@vizejs/marquette 0.299.1 → 0.303.0

package/dist/test-run-check.d.mts

@@ -0,0 +1,80 @@
+import { i as TestRunEvidence } from "./test-run-model-DkllmEsY.mjs";
+import { MarquetteDiagnostic } from "./validate.mjs";
+import { TestRunAdmissionDecision, TestRunCandidate } from "./test-run-admission.mjs";
+
+//#region src/test-run-check.d.ts
+/**
+ * Serialized `format` marker for retained tests-check records.
+ *
+ * Readers must reject any other value before trusting the record.
+ */
+declare const TEST_RUN_CHECK_FORMAT = "vize.test-run.check";
+/**
+ * Current serialized tests-check format.
+ *
+ * Readers must reject a higher value until they explicitly support it.
+ */
+declare const TEST_RUN_CHECK_FORMAT_VERSION = 1;
+/**
+ * Retained, release-bound `tests` check for one deployment decision.
+ *
+ * The record replaces every generic test-result reference — a summary blob,
+ * a report path, or a green workflow label — with the exact
+ * `test-run:<sha256>` admission id of an independently verified run, the six
+ * candidate facts the run was admitted for, and the identity and instant of
+ * the independent observer that recorded the admission. A release decision
+ * retaining anything else as its tests evidence cannot pass
+ * {@link verifyTestRunCheck}.
+ */
+interface TestRunCheck {
+  /** Serialized format marker; always {@link TEST_RUN_CHECK_FORMAT}. */
+  readonly format: typeof TEST_RUN_CHECK_FORMAT;
+  /**
+   * Serialized format version.
+   *
+   * Defaults to {@link TEST_RUN_CHECK_FORMAT_VERSION}.
+   */
+  readonly formatVersion?: typeof TEST_RUN_CHECK_FORMAT_VERSION;
+  /** Exact `test-run:<sha256>` admission id of the observed run. */
+  readonly evidence: string;
+  /** Exact candidate facts the run was admitted for. */
+  readonly candidate: TestRunCandidate;
+  /**
+   * Identity of the independent observer that recorded the admission.
+   *
+   * The observer is the trusted promotion boundary, never the runner that
+   * executed the tests.
+   */
+  readonly observer: string;
+  /** Millisecond-precision UTC instant the admission was observed. */
+  readonly observedAt: string;
+}
+/**
+ * Validates a retained tests-check record structurally.
+ *
+ * Diagnostics use `check.` paths and are deterministic and sorted by path,
+ * code, and message. A generic evidence reference fails here with
+ * `VIZE_MARQUETTE_141`: only an exact `test-run:<sha256>` admission id can
+ * name retained test evidence. Structural validity never admits anything by
+ * itself; {@link verifyTestRunCheck} must confirm the record against the
+ * caller's candidate and the retained run. Codes, paths, messages, and
+ * ordering are identical to the native implementation.
+ */
+declare function validateTestRunCheck(check: TestRunCheck): MarquetteDiagnostic[];
+/**
+ * Verifies one retained tests check against the caller's own facts.
+ *
+ * The caller supplies the candidate it is deciding from its own trusted
+ * facts; the retained check must validate structurally, bind that candidate
+ * exactly, name an observer independent from the run's runner, and be
+ * observed no earlier than the run's completed verification. The referenced
+ * record is then admitted exactly like {@link admitTestRun}: canonical
+ * fingerprint, candidate bindings, expiry at `now`, verification outcome,
+ * and skipped-test accounting all fail closed. Diagnostics, denial codes,
+ * and ordering are identical to the native implementation, as pinned by the
+ * shared check-decision fixtures.
+ */
+declare function verifyTestRunCheck(check: TestRunCheck, candidate: TestRunCandidate, evidence: TestRunEvidence, now: string): Promise<TestRunAdmissionDecision>;
+//#endregion
+export { TEST_RUN_CHECK_FORMAT, TEST_RUN_CHECK_FORMAT_VERSION, TestRunCheck, validateTestRunCheck, verifyTestRunCheck };
+//# sourceMappingURL=test-run-check.d.mts.map

package/dist/test-run-check.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-run-check.d.mts","names":[],"sources":["../src/test-run-check.ts"],"mappings":";;;;;;;AAwBA;;;cAAa,qBAAA;;AAOb;;;;cAAa,6BAAA;AAab;;;;;;;;;;;AAAA,UAAiB,YAAA;EAUN;EAAA,SARA,MAAA,SAAe,qBAAA;EAUJ;;;;;EAAA,SAJX,aAAA,UAAuB,6BAAA;EA2BE;EAAA,SAzBzB,QAAA;EAyBmE;EAAA,SAvBnE,SAAA,EAAW,gBAAA;EAuBe;;;;AA4DrC;;EA5DqC,SAhB1B,QAAA;EA6EF;EAAA,SA3EE,UAAA;AAAA;;;;;;;;;;;;iBAcK,oBAAA,CAAqB,KAAA,EAAO,YAAA,GAAe,mBAAA;;;;;;;;;;;;;;iBA4DrC,kBAAA,CACpB,KAAA,EAAO,YAAA,EACP,SAAA,EAAW,gBAAA,EACX,QAAA,EAAU,eAAA,EACV,GAAA,WACC,OAAA,CAAQ,wBAAA"}

package/dist/test-run-check.mjs

@@ -0,0 +1,116 @@
+import { a as checkDigest, c as checkSourceRevision, d as isStrictTimestamp, l as checkTimestamp, o as checkIdentifier, u as error } from "./test-run-validate-C_KR031E.mjs";
+import { parseTestRunAdmissionId } from "./test-run-canonical.mjs";
+import { admitTestRun, testRunDenialCode } from "./test-run-admission.mjs";
+//#region src/test-run-check.ts
+/**
+* Serialized `format` marker for retained tests-check records.
+*
+* Readers must reject any other value before trusting the record.
+*/
+const TEST_RUN_CHECK_FORMAT = "vize.test-run.check";
+/**
+* Current serialized tests-check format.
+*
+* Readers must reject a higher value until they explicitly support it.
+*/
+const TEST_RUN_CHECK_FORMAT_VERSION = 1;
+/**
+* Validates a retained tests-check record structurally.
+*
+* Diagnostics use `check.` paths and are deterministic and sorted by path,
+* code, and message. A generic evidence reference fails here with
+* `VIZE_MARQUETTE_141`: only an exact `test-run:<sha256>` admission id can
+* name retained test evidence. Structural validity never admits anything by
+* itself; {@link verifyTestRunCheck} must confirm the record against the
+* caller's candidate and the retained run. Codes, paths, messages, and
+* ordering are identical to the native implementation.
+*/
+function validateTestRunCheck(check) {
+	const diagnostics = [];
+	if (check.format !== "vize.test-run.check") diagnostics.push(error("VIZE_MARQUETTE_101", "check.format", "unsupported tests-check format marker"));
+	if ((check.formatVersion ?? 1) !== 1) diagnostics.push(error("VIZE_MARQUETTE_102", "check.formatVersion", "unsupported tests-check format version"));
+	if (parseTestRunAdmissionId(check.evidence) === void 0) diagnostics.push(error("VIZE_MARQUETTE_141", "check.evidence", "check evidence must be test-run: followed by 64 lowercase hexadecimal characters"));
+	const candidate = check.candidate;
+	checkIdentifier(candidate.application, "check.candidate.application", diagnostics);
+	checkIdentifier(candidate.environment, "check.candidate.environment", diagnostics);
+	checkDigest(candidate.contractFingerprint, "check.candidate.contractFingerprint", diagnostics);
+	checkSourceRevision(candidate.sourceRevision, "check.candidate.sourceRevision", diagnostics);
+	if (candidate.release.length === 0 || candidate.release.length > 256) diagnostics.push(error("VIZE_MARQUETTE_106", "check.candidate.release", "release must be between 1 and 256 characters"));
+	checkDigest(candidate.artifactFingerprint, "check.candidate.artifactFingerprint", diagnostics);
+	checkIdentifier(check.observer, "check.observer", diagnostics);
+	checkTimestamp(check.observedAt, "check.observedAt", diagnostics);
+	sortDiagnostics(diagnostics);
+	return diagnostics;
+}
+/**
+* Verifies one retained tests check against the caller's own facts.
+*
+* The caller supplies the candidate it is deciding from its own trusted
+* facts; the retained check must validate structurally, bind that candidate
+* exactly, name an observer independent from the run's runner, and be
+* observed no earlier than the run's completed verification. The referenced
+* record is then admitted exactly like {@link admitTestRun}: canonical
+* fingerprint, candidate bindings, expiry at `now`, verification outcome,
+* and skipped-test accounting all fail closed. Diagnostics, denial codes,
+* and ordering are identical to the native implementation, as pinned by the
+* shared check-decision fixtures.
+*/
+async function verifyTestRunCheck(check, candidate, evidence, now) {
+	const diagnostics = validateTestRunCheck(check);
+	const bindings = [
+		[
+			check.candidate.application,
+			candidate.application,
+			"application",
+			"application"
+		],
+		[
+			check.candidate.environment,
+			candidate.environment,
+			"environment",
+			"environment"
+		],
+		[
+			check.candidate.contractFingerprint,
+			candidate.contractFingerprint,
+			"contractFingerprint",
+			"contract fingerprint"
+		],
+		[
+			check.candidate.sourceRevision,
+			candidate.sourceRevision,
+			"sourceRevision",
+			"source revision"
+		],
+		[
+			check.candidate.release,
+			candidate.release,
+			"release",
+			"release"
+		],
+		[
+			check.candidate.artifactFingerprint,
+			candidate.artifactFingerprint,
+			"artifactFingerprint",
+			"artifact fingerprint"
+		]
+	];
+	for (const [recorded, expected, property, field] of bindings) if (recorded !== expected) diagnostics.push(error("VIZE_MARQUETTE_149", `check.candidate.${property}`, `check does not bind the candidate ${field}`));
+	if (check.observer === evidence.runner.identity) diagnostics.push(error("VIZE_MARQUETTE_151", "check.observer", "check observer must be independent from the run's runner"));
+	if (isStrictTimestamp(check.observedAt) && check.observedAt < evidence.verification.completedAt) diagnostics.push(error("VIZE_MARQUETTE_150", "check.observedAt", "observation must not precede the completed verification"));
+	diagnostics.push(...await admitTestRun(evidence, candidate, check.evidence, now));
+	sortDiagnostics(diagnostics);
+	const denialCodes = [...new Set(diagnostics.map(testRunDenialCode))].sort();
+	return {
+		allowed: diagnostics.length === 0,
+		denialCodes,
+		diagnostics
+	};
+}
+function sortDiagnostics(diagnostics) {
+	diagnostics.sort((left, right) => left.path !== right.path ? left.path < right.path ? -1 : 1 : left.code !== right.code ? left.code < right.code ? -1 : 1 : left.message < right.message ? -1 : left.message > right.message ? 1 : 0);
+}
+//#endregion
+export { TEST_RUN_CHECK_FORMAT, TEST_RUN_CHECK_FORMAT_VERSION, validateTestRunCheck, verifyTestRunCheck };
+
+//# sourceMappingURL=test-run-check.mjs.map

package/dist/test-run-check.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-run-check.mjs","names":[],"sources":["../src/test-run-check.ts"],"sourcesContent":["import type { TestRunEvidence } from \"./test-run-model.js\";\nimport type { MarquetteDiagnostic } from \"./validate.js\";\nimport {\n  admitTestRun,\n  testRunDenialCode,\n  type TestRunAdmissionDecision,\n  type TestRunCandidate,\n  type TestRunDenialCode,\n} from \"./test-run-admission.js\";\nimport { parseTestRunAdmissionId } from \"./test-run-canonical.js\";\nimport {\n  checkDigest,\n  checkIdentifier,\n  checkSourceRevision,\n  checkTimestamp,\n  error,\n  isStrictTimestamp,\n} from \"./test-run-validate-rules.js\";\n\n/**\n * Serialized `format` marker for retained tests-check records.\n *\n * Readers must reject any other value before trusting the record.\n */\nexport const TEST_RUN_CHECK_FORMAT = \"vize.test-run.check\";\n\n/**\n * Current serialized tests-check format.\n *\n * Readers must reject a higher value until they explicitly support it.\n */\nexport const TEST_RUN_CHECK_FORMAT_VERSION = 1;\n\n/**\n * Retained, release-bound `tests` check for one deployment decision.\n *\n * The record replaces every generic test-result reference — a summary blob,\n * a report path, or a green workflow label — with the exact\n * `test-run:<sha256>` admission id of an independently verified run, the six\n * candidate facts the run was admitted for, and the identity and instant of\n * the independent observer that recorded the admission. A release decision\n * retaining anything else as its tests evidence cannot pass\n * {@link verifyTestRunCheck}.\n */\nexport interface TestRunCheck {\n  /** Serialized format marker; always {@link TEST_RUN_CHECK_FORMAT}. */\n  readonly format: typeof TEST_RUN_CHECK_FORMAT;\n  /**\n   * Serialized format version.\n   *\n   * Defaults to {@link TEST_RUN_CHECK_FORMAT_VERSION}.\n   */\n  readonly formatVersion?: typeof TEST_RUN_CHECK_FORMAT_VERSION;\n  /** Exact `test-run:<sha256>` admission id of the observed run. */\n  readonly evidence: string;\n  /** Exact candidate facts the run was admitted for. */\n  readonly candidate: TestRunCandidate;\n  /**\n   * Identity of the independent observer that recorded the admission.\n   *\n   * The observer is the trusted promotion boundary, never the runner that\n   * executed the tests.\n   */\n  readonly observer: string;\n  /** Millisecond-precision UTC instant the admission was observed. */\n  readonly observedAt: string;\n}\n\n/**\n * Validates a retained tests-check record structurally.\n *\n * Diagnostics use `check.` paths and are deterministic and sorted by path,\n * code, and message. A generic evidence reference fails here with\n * `VIZE_MARQUETTE_141`: only an exact `test-run:<sha256>` admission id can\n * name retained test evidence. Structural validity never admits anything by\n * itself; {@link verifyTestRunCheck} must confirm the record against the\n * caller's candidate and the retained run. Codes, paths, messages, and\n * ordering are identical to the native implementation.\n */\nexport function validateTestRunCheck(check: TestRunCheck): MarquetteDiagnostic[] {\n  const diagnostics: MarquetteDiagnostic[] = [];\n\n  if ((check.format as string) !== TEST_RUN_CHECK_FORMAT) {\n    diagnostics.push(\n      error(\"VIZE_MARQUETTE_101\", \"check.format\", \"unsupported tests-check format marker\"),\n    );\n  }\n  if ((check.formatVersion ?? TEST_RUN_CHECK_FORMAT_VERSION) !== TEST_RUN_CHECK_FORMAT_VERSION) {\n    diagnostics.push(\n      error(\"VIZE_MARQUETTE_102\", \"check.formatVersion\", \"unsupported tests-check format version\"),\n    );\n  }\n\n  if (parseTestRunAdmissionId(check.evidence) === undefined) {\n    diagnostics.push(\n      error(\n        \"VIZE_MARQUETTE_141\",\n        \"check.evidence\",\n        \"check evidence must be test-run: followed by 64 lowercase hexadecimal characters\",\n      ),\n    );\n  }\n\n  const candidate = check.candidate;\n  checkIdentifier(candidate.application, \"check.candidate.application\", diagnostics);\n  checkIdentifier(candidate.environment, \"check.candidate.environment\", diagnostics);\n  checkDigest(candidate.contractFingerprint, \"check.candidate.contractFingerprint\", diagnostics);\n  checkSourceRevision(candidate.sourceRevision, \"check.candidate.sourceRevision\", diagnostics);\n  if (candidate.release.length === 0 || candidate.release.length > 256) {\n    diagnostics.push(\n      error(\n        \"VIZE_MARQUETTE_106\",\n        \"check.candidate.release\",\n        \"release must be between 1 and 256 characters\",\n      ),\n    );\n  }\n  checkDigest(candidate.artifactFingerprint, \"check.candidate.artifactFingerprint\", diagnostics);\n\n  checkIdentifier(check.observer, \"check.observer\", diagnostics);\n  checkTimestamp(check.observedAt, \"check.observedAt\", diagnostics);\n\n  sortDiagnostics(diagnostics);\n  return diagnostics;\n}\n\n/**\n * Verifies one retained tests check against the caller's own facts.\n *\n * The caller supplies the candidate it is deciding from its own trusted\n * facts; the retained check must validate structurally, bind that candidate\n * exactly, name an observer independent from the run's runner, and be\n * observed no earlier than the run's completed verification. The referenced\n * record is then admitted exactly like {@link admitTestRun}: canonical\n * fingerprint, candidate bindings, expiry at `now`, verification outcome,\n * and skipped-test accounting all fail closed. Diagnostics, denial codes,\n * and ordering are identical to the native implementation, as pinned by the\n * shared check-decision fixtures.\n */\nexport async function verifyTestRunCheck(\n  check: TestRunCheck,\n  candidate: TestRunCandidate,\n  evidence: TestRunEvidence,\n  now: string,\n): Promise<TestRunAdmissionDecision> {\n  const diagnostics = validateTestRunCheck(check);\n\n  const bindings = [\n    [check.candidate.application, candidate.application, \"application\", \"application\"],\n    [check.candidate.environment, candidate.environment, \"environment\", \"environment\"],\n    [\n      check.candidate.contractFingerprint,\n      candidate.contractFingerprint,\n      \"contractFingerprint\",\n      \"contract fingerprint\",\n    ],\n    [check.candidate.sourceRevision, candidate.sourceRevision, \"sourceRevision\", \"source revision\"],\n    [check.candidate.release, candidate.release, \"release\", \"release\"],\n    [\n      check.candidate.artifactFingerprint,\n      candidate.artifactFingerprint,\n      \"artifactFingerprint\",\n      \"artifact fingerprint\",\n    ],\n  ] as const;\n  for (const [recorded, expected, property, field] of bindings) {\n    if (recorded !== expected) {\n      diagnostics.push(\n        error(\n          \"VIZE_MARQUETTE_149\",\n          `check.candidate.${property}`,\n          `check does not bind the candidate ${field}`,\n        ),\n      );\n    }\n  }\n\n  if (check.observer === evidence.runner.identity) {\n    diagnostics.push(\n      error(\n        \"VIZE_MARQUETTE_151\",\n        \"check.observer\",\n        \"check observer must be independent from the run's runner\",\n      ),\n    );\n  }\n  if (isStrictTimestamp(check.observedAt) && check.observedAt < evidence.verification.completedAt) {\n    diagnostics.push(\n      error(\n        \"VIZE_MARQUETTE_150\",\n        \"check.observedAt\",\n        \"observation must not precede the completed verification\",\n      ),\n    );\n  }\n\n  diagnostics.push(...(await admitTestRun(evidence, candidate, check.evidence, now)));\n  sortDiagnostics(diagnostics);\n  const denialCodes: TestRunDenialCode[] = [...new Set(diagnostics.map(testRunDenialCode))].sort();\n  return { allowed: diagnostics.length === 0, denialCodes, diagnostics };\n}\n\nfunction sortDiagnostics(diagnostics: MarquetteDiagnostic[]): void {\n  diagnostics.sort((left, right) =>\n    left.path !== right.path\n      ? left.path < right.path\n        ? -1\n        : 1\n      : left.code !== right.code\n        ? left.code < right.code\n          ? -1\n          : 1\n        : left.message < right.message\n          ? -1\n          : left.message > right.message\n            ? 1\n            : 0,\n  );\n}\n"],"mappings":";;;;;;;;;AAwBA,MAAa,wBAAwB;;;;;;AAOrC,MAAa,gCAAgC;;;;;;;;;;;;AAgD7C,SAAgB,qBAAqB,OAA4C;CAC/E,MAAM,cAAqC,EAAE;CAE7C,IAAK,MAAM,WAAA,uBACT,YAAY,KACV,MAAM,sBAAsB,gBAAgB,wCAAwC,CACrF;CAEH,KAAK,MAAM,iBAAA,OAAA,GACT,YAAY,KACV,MAAM,sBAAsB,uBAAuB,yCAAyC,CAC7F;CAGH,IAAI,wBAAwB,MAAM,SAAS,KAAK,KAAA,GAC9C,YAAY,KACV,MACE,sBACA,kBACA,mFACD,CACF;CAGH,MAAM,YAAY,MAAM;CACxB,gBAAgB,UAAU,aAAa,+BAA+B,YAAY;CAClF,gBAAgB,UAAU,aAAa,+BAA+B,YAAY;CAClF,YAAY,UAAU,qBAAqB,uCAAuC,YAAY;CAC9F,oBAAoB,UAAU,gBAAgB,kCAAkC,YAAY;CAC5F,IAAI,UAAU,QAAQ,WAAW,KAAK,UAAU,QAAQ,SAAS,KAC/D,YAAY,KACV,MACE,sBACA,2BACA,+CACD,CACF;CAEH,YAAY,UAAU,qBAAqB,uCAAuC,YAAY;CAE9F,gBAAgB,MAAM,UAAU,kBAAkB,YAAY;CAC9D,eAAe,MAAM,YAAY,oBAAoB,YAAY;CAEjE,gBAAgB,YAAY;CAC5B,OAAO;;;;;;;;;;;;;;;AAgBT,eAAsB,mBACpB,OACA,WACA,UACA,KACmC;CACnC,MAAM,cAAc,qBAAqB,MAAM;CAE/C,MAAM,WAAW;EACf;GAAC,MAAM,UAAU;GAAa,UAAU;GAAa;GAAe;GAAc;EAClF;GAAC,MAAM,UAAU;GAAa,UAAU;GAAa;GAAe;GAAc;EAClF;GACE,MAAM,UAAU;GAChB,UAAU;GACV;GACA;GACD;EACD;GAAC,MAAM,UAAU;GAAgB,UAAU;GAAgB;GAAkB;GAAkB;EAC/F;GAAC,MAAM,UAAU;GAAS,UAAU;GAAS;GAAW;GAAU;EAClE;GACE,MAAM,UAAU;GAChB,UAAU;GACV;GACA;GACD;EACF;CACD,KAAK,MAAM,CAAC,UAAU,UAAU,UAAU,UAAU,UAClD,IAAI,aAAa,UACf,YAAY,KACV,MACE,sBACA,mBAAmB,YACnB,qCAAqC,QACtC,CACF;CAIL,IAAI,MAAM,aAAa,SAAS,OAAO,UACrC,YAAY,KACV,MACE,sBACA,kBACA,2DACD,CACF;CAEH,IAAI,kBAAkB,MAAM,WAAW,IAAI,MAAM,aAAa,SAAS,aAAa,aAClF,YAAY,KACV,MACE,sBACA,oBACA,0DACD,CACF;CAGH,YAAY,KAAK,GAAI,MAAM,aAAa,UAAU,WAAW,MAAM,UAAU,IAAI,CAAE;CACnF,gBAAgB,YAAY;CAC5B,MAAM,cAAmC,CAAC,GAAG,IAAI,IAAI,YAAY,IAAI,kBAAkB,CAAC,CAAC,CAAC,MAAM;CAChG,OAAO;EAAE,SAAS,YAAY,WAAW;EAAG;EAAa;EAAa;;AAGxE,SAAS,gBAAgB,aAA0C;CACjE,YAAY,MAAM,MAAM,UACtB,KAAK,SAAS,MAAM,OAChB,KAAK,OAAO,MAAM,OAChB,KACA,IACF,KAAK,SAAS,MAAM,OAClB,KAAK,OAAO,MAAM,OAChB,KACA,IACF,KAAK,UAAU,MAAM,UACnB,KACA,KAAK,UAAU,MAAM,UACnB,IACA,EACX"}

package/dist/test-run-check.schema.json

@@ -0,0 +1,82 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://vizejs.dev/schemas/marquette/test-run-check.schema.json",
+  "title": "Vize Test Run Check",
+  "description": "Retained, release-bound tests check for one deployment decision. This record replaces every generic test-result reference: a release decision may only satisfy its tests evidence with the exact test-run:<sha256> admission id of an independently verified run, bound to the six exact candidate facts and to the independent observer that recorded the admission. Verification is fail-closed and identical across JavaScript, Rust, Go, and JVM hosts; the shared tests/fixtures/test-run-evidence check-decision fixtures are the conformance source of truth for new host implementations.",
+  "$ref": "#/$defs/check",
+  "$defs": {
+    "identifier": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "pattern": "^[a-z0-9][a-z0-9._-]*$"
+    },
+    "digest": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    },
+    "admissionId": {
+      "description": "Exact test-run:<sha256> admission id. Summary blobs, report paths, run URLs, and green workflow labels are not admissible test evidence.",
+      "type": "string",
+      "pattern": "^test-run:[a-f0-9]{64}$"
+    },
+    "timestamp": {
+      "type": "string",
+      "format": "date-time",
+      "pattern": "^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\\.[0-9]{3}Z$"
+    },
+    "candidate": {
+      "description": "Exact release candidate the run was admitted for. Every field must equal the deciding gate's own facts; verification rejects any difference.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "application",
+        "environment",
+        "contractFingerprint",
+        "sourceRevision",
+        "release",
+        "artifactFingerprint"
+      ],
+      "properties": {
+        "application": { "$ref": "#/$defs/identifier" },
+        "environment": { "$ref": "#/$defs/identifier" },
+        "contractFingerprint": { "$ref": "#/$defs/digest" },
+        "sourceRevision": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{40,128}$"
+        },
+        "release": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256
+        },
+        "artifactFingerprint": { "$ref": "#/$defs/digest" }
+      }
+    },
+    "check": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["format", "formatVersion", "evidence", "candidate", "observer", "observedAt"],
+      "properties": {
+        "format": {
+          "description": "Serialized format marker; readers must reject any other value.",
+          "const": "vize.test-run.check"
+        },
+        "formatVersion": {
+          "description": "Serialized format version; readers must reject a higher value until they explicitly support it.",
+          "const": 1
+        },
+        "evidence": { "$ref": "#/$defs/admissionId" },
+        "candidate": { "$ref": "#/$defs/candidate" },
+        "observer": {
+          "description": "Identity of the independent observer that recorded the admission — the trusted promotion boundary, never the runner that executed the tests. Verification rejects a check whose observer equals the run's runner identity.",
+          "$ref": "#/$defs/identifier"
+        },
+        "observedAt": {
+          "description": "Millisecond-precision UTC instant the admission was observed. Verification rejects an observation earlier than the run's completed verification.",
+          "$ref": "#/$defs/timestamp"
+        }
+      }
+    }
+  }
+}

package/dist/test-run-evidence.schema.json

@@ -0,0 +1,266 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://vizejs.dev/schemas/marquette/test-run-evidence.schema.json",
+  "title": "Vize Test Run Evidence",
+  "description": "Language-neutral evidence that binds completed test executions to one application release candidate.",
+  "$ref": "#/$defs/evidence",
+  "$defs": {
+    "identifier": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "pattern": "^[a-z0-9][a-z0-9._-]*$"
+    },
+    "digest": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    },
+    "sourceRevision": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{40,128}$"
+    },
+    "contentReference": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "nonEmptyString": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256
+    },
+    "nonNegativeCount": {
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 4294967295
+    },
+    "timestamp": {
+      "type": "string",
+      "format": "date-time",
+      "pattern": "^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\\.[0-9]{3}Z$"
+    },
+    "retainedEvidence": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["reference", "fingerprint"],
+      "properties": {
+        "reference": { "$ref": "#/$defs/contentReference" },
+        "fingerprint": { "$ref": "#/$defs/digest" }
+      }
+    },
+    "artifact": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "fingerprint", "sizeBytes"],
+      "properties": {
+        "id": { "$ref": "#/$defs/identifier" },
+        "fingerprint": { "$ref": "#/$defs/digest" },
+        "sizeBytes": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 9007199254740991
+        }
+      }
+    },
+    "runner": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "identity",
+        "authenticationEvidence",
+        "isolation",
+        "invocationFingerprint",
+        "environmentEvidence",
+        "environmentFingerprint"
+      ],
+      "properties": {
+        "identity": { "$ref": "#/$defs/identifier" },
+        "authenticationEvidence": { "$ref": "#/$defs/retainedEvidence" },
+        "isolation": { "enum": ["dedicated", "ephemeral"] },
+        "invocationFingerprint": { "$ref": "#/$defs/digest" },
+        "environmentEvidence": { "$ref": "#/$defs/retainedEvidence" },
+        "environmentFingerprint": { "$ref": "#/$defs/digest" }
+      }
+    },
+    "selection": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["targetIds", "suiteIds"],
+      "properties": {
+        "targetIds": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 32,
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/identifier" }
+        },
+        "suiteIds": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 512,
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/identifier" }
+        }
+      }
+    },
+    "targetExecution": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "kind", "environment"],
+      "properties": {
+        "id": { "$ref": "#/$defs/identifier" },
+        "kind": { "enum": ["web", "native", "desktop", "terminal", "server"] },
+        "environment": { "$ref": "#/$defs/identifier" }
+      }
+    },
+    "suiteExecution": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "targetId",
+        "kind",
+        "shardIndex",
+        "shardCount",
+        "outcome",
+        "passed",
+        "failed",
+        "skipped",
+        "retries",
+        "durationMs",
+        "invocationFingerprint",
+        "report",
+        "log"
+      ],
+      "properties": {
+        "id": { "$ref": "#/$defs/identifier" },
+        "targetId": { "$ref": "#/$defs/identifier" },
+        "kind": {
+          "enum": [
+            "unit",
+            "integration",
+            "contract",
+            "end-to-end",
+            "accessibility",
+            "visual",
+            "performance",
+            "resilience",
+            "installation",
+            "upgrade",
+            "migration"
+          ]
+        },
+        "shardIndex": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 1024
+        },
+        "shardCount": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 1024
+        },
+        "outcome": { "enum": ["passed", "failed", "cancelled"] },
+        "passed": { "$ref": "#/$defs/nonNegativeCount" },
+        "failed": { "$ref": "#/$defs/nonNegativeCount" },
+        "skipped": { "$ref": "#/$defs/nonNegativeCount" },
+        "retries": { "$ref": "#/$defs/nonNegativeCount" },
+        "durationMs": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 9007199254740991
+        },
+        "invocationFingerprint": { "$ref": "#/$defs/digest" },
+        "report": { "$ref": "#/$defs/retainedEvidence" },
+        "log": { "$ref": "#/$defs/retainedEvidence" }
+      }
+    },
+    "verification": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "verifier",
+        "completedAt",
+        "outcome",
+        "targetCount",
+        "suiteCount",
+        "passed",
+        "failed",
+        "skipped",
+        "retries",
+        "evidence"
+      ],
+      "properties": {
+        "verifier": { "$ref": "#/$defs/identifier" },
+        "completedAt": { "$ref": "#/$defs/timestamp" },
+        "outcome": { "enum": ["accepted", "rejected"] },
+        "targetCount": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 32
+        },
+        "suiteCount": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 512
+        },
+        "passed": { "$ref": "#/$defs/nonNegativeCount" },
+        "failed": { "$ref": "#/$defs/nonNegativeCount" },
+        "skipped": { "$ref": "#/$defs/nonNegativeCount" },
+        "retries": { "$ref": "#/$defs/nonNegativeCount" },
+        "evidence": { "$ref": "#/$defs/retainedEvidence" }
+      }
+    },
+    "evidence": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "format",
+        "formatVersion",
+        "id",
+        "application",
+        "environment",
+        "contractFingerprint",
+        "sourceRevision",
+        "release",
+        "artifact",
+        "startedAt",
+        "completedAt",
+        "validUntil",
+        "runner",
+        "selection",
+        "targets",
+        "suites",
+        "verification"
+      ],
+      "properties": {
+        "format": { "const": "vize.test-run.evidence" },
+        "formatVersion": { "const": 1, "default": 1 },
+        "id": { "$ref": "#/$defs/identifier" },
+        "application": { "$ref": "#/$defs/identifier" },
+        "environment": { "$ref": "#/$defs/identifier" },
+        "contractFingerprint": { "$ref": "#/$defs/digest" },
+        "sourceRevision": { "$ref": "#/$defs/sourceRevision" },
+        "release": { "$ref": "#/$defs/nonEmptyString" },
+        "artifact": { "$ref": "#/$defs/artifact" },
+        "startedAt": { "$ref": "#/$defs/timestamp" },
+        "completedAt": { "$ref": "#/$defs/timestamp" },
+        "validUntil": { "$ref": "#/$defs/timestamp" },
+        "runner": { "$ref": "#/$defs/runner" },
+        "selection": { "$ref": "#/$defs/selection" },
+        "targets": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 32,
+          "items": { "$ref": "#/$defs/targetExecution" }
+        },
+        "suites": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 512,
+          "items": { "$ref": "#/$defs/suiteExecution" }
+        },
+        "verification": { "$ref": "#/$defs/verification" }
+      }
+    }
+  }
+}