eval-quality 0.1.0 → 0.2.0

package/dist/core/schemas/probe-qualification.d.ts

@@ -0,0 +1,168 @@
+/** AD-9's five qualification routes, one per way ground truth is earned. */
+import { z } from 'zod';
+/**
+ * AD-9 spells a route for each of the five ways a probe earns ground truth. The
+ * order is AD-9's own: historical fix boundary, controlled mutation,
+ * gameability demonstration, canary, clean control.
+ */
+export declare const QUALIFICATION_ROUTES: readonly ['historical', 'controlled-mutation', 'gameability', 'canary', 'clean-control'];
+export type QualificationRouteValue = (typeof QUALIFICATION_ROUTES)[number];
+export declare const QualificationRoute: z.ZodEnum<{
+    canary: "canary";
+    "clean-control": "clean-control";
+    "controlled-mutation": "controlled-mutation";
+    gameability: "gameability";
+    historical: "historical";
+}>;
+/**
+ * AD-9's qualification record, as a tagged union on `route`.
+ *
+ * A union rather than one wide object with nullable fields: the five routes
+ * demand disjoint evidence, and a flat shape would make every route's evidence
+ * optional on every other route, which is the shape AD-9 was written against:
+ * "a mined fix commit being trusted when its own test already passed at the
+ * parent commit". Each branch names what its route must record and nothing
+ * else.
+ *
+ * Required on every probe, canaries included. AD-9 spells a route for all five
+ * kinds and closes with "an unqualified probe cannot enter a sealed set" with
+ * no exception, so exempting the canary would leave the route AD-9 writes for
+ * it with nothing to write it in. The exemption AD-9 does grant attaches to the
+ * defect signature, which is AD-40's field.
+ *
+ * Which route a probe may take is fixed by its class and its `expectedClean`
+ * flag, and that pairing is enforced by the corpus qualification gate rather
+ * than by a schema refinement: all combinations parse here, so an incompatible
+ * pairing stays a reason code carrying an artifact path rather than an
+ * anonymous parse failure.
+ *
+ * Inlined rather than given a `.meta({ id })`. Two `$defs` sharing an internal
+ * path are indistinguishable from a schema path alone, and every branch here
+ * carries an `ArtifactReference`, so a `$defs` entry would share def-relative
+ * suffixes with `Expression` and `ArtifactReference` and make the published
+ * keyword walk's stated no-collision premise false.
+ */
+export declare const ProbeQualification: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    route: z.ZodLiteral<"historical">;
+    failBeforeEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        storage: z.ZodLiteral<"public">;
+        path: z.ZodString;
+        privateRef: z.ZodNull;
+        digest: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        storage: z.ZodLiteral<"private">;
+        path: z.ZodNull;
+        privateRef: z.ZodString;
+        digest: z.ZodString;
+    }, z.core.$strict>], "storage">;
+    passAfterEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        storage: z.ZodLiteral<"public">;
+        path: z.ZodString;
+        privateRef: z.ZodNull;
+        digest: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        storage: z.ZodLiteral<"private">;
+        path: z.ZodNull;
+        privateRef: z.ZodString;
+        digest: z.ZodString;
+    }, z.core.$strict>], "storage">;
+    fixCommitDigest: z.ZodString;
+    oracleStableAcrossRevisions: z.ZodBoolean;
+}, z.core.$strict>, z.ZodObject<{
+    route: z.ZodLiteral<"controlled-mutation">;
+    mutationSource: z.ZodString;
+    mutationOperator: z.ZodString;
+    targetArtifact: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        storage: z.ZodLiteral<"public">;
+        path: z.ZodString;
+        privateRef: z.ZodNull;
+        digest: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        storage: z.ZodLiteral<"private">;
+        path: z.ZodNull;
+        privateRef: z.ZodString;
+        digest: z.ZodString;
+    }, z.core.$strict>], "storage">;
+    expectedObservableFailure: z.ZodString;
+    baselinePassEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        storage: z.ZodLiteral<"public">;
+        path: z.ZodString;
+        privateRef: z.ZodNull;
+        digest: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        storage: z.ZodLiteral<"private">;
+        path: z.ZodNull;
+        privateRef: z.ZodString;
+        digest: z.ZodString;
+    }, z.core.$strict>], "storage">;
+    mutatedFailEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        storage: z.ZodLiteral<"public">;
+        path: z.ZodString;
+        privateRef: z.ZodNull;
+        digest: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        storage: z.ZodLiteral<"private">;
+        path: z.ZodNull;
+        privateRef: z.ZodString;
+        digest: z.ZodString;
+    }, z.core.$strict>], "storage">;
+    rollbackVerified: z.ZodBoolean;
+}, z.core.$strict>, z.ZodObject<{
+    route: z.ZodLiteral<"gameability">;
+    degenerateResponse: z.ZodString;
+    naiveOracleSatisfiedEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        storage: z.ZodLiteral<"public">;
+        path: z.ZodString;
+        privateRef: z.ZodNull;
+        digest: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        storage: z.ZodLiteral<"private">;
+        path: z.ZodNull;
+        privateRef: z.ZodString;
+        digest: z.ZodString;
+    }, z.core.$strict>], "storage">;
+    disciplinedOracleRejectedEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        storage: z.ZodLiteral<"public">;
+        path: z.ZodString;
+        privateRef: z.ZodNull;
+        digest: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        storage: z.ZodLiteral<"private">;
+        path: z.ZodNull;
+        privateRef: z.ZodString;
+        digest: z.ZodString;
+    }, z.core.$strict>], "storage">;
+}, z.core.$strict>, z.ZodObject<{
+    route: z.ZodLiteral<"canary">;
+    indicts: z.ZodEnum<{
+        corpus: "corpus";
+        fixture: "fixture";
+    }>;
+    nonDetectionEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        storage: z.ZodLiteral<"public">;
+        path: z.ZodString;
+        privateRef: z.ZodNull;
+        digest: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        storage: z.ZodLiteral<"private">;
+        path: z.ZodNull;
+        privateRef: z.ZodString;
+        digest: z.ZodString;
+    }, z.core.$strict>], "storage">;
+}, z.core.$strict>, z.ZodObject<{
+    route: z.ZodLiteral<"clean-control">;
+    baselinePassEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        storage: z.ZodLiteral<"public">;
+        path: z.ZodString;
+        privateRef: z.ZodNull;
+        digest: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        storage: z.ZodLiteral<"private">;
+        path: z.ZodNull;
+        privateRef: z.ZodString;
+        digest: z.ZodString;
+    }, z.core.$strict>], "storage">;
+    revisionCommitDigest: z.ZodString;
+    noKnownDefectStatement: z.ZodString;
+}, z.core.$strict>], "route">;
+export type ProbeQualification = z.infer<typeof ProbeQualification>;

package/dist/core/schemas/probe-qualification.js

@@ -0,0 +1,106 @@
+/** AD-9's five qualification routes, one per way ground truth is earned. */
+import { z } from 'zod';
+import { ArtifactReference } from './artifact-reference.js';
+import { Digest } from './primitives.js';
+/**
+ * AD-9 spells a route for each of the five ways a probe earns ground truth. The
+ * order is AD-9's own: historical fix boundary, controlled mutation,
+ * gameability demonstration, canary, clean control.
+ */
+export const QUALIFICATION_ROUTES = [
+    'historical',
+    'controlled-mutation',
+    'gameability',
+    'canary',
+    'clean-control',
+];
+export const QualificationRoute = z.enum(QUALIFICATION_ROUTES);
+/**
+ * AD-9's qualification record, as a tagged union on `route`.
+ *
+ * A union rather than one wide object with nullable fields: the five routes
+ * demand disjoint evidence, and a flat shape would make every route's evidence
+ * optional on every other route, which is the shape AD-9 was written against:
+ * "a mined fix commit being trusted when its own test already passed at the
+ * parent commit". Each branch names what its route must record and nothing
+ * else.
+ *
+ * Required on every probe, canaries included. AD-9 spells a route for all five
+ * kinds and closes with "an unqualified probe cannot enter a sealed set" with
+ * no exception, so exempting the canary would leave the route AD-9 writes for
+ * it with nothing to write it in. The exemption AD-9 does grant attaches to the
+ * defect signature, which is AD-40's field.
+ *
+ * Which route a probe may take is fixed by its class and its `expectedClean`
+ * flag, and that pairing is enforced by the corpus qualification gate rather
+ * than by a schema refinement: all combinations parse here, so an incompatible
+ * pairing stays a reason code carrying an artifact path rather than an
+ * anonymous parse failure.
+ *
+ * Inlined rather than given a `.meta({ id })`. Two `$defs` sharing an internal
+ * path are indistinguishable from a schema path alone, and every branch here
+ * carries an `ArtifactReference`, so a `$defs` entry would share def-relative
+ * suffixes with `Expression` and `ArtifactReference` and make the published
+ * keyword walk's stated no-collision premise false.
+ */
+export const ProbeQualification = z.discriminatedUnion('route', [
+    z
+        .strictObject({
+        route: z.literal('historical'),
+        failBeforeEvidence: ArtifactReference.describe('The recorded failure at the parent revision. AD-9 exists because 2 of 18 mined fix commits had a test that already passed at the parent, so this is the half that cannot be assumed.'),
+        passAfterEvidence: ArtifactReference,
+        fixCommitDigest: Digest.describe('The causally isolated fix boundary AD-9 requires the two evidence records to straddle.'),
+        oracleStableAcrossRevisions: z
+            .boolean()
+            .describe("AD-9 requires the oracle to be stable across both revisions. `false` parses and fails the gate: a route that cannot record its own unmet precondition cannot be audited, and the schema is not where AD-9's admission decision is made."),
+    })
+        .describe('A historical probe: a defect mined from a real fix boundary, seeded by reverting it.'),
+    z
+        .strictObject({
+        route: z.literal('controlled-mutation'),
+        mutationSource: z
+            .string()
+            .min(1)
+            .describe("Where the mutation came from, in the corpus author's own terms. An opaque caller string, unrelated to `Defect.source`'s two-member enum, which records whether the defect is natural or introduced."),
+        mutationOperator: z.string().min(1),
+        targetArtifact: ArtifactReference,
+        expectedObservableFailure: z.string().min(1),
+        baselinePassEvidence: ArtifactReference,
+        mutatedFailEvidence: ArtifactReference,
+        rollbackVerified: z
+            .boolean()
+            .describe("AD-9's verified rollback or cleanup. `false` parses and fails the gate, for the same reason `oracleStableAcrossRevisions` does."),
+    })
+        .describe('A controlled mutation: a defect introduced by a named operator against a named artifact.'),
+    z
+        .strictObject({
+        route: z.literal('gameability'),
+        degenerateResponse: z
+            .string()
+            .min(1)
+            .describe('The compliant-looking degenerate response, described rather than embedded: AD-8 forbids sealed-case content from entering any artifact.'),
+        naiveOracleSatisfiedEvidence: ArtifactReference,
+        disciplinedOracleRejectedEvidence: ArtifactReference,
+    })
+        .describe('A gameability probe: the demonstration that a degenerate response satisfies a naive oracle and is rejected by a disciplined one.'),
+    z
+        .strictObject({
+        route: z.literal('canary'),
+        indicts: z
+            .enum(['corpus', 'fixture'])
+            .describe("AD-9's canary qualifies by demonstrating that non-detection indicts one of these two rather than the contract. Which one it indicts is the demonstration's own result and is recorded rather than left to the reader."),
+        nonDetectionEvidence: ArtifactReference,
+    })
+        .describe('A canary: a probe whose non-detection is evidence about the instrument, never about the contract.'),
+    z
+        .strictObject({
+        route: z.literal('clean-control'),
+        baselinePassEvidence: ArtifactReference,
+        revisionCommitDigest: Digest,
+        noKnownDefectStatement: z
+            .string()
+            .min(1)
+            .describe('AD-9 qualifies a clean control at "a revision with no known defect in the probed interface". No field can prove an absence, so the statement is recorded as an attestation under AD-32 and read as trust rather than as a computed fact.'),
+    })
+        .describe('A known-clean control: recorded baseline-pass evidence at a revision with no known defect in the probed interface.'),
+]);

package/dist/core/schemas/probe.d.ts

@@ -82,6 +82,129 @@ export declare const Probe: z.ZodDiscriminatedUnion<[z.ZodObject<{
     artifactDigest: z.ZodString;
     commitDigest: z.ZodString;
     rationale: z.ZodString;
+    qualification: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        route: z.ZodLiteral<"historical">;
+        failBeforeEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+        passAfterEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+        fixCommitDigest: z.ZodString;
+        oracleStableAcrossRevisions: z.ZodBoolean;
+    }, z.core.$strict>, z.ZodObject<{
+        route: z.ZodLiteral<"controlled-mutation">;
+        mutationSource: z.ZodString;
+        mutationOperator: z.ZodString;
+        targetArtifact: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+        expectedObservableFailure: z.ZodString;
+        baselinePassEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+        mutatedFailEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+        rollbackVerified: z.ZodBoolean;
+    }, z.core.$strict>, z.ZodObject<{
+        route: z.ZodLiteral<"gameability">;
+        degenerateResponse: z.ZodString;
+        naiveOracleSatisfiedEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+        disciplinedOracleRejectedEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+    }, z.core.$strict>, z.ZodObject<{
+        route: z.ZodLiteral<"canary">;
+        indicts: z.ZodEnum<{
+            corpus: "corpus";
+            fixture: "fixture";
+        }>;
+        nonDetectionEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+    }, z.core.$strict>, z.ZodObject<{
+        route: z.ZodLiteral<"clean-control">;
+        baselinePassEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+        revisionCommitDigest: z.ZodString;
+        noKnownDefectStatement: z.ZodString;
+    }, z.core.$strict>], "route">;
     expectedClean: z.ZodLiteral<true>;
     defects: z.ZodArray<z.ZodObject<{
         defectId: z.ZodString;
@@ -142,6 +265,129 @@ export declare const Probe: z.ZodDiscriminatedUnion<[z.ZodObject<{
     artifactDigest: z.ZodString;
     commitDigest: z.ZodString;
     rationale: z.ZodString;
+    qualification: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        route: z.ZodLiteral<"historical">;
+        failBeforeEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+        passAfterEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+        fixCommitDigest: z.ZodString;
+        oracleStableAcrossRevisions: z.ZodBoolean;
+    }, z.core.$strict>, z.ZodObject<{
+        route: z.ZodLiteral<"controlled-mutation">;
+        mutationSource: z.ZodString;
+        mutationOperator: z.ZodString;
+        targetArtifact: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+        expectedObservableFailure: z.ZodString;
+        baselinePassEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+        mutatedFailEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+        rollbackVerified: z.ZodBoolean;
+    }, z.core.$strict>, z.ZodObject<{
+        route: z.ZodLiteral<"gameability">;
+        degenerateResponse: z.ZodString;
+        naiveOracleSatisfiedEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+        disciplinedOracleRejectedEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+    }, z.core.$strict>, z.ZodObject<{
+        route: z.ZodLiteral<"canary">;
+        indicts: z.ZodEnum<{
+            corpus: "corpus";
+            fixture: "fixture";
+        }>;
+        nonDetectionEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+    }, z.core.$strict>, z.ZodObject<{
+        route: z.ZodLiteral<"clean-control">;
+        baselinePassEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+        revisionCommitDigest: z.ZodString;
+        noKnownDefectStatement: z.ZodString;
+    }, z.core.$strict>], "route">;
     expectedClean: z.ZodLiteral<false>;
     defects: z.ZodArray<z.ZodObject<{
         defectId: z.ZodString;
@@ -185,5 +431,71 @@ export declare const Probe: z.ZodDiscriminatedUnion<[z.ZodObject<{
             relation: z.ZodType<import("./expression.ts").Expression, unknown, z.core.$ZodTypeInternals<import("./expression.ts").Expression, unknown>>;
         }, z.core.$strict>>;
     }, z.core.$strict>>;
+    defectSignature: z.ZodNullable<z.ZodObject<{
+        interfaceKind: z.ZodEnum<{
+            api: "api";
+            cli: "cli";
+            mcp: "mcp";
+            web: "web";
+        }>;
+        method: z.ZodEnum<{
+            DELETE: "DELETE";
+            GET: "GET";
+            HEAD: "HEAD";
+            OPTIONS: "OPTIONS";
+            PATCH: "PATCH";
+            POST: "POST";
+            PUT: "PUT";
+        }>;
+        pathTemplate: z.ZodString;
+        observableChannel: z.ZodEnum<{
+            "call-inputs": "call-inputs";
+            "exit-code": "exit-code";
+            "response-body": "response-body";
+            "response-headers": "response-headers";
+            "response-status": "response-status";
+            stderr: "stderr";
+            stdout: "stdout";
+        }>;
+        condition: z.ZodObject<{
+            selector: z.ZodObject<{
+                inputBinding: z.ZodObject<{
+                    path: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
+                    query: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
+                    header: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
+                    body: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
+                }, z.core.$strict>;
+            }, z.core.$strict>;
+            predicate: z.ZodType<import("./expression.ts").Expression, unknown, z.core.$ZodTypeInternals<import("./expression.ts").Expression, unknown>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
 }, z.core.$strict>], "expectedClean">;
 export type Probe = z.infer<typeof Probe>;

package/dist/core/schemas/probe.js

@@ -1,9 +1,11 @@
 /** a corpus probe: its class, its control status, and the defects it seeds. */
 import { z } from 'zod';
 import { ArtifactReference } from './artifact-reference.js';
+import { DefectSignature } from './defect-signature.js';
 import { Severity } from './eval-contract.js';
 import { lineageFields } from './lineage.js';
 import { BehaviorId, DefectId, Digest, ProbeId } from './primitives.js';
+import { ProbeQualification } from './probe-qualification.js';
 import { ManifestationWitness } from './sensitivity-witness.js';
 /**
  * AD-9's closed four, one per probe, in scope because AD-7's strength vector
@@ -44,6 +46,7 @@ const probeCommonFields = {
     artifactDigest: Digest,
     commitDigest: Digest,
     rationale: z.string().min(1),
+    qualification: ProbeQualification.describe('AD-9\'s qualification record: which of the five routes earned this probe its ground truth, and the evidence that route demands. Required on every branch and on every class, canaries included, because AD-9 closes with "an unqualified probe cannot enter a sealed set" and spells a route for all five kinds. That the route is compatible with this probe\'s class and `expectedClean` flag is a cross-field rule the export cannot carry; the corpus qualification gate enforces it and returns a reason code. Required, not optional, which with `defectSignature` below makes the probe\'s `schemaVersion` 1 -> 2 BREAKING bump under AD-11, whose rule is that "adding an optional field is a `schemaVersion` bump recorded in the field\'s own description; removing or retyping is breaking". This field is on both branches, so it alone is what stops every version-1 probe from parsing.'),
 };
 /**
  * The prior art's `expectedClean` conditional, re-expressed as a discriminated
@@ -73,10 +76,11 @@ export const Probe = z
         defects: z
             .array(Defect)
             .describe('No minimum. AD-9 states none, and a minimum would make a canary unrepresentable, since a canary indicts the fixture rather than seeding a defect.'),
+        defectSignature: DefectSignature.nullable().describe("AD-40's machine-readable defect signature, declared on this branch alone: a clean control seeds nothing, so its branch has no signature to carry. Nullable rather than plain, because the one class that legitimately carries none is `canary`, and a union-level refinement expressing that is dropped from the published export, which would leave Zod rejecting a probe ajv accepts. The corpus qualification gate is the enforcement point and the constraint ledger records the gap; the shipped precedent is `compile/interface-inventory.ts`, which put the principal check in the compiler for the same reason. The other half of the probe's `schemaVersion` 1 -> 2 BREAKING bump under AD-11, recorded here as that rule requires: the key is required on this branch, and `null` is the legal value a canary carries."),
     })
-        .describe('A probe that is not a known-clean control.'),
+        .describe('A probe that is not a known-clean control. The one branch AD-40 gives a defect signature.'),
 ])
     .meta({
     id: 'Probe',
-    description: "One corpus probe. Succeeds the prior-art `h0-ground-truth` schema per AD-24, carrying its system identifier, implementation digest, `expectedClean` flag, seeded defects, and rationale, and adding AD-9's probe class and AD-9's per-probe artifact and commit digests. Divergences: `implementationSha` becomes `implementationDigest`, `taskId` does not survive because the probe pins what it describes by digest, and `expectedGate` does not survive because AD-40 makes detection a signature match rather than a verdict comparison and AD-7 keeps comparisons inside the dominance vector, so carrying an expected gate would invite a comparison the architecture forbids. Two constructions are deliberately absent: AD-9's per-class QUALIFICATION record, whose five prose routes name no fields and whose acceptance criteria of record do not command it, and AD-40's machine-readable DEFECT SIGNATURE, which Owed item 7 records as having no fixture to land in because this repository contains no probe at all. Both arrive as additive `schemaVersion` bumps under AD-11 once a corpus exists to carry them. The cost is named rather than hidden: AD-9's \"an unqualified probe cannot enter a sealed set\" is enforced by nothing in v0: not this schema, not an AD-5 code, and not an AD-21 rung.",
+    description: "One corpus probe. Succeeds the prior-art `h0-ground-truth` schema per AD-24, carrying its system identifier, implementation digest, `expectedClean` flag, seeded defects, and rationale, and adding AD-9's probe class and AD-9's per-probe artifact and commit digests. Divergences: `implementationSha` becomes `implementationDigest`, `taskId` does not survive because the probe pins what it describes by digest, and `expectedGate` does not survive because AD-40 makes detection a signature match rather than a verdict comparison and AD-7 keeps comparisons inside the dominance vector, so carrying an expected gate would invite a comparison the architecture forbids. Two constructions landed here together under one BREAKING `schemaVersion` bump: AD-9's per-class QUALIFICATION record, as a five-route tagged union required on every branch, and AD-40's machine-readable DEFECT SIGNATURE on the `expectedClean: false` branch, carrying the interface kind, the home operation as a method and a path template, the observable channel, and the discriminating condition. Both are required rather than optional, which is what makes the bump breaking under AD-11: every corpus written against version 1 fails to parse. What the schema still does not decide is stated rather than hidden. AD-9's \"an unqualified probe cannot enter a sealed set\" is a corpus-construction invariant enforced by the qualification gate in `core/score/qualification.ts`, not by this schema: all eight class-and-`expectedClean` pairings parse, a route incompatible with the pair parses, and a signature-less non-canary parses, each so the gate can return a reason code carrying an artifact path instead of an anonymous parse failure. The constraint ledger carries both gaps.",
 });

package/dist/core/schemas/scoring-policy.d.ts

@@ -20,6 +20,7 @@ export declare const ScoringPolicy: z.ZodObject<{
         material: "material";
     }>;
     confidenceThreshold: z.ZodNumber;
+    catchThreshold: z.ZodNumber;
     minimumTrialCount: z.ZodInt;
     reExecutionCap: z.ZodInt;
     remediationCap: z.ZodInt;