eval-quality 0.1.0 → 0.3.0

package/dist/core/schemas/sealed-run-record.d.ts

@@ -5,8 +5,38 @@ import { JsonValue } from './primitives.ts';
  * AD-23's verbatim quotation, paired with the channel it came from: a
  * quotation with no channel cannot be audited against its source observation
  * (ADR-009 Decision 2).
+ *
+ * Two arms rather than one shape with a nullable identifier and a `.refine()`
+ * over the pair. The identifier is meaningful on exactly one channel, and the
+ * first spelling of this field said so in prose while admitting every other
+ * combination: `channel: "response-body"` with a non-null `artifactId` parsed,
+ * and `projectChannel` reads the identifier only on the artifact channel, so
+ * the quotation was audited against the response body and a record naming a
+ * file it never consulted produced no condition at all. That is a narrower
+ * spelling of the wrong-file hole `artifactId` was added to close.
+ *
+ * A refinement would not have closed it either, for the reason
+ * `evidence-artifact.ts` records where it narrows a mode to a literal instead:
+ * a refinement never exports, so the published document keeps admitting the
+ * disagreement, and AD-13's corpus-mutation generator synthesises witnesses
+ * from a branch's own JSON Schema with no knowledge of a Zod-only cross-field
+ * rule. Narrowing the schema removes the gap at its source.
+ *
+ * A plain union rather than a discriminated one, on `DefectSignature`'s own
+ * reasoning: the discriminator would be `channel`, and one arm carries seven
+ * values for it. The two arms are told apart by the channel they name.
+ *
+ * The `EvidenceChannel` `$ref` is not carried at this site, since neither arm
+ * accepts the whole vocabulary. A non-TypeScript consumer reads a literal on
+ * one arm and a seven-member enum on the other, which is the rule itself
+ * rather than a reference plus a sentence about it.
  */
-export declare const QuotedEvidence: z.ZodObject<{
+export declare const ArtifactQuotedEvidence: z.ZodObject<{
+    quote: z.ZodString;
+    channel: z.ZodLiteral<"artifact">;
+    artifactId: z.ZodString;
+}, z.core.$strict>;
+export declare const ChannelQuotedEvidence: z.ZodObject<{
     quote: z.ZodString;
     channel: z.ZodEnum<{
         "call-inputs": "call-inputs";
@@ -17,7 +47,25 @@ export declare const QuotedEvidence: z.ZodObject<{
         stderr: "stderr";
         stdout: "stdout";
     }>;
+    artifactId: z.ZodNull;
 }, z.core.$strict>;
+export declare const QuotedEvidence: z.ZodUnion<readonly [z.ZodObject<{
+    quote: z.ZodString;
+    channel: z.ZodLiteral<"artifact">;
+    artifactId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    quote: z.ZodString;
+    channel: z.ZodEnum<{
+        "call-inputs": "call-inputs";
+        "exit-code": "exit-code";
+        "response-body": "response-body";
+        "response-headers": "response-headers";
+        "response-status": "response-status";
+        stderr: "stderr";
+        stdout: "stdout";
+    }>;
+    artifactId: z.ZodNull;
+}, z.core.$strict>]>;
 /**
  * `defect` findings additionally require observation identifiers and quoted
  * evidence (AD-23). A nullable field can't express "required on this branch
@@ -49,7 +97,11 @@ export declare const Finding: z.ZodDiscriminatedUnion<[z.ZodObject<{
     }, z.core.$strict>], "storage">>;
     findingType: z.ZodLiteral<"defect">;
     observationIds: z.ZodArray<z.ZodString>;
-    quotedEvidence: z.ZodArray<z.ZodObject<{
+    quotedEvidence: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        quote: z.ZodString;
+        channel: z.ZodLiteral<"artifact">;
+        artifactId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
         quote: z.ZodString;
         channel: z.ZodEnum<{
             "call-inputs": "call-inputs";
@@ -60,7 +112,8 @@ export declare const Finding: z.ZodDiscriminatedUnion<[z.ZodObject<{
             stderr: "stderr";
             stdout: "stdout";
         }>;
-    }, z.core.$strict>>;
+        artifactId: z.ZodNull;
+    }, z.core.$strict>]>>;
 }, z.core.$strict>, z.ZodObject<{
     findingId: z.ZodString;
     oracleId: z.ZodNullable<z.ZodString>;
@@ -132,6 +185,7 @@ export declare const OracleDisposition: z.ZodObject<{
     observationIds: z.ZodArray<z.ZodString>;
     note: z.ZodNullable<z.ZodString>;
 }, z.core.$strict>;
+export type OracleDisposition = z.infer<typeof OracleDisposition>;
 /**
  * A flat map would break pointer addressing: AD-26 keys `call-inputs` by
  * transport channel, so a pointer like
@@ -146,34 +200,71 @@ export declare const ObservedCallInputs: z.ZodObject<{
     query: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
     header: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
     body: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
+    argument: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
+    option: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
+    environment: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
+    stdin: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
 }, z.core.$strict>;
+/** the constraint identifier the ledger carries for the check below. */
+export declare const OBSERVATION_SEQUENCE_UNIQUE = "observation-sequence-unique";
 /**
  * One ingested observation, carrying AD-26's closed channel set so every
  * pointer in the addressing grammar has something to resolve against.
  *
- * Observation ordering is deliberately absent (Owed item 2): ADR-006 forbids
- * using array position as ordering, and the fix, a monotonic sequence, arrives
- * as an additive `schemaVersion` bump under AD-11.
+ * `sequence` closes owed item 2: ADR-006 forbids using array position as
+ * ordering. A required, per-record-unique `sequence` is the total order a
+ * selector reads.
  */
 export declare const Observation: z.ZodObject<{
     observationId: z.ZodString;
+    sequence: z.ZodInt;
     operationId: z.ZodString;
     provenance: z.ZodEnum<{
         baseline: "baseline";
         "evaluator-chosen": "evaluator-chosen";
     }>;
+    principal: z.ZodNullable<z.ZodString>;
     callInputs: z.ZodObject<{
         path: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
         query: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
         header: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
         body: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
+        argument: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
+        option: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
+        environment: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
+        stdin: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
     }, z.core.$strict>;
     responseBody: z.ZodNullable<z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>;
     responseHeaders: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
     responseStatus: z.ZodNullable<z.ZodInt>;
-    stdout: z.ZodNullable<z.ZodString>;
-    stderr: z.ZodNullable<z.ZodString>;
+    stdout: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"json">;
+        value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"text">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"absent">;
+    }, z.core.$strict>], "kind">;
+    stderr: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"json">;
+        value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"text">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"absent">;
+    }, z.core.$strict>], "kind">;
     exitCode: z.ZodNullable<z.ZodInt>;
+    artifacts: z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"json">;
+        value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"text">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"absent">;
+    }, z.core.$strict>], "kind">>;
 }, z.core.$strict>;
 export type ObservedCallInputs = z.infer<typeof ObservedCallInputs>;
 export type Observation = z.infer<typeof Observation>;
@@ -205,12 +296,34 @@ export declare const EvidenceDisclosure: z.ZodObject<{
     truncationBound: z.ZodNullable<z.ZodInt>;
     reportedIncomplete: z.ZodBoolean;
 }, z.core.$strict>;
+/** exported so the ladder names this shape without importing Zod. */
+export type EvidenceDisclosure = z.infer<typeof EvidenceDisclosure>;
+/**
+ * AD-21's two modes, closed. In `production` the subject is the system under
+ * test; in `contract-scoring` the subject is the contract, the probe is
+ * knowingly defective, and a `caught` outcome is the contract succeeding.
+ *
+ * Declared on the record rather than on the evidence artifact because this is
+ * where mode is now fixed: AD-21 requires mode "fixed before ingest", and an
+ * evidence artifact is `emit`'s output, four stages past the only place a
+ * caller can supply one.
+ */
+export declare const RUN_MODES: readonly ['production', 'contract-scoring'];
+export type RunModeValue = (typeof RUN_MODES)[number];
+export declare const RunMode: z.ZodEnum<{
+    "contract-scoring": "contract-scoring";
+    production: "production";
+}>;
 export declare const SealedRunRecord: z.ZodObject<{
     schemaVersion: z.ZodInt;
     parentDigest: z.ZodNullable<z.ZodString>;
     revisionCount: z.ZodInt;
     runId: z.ZodString;
     conditionArm: z.ZodString;
+    mode: z.ZodEnum<{
+        "contract-scoring": "contract-scoring";
+        production: "production";
+    }>;
     trialIndex: z.ZodInt;
     contractDigest: z.ZodString;
     sealedBriefDigest: z.ZodString;
@@ -255,7 +368,11 @@ export declare const SealedRunRecord: z.ZodObject<{
         }, z.core.$strict>], "storage">>;
         findingType: z.ZodLiteral<"defect">;
         observationIds: z.ZodArray<z.ZodString>;
-        quotedEvidence: z.ZodArray<z.ZodObject<{
+        quotedEvidence: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+            quote: z.ZodString;
+            channel: z.ZodLiteral<"artifact">;
+            artifactId: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
             quote: z.ZodString;
             channel: z.ZodEnum<{
                 "call-inputs": "call-inputs";
@@ -266,7 +383,8 @@ export declare const SealedRunRecord: z.ZodObject<{
                 stderr: "stderr";
                 stdout: "stdout";
             }>;
-        }, z.core.$strict>>;
+            artifactId: z.ZodNull;
+        }, z.core.$strict>]>>;
     }, z.core.$strict>, z.ZodObject<{
         findingId: z.ZodString;
         oracleId: z.ZodNullable<z.ZodString>;
@@ -320,23 +438,54 @@ export declare const SealedRunRecord: z.ZodObject<{
     }, z.core.$strict>], "findingType">>;
     observations: z.ZodArray<z.ZodObject<{
         observationId: z.ZodString;
+        sequence: z.ZodInt;
         operationId: z.ZodString;
         provenance: z.ZodEnum<{
             baseline: "baseline";
             "evaluator-chosen": "evaluator-chosen";
         }>;
+        principal: z.ZodNullable<z.ZodString>;
         callInputs: z.ZodObject<{
             path: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
             query: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
             header: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
             body: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
+            argument: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
+            option: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
+            environment: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
+            stdin: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
         }, z.core.$strict>;
         responseBody: z.ZodNullable<z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>;
         responseHeaders: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
         responseStatus: z.ZodNullable<z.ZodInt>;
-        stdout: z.ZodNullable<z.ZodString>;
-        stderr: z.ZodNullable<z.ZodString>;
+        stdout: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"json">;
+            value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"text">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"absent">;
+        }, z.core.$strict>], "kind">;
+        stderr: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"json">;
+            value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"text">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"absent">;
+        }, z.core.$strict>], "kind">;
         exitCode: z.ZodNullable<z.ZodInt>;
+        artifacts: z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"json">;
+            value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"text">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"absent">;
+        }, z.core.$strict>], "kind">>;
     }, z.core.$strict>>;
     judgeResults: z.ZodArray<z.ZodObject<{
         rubricId: z.ZodString;

package/dist/core/schemas/sealed-run-record.js

@@ -3,21 +3,58 @@ import { z } from 'zod';
 import { ArtifactReference } from './artifact-reference.js';
 import { Severity } from './eval-contract.js';
 import { lineageFields } from './lineage.js';
-import { EvidenceChannel } from './pointer.js';
+import { IDENTIFIER_ROOTED_CHANNEL, NON_IDENTIFIER_ROOTED_CHANNELS, } from './pointer.js';
 import { BehaviorId, Digest, FindingId, Identifier, JsonObjectValue, JsonValue, OracleId, ProbeId, RubricCriterionId, RubricId, UnsignedDecimalString, } from './primitives.js';
+import { ProbeObservedBody } from './probe-body.js';
 import { EvaluatorRecommendation } from './verdict.js';
+const QUOTE_DESCRIPTION = "The evaluator's verbatim quotation, per AD-23. Non-empty: an empty quotation quotes nothing, no AD-5 code names the condition, and under the admit-rule's second clause the schema is therefore the enforcement point. That this text appears in at least one of the finding's cited observations is NOT checked here; it is an AD-32 declared-versus-observed inconsistency that invalidates at ingest, and ADR-009 Decision 2 settles the precedence: \"cited identifiers govern the witness match; quotation audits it.\"";
+const quote = z.string().min(1).describe(QUOTE_DESCRIPTION);
 /**
  * AD-23's verbatim quotation, paired with the channel it came from: a
  * quotation with no channel cannot be audited against its source observation
  * (ADR-009 Decision 2).
+ *
+ * Two arms rather than one shape with a nullable identifier and a `.refine()`
+ * over the pair. The identifier is meaningful on exactly one channel, and the
+ * first spelling of this field said so in prose while admitting every other
+ * combination: `channel: "response-body"` with a non-null `artifactId` parsed,
+ * and `projectChannel` reads the identifier only on the artifact channel, so
+ * the quotation was audited against the response body and a record naming a
+ * file it never consulted produced no condition at all. That is a narrower
+ * spelling of the wrong-file hole `artifactId` was added to close.
+ *
+ * A refinement would not have closed it either, for the reason
+ * `evidence-artifact.ts` records where it narrows a mode to a literal instead:
+ * a refinement never exports, so the published document keeps admitting the
+ * disagreement, and AD-13's corpus-mutation generator synthesises witnesses
+ * from a branch's own JSON Schema with no knowledge of a Zod-only cross-field
+ * rule. Narrowing the schema removes the gap at its source.
+ *
+ * A plain union rather than a discriminated one, on `DefectSignature`'s own
+ * reasoning: the discriminator would be `channel`, and one arm carries seven
+ * values for it. The two arms are told apart by the channel they name.
+ *
+ * The `EvidenceChannel` `$ref` is not carried at this site, since neither arm
+ * accepts the whole vocabulary. A non-TypeScript consumer reads a literal on
+ * one arm and a seven-member enum on the other, which is the rule itself
+ * rather than a reference plus a sentence about it.
  */
-export const QuotedEvidence = z.strictObject({
-    quote: z
-        .string()
-        .min(1)
-        .describe("The evaluator's verbatim quotation, per AD-23. Non-empty: an empty quotation quotes nothing, no AD-5 code names the condition, and under the admit-rule's second clause the schema is therefore the enforcement point. That this text appears in at least one of the finding's cited observations is NOT checked here; it is an AD-32 declared-versus-observed inconsistency that invalidates at ingest, and ADR-009 Decision 2 settles the precedence: \"cited identifiers govern the witness match; quotation audits it.\""),
-    channel: EvidenceChannel,
+export const ArtifactQuotedEvidence = z.strictObject({
+    quote,
+    channel: z.literal(IDENTIFIER_ROOTED_CHANNEL),
+    artifactId: Identifier.describe("Which written file the quotation came from. A channel alone does not identify one: an operation may write several, and an audit that searched all of them at once accepted a quotation lifted from a file the finding never cited, which is the opposite of what AD-23's verbatim requirement is for."),
 });
+export const ChannelQuotedEvidence = z.strictObject({
+    quote,
+    channel: z.enum(NON_IDENTIFIER_ROOTED_CHANNELS),
+    artifactId: z
+        .null()
+        .describe('Null on every channel but `artifact`, and required rather than optional so a record cannot omit the question. Only a written file needs naming; every other channel is one thing per observation.'),
+});
+export const QuotedEvidence = z.union([
+    ArtifactQuotedEvidence,
+    ChannelQuotedEvidence,
+]);
 // Spread into each finding branch rather than shared as a base object: a
 // spread adds no `$defs` entry, so each branch exports as a complete shape a
 // non-TypeScript consumer can read without following a reference (AD-13).
@@ -108,21 +145,32 @@ export const ObservedCallInputs = z.strictObject({
     query: JsonObjectValue.nullable(),
     header: JsonObjectValue.nullable(),
     body: JsonObjectValue.nullable(),
+    argument: JsonObjectValue.nullable(),
+    option: JsonObjectValue.nullable(),
+    environment: JsonObjectValue.nullable(),
+    stdin: JsonObjectValue.nullable(),
 });
+/** the constraint identifier the ledger carries for the check below. */
+export const OBSERVATION_SEQUENCE_UNIQUE = 'observation-sequence-unique';
 /**
  * One ingested observation, carrying AD-26's closed channel set so every
  * pointer in the addressing grammar has something to resolve against.
  *
- * Observation ordering is deliberately absent (Owed item 2): ADR-006 forbids
- * using array position as ordering, and the fix, a monotonic sequence, arrives
- * as an additive `schemaVersion` bump under AD-11.
+ * `sequence` closes owed item 2: ADR-006 forbids using array position as
+ * ordering. A required, per-record-unique `sequence` is the total order a
+ * selector reads.
  */
 export const Observation = z.strictObject({
     observationId: Identifier,
+    sequence: z
+        .int()
+        .positive()
+        .describe('The total order ADR-006 forbids reading off array position (owed item 2). A positive integer, unique across every observation in the same record: uniqueness is what a sorted-by-`sequence` read needs to be strictly increasing, so no separate monotonicity check is required. Neither starting at 1 nor contiguous is required across a record: only positivity and per-record uniqueness are enforced, so a record whose sequences are e.g. [5, 12, 40] is equally valid. Required rather than optional, which makes this a BREAKING `schemaVersion` bump under AD-11: adding an optional field is additive, and this field is not optional. A record with an absent or duplicated `sequence` fails to parse.'),
     operationId: Identifier.describe('The operation this observation exercised. `Operation.operationId` is scoped to a `PermittedInterface`, so two interfaces may declare the same one; that collision is a cross-artifact rule with no AD-5 code, since `duplicate-operation-signature` covers method plus path template only, and it is left to ingest.'),
     provenance: z
         .enum(['baseline', 'evaluator-chosen'])
         .describe("AD-23: `baseline` for a pre-canned or deterministic test, `evaluator-chosen` for an action the evaluator selected. The distinction is the one the product's central finding rests on: what a sealed evaluator detects beyond the pre-canned baseline. It lives on the observation, never on the finding."),
+    principal: Identifier.nullable().describe("The declared principal the harness acted as, or `null` where the run named none. Owed item 3's other half: a `{ principal }` input binding is presence-only by construction, since the contract declares a name and the harness provisions the value, so without this field two steps of one operation binding `owner` and `other-user` both match every observation and both resolve `several`. That is exactly the act-as-A-read-as-B shape the two critical-severity cross-user behaviours need, and it was unscoreable while the record said nothing about which account was used. An opaque label carrying no account identifier or credential, on `testData.principals`' own AD-18 terms."),
     callInputs: ObservedCallInputs,
     responseBody: JsonValue.nullable().describe('AD-26\'s `response-body` channel. The null branch is redundant against the value container, which already admits `null`; it is kept so all ten observation fields read the same way, and it means "no body observed" and "a body that was JSON null" are indistinguishable here, which is an accepted cost of one uniform spelling.'),
     responseHeaders: JsonObjectValue.nullable().describe('A name-to-value map, not the open value container. AD-26 gives `response-headers` a tail, so a pointer resolves INTO this channel; a scalar here would leave `/interactions/x/response-headers/Content-Type` addressing nothing. That is the difference from `responseBody`, where a scalar or an array is a legitimate body and the open container is correct.'),
@@ -131,12 +179,15 @@ export const Observation = z.strictObject({
         .min(0)
         .nullable()
         .describe('Deliberately not bounded to a protocol range. A negative status is meaningless and excluded, but the upper end is left open: AD-19 declares four interface kinds and v0 rejects three of them at compile time under `unsupported-interface-kind`, so bounding this to HTTP would encode a protocol assumption the artifact outlives. `null` where the channel does not apply.'),
-    stdout: z.string().nullable(),
-    stderr: z.string().nullable(),
+    stdout: ProbeObservedBody.describe('AD-26\'s `stdout` channel, tagged rather than a bare string. An operation may nominate standard output as the channel its response descriptor describes, in which case a pointer descends into it, and an untagged string could not tell output that was JSON from output that was only ever text. `{ "kind": "absent" }` is the channel a run did not observe.'),
+    stderr: ProbeObservedBody.describe("AD-26's `stderr` channel, tagged on the same terms as `stdout`."),
     exitCode: z
         .int()
         .nullable()
         .describe('Signed on purpose, unlike `responseStatus`: a process terminated by a signal is conventionally reported as a negative code, and this field records what was observed rather than what is tidy.'),
+    artifacts: z
+        .record(Identifier, ProbeObservedBody)
+        .describe("AD-26's `artifact` channel, keyed by the identifier the operation declares it writes, which is the segment an artifact pointer carries before its tail. Caller-keyed and expected to be partial: a run that wrote no files carries `{}`. Tagged on the same terms as `stdout`, since a written report may be JSON, may be prose, and may not have been written at all."),
 });
 /**
  * AD-17: judge results arrive inside the sealed run record and the package
@@ -148,7 +199,7 @@ export const JudgeResult = z.strictObject({
     score: z
         .int()
         .nullable()
-        .describe("An integer, because AD-22 puts the scale on the rubric's own anchored levels and `ScaleLevel.level` is already `z.int()`; no second scale is minted here. `null` is the shape AD-6's `judge-error` fires on, so it must parse. That the criterion is one the cited rubric declares, and that a conforming record shows one judge call scoring all named criteria, are AD-17 cross-artifact rules a schema over one artifact cannot see."),
+        .describe("An integer, because AD-22 puts the scale on the rubric's own anchored levels and `ScaleLevel.level` is already `z.int()`; no second scale is minted here. `null` is the shape AD-6's `judge-error` fires on, so it must parse. Two AD-17 rules sit over this field and only one of them is decidable from a record. That a criterion is scored at most once IS: `core/ingest` reports a repeated `rubricId`/`criterionId` pair as a `duplicate-record-identifier` condition, since a criterion scored twice is not one judge call's product whatever else the record says. That a scored criterion is one the cited rubric DECLARES is not, and never will be from inside this package: the rubric is not among ingest's declared inputs, no stage row names it, and a schema over one artifact has no second operand. That half is the caller's, on the same terms AD-12 states for the remediation cap, and it is a stated boundary rather than an unimplemented rule."),
     note: z.string().nullable(),
 });
 /** the prior art's five members, with money as a string per AD-36. */
@@ -178,6 +229,18 @@ export const EvidenceDisclosure = z.strictObject({
         .boolean()
         .describe('AD-17: "a case that cannot be bounded without discarding disconfirming material is reported incomplete". This is the operand AD-21\'s incomplete condition reads. The remaining two conditions read no field here: unavailable is an `ArtifactReference` that does not resolve through the corpus port, and internally inconsistent is AD-32\'s cross-artifact agreement check. AD-17\'s "must retain evidence contradicting the leading verdict" is decidable by none of them and is recorded as unenforced in v0.'),
 });
+/**
+ * AD-21's two modes, closed. In `production` the subject is the system under
+ * test; in `contract-scoring` the subject is the contract, the probe is
+ * knowingly defective, and a `caught` outcome is the contract succeeding.
+ *
+ * Declared on the record rather than on the evidence artifact because this is
+ * where mode is now fixed: AD-21 requires mode "fixed before ingest", and an
+ * evidence artifact is `emit`'s output, four stages past the only place a
+ * caller can supply one.
+ */
+export const RUN_MODES = ['production', 'contract-scoring'];
+export const RunMode = z.enum(RUN_MODES);
 export const SealedRunRecord = z
     .strictObject({
     ...lineageFields,
@@ -189,6 +252,7 @@ export const SealedRunRecord = z
         .string()
         .min(1)
         .describe("An opaque caller label with no product semantics, per AD-24. The prior art's five-member enum does not survive, and its own extension history is the reason: an enum a local amendment had to widen once for `self-review` will be widened again."),
+    mode: RunMode.describe('AD-21\'s run mode, supplied by the caller on the record and never derived, recomputed, or defaulted afterwards. AD-21 requires mode to be "fixed before ingest", and owed item 4 records what its absence costs: the same sealed run could be relabelled after ingest and scored under the same scoring version. Required rather than optional, which makes this a BREAKING `schemaVersion` bump under AD-11, whose rule is that "adding an optional field is a `schemaVersion` bump recorded in the field\'s own description; removing or retyping is breaking". A version-1 record carries no mode, and no default may repair one into a version-2 record, because a defaulted mode is the relabelling this field exists to stop. A record presenting no mode fails to parse, which AD-28 makes a `schema-parse-failure` fault rather than an AD-21 verdict or an AD-5 code, the same routing `evaluatorRecommendation` already records for an unrecognised value. This field is where mode is read from; the evidence artifact restates it and is never the source.'),
     trialIndex: z
         .int()
         .min(1)
@@ -199,7 +263,20 @@ export const SealedRunRecord = z
     evaluatorRecommendation: EvaluatorRecommendation,
     oracleDispositions: z.array(OracleDisposition),
     findings: z.array(Finding),
-    observations: z.array(Observation),
+    observations: z
+        .array(Observation)
+        .refine((observations) => {
+        const seen = new Set();
+        for (const observation of observations) {
+            if (seen.has(observation.sequence))
+                return false;
+            seen.add(observation.sequence);
+        }
+        return true;
+    }, {
+        error: "every observation's `sequence` is unique within the record (ADR-006, owed item 2); a duplicate leaves the total order the fix exists to supply ambiguous",
+    })
+        .describe('Per-observation `sequence` uniqueness is enforced here. The published JSON Schema dialect has no keyword for uniqueness of a nested field across array items, so this constraint is Zod-only: a non-Zod consumer must reimplement it, exactly as with any other cross-item invariant this dialect cannot state.'),
     judgeResults: z
         .array(JudgeResult)
         .describe('Empty is legal: a contract with no rubric produces no judge call.'),
@@ -211,5 +288,5 @@ export const SealedRunRecord = z
 })
     .meta({
     id: 'SealedRunRecord',
-    description: "One sealed evaluator trial, as the caller presents it. Succeeds the prior-art `h0-run-result` schema per AD-24, keeping its run identifier, condition arm, findings, action-log reference, resource use, invalidation reason, evaluator recommendation as a closed enum, and per-finding confidence on a declared scale. Divergences: `condition` is demoted to the opaque `conditionArm`, `verdict` becomes `evaluatorRecommendation` without `NOT_APPLICABLE`, money is a decimal string, and `taskId`, `note`, and per-finding `actionIds` do not survive: the contract is pinned by `contractDigest`, an unstructured orchestrator annotation is the free-prose channel the Conventions close everywhere else, and two citation vocabularies on one finding is the ambiguity ADR-009 removed. Two constructions are deliberately absent and each is owed to an open item: the run MODE, which AD-21 requires to be fixed before ingest and to enter AD-11's identity inputs rather than appearing first in the evidence artifact (Owed item 4), and observation ORDERING, which ADR-006 forbids reading off array position (Owed item 2). Both arrive as additive `schemaVersion` bumps under AD-11.",
+    description: "One sealed evaluator trial, as the caller presents it. Succeeds the prior-art `h0-run-result` schema per AD-24, keeping its run identifier, condition arm, findings, action-log reference, resource use, invalidation reason, evaluator recommendation as a closed enum, and per-finding confidence on a declared scale. Divergences: `condition` is demoted to the opaque `conditionArm`, `verdict` becomes `evaluatorRecommendation` without `NOT_APPLICABLE`, money is a decimal string, and `taskId`, `note`, and per-finding `actionIds` do not survive: the contract is pinned by `contractDigest`, an unstructured orchestrator annotation is the free-prose channel the Conventions close everywhere else, and two citation vocabularies on one finding is the ambiguity ADR-009 removed. The run MODE landed here as a required field under a BREAKING `schemaVersion` bump, which is where AD-21's \"fixed before ingest\" puts it; owed item 4 is now closed: mode enters AD-11's identity inputs as `ScoringVersionInputs`'s sixth field, and `core/score/ladder.ts` carries `ProductionAssessment`/`ContractAssessment` as the two assessment input types with their own total ladders. Observation ORDERING landed here too, under its own BREAKING `schemaVersion` bump: `sequence` is required and unique per record, closing owed item 2's ADR-006 gap, since array position was never a legal ordering. Version 4 opened the record to a system under test that runs behind a command: `callInputs` carries the four command channels beside the four transport ones, `stdout` and `stderr` are tagged rather than bare strings so a nominated output channel can be descended into, and `artifacts` records the files the run wrote, keyed by the identifier the operation declares.",
 });