@sourcey/catalog-verifier 1.1.3 → 1.1.5

package/dist/modules/release/src/verification-policies.d.ts

@@ -32,246 +32,73 @@ export declare function verifyCatalogDeltaPolicies(bundle: CatalogReleaseBundle,
     agentReadinessPolicy: {
         policy_contract: "sourcey.agent-readiness-policy/v1alpha1";
         policy_version: string;
-        assessment_basis: {
-            principal: "authorized_human_or_organization";
-            initial_state: {
-                product_specific_account: false;
-                product_credentials: false;
-                paid_subscription: false;
-                provisioned_resource: false;
-                external_identity: "only_when_declared_by_exact_funnel";
-            };
-            permitted_human_boundaries: ("account_ownership_confirmation" | "delegated_identity_consent" | "final_payment_or_irreversible_commitment" | "regulated_approval")[];
-            required_handoff_properties: ("deterministic_continuation" | "exact_disclosure" | "resumable_handoff")[];
-            forbidden_substitutions: ("captcha_solving" | "concealed_agent_identity" | "human_password_or_session_sharing" | "invented_eligibility" | "unapproved_consequential_action" | "unbound_out_of_band_code" | "vendor_policy_bypass")[];
-            success: {
-                target_coverage: "every_declared_target";
-                interface_coverage: "at_least_one_declared_alternative" | "one_selected_interface_per_target";
-                authority: "scoped";
-                failure_semantics: "documented";
-                recovery: "supported";
-            };
-            observed_assessment: {
-                allowed_sources: ("non_mutating_interaction" | "operator_attested_public_observation" | "public_documentation" | "public_endpoints" | "public_metadata")[];
-                consequential_claims: "certification_required";
-            };
-        };
-        assessment_methods: {
-            method_contract: "sourcey.agent-readiness-method/v1alpha1";
-            name: string;
-            version: string;
-            capabilities: {
-                stage: "evaluate" | "operate" | "pay" | "provision" | "sign_up";
-                signal_code: string;
-                values: ("no" | "not_applicable" | "partial" | "yes")[];
-                determination_bases: ("bounded_absence" | "certification_receipt" | "direct_observation" | "explicit_first_party_declaration" | "standard_requirement")[];
-            }[];
-            surface_support: {
-                node_kinds: ("endpoint" | "interface" | "resource" | "surface_exclusion")[];
-                resource_roles: ("access" | "authentication" | "checkout" | "descriptor" | "discovery" | "documentation" | "eligibility" | "operations" | "policy" | "pricing" | "provisioning" | "recovery" | "status" | "terms")[];
-                endpoint_roles: ("authorization" | "checkout" | "protected_resource" | "recovery" | "registration" | "service" | "status" | "token" | "webhook")[];
-                interface_modalities: ("agent_service" | "command_line" | "network_api" | "software_library" | "tool_server" | "web_application")[];
-                interface_functions: ("authentication" | "commerce" | "events" | "recovery" | "service_operation")[];
-            };
-            capture: {
-                rungs: ("archive" | "headless" | "http" | "manual")[];
-                redirects: "allowed-hosts" | "reject" | "same-origin";
-                require_https: true;
-                max_redirects: number;
-                timeout_ms: number;
-                max_bytes: number;
-                freshness_capability: "current" | "history-only";
-            };
-            interaction: {
-                mode: "non_mutating";
-                max_actions: number;
-                allowed_actions: ("expand_disclosure" | "follow_link" | "navigate" | "scroll" | "select_non_submitting_control" | "wait")[];
-                forbidden_effects: ("accept_terms" | "create_account" | "create_key" | "enter_credentials" | "enter_payment_details" | "invoke_billable_service" | "provision" | "purchase" | "send_verification_code" | "submit_application")[];
-            };
-            required_artifacts: ("capture_interaction_trace" | "evidence_excerpt" | "interaction_trace" | "manual_review_note" | "screenshot" | "source_observation" | "standard_evidence_result")[];
-            failure_classes: ("authentication_required" | "capture_unavailable" | "interaction_budget_exhausted" | "invalid_structure" | "network_failure" | "policy_refusal" | "render_failure" | "timeout")[];
-            residue_classes: ("conflicting_observations" | "insufficient_determination_basis" | "manual_review_required" | "scope_mismatch" | "unresolved_signal" | "unsupported_interaction")[];
-            external_references: {
-                namespace: string;
-                version: string;
-                requirement_id: string;
-                relation: "informational-reference" | "tests";
-            }[];
-            method_digest: string;
-        }[];
-        signal_rules: {
-            stage: "evaluate" | "operate" | "pay" | "provision" | "sign_up";
-            signal_code: string;
-            evaluation_role: "barrier" | "graded" | "informational";
-            required: boolean;
-            pass_values: ("no" | "not_applicable" | "partial" | "unknown" | "yes")[];
-            constrained_values: ("no" | "not_applicable" | "partial" | "unknown" | "yes")[];
-            fail_values: ("no" | "not_applicable" | "partial" | "unknown" | "yes")[];
-            allow_not_applicable: boolean;
-            allowed_method_digests: string[];
-            selector_groups: {
-                selector_group_id: string;
-                coverage: "all_matches" | "at_least_one";
-                alternatives: {
-                    alternative_id: string;
-                    selectors: ({
-                        kind: "resource_role";
-                        roles: ("access" | "authentication" | "checkout" | "descriptor" | "discovery" | "documentation" | "eligibility" | "operations" | "policy" | "pricing" | "provisioning" | "recovery" | "status" | "terms")[];
-                    } | {
-                        kind: "endpoint_role";
-                        roles: ("authorization" | "checkout" | "protected_resource" | "recovery" | "registration" | "service" | "status" | "token" | "webhook")[];
-                    } | {
-                        kind: "interface_signature";
-                        modalities: ("agent_service" | "command_line" | "network_api" | "software_library" | "tool_server" | "web_application")[];
-                        functions: ("authentication" | "commerce" | "events" | "recovery" | "service_operation")[];
-                    } | {
-                        kind: "assessment_target_membership";
-                        membership: "direct" | "reachable" | "selected_path";
-                    } | {
-                        kind: "target_relation";
-                        relation_kind: "alternative_to" | "authenticates" | "describes" | "precedes" | "requires";
-                        direction: "from_target" | "to_target";
-                    } | {
-                        kind: "standard_requirement";
-                        requirement: {
-                            namespace: string;
-                            version: string;
-                            requirement_id: string;
-                            relation: "informational-reference" | "tests";
-                        };
-                    })[];
+        job_library: {
+            library_contract: "sourcey.agent-readiness-job-library/v1alpha1";
+            library_version: string;
+            jobs: {
+                job_id: string;
+                category: string;
+                name: string;
+                statement: string;
+                inputs: ({
+                    kind: "fixed";
+                    name: string;
+                    value: string | number | boolean;
+                } | {
+                    kind: "nonce";
+                    name: string;
+                } | {
+                    kind: "sink";
+                    name: string;
+                    sink: "email" | "phone" | "webhook";
+                })[];
+                assertions: {
+                    name: string;
+                    statement: string;
+                    proof: "dns_answer" | "dns_success" | "message_accepted" | "model_selected" | "resource_created" | "resource_read_back" | "sink_received" | "stream_chunks" | "tool_called";
                 }[];
-            }[];
-            evidence_terms?: string[] | undefined;
-            value_evidence: {
-                value: "no" | "not_applicable" | "partial" | "yes";
-                alternatives: {
-                    alternative_id: string;
-                    required_basis_kinds: ("bounded_absence" | "certification_receipt" | "direct_observation" | "explicit_first_party_declaration" | "standard_requirement")[];
-                    minimum_distinct_captures: number;
-                    require_independent_capture_rungs: boolean;
-                    required_artifacts: ("capture_interaction_trace" | "evidence_excerpt" | "interaction_trace" | "manual_review_note" | "screenshot" | "source_observation" | "standard_evidence_result")[];
-                    minimum_surfaces: number;
-                    minimum_branches: number;
+                observation_links: {
+                    from: {
+                        assertion: string;
+                        observation: string;
+                    };
+                    to: {
+                        assertion: string;
+                        observation: string;
+                    };
                 }[];
-            }[];
-            priority: number;
-            blocker?: {
-                code: string;
-                explanation: string;
-            } | undefined;
-            remediation?: {
-                code: string;
-                instruction: string;
-            } | undefined;
-            public_findings: {
-                yes: {
-                    condition: string;
-                    finding: string;
-                };
-                no: {
-                    condition: string;
-                    finding: string;
+                error_probe: {
+                    statement: string;
                 };
-                partial: {
-                    condition: string;
-                    finding: string;
-                };
-                unknown: {
-                    condition: string;
-                    finding: string;
-                };
-                not_applicable: {
-                    condition: string;
-                    finding: string;
-                };
-            };
-            external_references: {
-                namespace: string;
-                version: string;
-                requirement_id: string;
-                relation: "informational-reference" | "tests";
+                effect: "billable" | "consequential" | "read";
+                cleanup: "none" | "required";
             }[];
-            standard_evidence: {
-                requirement: {
-                    namespace: string;
-                    version: string;
-                    requirement_id: string;
-                    relation: "informational-reference" | "tests";
-                };
-                support: {
-                    result: "not_satisfied" | "satisfied";
-                    values: ("no" | "not_applicable" | "partial" | "yes")[];
-                }[];
-            }[];
-        }[];
-        aggregation: {
-            stage: "worst-signal";
-            overall: "worst-stage";
-            outcome_precedence: ("constrained" | "fail" | "not_applicable" | "pass" | "unknown")[];
-            blocker_precedence: "outcome-then-rule-priority";
-            tie_breaker: "signal-code";
-        };
-        coverage: {
-            unknown_signals: "uncovered";
-            contradicted_signals: "uncovered";
-        };
-        freshness: {
-            source: "observation-freshness-policy";
-            aggregation: "worst-evaluated-signal" | "worst-required-signal" | "worst-signal";
-        };
-        public_states: {
-            pass: {
-                state: "blocked" | "limited" | "not_applicable" | "ready" | "unknown";
-                label: string;
-            };
-            constrained: {
-                state: "blocked" | "limited" | "not_applicable" | "ready" | "unknown";
-                label: string;
-            };
-            fail: {
-                state: "blocked" | "limited" | "not_applicable" | "ready" | "unknown";
-                label: string;
-            };
-            unknown: {
-                state: "blocked" | "limited" | "not_applicable" | "ready" | "unknown";
-                label: string;
-            };
-            not_applicable: {
-                state: "blocked" | "limited" | "not_applicable" | "ready" | "unknown";
-                label: string;
-            };
+            library_digest: string;
         };
-        grading: {
-            strategy: "stage-state-cardinality";
-            grade_by_limited_stage_count: {
-                "0": "A+";
-                "1": "A";
-                "2": "B+";
-                "3": "B";
-                "4": "C+";
-                "5": "C";
-            };
-            failure_grade_by_stage: {
-                evaluate: "D";
-                sign_up: "D";
-                pay: "D";
-                provision: "F";
-                operate: "F";
+        letters: {
+            letter: "A" | "A+" | "B" | "B+" | "C" | "C+";
+            condition: {
+                workarounds_allowed: boolean;
+                recurring_allowed_in: ("confirm" | "delegation" | "discover" | "job" | "pay" | "sustain")[];
+                recurring_required_in: ("confirm" | "delegation" | "discover" | "job" | "pay" | "sustain")[] | null;
+                setup_workarounds: {
+                    minimum: number;
+                    maximum: number | null;
+                };
             };
-            unverified_barrier_grade_cap?: "B+" | undefined;
-            not_applicable_signals: "excluded";
-            unrated_when: {
-                coverage: "not-complete";
-                freshness: "not-fresh";
+            coverage: ("confirm" | "delegation" | "discover" | "job" | "pay" | "sustain")[];
+            statement: string;
+        }[];
+        blocked: {
+            attempts: number;
+            minimum_interval_seconds: number;
+            statuses: number[];
+            statements: {
+                D: string;
+                F: string;
             };
         };
-        grade_derivation: {
-            label: string;
-            explanation: string;
-            coverage_rule: string;
-            outcome_rule: string;
-        };
+        fresh_for_days: number;
         policy_digest: string;
     };
     assuranceMethodPolicy: {

package/dist/modules/release/src/verification-policies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verification-policies.d.ts","sourceRoot":"","sources":["../../../../modules/release/src/verification-policies.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,oBAAoB,EAI1B,MAAM,yCAAyC,CAAC;AAKjD,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,oBAAoB,EAC5B,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC;IAuDhC,cAAc;;;;;;;;;;;;;;;;;;;;;;;IACd,eAAe;;;;;;IACf,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IACpB,qBAAqB;;;;;;;;;;;;;;;;;;;;;;EAExB"}
+{"version":3,"file":"verification-policies.d.ts","sourceRoot":"","sources":["../../../../modules/release/src/verification-policies.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,oBAAoB,EAI1B,MAAM,yCAAyC,CAAC;AAKjD,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,oBAAoB,EAC5B,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC;IAuDhC,cAAc;;;;;;;;;;;;;;;;;;;;;;;IACd,eAAe;;;;;;IACf,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IACpB,qBAAqB;;;;;;;;;;;;;;;;;;;;;;EAExB"}

package/dist/modules/release/src/verification-policies.js

@@ -1,7 +1,7 @@
 import { digest, parseJsonFile } from "provenry/primitives";
 import { coveragePolicyCoreSchema, coveragePolicySchema, freshnessPolicyCoreSchema, freshnessPolicySchema, } from "../../../contracts/policies/src/index.js";
 import { RELEASE_RESOURCES, releasePolicyObjectPath, releaseResourceDigest, } from "../../../contracts/release/src/index.js";
-import { validateAgentReadinessPolicy } from "../../agent-readiness-policy/src/index.js";
+import { verifyAgentReadinessPolicy } from "../../agent-readiness-policy/src/operate-policy.js";
 import { CATALOG_RELEASE } from "../../artifact/src/release-directory-files.js";
 import { validateAssuranceMethodPolicy } from "../../assurance/src/index.js";
 export function verifyCatalogDeltaPolicies(bundle, delta, files) {
@@ -12,7 +12,7 @@ export function verifyCatalogDeltaPolicies(bundle, delta, files) {
     const freshness = freshnessPolicySchema.parse(parseJsonFile(files, releasePolicyObjectPath(freshnessExpected), CATALOG_RELEASE));
     const { policy_digest: freshnessDigest, ...freshnessCore } = freshness;
     const agentReadinessExpected = releaseResourceDigest(bundle.resource_digests, RELEASE_RESOURCES.agentReadinessPolicy);
-    const agentReadiness = validateAgentReadinessPolicy(parseJsonFile(files, releasePolicyObjectPath(agentReadinessExpected), CATALOG_RELEASE));
+    const agentReadiness = verifyAgentReadinessPolicy(parseJsonFile(files, releasePolicyObjectPath(agentReadinessExpected), CATALOG_RELEASE));
     const assuranceMethodExpected = releaseResourceDigest(bundle.resource_digests, RELEASE_RESOURCES.assuranceMethodPolicy);
     const assuranceMethod = validateAssuranceMethodPolicy(parseJsonFile(files, releasePolicyObjectPath(assuranceMethodExpected), CATALOG_RELEASE));
     if (digest(coveragePolicyCoreSchema.parse(coverageCore)) !== coverageDigest ||

package/dist/modules/release/src/verification-policies.js.map

@@ -1 +1 @@
-{"version":3,"file":"verification-policies.js","sourceRoot":"","sources":["../../../../modules/release/src/verification-policies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAGL,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AACzF,OAAO,EAAE,eAAe,EAAE,MAAM,+CAA+C,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAE7E,MAAM,UAAU,0BAA0B,CACxC,MAA4B,EAC5B,KAAmB,EACnB,KAAkC;IAElC,MAAM,gBAAgB,GAAG,qBAAqB,CAC5C,MAAM,CAAC,gBAAgB,EACvB,iBAAiB,CAAC,cAAc,CACjC,CAAC;IACF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CACzC,aAAa,CAAC,KAAK,EAAE,uBAAuB,CAAC,gBAAgB,CAAC,EAAE,eAAe,CAAC,CACjF,CAAC;IACF,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,GAAG,YAAY,EAAE,GAAG,QAAQ,CAAC;IACpE,MAAM,iBAAiB,GAAG,qBAAqB,CAC7C,MAAM,CAAC,gBAAgB,EACvB,iBAAiB,CAAC,eAAe,CAClC,CAAC;IACF,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAC3C,aAAa,CAAC,KAAK,EAAE,uBAAuB,CAAC,iBAAiB,CAAC,EAAE,eAAe,CAAC,CAClF,CAAC;IACF,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE,GAAG,aAAa,EAAE,GAAG,SAAS,CAAC;IACvE,MAAM,sBAAsB,GAAG,qBAAqB,CAClD,MAAM,CAAC,gBAAgB,EACvB,iBAAiB,CAAC,oBAAoB,CACvC,CAAC;IACF,MAAM,cAAc,GAAG,4BAA4B,CACjD,aAAa,CAAC,KAAK,EAAE,uBAAuB,CAAC,sBAAsB,CAAC,EAAE,eAAe,CAAC,CACvF,CAAC;IACF,MAAM,uBAAuB,GAAG,qBAAqB,CACnD,MAAM,CAAC,gBAAgB,EACvB,iBAAiB,CAAC,qBAAqB,CACxC,CAAC;IACF,MAAM,eAAe,GAAG,6BAA6B,CACnD,aAAa,CAAC,KAAK,EAAE,uBAAuB,CAAC,uBAAuB,CAAC,EAAE,eAAe,CAAC,CACxF,CAAC;IACF,IACE,MAAM,CAAC,wBAAwB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,cAAc;QACvE,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,KAAK,eAAe;QAC1E,gBAAgB,KAAK,cAAc;QACnC,iBAAiB,KAAK,eAAe;QACrC,sBAAsB,KAAK,cAAc,CAAC,aAAa;QACvD,uBAAuB,KAAK,eAAe,CAAC,aAAa;QACzD,qBAAqB,CACnB,KAAK,CAAC,aAAa,CAAC,cAAc,EAClC,iBAAiB,CAAC,oBAAoB,CACvC,KAAK,cAAc,CAAC,aAAa;QAClC,qBAAqB,CACnB,KAAK,CAAC,aAAa,CAAC,cAAc,EAClC,iBAAiB,CAAC,qBAAqB,CACxC,KAAK,eAAe,CAAC,aAAa;QACnC,qBAAqB,CAAC,KAAK,CAAC,aAAa,CAAC,cAAc,EAAE,iBAAiB,CAAC,cAAc,CAAC;YACzF,cAAc;QAChB,qBAAqB,CAAC,KAAK,CAAC,aAAa,CAAC,cAAc,EAAE,iBAAiB,CAAC,eAAe,CAAC;YAC1F,eAAe,EACjB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO;QACL,cAAc,EAAE,QAAQ;QACxB,eAAe,EAAE,SAAS;QAC1B,oBAAoB,EAAE,cAAc;QACpC,qBAAqB,EAAE,eAAe;KACvC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"verification-policies.js","sourceRoot":"","sources":["../../../../modules/release/src/verification-policies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAGL,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,0BAA0B,EAAE,MAAM,oDAAoD,CAAC;AAChG,OAAO,EAAE,eAAe,EAAE,MAAM,+CAA+C,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAE7E,MAAM,UAAU,0BAA0B,CACxC,MAA4B,EAC5B,KAAmB,EACnB,KAAkC;IAElC,MAAM,gBAAgB,GAAG,qBAAqB,CAC5C,MAAM,CAAC,gBAAgB,EACvB,iBAAiB,CAAC,cAAc,CACjC,CAAC;IACF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CACzC,aAAa,CAAC,KAAK,EAAE,uBAAuB,CAAC,gBAAgB,CAAC,EAAE,eAAe,CAAC,CACjF,CAAC;IACF,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,GAAG,YAAY,EAAE,GAAG,QAAQ,CAAC;IACpE,MAAM,iBAAiB,GAAG,qBAAqB,CAC7C,MAAM,CAAC,gBAAgB,EACvB,iBAAiB,CAAC,eAAe,CAClC,CAAC;IACF,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAC3C,aAAa,CAAC,KAAK,EAAE,uBAAuB,CAAC,iBAAiB,CAAC,EAAE,eAAe,CAAC,CAClF,CAAC;IACF,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE,GAAG,aAAa,EAAE,GAAG,SAAS,CAAC;IACvE,MAAM,sBAAsB,GAAG,qBAAqB,CAClD,MAAM,CAAC,gBAAgB,EACvB,iBAAiB,CAAC,oBAAoB,CACvC,CAAC;IACF,MAAM,cAAc,GAAG,0BAA0B,CAC/C,aAAa,CAAC,KAAK,EAAE,uBAAuB,CAAC,sBAAsB,CAAC,EAAE,eAAe,CAAC,CACvF,CAAC;IACF,MAAM,uBAAuB,GAAG,qBAAqB,CACnD,MAAM,CAAC,gBAAgB,EACvB,iBAAiB,CAAC,qBAAqB,CACxC,CAAC;IACF,MAAM,eAAe,GAAG,6BAA6B,CACnD,aAAa,CAAC,KAAK,EAAE,uBAAuB,CAAC,uBAAuB,CAAC,EAAE,eAAe,CAAC,CACxF,CAAC;IACF,IACE,MAAM,CAAC,wBAAwB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,cAAc;QACvE,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,KAAK,eAAe;QAC1E,gBAAgB,KAAK,cAAc;QACnC,iBAAiB,KAAK,eAAe;QACrC,sBAAsB,KAAK,cAAc,CAAC,aAAa;QACvD,uBAAuB,KAAK,eAAe,CAAC,aAAa;QACzD,qBAAqB,CACnB,KAAK,CAAC,aAAa,CAAC,cAAc,EAClC,iBAAiB,CAAC,oBAAoB,CACvC,KAAK,cAAc,CAAC,aAAa;QAClC,qBAAqB,CACnB,KAAK,CAAC,aAAa,CAAC,cAAc,EAClC,iBAAiB,CAAC,qBAAqB,CACxC,KAAK,eAAe,CAAC,aAAa;QACnC,qBAAqB,CAAC,KAAK,CAAC,aAAa,CAAC,cAAc,EAAE,iBAAiB,CAAC,cAAc,CAAC;YACzF,cAAc;QAChB,qBAAqB,CAAC,KAAK,CAAC,aAAa,CAAC,cAAc,EAAE,iBAAiB,CAAC,eAAe,CAAC;YAC1F,eAAe,EACjB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO;QACL,cAAc,EAAE,QAAQ;QACxB,eAAe,EAAE,SAAS;QAC1B,oBAAoB,EAAE,cAAc;QACpC,qBAAqB,EAAE,eAAe;KACvC,CAAC;AACJ,CAAC"}

package/dist/modules/sourcey-publication/src/verifier.d.ts

@@ -1,3 +1,4 @@
+import type { AttestedCapture } from "provenry/capture/attestation";
 import { type Digest } from "provenry/primitives";
 import { type AgentReadinessDeltaObject, type AgentReadinessOfferRelationDeltaObject, type AgentReadinessProjection } from "../../../contracts/agent-readiness/src/index.js";
 import type { CompiledEntity, releaseChangeSchema } from "../../../contracts/artifact/src/index.js";
@@ -5,7 +6,6 @@ import type { AssetDelta } from "../../../contracts/assets/src/index.js";
 import type { EntityAuthoring } from "../../../contracts/authoring/src/index.js";
 import type { RootSet, SignerRegistry } from "../../../contracts/authority/src/index.js";
 import type { CatalogEvent } from "../../../contracts/events/src/index.js";
-import { type CaptureReceipt } from "../../../contracts/evidence/src/index.js";
 import { type Observation } from "../../../contracts/observations/src/index.js";
 import type { CatalogPublicationChangeSet, CatalogPublicationIngress, CatalogPublicationProposal, PublicationIngressReceipt } from "../../../contracts/publication/src/index.js";
 import { type CatalogDelta, type CatalogReleaseBundle } from "../../../contracts/release/src/index.js";
@@ -28,7 +28,8 @@ export interface VerifiedCatalogDelta {
     readonly agentReadinessOfferRelationObjects: ReadonlyMap<string, AgentReadinessOfferRelationDeltaObject>;
     readonly events: readonly CatalogEvent[];
     readonly observations: readonly Observation[];
-    readonly captureReceipts: readonly CaptureReceipt[];
+    /** The attested captures the delta's new evidence cites, by attestation digest. */
+    readonly attestedCaptures: ReadonlyMap<string, AttestedCapture>;
     readonly publicationProposal: CatalogPublicationProposal;
     readonly publicationChangeSet: CatalogPublicationChangeSet;
     readonly ingressReceipts: readonly PublicationIngressReceipt[];
@@ -44,5 +45,5 @@ export declare function verifyCatalogDeltaDirectory(directory: string, trust?: {
 /** Verifies a delta release whose envelope is already verified. */
 export declare function verifyCatalogDelta(release: VerifiedSourceyRelease, trust?: {
     readonly rootSetDigest: Digest;
-}): VerifiedCatalogDelta;
+}): Promise<VerifiedCatalogDelta>;
 //# sourceMappingURL=verifier.d.ts.map

package/dist/modules/sourcey-publication/src/verifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../../../modules/sourcey-publication/src/verifier.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,MAAM,EAKZ,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAEL,KAAK,yBAAyB,EAC9B,KAAK,sCAAsC,EAG3C,KAAK,wBAAwB,EAS9B,MAAM,iDAAiD,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACpG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAEzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAEzF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AAC3E,OAAO,EACL,KAAK,cAAc,EAEpB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,KAAK,WAAW,EAAqB,MAAM,8CAA8C,CAAC;AACnG,OAAO,KAAK,EACV,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,yBAAyB,EAC1B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,oBAAoB,EAQ1B,MAAM,yCAAyC,CAAC;AAqBjD,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,oDAAoD,CAAC;AAE5D,OAAO,EAIL,KAAK,sBAAsB,EAC5B,MAAM,yCAAyC,CAAC;AAwBjD,OAAO,EACL,KAAK,6BAA6B,EAEnC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,6BAA6B,CAAC;IACpD,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACvD,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC,CAAC;IACnE,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACzD,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAAC,CAAC;IACrE,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrD,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACjE,QAAQ,CAAC,sBAAsB,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IAC/E,QAAQ,CAAC,qBAAqB,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;IAC/E,QAAQ,CAAC,kCAAkC,EAAE,WAAW,CACtD,MAAM,EACN,sCAAsC,CACvC,CAAC;IACF,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,SAAS,WAAW,EAAE,CAAC;IAC9C,QAAQ,CAAC,eAAe,EAAE,SAAS,cAAc,EAAE,CAAC;IACpD,QAAQ,CAAC,mBAAmB,EAAE,0BAA0B,CAAC;IACzD,QAAQ,CAAC,oBAAoB,EAAE,2BAA2B,CAAC;IAC3D,QAAQ,CAAC,eAAe,EAAE,SAAS,yBAAyB,EAAE,CAAC;IAC/D,QAAQ,CAAC,oBAAoB,EAAE,SAAS,yBAAyB,EAAE,CAAC;IACpE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,CAAC,OAAO,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;CAC3E;AAED,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE;IAAE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GACzC,OAAO,CAAC,oBAAoB,CAAC,CAE/B;AAED,mEAAmE;AACnE,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,sBAAsB,EAC/B,KAAK,CAAC,EAAE;IAAE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GACzC,oBAAoB,CA6RtB"}
+{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../../../modules/sourcey-publication/src/verifier.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAGL,KAAK,MAAM,EAKZ,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAEL,KAAK,yBAAyB,EAC9B,KAAK,sCAAsC,EAG3C,KAAK,wBAAwB,EAW9B,MAAM,iDAAiD,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACpG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAEzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAEzF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AAC3E,OAAO,EAAE,KAAK,WAAW,EAAqB,MAAM,8CAA8C,CAAC;AACnG,OAAO,KAAK,EACV,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,yBAAyB,EAC1B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,oBAAoB,EAQ1B,MAAM,yCAAyC,CAAC;AAkBjD,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,oDAAoD,CAAC;AAE5D,OAAO,EAIL,KAAK,sBAAsB,EAC5B,MAAM,yCAAyC,CAAC;AAyBjD,OAAO,EACL,KAAK,6BAA6B,EAEnC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,6BAA6B,CAAC;IACpD,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACvD,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC,CAAC;IACnE,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACzD,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAAC,CAAC;IACrE,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrD,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACjE,QAAQ,CAAC,sBAAsB,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IAC/E,QAAQ,CAAC,qBAAqB,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;IAC/E,QAAQ,CAAC,kCAAkC,EAAE,WAAW,CACtD,MAAM,EACN,sCAAsC,CACvC,CAAC;IACF,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,SAAS,WAAW,EAAE,CAAC;IAC9C,mFAAmF;IACnF,QAAQ,CAAC,gBAAgB,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAChE,QAAQ,CAAC,mBAAmB,EAAE,0BAA0B,CAAC;IACzD,QAAQ,CAAC,oBAAoB,EAAE,2BAA2B,CAAC;IAC3D,QAAQ,CAAC,eAAe,EAAE,SAAS,yBAAyB,EAAE,CAAC;IAC/D,QAAQ,CAAC,oBAAoB,EAAE,SAAS,yBAAyB,EAAE,CAAC;IACpE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,CAAC,OAAO,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;CAC3E;AAED,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE;IAAE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GACzC,OAAO,CAAC,oBAAoB,CAAC,CAE/B;AAED,mEAAmE;AACnE,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,sBAAsB,EAC/B,KAAK,CAAC,EAAE;IAAE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GACzC,OAAO,CAAC,oBAAoB,CAAC,CA2R/B"}

package/dist/modules/sourcey-publication/src/verifier.js

@@ -1,22 +1,23 @@
 import { basename } from "node:path";
 import { canonicalJson, compareCanonicalStrings, digest, digestFromPathSegment, digestPathSegment, parseJsonFile, } from "provenry/primitives";
 import { publicationParent } from "provenry/publication/envelope";
-import { agentReadinessDeltaObjectSchema, agentReadinessInputsSchema, agentReadinessOfferRelationDeltaObjectSchema, agentReadinessOfferRelationInputsSchema, agentReadinessOfferRelationRevisionCoreSchema, agentReadinessProfileInputSchema, agentReadinessRevisionContract, } from "../../../contracts/agent-readiness/src/index.js";
+import { agentReadinessDeclarationRevisionSchema, agentReadinessDeltaObjectSchema, agentReadinessInputsSchema, agentReadinessOfferRelationDeltaObjectSchema, agentReadinessOfferRelationInputsSchema, agentReadinessOfferRelationRevisionCoreSchema, agentReadinessProfileInputSchema, agentReadinessRevisionContract, agentReadinessRevisionSchema, } from "../../../contracts/agent-readiness/src/index.js";
 import { assetDeltaSchema } from "../../../contracts/assets/src/index.js";
 import { rootSetSchema } from "../../../contracts/authority/src/index.js";
-import { captureReceiptSchema, } from "../../../contracts/evidence/src/index.js";
 import { observationSchema } from "../../../contracts/observations/src/index.js";
 import { catalogDeltaAuthoringObjectSchema, catalogDeltaEntityObjectSchema, catalogDeltaSchema, RELEASE_RESOURCES, releaseResourceDigest, releaseRootSetObjectPath, releaseSignerRegistryObjectPath, } from "../../../contracts/release/src/index.js";
 import { compileAgentReadinessOfferRelationRevision, compileAgentReadinessRevision, deriveAgentReadinessProjection, } from "../../agent-readiness-policy/src/index.js";
 import { addressFromReleaseJsonPath, CATALOG_RELEASE, releasedEvidenceObjects, } from "../../artifact/src/release-directory-files.js";
 import { validateTrustHistory } from "../../artifact/src/trust-history.js";
 import { verifyAssetDelta } from "../../assets/src/index.js";
-import { validateProtectedCaptureReceipt, validateProtectedEvent, validateSignerRegistry, } from "../../authority/src/index.js";
+import { validateProtectedEvent, validateSignerRegistry } from "../../authority/src/index.js";
 import { verifyCatalogPublicationAuthoringChanges } from "../../catalog-admission/src/publication-composition.js";
+import { verifyReleasedCaptureRecords } from "../../evidence-operations/src/attested-capture.js";
 import { verifyEvidenceObjectGraph } from "../../evidence-operations/src/proof-graph.js";
 import { parseRetainedCatalogRevision, } from "../../evidence-operations/src/retained-revision.js";
 import { buildEventGraph } from "../../provenance/src/index.js";
 import { readVerifiedSourceyRelease, SOURCEY_DELTA_STATE_FILE, sourceyReleaseEnvelope, } from "../../publication-instance/src/index.js";
+import { assertAgentReadinessAdmitted } from "../../release/src/agent-readiness-authority.js";
 import { verifyAgentReadinessPublicationInputs } from "../../release/src/agent-readiness-publication-inputs.js";
 import { AGENT_READINESS_REGRADE_EVIDENCE_PREFIX, assertAgentReadinessRegradeEvidenceClosure, expectedAgentReadinessRegradeProjection, readAgentReadinessRegradeEvidenceFile, selectAgentReadinessEvidenceChanges, } from "../../release/src/agent-readiness-regrade-evidence.js";
 import { assertCatalogAssetDeltaClosure } from "../../release/src/asset-delta-verifier.js";
@@ -31,7 +32,7 @@ export async function verifyCatalogDeltaDirectory(directory, trust) {
     return verifyCatalogDelta(await readVerifiedSourceyRelease(directory), trust);
 }
 /** Verifies a delta release whose envelope is already verified. */
-export function verifyCatalogDelta(release, trust) {
+export async function verifyCatalogDelta(release, trust) {
     if (release.kind !== "delta") {
         throw new Error(`Catalog delta bundle is missing ${SOURCEY_DELTA_STATE_FILE}.`);
     }
@@ -76,8 +77,8 @@ export function verifyCatalogDelta(release, trust) {
     const priorAuthoring = new Map();
     const revisions = new Map();
     const events = [];
+    const eventIds = new Set();
     const observations = [];
-    const captureReceipts = [];
     const agentReadinessObjects = new Map();
     const agentReadinessRegradeEvidence = new Map();
     const agentReadinessOfferRelationObjects = new Map();
@@ -162,9 +163,14 @@ export function verifyCatalogDelta(release, trust) {
             const input = JSON.parse(bytes.toString("utf8"));
             const address = addressFromReleaseJsonPath(path);
             const inclusion = delta.provenance.events[address];
-            if (!inclusion || input.event_id !== address) {
-                throw new Error(`Catalog delta event ${path} lacks its exact inclusion.`);
+            if (!inclusion ||
+                input.event_id !== address ||
+                inclusion.event_id !== address ||
+                eventIds.has(address) ||
+                inclusion.first_inclusion_sequence !== descriptor.release_core.release_sequence) {
+                throw new Error(`Catalog delta event ${path} lacks its exact first inclusion.`);
             }
+            eventIds.add(address);
             const event = validateProtectedEvent(input, registry, inclusion.first_inclusion_sequence);
             if (digest(event) !== inclusion.event_object_digest ||
                 event.operation_id !== inclusion.operation_id ||
@@ -183,29 +189,24 @@ export function verifyCatalogDelta(release, trust) {
             }
             observations.push(observation);
         }
-        else if (path.startsWith("capture-receipts/")) {
-            const input = captureReceiptSchema.parse(JSON.parse(bytes.toString("utf8")));
-            const address = addressFromReleaseJsonPath(path);
-            const inclusion = delta.provenance.capture_receipts[address];
-            if (!inclusion || input.receipt_digest !== address) {
-                throw new Error(`Catalog delta capture receipt ${path} lacks its exact inclusion.`);
-            }
-            const receipt = validateProtectedCaptureReceipt(input, registry, inclusion.first_inclusion_sequence);
-            if (digest(receipt) !== inclusion.receipt_object_digest ||
-                receipt.operation_id !== inclusion.operation_id ||
-                receipt.issuer_id !== inclusion.issuer_id ||
-                inclusion.signer_registry_digest !== registry.registry_digest) {
-                throw new Error(`Catalog delta capture receipt ${path} disagrees with its inclusion.`);
-            }
-            captureReceipts.push(receipt);
-        }
     }
-    assertDeltaClosure(delta, entities, priorEntities, authoring, priorAuthoring, publication.proposal, publication.change_set, revisions, events, observations, captureReceipts, files, { agentReadiness: profileInputPaths, offerRelations: relationInputPaths }, agentReadinessObjects, agentReadinessRegradeEvidence, agentReadinessOfferRelationObjects, policies, assetDelta, safeAssetBytes);
+    // A delta carries nothing: each attestation is first included here, judged by its registry.
+    const deltaSequence = descriptor.release_core.release_sequence;
+    if (Object.values(delta.provenance.capture_attestations).some((inclusion) => inclusion.first_inclusion_sequence !== deltaSequence)) {
+        throw new Error("Catalog delta capture attestations must be first included in the delta.");
+    }
+    const attestedCaptures = await verifyReleasedCaptureRecords({
+        files,
+        inclusions: delta.provenance.capture_attestations,
+        releaseSequence: deltaSequence,
+        registryFor: (signerRegistryDigest) => signerRegistryDigest === registry.registry_digest ? registry : undefined,
+    });
+    assertDeltaClosure(delta, entities, priorEntities, authoring, priorAuthoring, publication.proposal, publication.change_set, revisions, events, files, { agentReadiness: profileInputPaths, offerRelations: relationInputPaths }, agentReadinessObjects, agentReadinessRegradeEvidence, agentReadinessOfferRelationObjects, policies, assetDelta, safeAssetBytes);
     verifyEvidenceObjectGraph({
         revisions: [...revisions.values()],
         events,
         observations,
-        captureReceipts,
+        attestedCaptures,
         ...releasedEvidenceObjects(observations, files, bundle.files),
         capturesProven: true,
     });
@@ -236,7 +237,7 @@ export function verifyCatalogDelta(release, trust) {
         agentReadinessOfferRelationObjects,
         events: events.sort((left, right) => compareCanonicalStrings(left.event_id, right.event_id)),
         observations: observations.sort((left, right) => compareCanonicalStrings(left.observation_id, right.observation_id)),
-        captureReceipts: captureReceipts.sort((left, right) => compareCanonicalStrings(left.receipt_digest, right.receipt_digest)),
+        attestedCaptures,
         publicationProposal: publication.proposal,
         publicationChangeSet: publication.change_set,
         ingressReceipts: publication.ingresses.map(({ ingress_receipt }) => ingress_receipt),
@@ -269,14 +270,15 @@ function verifyReleaseChain(bundle, delta, descriptor, agentReadinessChanges, ag
         throw new Error("Catalog delta does not form one exact canonical successor.");
     }
 }
-function assertDeltaClosure(delta, entities, priorEntities, authoring, priorAuthoring, publicationProposal, publicationChangeSet, revisions, events, observations, captureReceipts, files, inputPaths, agentReadinessObjects, agentReadinessRegradeEvidence, agentReadinessOfferRelationObjects, policies, assetDelta, safeAssetBytes) {
+function assertDeltaClosure(delta, entities, priorEntities, authoring, priorAuthoring, publicationProposal, publicationChangeSet, revisions, events, files, inputPaths, agentReadinessObjects, agentReadinessRegradeEvidence, agentReadinessOfferRelationObjects, policies, assetDelta, safeAssetBytes) {
     assertAgentReadinessRegradeEvidenceClosure(agentReadinessRegradeEvidence, agentReadinessObjects);
+    const admittedProfileInputs = verifyAgentReadinessPublicationInputs({
+        files,
+        proposal: publicationProposal,
+        profiles: agentReadinessObjects,
+    });
     verifyAgentReadinessOfferRelationWithdrawals({
-        admittedProfileInputs: verifyAgentReadinessPublicationInputs({
-            files,
-            proposal: publicationProposal,
-            profiles: agentReadinessObjects,
-        }),
+        admittedProfileInputs,
         objects: agentReadinessOfferRelationObjects,
         profiles: agentReadinessObjects,
         revisions,
@@ -341,8 +343,8 @@ function assertDeltaClosure(delta, entities, priorEntities, authoring, priorAuth
             }
         }
     }
-    if (events.length !== Object.keys(delta.provenance.events).length ||
-        captureReceipts.length !== Object.keys(delta.provenance.capture_receipts).length) {
+    // Event ids are distinct and each has its witness, so equal counts make equal sets.
+    if (events.length !== Object.keys(delta.provenance.events).length) {
         throw new Error("Catalog delta evidence objects and inclusion records disagree.");
     }
     const changedInputCount = [...agentReadinessObjects.values()].filter((object) => object.profile_input !== null).length;
@@ -423,14 +425,13 @@ function assertDeltaClosure(delta, entities, priorEntities, authoring, priorAuth
         const context = object.catalog_context;
         if (!context)
             throw new Error(`Agent Readiness delta ${profileId} lacks Catalog context.`);
-        const revision = revisions.get(current.revision_digest);
-        if (revision?.revision_contract !== agentReadinessRevisionContract) {
+        const retainedRevision = revisions.get(current.revision_digest);
+        if (retainedRevision?.revision_contract !== agentReadinessRevisionContract) {
             throw new Error(`Agent Readiness delta ${profileId} lacks its exact revision.`);
         }
-        const declarationRevision = revisions.get(revision.declaration_revision_digest);
-        if (declarationRevision?.revision_contract !==
-            "sourcey.agent-readiness-declaration-revision/v1alpha1" ||
-            canonicalJson(declarationRevision) !== canonicalJson(context.declaration_revision)) {
+        const revision = agentReadinessRevisionSchema.parse(retainedRevision);
+        const declarationRevision = agentReadinessDeclarationRevisionSchema.parse(revisions.get(revision.declaration_revision_digest));
+        if (canonicalJson(declarationRevision) !== canonicalJson(context.declaration_revision)) {
             throw new Error(`Agent Readiness delta ${profileId} lacks its declaration revision.`);
         }
         if (
@@ -444,13 +445,11 @@ function assertDeltaClosure(delta, entities, priorEntities, authoring, priorAuth
         }
         let expected;
         if (object.profile_input) {
-            const profileEvidence = selectAgentReadinessEvidenceChanges({
+            const graph = buildEventGraph(selectAgentReadinessEvidenceChanges({
                 profileId,
                 revisionDigest: revision.revision_digest,
                 events,
-                observations,
-            });
-            const graph = buildEventGraph(profileEvidence.events, profileEvidence.observations);
+            }), []);
             const inputEntry = inputEntries.get(profileId);
             if (!inputEntry ||
                 inputEntry.input_digest !== digest(object.profile_input) ||
@@ -462,6 +461,15 @@ function assertDeltaClosure(delta, entities, priorEntities, authoring, priorAuth
                     canonicalJson(revision)) {
                 throw new Error(`Agent Readiness delta ${profileId} has invalid canonical input.`);
             }
+            const releaseInput = admittedProfileInputs.get(profileId);
+            if (!releaseInput) {
+                throw new Error(`Agent Readiness delta ${profileId} lacks its admitted release input.`);
+            }
+            assertAgentReadinessAdmitted({
+                events,
+                releaseInput,
+                policy: policies.agentReadinessPolicy,
+            });
             profileInputs.push({
                 input: object.profile_input,
                 declarationRevision,
@@ -478,7 +486,6 @@ function assertDeltaClosure(delta, entities, priorEntities, authoring, priorAuth
                 graph,
                 policy: policies.agentReadinessPolicy,
                 policyAsOf: delta.policy_as_of,
-                freshnessPolicy: policies.freshnessPolicy,
             });
         }
         else {
@@ -491,15 +498,13 @@ function assertDeltaClosure(delta, entities, priorEntities, authoring, priorAuth
                 entityRevision: context.entity_revision,
                 entitySlug: context.entity_slug,
                 evidence: agentReadinessRegradeEvidence.get(profileId),
-                deltaEvidence: selectAgentReadinessEvidenceChanges({
+                deltaEvents: selectAgentReadinessEvidenceChanges({
                     profileId,
                     revisionDigest: revision.revision_digest,
                     events,
-                    observations,
                 }),
                 policy: policies.agentReadinessPolicy,
                 policyAsOf: delta.policy_as_of,
-                freshnessPolicy: policies.freshnessPolicy,
             });
         }
         if (canonicalJson(expected) !== canonicalJson(current)) {
@@ -520,8 +525,6 @@ function assertDeltaClosure(delta, entities, priorEntities, authoring, priorAuth
         policy: policies.agentReadinessPolicy,
         entityIds: new Set([...agentReadinessObjects.values()].flatMap((object) => object.catalog_context ? [object.catalog_context.entity_revision.entity_id] : [])),
         offers: relationOffers,
-        events,
-        observations,
     });
     const declaredRelationInputPaths = new Set([...relationInputEntries.values()].map((entry) => entry.path));
     if (declaredRelationInputPaths.size !== inputPaths.offerRelations.length ||