled set passes the check that `after-run` fails.
+ */
+function withheldAtLock(benchmark, closeAt) {
+    const { policy, notBefore } = benchmark.reveal;
+    if (policy === "after-run")
+        return true;
+    if (policy !== "scheduled")
+        return false;
+    if (notBefore === undefined)
+        return true;
+    const order = compareCalendarStrictRfc3339Instants(notBefore, closeAt);
+    return order === undefined || order >= 0;
+}
+/**
+ * The declared mode, refusing rather than throwing raw on bytes the Run schema would not have
+ * sealed. Exported so any reader that resolves the mode does so through this refusal posture
+ * rather than re-deriving it with its own error handling. No presentation asset consumes it today
+ * -- the report face renders nothing for task selection until issue #3416 -- so its only callers
+ * are `taskSelectionContradiction` below and its own tests.
+ */
+export function declaredTaskSelectionMode(runRecord) {
+    try {
+        return readTaskSelectionMode(runRecord);
+    }
+    catch (cause) {
+        refuse("record-integrity", PATH, `the Run's declared task selection is not one of the recorded selection modes: ${cause instanceof Error ? cause.message : String(cause)}`);
+    }
+}
+/**
+ * The way the sealed records contradict a declared task-selection mode, or `undefined` when they
+ * do not. Pure, and shared deliberately: the producer calls it BEFORE the lock so a contradiction
+ * is a draft-validation refusal the claimant can still act on, and the cold verifier calls it after
+ * the fact through {@link assertTaskSelectionConsistency}. One rule, two postures — a second copy
+ * would be free to drift into refusing at publish what it accepted at lock, which is the worst
+ * possible place to disagree.
+ *
+ * Two contradictions, both provable from bundle bytes:
+ *
+ * 1. **`fixed-public-set` over an undeclared set.** A set nobody declared is not a publicly
+ *    declared set, so the Benchmark record must at least name an `author`.
+ * 2. **Reveal policy that cannot coexist with the mode.** `fixed-public-set` is refused when the
+ *    items were provably withheld at the lock; `drawn-post-lock` is refused when they were
+ *    `immediate` — open the moment the record existed, so the Run sealed against a set the
+ *    claimant could already read, and nothing was drawn afterwards.
+ *
+ * What this deliberately does NOT do is decide the stronger modes from `benchmark.author` versus
+ * `run.owner`. That rule looks decisive and is not: `author` is a self-declaration the design spec
+ * marks non-authoritative, and every task-set intake in this product re-authors the Benchmark under
+ * the workspace's own key (`intake/workspace-authored.ts`), which is also the Run's owner. Enforcing
+ * on it would refuse every bundle this product can produce, making two of the three vocabulary
+ * values dead letters.
+ *
+ * So the honest boundary: these checks catch declarations the records positively contradict, but
+ * none can prove a `fixed-public-set` claim TRUE — the bundle carries no independent witness of the
+ * upstream set. `PUBLIC-BUNDLE.md` says so in the same words, because a gap a reader can see is
+ * worth more than one a rule pretends to close.
+ *
+ * `claimant-chosen` is unconstrained on purpose. It asserts nothing about anyone but the claimant,
+ * so nothing can contradict it, and constraining it would only make the honest answer the
+ * expensive one.
+ */
+export function taskSelectionContradiction(input) {
+    const { benchmarkRecord, runRecord } = input;
+    const declared = declaredTaskSelectionMode(runRecord);
+    if (declared === undefined || declared === "claimant-chosen")
+        return undefined;
+    if (declared === "fixed-public-set") {
+        if (benchmarkRecord.author === undefined) {
+            return "task selection is declared fixed-public-set but the Benchmark record names no author,"
+                + " so the set it describes was never publicly declared by anyone";
+        }
+        if (withheldAtLock(benchmarkRecord, runRecord.closeAt)) {
+            return "task selection is declared fixed-public-set but the Benchmark's reveal policy withholds"
+                + " its items past the end of the run, so they were not public when the run was locked";
+        }
+        return undefined;
+    }
+    if (benchmarkRecord.reveal.policy === "immediate") {
+        return "task selection is declared drawn-post-lock but the Benchmark reveals its items"
+            + " immediately, so the run was locked against a set the claimant could already read";
+    }
+    return undefined;
+}
+/** The cold verifier's posture over {@link taskSelectionContradiction}: a typed record refusal. */
+export function assertTaskSelectionConsistency(input) {
+    const contradiction = taskSelectionContradiction(input);
+    if (contradiction !== undefined)
+        refuse("record-integrity", PATH, contradiction);
+}

package/dist/reader-instructions.d.ts

@@ -20,7 +20,36 @@ export declare const PUBLIC_BUNDLE_V6_COMPATIBLE_VERIFICATION_COMMAND: "npx @col
  * `EVIDENCE_NATIVE_BUNDLE_V5_CHECKS`.
  */
 export declare const PUBLIC_BUNDLE_V6_CHECKS: readonly ["manifest", "evidence-closure", "trust", "matrix-rederivation", "report-verification", "claim-consistency", "integrity-anchors"];
-/** Every current format stamps the same first public 0.1 line. */
+/**
+ * The anchored binary-qualification closure runs exactly the anchored list (issue #3205): the
+ * qualification projection changes what `evidence-closure` and `claim-consistency` examine, not
+ * which checks run.
+ */
+export declare const PUBLIC_BUNDLE_V7_CHECKS: readonly ["manifest", "evidence-closure", "trust", "matrix-rederivation", "report-verification", "claim-consistency", "integrity-anchors"];
+/**
+ * Unlike every earlier closure, this one does NOT stamp the first public 0.1 line: no released
+ * verifier before 0.2.1 understands `benchmark-product-public-bundle/7`, and a claim naming a
+ * reader that cannot read it would be an instruction to fail. 0.2.1 is also the line that carries
+ * the prompted-screening admission surface a binary claim may need.
+ */
+export declare const PUBLIC_BUNDLE_V7_VERIFICATION_COMMAND: "npx @colophon-claims/verify@0.2.1 <bundle-dir>";
+export declare const PUBLIC_BUNDLE_V7_COMPATIBLE_VERIFICATION_COMMAND: "npx @colophon-claims/verify@0.2 <bundle-dir>";
+/**
+ * The disclosed closure's check list (disclosure-specification-record design §7, issue #2839): v7's
+ * seven plus `disclosure-specification`, **last**. It runs after `claim-consistency` because the
+ * claim's `disclosure` section is among the things it compares, and it is **always present** on this
+ * format — a disclosed bundle whose record was stripped is a closure failure, not a shorter list.
+ */
+export declare const PUBLIC_BUNDLE_V8_CHECKS: readonly ["manifest", "evidence-closure", "trust", "matrix-rederivation", "report-verification", "claim-consistency", "integrity-anchors", "disclosure-specification"];
+/**
+ * Like v7 and for the same reason: no released reader before 0.2.1 understands
+ * `benchmark-product-public-bundle/8`, and a claim naming a reader that cannot read it would be an
+ * instruction to fail. The disclosed closure ships in the same unpublished 0.2.1 line as v7, so it
+ * pins that line rather than minting a third.
+ */
+export declare const PUBLIC_BUNDLE_V8_VERIFICATION_COMMAND: "npx @colophon-claims/verify@0.2.1 <bundle-dir>";
+export declare const PUBLIC_BUNDLE_V8_COMPATIBLE_VERIFICATION_COMMAND: "npx @colophon-claims/verify@0.2 <bundle-dir>";
+/** Every format through v6 stamps the same first public 0.1 line; v7 is the first that cannot. */
 export declare const PUBLIC_BUNDLE_VERIFICATION_INSTRUCTIONS: {
     readonly "benchmark-product-public-bundle/2": {
         readonly command: "npx @colophon-claims/verify@0.1.0 <bundle-dir>";
@@ -38,4 +67,12 @@ export declare const PUBLIC_BUNDLE_VERIFICATION_INSTRUCTIONS: {
         readonly command: "npx @colophon-claims/verify@0.1.0 <bundle-dir>";
         readonly compatibleCommand: "npx @colophon-claims/verify@0.1 <bundle-dir>";
     };
+    readonly "benchmark-product-public-bundle/7": {
+        readonly command: "npx @colophon-claims/verify@0.2.1 <bundle-dir>";
+        readonly compatibleCommand: "npx @colophon-claims/verify@0.2 <bundle-dir>";
+    };
+    readonly "benchmark-product-public-bundle/8": {
+        readonly command: "npx @colophon-claims/verify@0.2.1 <bundle-dir>";
+        readonly compatibleCommand: "npx @colophon-claims/verify@0.2 <bundle-dir>";
+    };
 };

package/dist/reader-instructions.js

@@ -30,7 +30,39 @@ export const PUBLIC_BUNDLE_V6_CHECKS = [
     ...PUBLIC_BUNDLE_VERIFICATION_CHECKS,
     "integrity-anchors",
 ];
-/** Every current format stamps the same first public 0.1 line. */
+/**
+ * The anchored binary-qualification closure runs exactly the anchored list (issue #3205): the
+ * qualification projection changes what `evidence-closure` and `claim-consistency` examine, not
+ * which checks run.
+ */
+export const PUBLIC_BUNDLE_V7_CHECKS = PUBLIC_BUNDLE_V6_CHECKS;
+/**
+ * Unlike every earlier closure, this one does NOT stamp the first public 0.1 line: no released
+ * verifier before 0.2.1 understands `benchmark-product-public-bundle/7`, and a claim naming a
+ * reader that cannot read it would be an instruction to fail. 0.2.1 is also the line that carries
+ * the prompted-screening admission surface a binary claim may need.
+ */
+export const PUBLIC_BUNDLE_V7_VERIFICATION_COMMAND = "npx @colophon-claims/verify@0.2.1 <bundle-dir>";
+export const PUBLIC_BUNDLE_V7_COMPATIBLE_VERIFICATION_COMMAND = "npx @colophon-claims/verify@0.2 <bundle-dir>";
+/**
+ * The disclosed closure's check list (disclosure-specification-record design §7, issue #2839): v7's
+ * seven plus `disclosure-specification`, **last**. It runs after `claim-consistency` because the
+ * claim's `disclosure` section is among the things it compares, and it is **always present** on this
+ * format — a disclosed bundle whose record was stripped is a closure failure, not a shorter list.
+ */
+export const PUBLIC_BUNDLE_V8_CHECKS = [
+    ...PUBLIC_BUNDLE_V7_CHECKS,
+    "disclosure-specification",
+];
+/**
+ * Like v7 and for the same reason: no released reader before 0.2.1 understands
+ * `benchmark-product-public-bundle/8`, and a claim naming a reader that cannot read it would be an
+ * instruction to fail. The disclosed closure ships in the same unpublished 0.2.1 line as v7, so it
+ * pins that line rather than minting a third.
+ */
+export const PUBLIC_BUNDLE_V8_VERIFICATION_COMMAND = PUBLIC_BUNDLE_V7_VERIFICATION_COMMAND;
+export const PUBLIC_BUNDLE_V8_COMPATIBLE_VERIFICATION_COMMAND = PUBLIC_BUNDLE_V7_COMPATIBLE_VERIFICATION_COMMAND;
+/** Every format through v6 stamps the same first public 0.1 line; v7 is the first that cannot. */
 export const PUBLIC_BUNDLE_VERIFICATION_INSTRUCTIONS = {
     [BUNDLE_FORMAT]: {
         command: PUBLIC_BUNDLE_VERIFICATION_COMMAND,
@@ -48,5 +80,13 @@ export const PUBLIC_BUNDLE_VERIFICATION_INSTRUCTIONS = {
         command: PUBLIC_BUNDLE_V6_VERIFICATION_COMMAND,
         compatibleCommand: PUBLIC_BUNDLE_V6_COMPATIBLE_VERIFICATION_COMMAND,
     },
+    [BUNDLE_V7_FORMAT]: {
+        command: PUBLIC_BUNDLE_V7_VERIFICATION_COMMAND,
+        compatibleCommand: PUBLIC_BUNDLE_V7_COMPATIBLE_VERIFICATION_COMMAND,
+    },
+    [BUNDLE_V8_FORMAT]: {
+        command: PUBLIC_BUNDLE_V8_VERIFICATION_COMMAND,
+        compatibleCommand: PUBLIC_BUNDLE_V8_COMPATIBLE_VERIFICATION_COMMAND,
+    },
 };
-import { BUNDLE_FORMAT, BUNDLE_V4_FORMAT, BUNDLE_V5_FORMAT, BUNDLE_V6_FORMAT } from "./manifest.js";
+import { BUNDLE_FORMAT, BUNDLE_V4_FORMAT, BUNDLE_V5_FORMAT, BUNDLE_V6_FORMAT, BUNDLE_V7_FORMAT, BUNDLE_V8_FORMAT, } from "./manifest.js";