@mnstry/atelier 0.2.0-alpha.11 → 0.2.0-alpha.13

package/src/ingestion/optional/graphify/json_bridge.py

@@ -0,0 +1,163 @@
+"""Finite JSON workflow bridge for a host-owned supplier factory.
+
+Host module must define create_supplier() -> GraphifySupplier. This does not
+choose a processor or discover credentials. The executable host module belongs
+to host custody. Workflow shape is validated before importing that module.
+"""
+from __future__ import annotations
+import argparse
+import importlib.util
+import json
+import math
+import sys
+from pathlib import Path
+
+from graphify_supplier import GraphifySupplier, PINS, SupplierError, json_safe, require
+
+
+def validate_workflow(requests) -> list[dict]:
+    """Validate the complete finite transport, including later steps, before effects.
+
+    Source admission, budgets and per-operation native settings still belong to
+    the supplier/host. A valid transport never confers acceptance or authority.
+    """
+    require(isinstance(requests, list) and 0 < len(requests) <= 128, "WORKFLOW_BOUND", "Finite native workflow required")
+    labels, count = set(), 0
+
+    def value_shape(value, depth=0):
+        nonlocal count
+        count += 1
+        require(depth <= 64 and count <= 100000, "WORKFLOW_BOUND", "Bounded JSON workflow required")
+        if isinstance(value, dict):
+            require(all(isinstance(k, str) for k in value), "WORKFLOW_SHAPE", "JSON object keys required")
+            if "generationFrom" in value:
+                require(set(value) == {"generationFrom"} and isinstance(value["generationFrom"], str)
+                        and value["generationFrom"] in labels, "WORKFLOW_REFERENCE", "Generation must reference an earlier operation label")
+            else:
+                for item in value.values():
+                    value_shape(item, depth + 1)
+        elif isinstance(value, list):
+            for item in value:
+                value_shape(item, depth + 1)
+        else:
+            require(value is None or isinstance(value, (str, bool, int, float)), "WORKFLOW_SHAPE", "JSON scalar required")
+            require(not isinstance(value, float) or math.isfinite(value), "WORKFLOW_SHAPE", "Finite JSON number required")
+            require(not isinstance(value, str) or len(value) <= 1048576, "WORKFLOW_BOUND", "Bounded JSON string required")
+
+    for request in requests:
+        require(isinstance(request, dict) and {"id", "operation"} <= set(request)
+                and set(request) <= {"id", "operation", "params"}, "WORKFLOW_SHAPE", "ID and operation are required")
+        rid, operation = request["id"], request["operation"]
+        require(isinstance(rid, str) and 0 < len(rid) <= 128 and rid not in labels,
+                "WORKFLOW_REFERENCE", "Unique bounded operation label required")
+        require(isinstance(operation, str), "WORKFLOW_SHAPE", "Operation name must be a string")
+        require(operation in PINS["operations"], "CAPABILITY_UNSUPPORTED", "Unknown or unsupported workflow operation")
+        params = request.get("params", {})
+        require(isinstance(params, dict), "WORKFLOW_SHAPE", "Operation params must be an object")
+        value_shape(params)
+        labels.add(rid)
+    # A detached JSON value prevents caller mutation during an admitted workflow.
+    return json.loads(json.dumps(requests, allow_nan=False))
+
+
+def _portable(value):
+    return json.loads(json.dumps(json_safe(value), sort_keys=True, ensure_ascii=False, allow_nan=False))
+
+
+def _error_receipt(receipt):
+    try:
+        return _portable(receipt)
+    except BaseException as exc:
+        # Retain useful existing receipt identities without pretending an unknown
+        # result was transported. Earlier successful snapshots are unaffected.
+        safe = {"transportState": "receipt-serialization-failed", "errorType": type(exc).__name__,
+                "authority": "none", "canonicalMutation": False}
+        if isinstance(receipt, dict):
+            for key in ("operationId", "operation", "status", "generationId", "rootIdentity"):
+                if isinstance(receipt.get(key), str):
+                    safe[key] = receipt[key]
+            for key in ("artifacts", "nativeExecution", "error"):
+                try:
+                    safe[key] = _portable(receipt.get(key))
+                except BaseException:
+                    pass
+        return safe
+
+
+def run_workflow(supplier: GraphifySupplier, requests: list[dict]) -> dict:
+    completed, receipts = {}, []
+    try:
+        requests = validate_workflow(requests)
+    except BaseException as exc:
+        return {"status": "failed", "completed": [], "executionState": "workflow-not-started",
+                "error": {"code": getattr(exc, "code", "WORKFLOW_VALIDATION_FAILURE"), "type": type(exc).__name__},
+                "authority": "none", "canonicalMutation": False}
+
+    def bind(value):
+        if isinstance(value, dict) and set(value) == {"generationFrom"}:
+            previous = completed[value["generationFrom"]]
+            require(isinstance(previous.get("generationId"), str), "WORKFLOW_REFERENCE", "Earlier operation did not create a generation")
+            return previous["generationId"]
+        if isinstance(value, list):
+            return [bind(x) for x in value]
+        if isinstance(value, dict):
+            return {k: bind(v) for k, v in value.items()}
+        return value
+
+    for request in requests:
+        rid, receipt, invoked, returned = request["id"], None, False, False
+        try:
+            params = bind(request.get("params", {}))
+            invoked = True
+            receipt = supplier.call(request["operation"], params)
+            returned = True
+            snapshot = _portable(receipt)
+            require(isinstance(snapshot, dict) and snapshot.get("status") in {"complete", "partial"},
+                    "WORKFLOW_RECEIPT", "Supplier returned no terminal usable receipt")
+        except BaseException as exc:
+            current_receipt = getattr(exc, "receipt", None) or receipt
+            return {"status": "failed", "completed": receipts, "failedOperation": rid,
+                    "executionState": "not-started" if not invoked else "returned-transport-failed" if returned else "unknown-owned-invocation",
+                    "error": {"code": getattr(exc, "code", "OWNED_INVOCATION_FAILURE"), "type": type(exc).__name__,
+                              "receipt": _error_receipt(current_receipt)}, "authority": "none", "canonicalMutation": False}
+        completed[rid] = snapshot
+        receipts.append({"id": rid, "receipt": snapshot})
+    return {"status": "partial" if any(r["receipt"]["status"] == "partial" for r in receipts) else "complete",
+            "completed": receipts, "authority": "none", "canonicalMutation": False}
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--host", required=True, help="Admitted local Python factory module")
+    parser.add_argument("--request", required=True, help="Finite JSON workflow file")
+    args = parser.parse_args()
+    output = sys.stdout
+    try:
+        # No host import/factory/cache creation until the whole request is valid.
+        raw = Path(args.request).read_bytes()
+        require(len(raw) <= 16777216, "WORKFLOW_BOUND", "Finite request file required")
+        requests = validate_workflow(json.loads(raw))
+        spec = importlib.util.spec_from_file_location("atelier_graphify_host", Path(args.host).resolve())
+        require(spec is not None and spec.loader is not None, "HOST_FACTORY", "Readable host factory required")
+        host = importlib.util.module_from_spec(spec)
+        sys.stdout = sys.stderr
+        spec.loader.exec_module(host)
+        supplier = host.create_supplier()
+        require(isinstance(supplier, GraphifySupplier), "HOST_FACTORY", "Host must return the supplier boundary")
+        result = run_workflow(supplier, requests)
+    except SupplierError as exc:
+        result = {"status": "failed", "completed": [], "error": {"code": exc.code, "receipt": _error_receipt(exc.receipt)},
+                  "authority": "none", "canonicalMutation": False}
+    except BaseException as exc:
+        result = {"status": "failed", "completed": [], "error": {"code": "HOST_BRIDGE_FAILURE", "type": type(exc).__name__},
+                  "authority": "none", "canonicalMutation": False}
+    finally:
+        sys.stdout = output
+    # run_workflow has already encoded each receipt independently; a later owned
+    # invocation/encoding failure cannot erase earlier completed portable receipts.
+    print(json.dumps(result, sort_keys=True, ensure_ascii=False, allow_nan=False))
+    return {"complete": 0, "failed": 1, "partial": 2}[result["status"]]
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/src/ingestion/optional/graphify/query_receiving.py

@@ -0,0 +1,209 @@
+"""Private current-owner receiving of retained Graphify queries, no native call.
+
+Host callbacks return original evidence/hits/receipt references. These structures
+are composition transport, not a new evidence, receipt or acceptance canonical.
+"""
+from __future__ import annotations
+import copy
+import fcntl
+import hashlib
+import json
+import re
+import uuid
+from pathlib import Path
+from graphify_supplier import SupplierError, digest, json_safe, require
+
+
+def _reference(value):
+    return (isinstance(value, dict) and set(value) == {"id", "digest"}
+            and isinstance(value["id"], str) and 0 < len(value["id"]) <= 256
+            and isinstance(value["digest"], str) and re.fullmatch(r"sha256:[a-f0-9]{64}", value["digest"]))
+
+
+def _selection(result, declared):
+    if isinstance(declared, str):
+        declared = {"pointer": declared}
+    require(isinstance(declared, dict) and set(declared) <= {"pointer", "span"}
+            and isinstance(declared.get("pointer"), str) and len(declared["pointer"]) <= 4096,
+            "QUERY_SELECTION", "Bounded existing-result pointer required")
+    pointer, value = declared["pointer"], result
+    require(pointer == "" or pointer.startswith("/"), "QUERY_SELECTION", "JSON pointer required")
+    for safe_name in pointer[1:].split("/") if pointer else []:
+        require(not re.search(r"~(?![01])", safe_name), "QUERY_SELECTION", "Exact JSON pointer escaping required")
+        safe_name = safe_name.replace("~1", "/").replace("~0", "~")
+        if isinstance(value, list):
+            require(re.fullmatch(r"0|[1-9][0-9]*", safe_name) is not None and int(safe_name) < len(value), "QUERY_SELECTION", "Selected result index absent")
+            value = value[int(safe_name)]
+        else:
+            require(isinstance(value, dict) and safe_name in value, "QUERY_SELECTION", "Selected result member absent")
+            value = value[safe_name]
+    if "span" in declared:
+        span = declared["span"]
+        require(isinstance(value, str) and isinstance(span, dict) and set(span) == {"start", "end"}
+                and type(span["start"]) is int and type(span["end"]) is int
+                and 0 <= span["start"] < span["end"] <= len(value), "QUERY_SELECTION", "Exact native text span required")
+        value = value[span["start"]:span["end"]]
+    return {"selection": copy.deepcopy(declared), "nativeResult": copy.deepcopy(value), "nativeResultDigest": digest(value)}
+
+
+def _valid_mapping(entry, selection, sources):
+    require(isinstance(entry, dict) and entry.get("selection") == selection["selection"]
+            and entry.get("nativeResultDigest") == selection["nativeResultDigest"], "QUERY_MAPPING_BINDING", "Mapping must bind the selected original native result")
+    evidence, hit = entry.get("evidence"), entry.get("hit")
+    require(isinstance(evidence, dict) and isinstance(hit, dict), "QUERY_MAPPING_MISSING", "Original owner evidence and hit are required")
+    ref = hit.get("evidenceRef")
+    require(isinstance(ref, dict) and set(ref) == {"sourceId", "revision", "representationId", "locator"}
+            and all(isinstance(ref[k], str) and 0 < len(ref[k]) <= 256 for k in ("sourceId", "revision", "representationId"))
+            and isinstance(ref["locator"], dict), "QUERY_EVIDENCE_REFERENCE", "Original composition evidence reference required")
+    source = sources.get(ref["sourceId"])
+    # Existing vanilla private projection uses the original evidence sourceDigest
+    # as revision and its original attemptId as representationId. Native catalogue
+    # revision remains a separate lifecycle binding; no new identity is inferred.
+    require(source is not None and source["sourceDigest"] == ref["revision"]
+            and evidence.get("sourceId") == ref["sourceId"] and evidence.get("sourceDigest") == source["sourceDigest"],
+            "QUERY_MAPPING_SOURCE", "Mapping source/revision must match current native dependencies")
+    require(evidence.get("schema") == "mnstry.atelier-ingestion-evidence@v1"
+            and evidence.get("freshness") == "current" and evidence.get("integrity") == "verified"
+            and evidence.get("readScope") == "all-plan" and evidence.get("synthesized") is False
+            and evidence.get("semanticAcceptance") == "pending" and evidence.get("locator") == ref["locator"]
+            and isinstance(evidence.get("ref"), str) and 0 < len(evidence["ref"]) <= 16384
+            and isinstance(evidence.get("text"), str), "QUERY_EVIDENCE_UNVERIFIED", "Original current located evidence receipt required")
+    locator = evidence["locator"]
+    require(set(locator) == {"kind", "value"} and locator["kind"] in {"line", "csv-cell", "json-pointer"}
+            and isinstance(locator["value"], str) and 0 < len(locator["value"]) <= 16384,
+            "QUERY_EVIDENCE_REFERENCE", "Supported exact original owner locator required")
+    require(isinstance(evidence.get("planId"), str) and bool(evidence["planId"])
+            and isinstance(evidence.get("planDigest"), str) and re.fullmatch(r"[a-f0-9]{64}", evidence["planDigest"])
+            and isinstance(evidence.get("attemptId"), str) and bool(evidence["attemptId"]),
+            "QUERY_EVIDENCE_UNVERIFIED", "Original owner plan/digest/attempt bindings required")
+    require(all(evidence.get(k) == source[k] for k in ("attemptId", "planId", "planDigest") if k in source),
+            "QUERY_MAPPING_SOURCE", "Located evidence attempt/plan differs from current dependency")
+    require(isinstance(source.get("attemptId"), str) and bool(source["attemptId"])
+            and ref["representationId"] == evidence["attemptId"] == source["attemptId"],
+            "QUERY_MAPPING_REPRESENTATION", "Original evidence representation must match its original owner attempt")
+    require(isinstance(hit.get("quote"), str) and bool(hit["quote"]) and hit["quote"] in evidence["text"],
+            "QUERY_QUOTE_UNVERIFIED", "Original hit quote must occur in its owner-read evidence")
+    # The existing owner verifier still qualifies representation identity, exact
+    # passage/current permission and canonical receipts. Shape never grants it.
+    return copy.deepcopy(hit)
+
+
+def receive_query(supplier, operation_id, *, selections=None):
+    require(supplier.lock.acquire(blocking=False), "WRITER_BUSY", "A supplier operation owns receiving")
+    lease, envelope, body, directory = None, None, None, None
+    try:
+        lease = (supplier.artifacts / ".writer.lock").open("a+b")
+        try:
+            fcntl.flock(lease, fcntl.LOCK_EX | fcntl.LOCK_NB)
+        except BlockingIOError as exc:
+            raise SupplierError("WRITER_BUSY", "Another process owns this supplier destination") from exc
+        receipt = supplier.read_capture(operation_id)["receipt"]
+        require(receipt.get("operation") == "query" and receipt.get("status") == "complete", "QUERY_RECEIVING_SCOPE", "Existing successful retained query required")
+        generation = receipt.get("graphGeneration")
+        directory = supplier.artifacts / operation_id
+        artifacts = [a for a in receipt["artifacts"] if Path(a["path"]).name == "result.json"]
+        require(len(artifacts) == 1, "QUERY_RECEIVING_ARTIFACT", "Exactly one original retained query result required")
+        artifact = copy.deepcopy(artifacts[0])
+        result = json.loads(Path(artifact["path"]).read_bytes())
+        original_receipt = directory / "receipt.json"
+        receipt_bytes = original_receipt.read_bytes()
+        receipt_artifact = {"path": str(original_receipt), "sha256": hashlib.sha256(receipt_bytes).hexdigest(), "bytes": len(receipt_bytes)}
+        declared = [""] if selections is None else selections
+        require(isinstance(declared, list) and 0 < len(declared) <= 128, "QUERY_SELECTION", "Finite explicit native selection required")
+        selected = [_selection(result, selection) for selection in declared]
+        require(len({digest(s["selection"]) for s in selected}) == len(selected), "QUERY_SELECTION_AMBIGUOUS", "Duplicate native selection is ambiguous")
+        context = {"queryArtifact": artifact, "queryReceiptArtifact": receipt_artifact, "generation": generation,
+                   "sourceBindings": copy.deepcopy(receipt["sourceBindings"]), "rootIdentity": supplier.root_id,
+                   "epoch": receipt["epoch"], "view": receipt["view"], "nativeSelections": selected}
+        envelope = {"provider": "graphify", "generation": generation, "artifactRef": artifact,
+                    "hits": [], "unresolved": [], "receiptRef": None, "usage": copy.deepcopy(receipt.get("usage")),
+                    "authority": "none", "canonicalMutation": False}
+        body = {"queryOperationId": operation_id, "queryBinding": context, "hostMappingOriginal": None,
+                "hostEligibilityOriginal": None, "envelope": envelope, "qualification": "private receiving; original canonical owners retain authority"}
+        def finish():
+            envelope["status"] = "received" if envelope["hits"] and not envelope["unresolved"] else "partial-received" if envelope["hits"] else "unresolved"
+            capture = supplier._write(directory, f"receiving-{uuid.uuid4().hex}.json", body)
+            envelope["receivingArtifact"] = capture
+            return envelope
+        def propagate_control(exc):
+            if isinstance(exc, Exception): return
+            envelope["hits"] = []
+            envelope["receiptRef"] = None
+            body["controlSignal"] = {"type": type(exc).__name__, "propagated": True}
+            try:
+                finish()
+            except BaseException as capture_error:
+                body["captureError"] = {"type": type(capture_error).__name__, "code": getattr(capture_error, "code", "CAPTURE_FAILURE")}
+            exc.receipt = copy.deepcopy(body)
+            raise exc
+        try:
+            item = supplier._fresh(generation, "graph")
+            require(context["sourceBindings"] == item["dependencies"] and receipt["epoch"] == supplier.epoch,
+                    "QUERY_RECEIVING_STALE", "Query generation/source bindings differ from current graph")
+            if item.get("accepted_reference") is not None:
+                build_receipt = supplier.read_capture(item["operationId"])["receipt"]
+                context.update(historyDigest=build_receipt["acceptedHead"], activationRef=copy.deepcopy(item["accepted_reference"]))
+        except BaseException as exc:
+            envelope["unresolved"].append({"reason": getattr(exc, "code", "QUERY_RECEIVING_STALE"), "type": type(exc).__name__})
+            propagate_control(exc)
+            return finish()
+        if not callable(supplier.query_hydrator) or not callable(supplier.query_verifier):
+            envelope["unresolved"] = [{"selection": s["selection"], "reason": "current-owner-receiving-unreceived"} for s in selected]
+        else:
+            try:
+                hydrated = json_safe(supplier.query_hydrator(copy.deepcopy(context)))
+                body["hostMappingOriginal"] = hydrated
+                require(isinstance(hydrated, dict) and _reference(hydrated.get("mappingReceipt"))
+                        and isinstance(hydrated.get("mappings"), list), "QUERY_MAPPING_RECEIPT", "Original owner mapping receipt/mappings required")
+                entries, hits = hydrated["mappings"], []
+                # Hydrator may decline an exact selection. Multiple mappings for
+                # the same selection remain ambiguous; there is no arbitrary winner.
+                require(all(isinstance(e, dict) and e.get("selection") in [s["selection"] for s in selected] for e in entries),
+                        "QUERY_MAPPING_BINDING", "Mapping includes an unselected native result")
+                for selection in selected:
+                    matches = [e for e in entries if e.get("selection") == selection["selection"]]
+                    if len(matches) != 1:
+                        envelope["unresolved"].append({"selection": selection["selection"], "reason": "mapping-absent" if not matches else "mapping-ambiguous"})
+                        continue
+                    try:
+                        hits.append(_valid_mapping(matches[0], selection, context["sourceBindings"]))
+                    except SupplierError as exc:
+                        envelope["unresolved"].append({"selection": selection["selection"], "reason": exc.code})
+                if hits:
+                    binding = {**copy.deepcopy(context), "mappingReceipt": copy.deepcopy(hydrated["mappingReceipt"]),
+                               "mappingDigest": digest(hydrated), "hitsDigest": digest(hits)}
+                    # Repeat current generation/source/accepted-head checks around
+                    # the existing owner's actual mapping+eligibility verification.
+                    supplier._fresh(generation, "graph")
+                    verdict = json_safe(supplier.query_verifier({"binding": copy.deepcopy(binding), "mapping": copy.deepcopy(hydrated), "hits": copy.deepcopy(hits)}))
+                    body["hostEligibilityOriginal"] = verdict
+                    require(isinstance(verdict, dict) and verdict.get("binding") == binding
+                            and verdict.get("current") is True and verdict.get("permitted") is True
+                            and _reference(verdict.get("eligibilityReceipt")) and _reference(verdict.get("receiptRef")),
+                            "QUERY_ELIGIBILITY_UNVERIFIED", "Current owner must bind original query/source/generation/mapping/hits and eligibility receipts")
+                    envelope.update(hits=hits, mappingReceipt=copy.deepcopy(hydrated["mappingReceipt"]),
+                                    eligibilityReceipt=copy.deepcopy(verdict["eligibilityReceipt"]), receiptRef=copy.deepcopy(verdict["receiptRef"]))
+            except BaseException as exc:
+                envelope["hits"] = []
+                envelope["unresolved"].append({"reason": getattr(exc, "code", "QUERY_OWNER_RECEIVING_FAILURE"), "type": type(exc).__name__})
+                propagate_control(exc)
+        try:
+            supplier._fresh(generation, "graph")
+            supplier.read_capture(operation_id)
+            require(original_receipt.read_bytes() == receipt_bytes, "ARTIFACT_DRIFT", "Original query receipt changed during receiving")
+        except BaseException as exc:
+            envelope["hits"] = []
+            envelope["receiptRef"] = None
+            envelope["unresolved"].append({"reason": getattr(exc, "code", "QUERY_RECEIVING_STALE"), "type": type(exc).__name__})
+            propagate_control(exc)
+        # Supplemental capture uses existing owned artifact custody and links the
+        # original immutable query receipt. It is not a new canonical journal.
+        return finish()
+    except BaseException as exc:
+        if not isinstance(exc, Exception) and not hasattr(exc, "receipt"):
+            exc.receipt = copy.deepcopy(body) if body is not None else {"queryOperationId": operation_id, "nativeReplay": False}
+        raise
+    finally:
+        if lease:
+            lease.close()
+        supplier.lock.release()

package/src/ingestion/optional/index.mjs

@@ -0,0 +1,9 @@
+export { createComposition, compileRoute, composeEvidence, CompositionFailure } from './composition/index.mjs'
+export { createVanillaCompositionBinding } from './vanilla/composition-binding.mjs'
+export { createVanillaIngestionBridge, createCandidateExtractor, normalizeCandidateJson, readVanillaCapture, VanillaIngestionError } from './vanilla/index.mjs'
+export { normalizeNativeExtraction, createNativeNormalizer, NativeHandoffError } from './vanilla/native-normalization.mjs'
+export { createCompositionJudgmentBinding } from './jev/composition-binding.mjs'
+export { prepareIngestionJudgments } from './jev/judgments.mjs'
+export { createGraphifyCompositionBinding, GraphifyCompositionBindingError } from './graphify/composition-binding.mjs'
+export { createLightRAGCompositionBinding, LightRAGCompositionBindingError } from './lightrag/composition-binding.mjs'
+export { PRESENCE_PROFILES, createQualificationExecutor, validateExecutionPlan, accountComponents, summarizeCohort, amortizedCosts } from './evaluation/index.mjs'

package/src/ingestion/optional/jev/bridge.mjs

@@ -0,0 +1,166 @@
+import {closed, freeze, materialDigest, requireContracts, requirePrepared, requireThat, snapshot, text, validId, RUBRIC_VERSION} from './judgments.mjs';
+
+function abstention(batch, model, mode, reason, elapsedMs, usage = null) {
+  return freeze({schema: 'atelier-decision-result@v1', requestId: batch.request.id,
+    requestDigest: batch.requestDigest, task: batch.request.task, rubricVersion: batch.request.rubricVersion,
+    scope: batch.request.scope, provider: {id: 'jev', model}, authority: 'proposal-only',
+    mode, status: 'abstained', reason, answers: {}, usage, elapsedMs});
+}
+function qualified(batch, qualifications, model) {
+  return Object.entries(batch.questionPlacements).every(([id, placement]) => {
+    const q = qualifications[placement], type = batch.request.questions[id].type;
+    return q && q.model === model && q.rubricVersion === RUBRIC_VERSION && validId(q.reference) &&
+      q.sourceProfile === 'invented-public-offline' &&
+      (type !== 'boolean' || Number.isFinite(q.rejectAtOrBelow) && Number.isFinite(q.acceptAtOrAbove) &&
+        q.rejectAtOrBelow >= 0 && q.acceptAtOrAbove <= 1 && q.rejectAtOrBelow < q.acceptAtOrAbove) &&
+      (type !== 'choice' || Number.isFinite(q.minimumConfidence) && q.minimumConfidence >= 0 && q.minimumConfidence <= 1 &&
+        Number.isFinite(q.minimumMargin) && q.minimumMargin > 0 && q.minimumMargin <= 1) &&
+      (type !== 'score' || Number.isFinite(q.minimumConfidence) && q.minimumConfidence >= 0 && q.minimumConfidence <= 1);
+  });
+}
+function dispositions(batch, result, qualifications) {
+  if (result.status === 'abstained') return Object.fromEntries(Object.keys(batch.request.questions).map(id => [id, {status: 'abstained', reason: result.reason}]));
+  return Object.fromEntries(Object.entries(result.answers).map(([id, answer]) => {
+    const placement = batch.questionPlacements[id], q = qualifications[placement]; let ambiguous = false;
+    if (answer.type === 'choice') {
+      const values = Object.values(answer.probabilities).sort((a, b) => b - a);
+      ambiguous = ['uncertain', 'unmodeled'].includes(answer.choice) || answer.confidence < q.minimumConfidence || values[0] - values[1] < q.minimumMargin;
+    } else if (answer.type === 'boolean') ambiguous = answer.probability > q.rejectAtOrBelow && answer.probability < q.acceptAtOrAbove;
+    else if (answer.type === 'score') ambiguous = answer.confidence < q.minimumConfidence;
+    return [id, {placement, status: ambiguous ? 'abstained' : 'proposal', ...(ambiguous ? {reason: 'ambiguous'} : {}),
+      answerRef: {requestId: result.requestId, requestDigest: result.requestDigest, questionId: id},
+      ...(answer.type === 'choice' && batch.choiceBindings[id]?.[answer.choice] ? {selection: batch.choiceBindings[id][answer.choice]} : {}),
+      qualificationRef: q.reference, authority: 'proposal-only'}];
+  }));
+}
+/**
+ * An offline supplier around the existing assess(request, options) host port.
+ * No HTTP, credentials, Consent implementation, cache, budget or executor.
+ * This packet profile deliberately refuses native activation; the transport
+ * owner must receive the narrow compatibility proposal before native use.
+ */
+export function createIngestionJudgmentBridge({contracts, assess, checkCurrent, admitAssessment, transport,
+  model = 'jev-1.13.0', mode = 'off', qualifications = {}, deadlineMs = 15000, now = Date.now}) {
+  requireContracts(contracts);
+  requireThat(['off', 'shadow', 'advisory'].includes(mode) && /^jev-\d+\.\d+\.\d+$/.test(model) &&
+    Number.isInteger(deadlineMs) && deadlineMs >= 1 && deadlineMs <= 30000 && typeof now === 'function', 'invalid-bridge-configuration');
+  const qualificationSnapshot = freeze(snapshot(qualifications)),
+    transportSnapshot = transport === undefined ? null : freeze(snapshot(transport)),
+    attempts = new Map(), observedRequests = new Set();
+  async function run(batch, {attemptId, signal, originalHostReceiptRef} = {}) {
+    requirePrepared(batch, model); requireThat(validId(attemptId), 'original-attempt-identity-required');
+    requireThat(!attempts.has(attemptId), 'attempt-already-observed-no-replay');
+    const originalRequestKey = batch.operationId + ':' + batch.requestDigest;
+    requireThat(!observedRequests.has(originalRequestKey), 'request-already-observed-no-replay');
+    const started = now(), elapsed = () => Math.max(0, now() - started), resultMode = mode === 'off' ? 'shadow' : mode;
+    const record = {attemptId, requestId: batch.request.id, requestDigest: batch.requestDigest, execution: 'not-invoked', transportInvoked: false,
+      hostAdmission: {status: 'not-requested', authenticity: 'owned-by-existing-host-not-observed-by-bridge'}};
+    attempts.set(attemptId, record);
+    observedRequests.add(originalRequestKey);
+    const finish = (result, reason, originalResult = null) => {
+      requireThat(contracts.validateDecisionResult(batch.request, result).ok, 'canonical-result-refused');
+      const receipt = freeze({attemptId, operationId: batch.operationId, requestId: batch.request.id,
+        requestDigest: batch.requestDigest, nativePayloadDigest: batch.nativePayloadDigest,
+        nativePayloadDigestKind: 'prepared-body-only', actualProviderPayloadDigest: null,
+        bindings: batch.bindings, questionPlacements: batch.questionPlacements,
+        model, rubricVersion: RUBRIC_VERSION, execution: record.execution,
+        transportInvoked: record.transportInvoked, providerInvocation: 'not-observed-by-bridge',
+        authority: 'proposal-only', nativeQualified: false,
+        hostAdmission: record.hostAdmission,
+        result, originalHostResult: originalResult, dispositions: dispositions(batch, result, qualificationSnapshot),
+        ...(reason ? {bridgeReason: reason} : {})});
+      record.returnedReceipt = receipt; return receipt;
+    };
+    const stop = (reason, bridgeReason = reason, usage = null, original = null) => finish(abstention(batch, model, resultMode, reason, elapsed(), usage), bridgeReason, original);
+    if (mode === 'off') return stop('unauthorized', 'off');
+    if (signal?.aborted) return stop('timeout', 'cancelled-before-invocation');
+    if (!qualified(batch, qualificationSnapshot, model)) return stop('unauthorized', 'placement-profile-unqualified');
+    if (typeof assess !== 'function' || typeof checkCurrent !== 'function') return stop('provider-unavailable', 'existing-assess-and-current-source-ports-required');
+    // Fixture qualification labels and integrity digests are never admission.
+    // Native transport is still outside this supplier's received profile.
+    if (!transportSnapshot || transportSnapshot.kind !== 'offline-fixture' || !validId(transportSnapshot.reference) ||
+        Object.keys(transportSnapshot).length !== 2) return stop('unauthorized', 'offline-host-transport-required');
+    if (typeof admitAssessment !== 'function' || !text(originalHostReceiptRef, 2048))
+      return stop('unauthorized', 'original-host-admission-and-receipt-required');
+    const controller = new AbortController(), abort = () => controller.abort();
+    signal?.addEventListener('abort', abort, {once: true});
+    const timer = setTimeout(abort, deadlineMs);
+    async function bounded(promise) {
+      if (controller.signal.aborted) throw Error('bounded-abort');
+      return new Promise((resolve, reject) => {
+        const cancel = () => reject(Error('bounded-abort'));
+        controller.signal.addEventListener('abort', cancel, {once: true});
+        Promise.resolve(promise).then(value => {controller.signal.removeEventListener('abort', cancel); resolve(value);}, error => {
+          controller.signal.removeEventListener('abort', cancel); reject(error);
+        });
+      });
+    }
+    const current = phase => checkCurrent(freeze({phase, attemptId, operationId: batch.operationId,
+      requestDigest: batch.requestDigest, nativePayloadDigest: batch.nativePayloadDigest, bindings: batch.bindings}), controller.signal);
+    let stage = 'source-check', receivedHostResult = null, validatedHostResult = null;
+    try {
+      if (await bounded(Promise.resolve().then(() => current('before-assess'))) !== true) return stop('insufficient-evidence', 'source-stale-or-withdrawn');
+      if (controller.signal.aborted) return stop('timeout', 'cancelled-before-invocation');
+      const intent = freeze({phase: 'before-assess', attemptId, operationId: batch.operationId,
+        originalHostReceiptRef, request: batch.request, requestDigest: batch.requestDigest,
+        scope: batch.request.scope, model, mode, rubricVersion: RUBRIC_VERSION,
+        questionPlacements: batch.questionPlacements, bindings: batch.bindings,
+        placementQualifications: Object.fromEntries([...new Set(Object.values(batch.questionPlacements))].map(p => [p, qualificationSnapshot[p]])),
+        transport: transportSnapshot, nativeBody: batch.nativeBody,
+        preparedNativePayloadDigest: batch.nativePayloadDigest, actualProviderPayloadDigest: null,
+        authority: 'proposal-only', nativeQualified: false});
+      const bindingDigest = materialDigest(intent);
+      stage = 'admission';
+      record.hostAdmission = {status: 'unknown', intent, bindingDigest,
+        authenticity: 'owned-by-existing-host-not-observed-by-bridge'};
+      const admitted = snapshot(await bounded(Promise.resolve().then(() => admitAssessment(freeze({...intent, bindingDigest}), {signal: controller.signal}))));
+      closed(admitted, ['allowed', 'receiptRef', 'bindingDigest']);
+      if (admitted.allowed !== true || !text(admitted.receiptRef, 2048) || admitted.bindingDigest !== bindingDigest) {
+        record.hostAdmission = {...record.hostAdmission, status: 'refused', originalHostReply: freeze(admitted)};
+        return stop('unauthorized', 'original-host-admission-refused');
+      }
+      record.hostAdmission = {...record.hostAdmission, status: 'host-received', receiptRef: admitted.receiptRef};
+      stage = 'source-check';
+      if (await bounded(Promise.resolve().then(() => current('after-admission-before-assess'))) !== true)
+        return stop('insufficient-evidence', 'source-stale-or-withdrawn-after-admission');
+      if (controller.signal.aborted) return stop('timeout', 'cancelled-before-invocation');
+      stage = 'assessment';
+      const hostPromise = Promise.resolve().then(() => {
+        if (controller.signal.aborted) throw Error('bounded-abort');
+        record.transportInvoked = true; record.execution = 'unknown';
+        return assess(batch.request, {
+          attemptId, operationId: batch.operationId, model, mode, rubricVersion: RUBRIC_VERSION,
+          signal: controller.signal, nativePayloadDigest: batch.nativePayloadDigest,
+          nativeBody: batch.nativeBody, bindings: batch.bindings, qualificationProfile: 'invented-public-offline',
+          originalHostReceiptRef, hostAdmissionReceiptRef: admitted.receiptRef,
+          admissionBindingDigest: bindingDigest, transport: transportSnapshot});
+      });
+      hostPromise.then(value => {record.hostReturned = true; try {record.originalHostResult = freeze(snapshot(value));} catch {record.invalidHostResult = true;}},
+        () => {record.hostReturned = true; record.hostError = 'host-assessment-failed';});
+      const output = snapshot(await bounded(hostPromise));
+      receivedHostResult = output;
+      // Return of this port does not independently settle the underlying provider.
+      record.execution = 'host-returned';
+      if (!contracts.validateDecisionResult(batch.request, output).ok || output.provider.id !== 'jev' || output.provider.model !== model || output.mode !== resultMode)
+        return stop('invalid-response', 'unbound-or-invalid-host-result', null, output);
+      validatedHostResult = output; stage = 'result-check';
+      if (await bounded(Promise.resolve().then(() => current('before-result-use'))) !== true)
+        return stop('insufficient-evidence', 'source-stale-or-withdrawn-after-assess', output.usage, output);
+      return finish(freeze(output), null, output);
+    } catch {
+      return stop(controller.signal.aborted ? 'timeout' : validatedHostResult ? 'insufficient-evidence' : 'provider-unavailable',
+        stage === 'result-check' ? 'post-assessment-currency-check-unavailable' :
+        stage === 'admission' ? 'original-host-admission-unavailable' :
+        record.transportInvoked ? 'host-outcome-requires-original-transport-reconciliation' : 'pre-invocation-check-unavailable',
+        validatedHostResult?.usage ?? null, receivedHostResult ?? record.originalHostResult ?? null);
+    } finally {clearTimeout(timer); signal?.removeEventListener('abort', abort);}
+  }
+  return Object.freeze({assess: run, inspect(attemptId) {
+    const record = attempts.get(attemptId); if (!record) return null;
+    return freeze(snapshot({attemptId: record.attemptId, requestId: record.requestId,
+      requestDigest: record.requestDigest, execution: record.execution, transportInvoked: record.transportInvoked,
+      hostReturned: record.hostReturned ?? false, originalHostResult: record.originalHostResult ?? null,
+      hostAdmission: record.hostAdmission,
+      providerExecutionSettled: 'not-observed-by-bridge', hostError: record.hostError ?? null}));
+  }});
+}