eval-quality 0.1.0 → 0.2.0

package/dist/cli/arguments.js

@@ -4,24 +4,68 @@
  * because every command is non-interactive. Paths are carried through exactly
  * as given and resolved by the caller.
  */
-export const COMMANDS = ['compile', 'seal', 'preflight'];
+export const COMMANDS = [
+    'compile',
+    'seal',
+    'preflight',
+    'score',
+];
 /** The input flags each command takes, and which of them it requires. */
 const INPUT_KEYS = {
     compile: ['in'],
     seal: ['in'],
     preflight: ['contract', 'probes', 'observations'],
+    score: [
+        'record',
+        'isolation-manifest',
+        'evaluator-configuration',
+        'contract',
+        'probe',
+        'preflight-verdict',
+        'policy',
+        'private-manifest',
+    ],
 };
-/** `--strict-inputs` is AD-4's compile mode; `preflight` has no compile step. */
+/**
+ * Keys whose absence is legal even though the command declares them: `in`
+ * falls back to stdin, and `score`'s three name artifacts that are genuinely
+ * optional at the domain level (AD-16's absent isolation manifest, an absent
+ * evaluator configuration, and an optional private-manifest no stage row
+ * requires).
+ */
+const OPTIONAL_INPUT_KEYS = new Set([
+    'in',
+    'isolation-manifest',
+    'evaluator-configuration',
+    'private-manifest',
+]);
+/** `--strict-inputs` is AD-4's compile mode; `preflight` and `score` have no compile step. */
 const TAKES_STRICT_INPUTS = {
     compile: true,
     seal: true,
     preflight: false,
+    score: false,
 };
-/** `--run-id` names the run a verdict is minted for, which only `preflight` does. */
+/** `--run-id` names the run a verdict is minted for, which only `preflight` does: `score` reads its run identifier off `--record` instead. */
 const TAKES_RUN_ID = {
     compile: false,
     seal: false,
     preflight: true,
+    score: false,
+};
+/** `--corpus-digest` supplies `score`'s one caller-attested scoring-version input with no artifact source; required whenever it applies, the same posture `--run-id` takes for `preflight`. */
+const TAKES_CORPUS_DIGEST = {
+    compile: false,
+    seal: false,
+    preflight: false,
+    score: true,
+};
+/** `--corpus-root` names the directory `score`'s corpus-port adapter resolves a private reference under; always optional at this layer, since whether one is actually needed depends on the artifacts' own content, not the argument grammar. */
+const TAKES_CORPUS_ROOT = {
+    compile: false,
+    seal: false,
+    preflight: false,
+    score: true,
 };
 const STDIN = '-';
 const isCommand = (token) => COMMANDS.includes(token);
@@ -63,10 +107,17 @@ function parseCommand(command, rest) {
     valueFlags.set('--out', 'out');
     if (TAKES_RUN_ID[command])
         valueFlags.set('--run-id', 'run-id');
+    if (TAKES_CORPUS_DIGEST[command]) {
+        valueFlags.set('--corpus-digest', 'corpus-digest');
+    }
+    if (TAKES_CORPUS_ROOT[command])
+        valueFlags.set('--corpus-root', 'corpus-root');
     const inputs = {};
     const seen = new Map();
     let out = null;
     let runId = null;
+    let corpusDigest = null;
+    let corpusRoot = null;
     let strictInputs = true;
     let strict = false;
     const takeValue = (flag, inline, index) => {
@@ -114,6 +165,10 @@ function parseCommand(command, rest) {
                 out = taken.value;
             else if (target === 'run-id')
                 runId = taken.value;
+            else if (target === 'corpus-digest')
+                corpusDigest = taken.value;
+            else if (target === 'corpus-root')
+                corpusRoot = taken.value;
             else
                 inputs[target] = taken.value;
             index = taken.next;
@@ -140,10 +195,13 @@ function parseCommand(command, rest) {
         return usageError(`unknown flag "${token}" for ${command}`);
     }
     const missing = INPUT_KEYS[command]
-        .filter((key) => key !== 'in' && inputs[key] === undefined)
+        .filter((key) => !OPTIONAL_INPUT_KEYS.has(key) && inputs[key] === undefined)
         .map((key) => `--${key}`);
     if (TAKES_RUN_ID[command] && runId === null)
         missing.push('--run-id');
+    if (TAKES_CORPUS_DIGEST[command] && corpusDigest === null) {
+        missing.push('--corpus-digest');
+    }
     // `PreflightVerdict.runId` is `z.string().min(1)`, which a run of spaces
     // satisfies. It then renders as blank in every diagnostic line and names
     // nothing a reader can correlate, so the argument surface refuses it here
@@ -163,5 +221,15 @@ function parseCommand(command, rest) {
             : `${flags.join(', ')} all name`;
         return usageError(`only one input may read stdin, but ${named} "-"`);
     }
-    return { kind: 'run', command, inputs, out, runId, strictInputs, strict };
+    return {
+        kind: 'run',
+        command,
+        inputs,
+        out,
+        runId,
+        corpusDigest,
+        corpusRoot,
+        strictInputs,
+        strict,
+    };
 }

package/dist/cli/exit-codes.d.ts

@@ -22,8 +22,12 @@ export type CommandOutcome = {
     readonly passed: boolean;
 } | {
     readonly kind: 'verdict';
-    readonly verdict: Verdict;
-    readonly evidenceConditionsOnly: boolean;
+    /** `null` is AD-21's Invalid rung: `LadderResolution.verdict` on that rung, never a `Verdict`. */
+    readonly verdict: Verdict | null;
+    /** `LadderResolution.exitCode`, read directly rather than recomputed from `verdict`. */
+    readonly exitCode: number;
+    /** `LadderResolution.strictPromotable`, carried through unchanged: never inverted into a locally-invented `evidenceConditionsOnly`. */
+    readonly strictPromotable: boolean;
 } | {
     readonly kind: 'structural-failure';
 } | {

package/dist/cli/exit-codes.js

@@ -7,17 +7,16 @@ export const EXIT_FAULT = 5;
 /** sysexits.h EX_USAGE. Outside the verdict range and outside AD-21's codes. */
 export const EXIT_USAGE = 64;
 function verdictExit(outcome, strict) {
-    if (outcome.verdict === 'FAIL')
-        return EXIT_FAIL;
-    // `--strict` promotes CONCERNS to one, "except a CONCERNS whose only firing
-    // conditions are evidence conditions, which `--strict` never promotes"
-    // (AD-21). A thinner measurement is not a claim about the system.
-    if (outcome.verdict === 'CONCERNS' &&
-        strict &&
-        !outcome.evidenceConditionsOnly) {
+    // `--strict` promotes a CONCERNS to one, "except a CONCERNS whose only
+    // firing conditions are evidence conditions, which `--strict` never
+    // promotes" (AD-21). `LADDER_EXIT_CODES.CONCERNS` is already zero, so this
+    // promotion cannot be read out of `outcome.exitCode` itself: it is applied
+    // on top of it. Every other rung -- PASS, WAIVED, FAIL, and Invalid's
+    // `null` -- returns its own `exitCode` unchanged.
+    if (outcome.verdict === 'CONCERNS' && strict && outcome.strictPromotable) {
         return EXIT_CONCERNS_PROMOTED;
     }
-    return EXIT_OK;
+    return outcome.exitCode;
 }
 export function exitCodeFor(outcome, options) {
     switch (outcome.kind) {

package/dist/cli/main.js

@@ -11,6 +11,7 @@
 import { mkdir, readFile, stat, writeFile } from 'node:fs/promises';
 import { dirname, join, resolve } from 'node:path';
 import process from 'node:process';
+import { createLocalCorpusAdapter } from '../adapters/local-corpus-adapter.js';
 import { parseArguments } from './arguments.js';
 import { exitCodeFor } from './exit-codes.js';
 import { renderError, renderUsage } from './render.js';
@@ -88,6 +89,14 @@ function environmentOf(version) {
                 return false;
             }
         },
+        // `score`'s corpus-port wiring: the one reference adapter, over a root
+        // known only once `--corpus-root` is parsed, which is why this is a
+        // factory rather than a constructed port.
+        corpusPort: (root) => createLocalCorpusAdapter({ root }),
+        // One controller per process invocation, never aborted here: no flag
+        // this binary parses requests cancellation, so the signal only ever
+        // answers "was this already aborted before the call" as false.
+        signal: new AbortController().signal,
         version,
     };
 }

package/dist/cli/render.d.ts

@@ -21,6 +21,6 @@ export declare function renderError(error: unknown): string;
  * AD-21's seven exit codes, one line each. The `--help` output and the README
  * table are this text, so the two cannot drift.
  */
-export declare const EXIT_CODE_TABLE = "Exit codes (AD-21):\n  0   success, and every verdict other than FAIL or a promoted CONCERNS\n  1   CONCERNS promoted by --strict\n  2   FAIL\n  3   invalid: a pre-flight verdict that did not pass\n  4   structural failure\n  5   runtime fault\n  64  usage error\n\n  1 and 2 report a scored verdict. Scoring ships in a later release, so no\n  command here reaches either yet, and --strict changes no code this binary\n  produces.";
+export declare const EXIT_CODE_TABLE = "Exit codes (AD-21):\n  0   success, and every verdict other than FAIL or a promoted CONCERNS\n  1   CONCERNS promoted by --strict\n  2   FAIL\n  3   invalid: a failed pre-flight, or any other AD-21 invalidating condition\n  4   structural failure\n  5   runtime fault\n  64  usage error\n\n  --strict never promotes a CONCERNS whose firing conditions are all evidence\n  conditions: those conditions report that the measurement fell short of the\n  policy. 1 and 2 report a verdict the score command's ladder resolved; every\n  other invalidating condition behind 3 is reachable there too, alongside the\n  failed pre-flight the preflight command itself reports.";
 /** `eval-quality: usage: <message>` */
 export declare function renderUsage(message: string): string;

package/dist/cli/render.js

@@ -39,14 +39,16 @@ export const EXIT_CODE_TABLE = `Exit codes (AD-21):
   0   success, and every verdict other than FAIL or a promoted CONCERNS
   1   CONCERNS promoted by --strict
   2   FAIL
-  3   invalid: a pre-flight verdict that did not pass
+  3   invalid: a failed pre-flight, or any other AD-21 invalidating condition
   4   structural failure
   5   runtime fault
   64  usage error
 
-  1 and 2 report a scored verdict. Scoring ships in a later release, so no
-  command here reaches either yet, and --strict changes no code this binary
-  produces.`;
+  --strict never promotes a CONCERNS whose firing conditions are all evidence
+  conditions: those conditions report that the measurement fell short of the
+  policy. 1 and 2 report a verdict the score command's ladder resolved; every
+  other invalidating condition behind 3 is reachable there too, alongside the
+  failed pre-flight the preflight command itself reports.`;
 /** `eval-quality: usage: <message>` */
 export function renderUsage(message) {
     return `${PREFIX}: usage: ${message}`;

package/dist/cli/run.d.ts

@@ -1,11 +1,11 @@
 /**
- * The three commands. Each one reads its inputs, makes exactly one call into
+ * The four commands. Each one reads its inputs, makes exactly one call into
  * `application/`, serializes what came back, and returns the outcome the exit
  * code is derived from. Every effect is a member of `RunEnvironment`, so this
  * module touches no stream, no `process`, and no Node builtin, and its tests
  * run in memory.
  */
-import { compile, preflightFromObservations, seal } from '../application/index.ts';
+import { compile, preflightFromObservations, type RunScoreOptions, runScore, seal } from '../application/index.ts';
 import type { Command, ParsedInvocation } from './arguments.ts';
 import type { CommandOutcome } from './exit-codes.ts';
 export type RunEnvironment = {
@@ -21,10 +21,19 @@ export type RunEnvironment = {
      * spellings that no amount of folding brings together.
      */
     readonly sameFile: (left: string, right: string) => Promise<boolean>;
+    /**
+     * `score`'s corpus-port factory over a caller-named root directory: a
+     * constructor, not a constructed value, since the root is only known once
+     * `--corpus-root` is parsed. `cli/` may not import `ports/` directly, so
+     * the port's own type is read off `RunScoreOptions` instead.
+     */
+    readonly corpusPort: (root: string) => NonNullable<RunScoreOptions['port']>;
+    /** One per process invocation, the same shape `RunPreflightOptions.signal` already declares. */
+    readonly signal: AbortSignal;
     readonly version: string;
 };
 /**
- * The three orchestration calls, behind one object so a test can count them.
+ * The four orchestration calls, behind one object so a test can count them.
  * An input/output count says nothing about how many calls into `application/`
  * happened, which is the property AD-14 constrains.
  */
@@ -32,6 +41,7 @@ export type ApplicationFacade = {
     readonly compile: typeof compile;
     readonly seal: typeof seal;
     readonly preflightFromObservations: typeof preflightFromObservations;
+    readonly runScore: typeof runScore;
 };
 export declare const APPLICATION: ApplicationFacade;
 export type RunResult = {

package/dist/cli/run.js

@@ -1,16 +1,17 @@
 /**
- * The three commands. Each one reads its inputs, makes exactly one call into
+ * The four commands. Each one reads its inputs, makes exactly one call into
  * `application/`, serializes what came back, and returns the outcome the exit
  * code is derived from. Every effect is a member of `RunEnvironment`, so this
  * module touches no stream, no `process`, and no Node builtin, and its tests
  * run in memory.
  */
-import { compile, preflightFromObservations, RuntimeFault, StructuralFailure, seal, } from '../application/index.js';
+import { compile, preflightFromObservations, RuntimeFault, runScore, StructuralFailure, seal, } from '../application/index.js';
 import { EXIT_CODE_TABLE, renderArtifact, renderDiagnostic, renderError, renderUsage, } from './render.js';
 export const APPLICATION = {
     compile,
     seal,
     preflightFromObservations,
+    runScore,
 };
 /** The artifact each command emits: its schema name and its file name. */
 const EMITTED = {
@@ -20,6 +21,7 @@ const EMITTED = {
         kind: 'sealed-evaluator-brief',
     },
     preflight: { artifactPath: 'PreflightVerdict', kind: 'preflight-verdict' },
+    score: { artifactPath: 'EvidenceArtifact', kind: 'evidence-artifact' },
 };
 /** The schema an input key deserializes into, for the parse fault's path. */
 const INPUT_ARTIFACT_PATH = {
@@ -27,6 +29,13 @@ const INPUT_ARTIFACT_PATH = {
     contract: 'EvalContract',
     probes: 'Probe',
     observations: 'ProbeObservation',
+    record: 'SealedRunRecord',
+    'isolation-manifest': 'IsolationManifest',
+    'evaluator-configuration': 'EvaluatorConfiguration',
+    probe: 'Probe',
+    'preflight-verdict': 'PreflightVerdict',
+    policy: 'ScoringPolicy',
+    'private-manifest': 'PrivateArtifactManifest',
 };
 const USAGE = `Usage:
   eval-quality compile          [--in <path>] [--out <target>]
@@ -35,6 +44,12 @@ const USAGE = `Usage:
                                 [--strict-inputs | --no-strict-inputs] [--strict]
   eval-quality preflight         --contract <path> --probes <path> --observations <path>
                                  --run-id <id> [--out <target>] [--strict]
+  eval-quality score             --record <path> --contract <path> --probe <path>
+                                  --preflight-verdict <path> --policy <path>
+                                  --corpus-digest <digest>
+                                  [--isolation-manifest <path>] [--evaluator-configuration <path>]
+                                  [--private-manifest <path>] [--corpus-root <dir>]
+                                  [--out <target>] [--strict]
   eval-quality --help | -h | help [<command>]
   eval-quality --version | -V`;
 const COMMAND_USAGE = {
@@ -66,10 +81,36 @@ const COMMAND_USAGE = {
   --run-id <id>            the run identifier the verdict is minted for
   --out <target>           a .json file path, or a directory taking preflight-verdict.json
   --strict                 promote CONCERNS to exit 1`,
+    score: `Usage:
+  eval-quality score             --record <path> --contract <path> --probe <path>
+                                  --preflight-verdict <path> --policy <path>
+                                  --corpus-digest <digest>
+                                  [--isolation-manifest <path>] [--evaluator-configuration <path>]
+                                  [--private-manifest <path>] [--corpus-root <dir>]
+                                  [--out <target>] [--strict]
+
+  --record <path>                   the sealed run record to ingest
+  --contract <path>                 the compiled contract to score against
+  --probe <path>                    the probe the record was run against
+  --preflight-verdict <path>        the pre-flight verdict, also the source of the AD-11 fixture digest
+  --policy <path>                   the scoring policy
+  --corpus-digest <digest>          AD-11's caller-attested corpus digest; no artifact carries it
+  --isolation-manifest <path>       the isolation manifest; absent invalidates the run under AD-16
+  --evaluator-configuration <path>  the evaluator configuration; absent invalidates the run
+  --private-manifest <path>         each entry's digest is checked against its resolved bytes
+  --corpus-root <dir>               the directory a private reference resolves under; required only
+                                     when --private-manifest or a private-storage isolation-manifest
+                                     reference is present
+  --out <target>                    a .json file path, or a directory taking evidence-artifact.json
+  --strict                          promote CONCERNS to exit 1`,
 };
 const IO_RULES = `Inputs and outputs:
-  An input flag left out reads stdin, and "-" names stdin explicitly; at most
-  one input may be "-". Without --out the artifact goes to stdout. An --out
+  --in is the only input that falls back to stdin: compile and seal read it
+  when --in is left out. "-" names stdin explicitly on any input, and at most
+  one input may be "-" per invocation. compile and seal each take one input;
+  preflight takes three, all required; score takes eight, three of them
+  optional (--isolation-manifest, --evaluator-configuration, and
+  --private-manifest). Without --out the artifact goes to stdout. An --out
   ending in .json is a file path; anything else is a directory taking
   <target>/<kind>.json. Diagnostics and errors go to stderr.`;
 export function helpText(command) {
@@ -155,19 +196,32 @@ async function runCommand(invocation, environment, application) {
         }
     }
     try {
-        if (command === 'preflight') {
-            const verdict = await runPreflightCommand(invocation, environment, application, target);
-            return { outcome: { kind: 'preflight', passed: verdict.passed } };
+        // Exhaustive over `Command`, not a fallthrough: a fifth command with no
+        // case here is a compile error ("not all code paths return a value"),
+        // never a silent seal. `compile` and `seal` share one case body, and the
+        // ternary inside it is itself exhaustive over the narrowed two-member
+        // union the shared case leaves `command` as.
+        switch (command) {
+            case 'preflight': {
+                const verdict = await runPreflightCommand(invocation, environment, application, target);
+                return { outcome: { kind: 'preflight', passed: verdict.passed } };
+            }
+            case 'score':
+                return await runScoreCommand(invocation, environment, application, target);
+            case 'compile':
+            case 'seal': {
+                const input = await readJson(environment, 'in', inputs.in);
+                const options = { strict: strictInputs };
+                const artifact = command === 'compile'
+                    ? application.compile(input, options)
+                    : application.seal(input, options);
+                // No diagnostic on success: neither command carries a run
+                // identifier, so any line either wrote would name no run and no
+                // stage.
+                await emitArtifact(environment, artifact, command, target);
+                return { outcome: { kind: 'artifact' } };
+            }
         }
-        const input = await readJson(environment, 'in', inputs.in);
-        const options = { strict: strictInputs };
-        const artifact = command === 'compile'
-            ? application.compile(input, options)
-            : application.seal(input, options);
-        // No diagnostic on success: neither command carries a run identifier,
-        // so any line either wrote would name no run and no stage.
-        await emitArtifact(environment, artifact, command, target);
-        return { outcome: { kind: 'artifact' } };
     }
     catch (error) {
         if (error instanceof StructuralFailure) {
@@ -201,3 +255,69 @@ async function runPreflightCommand(invocation, environment, application, target)
     await emitArtifact(environment, verdict, 'preflight', target);
     return verdict;
 }
+/** `undefined` means the optional flag was not given; unlike `'in'`, none of `score`'s three optional inputs falls back to stdin. */
+async function readOptionalJson(environment, key, value) {
+    return value === undefined ? null : await readJson(environment, key, value);
+}
+/**
+ * Whether `score` needs a `CorpusPort` at all: a `--private-manifest` with at
+ * least one entry, or a private-storage `isolationManifestArtifact`. Read off
+ * unvalidated JSON with optional chaining throughout -- a malformed shape
+ * here simply reads `undefined` and falls through to `application.runScore`'s
+ * own real parse, which raises the accurate `schema-parse-failure` rather
+ * than this pre-check inventing one.
+ */
+function needsCorpusPort(record, privateManifest) {
+    const manifest = privateManifest;
+    if (manifest !== null && (manifest.entries?.length ?? 0) > 0)
+        return true;
+    const typedRecord = record;
+    return typedRecord?.isolationManifestArtifact?.storage === 'private';
+}
+/** `CommandOutcome`'s `'verdict'` kind, read straight off `LadderResolution`: no inversion, no recomputation. */
+function scoreOutcomeOf(ladder) {
+    return {
+        kind: 'verdict',
+        verdict: ladder.verdict,
+        exitCode: ladder.exitCode,
+        strictPromotable: ladder.strictPromotable,
+    };
+}
+async function runScoreCommand(invocation, environment, application, target) {
+    const { inputs, corpusDigest, corpusRoot } = invocation;
+    const record = (await readJson(environment, 'record', inputs.record));
+    const manifest = (await readOptionalJson(environment, 'isolation-manifest', inputs['isolation-manifest']));
+    const configuration = (await readOptionalJson(environment, 'evaluator-configuration', inputs['evaluator-configuration']));
+    const contract = (await readJson(environment, 'contract', inputs.contract));
+    const probe = (await readJson(environment, 'probe', inputs.probe));
+    const preflightVerdict = (await readJson(environment, 'preflight-verdict', inputs['preflight-verdict']));
+    const policy = (await readJson(environment, 'policy', inputs.policy));
+    const privateManifest = (await readOptionalJson(environment, 'private-manifest', inputs['private-manifest']));
+    // A private reference with no `--corpus-root` to resolve it under is a
+    // usage error naming the missing flag, not a silently skipped check.
+    // `application.runScore` never returns `usage-error` itself (that
+    // vocabulary is `cli/`'s alone), so this is checked here, before the call.
+    if (corpusRoot === null && needsCorpusPort(record, privateManifest)) {
+        environment.writeDiagnostic(renderUsage('--corpus-root is required to resolve a --private-manifest entry or a private-storage isolationManifestArtifact reference'));
+        return { outcome: { kind: 'usage-error' } };
+    }
+    const result = await application.runScore({
+        record,
+        manifest,
+        configuration,
+        contract,
+        probe,
+        preflightVerdict,
+        policy,
+        privateManifest,
+        // The parser requires `--corpus-digest` on this command, so it is
+        // never null.
+        corpusDigest: corpusDigest ?? '',
+        port: corpusRoot === null ? undefined : environment.corpusPort(corpusRoot),
+        signal: environment.signal,
+    });
+    if (result.artifact !== null) {
+        await emitArtifact(environment, result.artifact, 'score', target);
+    }
+    return { outcome: scoreOutcomeOf(result.ladder) };
+}

package/dist/core/canonical/canonicalize.d.ts

@@ -1 +1,13 @@
 export declare function canonicalize(value: unknown, artifactPath: string): Uint8Array;
+/**
+ * The RFC 8785 string form, exported because AD-40's quotation audit projects a
+ * structured evidence channel to text and asks for the quoted evidence as an
+ * exact substring of it. `canonicalize` returns a `Uint8Array` and `core/` may
+ * import no Node builtin, so decoding those bytes back is not available; the
+ * string is what already exists one call in.
+ *
+ * Two parameters, the same two `canonicalize` takes. The traversal state is
+ * seeded here and reachable nowhere else, so no caller can hand in a primed
+ * ancestor set or a depth that starts the AD-36 nesting guard part-spent.
+ */
+export declare function serialize(value: unknown, artifactPath: string): string;

package/dist/core/canonical/canonicalize.js

@@ -11,12 +11,26 @@ import { assertDomainNumber, assertDomainString, MAX_NESTING_DEPTH, } from './va
 // lying Proxy could answer the emit-time read differently than the
 // validation read.
 export function canonicalize(value, artifactPath) {
-    return new TextEncoder().encode(serialize(value, artifactPath, '$', new Set(), 0));
+    return new TextEncoder().encode(serialize(value, artifactPath));
 }
 const fault = (artifactPath, detail) => {
     throw new RuntimeFault('non-canonicalizable-value', artifactPath, detail);
 };
-function serialize(value, artifactPath, location, ancestors, depth) {
+/**
+ * The RFC 8785 string form, exported because AD-40's quotation audit projects a
+ * structured evidence channel to text and asks for the quoted evidence as an
+ * exact substring of it. `canonicalize` returns a `Uint8Array` and `core/` may
+ * import no Node builtin, so decoding those bytes back is not available; the
+ * string is what already exists one call in.
+ *
+ * Two parameters, the same two `canonicalize` takes. The traversal state is
+ * seeded here and reachable nowhere else, so no caller can hand in a primed
+ * ancestor set or a depth that starts the AD-36 nesting guard part-spent.
+ */
+export function serialize(value, artifactPath) {
+    return serializeNode(value, artifactPath, '$', new Set(), 0);
+}
+function serializeNode(value, artifactPath, location, ancestors, depth) {
     if (value === null)
         return 'null';
     switch (typeof value) {
@@ -75,7 +89,7 @@ function serialize(value, artifactPath, location, ancestors, depth) {
             fault(artifactPath, `array with holes or non-index properties at ${location}`);
         }
         rendered = `[${elements
-            .map((element, index) => serialize(element, artifactPath, `${location}[${index}]`, ancestors, depth + 1))
+            .map((element, index) => serializeNode(element, artifactPath, `${location}[${index}]`, ancestors, depth + 1))
             .join(',')}]`;
     }
     else {
@@ -105,7 +119,7 @@ function serialize(value, artifactPath, location, ancestors, depth) {
         // never localeCompare, never Intl, never .normalize().
         properties.sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
         rendered = `{${properties
-            .map(([key, entry]) => `${JSON.stringify(key)}:${serialize(entry, artifactPath, `${location}.${key}`, ancestors, depth + 1)}`)
+            .map(([key, entry]) => `${JSON.stringify(key)}:${serializeNode(entry, artifactPath, `${location}.${key}`, ancestors, depth + 1)}`)
             .join(',')}}`;
     }
     ancestors.delete(object);

package/dist/core/compile/bindings.d.ts

@@ -0,0 +1,70 @@
+import type { EvalContract } from '../schemas/eval-contract.ts';
+import type { InteractionStep } from '../schemas/plan.ts';
+import { type TransportChannelName } from '../schemas/pointer.ts';
+import { type EvidenceTarget } from '../seal/plan-index.ts';
+/** One `{ captured }` binding, resolved to the pointer target it addresses. */
+export type CapturedBinding = {
+    readonly transportChannel: TransportChannelName;
+    readonly key: string;
+    readonly pointer: string;
+    readonly target: EvidenceTarget;
+};
+/**
+ * Every captured binding one step declares, in fixed transport-channel order
+ * then by key name, so which binding a check reports never depends on a
+ * caller-keyed map's insertion order. Exported because `score/binding-order.ts`
+ * and `score/bindings.ts` need the same reading of which bindings are captures.
+ */
+export declare function capturedBindings(step: InteractionStep): readonly CapturedBinding[];
+/**
+ * `binding-cycle`: a cycle over the union of the capture edges and AD-39's
+ * `after` edges that contains at least one capture edge.
+ *
+ * Both edge kinds assert that this step's observation comes after that one, so
+ * a capture B to A together with `A.after = B` is an unsatisfiable ordering
+ * while each graph alone stays acyclic. A cycle made only of `after` edges is
+ * left to `checkNestedTemporalClause`, which already catches every one of them,
+ * so requiring a capture edge in the cycle keeps the two codes disjoint.
+ *
+ * Decided by strongly connected components rather than by a depth-first walk
+ * that inspects each back edge. A cycle lies entirely inside one component, and
+ * a capture edge whose endpoints share a component is closed by a path back
+ * through that component, so "some cycle contains a capture edge" is exactly
+ * "some capture edge has both endpoints in one component". A self-capture is
+ * the singleton case and needs no rule of its own. The depth-first form was
+ * written first and rejected: settling a node after rejecting a pure-`after`
+ * back edge can hide a mixed cycle a later root would reach, and whether it
+ * does depends on the order edges happen to be enumerated in, which is an
+ * invariant nothing states.
+ *
+ * Nodes are the plan's declared step ids; an edge whose target no step declares
+ * is dropped, since a dangling reference is not a cycle and AD-39 makes a
+ * dangling `after` permissive besides. The binding reported is the first, in
+ * the plan's own declaration order, whose endpoints share a component.
+ */
+export declare function checkBindingCycle(contract: EvalContract): void;
+/**
+ * `captured-channel-undeclared`: a captured pointer naming any AD-26 channel
+ * but `response-body`. `call-inputs` addresses a step's own request,
+ * `stdout`, `stderr`, and `exit-code` are process channels no operation
+ * surviving `unsupported-interface-kind` produces, and `response-headers` and
+ * `response-status` have no declared structure to give a captured value a
+ * type.
+ */
+export declare function checkCapturedChannel(contract: EvalContract): void;
+/**
+ * `unreachable-check-evidence` over the captured-pointer residue: an
+ * unresolvable step or operation, an undeclared body key, a tail that is not
+ * exactly one segment, an array index, an absent, indeterminate, or non-scalar
+ * declared type, and a declared type that does not equal the bound
+ * parameter's.
+ *
+ * A capture naming another channel is reported here only for the two conditions
+ * that are decidable without a response descriptor: an unresolvable step and an
+ * unresolvable operation. Everything else about such a pointer is
+ * `checkCapturedChannel`'s. That split is what lets this check run at the
+ * registry's third rung without shadowing the fifteenth, and it keeps the
+ * higher-ranked code first on a pointer that is unresolvable and off-body at
+ * once.
+ */
+export declare function checkCapturedReachability(contract: EvalContract): void;