eval-quality 0.1.0 → 0.3.0

package/dist/core/schemas/plan.js

@@ -1,5 +1,6 @@
 /** the interaction plan: steps as selectors over observations. */
 import { z } from 'zod';
+import { InteractionPointer } from './pointer.js';
 import { Identifier, JsonValue, KeyName } from './primitives.js';
 /**
  * AD-39: input-binding values are tagged and never share a value space. The
@@ -7,10 +8,52 @@ import { Identifier, JsonValue, KeyName } from './primitives.js';
  * one implementation and the literal string to another, and flipped a witness
  * match between `caught` and `missed` on one record; that form is
  * unrepresentable here.
+ *
+ * Four members, one tag each. `{ literal }` writes the sent value down;
+ * `{ matcher: 'any' }` binds whatever was sent and `{ matcher: 'type-violating' }`
+ * binds a value whose JSON type differs from the operation's declared type for
+ * the key, which is how AD-31 rule 3's malformed-input behaviour is addressed.
+ *
+ * `{ captured }` addresses an earlier step's declared scalar output. Owed item
+ * 3: a `POST` returning a server-generated identifier followed by a `GET`
+ * proving persistence is unwritable with the first two, since a literal
+ * hard-codes a resource the evaluator never created and `any` matches
+ * unrelated reads. "Earlier" is earlier in the capture graph's own topological
+ * order, which `binding-cycle` makes exist. It is deliberately not AD-39's
+ * `after` clause: `nested-temporal-clause` already rejects every `after` cycle,
+ * so a capture forced to follow an `after` edge would leave `binding-cycle`
+ * unfireable. At score time the ordering is the record's `sequence`.
+ *
+ * `{ principal }` names a principal `testData.principals` declares. The two
+ * critical-severity cross-user behaviours (act as A, read as B, must be denied
+ * or absent) bind a step to an account that is neither a literal, since AD-19
+ * forbids credential values in declarations, nor an earlier step's output,
+ * since accounts are provisioned outside the observation stream. The name is
+ * an opaque label carrying no account identifier, credential, or subject data
+ * (AD-18). An undeclared name fires `undeclared-mandatory-input` in strict
+ * mode; a Zod refinement here would be a cross-subtree constraint the export
+ * cannot carry, and the published-schema differential sweep synthesises a
+ * union-branch witness that would expose the disagreement.
+ *
+ * A captured pointer resolves to a declared scalar with no transform applied,
+ * which keeps AD-4's ban on arithmetic, projection, and user-defined functions
+ * holding by construction: the grammar has no place to write one.
  */
+/**
+ * The first two members, named individually so the probe-side selector under
+ * AD-40 admits exactly these two and nothing else. Bare `export const` with no
+ * `.meta({ id })`: an id would collapse the branches to `$ref`s and mint new
+ * `$defs`, so the export stays byte-identical.
+ */
+export const LiteralBindingValue = z.strictObject({ literal: JsonValue });
+export const MatcherBindingValue = z.strictObject({
+    matcher: z.enum(['any', 'type-violating']),
+});
 export const BindingValue = z.union([
-    z.strictObject({ literal: JsonValue }),
-    z.strictObject({ matcher: z.enum(['any', 'type-violating']) }),
+    LiteralBindingValue,
+    MatcherBindingValue,
+    z.strictObject({ captured: InteractionPointer }),
+    z.strictObject({ principal: Identifier }),
 ]);
 /** the constraint identifier the ledger carries for the check below. */
 export const BINDING_CHANNEL_NON_EMPTY = 'binding-channel-non-empty';
@@ -37,12 +80,54 @@ export const BindingChannel = BindingChannelMap.nullable().meta({
  * requires every member at parse time and fails five of the Gate C fixture's
  * six steps, all of which bind a subset of the channels.
  */
-export const InputBinding = z.strictObject({
+export const ApiInputBinding = z.strictObject({
     path: BindingChannel,
     query: BindingChannel,
     header: BindingChannel,
     body: BindingChannel,
 });
+/** The same shape over the four channels a command-kind operation accepts. */
+export const CommandInputBinding = z.strictObject({
+    argument: BindingChannel,
+    option: BindingChannel,
+    environment: BindingChannel,
+    stdin: BindingChannel,
+});
+/**
+ * A plain union rather than a discriminated one, and the agreement between a
+ * step's bound channels and its operation's kind is a compile-time check
+ * rather than a schema refinement.
+ *
+ * A step names an `operationId` and nothing else; the kind of the interface
+ * declaring that operation lives in a different subtree of the same document.
+ * That is the cross-subtree constraint the `{ principal }` comment above
+ * already records as unrepresentable in the export. Adding a `kind` field to
+ * the step itself was the other option and duplicates a fact the operation
+ * already carries, which makes a disagreeing step a second inconsistency to
+ * check rather than one fewer.
+ */
+export const InputBinding = z.union([ApiInputBinding, CommandInputBinding]);
+/**
+ * AD-39's declared selector cardinality (owed item 2): what a step means when
+ * its selector matches more than one observation was not decided at the
+ * architecture layer, so a first-match scorer and a last-match scorer could
+ * bind different evidence. The contract now declares the rule per step.
+ * `several` under `exactly-one`/`at-most-one` is a named ambiguity condition;
+ * a reference function returns it as data. Routing that ambiguity to a
+ * verdict rung is later work. `any` is unrelated to
+ * `BindingValue`'s `{ matcher: 'any' }` above: same string, different field,
+ * no type-level collision. `ExpectedCardinality` (`interface.ts`) is a
+ * second, unrelated reuse of the word for AD-20's response-collection
+ * cardinality, and its `at-most` mode is a near-miss for `at-most-one` here;
+ * different type, different field, no collision, but easy to misread as the
+ * same declaration.
+ */
+export const SELECTOR_CARDINALITIES = [
+    'exactly-one',
+    'at-most-one',
+    'any',
+];
+export const SelectorCardinality = z.enum(SELECTOR_CARDINALITIES);
 /**
  * AD-39: a step is a selector over observations the evaluator produced, never
  * an instruction. Its selection predicate is spelled as its two members, the
@@ -55,4 +140,5 @@ export const InteractionStep = z.strictObject({
     operationId: Identifier,
     inputBinding: InputBinding,
     after: Identifier.nullable().describe("The temporal clause: the identifier of an earlier step, or `null`. That the named step carries no clause of its own is AD-39's one-level bound, which fires `nested-temporal-clause` at compile time and is deliberately not enforced here, so the code keeps a shape to fire on."),
+    cardinality: SelectorCardinality.describe("AD-39's declared selector cardinality (owed item 2): `exactly-one` or `at-most-one` when the step expects a single matching observation, `any` when several are legitimate. Several matches under `exactly-one`/`at-most-one` is the named ambiguity condition; a reference selection function returns it as data. Required rather than optional, which makes this a BREAKING `schemaVersion` bump under AD-11: adding an optional field is additive, and this field is not optional."),
 });

package/dist/core/schemas/pointer.d.ts

@@ -7,9 +7,10 @@ import { z } from 'zod';
  * are exported here because the Sealed Run Record's quoted evidence needs to
  * name a channel by one shared spelling.
  */
-export declare const EVIDENCE_CHANNELS: readonly ['response-body', 'response-headers', 'response-status', 'call-inputs', 'stdout', 'stderr', 'exit-code'];
+export declare const EVIDENCE_CHANNELS: readonly ['response-body', 'response-headers', 'response-status', 'call-inputs', 'stdout', 'stderr', 'exit-code', 'artifact'];
 export type EvidenceChannelName = (typeof EVIDENCE_CHANNELS)[number];
 export declare const EvidenceChannel: z.ZodEnum<{
+    artifact: "artifact";
     "call-inputs": "call-inputs";
     "exit-code": "exit-code";
     "response-body": "response-body";
@@ -31,9 +32,54 @@ export declare const TransportChannel: z.ZodEnum<{
     path: "path";
     query: "query";
 }>;
+/**
+ * The four channels a command-kind operation accepts input on. They sit beside
+ * the transport channels because this module owns channel vocabulary, and the
+ * request shape that declares them has to name them without forward-declaring
+ * a tuple it does not own.
+ *
+ * `stdin` is the command analogue of `body` and inherits its asymmetry: a
+ * request shape declares it as a key map, while one witness leg supplies it as
+ * a tagged body value.
+ */
+export declare const COMMAND_CHANNELS: readonly ['argument', 'option', 'environment', 'stdin'];
+export type CommandChannelName = (typeof COMMAND_CHANNELS)[number];
+/**
+ * Every channel `call-inputs` may take as its next segment, both kinds
+ * together. A pointer is parsed with no contract in hand, so the grammar
+ * admits all eight and the question of which four a given operation may use is
+ * answered by reachability, which has the operation.
+ */
+export declare const INPUT_CHANNELS: readonly ["path", "query", "header", "body", "argument", "option", "environment", "stdin"];
+export type InputChannelName = (typeof INPUT_CHANNELS)[number];
 export declare const TAIL_BEARING_CHANNELS: readonly ["response-body", "response-headers", "stdout", "stderr"];
 export declare const SCALAR_CHANNELS: readonly ["response-status", "exit-code"];
 export declare const TRANSPORT_ROOTED_CHANNEL: "call-inputs";
+export declare const IDENTIFIER_ROOTED_CHANNEL: "artifact";
+/**
+ * The response-side channels each kind produces, and neither produces the
+ * other's. Declared here rather than rebuilt from a description, so a channel
+ * added to the vocabulary has to be assigned to a side and a test can assert
+ * the two partition the response side exactly.
+ *
+ * `call-inputs` belongs to neither: it carries what was sent rather than what
+ * came back, and both kinds have it.
+ */
+export declare const API_RESPONSE_CHANNELS: readonly ["response-body", "response-headers", "response-status"];
+export declare const COMMAND_RESPONSE_CHANNELS: readonly ["stdout", "stderr", "exit-code", "artifact"];
+/**
+ * Every channel but the identifier-rooted one, in the vocabulary's own order.
+ *
+ * Spelled out and typed against the enum rather than filtered from it: a filter
+ * widens to `EvidenceChannelName[]` and `z.enum` needs a tuple, and the whole
+ * point of the list is that adding a ninth channel has to be a decision about
+ * which side of this line it falls on rather than something a filter absorbs.
+ * `tests/schemas/pointer.test.ts` asserts it partitions the vocabulary with
+ * `IDENTIFIER_ROOTED_CHANNEL` exactly.
+ */
+export declare const NON_IDENTIFIER_ROOTED_CHANNELS: readonly ["response-body", "response-headers", "response-status", "call-inputs", "stdout", "stderr", "exit-code"];
+/** Every channel that carries what came back, whichever kind produced it. */
+export declare const RESPONSE_SIDE_CHANNELS: readonly ["response-body", "response-headers", "response-status", "stdout", "stderr", "exit-code", "artifact"];
 export declare const INTERACTION_POINTER_PATTERN: RegExp;
 export declare const BOUND_ELEMENT_POINTER_PATTERN: RegExp;
 export declare const DESCRIPTOR_POINTER_PATTERN: RegExp;

package/dist/core/schemas/pointer.js

@@ -16,10 +16,11 @@ export const EVIDENCE_CHANNELS = [
     'stdout',
     'stderr',
     'exit-code',
+    'artifact',
 ];
 export const EvidenceChannel = z.enum(EVIDENCE_CHANNELS).meta({
     id: 'EvidenceChannel',
-    description: "AD-26's closed evidence channel vocabulary. The same seven the interaction-rooted pointer addresses; a channel outside this set is a syntax error rather than an unreachable-evidence finding.",
+    description: "AD-26's closed evidence channel vocabulary. The same eight the interaction-rooted pointer addresses; a channel outside this set is a syntax error rather than an unreachable-evidence finding.",
 });
 /**
  * AD-19's four transport channels. `call-inputs` alone has no declared
@@ -31,11 +32,37 @@ export const TransportChannel = z.enum(TRANSPORT_CHANNELS).meta({
     id: 'TransportChannel',
     description: "AD-19's four transport channels. They are the segment `call-inputs` takes before its tail, and the four keys an observation's recorded call inputs are keyed by.",
 });
-// The three-way partition (tail-bearing, scalar, transport-rooted) is spelled
-// out and typed against the enum rather than rebuilt from it, so a typo fails
-// the typecheck; a test asserts it stays disjoint and exhaustive. A status or
-// exit code is scalar, so a pointer into one is a syntax error rather than an
-// unreachable-evidence finding.
+/**
+ * The four channels a command-kind operation accepts input on. They sit beside
+ * the transport channels because this module owns channel vocabulary, and the
+ * request shape that declares them has to name them without forward-declaring
+ * a tuple it does not own.
+ *
+ * `stdin` is the command analogue of `body` and inherits its asymmetry: a
+ * request shape declares it as a key map, while one witness leg supplies it as
+ * a tagged body value.
+ */
+export const COMMAND_CHANNELS = [
+    'argument',
+    'option',
+    'environment',
+    'stdin',
+];
+/**
+ * Every channel `call-inputs` may take as its next segment, both kinds
+ * together. A pointer is parsed with no contract in hand, so the grammar
+ * admits all eight and the question of which four a given operation may use is
+ * answered by reachability, which has the operation.
+ */
+export const INPUT_CHANNELS = [
+    ...TRANSPORT_CHANNELS,
+    ...COMMAND_CHANNELS,
+];
+// The four-way partition (tail-bearing, scalar, transport-rooted,
+// identifier-rooted) is spelled out and typed against the enum rather than
+// rebuilt from it, so a typo fails the typecheck; a test asserts it stays
+// disjoint and exhaustive. A status or exit code is scalar, so a pointer into
+// one is a syntax error rather than an unreachable-evidence finding.
 export const TAIL_BEARING_CHANNELS = [
     'response-body',
     'response-headers',
@@ -47,13 +74,67 @@ export const SCALAR_CHANNELS = [
     'exit-code',
 ];
 export const TRANSPORT_ROOTED_CHANNEL = 'call-inputs';
+// A fourth class rather than a fourth rule. AD-26's repair for `call-inputs`
+// is that "a channel that names one of several things needs a declared segment
+// to resolve against", and a written file is the same situation: an operation
+// may write several, so the pointer names which one before its tail. The only
+// difference from `call-inputs` is that the segment is an open identifier
+// rather than a closed enum, because the artifact names are the contract
+// author's own. What the segment resolves against is the operation's declared
+// `artifacts` list, and a name absent from it is `unresolved-artifact-reference`
+// rather than evidence that resolves absent.
+export const IDENTIFIER_ROOTED_CHANNEL = 'artifact';
+/**
+ * The response-side channels each kind produces, and neither produces the
+ * other's. Declared here rather than rebuilt from a description, so a channel
+ * added to the vocabulary has to be assigned to a side and a test can assert
+ * the two partition the response side exactly.
+ *
+ * `call-inputs` belongs to neither: it carries what was sent rather than what
+ * came back, and both kinds have it.
+ */
+export const API_RESPONSE_CHANNELS = [
+    'response-body',
+    'response-headers',
+    'response-status',
+];
+export const COMMAND_RESPONSE_CHANNELS = [
+    'stdout',
+    'stderr',
+    'exit-code',
+    'artifact',
+];
+/**
+ * Every channel but the identifier-rooted one, in the vocabulary's own order.
+ *
+ * Spelled out and typed against the enum rather than filtered from it: a filter
+ * widens to `EvidenceChannelName[]` and `z.enum` needs a tuple, and the whole
+ * point of the list is that adding a ninth channel has to be a decision about
+ * which side of this line it falls on rather than something a filter absorbs.
+ * `tests/schemas/pointer.test.ts` asserts it partitions the vocabulary with
+ * `IDENTIFIER_ROOTED_CHANNEL` exactly.
+ */
+export const NON_IDENTIFIER_ROOTED_CHANNELS = [
+    'response-body',
+    'response-headers',
+    'response-status',
+    'call-inputs',
+    'stdout',
+    'stderr',
+    'exit-code',
+];
+/** Every channel that carries what came back, whichever kind produced it. */
+export const RESPONSE_SIDE_CHANNELS = [
+    ...API_RESPONSE_CHANNELS,
+    ...COMMAND_RESPONSE_CHANNELS,
+];
 // An RFC 6901 reference token: any character but "/" and "~", plus the two
 // escapes. A token may be empty, which is RFC 6901's spelling for a key that is
 // the empty string.
 const TOKEN = '(?:[^/~]|~[01])*';
 const TAIL = `(?:/${TOKEN})*`;
 const alternation = (members) => members.join('|');
-export const INTERACTION_POINTER_PATTERN = new RegExp(`^/interactions/${IDENTIFIER_CHARSET_SOURCE}/(?:(?:${alternation(TAIL_BEARING_CHANNELS)})${TAIL}|(?:${alternation(SCALAR_CHANNELS)})|${TRANSPORT_ROOTED_CHANNEL}/(?:${alternation(TRANSPORT_CHANNELS)})${TAIL})$`);
+export const INTERACTION_POINTER_PATTERN = new RegExp(`^/interactions/${IDENTIFIER_CHARSET_SOURCE}/(?:(?:${alternation(TAIL_BEARING_CHANNELS)})${TAIL}|(?:${alternation(SCALAR_CHANNELS)})|${TRANSPORT_ROOTED_CHANNEL}/(?:${alternation(INPUT_CHANNELS)})${TAIL}|${IDENTIFIER_ROOTED_CHANNEL}/${IDENTIFIER_CHARSET_SOURCE}${TAIL})$`);
 export const BOUND_ELEMENT_POINTER_PATTERN = new RegExp(`^@(?:/${TOKEN})+$`);
 export const DESCRIPTOR_POINTER_PATTERN = new RegExp(`^(?:/${TOKEN})*$`);
 /**
@@ -63,7 +144,7 @@ export const DESCRIPTOR_POINTER_PATTERN = new RegExp(`^(?:/${TOKEN})*$`);
 export const InteractionPointer = z
     .string()
     .regex(INTERACTION_POINTER_PATTERN)
-    .describe('AD-26 interaction-rooted pointer: "/interactions/{stepId}/" followed by one channel of the closed vocabulary. `call-inputs` takes one of the four transport channels as its next segment; `response-status` and `exit-code` take no tail. Syntax only: whether the step exists and whether the evidence is reachable are compile-time checks, not schema checks.');
+    .describe('AD-26 interaction-rooted pointer: "/interactions/{stepId}/" followed by one channel of the closed vocabulary. `call-inputs` takes one input channel as its next segment, one of the four transport channels or one of the four command channels; `artifact` takes the identifier of a file the operation declares it writes; `response-status` and `exit-code` take no tail. Syntax only: whether the step exists and whether the evidence is reachable are compile-time checks, not schema checks.');
 /**
  * Spelling 2, bound-element relative. Consumer: a `{ pointer }` operand inside
  * a quantifier predicate. Never an evidence target, because AD-3 computes

package/dist/core/schemas/port-messages.d.ts

@@ -29,19 +29,16 @@ export declare const FileWriteResponse: z.ZodObject<{
     byteLength: z.ZodInt;
 }, z.core.$strict>;
 /**
- * AD-35: the request names a logical interface identifier and never a URL,
- * host, or port. Mapping the identifier to an authorized target is the
- * adapter's, from configuration outside the contract.
- *
- * No credential appears here. AD-18 forbids a credential value in a
- * declaration, and the values that reach this shape come from a declaration;
- * authorization material is the adapter's, supplied by the same mapping that
- * authorizes the target.
+ * A request to an interface that speaks HTTP. Tagged on `kind` so an adapter
+ * knows what it is being asked to do before it reads anything else, and so the
+ * two shapes cannot be confused for one another by a field that happens to be
+ * absent.
  */
-export declare const ProbeRequest: z.ZodObject<{
+export declare const ApiProbeRequest: z.ZodObject<{
     probeId: z.ZodString;
     interfaceId: z.ZodString;
     operationId: z.ZodString;
+    kind: z.ZodLiteral<"api">;
     method: z.ZodEnum<{
         DELETE: "DELETE";
         GET: "GET";
@@ -64,6 +61,90 @@ export declare const ProbeRequest: z.ZodObject<{
         }, z.core.$strict>], "kind">;
     }, z.core.$strict>;
 }, z.core.$strict>;
+/**
+ * A request to run a command.
+ *
+ * AD-35's rule is that a contract names a logical identifier and the caller
+ * maps it, and the analogue for a command is exactly the same shape: the
+ * `executable` is the logical name the contract declared, and the adapter maps
+ * it to something runnable from configuration outside the contract. No
+ * filesystem path, no interpreter, no shell string. The adapter builds the
+ * argument vector; it is never handed one to execute.
+ *
+ * `environment` is string-valued for the reason `header` is, and carries no
+ * credential for the reason AD-18 gives: authorization material is the
+ * adapter's, supplied by the same mapping that authorizes the target.
+ */
+export declare const CommandProbeRequest: z.ZodObject<{
+    probeId: z.ZodString;
+    interfaceId: z.ZodString;
+    operationId: z.ZodString;
+    kind: z.ZodLiteral<"cli">;
+    executable: z.ZodString;
+    subcommandPath: z.ZodArray<z.ZodString>;
+    channels: z.ZodObject<{
+        argument: z.ZodRecord<z.ZodString, z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>;
+        option: z.ZodRecord<z.ZodString, z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>;
+        environment: z.ZodRecord<z.ZodString, z.ZodString>;
+        stdin: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"json">;
+            value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"text">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"absent">;
+        }, z.core.$strict>], "kind">;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const ProbeRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    probeId: z.ZodString;
+    interfaceId: z.ZodString;
+    operationId: z.ZodString;
+    kind: z.ZodLiteral<"api">;
+    method: z.ZodEnum<{
+        DELETE: "DELETE";
+        GET: "GET";
+        HEAD: "HEAD";
+        OPTIONS: "OPTIONS";
+        PATCH: "PATCH";
+        POST: "POST";
+        PUT: "PUT";
+    }>;
+    pathTemplate: z.ZodString;
+    channels: z.ZodObject<{
+        path: z.ZodRecord<z.ZodString, z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>;
+        query: z.ZodRecord<z.ZodString, z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>;
+        header: z.ZodRecord<z.ZodString, z.ZodString>;
+        body: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"json">;
+            value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"absent">;
+        }, z.core.$strict>], "kind">;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    probeId: z.ZodString;
+    interfaceId: z.ZodString;
+    operationId: z.ZodString;
+    kind: z.ZodLiteral<"cli">;
+    executable: z.ZodString;
+    subcommandPath: z.ZodArray<z.ZodString>;
+    channels: z.ZodObject<{
+        argument: z.ZodRecord<z.ZodString, z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>;
+        option: z.ZodRecord<z.ZodString, z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>;
+        environment: z.ZodRecord<z.ZodString, z.ZodString>;
+        stdin: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"json">;
+            value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"text">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"absent">;
+        }, z.core.$strict>], "kind">;
+    }, z.core.$strict>;
+}, z.core.$strict>], "kind">;
 /**
  * What the adapter observed. Deliberately response content only: no elapsed
  * time, no redirect count, no retry count. AD-35's caps are safety limits, so
@@ -75,10 +156,11 @@ export declare const ProbeRequest: z.ZodObject<{
  * policy denial, a cap, an abort, or a transport failure throws; a 500 is the
  * payload AD-10's seeded-fault check reads, never an error.
  */
-export declare const ProbeObservation: z.ZodObject<{
+export declare const ApiProbeObservation: z.ZodObject<{
     probeId: z.ZodString;
     interfaceId: z.ZodString;
     operationId: z.ZodString;
+    kind: z.ZodLiteral<"api">;
     status: z.ZodInt;
     headers: z.ZodRecord<z.ZodString, z.ZodString>;
     body: z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -91,6 +173,104 @@ export declare const ProbeObservation: z.ZodObject<{
         kind: z.ZodLiteral<"absent">;
     }, z.core.$strict>], "kind">;
 }, z.core.$strict>;
+/**
+ * What the adapter observed of a command run: its two streams, its exit code,
+ * and the files it wrote.
+ *
+ * `exitCode` is signed, unlike an HTTP status, because a process terminated by
+ * a signal is conventionally reported as a negative code and this field records
+ * what happened rather than what is tidy. A non-zero exit is an observation
+ * exactly as a 500 is: only a policy denial, a cap, an abort, or a failure to
+ * start the process throws.
+ *
+ * `artifacts` is keyed by the identifier the operation declared, not by a
+ * filesystem path. Which path each identifier names is the adapter's mapping,
+ * the same disclosure boundary AD-35 draws around the executable itself.
+ */
+export declare const CommandProbeObservation: z.ZodObject<{
+    probeId: z.ZodString;
+    interfaceId: z.ZodString;
+    operationId: z.ZodString;
+    kind: z.ZodLiteral<"cli">;
+    exitCode: z.ZodInt;
+    stdout: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"json">;
+        value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"text">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"absent">;
+    }, z.core.$strict>], "kind">;
+    stderr: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"json">;
+        value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"text">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"absent">;
+    }, z.core.$strict>], "kind">;
+    artifacts: z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"json">;
+        value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"text">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"absent">;
+    }, z.core.$strict>], "kind">>;
+}, z.core.$strict>;
+export declare const ProbeObservation: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    probeId: z.ZodString;
+    interfaceId: z.ZodString;
+    operationId: z.ZodString;
+    kind: z.ZodLiteral<"api">;
+    status: z.ZodInt;
+    headers: z.ZodRecord<z.ZodString, z.ZodString>;
+    body: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"json">;
+        value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"text">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"absent">;
+    }, z.core.$strict>], "kind">;
+}, z.core.$strict>, z.ZodObject<{
+    probeId: z.ZodString;
+    interfaceId: z.ZodString;
+    operationId: z.ZodString;
+    kind: z.ZodLiteral<"cli">;
+    exitCode: z.ZodInt;
+    stdout: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"json">;
+        value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"text">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"absent">;
+    }, z.core.$strict>], "kind">;
+    stderr: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"json">;
+        value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"text">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"absent">;
+    }, z.core.$strict>], "kind">;
+    artifacts: z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"json">;
+        value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"text">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"absent">;
+    }, z.core.$strict>], "kind">>;
+}, z.core.$strict>], "kind">;
 export type CorpusResolveRequest = z.infer<typeof CorpusResolveRequest>;
 export type CorpusResolveResponse = z.infer<typeof CorpusResolveResponse>;
 export type ClockReadRequest = z.infer<typeof ClockReadRequest>;
@@ -99,5 +279,9 @@ export type FileReadRequest = z.infer<typeof FileReadRequest>;
 export type FileReadResponse = z.infer<typeof FileReadResponse>;
 export type FileWriteRequest = z.infer<typeof FileWriteRequest>;
 export type FileWriteResponse = z.infer<typeof FileWriteResponse>;
+export type ApiProbeRequest = z.infer<typeof ApiProbeRequest>;
+export type CommandProbeRequest = z.infer<typeof CommandProbeRequest>;
 export type ProbeRequest = z.infer<typeof ProbeRequest>;
+export type ApiProbeObservation = z.infer<typeof ApiProbeObservation>;
+export type CommandProbeObservation = z.infer<typeof CommandProbeObservation>;
 export type ProbeObservation = z.infer<typeof ProbeObservation>;