@qlm/learnlog-mcp 0.0.0-stage → 0.2.0

package/vendor/qlm-measure/verifier/hash.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Hash utilities for evidence record integrity.
+ *
+ * Uses SHA-256 via Node's crypto module (ESM import).
+ * Canonical serialization ensures deterministic hashing.
+ */
+import type { EvidenceEntry } from "../schema/evidence-record.js";
+/**
+ * Canonical JSON serialization — sorted keys, no whitespace.
+ * Matches Python's json.dumps(sort_keys=True, separators=(",",":"), default=str)
+ * byte-for-byte, including number and string formatting.
+ */
+export declare function canonicalize(obj: unknown): string;
+/**
+ * Compute SHA-256 hash of a string.
+ */
+export declare function sha256(input: string): string;
+/**
+ * Compute the canonical hash of an evidence entry.
+ * Every field must be explicitly null (not undefined) to match Python.
+ */
+export declare function hashEntry(entry: EvidenceEntry): string;
+/**
+ * Compute a hash over a canonical string.
+ */
+export declare function hashCanonical(input: string): string;
+//# sourceMappingURL=hash.d.ts.map

package/vendor/qlm-measure/verifier/hash.js

@@ -0,0 +1,163 @@
+/**
+ * Hash utilities for evidence record integrity.
+ *
+ * Uses SHA-256 via Node's crypto module (ESM import).
+ * Canonical serialization ensures deterministic hashing.
+ */
+import { createHash } from "crypto";
+/**
+ * Format a number to match Python's json.dumps output.
+ *
+ * Python's json.dumps uses different formatting for int vs float:
+ *   int 9200     → "9200"     (no decimal point)
+ *   float 1.0    → "1.0"     (always has decimal point)
+ *   float 3e-05  → "3e-05"   (2-digit exponent minimum)
+ *
+ * JS has no int/float distinction. We use Number.isInteger() as the
+ * heuristic: if the JSON source had no decimal point, Python stored
+ * it as int and wrote it without .0.
+ *
+ * For the entry-hash hashable subset, only evidentialWeight,
+ * priorPosterior, and updatedPosterior are Python floats. version is
+ * an int. Everything inside event follows Python's own int/float typing
+ * from the original JSON (which round-trips through JSON.parse identically).
+ */
+/**
+ * Format a number to match Python's json.dumps output.
+ *
+ * Python uses the shortest decimal representation that round-trips
+ * (David Gay's dtoa algorithm). JS's Number.toString() also uses dtoa
+ * but sometimes produces longer representations with floating-point noise.
+ *
+ * We match Python by finding the shortest representation that round-trips.
+ */
+function pyNumberFormat(n) {
+    if (Object.is(n, -0))
+        return "-0.0";
+    if (!Number.isFinite(n))
+        return String(n);
+    // Python int path
+    if (Number.isInteger(n) && Math.abs(n) < Number.MAX_SAFE_INTEGER) {
+        return n.toString();
+    }
+    // Find the shortest decimal representation that round-trips
+    // This matches Python's float.__repr__ (shortest via dtoa)
+    let best = JSON.stringify(n);
+    // Try progressively shorter representations
+    for (let prec = 17; prec >= 1; prec--) {
+        const candidate = n.toPrecision(prec);
+        if (parseFloat(candidate) === n) {
+            best = candidate;
+        }
+        else {
+            break; // once it stops round-tripping, shorter won't work either
+        }
+    }
+    // Remove unnecessary trailing zeros and decimal point
+    // but keep at least one digit after decimal for floats
+    if (best.includes(".") && !best.includes("e") && !best.includes("E")) {
+        best = best.replace(/0+$/, "");
+        if (best.endsWith("."))
+            best += "0"; // keep the .0 for e.g. "1.0"
+    }
+    // Python uses scientific notation for abs < 1e-4
+    const abs = Math.abs(n);
+    if (abs > 0 && abs < 1e-4) {
+        if (!best.includes("e") && !best.includes("E")) {
+            // Use toExponential() for JS's shortest digits (no division noise)
+            best = n.toExponential();
+        }
+    }
+    // Fix exponent padding: e-7 → e-07, e+2 → e+02
+    best = best.replace(/e([+-])(\d)$/, "e$10$2");
+    return best;
+}
+/**
+ * Format a string to match Python's json.dumps output.
+ * Python escapes all non-ASCII characters to \\uXXXX by default.
+ * JS JSON.stringify passes them through as UTF-8.
+ */
+function pyStringFormat(s) {
+    let result = JSON.stringify(s);
+    // Replace non-ASCII characters with \\uXXXX escapes, matching Python
+    result = result.replace(/[\u0080-\uffff]/g, (ch) => {
+        return "\\u" + ch.charCodeAt(0).toString(16).padStart(4, "0");
+    });
+    return result;
+}
+/**
+ * Canonical JSON serialization — sorted keys, no whitespace.
+ * Matches Python's json.dumps(sort_keys=True, separators=(",",":"), default=str)
+ * byte-for-byte, including number and string formatting.
+ */
+export function canonicalize(obj) {
+    return _canonicalizeValue(obj);
+}
+function _canonicalizeValue(val) {
+    if (val === null)
+        return "null";
+    if (val === undefined)
+        return "null";
+    if (typeof val === "boolean")
+        return val ? "true" : "false";
+    if (typeof val === "number")
+        return pyNumberFormat(val);
+    if (typeof val === "string")
+        return pyStringFormat(val);
+    if (Array.isArray(val)) {
+        return "[" + val.map(_canonicalizeValue).join(",") + "]";
+    }
+    if (typeof val === "object") {
+        const keys = Object.keys(val).sort();
+        const pairs = keys.map(k => {
+            const v = val[k];
+            return JSON.stringify(k) + ":" + _canonicalizeValue(v);
+        });
+        return "{" + pairs.join(",") + "}";
+    }
+    return JSON.stringify(val);
+}
+/**
+ * Compute SHA-256 hash of a string.
+ */
+export function sha256(input) {
+    return createHash("sha256").update(input).digest("hex");
+}
+/**
+ * Compute the canonical hash of an evidence entry.
+ * Every field must be explicitly null (not undefined) to match Python.
+ */
+export function hashEntry(entry) {
+    const hashable = {
+        version: entry.version,
+        timestamp: entry.timestamp,
+        event: entry.event,
+        scaffoldType: entry.scaffoldType ?? null,
+        depthLevel: entry.depthLevel ?? null,
+        epistemicMode: entry.epistemicMode ?? null,
+        triageResult: entry.triageResult ?? null,
+        evidentialWeight: entry.evidentialWeight,
+        priorPosterior: entry.priorPosterior,
+        updatedPosterior: entry.updatedPosterior,
+        nonInterventionDecision: entry.nonInterventionDecision ?? null,
+    };
+    // Build canonical, then fix the three Python-float fields:
+    // evidentialWeight, priorPosterior, updatedPosterior are Python floats.
+    // Python writes 1.0 for float(1), but JS Number.isInteger(1) returns true
+    // and pyNumberFormat writes "1". Fix by post-processing these three fields.
+    let canonical = _canonicalizeValue(hashable);
+    for (const field of ["evidentialWeight", "priorPosterior", "updatedPosterior"]) {
+        const val = hashable[field];
+        if (typeof val === "number" && Number.isInteger(val)) {
+            canonical = canonical.replace(new RegExp(`"${field}":(-?\\d+)(?=[,}\\]])`), `"${field}":$1.0`);
+        }
+    }
+    return sha256(canonical);
+}
+/**
+ * Compute a hash over a canonical string.
+ */
+export function hashCanonical(input) {
+    return sha256(input);
+}
+//# sourceMappingURL=hash.js.map

package/vendor/qlm-measure/verifier/verify-record.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Evidence Record Verifier
+ *
+ * Verifies the bookkeeping integrity of an evidence record WITHOUT
+ * containing any estimation mathematics.
+ *
+ * verify makes no network calls. Records never leave your machine.
+ */
+import type { EvidenceRecord } from "../schema/evidence-record.js";
+export interface Violation {
+    version: number;
+    category: "schema" | "version" | "timestamp" | "hash" | "posterior" | "compaction" | "enum";
+    message: string;
+    checkId: string;
+}
+export interface VerificationResult {
+    valid: boolean;
+    violations: Violation[];
+    entriesChecked: number;
+}
+export declare function verifyRecord(record: EvidenceRecord, timestampToleranceMs?: number): VerificationResult;
+//# sourceMappingURL=verify-record.d.ts.map

package/vendor/qlm-measure/verifier/verify-record.js

@@ -0,0 +1,123 @@
+/**
+ * Evidence Record Verifier
+ *
+ * Verifies the bookkeeping integrity of an evidence record WITHOUT
+ * containing any estimation mathematics.
+ *
+ * verify makes no network calls. Records never leave your machine.
+ */
+import { hashEntry } from "./hash.js";
+const VALID_SCAFFOLD_TYPES = ["none", "socratic", "probing", "metacognitive", "scaffolding", "explain", "hint", "demonstrate"];
+const VALID_DEPTH_LEVELS = ["surface", "conceptual", "transfer", "integration"];
+const VALID_EPISTEMIC_MODES = ["experience", "inference", "analogy", "testimony"];
+const VALID_TRIAGE_RESULTS = ["correct", "slip", "misconception", "disengagement", "ambiguous"];
+function isValidISO8601(ts) {
+    const d = new Date(ts);
+    return !isNaN(d.getTime()) && ts.length > 0;
+}
+export function verifyRecord(record, timestampToleranceMs = 1000) {
+    const violations = [];
+    if (!record.studentScopeId || typeof record.studentScopeId !== "string") {
+        violations.push({ version: 0, category: "schema", message: "Missing or invalid studentScopeId", checkId: "SCHEMA.REQUIRED" });
+    }
+    if (!Array.isArray(record.entries)) {
+        violations.push({ version: 0, category: "schema", message: "entries must be an array", checkId: "SCHEMA.REQUIRED" });
+        return { valid: false, violations, entriesChecked: 0 };
+    }
+    // Compaction boundary
+    if (record.compactedBefore) {
+        if (typeof record.compactedBefore.version !== "number") {
+            violations.push({ version: 0, category: "compaction", message: "compactedBefore.version must be a number", checkId: "COMPACTION.BOUNDARY" });
+        }
+        if (typeof record.compactedBefore.summaryHash !== "string" || !record.compactedBefore.summaryHash) {
+            violations.push({ version: 0, category: "compaction", message: "compactedBefore.summaryHash must be a non-empty string", checkId: "COMPACTION.BOUNDARY" });
+        }
+        if (record.entries.length > 0 && record.entries[0].version <= record.compactedBefore.version) {
+            violations.push({
+                version: record.entries[0].version, category: "compaction",
+                message: `First entry version (${record.entries[0].version}) must be > compaction boundary (${record.compactedBefore.version})`,
+                checkId: "COMPACTION.BOUNDARY",
+            });
+        }
+    }
+    let prevVersion = record.compactedBefore?.version ?? 0;
+    let prevTimestamp = "";
+    let prevHash = record.compactedBefore?.summaryHash ?? "";
+    let lastUpdatedPosterior = null;
+    for (const entry of record.entries) {
+        const v = entry.version ?? -1;
+        // SCHEMA.REQUIRED
+        if (typeof v !== "number" || v < 1) {
+            violations.push({ version: v, category: "schema", message: "version must be a positive integer", checkId: "SCHEMA.REQUIRED" });
+        }
+        if (typeof entry.timestamp !== "string" || !entry.timestamp) {
+            violations.push({ version: v, category: "schema", message: "timestamp is required", checkId: "SCHEMA.REQUIRED" });
+        }
+        // SCHEMA.REQUIRED + SCHEMA.TYPES for numeric fields
+        for (const f of ["evidentialWeight", "priorPosterior", "updatedPosterior"]) {
+            if (!(f in entry)) {
+                violations.push({ version: v, category: "schema", message: `${f} must be a number`, checkId: "SCHEMA.REQUIRED" });
+            }
+            else if (typeof entry[f] !== "number") {
+                violations.push({ version: v, category: "schema", message: `${f} must be a number`, checkId: "SCHEMA.TYPES" });
+            }
+        }
+        // SCHEMA.TIMESTAMP_FORMAT
+        if (typeof entry.timestamp === "string" && entry.timestamp && !isValidISO8601(entry.timestamp)) {
+            violations.push({ version: v, category: "timestamp", message: `Timestamp is not valid ISO 8601: "${entry.timestamp}"`, checkId: "SCHEMA.TIMESTAMP_FORMAT" });
+        }
+        // VERSION.MONOTONIC
+        if (v <= prevVersion) {
+            violations.push({ version: v, category: "version", message: `Version ${v} <= previous ${prevVersion}`, checkId: "VERSION.MONOTONIC" });
+        }
+        // TIMESTAMP.MONOTONIC
+        if (prevTimestamp && entry.timestamp) {
+            const prevMs = new Date(prevTimestamp).getTime();
+            const currMs = new Date(entry.timestamp).getTime();
+            if (!isNaN(prevMs) && !isNaN(currMs) && currMs < prevMs - timestampToleranceMs) {
+                violations.push({ version: v, category: "timestamp", message: "Timestamp goes backward", checkId: "TIMESTAMP.MONOTONIC" });
+            }
+        }
+        // ENUM.VALID
+        if (entry.scaffoldType && !VALID_SCAFFOLD_TYPES.includes(entry.scaffoldType)) {
+            violations.push({ version: v, category: "enum", message: `Invalid scaffoldType: ${entry.scaffoldType}`, checkId: "ENUM.VALID" });
+        }
+        if (entry.depthLevel && !VALID_DEPTH_LEVELS.includes(entry.depthLevel)) {
+            violations.push({ version: v, category: "enum", message: `Invalid depthLevel: ${entry.depthLevel}`, checkId: "ENUM.VALID" });
+        }
+        if (entry.epistemicMode && !VALID_EPISTEMIC_MODES.includes(entry.epistemicMode)) {
+            violations.push({ version: v, category: "enum", message: `Invalid epistemicMode: ${entry.epistemicMode}`, checkId: "ENUM.VALID" });
+        }
+        if (entry.triageResult && !VALID_TRIAGE_RESULTS.includes(entry.triageResult)) {
+            violations.push({ version: v, category: "enum", message: `Invalid triageResult: ${entry.triageResult}`, checkId: "ENUM.VALID" });
+        }
+        // HASH.PREV_LINK
+        if (entry.prevHash !== prevHash) {
+            violations.push({ version: v, category: "hash", message: "prevHash mismatch", checkId: "HASH.PREV_LINK" });
+        }
+        // HASH.ENTRY_RECOMPUTE
+        const computedHash = hashEntry(entry);
+        if (entry.entryHash !== computedHash) {
+            violations.push({ version: v, category: "hash", message: "entryHash mismatch", checkId: "HASH.ENTRY_RECOMPUTE" });
+        }
+        // POSTERIOR.CHAIN
+        if (lastUpdatedPosterior !== null && typeof entry.priorPosterior === "number") {
+            const diff = Math.abs(entry.priorPosterior - lastUpdatedPosterior);
+            if (diff > 1e-9) {
+                violations.push({
+                    version: v, category: "posterior",
+                    message: `priorPosterior (${entry.priorPosterior}) != previous updatedPosterior (${lastUpdatedPosterior})`,
+                    checkId: "POSTERIOR.CHAIN",
+                });
+            }
+        }
+        prevVersion = v;
+        prevTimestamp = entry.timestamp;
+        prevHash = entry.entryHash;
+        if (typeof entry.updatedPosterior === "number") {
+            lastUpdatedPosterior = entry.updatedPosterior;
+        }
+    }
+    return { valid: violations.length === 0, violations, entriesChecked: record.entries.length };
+}
+//# sourceMappingURL=verify-record.js.map

package/vendor/qlm-measure/verifier-v03.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Verifier for schema 0.3 records — two-level verification.
+ * Evidence chain + estimate chains + record-level consent/attestation checks.
+ */
+export interface Violation03 {
+    version: number;
+    category: string;
+    message: string;
+    checkId: string;
+    chain: string;
+}
+export interface VerificationResult03 {
+    valid: boolean;
+    level: number;
+    violations: Violation03[];
+    entriesChecked: number;
+    estimators: Array<{
+        name: string;
+        version: string;
+        opaque: boolean;
+    }>;
+}
+export declare function verifyRecordV03(record: Record<string, any>, timestampToleranceMs?: number, estimateTolerance?: number): VerificationResult03;
+//# sourceMappingURL=verifier-v03.d.ts.map

package/vendor/qlm-measure/verifier-v03.js

@@ -0,0 +1,205 @@
+/**
+ * Verifier for schema 0.3 records — two-level verification.
+ * Evidence chain + estimate chains + record-level consent/attestation checks.
+ */
+import { createHash } from "crypto";
+import { reproduce } from "./rules.js";
+function canonicalize(obj) {
+    return JSON.stringify(obj, (_, v) => {
+        if (v && typeof v === "object" && !Array.isArray(v)) {
+            return Object.keys(v).sort().reduce((s, k) => {
+                s[k] = v[k];
+                return s;
+            }, {});
+        }
+        return v;
+    });
+}
+function sha256(s) {
+    return createHash("sha256").update(s).digest("hex");
+}
+const VALID_ST = new Set(["none", "socratic", "probing", "metacognitive", "scaffolding", "explain", "hint", "demonstrate"]);
+const VALID_EM = new Set(["experience", "inference", "analogy", "testimony"]);
+const VALID_CA = new Set(["granted", "withdrawn"]);
+const VALID_CS = new Set(["instruction", "research", "export"]);
+const VALID_TR = new Set(["correct", "slip", "misconception", "disengagement", "ambiguous"]);
+const VALID_DL = new Set(["surface", "conceptual", "transfer", "integration"]);
+const VALID_DT = new Set(["INSTRUCTIONAL", "REPORTING", "PLACEMENT", "CREDENTIAL"]);
+export function verifyRecordV03(record, timestampToleranceMs = 1000, estimateTolerance = 1e-4) {
+    const violations = [];
+    const V = (v, cat, msg, id, chain) => violations.push({ version: v, category: cat, message: msg, checkId: id, chain });
+    if (!record.studentScopeId)
+        V(0, "schema", "Missing studentScopeId", "SCHEMA.REQUIRED", "record");
+    const evidence = record.evidence || {};
+    const evEntries = evidence.entries || [];
+    const estimates = record.estimates || [];
+    const attestations = record.attestations || [];
+    const exportBlock = record.export;
+    const level = estimates.length > 0 ? 2 : 1;
+    // Evidence chain
+    const evByVersion = {};
+    const evByHash = {};
+    const compacted = evidence.compactedBefore;
+    let prevV = compacted?.version ?? 0;
+    let prevH = compacted?.summaryHash ?? "";
+    let prevTs = "";
+    const consentState = {};
+    for (const entry of evEntries) {
+        const v = entry.version ?? -1;
+        const ch = "evidence";
+        for (const req of ["version", "timestamp", "eventHash", "event", "prevHash", "entryHash"]) {
+            if (!(req in entry))
+                V(v, "schema", `${req} is required`, "SCHEMA.REQUIRED", ch);
+        }
+        const ts = entry.timestamp || "";
+        const tsMs = ts ? new Date(ts).getTime() : NaN;
+        if (ts && isNaN(tsMs))
+            V(v, "timestamp", `Not valid ISO 8601: ${ts}`, "SCHEMA.TIMESTAMP_FORMAT", ch);
+        if (typeof v === "number" && v <= prevV)
+            V(v, "version", `Version ${v} <= previous ${prevV}`, "VERSION.MONOTONIC", ch);
+        if (prevTs && ts && !isNaN(tsMs)) {
+            const pm = new Date(prevTs).getTime();
+            if (!isNaN(pm) && tsMs < pm - timestampToleranceMs)
+                V(v, "timestamp", "Timestamp goes backward", "TIMESTAMP.MONOTONIC", ch);
+        }
+        const event = entry.event || {};
+        const kind = event.redacted ? "redacted" : (event.action && VALID_CA.has(event.action)) ? "consent" : "correct" in event ? "observation" : "unknown";
+        if (kind === "unknown")
+            V(v, "schema", "Event is not Observation, Consent, or Redacted", "SCHEMA.EVENT_UNION", ch);
+        if (kind === "observation") {
+            if (event.scaffoldType && !VALID_ST.has(event.scaffoldType))
+                V(v, "enum", `Invalid scaffoldType`, "ENUM.VALID", ch);
+            if (event.epistemicMode && !VALID_EM.has(event.epistemicMode))
+                V(v, "enum", `Invalid epistemicMode`, "ENUM.VALID", ch);
+        }
+        if (kind === "consent") {
+            if (!VALID_CA.has(event.action))
+                V(v, "enum", `Invalid consent action`, "ENUM.VALID", ch);
+            for (const s of event.scopes || []) {
+                if (!VALID_CS.has(s))
+                    V(v, "enum", `Invalid consent scope: ${s}`, "ENUM.VALID", ch);
+                consentState[s] = event.action;
+            }
+        }
+        if (kind !== "redacted") {
+            const computedEvHash = sha256(canonicalize(event));
+            if (entry.eventHash !== computedEvHash)
+                V(v, "hash", "eventHash mismatch", "EVENT.COMMITMENT", ch);
+        }
+        if (entry.prevHash !== prevH)
+            V(v, "hash", "prevHash mismatch", "HASH.PREV_LINK", ch);
+        const entryHashable = { version: entry.version, timestamp: entry.timestamp, eventHash: entry.eventHash, prevHash: entry.prevHash };
+        const computedEntryHash = sha256(canonicalize(entryHashable));
+        if (entry.entryHash !== computedEntryHash)
+            V(v, "hash", "entryHash mismatch", "HASH.ENTRY_RECOMPUTE", ch);
+        evByVersion[v] = entry;
+        evByHash[entry.entryHash || ""] = entry;
+        if (typeof v === "number")
+            prevV = v;
+        prevTs = ts;
+        prevH = entry.entryHash || "";
+    }
+    // Estimate chains
+    const estimatorSummaries = [];
+    for (let idx = 0; idx < estimates.length; idx++) {
+        const estChain = estimates[idx];
+        const chainLabel = `estimate:${idx}`;
+        const estimator = estChain.estimator || {};
+        if (!estimator.name)
+            V(0, "schema", "Estimator name missing", "ESTIMATE.DECLARED", chainLabel);
+        const isOpaque = estimator.opaque !== false;
+        const ruleId = estimator.ruleId;
+        const defaultParams = estimator.params || {};
+        estimatorSummaries.push({ name: estimator.name || "unknown", version: estimator.version || "?", opaque: isOpaque });
+        const estEntries = estChain.entries || [];
+        let estPrevV = estChain.compactedBefore?.version ?? 0;
+        let estPrevH = estChain.compactedBefore?.summaryHash ?? "";
+        let lastUp = null;
+        let lastEvV = 0;
+        for (const entry of estEntries) {
+            const v = entry.version ?? -1;
+            if (typeof v === "number" && v <= estPrevV)
+                V(v, "version", `Version ${v} <= previous ${estPrevV}`, "VERSION.MONOTONIC", chainLabel);
+            if (entry.prevHash !== estPrevH)
+                V(v, "hash", "prevHash mismatch", "HASH.PREV_LINK", chainLabel);
+            const hashable = { ...entry };
+            delete hashable.entryHash;
+            const computed = sha256(canonicalize(hashable));
+            if (entry.entryHash !== computed)
+                V(v, "hash", "entryHash mismatch", "HASH.ENTRY_RECOMPUTE", chainLabel);
+            const evVer = entry.evidenceVersion;
+            if (evVer != null && !(evVer in evByVersion))
+                V(v, "schema", `evidenceVersion ${evVer} not in evidence`, "ESTIMATE.LINKS_EVIDENCE", chainLabel);
+            if (evVer != null && evVer <= lastEvV)
+                V(v, "version", `evidenceVersion ${evVer} <= previous ${lastEvV}`, "ESTIMATE.ORDER", chainLabel);
+            if (entry.triageResult && !VALID_TR.has(entry.triageResult))
+                V(v, "enum", `Invalid triageResult`, "ENUM.VALID", chainLabel);
+            if (entry.depthLevel && !VALID_DL.has(entry.depthLevel))
+                V(v, "enum", `Invalid depthLevel`, "ENUM.VALID", chainLabel);
+            if (entry.decisionTier && !VALID_DT.has(entry.decisionTier))
+                V(v, "enum", `Invalid decisionTier`, "ENUM.VALID", chainLabel);
+            const w = entry.evidentialWeight;
+            if (typeof w === "number" && (w < 0 || w > 1))
+                V(v, "schema", `Weight ${w} outside [0,1]`, "WEIGHT.RANGE", chainLabel);
+            for (const f of ["priorPosterior", "updatedPosterior"]) {
+                const pv = entry[f];
+                if (typeof pv === "number" && (pv <= 0 || pv >= 1))
+                    V(v, "schema", `${f} ${pv} outside (0,1)`, "POSTERIOR.RANGE", chainLabel);
+            }
+            if (lastUp !== null && typeof entry.priorPosterior === "number" && Math.abs(entry.priorPosterior - lastUp) > 1e-9) {
+                V(v, "posterior", `priorPosterior (${entry.priorPosterior}) != previous updatedPosterior (${lastUp})`, "POSTERIOR.CHAIN", chainLabel);
+            }
+            if (!isOpaque && ruleId) {
+                const params = entry.params || defaultParams;
+                const evEntry = evByVersion[evVer] || {};
+                const evEvent = evEntry.event || {};
+                const correct = evEvent.correct;
+                if (correct !== undefined && typeof entry.priorPosterior === "number" && typeof w === "number") {
+                    const reproduced = reproduce(ruleId, params, entry.priorPosterior, correct, w);
+                    if (reproduced !== null && Math.abs(reproduced - entry.updatedPosterior) > estimateTolerance) {
+                        V(v, "estimate", `Reproduced ${reproduced.toFixed(6)} != recorded ${entry.updatedPosterior.toFixed(6)}`, "ESTIMATE.REPRODUCE", chainLabel);
+                    }
+                }
+            }
+            if (typeof v === "number")
+                estPrevV = v;
+            estPrevH = entry.entryHash || "";
+            if (typeof entry.updatedPosterior === "number")
+                lastUp = entry.updatedPosterior;
+            if (evVer != null)
+                lastEvV = evVer;
+        }
+    }
+    // Record-level
+    if (exportBlock) {
+        const scope = exportBlock.scope;
+        if (scope && consentState[scope] === "withdrawn") {
+            V(0, "consent", `Scope '${scope}' was withdrawn`, "CONSENT.WITHDRAWAL", "record");
+        }
+        else if (scope && !(scope in consentState)) {
+            V(0, "consent", `No consent for scope '${scope}'`, "CONSENT.SCOPE", "record");
+        }
+    }
+    for (const att of attestations) {
+        if (att.payload && att.payloadHash) {
+            const computed = sha256(canonicalize(att.payload));
+            if (computed !== att.payloadHash)
+                V(0, "hash", "Attestation payloadHash mismatch", "ATTEST.INTEGRITY", "record");
+        }
+        const covers = att.covers || {};
+        if (covers.throughEvidenceVersion != null && !(covers.throughEvidenceVersion in evByVersion)) {
+            V(0, "schema", `Attestation covers version ${covers.throughEvidenceVersion} not in evidence`, "ATTEST.COVERS", "record");
+        }
+        if (covers.evidenceEntryHash && !(covers.evidenceEntryHash in evByHash)) {
+            V(0, "hash", "Attestation covers hash not in evidence", "ATTEST.COVERS", "record");
+        }
+    }
+    return {
+        valid: violations.length === 0,
+        level,
+        violations,
+        entriesChecked: evEntries.length + estimates.reduce((s, e) => s + (e.entries?.length || 0), 0),
+        estimators: estimatorSummaries,
+    };
+}
+//# sourceMappingURL=verifier-v03.js.map

package/vendor/transformer/LICENSE.txt

@@ -0,0 +1,29 @@
+MIT License
+
+Copyright (c) 2026 Quantum Learning Machines
+
+This license applies to the QLM-authored transformer, companion AI Use
+profile, documentation, mapping templates and synthetic examples in this
+project, except for the separately licensed material identified in NOTICE
+and THIRD_PARTY_NOTICES.md. In particular, the bundled Internet-Draft texts
+in spec/draft-srivastava-learnlog-00.txt and
+spec/draft-srivastava-learnlog-01.txt are excluded from this MIT grant.
+Dependencies retain their own upstream licenses.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/vendor/transformer/cross-source-analysis-data.d.mts

@@ -0,0 +1,3 @@
+// Type declaration for the vendored cross-source-analysis-data.mjs. Written for this package.
+declare const data: Record<string, unknown>;
+export default data;