eval-quality 0.1.0 → 0.3.0

package/dist/core/evaluate/resolution.d.ts

@@ -3,8 +3,9 @@
  * that turns an `Expression` into one `CheckResolutionValue`. Leaf operators,
  * `covers-by-key` included, live in `operators.ts`. Operand resolution, every
  * pointer form including the bound-element `@/` form, is injected;
- * `evidence-resolution.ts` supplies it, and `ResolveOperand` and
- * `PointerDenotesCollection` are the consumer-side contract it satisfies.
+ * `evidence-resolution.ts` supplies it, and `ResolveOperand`,
+ * `PointerDenotesCollection`, and `ReferenceSetKeys` are the consumer-side
+ * contract it satisfies.
  */
 import type { CheckResolutionValue } from '../schemas/evidence-artifact.ts';
 import type { Expression, Operand } from '../schemas/expression.ts';
@@ -31,10 +32,20 @@ export type ResolveOperand = (operand: Operand, boundElement: ResolvedValue, art
  * soft-delete agreement pair (AD-4's own worked example).
  */
 export type PointerDenotesCollection = (pointer: string) => boolean;
+/**
+ * The `keys` each declared reference set names, by identifier.
+ * `set-membership`'s set position reads the single declared key off each
+ * member (`reference-set.ts`), and the members map the injected
+ * `ResolveOperand` closes over has already discarded the keys, so they travel
+ * separately. Plain data, because `PreflightPlan` carries this through to
+ * its reducer and is compared by value, which a closure fails.
+ * `evidence-resolution.ts` builds it from a contract.
+ */
+export type ReferenceSetKeys = Readonly<Record<string, readonly string[]>>;
 /**
  * The public entry point. Walks `expression` and produces one
  * `CheckResolutionValue`, exactly what `Outcome.checkResolution` needs,
  * unmodified. `boundElement` starts `ABSENT` at the root, where no quantifier
  * has bound anything yet.
  */
-export declare function resolveCheck(expression: Expression, resolveOperand: ResolveOperand, pointerDenotesCollection: PointerDenotesCollection, regexMatchStepBudget: number, artifactPath: string): CheckResolutionValue;
+export declare function resolveCheck(expression: Expression, resolveOperand: ResolveOperand, pointerDenotesCollection: PointerDenotesCollection, referenceSetKeys: ReferenceSetKeys, regexMatchStepBudget: number, artifactPath: string): CheckResolutionValue;

package/dist/core/evaluate/resolution.js

@@ -1,4 +1,4 @@
-import { absence, containment, countTolerance, coversByKey, deepEquality, equality, existence, ordering, regexMatch, setMembership, shape, } from './operators.js';
+import { absence, containment, countTolerance, coversByKey, deepEquality, equality, existence, keyValueOf, ordering, regexMatch, setMembership, shape, } from './operators.js';
 import { ABSENT } from './resolved-value.js';
 /**
  * AD-4's one closed introduction condition, checked per operand and applied
@@ -242,10 +242,69 @@ function resolveRegexNode(expression, boundElement, ctx) {
     const { pattern } = expression;
     return resolveSingleOperand(operand, boundElement, ctx, (resolved) => regexMatch(resolved, pattern, ctx.regexMatchStepBudget, ctx.artifactPath));
 }
+/**
+ * Reads the single declared key off each member of a `{ referenceSet }` set
+ * operand. `reference-set.ts` declares members as objects so one declaration
+ * serves both operators, and states that "a `set-membership` operand against
+ * the same set reads the single named key". This is where that reading
+ * happens, and without it AD-20 rule 6's injection form can never answer
+ * `true`: the value operand resolves to a scalar, and `setMembership` compares
+ * whole members by digest, so a scalar against an object is always `false`.
+ *
+ * Scoped to this one operator position on purpose. `covers-by-key` projects
+ * both sides itself on `expectedKey` and `actualKey`, and `containment`
+ * matches whole members, so both want the members unprojected. The injected
+ * `ResolveOperand` is handed one operand at a time and cannot see which
+ * operator position it is filling, which is why the projection lives at the
+ * resolution site.
+ *
+ * The option turned down: an explicit `memberKey` field on `set-membership`
+ * mirroring `covers-by-key`'s `expectedKey`. It is symmetric with its sibling
+ * and it carries a multi-key set, at the price of a grammar change to a
+ * published artifact, an eval-contract `schemaVersion` bump, and
+ * published-schema drift, for a case no shipped contract has. Revisit it the
+ * first time a real contract wants a multi-key set in this position.
+ *
+ * Both throws are unreachable for a compiled contract:
+ * `checkOperandLegality` rejects a multi-key reference set in this position,
+ * and a member missing the declared key, under
+ * `malformed-operator-expression`. They throw, because a set this function
+ * cannot project carries no membership answer to give.
+ */
+function projectSetOperand(resolvedSet, setOperand, ctx) {
+    if (!('referenceSet' in setOperand))
+        return resolvedSet;
+    const { referenceSet } = setOperand;
+    // `Object.hasOwn`, the same prototype-chain guard `makeResolveOperand`
+    // applies to its own maps: `Identifier`'s charset admits `constructor`.
+    const keys = Object.hasOwn(ctx.referenceSetKeys, referenceSet)
+        ? ctx.referenceSetKeys[referenceSet]
+        : undefined;
+    // No declared keys means the contract declares no such reference set,
+    // which compilation rejects under `unresolved-reference-set`; a non-array
+    // is the array guard below reporting whatever the resolver returned. Both
+    // pass through so exactly one guard speaks for each.
+    if (keys === undefined || !Array.isArray(resolvedSet))
+        return resolvedSet;
+    if (keys.length !== 1) {
+        throw new Error(`set-membership's set-operand projection: referenceSet "${referenceSet}" declares ${keys.length} keys, and this position reads exactly one. A multi-key set here is malformed-operator-expression, which compilation rejects.`);
+    }
+    const key = keys[0];
+    return resolvedSet.map((member) => {
+        const keyValue = keyValueOf(member, key);
+        if (keyValue === ABSENT) {
+            throw new Error(`set-membership's set-operand projection: a member of referenceSet "${referenceSet}" carries no own property "${key}", the key it declares. That is malformed-operator-expression, which compilation rejects.`);
+        }
+        return keyValue;
+    });
+}
 function resolveSetMembershipNode(expression, boundElement, ctx) {
     const [valueOperand, setOperand] = expression.operands;
     const value = ctx.resolveOperand(valueOperand, boundElement, ctx.artifactPath);
-    const resolvedSet = ctx.resolveOperand(setOperand, boundElement, ctx.artifactPath);
+    // Projected before the empty-collection interception and the array guard
+    // below, so both read the one value the operator will see. Projection
+    // preserves length and array-ness, so neither answer moves.
+    const resolvedSet = projectSetOperand(ctx.resolveOperand(setOperand, boundElement, ctx.artifactPath), setOperand, ctx);
     if (anyOperandEmpty([
         { operand: valueOperand, resolved: value },
         { operand: setOperand, resolved: resolvedSet },
@@ -326,10 +385,11 @@ function resolveNode(expression, boundElement, ctx) {
  * unmodified. `boundElement` starts `ABSENT` at the root, where no quantifier
  * has bound anything yet.
  */
-export function resolveCheck(expression, resolveOperand, pointerDenotesCollection, regexMatchStepBudget, artifactPath) {
+export function resolveCheck(expression, resolveOperand, pointerDenotesCollection, referenceSetKeys, regexMatchStepBudget, artifactPath) {
     return resolveNode(expression, ABSENT, {
         resolveOperand,
         pointerDenotesCollection,
+        referenceSetKeys,
         regexMatchStepBudget,
         artifactPath,
     });

package/dist/core/excluded-content.d.ts

@@ -0,0 +1,65 @@
+/**
+ * AD-18's excluded categories, as patterns that read a value rather than a name.
+ *
+ * AD-18 excludes "credentials, tokens, real names, email addresses, account
+ * identifiers, and transaction content" from every artifact this package
+ * produces or publishes, and binds "published examples and test fixtures as
+ * strictly as real runs". Until this module the whole prohibition was carried by
+ * one test that scans `corpus/dev`, so a contract carrying a live-shaped token
+ * compiled clean and the token travelled into the sealed brief.
+ *
+ * Only the value-shaped half of that scan ships here, and the split is the point
+ * rather than an economy. AD-18's own reading of the rule for the header channel
+ * is that a declaration "names the header and its type and never carries a
+ * credential value", so a name is what an author is supposed to write: an
+ * operation declaring a `password` body key or an `Authorization` header is a
+ * contract for an authentication API, and a gate matching `\bpassword\b` would
+ * reject exactly the systems this package exists to evaluate. The patterns below
+ * therefore match only strings whose shape is decidable without knowing what
+ * field they sit in: a PEM header, a token with an issuer prefix, an address, a
+ * checkable account number, a card-shaped digit run. The name-shaped patterns
+ * stay in `tests/architecture/dev-corpus.test.ts`, where review rather than a
+ * compiler decides.
+ *
+ * Each pattern carries a string it must fire on, and a test asserts every one
+ * still does. A pattern that has rotted into a regex matching nothing is worse
+ * than no pattern: it reports clean forever.
+ */
+/** AD-18's six categories, in the rule's own order. */
+export declare const EXCLUDED_CATEGORIES: readonly ['credentials', 'tokens', 'real names', 'email addresses', 'account identifiers', 'transaction content'];
+export type ExcludedCategory = (typeof EXCLUDED_CATEGORIES)[number];
+export type ExcludedContentPattern = {
+    readonly category: ExcludedCategory;
+    readonly regex: RegExp;
+    /** a string the pattern must match, so a rotted pattern fails its own test. */
+    readonly fires: string;
+};
+/**
+ * `real names` has no member here and never will: a personal name has no surface
+ * form, so every pattern that reaches one reads the field that carries it, which
+ * is a name-shaped test. The category stays in the tuple above because AD-18
+ * names six and dropping one from the vocabulary would make the gate look total.
+ */
+export declare const EXCLUDED_VALUE_PATTERNS: readonly ExcludedContentPattern[];
+export type ExcludedContentHit = {
+    readonly category: ExcludedCategory;
+    /** the artifact-rooted path of the string that matched. */
+    readonly path: string;
+    /** the matched run, which is short by construction and is what a caller redacts. */
+    readonly match: string;
+};
+/**
+ * Every string anywhere inside one value, against every value-shaped pattern.
+ *
+ * Object keys are walked as paths and never scanned as content: a key is a name
+ * by construction, which is the same line the pattern set is drawn on. The walk
+ * is total over JSON and stops at nothing, so a token nested under a body
+ * example twelve levels down is found; the first matching category per string
+ * wins, since one string reported six times says nothing more than once.
+ *
+ * Order is the walk's order, which for an object is its own key order. A caller
+ * that needs a stable report over two spellings of the same object sorts what
+ * comes back; the compile gate below reads only the first hit and never the
+ * order.
+ */
+export declare function scanExcludedContent(value: unknown, path: string): readonly ExcludedContentHit[];

package/dist/core/excluded-content.js

@@ -0,0 +1,113 @@
+/**
+ * AD-18's excluded categories, as patterns that read a value rather than a name.
+ *
+ * AD-18 excludes "credentials, tokens, real names, email addresses, account
+ * identifiers, and transaction content" from every artifact this package
+ * produces or publishes, and binds "published examples and test fixtures as
+ * strictly as real runs". Until this module the whole prohibition was carried by
+ * one test that scans `corpus/dev`, so a contract carrying a live-shaped token
+ * compiled clean and the token travelled into the sealed brief.
+ *
+ * Only the value-shaped half of that scan ships here, and the split is the point
+ * rather than an economy. AD-18's own reading of the rule for the header channel
+ * is that a declaration "names the header and its type and never carries a
+ * credential value", so a name is what an author is supposed to write: an
+ * operation declaring a `password` body key or an `Authorization` header is a
+ * contract for an authentication API, and a gate matching `\bpassword\b` would
+ * reject exactly the systems this package exists to evaluate. The patterns below
+ * therefore match only strings whose shape is decidable without knowing what
+ * field they sit in: a PEM header, a token with an issuer prefix, an address, a
+ * checkable account number, a card-shaped digit run. The name-shaped patterns
+ * stay in `tests/architecture/dev-corpus.test.ts`, where review rather than a
+ * compiler decides.
+ *
+ * Each pattern carries a string it must fire on, and a test asserts every one
+ * still does. A pattern that has rotted into a regex matching nothing is worse
+ * than no pattern: it reports clean forever.
+ */
+/** AD-18's six categories, in the rule's own order. */
+export const EXCLUDED_CATEGORIES = [
+    'credentials',
+    'tokens',
+    'real names',
+    'email addresses',
+    'account identifiers',
+    'transaction content',
+];
+/**
+ * `real names` has no member here and never will: a personal name has no surface
+ * form, so every pattern that reaches one reads the field that carries it, which
+ * is a name-shaped test. The category stays in the tuple above because AD-18
+ * names six and dropping one from the vocabulary would make the gate look total.
+ */
+export const EXCLUDED_VALUE_PATTERNS = [
+    {
+        category: 'credentials',
+        regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----/,
+        fires: '-----BEGIN RSA PRIVATE KEY-----',
+    },
+    {
+        category: 'tokens',
+        regex: /(?<![A-Za-z])(?:[Bb]earer\s+[\w.~+/-]{16,}|eyJ[\w-]{8,}\.[\w-]{8,}|sk-[A-Za-z0-9]{16,}|gh[pousr]_[A-Za-z0-9]{16,}|AKIA[0-9A-Z]{16})/,
+        fires: 'Authorization: Bearer abcdefghijklmnopqrstuv',
+    },
+    {
+        category: 'email addresses',
+        regex: /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/,
+        fires: '{"contact":"ada@example.com"}',
+    },
+    {
+        // Case-sensitive: an IBAN is upper case, and a case-insensitive form
+        // matches a run inside a lower-case hex digest.
+        category: 'account identifiers',
+        regex: /\b[A-Z]{2}\d{2}[A-Z0-9]{11,30}\b|\b\d{3}-\d{2}-\d{4}\b/,
+        fires: 'GB29NWBK60161331926819',
+    },
+    {
+        category: 'transaction content',
+        regex: /(?<![0-9A-Za-z])\d{4}(?:[ -]\d{4}){3}(?![0-9A-Za-z])/,
+        fires: 'charged 4111 1111 1111 1111',
+    },
+];
+const step = (path, key) => typeof key === 'number' ? `${path}[${key}]` : `${path}.${key}`;
+/**
+ * Every string anywhere inside one value, against every value-shaped pattern.
+ *
+ * Object keys are walked as paths and never scanned as content: a key is a name
+ * by construction, which is the same line the pattern set is drawn on. The walk
+ * is total over JSON and stops at nothing, so a token nested under a body
+ * example twelve levels down is found; the first matching category per string
+ * wins, since one string reported six times says nothing more than once.
+ *
+ * Order is the walk's order, which for an object is its own key order. A caller
+ * that needs a stable report over two spellings of the same object sorts what
+ * comes back; the compile gate below reads only the first hit and never the
+ * order.
+ */
+export function scanExcludedContent(value, path) {
+    const hits = [];
+    const visit = (node, at) => {
+        if (typeof node === 'string') {
+            for (const { category, regex } of EXCLUDED_VALUE_PATTERNS) {
+                const match = regex.exec(node);
+                if (match === null)
+                    continue;
+                hits.push({ category, path: at, match: match[0] });
+                return;
+            }
+            return;
+        }
+        if (Array.isArray(node)) {
+            node.forEach((element, index) => {
+                visit(element, step(at, index));
+            });
+            return;
+        }
+        if (node === null || typeof node !== 'object')
+            return;
+        for (const [key, child] of Object.entries(node))
+            visit(child, step(at, key));
+    };
+    visit(value, path);
+    return hits;
+}

package/dist/core/failure-codes.d.ts

@@ -1,5 +1,5 @@
-/** AD-5's twenty-one compile-time failure codes, as data, in the table's order. */
-export declare const FAILURE_CODES: readonly ['missing-requirement-linkage', 'no-observable-success-criterion', 'unreachable-check-evidence', 'malformed-operator-expression', 'quantifier-over-non-collection', 'quantifier-nesting-exceeded', 'unresolved-reference-set', 'duplicate-operation-signature', 'undeclared-mandatory-input', 'oracle-missing-channel', 'direction-check-misaligned', 'unsupported-interface-kind', 'nested-temporal-clause', 'plan-exceeds-scripting-bound', 'rubric-scores-reasoning-prose', 'rubric-unanchored', 'rubric-evidence-unreachable', 'forbidden-input-floor-incomplete', 'scoped-reference-resolves-forbidden', 'waiver-incomplete', 'brief-exceeds-scripting-bound'];
+/** AD-5's twenty-six compile-time failure codes, as data, in the table's order. */
+export declare const FAILURE_CODES: readonly ['missing-requirement-linkage', 'no-observable-success-criterion', 'unreachable-check-evidence', 'malformed-operator-expression', 'quantifier-over-non-collection', 'quantifier-nesting-exceeded', 'unresolved-reference-set', 'duplicate-operation-signature', 'undeclared-mandatory-input', 'oracle-missing-channel', 'direction-check-misaligned', 'unsupported-interface-kind', 'nested-temporal-clause', 'plan-exceeds-scripting-bound', 'binding-cycle', 'captured-channel-undeclared', 'rubric-scores-reasoning-prose', 'rubric-unanchored', 'rubric-evidence-unreachable', 'forbidden-input-floor-incomplete', 'scoped-reference-resolves-forbidden', 'waiver-incomplete', 'brief-exceeds-scripting-bound', 'unresolved-artifact-reference', 'irreducible-step-reference', 'excluded-content-in-declaration'];
 export type FailureCode = (typeof FAILURE_CODES)[number];
 /**
  * AD-5's compile-time failure registry: thrown when a structural error fails

package/dist/core/failure-codes.js

@@ -1,11 +1,11 @@
-/** AD-5's twenty-one compile-time failure codes, as data, in the table's order. */
+/** AD-5's twenty-six compile-time failure codes, as data, in the table's order. */
 // This lives in `core/`, since it's a plain data tuple and `core/schemas/`
 // is reserved for Zod definitions. The compiler that emits these codes lives
 // in `core/compile/`, one directory over.
 //
 // `scripts/check-ad5-registry.ts` checks this tuple against AD-5's own
 // registry table under `npm run validate`; the tuple's own invariants
-// (twenty-one members, unique, kebab-case) are locked in
+// (twenty-six members, unique, kebab-case) are locked in
 // tests/schemas/failure-codes.test.ts.
 export const FAILURE_CODES = [
     'missing-requirement-linkage',
@@ -22,6 +22,8 @@ export const FAILURE_CODES = [
     'unsupported-interface-kind',
     'nested-temporal-clause',
     'plan-exceeds-scripting-bound',
+    'binding-cycle',
+    'captured-channel-undeclared',
     'rubric-scores-reasoning-prose',
     'rubric-unanchored',
     'rubric-evidence-unreachable',
@@ -29,6 +31,9 @@ export const FAILURE_CODES = [
     'scoped-reference-resolves-forbidden',
     'waiver-incomplete',
     'brief-exceeds-scripting-bound',
+    'unresolved-artifact-reference',
+    'irreducible-step-reference',
+    'excluded-content-in-declaration',
 ];
 /**
  * AD-5's compile-time failure registry: thrown when a structural error fails

package/dist/core/ingest/conditions.d.ts

@@ -0,0 +1,201 @@
+/**
+ * The eleven conditions `core/ingest` detects, and the ladder input each one
+ * feeds.
+ *
+ * Each condition is a cross-artifact rule a shipped schema names `core/ingest`
+ * as the enforcement point for, and none of them is a parse failure: the
+ * artifacts arrive already parsed, and a rule two conforming artifacts break
+ * between them is a finding about the run rather than a rejection of its bytes.
+ *
+ * The kinds are a runtime tuple first and the union draws from it, the idiom
+ * `RUNTIME_FAULT_CODES`, `FORBIDDEN_INPUT_FLOOR`, and `ORACLE_DISPOSITIONS` are
+ * written in. A union's `kind` literals are erased at compile time, so a drift
+ * check over a bare union could only compare the mapping below against itself or
+ * against a hand-written second list, which is the drift it exists to catch.
+ *
+ * `ladder.ts` is imported type-only on purpose. `isolatedModules` without
+ * `verbatimModuleSyntax` compiles a value import used only in type position
+ * silently, which would put the whole ladder module on this module's runtime
+ * load path; `preflight/reduce.ts` imports `ReduceStage` the same way.
+ */
+import type { ForbiddenInput } from '../schemas/eval-contract.ts';
+import type { EvidenceIntegrityInputs, OutcomeStateInputs } from '../score/ladder.ts';
+import type { UnwitnessedQuotation } from '../score/quotation.ts';
+/**
+ * The eleven kinds, in the order `ingest` records them. The two isolation-family
+ * kinds and the two evaluator-configuration ones are sequenced here; the order
+ * of the values inside one `isolation-manifest-violation` is the manifest's own
+ * array order and belongs to the stage, not to this tuple.
+ */
+export declare const INGEST_CONDITION_KINDS: readonly ['duplicate-record-identifier', 'dangling-citation', 'dangling-disposition-citation', 'unwitnessed-quotation', 'isolation-manifest-absent', 'isolation-manifest-violation', 'forbidden-input-not-withheld', 'cross-artifact-disagreement', 'evaluator-configuration-absent', 'evaluator-configuration-digest-mismatch', 'judge-result-unscored'];
+export type IngestConditionKind = (typeof INGEST_CONDITION_KINDS)[number];
+/**
+ * The three fields AD-32 requires the sealed run record and the isolation
+ * manifest to agree on, in the order a disagreement is reported.
+ *
+ * `conditionArm` sits on both artifacts and is deliberately excluded: both
+ * schemas describe it as "an opaque caller label with no product semantics, per
+ * AD-24", so making a mismatch invalidate would mint a normative rule with no
+ * AD behind it and would be the one invalidating condition in the design with
+ * nothing downstream reading it.
+ */
+export declare const AGREEMENT_FIELDS: readonly ['runId', 'contractDigest', 'evaluatorConfigurationDigest'];
+export type AgreementField = (typeof AGREEMENT_FIELDS)[number];
+/**
+ * An identifier the record uses twice where everything downstream addresses by
+ * it once.
+ *
+ * `SealedRunRecord` refines exactly one array for uniqueness, and it refines it
+ * on `sequence` rather than on an identifier, so all three of `observationId`,
+ * `findingId`, and `oracleId` may repeat in a record that parses. Nothing
+ * downstream can then tell the pair apart: `verdictBasis` names a finding by its
+ * identifier, `FindingConfidence` is keyed by it, `resolveOutcome` reads one
+ * disposition per oracle, and `auditQuotation` indexes observations into a `Map`
+ * keyed on `observationId`, which is last-write-wins. Recorded rather than
+ * repaired, because choosing which of two entries an identifier means is not a
+ * choice this stage can make.
+ *
+ * The observation case is the one with teeth. A repeated `observationId` decides
+ * which body a quotation is checked against, so it changes whether a defect
+ * finding's evidence is witnessed at all, which is the AD-32
+ * declared-versus-observed property this stage exists to check. The other two
+ * change an order; this one changes an answer.
+ *
+ * It is also what makes the product's `findings` and `dispositions` order total,
+ * and `unwitnessedQuotations` a function of the record's content, in every
+ * record that does not carry this condition.
+ */
+export type DuplicateRecordIdentifier = {
+    readonly kind: Extract<IngestConditionKind, 'duplicate-record-identifier'>;
+    readonly subject: 'observation' | 'finding' | 'oracle-disposition' | 'judge-result';
+    readonly identifier: string;
+    readonly occurrences: number;
+};
+/**
+ * A finding citing an observation identifier the record does not declare. One
+ * per finding, carrying every identifier that resolved to nothing, so a
+ * consumer never has to re-derive which half of the citation was bad.
+ */
+export type DanglingCitation = {
+    readonly kind: Extract<IngestConditionKind, 'dangling-citation'>;
+    readonly findingId: string;
+    readonly unresolvedObservationIds: readonly string[];
+};
+/**
+ * A disposition citing an observation identifier the record does not declare.
+ *
+ * The record's second citation site, and the one nothing else reads. AD-33 wants
+ * "every disposition citing supporting observations, and an unsupported
+ * disposition invalidating cross-artifact agreement rather than being believed";
+ * `resolveOutcome`'s `unsupported-disposition` covers the empty list only, so a
+ * `violated` disposition corroborated by a citation to nothing would otherwise
+ * be believed. Ingest is the only stage holding the dispositions and the
+ * observations at once.
+ */
+export type DanglingDispositionCitation = {
+    readonly kind: Extract<IngestConditionKind, 'dangling-disposition-citation'>;
+    readonly oracleId: string;
+    readonly unresolvedObservationIds: readonly string[];
+};
+/**
+ * The quotation audit's own return value, unchanged. `auditQuotation` already
+ * shapes the payload its consumer declares, so re-projecting it here would be a
+ * second spelling of one result.
+ */
+export type UnwitnessedQuotationCondition = {
+    readonly kind: Extract<IngestConditionKind, 'unwitnessed-quotation'>;
+    readonly quotations: readonly UnwitnessedQuotation[];
+};
+/**
+ * AD-16's absent manifest. No payload: there is no artifact to describe, which
+ * is why no schema can carry this rule and why the manifest's own `.meta` hands
+ * the violating case to `core/ingest`.
+ */
+export type IsolationManifestAbsent = {
+    readonly kind: Extract<IngestConditionKind, 'isolation-manifest-absent'>;
+};
+/**
+ * A declared violation, an observed mount, network target, or tool call outside
+ * its allowlist, or any combination. One condition rather than four, each
+ * exceeded allowlist carrying its own offending values in the manifest's array
+ * order, so a consumer reads values rather than parsing them back out of a
+ * joined summary.
+ */
+export type IsolationManifestViolation = {
+    readonly kind: Extract<IngestConditionKind, 'isolation-manifest-violation'>;
+    readonly violation: string | null;
+    readonly mountsOutsideAllowlist: readonly string[];
+    readonly networkTargetsOutsideAllowlist: readonly string[];
+    readonly toolCallsOutsideAllowlist: readonly string[];
+};
+/**
+ * AD-16's first clause: a prohibited input the manifest accounts for with
+ * `withheld: false`. Named in `FORBIDDEN_INPUT_FLOOR` order, since that list is
+ * the floor's one home and the manifest's key order is the caller's.
+ */
+export type ForbiddenInputNotWithheld = {
+    readonly kind: Extract<IngestConditionKind, 'forbidden-input-not-withheld'>;
+    readonly inputs: readonly ForbiddenInput[];
+};
+/**
+ * One field the two artifacts disagree on, carrying both values. Per field
+ * rather than per record: a run whose two artifacts disagree about which
+ * configuration produced it is a different finding from one that disagrees
+ * about which run it is.
+ */
+export type CrossArtifactDisagreement = {
+    readonly kind: Extract<IngestConditionKind, 'cross-artifact-disagreement'>;
+    readonly field: AgreementField;
+    readonly recordValue: string;
+    readonly manifestValue: string;
+};
+/**
+ * AD-24's absent evaluator configuration. No payload, for the same reason
+ * `IsolationManifestAbsent` carries none: there is no artifact to describe.
+ */
+export type EvaluatorConfigurationAbsent = {
+    readonly kind: Extract<IngestConditionKind, 'evaluator-configuration-absent'>;
+};
+/**
+ * The digest the record declares for the evaluator configuration against the
+ * one that artifact actually produces.
+ *
+ * The operand is the record's declaration. A disagreement between the record's
+ * and the manifest's declarations is already `cross-artifact-disagreement`, and
+ * what this condition adds is the half AD-32 calls the trust boundary: both
+ * declarations are caller-attested, and only the recomputation reads the
+ * artifact.
+ */
+export type EvaluatorConfigurationDigestMismatch = {
+    readonly kind: Extract<IngestConditionKind, 'evaluator-configuration-digest-mismatch'>;
+    readonly declaredDigest: string;
+    readonly computedDigest: string;
+};
+/**
+ * AD-17's record-decidable half: a judge result carrying `score: null`. The
+ * other half, that the criterion is one the cited rubric declares, needs the
+ * rubric, which no stage row declares as an input.
+ */
+export type JudgeResultUnscored = {
+    readonly kind: Extract<IngestConditionKind, 'judge-result-unscored'>;
+    readonly rubricId: string;
+    readonly criterionId: string;
+};
+export type IngestCondition = DuplicateRecordIdentifier | DanglingCitation | DanglingDispositionCitation | UnwitnessedQuotationCondition | IsolationManifestAbsent | IsolationManifestViolation | ForbiddenInputNotWithheld | CrossArtifactDisagreement | EvaluatorConfigurationAbsent | EvaluatorConfigurationDigestMismatch | JudgeResultUnscored;
+/**
+ * The ladder field a condition feeds. Every one of the eleven kinds now
+ * carries a rung, so the union below names all ten `EvidenceIntegrityInputs`
+ * fields that carry an ingest condition and `null` is dropped entirely: a
+ * kind with no rung is a compile error now, not a documented gap.
+ *
+ * Ten pairs built with `Extract` rather than a bare `keyof` product: the
+ * product would also pull in fields like `internallyInconsistent`, whose row
+ * is FAIL and whose guard reads "internally inconsistent under AD-17" rather
+ * than reading an `IngestCondition`, and a bare key would lose which of the
+ * two input types a member came from. Renaming a field in `ladder.ts`
+ * collapses its branch here to `never`, so the mapping below stops compiling
+ * instead of pointing at a field that no longer exists.
+ */
+export type LadderTarget = Extract<keyof EvidenceIntegrityInputs, 'isolationViolation'> | Extract<keyof OutcomeStateInputs, 'unwitnessedQuotations'> | Extract<keyof EvidenceIntegrityInputs, 'duplicateRecordIdentifiers'> | Extract<keyof EvidenceIntegrityInputs, 'danglingCitations'> | Extract<keyof EvidenceIntegrityInputs, 'danglingDispositionCitations'> | Extract<keyof EvidenceIntegrityInputs, 'forbiddenInputsNotWithheld'> | Extract<keyof EvidenceIntegrityInputs, 'crossArtifactDisagreements'> | Extract<keyof EvidenceIntegrityInputs, 'evaluatorConfigurationAbsent'> | Extract<keyof EvidenceIntegrityInputs, 'evaluatorConfigurationDigestMismatches'> | Extract<keyof EvidenceIntegrityInputs, 'judgeResultsUnscored'>;
+/** Total over the kinds tuple: a new kind fails to compile until it declares its rung. */
+export declare const LADDER_TARGETS: Record<IngestConditionKind, LadderTarget>;

package/dist/core/ingest/conditions.js

@@ -0,0 +1,48 @@
+/**
+ * The eleven kinds, in the order `ingest` records them. The two isolation-family
+ * kinds and the two evaluator-configuration ones are sequenced here; the order
+ * of the values inside one `isolation-manifest-violation` is the manifest's own
+ * array order and belongs to the stage, not to this tuple.
+ */
+export const INGEST_CONDITION_KINDS = [
+    'duplicate-record-identifier',
+    'dangling-citation',
+    'dangling-disposition-citation',
+    'unwitnessed-quotation',
+    'isolation-manifest-absent',
+    'isolation-manifest-violation',
+    'forbidden-input-not-withheld',
+    'cross-artifact-disagreement',
+    'evaluator-configuration-absent',
+    'evaluator-configuration-digest-mismatch',
+    'judge-result-unscored',
+];
+/**
+ * The three fields AD-32 requires the sealed run record and the isolation
+ * manifest to agree on, in the order a disagreement is reported.
+ *
+ * `conditionArm` sits on both artifacts and is deliberately excluded: both
+ * schemas describe it as "an opaque caller label with no product semantics, per
+ * AD-24", so making a mismatch invalidate would mint a normative rule with no
+ * AD behind it and would be the one invalidating condition in the design with
+ * nothing downstream reading it.
+ */
+export const AGREEMENT_FIELDS = [
+    'runId',
+    'contractDigest',
+    'evaluatorConfigurationDigest',
+];
+/** Total over the kinds tuple: a new kind fails to compile until it declares its rung. */
+export const LADDER_TARGETS = {
+    'duplicate-record-identifier': 'duplicateRecordIdentifiers',
+    'dangling-citation': 'danglingCitations',
+    'dangling-disposition-citation': 'danglingDispositionCitations',
+    'unwitnessed-quotation': 'unwitnessedQuotations',
+    'isolation-manifest-absent': 'isolationViolation',
+    'isolation-manifest-violation': 'isolationViolation',
+    'forbidden-input-not-withheld': 'forbiddenInputsNotWithheld',
+    'cross-artifact-disagreement': 'crossArtifactDisagreements',
+    'evaluator-configuration-absent': 'evaluatorConfigurationAbsent',
+    'evaluator-configuration-digest-mismatch': 'evaluatorConfigurationDigestMismatches',
+    'judge-result-unscored': 'judgeResultsUnscored',
+};

package/dist/core/ingest/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The ingest stage's surface for the rest of `core/`: the stage itself, the
+ * product it owns, the condition vocabulary, and the ladder input each
+ * condition feeds.
+ *
+ * Nothing here reaches `src/index.ts` or `src/application/index.ts`.
+ * `validated-observations` is an internal stage product AD-24 exempts from
+ * publication, so it has no schema, no registry entry, and no published type.
+ */
+export type { AgreementField, CrossArtifactDisagreement, DanglingCitation, DanglingDispositionCitation, DuplicateRecordIdentifier, EvaluatorConfigurationAbsent, EvaluatorConfigurationDigestMismatch, ForbiddenInputNotWithheld, IngestCondition, IngestConditionKind, IsolationManifestAbsent, IsolationManifestViolation, JudgeResultUnscored, LadderTarget, UnwitnessedQuotationCondition, } from './conditions.ts';
+export { AGREEMENT_FIELDS, INGEST_CONDITION_KINDS, LADDER_TARGETS, } from './conditions.ts';
+export type { ValidatedObservations } from './ingest.ts';
+export { ingest } from './ingest.ts';

package/dist/core/ingest/index.js

@@ -0,0 +1,11 @@
+/**
+ * The ingest stage's surface for the rest of `core/`: the stage itself, the
+ * product it owns, the condition vocabulary, and the ladder input each
+ * condition feeds.
+ *
+ * Nothing here reaches `src/index.ts` or `src/application/index.ts`.
+ * `validated-observations` is an internal stage product AD-24 exempts from
+ * publication, so it has no schema, no registry entry, and no published type.
+ */
+export { AGREEMENT_FIELDS, INGEST_CONDITION_KINDS, LADDER_TARGETS, } from './conditions.js';
+export { ingest } from './ingest.js';