@colophon-claims/verify 0.2.0 → 0.2.1

package/dist/schema.d.ts

@@ -6,7 +6,7 @@ export declare const BUNDLE_ASSEMBLY_FORMAT: "benchmark-product-assembly/2";
 export declare const BUNDLE_V4_TRUST_FORMAT: "benchmark-product-public-trust/4";
 export declare const BUNDLE_V4_EVIDENCE_FORMAT: "benchmark-product-evidence-catalog/4";
 export declare const BUNDLE_QUALIFICATION_FORMAT: "benchmark-product-binary-qualification/1";
-export declare const BUNDLE_V4_EVIDENCE_ROLES: readonly ["task", "runtime-selection", "evaluation-spec", "admission-receipt", "solve-submission", "run-pinning-evidence", "evaluation-submission", "solve-delivery", "solve-output", "evaluation-task", "evaluation-delivery", "verdict", "item-bank", "source-manifest", "admission-index", "admission-manifest", "replacement-ledger", "source-item", "judge-instrument", "analysis-context", "label-resolution", "human-review-evaluation-spec", "human-review-form", "human-review-packet", "human-review-response", "human-review-verdict", "reviewer-roster", "review-visibility-receipt", "review-reveal-receipt", "operator-assertion", "snapshot-probe", "screening-table", "screening-reveal-receipt", "screening-instrument", "screening-sampling-script", "screening-raw-outputs", "screening-prompt", "screening-procedure", "screening-pool", "screening-sample-commitment", "screening-transcript"];
+export declare const BUNDLE_V4_EVIDENCE_ROLES: readonly ["task", "runtime-selection", "evaluation-spec", "admission-receipt", "solve-submission", "run-pinning-evidence", "evaluation-submission", "solve-delivery", "solve-output", "evaluation-task", "evaluation-delivery", "verdict", "item-bank", "source-manifest", "admission-index", "admission-manifest", "replacement-ledger", "source-item", "judge-instrument", "analysis-context", "label-resolution", "human-review-evaluation-spec", "human-review-form", "human-review-packet", "human-review-response", "human-review-verdict", "reviewer-roster", "review-visibility-receipt", "review-reveal-receipt", "operator-assertion", "snapshot-probe", "screening-table", "screening-reveal-receipt", "screening-instrument", "screening-sampling-script", "screening-raw-outputs", "screening-prompt", "screening-procedure", "screening-pool", "screening-sample-commitment", "screening-transcript", "disclosure-specification"];
 export type BundleV4EvidenceRole = (typeof BUNDLE_V4_EVIDENCE_ROLES)[number];
 export declare const BUNDLE_V4_ADMISSION_EVIDENCE_ROLES: readonly ["admission-manifest", "replacement-ledger", "source-item", "label-resolution", "analysis-context", "human-review-evaluation-spec", "human-review-form", "human-review-packet", "human-review-response", "human-review-verdict", "reviewer-roster", "review-visibility-receipt", "review-reveal-receipt", "operator-assertion", "screening-table", "screening-reveal-receipt", "screening-instrument", "screening-sampling-script", "screening-raw-outputs", "screening-prompt", "screening-procedure", "screening-pool", "screening-sample-commitment", "screening-transcript"];
 export declare const BundleTrustSchema: z.ZodObject<{
@@ -76,7 +76,6 @@ export declare const BundleEvidenceCatalogSchema: z.ZodObject<{
     records: z.ZodArray<z.ZodObject<{
         sha256: z.ZodString;
         roles: z.ZodArray<z.ZodEnum<{
-            verdict: "verdict";
             task: "task";
             "runtime-selection": "runtime-selection";
             "evaluation-spec": "evaluation-spec";
@@ -88,6 +87,7 @@ export declare const BundleEvidenceCatalogSchema: z.ZodObject<{
             "solve-output": "solve-output";
             "evaluation-task": "evaluation-task";
             "evaluation-delivery": "evaluation-delivery";
+            verdict: "verdict";
             "judge-instrument": "judge-instrument";
             "analysis-context": "analysis-context";
             "label-resolution": "label-resolution";
@@ -100,7 +100,7 @@ export declare const BundleV4EvidenceCatalogSchema: z.ZodObject<{
     records: z.ZodArray<z.ZodObject<{
         sha256: z.ZodString;
         roles: z.ZodArray<z.ZodEnum<{
-            verdict: "verdict";
+            "disclosure-specification": "disclosure-specification";
             task: "task";
             "runtime-selection": "runtime-selection";
             "evaluation-spec": "evaluation-spec";
@@ -112,6 +112,7 @@ export declare const BundleV4EvidenceCatalogSchema: z.ZodObject<{
             "solve-output": "solve-output";
             "evaluation-task": "evaluation-task";
             "evaluation-delivery": "evaluation-delivery";
+            verdict: "verdict";
             "item-bank": "item-bank";
             "source-manifest": "source-manifest";
             "admission-index": "admission-index";

package/dist/schema.js

@@ -57,6 +57,17 @@ export const BUNDLE_V4_EVIDENCE_ROLES = [
     "screening-pool",
     "screening-sample-commitment",
     "screening-transcript",
+    // Appended at the very end (disclosure-specification-record design §6.2, issue #2839). Appending
+    // is the ONLY additive move available here: this array's index order is the frozen role-ordering
+    // map used by both the catalog schema's ordering refinement and the bundle writer, so inserting
+    // anywhere earlier would re-order existing bundles' role arrays and move their bytes. The /2
+    // catalog is a SEPARATE constant (`BUNDLE_EVIDENCE_ROLES` below) and is untouched by this append.
+    //
+    // The token is admitted on every v4-graph closure, because the enum is one shared constant and
+    // there is no per-closure role vocabulary. What keeps a disclosure record off an earlier closure
+    // is that nothing DERIVES the role there: off `/8` the Report extension is never read, so the
+    // evidence closure's own size and per-digest guards refuse the record as unreachable (§6.5.2).
+    "disclosure-specification",
 ];
 export const BUNDLE_V4_ADMISSION_EVIDENCE_ROLES = [
     "admission-manifest", "replacement-ledger", "source-item", "label-resolution",
@@ -215,6 +226,12 @@ const PrefixedSha256Schema = z.string().regex(/^sha256:[a-f0-9]{64}$/u);
 const IDENTIFIER_NAME = /^[A-Za-z][A-Za-z0-9._-]{0,63}$/u;
 export const BundleQualificationSchema = z.strictObject({
     format: z.literal(BUNDLE_QUALIFICATION_FORMAT),
+    // Deliberately NOT widened when a later closure allocates a new claim id (issue #3205's
+    // claim-package/5; the same resolution the disclosure-record design reached in its §6.5.1).
+    // This field names WHICH CLAIM PROJECTION SHAPE the qualification graph was built for, and the
+    // anchors section changes nothing about that graph: the qualification projection under /5 is
+    // byte-identical to the one under /2. Widening the literal would make this schema co-vary with
+    // an unrelated section, and would need widening again for every future closure.
     claimSchema: z.literal("benchmark-product.claim-package/2"),
     sourceManifestSha256: PrefixedSha256Schema,
     admissionManifestSha256: PrefixedSha256Schema,

package/dist/signers.d.ts

@@ -0,0 +1,48 @@
+import type { BundleTrust, BundleV4Trust } from "./schema.js";
+/**
+ * Who signed, in reader terms. The bundle's own identifiers select signatures and join records,
+ * so they stay exact on the machine surface; the human surface is given the role instead
+ * (issue #3024).
+ */
+export type PublicBundleSignerRole = "publisher" | "automated-grader" | "human-reviewer" | "label-admission";
+export interface PublicBundleSigner {
+    readonly role: PublicBundleSignerRole;
+    /** The load-bearing signer identity, verbatim. Machine surface only. */
+    readonly identity: string;
+    /** The exact key the signature selection resolved to. Machine surface only. */
+    readonly keyId: string;
+    /**
+     * `same-operator` where the bundle itself declares that the key is workspace-minted under the
+     * publisher's own custody; `undeclared` where it makes no custody statement. Never a claim that
+     * a signer is an independent party -- no bundle format can establish that.
+     */
+    readonly custody: "same-operator" | "undeclared";
+}
+/**
+ * Signers of a v2/v4/v6/v7 bundle, read from its already-authenticated `trust/public-keys.json`
+ * and the Matrix verdict closure the `trust` check validated it against.
+ *
+ * Every group this returns is ground-truthed rather than merely declared: `trust.evaluators` is
+ * pinned to exactly the union of the Matrix-referenced evaluators and the admission reviewers, and
+ * each reviewer binding to the authenticated signed review closure. That union is why the two roles
+ * are read from the two sets separately -- an identity that both graded cells and signed reviews is
+ * in both, and classifying reviewer-first would print one fewer grader than actually graded. Both
+ * trust grammars pin `selfRun.custody: "workspace-minted"` and `partyIndependence:
+ * "not-established"`, so same-operator custody is a fact of the parsed record, not an inference.
+ *
+ * Admission authorities are deliberately absent: the v4 grammar pins every authority keyId to the
+ * report key, so listing them would count the publisher's one key twice under two headings.
+ */
+export declare function legacyBundleSigners(trust: BundleTrust | BundleV4Trust, verdictEvaluators: ReadonlySet<string>): readonly PublicBundleSigner[];
+/**
+ * Signers of a v5 evidence-native bundle, read from the same authenticated `claim-package.json`
+ * bytes the closure verified.
+ *
+ * `claim.trust.signers` is a publisher-written declaration used by the closure only as a lookup
+ * table: a surplus entry there is never contradicted, because no signature ever selects it. So this
+ * keeps only the keys that actually carried a signature the closure accepted
+ * (`verifiedSignerKeyIds`). Without that filter a bundle could declare a human reviewer, or a dozen
+ * graders, that signed nothing and have the checker print them as fact. The claim package declares
+ * no custody, so nothing here upgrades a signer to same-operator either.
+ */
+export declare function evidenceNativeBundleSigners(claimPackageBytes: Uint8Array, verifiedSignerKeyIds: readonly string[]): readonly PublicBundleSigner[];

package/dist/signers.js

@@ -0,0 +1,77 @@
+import { parseEvidenceNativeClaimPackageV3 } from "@jinn-network/benchmarking-protocol";
+function deduplicate(signers) {
+    const seen = new Set();
+    return signers.filter((signer) => {
+        const key = `${signer.role} ${signer.keyId}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+/**
+ * Signers of a v2/v4/v6/v7 bundle, read from its already-authenticated `trust/public-keys.json`
+ * and the Matrix verdict closure the `trust` check validated it against.
+ *
+ * Every group this returns is ground-truthed rather than merely declared: `trust.evaluators` is
+ * pinned to exactly the union of the Matrix-referenced evaluators and the admission reviewers, and
+ * each reviewer binding to the authenticated signed review closure. That union is why the two roles
+ * are read from the two sets separately -- an identity that both graded cells and signed reviews is
+ * in both, and classifying reviewer-first would print one fewer grader than actually graded. Both
+ * trust grammars pin `selfRun.custody: "workspace-minted"` and `partyIndependence:
+ * "not-established"`, so same-operator custody is a fact of the parsed record, not an inference.
+ *
+ * Admission authorities are deliberately absent: the v4 grammar pins every authority keyId to the
+ * report key, so listing them would count the publisher's one key twice under two headings.
+ */
+export function legacyBundleSigners(trust, verdictEvaluators) {
+    const reviewers = new Set("admission" in trust ? trust.admission.reviewers.map((entry) => entry.evaluator) : []);
+    return deduplicate([
+        { role: "publisher", identity: trust.report.author, keyId: trust.report.keyId, custody: "same-operator" },
+        ...trust.evaluators.flatMap((entry) => {
+            const roles = [];
+            // The trust set equals verdicts + reviewers, so "in neither" is unreachable; if a future
+            // widening makes it reachable, a signer must still be shown rather than silently dropped.
+            if (verdictEvaluators.has(entry.evaluator) || !reviewers.has(entry.evaluator))
+                roles.push("automated-grader");
+            if (reviewers.has(entry.evaluator))
+                roles.push("human-reviewer");
+            return roles.map((role) => ({
+                role,
+                identity: entry.evaluator,
+                keyId: entry.keyId,
+                custody: "same-operator",
+            }));
+        }),
+    ]);
+}
+// Keyed to the purpose union rather than to `string`, so a protocol widening is a build failure
+// here instead of an `undefined` role reaching the reader's screen.
+const EVIDENCE_NATIVE_PURPOSE_ROLES = {
+    report: "publisher",
+    "automated-evaluator": "automated-grader",
+    "human-reviewer": "human-reviewer",
+    "label-admission": "label-admission",
+};
+/**
+ * Signers of a v5 evidence-native bundle, read from the same authenticated `claim-package.json`
+ * bytes the closure verified.
+ *
+ * `claim.trust.signers` is a publisher-written declaration used by the closure only as a lookup
+ * table: a surplus entry there is never contradicted, because no signature ever selects it. So this
+ * keeps only the keys that actually carried a signature the closure accepted
+ * (`verifiedSignerKeyIds`). Without that filter a bundle could declare a human reviewer, or a dozen
+ * graders, that signed nothing and have the checker print them as fact. The claim package declares
+ * no custody, so nothing here upgrades a signer to same-operator either.
+ */
+export function evidenceNativeBundleSigners(claimPackageBytes, verifiedSignerKeyIds) {
+    const verified = new Set(verifiedSignerKeyIds);
+    return deduplicate(parseEvidenceNativeClaimPackageV3(claimPackageBytes).trust.signers
+        .filter((signer) => verified.has(signer.keyId))
+        .map((signer) => ({
+        role: EVIDENCE_NATIVE_PURPOSE_ROLES[signer.purpose],
+        identity: signer.identity,
+        keyId: signer.keyId,
+        custody: "undeclared",
+    })));
+}

package/dist/verify.d.ts

@@ -1,15 +1,21 @@
 import { type EvidenceNativePortableBundleVerification } from "@jinn-network/benchmarking-evidence";
+import { type PublicBundleSigner } from "./signers.js";
 import { type InspectRuntimeMethodDisclosure } from "./profile/inspect-disclosure.js";
 import { type PublicComparisonView } from "./comparison.js";
 import { type VerifiedBundleSnapshot, type VerifyBundleSnapshotDeps } from "./manifest.js";
+import { type DisclosureSpecificationReport } from "./profile/disclosure.js";
 import { type IntegrityAnchorsReport, type PublicBundleAnchorTrustMaterial } from "./anchor/check.js";
 import { type BinaryItemBankEntry, type BinarySourceManifestEntry } from "./admission/intake.js";
 export type PublicBundleVerificationCheck = "manifest" | "evidence-closure" | "trust" | "matrix-rederivation" | "report-verification" | "claim-consistency"
-/** Always present for `benchmark-product-public-bundle/6`, never for any earlier closure
- * (anchor-evidence design §8, §12). */
- | "integrity-anchors";
-export interface LegacyPublicBundleVerificationResult {
-    readonly format: "benchmark-product-public-bundle/2" | "benchmark-product-public-bundle/4" | "benchmark-product-public-bundle/6";
+/** Always present for the anchored closures, `benchmark-product-public-bundle/6`, `/7`, and `/8`,
+ * never for any earlier one (anchor-evidence design §8, §12). */
+ | "integrity-anchors"
+/** Always present for `benchmark-product-public-bundle/8`, never for any earlier closure
+ * (disclosure-specification-record design §7, issue #2839). Runs last: the claim's `disclosure`
+ * section is among the things it depends on having already been byte-compared. */
+ | "disclosure-specification";
+export interface LegacyPublicBundleVerificationResult extends PublicBundleSignerDisclosure {
+    readonly format: "benchmark-product-public-bundle/2" | "benchmark-product-public-bundle/4" | "benchmark-product-public-bundle/6" | "benchmark-product-public-bundle/7" | "benchmark-product-public-bundle/8";
     readonly identity: string;
     readonly checks: readonly PublicBundleVerificationCheck[];
     readonly benchmarkSha256: string;
@@ -22,6 +28,10 @@ export interface LegacyPublicBundleVerificationResult {
      * subject's context outcome (anchor-evidence design §8). Statuses are disclosed facts, not a
      * summary — nothing here is folded into a single verified badge. */
     readonly anchors?: IntegrityAnchorsReport;
+    /** Present exactly for the disclosed closure (issue #2839, design §7 step 11): the sealed record's
+     * identity and all six variables' statuses. Statuses are DISCLOSED FACTS, never folded into a
+     * single badge and never counted — the same posture `anchors` takes, and for the same reason. */
+    readonly disclosure?: DisclosureSpecificationReport;
     readonly qualification?: {
         readonly publicationGrade: boolean;
         readonly truthAdmission: "two-human-unanimous" | "operator-only" | "screened-operator-sampled";
@@ -32,7 +42,11 @@ export interface LegacyPublicBundleVerificationResult {
         readonly exclusionCount: number;
     };
 }
-export type PublicBundleVerificationResult = LegacyPublicBundleVerificationResult | EvidenceNativePortableBundleVerification;
+/** Who signed the bundle, with the identifiers the human surface deliberately does not print. */
+export interface PublicBundleSignerDisclosure {
+    readonly signers?: readonly PublicBundleSigner[];
+}
+export type PublicBundleVerificationResult = LegacyPublicBundleVerificationResult | (EvidenceNativePortableBundleVerification & PublicBundleSignerDisclosure);
 export interface VerifyPublicBundleDeps extends VerifyBundleSnapshotDeps {
     /**
      * Trust material for the `integrity-anchors` check (anchor-evidence design §8 step 3): timestamp

package/dist/verify.js

@@ -2,16 +2,17 @@ import { createHash, createPublicKey, verify as verifySignature } from "node:cry
 import { verifyReport } from "@jinn-network/benchmarking-aggregate";
 import { verifyEvidenceNativePortableBundle, } from "@jinn-network/benchmarking-evidence";
 import { exportStaticBundle } from "@jinn-network/benchmarking-interop";
-import { cellIdempotencyKey, expectedCellSet, parseBenchmark, parseMatrix, parseReport, parseRun, readRunAnchorIntentExtension, readRunPublicationExtension, } from "@jinn-network/benchmarking-records";
+import { DISCLOSURE_SPECIFICATION_EXTENSION, cellIdempotencyKey, expectedCellSet, parseBenchmark, parseMatrix, parseReport, parseRun, readReportDisclosureExtension, readRunAnchorIntentExtension, readRunPublicationExtension, } from "@jinn-network/benchmarking-records";
 import { verifyMatrix } from "@jinn-network/benchmarking-run";
 import { BINARY_JUDGMENT_INSTRUMENT_REQUIREMENT_KEY, BINARY_JUDGMENT_PROFILE_URI, BinaryJudgmentSnapshotProbeSchema, deriveEvaluationTask, parseBinaryJudgmentAnalysisContext, parseBinaryJudgmentInstrument, parseEvaluationSpec, } from "@jinn-network/task-execution-profiles";
 import { DeliveryRecordSchema, SubmissionRecordSchema, TaskSpecificationSchema } from "@jinn-network/task-execution-protocol";
 import { canonicalJsonBytes, dssePreAuthEncoding, parseExactDsseEnvelope } from "@jinn-network/trust-core";
 import { refuse } from "./profile/errors.js";
-import { ClaimPackageSchema } from "./profile/claim.js";
+import { BINARY_QUALIFICATION_CLAIM_PACKAGE_SCHEMA_ID, ClaimPackageSchema, DISCLOSED_CLAIM_PACKAGE_SCHEMA_ID, } from "./profile/claim.js";
 import { buildMethodPortsFromResolver } from "./profile/ports.js";
 import { didKeyFromEd25519PublicKey } from "./profile/signing.js";
 import { buildPublicReportTrustDeps } from "./profile/trust.js";
+import { evidenceNativeBundleSigners, legacyBundleSigners } from "./signers.js";
 import { buildAssemblyPortsFromFacts } from "./profile/assembly-ports.js";
 import { parseRunPinningEvidenceArtifact, pinningEvidenceFacts, } from "./profile/pinning-evidence.js";
 import { parsePredictionSnapshotAdmissionReceipt, } from "./profile/admission-receipts.js";
@@ -23,11 +24,13 @@ import { InspectSelectionManifestSchema, isInspectMultiScorerSelection, } from "
 import { describeInspectRuntimeMethod, } from "./profile/inspect-disclosure.js";
 import { deriveInspectEvaluationStrategy, INSPECT_SEPARATE_ASSURANCE_LIMITATIONS, inspectLogVerifierMethod, } from "./profile/inspect-assurance.js";
 import { assertClaimConsistency } from "./profile/claim-consistency.js";
+import { assertTaskSelectionConsistency } from "./profile/task-selection.js";
 import { buildPublicAssets } from "./assets.js";
 import { derivePublicComparison } from "./comparison.js";
 import { verifyBundleSnapshot, } from "./manifest.js";
 import { PUBLIC_BUNDLE_FILES, PUBLIC_BUNDLE_V4_FILES } from "./materialize.js";
-import { BUNDLE_V4_FORMAT, BUNDLE_V5_FORMAT, BUNDLE_V6_FORMAT } from "./manifest.js";
+import { BUNDLE_V4_FORMAT, BUNDLE_V5_FORMAT, BUNDLE_V6_FORMAT, BUNDLE_V7_FORMAT, BUNDLE_V8_FORMAT } from "./manifest.js";
+import { DISCLOSURE_SPECIFICATION_BUNDLE_ROLE, DisclosureProjectionError, assertDisclosureSpecification, deriveDisclosureSpecification, } from "./profile/disclosure.js";
 import { evaluateIntegrityAnchors, } from "./anchor/check.js";
 import { ClaimAnchorProjectionError, deriveClaimAnchors } from "./profile/anchor-claims.js";
 import { verifyBinaryJudgmentAdmissionClosure, } from "./admission/verification.js";
@@ -214,13 +217,54 @@ export function checkItemBankSourceClosure(itemRows, sourceRows) {
  * public keys. No pathname is reopened after manifest authentication. */
 export async function verifyPublicBundleSnapshot(bundleDir, deps = {}) {
     const checked = verifyBundleSnapshot(bundleDir, deps);
+    // ── G0, the closure-INDEPENDENT extension guard (disclosure design §7 preamble, issue #2839) ──
+    //
+    // A Report carrying `DISCLOSURE_SPECIFICATION_EXTENSION` on any format other than `/8` refuses,
+    // here, before the format branch — so this holds for `/2`, `/4`, `/5`, `/6`, and `/7` alike, the
+    // evidence-native path included.
+    //
+    // Without it there is a real hole: a `/7` bundle could carry both the extension and the record,
+    // have the record's role derived by the extension edge, satisfy the evidence-closure reachability
+    // guard, and never be looked at by any check — because the named check runs only on `/8`. G0
+    // closes that direction; the evidence closure's own size and per-digest guards close the
+    // complementary one (role present, extension absent). The two together are what make the
+    // extension and the closure inseparable.
+    //
+    // Read deliberately at the JSON level rather than through `parseReport`: this must fire on a
+    // format whose `report.json` this function never otherwise parses, and it must fire on the
+    // extension's PRESENCE, not on its well-formedness.
+    if (checked.manifest.format !== BUNDLE_V8_FORMAT) {
+        const carriedReport = checked.fileBytes.get("report.json");
+        if (carriedReport !== undefined) {
+            let parsedReportJson;
+            try {
+                parsedReportJson = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(carriedReport));
+            }
+            catch {
+                parsedReportJson = undefined;
+            }
+            if (typeof parsedReportJson === "object" && parsedReportJson !== null && !Array.isArray(parsedReportJson)
+                && parsedReportJson[DISCLOSURE_SPECIFICATION_EXTENSION] !== undefined) {
+                refuse("record-integrity", "report.json", `a Report carrying ${DISCLOSURE_SPECIFICATION_EXTENSION} is publishable only on`
+                    + ` ${BUNDLE_V8_FORMAT}, whose disclosure-specification check reads it; this bundle`
+                    + ` declares ${checked.manifest.format}`);
+            }
+        }
+    }
     if (checked.manifest.format === BUNDLE_V5_FORMAT) {
         try {
+            const claimPackageBytes = checked.fileBytes.get("claim-package.json");
+            if (claimPackageBytes === undefined)
+                throw new TypeError("portable bundle is missing claim-package.json");
+            const verification = await verifyEvidenceNativePortableBundle({
+                files: checked.fileBytes,
+                verifySignature: verifyEvidenceNativeSignature,
+            });
             return {
-                verification: await verifyEvidenceNativePortableBundle({
-                    files: checked.fileBytes,
-                    verifySignature: verifyEvidenceNativeSignature,
-                }),
+                verification: {
+                    ...verification,
+                    signers: evidenceNativeBundleSigners(claimPackageBytes, verification.verifiedSignerKeyIds),
+                },
                 snapshot: checked,
             };
         }
@@ -236,17 +280,25 @@ export async function verifyPublicBundleSnapshot(bundleDir, deps = {}) {
     };
     const checks = ["manifest"];
     const manifestPaths = new Set(checked.manifest.files.map((file) => file.path));
-    const isV4 = checked.manifest.format === BUNDLE_V4_FORMAT;
-    // The anchored closure is v2's graph plus `anchors/`, so it takes v2's mandatory member list; the
-    // binary qualification projection has its own later anchored allocation and is not this one.
-    const isV6 = checked.manifest.format === BUNDLE_V6_FORMAT;
-    const mandatoryFiles = isV4 ? PUBLIC_BUNDLE_V4_FILES : PUBLIC_BUNDLE_FILES;
+    // Three independent axes, five formats. The qualification axis decides the mandatory member list,
+    // the evidence-catalog grammar, and the trust grammar; the anchor axis decides the `anchors/`
+    // allowlist and the `integrity-anchors` check; the disclosure axis decides the Report-extension
+    // edge and the `disclosure-specification` check. v6 is v2 plus anchors, v7 is v4 plus anchors
+    // (issue #3205), v8 is v7 plus disclosure (issue #2839) — no axis reinterprets another.
+    const carriesQualification = checked.manifest.format === BUNDLE_V4_FORMAT
+        || checked.manifest.format === BUNDLE_V7_FORMAT
+        || checked.manifest.format === BUNDLE_V8_FORMAT;
+    const carriesAnchors = checked.manifest.format === BUNDLE_V6_FORMAT
+        || checked.manifest.format === BUNDLE_V7_FORMAT
+        || checked.manifest.format === BUNDLE_V8_FORMAT;
+    const carriesDisclosure = checked.manifest.format === BUNDLE_V8_FORMAT;
+    const mandatoryFiles = carriesQualification ? PUBLIC_BUNDLE_V4_FILES : PUBLIC_BUNDLE_FILES;
     for (const path of mandatoryFiles) {
         if (!manifestPaths.has(path))
             refuse("record-integrity", path, `mandatory public bundle file "${path}" is missing`);
     }
     const evidenceBytes = read("evidence.json");
-    const evidence = isV4
+    const evidence = carriesQualification
         ? parseJson(evidenceBytes, BundleV4EvidenceCatalogSchema, "evidence.json")
         : parseJson(evidenceBytes, BundleEvidenceCatalogSchema, "evidence.json");
     requireCanonical(evidenceBytes, evidence, "evidence.json");
@@ -263,10 +315,10 @@ export async function verifyPublicBundleSnapshot(bundleDir, deps = {}) {
         if (/^native\/inspect\/[a-f0-9]{64}\.eval$/u.test(path))
             expectedPaths.add(path);
     }
-    // `anchors/<sha256>.bin` is allowlisted only by the closure version that defines it: an anchor
-    // member in a v2 or v4 bundle is a non-allowlisted file, exactly as it was before this format.
+    // `anchors/<sha256>.bin` is allowlisted only by the closure versions that define it: an anchor
+    // member in a v2 or v4 bundle is a non-allowlisted file, exactly as it was before these formats.
     const anchorPaths = [];
-    if (isV6) {
+    if (carriesAnchors) {
         for (const path of manifestPaths) {
             if (/^anchors\/[a-f0-9]{64}\.bin$/u.test(path)) {
                 expectedPaths.add(path);
@@ -290,7 +342,7 @@ export async function verifyPublicBundleSnapshot(bundleDir, deps = {}) {
         declaredRoles.set(record.sha256, new Set(record.roles));
     }
     const trustBytes = read("trust/public-keys.json");
-    const trust = isV4
+    const trust = carriesQualification
         ? parseJson(trustBytes, BundleV4TrustSchema, "trust/public-keys.json")
         : parseJson(trustBytes, BundleTrustSchema, "trust/public-keys.json");
     requireCanonical(trustBytes, trust, "trust/public-keys.json");
@@ -300,7 +352,7 @@ export async function verifyPublicBundleSnapshot(bundleDir, deps = {}) {
         { keyId: entry.keyId, publicKey: publicKey(entry.spkiDerBase64, `trust.evaluators.${entry.evaluator}`) },
     ]));
     let qualification;
-    if (isV4) {
+    if (carriesQualification) {
         const qualificationBytes = read("qualification.json");
         qualification = parseJson(qualificationBytes, BundleQualificationSchema, "qualification.json");
         requireCanonical(qualificationBytes, qualification, "qualification.json");
@@ -348,7 +400,7 @@ export async function verifyPublicBundleSnapshot(bundleDir, deps = {}) {
     // empty section and an omitted one are different claims, and §7.3's declared-but-absent bundle
     // carries the first.
     let claimAnchors;
-    if (isV6) {
+    if (carriesAnchors) {
         const anchorRecords = anchorPaths
             .map((path) => {
             const bytes = read(path);
@@ -384,6 +436,33 @@ export async function verifyPublicBundleSnapshot(bundleDir, deps = {}) {
             throw cause;
         }
     }
+    // ── The disclosed closure's Report-extension edge and claim projection (issue #2839) ────────
+    //
+    // Read here, beside the anchors, and for the same two reasons: the evidence-closure walk below
+    // needs the edge to derive the record's role, and `assertClaimConsistency` needs the projection to
+    // rebuild the claim from the RECORD'S OWN BYTES rather than from the claim under test.
+    let disclosureExtensionDigest;
+    let claimDisclosure;
+    if (carriesDisclosure) {
+        const descriptor = readReportDisclosureExtension(report);
+        if (descriptor === undefined) {
+            refuse("record-integrity", "disclosure-specification", `a ${BUNDLE_V8_FORMAT} bundle must carry ${DISCLOSURE_SPECIFICATION_EXTENSION} on its Report`);
+        }
+        disclosureExtensionDigest = descriptor.digest.sha256;
+        const disclosureBytes = records.get(disclosureExtensionDigest);
+        if (disclosureBytes === undefined) {
+            refuse("record-integrity", `records/${disclosureExtensionDigest}.bin`, "the bundle does not carry the disclosure-specification record its Report names");
+        }
+        try {
+            claimDisclosure = deriveDisclosureSpecification(disclosureBytes);
+        }
+        catch (cause) {
+            if (cause instanceof DisclosureProjectionError) {
+                refuse("record-integrity", `records/${disclosureExtensionDigest}.bin`, cause.message);
+            }
+            throw cause;
+        }
+    }
     const assembly = parseAssembly(read("verification/assembly.jsonl"));
     const expectedNativePaths = new Set(assembly.header.graph.solveDeliveries.flatMap((delivery) => delivery.outputs
         .filter((output) => output.name === "inspect-log")
@@ -415,6 +494,18 @@ export async function verifyPublicBundleSnapshot(bundleDir, deps = {}) {
     const cellsByKey = new Map(assembly.cells.map((cell) => [cell.cellKey, cell]));
     const coordinatesByKey = new Map(expectedCoordinates.map((coord) => [coord.cellKey, coord]));
     const expectedRoles = new Map();
+    // ── The disclosed closure's one graph edge (issue #2839, design §6.2 / §10.2) ───────────────
+    //
+    // The Report extension IS the edge: it is the only thing that derives the
+    // `disclosure-specification` role for any record. Adding it here — and only on `/8` — is what
+    // makes the two refusals in §6.5.2 fire on every other format without a bespoke guard. A
+    // standalone disclosure record on a `/7` bundle makes `declaredRoles` exceed `expectedRoles` and
+    // trips the size compare; the role appended to an existing graph record's array leaves the sizes
+    // equal and trips the per-digest compare instead. Both refusals already existed and cannot be
+    // forgotten.
+    if (disclosureExtensionDigest !== undefined) {
+        addRole(expectedRoles, disclosureExtensionDigest, DISCLOSURE_SPECIFICATION_BUNDLE_ROLE);
+    }
     const evaluationSpecs = new Map();
     const taskSpecs = new Map();
     const inspectSelections = new Map();
@@ -1476,6 +1567,11 @@ export async function verifyPublicBundleSnapshot(bundleDir, deps = {}) {
     if (!equalBytes(canonicalJsonBytes(verifiedReport.record), reportBytes))
         refuse("record-integrity", "report-verification", "verified Report payload does not match report.json");
     checks.push("report-verification");
+    // Task-selection provenance (#2980). Runs under the `claim-consistency` check because that is
+    // exactly the question it answers -- does the claim's declared selection survive contact with
+    // the records? -- and because the claim pins the check list byte-for-byte, so a new named check
+    // would be a bundle-format bump rather than an addition.
+    assertTaskSelectionConsistency({ benchmarkRecord: benchmark, runRecord: run });
     assertClaimConsistency({
         claim,
         identities,
@@ -1490,12 +1586,41 @@ export async function verifyPublicBundleSnapshot(bundleDir, deps = {}) {
             : {}),
         ...(assembly.header.rehearsal === undefined ? {} : { rehearsal: assembly.header.rehearsal }),
         ...(claimAnchors === undefined ? {} : { anchors: claimAnchors }),
+        ...(claimDisclosure === undefined ? {} : { disclosure: claimDisclosure }),
     });
     checks.push("claim-consistency");
-    // Always present for this closure version, and never for any earlier one: an anchored bundle
-    // whose anchors were stripped is a closure failure above, not a shorter check list here.
-    if (isV6)
+    // Always present for the anchored closure versions, and never for any earlier one: an anchored
+    // bundle whose anchors were stripped is a closure failure above, not a shorter check list here.
+    if (carriesAnchors)
         checks.push("integrity-anchors");
+    // ── disclosure-specification (issue #2839, design §7 steps 1-9) ────────────────────────────
+    //
+    // Runs after `claim-consistency` because step 10 — projection equality — is delivered BY that
+    // check's existing whole-claim byte-compare rather than by a second comparison here. What is left
+    // for this block is authenticating the record itself and pairing the two claim identifiers.
+    let disclosureReport;
+    if (carriesDisclosure) {
+        // Step 9: claim-id pairing. `qualification.json`'s `claimSchema` names WHICH PROJECTION SHAPE
+        // the qualification graph was built for, and that shape is claim-package/2's on every binary
+        // allocation — so the frozen literal does not move, while `claim-package.json` declares the
+        // closure. Either field carrying the other's value refuses, so the two cannot drift together.
+        if (claim.claimSchema !== DISCLOSED_CLAIM_PACKAGE_SCHEMA_ID) {
+            refuse("record-integrity", "claim-package.json", `a ${BUNDLE_V8_FORMAT} bundle's claim must declare ${DISCLOSED_CLAIM_PACKAGE_SCHEMA_ID}`);
+        }
+        if (qualification?.claimSchema !== BINARY_QUALIFICATION_CLAIM_PACKAGE_SCHEMA_ID) {
+            refuse("record-integrity", "qualification.json", `a ${BUNDLE_V8_FORMAT} bundle's qualification document must keep its frozen`
+                + ` ${BINARY_QUALIFICATION_CLAIM_PACKAGE_SCHEMA_ID} projection literal`);
+        }
+        disclosureReport = assertDisclosureSpecification({
+            extensionDigestSha256: disclosureExtensionDigest,
+            catalogRoles: declaredRoles,
+            recordBytes: records,
+            matrixSha256: identities.matrixSha256,
+            reportAuthor: verifiedReport.record.author,
+            refuse: (path, message) => refuse("record-integrity", path, message),
+        });
+        checks.push("disclosure-specification");
+    }
     const dissentCellKeys = assembly.cells
         .filter((cell) => new Set(cell.verdicts.map((verdict) => verdict.verdict)).size > 1)
         .map((cell) => cell.cellKey)
@@ -1520,17 +1645,15 @@ export async function verifyPublicBundleSnapshot(bundleDir, deps = {}) {
         }),
         dissentCellKeys,
     };
-    // Reader v1 remains able to authenticate bundles published before the
-    // human comparison projection existed. A bundle must match one complete,
-    // deterministic presentation profile; individual assets cannot be mixed.
-    const legacyAssets = qualification === undefined ? buildPublicAssets(assetFacts) : undefined;
-    const isLegacyPresentation = legacyAssets !== undefined
-        && Object.entries(legacyAssets).every(([path, bytes]) => equalBytes(read(path), bytes));
+    // The closure selects the presentation profile and the bundle must byte-match that one
+    // profile completely — assets cannot be mixed, and there is no second profile to fall back
+    // to (issue #2984). A qualification-projecting bundle (`/4`, `/7`) renders the
+    // instrument-qualification graph; every other one renders the human comparison, which
+    // `derivePublicComparison` above always produces. The comparison-absent rendering a
+    // pre-comparison producer would have written is therefore no bundle's profile.
     const expectedAssets = qualification !== undefined
         ? buildPublicAssets({ ...assetFacts, binaryQualification: binaryAssetQualification })
-        : isLegacyPresentation
-            ? legacyAssets
-            : buildPublicAssets({ ...assetFacts, comparison });
+        : buildPublicAssets({ ...assetFacts, comparison });
     for (const [path, bytes] of Object.entries(expectedAssets)) {
         if (!equalBytes(read(path), bytes))
             refuse("record-integrity", path, `${path} is not the exact projection of verified public facts`);
@@ -1547,9 +1670,11 @@ export async function verifyPublicBundleSnapshot(bundleDir, deps = {}) {
             format: checked.manifest.format,
             identity: checked.identity,
             checks,
+            signers: legacyBundleSigners(trust, new Set(verdictCatalog.verdicts.map((verdict) => verdict.evaluator))),
             ...identities,
             ...(runtimeMethod === undefined ? {} : { runtimeMethod }),
             ...(anchorReport === undefined ? {} : { anchors: anchorReport }),
+            ...(disclosureReport === undefined ? {} : { disclosure: disclosureReport }),
             ...(qualification === undefined ? {} : {
                 qualification: {
                     publicationGrade: qualification.publicationGrade,

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** Public verifier release line. Kept in one module for output and bundle instructions. */
-export declare const VERIFIER_VERSION: "0.2.0";
+export declare const VERIFIER_VERSION: "0.2.1";

package/dist/version.js

@@ -1,2 +1,2 @@
 /** Public verifier release line. Kept in one module for output and bundle instructions. */
-export const VERIFIER_VERSION = "0.2.0";
+export const VERIFIER_VERSION = "0.2.1";