eval-quality 0.1.0 → 0.3.0

package/dist/core/schemas/probe.d.ts

@@ -82,6 +82,129 @@ export declare const Probe: z.ZodDiscriminatedUnion<[z.ZodObject<{
     artifactDigest: z.ZodString;
     commitDigest: z.ZodString;
     rationale: z.ZodString;
+    qualification: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        route: z.ZodLiteral<"historical">;
+        failBeforeEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+        passAfterEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+        fixCommitDigest: z.ZodString;
+        oracleStableAcrossRevisions: z.ZodBoolean;
+    }, z.core.$strict>, z.ZodObject<{
+        route: z.ZodLiteral<"controlled-mutation">;
+        mutationSource: z.ZodString;
+        mutationOperator: z.ZodString;
+        targetArtifact: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+        expectedObservableFailure: z.ZodString;
+        baselinePassEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+        mutatedFailEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+        rollbackVerified: z.ZodBoolean;
+    }, z.core.$strict>, z.ZodObject<{
+        route: z.ZodLiteral<"gameability">;
+        degenerateResponse: z.ZodString;
+        naiveOracleSatisfiedEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+        disciplinedOracleRejectedEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+    }, z.core.$strict>, z.ZodObject<{
+        route: z.ZodLiteral<"canary">;
+        indicts: z.ZodEnum<{
+            corpus: "corpus";
+            fixture: "fixture";
+        }>;
+        nonDetectionEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+    }, z.core.$strict>, z.ZodObject<{
+        route: z.ZodLiteral<"clean-control">;
+        baselinePassEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+        revisionCommitDigest: z.ZodString;
+        noKnownDefectStatement: z.ZodString;
+    }, z.core.$strict>], "route">;
     expectedClean: z.ZodLiteral<true>;
     defects: z.ZodArray<z.ZodObject<{
         defectId: z.ZodString;
@@ -142,6 +265,129 @@ export declare const Probe: z.ZodDiscriminatedUnion<[z.ZodObject<{
     artifactDigest: z.ZodString;
     commitDigest: z.ZodString;
     rationale: z.ZodString;
+    qualification: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        route: z.ZodLiteral<"historical">;
+        failBeforeEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+        passAfterEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+        fixCommitDigest: z.ZodString;
+        oracleStableAcrossRevisions: z.ZodBoolean;
+    }, z.core.$strict>, z.ZodObject<{
+        route: z.ZodLiteral<"controlled-mutation">;
+        mutationSource: z.ZodString;
+        mutationOperator: z.ZodString;
+        targetArtifact: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+        expectedObservableFailure: z.ZodString;
+        baselinePassEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+        mutatedFailEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+        rollbackVerified: z.ZodBoolean;
+    }, z.core.$strict>, z.ZodObject<{
+        route: z.ZodLiteral<"gameability">;
+        degenerateResponse: z.ZodString;
+        naiveOracleSatisfiedEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+        disciplinedOracleRejectedEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+    }, z.core.$strict>, z.ZodObject<{
+        route: z.ZodLiteral<"canary">;
+        indicts: z.ZodEnum<{
+            corpus: "corpus";
+            fixture: "fixture";
+        }>;
+        nonDetectionEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+    }, z.core.$strict>, z.ZodObject<{
+        route: z.ZodLiteral<"clean-control">;
+        baselinePassEvidence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            storage: z.ZodLiteral<"public">;
+            path: z.ZodString;
+            privateRef: z.ZodNull;
+            digest: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            storage: z.ZodLiteral<"private">;
+            path: z.ZodNull;
+            privateRef: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>], "storage">;
+        revisionCommitDigest: z.ZodString;
+        noKnownDefectStatement: z.ZodString;
+    }, z.core.$strict>], "route">;
     expectedClean: z.ZodLiteral<false>;
     defects: z.ZodArray<z.ZodObject<{
         defectId: z.ZodString;
@@ -185,5 +431,190 @@ export declare const Probe: z.ZodDiscriminatedUnion<[z.ZodObject<{
             relation: z.ZodType<import("./expression.ts").Expression, unknown, z.core.$ZodTypeInternals<import("./expression.ts").Expression, unknown>>;
         }, z.core.$strict>>;
     }, z.core.$strict>>;
+    defectSignature: z.ZodNullable<z.ZodUnion<readonly [z.ZodObject<{
+        observableChannel: z.ZodEnum<{
+            artifact: "artifact";
+            "call-inputs": "call-inputs";
+            "exit-code": "exit-code";
+            "response-body": "response-body";
+            "response-headers": "response-headers";
+            "response-status": "response-status";
+            stderr: "stderr";
+            stdout: "stdout";
+        }>;
+        condition: z.ZodObject<{
+            selector: z.ZodObject<{
+                inputBinding: z.ZodObject<{
+                    path: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
+                    query: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
+                    header: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
+                    body: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
+                    argument: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
+                    option: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
+                    environment: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
+                    stdin: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
+                }, z.core.$strict>;
+            }, z.core.$strict>;
+            predicate: z.ZodType<import("./expression.ts").Expression, unknown, z.core.$ZodTypeInternals<import("./expression.ts").Expression, unknown>>;
+        }, z.core.$strict>;
+        interfaceKind: z.ZodEnum<{
+            api: "api";
+            mcp: "mcp";
+            web: "web";
+        }>;
+        method: z.ZodEnum<{
+            DELETE: "DELETE";
+            GET: "GET";
+            HEAD: "HEAD";
+            OPTIONS: "OPTIONS";
+            PATCH: "PATCH";
+            POST: "POST";
+            PUT: "PUT";
+        }>;
+        pathTemplate: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        observableChannel: z.ZodEnum<{
+            artifact: "artifact";
+            "call-inputs": "call-inputs";
+            "exit-code": "exit-code";
+            "response-body": "response-body";
+            "response-headers": "response-headers";
+            "response-status": "response-status";
+            stderr: "stderr";
+            stdout: "stdout";
+        }>;
+        condition: z.ZodObject<{
+            selector: z.ZodObject<{
+                inputBinding: z.ZodObject<{
+                    path: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
+                    query: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
+                    header: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
+                    body: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
+                    argument: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
+                    option: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
+                    environment: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
+                    stdin: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
+                }, z.core.$strict>;
+            }, z.core.$strict>;
+            predicate: z.ZodType<import("./expression.ts").Expression, unknown, z.core.$ZodTypeInternals<import("./expression.ts").Expression, unknown>>;
+        }, z.core.$strict>;
+        interfaceKind: z.ZodLiteral<"cli">;
+        invocation: z.ZodObject<{
+            executable: z.ZodString;
+            subcommandPath: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>;
+    }, z.core.$strict>]>>;
 }, z.core.$strict>], "expectedClean">;
 export type Probe = z.infer<typeof Probe>;

package/dist/core/schemas/probe.js

@@ -1,9 +1,11 @@
 /** a corpus probe: its class, its control status, and the defects it seeds. */
 import { z } from 'zod';
 import { ArtifactReference } from './artifact-reference.js';
+import { DefectSignature } from './defect-signature.js';
 import { Severity } from './eval-contract.js';
 import { lineageFields } from './lineage.js';
 import { BehaviorId, DefectId, Digest, ProbeId } from './primitives.js';
+import { ProbeQualification } from './probe-qualification.js';
 import { ManifestationWitness } from './sensitivity-witness.js';
 /**
  * AD-9's closed four, one per probe, in scope because AD-7's strength vector
@@ -44,6 +46,7 @@ const probeCommonFields = {
     artifactDigest: Digest,
     commitDigest: Digest,
     rationale: z.string().min(1),
+    qualification: ProbeQualification.describe('AD-9\'s qualification record: which of the five routes earned this probe its ground truth, and the evidence that route demands. Required on every branch and on every class, canaries included, because AD-9 closes with "an unqualified probe cannot enter a sealed set" and spells a route for all five kinds. That the route is compatible with this probe\'s class and `expectedClean` flag is a cross-field rule the export cannot carry; the corpus qualification gate enforces it and returns a reason code. Required, not optional, which with `defectSignature` below makes the probe\'s `schemaVersion` 1 -> 2 BREAKING bump under AD-11, whose rule is that "adding an optional field is a `schemaVersion` bump recorded in the field\'s own description; removing or retyping is breaking". This field is on both branches, so it alone is what stops every version-1 probe from parsing.'),
 };
 /**
  * The prior art's `expectedClean` conditional, re-expressed as a discriminated
@@ -73,10 +76,11 @@ export const Probe = z
         defects: z
             .array(Defect)
             .describe('No minimum. AD-9 states none, and a minimum would make a canary unrepresentable, since a canary indicts the fixture rather than seeding a defect.'),
+        defectSignature: DefectSignature.nullable().describe("AD-40's machine-readable defect signature, declared on this branch alone: a clean control seeds nothing, so its branch has no signature to carry. Nullable rather than plain, because the one class that legitimately carries none is `canary`, and a union-level refinement expressing that is dropped from the published export, which would leave Zod rejecting a probe ajv accepts. The corpus qualification gate is the enforcement point and the constraint ledger records the gap; the shipped precedent is `compile/interface-inventory.ts`, which put the principal check in the compiler for the same reason. The other half of the probe's `schemaVersion` 1 -> 2 BREAKING bump under AD-11, recorded here as that rule requires: the key is required on this branch, and `null` is the legal value a canary carries."),
     })
-        .describe('A probe that is not a known-clean control.'),
+        .describe('A probe that is not a known-clean control. The one branch AD-40 gives a defect signature.'),
 ])
     .meta({
     id: 'Probe',
-    description: "One corpus probe. Succeeds the prior-art `h0-ground-truth` schema per AD-24, carrying its system identifier, implementation digest, `expectedClean` flag, seeded defects, and rationale, and adding AD-9's probe class and AD-9's per-probe artifact and commit digests. Divergences: `implementationSha` becomes `implementationDigest`, `taskId` does not survive because the probe pins what it describes by digest, and `expectedGate` does not survive because AD-40 makes detection a signature match rather than a verdict comparison and AD-7 keeps comparisons inside the dominance vector, so carrying an expected gate would invite a comparison the architecture forbids. Two constructions are deliberately absent: AD-9's per-class QUALIFICATION record, whose five prose routes name no fields and whose acceptance criteria of record do not command it, and AD-40's machine-readable DEFECT SIGNATURE, which Owed item 7 records as having no fixture to land in because this repository contains no probe at all. Both arrive as additive `schemaVersion` bumps under AD-11 once a corpus exists to carry them. The cost is named rather than hidden: AD-9's \"an unqualified probe cannot enter a sealed set\" is enforced by nothing in v0: not this schema, not an AD-5 code, and not an AD-21 rung.",
+    description: "One corpus probe. Succeeds the prior-art `h0-ground-truth` schema per AD-24, carrying its system identifier, implementation digest, `expectedClean` flag, seeded defects, and rationale, and adding AD-9's probe class and AD-9's per-probe artifact and commit digests. Divergences: `implementationSha` becomes `implementationDigest`, `taskId` does not survive because the probe pins what it describes by digest, and `expectedGate` does not survive because AD-40 makes detection a signature match rather than a verdict comparison and AD-7 keeps comparisons inside the dominance vector, so carrying an expected gate would invite a comparison the architecture forbids. Two constructions landed here together under one BREAKING `schemaVersion` bump: AD-9's per-class QUALIFICATION record, as a five-route tagged union required on every branch, and AD-40's machine-readable DEFECT SIGNATURE on the `expectedClean: false` branch, carrying the interface kind, the home operation as a method and a path template, the observable channel, and the discriminating condition. Both are required rather than optional, which is what makes the bump breaking under AD-11: every corpus written against version 1 fails to parse. Version 3 opened the signature to a second interface kind: it is a union on `interfaceKind`, where the `cli` branch declares a logical invocation in place of a method and a path template, and the selector's input binding carries the four command channels beside the four transport ones. What the schema still does not decide is stated rather than hidden. AD-9's \"an unqualified probe cannot enter a sealed set\" is a corpus-construction invariant enforced by the qualification gate in `core/score/qualification.ts`, not by this schema: all eight class-and-`expectedClean` pairings parse, a route incompatible with the pair parses, and a signature-less non-canary parses, each so the gate can return a reason code carrying an artifact path instead of an anonymous parse failure. The constraint ledger carries both gaps.",
 });

package/dist/core/schemas/scoring-policy.d.ts

@@ -20,6 +20,7 @@ export declare const ScoringPolicy: z.ZodObject<{
         material: "material";
     }>;
     confidenceThreshold: z.ZodNumber;
+    catchThreshold: z.ZodNumber;
     minimumTrialCount: z.ZodInt;
     reExecutionCap: z.ZodInt;
     remediationCap: z.ZodInt;

package/dist/core/schemas/scoring-policy.js

@@ -22,6 +22,11 @@ export const ScoringPolicy = z
         .min(0)
         .max(1)
         .describe('The same closed unit interval a finding\'s `confidence` uses. AD-21\'s "a finding whose confidence falls below the policy threshold" compares the two, and two different scales would make that comparison meaningless.'),
+    catchThreshold: z
+        .number()
+        .min(0)
+        .max(1)
+        .describe('AD-7\'s trial-set reducer: a probe counts as caught only when its caught-trial count is strictly greater than this fraction of its valid-trial count, so an exact tie never counts as caught. The published default artifact carries 0.5, the pre-registered "at least two catches in three valid repetitions" read at a valid count of three. No `.default()`, on the same reasoning `confidenceThreshold` gives. Required, not optional, which makes this the scoring policy\'s `schemaVersion` 1 -> 2 BREAKING bump under AD-11, whose rule is that "adding an optional field is a `schemaVersion` bump recorded in the field\'s own description; removing or retyping is breaking". With no default to fill it in, every version-1 policy document fails to parse.'),
     minimumTrialCount: z
         .int()
         .min(1)
@@ -47,5 +52,5 @@ export const ScoringPolicy = z
 })
     .meta({
     id: 'ScoringPolicy',
-    description: 'The scoring policy, with no prior art. It carries the severity floor, confidence threshold, minimum trial count, re-execution cap, remediation cap, and a regex match-step budget that AD-6, AD-12, AD-4, and AD-21 read, and its digest is one of the five named inputs to AD-11\'s scoring version. It is a published artifact rather than a set of constants so that "the default" has an identity a result can name by digest.',
+    description: 'The scoring policy, with no prior art. It carries the severity floor, confidence threshold, catch threshold, minimum trial count, re-execution cap, remediation cap, and a regex match-step budget that AD-6, AD-7, AD-12, AD-4, and AD-21 read, and its digest is one of the six named inputs to AD-11\'s scoring version. It is a published artifact rather than a set of constants so that "the default" has an identity a result can name by digest.',
 });

package/dist/core/schemas/sealed-evaluator-brief.d.ts

@@ -69,6 +69,7 @@ export declare const SealedEvaluatorBrief: z.ZodObject<{
         reference: z.ZodString;
         kind: z.ZodString;
     }, z.core.$strict>>;
+    principals: z.ZodArray<z.ZodString>;
     budgets: z.ZodObject<{
         maxToolCalls: z.ZodInt;
         maxWallClockMinutes: z.ZodInt;

package/dist/core/schemas/sealed-evaluator-brief.js

@@ -45,6 +45,9 @@ export const SealedEvaluatorBrief = z
     scopedResources: z
         .array(ScopedResource)
         .describe("AD-16's scoped resource references. Not nullable here, unlike on the contract: absent-versus-explicitly-empty is an AD-31 grading of a CALLER declaration, and this artifact is generated by `seal`, which always knows the answer. No scoped reference may resolve to a forbidden input; that resolution is `scoped-reference-resolves-forbidden` at compile time and is not a schema check."),
+    principals: z
+        .array(Identifier)
+        .describe("The names declared in the contract's `testData.principals`, sorted. Not nullable, on `scopedResources`'s reasoning above: `seal` always knows the answer, and empty is the legal spelling for a contract declaring none. Names only, no `kind`: `kind` is the author's own opaque vocabulary with no value space any AD declares, so shipping it would put uninterpretable text on the one artifact AD-16 keeps minimal. A name is an opaque label (AD-18), so it discloses no account identifier or credential, and it carries no step identifier (AD-16). Required, not optional, which makes this the sealed brief's `schemaVersion` 1 -> 2 BREAKING bump under AD-11, whose rule is that \"adding an optional field is a `schemaVersion` bump recorded in the field's own description; removing or retyping is breaking\". `[]` is the empty spelling and the key is mandatory, so no version-1 brief parses."),
     budgets: Budgets.describe("The contract's declared ceilings, carried because AD-16 says the caller who executes needs the ceilings the isolation manifest reports against. The manifest's own `resourceCeilings` is a different shape and a different concern: this is a declaration, that is a record of what the harness enforced."),
     safetyLimits: z.array(z.string()),
     probeStepBound: z
@@ -55,5 +58,5 @@ export const SealedEvaluatorBrief = z
 })
     .meta({
     id: 'SealedEvaluatorBrief',
-    description: "The sealed evaluator brief, with no prior art. AD-16 fixes what it carries: the contract's behaviours, the generated evaluator-facing directions of AD-3, permitted interfaces, and scoped resource references, plus budgets and safety limits. It also fixes what the brief never carries: author commentary, the interaction plan, or the plan's step identifiers, and never a prescribed action sequence. Those exclusions are structural rather than conventional: this object is strict, so a brief carrying `interactionPlan`, `commentary`, or a `stepId` fails with `unrecognized_keys`, and each of the three has its own reject fixture rather than resting on strictness alone. It carries no identity field of its own, because every artifact that refers to it does so by digest.",
+    description: "The sealed evaluator brief, with no prior art. AD-16 fixes what it carries: the contract's behaviours, the generated evaluator-facing directions of AD-3, permitted interfaces, scoped resource references, and the declared test-data principal names, plus budgets and safety limits. It also fixes what the brief never carries: author commentary, the interaction plan, or the plan's step identifiers, and never a prescribed action sequence. Those exclusions are structural rather than conventional: this object is strict, so a brief carrying `interactionPlan`, `commentary`, or a `stepId` fails with `unrecognized_keys`, and each of the three has its own reject fixture rather than resting on strictness alone. It carries no identity field of its own, because every artifact that refers to it does so by digest.",
 });