@lapxo/bound 0.1.9 → 0.2.1

package/vectors/native/authenticated-reference-formation.vector.json

@@ -0,0 +1,107 @@
+{
+  "scope": "fixture/authenticated-reference-formation",
+  "measure": "count",
+  "result": "failures",
+  "execution": "independent",
+  "phase": "fixture preparation before independent timed readings; existing public signed places, no private key",
+  "cases": [
+    {
+      "program": "/usr/bin/env",
+      "args": [
+        "bound",
+        "land",
+        "--key",
+        "device"
+      ],
+      "cwd": "samples/authenticated-reference/yes/weather-reading",
+      "inputs": [
+        "samples/authenticated-reference/yes/weather-reading/TARGET.bound"
+      ],
+      "timeoutMs": 10000,
+      "maxBytes": 2097152,
+      "exit": 0,
+      "matches": [
+        {
+          "stream": "stdout",
+          "pattern": "FACT     landed 56 unique lines from 56 in TARGET \u00b7 0 of 56 signed lines fail admission by declared authority"
+        }
+      ]
+    },
+    {
+      "program": "/usr/bin/env",
+      "args": [
+        "bound",
+        "land",
+        "--key",
+        "device"
+      ],
+      "cwd": "samples/authenticated-reference/yes/editorial-state",
+      "inputs": [
+        "samples/authenticated-reference/yes/editorial-state/TARGET.bound"
+      ],
+      "timeoutMs": 10000,
+      "maxBytes": 2097152,
+      "exit": 0,
+      "matches": [
+        {
+          "stream": "stdout",
+          "pattern": "FACT     landed 56 unique lines from 56 in TARGET \u00b7 0 of 56 signed lines fail admission by declared authority"
+        }
+      ]
+    },
+    {
+      "program": "runtime",
+      "args": [
+        "../../../dist/cli/verb.js",
+        "land"
+      ],
+      "cwd": "samples/wasm/water-level",
+      "inputs": [
+        "dist/cli/verb.js",
+        "dist/wasm/node-worker.js",
+        "package.json",
+        "assets/wasm/manifest.json",
+        "assets/wasm/runtime.js",
+        "assets/wasm/runtime.wasm",
+        "assets/wasm/guest.js",
+        "samples/wasm/water-level/TARGET.bound"
+      ],
+      "timeoutMs": 20000,
+      "maxBytes": 1048576,
+      "exit": 0,
+      "matches": [
+        {
+          "stream": "stdout",
+          "pattern": "FACT\\s+landed"
+        }
+      ]
+    },
+    {
+      "program": "runtime",
+      "args": [
+        "../../../dist/cli/verb.js",
+        "land"
+      ],
+      "cwd": "samples/wasm/editorial-notes",
+      "inputs": [
+        "dist/cli/verb.js",
+        "dist/wasm/node-worker.js",
+        "package.json",
+        "assets/wasm/manifest.json",
+        "assets/wasm/runtime.js",
+        "assets/wasm/runtime.wasm",
+        "assets/wasm/guest.js",
+        "samples/wasm/editorial-notes/TARGET.bound"
+      ],
+      "timeoutMs": 20000,
+      "maxBytes": 1048576,
+      "exit": 0,
+      "matches": [
+        {
+          "stream": "stdout",
+          "pattern": "FACT\\s+landed"
+        }
+      ]
+    }
+  ]
+}

package/vectors/native/authenticated-reference.cli.json

@@ -0,0 +1,157 @@
+{
+  "profile": "native-cli-protocol-captures@1",
+  "projection": "SOURCE,CELL,AUTHENTICATED stdout records and named stderr refusal; duplicate TOPOS data excluded explicitly; full raw output digests retained",
+  "cases": [
+    {
+      "place": "weather-reading",
+      "case": "yes",
+      "status": 0,
+      "stdoutRecords": [
+        "SOURCE   fixture://carrier/yes",
+        "CELL {\"cell\":\"weather/temperature\",\"state\":\"REQUIRED\",\"parts\":{\"floor\":{\"lo\":2,\"hi\":3},\"ceiling\":{\"lo\":2,\"hi\":3},\"origins\":[{\"id\":\"claim-first\",\"at\":3,\"origin\":\"origin-one\",\"span\":{\"lo\":2,\"hi\":3}}],\"rest\":[],\"required\":{\"lo\":0,\"hi\":10},\"signed\":{\"lo\":0,\"hi\":6}},\"rest\":[],\"ownMarks\":[\"parent-ceiling\"],\"ownClaims\":[{\"id\":\"claim-first\",\"origin\":\"origin-one\"}],\"marks\":[{\"pole\":\"ceiling\",\"reach\":\"travels\",\"span\":{\"lo\":0,\"hi\":6},\"id\":\"parent-ceiling\",\"at\":3}],\"claims\":[{\"id\":\"claim-first\",\"at\":3,\"origin\":\"origin-one\",\"span\":{\"lo\":2,\"hi\":3}}]}",
+        "CELL {\"cell\":\"weather/indoor\",\"state\":\"REQUIRED\",\"parts\":{\"floor\":{\"lo\":0,\"hi\":10},\"ceiling\":{\"lo\":0,\"hi\":9},\"origins\":[],\"rest\":[\"weather/temperature\"],\"required\":{\"lo\":0,\"hi\":10},\"signed\":{\"lo\":0,\"hi\":9}},\"rest\":[\"weather/temperature\"],\"ownMarks\":[\"child-join\"],\"ownClaims\":[],\"marks\":[{\"pole\":\"ceiling\",\"reach\":\"local\",\"span\":{\"lo\":0,\"hi\":9},\"widens\":\"parent-ceiling\",\"at\":4,\"id\":\"child-join\"}],\"claims\":[]}",
+        "AUTHENTICATED standing sha256:6bb526807d02f1072556d3dea7cb05227e4cdeb1747219c93c3fc950b2617fd8 \u00b7 authority sha256:5798403c3964ef08ad14de4cb5c8dcba9680e3d52ac29740b995f7c7da3fb4e5 \u00b7 no effects committed"
+      ],
+      "stderrRefusal": "",
+      "rawOutputDigest": "sha256:c75cff416ff786a03d74d63ed2c53d0070d47eb29b3ff6ab3ae76ca2b501130c"
+    },
+    {
+      "place": "editorial-state",
+      "case": "yes",
+      "status": 0,
+      "stdoutRecords": [
+        "SOURCE   fixture://carrier/yes",
+        "CELL {\"cell\":\"editorial/state\",\"state\":\"REQUIRED\",\"parts\":{\"floor\":{\"words\":{\"0\":1},\"width\":3},\"ceiling\":{\"words\":{\"0\":1},\"width\":3},\"origins\":[{\"id\":\"claim-first\",\"at\":3,\"origin\":\"origin-one\",\"span\":{\"words\":{\"0\":1},\"width\":3}}],\"rest\":[],\"required\":{\"words\":{\"0\":7},\"width\":3},\"signed\":{\"words\":{\"0\":3},\"width\":3}},\"rest\":[],\"ownMarks\":[\"parent-ceiling\"],\"ownClaims\":[{\"id\":\"claim-first\",\"origin\":\"origin-one\"}],\"marks\":[{\"pole\":\"ceiling\",\"reach\":\"travels\",\"span\":{\"words\":{\"0\":3},\"width\":3},\"id\":\"parent-ceiling\",\"at\":3}],\"claims\":[{\"id\":\"claim-first\",\"at\":3,\"origin\":\"origin-one\",\"span\":{\"words\":{\"0\":1},\"width\":3}}]}",
+        "CELL {\"cell\":\"editorial/review\",\"state\":\"REQUIRED\",\"parts\":{\"floor\":{\"words\":{\"0\":7},\"width\":3},\"ceiling\":{\"words\":{\"0\":7},\"width\":3},\"origins\":[],\"rest\":[\"editorial/state\"],\"required\":{\"words\":{\"0\":7},\"width\":3},\"signed\":{\"words\":{\"0\":7},\"width\":3}},\"rest\":[\"editorial/state\"],\"ownMarks\":[\"child-join\"],\"ownClaims\":[],\"marks\":[{\"pole\":\"ceiling\",\"reach\":\"local\",\"span\":{\"words\":{\"0\":7},\"width\":3},\"widens\":\"parent-ceiling\",\"at\":4,\"id\":\"child-join\"}],\"claims\":[]}",
+        "AUTHENTICATED standing sha256:48ed60f5bc98aaed5a0818087e2b5b1d0e63000bb3b8dbd1e97bd250b097106c \u00b7 authority sha256:304d0960aa94aaeb51baf2f5d3afbfb70525595bd40ff6bb670d6d741f92742c \u00b7 no effects committed"
+      ],
+      "stderrRefusal": "",
+      "rawOutputDigest": "sha256:6a22b911a06532cab7e1ae12d44e93e068856e956f2cacc18a28651e8f955e1f"
+    },
+    {
+      "place": "weather-reading",
+      "case": "signature",
+      "status": 1,
+      "stdoutRecords": [],
+      "stderrRefusal": "instrument: REFUSE\u00b7authenticated-reference original grey the signature does not hold for device",
+      "rawOutputDigest": "sha256:f043d89abb781deedff44dc4b9cafdbdd2cb831733eb1678ab87f2e29d703dcc"
+    },
+    {
+      "place": "weather-reading",
+      "case": "coverage",
+      "status": 1,
+      "stdoutRecords": [],
+      "stderrRefusal": "instrument: REFUSE\u00b7authenticated-reference original refuse REFUSE\u00b7authority attester does not cover weather/temperature",
+      "rawOutputDigest": "sha256:c1b666a865ec09335abcc5c9c8e89635002c48fddafcd20edcd6a88438130d87"
+    },
+    {
+      "place": "weather-reading",
+      "case": "era",
+      "status": 1,
+      "stdoutRecords": [],
+      "stderrRefusal": "instrument: REFUSE\u00b7authenticated-reference proof grey the signature does not hold for device",
+      "rawOutputDigest": "sha256:3b3639301ecb7bc26b322ac2e19c7f2d035b75b62fe2f9712303ca12f0c1c9ac"
+    },
+    {
+      "place": "weather-reading",
+      "case": "order",
+      "status": 1,
+      "stdoutRecords": [],
+      "stderrRefusal": "instrument: REFUSE\u00b7object context: cell not declared before claim-first",
+      "rawOutputDigest": "sha256:b30e83ea7041f2b1dbf430221cb44b7325d50e50077a6d8c4dac7b3be07b3a8c"
+    },
+    {
+      "place": "weather-reading",
+      "case": "arrival",
+      "status": 0,
+      "stdoutRecords": [
+        "SOURCE   fixture://carrier/arrival",
+        "CELL {\"cell\":\"weather/temperature\",\"state\":\"REQUIRED\",\"parts\":{\"floor\":{\"lo\":2,\"hi\":3},\"ceiling\":{\"lo\":2,\"hi\":3},\"origins\":[{\"id\":\"claim-first\",\"at\":3,\"origin\":\"origin-one\",\"span\":{\"lo\":2,\"hi\":3}}],\"rest\":[],\"required\":{\"lo\":0,\"hi\":10},\"signed\":{\"lo\":0,\"hi\":6}},\"rest\":[],\"ownMarks\":[\"parent-ceiling\"],\"ownClaims\":[{\"id\":\"claim-first\",\"origin\":\"origin-one\"}],\"marks\":[{\"pole\":\"ceiling\",\"reach\":\"travels\",\"span\":{\"lo\":0,\"hi\":6},\"id\":\"parent-ceiling\",\"at\":3}],\"claims\":[{\"id\":\"claim-first\",\"at\":3,\"origin\":\"origin-one\",\"span\":{\"lo\":2,\"hi\":3}}]}",
+        "CELL {\"cell\":\"weather/indoor\",\"state\":\"REQUIRED\",\"parts\":{\"floor\":{\"lo\":0,\"hi\":10},\"ceiling\":{\"lo\":0,\"hi\":9},\"origins\":[],\"rest\":[\"weather/temperature\"],\"required\":{\"lo\":0,\"hi\":10},\"signed\":{\"lo\":0,\"hi\":9}},\"rest\":[\"weather/temperature\"],\"ownMarks\":[\"child-join\"],\"ownClaims\":[],\"marks\":[{\"pole\":\"ceiling\",\"reach\":\"local\",\"span\":{\"lo\":0,\"hi\":9},\"widens\":\"parent-ceiling\",\"at\":4,\"id\":\"child-join\"}],\"claims\":[]}",
+        "AUTHENTICATED standing sha256:6bb526807d02f1072556d3dea7cb05227e4cdeb1747219c93c3fc950b2617fd8 \u00b7 authority sha256:5798403c3964ef08ad14de4cb5c8dcba9680e3d52ac29740b995f7c7da3fb4e5 \u00b7 no effects committed"
+      ],
+      "stderrRefusal": "",
+      "rawOutputDigest": "sha256:92be61b9a888bfe90c39995f11e59c80bac2adf1107c42bbacdeba03e8acdb51"
+    },
+    {
+      "place": "weather-reading",
+      "case": "blob",
+      "status": 1,
+      "stdoutRecords": [],
+      "stderrRefusal": "instrument: REFUSE\u00b7authenticated-reference blob integrity",
+      "rawOutputDigest": "sha256:1239171cee7142f85e1175f205b38710b869636ab5d06a7459551b4afedf0f6d"
+    },
+    {
+      "place": "weather-reading",
+      "case": "standing",
+      "status": 1,
+      "stdoutRecords": [],
+      "stderrRefusal": "instrument: REFUSE\u00b7authenticated-reference standing identity",
+      "rawOutputDigest": "sha256:c7c7d3ef55d1911d5cccfa78fb4f8ff59450c9a6a80b413fb101ed5361f3c7ed"
+    },
+    {
+      "place": "editorial-state",
+      "case": "signature",
+      "status": 1,
+      "stdoutRecords": [],
+      "stderrRefusal": "instrument: REFUSE\u00b7authenticated-reference original grey the signature does not hold for device",
+      "rawOutputDigest": "sha256:f043d89abb781deedff44dc4b9cafdbdd2cb831733eb1678ab87f2e29d703dcc"
+    },
+    {
+      "place": "editorial-state",
+      "case": "coverage",
+      "status": 1,
+      "stdoutRecords": [],
+      "stderrRefusal": "instrument: REFUSE\u00b7authenticated-reference original refuse REFUSE\u00b7authority attester does not cover editorial/state",
+      "rawOutputDigest": "sha256:02b7f1f972ab9d3569b3112a945c1adda93a7b7f4403e2a86f81b1469951c06f"
+    },
+    {
+      "place": "editorial-state",
+      "case": "era",
+      "status": 1,
+      "stdoutRecords": [],
+      "stderrRefusal": "instrument: REFUSE\u00b7authenticated-reference proof grey the signature does not hold for device",
+      "rawOutputDigest": "sha256:3b3639301ecb7bc26b322ac2e19c7f2d035b75b62fe2f9712303ca12f0c1c9ac"
+    },
+    {
+      "place": "editorial-state",
+      "case": "order",
+      "status": 1,
+      "stdoutRecords": [],
+      "stderrRefusal": "instrument: REFUSE\u00b7object context: cell not declared before claim-first",
+      "rawOutputDigest": "sha256:b30e83ea7041f2b1dbf430221cb44b7325d50e50077a6d8c4dac7b3be07b3a8c"
+    },
+    {
+      "place": "editorial-state",
+      "case": "arrival",
+      "status": 0,
+      "stdoutRecords": [
+        "SOURCE   fixture://carrier/arrival",
+        "CELL {\"cell\":\"editorial/state\",\"state\":\"REQUIRED\",\"parts\":{\"floor\":{\"words\":{\"0\":1},\"width\":3},\"ceiling\":{\"words\":{\"0\":1},\"width\":3},\"origins\":[{\"id\":\"claim-first\",\"at\":3,\"origin\":\"origin-one\",\"span\":{\"words\":{\"0\":1},\"width\":3}}],\"rest\":[],\"required\":{\"words\":{\"0\":7},\"width\":3},\"signed\":{\"words\":{\"0\":3},\"width\":3}},\"rest\":[],\"ownMarks\":[\"parent-ceiling\"],\"ownClaims\":[{\"id\":\"claim-first\",\"origin\":\"origin-one\"}],\"marks\":[{\"pole\":\"ceiling\",\"reach\":\"travels\",\"span\":{\"words\":{\"0\":3},\"width\":3},\"id\":\"parent-ceiling\",\"at\":3}],\"claims\":[{\"id\":\"claim-first\",\"at\":3,\"origin\":\"origin-one\",\"span\":{\"words\":{\"0\":1},\"width\":3}}]}",
+        "CELL {\"cell\":\"editorial/review\",\"state\":\"REQUIRED\",\"parts\":{\"floor\":{\"words\":{\"0\":7},\"width\":3},\"ceiling\":{\"words\":{\"0\":7},\"width\":3},\"origins\":[],\"rest\":[\"editorial/state\"],\"required\":{\"words\":{\"0\":7},\"width\":3},\"signed\":{\"words\":{\"0\":7},\"width\":3}},\"rest\":[\"editorial/state\"],\"ownMarks\":[\"child-join\"],\"ownClaims\":[],\"marks\":[{\"pole\":\"ceiling\",\"reach\":\"local\",\"span\":{\"words\":{\"0\":7},\"width\":3},\"widens\":\"parent-ceiling\",\"at\":4,\"id\":\"child-join\"}],\"claims\":[]}",
+        "AUTHENTICATED standing sha256:48ed60f5bc98aaed5a0818087e2b5b1d0e63000bb3b8dbd1e97bd250b097106c \u00b7 authority sha256:304d0960aa94aaeb51baf2f5d3afbfb70525595bd40ff6bb670d6d741f92742c \u00b7 no effects committed"
+      ],
+      "stderrRefusal": "",
+      "rawOutputDigest": "sha256:fcdbdaf586d3642b9abf6ce109aa431246902e883e2aaf3305d8db33829d0ef3"
+    },
+    {
+      "place": "editorial-state",
+      "case": "blob",
+      "status": 1,
+      "stdoutRecords": [],
+      "stderrRefusal": "instrument: REFUSE\u00b7authenticated-reference blob integrity",
+      "rawOutputDigest": "sha256:1239171cee7142f85e1175f205b38710b869636ab5d06a7459551b4afedf0f6d"
+    },
+    {
+      "place": "editorial-state",
+      "case": "standing",
+      "status": 1,
+      "stdoutRecords": [],
+      "stderrRefusal": "instrument: REFUSE\u00b7authenticated-reference standing identity",
+      "rawOutputDigest": "sha256:c7c7d3ef55d1911d5cccfa78fb4f8ff59450c9a6a80b413fb101ed5361f3c7ed"
+    }
+  ],
+  "instrument": "actual candidate public CLI; verified transitive context closure before execution",
+  "effects": "no signed state/authority changes or successful partial receipts; private CAS accounting is separate",
+  "platform": "two places, same Mac; not L6"
+}

package/vectors/native/authenticated-reference.vector.json

@@ -0,0 +1,76 @@
+{
+  "scope": "conformance/authenticated-reference-native",
+  "measure": "count",
+  "result": "failures",
+  "execution": "independent",
+  "cases": [
+    {
+      "name": "weather-reading/compatibility",
+      "program": "runtime",
+      "args": [
+        "--experimental-strip-types",
+        "--test",
+        "--test-name-pattern",
+        "legacy authenticated carrier compatibility weather-reading",
+        "test/authenticated-reference-compatibility.test.ts"
+      ],
+      "cwd": ".",
+      "inputs": [
+        "test/authenticated-reference-compatibility.test.ts",
+        "test/support/reference-world.ts",
+        "samples/reference-backend/world-fixture.json",
+        "samples/authenticated-reference/compatibility.json",
+        "samples/authenticated-reference/yes/weather-reading/TARGET.bound",
+        "samples/authenticated-reference/yes/weather-reading/inputs/arrival.json",
+        "samples/authenticated-reference/yes/weather-reading/inputs/coverage.json",
+        "samples/authenticated-reference/yes/weather-reading/inputs/era.json",
+        "samples/authenticated-reference/yes/weather-reading/inputs/order.json",
+        "samples/authenticated-reference/yes/weather-reading/inputs/signature.json",
+        "samples/authenticated-reference/yes/weather-reading/inputs/yes.json"
+      ],
+      "timeoutMs": 10000,
+      "maxBytes": 2097152,
+      "exit": 0,
+      "matches": [
+        {
+          "stream": "stdout",
+          "pattern": "COMPAT weather-reading \u00b7 original signatures \u00b7 yes and arrival byte-equal \u00b7 signature coverage era order blob standing refused \u00b7 native backend required"
+        }
+      ]
+    },
+    {
+      "name": "editorial-state/compatibility",
+      "program": "runtime",
+      "args": [
+        "--experimental-strip-types",
+        "--test",
+        "--test-name-pattern",
+        "legacy authenticated carrier compatibility editorial-state",
+        "test/authenticated-reference-compatibility.test.ts"
+      ],
+      "cwd": ".",
+      "inputs": [
+        "test/authenticated-reference-compatibility.test.ts",
+        "test/support/reference-world.ts",
+        "samples/reference-backend/world-fixture.json",
+        "samples/authenticated-reference/compatibility.json",
+        "samples/authenticated-reference/yes/editorial-state/TARGET.bound",
+        "samples/authenticated-reference/yes/editorial-state/inputs/arrival.json",
+        "samples/authenticated-reference/yes/editorial-state/inputs/coverage.json",
+        "samples/authenticated-reference/yes/editorial-state/inputs/era.json",
+        "samples/authenticated-reference/yes/editorial-state/inputs/order.json",
+        "samples/authenticated-reference/yes/editorial-state/inputs/signature.json",
+        "samples/authenticated-reference/yes/editorial-state/inputs/yes.json"
+      ],
+      "timeoutMs": 10000,
+      "maxBytes": 2097152,
+      "exit": 0,
+      "matches": [
+        {
+          "stream": "stdout",
+          "pattern": "COMPAT editorial-state \u00b7 original signatures \u00b7 yes and arrival byte-equal \u00b7 signature coverage era order blob standing refused \u00b7 native backend required"
+        }
+      ]
+    }
+  ]
+}

package/vectors/native/host-ports.vector.json

@@ -0,0 +1,107 @@
+{
+  "scope": "conformance/host-ports",
+  "measure": "count",
+  "result": "failures",
+  "execution": "independent",
+  "cases": [
+    {
+      "name": "host-ports/0",
+      "program": "runtime",
+      "args": [
+        "--experimental-strip-types",
+        "--test",
+        "--test-name-pattern",
+        "public host ports retain owned bytes and reject failed or interrupted operations",
+        "test/host-ports.test.ts"
+      ],
+      "cwd": ".",
+      "inputs": [
+        "test/host-ports.test.ts",
+        "test/support/reference-root.ts",
+        "test/support/acting-root.ts",
+        "samples/reference-export/yes.json",
+        "samples/reference-export/no.json",
+        "docs/contracts/refusals.bound",
+        "docs/contracts/standing.bound",
+        "assets/wasm/guest.js",
+        "samples/host-ports/yes.json",
+        "samples/host-ports/no.json"
+      ],
+      "timeoutMs": 15000,
+      "maxBytes": 262144,
+      "exit": 0,
+      "matches": [
+        {
+          "stream": "stdout",
+          "pattern": "PORTS owned content \u00b7 verified retention \u00b7 signer content persistence failures \u00b7 budget integrity cancellation timeout refused"
+        }
+      ]
+    },
+    {
+      "name": "host-ports/1",
+      "program": "runtime",
+      "args": [
+        "--experimental-strip-types",
+        "--test",
+        "--test-name-pattern",
+        "native injected host ports host-sensor",
+        "test/host-ports.test.ts"
+      ],
+      "cwd": ".",
+      "inputs": [
+        "test/host-ports.test.ts",
+        "test/support/reference-root.ts",
+        "test/support/acting-root.ts",
+        "samples/reference-export/yes.json",
+        "samples/reference-export/no.json",
+        "docs/contracts/refusals.bound",
+        "docs/contracts/standing.bound",
+        "assets/wasm/guest.js",
+        "samples/host-ports/yes.json",
+        "samples/host-ports/no.json"
+      ],
+      "timeoutMs": 15000,
+      "maxBytes": 262144,
+      "exit": 0,
+      "matches": [
+        {
+          "stream": "stdout",
+          "pattern": "HOST host-sensor \u00b7 declared signer and content injected \u00b7 real signature verified \u00b7 wrong binding refused \u00b7 no commit"
+        }
+      ]
+    },
+    {
+      "name": "host-ports/2",
+      "program": "runtime",
+      "args": [
+        "--experimental-strip-types",
+        "--test",
+        "--test-name-pattern",
+        "native injected host ports host-editorial",
+        "test/host-ports.test.ts"
+      ],
+      "cwd": ".",
+      "inputs": [
+        "test/host-ports.test.ts",
+        "test/support/reference-root.ts",
+        "test/support/acting-root.ts",
+        "samples/reference-export/yes.json",
+        "samples/reference-export/no.json",
+        "docs/contracts/refusals.bound",
+        "docs/contracts/standing.bound",
+        "assets/wasm/guest.js",
+        "samples/host-ports/yes.json",
+        "samples/host-ports/no.json"
+      ],
+      "timeoutMs": 15000,
+      "maxBytes": 262144,
+      "exit": 0,
+      "matches": [
+        {
+          "stream": "stdout",
+          "pattern": "HOST host-editorial \u00b7 declared signer and content injected \u00b7 real signature verified \u00b7 wrong binding refused \u00b7 no commit"
+        }
+      ]
+    }
+  ]
+}

package/vectors/native/readme.vector.json

@@ -0,0 +1,76 @@
+{
+  "scope": "conformance/readme",
+  "measure": "count",
+  "result": "failures",
+  "execution": "independent",
+  "cases": [
+    {
+      "name": "readme/0",
+      "program": "runtime",
+      "args": [
+        "--experimental-strip-types",
+        "--test",
+        "--test-name-pattern",
+        "installed README example sensor",
+        "test/readme.test.ts"
+      ],
+      "cwd": ".",
+      "inputs": [
+        "test/readme.test.ts",
+        "test/support/reference-root.ts",
+        "test/support/acting-root.ts",
+        "samples/reference-export/yes.json",
+        "samples/reference-export/no.json",
+        "docs/contracts/refusals.bound",
+        "docs/contracts/standing.bound",
+        "assets/wasm/guest.js",
+        "samples/readme/yes.json",
+        "samples/readme/no.json",
+        "README.md"
+      ],
+      "timeoutMs": 15000,
+      "maxBytes": 262144,
+      "exit": 0,
+      "matches": [
+        {
+          "stream": "stdout",
+          "pattern": "README sensor \u00b7 REQUIRED \u00b7 altered carrier refused"
+        }
+      ]
+    },
+    {
+      "name": "readme/1",
+      "program": "runtime",
+      "args": [
+        "--experimental-strip-types",
+        "--test",
+        "--test-name-pattern",
+        "installed README example editorial",
+        "test/readme.test.ts"
+      ],
+      "cwd": ".",
+      "inputs": [
+        "test/readme.test.ts",
+        "test/support/reference-root.ts",
+        "test/support/acting-root.ts",
+        "samples/reference-export/yes.json",
+        "samples/reference-export/no.json",
+        "docs/contracts/refusals.bound",
+        "docs/contracts/standing.bound",
+        "assets/wasm/guest.js",
+        "samples/readme/yes.json",
+        "samples/readme/no.json",
+        "README.md"
+      ],
+      "timeoutMs": 15000,
+      "maxBytes": 262144,
+      "exit": 0,
+      "matches": [
+        {
+          "stream": "stdout",
+          "pattern": "README editorial \u00b7 REQUIRED \u00b7 altered carrier refused"
+        }
+      ]
+    }
+  ]
+}

package/vectors/native/reference-backend.vector.json

@@ -0,0 +1,84 @@
+{
+  "scope": "conformance/reference-backend",
+  "measure": "count",
+  "result": "failures",
+  "execution": "independent",
+  "cases": [
+    {
+      "name": "authenticated-wasm-water-level-reference",
+      "program": "runtime",
+      "args": [
+        "--experimental-strip-types",
+        "--test",
+        "--test-name-pattern",
+        "complete authenticated WASM opening water-level-reference",
+        "test/reference-backend.test.ts"
+      ],
+      "cwd": ".",
+      "inputs": [
+        "test/reference-backend.test.ts",
+        "test/support/reference-root.ts",
+        "test/support/reference-world.ts",
+        "test/support/acting-root.ts",
+        "samples/reference-export/yes.json",
+        "samples/reference-export/no.json",
+        "samples/reference-backend/world-fixture.json",
+        "samples/reference-backend/yes.json",
+        "samples/reference-backend/no.json",
+        "docs/contracts/refusals.bound",
+        "docs/contracts/standing.bound",
+        "assets/wasm/manifest.json",
+        "assets/wasm/guest.js",
+        "assets/wasm/runtime.js",
+        "assets/wasm/runtime.wasm"
+      ],
+      "timeoutMs": 15000,
+      "maxBytes": 262144,
+      "exit": 0,
+      "matches": [
+        {
+          "stream": "stdout",
+          "pattern": "WASM water-level-reference · authenticated download · same standing · same records · byte-equal ESM projection · altered carrier refused · no commit"
+        }
+      ]
+    },
+    {
+      "name": "authenticated-wasm-editorial-reference",
+      "program": "runtime",
+      "args": [
+        "--experimental-strip-types",
+        "--test",
+        "--test-name-pattern",
+        "complete authenticated WASM opening editorial-reference",
+        "test/reference-backend.test.ts"
+      ],
+      "cwd": ".",
+      "inputs": [
+        "test/reference-backend.test.ts",
+        "test/support/reference-root.ts",
+        "test/support/reference-world.ts",
+        "test/support/acting-root.ts",
+        "samples/reference-export/yes.json",
+        "samples/reference-export/no.json",
+        "samples/reference-backend/world-fixture.json",
+        "samples/reference-backend/yes.json",
+        "samples/reference-backend/no.json",
+        "docs/contracts/refusals.bound",
+        "docs/contracts/standing.bound",
+        "assets/wasm/manifest.json",
+        "assets/wasm/guest.js",
+        "assets/wasm/runtime.js",
+        "assets/wasm/runtime.wasm"
+      ],
+      "timeoutMs": 15000,
+      "maxBytes": 262144,
+      "exit": 0,
+      "matches": [
+        {
+          "stream": "stdout",
+          "pattern": "WASM editorial-reference · authenticated download · same standing · same records · byte-equal ESM projection · altered carrier refused · no commit"
+        }
+      ]
+    }
+  ]
+}