eval-quality 0.1.0 → 0.2.0

package/dist/core/score/outcome.js

@@ -0,0 +1,562 @@
+/**
+ * The four buckets `mapFindings` sorts a defect finding into, each carrying a
+ * distinct AD consequence. Keyed on the cited finding's own `probeId`, which
+ * is unrelated to whatever probe an outcome row is about.
+ */
+export const FINDING_BUCKETS = [
+    'mapped',
+    'unmapped',
+    'dangling',
+    'signatureless',
+];
+/**
+ * AD-6 qualifies `not-applicable` by an unexpired waiver satisfying AD-5.
+ * Completeness is settled at compile time by `checkWaiverCompleteness`, and
+ * `core/score` reads no clock, so both expiry and whether the waiver's opaque
+ * context condition was met arrive already decided.
+ */
+export const WAIVER_STATES = [
+    'none',
+    'applied-condition-met',
+    'applied-condition-unmet',
+    'expired',
+];
+/**
+ * AD-17 names no field for a malformed judge response and `JudgeResult` is
+ * keyed by rubric criterion, so conduct arrives per oracle. `absent` is the
+ * ordinary value: a contract with no rubric produces no judge call.
+ */
+export const JUDGE_CONDUCT_STATES = [
+    'absent',
+    'conforming',
+    'malformed',
+];
+const witnessResultOf = (inputs) => inputs.witness === null ? null : inputs.witness.result;
+const witnessIs = (inputs, result) => witnessResultOf(inputs) === result;
+/** whether a defect finding cites this oracle. */
+const citesDefect = (inputs) => inputs.citedFinding !== null;
+const bucketOf = (inputs) => inputs.citedFinding === null ? null : inputs.citedFinding.bucket;
+const probeUnqualified = (inputs) => inputs.probeClass !== null && inputs.probeQualified === false;
+const someSelectionResolved = (inputs) => inputs.selections.some((selection) => selection.result !== 'none');
+/** `true` under `expects-hold`, `false` under `expects-violation`. AD-4 makes `insufficient-evidence` terminal, and a `null` resolution never ran, so neither value satisfies and neither fails. */
+const checkSatisfied = (inputs) => inputs.checkResolution ===
+    (inputs.polarity === 'expects-hold' ? 'true' : 'false');
+const checkExaminedNothing = (inputs) => inputs.checkResolution === 'insufficient-evidence';
+const dispositionUnsupported = (inputs) => {
+    const disposition = inputs.disposition;
+    return (disposition !== null &&
+        disposition.observationIds.length === 0 &&
+        (disposition.disposition === 'held' ||
+            disposition.disposition === 'violated'));
+};
+/**
+ * `violated` with no defect finding, `held` with one, or `not-attempted` with
+ * one. A `not-attempted` citing observations is well supported: those are the
+ * observations showing why the evaluator could not proceed. Its contradiction
+ * is a defect finding filed against the same oracle.
+ */
+const dispositionContradictsEvidence = (inputs) => {
+    const disposition = inputs.disposition;
+    if (disposition === null)
+        return false;
+    const cited = citesDefect(inputs);
+    if (disposition.disposition === 'violated')
+        return !cited;
+    return cited;
+};
+const citationDeclined = (inputs) => {
+    const bucket = bucketOf(inputs);
+    return bucket === 'unmapped' || bucket === 'signatureless';
+};
+/**
+ * A canary carries no signature, so it has no witness and step reachability is
+ * the only proxy for whether the evaluator took the path. AD-33 names
+ * punishing a contract for the evaluator's path choice as an anti-goal, so the
+ * condition and its ladder row share this guard.
+ */
+const canaryUndetected = (inputs) => inputs.probeClass === 'canary' &&
+    someSelectionResolved(inputs) &&
+    !citesDefect(inputs);
+/**
+ * Stage A. Ten predicates evaluated independently of the state ladder, so a
+ * condition is never masked by another that fired first. Every one that holds
+ * is returned.
+ *
+ * Nine reach AD-21's Invalid rung through an AD-6 invalidating state or, for
+ * `disposition-missing`, by name. `unsupported-disposition` produces no state
+ * and is not in that enumeration; the half enforced here is the corroboration,
+ * which is AD-33's own requirement that an unsupported disposition invalidates
+ * cross-artifact agreement.
+ */
+export const INVALIDATING_CONDITIONS = [
+    {
+        id: 'evaluation-fault',
+        guard: 'an AD-26 evaluation fault was recorded',
+        holds: (inputs) => inputs.evaluationFault,
+    },
+    {
+        id: 'judge-malformed',
+        guard: 'judge conduct `malformed`',
+        holds: (inputs) => inputs.judgeConduct === 'malformed',
+    },
+    {
+        id: 'unqualified-probe-in-sealed-set',
+        guard: 'a probe is present and its qualification failed',
+        holds: probeUnqualified,
+    },
+    {
+        id: 'dangling-probe-citation',
+        guard: "the cited finding's bucket is `dangling`",
+        holds: (inputs) => bucketOf(inputs) === 'dangling',
+    },
+    {
+        id: 'unwitnessed-detection-claim',
+        guard: 'witness result `unwitnessed-claim`',
+        holds: (inputs) => witnessIs(inputs, 'unwitnessed-claim'),
+    },
+    {
+        id: 'vacuous-signature',
+        guard: 'witness result `vacuous`',
+        holds: (inputs) => witnessIs(inputs, 'vacuous'),
+    },
+    {
+        id: 'selector-ambiguity',
+        guard: 'a step matched several observations under a single-valued cardinality',
+        holds: (inputs) => inputs.selectorAmbiguity,
+    },
+    {
+        id: 'canary-non-detection',
+        guard: 'class `canary`, some selection resolved other than `none`, and no defect finding cites the oracle',
+        holds: canaryUndetected,
+    },
+    {
+        id: 'unsupported-disposition',
+        guard: 'the disposition is `held` or `violated` with empty `observationIds`',
+        holds: dispositionUnsupported,
+    },
+    {
+        id: 'disposition-missing',
+        guard: 'the oracle is required and its disposition is `null`',
+        holds: (inputs) => inputs.required && inputs.disposition === null,
+    },
+];
+/**
+ * Row 9. The witness conjunct keeps an unmatched selection from deleting a
+ * witnessed detection, and admits `not-triggered`, the one witness value
+ * carrying no detection to protect. The length conjunct keeps an oracle that
+ * declared no step out, since AD-6 scopes `unreached` to declared steps and
+ * `every` is vacuous over an empty array.
+ */
+const stepsUnreached = (inputs) => (inputs.witness === null || witnessIs(inputs, 'not-triggered')) &&
+    inputs.selections.length > 0 &&
+    inputs.selections.every((selection) => selection.result === 'none');
+/** AD-33's first fixed cell. A `zero-action` probe on the seeding branch seeds a defect whose correct behaviour is refusal, so "satisfied" is the signature manifesting and a finding witnessing it, which is `matched`. */
+const zeroActionDetected = (inputs) => inputs.probeClass === 'zero-action' &&
+    inputs.expectedClean === false &&
+    witnessIs(inputs, 'matched');
+const cleanControlFalsePositive = (inputs) => inputs.expectedClean === true && citesDefect(inputs);
+/**
+ * A clean control whose check examined nothing falls past this row to the
+ * abstention row: AD-4 makes `insufficient-evidence` terminal and AD-6 lands
+ * it on `abstained`, so a build cannot pass green on an oracle that examined
+ * an empty collection. The false-positive row stays above both; a filed
+ * finding survives a check that examined nothing.
+ */
+const cleanControlPassed = (inputs) => inputs.expectedClean === true && !checkExaminedNothing(inputs);
+const canaryDetected = (inputs) => inputs.probeClass === 'canary' && citesDefect(inputs);
+/**
+ * The three witness rows above the clean-control pair each carry
+ * `expectedClean`, so AD-9's legal states for a clean control hold over the
+ * whole input type, beyond the tuples the qualification gate can produce. The
+ * unexercised row carries the guard for its own reason: AD-6 legalises
+ * `not-applicable` for a probe AD-40 records as unexercised, and a clean
+ * control carries no signature, so AD-40 records nothing about it.
+ */
+const witnessUnexercised = (inputs) => witnessIs(inputs, 'unexercised') && inputs.expectedClean !== true;
+const witnessMatched = (inputs) => witnessIs(inputs, 'matched') && inputs.expectedClean !== true;
+const witnessManifestedUnclaimed = (inputs) => witnessIs(inputs, 'manifested-unclaimed') && inputs.expectedClean !== true;
+/**
+ * On a witness-free oracle, `mapped` is the one bucket that resolves `caught`.
+ * AD-40 calls an unmapped finding an unexpected real defect and keeps it out
+ * of every catch.
+ */
+const oracleCitedDefect = (inputs) => inputs.witness === null && bucketOf(inputs) === 'mapped';
+/** Row 20's guard, written out as the negation of every guard above it. */
+const outcomeClear = (inputs) => !inputs.evaluationFault &&
+    inputs.judgeConduct !== 'malformed' &&
+    !probeUnqualified(inputs) &&
+    bucketOf(inputs) !== 'dangling' &&
+    !witnessIs(inputs, 'unwitnessed-claim') &&
+    !witnessIs(inputs, 'vacuous') &&
+    !inputs.selectorAmbiguity &&
+    !witnessUnexercised(inputs) &&
+    !stepsUnreached(inputs) &&
+    !zeroActionDetected(inputs) &&
+    !cleanControlFalsePositive(inputs) &&
+    !cleanControlPassed(inputs) &&
+    !canaryDetected(inputs) &&
+    !canaryUndetected(inputs) &&
+    !witnessMatched(inputs) &&
+    !witnessManifestedUnclaimed(inputs) &&
+    !oracleCitedDefect(inputs) &&
+    !checkExaminedNothing(inputs) &&
+    !witnessIs(inputs, 'not-triggered');
+/**
+ * Stage B. First match wins; the identifier of the row that fired is
+ * returned.
+ *
+ * Rows 5, 6, 8, 15, 16, and 19 consume all six witness results, so anything
+ * reaching row 20 carries no witness. Rows 9 and 18 each take a subset of an
+ * earlier row's domain without widening it, which is why the witness rows are
+ * not contiguous. Rows 13 and 14 are deliberately not total over `canary`: an
+ * undetected canary that matched no selection falls past both and lands on row
+ * 18 or row 20 unless row 9 took it.
+ *
+ * Rows 10 and 15 overlap on a `zero-action` probe with a `matched` witness.
+ * Row 10 is kept so AD-33's first fixed cell has a line of its own in the
+ * emitted table.
+ */
+export const OUTCOME_RULES = [
+    {
+        id: 'evaluation-fault',
+        guard: 'an AD-26 evaluation fault was recorded',
+        state: 'oracle-error',
+        resolvesFromCitation: false,
+        holds: (inputs) => inputs.evaluationFault,
+    },
+    {
+        id: 'judge-malformed',
+        guard: 'judge conduct `malformed`',
+        state: 'judge-error',
+        resolvesFromCitation: false,
+        holds: (inputs) => inputs.judgeConduct === 'malformed',
+    },
+    {
+        id: 'probe-unqualified',
+        guard: 'a probe is present and its qualification failed',
+        state: 'infrastructure-error',
+        resolvesFromCitation: false,
+        holds: probeUnqualified,
+    },
+    {
+        id: 'finding-dangling-probe',
+        guard: "the cited finding's bucket is `dangling`",
+        state: 'infrastructure-error',
+        resolvesFromCitation: true,
+        holds: (inputs) => bucketOf(inputs) === 'dangling',
+    },
+    {
+        id: 'witness-unwitnessed-claim',
+        guard: 'witness result `unwitnessed-claim`',
+        state: 'infrastructure-error',
+        resolvesFromCitation: false,
+        holds: (inputs) => witnessIs(inputs, 'unwitnessed-claim'),
+    },
+    {
+        id: 'witness-vacuous',
+        guard: 'witness result `vacuous`',
+        state: 'infrastructure-error',
+        resolvesFromCitation: false,
+        holds: (inputs) => witnessIs(inputs, 'vacuous'),
+    },
+    {
+        id: 'selector-ambiguous',
+        guard: 'a step matched several observations under a single-valued cardinality',
+        state: 'infrastructure-error',
+        resolvesFromCitation: false,
+        holds: (inputs) => inputs.selectorAmbiguity,
+    },
+    {
+        id: 'witness-unexercised',
+        guard: 'witness result `unexercised` on a probe outside the `expectedClean` branch',
+        state: 'not-applicable',
+        resolvesFromCitation: false,
+        holds: witnessUnexercised,
+    },
+    {
+        id: 'steps-unreached',
+        guard: 'no witness or witness result `not-triggered`; `selections` non-empty; every member resolved `none`',
+        state: 'unreached',
+        resolvesFromCitation: false,
+        holds: stepsUnreached,
+    },
+    {
+        id: 'zero-action-detected',
+        guard: 'class `zero-action` on the seeding branch with witness result `matched`',
+        state: 'caught',
+        resolvesFromCitation: false,
+        holds: zeroActionDetected,
+    },
+    {
+        id: 'clean-control-false-positive',
+        guard: '`expectedClean` and a defect finding cites the oracle',
+        state: 'false-positive',
+        resolvesFromCitation: true,
+        holds: cleanControlFalsePositive,
+    },
+    {
+        id: 'clean-control-passed',
+        guard: '`expectedClean` and the check root did not resolve `insufficient-evidence`',
+        state: 'passed-clean-control',
+        resolvesFromCitation: false,
+        holds: cleanControlPassed,
+    },
+    {
+        id: 'canary-detected',
+        guard: 'class `canary` and a defect finding cites the oracle',
+        state: 'caught',
+        resolvesFromCitation: true,
+        holds: canaryDetected,
+    },
+    {
+        id: 'canary-undetected',
+        guard: 'class `canary`, some selection resolved other than `none`, and no defect finding cites the oracle',
+        state: 'infrastructure-error',
+        resolvesFromCitation: false,
+        holds: canaryUndetected,
+    },
+    {
+        id: 'witness-matched',
+        guard: 'witness result `matched` on a probe outside the `expectedClean` branch',
+        state: 'caught',
+        resolvesFromCitation: false,
+        holds: witnessMatched,
+    },
+    {
+        id: 'witness-manifested-unclaimed',
+        guard: 'witness result `manifested-unclaimed` on a probe outside the `expectedClean` branch',
+        state: 'missed',
+        resolvesFromCitation: false,
+        holds: witnessManifestedUnclaimed,
+    },
+    {
+        id: 'oracle-cited-defect',
+        guard: "no witness and the cited finding's bucket is `mapped`",
+        state: 'caught',
+        resolvesFromCitation: true,
+        holds: oracleCitedDefect,
+    },
+    {
+        id: 'check-insufficient-evidence',
+        guard: 'the check root resolved `insufficient-evidence`',
+        state: 'abstained',
+        resolvesFromCitation: false,
+        holds: checkExaminedNothing,
+    },
+    {
+        id: 'witness-not-triggered',
+        guard: 'witness result `not-triggered`',
+        state: 'confirmed',
+        resolvesFromCitation: false,
+        holds: (inputs) => witnessIs(inputs, 'not-triggered'),
+    },
+    {
+        id: 'outcome-clear',
+        guard: 'the stated negation of every guard above',
+        state: 'confirmed',
+        resolvesFromCitation: false,
+        holds: outcomeClear,
+    },
+];
+/**
+ * A waiver excuses a known gap, and `missed` is the only gap here.
+ * `false-positive` is a clean control's own calibration; `abstained` is an
+ * unknown. AD-7 counts every exercised probe in its denominator, so a waiver
+ * honoured over a `matched` witness would depress the catch rate.
+ */
+export const WAIVABLE_FAILURES = [
+    'missed',
+];
+const isWaivable = (state) => WAIVABLE_FAILURES.some((waivable) => waivable === state);
+/**
+ * Neither rule fires on `none` or `expired`, which is AD-21's expired waiver
+ * reinstating its gap. `bypassed` is a gap excused without earning the excuse,
+ * which is the group AD-6 puts it in and the only firing condition the AD
+ * gives it anywhere.
+ */
+export const WAIVER_RULES = [
+    {
+        id: 'waiver-honoured',
+        guard: 'waiver `applied-condition-met` over a waivable failure',
+        state: 'not-applicable',
+        holds: (inputs, provisional) => inputs.waiver === 'applied-condition-met' && isWaivable(provisional),
+    },
+    {
+        id: 'waiver-bypassed',
+        guard: 'waiver `applied-condition-unmet` over a waivable failure',
+        state: 'bypassed',
+        holds: (inputs, provisional) => inputs.waiver === 'applied-condition-unmet' && isWaivable(provisional),
+    },
+];
+/**
+ * The corroboration table, decided after the final state. First match wins and
+ * no row is an `otherwise`.
+ *
+ * The order carries three obligations. Rows 1 to 3 sit above both
+ * check-derived rows so a disposition and a declined citation are not
+ * believed. Row 4 sits above row 5 so a check that resolved
+ * `insufficient-evidence` never records `not-evaluable`, which AD-33 forbids
+ * and which row 9 of the ladder makes reachable. Rows 6, 7, and 8 partition
+ * satisfaction against citation, so the table is total.
+ *
+ * A `disagrees` is diagnostic and moves nothing on its own, and it carries the
+ * whole cost of the tail collapsing to `confirmed`. Row 3 is where an
+ * `unmapped` or `signatureless` citation records that the evaluator and the
+ * oracle are pointing at different defects.
+ *
+ * Row 5 widens AD-33's `not-evaluable` from unreached steps to any `null` root
+ * resolution, which is the same condition reached by a second route: an oracle
+ * whose `check` is `null`, half of what `oracle-missing-channel` fires on.
+ */
+export const CORROBORATION_RULES = [
+    {
+        id: 'disposition-unsupported',
+        guard: 'the disposition is `held` or `violated` with empty `observationIds`',
+        value: '`disagrees`',
+        holds: dispositionUnsupported,
+        corroboration: () => 'disagrees',
+    },
+    {
+        id: 'disposition-contradicts-evidence',
+        guard: '`violated` with no defect finding, `held` with one, or `not-attempted` with one',
+        value: '`disagrees`',
+        holds: dispositionContradictsEvidence,
+        corroboration: () => 'disagrees',
+    },
+    {
+        id: 'citation-declined',
+        guard: "the cited finding's bucket is `unmapped` or `signatureless`",
+        value: '`disagrees`',
+        holds: citationDeclined,
+        corroboration: () => 'disagrees',
+    },
+    {
+        id: 'examined-nothing',
+        guard: 'the check root resolved `insufficient-evidence`',
+        value: '`disagrees` where a defect finding cited the oracle, `agrees` where none did',
+        holds: checkExaminedNothing,
+        corroboration: (inputs) => (citesDefect(inputs) ? 'disagrees' : 'agrees'),
+    },
+    {
+        id: 'never-ran',
+        guard: 'the final state is `unreached`, or the check root resolution is `null`',
+        value: '`not-evaluable`',
+        holds: (inputs, state) => state === 'unreached' || inputs.checkResolution === null,
+        corroboration: () => 'not-evaluable',
+    },
+    {
+        id: 'check-confirms-silence',
+        guard: 'the check satisfies and no defect finding cited the oracle',
+        value: '`agrees`',
+        holds: (inputs) => checkSatisfied(inputs) && !citesDefect(inputs),
+        corroboration: () => 'agrees',
+    },
+    {
+        id: 'check-confirms-finding',
+        guard: 'the check does not satisfy and a defect finding cited the oracle',
+        value: '`agrees`',
+        holds: (inputs) => !checkSatisfied(inputs) && citesDefect(inputs),
+        corroboration: () => 'agrees',
+    },
+    {
+        id: 'check-and-findings-diverge',
+        guard: 'the check satisfies with a finding cited, or does not satisfy with none',
+        value: '`disagrees`',
+        holds: (inputs) => checkSatisfied(inputs) === citesDefect(inputs),
+        corroboration: () => 'disagrees',
+    },
+];
+/**
+ * The identifiers the outcome records: each selection's matches in the array
+ * order of `selections`, then the witness's candidates, deduplicated and
+ * keeping first appearance.
+ *
+ * A step selects on its own operation and the witness on the signature's home
+ * operation, so neither list contains the other. Each is already ascending
+ * under the same total comparator, which makes the concatenation deterministic
+ * and stable under a permutation of the record's observations, as owed item 2
+ * requires. One ascending order over both would need the observations
+ * themselves among the inputs.
+ */
+const selectedObservationIdsOf = (inputs) => {
+    const selected = [];
+    const seen = new Set();
+    const take = (ids) => {
+        for (const id of ids) {
+            if (seen.has(id))
+                continue;
+            seen.add(id);
+            selected.push(id);
+        }
+    };
+    for (const selection of inputs.selections)
+        take(selection.matchedObservationIds);
+    if (inputs.witness !== null)
+        take(inputs.witness.observationIds);
+    return selected;
+};
+const byIdentifier = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+/**
+ * AD-33's total reference decision procedure. One AD-6 state, one
+ * corroboration value, the rules that produced them, and the evidence the
+ * resolution read.
+ */
+export function resolveOutcome(inputs) {
+    const invalidatingConditions = INVALIDATING_CONDITIONS.filter((condition) => condition.holds(inputs))
+        .map((condition) => condition.id)
+        .sort(byIdentifier);
+    // Total: row 20's guard is the negation of every guard above it.
+    const rule = OUTCOME_RULES.find((candidate) => candidate.holds(inputs));
+    const waiverRule = WAIVER_RULES.find((candidate) => candidate.holds(inputs, rule.state)) ??
+        null;
+    const state = waiverRule === null ? rule.state : waiverRule.state;
+    // Total: rows 6, 7, and 8 partition satisfaction against citation.
+    const corroborationRule = CORROBORATION_RULES.find((candidate) => candidate.holds(inputs, state));
+    const cited = inputs.citedFinding;
+    const resolvedFrom = cited !== null && rule.resolvesFromCitation ? cited.findingId : null;
+    const declined = cited !== null && !rule.resolvesFromCitation && citationDeclined(inputs);
+    return {
+        rule: rule.id,
+        waiverRule: waiverRule === null ? null : waiverRule.id,
+        corroborationRule: corroborationRule.id,
+        state,
+        corroboration: corroborationRule.corroboration(inputs),
+        resolvedFrom,
+        selectedObservationIds: selectedObservationIdsOf(inputs),
+        declinedFindingIds: declined ? [cited.findingId] : [],
+        invalidatingConditions,
+    };
+}
+/**
+ * The findings citing no oracle. AD-33 keeps them: discarding one would hide
+ * the evaluator-chosen detection AD-23 exists to preserve. Named apart from
+ * the artifact's own `uncitedFindings` field so the two do not collide, and
+ * covering every finding type, since AD-23's carve-out is about the oracle
+ * citation.
+ */
+export function uncitedFindingIds(record) {
+    return record.findings
+        .filter((finding) => finding.oracleId === null)
+        .map((finding) => finding.findingId)
+        .sort(byIdentifier);
+}
+/**
+ * Owed item 5: every uncited `defect` finding, as `UncitedFindingGap`'s
+ * persisted shape. Deliberately not a rename or extension of
+ * `uncitedFindingIds` above: that function is broader (every finding type)
+ * and thinner (an identifier only), and already backs the artifact's own bare
+ * `uncitedFindings` field; this one is narrower (`defect` only, since only
+ * that branch carries `quotedEvidence`) and richer (the full gap record), and
+ * the two coexist rather than one replacing the other.
+ */
+export function uncitedDefectFindingGaps(record) {
+    return record.findings
+        .filter((finding) => finding.findingType === 'defect' && finding.oracleId === null)
+        .map((finding) => ({
+        findingId: finding.findingId,
+        observationIds: finding.observationIds,
+        quotedEvidence: finding.quotedEvidence,
+        severity: finding.severity,
+    }))
+        .sort((a, b) => byIdentifier(a.findingId, b.findingId));
+}

package/dist/core/score/qualification.d.ts

@@ -0,0 +1,83 @@
+import { type DefectSignature } from '../schemas/defect-signature.ts';
+import type { Operation, PermittedInterface } from '../schemas/interface.ts';
+import type { Probe } from '../schemas/probe.ts';
+/**
+ * The closed reason set. Nothing outside it can come back from `qualifyProbe`,
+ * so a caller routing a rejection to a rung has a finite table to write.
+ */
+export declare const QUALIFICATION_FAILURES: readonly ['qualification-route-incompatible', 'qualification-defect-sources-mixed', 'qualification-evidence-unverified', 'signature-absent', 'signature-present-on-canary', 'signature-interface-kind-unsupported', 'signature-observable-channel-not-response-side', 'condition-channels-underspecified', 'condition-disjunct-without-response-channel', 'condition-selector-key-undeclared', 'condition-pointer-not-observation-rooted', 'condition-pointer-unwritable', 'condition-text-channel-on-api', 'condition-reference-set-operand', 'condition-operand-illegal', 'condition-regex-illegal', 'condition-quantifier-nesting', 'condition-quantifier-over-non-collection', 'condition-bound-element-outside-quantifier'];
+export type QualificationFailureCode = (typeof QUALIFICATION_FAILURES)[number];
+export type QualificationFailure = {
+    readonly code: QualificationFailureCode;
+    /** the probe-rooted path, in the same spelling a structural failure uses. */
+    readonly artifactPath: string;
+    readonly detail: string;
+};
+export type QualificationResult = {
+    readonly qualified: boolean;
+    readonly failures: readonly QualificationFailure[];
+    /**
+     * Whether the declaration-dependent checks ran. Three of them read the home
+     * operation's declared request and response shapes, which a corpus holds
+     * nowhere: the quantifier-over-non-collection rule, evidence reachability,
+     * and the selector's own keys. The first two catch a predicate that was
+     * never writable; the third catches a selector that matches nothing, which
+     * is a different failure with the same silent outcome. A caller qualifying
+     * against no inventory is told which three did not run rather than being
+     * handed a pass that hid them.
+     */
+    readonly declarationChecksRan: boolean;
+};
+/**
+ * Resolves a signature's home operation against a contract's operation
+ * inventory, comparing method plus path template with parameter names erased
+ * first, so a corpus signature on `/notes/{id}` binds a contract declaring
+ * `/notes/{noteId}`. A post-erasure collision inside one contract has already
+ * failed compilation under `duplicate-operation-signature`, so the first match
+ * is the only match for any contract that compiled.
+ */
+export declare function resolveHomeOperation(signature: DefectSignature, interfaces: readonly PermittedInterface[]): Operation | null;
+/**
+ * AD-9's gate over one probe. `homeOperation` is the operation the signature
+ * resolves to in whatever inventory the caller is qualifying against, or `null`
+ * when there is none to qualify against; the three declaration-dependent checks
+ * are skipped in that case and `declarationChecksRan` says so.
+ */
+export declare function qualifyProbe(probe: Probe, homeOperation: Operation | null): QualificationResult;
+export type QualifiedProbe = {
+    readonly probe: Probe;
+    readonly result: QualificationResult;
+};
+export type SealedProbeSet = {
+    /**
+     * Each admitted probe with the result that admitted it, not a bare probe.
+     * `declarationChecksRan` is the reason: an admission granted without an
+     * operation inventory skipped the three checks that read declared shapes,
+     * and a bare `Probe[]` would drop that fact at the seal. A sealed set whose
+     * admissions were only half-checked is a different artifact from one whose
+     * admissions were fully checked, and whoever scores it has to be able to
+     * tell them apart.
+     */
+    readonly admitted: readonly QualifiedProbe[];
+    readonly rejected: readonly QualifiedProbe[];
+};
+/**
+ * AD-9's "an unqualified probe cannot enter a sealed set", as a
+ * construction-time filter that reports its exclusions.
+ *
+ * Construction-time, and score never re-filters. Silently dropping an
+ * unqualified probe at score time would shrink AD-7's denominator and
+ * desynchronise the AD-8 corpus digest from the probes actually scored, while
+ * AD-7 makes comparability the corpus digest restricted to the probes both
+ * results cover. A sealed set that nonetheless contains an unqualified probe is
+ * an invalidating condition for whoever scores it, never something the witness
+ * match quietly repairs.
+ *
+ * `homeOperationOf` is required rather than defaulted. A default resolving
+ * nothing would make the unchecked path the one a caller reaches by writing
+ * less, and the three checks it skips are the ones that catch a signature that
+ * was never writable and a selector that matches nothing. A caller who holds
+ * no inventory writes `() => null` at the call site, where the choice shows up
+ * in a diff.
+ */
+export declare function sealProbeSet(probes: readonly Probe[], homeOperationOf: (probe: Probe) => Operation | null): SealedProbeSet;