eval-quality 0.1.0 → 0.3.0

package/dist/core/compile/bindings.d.ts

@@ -0,0 +1,89 @@
+import type { EvalContract } from '../schemas/eval-contract.ts';
+import type { InteractionStep } from '../schemas/plan.ts';
+import type { InputChannelName } from '../schemas/pointer.ts';
+import { type EvidenceTarget } from '../seal/plan-index.ts';
+/**
+ * The one channel a captured pointer may name: whichever channel the
+ * referenced operation's own response descriptor describes.
+ *
+ * `ResponseDescriptor` declares `requiredKeys`, `permittedKeys`, `types`,
+ * `successIndicator`, `channelRoles`, and `collectionLocations`, and every one
+ * of them is about the channel the operation nominates. Off an interface that
+ * speaks HTTP that is the response body; off a command it is the stream the
+ * operation names. `response-headers` and `response-status` are never it,
+ * because `Observation.responseHeaders` admits objects, arrays, numbers, and
+ * `null`, so a header capture compiled as a `string` could resolve to an
+ * object at score time.
+ */
+/** One `{ captured }` binding, resolved to the pointer target it addresses. */
+export type CapturedBinding = {
+    readonly transportChannel: InputChannelName;
+    readonly key: string;
+    readonly pointer: string;
+    readonly target: EvidenceTarget;
+};
+/**
+ * Every captured binding one step declares, in fixed transport-channel order
+ * then by key name, so which binding a check reports never depends on a
+ * caller-keyed map's insertion order. Exported because `score/binding-order.ts`
+ * and `score/bindings.ts` need the same reading of which bindings are captures.
+ */
+export declare function capturedBindings(step: InteractionStep): readonly CapturedBinding[];
+/**
+ * `binding-cycle`: a cycle over the union of the capture edges and AD-39's
+ * `after` edges that contains at least one capture edge.
+ *
+ * Both edge kinds assert that this step's observation comes after that one, so
+ * a capture B to A together with `A.after = B` is an unsatisfiable ordering
+ * while each graph alone stays acyclic. A cycle made only of `after` edges is
+ * left to `checkNestedTemporalClause`, which already catches every one of them,
+ * so requiring a capture edge in the cycle keeps the two codes disjoint.
+ *
+ * Decided by strongly connected components rather than by a depth-first walk
+ * that inspects each back edge. A cycle lies entirely inside one component, and
+ * a capture edge whose endpoints share a component is closed by a path back
+ * through that component, so "some cycle contains a capture edge" is exactly
+ * "some capture edge has both endpoints in one component". A self-capture is
+ * the singleton case and needs no rule of its own. The depth-first form was
+ * written first and rejected: settling a node after rejecting a pure-`after`
+ * back edge can hide a mixed cycle a later root would reach, and whether it
+ * does depends on the order edges happen to be enumerated in, which is an
+ * invariant nothing states.
+ *
+ * Nodes are the plan's declared step ids; an edge whose target no step declares
+ * is dropped, since a dangling reference is not a cycle and AD-39 makes a
+ * dangling `after` permissive besides. The binding reported is the first, in
+ * the plan's own declaration order, whose endpoints share a component.
+ */
+export declare function checkBindingCycle(contract: EvalContract): void;
+/**
+ * `captured-channel-undeclared`: a captured pointer naming any AD-26 channel
+ * but the one the referenced operation's response descriptor describes. That
+ * is `response-body` off an interface that speaks HTTP and whichever channel
+ * `descriptorChannel` nominates off one that runs behind a command, which is
+ * the same rule read against the declaration rather than assumed.
+ *
+ * Every other channel is refused for a reason that does not depend on the
+ * kind: `call-inputs` addresses a step's own request, and `response-headers`,
+ * `response-status`, and `exit-code` have no declared structure to give a
+ * captured value a type. On the `artifact` channel the identifier is compared
+ * too, so a capture from a file the operation writes but does not describe is
+ * refused alongside one from a file it never writes.
+ */
+export declare function checkCapturedChannel(contract: EvalContract): void;
+/**
+ * `unreachable-check-evidence` over the captured-pointer residue: an
+ * unresolvable step or operation, an undeclared body key, a tail that is not
+ * exactly one segment, an array index, an absent, indeterminate, or non-scalar
+ * declared type, and a declared type that does not equal the bound
+ * parameter's.
+ *
+ * A capture naming another channel is reported here only for the two conditions
+ * that are decidable without a response descriptor: an unresolvable step and an
+ * unresolvable operation. Everything else about such a pointer is
+ * `checkCapturedChannel`'s. That split is what lets this check run at the
+ * registry's third rung without shadowing the fifteenth, and it keeps the
+ * higher-ranked code first on a pointer that is unresolvable and off-body at
+ * once.
+ */
+export declare function checkCapturedReachability(contract: EvalContract): void;

package/dist/core/compile/bindings.js

@@ -0,0 +1,334 @@
+/**
+ * Owed item 3's compile-time checks over captured input bindings:
+ * `binding-cycle` over the ordering graph, `captured-channel-undeclared` on a
+ * pointer naming any channel but `response-body`, and the typed residue that
+ * fires the shipped `unreachable-check-evidence`.
+ *
+ * The three run at two registry positions. `checkCapturedReachability` fires
+ * `unreachable-check-evidence`, whose rung is third, so it runs beside
+ * `checkEvidenceReachability`; the two new codes run at their own inserted
+ * position. Running captured reachability late would let a lower-ranked code
+ * win on a contract carrying both defects, which `compile.ts`'s own documented
+ * priority forbids.
+ *
+ * `evaluatePointerReachability` decides the step, operation, body-key, and
+ * scalar-descent half. The scalar determination, the one-segment tail rule, and
+ * type equality are this module's own.
+ */
+import { boundChannelsOf, descriptorChannelOf, requestShapeOf, targetsDescribedChannel, } from '../declared-inputs.js';
+import { ARRAY_INDEX_PATTERN } from '../evaluate/evidence-resolution.js';
+import { StructuralFailure } from '../failure-codes.js';
+import { JsonTypeName } from '../schemas/primitives.js';
+import { anyOperationOf, buildPlanIndex, parseEvidenceTarget, resolveStep, } from '../seal/plan-index.js';
+import { evaluatePointerReachability } from './reachability.js';
+/**
+ * Every captured binding one step declares, in fixed transport-channel order
+ * then by key name, so which binding a check reports never depends on a
+ * caller-keyed map's insertion order. Exported because `score/binding-order.ts`
+ * and `score/bindings.ts` need the same reading of which bindings are captures.
+ */
+export function capturedBindings(step) {
+    const captures = [];
+    for (const { channel: transportChannel, bound: map } of boundChannelsOf(step.inputBinding)) {
+        if (map === null)
+            continue;
+        for (const key of Object.keys(map).sort()) {
+            const value = map[key];
+            if (value === undefined || !('captured' in value))
+                continue;
+            captures.push({
+                transportChannel,
+                key,
+                pointer: value.captured,
+                target: parseEvidenceTarget(value.captured),
+            });
+        }
+    }
+    return captures;
+}
+// The one shipped precedent for addressing a caller-keyed binding entry
+// (`interface-inventory.ts`'s undeclared-key throw), reused so the two new
+// codes and the widened `undeclared-mandatory-input` agree on one spelling.
+function bindingPath(step, capture) {
+    return `EvalContract.interactionPlan[stepId=${step.stepId}].inputBinding.${capture.transportChannel}[${JSON.stringify(capture.key)}]`;
+}
+// ---- binding-cycle -------------------------------------------------------
+/**
+ * `binding-cycle`: a cycle over the union of the capture edges and AD-39's
+ * `after` edges that contains at least one capture edge.
+ *
+ * Both edge kinds assert that this step's observation comes after that one, so
+ * a capture B to A together with `A.after = B` is an unsatisfiable ordering
+ * while each graph alone stays acyclic. A cycle made only of `after` edges is
+ * left to `checkNestedTemporalClause`, which already catches every one of them,
+ * so requiring a capture edge in the cycle keeps the two codes disjoint.
+ *
+ * Decided by strongly connected components rather than by a depth-first walk
+ * that inspects each back edge. A cycle lies entirely inside one component, and
+ * a capture edge whose endpoints share a component is closed by a path back
+ * through that component, so "some cycle contains a capture edge" is exactly
+ * "some capture edge has both endpoints in one component". A self-capture is
+ * the singleton case and needs no rule of its own. The depth-first form was
+ * written first and rejected: settling a node after rejecting a pure-`after`
+ * back edge can hide a mixed cycle a later root would reach, and whether it
+ * does depends on the order edges happen to be enumerated in, which is an
+ * invariant nothing states.
+ *
+ * Nodes are the plan's declared step ids; an edge whose target no step declares
+ * is dropped, since a dangling reference is not a cycle and AD-39 makes a
+ * dangling `after` permissive besides. The binding reported is the first, in
+ * the plan's own declaration order, whose endpoints share a component.
+ */
+export function checkBindingCycle(contract) {
+    const declaredStepIds = new Set(contract.interactionPlan.map((step) => step.stepId));
+    const edgesFrom = new Map();
+    const addEdge = (from, to) => {
+        const list = edgesFrom.get(from);
+        if (list === undefined)
+            edgesFrom.set(from, [to]);
+        else
+            list.push(to);
+    };
+    for (const step of contract.interactionPlan) {
+        for (const capture of capturedBindings(step)) {
+            if (declaredStepIds.has(capture.target.stepId)) {
+                addEdge(step.stepId, capture.target.stepId);
+            }
+        }
+        if (step.after !== null && declaredStepIds.has(step.after)) {
+            addEdge(step.stepId, step.after);
+        }
+    }
+    const component = stronglyConnectedComponents(declaredStepIds, edgesFrom);
+    for (const step of contract.interactionPlan) {
+        for (const capture of capturedBindings(step)) {
+            const target = capture.target.stepId;
+            if (!declaredStepIds.has(target))
+                continue;
+            if (component.get(step.stepId) !== component.get(target))
+                continue;
+            throw new StructuralFailure('binding-cycle', bindingPath(step, capture), `captured pointer "${capture.pointer}" closes a cycle over the capture and temporal-clause edges; a captured value has no earlier step to resolve from (AD-39)`);
+        }
+    }
+}
+/** Tarjan's algorithm, returning each node's component identifier. */
+function stronglyConnectedComponents(nodes, edgesFrom) {
+    const order = new Map();
+    const lowLink = new Map();
+    const onStack = new Set();
+    const stack = [];
+    const component = new Map();
+    let nextOrder = 0;
+    let nextComponent = 0;
+    const connect = (node) => {
+        order.set(node, nextOrder);
+        lowLink.set(node, nextOrder);
+        nextOrder += 1;
+        stack.push(node);
+        onStack.add(node);
+        for (const next of edgesFrom.get(node) ?? []) {
+            if (!order.has(next)) {
+                connect(next);
+                lowLink.set(node, Math.min(lowLink.get(node) ?? 0, lowLink.get(next) ?? 0));
+            }
+            else if (onStack.has(next)) {
+                lowLink.set(node, Math.min(lowLink.get(node) ?? 0, order.get(next) ?? 0));
+            }
+        }
+        if (lowLink.get(node) !== order.get(node))
+            return;
+        const id = nextComponent;
+        nextComponent += 1;
+        for (;;) {
+            const member = stack.pop();
+            if (member === undefined)
+                break;
+            onStack.delete(member);
+            component.set(member, id);
+            if (member === node)
+                break;
+        }
+    };
+    for (const node of nodes) {
+        if (!order.has(node))
+            connect(node);
+    }
+    return component;
+}
+// ---- captured-channel-undeclared -----------------------------------------
+/**
+ * `captured-channel-undeclared`: a captured pointer naming any AD-26 channel
+ * but the one the referenced operation's response descriptor describes. That
+ * is `response-body` off an interface that speaks HTTP and whichever channel
+ * `descriptorChannel` nominates off one that runs behind a command, which is
+ * the same rule read against the declaration rather than assumed.
+ *
+ * Every other channel is refused for a reason that does not depend on the
+ * kind: `call-inputs` addresses a step's own request, and `response-headers`,
+ * `response-status`, and `exit-code` have no declared structure to give a
+ * captured value a type. On the `artifact` channel the identifier is compared
+ * too, so a capture from a file the operation writes but does not describe is
+ * refused alongside one from a file it never writes.
+ */
+export function checkCapturedChannel(contract) {
+    let index;
+    for (const step of contract.interactionPlan) {
+        for (const capture of capturedBindings(step)) {
+            index ??= buildPlanIndex(contract.interactionPlan, contract.permittedInterfaces, { duplicateIds: 'unresolved' });
+            const referenced = index.stepOf(capture.target.stepId);
+            const operation = referenced === undefined
+                ? undefined
+                : anyOperationOf(index, referenced.operationId);
+            // An unresolvable reference is `checkCapturedReachability`'s, at a
+            // higher rung. With nothing to ask, this check falls back to the
+            // api answer so an unresolvable off-body capture still reports.
+            const capturable = operation === undefined
+                ? 'response-body'
+                : descriptorChannelOf(operation);
+            if (operation === undefined
+                ? capture.target.channel === capturable
+                : targetsDescribedChannel(operation, capture.target)) {
+                continue;
+            }
+            throw new StructuralFailure('captured-channel-undeclared', bindingPath(step, capture), `captured pointer "${capture.pointer}" names the ${capture.target.channel} channel, which the referenced operation's response descriptor does not declare (AD-26)`);
+        }
+    }
+}
+// ---- the typed residue: unreachable-check-evidence -----------------------
+const SCALAR_TYPES = new Set(JsonTypeName.options.filter((name) => name !== 'object' && name !== 'array'));
+/**
+ * The type a captured pointer resolves to, or why nothing scalar is declared
+ * there. The tail must be exactly one segment: `ResponseDescriptor.types` is
+ * keyed by plain key name, so a nested segment has no declared type to compare
+ * against, and an array element has none either even where
+ * `evaluatePointerReachability` admits the index against a root collection.
+ */
+function capturedType(target, index) {
+    const channel = target.channel;
+    const segments = target.tail.length;
+    if (segments !== 1) {
+        return {
+            reason: `addresses ${segments === 0 ? `the whole ${channel}` : `a ${channel} path ${segments} segments deep`}, which declares no scalar to capture`,
+        };
+    }
+    const key = target.tail[0];
+    if (key === undefined) {
+        // Unreachable: the length check above guarantees one segment.
+        throw new TypeError('captured pointer tail is one segment but is empty');
+    }
+    if (ARRAY_INDEX_PATTERN.test(key)) {
+        return {
+            reason: `addresses ${channel} element ${key}, which no declaration gives a type`,
+        };
+    }
+    const step = resolveStep(index, target.stepId);
+    const operation = anyOperationOf(index, step.operationId);
+    if (operation === undefined) {
+        throw new TypeError(`step names an operation the permitted interfaces do not declare: ${step.operationId}`);
+    }
+    const declared = operation.responseDescriptor.types[key];
+    if (declared === undefined || declared === null) {
+        return {
+            reason: `addresses ${channel} field "${key}", whose type operation "${operation.operationId}" ${declared === undefined ? 'does not declare' : 'declares indeterminate'}`,
+        };
+    }
+    if (!SCALAR_TYPES.has(declared)) {
+        return {
+            reason: `addresses ${channel} field "${key}", which operation "${operation.operationId}" declares "${declared}" rather than a scalar`,
+        };
+    }
+    return { type: declared };
+}
+/**
+ * The type the bound parameter itself is declared as. An indeterminate
+ * declaration on either side is not equal to anything and fails closed, which
+ * is AD-31's disposition for an indeterminate descriptor. A step whose own
+ * operation does not resolve is skipped, matching
+ * `checkUndeclaredMandatoryInput`: that defect belongs to a separate
+ * cross-field rule.
+ */
+function boundParameterType(step, capture, index) {
+    const operation = anyOperationOf(index, step.operationId);
+    if (operation === undefined)
+        return null;
+    const shape = requestShapeOf(operation, capture.transportChannel);
+    // A channel the operation does not accept input on declares no type for
+    // the key either, so there is nothing to compare and the check abstains
+    // for the same reason the undeclared-key branch below does.
+    if (shape === undefined)
+        return null;
+    // A key the operation declares in neither list is an input the contract did
+    // not declare, which is `undeclared-mandatory-input`'s and strict-only under
+    // AD-4. This check runs unconditionally, so claiming it here would reject a
+    // non-strict contract under a code that names a different defect, and would
+    // treat a captured binding more harshly than the same key bound to a literal.
+    if (!shape.requiredKeys.includes(capture.key) &&
+        !shape.permittedKeys.includes(capture.key)) {
+        return null;
+    }
+    const declared = shape.types[capture.key];
+    if (declared === undefined || declared === null) {
+        return {
+            reason: `binds ${capture.transportChannel} parameter "${capture.key}", whose type operation "${operation.operationId}" ${declared === undefined ? 'does not declare' : 'declares indeterminate'}, so no type equality is decidable`,
+        };
+    }
+    return { type: declared };
+}
+/**
+ * `unreachable-check-evidence` over the captured-pointer residue: an
+ * unresolvable step or operation, an undeclared body key, a tail that is not
+ * exactly one segment, an array index, an absent, indeterminate, or non-scalar
+ * declared type, and a declared type that does not equal the bound
+ * parameter's.
+ *
+ * A capture naming another channel is reported here only for the two conditions
+ * that are decidable without a response descriptor: an unresolvable step and an
+ * unresolvable operation. Everything else about such a pointer is
+ * `checkCapturedChannel`'s. That split is what lets this check run at the
+ * registry's third rung without shadowing the fifteenth, and it keeps the
+ * higher-ranked code first on a pointer that is unresolvable and off-body at
+ * once.
+ */
+export function checkCapturedReachability(contract) {
+    let index;
+    for (const step of contract.interactionPlan) {
+        for (const capture of capturedBindings(step)) {
+            const path = bindingPath(step, capture);
+            index ??= buildPlanIndex(contract.interactionPlan, contract.permittedInterfaces, { duplicateIds: 'unresolved' });
+            // Resolved before the channel test, so a pointer that is both
+            // unresolvable and on a non-body channel reports the higher-ranked
+            // code. Deferring this to `checkCapturedChannel` would fire index 15
+            // where AD-5's order gives index 2, and would assert something about
+            // a response descriptor that no declared operation supplies. The
+            // wording matches `evaluatePointerReachability`'s own two reasons, so
+            // one defect reads the same however it is reached.
+            const referenced = index.stepOf(capture.target.stepId);
+            if (referenced === undefined) {
+                throw new StructuralFailure('unreachable-check-evidence', path, `captured pointer "${capture.pointer}" names a step the interaction plan does not declare`);
+            }
+            const operation = anyOperationOf(index, referenced.operationId);
+            if (operation === undefined) {
+                throw new StructuralFailure('unreachable-check-evidence', path, `captured pointer "${capture.pointer}" names step "${capture.target.stepId}", which names operation "${referenced.operationId}", not declared by any permitted interface`);
+            }
+            if (!targetsDescribedChannel(operation, capture.target))
+                continue;
+            const reachability = evaluatePointerReachability(capture.pointer, index);
+            if (!reachability.reachable) {
+                throw new StructuralFailure('unreachable-check-evidence', path, `captured pointer "${capture.pointer}" ${reachability.reason}`);
+            }
+            const captured = capturedType(capture.target, index);
+            if (captured.type === undefined) {
+                throw new StructuralFailure('unreachable-check-evidence', path, `captured pointer "${capture.pointer}" ${captured.reason}`);
+            }
+            const bound = boundParameterType(step, capture, index);
+            if (bound === null)
+                continue;
+            if (bound.type === undefined) {
+                throw new StructuralFailure('unreachable-check-evidence', path, `captured pointer "${capture.pointer}" resolves to a declared "${captured.type}", but the step ${bound.reason}`);
+            }
+            if (bound.type !== captured.type) {
+                throw new StructuralFailure('unreachable-check-evidence', path, `captured pointer "${capture.pointer}" resolves to a declared "${captured.type}", which is not the "${bound.type}" the bound ${capture.transportChannel} parameter "${capture.key}" is declared as`);
+            }
+        }
+    }
+}

package/dist/core/compile/compile.d.ts

@@ -13,6 +13,23 @@
  * code; the other two witness checks fire different codes and run
  * unconditionally, after the registry order, since AD-5 names no rung for them.
  *
+ * `checkCapturedReachability` fires the shipped `unreachable-check-evidence`,
+ * so it runs at that code's own third rung, beside `checkEvidenceReachability`.
+ * Grouping it with the two codes owed item 3 added, at the inserted position
+ * below, would let a lower-ranked code win on a contract carrying both defects.
+ *
+ * `checkArtifactReferences` fires `unresolved-artifact-reference`, the
+ * registry's last code, but runs near the front for the reason its own call
+ * site records: it names a fault that reachability can only describe the
+ * consequence of, and reachability abstains on the same pointer so the two
+ * never race.
+ *
+ * `checkStepReferenceReducibility` runs last, after every other check has had
+ * its say. It is the only check that reports what a LATER stage cannot do
+ * rather than what this contract declares wrongly, so a contract with an
+ * ordinary declaration fault should hear about that fault rather than about
+ * the sealing consequence of it.
+ *
  * `checkRubricIdentifiers` fires `rubric-unanchored` but runs ahead of
  * `checkRubricReasoningProse`, which outranks it in the registry. A duplicated
  * rubric or criterion id makes every `rubrics[id=...]` path the other three

package/dist/core/compile/compile.js

@@ -13,26 +13,58 @@
  * code; the other two witness checks fire different codes and run
  * unconditionally, after the registry order, since AD-5 names no rung for them.
  *
+ * `checkCapturedReachability` fires the shipped `unreachable-check-evidence`,
+ * so it runs at that code's own third rung, beside `checkEvidenceReachability`.
+ * Grouping it with the two codes owed item 3 added, at the inserted position
+ * below, would let a lower-ranked code win on a contract carrying both defects.
+ *
+ * `checkArtifactReferences` fires `unresolved-artifact-reference`, the
+ * registry's last code, but runs near the front for the reason its own call
+ * site records: it names a fault that reachability can only describe the
+ * consequence of, and reachability abstains on the same pointer so the two
+ * never race.
+ *
+ * `checkStepReferenceReducibility` runs last, after every other check has had
+ * its say. It is the only check that reports what a LATER stage cannot do
+ * rather than what this contract declares wrongly, so a contract with an
+ * ordinary declaration fault should hear about that fault rather than about
+ * the sealing consequence of it.
+ *
  * `checkRubricIdentifiers` fires `rubric-unanchored` but runs ahead of
  * `checkRubricReasoningProse`, which outranks it in the registry. A duplicated
  * rubric or criterion id makes every `rubrics[id=...]` path the other three
  * rubric checks emit address two things, so identifiers are settled before any
  * of them reports.
  */
+import { EVAL_CONTRACT_SCHEMA_VERSION } from '../schemas/eval-contract.js';
+import { checkBindingCycle, checkCapturedChannel, checkCapturedReachability, } from './bindings.js';
 import { checkObservableSuccessCriterion, checkRequirementLinkage, } from './declarations.js';
+import { checkExcludedContent } from './excluded-content.js';
 import { checkOperandLegality, checkQuantifierNesting, checkQuantifierOverNonCollection, checkReferenceSetResolution, checkRegexConstructs, } from './expression-legality.js';
 import { checkForbiddenInputFloor, checkScopedResourceReferences, } from './forbidden-inputs.js';
-import { checkDuplicateOperationSignature, checkInterfaceKind, checkUndeclaredMandatoryInput, } from './interface-inventory.js';
+import { checkArtifactReferences, checkDuplicateOperationSignature, checkInterfaceKind, checkUndeclaredMandatoryInput, } from './interface-inventory.js';
 import { checkOracleAlignment, checkOracleChannel } from './oracle-alignment.js';
 import { checkBoundElementScope, checkEvidenceReachability, } from './reachability.js';
 import { checkRubricAnchoring, checkRubricEvidenceReachability, checkRubricIdentifiers, checkRubricReasoningProse, } from './rubrics.js';
+import { checkSchemaVersion } from './schema-version.js';
 import { checkNestedTemporalClause, checkScriptingBound, } from './scripting-bound.js';
 import { checkSensitivityWitnessDeclared, checkWitnessLegality, checkWitnessLegIdentifiers, } from './sensitivity-witness.js';
+import { checkStepReferenceReducibility } from './step-reference.js';
 import { checkWaiverCompleteness } from './waivers.js';
 export function compile(contract, options) {
+    // First, and before any check reads a declaration. AD-11 makes an unequal
+    // stamp a rejection rather than a degraded read, and every check below is
+    // written against this version's field shapes.
+    checkSchemaVersion(contract.schemaVersion, EVAL_CONTRACT_SCHEMA_VERSION, 'EvalContract.schemaVersion');
     checkRequirementLinkage(contract);
     checkObservableSuccessCriterion(contract);
+    // Ahead of reachability, because a pointer naming an artifact nothing
+    // declares has no operation shape to be reachable against, and the code
+    // that names the fault directly should not lose the race to the code that
+    // describes its consequence.
+    checkArtifactReferences(contract);
     checkEvidenceReachability(contract);
+    checkCapturedReachability(contract);
     checkBoundElementScope(contract);
     checkOperandLegality(contract);
     checkRegexConstructs(contract);
@@ -49,13 +81,17 @@ export function compile(contract, options) {
     checkInterfaceKind(contract);
     checkNestedTemporalClause(contract);
     checkScriptingBound(contract);
+    checkBindingCycle(contract);
+    checkCapturedChannel(contract);
     checkRubricIdentifiers(contract);
     checkRubricReasoningProse(contract);
     checkRubricAnchoring(contract);
     checkRubricEvidenceReachability(contract);
     checkForbiddenInputFloor(contract);
+    checkExcludedContent(contract);
     checkScopedResourceReferences(contract);
     checkWaiverCompleteness(contract);
+    checkStepReferenceReducibility(contract);
     // Identifiers before legality. A duplicated or plan-colliding leg id makes
     // the legality check's question ("does the relation address both legs?")
     // unanswerable, so legality-first reports an unreachable-evidence failure on

package/dist/core/compile/excluded-content.d.ts

@@ -0,0 +1,11 @@
+import type { EvalContract } from '../schemas/eval-contract.ts';
+/**
+ * `excluded-content-in-declaration`: the contract carries a value-shaped secret.
+ *
+ * The first hit is reported and the rest are dropped. A contract carrying one
+ * has to be re-authored before it compiles at all, so enumerating the others
+ * would print more of the secret material into a failure message that gets
+ * pasted into a terminal, an issue, and a log. The message names the category
+ * and the path and quotes nothing.
+ */
+export declare function checkExcludedContent(contract: EvalContract): void;

package/dist/core/compile/excluded-content.js

@@ -0,0 +1,42 @@
+/**
+ * AD-18's exclusion, read against the contract rather than against a directory.
+ *
+ * AD-18 excludes credentials, tokens, real names, email addresses, account
+ * identifiers, and transaction content from every artifact this package produces
+ * or publishes, and says so binds "published examples and test fixtures as
+ * strictly as real runs". The only mechanism enforcing it was a test that greps
+ * `corpus/dev`, which reaches the corpus this repository ships and no contract an
+ * adopter authors. A token written into a contract therefore compiled clean and
+ * travelled onward: `seal` copies permitted interfaces onto the sealed brief, so
+ * the value reaches the one artifact AD-16 hands to an evaluator, and `emit`
+ * copies quoted evidence onto the evidence artifact.
+ *
+ * The whole contract is scanned, not a chosen subtree. Choosing one would have to
+ * be right about where an author pastes a secret, and the answer is wherever the
+ * field they were filling in happened to be: a witness input value, a fixture
+ * reset payload, an oracle's expected operand, a behaviour description. The
+ * scan's cost is one walk of an already-parsed object.
+ *
+ * Unconditional rather than strict-gated, unlike `undeclared-mandatory-input`
+ * next to it. That code is strict-only because AD-4 leaves a contract two
+ * legitimate readings of how completely it declares its inputs. AD-18 has one
+ * reading and no lenient mode: a credential that reaches a published artifact is
+ * unrecoverable, which is the harm the decision names.
+ */
+import { scanExcludedContent } from '../excluded-content.js';
+import { StructuralFailure } from '../failure-codes.js';
+/**
+ * `excluded-content-in-declaration`: the contract carries a value-shaped secret.
+ *
+ * The first hit is reported and the rest are dropped. A contract carrying one
+ * has to be re-authored before it compiles at all, so enumerating the others
+ * would print more of the secret material into a failure message that gets
+ * pasted into a terminal, an issue, and a log. The message names the category
+ * and the path and quotes nothing.
+ */
+export function checkExcludedContent(contract) {
+    const hit = scanExcludedContent(contract, 'EvalContract')[0];
+    if (hit === undefined)
+        return;
+    throw new StructuralFailure('excluded-content-in-declaration', hit.path, `carries a value shaped like ${hit.category}, which AD-18 excludes from every artifact this package produces; store a digest or an AD-8 opaque reference instead. The matched text is not quoted here, since a failure message travels further than the contract does`);
+}

package/dist/core/compile/expression-legality.d.ts

@@ -1,10 +1,58 @@
 import type { EvalContract } from '../schemas/eval-contract.ts';
+import type { Expression, Operand, SetOperand } from '../schemas/expression.ts';
+import type { AnyOperation } from '../schemas/interface.ts';
+type OperandPosition = 0 | 1 | 'collection';
+type OperandBearingOp = Exclude<Expression['op'], 'not' | 'all' | 'any'>;
+type Visitor = {
+    onOperand?: (operand: Operand, op: OperandBearingOp, position: OperandPosition, path: string, quantifierDepth: number) => void;
+    onSetOperand?: (setOperand: SetOperand, path: string) => void;
+    onQuantifier?: (expr: {
+        op: 'for-all' | 'for-any';
+        collection: Operand;
+        predicate: Expression;
+    }, path: string, quantifierDepth: number) => void;
+    onCoversByKey?: (expr: Extract<Expression, {
+        op: 'covers-by-key';
+    }>, path: string, quantifierDepth: number) => void;
+    onRegex?: (pattern: string, path: string) => void;
+};
+/**
+ * The one expression walker in this package. Contract-free and a superset of
+ * the narrower walks the checks below need, so a probe-side legality pass
+ * reuses it rather than adding a fifth traversal that can drift from it.
+ */
+export declare function walkExpression(expr: Expression, quantifierDepth: number, path: string, visitor: Visitor): void;
+/**
+ * `checkOperandLegality` over one bare `Expression`, minus the `covers-by-key`
+ * `expectedKey` uniqueness rule, which reads the contract's declared reference
+ * sets and has no probe-side form: a probe-side condition may carry no
+ * `{ referenceSet }` operand at all.
+ */
+export declare function checkExpressionOperandLegality(expression: Expression, artifactPath: string): void;
+/** `checkRegexConstructs` over one bare `Expression`. */
+export declare function checkExpressionRegexConstructs(expression: Expression, artifactPath: string): void;
+/** `checkQuantifierNesting` over one bare `Expression`. */
+export declare function checkExpressionQuantifierNesting(expression: Expression, artifactPath: string): void;
 /** Checks each operator's operands against its position-specific constraints. */
 export declare function checkOperandLegality(contract: EvalContract): void;
 /** Rejects invalid regexes, partial anchors, backreferences, and lookbehind. */
 export declare function checkRegexConstructs(contract: EvalContract): void;
 /** Rejects nested quantifiers and covers-by-key inside a quantifier. */
 export declare function checkQuantifierNesting(contract: EvalContract): void;
+/**
+ * `checkQuantifierOverNonCollection` over one bare `Expression` rooted at a
+ * known set of step identifiers, all of which resolve to one operation. The
+ * `legIds` argument is load-bearing: omit it and the check silently no-ops on
+ * every expression, which is the trap the witness branch below already warns
+ * about. It reads the operation's declared response types, never its
+ * `collectionLocations`; a declared non-array type beats a contradictory
+ * collection location, and a re-derivation that read the other field would
+ * disagree with the compiler on a committed fixture.
+ */
+export declare function checkExpressionQuantifierOverNonCollection(expression: Expression, artifactPath: string, scope: {
+    readonly operation: AnyOperation;
+    readonly legIds: readonly string[];
+}): void;
 /** Checks response-body collection pointers, after bound-element substitution. */
 export declare function checkQuantifierOverNonCollection(contract: EvalContract): void;
 /**
@@ -12,3 +60,4 @@ export declare function checkQuantifierOverNonCollection(contract: EvalContract)
  * This preserves legal identifiers such as `constructor`.
  */
 export declare function checkReferenceSetResolution(contract: EvalContract): void;
+export {};