eval-quality 0.1.0 → 0.3.0

package/schemas/eval-contract.schema.json

@@ -161,8 +161,8 @@
                     "type": "array",
                     "items": {
                       "type": "string",
-                      "pattern": "^\\/interactions\\/[a-z0-9]+(?:-[a-z0-9]+)*\\/(?:(?:response-body|response-headers|stdout|stderr)(?:\\/(?:[^/~]|~[01])*)*|(?:response-status|exit-code)|call-inputs\\/(?:path|query|header|body)(?:\\/(?:[^/~]|~[01])*)*)$",
-                      "description": "AD-26 interaction-rooted pointer: \"/interactions/{stepId}/\" followed by one channel of the closed vocabulary. `call-inputs` takes one of the four transport channels as its next segment; `response-status` and `exit-code` take no tail. Syntax only: whether the step exists and whether the evidence is reachable are compile-time checks, not schema checks."
+                      "pattern": "^\\/interactions\\/[a-z0-9]+(?:-[a-z0-9]+)*\\/(?:(?:response-body|response-headers|stdout|stderr)(?:\\/(?:[^/~]|~[01])*)*|(?:response-status|exit-code)|call-inputs\\/(?:path|query|header|body|argument|option|environment|stdin)(?:\\/(?:[^/~]|~[01])*)*|artifact\\/[a-z0-9]+(?:-[a-z0-9]+)*(?:\\/(?:[^/~]|~[01])*)*)$",
+                      "description": "AD-26 interaction-rooted pointer: \"/interactions/{stepId}/\" followed by one channel of the closed vocabulary. `call-inputs` takes one input channel as its next segment, one of the four transport channels or one of the four command channels; `artifact` takes the identifier of a file the operation declares it writes; `response-status` and `exit-code` take no tail. Syntax only: whether the step exists and whether the evidence is reachable are compile-time checks, not schema checks."
                     },
                     "description": "Interaction-rooted pointers only. AD-3 computes containment after quantifier substitution, so a target is always fully rooted and the bound-element spelling never appears here."
                   },
@@ -362,162 +362,414 @@
     "permittedInterfaces": {
       "type": "array",
       "items": {
-        "type": "object",
-        "properties": {
-          "logicalId": {
-            "type": "string",
-            "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
-            "description": "AD-35: a logical identifier for the interface, never a URL, host, or port. Mapping it to a target is the caller's, outside the contract."
-          },
-          "kind": {
-            "type": "string",
-            "enum": [
-              "api",
-              "web",
-              "cli",
-              "mcp"
+        "oneOf": [
+          {
+            "type": "object",
+            "properties": {
+              "logicalId": {
+                "type": "string",
+                "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+                "description": "AD-35: a logical identifier for the interface, never a URL, host, or port. Mapping it to a target is the caller's, outside the contract."
+              },
+              "kind": {
+                "type": "string",
+                "const": "api"
+              },
+              "operations": {
+                "type": "array",
+                "items": {
+                  "$ref": "#/$defs/Operation"
+                },
+                "description": "No uniqueness constraint: two operations colliding on their transport identity after parameter-name erasure is `duplicate-operation-signature`, a coded compile-time error, and a schema that deduped them would delete it."
+              }
+            },
+            "required": [
+              "logicalId",
+              "kind",
+              "operations"
             ],
-            "description": "All four kinds are admitted so `unsupported-interface-kind` stays fireable. v0 supports `api`; the other three fail compilation under that code rather than failing to parse."
+            "additionalProperties": false
           },
-          "operations": {
-            "type": "array",
-            "items": {
-              "type": "object",
-              "properties": {
-                "operationId": {
-                  "type": "string",
-                  "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
-                  "description": "A kebab-case slug. Excludes \"/\" and \"~\" so an identifier can be embedded in an interaction-rooted pointer without escaping."
-                },
-                "method": {
-                  "type": "string",
-                  "enum": [
-                    "GET",
-                    "HEAD",
-                    "POST",
-                    "PUT",
-                    "PATCH",
-                    "DELETE",
-                    "OPTIONS"
-                  ]
-                },
-                "pathTemplate": {
-                  "type": "string",
-                  "pattern": "^(?:\\/(?:[^/{}:]|\\{[A-Za-z0-9_-]+\\})*)+$",
-                  "description": "A path template whose parameters are spelled `{name}` in braces. The `:name` spelling is rejected: AD-40 resolves a defect signature by comparing method and path template, and that comparison is not implementable against an unstated syntax."
+          {
+            "type": "object",
+            "properties": {
+              "logicalId": {
+                "type": "string",
+                "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+                "description": "AD-35: a logical identifier for the interface, never a URL, host, or port. Mapping it to a target is the caller's, outside the contract."
+              },
+              "kind": {
+                "type": "string",
+                "const": "web"
+              },
+              "operations": {
+                "type": "array",
+                "items": {
+                  "$ref": "#/$defs/Operation"
                 },
-                "stateChangeMarker": {
-                  "type": "boolean",
-                  "description": "AD-19: whether the operation is intended to change state. AD-20 rule 7 relevance reads it, and AD-10 selects the sensitivity channel by it. Both values are legal and neither is a default."
+                "description": "No uniqueness constraint: two operations colliding on their transport identity after parameter-name erasure is `duplicate-operation-signature`, a coded compile-time error, and a schema that deduped them would delete it."
+              }
+            },
+            "required": [
+              "logicalId",
+              "kind",
+              "operations"
+            ],
+            "additionalProperties": false
+          },
+          {
+            "type": "object",
+            "properties": {
+              "logicalId": {
+                "type": "string",
+                "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+                "description": "AD-35: a logical identifier for the interface, never a URL, host, or port. Mapping it to a target is the caller's, outside the contract."
+              },
+              "kind": {
+                "type": "string",
+                "const": "mcp"
+              },
+              "operations": {
+                "type": "array",
+                "items": {
+                  "$ref": "#/$defs/Operation"
                 },
-                "requestShape": {
+                "description": "No uniqueness constraint: two operations colliding on their transport identity after parameter-name erasure is `duplicate-operation-signature`, a coded compile-time error, and a schema that deduped them would delete it."
+              }
+            },
+            "required": [
+              "logicalId",
+              "kind",
+              "operations"
+            ],
+            "additionalProperties": false
+          },
+          {
+            "type": "object",
+            "properties": {
+              "logicalId": {
+                "type": "string",
+                "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+                "description": "AD-35: a logical identifier for the interface, never a URL, host, or port. Mapping it to a target is the caller's, outside the contract."
+              },
+              "kind": {
+                "type": "string",
+                "const": "cli"
+              },
+              "operations": {
+                "type": "array",
+                "items": {
                   "type": "object",
                   "properties": {
-                    "path": {
+                    "operationId": {
+                      "type": "string",
+                      "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+                      "description": "A kebab-case slug. Excludes \"/\" and \"~\" so an identifier can be embedded in an interaction-rooted pointer without escaping."
+                    },
+                    "invocation": {
                       "type": "object",
                       "properties": {
-                        "requiredKeys": {
-                          "type": "array",
-                          "items": {
-                            "type": "string",
-                            "minLength": 1
-                          }
+                        "executable": {
+                          "type": "string",
+                          "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+                          "description": "A logical executable name, never a filesystem path, a URL, a host, or a port (AD-35). The caller maps it to an authorized target through configuration outside the contract."
                         },
-                        "permittedKeys": {
+                        "subcommandPath": {
                           "type": "array",
                           "items": {
                             "type": "string",
-                            "minLength": 1
-                          },
-                          "description": "The closed set of keys the shape admits. Deliberately not refined to be a superset of `requiredKeys`: no AD-5 code names that contradiction, so it joins the cross-field rules left to the compiler in v0. There is no spelling for \"these keys are required and extras are unconstrained\" \u2014 AD-4 calls the descriptor closed, so an open mode would be a different grammar."
-                        },
-                        "types": {
-                          "type": "object",
-                          "propertyNames": {
-                            "type": "string",
-                            "minLength": 1
+                            "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+                            "description": "A kebab-case slug. Excludes \"/\" and \"~\" so an identifier can be embedded in an interaction-rooted pointer without escaping."
                           },
-                          "additionalProperties": {
-                            "anyOf": [
-                              {
-                                "type": "string",
-                                "enum": [
-                                  "string",
-                                  "number",
-                                  "boolean",
-                                  "object",
-                                  "array",
-                                  "null"
-                                ]
-                              },
-                              {
-                                "type": "null"
-                              }
-                            ]
-                          },
-                          "description": "Caller-keyed by plain key name, never by pointer: the descriptor-relative pointer spelling does not apply to these keys and must not be extended to them by analogy. A missing key means \"not declared\"; an explicit `null` value means \"declared, type not stated\"."
+                          "description": "The subcommand segments after the executable, outermost first. Empty is legal and means the executable is invoked with no subcommand."
                         }
                       },
                       "required": [
-                        "requiredKeys",
-                        "permittedKeys",
-                        "types"
+                        "executable",
+                        "subcommandPath"
                       ],
                       "additionalProperties": false
                     },
-                    "query": {
+                    "stateChangeMarker": {
+                      "type": "boolean",
+                      "description": "AD-19: whether the operation is intended to change state. AD-20 rule 7 relevance reads it, and AD-10 selects the sensitivity channel by it. Both values are legal and neither is a default."
+                    },
+                    "requestShape": {
                       "type": "object",
                       "properties": {
-                        "requiredKeys": {
-                          "type": "array",
-                          "items": {
-                            "type": "string",
-                            "minLength": 1
-                          }
-                        },
-                        "permittedKeys": {
-                          "type": "array",
-                          "items": {
-                            "type": "string",
-                            "minLength": 1
+                        "argument": {
+                          "type": "object",
+                          "properties": {
+                            "requiredKeys": {
+                              "type": "array",
+                              "items": {
+                                "type": "string",
+                                "minLength": 1
+                              }
+                            },
+                            "permittedKeys": {
+                              "type": "array",
+                              "items": {
+                                "type": "string",
+                                "minLength": 1
+                              },
+                              "description": "The closed set of keys the shape admits. Deliberately not refined to be a superset of `requiredKeys`: no AD-5 code names that contradiction, so it joins the cross-field rules left to the compiler in v0. There is no spelling for \"these keys are required and extras are unconstrained\" \u2014 AD-4 calls the descriptor closed, so an open mode would be a different grammar."
+                            },
+                            "types": {
+                              "type": "object",
+                              "propertyNames": {
+                                "type": "string",
+                                "minLength": 1
+                              },
+                              "additionalProperties": {
+                                "anyOf": [
+                                  {
+                                    "type": "string",
+                                    "enum": [
+                                      "string",
+                                      "number",
+                                      "boolean",
+                                      "object",
+                                      "array",
+                                      "null"
+                                    ]
+                                  },
+                                  {
+                                    "type": "null"
+                                  }
+                                ]
+                              },
+                              "description": "Caller-keyed by plain key name, never by pointer: the descriptor-relative pointer spelling does not apply to these keys and must not be extended to them by analogy. A missing key means \"not declared\"; an explicit `null` value means \"declared, type not stated\"."
+                            }
                           },
-                          "description": "The closed set of keys the shape admits. Deliberately not refined to be a superset of `requiredKeys`: no AD-5 code names that contradiction, so it joins the cross-field rules left to the compiler in v0. There is no spelling for \"these keys are required and extras are unconstrained\" \u2014 AD-4 calls the descriptor closed, so an open mode would be a different grammar."
+                          "required": [
+                            "requiredKeys",
+                            "permittedKeys",
+                            "types"
+                          ],
+                          "additionalProperties": false,
+                          "description": "Positional arguments, keyed by the name the contract gives each position. The key is the author's own label; position is not encoded here, because no AD-31 predicate reads argument order."
                         },
-                        "types": {
+                        "option": {
                           "type": "object",
-                          "propertyNames": {
-                            "type": "string",
-                            "minLength": 1
+                          "properties": {
+                            "requiredKeys": {
+                              "type": "array",
+                              "items": {
+                                "type": "string",
+                                "minLength": 1
+                              }
+                            },
+                            "permittedKeys": {
+                              "type": "array",
+                              "items": {
+                                "type": "string",
+                                "minLength": 1
+                              },
+                              "description": "The closed set of keys the shape admits. Deliberately not refined to be a superset of `requiredKeys`: no AD-5 code names that contradiction, so it joins the cross-field rules left to the compiler in v0. There is no spelling for \"these keys are required and extras are unconstrained\" \u2014 AD-4 calls the descriptor closed, so an open mode would be a different grammar."
+                            },
+                            "types": {
+                              "type": "object",
+                              "propertyNames": {
+                                "type": "string",
+                                "minLength": 1
+                              },
+                              "additionalProperties": {
+                                "anyOf": [
+                                  {
+                                    "type": "string",
+                                    "enum": [
+                                      "string",
+                                      "number",
+                                      "boolean",
+                                      "object",
+                                      "array",
+                                      "null"
+                                    ]
+                                  },
+                                  {
+                                    "type": "null"
+                                  }
+                                ]
+                              },
+                              "description": "Caller-keyed by plain key name, never by pointer: the descriptor-relative pointer spelling does not apply to these keys and must not be extended to them by analogy. A missing key means \"not declared\"; an explicit `null` value means \"declared, type not stated\"."
+                            }
                           },
-                          "additionalProperties": {
-                            "anyOf": [
-                              {
+                          "required": [
+                            "requiredKeys",
+                            "permittedKeys",
+                            "types"
+                          ],
+                          "additionalProperties": false
+                        },
+                        "environment": {
+                          "type": "object",
+                          "properties": {
+                            "requiredKeys": {
+                              "type": "array",
+                              "items": {
                                 "type": "string",
-                                "enum": [
-                                  "string",
-                                  "number",
-                                  "boolean",
-                                  "object",
-                                  "array",
-                                  "null"
+                                "minLength": 1
+                              }
+                            },
+                            "permittedKeys": {
+                              "type": "array",
+                              "items": {
+                                "type": "string",
+                                "minLength": 1
+                              },
+                              "description": "The closed set of keys the shape admits. Deliberately not refined to be a superset of `requiredKeys`: no AD-5 code names that contradiction, so it joins the cross-field rules left to the compiler in v0. There is no spelling for \"these keys are required and extras are unconstrained\" \u2014 AD-4 calls the descriptor closed, so an open mode would be a different grammar."
+                            },
+                            "types": {
+                              "type": "object",
+                              "propertyNames": {
+                                "type": "string",
+                                "minLength": 1
+                              },
+                              "additionalProperties": {
+                                "anyOf": [
+                                  {
+                                    "type": "string",
+                                    "enum": [
+                                      "string",
+                                      "number",
+                                      "boolean",
+                                      "object",
+                                      "array",
+                                      "null"
+                                    ]
+                                  },
+                                  {
+                                    "type": "null"
+                                  }
                                 ]
                               },
-                              {
-                                "type": "null"
+                              "description": "Caller-keyed by plain key name, never by pointer: the descriptor-relative pointer spelling does not apply to these keys and must not be extended to them by analogy. A missing key means \"not declared\"; an explicit `null` value means \"declared, type not stated\"."
+                            }
+                          },
+                          "required": [
+                            "requiredKeys",
+                            "permittedKeys",
+                            "types"
+                          ],
+                          "additionalProperties": false,
+                          "description": "AD-18: an environment channel declaration names a variable and its type and never carries a credential value. The same rule the header channel carries, for the channel that plays the same role off an HTTP interface."
+                        },
+                        "stdin": {
+                          "type": "object",
+                          "properties": {
+                            "requiredKeys": {
+                              "type": "array",
+                              "items": {
+                                "type": "string",
+                                "minLength": 1
                               }
-                            ]
+                            },
+                            "permittedKeys": {
+                              "type": "array",
+                              "items": {
+                                "type": "string",
+                                "minLength": 1
+                              },
+                              "description": "The closed set of keys the shape admits. Deliberately not refined to be a superset of `requiredKeys`: no AD-5 code names that contradiction, so it joins the cross-field rules left to the compiler in v0. There is no spelling for \"these keys are required and extras are unconstrained\" \u2014 AD-4 calls the descriptor closed, so an open mode would be a different grammar."
+                            },
+                            "types": {
+                              "type": "object",
+                              "propertyNames": {
+                                "type": "string",
+                                "minLength": 1
+                              },
+                              "additionalProperties": {
+                                "anyOf": [
+                                  {
+                                    "type": "string",
+                                    "enum": [
+                                      "string",
+                                      "number",
+                                      "boolean",
+                                      "object",
+                                      "array",
+                                      "null"
+                                    ]
+                                  },
+                                  {
+                                    "type": "null"
+                                  }
+                                ]
+                              },
+                              "description": "Caller-keyed by plain key name, never by pointer: the descriptor-relative pointer spelling does not apply to these keys and must not be extended to them by analogy. A missing key means \"not declared\"; an explicit `null` value means \"declared, type not stated\"."
+                            }
                           },
-                          "description": "Caller-keyed by plain key name, never by pointer: the descriptor-relative pointer spelling does not apply to these keys and must not be extended to them by analogy. A missing key means \"not declared\"; an explicit `null` value means \"declared, type not stated\"."
+                          "required": [
+                            "requiredKeys",
+                            "permittedKeys",
+                            "types"
+                          ],
+                          "additionalProperties": false
                         }
                       },
                       "required": [
-                        "requiredKeys",
-                        "permittedKeys",
-                        "types"
+                        "argument",
+                        "option",
+                        "environment",
+                        "stdin"
                       ],
                       "additionalProperties": false
                     },
-                    "header": {
+                    "artifacts": {
+                      "type": "array",
+                      "items": {
+                        "type": "string",
+                        "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+                        "description": "A kebab-case slug. Excludes \"/\" and \"~\" so an identifier can be embedded in an interaction-rooted pointer without escaping."
+                      },
+                      "description": "The files the operation writes, as bare declared identifiers with existence semantics only. No descriptor and no keys of their own: an artifact pointer's identifier segment resolves against this list, and structure comes from the operation's one response descriptor when `descriptorChannel` nominates that artifact. A pointer naming an identifier absent here fails compilation under `unresolved-artifact-reference`."
+                    },
+                    "descriptorChannel": {
+                      "oneOf": [
+                        {
+                          "type": "object",
+                          "properties": {
+                            "kind": {
+                              "type": "string",
+                              "const": "stream"
+                            },
+                            "channel": {
+                              "type": "string",
+                              "enum": [
+                                "stdout",
+                                "stderr"
+                              ]
+                            }
+                          },
+                          "required": [
+                            "kind",
+                            "channel"
+                          ],
+                          "additionalProperties": false
+                        },
+                        {
+                          "type": "object",
+                          "properties": {
+                            "kind": {
+                              "type": "string",
+                              "const": "artifact"
+                            },
+                            "artifactId": {
+                              "type": "string",
+                              "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+                              "description": "One of the identifiers this operation declares in `artifacts`. A name absent from that list fails compilation under `unresolved-artifact-reference` rather than resolving absent, because a dangling declaration is an authoring fault the compiler can see."
+                            }
+                          },
+                          "required": [
+                            "kind",
+                            "artifactId"
+                          ],
+                          "additionalProperties": false
+                        }
+                      ]
+                    },
+                    "responseDescriptor": {
                       "type": "object",
                       "properties": {
                         "requiredKeys": {
@@ -525,15 +777,15 @@
                           "items": {
                             "type": "string",
                             "minLength": 1
-                          }
+                          },
+                          "description": "No minimum of two anywhere in this shape: AD-20 rule 2 relevance is \"the descriptor declares more than one pointer\", so a one-pointer descriptor must parse in order to be the irrelevant case."
                         },
                         "permittedKeys": {
                           "type": "array",
                           "items": {
                             "type": "string",
                             "minLength": 1
-                          },
-                          "description": "The closed set of keys the shape admits. Deliberately not refined to be a superset of `requiredKeys`: no AD-5 code names that contradiction, so it joins the cross-field rules left to the compiler in v0. There is no spelling for \"these keys are required and extras are unconstrained\" \u2014 AD-4 calls the descriptor closed, so an open mode would be a different grammar."
+                          }
                         },
                         "types": {
                           "type": "object",
@@ -559,363 +811,351 @@
                               }
                             ]
                           },
-                          "description": "Caller-keyed by plain key name, never by pointer: the descriptor-relative pointer spelling does not apply to these keys and must not be extended to them by analogy. A missing key means \"not declared\"; an explicit `null` value means \"declared, type not stated\"."
-                        }
-                      },
-                      "required": [
-                        "requiredKeys",
-                        "permittedKeys",
-                        "types"
-                      ],
-                      "additionalProperties": false,
-                      "description": "AD-18: a header channel declaration names a header and its type and never carries a credential value."
-                    },
-                    "body": {
-                      "type": "object",
-                      "properties": {
-                        "requiredKeys": {
-                          "type": "array",
-                          "items": {
-                            "type": "string",
-                            "minLength": 1
-                          }
+                          "description": "Caller-keyed by plain key name, never by pointer: this is the shape where that trap bites, since `requiredKeys` sits beside a pointer-keyed `channelRoles` and a pointer-valued `successIndicator`, and the descriptor-relative spelling must not be extended here by analogy. A missing key means \"not declared\"; an explicit `null` value means \"declared, type not stated\", which is AD-31's enumerated indeterminate descriptor state and the shape `quantifier-over-non-collection` reads."
                         },
-                        "permittedKeys": {
-                          "type": "array",
-                          "items": {
-                            "type": "string",
-                            "minLength": 1
-                          },
-                          "description": "The closed set of keys the shape admits. Deliberately not refined to be a superset of `requiredKeys`: no AD-5 code names that contradiction, so it joins the cross-field rules left to the compiler in v0. There is no spelling for \"these keys are required and extras are unconstrained\" \u2014 AD-4 calls the descriptor closed, so an open mode would be a different grammar."
+                        "successIndicator": {
+                          "anyOf": [
+                            {
+                              "type": "string",
+                              "pattern": "^(?:\\/(?:[^/~]|~[01])*)*$",
+                              "description": "A plain RFC 6901 pointer into one operation's response descriptor. It resolves through the operation an interaction step names, never through the interaction root. A request or response shape's descriptor keys are plain key names rather than pointers, so this spelling does not apply there. The empty string is admitted and carries RFC 6901's own meaning, the whole document: as a nominated success indicator it says success is visible in the response taken as a whole rather than at any one key, and as a channel-role key it assigns a role to the whole body."
+                            },
+                            {
+                              "type": "null"
+                            }
+                          ],
+                          "description": "AD-20 rule 1 relevance reads this as its first conjunct, so `null` must stay representable."
                         },
-                        "types": {
-                          "type": "object",
-                          "propertyNames": {
-                            "type": "string",
-                            "minLength": 1
-                          },
-                          "additionalProperties": {
-                            "anyOf": [
-                              {
+                        "channelRoles": {
+                          "anyOf": [
+                            {
+                              "type": "object",
+                              "propertyNames": {
+                                "type": "string",
+                                "pattern": "^(?:\\/(?:[^/~]|~[01])*)*$",
+                                "description": "A plain RFC 6901 pointer into one operation's response descriptor. It resolves through the operation an interaction step names, never through the interaction root. A request or response shape's descriptor keys are plain key names rather than pointers, so this spelling does not apply there. The empty string is admitted and carries RFC 6901's own meaning, the whole document: as a nominated success indicator it says success is visible in the response taken as a whole rather than at any one key, and as a channel-role key it assigns a role to the whole body."
+                              },
+                              "additionalProperties": {
                                 "type": "string",
                                 "enum": [
-                                  "string",
-                                  "number",
-                                  "boolean",
-                                  "object",
-                                  "array",
-                                  "null"
+                                  "success-indicator",
+                                  "diagnostic",
+                                  "payload",
+                                  "collection"
                                 ]
-                              },
-                              {
-                                "type": "null"
                               }
-                            ]
-                          },
-                          "description": "Caller-keyed by plain key name, never by pointer: the descriptor-relative pointer spelling does not apply to these keys and must not be extended to them by analogy. A missing key means \"not declared\"; an explicit `null` value means \"declared, type not stated\"."
+                            },
+                            {
+                              "type": "null"
+                            }
+                          ],
+                          "description": "Caller-keyed, and expected to be partial: a missing key means \"no role declared for that pointer\". AD-31 grades absent and explicitly empty differently, so `null`, `{}`, and a populated map are three distinct answers. Deliberately not refined to require a role for every descriptor key: no AD-5 code names that rule, the AD-31 predicates degrade gracefully on partial roles, and a refinement buys nothing an export can carry."
+                        },
+                        "collectionLocations": {
+                          "anyOf": [
+                            {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "pointer": {
+                                    "type": "string",
+                                    "pattern": "^(?:\\/(?:[^/~]|~[01])*)*$",
+                                    "description": "A plain RFC 6901 pointer into one operation's response descriptor. It resolves through the operation an interaction step names, never through the interaction root. A request or response shape's descriptor keys are plain key names rather than pointers, so this spelling does not apply there. The empty string is admitted and carries RFC 6901's own meaning, the whole document: as a nominated success indicator it says success is visible in the response taken as a whole rather than at any one key, and as a channel-role key it assigns a role to the whole body."
+                                  },
+                                  "expectedCardinality": {
+                                    "oneOf": [
+                                      {
+                                        "type": "object",
+                                        "properties": {
+                                          "mode": {
+                                            "type": "string",
+                                            "const": "exact"
+                                          },
+                                          "count": {
+                                            "type": "integer",
+                                            "minimum": 0,
+                                            "maximum": 9007199254740991
+                                          }
+                                        },
+                                        "required": [
+                                          "mode",
+                                          "count"
+                                        ],
+                                        "additionalProperties": false
+                                      },
+                                      {
+                                        "type": "object",
+                                        "properties": {
+                                          "mode": {
+                                            "type": "string",
+                                            "const": "at-most"
+                                          },
+                                          "max": {
+                                            "type": "integer",
+                                            "minimum": 0,
+                                            "maximum": 9007199254740991
+                                          }
+                                        },
+                                        "required": [
+                                          "mode",
+                                          "max"
+                                        ],
+                                        "additionalProperties": false
+                                      },
+                                      {
+                                        "type": "object",
+                                        "properties": {
+                                          "mode": {
+                                            "type": "string",
+                                            "const": "page-bounded"
+                                          },
+                                          "max": {
+                                            "type": "integer",
+                                            "minimum": 0,
+                                            "maximum": 9007199254740991
+                                          }
+                                        },
+                                        "required": [
+                                          "mode",
+                                          "max"
+                                        ],
+                                        "additionalProperties": false
+                                      }
+                                    ]
+                                  },
+                                  "referenceSet": {
+                                    "anyOf": [
+                                      {
+                                        "type": "string",
+                                        "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+                                        "description": "A kebab-case slug. Excludes \"/\" and \"~\" so an identifier can be embedded in an interaction-rooted pointer without escaping."
+                                      },
+                                      {
+                                        "type": "null"
+                                      }
+                                    ],
+                                    "description": "AD-20 rule 6 is relevant when a declared collection location names a reference set, so `null` is the shape that makes the rule irrelevant and must stay representable."
+                                  }
+                                },
+                                "required": [
+                                  "pointer",
+                                  "expectedCardinality",
+                                  "referenceSet"
+                                ],
+                                "additionalProperties": false
+                              }
+                            },
+                            {
+                              "type": "null"
+                            }
+                          ],
+                          "description": "AD-20 rule 4 relevance reads this, and AD-31 grades an absent declaration and an explicit empty one differently, so `null` and `[]` are distinct answers."
                         }
                       },
                       "required": [
                         "requiredKeys",
                         "permittedKeys",
-                        "types"
+                        "types",
+                        "successIndicator",
+                        "channelRoles",
+                        "collectionLocations"
                       ],
                       "additionalProperties": false
-                    }
-                  },
-                  "required": [
-                    "path",
-                    "query",
-                    "header",
-                    "body"
-                  ],
-                  "additionalProperties": false
-                },
-                "responseDescriptor": {
-                  "type": "object",
-                  "properties": {
-                    "requiredKeys": {
-                      "type": "array",
-                      "items": {
-                        "type": "string",
-                        "minLength": 1
-                      },
-                      "description": "No minimum of two anywhere in this shape: AD-20 rule 2 relevance is \"the descriptor declares more than one pointer\", so a one-pointer descriptor must parse in order to be the irrelevant case."
                     },
-                    "permittedKeys": {
+                    "volatilePointers": {
                       "type": "array",
                       "items": {
                         "type": "string",
-                        "minLength": 1
+                        "pattern": "^(?:\\/(?:[^/~]|~[01])*)*$",
+                        "description": "A plain RFC 6901 pointer into one operation's response descriptor. It resolves through the operation an interaction step names, never through the interaction root. A request or response shape's descriptor keys are plain key names rather than pointers, so this spelling does not apply there. The empty string is admitted and carries RFC 6901's own meaning, the whole document: as a nominated success indicator it says success is visible in the response taken as a whole rather than at any one key, and as a channel-role key it assigns a role to the whole body."
                       }
                     },
-                    "types": {
-                      "type": "object",
-                      "propertyNames": {
-                        "type": "string",
-                        "minLength": 1
-                      },
-                      "additionalProperties": {
-                        "anyOf": [
-                          {
-                            "type": "string",
-                            "enum": [
-                              "string",
-                              "number",
-                              "boolean",
-                              "object",
-                              "array",
-                              "null"
-                            ]
-                          },
-                          {
-                            "type": "null"
-                          }
-                        ]
-                      },
-                      "description": "Caller-keyed by plain key name, never by pointer: this is the shape where that trap bites, since `requiredKeys` sits beside a pointer-keyed `channelRoles` and a pointer-valued `successIndicator`, and the descriptor-relative spelling must not be extended here by analogy. A missing key means \"not declared\"; an explicit `null` value means \"declared, type not stated\", which is AD-31's enumerated indeterminate descriptor state and the shape `quantifier-over-non-collection` reads."
-                    },
-                    "successIndicator": {
-                      "anyOf": [
-                        {
-                          "type": "string",
-                          "pattern": "^(?:\\/(?:[^/~]|~[01])*)*$",
-                          "description": "A plain RFC 6901 pointer into one operation's response descriptor. It resolves through the operation an interaction step names, never through the interaction root. A request or response shape's descriptor keys are plain key names rather than pointers, so this spelling does not apply there. The empty string is admitted and carries RFC 6901's own meaning, the whole document: as a nominated success indicator it says success is visible in the response taken as a whole rather than at any one key, and as a channel-role key it assigns a role to the whole body."
-                        },
-                        {
-                          "type": "null"
-                        }
-                      ],
-                      "description": "AD-20 rule 1 relevance reads this as its first conjunct, so `null` must stay representable."
-                    },
-                    "channelRoles": {
+                    "sensitivityWitness": {
                       "anyOf": [
                         {
                           "type": "object",
-                          "propertyNames": {
-                            "type": "string",
-                            "pattern": "^(?:\\/(?:[^/~]|~[01])*)*$",
-                            "description": "A plain RFC 6901 pointer into one operation's response descriptor. It resolves through the operation an interaction step names, never through the interaction root. A request or response shape's descriptor keys are plain key names rather than pointers, so this spelling does not apply there. The empty string is admitted and carries RFC 6901's own meaning, the whole document: as a nominated success indicator it says success is visible in the response taken as a whole rather than at any one key, and as a channel-role key it assigns a role to the whole body."
-                          },
-                          "additionalProperties": {
-                            "type": "string",
-                            "enum": [
-                              "success-indicator",
-                              "diagnostic",
-                              "payload",
-                              "collection"
-                            ]
-                          }
-                        },
-                        {
-                          "type": "null"
-                        }
-                      ],
-                      "description": "Caller-keyed, and expected to be partial: a missing key means \"no role declared for that pointer\". AD-31 grades absent and explicitly empty differently, so `null`, `{}`, and a populated map are three distinct answers. Deliberately not refined to require a role for every descriptor key: no AD-5 code names that rule, the AD-31 predicates degrade gracefully on partial roles, and a refinement buys nothing an export can carry."
-                    },
-                    "collectionLocations": {
-                      "anyOf": [
-                        {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "pointer": {
-                                "type": "string",
-                                "pattern": "^(?:\\/(?:[^/~]|~[01])*)*$",
-                                "description": "A plain RFC 6901 pointer into one operation's response descriptor. It resolves through the operation an interaction step names, never through the interaction root. A request or response shape's descriptor keys are plain key names rather than pointers, so this spelling does not apply there. The empty string is admitted and carries RFC 6901's own meaning, the whole document: as a nominated success indicator it says success is visible in the response taken as a whole rather than at any one key, and as a channel-role key it assigns a role to the whole body."
-                              },
-                              "expectedCardinality": {
-                                "oneOf": [
-                                  {
-                                    "type": "object",
-                                    "properties": {
-                                      "mode": {
-                                        "type": "string",
-                                        "const": "exact"
-                                      },
-                                      "count": {
-                                        "type": "integer",
-                                        "minimum": 0,
-                                        "maximum": 9007199254740991
-                                      }
-                                    },
-                                    "required": [
-                                      "mode",
-                                      "count"
-                                    ],
-                                    "additionalProperties": false
-                                  },
-                                  {
-                                    "type": "object",
-                                    "properties": {
-                                      "mode": {
-                                        "type": "string",
-                                        "const": "at-most"
-                                      },
-                                      "max": {
-                                        "type": "integer",
-                                        "minimum": 0,
-                                        "maximum": 9007199254740991
-                                      }
-                                    },
-                                    "required": [
-                                      "mode",
-                                      "max"
-                                    ],
-                                    "additionalProperties": false
-                                  },
-                                  {
-                                    "type": "object",
-                                    "properties": {
-                                      "mode": {
-                                        "type": "string",
-                                        "const": "page-bounded"
-                                      },
-                                      "max": {
-                                        "type": "integer",
-                                        "minimum": 0,
-                                        "maximum": 9007199254740991
-                                      }
-                                    },
-                                    "required": [
-                                      "mode",
-                                      "max"
-                                    ],
-                                    "additionalProperties": false
-                                  }
-                                ]
-                              },
-                              "referenceSet": {
-                                "anyOf": [
-                                  {
+                          "properties": {
+                            "witnessId": {
+                              "type": "string",
+                              "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+                              "description": "A kebab-case slug. Excludes \"/\" and \"~\" so an identifier can be embedded in an interaction-rooted pointer without escaping."
+                            },
+                            "channel": {
+                              "type": "string",
+                              "enum": [
+                                "path",
+                                "query",
+                                "body",
+                                "argument",
+                                "option",
+                                "environment",
+                                "stdin"
+                              ]
+                            },
+                            "legs": {
+                              "minItems": 2,
+                              "maxItems": 2,
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "legId": {
                                     "type": "string",
                                     "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
                                     "description": "A kebab-case slug. Excludes \"/\" and \"~\" so an identifier can be embedded in an interaction-rooted pointer without escaping."
                                   },
-                                  {
-                                    "type": "null"
+                                  "inputs": {
+                                    "anyOf": [
+                                      {
+                                        "$ref": "#/$defs/WitnessInputs"
+                                      },
+                                      {
+                                        "type": "object",
+                                        "properties": {
+                                          "argument": {
+                                            "type": "object",
+                                            "propertyNames": {
+                                              "type": "string"
+                                            },
+                                            "additionalProperties": {
+                                              "$ref": "#/$defs/JsonValue"
+                                            }
+                                          },
+                                          "option": {
+                                            "type": "object",
+                                            "propertyNames": {
+                                              "type": "string"
+                                            },
+                                            "additionalProperties": {
+                                              "$ref": "#/$defs/JsonValue"
+                                            }
+                                          },
+                                          "environment": {
+                                            "type": "object",
+                                            "propertyNames": {
+                                              "type": "string",
+                                              "minLength": 1
+                                            },
+                                            "additionalProperties": {
+                                              "type": "string"
+                                            }
+                                          },
+                                          "stdin": {
+                                            "oneOf": [
+                                              {
+                                                "type": "object",
+                                                "properties": {
+                                                  "kind": {
+                                                    "type": "string",
+                                                    "const": "json"
+                                                  },
+                                                  "value": {
+                                                    "$ref": "#/$defs/JsonValue"
+                                                  }
+                                                },
+                                                "required": [
+                                                  "kind",
+                                                  "value"
+                                                ],
+                                                "additionalProperties": false
+                                              },
+                                              {
+                                                "type": "object",
+                                                "properties": {
+                                                  "kind": {
+                                                    "type": "string",
+                                                    "const": "text"
+                                                  },
+                                                  "value": {
+                                                    "type": "string"
+                                                  }
+                                                },
+                                                "required": [
+                                                  "kind",
+                                                  "value"
+                                                ],
+                                                "additionalProperties": false
+                                              },
+                                              {
+                                                "type": "object",
+                                                "properties": {
+                                                  "kind": {
+                                                    "type": "string",
+                                                    "const": "absent"
+                                                  }
+                                                },
+                                                "required": [
+                                                  "kind"
+                                                ],
+                                                "additionalProperties": false
+                                              }
+                                            ]
+                                          }
+                                        },
+                                        "required": [
+                                          "argument",
+                                          "option",
+                                          "environment",
+                                          "stdin"
+                                        ],
+                                        "additionalProperties": false
+                                      }
+                                    ]
                                   }
+                                },
+                                "required": [
+                                  "legId",
+                                  "inputs"
                                 ],
-                                "description": "AD-20 rule 6 is relevant when a declared collection location names a reference set, so `null` is the shape that makes the rule irrelevant and must stay representable."
+                                "additionalProperties": false
                               }
                             },
-                            "required": [
-                              "pointer",
-                              "expectedCardinality",
-                              "referenceSet"
-                            ],
-                            "additionalProperties": false
-                          }
+                            "relation": {
+                              "$ref": "#/$defs/Expression"
+                            }
+                          },
+                          "required": [
+                            "witnessId",
+                            "channel",
+                            "legs",
+                            "relation"
+                          ],
+                          "additionalProperties": false
                         },
                         {
                           "type": "null"
                         }
                       ],
-                      "description": "AD-20 rule 4 relevance reads this, and AD-31 grades an absent declaration and an explicit empty one differently, so `null` and `[]` are distinct answers."
+                      "description": "AD-10, mandatory per declared operation rather than per interface, on the api operation's own terms. `null` is legal only for an operation declaring no keys in any request channel, which for a command means no argument, no option, no environment variable, and no standard input. An input-bearing operation declaring `null` fails a strict compilation under `undeclared-mandatory-input`."
                     }
                   },
                   "required": [
-                    "requiredKeys",
-                    "permittedKeys",
-                    "types",
-                    "successIndicator",
-                    "channelRoles",
-                    "collectionLocations"
+                    "operationId",
+                    "invocation",
+                    "stateChangeMarker",
+                    "requestShape",
+                    "artifacts",
+                    "descriptorChannel",
+                    "responseDescriptor",
+                    "volatilePointers",
+                    "sensitivityWitness"
                   ],
                   "additionalProperties": false
                 },
-                "volatilePointers": {
-                  "type": "array",
-                  "items": {
-                    "type": "string",
-                    "pattern": "^(?:\\/(?:[^/~]|~[01])*)*$",
-                    "description": "A plain RFC 6901 pointer into one operation's response descriptor. It resolves through the operation an interaction step names, never through the interaction root. A request or response shape's descriptor keys are plain key names rather than pointers, so this spelling does not apply there. The empty string is admitted and carries RFC 6901's own meaning, the whole document: as a nominated success indicator it says success is visible in the response taken as a whole rather than at any one key, and as a channel-role key it assigns a role to the whole body."
-                  }
-                },
-                "sensitivityWitness": {
-                  "anyOf": [
-                    {
-                      "type": "object",
-                      "properties": {
-                        "witnessId": {
-                          "type": "string",
-                          "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
-                          "description": "A kebab-case slug. Excludes \"/\" and \"~\" so an identifier can be embedded in an interaction-rooted pointer without escaping."
-                        },
-                        "channel": {
-                          "type": "string",
-                          "enum": [
-                            "path",
-                            "query",
-                            "body"
-                          ]
-                        },
-                        "legs": {
-                          "minItems": 2,
-                          "maxItems": 2,
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "legId": {
-                                "type": "string",
-                                "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
-                                "description": "A kebab-case slug. Excludes \"/\" and \"~\" so an identifier can be embedded in an interaction-rooted pointer without escaping."
-                              },
-                              "inputs": {
-                                "$ref": "#/$defs/WitnessInputs"
-                              }
-                            },
-                            "required": [
-                              "legId",
-                              "inputs"
-                            ],
-                            "additionalProperties": false
-                          }
-                        },
-                        "relation": {
-                          "$ref": "#/$defs/Expression"
-                        }
-                      },
-                      "required": [
-                        "witnessId",
-                        "channel",
-                        "legs",
-                        "relation"
-                      ],
-                      "additionalProperties": false
-                    },
-                    {
-                      "type": "null"
-                    }
-                  ],
-                  "description": "AD-10, mandatory per declared operation rather than per interface. `null` is legal only for an operation declaring no keys in any request channel; AD-10 exempts that operation and requires the exemption to be recorded, which pre-flight does as an `exempt` check. An input-bearing operation declaring `null` fails a strict compilation under `undeclared-mandatory-input`, alongside the other declaration-completeness check that code already gates."
-                }
-              },
-              "required": [
-                "operationId",
-                "method",
-                "pathTemplate",
-                "stateChangeMarker",
-                "requestShape",
-                "responseDescriptor",
-                "volatilePointers",
-                "sensitivityWitness"
-              ],
-              "additionalProperties": false
+                "description": "No uniqueness constraint: two operations colliding on their transport identity after parameter-name erasure is `duplicate-operation-signature`, a coded compile-time error, and a schema that deduped them would delete it."
+              }
             },
-            "description": "No uniqueness constraint: two operations colliding on method plus path template after parameter-name erasure is `duplicate-operation-signature`, a coded compile-time error, and a schema that deduped them would delete it."
+            "required": [
+              "logicalId",
+              "kind",
+              "operations"
+            ],
+            "additionalProperties": false
           }
-        },
-        "required": [
-          "logicalId",
-          "kind",
-          "operations"
-        ],
-        "additionalProperties": false
+        ]
       },
-      "description": "AD-35: logical identifiers only. No entry here is ever a URL, a host, or a port."
+      "description": "AD-35: logical identifiers only. No entry here is ever a URL, a host, or a port. Discriminated on `kind`, which makes this field the eval contract's `schemaVersion` 3 -> 4 BREAKING bump under AD-11, whose rule is that \"adding an optional field is a `schemaVersion` bump recorded in the field's own description; removing or retyping is breaking\". The `api`, `web`, and `mcp` branches carry the shipped operation shape unchanged, so a version-3 contract's own bytes still parse on them; the `cli` branch carries a command operation, which declares a logical invocation instead of a method and a path template, four command input channels instead of the four transport channels, a nominated output channel for its one response descriptor, and the files it writes."
     },
     "referenceSets": {
       "anyOf": [
@@ -1034,28 +1274,56 @@
             "description": "A kebab-case slug. Excludes \"/\" and \"~\" so an identifier can be embedded in an interaction-rooted pointer without escaping."
           },
           "inputBinding": {
-            "type": "object",
-            "properties": {
-              "path": {
-                "$ref": "#/$defs/InputBindingChannel"
-              },
-              "query": {
-                "$ref": "#/$defs/InputBindingChannel"
-              },
-              "header": {
-                "$ref": "#/$defs/InputBindingChannel"
+            "anyOf": [
+              {
+                "type": "object",
+                "properties": {
+                  "path": {
+                    "$ref": "#/$defs/InputBindingChannel"
+                  },
+                  "query": {
+                    "$ref": "#/$defs/InputBindingChannel"
+                  },
+                  "header": {
+                    "$ref": "#/$defs/InputBindingChannel"
+                  },
+                  "body": {
+                    "$ref": "#/$defs/InputBindingChannel"
+                  }
+                },
+                "required": [
+                  "path",
+                  "query",
+                  "header",
+                  "body"
+                ],
+                "additionalProperties": false
               },
-              "body": {
-                "$ref": "#/$defs/InputBindingChannel"
+              {
+                "type": "object",
+                "properties": {
+                  "argument": {
+                    "$ref": "#/$defs/InputBindingChannel"
+                  },
+                  "option": {
+                    "$ref": "#/$defs/InputBindingChannel"
+                  },
+                  "environment": {
+                    "$ref": "#/$defs/InputBindingChannel"
+                  },
+                  "stdin": {
+                    "$ref": "#/$defs/InputBindingChannel"
+                  }
+                },
+                "required": [
+                  "argument",
+                  "option",
+                  "environment",
+                  "stdin"
+                ],
+                "additionalProperties": false
               }
-            },
-            "required": [
-              "path",
-              "query",
-              "header",
-              "body"
-            ],
-            "additionalProperties": false
+            ]
           },
           "after": {
             "anyOf": [
@@ -1069,13 +1337,23 @@
               }
             ],
             "description": "The temporal clause: the identifier of an earlier step, or `null`. That the named step carries no clause of its own is AD-39's one-level bound, which fires `nested-temporal-clause` at compile time and is deliberately not enforced here, so the code keeps a shape to fire on."
+          },
+          "cardinality": {
+            "type": "string",
+            "enum": [
+              "exactly-one",
+              "at-most-one",
+              "any"
+            ],
+            "description": "AD-39's declared selector cardinality (owed item 2): `exactly-one` or `at-most-one` when the step expects a single matching observation, `any` when several are legitimate. Several matches under `exactly-one`/`at-most-one` is the named ambiguity condition; a reference selection function returns it as data. Required rather than optional, which makes this a BREAKING `schemaVersion` bump under AD-11: adding an optional field is additive, and this field is not optional."
           }
         },
         "required": [
           "stepId",
           "operationId",
           "inputBinding",
-          "after"
+          "after",
+          "cardinality"
         ],
         "additionalProperties": false
       },
@@ -1148,23 +1426,83 @@
               "type": "null"
             }
           ]
-        }
-      },
-      "required": [
-        "setup",
-        "cleanup"
-      ],
-      "additionalProperties": false
-    },
-    "budgets": {
-      "type": "object",
-      "properties": {
-        "maxToolCalls": {
-          "type": "integer",
-          "minimum": 0,
-          "maximum": 9007199254740991
         },
-        "maxWallClockMinutes": {
+        "principals": {
+          "anyOf": [
+            {
+              "type": "object",
+              "propertyNames": {
+                "type": "string",
+                "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+                "description": "A kebab-case slug. Excludes \"/\" and \"~\" so an identifier can be embedded in an interaction-rooted pointer without escaping."
+              },
+              "additionalProperties": {
+                "type": "object",
+                "properties": {
+                  "kind": {
+                    "type": "string",
+                    "minLength": 1
+                  }
+                },
+                "required": [
+                  "kind"
+                ],
+                "additionalProperties": false
+              }
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Owed item 3: the principals a `{ principal }` input binding may name. Caller-keyed by name, which makes a duplicate declaration unrepresentable, and valueless, since AD-19 forbids a credential value in a declaration and AD-18 keeps the name an opaque label. `null`, `{}`, and a populated map are three distinct answers, on `referenceSets`' own reasoning. A binding naming a key absent here still parses; it fires `undeclared-mandatory-input` at compile time in strict mode, because a cross-subtree constraint reaching from `interactionPlan` into this field cannot survive the export. Required, not optional, which makes this and `resources` below together the eval contract's `schemaVersion` 2 -> 3 BREAKING bump under AD-11, whose rule is that \"adding an optional field is a `schemaVersion` bump recorded in the field's own description; removing or retyping is breaking\". `null` is the legal spelling for a contract declaring none, but `TestData` is a `strictObject` and the key itself must be present, so no version-2 contract parses."
+        },
+        "resources": {
+          "anyOf": [
+            {
+              "type": "object",
+              "propertyNames": {
+                "type": "string",
+                "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+                "description": "A kebab-case slug. Excludes \"/\" and \"~\" so an identifier can be embedded in an interaction-rooted pointer without escaping."
+              },
+              "additionalProperties": {
+                "type": "object",
+                "properties": {
+                  "kind": {
+                    "type": "string",
+                    "minLength": 1
+                  }
+                },
+                "required": [
+                  "kind"
+                ],
+                "additionalProperties": false
+              }
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Test-data resources, declared the same way as `principals` above. Any entry fires `scoped-reference-resolves-forbidden` at compile time exactly as a `scopedResources` entry does: a resource the contract points the evaluator at is a scoped reference wherever it is written down (AD-16). Required on the same terms as `principals`, and the other half of the eval contract's `schemaVersion` 2 -> 3 BREAKING bump under AD-11: `null` is the empty spelling and the key is mandatory."
+        }
+      },
+      "required": [
+        "setup",
+        "cleanup",
+        "principals",
+        "resources"
+      ],
+      "additionalProperties": false
+    },
+    "budgets": {
+      "type": "object",
+      "properties": {
+        "maxToolCalls": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 9007199254740991
+        },
+        "maxWallClockMinutes": {
           "type": "integer",
           "minimum": 0,
           "maximum": 9007199254740991
@@ -1270,7 +1608,7 @@
     "fixtureReset"
   ],
   "additionalProperties": false,
-  "description": "The Eval Contract. Succeeds the prior-art `eval-contract` schema per AD-24. It carries every declaration AD-19 requires so that AD-31's fourteen relevance and satisfaction predicates are decidable from declarations alone. AD-10's sensitivity witnesses arrived in this version, on each operation, as the additive `schemaVersion` bump AD-11 requires; the bump is recorded in each new field's own description, since no reader in this version declares an expected version constant to compare against.",
+  "description": "The Eval Contract. Succeeds the prior-art `eval-contract` schema per AD-24. It carries every declaration AD-19 requires so that AD-31's fourteen relevance and satisfaction predicates are decidable from declarations alone. AD-10's sensitivity witnesses arrived on each operation as an additive `schemaVersion` bump; version 4 opens `permittedInterfaces` to a second interface kind, so a contract may describe a system under test that runs behind a command, and widens the interaction pointer's accepted language with the four command input channels and the `artifact` channel. The widening retypes nothing on its own, since every pointer legal under version 3 is still legal; it carries the same version because it ships in the same release as the retypes. Each bump is recorded in its own field's description, and `compile` compares the stamp against `EVAL_CONTRACT_SCHEMA_VERSION` and throws AD-28's `schema-version-mismatch` on anything else.",
   "$defs": {
     "Expression": {
       "description": "A `check` expression tree over AD-4's closed vocabulary, discriminated on `op`. Exports as a `oneOf` of sixteen branches, each identified by its `op` const; a constraint ledger entry names a branch by that const rather than by position.",
@@ -1596,11 +1934,618 @@
                   "$ref": "#/$defs/Operand"
                 }
               ],
-              "description": "One operand, legally a pointer. Every position admits the full operand union on purpose. AD-26 makes a reference-set operand outside its three legal positions \u2014 `covers-by-key`'s expected operand, and the set operand of `set-membership` or `containment` \u2014 fail compilation under `malformed-operator-expression`, which only stays fireable if the other positions admit it. Compilation enforces the legality stated here; the schema does not narrow it.",
-              "minItems": 1,
-              "items": false
+              "description": "One operand, legally a pointer. Every position admits the full operand union on purpose. AD-26 makes a reference-set operand outside its three legal positions \u2014 `covers-by-key`'s expected operand, and the set operand of `set-membership` or `containment` \u2014 fail compilation under `malformed-operator-expression`, which only stays fireable if the other positions admit it. Compilation enforces the legality stated here; the schema does not narrow it.",
+              "minItems": 1,
+              "items": false
+            },
+            "descriptor": {
+              "type": "object",
+              "properties": {
+                "requiredKeys": {
+                  "type": "array",
+                  "items": {
+                    "type": "string",
+                    "minLength": 1
+                  }
+                },
+                "permittedKeys": {
+                  "type": "array",
+                  "items": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "description": "The closed set of keys the shape admits. Deliberately not refined to be a superset of `requiredKeys`: no AD-5 code names that contradiction, so it joins the cross-field rules left to the compiler in v0. There is no spelling for \"these keys are required and extras are unconstrained\" \u2014 AD-4 calls the descriptor closed, so an open mode would be a different grammar."
+                },
+                "types": {
+                  "type": "object",
+                  "propertyNames": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "additionalProperties": {
+                    "anyOf": [
+                      {
+                        "type": "string",
+                        "enum": [
+                          "string",
+                          "number",
+                          "boolean",
+                          "object",
+                          "array",
+                          "null"
+                        ]
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ]
+                  },
+                  "description": "Caller-keyed by plain key name, never by pointer: the descriptor-relative pointer spelling does not apply to these keys and must not be extended to them by analogy. A missing key means \"not declared\"; an explicit `null` value means \"declared, type not stated\"."
+                }
+              },
+              "required": [
+                "requiredKeys",
+                "permittedKeys",
+                "types"
+              ],
+              "additionalProperties": false,
+              "description": "AD-4: a closed descriptor, never an embedded JSON Schema. Typing it as a named field is what makes that structural, and it is a deliberate divergence from the Gate C fixture's `{ \"literal\": { \u2026 } }` spelling, where any JSON could sit."
+            }
+          },
+          "required": [
+            "op",
+            "operands",
+            "descriptor"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "op": {
+              "type": "string",
+              "const": "covers-by-key"
+            },
+            "operands": {
+              "type": "array",
+              "prefixItems": [
+                {
+                  "$ref": "#/$defs/Operand"
+                },
+                {
+                  "$ref": "#/$defs/Operand"
+                }
+              ],
+              "description": "Two operands: `expected` is legally a reference set, and `actual` is legally a pointer to a collection. Every position admits the full operand union on purpose. AD-26 makes a reference-set operand outside its three legal positions \u2014 `covers-by-key`'s expected operand, and the set operand of `set-membership` or `containment` \u2014 fail compilation under `malformed-operator-expression`, which only stays fireable if the other positions admit it. Compilation enforces the legality stated here; the schema does not narrow it.",
+              "minItems": 2,
+              "items": false
+            },
+            "expectedKey": {
+              "type": "string",
+              "minLength": 1
+            },
+            "actualKey": {
+              "type": "string",
+              "minLength": 1
+            }
+          },
+          "required": [
+            "op",
+            "operands",
+            "expectedKey",
+            "actualKey"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "op": {
+              "type": "string",
+              "const": "not"
+            },
+            "operands": {
+              "type": "array",
+              "prefixItems": [
+                {
+                  "$ref": "#/$defs/Expression"
+                }
+              ],
+              "description": "One nested expression rather than an operand. A connective composes the tree; it never addresses evidence itself.",
+              "minItems": 1,
+              "items": false
+            }
+          },
+          "required": [
+            "op",
+            "operands"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "op": {
+              "type": "string",
+              "const": "all"
+            },
+            "operands": {
+              "minItems": 2,
+              "type": "array",
+              "items": {
+                "$ref": "#/$defs/Expression"
+              },
+              "description": "Two or more nested expressions rather than operands. The minimum is settled here because AD-4 leaves connective arity unstated: zero operands would certify vacuously and one is the identity."
+            }
+          },
+          "required": [
+            "op",
+            "operands"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "op": {
+              "type": "string",
+              "const": "any"
+            },
+            "operands": {
+              "minItems": 2,
+              "type": "array",
+              "items": {
+                "$ref": "#/$defs/Expression"
+              },
+              "description": "Two or more nested expressions rather than operands, for the same reason `all` carries the same minimum."
+            }
+          },
+          "required": [
+            "op",
+            "operands"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "op": {
+              "type": "string",
+              "const": "for-all"
+            },
+            "collection": {
+              "$ref": "#/$defs/Operand"
+            },
+            "predicate": {
+              "$ref": "#/$defs/Expression"
+            }
+          },
+          "required": [
+            "op",
+            "collection",
+            "predicate"
+          ],
+          "additionalProperties": false,
+          "description": "`collection` is legally a pointer to a collection, and `predicate` is the expression each bound element is tested against, addressed by the `@/` pointer spelling. A quantifier inside the predicate is structurally admitted so `quantifier-nesting-exceeded` keeps a shape to fire on. Every position admits the full operand union on purpose. AD-26 makes a reference-set operand outside its three legal positions \u2014 `covers-by-key`'s expected operand, and the set operand of `set-membership` or `containment` \u2014 fail compilation under `malformed-operator-expression`, which only stays fireable if the other positions admit it. Compilation enforces the legality stated here; the schema does not narrow it."
+        },
+        {
+          "type": "object",
+          "properties": {
+            "op": {
+              "type": "string",
+              "const": "for-any"
+            },
+            "collection": {
+              "$ref": "#/$defs/Operand"
+            },
+            "predicate": {
+              "$ref": "#/$defs/Expression"
+            }
+          },
+          "required": [
+            "op",
+            "collection",
+            "predicate"
+          ],
+          "additionalProperties": false,
+          "description": "`collection` is legally a pointer to a collection, and `predicate` is the expression each bound element is tested against, addressed by the `@/` pointer spelling. Every position admits the full operand union on purpose. AD-26 makes a reference-set operand outside its three legal positions \u2014 `covers-by-key`'s expected operand, and the set operand of `set-membership` or `containment` \u2014 fail compilation under `malformed-operator-expression`, which only stays fireable if the other positions admit it. Compilation enforces the legality stated here; the schema does not narrow it."
+        }
+      ]
+    },
+    "Operand": {
+      "anyOf": [
+        {
+          "type": "object",
+          "properties": {
+            "pointer": {
+              "anyOf": [
+                {
+                  "type": "string",
+                  "pattern": "^\\/interactions\\/[a-z0-9]+(?:-[a-z0-9]+)*\\/(?:(?:response-body|response-headers|stdout|stderr)(?:\\/(?:[^/~]|~[01])*)*|(?:response-status|exit-code)|call-inputs\\/(?:path|query|header|body|argument|option|environment|stdin)(?:\\/(?:[^/~]|~[01])*)*|artifact\\/[a-z0-9]+(?:-[a-z0-9]+)*(?:\\/(?:[^/~]|~[01])*)*)$",
+                  "description": "AD-26 interaction-rooted pointer: \"/interactions/{stepId}/\" followed by one channel of the closed vocabulary. `call-inputs` takes one input channel as its next segment, one of the four transport channels or one of the four command channels; `artifact` takes the identifier of a file the operation declares it writes; `response-status` and `exit-code` take no tail. Syntax only: whether the step exists and whether the evidence is reachable are compile-time checks, not schema checks."
+                },
+                {
+                  "type": "string",
+                  "pattern": "^@(?:\\/(?:[^/~]|~[01])*)+$",
+                  "description": "AD-26 bound-element pointer: \"@/\" plus an RFC 6901 tail, addressing the element a quantifier binds. Bare \"@/\" addresses the element itself. That it appears only inside a quantifier is a compile-time check, not a schema check."
+                }
+              ]
+            }
+          },
+          "required": [
+            "pointer"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "literal": {
+              "$ref": "#/$defs/JsonValue"
+            }
+          },
+          "required": [
+            "literal"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "referenceSet": {
+              "type": "string",
+              "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+              "description": "A plain identifier. Deliberately not an enum of the contract's declared reference sets and deliberately not refined against them: an identifier the contract does not declare is `unresolved-reference-set`, a coded compile-time error, and a schema that rejected it would convert that code into an anonymous parse fault."
+            }
+          },
+          "required": [
+            "referenceSet"
+          ],
+          "additionalProperties": false
+        }
+      ],
+      "description": "One of the three operand forms, each a single-keyed object. Named so the published schema carries it once as a shared definition rather than inlining it at seventeen use sites. Which forms are legal in which position is declared on each operator's own `operands`, never narrowed here."
+    },
+    "JsonValue": {
+      "description": "AD-36 value domain. Every number is a finite IEEE 754 double-precision value, and every integer lies in the safe-integer range; a larger integer, and any value needing exact decimal semantics such as money, is carried as a string in its own declared format. JSON Schema cannot express finiteness, so this restriction is stated rather than encoded: producers are told the rule here instead of discovering it through a digest mismatch, and the canonical scanner rejects a violating value before any parse.",
+      "anyOf": [
+        {
+          "type": "string"
+        },
+        {
+          "type": "number"
+        },
+        {
+          "type": "boolean"
+        },
+        {
+          "type": "null"
+        },
+        {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/JsonValue"
+          }
+        },
+        {
+          "type": "object",
+          "propertyNames": {
+            "type": "string"
+          },
+          "additionalProperties": {
+            "$ref": "#/$defs/JsonValue"
+          }
+        }
+      ]
+    },
+    "RubricBody": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string",
+          "pattern": "^R-[0-9]{3,}$"
+        },
+        "scaleLevels": {
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "level": {
+                    "type": "integer",
+                    "minimum": -9007199254740991,
+                    "maximum": 9007199254740991,
+                    "description": "The ordinal this level sits at. A repeated ordinal is the one half the compiler closes, failing under `rubric-unanchored`, since two levels at one ordinal make the ordinal address two anchors. Magnitude, sign, ordering, and contiguity stay free everywhere, because a scale running -2 to 2 or 1, 3, 5 is an ordinary authoring choice."
+                  },
+                  "anchor": {
+                    "type": "string",
+                    "description": "The observable condition that anchors this level. AD-22 calls an unanchored scale a compile-time failure under `rubric-unanchored`, so the anchor is a declared field rather than a convention."
+                  }
+                },
+                "required": [
+                  "level",
+                  "anchor"
+                ],
+                "additionalProperties": false
+              }
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "`null` and `[]` are both the unanchored shape `rubric-unanchored` fires on, and both must parse."
+        },
+        "failureModePenalties": {
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "description": {
+                    "type": "string",
+                    "description": "AD-22 requires named failure-mode penalties and states no magnitude. None is invented here: a penalty weight would be a scoring semantic no module below `score` has authority to mint, and AD-7 keeps weighted composites out of the reported result. AD-22's compile checks ship without one, so a penalty carries a name and a description and nothing else."
+                  }
+                },
+                "required": [
+                  "name",
+                  "description"
+                ],
+                "additionalProperties": false
+              }
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Missing named penalties is `rubric-unanchored`, not a parse failure."
+        },
+        "maxLength": {
+          "anyOf": [
+            {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 9007199254740991
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "An unbounded length is `null`, which is one of the shapes `rubric-unanchored` fires on."
+        },
+        "criteria": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "id": {
+                "type": "string",
+                "pattern": "^RC-[0-9]{3,}$"
+              },
+              "text": {
+                "type": "string",
+                "description": "A criterion whose wording matches the compiler's closed stated-reasoning vocabulary fails compilation under `rubric-scores-reasoning-prose`, so such a criterion must stay representable here. A blank text parses for the same reason and fails under `rubric-unanchored`."
+              },
+              "evidence": {
+                "type": "string",
+                "pattern": "^\\/interactions\\/[a-z0-9]+(?:-[a-z0-9]+)*\\/(?:(?:response-body|response-headers|stdout|stderr)(?:\\/(?:[^/~]|~[01])*)*|(?:response-status|exit-code)|call-inputs\\/(?:path|query|header|body|argument|option|environment|stdin)(?:\\/(?:[^/~]|~[01])*)*|artifact\\/[a-z0-9]+(?:-[a-z0-9]+)*(?:\\/(?:[^/~]|~[01])*)*)$",
+                "description": "Where the criterion is answerable from. A pointer that resolves nowhere is `rubric-evidence-unreachable`, a compile-time code, and is deliberately not a schema rejection."
+              }
+            },
+            "required": [
+              "id",
+              "text",
+              "evidence"
+            ],
+            "additionalProperties": false
+          }
+        }
+      },
+      "required": [
+        "id",
+        "scaleLevels",
+        "failureModePenalties",
+        "maxLength",
+        "criteria"
+      ],
+      "additionalProperties": false,
+      "description": "The embeddable rubric body. Named so the shared body has a stable `$defs` key distinct from the published `Rubric` artifact, which is this body plus `schemaVersion` and AD-29 lineage; without the name the two collide in the published-schema drift check under a generated positional name."
+    },
+    "Operation": {
+      "type": "object",
+      "properties": {
+        "operationId": {
+          "type": "string",
+          "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+          "description": "A kebab-case slug. Excludes \"/\" and \"~\" so an identifier can be embedded in an interaction-rooted pointer without escaping."
+        },
+        "method": {
+          "type": "string",
+          "enum": [
+            "GET",
+            "HEAD",
+            "POST",
+            "PUT",
+            "PATCH",
+            "DELETE",
+            "OPTIONS"
+          ]
+        },
+        "pathTemplate": {
+          "type": "string",
+          "pattern": "^(?:\\/(?:[^/{}:]|\\{[A-Za-z0-9_-]+\\})*)+$",
+          "description": "A path template whose parameters are spelled `{name}` in braces. The `:name` spelling is rejected: AD-40 resolves a defect signature by comparing method and path template, and that comparison is not implementable against an unstated syntax."
+        },
+        "stateChangeMarker": {
+          "type": "boolean",
+          "description": "AD-19: whether the operation is intended to change state. AD-20 rule 7 relevance reads it, and AD-10 selects the sensitivity channel by it. Both values are legal and neither is a default."
+        },
+        "requestShape": {
+          "type": "object",
+          "properties": {
+            "path": {
+              "type": "object",
+              "properties": {
+                "requiredKeys": {
+                  "type": "array",
+                  "items": {
+                    "type": "string",
+                    "minLength": 1
+                  }
+                },
+                "permittedKeys": {
+                  "type": "array",
+                  "items": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "description": "The closed set of keys the shape admits. Deliberately not refined to be a superset of `requiredKeys`: no AD-5 code names that contradiction, so it joins the cross-field rules left to the compiler in v0. There is no spelling for \"these keys are required and extras are unconstrained\" \u2014 AD-4 calls the descriptor closed, so an open mode would be a different grammar."
+                },
+                "types": {
+                  "type": "object",
+                  "propertyNames": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "additionalProperties": {
+                    "anyOf": [
+                      {
+                        "type": "string",
+                        "enum": [
+                          "string",
+                          "number",
+                          "boolean",
+                          "object",
+                          "array",
+                          "null"
+                        ]
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ]
+                  },
+                  "description": "Caller-keyed by plain key name, never by pointer: the descriptor-relative pointer spelling does not apply to these keys and must not be extended to them by analogy. A missing key means \"not declared\"; an explicit `null` value means \"declared, type not stated\"."
+                }
+              },
+              "required": [
+                "requiredKeys",
+                "permittedKeys",
+                "types"
+              ],
+              "additionalProperties": false
+            },
+            "query": {
+              "type": "object",
+              "properties": {
+                "requiredKeys": {
+                  "type": "array",
+                  "items": {
+                    "type": "string",
+                    "minLength": 1
+                  }
+                },
+                "permittedKeys": {
+                  "type": "array",
+                  "items": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "description": "The closed set of keys the shape admits. Deliberately not refined to be a superset of `requiredKeys`: no AD-5 code names that contradiction, so it joins the cross-field rules left to the compiler in v0. There is no spelling for \"these keys are required and extras are unconstrained\" \u2014 AD-4 calls the descriptor closed, so an open mode would be a different grammar."
+                },
+                "types": {
+                  "type": "object",
+                  "propertyNames": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "additionalProperties": {
+                    "anyOf": [
+                      {
+                        "type": "string",
+                        "enum": [
+                          "string",
+                          "number",
+                          "boolean",
+                          "object",
+                          "array",
+                          "null"
+                        ]
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ]
+                  },
+                  "description": "Caller-keyed by plain key name, never by pointer: the descriptor-relative pointer spelling does not apply to these keys and must not be extended to them by analogy. A missing key means \"not declared\"; an explicit `null` value means \"declared, type not stated\"."
+                }
+              },
+              "required": [
+                "requiredKeys",
+                "permittedKeys",
+                "types"
+              ],
+              "additionalProperties": false
+            },
+            "header": {
+              "type": "object",
+              "properties": {
+                "requiredKeys": {
+                  "type": "array",
+                  "items": {
+                    "type": "string",
+                    "minLength": 1
+                  }
+                },
+                "permittedKeys": {
+                  "type": "array",
+                  "items": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "description": "The closed set of keys the shape admits. Deliberately not refined to be a superset of `requiredKeys`: no AD-5 code names that contradiction, so it joins the cross-field rules left to the compiler in v0. There is no spelling for \"these keys are required and extras are unconstrained\" \u2014 AD-4 calls the descriptor closed, so an open mode would be a different grammar."
+                },
+                "types": {
+                  "type": "object",
+                  "propertyNames": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "additionalProperties": {
+                    "anyOf": [
+                      {
+                        "type": "string",
+                        "enum": [
+                          "string",
+                          "number",
+                          "boolean",
+                          "object",
+                          "array",
+                          "null"
+                        ]
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ]
+                  },
+                  "description": "Caller-keyed by plain key name, never by pointer: the descriptor-relative pointer spelling does not apply to these keys and must not be extended to them by analogy. A missing key means \"not declared\"; an explicit `null` value means \"declared, type not stated\"."
+                }
+              },
+              "required": [
+                "requiredKeys",
+                "permittedKeys",
+                "types"
+              ],
+              "additionalProperties": false,
+              "description": "AD-18: a header channel declaration names a header and its type and never carries a credential value."
             },
-            "descriptor": {
+            "body": {
               "type": "object",
               "properties": {
                 "requiredKeys": {
@@ -1650,373 +2595,390 @@
                 "permittedKeys",
                 "types"
               ],
-              "additionalProperties": false,
-              "description": "AD-4: a closed descriptor, never an embedded JSON Schema. Typing it as a named field is what makes that structural, and it is a deliberate divergence from the Gate C fixture's `{ \"literal\": { \u2026 } }` spelling, where any JSON could sit."
+              "additionalProperties": false
             }
           },
           "required": [
-            "op",
-            "operands",
-            "descriptor"
+            "path",
+            "query",
+            "header",
+            "body"
           ],
           "additionalProperties": false
         },
-        {
+        "responseDescriptor": {
           "type": "object",
           "properties": {
-            "op": {
-              "type": "string",
-              "const": "covers-by-key"
+            "requiredKeys": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "minLength": 1
+              },
+              "description": "No minimum of two anywhere in this shape: AD-20 rule 2 relevance is \"the descriptor declares more than one pointer\", so a one-pointer descriptor must parse in order to be the irrelevant case."
             },
-            "operands": {
+            "permittedKeys": {
               "type": "array",
-              "prefixItems": [
+              "items": {
+                "type": "string",
+                "minLength": 1
+              }
+            },
+            "types": {
+              "type": "object",
+              "propertyNames": {
+                "type": "string",
+                "minLength": 1
+              },
+              "additionalProperties": {
+                "anyOf": [
+                  {
+                    "type": "string",
+                    "enum": [
+                      "string",
+                      "number",
+                      "boolean",
+                      "object",
+                      "array",
+                      "null"
+                    ]
+                  },
+                  {
+                    "type": "null"
+                  }
+                ]
+              },
+              "description": "Caller-keyed by plain key name, never by pointer: this is the shape where that trap bites, since `requiredKeys` sits beside a pointer-keyed `channelRoles` and a pointer-valued `successIndicator`, and the descriptor-relative spelling must not be extended here by analogy. A missing key means \"not declared\"; an explicit `null` value means \"declared, type not stated\", which is AD-31's enumerated indeterminate descriptor state and the shape `quantifier-over-non-collection` reads."
+            },
+            "successIndicator": {
+              "anyOf": [
                 {
-                  "$ref": "#/$defs/Operand"
+                  "type": "string",
+                  "pattern": "^(?:\\/(?:[^/~]|~[01])*)*$",
+                  "description": "A plain RFC 6901 pointer into one operation's response descriptor. It resolves through the operation an interaction step names, never through the interaction root. A request or response shape's descriptor keys are plain key names rather than pointers, so this spelling does not apply there. The empty string is admitted and carries RFC 6901's own meaning, the whole document: as a nominated success indicator it says success is visible in the response taken as a whole rather than at any one key, and as a channel-role key it assigns a role to the whole body."
                 },
                 {
-                  "$ref": "#/$defs/Operand"
+                  "type": "null"
                 }
               ],
-              "description": "Two operands: `expected` is legally a reference set, and `actual` is legally a pointer to a collection. Every position admits the full operand union on purpose. AD-26 makes a reference-set operand outside its three legal positions \u2014 `covers-by-key`'s expected operand, and the set operand of `set-membership` or `containment` \u2014 fail compilation under `malformed-operator-expression`, which only stays fireable if the other positions admit it. Compilation enforces the legality stated here; the schema does not narrow it.",
-              "minItems": 2,
-              "items": false
-            },
-            "expectedKey": {
-              "type": "string",
-              "minLength": 1
-            },
-            "actualKey": {
-              "type": "string",
-              "minLength": 1
-            }
-          },
-          "required": [
-            "op",
-            "operands",
-            "expectedKey",
-            "actualKey"
-          ],
-          "additionalProperties": false
-        },
-        {
-          "type": "object",
-          "properties": {
-            "op": {
-              "type": "string",
-              "const": "not"
+              "description": "AD-20 rule 1 relevance reads this as its first conjunct, so `null` must stay representable."
             },
-            "operands": {
-              "type": "array",
-              "prefixItems": [
+            "channelRoles": {
+              "anyOf": [
                 {
-                  "$ref": "#/$defs/Expression"
+                  "type": "object",
+                  "propertyNames": {
+                    "type": "string",
+                    "pattern": "^(?:\\/(?:[^/~]|~[01])*)*$",
+                    "description": "A plain RFC 6901 pointer into one operation's response descriptor. It resolves through the operation an interaction step names, never through the interaction root. A request or response shape's descriptor keys are plain key names rather than pointers, so this spelling does not apply there. The empty string is admitted and carries RFC 6901's own meaning, the whole document: as a nominated success indicator it says success is visible in the response taken as a whole rather than at any one key, and as a channel-role key it assigns a role to the whole body."
+                  },
+                  "additionalProperties": {
+                    "type": "string",
+                    "enum": [
+                      "success-indicator",
+                      "diagnostic",
+                      "payload",
+                      "collection"
+                    ]
+                  }
+                },
+                {
+                  "type": "null"
                 }
               ],
-              "description": "One nested expression rather than an operand. A connective composes the tree; it never addresses evidence itself.",
-              "minItems": 1,
-              "items": false
-            }
-          },
-          "required": [
-            "op",
-            "operands"
-          ],
-          "additionalProperties": false
-        },
-        {
-          "type": "object",
-          "properties": {
-            "op": {
-              "type": "string",
-              "const": "all"
-            },
-            "operands": {
-              "minItems": 2,
-              "type": "array",
-              "items": {
-                "$ref": "#/$defs/Expression"
-              },
-              "description": "Two or more nested expressions rather than operands. The minimum is settled here because AD-4 leaves connective arity unstated: zero operands would certify vacuously and one is the identity."
-            }
-          },
-          "required": [
-            "op",
-            "operands"
-          ],
-          "additionalProperties": false
-        },
-        {
-          "type": "object",
-          "properties": {
-            "op": {
-              "type": "string",
-              "const": "any"
-            },
-            "operands": {
-              "minItems": 2,
-              "type": "array",
-              "items": {
-                "$ref": "#/$defs/Expression"
-              },
-              "description": "Two or more nested expressions rather than operands, for the same reason `all` carries the same minimum."
-            }
-          },
-          "required": [
-            "op",
-            "operands"
-          ],
-          "additionalProperties": false
-        },
-        {
-          "type": "object",
-          "properties": {
-            "op": {
-              "type": "string",
-              "const": "for-all"
-            },
-            "collection": {
-              "$ref": "#/$defs/Operand"
+              "description": "Caller-keyed, and expected to be partial: a missing key means \"no role declared for that pointer\". AD-31 grades absent and explicitly empty differently, so `null`, `{}`, and a populated map are three distinct answers. Deliberately not refined to require a role for every descriptor key: no AD-5 code names that rule, the AD-31 predicates degrade gracefully on partial roles, and a refinement buys nothing an export can carry."
             },
-            "predicate": {
-              "$ref": "#/$defs/Expression"
-            }
-          },
-          "required": [
-            "op",
-            "collection",
-            "predicate"
-          ],
-          "additionalProperties": false,
-          "description": "`collection` is legally a pointer to a collection, and `predicate` is the expression each bound element is tested against, addressed by the `@/` pointer spelling. A quantifier inside the predicate is structurally admitted so `quantifier-nesting-exceeded` keeps a shape to fire on. Every position admits the full operand union on purpose. AD-26 makes a reference-set operand outside its three legal positions \u2014 `covers-by-key`'s expected operand, and the set operand of `set-membership` or `containment` \u2014 fail compilation under `malformed-operator-expression`, which only stays fireable if the other positions admit it. Compilation enforces the legality stated here; the schema does not narrow it."
-        },
-        {
-          "type": "object",
-          "properties": {
-            "op": {
-              "type": "string",
-              "const": "for-any"
-            },
-            "collection": {
-              "$ref": "#/$defs/Operand"
-            },
-            "predicate": {
-              "$ref": "#/$defs/Expression"
-            }
-          },
-          "required": [
-            "op",
-            "collection",
-            "predicate"
-          ],
-          "additionalProperties": false,
-          "description": "`collection` is legally a pointer to a collection, and `predicate` is the expression each bound element is tested against, addressed by the `@/` pointer spelling. Every position admits the full operand union on purpose. AD-26 makes a reference-set operand outside its three legal positions \u2014 `covers-by-key`'s expected operand, and the set operand of `set-membership` or `containment` \u2014 fail compilation under `malformed-operator-expression`, which only stays fireable if the other positions admit it. Compilation enforces the legality stated here; the schema does not narrow it."
-        }
-      ]
-    },
-    "Operand": {
-      "anyOf": [
-        {
-          "type": "object",
-          "properties": {
-            "pointer": {
+            "collectionLocations": {
               "anyOf": [
                 {
-                  "type": "string",
-                  "pattern": "^\\/interactions\\/[a-z0-9]+(?:-[a-z0-9]+)*\\/(?:(?:response-body|response-headers|stdout|stderr)(?:\\/(?:[^/~]|~[01])*)*|(?:response-status|exit-code)|call-inputs\\/(?:path|query|header|body)(?:\\/(?:[^/~]|~[01])*)*)$",
-                  "description": "AD-26 interaction-rooted pointer: \"/interactions/{stepId}/\" followed by one channel of the closed vocabulary. `call-inputs` takes one of the four transport channels as its next segment; `response-status` and `exit-code` take no tail. Syntax only: whether the step exists and whether the evidence is reachable are compile-time checks, not schema checks."
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "pointer": {
+                        "type": "string",
+                        "pattern": "^(?:\\/(?:[^/~]|~[01])*)*$",
+                        "description": "A plain RFC 6901 pointer into one operation's response descriptor. It resolves through the operation an interaction step names, never through the interaction root. A request or response shape's descriptor keys are plain key names rather than pointers, so this spelling does not apply there. The empty string is admitted and carries RFC 6901's own meaning, the whole document: as a nominated success indicator it says success is visible in the response taken as a whole rather than at any one key, and as a channel-role key it assigns a role to the whole body."
+                      },
+                      "expectedCardinality": {
+                        "oneOf": [
+                          {
+                            "type": "object",
+                            "properties": {
+                              "mode": {
+                                "type": "string",
+                                "const": "exact"
+                              },
+                              "count": {
+                                "type": "integer",
+                                "minimum": 0,
+                                "maximum": 9007199254740991
+                              }
+                            },
+                            "required": [
+                              "mode",
+                              "count"
+                            ],
+                            "additionalProperties": false
+                          },
+                          {
+                            "type": "object",
+                            "properties": {
+                              "mode": {
+                                "type": "string",
+                                "const": "at-most"
+                              },
+                              "max": {
+                                "type": "integer",
+                                "minimum": 0,
+                                "maximum": 9007199254740991
+                              }
+                            },
+                            "required": [
+                              "mode",
+                              "max"
+                            ],
+                            "additionalProperties": false
+                          },
+                          {
+                            "type": "object",
+                            "properties": {
+                              "mode": {
+                                "type": "string",
+                                "const": "page-bounded"
+                              },
+                              "max": {
+                                "type": "integer",
+                                "minimum": 0,
+                                "maximum": 9007199254740991
+                              }
+                            },
+                            "required": [
+                              "mode",
+                              "max"
+                            ],
+                            "additionalProperties": false
+                          }
+                        ]
+                      },
+                      "referenceSet": {
+                        "anyOf": [
+                          {
+                            "type": "string",
+                            "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+                            "description": "A kebab-case slug. Excludes \"/\" and \"~\" so an identifier can be embedded in an interaction-rooted pointer without escaping."
+                          },
+                          {
+                            "type": "null"
+                          }
+                        ],
+                        "description": "AD-20 rule 6 is relevant when a declared collection location names a reference set, so `null` is the shape that makes the rule irrelevant and must stay representable."
+                      }
+                    },
+                    "required": [
+                      "pointer",
+                      "expectedCardinality",
+                      "referenceSet"
+                    ],
+                    "additionalProperties": false
+                  }
                 },
                 {
-                  "type": "string",
-                  "pattern": "^@(?:\\/(?:[^/~]|~[01])*)+$",
-                  "description": "AD-26 bound-element pointer: \"@/\" plus an RFC 6901 tail, addressing the element a quantifier binds. Bare \"@/\" addresses the element itself. That it appears only inside a quantifier is a compile-time check, not a schema check."
+                  "type": "null"
                 }
-              ]
-            }
-          },
-          "required": [
-            "pointer"
-          ],
-          "additionalProperties": false
-        },
-        {
-          "type": "object",
-          "properties": {
-            "literal": {
-              "$ref": "#/$defs/JsonValue"
-            }
-          },
-          "required": [
-            "literal"
-          ],
-          "additionalProperties": false
-        },
-        {
-          "type": "object",
-          "properties": {
-            "referenceSet": {
-              "type": "string",
-              "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
-              "description": "A plain identifier. Deliberately not an enum of the contract's declared reference sets and deliberately not refined against them: an identifier the contract does not declare is `unresolved-reference-set`, a coded compile-time error, and a schema that rejected it would convert that code into an anonymous parse fault."
+              ],
+              "description": "AD-20 rule 4 relevance reads this, and AD-31 grades an absent declaration and an explicit empty one differently, so `null` and `[]` are distinct answers."
             }
           },
           "required": [
-            "referenceSet"
+            "requiredKeys",
+            "permittedKeys",
+            "types",
+            "successIndicator",
+            "channelRoles",
+            "collectionLocations"
           ],
           "additionalProperties": false
-        }
-      ],
-      "description": "One of the three operand forms, each a single-keyed object. Named so the published schema carries it once as a shared definition rather than inlining it at seventeen use sites. Which forms are legal in which position is declared on each operator's own `operands`, never narrowed here."
-    },
-    "JsonValue": {
-      "description": "AD-36 value domain. Every number is a finite IEEE 754 double-precision value, and every integer lies in the safe-integer range; a larger integer, and any value needing exact decimal semantics such as money, is carried as a string in its own declared format. JSON Schema cannot express finiteness, so this restriction is stated rather than encoded: producers are told the rule here instead of discovering it through a digest mismatch, and the canonical scanner rejects a violating value before any parse.",
-      "anyOf": [
-        {
-          "type": "string"
-        },
-        {
-          "type": "number"
-        },
-        {
-          "type": "boolean"
         },
-        {
-          "type": "null"
-        },
-        {
+        "volatilePointers": {
           "type": "array",
           "items": {
-            "$ref": "#/$defs/JsonValue"
-          }
-        },
-        {
-          "type": "object",
-          "propertyNames": {
-            "type": "string"
-          },
-          "additionalProperties": {
-            "$ref": "#/$defs/JsonValue"
+            "type": "string",
+            "pattern": "^(?:\\/(?:[^/~]|~[01])*)*$",
+            "description": "A plain RFC 6901 pointer into one operation's response descriptor. It resolves through the operation an interaction step names, never through the interaction root. A request or response shape's descriptor keys are plain key names rather than pointers, so this spelling does not apply there. The empty string is admitted and carries RFC 6901's own meaning, the whole document: as a nominated success indicator it says success is visible in the response taken as a whole rather than at any one key, and as a channel-role key it assigns a role to the whole body."
           }
-        }
-      ]
-    },
-    "RubricBody": {
-      "type": "object",
-      "properties": {
-        "id": {
-          "type": "string",
-          "pattern": "^R-[0-9]{3,}$"
         },
-        "scaleLevels": {
+        "sensitivityWitness": {
           "anyOf": [
             {
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "level": {
-                    "type": "integer",
-                    "minimum": -9007199254740991,
-                    "maximum": 9007199254740991,
-                    "description": "The ordinal this level sits at. A repeated ordinal is the one half the compiler closes, failing under `rubric-unanchored`, since two levels at one ordinal make the ordinal address two anchors. Magnitude, sign, ordering, and contiguity stay free everywhere, because a scale running -2 to 2 or 1, 3, 5 is an ordinary authoring choice."
-                  },
-                  "anchor": {
-                    "type": "string",
-                    "description": "The observable condition that anchors this level. AD-22 calls an unanchored scale a compile-time failure under `rubric-unanchored`, so the anchor is a declared field rather than a convention."
-                  }
+              "type": "object",
+              "properties": {
+                "witnessId": {
+                  "type": "string",
+                  "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+                  "description": "A kebab-case slug. Excludes \"/\" and \"~\" so an identifier can be embedded in an interaction-rooted pointer without escaping."
                 },
-                "required": [
-                  "level",
-                  "anchor"
-                ],
-                "additionalProperties": false
-              }
-            },
-            {
-              "type": "null"
-            }
-          ],
-          "description": "`null` and `[]` are both the unanchored shape `rubric-unanchored` fires on, and both must parse."
-        },
-        "failureModePenalties": {
-          "anyOf": [
-            {
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string",
-                    "minLength": 1
-                  },
-                  "description": {
-                    "type": "string",
-                    "description": "AD-22 requires named failure-mode penalties and states no magnitude. None is invented here: a penalty weight would be a scoring semantic no module below `score` has authority to mint, and AD-7 keeps weighted composites out of the reported result. AD-22's compile checks ship without one, so a penalty carries a name and a description and nothing else."
+                "channel": {
+                  "type": "string",
+                  "enum": [
+                    "path",
+                    "query",
+                    "body",
+                    "argument",
+                    "option",
+                    "environment",
+                    "stdin"
+                  ]
+                },
+                "legs": {
+                  "minItems": 2,
+                  "maxItems": 2,
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "legId": {
+                        "type": "string",
+                        "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+                        "description": "A kebab-case slug. Excludes \"/\" and \"~\" so an identifier can be embedded in an interaction-rooted pointer without escaping."
+                      },
+                      "inputs": {
+                        "anyOf": [
+                          {
+                            "$ref": "#/$defs/WitnessInputs"
+                          },
+                          {
+                            "type": "object",
+                            "properties": {
+                              "argument": {
+                                "type": "object",
+                                "propertyNames": {
+                                  "type": "string"
+                                },
+                                "additionalProperties": {
+                                  "$ref": "#/$defs/JsonValue"
+                                }
+                              },
+                              "option": {
+                                "type": "object",
+                                "propertyNames": {
+                                  "type": "string"
+                                },
+                                "additionalProperties": {
+                                  "$ref": "#/$defs/JsonValue"
+                                }
+                              },
+                              "environment": {
+                                "type": "object",
+                                "propertyNames": {
+                                  "type": "string",
+                                  "minLength": 1
+                                },
+                                "additionalProperties": {
+                                  "type": "string"
+                                }
+                              },
+                              "stdin": {
+                                "oneOf": [
+                                  {
+                                    "type": "object",
+                                    "properties": {
+                                      "kind": {
+                                        "type": "string",
+                                        "const": "json"
+                                      },
+                                      "value": {
+                                        "$ref": "#/$defs/JsonValue"
+                                      }
+                                    },
+                                    "required": [
+                                      "kind",
+                                      "value"
+                                    ],
+                                    "additionalProperties": false
+                                  },
+                                  {
+                                    "type": "object",
+                                    "properties": {
+                                      "kind": {
+                                        "type": "string",
+                                        "const": "text"
+                                      },
+                                      "value": {
+                                        "type": "string"
+                                      }
+                                    },
+                                    "required": [
+                                      "kind",
+                                      "value"
+                                    ],
+                                    "additionalProperties": false
+                                  },
+                                  {
+                                    "type": "object",
+                                    "properties": {
+                                      "kind": {
+                                        "type": "string",
+                                        "const": "absent"
+                                      }
+                                    },
+                                    "required": [
+                                      "kind"
+                                    ],
+                                    "additionalProperties": false
+                                  }
+                                ]
+                              }
+                            },
+                            "required": [
+                              "argument",
+                              "option",
+                              "environment",
+                              "stdin"
+                            ],
+                            "additionalProperties": false
+                          }
+                        ]
+                      }
+                    },
+                    "required": [
+                      "legId",
+                      "inputs"
+                    ],
+                    "additionalProperties": false
                   }
                 },
-                "required": [
-                  "name",
-                  "description"
-                ],
-                "additionalProperties": false
-              }
-            },
-            {
-              "type": "null"
-            }
-          ],
-          "description": "Missing named penalties is `rubric-unanchored`, not a parse failure."
-        },
-        "maxLength": {
-          "anyOf": [
-            {
-              "type": "integer",
-              "minimum": 1,
-              "maximum": 9007199254740991
+                "relation": {
+                  "$ref": "#/$defs/Expression"
+                }
+              },
+              "required": [
+                "witnessId",
+                "channel",
+                "legs",
+                "relation"
+              ],
+              "additionalProperties": false
             },
             {
               "type": "null"
             }
           ],
-          "description": "An unbounded length is `null`, which is one of the shapes `rubric-unanchored` fires on."
-        },
-        "criteria": {
-          "type": "array",
-          "items": {
-            "type": "object",
-            "properties": {
-              "id": {
-                "type": "string",
-                "pattern": "^RC-[0-9]{3,}$"
-              },
-              "text": {
-                "type": "string",
-                "description": "A criterion whose wording matches the compiler's closed stated-reasoning vocabulary fails compilation under `rubric-scores-reasoning-prose`, so such a criterion must stay representable here. A blank text parses for the same reason and fails under `rubric-unanchored`."
-              },
-              "evidence": {
-                "type": "string",
-                "pattern": "^\\/interactions\\/[a-z0-9]+(?:-[a-z0-9]+)*\\/(?:(?:response-body|response-headers|stdout|stderr)(?:\\/(?:[^/~]|~[01])*)*|(?:response-status|exit-code)|call-inputs\\/(?:path|query|header|body)(?:\\/(?:[^/~]|~[01])*)*)$",
-                "description": "Where the criterion is answerable from. A pointer that resolves nowhere is `rubric-evidence-unreachable`, a compile-time code, and is deliberately not a schema rejection."
-              }
-            },
-            "required": [
-              "id",
-              "text",
-              "evidence"
-            ],
-            "additionalProperties": false
-          }
+          "description": "AD-10, mandatory per declared operation rather than per interface. `null` is legal only for an operation declaring no keys in any request channel; AD-10 exempts that operation and requires the exemption to be recorded, which pre-flight does as an `exempt` check. An input-bearing operation declaring `null` fails a strict compilation under `undeclared-mandatory-input`, alongside the other declaration-completeness check that code already gates."
         }
       },
       "required": [
-        "id",
-        "scaleLevels",
-        "failureModePenalties",
-        "maxLength",
-        "criteria"
+        "operationId",
+        "method",
+        "pathTemplate",
+        "stateChangeMarker",
+        "requestShape",
+        "responseDescriptor",
+        "volatilePointers",
+        "sensitivityWitness"
       ],
       "additionalProperties": false,
-      "description": "The embeddable rubric body. Named so the shared body has a stable `$defs` key distinct from the published `Rubric` artifact, which is this body plus `schemaVersion` and AD-29 lineage; without the name the two collide in the published-schema drift check under a generated positional name."
+      "description": "AD-19's per-operation declaration inventory for an interface that speaks HTTP. Carried by the `api`, `web`, and `mcp` branches alike, so the export names it once instead of inlining three copies that could drift apart."
     },
     "WitnessInputs": {
       "type": "object",
@@ -2130,6 +3092,34 @@
                   "matcher"
                 ],
                 "additionalProperties": false
+              },
+              {
+                "type": "object",
+                "properties": {
+                  "captured": {
+                    "type": "string",
+                    "pattern": "^\\/interactions\\/[a-z0-9]+(?:-[a-z0-9]+)*\\/(?:(?:response-body|response-headers|stdout|stderr)(?:\\/(?:[^/~]|~[01])*)*|(?:response-status|exit-code)|call-inputs\\/(?:path|query|header|body|argument|option|environment|stdin)(?:\\/(?:[^/~]|~[01])*)*|artifact\\/[a-z0-9]+(?:-[a-z0-9]+)*(?:\\/(?:[^/~]|~[01])*)*)$",
+                    "description": "AD-26 interaction-rooted pointer: \"/interactions/{stepId}/\" followed by one channel of the closed vocabulary. `call-inputs` takes one input channel as its next segment, one of the four transport channels or one of the four command channels; `artifact` takes the identifier of a file the operation declares it writes; `response-status` and `exit-code` take no tail. Syntax only: whether the step exists and whether the evidence is reachable are compile-time checks, not schema checks."
+                  }
+                },
+                "required": [
+                  "captured"
+                ],
+                "additionalProperties": false
+              },
+              {
+                "type": "object",
+                "properties": {
+                  "principal": {
+                    "type": "string",
+                    "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+                    "description": "A kebab-case slug. Excludes \"/\" and \"~\" so an identifier can be embedded in an interaction-rooted pointer without escaping."
+                  }
+                },
+                "required": [
+                  "principal"
+                ],
+                "additionalProperties": false
               }
             ]
           }