@typedstandards/civic-typed-harness 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -3,6 +3,225 @@
 Factual record of what changed per published version. Section references are
 to the Typed Standards specification unless noted otherwise.
 
+## 0.5.0 — 2026-09-18
+
+The list is derived from
+`git log 33a3aff..<this release> -- packages/civic-typed-harness/` — `33a3aff`
+is the 0.4.1 release bump — so it is the commit range rather than a
+recollection.
+Three commits landed after that bump and had no entry; this phase's two
+changes join them.
+
+**Together, the two changes below make a record name the servers the run
+actually had, and say nothing where it does not know.** They are the harness
+half of
+[civic-ai-tools#205](https://github.com/npstorey/civic-ai-tools/issues/205)
+and
+[civic-ai-tools-website#449](https://github.com/npstorey/civic-ai-tools-website/issues/449);
+the caller half (a registry built from the instance's own configuration, and
+the packager passing the list) lands in the reference application.
+
+### The environment extension can name every server, not only the skill's
+
+- **`buildDatHereEnvironment` accepts a list of MCP servers**, additively. Its
+  second parameter is now `string | readonly DatHereMcpServer[] | undefined`:
+  the bare string is the pre-0.5.0 shape — the trace's skill-fetch URL, the one
+  server the builder could name — and a list is emitted in the order the caller
+  gives, each entry carrying `name` only when the caller supplied one. Spec
+  §8.7.1 requirement 3 always specified `mcpServers` as "an array of objects
+  with `url` and optional `name`"; until now the harness could only ever put
+  one object in it.
+- **The single-URL shape is byte-identical to before**, and a test pins those
+  exact bytes rather than deep-equality, because an already-signed datHere
+  package reproduces through this function. A one-entry list with no `name`
+  produces the same bytes as the string, which is the same statement from the
+  other side.
+- **`DatHerePolicyInput` gains `mcpServers`**, consulted in preference to
+  `skillMcpServerUrl` and falling back to it, so `deriveDatHereEnvelopeFields`
+  carries the list through without any existing caller changing.
+- **New export:** the `DatHereMcpServer` interface. An entry whose `url` is
+  empty contributes nothing — the same rule the single-URL shape always
+  applied: a server with no address is stated by absence, never by an empty
+  string.
+
+### A source agent names the configured address, or names no address at all
+
+- **`CivicSourceInfo.serverUrl` is optional.** The address a run reached is the
+  operator's configuration, not a fact the harness knows. A caller passes a
+  registry whose entries carry the addresses that instance is pointed at.
+- **`buildProvenanceGraph` omits `civic:serverUrl` when it has no address.**
+  Two shapes reach that: a registry entry that carries no `serverUrl`, and a
+  source id the registry does not carry at all. Both now emit an agent with no
+  `civic:serverUrl` key — the key's absence, not an empty string — so the
+  signed bytes say the address is unknown instead of naming a server the
+  analysis may never have contacted. When an address IS known the key keeps its
+  position in the emitted key order, which is the byte contract on the legacy
+  chain.
+- **The source-id fallback is dropped.** An agent for a source outside the
+  registry used to carry `civic:serverUrl` equal to its own source id — a
+  string that was never an address. That is the asserted-default class
+  ([civic-ai-tools#129](https://github.com/npstorey/civic-ai-tools/issues/129)'s
+  family): a stand-in standing in a signed record for a fact the run had and
+  did not write.
+- **`CIVIC_SOURCE_REGISTRY` keeps its three `serverUrl` values**, and the
+  comment now says what they are for: the reference deployment's own default
+  addresses for display, and — on the two aggregate sources — the companions of
+  `aggregatePortalUrl`. They are not what a record asserts about a run.
+- **Type-level consequence, stated rather than glossed.** Widening
+  `serverUrl` to optional is additive for a caller that BUILDS a registry and
+  narrowing for one that READS `info.serverUrl` and expects a `string`. A
+  TypeScript consumer doing the latter has to handle `undefined`.
+
+**Golden bytes.** Two of the three fixtures are untouched;
+`__fixtures__/website-golden.json` and `__fixtures__/reference-golden.json` are
+frozen reference captures and no byte of either is edited. The 2026-08-01
+website capture carries one MCP agent for a source its registry does not know,
+and that agent's `civic:serverUrl` is the dropped fallback, so the suites lift
+the capture over exactly that one key — derived from the registry, with the
+number of lifted nodes asserted, the same device already used for the two
+Appendix J literals and for the synthetic prompt hash. The lifted graph is
+inside the hashed bytes of the ninth golden-reproduction case, so
+`__fixtures__/span-carrying-golden.json`'s two recorded hashes are regenerated,
+intentionally and by that one dropped key: `envelopeHash` `eaa41755…b9b87d` →
+`2a57c911…c0af89`, `contentHashSha256` `cd036569…0e0202` → `e14adecf…a6af5f`.
+The fixture records the reason beside them. **A package signed before this
+change whose graph carried the source-id fallback no longer reproduces at the
+defaults** — that is the intended consequence of dropping an asserted default,
+and it is named here so nobody reads a moved hash as an accident.
+
+### Already on `main` since 0.4.1, and unreleased
+
+- **The test files type-check**
+  ([civic-ai-tools#197](https://github.com/npstorey/civic-ai-tools/issues/197),
+  `0a861b1`). `tsconfig.test.json` extends the build config, emits nothing, and
+  adds the Node types the suite needs; the package's `typecheck` script runs
+  both configs, and `src/the-suite-type-checks.test.ts` guards that every test
+  file is inside the checking config and none is inside the emitting one. The
+  build config now sets `types: []`, so shipped source still cannot reach a
+  Node global and type-check. No runtime export changes.
+- **The `civic:` vocabulary is named, and a rejected call states its elapsed**
+  ([civic-ai-tools#199](https://github.com/npstorey/civic-ai-tools/issues/199)
+  §2, `e4e32e7`). **Fourteen new `CIVIC_TERM_*` exports** —
+  `CIVIC_TERM_CONTENT_HASH`, `CIVIC_TERM_SERVER_URL`, `CIVIC_TERM_SOURCE_ID`,
+  `CIVIC_TERM_URL`, `CIVIC_TERM_PROMPT_TOKENS`, `CIVIC_TERM_COMPLETION_TOKENS`,
+  `CIVIC_TERM_TOOL_NAME`, `CIVIC_TERM_OPERATION_TYPE`, `CIVIC_TERM_DATASET_ID`,
+  `CIVIC_TERM_PORTAL_DOMAIN`, `CIVIC_TERM_DATASET_URL`,
+  `CIVIC_TERM_CROISSANT_METADATA_URL`, `CIVIC_TERM_RESPONSE_ROWS`,
+  `CIVIC_TERM_DURATION_MS` — replacing inline literals at twenty sites in
+  `capture/provenance.ts`, with no byte moving (a computed key inserts in the
+  same position with the same value). `purity.test.ts`'s guard derives its
+  universe rather than listing literals. The same commit corrected two comments
+  that said a rejected span carries no `tool.duration_ms`: the reference
+  producer records it, so a rejected call's activity emits `civic:durationMs`
+  beside `civic:failed`, the duration in its 0.3.1 position and the two markers
+  appended after it.
+- **A golden case that carries `mcp_tool_call` spans**
+  ([civic-ai-tools#199](https://github.com/npstorey/civic-ai-tools/issues/199)
+  §1, `92efbae`). `__fixtures__/span-carrying-golden.json` — a ninth
+  golden-reproduction case, in its own file so the verbatim upstream copy stays
+  a copy. The other eight carry zero spans of any kind, so until it existed the
+  byte-compat suite was green for everything the tool-span loop does. Test-only;
+  no export changes.
+
+**Correction to the 0.4.0 entry.** That entry's type-level-gate bullet says
+"`tsconfig.json` excludes `src/**/*.test.ts`, so the suite type-checks nothing
+— a test can drive a field the type does not have and `npm run typecheck` stays
+green." **That has been false since `0a861b1`.** The suite is type-checked by
+`tsconfig.test.json`, `npm run typecheck` runs it, and a type error in a test
+file fails that gate. The sentence is true of 0.4.0 as published and is left in
+place as the record of it; this is the forward correction.
+
+## 0.4.1 — 2026-09-12
+
+Patch: one existing export changes its output for one input shape, and no
+export is added, removed or retyped. That is measured across the release
+boundary rather than asserted — the published `0.4.0` and this build each
+expose 49 runtime exports from the package root, none added, none removed,
+none changing runtime type, and no declared top-level name in `dist/*.d.ts`
+differing between them. The tarball carries the same 28 files, and 22 of the
+24 under `dist/` are byte-identical to `0.4.0`; the two that are not are
+`dist/rubric/adversarial-eval-core.js` and its `.d.ts`, the latter differing
+by a doc comment alone.
+
+**What this release claims about golden bytes, and what it does not.** Every
+golden byte is unchanged. This time that sentence is not the evidence, and
+saying so is the point: **no golden fixture reaches the export that changed.**
+`buildEvaluationPrompt` is named in two test files, both under `src/rubric/`,
+and in neither golden suite. `__fixtures__/website-golden.json` carries no
+`queries` array at all; `__fixtures__/reference-golden.json` carries eight and
+**zero** occurrences of the `failed` key that is this release's only new
+branch. So the golden suites are green for this change the way they are green
+for a change to a file they never import, and their green is not evidence
+about it. This is the same narrowing
+[civic-ai-tools#199](https://github.com/npstorey/civic-ai-tools/issues/199)
+records for the graph builder, met from the other side.
+
+What **is** evidence is a direct measurement of the changed export either side
+of the release boundary: `buildEvaluationPrompt` imported from the published
+`0.4.0` and from this build, run over the same package.
+
+- A package in which **no entry records `failed: true`** renders
+  **byte-identical** on both — 492 bytes, `sha256 ed77c84e…` — over five entry
+  shapes: `resultRows: 12`, `resultRows: 0`, no `resultRows` at all,
+  `failed: false`, and a bare `failureKind` carrying no `failed`.
+- The same package plus one entry recorded `failed: true` renders
+  **differently** (539 bytes against 607). That case is the reason the first
+  one is worth reporting: an instrument that answers "identical" whatever it is
+  fed has not measured anything, and this one is shown answering "different"
+  on the shape it must flag.
+
+**The evaluator reads a rejected call as rejected**
+([civic-ai-tools#203](https://github.com/npstorey/civic-ai-tools/issues/203),
+Wave N11 P-H1). Behaviour change, confined to one input shape.
+
+- **The line that changes.** A `queries[]` entry the producer recorded as
+  rejected rendered `→ ? rows` — the same line an entry whose row count was
+  simply never recorded produces. A rejection and an unrecorded count were one
+  line to the evaluator, and the rubric asks that evaluator to cross-check the
+  answer's figures against the data the tool calls returned, so the conflation
+  invited it to read data that was never returned as merely uncounted. Its
+  score becomes a signed attestation. The entry now reads `→ REJECTED by the
+  source — no data was returned, and no row count is claimed`.
+- **`failed: true` is the whole assertion.** `failureKind` is declared on the
+  shape and **deliberately not rendered**: it is producer-controlled text, and
+  the turn built here is read by a model whose score is signed, so the
+  rejection is stated in this module's own fixed words, interpolating nothing
+  the producer wrote and claiming no row count.
+- **Absence stays absence.** An entry that records no outcome renders exactly
+  as it did before the fields existed. `failed: false` is not a rejection, and
+  a `failureKind` with no `failed` is not a rejection — the posture
+  `ToolCallSummary.failed` already takes in `capture/data-sources.ts`.
+- **No dependency moves.** The two keys are read off a locally-declared shape
+  rather than imported, following that same file: produce-core `0.3.0`, which
+  the lockfile resolves, names neither key. No manifest change, no lockfile
+  bump, no new dependency.
+
+**`RUBRIC_VERSION_SHA256` does not move, and the claim around it is corrected
+rather than left standing**
+([civic-ai-tools#207](https://github.com/npstorey/civic-ai-tools/issues/207)).
+The hash is `sha256Hex(EVALUATION_RUBRIC)` — the rubric text alone. It does not
+cover `buildEvaluationPrompt`, the template that assembles that rubric with the
+package's tool calls, data sources and model into the turn the evaluator
+actually reads. So this release changes what an evaluator is shown without
+changing the value an attestation pins as `methodology.promptSetVersion`: two
+evaluations either side of it carry the same value, measured here as
+`b62b193c992fd430cc82dff9a80a057bbe0b2b656fbdace450ca1a5d99fffa02` on both the
+published `0.4.0` and this build.
+
+- **The overclaim is retired in the same change.** ADR-0015 §3, Q26's
+  resolution note and the two module comments said the value pinned the whole
+  prompt set that produced the scores. They now say it pins the rubric
+  *wording*, and that the prompt template is outside the hash. The phrase they
+  used for the wider claim appears nowhere in the tree at this release.
+- **The gap is filed, not resolved.** #207 records what the hash covers, what
+  it does not, and the two spec-level options — widen the hash, or add a second
+  field — with no recommendation. Which one is right is a specification
+  decision, not a package's.
+
+A consumer sees none of this until its own lockfile moves: `^0.4.0` admits
+`0.4.1`, so the manifest range need not change and the refresh is the whole of
+the upgrade.
+
 ## 0.4.0 — 2026-09-04
 
 Minor: two optional input fields are added and no existing export is removed

package/dist/capture/provenance.d.ts

@@ -31,7 +31,10 @@ export interface ProvenanceInput {
 export interface ProvenanceConfig {
     /** Platform-agent identity — the deployment publishing the record. */
     platformAgent: PlatformAgentConfig;
-    /** Source registry supplying agent titles and MCP server URLs. */
+    /** Source registry supplying agent titles and MCP server URLs. Caller-
+     *  supplied configuration: an instance passes the addresses it is pointed
+     *  at, and an entry with no `serverUrl` makes its agent omit
+     *  `civic:serverUrl` (civic-ai-tools#205). */
     sourceRegistry: CivicSourceRegistry;
     /** Source id untagged tool spans fall back to. Default `socrata`
      *  (pre-source-tagging captures were Socrata-only). */

package/dist/capture/provenance.js

@@ -17,7 +17,7 @@
 // order is preserved throughout — the legacy hash chain's byte contract).
 import { makeProvGraph, makeEntityNode, makeActivityNode, makeAgentNode, provRef, provUsed, provWasGeneratedBy, provWasDerivedFrom, provWasAssociatedWith, xsdDateTime, } from '@typedstandards/produce-core';
 import { hash } from "./trace.js";
-import { CIVIC_VOCABULARY, CIVICAITOOLS_PLATFORM_AGENT, CIVIC_TERM_FAILED, CIVIC_TERM_FAILURE_KIND, } from "../format/vocabulary.js";
+import { CIVIC_VOCABULARY, CIVICAITOOLS_PLATFORM_AGENT, CIVIC_TERM_COMPLETION_TOKENS, CIVIC_TERM_CONTENT_HASH, CIVIC_TERM_CROISSANT_METADATA_URL, CIVIC_TERM_DATASET_ID, CIVIC_TERM_DATASET_URL, CIVIC_TERM_DURATION_MS, CIVIC_TERM_FAILED, CIVIC_TERM_FAILURE_KIND, CIVIC_TERM_OPERATION_TYPE, CIVIC_TERM_PORTAL_DOMAIN, CIVIC_TERM_PROMPT_TOKENS, CIVIC_TERM_RESPONSE_ROWS, CIVIC_TERM_SERVER_URL, CIVIC_TERM_SOURCE_ID, CIVIC_TERM_TOOL_NAME, CIVIC_TERM_URL, } from "../format/vocabulary.js";
 import { CIVIC_SOURCE_REGISTRY, FALLBACK_SOURCE_ID, isDatasetKeyedSource, } from "../format/sources.js";
 /** The civicaitools.org reference deployment's values. Passed explicitly by
  *  the reference app — never applied as a default, and never spread into
@@ -88,7 +88,7 @@ export function buildProvenanceGraph(trace, input, config) {
     // --- Entities ---
     // User prompt
     graph.push(makeEntityNode(vocab.urn(packageId, 'prompt', promptHash), {
-        'civic:contentHash': `sha256:${promptHash}`,
+        [CIVIC_TERM_CONTENT_HASH]: `sha256:${promptHash}`,
         'dcterms:description': 'User query prompt',
         ...(promptText ? { 'prov:value': promptText } : {}),
     }));
@@ -101,13 +101,13 @@ export function buildProvenanceGraph(trace, input, config) {
     const skillServerUrl = skillSpan ? getAttr(skillSpan.attributes, 'skill.mcp_server_url') : undefined;
     if (skillHash) {
         graph.push(makeEntityNode(vocab.urn(packageId, 'skill', skillHash), {
-            'civic:contentHash': `sha256:${skillHash}`,
+            [CIVIC_TERM_CONTENT_HASH]: `sha256:${skillHash}`,
             'dcterms:description': 'Composed MCP skill guidance (system prompt)',
         }, ['prov:Plan']));
     }
     // Final output
     graph.push(makeEntityNode(vocab.urn(packageId, 'output', outputHash), {
-        'civic:contentHash': `sha256:${outputHash}`,
+        [CIVIC_TERM_CONTENT_HASH]: `sha256:${outputHash}`,
         'dcterms:description': 'AI-generated analysis output',
     }));
     // --- Agents ---
@@ -127,6 +127,13 @@ export function buildProvenanceGraph(trace, input, config) {
     // configured fallback source (socrata — the only source at the time) for
     // backwards compatibility. Agent coordinates come from the source registry;
     // the skill-fetch span URL overrides the skill source's server URL.
+    //
+    // THE ADDRESS IS THE OPERATOR'S, OR IT IS ABSENT (civic-ai-tools#205, 0.5.0).
+    // `serverUrl` is optional on a registry entry and there is no stand-in for a
+    // source whose address this run does not know: a source the registry does
+    // not carry, and a registry entry with no address, both emit an agent with
+    // no `civic:serverUrl` key at all. The signed bytes then say the address is
+    // unknown instead of naming a server the analysis may never have contacted.
     const toolSpans = spans.filter(s => s.name === 'mcp_tool_call');
     const sourceAgentMap = {};
     for (const [id, info] of Object.entries(registry)) {
@@ -145,12 +152,13 @@ export function buildProvenanceGraph(trace, input, config) {
         const meta = sourceAgentMap[sourceId] ?? {
             urn: vocab.sourceAgentUrn(encodeURIComponent(sourceId)),
             title: `${sourceId} MCP Server`,
-            serverUrl: sourceId,
         };
         graph.push(makeAgentNode(meta.urn, {
             'dcterms:title': meta.title,
-            'civic:serverUrl': meta.serverUrl,
-            'civic:sourceId': sourceId,
+            // Conditional spread in place, so a known address keeps its
+            // position in the key order the legacy chain hashes.
+            ...(meta.serverUrl ? { [CIVIC_TERM_SERVER_URL]: meta.serverUrl } : {}),
+            [CIVIC_TERM_SOURCE_ID]: sourceId,
         }, ['prov:SoftwareAgent']));
     }
     // Resolve a source id to its agent URN, falling back to the configured
@@ -165,7 +173,7 @@ export function buildProvenanceGraph(trace, input, config) {
     // Platform
     graph.push(makeAgentNode(vocab.platformUrn(config.platformAgent.id), {
         'dcterms:title': config.platformAgent.title,
-        'civic:url': config.platformAgent.url,
+        [CIVIC_TERM_URL]: config.platformAgent.url,
     }, ['prov:SoftwareAgent']));
     // --- Activities ---
     // LLM inference spans
@@ -190,8 +198,8 @@ export function buildProvenanceGraph(trace, input, config) {
             ...(span.endTimeUnixNano
                 ? { 'prov:endedAtTime': xsdDateTime(nanoToIso(span.endTimeUnixNano)) }
                 : {}),
-            ...(promptTokens ? { 'civic:promptTokens': Number(promptTokens) } : {}),
-            ...(completionTokens ? { 'civic:completionTokens': Number(completionTokens) } : {}),
+            ...(promptTokens ? { [CIVIC_TERM_PROMPT_TOKENS]: Number(promptTokens) } : {}),
+            ...(completionTokens ? { [CIVIC_TERM_COMPLETION_TOKENS]: Number(completionTokens) } : {}),
         }));
     }
     // MCP tool call spans.
@@ -233,10 +241,10 @@ export function buildProvenanceGraph(trace, input, config) {
             .sort((a, b) => Number(b.endTimeUnixNano || '0') - Number(a.endTimeUnixNano || '0'))[0];
         const queryUrn = vocab.urn(packageId, 'query', queryHash);
         graph.push(makeEntityNode(queryUrn, {
-            'civic:contentHash': `sha256:${queryHash}`,
+            [CIVIC_TERM_CONTENT_HASH]: `sha256:${queryHash}`,
             // Omitted — not placeholdered — when the span named no tool.
-            ...(toolName ? { 'civic:toolName': toolName } : {}),
-            'civic:operationType': opType,
+            ...(toolName ? { [CIVIC_TERM_TOOL_NAME]: toolName } : {}),
+            [CIVIC_TERM_OPERATION_TYPE]: opType,
             'dcterms:description': `MCP tool arguments (${opType})`,
             ...(precedingInference
                 ? provWasGeneratedBy(vocab.urn(packageId, 'inference', precedingInference.spanId))
@@ -264,9 +272,9 @@ export function buildProvenanceGraph(trace, input, config) {
                 : `Data response from ${sourceAgentMap[toolSource]?.title || toolSource}`;
             const responseRows = getAttr(span.attributes, 'tool.response_rows');
             graph.push(makeEntityNode(dataUrn, {
-                'civic:contentHash': `sha256:${responseHash}`,
+                [CIVIC_TERM_CONTENT_HASH]: `sha256:${responseHash}`,
                 'dcterms:description': description,
-                'civic:sourceId': toolSource,
+                [CIVIC_TERM_SOURCE_ID]: toolSource,
                 ...provWasGeneratedBy(toolCallUrn),
                 // Croissant 1.1 placeholder — only meaningful for dataset-keyed
                 // sources today. The dataset id is stated whenever the span carried
@@ -274,17 +282,17 @@ export function buildProvenanceGraph(trace, input, config) {
                 // the portal as well. Key order is the byte contract.
                 ...(toolSourceDatasetKeyed && datasetId
                     ? {
-                        'civic:datasetId': datasetId,
+                        [CIVIC_TERM_DATASET_ID]: datasetId,
                         ...(portalDomain
                             ? {
-                                'civic:portalDomain': portalDomain,
-                                'civic:datasetUrl': `https://${portalDomain}/d/${datasetId}`,
+                                [CIVIC_TERM_PORTAL_DOMAIN]: portalDomain,
+                                [CIVIC_TERM_DATASET_URL]: `https://${portalDomain}/d/${datasetId}`,
                             }
                             : {}),
-                        'civic:croissantMetadataUrl': null, // hook for future Croissant integration
+                        [CIVIC_TERM_CROISSANT_METADATA_URL]: null, // hook for future Croissant integration
                     }
                     : {}),
-                ...(responseRows ? { 'civic:responseRows': Number(responseRows) } : {}),
+                ...(responseRows ? { [CIVIC_TERM_RESPONSE_ROWS]: Number(responseRows) } : {}),
             }));
         }
         // Tool call activity — associated with the MCP source agent that handled
@@ -317,7 +325,7 @@ export function buildProvenanceGraph(trace, input, config) {
             'dcterms:description': toolName
                 ? `MCP tool call: ${toolName} (${opType})`
                 : `MCP tool call (${opType})`,
-            'civic:sourceId': toolSource,
+            [CIVIC_TERM_SOURCE_ID]: toolSource,
             ...provUsed([queryUrn]),
             ...provWasAssociatedWith(toolAgentUrn),
             ...(span.startTimeUnixNano
@@ -326,16 +334,25 @@ export function buildProvenanceGraph(trace, input, config) {
             ...(span.endTimeUnixNano
                 ? { 'prov:endedAtTime': xsdDateTime(nanoToIso(span.endTimeUnixNano)) }
                 : {}),
-            ...(durationMs ? { 'civic:durationMs': Number(durationMs) } : {}),
+            ...(durationMs ? { [CIVIC_TERM_DURATION_MS]: Number(durationMs) } : {}),
             // Appended LAST and spread conditionally, exactly as `civic:durationMs`
             // above is: a span that recorded no rejection yields the key list it
             // yielded at 0.3.1, in the same order, and property insertion order is
             // the legacy chain's byte contract. `false` is never emitted — a
             // producer that stated "not failed" and one that stated nothing must
             // read the same, which is what makes a marker that IS present mean
-            // something. A rejected span carries no `tool.duration_ms` from the
-            // reference producer today (civic-ai-tools-website#413), so
-            // `civic:durationMs` simply does not fire beside these two.
+            // something.
+            //
+            // A REJECTED SPAN NOW CARRIES A DURATION. Until
+            // civic-ai-tools-website#413 shipped (Wave N11 P4, merged `ec7f173`)
+            // the reference producer measured a rejected call's elapsed and
+            // discarded it, so this comment said `civic:durationMs` "simply does
+            // not fire beside these two". It fires: the producer writes
+            // `tool.duration_ms` on the rejection path, and the conditional above
+            // states it — BEFORE the two markers, in the position it has held
+            // since 0.3.1, because that conditional is unchanged and this one is
+            // still appended after it. `capture/provenance.test.ts` drives that
+            // combination and pins the whole key list for it.
             ...(failed === true ? { [CIVIC_TERM_FAILED]: true } : {}),
             ...(failureKind ? { [CIVIC_TERM_FAILURE_KIND]: failureKind } : {}),
         }));

package/dist/format/dathere.d.ts

@@ -39,18 +39,37 @@ export declare function selectContentCanonicalization(contentProfile?: string):
  * value to pass as the envelope's `summary` field, or `undefined` to omit.
  */
 export declare function deriveSummaryEmission(contentProfile?: string, summary?: string): string | undefined;
+/** One MCP server the run had available, as the environment extension carries
+ *  it — spec §8.7.1 requirement 3: an object with `url` and optional `name`.
+ *  The CALLER supplies the order and the names; the harness neither sorts nor
+ *  invents them. */
+export interface DatHereMcpServer {
+    /** The server's configured address. */
+    url: string;
+    /** Optional label for the server (the reference caller passes the source
+     *  id). Omitted from the emitted object when absent, so a nameless entry
+     *  stays byte-identical to the pre-0.5.0 single-server shape. */
+    name?: string;
+}
 /**
  * Build the `org.civicaitools.environment` extension content for a datHere
  * package. Per OES §9.1.1 requirement 3 the extension MUST carry
  * `modelVersion`, `temperature`, `mcpServers`, `toolDefinitions`, `host`.
  *
+ * `mcpServers` accepts EITHER shape (additive since 0.5.0,
+ * civic-ai-tools-website#449): a single URL string — the trace's skill-fetch
+ * span URL, the only server the pre-0.5.0 builder could name — or the list of
+ * servers the run actually had, in the caller's order, each with an optional
+ * `name`. The single-URL shape produces byte-identical output to before, so
+ * an already-signed package still reproduces.
+ *
  * Prototype limitations carried over from the reference implementation
  * (known gaps, tightened in follow-up work): `temperature` placeholder `0`,
- * `toolDefinitions` placeholder `[]`; `mcpServers` derives from the trace's
- * skill-fetch span URL (the analysis's primary MCP server). Fields captured
- * honestly: `modelVersion` and `host`.
+ * `toolDefinitions` placeholder `[]`. Fields captured honestly:
+ * `modelVersion`, `host`, and — when the caller passes the list — the servers
+ * the run had.
  */
-export declare function buildDatHereEnvironment(model: string, skillMcpServerUrl: string | undefined, config: DatHereEnvironmentConfig): Record<string, unknown>;
+export declare function buildDatHereEnvironment(model: string, mcpServers: string | readonly DatHereMcpServer[] | undefined, config: DatHereEnvironmentConfig): Record<string, unknown>;
 /** Input to the composite datHere-policy derivation. */
 export interface DatHerePolicyInput {
     /** Model identifier (becomes `environment.modelVersion`). */
@@ -62,8 +81,15 @@ export interface DatHerePolicyInput {
     /** Candidate summary text (emitted only under the datHere profile). */
     summary?: string;
     /** MCP server URL from the trace's skill-fetch span (capture-side
-     *  extraction — see src/capture/skill-metadata.ts). */
+     *  extraction — see src/capture/skill-metadata.ts). Consulted only when
+     *  `mcpServers` is absent, so the pre-0.5.0 call shape keeps producing
+     *  byte-identical envelopes. */
     skillMcpServerUrl?: string;
+    /** Every MCP server the run had available, in the order the caller wants
+     *  them emitted, each with an optional `name`
+     *  (civic-ai-tools-website#449). When supplied this REPLACES
+     *  `skillMcpServerUrl` as the source of `environment.mcpServers`. */
+    mcpServers?: readonly DatHereMcpServer[];
     /** Caller-supplied extensions to layer the environment extension onto. */
     extensions?: Record<string, unknown>;
 }

package/dist/format/dathere.js

@@ -69,26 +69,50 @@ export function deriveSummaryEmission(contentProfile, summary) {
         ? summary
         : undefined;
 }
+/** Normalize the two accepted `mcpServers` inputs to the emitted array.
+ *
+ *  A bare string is the pre-0.5.0 shape — the trace's skill-fetch URL — and
+ *  yields at most the one `{ url }` entry, exactly as before. A list is
+ *  emitted in the order given, each entry carrying `name` only when the
+ *  caller supplied one. An entry with an empty `url` contributes nothing,
+ *  which is the same rule the single-URL shape always applied: a server with
+ *  no address is stated by absence, never by an empty string. */
+function normalizeMcpServers(servers) {
+    if (servers === undefined)
+        return [];
+    if (typeof servers === 'string') {
+        return servers ? [{ url: servers }] : [];
+    }
+    return servers
+        .filter((server) => Boolean(server.url))
+        .map((server) => ({
+        url: server.url,
+        ...(server.name ? { name: server.name } : {}),
+    }));
+}
 /**
  * Build the `org.civicaitools.environment` extension content for a datHere
  * package. Per OES §9.1.1 requirement 3 the extension MUST carry
  * `modelVersion`, `temperature`, `mcpServers`, `toolDefinitions`, `host`.
  *
+ * `mcpServers` accepts EITHER shape (additive since 0.5.0,
+ * civic-ai-tools-website#449): a single URL string — the trace's skill-fetch
+ * span URL, the only server the pre-0.5.0 builder could name — or the list of
+ * servers the run actually had, in the caller's order, each with an optional
+ * `name`. The single-URL shape produces byte-identical output to before, so
+ * an already-signed package still reproduces.
+ *
  * Prototype limitations carried over from the reference implementation
  * (known gaps, tightened in follow-up work): `temperature` placeholder `0`,
- * `toolDefinitions` placeholder `[]`; `mcpServers` derives from the trace's
- * skill-fetch span URL (the analysis's primary MCP server). Fields captured
- * honestly: `modelVersion` and `host`.
+ * `toolDefinitions` placeholder `[]`. Fields captured honestly:
+ * `modelVersion`, `host`, and — when the caller passes the list — the servers
+ * the run had.
  */
-export function buildDatHereEnvironment(model, skillMcpServerUrl, config) {
-    const mcpServers = [];
-    if (skillMcpServerUrl) {
-        mcpServers.push({ url: skillMcpServerUrl });
-    }
+export function buildDatHereEnvironment(model, mcpServers, config) {
     return {
         modelVersion: model,
         temperature: 0,
-        mcpServers,
+        mcpServers: normalizeMcpServers(mcpServers),
         toolDefinitions: [],
         host: config.host,
     };
@@ -102,7 +126,10 @@ export function buildDatHereEnvironment(model, skillMcpServerUrl, config) {
 export function deriveDatHereEnvelopeFields(input, config) {
     const extensions = { ...(input.extensions ?? {}) };
     if (input.contentProfile === DATHERE_CONTENT_PROFILE) {
-        extensions[ENVIRONMENT_EXTENSION_KEY] = buildDatHereEnvironment(input.model, input.skillMcpServerUrl, config);
+        extensions[ENVIRONMENT_EXTENSION_KEY] = buildDatHereEnvironment(input.model, 
+        // The list when the caller has one, the single skill-fetch URL
+        // otherwise — an input carrying neither still emits `mcpServers: []`.
+        input.mcpServers ?? input.skillMcpServerUrl, config);
     }
     return {
         producerProfile: deriveProducerProfile(input.producerProfile, input.contentProfile),

package/dist/format/sources.d.ts

@@ -5,8 +5,18 @@ export interface CivicSourceInfo {
     displayName: string;
     /** PROV agent `dcterms:title`, e.g. "Socrata MCP Server". */
     agentTitle: string;
-    /** MCP endpoint URL — the PROV agent's `civic:serverUrl`. */
-    serverUrl: string;
+    /**
+     * MCP endpoint URL — the PROV agent's `civic:serverUrl`, and this source's
+     * display address.
+     *
+     * OPTIONAL since 0.5.0 (civic-ai-tools#205). The address a run reached is
+     * the OPERATOR's configuration, not a fact the harness knows, so a caller
+     * passes a registry whose entries carry the addresses that instance is
+     * pointed at. An entry that carries no address makes the provenance graph
+     * OMIT `civic:serverUrl` from that source's agent entirely, rather than
+     * assert a stand-in: honest absence over an asserted default.
+     */
+    serverUrl?: string;
     /** `dataSources[].catalogType` value for entries from this source. */
     catalogType: string;
     /**
@@ -22,7 +32,14 @@ export interface CivicSourceInfo {
  *  order for aggregate `dataSources` entries. */
 export type CivicSourceRegistry = Record<string, CivicSourceInfo>;
 /** The civic reference registry — the three demo sources. Passed explicitly
- *  by the reference app — never applied as a default. */
+ *  by the reference app — never applied as a default.
+ *
+ *  THE `serverUrl` VALUES BELOW ARE THE REFERENCE DEPLOYMENT'S OWN, and since
+ *  0.5.0 (civic-ai-tools#205) that is the whole of their role: a default
+ *  display address, and — on the two aggregate sources — the companion of
+ *  `aggregatePortalUrl`. They are not what a record asserts about a run. An
+ *  instance pointed at other addresses passes a registry carrying those; an
+ *  entry with no address emits no `civic:serverUrl` at all. */
 export declare const CIVIC_SOURCE_REGISTRY: CivicSourceRegistry;
 /** The source id untagged/pre-M9.1 captures fall back to. Socrata was the
  *  only source when those packages were written. */

package/dist/format/sources.js

@@ -13,7 +13,14 @@
 // demo map is exported as `CIVIC_SOURCE_REGISTRY` for explicit use, never
 // applied as a default.
 /** The civic reference registry — the three demo sources. Passed explicitly
- *  by the reference app — never applied as a default. */
+ *  by the reference app — never applied as a default.
+ *
+ *  THE `serverUrl` VALUES BELOW ARE THE REFERENCE DEPLOYMENT'S OWN, and since
+ *  0.5.0 (civic-ai-tools#205) that is the whole of their role: a default
+ *  display address, and — on the two aggregate sources — the companion of
+ *  `aggregatePortalUrl`. They are not what a record asserts about a run. An
+ *  instance pointed at other addresses passes a registry carrying those; an
+ *  entry with no address emits no `civic:serverUrl` at all. */
 export const CIVIC_SOURCE_REGISTRY = {
     socrata: {
         displayName: 'Socrata',

package/dist/format/vocabulary.d.ts

@@ -35,6 +35,83 @@ export declare const CIVIC_TERM_FAILED = "civic:failed";
  * wider vocabulary widens this field rather than putting prose in it.
  */
 export declare const CIVIC_TERM_FAILURE_KIND = "civic:failureKind";
+/**
+ * `civic:contentHash` — the SHA-256 of the bytes an entity stands for, as
+ * `sha256:<hex>`. Emitted on the prompt, skill, output, tool-argument and
+ * data-response entities: a reader hashes the content it holds and compares.
+ */
+export declare const CIVIC_TERM_CONTENT_HASH = "civic:contentHash";
+/**
+ * `civic:serverUrl` — the MCP server URL an source agent answered from, as
+ * the deployment's source registry states it (or, for the skill source, as
+ * the trace's skill-fetch span carried it).
+ */
+export declare const CIVIC_TERM_SERVER_URL = "civic:serverUrl";
+/**
+ * `civic:sourceId` — the stable id of the source that answered a call, on
+ * both the tool-call activity and the data-response entity. It is the
+ * registry key, not a display name: a reader resolves it, and the graph never
+ * spells the reader-facing name.
+ */
+export declare const CIVIC_TERM_SOURCE_ID = "civic:sourceId";
+/**
+ * `civic:url` — the public URL of the platform agent that published the
+ * record (the deployment's own address, a typed config input).
+ */
+export declare const CIVIC_TERM_URL = "civic:url";
+/** `civic:promptTokens` — prompt tokens the span reported for one inference.
+ *  Emitted only when the span carried the count; never zero-filled. */
+export declare const CIVIC_TERM_PROMPT_TOKENS = "civic:promptTokens";
+/** `civic:completionTokens` — completion tokens the span reported for one
+ *  inference. Emitted only when the span carried the count. */
+export declare const CIVIC_TERM_COMPLETION_TOKENS = "civic:completionTokens";
+/**
+ * `civic:toolName` — the tool a call invoked, verbatim from the span.
+ * Omitted, never placeholdered, when the span named no tool: the graph states
+ * absence as absence.
+ */
+export declare const CIVIC_TERM_TOOL_NAME = "civic:toolName";
+/**
+ * `civic:operationType` — the producer's classification of what a call did
+ * (`query`, `metadata`, `unknown`, …). An open string the graph states
+ * verbatim and never re-derives.
+ */
+export declare const CIVIC_TERM_OPERATION_TYPE = "civic:operationType";
+/**
+ * `civic:datasetId` — the dataset a data response came from, stated whenever
+ * the span carried one and the source is dataset-keyed.
+ */
+export declare const CIVIC_TERM_DATASET_ID = "civic:datasetId";
+/**
+ * `civic:portalDomain` — the portal host a tool span carried. Never the run's
+ * selected portal: a call that addressed no portal yields a response
+ * attributed to none.
+ */
+export declare const CIVIC_TERM_PORTAL_DOMAIN = "civic:portalDomain";
+/**
+ * `civic:datasetUrl` — the canonical dataset URL, minted only when the span
+ * carried BOTH the portal host and the dataset id (a URL needs a host the
+ * span actually stated).
+ */
+export declare const CIVIC_TERM_DATASET_URL = "civic:datasetUrl";
+/**
+ * `civic:croissantMetadataUrl` — the Croissant 1.1 metadata URL for a
+ * dataset-keyed data response. Emitted as an explicit `null` placeholder for
+ * a future integration; the key is inside signed bytes, so it is stated here
+ * rather than left as an undocumented literal.
+ */
+export declare const CIVIC_TERM_CROISSANT_METADATA_URL = "civic:croissantMetadataUrl";
+/** `civic:responseRows` — the row count a tool response carried, when the
+ *  span reported one. */
+export declare const CIVIC_TERM_RESPONSE_ROWS = "civic:responseRows";
+/**
+ * `civic:durationMs` — the elapsed the producer measured for one tool call.
+ * Emitted whenever the span carried it, on a call that answered and on one
+ * the source REFUSED alike: since civic-ai-tools-website#413 the reference
+ * producer records the elapsed on its rejection path too, so this term and
+ * {@link CIVIC_TERM_FAILED} appear together on the same activity.
+ */
+export declare const CIVIC_TERM_DURATION_MS = "civic:durationMs";
 /**
  * One era of the civic vocabulary: the two literals plus the emitters bound
  * to them. The vocabulary is not deployment configuration (a deployment does

package/dist/format/vocabulary.js

@@ -37,16 +37,25 @@ export const PRIOR_ERA_CIVIC_URN_PREFIX = 'urn:civic-evidence';
 // A `civic:` property name is vocabulary as much as the namespace it hangs
 // under: it is the word a reader of a signed graph interprets, so it is
 // declared here and imported by the builder that emits it, never spelled as a
-// literal inside capture/ (`purity.test.ts` enforces that for the terms below).
-// Both terms are era-independent — the settlement moved the NAMESPACE, not the
-// property names — so they carry no era qualifier and are minted for the first
-// time after it.
+// literal inside capture/. Every term is era-independent — the 2026-08-19
+// settlement moved the NAMESPACE, not the property names — so none carries an
+// era qualifier.
 //
-// The settlement-era property names that predate Wave N10 (`civic:sourceId`,
-// `civic:durationMs`, `civic:datasetId` and their siblings) are still inline
-// literals in the capture-side builder. That is a real inconsistency, recorded
-// rather than fixed in passing: moving them is a byte-sensitive change across
-// every golden fixture and belongs to a phase of its own.
+// COMPLETE, AND GUARDED AS COMPLETE (civic-ai-tools#199 §2). Until this wave
+// two terms were declared here and the other fourteen were spelled inline in
+// capture/provenance.ts and declared nowhere, which the note that stood in
+// this place recorded as "a real inconsistency ... a phase of its own". This
+// is that phase. `purity.test.ts` no longer holds a list of the terms it
+// knows about — it derives the universe from both ends: no string literal
+// anywhere in capture/ may be a `civic:` term, and every `civic:` key a
+// DRIVEN graph emits must be the value of a constant declared here. A term
+// invented inline tomorrow fails both legs without anyone editing a list.
+//
+// NO BYTE MOVES. Naming a key changes no emitted byte: a computed key
+// (`{ [CIVIC_TERM_SOURCE_ID]: v }`) inserts in the same position with the same
+// value as the literal it replaces, and property insertion order is the legacy
+// chain's byte contract. Both golden suites and the span-carrying golden case
+// added in the same phase measure that rather than assume it.
 /**
  * `civic:failed` — a tool-call activity whose call the SOURCE REFUSED.
  *
@@ -71,6 +80,83 @@ export const CIVIC_TERM_FAILED = 'civic:failed';
  * wider vocabulary widens this field rather than putting prose in it.
  */
 export const CIVIC_TERM_FAILURE_KIND = 'civic:failureKind';
+/**
+ * `civic:contentHash` — the SHA-256 of the bytes an entity stands for, as
+ * `sha256:<hex>`. Emitted on the prompt, skill, output, tool-argument and
+ * data-response entities: a reader hashes the content it holds and compares.
+ */
+export const CIVIC_TERM_CONTENT_HASH = 'civic:contentHash';
+/**
+ * `civic:serverUrl` — the MCP server URL an source agent answered from, as
+ * the deployment's source registry states it (or, for the skill source, as
+ * the trace's skill-fetch span carried it).
+ */
+export const CIVIC_TERM_SERVER_URL = 'civic:serverUrl';
+/**
+ * `civic:sourceId` — the stable id of the source that answered a call, on
+ * both the tool-call activity and the data-response entity. It is the
+ * registry key, not a display name: a reader resolves it, and the graph never
+ * spells the reader-facing name.
+ */
+export const CIVIC_TERM_SOURCE_ID = 'civic:sourceId';
+/**
+ * `civic:url` — the public URL of the platform agent that published the
+ * record (the deployment's own address, a typed config input).
+ */
+export const CIVIC_TERM_URL = 'civic:url';
+/** `civic:promptTokens` — prompt tokens the span reported for one inference.
+ *  Emitted only when the span carried the count; never zero-filled. */
+export const CIVIC_TERM_PROMPT_TOKENS = 'civic:promptTokens';
+/** `civic:completionTokens` — completion tokens the span reported for one
+ *  inference. Emitted only when the span carried the count. */
+export const CIVIC_TERM_COMPLETION_TOKENS = 'civic:completionTokens';
+/**
+ * `civic:toolName` — the tool a call invoked, verbatim from the span.
+ * Omitted, never placeholdered, when the span named no tool: the graph states
+ * absence as absence.
+ */
+export const CIVIC_TERM_TOOL_NAME = 'civic:toolName';
+/**
+ * `civic:operationType` — the producer's classification of what a call did
+ * (`query`, `metadata`, `unknown`, …). An open string the graph states
+ * verbatim and never re-derives.
+ */
+export const CIVIC_TERM_OPERATION_TYPE = 'civic:operationType';
+/**
+ * `civic:datasetId` — the dataset a data response came from, stated whenever
+ * the span carried one and the source is dataset-keyed.
+ */
+export const CIVIC_TERM_DATASET_ID = 'civic:datasetId';
+/**
+ * `civic:portalDomain` — the portal host a tool span carried. Never the run's
+ * selected portal: a call that addressed no portal yields a response
+ * attributed to none.
+ */
+export const CIVIC_TERM_PORTAL_DOMAIN = 'civic:portalDomain';
+/**
+ * `civic:datasetUrl` — the canonical dataset URL, minted only when the span
+ * carried BOTH the portal host and the dataset id (a URL needs a host the
+ * span actually stated).
+ */
+export const CIVIC_TERM_DATASET_URL = 'civic:datasetUrl';
+/**
+ * `civic:croissantMetadataUrl` — the Croissant 1.1 metadata URL for a
+ * dataset-keyed data response. Emitted as an explicit `null` placeholder for
+ * a future integration; the key is inside signed bytes, so it is stated here
+ * rather than left as an undocumented literal.
+ */
+export const CIVIC_TERM_CROISSANT_METADATA_URL = 'civic:croissantMetadataUrl';
+/** `civic:responseRows` — the row count a tool response carried, when the
+ *  span reported one. */
+export const CIVIC_TERM_RESPONSE_ROWS = 'civic:responseRows';
+/**
+ * `civic:durationMs` — the elapsed the producer measured for one tool call.
+ * Emitted whenever the span carried it, on a call that answered and on one
+ * the source REFUSED alike: since civic-ai-tools-website#413 the reference
+ * producer records the elapsed on its rejection path too, so this term and
+ * {@link CIVIC_TERM_FAILED} appear together on the same activity.
+ */
+export const CIVIC_TERM_DURATION_MS = 'civic:durationMs';
 /** Bind the emitters to one era's two literals. */
 export function makeCivicVocabulary(ns, urnPrefix) {
     return {

package/dist/rubric/adversarial-eval-core.d.ts

@@ -6,7 +6,10 @@ export declare const EVALUATION_CRITERIA: readonly ["dataSourceIdentification",
 export declare const EVALUATION_RUBRIC = "You are an independent evaluator assessing an AI-generated civic data analysis.\n\nYou will receive:\n1. The original prompt (question asked)\n2. The tool calls made (MCP queries to Socrata open data portals)\n3. The AI's final output/analysis\n\nEvaluate the analysis against these 6 criteria, scoring each 1-10:\n\na) **Data Source Identification** (1-10): Does the output correctly identify the data source(s) and time period? Are dataset IDs, portal domains, and date ranges accurate?\n\nb) **Quantitative Claim Support** (1-10): Are the quantitative claims (numbers, percentages, rankings) supported by the data returned in the tool calls? Cross-check key figures against the raw data.\n\nc) **Confounders and Bias** (1-10): Does the analysis acknowledge obvious confounders, selection biases, or framing issues? Are there lurking variables or cherry-picked timeframes?\n\nd) **Geographic Scope** (1-10): Is the geographic scope appropriate for the question? Does the analysis avoid over-generalizing from one jurisdiction?\n\ne) **Limitations Noted** (1-10): Are limitations and caveats noted? Does the analysis flag data quality issues, missing fields, or incomplete coverage?\n\nf) **Contradictory Conclusion** (1-10): Could the same data reasonably support a contradictory conclusion? Does the analysis consider alternative interpretations?\n\nRespond in this exact JSON format (no markdown fences, just raw JSON):\n{\n  \"dataSourceIdentification\": { \"score\": <1-10>, \"comment\": \"<1-2 sentences>\" },\n  \"quantitativeClaimSupport\": { \"score\": <1-10>, \"comment\": \"<1-2 sentences>\" },\n  \"confoundersAndBias\": { \"score\": <1-10>, \"comment\": \"<1-2 sentences>\" },\n  \"geographicScope\": { \"score\": <1-10>, \"comment\": \"<1-2 sentences>\" },\n  \"limitationsNoted\": { \"score\": <1-10>, \"comment\": \"<1-2 sentences>\" },\n  \"contradictoryConclusion\": { \"score\": <1-10>, \"comment\": \"<1-2 sentences>\" },\n  \"overallScore\": <average of all 6 scores, one decimal>,\n  \"assessment\": \"<2-4 sentence overall assessment>\"\n}";
 /** The methodology's `promptSetVersion`: SHA-256 of the rubric text, computed
  *  once at module load. Any wording change to the rubric produces a new
- *  version, so an attestation pins the exact prompt set that scored it. */
+ *  version, so an attestation pins the rubric WORDING that scored it — and
+ *  that wording only. The prompt template around it (`buildEvaluationPrompt`)
+ *  is outside this hash, so one value does not identify one set of evaluator
+ *  inputs (civic-ai-tools#207). */
 export declare const RUBRIC_VERSION_SHA256: string;
 /** Build the user-turn evaluation content from a package's signed fields.
  *  Takes `RecordPackage` — produce-core 0.3.0's settlement-era name for the

package/dist/rubric/adversarial-eval-core.js

@@ -5,8 +5,14 @@
 // brief §1. The model runner and DB/blob emission (`adversarial-eval.ts`)
 // stay app-side — this module never performs I/O.
 //
-// ⚠ RUBRIC_VERSION_SHA256 is a Q26-pinned version hash: attestations pin the
-// exact prompt set that scored them by this value. The rubric text below is
+// ⚠ RUBRIC_VERSION_SHA256 is a Q26-pinned version hash over THE RUBRIC TEXT
+// ALONE (`sha256Hex(EVALUATION_RUBRIC)`). It does NOT cover
+// `buildEvaluationPrompt` below — the template that assembles the rubric with
+// the package's tool calls, data sources and model into the turn the evaluator
+// actually reads. So two evaluations either side of a change to that template
+// carry the SAME `methodology.promptSetVersion` while the evaluator saw
+// different inputs; civic-ai-tools#207 files that gap for the specification to
+// settle, and this module does not resolve it. The rubric text below is
 // byte-exact with the reference implementation (the relocation changes no
 // hashes), and the test suite asserts the literal digest. Any wording change
 // to EVALUATION_RUBRIC is a NEW rubric version — never edit the text without
@@ -57,8 +63,24 @@ Respond in this exact JSON format (no markdown fences, just raw JSON):
 }`;
 /** The methodology's `promptSetVersion`: SHA-256 of the rubric text, computed
  *  once at module load. Any wording change to the rubric produces a new
- *  version, so an attestation pins the exact prompt set that scored it. */
+ *  version, so an attestation pins the rubric WORDING that scored it — and
+ *  that wording only. The prompt template around it (`buildEvaluationPrompt`)
+ *  is outside this hash, so one value does not identify one set of evaluator
+ *  inputs (civic-ai-tools#207). */
 export const RUBRIC_VERSION_SHA256 = sha256Hex(EVALUATION_RUBRIC);
+/** Did the producer record this entry as REJECTED by the source? Only a
+ *  literal `failed: true` is a rejection (see `RecordedCallOutcome`). */
+function wasRecordedRejected(query) {
+    return query.failed === true;
+}
+/** What the evaluator is told about a call the source rejected. A FIXED
+ *  string: it interpolates nothing the producer wrote, and it claims no row
+ *  count — there were no rows to count, which is neither "zero rows" nor "an
+ *  unknown number of rows". The rubric asks the evaluator to cross-check
+ *  figures against the data returned in the tool calls, so a rejected call
+ *  reading `→ ? rows` invited it to treat absent data as merely unrecorded
+ *  (civic-ai-tools#203). */
+const REJECTED_CALL_RENDERING = 'REJECTED by the source — no data was returned, and no row count is claimed';
 /** Build the user-turn evaluation content from a package's signed fields.
  *  Takes `RecordPackage` — produce-core 0.3.0's settlement-era name for the
  *  same object (spec Appendix J, migration class alias-and-deprecate). The
@@ -70,7 +92,10 @@ export function buildEvaluationPrompt(pkg) {
         const argStr = Object.entries(q.arguments)
             .map(([k, v]) => `${k}=${JSON.stringify(v)}`)
             .join(', ');
-        return `  ${i + 1}. ${q.tool}(${argStr}) → ${q.resultRows ?? '?'} rows`;
+        const outcome = wasRecordedRejected(q)
+            ? REJECTED_CALL_RENDERING
+            : `${q.resultRows ?? '?'} rows`;
+        return `  ${i + 1}. ${q.tool}(${argStr}) → ${outcome}`;
     })
         .join('\n');
     const dataSources = pkg.dataSources

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@typedstandards/civic-typed-harness",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Civic-domain harness for Typed Standards evidence packages — the DOMAIN layer of the ADR-0021 format/domain line: civic PROV-O vocabulary and provenance builder, datHere envelope-policy derivations, and the capture machinery (trace builder, skill-metadata extraction, data-source population, adversarial rubric core). Derives; @typedstandards/produce-core assembles.",
   "license": "MIT",
   "author": "Nathan Storey",
@@ -26,7 +26,7 @@
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "clean": "rm -rf dist tsconfig.tsbuildinfo",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.test.json",
     "lint": "eslint .",
     "test": "node --test --experimental-strip-types \"src/**/*.test.ts\"",
     "prepare": "npm run build",
@@ -37,6 +37,7 @@
   },
   "devDependencies": {
     "@typedstandards/verify-core": "^0.9.0",
+    "@types/node": "^22.20.2",
     "@typescript-eslint/parser": "^8",
     "eslint": "^9",
     "typescript": "^5.9.3"