eval-quality 0.1.0 → 0.2.0

package/dist/core/ingest/conditions.d.ts

@@ -0,0 +1,201 @@
+/**
+ * The eleven conditions `core/ingest` detects, and the ladder input each one
+ * feeds.
+ *
+ * Each condition is a cross-artifact rule a shipped schema names `core/ingest`
+ * as the enforcement point for, and none of them is a parse failure: the
+ * artifacts arrive already parsed, and a rule two conforming artifacts break
+ * between them is a finding about the run rather than a rejection of its bytes.
+ *
+ * The kinds are a runtime tuple first and the union draws from it, the idiom
+ * `RUNTIME_FAULT_CODES`, `FORBIDDEN_INPUT_FLOOR`, and `ORACLE_DISPOSITIONS` are
+ * written in. A union's `kind` literals are erased at compile time, so a drift
+ * check over a bare union could only compare the mapping below against itself or
+ * against a hand-written second list, which is the drift it exists to catch.
+ *
+ * `ladder.ts` is imported type-only on purpose. `isolatedModules` without
+ * `verbatimModuleSyntax` compiles a value import used only in type position
+ * silently, which would put the whole ladder module on this module's runtime
+ * load path; `preflight/reduce.ts` imports `ReduceStage` the same way.
+ */
+import type { ForbiddenInput } from '../schemas/eval-contract.ts';
+import type { EvidenceIntegrityInputs, OutcomeStateInputs } from '../score/ladder.ts';
+import type { UnwitnessedQuotation } from '../score/quotation.ts';
+/**
+ * The eleven kinds, in the order `ingest` records them. The two isolation-family
+ * kinds and the two evaluator-configuration ones are sequenced here; the order
+ * of the values inside one `isolation-manifest-violation` is the manifest's own
+ * array order and belongs to the stage, not to this tuple.
+ */
+export declare const INGEST_CONDITION_KINDS: readonly ['duplicate-record-identifier', 'dangling-citation', 'dangling-disposition-citation', 'unwitnessed-quotation', 'isolation-manifest-absent', 'isolation-manifest-violation', 'forbidden-input-not-withheld', 'cross-artifact-disagreement', 'evaluator-configuration-absent', 'evaluator-configuration-digest-mismatch', 'judge-result-unscored'];
+export type IngestConditionKind = (typeof INGEST_CONDITION_KINDS)[number];
+/**
+ * The three fields AD-32 requires the sealed run record and the isolation
+ * manifest to agree on, in the order a disagreement is reported.
+ *
+ * `conditionArm` sits on both artifacts and is deliberately excluded: both
+ * schemas describe it as "an opaque caller label with no product semantics, per
+ * AD-24", so making a mismatch invalidate would mint a normative rule with no
+ * AD behind it and would be the one invalidating condition in the design with
+ * nothing downstream reading it.
+ */
+export declare const AGREEMENT_FIELDS: readonly ['runId', 'contractDigest', 'evaluatorConfigurationDigest'];
+export type AgreementField = (typeof AGREEMENT_FIELDS)[number];
+/**
+ * An identifier the record uses twice where everything downstream addresses by
+ * it once.
+ *
+ * `SealedRunRecord` refines exactly one array for uniqueness, and it refines it
+ * on `sequence` rather than on an identifier, so all three of `observationId`,
+ * `findingId`, and `oracleId` may repeat in a record that parses. Nothing
+ * downstream can then tell the pair apart: `verdictBasis` names a finding by its
+ * identifier, `FindingConfidence` is keyed by it, `resolveOutcome` reads one
+ * disposition per oracle, and `auditQuotation` indexes observations into a `Map`
+ * keyed on `observationId`, which is last-write-wins. Recorded rather than
+ * repaired, because choosing which of two entries an identifier means is not a
+ * choice this stage can make.
+ *
+ * The observation case is the one with teeth. A repeated `observationId` decides
+ * which body a quotation is checked against, so it changes whether a defect
+ * finding's evidence is witnessed at all, which is the AD-32
+ * declared-versus-observed property this stage exists to check. The other two
+ * change an order; this one changes an answer.
+ *
+ * It is also what makes the product's `findings` and `dispositions` order total,
+ * and `unwitnessedQuotations` a function of the record's content, in every
+ * record that does not carry this condition.
+ */
+export type DuplicateRecordIdentifier = {
+    readonly kind: Extract<IngestConditionKind, 'duplicate-record-identifier'>;
+    readonly subject: 'observation' | 'finding' | 'oracle-disposition';
+    readonly identifier: string;
+    readonly occurrences: number;
+};
+/**
+ * A finding citing an observation identifier the record does not declare. One
+ * per finding, carrying every identifier that resolved to nothing, so a
+ * consumer never has to re-derive which half of the citation was bad.
+ */
+export type DanglingCitation = {
+    readonly kind: Extract<IngestConditionKind, 'dangling-citation'>;
+    readonly findingId: string;
+    readonly unresolvedObservationIds: readonly string[];
+};
+/**
+ * A disposition citing an observation identifier the record does not declare.
+ *
+ * The record's second citation site, and the one nothing else reads. AD-33 wants
+ * "every disposition citing supporting observations, and an unsupported
+ * disposition invalidating cross-artifact agreement rather than being believed";
+ * `resolveOutcome`'s `unsupported-disposition` covers the empty list only, so a
+ * `violated` disposition corroborated by a citation to nothing would otherwise
+ * be believed. Ingest is the only stage holding the dispositions and the
+ * observations at once.
+ */
+export type DanglingDispositionCitation = {
+    readonly kind: Extract<IngestConditionKind, 'dangling-disposition-citation'>;
+    readonly oracleId: string;
+    readonly unresolvedObservationIds: readonly string[];
+};
+/**
+ * The quotation audit's own return value, unchanged. `auditQuotation` already
+ * shapes the payload its consumer declares, so re-projecting it here would be a
+ * second spelling of one result.
+ */
+export type UnwitnessedQuotationCondition = {
+    readonly kind: Extract<IngestConditionKind, 'unwitnessed-quotation'>;
+    readonly quotations: readonly UnwitnessedQuotation[];
+};
+/**
+ * AD-16's absent manifest. No payload: there is no artifact to describe, which
+ * is why no schema can carry this rule and why the manifest's own `.meta` hands
+ * the violating case to `core/ingest`.
+ */
+export type IsolationManifestAbsent = {
+    readonly kind: Extract<IngestConditionKind, 'isolation-manifest-absent'>;
+};
+/**
+ * A declared violation, an observed mount, network target, or tool call outside
+ * its allowlist, or any combination. One condition rather than four, each
+ * exceeded allowlist carrying its own offending values in the manifest's array
+ * order, so a consumer reads values rather than parsing them back out of a
+ * joined summary.
+ */
+export type IsolationManifestViolation = {
+    readonly kind: Extract<IngestConditionKind, 'isolation-manifest-violation'>;
+    readonly violation: string | null;
+    readonly mountsOutsideAllowlist: readonly string[];
+    readonly networkTargetsOutsideAllowlist: readonly string[];
+    readonly toolCallsOutsideAllowlist: readonly string[];
+};
+/**
+ * AD-16's first clause: a prohibited input the manifest accounts for with
+ * `withheld: false`. Named in `FORBIDDEN_INPUT_FLOOR` order, since that list is
+ * the floor's one home and the manifest's key order is the caller's.
+ */
+export type ForbiddenInputNotWithheld = {
+    readonly kind: Extract<IngestConditionKind, 'forbidden-input-not-withheld'>;
+    readonly inputs: readonly ForbiddenInput[];
+};
+/**
+ * One field the two artifacts disagree on, carrying both values. Per field
+ * rather than per record: a run whose two artifacts disagree about which
+ * configuration produced it is a different finding from one that disagrees
+ * about which run it is.
+ */
+export type CrossArtifactDisagreement = {
+    readonly kind: Extract<IngestConditionKind, 'cross-artifact-disagreement'>;
+    readonly field: AgreementField;
+    readonly recordValue: string;
+    readonly manifestValue: string;
+};
+/**
+ * AD-24's absent evaluator configuration. No payload, for the same reason
+ * `IsolationManifestAbsent` carries none: there is no artifact to describe.
+ */
+export type EvaluatorConfigurationAbsent = {
+    readonly kind: Extract<IngestConditionKind, 'evaluator-configuration-absent'>;
+};
+/**
+ * The digest the record declares for the evaluator configuration against the
+ * one that artifact actually produces.
+ *
+ * The operand is the record's declaration. A disagreement between the record's
+ * and the manifest's declarations is already `cross-artifact-disagreement`, and
+ * what this condition adds is the half AD-32 calls the trust boundary: both
+ * declarations are caller-attested, and only the recomputation reads the
+ * artifact.
+ */
+export type EvaluatorConfigurationDigestMismatch = {
+    readonly kind: Extract<IngestConditionKind, 'evaluator-configuration-digest-mismatch'>;
+    readonly declaredDigest: string;
+    readonly computedDigest: string;
+};
+/**
+ * AD-17's record-decidable half: a judge result carrying `score: null`. The
+ * other half, that the criterion is one the cited rubric declares, needs the
+ * rubric, which no stage row declares as an input.
+ */
+export type JudgeResultUnscored = {
+    readonly kind: Extract<IngestConditionKind, 'judge-result-unscored'>;
+    readonly rubricId: string;
+    readonly criterionId: string;
+};
+export type IngestCondition = DuplicateRecordIdentifier | DanglingCitation | DanglingDispositionCitation | UnwitnessedQuotationCondition | IsolationManifestAbsent | IsolationManifestViolation | ForbiddenInputNotWithheld | CrossArtifactDisagreement | EvaluatorConfigurationAbsent | EvaluatorConfigurationDigestMismatch | JudgeResultUnscored;
+/**
+ * The ladder field a condition feeds. Every one of the eleven kinds now
+ * carries a rung, so the union below names all ten `EvidenceIntegrityInputs`
+ * fields that carry an ingest condition and `null` is dropped entirely: a
+ * kind with no rung is a compile error now, not a documented gap.
+ *
+ * Ten pairs built with `Extract` rather than a bare `keyof` product: the
+ * product would also pull in fields like `internallyInconsistent`, whose row
+ * is FAIL and whose guard reads "internally inconsistent under AD-17" rather
+ * than reading an `IngestCondition`, and a bare key would lose which of the
+ * two input types a member came from. Renaming a field in `ladder.ts`
+ * collapses its branch here to `never`, so the mapping below stops compiling
+ * instead of pointing at a field that no longer exists.
+ */
+export type LadderTarget = Extract<keyof EvidenceIntegrityInputs, 'isolationViolation'> | Extract<keyof OutcomeStateInputs, 'unwitnessedQuotations'> | Extract<keyof EvidenceIntegrityInputs, 'duplicateRecordIdentifiers'> | Extract<keyof EvidenceIntegrityInputs, 'danglingCitations'> | Extract<keyof EvidenceIntegrityInputs, 'danglingDispositionCitations'> | Extract<keyof EvidenceIntegrityInputs, 'forbiddenInputsNotWithheld'> | Extract<keyof EvidenceIntegrityInputs, 'crossArtifactDisagreements'> | Extract<keyof EvidenceIntegrityInputs, 'evaluatorConfigurationAbsent'> | Extract<keyof EvidenceIntegrityInputs, 'evaluatorConfigurationDigestMismatches'> | Extract<keyof EvidenceIntegrityInputs, 'judgeResultsUnscored'>;
+/** Total over the kinds tuple: a new kind fails to compile until it declares its rung. */
+export declare const LADDER_TARGETS: Record<IngestConditionKind, LadderTarget>;

package/dist/core/ingest/conditions.js

@@ -0,0 +1,48 @@
+/**
+ * The eleven kinds, in the order `ingest` records them. The two isolation-family
+ * kinds and the two evaluator-configuration ones are sequenced here; the order
+ * of the values inside one `isolation-manifest-violation` is the manifest's own
+ * array order and belongs to the stage, not to this tuple.
+ */
+export const INGEST_CONDITION_KINDS = [
+    'duplicate-record-identifier',
+    'dangling-citation',
+    'dangling-disposition-citation',
+    'unwitnessed-quotation',
+    'isolation-manifest-absent',
+    'isolation-manifest-violation',
+    'forbidden-input-not-withheld',
+    'cross-artifact-disagreement',
+    'evaluator-configuration-absent',
+    'evaluator-configuration-digest-mismatch',
+    'judge-result-unscored',
+];
+/**
+ * The three fields AD-32 requires the sealed run record and the isolation
+ * manifest to agree on, in the order a disagreement is reported.
+ *
+ * `conditionArm` sits on both artifacts and is deliberately excluded: both
+ * schemas describe it as "an opaque caller label with no product semantics, per
+ * AD-24", so making a mismatch invalidate would mint a normative rule with no
+ * AD behind it and would be the one invalidating condition in the design with
+ * nothing downstream reading it.
+ */
+export const AGREEMENT_FIELDS = [
+    'runId',
+    'contractDigest',
+    'evaluatorConfigurationDigest',
+];
+/** Total over the kinds tuple: a new kind fails to compile until it declares its rung. */
+export const LADDER_TARGETS = {
+    'duplicate-record-identifier': 'duplicateRecordIdentifiers',
+    'dangling-citation': 'danglingCitations',
+    'dangling-disposition-citation': 'danglingDispositionCitations',
+    'unwitnessed-quotation': 'unwitnessedQuotations',
+    'isolation-manifest-absent': 'isolationViolation',
+    'isolation-manifest-violation': 'isolationViolation',
+    'forbidden-input-not-withheld': 'forbiddenInputsNotWithheld',
+    'cross-artifact-disagreement': 'crossArtifactDisagreements',
+    'evaluator-configuration-absent': 'evaluatorConfigurationAbsent',
+    'evaluator-configuration-digest-mismatch': 'evaluatorConfigurationDigestMismatches',
+    'judge-result-unscored': 'judgeResultsUnscored',
+};

package/dist/core/ingest/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The ingest stage's surface for the rest of `core/`: the stage itself, the
+ * product it owns, the condition vocabulary, and the ladder input each
+ * condition feeds.
+ *
+ * Nothing here reaches `src/index.ts` or `src/application/index.ts`.
+ * `validated-observations` is an internal stage product AD-24 exempts from
+ * publication, so it has no schema, no registry entry, and no published type.
+ */
+export type { AgreementField, CrossArtifactDisagreement, DanglingCitation, DanglingDispositionCitation, DuplicateRecordIdentifier, EvaluatorConfigurationAbsent, EvaluatorConfigurationDigestMismatch, ForbiddenInputNotWithheld, IngestCondition, IngestConditionKind, IsolationManifestAbsent, IsolationManifestViolation, JudgeResultUnscored, LadderTarget, UnwitnessedQuotationCondition, } from './conditions.ts';
+export { AGREEMENT_FIELDS, INGEST_CONDITION_KINDS, LADDER_TARGETS, } from './conditions.ts';
+export type { ValidatedObservations } from './ingest.ts';
+export { ingest } from './ingest.ts';

package/dist/core/ingest/index.js

@@ -0,0 +1,11 @@
+/**
+ * The ingest stage's surface for the rest of `core/`: the stage itself, the
+ * product it owns, the condition vocabulary, and the ladder input each
+ * condition feeds.
+ *
+ * Nothing here reaches `src/index.ts` or `src/application/index.ts`.
+ * `validated-observations` is an internal stage product AD-24 exempts from
+ * publication, so it has no schema, no registry entry, and no published type.
+ */
+export { AGREEMENT_FIELDS, INGEST_CONDITION_KINDS, LADDER_TARGETS, } from './conditions.js';
+export { ingest } from './ingest.js';

package/dist/core/ingest/ingest.d.ts

@@ -0,0 +1,68 @@
+import type { Observation, OracleDisposition, RunModeValue, SealedRunRecord } from '../schemas/sealed-run-record.ts';
+import type { EvaluatorRecommendation } from '../schemas/verdict.ts';
+import { type UnwitnessedQuotation } from '../score/quotation.ts';
+import type { IngestStage } from '../stage-contracts.ts';
+import { type IngestCondition } from './conditions.ts';
+/**
+ * `validated-observations`, the internal product AD-24 exempts from
+ * publication: a TypeScript type with no Zod schema, no registry entry, and no
+ * `schemaVersion`.
+ *
+ * `unwitnessedQuotations` and `isolationViolation` are derived here rather than
+ * left for the next stage to rebuild out of condition entries, because both are
+ * shapes the ladder already declares.
+ *
+ * The three carried arrays are copies and their elements are not: an
+ * observation, a finding, or a disposition on this product is the same object
+ * the record holds. The stage is pure and mutates nothing, so a caller that also
+ * does not mutate the record it passed in sees a stable product; deep-copying
+ * every observation to defend against a caller mutating its own input is a cost
+ * no consumer in this package asks for. `isolationViolation` is a list where
+ * `EvidenceIntegrityInputs` still declares one nullable string: the ladder's own
+ * row type says a multi-entry `reasons` "names each affected oracle, gap, or
+ * finding separately, matching AD-21's 'the record carries every condition that
+ * fired'", so the single-valued field is the shape that is wrong. Collapsing to
+ * it here would mean inventing a separator and an ordering rule that the field's
+ * widening then deletes.
+ */
+export type ValidatedObservations = {
+    /** `record.runId`, restated for the same reason `mode` is: `score.ts` reads it off the first trial to build `emit`'s own `runId` field, and no later stage may re-derive or default it. */
+    readonly runId: string;
+    readonly mode: RunModeValue;
+    /**
+     * `AssessmentCommon.evaluatorRecommendation` (`score/ladder.ts:107`) is
+     * required and two shared ladder rows read it directly; nothing before
+     * this field supplied it to anything score-shaped. Read off
+     * `record.evaluatorRecommendation` the same way `mode` already is above:
+     * restated, never derived, recomputed, or defaulted.
+     */
+    readonly evaluatorRecommendation: EvaluatorRecommendation;
+    /** ascending `sequence`, then `observationId`, so the record's array order is never what a consumer reads. */
+    readonly observations: readonly Observation[];
+    /** ascending `findingId`; entries sharing one keep their presented order, which is all the record supplies. */
+    readonly findings: readonly SealedRunRecord['findings'][number][];
+    /** ascending `oracleId`, on the same terms as `findings`. */
+    readonly dispositions: readonly OracleDisposition[];
+    readonly conditions: readonly IngestCondition[];
+    readonly unwitnessedQuotations: readonly UnwitnessedQuotation[];
+    /** empty when nothing fired; one entry per offending value, never a joined summary. */
+    readonly isolationViolation: readonly string[];
+};
+/**
+ * The stage. Reads nothing outside its three declared inputs: a rule needing
+ * the eval contract, the rubric, or bytes resolved through the corpus port is
+ * routed to whoever declares them rather than absorbed here on the strength of
+ * being nearby.
+ *
+ * Two rules read the evaluator configuration and they are separate. AD-32's
+ * agreement rule compares the digest the record declares against the one the
+ * manifest declares, which is `cross-artifact-disagreement` and never reads the
+ * artifact. AD-24 and AD-11 require the digest to be recomputed from the
+ * artifact, which is the only one of the three that is not caller-attested and
+ * is why the artifact is a declared input at all.
+ *
+ * AD-24's "absent or incomplete" splits the same way the manifest's does:
+ * incomplete is a schema rejection the application boundary already raises, and
+ * absent is a shape no schema can describe, so the parameter admits `null`.
+ */
+export declare const ingest: IngestStage<ValidatedObservations>;

package/dist/core/ingest/ingest.js

@@ -0,0 +1,310 @@
+/**
+ * AD-24's ingest stage: three already-parsed artifacts in, the validated
+ * observations plus every condition detected out.
+ *
+ * The organizing rule is the isolation manifest's own `.meta` sentence, "a
+ * schema rejection is the correct expression of unparseable and incomplete, so
+ * nothing is admitted for their sake, and the violating case is
+ * `core/ingest`'s". Bytes that will not parse are the application layer's to
+ * reject; bytes that parse and then contradict each other are a finding about
+ * the run. So a detected problem is returned as data and nothing here throws.
+ *
+ * One fault does propagate and is named, from two call sites into the same
+ * module. `auditQuotation` canonicalizes the three structured evidence
+ * channels, and the evaluator configuration's digest is recomputed by
+ * canonicalizing the whole artifact, so an unsafe integer or a lone surrogate in
+ * either raises AD-28's `non-canonicalizable-value` out of `core/canonical`. It
+ * is neither caught nor re-raised here, which is what lets a caller tell an
+ * invalid run from a crashed one.
+ *
+ * Nothing here re-derives what `resolveOutcome` already decides. Its ten
+ * invalidating conditions are per oracle and reach the ladder through
+ * `outcome.resolution.invalidatingConditions`; these eleven are per record and
+ * reach it through `EvidenceIntegrityInputs` and `OutcomeStateInputs`. Two
+ * pairs are related rather than identical: `judge-result-unscored` is the
+ * derivation `OutcomeInputs.judgeConduct` has never had, and a
+ * `dangling-citation` and an `unwitnessed-detection-claim` can both fire on one
+ * finding, in which case the basis names both and the rung is the same either
+ * way.
+ */
+import { digestArtifact } from '../canonical/digest.js';
+import { FORBIDDEN_INPUT_FLOOR } from '../schemas/eval-contract.js';
+import { auditQuotation, } from '../score/quotation.js';
+import { AGREEMENT_FIELDS } from './conditions.js';
+/**
+ * Observed values with no entry in their allowlist, in the manifest's own array
+ * order and each named once. A value observed twice outside its allowlist is one
+ * value outside its allowlist; the payload is what a consumer renders, and
+ * `isolationViolation` is specified as one entry per offending value.
+ */
+const outsideAllowlist = (observed, allowed) => {
+    const permitted = new Set(allowed);
+    return [...new Set(observed)].filter((value) => !permitted.has(value));
+};
+/** The path AD-27 digests the evaluator configuration under, matching `seal.ts`'s treatment of the contract. */
+const EVALUATOR_CONFIGURATION_ARTIFACT_PATH = 'EvaluatorConfiguration';
+/**
+ * A total order over the two condition families whose source array declares no
+ * order of its own. A finding carries no sequence field and a judge result is
+ * addressed by its `(rubricId, criterionId)` pair, so reading either in array
+ * position would make the recorded conditions depend on a position NFR9 forbids
+ * reading; `auditQuotation` sorts its own result for the same reason.
+ *
+ * Keyed on the whole payload rather than on the identifier alone. `observations`
+ * is the only one of the three arrays the record schema refines for uniqueness,
+ * so a repeated `findingId` and a repeated `(rubricId, criterionId)` are both
+ * representable, and a comparator keyed on the identifier would leave the tied
+ * pair ordered by the array position the sort exists to stop reading. Entries
+ * that still tie here are equal values, so the order between them cannot be
+ * observed.
+ *
+ * Joined on U+0000 rather than compared position by position. Every identifier
+ * in a key is drawn from `IDENTIFIER_SOURCE` or a `X-digits` prefix form, whose
+ * lowest code point is U+002D, so the separator sorts below every character a
+ * segment can carry and the joined comparison is the element-wise one.
+ */
+const compareKeys = (left, right) => {
+    const a = left.join('\u0000');
+    const b = right.join('\u0000');
+    return a < b ? -1 : a > b ? 1 : 0;
+};
+/**
+ * The stage. Reads nothing outside its three declared inputs: a rule needing
+ * the eval contract, the rubric, or bytes resolved through the corpus port is
+ * routed to whoever declares them rather than absorbed here on the strength of
+ * being nearby.
+ *
+ * Two rules read the evaluator configuration and they are separate. AD-32's
+ * agreement rule compares the digest the record declares against the one the
+ * manifest declares, which is `cross-artifact-disagreement` and never reads the
+ * artifact. AD-24 and AD-11 require the digest to be recomputed from the
+ * artifact, which is the only one of the three that is not caller-attested and
+ * is why the artifact is a declared input at all.
+ *
+ * AD-24's "absent or incomplete" splits the same way the manifest's does:
+ * incomplete is a schema rejection the application boundary already raises, and
+ * absent is a shape no schema can describe, so the parameter admits `null`.
+ */
+export const ingest = (record, manifest, configuration) => {
+    const conditions = [];
+    // Prior to every other check: a record that uses one identifier twice cannot
+    // address its own entries, and every consumer downstream addresses by them.
+    // Reported before the conditions that name one, so a reader meets the
+    // ambiguity before a condition that relies on it.
+    //
+    // Observations lead because a repeat there changes an answer rather than an
+    // order: `auditQuotation` indexes them into a `Map` keyed on `observationId`,
+    // so the last entry with a repeated identifier wins and decides which body a
+    // quotation is checked against.
+    for (const [subject, identifiers] of [
+        [
+            'observation',
+            record.observations.map((observation) => observation.observationId),
+        ],
+        ['finding', record.findings.map((finding) => finding.findingId)],
+        [
+            'oracle-disposition',
+            record.oracleDispositions.map((disposition) => disposition.oracleId),
+        ],
+    ]) {
+        const counts = new Map();
+        for (const identifier of identifiers) {
+            counts.set(identifier, (counts.get(identifier) ?? 0) + 1);
+        }
+        const repeated = [...counts.entries()]
+            .filter(([, occurrences]) => occurrences > 1)
+            .sort((a, b) => compareKeys([a[0]], [b[0]]));
+        for (const [identifier, occurrences] of repeated) {
+            conditions.push({
+                kind: 'duplicate-record-identifier',
+                subject,
+                identifier,
+                occurrences,
+            });
+        }
+    }
+    // A cited identifier matching a declared observation is the cross-artifact
+    // rule `observationIds` leaves to this stage. Declared on every finding
+    // branch, so the check is too: AD-23's word is "additionally", a floor on
+    // `defect` rather than a prohibition on the other two.
+    const declared = new Set(record.observations.map((observation) => observation.observationId));
+    const dangling = record.findings
+        .map((finding) => ({
+        findingId: finding.findingId,
+        // Deduplicated first, in first-citation order: the condition names
+        // which identifiers resolved to nothing, and a finding citing one
+        // twice has one bad citation to report rather than two.
+        unresolvedObservationIds: [...new Set(finding.observationIds)].filter((observationId) => !declared.has(observationId)),
+    }))
+        .filter((entry) => entry.unresolvedObservationIds.length > 0)
+        .sort((a, b) => compareKeys([a.findingId, ...a.unresolvedObservationIds], [b.findingId, ...b.unresolvedObservationIds]));
+    for (const entry of dangling) {
+        conditions.push({ kind: 'dangling-citation', ...entry });
+    }
+    // The same rule over the record's second citation site. `resolveOutcome`
+    // reads a disposition's `observationIds` only for emptiness, so a `violated`
+    // disposition whose one citation names nothing would otherwise be believed,
+    // which is the shape AD-33 says invalidates rather than being believed.
+    const danglingDispositions = record.oracleDispositions
+        .map((disposition) => ({
+        oracleId: disposition.oracleId,
+        unresolvedObservationIds: [...new Set(disposition.observationIds)].filter((observationId) => !declared.has(observationId)),
+    }))
+        .filter((entry) => entry.unresolvedObservationIds.length > 0)
+        .sort((a, b) => compareKeys([a.oracleId, ...a.unresolvedObservationIds], [b.oracleId, ...b.unresolvedObservationIds]));
+    for (const entry of danglingDispositions) {
+        conditions.push({ kind: 'dangling-disposition-citation', ...entry });
+    }
+    // ADR-009 Decision 2's precedence: cited identifiers govern the witness
+    // match and quotation audits it. This is that audit's caller.
+    const unwitnessedQuotations = auditQuotation(record);
+    if (unwitnessedQuotations.length > 0) {
+        conditions.push({
+            kind: 'unwitnessed-quotation',
+            quotations: unwitnessedQuotations,
+        });
+    }
+    const isolationViolation = [];
+    if (manifest === null) {
+        // AD-16's absent case. The agreement and forbidden-input checks read
+        // manifest fields and cannot run; every record-internal check still does,
+        // so a run that is both manifest-less and internally inconsistent reports
+        // both rather than only the first.
+        conditions.push({ kind: 'isolation-manifest-absent' });
+        isolationViolation.push('isolation manifest absent');
+    }
+    else {
+        const mounts = outsideAllowlist(manifest.observedMounts, manifest.allowedMounts);
+        const networkTargets = outsideAllowlist(manifest.observedNetworkTargets, manifest.networkAllowlist);
+        const toolCalls = outsideAllowlist(manifest.observedToolCalls, manifest.toolAllowlist);
+        // One count over the three allowlists. The condition is "some observed
+        // value sits outside its allowlist", and asking it as three
+        // short-circuiting disjuncts would leave two of them evaluated in one
+        // direction only.
+        const exceeded = mounts.length + networkTargets.length + toolCalls.length;
+        if (manifest.violation !== null || exceeded > 0) {
+            conditions.push({
+                kind: 'isolation-manifest-violation',
+                violation: manifest.violation,
+                mountsOutsideAllowlist: mounts,
+                networkTargetsOutsideAllowlist: networkTargets,
+                toolCallsOutsideAllowlist: toolCalls,
+            });
+            // The declared violation first, then mounts, network targets, and tool
+            // calls, each in the manifest's own array order and one entry per
+            // offending value.
+            if (manifest.violation !== null) {
+                isolationViolation.push(`manifest violation: ${manifest.violation}`);
+            }
+            for (const value of mounts) {
+                isolationViolation.push(`mount outside allowlist: ${value}`);
+            }
+            for (const value of networkTargets) {
+                isolationViolation.push(`network target outside allowlist: ${value}`);
+            }
+            for (const value of toolCalls) {
+                isolationViolation.push(`tool call outside allowlist: ${value}`);
+            }
+        }
+        // AD-16's "account for each forbidden input by name". Read off the floor
+        // rather than off the manifest's own key order, so the seven are named in
+        // the order the list that generates them declares.
+        const admitted = FORBIDDEN_INPUT_FLOOR.filter((input) => !manifest.forbiddenInputAccounting[input].withheld);
+        if (admitted.length > 0) {
+            conditions.push({
+                kind: 'forbidden-input-not-withheld',
+                inputs: admitted,
+            });
+        }
+        // AD-32's agreement rule. Both artifacts carry all three fields, so the
+        // comparison is between them and never against the configuration artifact
+        // standing behind the digest.
+        for (const field of AGREEMENT_FIELDS) {
+            if (record[field] === manifest[field])
+                continue;
+            conditions.push({
+                kind: 'cross-artifact-disagreement',
+                field,
+                recordValue: record[field],
+                manifestValue: manifest[field],
+            });
+        }
+    }
+    // AD-24: "ingest computes its digest from the artifact and invalidates the
+    // run when it is absent or incomplete", restated by AD-11 as the one
+    // scoring-version input this stage recomputes. The record's declaration is
+    // the operand because AD-32 puts the trust boundary there: a caller that
+    // declares one configuration and runs another leaves the two declarations
+    // agreeing and only the recomputation disagreeing.
+    if (configuration === null) {
+        conditions.push({ kind: 'evaluator-configuration-absent' });
+    }
+    else {
+        const computedDigest = digestArtifact(configuration, EVALUATOR_CONFIGURATION_ARTIFACT_PATH);
+        if (computedDigest !== record.evaluatorConfigurationDigest) {
+            conditions.push({
+                kind: 'evaluator-configuration-digest-mismatch',
+                declaredDigest: record.evaluatorConfigurationDigest,
+                computedDigest,
+            });
+        }
+    }
+    // AD-17's record-decidable half. `null` is the shape AD-6's `judge-error`
+    // fires on, which is why the schema must parse it and why this is a condition
+    // rather than a parse failure.
+    //
+    // Deduplicated by the pair that addresses the result: `judgeResults` carries
+    // no uniqueness refinement, so one criterion may appear twice, and two
+    // byte-identical conditions naming one criterion are one finding a basis line
+    // can act on rather than two.
+    //
+    // The two citation families deduplicate identifiers inside an entry and never
+    // the entries themselves, which is the opposite answer to the same shape and
+    // is deliberate. A repeated `(rubricId, criterionId)` is one criterion scored
+    // twice, so the second entry names nothing new. Two findings sharing a
+    // `findingId` are two findings the record cannot address apart, and their
+    // citations may differ, so collapsing them would drop a bad citation on the
+    // floor.
+    const unscored = [
+        ...new Map(record.judgeResults
+            .filter((result) => result.score === null)
+            .map((result) => [
+            `${result.rubricId}/${result.criterionId}`,
+            { rubricId: result.rubricId, criterionId: result.criterionId },
+        ])).values(),
+    ].sort((a, b) => compareKeys([a.rubricId, a.criterionId], [b.rubricId, b.criterionId]));
+    for (const entry of unscored) {
+        conditions.push({ kind: 'judge-result-unscored', ...entry });
+    }
+    return {
+        // Read off the record and restated, never derived, recomputed, or
+        // defaulted, the same posture `mode` below takes.
+        runId: record.runId,
+        // Read off the record and restated, never derived, recomputed, or
+        // defaulted: AD-21 fixes mode before ingest and there is no fourth
+        // parameter for a caller to disagree with it through.
+        mode: record.mode,
+        evaluatorRecommendation: record.evaluatorRecommendation,
+        // `selectObservations`' own sort, matched exactly so two readers of one
+        // record cannot disagree about which observation came first. The
+        // identifier tie-break cannot fire on a record that parsed, since
+        // `sequence` is refined unique per record; it is kept for comparator
+        // identity with the shipped sort rather than because the case is real.
+        observations: [...record.observations].sort((a, b) => a.sequence - b.sequence || (a.observationId < b.observationId ? -1 : 1)),
+        // Sorted for the same reason the conditions are: neither array declares an
+        // order, so carrying the record's would make the product depend on a
+        // position nothing may read. The identifier is a total key on any record
+        // that does not repeat one, and a record that does repeats it into a
+        // `duplicate-record-identifier` condition, so the one input whose product
+        // still varies with presentation order is one the run already reports as
+        // unaddressable. Ordering that pair by content instead would mean
+        // canonicalizing every finding, which buys determinism for a record
+        // already flagged at the cost of making `non-canonicalizable-value`
+        // reachable from a field no quotation cites.
+        findings: [...record.findings].sort((a, b) => compareKeys([a.findingId], [b.findingId])),
+        dispositions: [...record.oracleDispositions].sort((a, b) => compareKeys([a.oracleId], [b.oracleId])),
+        conditions,
+        unwitnessedQuotations,
+        isolationViolation,
+    };
+};