@typedstandards/civic-typed-harness 0.4.1 → 0.6.0

package/CHANGELOG.md

@@ -3,6 +3,163 @@
 Factual record of what changed per published version. Section references are
 to the Typed Standards specification unless noted otherwise.
 
+## 0.6.0 — 2026-09-26
+
+The list is derived from
+`git log 65e8a1d..<this release> -- packages/civic-typed-harness/` — `65e8a1d`
+is the 0.5.0 release's last commit, its dating fix. No harness source changes
+in that range.
+
+- **Dependency floor raised:** `@typedstandards/produce-core` `^0.3.0 ||
+  ^0.4.0` → `^0.7.0`, and the `@typedstandards/verify-core` devDependency
+  `^0.9.0` → `^0.12.0`, the version produce-core 0.7.0 resolves. The two move
+  together so the install holds one copy of verify-core: with only the
+  devDependency moved, produce-core 0.3.0 kept verify-core 0.9.0 and the
+  harness tests imported a second copy. The raise went to `^0.6.0` /
+  `^0.11.0` first ([civic-ai-tools#232](https://github.com/npstorey/civic-ai-tools/issues/232))
+  and was not published at that range.
+- **What the two releases bring.** verify-core 0.11.0 is the first release
+  that exports `KNOWN_TYPE_URIS`, which the hub's `check:verifier-subtype-set`
+  compares with the specification's §8.12.1 table. verify-core 0.12.0 (the
+  certificate-chain split, typedstandards#100) adds a member to
+  `ChainFailReason` and to `Rfc3161FailReason`; the harness reads neither.
+  produce-core 0.7.0 changes none of its own source.
+- The lockfile resolves produce-core 0.7.0 and verify-core 0.12.0, one copy
+  each, and no other entry moves. The golden byte-compat suite passes
+  unchanged.
+- A consumer that pins produce-core 0.3.x through 0.6.x no longer shares its
+  copy with this package: under 0.x semver `^0.7.0` excludes them.
+- **README:** the runtime-dependency line named produce-core `^0.2.0`, a range
+  this package has not declared since 0.3.0. It names `^0.7.0`.
+
+## 0.5.0 — 2026-09-18
+
+The list is derived from
+`git log 33a3aff..<this release> -- packages/civic-typed-harness/` — `33a3aff`
+is the 0.4.1 release bump — so it is the commit range rather than a
+recollection.
+Three commits landed after that bump and had no entry; this phase's two
+changes join them.
+
+**Together, the two changes below make a record name the servers the run
+actually had, and say nothing where it does not know.** They are the harness
+half of
+[civic-ai-tools#205](https://github.com/npstorey/civic-ai-tools/issues/205)
+and
+[civic-ai-tools-website#449](https://github.com/npstorey/civic-ai-tools-website/issues/449);
+the caller half (a registry built from the instance's own configuration, and
+the packager passing the list) lands in the reference application.
+
+### The environment extension can name every server, not only the skill's
+
+- **`buildDatHereEnvironment` accepts a list of MCP servers**, additively. Its
+  second parameter is now `string | readonly DatHereMcpServer[] | undefined`:
+  the bare string is the pre-0.5.0 shape — the trace's skill-fetch URL, the one
+  server the builder could name — and a list is emitted in the order the caller
+  gives, each entry carrying `name` only when the caller supplied one. Spec
+  §8.7.1 requirement 3 always specified `mcpServers` as "an array of objects
+  with `url` and optional `name`"; until now the harness could only ever put
+  one object in it.
+- **The single-URL shape is byte-identical to before**, and a test pins those
+  exact bytes rather than deep-equality, because an already-signed datHere
+  package reproduces through this function. A one-entry list with no `name`
+  produces the same bytes as the string, which is the same statement from the
+  other side.
+- **`DatHerePolicyInput` gains `mcpServers`**, consulted in preference to
+  `skillMcpServerUrl` and falling back to it, so `deriveDatHereEnvelopeFields`
+  carries the list through without any existing caller changing.
+- **New export:** the `DatHereMcpServer` interface. An entry whose `url` is
+  empty contributes nothing — the same rule the single-URL shape always
+  applied: a server with no address is stated by absence, never by an empty
+  string.
+
+### A source agent names the configured address, or names no address at all
+
+- **`CivicSourceInfo.serverUrl` is optional.** The address a run reached is the
+  operator's configuration, not a fact the harness knows. A caller passes a
+  registry whose entries carry the addresses that instance is pointed at.
+- **`buildProvenanceGraph` omits `civic:serverUrl` when it has no address.**
+  Two shapes reach that: a registry entry that carries no `serverUrl`, and a
+  source id the registry does not carry at all. Both now emit an agent with no
+  `civic:serverUrl` key — the key's absence, not an empty string — so the
+  signed bytes say the address is unknown instead of naming a server the
+  analysis may never have contacted. When an address IS known the key keeps its
+  position in the emitted key order, which is the byte contract on the legacy
+  chain.
+- **The source-id fallback is dropped.** An agent for a source outside the
+  registry used to carry `civic:serverUrl` equal to its own source id — a
+  string that was never an address. That is the asserted-default class
+  ([civic-ai-tools#129](https://github.com/npstorey/civic-ai-tools/issues/129)'s
+  family): a stand-in standing in a signed record for a fact the run had and
+  did not write.
+- **`CIVIC_SOURCE_REGISTRY` keeps its three `serverUrl` values**, and the
+  comment now says what they are for: the reference deployment's own default
+  addresses for display, and — on the two aggregate sources — the companions of
+  `aggregatePortalUrl`. They are not what a record asserts about a run.
+- **Type-level consequence, stated rather than glossed.** Widening
+  `serverUrl` to optional is additive for a caller that BUILDS a registry and
+  narrowing for one that READS `info.serverUrl` and expects a `string`. A
+  TypeScript consumer doing the latter has to handle `undefined`.
+
+**Golden bytes.** Two of the three fixtures are untouched;
+`__fixtures__/website-golden.json` and `__fixtures__/reference-golden.json` are
+frozen reference captures and no byte of either is edited. The 2026-08-01
+website capture carries one MCP agent for a source its registry does not know,
+and that agent's `civic:serverUrl` is the dropped fallback, so the suites lift
+the capture over exactly that one key — derived from the registry, with the
+number of lifted nodes asserted, the same device already used for the two
+Appendix J literals and for the synthetic prompt hash. The lifted graph is
+inside the hashed bytes of the ninth golden-reproduction case, so
+`__fixtures__/span-carrying-golden.json`'s two recorded hashes are regenerated,
+intentionally and by that one dropped key: `envelopeHash` `eaa41755…b9b87d` →
+`2a57c911…c0af89`, `contentHashSha256` `cd036569…0e0202` → `e14adecf…a6af5f`.
+The fixture records the reason beside them. **A package signed before this
+change whose graph carried the source-id fallback no longer reproduces at the
+defaults** — that is the intended consequence of dropping an asserted default,
+and it is named here so nobody reads a moved hash as an accident.
+
+### Already on `main` since 0.4.1, and unreleased
+
+- **The test files type-check**
+  ([civic-ai-tools#197](https://github.com/npstorey/civic-ai-tools/issues/197),
+  `0a861b1`). `tsconfig.test.json` extends the build config, emits nothing, and
+  adds the Node types the suite needs; the package's `typecheck` script runs
+  both configs, and `src/the-suite-type-checks.test.ts` guards that every test
+  file is inside the checking config and none is inside the emitting one. The
+  build config now sets `types: []`, so shipped source still cannot reach a
+  Node global and type-check. No runtime export changes.
+- **The `civic:` vocabulary is named, and a rejected call states its elapsed**
+  ([civic-ai-tools#199](https://github.com/npstorey/civic-ai-tools/issues/199)
+  §2, `e4e32e7`). **Fourteen new `CIVIC_TERM_*` exports** —
+  `CIVIC_TERM_CONTENT_HASH`, `CIVIC_TERM_SERVER_URL`, `CIVIC_TERM_SOURCE_ID`,
+  `CIVIC_TERM_URL`, `CIVIC_TERM_PROMPT_TOKENS`, `CIVIC_TERM_COMPLETION_TOKENS`,
+  `CIVIC_TERM_TOOL_NAME`, `CIVIC_TERM_OPERATION_TYPE`, `CIVIC_TERM_DATASET_ID`,
+  `CIVIC_TERM_PORTAL_DOMAIN`, `CIVIC_TERM_DATASET_URL`,
+  `CIVIC_TERM_CROISSANT_METADATA_URL`, `CIVIC_TERM_RESPONSE_ROWS`,
+  `CIVIC_TERM_DURATION_MS` — replacing inline literals at twenty sites in
+  `capture/provenance.ts`, with no byte moving (a computed key inserts in the
+  same position with the same value). `purity.test.ts`'s guard derives its
+  universe rather than listing literals. The same commit corrected two comments
+  that said a rejected span carries no `tool.duration_ms`: the reference
+  producer records it, so a rejected call's activity emits `civic:durationMs`
+  beside `civic:failed`, the duration in its 0.3.1 position and the two markers
+  appended after it.
+- **A golden case that carries `mcp_tool_call` spans**
+  ([civic-ai-tools#199](https://github.com/npstorey/civic-ai-tools/issues/199)
+  §1, `92efbae`). `__fixtures__/span-carrying-golden.json` — a ninth
+  golden-reproduction case, in its own file so the verbatim upstream copy stays
+  a copy. The other eight carry zero spans of any kind, so until it existed the
+  byte-compat suite was green for everything the tool-span loop does. Test-only;
+  no export changes.
+
+**Correction to the 0.4.0 entry.** That entry's type-level-gate bullet says
+"`tsconfig.json` excludes `src/**/*.test.ts`, so the suite type-checks nothing
+— a test can drive a field the type does not have and `npm run typecheck` stays
+green." **That has been false since `0a861b1`.** The suite is type-checked by
+`tsconfig.test.json`, `npm run typecheck` runs it, and a type error in a test
+file fails that gate. The sentence is true of 0.4.0 as published and is left in
+place as the record of it; this is the forward correction.
+
 ## 0.4.1 — 2026-09-12
 
 Patch: one existing export changes its output for one input shape, and no

package/README.md

@@ -49,7 +49,7 @@ Likewise: `buildDatHereEnvironment` / `deriveDatHereEnvelopeFields` take `CIVICA
 
 No I/O, no network, no environment reads, no Node built-ins, browser-safe — anywhere in the package. Clock and RNG are permitted **in capture modules only** (span timestamps and ids are what capture *is*) and are injectable for deterministic tests. Enforced mechanically twice: `eslint.config.mjs` (`no-restricted-imports` / `-globals` / `-properties` / `-syntax`) and `src/purity.test.ts` (browser-safety + determinism + module-boundary checks under `node --test`).
 
-Runtime dependency: **`@typedstandards/produce-core` (`^0.2.0`) only.** The verify-core primitives the harness consumes (`sha256Hex`, `isBlobRef`, the canonicalization-rule URIs, the Q32 vocabulary table, the `CaptureMethod` type) are reached through produce-core's 0.2.0 re-exports rather than imported from `@typedstandards/verify-core` directly — one declared dependency, no phantom, and still one hashing implementation across producer, harness, and verifier by construction (produce-core re-exports the same bindings verify-core defines, verified by reference identity).
+Runtime dependency: **`@typedstandards/produce-core` (`^0.7.0`) only.** The verify-core primitives the harness consumes (`sha256Hex`, `isBlobRef`, the canonicalization-rule URIs, the Q32 vocabulary table, the `CaptureMethod` type) are reached through produce-core's 0.2.0 re-exports rather than imported from `@typedstandards/verify-core` directly — one declared dependency, no phantom, and still one hashing implementation across producer, harness, and verifier by construction (produce-core re-exports the same bindings verify-core defines, verified by reference identity).
 
 > **Q32 adjacency** (open-questions registry): the captureMethod vocabulary re-exported from `src/format/profiles.ts` is verify-core's hardcoded fallback table, pending versioned, content-addressed guidance bundles. Flagged, not solved, here.
 

package/dist/capture/provenance.d.ts

@@ -31,7 +31,10 @@ export interface ProvenanceInput {
 export interface ProvenanceConfig {
     /** Platform-agent identity — the deployment publishing the record. */
     platformAgent: PlatformAgentConfig;
-    /** Source registry supplying agent titles and MCP server URLs. */
+    /** Source registry supplying agent titles and MCP server URLs. Caller-
+     *  supplied configuration: an instance passes the addresses it is pointed
+     *  at, and an entry with no `serverUrl` makes its agent omit
+     *  `civic:serverUrl` (civic-ai-tools#205). */
     sourceRegistry: CivicSourceRegistry;
     /** Source id untagged tool spans fall back to. Default `socrata`
      *  (pre-source-tagging captures were Socrata-only). */

package/dist/capture/provenance.js

@@ -17,7 +17,7 @@
 // order is preserved throughout — the legacy hash chain's byte contract).
 import { makeProvGraph, makeEntityNode, makeActivityNode, makeAgentNode, provRef, provUsed, provWasGeneratedBy, provWasDerivedFrom, provWasAssociatedWith, xsdDateTime, } from '@typedstandards/produce-core';
 import { hash } from "./trace.js";
-import { CIVIC_VOCABULARY, CIVICAITOOLS_PLATFORM_AGENT, CIVIC_TERM_FAILED, CIVIC_TERM_FAILURE_KIND, } from "../format/vocabulary.js";
+import { CIVIC_VOCABULARY, CIVICAITOOLS_PLATFORM_AGENT, CIVIC_TERM_COMPLETION_TOKENS, CIVIC_TERM_CONTENT_HASH, CIVIC_TERM_CROISSANT_METADATA_URL, CIVIC_TERM_DATASET_ID, CIVIC_TERM_DATASET_URL, CIVIC_TERM_DURATION_MS, CIVIC_TERM_FAILED, CIVIC_TERM_FAILURE_KIND, CIVIC_TERM_OPERATION_TYPE, CIVIC_TERM_PORTAL_DOMAIN, CIVIC_TERM_PROMPT_TOKENS, CIVIC_TERM_RESPONSE_ROWS, CIVIC_TERM_SERVER_URL, CIVIC_TERM_SOURCE_ID, CIVIC_TERM_TOOL_NAME, CIVIC_TERM_URL, } from "../format/vocabulary.js";
 import { CIVIC_SOURCE_REGISTRY, FALLBACK_SOURCE_ID, isDatasetKeyedSource, } from "../format/sources.js";
 /** The civicaitools.org reference deployment's values. Passed explicitly by
  *  the reference app — never applied as a default, and never spread into
@@ -88,7 +88,7 @@ export function buildProvenanceGraph(trace, input, config) {
     // --- Entities ---
     // User prompt
     graph.push(makeEntityNode(vocab.urn(packageId, 'prompt', promptHash), {
-        'civic:contentHash': `sha256:${promptHash}`,
+        [CIVIC_TERM_CONTENT_HASH]: `sha256:${promptHash}`,
         'dcterms:description': 'User query prompt',
         ...(promptText ? { 'prov:value': promptText } : {}),
     }));
@@ -101,13 +101,13 @@ export function buildProvenanceGraph(trace, input, config) {
     const skillServerUrl = skillSpan ? getAttr(skillSpan.attributes, 'skill.mcp_server_url') : undefined;
     if (skillHash) {
         graph.push(makeEntityNode(vocab.urn(packageId, 'skill', skillHash), {
-            'civic:contentHash': `sha256:${skillHash}`,
+            [CIVIC_TERM_CONTENT_HASH]: `sha256:${skillHash}`,
             'dcterms:description': 'Composed MCP skill guidance (system prompt)',
         }, ['prov:Plan']));
     }
     // Final output
     graph.push(makeEntityNode(vocab.urn(packageId, 'output', outputHash), {
-        'civic:contentHash': `sha256:${outputHash}`,
+        [CIVIC_TERM_CONTENT_HASH]: `sha256:${outputHash}`,
         'dcterms:description': 'AI-generated analysis output',
     }));
     // --- Agents ---
@@ -127,6 +127,13 @@ export function buildProvenanceGraph(trace, input, config) {
     // configured fallback source (socrata — the only source at the time) for
     // backwards compatibility. Agent coordinates come from the source registry;
     // the skill-fetch span URL overrides the skill source's server URL.
+    //
+    // THE ADDRESS IS THE OPERATOR'S, OR IT IS ABSENT (civic-ai-tools#205, 0.5.0).
+    // `serverUrl` is optional on a registry entry and there is no stand-in for a
+    // source whose address this run does not know: a source the registry does
+    // not carry, and a registry entry with no address, both emit an agent with
+    // no `civic:serverUrl` key at all. The signed bytes then say the address is
+    // unknown instead of naming a server the analysis may never have contacted.
     const toolSpans = spans.filter(s => s.name === 'mcp_tool_call');
     const sourceAgentMap = {};
     for (const [id, info] of Object.entries(registry)) {
@@ -145,12 +152,13 @@ export function buildProvenanceGraph(trace, input, config) {
         const meta = sourceAgentMap[sourceId] ?? {
             urn: vocab.sourceAgentUrn(encodeURIComponent(sourceId)),
             title: `${sourceId} MCP Server`,
-            serverUrl: sourceId,
         };
         graph.push(makeAgentNode(meta.urn, {
             'dcterms:title': meta.title,
-            'civic:serverUrl': meta.serverUrl,
-            'civic:sourceId': sourceId,
+            // Conditional spread in place, so a known address keeps its
+            // position in the key order the legacy chain hashes.
+            ...(meta.serverUrl ? { [CIVIC_TERM_SERVER_URL]: meta.serverUrl } : {}),
+            [CIVIC_TERM_SOURCE_ID]: sourceId,
         }, ['prov:SoftwareAgent']));
     }
     // Resolve a source id to its agent URN, falling back to the configured
@@ -165,7 +173,7 @@ export function buildProvenanceGraph(trace, input, config) {
     // Platform
     graph.push(makeAgentNode(vocab.platformUrn(config.platformAgent.id), {
         'dcterms:title': config.platformAgent.title,
-        'civic:url': config.platformAgent.url,
+        [CIVIC_TERM_URL]: config.platformAgent.url,
     }, ['prov:SoftwareAgent']));
     // --- Activities ---
     // LLM inference spans
@@ -190,8 +198,8 @@ export function buildProvenanceGraph(trace, input, config) {
             ...(span.endTimeUnixNano
                 ? { 'prov:endedAtTime': xsdDateTime(nanoToIso(span.endTimeUnixNano)) }
                 : {}),
-            ...(promptTokens ? { 'civic:promptTokens': Number(promptTokens) } : {}),
-            ...(completionTokens ? { 'civic:completionTokens': Number(completionTokens) } : {}),
+            ...(promptTokens ? { [CIVIC_TERM_PROMPT_TOKENS]: Number(promptTokens) } : {}),
+            ...(completionTokens ? { [CIVIC_TERM_COMPLETION_TOKENS]: Number(completionTokens) } : {}),
         }));
     }
     // MCP tool call spans.
@@ -233,10 +241,10 @@ export function buildProvenanceGraph(trace, input, config) {
             .sort((a, b) => Number(b.endTimeUnixNano || '0') - Number(a.endTimeUnixNano || '0'))[0];
         const queryUrn = vocab.urn(packageId, 'query', queryHash);
         graph.push(makeEntityNode(queryUrn, {
-            'civic:contentHash': `sha256:${queryHash}`,
+            [CIVIC_TERM_CONTENT_HASH]: `sha256:${queryHash}`,
             // Omitted — not placeholdered — when the span named no tool.
-            ...(toolName ? { 'civic:toolName': toolName } : {}),
-            'civic:operationType': opType,
+            ...(toolName ? { [CIVIC_TERM_TOOL_NAME]: toolName } : {}),
+            [CIVIC_TERM_OPERATION_TYPE]: opType,
             'dcterms:description': `MCP tool arguments (${opType})`,
             ...(precedingInference
                 ? provWasGeneratedBy(vocab.urn(packageId, 'inference', precedingInference.spanId))
@@ -264,9 +272,9 @@ export function buildProvenanceGraph(trace, input, config) {
                 : `Data response from ${sourceAgentMap[toolSource]?.title || toolSource}`;
             const responseRows = getAttr(span.attributes, 'tool.response_rows');
             graph.push(makeEntityNode(dataUrn, {
-                'civic:contentHash': `sha256:${responseHash}`,
+                [CIVIC_TERM_CONTENT_HASH]: `sha256:${responseHash}`,
                 'dcterms:description': description,
-                'civic:sourceId': toolSource,
+                [CIVIC_TERM_SOURCE_ID]: toolSource,
                 ...provWasGeneratedBy(toolCallUrn),
                 // Croissant 1.1 placeholder — only meaningful for dataset-keyed
                 // sources today. The dataset id is stated whenever the span carried
@@ -274,17 +282,17 @@ export function buildProvenanceGraph(trace, input, config) {
                 // the portal as well. Key order is the byte contract.
                 ...(toolSourceDatasetKeyed && datasetId
                     ? {
-                        'civic:datasetId': datasetId,
+                        [CIVIC_TERM_DATASET_ID]: datasetId,
                         ...(portalDomain
                             ? {
-                                'civic:portalDomain': portalDomain,
-                                'civic:datasetUrl': `https://${portalDomain}/d/${datasetId}`,
+                                [CIVIC_TERM_PORTAL_DOMAIN]: portalDomain,
+                                [CIVIC_TERM_DATASET_URL]: `https://${portalDomain}/d/${datasetId}`,
                             }
                             : {}),
-                        'civic:croissantMetadataUrl': null, // hook for future Croissant integration
+                        [CIVIC_TERM_CROISSANT_METADATA_URL]: null, // hook for future Croissant integration
                     }
                     : {}),
-                ...(responseRows ? { 'civic:responseRows': Number(responseRows) } : {}),
+                ...(responseRows ? { [CIVIC_TERM_RESPONSE_ROWS]: Number(responseRows) } : {}),
             }));
         }
         // Tool call activity — associated with the MCP source agent that handled
@@ -317,7 +325,7 @@ export function buildProvenanceGraph(trace, input, config) {
             'dcterms:description': toolName
                 ? `MCP tool call: ${toolName} (${opType})`
                 : `MCP tool call (${opType})`,
-            'civic:sourceId': toolSource,
+            [CIVIC_TERM_SOURCE_ID]: toolSource,
             ...provUsed([queryUrn]),
             ...provWasAssociatedWith(toolAgentUrn),
             ...(span.startTimeUnixNano
@@ -326,16 +334,25 @@ export function buildProvenanceGraph(trace, input, config) {
             ...(span.endTimeUnixNano
                 ? { 'prov:endedAtTime': xsdDateTime(nanoToIso(span.endTimeUnixNano)) }
                 : {}),
-            ...(durationMs ? { 'civic:durationMs': Number(durationMs) } : {}),
+            ...(durationMs ? { [CIVIC_TERM_DURATION_MS]: Number(durationMs) } : {}),
             // Appended LAST and spread conditionally, exactly as `civic:durationMs`
             // above is: a span that recorded no rejection yields the key list it
             // yielded at 0.3.1, in the same order, and property insertion order is
             // the legacy chain's byte contract. `false` is never emitted — a
             // producer that stated "not failed" and one that stated nothing must
             // read the same, which is what makes a marker that IS present mean
-            // something. A rejected span carries no `tool.duration_ms` from the
-            // reference producer today (civic-ai-tools-website#413), so
-            // `civic:durationMs` simply does not fire beside these two.
+            // something.
+            //
+            // A REJECTED SPAN NOW CARRIES A DURATION. Until
+            // civic-ai-tools-website#413 shipped (Wave N11 P4, merged `ec7f173`)
+            // the reference producer measured a rejected call's elapsed and
+            // discarded it, so this comment said `civic:durationMs` "simply does
+            // not fire beside these two". It fires: the producer writes
+            // `tool.duration_ms` on the rejection path, and the conditional above
+            // states it — BEFORE the two markers, in the position it has held
+            // since 0.3.1, because that conditional is unchanged and this one is
+            // still appended after it. `capture/provenance.test.ts` drives that
+            // combination and pins the whole key list for it.
             ...(failed === true ? { [CIVIC_TERM_FAILED]: true } : {}),
             ...(failureKind ? { [CIVIC_TERM_FAILURE_KIND]: failureKind } : {}),
         }));

package/dist/format/dathere.d.ts

@@ -39,18 +39,37 @@ export declare function selectContentCanonicalization(contentProfile?: string):
  * value to pass as the envelope's `summary` field, or `undefined` to omit.
  */
 export declare function deriveSummaryEmission(contentProfile?: string, summary?: string): string | undefined;
+/** One MCP server the run had available, as the environment extension carries
+ *  it — spec §8.7.1 requirement 3: an object with `url` and optional `name`.
+ *  The CALLER supplies the order and the names; the harness neither sorts nor
+ *  invents them. */
+export interface DatHereMcpServer {
+    /** The server's configured address. */
+    url: string;
+    /** Optional label for the server (the reference caller passes the source
+     *  id). Omitted from the emitted object when absent, so a nameless entry
+     *  stays byte-identical to the pre-0.5.0 single-server shape. */
+    name?: string;
+}
 /**
  * Build the `org.civicaitools.environment` extension content for a datHere
  * package. Per OES §9.1.1 requirement 3 the extension MUST carry
  * `modelVersion`, `temperature`, `mcpServers`, `toolDefinitions`, `host`.
  *
+ * `mcpServers` accepts EITHER shape (additive since 0.5.0,
+ * civic-ai-tools-website#449): a single URL string — the trace's skill-fetch
+ * span URL, the only server the pre-0.5.0 builder could name — or the list of
+ * servers the run actually had, in the caller's order, each with an optional
+ * `name`. The single-URL shape produces byte-identical output to before, so
+ * an already-signed package still reproduces.
+ *
  * Prototype limitations carried over from the reference implementation
  * (known gaps, tightened in follow-up work): `temperature` placeholder `0`,
- * `toolDefinitions` placeholder `[]`; `mcpServers` derives from the trace's
- * skill-fetch span URL (the analysis's primary MCP server). Fields captured
- * honestly: `modelVersion` and `host`.
+ * `toolDefinitions` placeholder `[]`. Fields captured honestly:
+ * `modelVersion`, `host`, and — when the caller passes the list — the servers
+ * the run had.
  */
-export declare function buildDatHereEnvironment(model: string, skillMcpServerUrl: string | undefined, config: DatHereEnvironmentConfig): Record<string, unknown>;
+export declare function buildDatHereEnvironment(model: string, mcpServers: string | readonly DatHereMcpServer[] | undefined, config: DatHereEnvironmentConfig): Record<string, unknown>;
 /** Input to the composite datHere-policy derivation. */
 export interface DatHerePolicyInput {
     /** Model identifier (becomes `environment.modelVersion`). */
@@ -62,8 +81,15 @@ export interface DatHerePolicyInput {
     /** Candidate summary text (emitted only under the datHere profile). */
     summary?: string;
     /** MCP server URL from the trace's skill-fetch span (capture-side
-     *  extraction — see src/capture/skill-metadata.ts). */
+     *  extraction — see src/capture/skill-metadata.ts). Consulted only when
+     *  `mcpServers` is absent, so the pre-0.5.0 call shape keeps producing
+     *  byte-identical envelopes. */
     skillMcpServerUrl?: string;
+    /** Every MCP server the run had available, in the order the caller wants
+     *  them emitted, each with an optional `name`
+     *  (civic-ai-tools-website#449). When supplied this REPLACES
+     *  `skillMcpServerUrl` as the source of `environment.mcpServers`. */
+    mcpServers?: readonly DatHereMcpServer[];
     /** Caller-supplied extensions to layer the environment extension onto. */
     extensions?: Record<string, unknown>;
 }

package/dist/format/dathere.js

@@ -69,26 +69,50 @@ export function deriveSummaryEmission(contentProfile, summary) {
         ? summary
         : undefined;
 }
+/** Normalize the two accepted `mcpServers` inputs to the emitted array.
+ *
+ *  A bare string is the pre-0.5.0 shape — the trace's skill-fetch URL — and
+ *  yields at most the one `{ url }` entry, exactly as before. A list is
+ *  emitted in the order given, each entry carrying `name` only when the
+ *  caller supplied one. An entry with an empty `url` contributes nothing,
+ *  which is the same rule the single-URL shape always applied: a server with
+ *  no address is stated by absence, never by an empty string. */
+function normalizeMcpServers(servers) {
+    if (servers === undefined)
+        return [];
+    if (typeof servers === 'string') {
+        return servers ? [{ url: servers }] : [];
+    }
+    return servers
+        .filter((server) => Boolean(server.url))
+        .map((server) => ({
+        url: server.url,
+        ...(server.name ? { name: server.name } : {}),
+    }));
+}
 /**
  * Build the `org.civicaitools.environment` extension content for a datHere
  * package. Per OES §9.1.1 requirement 3 the extension MUST carry
  * `modelVersion`, `temperature`, `mcpServers`, `toolDefinitions`, `host`.
  *
+ * `mcpServers` accepts EITHER shape (additive since 0.5.0,
+ * civic-ai-tools-website#449): a single URL string — the trace's skill-fetch
+ * span URL, the only server the pre-0.5.0 builder could name — or the list of
+ * servers the run actually had, in the caller's order, each with an optional
+ * `name`. The single-URL shape produces byte-identical output to before, so
+ * an already-signed package still reproduces.
+ *
  * Prototype limitations carried over from the reference implementation
  * (known gaps, tightened in follow-up work): `temperature` placeholder `0`,
- * `toolDefinitions` placeholder `[]`; `mcpServers` derives from the trace's
- * skill-fetch span URL (the analysis's primary MCP server). Fields captured
- * honestly: `modelVersion` and `host`.
+ * `toolDefinitions` placeholder `[]`. Fields captured honestly:
+ * `modelVersion`, `host`, and — when the caller passes the list — the servers
+ * the run had.
  */
-export function buildDatHereEnvironment(model, skillMcpServerUrl, config) {
-    const mcpServers = [];
-    if (skillMcpServerUrl) {
-        mcpServers.push({ url: skillMcpServerUrl });
-    }
+export function buildDatHereEnvironment(model, mcpServers, config) {
     return {
         modelVersion: model,
         temperature: 0,
-        mcpServers,
+        mcpServers: normalizeMcpServers(mcpServers),
         toolDefinitions: [],
         host: config.host,
     };
@@ -102,7 +126,10 @@ export function buildDatHereEnvironment(model, skillMcpServerUrl, config) {
 export function deriveDatHereEnvelopeFields(input, config) {
     const extensions = { ...(input.extensions ?? {}) };
     if (input.contentProfile === DATHERE_CONTENT_PROFILE) {
-        extensions[ENVIRONMENT_EXTENSION_KEY] = buildDatHereEnvironment(input.model, input.skillMcpServerUrl, config);
+        extensions[ENVIRONMENT_EXTENSION_KEY] = buildDatHereEnvironment(input.model, 
+        // The list when the caller has one, the single skill-fetch URL
+        // otherwise — an input carrying neither still emits `mcpServers: []`.
+        input.mcpServers ?? input.skillMcpServerUrl, config);
     }
     return {
         producerProfile: deriveProducerProfile(input.producerProfile, input.contentProfile),

package/dist/format/sources.d.ts

@@ -5,8 +5,18 @@ export interface CivicSourceInfo {
     displayName: string;
     /** PROV agent `dcterms:title`, e.g. "Socrata MCP Server". */
     agentTitle: string;
-    /** MCP endpoint URL — the PROV agent's `civic:serverUrl`. */
-    serverUrl: string;
+    /**
+     * MCP endpoint URL — the PROV agent's `civic:serverUrl`, and this source's
+     * display address.
+     *
+     * OPTIONAL since 0.5.0 (civic-ai-tools#205). The address a run reached is
+     * the OPERATOR's configuration, not a fact the harness knows, so a caller
+     * passes a registry whose entries carry the addresses that instance is
+     * pointed at. An entry that carries no address makes the provenance graph
+     * OMIT `civic:serverUrl` from that source's agent entirely, rather than
+     * assert a stand-in: honest absence over an asserted default.
+     */
+    serverUrl?: string;
     /** `dataSources[].catalogType` value for entries from this source. */
     catalogType: string;
     /**
@@ -22,7 +32,14 @@ export interface CivicSourceInfo {
  *  order for aggregate `dataSources` entries. */
 export type CivicSourceRegistry = Record<string, CivicSourceInfo>;
 /** The civic reference registry — the three demo sources. Passed explicitly
- *  by the reference app — never applied as a default. */
+ *  by the reference app — never applied as a default.
+ *
+ *  THE `serverUrl` VALUES BELOW ARE THE REFERENCE DEPLOYMENT'S OWN, and since
+ *  0.5.0 (civic-ai-tools#205) that is the whole of their role: a default
+ *  display address, and — on the two aggregate sources — the companion of
+ *  `aggregatePortalUrl`. They are not what a record asserts about a run. An
+ *  instance pointed at other addresses passes a registry carrying those; an
+ *  entry with no address emits no `civic:serverUrl` at all. */
 export declare const CIVIC_SOURCE_REGISTRY: CivicSourceRegistry;
 /** The source id untagged/pre-M9.1 captures fall back to. Socrata was the
  *  only source when those packages were written. */

package/dist/format/sources.js

@@ -13,7 +13,14 @@
 // demo map is exported as `CIVIC_SOURCE_REGISTRY` for explicit use, never
 // applied as a default.
 /** The civic reference registry — the three demo sources. Passed explicitly
- *  by the reference app — never applied as a default. */
+ *  by the reference app — never applied as a default.
+ *
+ *  THE `serverUrl` VALUES BELOW ARE THE REFERENCE DEPLOYMENT'S OWN, and since
+ *  0.5.0 (civic-ai-tools#205) that is the whole of their role: a default
+ *  display address, and — on the two aggregate sources — the companion of
+ *  `aggregatePortalUrl`. They are not what a record asserts about a run. An
+ *  instance pointed at other addresses passes a registry carrying those; an
+ *  entry with no address emits no `civic:serverUrl` at all. */
 export const CIVIC_SOURCE_REGISTRY = {
     socrata: {
         displayName: 'Socrata',

package/dist/format/vocabulary.d.ts

@@ -35,6 +35,83 @@ export declare const CIVIC_TERM_FAILED = "civic:failed";
  * wider vocabulary widens this field rather than putting prose in it.
  */
 export declare const CIVIC_TERM_FAILURE_KIND = "civic:failureKind";
+/**
+ * `civic:contentHash` — the SHA-256 of the bytes an entity stands for, as
+ * `sha256:<hex>`. Emitted on the prompt, skill, output, tool-argument and
+ * data-response entities: a reader hashes the content it holds and compares.
+ */
+export declare const CIVIC_TERM_CONTENT_HASH = "civic:contentHash";
+/**
+ * `civic:serverUrl` — the MCP server URL an source agent answered from, as
+ * the deployment's source registry states it (or, for the skill source, as
+ * the trace's skill-fetch span carried it).
+ */
+export declare const CIVIC_TERM_SERVER_URL = "civic:serverUrl";
+/**
+ * `civic:sourceId` — the stable id of the source that answered a call, on
+ * both the tool-call activity and the data-response entity. It is the
+ * registry key, not a display name: a reader resolves it, and the graph never
+ * spells the reader-facing name.
+ */
+export declare const CIVIC_TERM_SOURCE_ID = "civic:sourceId";
+/**
+ * `civic:url` — the public URL of the platform agent that published the
+ * record (the deployment's own address, a typed config input).
+ */
+export declare const CIVIC_TERM_URL = "civic:url";
+/** `civic:promptTokens` — prompt tokens the span reported for one inference.
+ *  Emitted only when the span carried the count; never zero-filled. */
+export declare const CIVIC_TERM_PROMPT_TOKENS = "civic:promptTokens";
+/** `civic:completionTokens` — completion tokens the span reported for one
+ *  inference. Emitted only when the span carried the count. */
+export declare const CIVIC_TERM_COMPLETION_TOKENS = "civic:completionTokens";
+/**
+ * `civic:toolName` — the tool a call invoked, verbatim from the span.
+ * Omitted, never placeholdered, when the span named no tool: the graph states
+ * absence as absence.
+ */
+export declare const CIVIC_TERM_TOOL_NAME = "civic:toolName";
+/**
+ * `civic:operationType` — the producer's classification of what a call did
+ * (`query`, `metadata`, `unknown`, …). An open string the graph states
+ * verbatim and never re-derives.
+ */
+export declare const CIVIC_TERM_OPERATION_TYPE = "civic:operationType";
+/**
+ * `civic:datasetId` — the dataset a data response came from, stated whenever
+ * the span carried one and the source is dataset-keyed.
+ */
+export declare const CIVIC_TERM_DATASET_ID = "civic:datasetId";
+/**
+ * `civic:portalDomain` — the portal host a tool span carried. Never the run's
+ * selected portal: a call that addressed no portal yields a response
+ * attributed to none.
+ */
+export declare const CIVIC_TERM_PORTAL_DOMAIN = "civic:portalDomain";
+/**
+ * `civic:datasetUrl` — the canonical dataset URL, minted only when the span
+ * carried BOTH the portal host and the dataset id (a URL needs a host the
+ * span actually stated).
+ */
+export declare const CIVIC_TERM_DATASET_URL = "civic:datasetUrl";
+/**
+ * `civic:croissantMetadataUrl` — the Croissant 1.1 metadata URL for a
+ * dataset-keyed data response. Emitted as an explicit `null` placeholder for
+ * a future integration; the key is inside signed bytes, so it is stated here
+ * rather than left as an undocumented literal.
+ */
+export declare const CIVIC_TERM_CROISSANT_METADATA_URL = "civic:croissantMetadataUrl";
+/** `civic:responseRows` — the row count a tool response carried, when the
+ *  span reported one. */
+export declare const CIVIC_TERM_RESPONSE_ROWS = "civic:responseRows";
+/**
+ * `civic:durationMs` — the elapsed the producer measured for one tool call.
+ * Emitted whenever the span carried it, on a call that answered and on one
+ * the source REFUSED alike: since civic-ai-tools-website#413 the reference
+ * producer records the elapsed on its rejection path too, so this term and
+ * {@link CIVIC_TERM_FAILED} appear together on the same activity.
+ */
+export declare const CIVIC_TERM_DURATION_MS = "civic:durationMs";
 /**
  * One era of the civic vocabulary: the two literals plus the emitters bound
  * to them. The vocabulary is not deployment configuration (a deployment does

package/dist/format/vocabulary.js

@@ -37,16 +37,25 @@ export const PRIOR_ERA_CIVIC_URN_PREFIX = 'urn:civic-evidence';
 // A `civic:` property name is vocabulary as much as the namespace it hangs
 // under: it is the word a reader of a signed graph interprets, so it is
 // declared here and imported by the builder that emits it, never spelled as a
-// literal inside capture/ (`purity.test.ts` enforces that for the terms below).
-// Both terms are era-independent — the settlement moved the NAMESPACE, not the
-// property names — so they carry no era qualifier and are minted for the first
-// time after it.
+// literal inside capture/. Every term is era-independent — the 2026-08-19
+// settlement moved the NAMESPACE, not the property names — so none carries an
+// era qualifier.
 //
-// The settlement-era property names that predate Wave N10 (`civic:sourceId`,
-// `civic:durationMs`, `civic:datasetId` and their siblings) are still inline
-// literals in the capture-side builder. That is a real inconsistency, recorded
-// rather than fixed in passing: moving them is a byte-sensitive change across
-// every golden fixture and belongs to a phase of its own.
+// COMPLETE, AND GUARDED AS COMPLETE (civic-ai-tools#199 §2). Until this wave
+// two terms were declared here and the other fourteen were spelled inline in
+// capture/provenance.ts and declared nowhere, which the note that stood in
+// this place recorded as "a real inconsistency ... a phase of its own". This
+// is that phase. `purity.test.ts` no longer holds a list of the terms it
+// knows about — it derives the universe from both ends: no string literal
+// anywhere in capture/ may be a `civic:` term, and every `civic:` key a
+// DRIVEN graph emits must be the value of a constant declared here. A term
+// invented inline tomorrow fails both legs without anyone editing a list.
+//
+// NO BYTE MOVES. Naming a key changes no emitted byte: a computed key
+// (`{ [CIVIC_TERM_SOURCE_ID]: v }`) inserts in the same position with the same
+// value as the literal it replaces, and property insertion order is the legacy
+// chain's byte contract. Both golden suites and the span-carrying golden case
+// added in the same phase measure that rather than assume it.
 /**
  * `civic:failed` — a tool-call activity whose call the SOURCE REFUSED.
  *
@@ -71,6 +80,83 @@ export const CIVIC_TERM_FAILED = 'civic:failed';
  * wider vocabulary widens this field rather than putting prose in it.
  */
 export const CIVIC_TERM_FAILURE_KIND = 'civic:failureKind';
+/**
+ * `civic:contentHash` — the SHA-256 of the bytes an entity stands for, as
+ * `sha256:<hex>`. Emitted on the prompt, skill, output, tool-argument and
+ * data-response entities: a reader hashes the content it holds and compares.
+ */
+export const CIVIC_TERM_CONTENT_HASH = 'civic:contentHash';
+/**
+ * `civic:serverUrl` — the MCP server URL an source agent answered from, as
+ * the deployment's source registry states it (or, for the skill source, as
+ * the trace's skill-fetch span carried it).
+ */
+export const CIVIC_TERM_SERVER_URL = 'civic:serverUrl';
+/**
+ * `civic:sourceId` — the stable id of the source that answered a call, on
+ * both the tool-call activity and the data-response entity. It is the
+ * registry key, not a display name: a reader resolves it, and the graph never
+ * spells the reader-facing name.
+ */
+export const CIVIC_TERM_SOURCE_ID = 'civic:sourceId';
+/**
+ * `civic:url` — the public URL of the platform agent that published the
+ * record (the deployment's own address, a typed config input).
+ */
+export const CIVIC_TERM_URL = 'civic:url';
+/** `civic:promptTokens` — prompt tokens the span reported for one inference.
+ *  Emitted only when the span carried the count; never zero-filled. */
+export const CIVIC_TERM_PROMPT_TOKENS = 'civic:promptTokens';
+/** `civic:completionTokens` — completion tokens the span reported for one
+ *  inference. Emitted only when the span carried the count. */
+export const CIVIC_TERM_COMPLETION_TOKENS = 'civic:completionTokens';
+/**
+ * `civic:toolName` — the tool a call invoked, verbatim from the span.
+ * Omitted, never placeholdered, when the span named no tool: the graph states
+ * absence as absence.
+ */
+export const CIVIC_TERM_TOOL_NAME = 'civic:toolName';
+/**
+ * `civic:operationType` — the producer's classification of what a call did
+ * (`query`, `metadata`, `unknown`, …). An open string the graph states
+ * verbatim and never re-derives.
+ */
+export const CIVIC_TERM_OPERATION_TYPE = 'civic:operationType';
+/**
+ * `civic:datasetId` — the dataset a data response came from, stated whenever
+ * the span carried one and the source is dataset-keyed.
+ */
+export const CIVIC_TERM_DATASET_ID = 'civic:datasetId';
+/**
+ * `civic:portalDomain` — the portal host a tool span carried. Never the run's
+ * selected portal: a call that addressed no portal yields a response
+ * attributed to none.
+ */
+export const CIVIC_TERM_PORTAL_DOMAIN = 'civic:portalDomain';
+/**
+ * `civic:datasetUrl` — the canonical dataset URL, minted only when the span
+ * carried BOTH the portal host and the dataset id (a URL needs a host the
+ * span actually stated).
+ */
+export const CIVIC_TERM_DATASET_URL = 'civic:datasetUrl';
+/**
+ * `civic:croissantMetadataUrl` — the Croissant 1.1 metadata URL for a
+ * dataset-keyed data response. Emitted as an explicit `null` placeholder for
+ * a future integration; the key is inside signed bytes, so it is stated here
+ * rather than left as an undocumented literal.
+ */
+export const CIVIC_TERM_CROISSANT_METADATA_URL = 'civic:croissantMetadataUrl';
+/** `civic:responseRows` — the row count a tool response carried, when the
+ *  span reported one. */
+export const CIVIC_TERM_RESPONSE_ROWS = 'civic:responseRows';
+/**
+ * `civic:durationMs` — the elapsed the producer measured for one tool call.
+ * Emitted whenever the span carried it, on a call that answered and on one
+ * the source REFUSED alike: since civic-ai-tools-website#413 the reference
+ * producer records the elapsed on its rejection path too, so this term and
+ * {@link CIVIC_TERM_FAILED} appear together on the same activity.
+ */
+export const CIVIC_TERM_DURATION_MS = 'civic:durationMs';
 /** Bind the emitters to one era's two literals. */
 export function makeCivicVocabulary(ns, urnPrefix) {
     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@typedstandards/civic-typed-harness",
-  "version": "0.4.1",
+  "version": "0.6.0",
   "description": "Civic-domain harness for Typed Standards evidence packages — the DOMAIN layer of the ADR-0021 format/domain line: civic PROV-O vocabulary and provenance builder, datHere envelope-policy derivations, and the capture machinery (trace builder, skill-metadata extraction, data-source population, adversarial rubric core). Derives; @typedstandards/produce-core assembles.",
   "license": "MIT",
   "author": "Nathan Storey",
@@ -26,17 +26,18 @@
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "clean": "rm -rf dist tsconfig.tsbuildinfo",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.test.json",
     "lint": "eslint .",
     "test": "node --test --experimental-strip-types \"src/**/*.test.ts\"",
     "prepare": "npm run build",
     "prepublishOnly": "npm run clean && npm run build"
   },
   "dependencies": {
-    "@typedstandards/produce-core": "^0.3.0 || ^0.4.0"
+    "@typedstandards/produce-core": "^0.7.0"
   },
   "devDependencies": {
-    "@typedstandards/verify-core": "^0.9.0",
+    "@typedstandards/verify-core": "^0.12.0",
+    "@types/node": "^22.20.2",
     "@typescript-eslint/parser": "^8",
     "eslint": "^9",
     "typescript": "^5.9.3"