eval-quality 0.1.0 → 0.3.0

package/dist/core/ingest/ingest.d.ts

@@ -0,0 +1,68 @@
+import type { Observation, OracleDisposition, RunModeValue, SealedRunRecord } from '../schemas/sealed-run-record.ts';
+import type { EvaluatorRecommendation } from '../schemas/verdict.ts';
+import { type UnwitnessedQuotation } from '../score/quotation.ts';
+import type { IngestStage } from '../stage-contracts.ts';
+import { type IngestCondition } from './conditions.ts';
+/**
+ * `validated-observations`, the internal product AD-24 exempts from
+ * publication: a TypeScript type with no Zod schema, no registry entry, and no
+ * `schemaVersion`.
+ *
+ * `unwitnessedQuotations` and `isolationViolation` are derived here rather than
+ * left for the next stage to rebuild out of condition entries, because both are
+ * shapes the ladder already declares.
+ *
+ * The three carried arrays are copies and their elements are not: an
+ * observation, a finding, or a disposition on this product is the same object
+ * the record holds. The stage is pure and mutates nothing, so a caller that also
+ * does not mutate the record it passed in sees a stable product; deep-copying
+ * every observation to defend against a caller mutating its own input is a cost
+ * no consumer in this package asks for. `isolationViolation` is a list where
+ * `EvidenceIntegrityInputs` still declares one nullable string: the ladder's own
+ * row type says a multi-entry `reasons` "names each affected oracle, gap, or
+ * finding separately, matching AD-21's 'the record carries every condition that
+ * fired'", so the single-valued field is the shape that is wrong. Collapsing to
+ * it here would mean inventing a separator and an ordering rule that the field's
+ * widening then deletes.
+ */
+export type ValidatedObservations = {
+    /** `record.runId`, restated for the same reason `mode` is: `score.ts` reads it off the first trial to build `emit`'s own `runId` field, and no later stage may re-derive or default it. */
+    readonly runId: string;
+    readonly mode: RunModeValue;
+    /**
+     * `AssessmentCommon.evaluatorRecommendation` (`score/ladder.ts:107`) is
+     * required and two shared ladder rows read it directly; nothing before
+     * this field supplied it to anything score-shaped. Read off
+     * `record.evaluatorRecommendation` the same way `mode` already is above:
+     * restated, never derived, recomputed, or defaulted.
+     */
+    readonly evaluatorRecommendation: EvaluatorRecommendation;
+    /** ascending `sequence`, then `observationId`, so the record's array order is never what a consumer reads. */
+    readonly observations: readonly Observation[];
+    /** ascending `findingId`; entries sharing one keep their presented order, which is all the record supplies. */
+    readonly findings: readonly SealedRunRecord['findings'][number][];
+    /** ascending `oracleId`, on the same terms as `findings`. */
+    readonly dispositions: readonly OracleDisposition[];
+    readonly conditions: readonly IngestCondition[];
+    readonly unwitnessedQuotations: readonly UnwitnessedQuotation[];
+    /** empty when nothing fired; one entry per offending value, never a joined summary. */
+    readonly isolationViolation: readonly string[];
+};
+/**
+ * The stage. Reads nothing outside its three declared inputs: a rule needing
+ * the eval contract, the rubric, or bytes resolved through the corpus port is
+ * routed to whoever declares them rather than absorbed here on the strength of
+ * being nearby.
+ *
+ * Two rules read the evaluator configuration and they are separate. AD-32's
+ * agreement rule compares the digest the record declares against the one the
+ * manifest declares, which is `cross-artifact-disagreement` and never reads the
+ * artifact. AD-24 and AD-11 require the digest to be recomputed from the
+ * artifact, which is the only one of the three that is not caller-attested and
+ * is why the artifact is a declared input at all.
+ *
+ * AD-24's "absent or incomplete" splits the same way the manifest's does:
+ * incomplete is a schema rejection the application boundary already raises, and
+ * absent is a shape no schema can describe, so the parameter admits `null`.
+ */
+export declare const ingest: IngestStage<ValidatedObservations>;

package/dist/core/ingest/ingest.js

@@ -0,0 +1,318 @@
+/**
+ * AD-24's ingest stage: three already-parsed artifacts in, the validated
+ * observations plus every condition detected out.
+ *
+ * The organizing rule is the isolation manifest's own `.meta` sentence, "a
+ * schema rejection is the correct expression of unparseable and incomplete, so
+ * nothing is admitted for their sake, and the violating case is
+ * `core/ingest`'s". Bytes that will not parse are the application layer's to
+ * reject; bytes that parse and then contradict each other are a finding about
+ * the run. So a detected problem is returned as data and nothing here throws.
+ *
+ * One fault does propagate and is named, from two call sites into the same
+ * module. `auditQuotation` canonicalizes the three structured evidence
+ * channels, and the evaluator configuration's digest is recomputed by
+ * canonicalizing the whole artifact, so an unsafe integer or a lone surrogate in
+ * either raises AD-28's `non-canonicalizable-value` out of `core/canonical`. It
+ * is neither caught nor re-raised here, which is what lets a caller tell an
+ * invalid run from a crashed one.
+ *
+ * Nothing here re-derives what `resolveOutcome` already decides. Its ten
+ * invalidating conditions are per oracle and reach the ladder through
+ * `outcome.resolution.invalidatingConditions`; these eleven are per record and
+ * reach it through `EvidenceIntegrityInputs` and `OutcomeStateInputs`. Two
+ * pairs are related rather than identical: `judge-result-unscored` is the
+ * derivation `OutcomeInputs.judgeConduct` has never had, and a
+ * `dangling-citation` and an `unwitnessed-detection-claim` can both fire on one
+ * finding, in which case the basis names both and the rung is the same either
+ * way.
+ */
+import { digestArtifact } from '../canonical/digest.js';
+import { FORBIDDEN_INPUT_FLOOR } from '../schemas/eval-contract.js';
+import { auditQuotation, } from '../score/quotation.js';
+import { AGREEMENT_FIELDS } from './conditions.js';
+/**
+ * Observed values with no entry in their allowlist, in the manifest's own array
+ * order and each named once. A value observed twice outside its allowlist is one
+ * value outside its allowlist; the payload is what a consumer renders, and
+ * `isolationViolation` is specified as one entry per offending value.
+ */
+const outsideAllowlist = (observed, allowed) => {
+    const permitted = new Set(allowed);
+    return [...new Set(observed)].filter((value) => !permitted.has(value));
+};
+/** The path AD-27 digests the evaluator configuration under, matching `seal.ts`'s treatment of the contract. */
+const EVALUATOR_CONFIGURATION_ARTIFACT_PATH = 'EvaluatorConfiguration';
+/**
+ * A total order over the two condition families whose source array declares no
+ * order of its own. A finding carries no sequence field and a judge result is
+ * addressed by its `(rubricId, criterionId)` pair, so reading either in array
+ * position would make the recorded conditions depend on a position NFR9 forbids
+ * reading; `auditQuotation` sorts its own result for the same reason.
+ *
+ * Keyed on the whole payload rather than on the identifier alone. `observations`
+ * is the only one of the three arrays the record schema refines for uniqueness,
+ * so a repeated `findingId` and a repeated `(rubricId, criterionId)` are both
+ * representable, and a comparator keyed on the identifier would leave the tied
+ * pair ordered by the array position the sort exists to stop reading. Entries
+ * that still tie here are equal values, so the order between them cannot be
+ * observed.
+ *
+ * Joined on U+0000 rather than compared position by position. Every identifier
+ * in a key is drawn from `IDENTIFIER_SOURCE` or a `X-digits` prefix form, whose
+ * lowest code point is U+002D, so the separator sorts below every character a
+ * segment can carry and the joined comparison is the element-wise one.
+ */
+const compareKeys = (left, right) => {
+    const a = left.join('\u0000');
+    const b = right.join('\u0000');
+    return a < b ? -1 : a > b ? 1 : 0;
+};
+/**
+ * The stage. Reads nothing outside its three declared inputs: a rule needing
+ * the eval contract, the rubric, or bytes resolved through the corpus port is
+ * routed to whoever declares them rather than absorbed here on the strength of
+ * being nearby.
+ *
+ * Two rules read the evaluator configuration and they are separate. AD-32's
+ * agreement rule compares the digest the record declares against the one the
+ * manifest declares, which is `cross-artifact-disagreement` and never reads the
+ * artifact. AD-24 and AD-11 require the digest to be recomputed from the
+ * artifact, which is the only one of the three that is not caller-attested and
+ * is why the artifact is a declared input at all.
+ *
+ * AD-24's "absent or incomplete" splits the same way the manifest's does:
+ * incomplete is a schema rejection the application boundary already raises, and
+ * absent is a shape no schema can describe, so the parameter admits `null`.
+ */
+export const ingest = (record, manifest, configuration) => {
+    const conditions = [];
+    // Prior to every other check: a record that uses one identifier twice cannot
+    // address its own entries, and every consumer downstream addresses by them.
+    // Reported before the conditions that name one, so a reader meets the
+    // ambiguity before a condition that relies on it.
+    //
+    // Observations lead because a repeat there changes an answer rather than an
+    // order: `auditQuotation` indexes them into a `Map` keyed on `observationId`,
+    // so the last entry with a repeated identifier wins and decides which body a
+    // quotation is checked against.
+    for (const [subject, identifiers] of [
+        [
+            'observation',
+            record.observations.map((observation) => observation.observationId),
+        ],
+        ['finding', record.findings.map((finding) => finding.findingId)],
+        [
+            'oracle-disposition',
+            record.oracleDispositions.map((disposition) => disposition.oracleId),
+        ],
+        // AD-17's "one judge call scoring all named criteria", read as far as
+        // one record can be read: a criterion scored twice is not one call's
+        // product whatever the rest of the record says. Keyed by the pair,
+        // since two rubrics may each declare a criterion of the same name.
+        [
+            'judge-result',
+            record.judgeResults.map((result) => `${result.rubricId}/${result.criterionId}`),
+        ],
+    ]) {
+        const counts = new Map();
+        for (const identifier of identifiers) {
+            counts.set(identifier, (counts.get(identifier) ?? 0) + 1);
+        }
+        const repeated = [...counts.entries()]
+            .filter(([, occurrences]) => occurrences > 1)
+            .sort((a, b) => compareKeys([a[0]], [b[0]]));
+        for (const [identifier, occurrences] of repeated) {
+            conditions.push({
+                kind: 'duplicate-record-identifier',
+                subject,
+                identifier,
+                occurrences,
+            });
+        }
+    }
+    // A cited identifier matching a declared observation is the cross-artifact
+    // rule `observationIds` leaves to this stage. Declared on every finding
+    // branch, so the check is too: AD-23's word is "additionally", a floor on
+    // `defect` rather than a prohibition on the other two.
+    const declared = new Set(record.observations.map((observation) => observation.observationId));
+    const dangling = record.findings
+        .map((finding) => ({
+        findingId: finding.findingId,
+        // Deduplicated first, in first-citation order: the condition names
+        // which identifiers resolved to nothing, and a finding citing one
+        // twice has one bad citation to report rather than two.
+        unresolvedObservationIds: [...new Set(finding.observationIds)].filter((observationId) => !declared.has(observationId)),
+    }))
+        .filter((entry) => entry.unresolvedObservationIds.length > 0)
+        .sort((a, b) => compareKeys([a.findingId, ...a.unresolvedObservationIds], [b.findingId, ...b.unresolvedObservationIds]));
+    for (const entry of dangling) {
+        conditions.push({ kind: 'dangling-citation', ...entry });
+    }
+    // The same rule over the record's second citation site. `resolveOutcome`
+    // reads a disposition's `observationIds` only for emptiness, so a `violated`
+    // disposition whose one citation names nothing would otherwise be believed,
+    // which is the shape AD-33 says invalidates rather than being believed.
+    const danglingDispositions = record.oracleDispositions
+        .map((disposition) => ({
+        oracleId: disposition.oracleId,
+        unresolvedObservationIds: [...new Set(disposition.observationIds)].filter((observationId) => !declared.has(observationId)),
+    }))
+        .filter((entry) => entry.unresolvedObservationIds.length > 0)
+        .sort((a, b) => compareKeys([a.oracleId, ...a.unresolvedObservationIds], [b.oracleId, ...b.unresolvedObservationIds]));
+    for (const entry of danglingDispositions) {
+        conditions.push({ kind: 'dangling-disposition-citation', ...entry });
+    }
+    // ADR-009 Decision 2's precedence: cited identifiers govern the witness
+    // match and quotation audits it. This is that audit's caller.
+    const unwitnessedQuotations = auditQuotation(record);
+    if (unwitnessedQuotations.length > 0) {
+        conditions.push({
+            kind: 'unwitnessed-quotation',
+            quotations: unwitnessedQuotations,
+        });
+    }
+    const isolationViolation = [];
+    if (manifest === null) {
+        // AD-16's absent case. The agreement and forbidden-input checks read
+        // manifest fields and cannot run; every record-internal check still does,
+        // so a run that is both manifest-less and internally inconsistent reports
+        // both rather than only the first.
+        conditions.push({ kind: 'isolation-manifest-absent' });
+        isolationViolation.push('isolation manifest absent');
+    }
+    else {
+        const mounts = outsideAllowlist(manifest.observedMounts, manifest.allowedMounts);
+        const networkTargets = outsideAllowlist(manifest.observedNetworkTargets, manifest.networkAllowlist);
+        const toolCalls = outsideAllowlist(manifest.observedToolCalls, manifest.toolAllowlist);
+        // One count over the three allowlists. The condition is "some observed
+        // value sits outside its allowlist", and asking it as three
+        // short-circuiting disjuncts would leave two of them evaluated in one
+        // direction only.
+        const exceeded = mounts.length + networkTargets.length + toolCalls.length;
+        if (manifest.violation !== null || exceeded > 0) {
+            conditions.push({
+                kind: 'isolation-manifest-violation',
+                violation: manifest.violation,
+                mountsOutsideAllowlist: mounts,
+                networkTargetsOutsideAllowlist: networkTargets,
+                toolCallsOutsideAllowlist: toolCalls,
+            });
+            // The declared violation first, then mounts, network targets, and tool
+            // calls, each in the manifest's own array order and one entry per
+            // offending value.
+            if (manifest.violation !== null) {
+                isolationViolation.push(`manifest violation: ${manifest.violation}`);
+            }
+            for (const value of mounts) {
+                isolationViolation.push(`mount outside allowlist: ${value}`);
+            }
+            for (const value of networkTargets) {
+                isolationViolation.push(`network target outside allowlist: ${value}`);
+            }
+            for (const value of toolCalls) {
+                isolationViolation.push(`tool call outside allowlist: ${value}`);
+            }
+        }
+        // AD-16's "account for each forbidden input by name". Read off the floor
+        // rather than off the manifest's own key order, so the seven are named in
+        // the order the list that generates them declares.
+        const admitted = FORBIDDEN_INPUT_FLOOR.filter((input) => !manifest.forbiddenInputAccounting[input].withheld);
+        if (admitted.length > 0) {
+            conditions.push({
+                kind: 'forbidden-input-not-withheld',
+                inputs: admitted,
+            });
+        }
+        // AD-32's agreement rule. Both artifacts carry all three fields, so the
+        // comparison is between them and never against the configuration artifact
+        // standing behind the digest.
+        for (const field of AGREEMENT_FIELDS) {
+            if (record[field] === manifest[field])
+                continue;
+            conditions.push({
+                kind: 'cross-artifact-disagreement',
+                field,
+                recordValue: record[field],
+                manifestValue: manifest[field],
+            });
+        }
+    }
+    // AD-24: "ingest computes its digest from the artifact and invalidates the
+    // run when it is absent or incomplete", restated by AD-11 as the one
+    // scoring-version input this stage recomputes. The record's declaration is
+    // the operand because AD-32 puts the trust boundary there: a caller that
+    // declares one configuration and runs another leaves the two declarations
+    // agreeing and only the recomputation disagreeing.
+    if (configuration === null) {
+        conditions.push({ kind: 'evaluator-configuration-absent' });
+    }
+    else {
+        const computedDigest = digestArtifact(configuration, EVALUATOR_CONFIGURATION_ARTIFACT_PATH);
+        if (computedDigest !== record.evaluatorConfigurationDigest) {
+            conditions.push({
+                kind: 'evaluator-configuration-digest-mismatch',
+                declaredDigest: record.evaluatorConfigurationDigest,
+                computedDigest,
+            });
+        }
+    }
+    // AD-17's record-decidable half. `null` is the shape AD-6's `judge-error`
+    // fires on, which is why the schema must parse it and why this is a condition
+    // rather than a parse failure.
+    //
+    // Deduplicated by the pair that addresses the result: `judgeResults` carries
+    // no uniqueness refinement, so one criterion may appear twice, and two
+    // byte-identical conditions naming one criterion are one finding a basis line
+    // can act on rather than two.
+    //
+    // The two citation families deduplicate identifiers inside an entry and never
+    // the entries themselves, which is the opposite answer to the same shape and
+    // is deliberate. A repeated `(rubricId, criterionId)` is one criterion scored
+    // twice, so the second entry names nothing new. Two findings sharing a
+    // `findingId` are two findings the record cannot address apart, and their
+    // citations may differ, so collapsing them would drop a bad citation on the
+    // floor.
+    const unscored = [
+        ...new Map(record.judgeResults
+            .filter((result) => result.score === null)
+            .map((result) => [
+            `${result.rubricId}/${result.criterionId}`,
+            { rubricId: result.rubricId, criterionId: result.criterionId },
+        ])).values(),
+    ].sort((a, b) => compareKeys([a.rubricId, a.criterionId], [b.rubricId, b.criterionId]));
+    for (const entry of unscored) {
+        conditions.push({ kind: 'judge-result-unscored', ...entry });
+    }
+    return {
+        // Read off the record and restated, never derived, recomputed, or
+        // defaulted, the same posture `mode` below takes.
+        runId: record.runId,
+        // Read off the record and restated, never derived, recomputed, or
+        // defaulted: AD-21 fixes mode before ingest and there is no fourth
+        // parameter for a caller to disagree with it through.
+        mode: record.mode,
+        evaluatorRecommendation: record.evaluatorRecommendation,
+        // `selectObservations`' own sort, matched exactly so two readers of one
+        // record cannot disagree about which observation came first. The
+        // identifier tie-break cannot fire on a record that parsed, since
+        // `sequence` is refined unique per record; it is kept for comparator
+        // identity with the shipped sort rather than because the case is real.
+        observations: [...record.observations].sort((a, b) => a.sequence - b.sequence || (a.observationId < b.observationId ? -1 : 1)),
+        // Sorted for the same reason the conditions are: neither array declares an
+        // order, so carrying the record's would make the product depend on a
+        // position nothing may read. The identifier is a total key on any record
+        // that does not repeat one, and a record that does repeats it into a
+        // `duplicate-record-identifier` condition, so the one input whose product
+        // still varies with presentation order is one the run already reports as
+        // unaddressable. Ordering that pair by content instead would mean
+        // canonicalizing every finding, which buys determinism for a record
+        // already flagged at the cost of making `non-canonicalizable-value`
+        // reachable from a field no quotation cites.
+        findings: [...record.findings].sort((a, b) => compareKeys([a.findingId], [b.findingId])),
+        dispositions: [...record.oracleDispositions].sort((a, b) => compareKeys([a.oracleId], [b.oracleId])),
+        conditions,
+        unwitnessedQuotations,
+        isolationViolation,
+    };
+};

package/dist/core/lineage/stage-table.d.ts

@@ -1,9 +1,10 @@
 /**
  * AD-24's stage-signature table and AD-29's producer map, as data: six stages
- * with their inputs, their one owned output, and the lineage edge each writes;
- * twelve interchange artifacts with one producer apiece. The `check:lineage`
- * scanner derives its allowlist from `module`, so the registry import stays
- * type-only to keep zod off that gate's load path.
+ * with their artifact inputs, the non-artifact values they receive, their one
+ * owned output, and the lineage edge each writes; twelve interchange artifacts
+ * with one producer apiece. The `check:lineage` scanner derives its allowlist
+ * from `module`, so the registry import stays type-only to keep zod off that
+ * gate's load path.
  */
 import type { InterchangeArtifactKey } from '../schemas/artifact.ts';
 /** AD-24's six stages, in the order the Consistency Conventions list them. */
@@ -16,6 +17,20 @@ export type PipelineStage = (typeof PIPELINE_STAGES)[number];
  */
 export declare const INTERNAL_PRODUCTS: readonly ['probe-plan', 'probe-observations', 'validated-observations', 'scored-outcomes-and-verdict'];
 export type InternalProduct = (typeof INTERNAL_PRODUCTS)[number];
+/**
+ * Values a stage reads at its boundary that the `inputs` column does not name.
+ * AD-24 writes the table in artifacts, and owed item 6 records the source of
+ * run mode as absent from it: a row naming `sealed-run-record` says which bytes
+ * arrive and leaves open which value fixes the run's mode. Closed rather than
+ * free text, so the column cannot become a notes field.
+ *
+ * The three digests join `mode` for the same reason: they are exactly what
+ * this column exists for, "values a stage reads at its boundary that the
+ * inputs column does not name" -- `emit`'s three caller-attested AD-11
+ * digests have no artifact source anywhere in this pipeline.
+ */
+export declare const STAGE_VALUE_INPUTS: readonly ['mode', 'corpusDigest', 'fixtureDigest', 'evaluatorConfigurationDigest'];
+export type StageValueInput = (typeof STAGE_VALUE_INPUTS)[number];
 /**
  * What a stage does to the two AD-29 fields on the artifact it owns. `mints`
  * covers a root and a revision alike, since both write the fields.
@@ -25,6 +40,8 @@ export type LineageEdge = 'mints' | 'carries-through' | 'none';
 export type ArtifactProducer = PipelineStage | 'caller' | 'embedded';
 export type StageSignature = {
     readonly inputs: readonly (InterchangeArtifactKey | InternalProduct)[];
+    /** non-artifact values the stage receives; see STAGE_VALUE_INPUTS. */
+    readonly valueInputs: readonly StageValueInput[];
     readonly owns: InterchangeArtifactKey | InternalProduct;
     /** the owned output's registry key; null when the output is internal. */
     readonly ownsInterchange: InterchangeArtifactKey | null;

package/dist/core/lineage/stage-table.js

@@ -18,9 +18,28 @@ export const INTERNAL_PRODUCTS = [
     'validated-observations',
     'scored-outcomes-and-verdict',
 ];
+/**
+ * Values a stage reads at its boundary that the `inputs` column does not name.
+ * AD-24 writes the table in artifacts, and owed item 6 records the source of
+ * run mode as absent from it: a row naming `sealed-run-record` says which bytes
+ * arrive and leaves open which value fixes the run's mode. Closed rather than
+ * free text, so the column cannot become a notes field.
+ *
+ * The three digests join `mode` for the same reason: they are exactly what
+ * this column exists for, "values a stage reads at its boundary that the
+ * inputs column does not name" -- `emit`'s three caller-attested AD-11
+ * digests have no artifact source anywhere in this pipeline.
+ */
+export const STAGE_VALUE_INPUTS = [
+    'mode',
+    'corpusDigest',
+    'fixtureDigest',
+    'evaluatorConfigurationDigest',
+];
 export const STAGE_SIGNATURES = {
     compile: {
         inputs: ['eval-contract'],
+        valueInputs: [],
         owns: 'eval-contract',
         ownsInterchange: 'eval-contract',
         // The caller authors the contract and its lineage; `compile` validates
@@ -31,6 +50,7 @@ export const STAGE_SIGNATURES = {
     },
     seal: {
         inputs: ['eval-contract'],
+        valueInputs: [],
         owns: 'sealed-evaluator-brief',
         ownsInterchange: 'sealed-evaluator-brief',
         lineage: 'mints',
@@ -42,15 +62,21 @@ export const STAGE_SIGNATURES = {
             'isolation-manifest',
             'evaluator-configuration',
         ],
+        // Mode arrives on the sealed run record and is named here because owed
+        // item 6 asks the table for the source of run mode. `ingest` is the last
+        // stage that may read it from the caller and the first that may reject
+        // its absence; no later stage derives, recomputes, or defaults it.
+        valueInputs: ['mode'],
         owns: 'validated-observations',
         ownsInterchange: null,
         lineage: 'none',
-        module: null,
+        module: 'src/core/ingest/ingest.ts',
     },
     preflight: {
         // AD-34 splits the stage into `plan` and `reduce`; both halves' inputs
         // are the stage's inputs, and only `reduce` returns an artifact.
         inputs: ['eval-contract', 'probe', 'probe-plan', 'probe-observations'],
+        valueInputs: [],
         owns: 'preflight-verdict',
         ownsInterchange: 'preflight-verdict',
         lineage: 'mints',
@@ -64,19 +90,25 @@ export const STAGE_SIGNATURES = {
             'preflight-verdict',
             'scoring-policy',
         ],
+        valueInputs: [],
         // AD-24: "score produces the outcome and verdict values emit
         // serializes". Owed item 6 records that type as unnamed; this names it.
         owns: 'scored-outcomes-and-verdict',
         ownsInterchange: null,
         lineage: 'none',
-        module: null,
+        module: 'src/core/score/score.ts',
     },
     emit: {
         inputs: ['scored-outcomes-and-verdict'],
+        valueInputs: [
+            'corpusDigest',
+            'fixtureDigest',
+            'evaluatorConfigurationDigest',
+        ],
         owns: 'evidence-artifact',
         ownsInterchange: 'evidence-artifact',
         lineage: 'mints',
-        module: null,
+        module: 'src/core/emit/emit.ts',
     },
 };
 export const ARTIFACT_PRODUCERS = {

package/dist/core/preflight/plan.d.ts

@@ -1,5 +1,6 @@
+import type { ReferenceSetKeys } from '../evaluate/resolution.ts';
 import type { EvalContract } from '../schemas/eval-contract.ts';
-import type { Operation } from '../schemas/interface.ts';
+import type { AnyOperation } from '../schemas/interface.ts';
 import type { ProbeRequest } from '../schemas/port-messages.ts';
 import type { JsonValue } from '../schemas/primitives.ts';
 import type { Probe } from '../schemas/probe.ts';
@@ -15,7 +16,7 @@ export type PlannedLeg = {
     readonly legId: string;
     readonly purpose: PlannedLegPurpose;
     readonly request: ProbeRequest;
-    readonly operation: Operation;
+    readonly operation: AnyOperation;
     readonly inputs: WitnessInputs;
 };
 export type PlannedCheck = {
@@ -28,7 +29,7 @@ export type PlannedCheck = {
     readonly interfaceId: string;
     readonly operationId: string;
     readonly witness: SensitivityWitness | null;
-    readonly operation: Operation;
+    readonly operation: AnyOperation;
 } | {
     readonly kind: 'state-reset';
     readonly legIds: readonly [string, string];
@@ -39,19 +40,20 @@ export type PlannedCheck = {
     readonly kind: 'seeded-faults-scoped';
     readonly defectId: string;
     readonly witness: ManifestationWitness;
-    readonly operation: Operation;
+    readonly operation: AnyOperation;
     readonly cleanLegIds: readonly string[];
 } | {
     readonly kind: 'seeded-fault-fired';
     readonly defectId: string;
     readonly witness: ManifestationWitness | null;
-    readonly operation: Operation | null;
+    readonly operation: AnyOperation | null;
 };
 export type PreflightPlan = {
     readonly runId: string;
     readonly legs: readonly PlannedLeg[];
     readonly checks: readonly PlannedCheck[];
     readonly referenceSets: Readonly<Record<string, JsonValue[]>>;
+    readonly referenceSetKeys: ReferenceSetKeys;
 };
 /**
  * AD-10's plan, derived from the interfaces the contract's probes exercise.