eval-quality 0.1.0 → 0.2.0

package/dist/core/score/bindings.js

@@ -0,0 +1,297 @@
+/**
+ * Owed item 3's score-time half: resolving a captured pointer to the scalar an
+ * earlier step's observation carried, and filtering a step's matched
+ * observations against its own selection predicate before reporting a
+ * cardinality verdict.
+ *
+ * An AD-39 selector is an input binding and an optional temporal clause, so
+ * `selectWithBindings` resolves both halves. `selectObservations` matches on
+ * `operationId` alone and is untouched, so its permutation guarantee and its
+ * tests stand; this wraps it.
+ *
+ * Pure and total, like the module it wraps: nothing throws on unresolvable
+ * evidence, and no AD-6 outcome state is assigned.
+ */
+import { capturedBindings } from '../compile/bindings.js';
+import { channelRoot, walkTail } from '../evaluate/evidence-resolution.js';
+import { ABSENT } from '../evaluate/resolved-value.js';
+import { TRANSPORT_CHANNELS, } from '../schemas/pointer.js';
+import { parseEvidenceTarget } from '../seal/plan-index.js';
+import { bindingOrder } from './binding-order.js';
+import { selectObservations } from './selection.js';
+const ABSENT_RESOLUTION = { status: 'absent' };
+/**
+ * The key one captured binding occupies in the resolution map. Keyed by
+ * binding site rather than by pointer: one step can carry several captured
+ * bindings, and two of them may name the same pointer in different channels.
+ * JSON-encoded rather than delimiter-joined, since a parameter key is arbitrary
+ * caller-supplied text and could contain any separator.
+ */
+export function bindingSiteKey(stepId, transportChannel, key) {
+    return JSON.stringify([stepId, transportChannel, key]);
+}
+/**
+ * Resolves one captured pointer against the record.
+ *
+ * The referenced step is selected through `selectWithBindings`, so its own
+ * selection predicate applies before a value is read off it. Selecting it with
+ * `selectObservations` alone would match on `operationId` and leave a step that
+ * only its own bindings separate reporting the named ambiguity, which would
+ * make a capture from either half of a literal-bound collision pair resolve
+ * nothing at all. `resolved` carries the referenced step's own captured values,
+ * already filled by the tier below it, which is what makes the tiering
+ * load-bearing.
+ *
+ * The three dispositions already settled hold unchanged over the filtered
+ * result: one match binds, several under a declared `any` binds the lowest
+ * `sequence`, and several under `exactly-one`/`at-most-one` is the named
+ * ambiguity, returned as data with no value resolved.
+ *
+ * A pointer whose step the plan does not declare, or whose referenced step
+ * matched nothing, resolves `absent`.
+ *
+ * `resolved` as a status means an observation was selected, which is a
+ * different fact from the pointer finding a value in it: a tail that walks off
+ * the observed body comes back `resolved` carrying `ABSENT`, with the source
+ * observation and its `sequence` intact. That is why `CapturedResolution.value`
+ * is `ResolvedValue`. AD-26 makes absent an observation rather than an error,
+ * and `deepEquals` is false against it, so the referencing step still selects
+ * `none`; keeping the source observation means the ordering floor stays
+ * computable either way.
+ */
+export function resolveCapturedValue(pointer, index, observations, resolved) {
+    const target = parseEvidenceTarget(pointer);
+    const step = index.stepOf(target.stepId);
+    if (step === undefined)
+        return ABSENT_RESOLUTION;
+    const selected = selectOne(step, observations, index, resolved, new Set());
+    if (selected === null)
+        return ABSENT_RESOLUTION;
+    if (selected.ambiguous !== null) {
+        return { status: 'ambiguous', matchedObservationIds: selected.ambiguous };
+    }
+    const { source } = selected;
+    if (source === null)
+        return ABSENT_RESOLUTION;
+    return {
+        status: 'resolved',
+        value: walkTail(channelRoot(source, target), target.tail),
+        observationId: source.observationId,
+        sequence: source.sequence,
+    };
+}
+function selectOne(step, observations, index, resolved, guard) {
+    if (guard.has(step.stepId))
+        return null;
+    const selection = selectFiltered(step, observations, index, resolved, new Set([...guard, step.stepId]));
+    const [first] = selection.matchedObservationIds;
+    if (selection.result === 'none' || first === undefined) {
+        return { source: null, ambiguous: null };
+    }
+    if (selection.result === 'several' && step.cardinality !== 'any') {
+        return { source: null, ambiguous: selection.matchedObservationIds };
+    }
+    // Ascending-`sequence` order already holds the lowest-sequence match first,
+    // which is `resolveTemporalAnchor`'s own rule for a declared `any`.
+    const source = observations.find((observation) => observation.observationId === first);
+    return { source: source ?? null, ambiguous: null };
+}
+/**
+ * Every captured binding in the plan, resolved in `bindingOrder`'s tiers and
+ * keyed by binding site. Walking the tiers in order is what lets a step's
+ * captured values be resolved against a referenced step whose own captures are
+ * already in the map. Steps `bindingOrder` reports cyclic are left out, so
+ * their bindings resolve as unlisted and filter every candidate away.
+ */
+export function resolveCapturedBindings(interactionPlan, index, observations) {
+    const resolved = new Map();
+    for (const tier of bindingOrder(interactionPlan).tiers) {
+        for (const stepId of tier) {
+            const step = index.stepOf(stepId);
+            if (step === undefined)
+                continue;
+            for (const capture of capturedBindings(step)) {
+                resolved.set(bindingSiteKey(stepId, capture.transportChannel, capture.key), resolveCapturedValue(capture.pointer, index, observations, resolved));
+            }
+        }
+    }
+    return resolved;
+}
+// AD-4 separates `equality` from `deep-equality`; a literal binding is
+// `JsonValue` and admits objects and arrays, so this is the deep one. Spelled
+// here rather than reached for in `core/evaluate`'s operator set: that set
+// resolves operands inside an oracle tree, and a binding filter is not an
+// oracle.
+// Exported so the AD-40 probe-side selector follows these rules rather than
+// re-deriving them: two copies of a deep comparison that drift flip a witness
+// match silently.
+export function deepEquals(a, b) {
+    if (a === ABSENT || b === ABSENT)
+        return false;
+    if (a === b)
+        return true;
+    if (Array.isArray(a) || Array.isArray(b)) {
+        if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) {
+            return false;
+        }
+        return a.every((element, position) => deepEquals(element, b[position]));
+    }
+    if (a === null || b === null)
+        return false;
+    if (typeof a !== 'object' || typeof b !== 'object')
+        return false;
+    const keys = Object.keys(a);
+    if (keys.length !== Object.keys(b).length)
+        return false;
+    return keys.every((key) => Object.hasOwn(b, key) &&
+        deepEquals(a[key], b[key]));
+}
+export function jsonTypeOf(value) {
+    if (value === null)
+        return 'null';
+    if (Array.isArray(value))
+        return 'array';
+    return typeof value;
+}
+/**
+ * The highest `sequence` any of this step's captured bindings resolved from, or
+ * `null` when one of them resolved nothing at all. A candidate must come
+ * strictly after every captured value, so the highest is the binding bound.
+ */
+function capturedFloor(step, resolved) {
+    let floor = null;
+    for (const capture of capturedBindings(step)) {
+        const resolution = resolved.get(bindingSiteKey(step.stepId, capture.transportChannel, capture.key));
+        if (resolution === undefined || resolution.status !== 'resolved')
+            return null;
+        floor =
+            floor === null
+                ? resolution.sequence
+                : Math.max(floor, resolution.sequence);
+    }
+    return floor;
+}
+/**
+ * Whether one observation's recorded call inputs satisfy one step's declared
+ * bindings. Four rules over the four tagged forms, and one shared
+ * precondition: every channel of `observation.callInputs` is nullable, and a
+ * `null` channel means the key is not present, so a binding into one filters
+ * the candidate out. That is the same fail-closed disposition as an absent
+ * captured value, and AD-26's.
+ *
+ * - `{ literal: v }`: the observed value deep-equals `v`, key order
+ *   irrelevant.
+ * - `{ captured: p }`: the observed value deep-equals the resolved captured
+ *   value. The ordering half is `capturedFloor`'s, applied before this runs.
+ * - `{ matcher: 'any' }` and `{ principal }`: the key is present, and nothing
+ *   more. Neither declares a value the contract knows: a principal's value is
+ *   provisioned by the harness at runtime, which is the whole reason the
+ *   binding exists. The consequence is that two steps differing only by which
+ *   principal they bind cannot be separated here, because no field of a sealed
+ *   run record says which principal the harness used.
+ * - `{ matcher: 'type-violating' }`: the observed value's JSON type differs
+ *   from the operation's declared type for that key. A key whose declared type
+ *   is absent or `null` fails closed: an indeterminate type cannot prove a
+ *   violation.
+ */
+function satisfiesBindings(step, observation, index, resolved) {
+    const operation = index.operationOf(step.operationId);
+    for (const channel of TRANSPORT_CHANNELS) {
+        const binding = step.inputBinding[channel];
+        if (binding === null)
+            continue;
+        const observed = observation.callInputs[channel];
+        if (observed === null)
+            return false;
+        for (const key of Object.keys(binding)) {
+            const value = binding[key];
+            if (value === undefined)
+                continue;
+            if (!Object.hasOwn(observed, key))
+                return false;
+            const actual = observed[key];
+            if ('literal' in value) {
+                if (!deepEquals(actual, value.literal))
+                    return false;
+                continue;
+            }
+            if ('captured' in value) {
+                const resolution = resolved.get(bindingSiteKey(step.stepId, channel, key));
+                if (resolution === undefined || resolution.status !== 'resolved') {
+                    return false;
+                }
+                if (!deepEquals(actual, resolution.value))
+                    return false;
+                continue;
+            }
+            if ('principal' in value)
+                continue;
+            if (value.matcher === 'any')
+                continue;
+            const declared = operation?.requestShape[channel].types[key];
+            if (declared === undefined || declared === null)
+                return false;
+            if (jsonTypeOf(actual) === declared)
+                return false;
+        }
+    }
+    return true;
+}
+function temporalFloor(step, index, observations, resolved, guard) {
+    if (step.after === null)
+        return { kind: 'none' };
+    const anchorStep = index.stepOf(step.after);
+    if (anchorStep === undefined)
+        return { kind: 'none' };
+    const anchor = selectOne(anchorStep, observations, index, resolved, guard);
+    if (anchor === null || anchor.source === null)
+        return { kind: 'unsatisfiable' };
+    return { kind: 'after', sequence: anchor.source.sequence };
+}
+/**
+ * `selectObservations`, then the step's own selection predicate as a filter
+ * over the matches, then the cardinality verdict over what survived.
+ *
+ * The order is temporal clause, then capture ordering, then the binding
+ * filters. Ordering is enforced at score time as well as at compile time: the
+ * persistence read-back this exists for is exactly a claim about order, and a
+ * record whose `GET` sits at `sequence` 2 and whose `POST` sits at `sequence` 9
+ * would otherwise satisfy the binding and pass an oracle proving the opposite.
+ *
+ * `resolved` is the map `resolveCapturedBindings` fills from `bindingOrder`'s
+ * tiers, keyed by binding site. An unlisted or unresolved site filters every
+ * candidate out, so a caller that skipped a tier gets `none` rather than a
+ * silently wrong match.
+ *
+ * A filter over zero bindings and no clause separates nothing, so two steps
+ * sharing an operation and declaring neither both still return `several`: the
+ * declared structure does not distinguish them.
+ */
+export function selectWithBindings(step, observations, index, resolved) {
+    return selectFiltered(step, observations, index, resolved, new Set());
+}
+// `guard` carries the steps already being resolved further up the call, so an
+// `after` clause cycle in an uncompiled plan terminates instead of recursing.
+function selectFiltered(step, observations, index, resolved, guard) {
+    const base = selectObservations(step, observations);
+    const temporal = temporalFloor(step, index, observations, resolved, new Set([...guard, step.stepId]));
+    const captured = capturedFloor(step, resolved);
+    const hasCaptures = capturedBindings(step).length > 0;
+    if (temporal.kind === 'unsatisfiable' || (hasCaptures && captured === null)) {
+        return { result: 'none', matchedObservationIds: [] };
+    }
+    const floor = Math.max(temporal.kind === 'after' ? temporal.sequence : Number.NEGATIVE_INFINITY, captured ?? Number.NEGATIVE_INFINITY);
+    const byId = new Map(observations.map((observation) => [observation.observationId, observation]));
+    const matchedObservationIds = base.matchedObservationIds.filter((id) => {
+        const observation = byId.get(id);
+        return (observation !== undefined &&
+            observation.sequence > floor &&
+            satisfiesBindings(step, observation, index, resolved));
+    });
+    const result = matchedObservationIds.length === 0
+        ? 'none'
+        : matchedObservationIds.length === 1
+            ? 'one'
+            : 'several';
+    return { result, matchedObservationIds };
+}

package/dist/core/score/ladder-table.d.ts

@@ -0,0 +1,23 @@
+/**
+ * AD-21's published decision table, emitted from the two ladders' own
+ * condition rows and from the fixture set that exercises them, mirroring
+ * `outcome-table.ts`'s builder: pure, so the writer and the drift check
+ * cannot disagree about bytes, and every census count throws on zero rather
+ * than publishing a coverage claim the fixture set does not back.
+ *
+ * `LadderResolution.basis` is free text (`evidence-artifact.ts`'s own
+ * `verdictBasis` shape), so the per-condition census does not parse it: it
+ * re-evaluates each row's own `reasons` function against the same fixture
+ * input the resolution was built from, the same way `resolveProductionVerdict`
+ * and `resolveContractVerdict` do internally.
+ */
+import { type ContractAssessment, type ProductionAssessment } from './ladder.ts';
+export type LadderFixtureCase = {
+    readonly ladder: 'production';
+    readonly assessment: ProductionAssessment;
+} | {
+    readonly ladder: 'contract-scoring';
+    readonly assessment: ContractAssessment;
+};
+/** The whole document. Throws a worded diagnosis on an empty census cell. */
+export declare function ladderDecisionTable(cases: readonly LadderFixtureCase[]): string;

package/dist/core/score/ladder-table.js

@@ -0,0 +1,109 @@
+/**
+ * AD-21's published decision table, emitted from the two ladders' own
+ * condition rows and from the fixture set that exercises them, mirroring
+ * `outcome-table.ts`'s builder: pure, so the writer and the drift check
+ * cannot disagree about bytes, and every census count throws on zero rather
+ * than publishing a coverage claim the fixture set does not back.
+ *
+ * `LadderResolution.basis` is free text (`evidence-artifact.ts`'s own
+ * `verdictBasis` shape), so the per-condition census does not parse it: it
+ * re-evaluates each row's own `reasons` function against the same fixture
+ * input the resolution was built from, the same way `resolveProductionVerdict`
+ * and `resolveContractVerdict` do internally.
+ */
+import { CONTRACT_LADDER, LADDER_EXIT_CODES, PRODUCTION_LADDER, resolveContractVerdict, resolveProductionVerdict, } from './ladder.js';
+/** `|` escaped: a guard is prose, and a broken table is still byte-stable. */
+const cell = (text) => text.replace(/\|/g, '\\|');
+const row = (cells) => `| ${cells.map(cell).join(' | ')} |`;
+const table = (headers, rows) => [
+    row(headers),
+    `| ${headers.map(() => '---').join(' | ')} |`,
+    ...rows.map(row),
+];
+const code = (text) => `\`${text}\``;
+const HEADER = [
+    '# AD-21 verdict decision',
+    '',
+    'Generated by `npm run generate:ad21-table` from the two rule tables in',
+    '`src/core/score/ladder.ts` and from the fixture set that exercises them. Guarded by',
+    '`npm run check:ad21-table`, a byte-exact drift check. A hand edit fails that check; regenerate.',
+    '',
+    'Each ladder is pure and total: every input value returns a defined resolution and nothing',
+    'throws. Precedence is Invalid, then FAIL, then CONCERNS, then WAIVED, then PASS. Within the',
+    'winning tier every condition that holds contributes to the basis; none is masked by another',
+    'that fired first.',
+    '',
+    'The exit-code column names the rung, not `--strict`. Every CONCERNS row shows 0 because that is',
+    "the rung's own exit code before `--strict` runs; passing `--strict` promotes the resolution to 1,",
+    'except when every firing row for that resolution has "Evidence condition" `yes`, which `--strict`',
+    'never promotes.',
+];
+const RUNG_LABELS = ['invalid', 'FAIL', 'CONCERNS', 'WAIVED', 'PASS'];
+const rungLabelOf = (verdict) => verdict === null ? 'invalid' : verdict;
+/**
+ * Counts each key across one ladder's cases, then reports the first key no
+ * case reached. A zero census is what a narrowed fixture set looks like, and
+ * no regeneration repairs it.
+ */
+function census(ladderName, label, keys, countOf) {
+    return keys.map((key) => {
+        const count = countOf(key);
+        if (count === 0) {
+            throw new Error(`ladderDecisionTable: no ${ladderName} case reaches ${label} ${key}, so the published census would claim coverage the fixture set does not have`);
+        }
+        return [code(key), String(count)];
+    });
+}
+function ladderSection(name, ladderKey, ladderRows, cases) {
+    const ladderCases = cases.filter((entry) => entry.ladder === ladderKey);
+    if (ladderCases.length === 0) {
+        throw new Error(`ladderDecisionTable: no resolved cases for the ${ladderKey} ladder`);
+    }
+    const resolved = ladderCases.map((entry) => entry.ladder === 'production'
+        ? resolveProductionVerdict(entry.assessment)
+        : resolveContractVerdict(entry.assessment));
+    const conditionRows = ladderRows.map((conditionRow) => [
+        code(conditionRow.id),
+        conditionRow.rung === 'invalid' ? 'Invalid' : conditionRow.rung,
+        conditionRow.guard,
+        conditionRow.evidenceCondition ? 'yes' : 'no',
+        String(LADDER_EXIT_CODES[conditionRow.rung]),
+    ]);
+    const rungCensus = census(ladderKey, 'the rung', [...RUNG_LABELS], (key) => resolved.filter((entry) => rungLabelOf(entry.verdict) === key).length);
+    const conditionCensus = ladderRows.map((conditionRow) => {
+        const count = ladderCases.filter((entry) => conditionRow.reasons(entry.assessment).length > 0).length;
+        if (count === 0) {
+            throw new Error(`ladderDecisionTable: no ${ladderKey} case reaches the condition ${conditionRow.id}, so the published census would claim coverage the fixture set does not have`);
+        }
+        return [code(conditionRow.id), String(count)];
+    });
+    return [
+        `## ${name}`,
+        '',
+        ...table(['Condition', 'Rung', 'Guard', 'Evidence condition', 'Exit code'], conditionRows),
+        '',
+        `### ${name} census, by rung`,
+        '',
+        `Over the ${ladderCases.length} resolved ${ladderKey} fixture cases.`,
+        '',
+        ...table(['Rung', 'Cases'], rungCensus),
+        '',
+        `### ${name} census, by condition`,
+        '',
+        ...table(['Condition', 'Cases'], conditionCensus),
+    ];
+}
+/** The whole document. Throws a worded diagnosis on an empty census cell. */
+export function ladderDecisionTable(cases) {
+    if (cases.length === 0) {
+        throw new Error('ladderDecisionTable: no resolved cases, so every census below would be empty');
+    }
+    const lines = [
+        ...HEADER,
+        '',
+        ...ladderSection('Production ladder', 'production', PRODUCTION_LADDER, cases),
+        '',
+        ...ladderSection('Contract-scoring ladder', 'contract-scoring', CONTRACT_LADDER, cases),
+    ];
+    return `${lines.join('\n')}\n`;
+}

package/dist/core/score/ladder.d.ts

@@ -0,0 +1,229 @@
+/**
+ * AD-21's total decision table, built for the first time. Owed item 4's
+ * remaining three clauses: `ProductionAssessment` and `ContractAssessment`
+ * as separate input types, each resolved by its own pure, total,
+ * first-match-wins ladder over the same seven state categories AD-21 names.
+ *
+ * Every rung is derived independently per category, so a condition never
+ * masks another that fired in the same tier -- the same independence
+ * `outcome.ts`'s Stage A uses for AD-6's invalidating conditions. Precedence
+ * across tiers is Invalid, then FAIL, then CONCERNS, then WAIVED, then PASS,
+ * exactly AD-21's own order; within a tier every condition that holds is
+ * recorded, never only the first.
+ *
+ * `verdict: null` is AD-21's "Invalid" rung. It is not one of the four
+ * `Verdict` members: AD-21 itself says a failed run "never becomes a
+ * contract verdict", and exit code 3 sits outside the verdict range
+ * `src/cli/exit-codes.ts` defines. This module cannot import that file
+ * (`core/` imports only `core/schemas`, AD-1), so the three exit-code
+ * literals are repeated here rather than shared.
+ *
+ * AD-21's own "unrecognised evaluator recommendation value" clause is
+ * omitted: `verdict.ts:22-25` records that a schema-valid
+ * `EvaluatorRecommendation` cannot carry one, since an unrecognised value
+ * fails to parse before either ladder runs.
+ */
+import type { IngestCondition } from '../ingest/conditions.ts';
+import { type Severity } from '../schemas/eval-contract.ts';
+import type { CoverageGap, LineageChain, Trials, UncitedFindingGap } from '../schemas/evidence-artifact.ts';
+import type { EvidenceDisclosure } from '../schemas/sealed-run-record.ts';
+import type { EvaluatorRecommendation, Verdict } from '../schemas/verdict.ts';
+import type { OutcomeResolution } from './outcome.ts';
+import type { UnwitnessedQuotation } from './quotation.ts';
+/**
+ * One oracle's AD-33 resolution, paired with the two fields `OutcomeResolution`
+ * does not carry: `severity` is caller-owned on the persisted `Outcome`
+ * (`evidence-artifact.ts`'s own field, sourced from `Behavior.severity`), and
+ * `checkResolved` is the caller's own `OutcomeInputs.checkResolution !== null`,
+ * needed for AD-21's "no required check resolved" Invalid clause, which
+ * `OutcomeResolution` has no field for.
+ */
+export type ScoredOutcome = {
+    readonly oracleId: string;
+    readonly required: boolean;
+    readonly severity: Severity;
+    readonly checkResolved: boolean;
+    readonly resolution: OutcomeResolution;
+};
+/**
+ * AD-21's "outcome state" category. A composite rather than a bare
+ * `OutcomeState[]`: the three new Invalid conditions below each need
+ * per-condition detail a state enum alone cannot carry, so this bundles the
+ * per-oracle resolutions, the record-level `auditQuotation` result, and
+ * `Trials` alongside the re-execution cap (Design Notes: the AD-6
+ * re-execution cap, never AD-12's `Remediation.cap`).
+ */
+export type OutcomeStateInputs = {
+    readonly outcomes: readonly ScoredOutcome[];
+    readonly unwitnessedQuotations: readonly UnwitnessedQuotation[];
+    readonly trials: Trials;
+    readonly reExecutionCap: number;
+};
+/**
+ * AD-21's "evidence-integrity state" category, read for the FAIL rung's
+ * "incomplete, over-truncated, unavailable, or internally inconsistent under
+ * AD-17" clause. `EvidenceDisclosure` carries only the two caller-declared
+ * halves (`reportedIncomplete`, `truncationBound`); the other two have no
+ * source anywhere in the tree today (`evidence-disclosure`'s own describe:
+ * "unavailable is an ArtifactReference that does not resolve through the
+ * corpus port, and internally inconsistent is AD-32's cross-artifact
+ * agreement check"), so they arrive declared rather than derived, the same
+ * posture `outcome.ts`'s `judgeConduct` and `waiver` inputs take.
+ * `overTruncated` is declared for the same reason: it compares the disclosed
+ * bound against the evidence actually carried, which this pure function does
+ * not read.
+ */
+export type EvidenceIntegrityInputs = {
+    readonly disclosure: EvidenceDisclosure;
+    readonly overTruncated: boolean;
+    readonly unavailable: boolean;
+    readonly internallyInconsistent: boolean;
+    /**
+     * AD-16's unaccounted-manifest Invalid condition: `IsolationManifest.violation`.
+     * Widened from a single nullable string to an array, matching
+     * `ValidatedObservations.isolationViolation`'s shape (`ingest.ts:78`): empty
+     * when nothing fired, one entry per offending value.
+     */
+    readonly isolationViolation: readonly string[];
+    /**
+     * Eight ingest conditions, each a structured payload `ingest` already
+     * computed, `Extract`-typed against `IngestCondition` so a rename in
+     * `ingest/conditions.ts` collapses the field's type to `never[]` rather
+     * than silently reading a stale shape. Ascending `EvidenceIntegrityInputs`
+     * field order matches `INGEST_CONDITION_KINDS`' declaration order.
+     */
+    readonly duplicateRecordIdentifiers: readonly Extract<IngestCondition, {
+        kind: 'duplicate-record-identifier';
+    }>[];
+    readonly danglingCitations: readonly Extract<IngestCondition, {
+        kind: 'dangling-citation';
+    }>[];
+    readonly danglingDispositionCitations: readonly Extract<IngestCondition, {
+        kind: 'dangling-disposition-citation';
+    }>[];
+    readonly forbiddenInputsNotWithheld: readonly Extract<IngestCondition, {
+        kind: 'forbidden-input-not-withheld';
+    }>[];
+    readonly crossArtifactDisagreements: readonly Extract<IngestCondition, {
+        kind: 'cross-artifact-disagreement';
+    }>[];
+    readonly evaluatorConfigurationAbsent: readonly Extract<IngestCondition, {
+        kind: 'evaluator-configuration-absent';
+    }>[];
+    readonly evaluatorConfigurationDigestMismatches: readonly Extract<IngestCondition, {
+        kind: 'evaluator-configuration-digest-mismatch';
+    }>[];
+    readonly judgeResultsUnscored: readonly Extract<IngestCondition, {
+        kind: 'judge-result-unscored';
+    }>[];
+    /**
+     * The two score-computed conditions, pre-rendered like `isolationViolation`
+     * rather than structured: `score.ts` computes and renders both itself
+     * (neither is an `IngestCondition`), so the ladder only needs to display
+     * them.
+     */
+    readonly operationIdentifierCollisions: readonly string[];
+    readonly trialSetDisagreements: readonly string[];
+};
+export type FindingConfidence = {
+    readonly findingId: string;
+    readonly confidence: number;
+};
+/**
+ * The seven category values, common to both modes; AD-21 is explicit the two
+ * verdicts "never share a field" beyond this. `uncitedDefectFindings` sits in
+ * the "coverage condition" category: owed item 5 calls an uncited defect
+ * finding, in contract-scoring, "the strongest available evidence of a
+ * coverage gap".
+ */
+type AssessmentCommon = {
+    readonly outcomeState: OutcomeStateInputs;
+    readonly evidenceIntegrity: EvidenceIntegrityInputs;
+    readonly evaluatorRecommendation: EvaluatorRecommendation;
+    readonly coverageGaps: readonly CoverageGap[];
+    /**
+     * Owed item 5, per `outcome.ts`'s `uncitedDefectFindingGaps`. Only presence
+     * and each entry's `findingId` are read below; the rest is carried for the
+     * persisted record.
+     */
+    readonly uncitedDefectFindings: readonly UncitedFindingGap[];
+    readonly findings: readonly FindingConfidence[];
+    readonly confidenceThreshold: number;
+    /** AD-21's "remediation state": `Remediation.lineageChain`'s conjunction only, never `Remediation.cap` (AD-12's contract-revision cap). */
+    readonly remediationState: LineageChain;
+    /** AD-21's "pre-flight state": `PreflightVerdict.passed`. */
+    readonly preflightPassed: boolean;
+    readonly severityFloor: Severity;
+};
+/**
+ * A literal `mode` discriminant, mirroring `EvidenceArtifact`'s own union, so
+ * the two types are nominally distinct rather than structurally compatible in
+ * one direction only.
+ */
+export type ProductionAssessment = AssessmentCommon & {
+    readonly mode: 'production';
+};
+export type ContractAssessment = AssessmentCommon & {
+    readonly mode: 'contract-scoring';
+    readonly systemRecommendationRecorded: EvaluatorRecommendation;
+    readonly systemRecommendationNote: string | null;
+};
+export type LadderResolution = {
+    /** `null` is AD-21's Invalid rung: never a `Verdict`, and a run that never becomes a contract verdict. */
+    readonly verdict: Verdict | null;
+    readonly exitCode: number;
+    /** `false` for a CONCERNS whose only firing conditions are the two evidence conditions; `cli/exit-codes.ts`'s `evidenceConditionsOnly` semantics, restated for the ladder to agree with rather than re-derive. */
+    readonly strictPromotable: boolean;
+    readonly basis: readonly string[];
+};
+/**
+ * AD-21's exit codes for this rung. Not imported from `src/cli/exit-codes.ts`:
+ * `core/` imports only `core/schemas` (AD-1), so the three numbers are
+ * repeated here rather than shared. Exported so a test outside `core/` can
+ * assert this restatement still agrees with that file's own `EXIT_*`
+ * constants and `evidenceConditionsOnly` rule, which neither file can check
+ * of itself.
+ */
+export declare const LADDER_EXIT_CODES: {
+    readonly invalid: 3;
+    readonly FAIL: 2;
+    readonly CONCERNS: 0;
+    readonly WAIVED: 0;
+    readonly PASS: 0;
+};
+/**
+ * One condition this table can independently confirm or deny. `reasons`
+ * returns zero or more free-text entries (`evidence-artifact.ts`'s own
+ * `verdictBasis` shape: non-empty strings, empty array legal); more than one
+ * entry names each affected oracle, gap, or finding separately, matching
+ * AD-21's "the record carries every condition that fired".
+ */
+type LadderConditionRow = {
+    readonly id: string;
+    readonly rung: 'invalid' | 'FAIL' | 'CONCERNS' | 'WAIVED';
+    readonly guard: string;
+    /** the two evidence conditions AD-21 names as a thinner measurement rather than a system claim; `strictPromotable` reads this. */
+    readonly evidenceCondition: boolean;
+    readonly reasons: (inputs: AssessmentCommon) => readonly string[];
+};
+/**
+ * Production's ladder: the shared rows plus the two rows that read an
+ * ingested evaluator recommendation, which contract-scoring's never does.
+ */
+export declare const PRODUCTION_LADDER: readonly LadderConditionRow[];
+/**
+ * Contract-scoring's ladder: FAIL/CONCERNS/WAIVED/PASS mirror production's
+ * minus every clause that promotes `evaluatorRecommendation`, per AD-21.
+ */
+export declare const CONTRACT_LADDER: readonly LadderConditionRow[];
+/** AD-21's production-mode ladder: the subject is the system under test. */
+export declare function resolveProductionVerdict(assessment: ProductionAssessment): LadderResolution;
+/**
+ * AD-21's contract-scoring ladder: the subject is the contract. No row here
+ * reads `evaluatorRecommendation`; `systemRecommendationRecorded` and
+ * `systemRecommendationNote` are carried on the input for symmetry with
+ * `EvidenceArtifact`'s own contract-scoring branch and are read by nothing in
+ * this module.
+ */
+export declare function resolveContractVerdict(assessment: ContractAssessment): LadderResolution;
+export {};