eval-quality 0.1.0

package/dist/core/preflight/plan.js

@@ -0,0 +1,313 @@
+/**
+ * AD-34's planning half for AD-10's pre-flight: the contract and its probes in,
+ * a description of every request the environment-probe port must issue out.
+ * Pure and synchronous; nothing here awaits, reads a clock, or observes.
+ *
+ * The plan carries everything the reducer reads, because `ReduceStage` takes a
+ * plan and observations and nothing else. That is why a `PlannedCheck` embeds
+ * the operation and the witness themselves: there is nothing to look an
+ * identifier up in at reduce time.
+ */
+import { checkInputsAgainstShape } from '../compile/sensitivity-witness.js';
+import { declaresNoRequiredKeys } from '../declared-inputs.js';
+import { StructuralFailure } from '../failure-codes.js';
+import { referenceSetMembers } from './witness-evidence.js';
+const requestOf = (legId, interfaceId, operation, inputs) => ({
+    // NFR9's correlation by identifier: the port echoes this back, and it is
+    // the only thing that tells two legs of one operation apart.
+    probeId: legId,
+    interfaceId,
+    operationId: operation.operationId,
+    method: operation.method,
+    pathTemplate: operation.pathTemplate,
+    channels: {
+        path: inputs.path,
+        query: inputs.query,
+        header: inputs.header,
+        body: inputs.body,
+    },
+});
+/**
+ * The contract declares no identifier for a control leg, so one is minted, and it
+ * has to avoid every identifier the contract already spends. The same input
+ * always produces the same suffix, which is what fixture 104 asserts.
+ */
+const mintLegId = (base, taken) => {
+    if (!taken.has(base))
+        return base;
+    for (let ordinal = 2;; ordinal++) {
+        const candidate = `${base}-${ordinal}`;
+        if (!taken.has(candidate))
+            return candidate;
+    }
+};
+/**
+ * Every identifier a minted control leg has to avoid. The probes' manifestation
+ * witnesses are in the set even though they are not part of the contract: a
+ * minted id colliding with one is a collision the minting caused, and the
+ * duplicate scan below would report it against the probe's leg instead.
+ */
+const declaredLegIds = (contract, probes) => {
+    const taken = new Set(contract.interactionPlan.map((step) => step.stepId));
+    for (const probe of probes)
+        if (!probe.expectedClean)
+            for (const defect of probe.defects) {
+                const legId = defect.manifestationWitness?.legId;
+                if (legId !== undefined)
+                    taken.add(legId);
+            }
+    for (const iface of contract.permittedInterfaces)
+        for (const operation of iface.operations)
+            for (const leg of operation.sensitivityWitness?.legs ?? [])
+                taken.add(leg.legId);
+    if (contract.fixtureReset !== null)
+        taken.add(contract.fixtureReset.legId);
+    return taken;
+};
+const EMPTY_INPUTS = {
+    path: {},
+    query: {},
+    header: {},
+    body: { kind: 'absent' },
+};
+/**
+ * The inputs a control leg sends. A witness supplies them when the operation has
+ * one; an operation AD-10 exempts has no required key to fill, so empty inputs
+ * are a legal request. Returns `null` only when required keys exist that nothing
+ * here can supply.
+ *
+ * Reading a witness alone left the immutability branch unreachable for the
+ * contract that most needs it: a read-only contract whose only safe read is a
+ * parameterless GET is exempt, so it carried no witness, so no control leg was
+ * planned and the verdict passed with no immutability evidence at all.
+ */
+const controlInputs = (operation) => {
+    const declared = operation.sensitivityWitness?.legs[0]?.inputs;
+    if (declared !== undefined)
+        return declared;
+    return declaresNoRequiredKeys(operation) ? EMPTY_INPUTS : null;
+};
+const targetOf = (iface, operation) => {
+    const inputs = controlInputs(operation);
+    return inputs === null ? null : { iface, operation, inputs };
+};
+/**
+ * AD-10 rule 3's selection, by declaration order so a fixture catches a later
+ * change to the rule. The observed operation is the first safe read anywhere in
+ * the contract that can be given inputs; the mutating one is the first
+ * marker-true operation on the interface the fixture reset names, resolved
+ * independently of where the observed read came from.
+ */
+const selectControl = (contract) => {
+    let observed = null;
+    for (const iface of contract.permittedInterfaces) {
+        for (const operation of iface.operations) {
+            if (operation.stateChangeMarker)
+                continue;
+            observed = targetOf(iface, operation);
+            if (observed !== null)
+                break;
+        }
+        if (observed !== null)
+            break;
+    }
+    if (observed === null)
+        return null;
+    const reset = contract.fixtureReset;
+    if (reset === null)
+        return { observed, mutating: null };
+    const resetInterface = contract.permittedInterfaces.find((candidate) => candidate.logicalId === reset.interfaceId);
+    let mutating = null;
+    for (const operation of resetInterface?.operations ?? []) {
+        if (!operation.stateChangeMarker)
+            continue;
+        mutating = targetOf(resetInterface, operation);
+        if (mutating !== null)
+            break;
+    }
+    return { observed, mutating };
+};
+/**
+ * AD-10's plan, derived from the interfaces the contract's probes exercise.
+ *
+ * Three constructions worth knowing. An `interface-present` check is emitted
+ * only for an operation that has at least one leg, because a check over no legs
+ * is satisfied vacuously and asserts nothing. The `state-reset` and
+ * `clean-control` checks are emitted only when control legs could be planned at
+ * all, for the same reason. And the fixture reset's own leg is one more leg
+ * through the same port, so its identifier shares the namespace every other leg
+ * identifier sits in.
+ */
+export const planPreflight = (input) => {
+    const { contract, probes, runId } = input;
+    for (const iface of contract.permittedInterfaces) {
+        // Already thrown at compile; asserted again because the plan is reachable
+        // from a caller who assembled a contract by hand.
+        if (iface.kind !== 'api') {
+            throw new StructuralFailure('unsupported-interface-kind', `EvalContract.permittedInterfaces[logicalId=${iface.logicalId}].kind`, `"${iface.kind}" is not supported in v0; only "api" is (AD-10)`);
+        }
+    }
+    const origins = [];
+    const checks = [];
+    // Keyed by interface AND operation: `Operation.operationId` is scoped to a
+    // `PermittedInterface`, so two interfaces may legally declare the same one
+    // (its own schema description says so, and `duplicate-operation-signature`
+    // covers method plus path template only). Keyed by operation id alone, one
+    // interface's legs become another's clean legs.
+    const legIdsByOperation = new Map();
+    const scopeKey = (interfaceId, operationId) => `${interfaceId}\u0000${operationId}`;
+    const addLeg = (legId, purpose, interfaceId, operation, inputs, artifactPath) => {
+        origins.push({
+            leg: {
+                legId,
+                purpose,
+                request: requestOf(legId, interfaceId, operation, inputs),
+                operation,
+                inputs,
+            },
+            artifactPath,
+        });
+        const key = scopeKey(interfaceId, operation.operationId);
+        const group = legIdsByOperation.get(key);
+        if (group === undefined)
+            legIdsByOperation.set(key, [legId]);
+        else
+            group.push(legId);
+    };
+    // 1. the sensitivity legs and their checks
+    contract.permittedInterfaces.forEach((iface, interfaceIndex) => {
+        iface.operations.forEach((operation, operationIndex) => {
+            const witness = operation.sensitivityWitness;
+            const path = `EvalContract.permittedInterfaces[${interfaceIndex}].operations[${operationIndex}]`;
+            if (witness !== null)
+                witness.legs.forEach((leg, legIndex) => {
+                    addLeg(leg.legId, 'sensitivity', iface.logicalId, operation, leg.inputs, `${path}.sensitivityWitness.legs[${legIndex}].legId`);
+                });
+            checks.push({
+                kind: 'input-sensitivity',
+                interfaceId: iface.logicalId,
+                operationId: operation.operationId,
+                witness,
+                operation,
+            });
+        });
+    });
+    // 3. the control legs, once per contract
+    const control = selectControl(contract);
+    const controlLegIds = [];
+    if (control !== null) {
+        const taken = declaredLegIds(contract, probes);
+        const mintControl = (base) => {
+            const legId = mintLegId(base, taken);
+            taken.add(legId);
+            return legId;
+        };
+        const { observed } = control;
+        const observe = (legId) => {
+            addLeg(legId, 'control-observe', observed.iface.logicalId, observed.operation, observed.inputs, `the minted control-observe leg against "${observed.operation.operationId}"`);
+            controlLegIds.push(legId);
+        };
+        const first = mintControl('preflight-control-observe');
+        observe(first);
+        const reset = contract.fixtureReset;
+        if (control.mutating !== null && reset !== null) {
+            const { mutating } = control;
+            const mutate = mintControl('preflight-control-mutate');
+            addLeg(mutate, 'control-mutate', mutating.iface.logicalId, mutating.operation, mutating.inputs, `the minted control-mutate leg against "${mutating.operation.operationId}"`);
+            controlLegIds.push(mutate);
+            const resetOperation = mutating.iface.operations.find((candidate) => candidate.operationId === reset.operationId);
+            if (resetOperation === undefined) {
+                throw new StructuralFailure('unreachable-check-evidence', 'EvalContract.fixtureReset', `the fixture reset names operation "${reset.operationId}" on interface "${reset.interfaceId}", which the contract does not declare (AD-10)`);
+            }
+            addLeg(reset.legId, 'control-reset', reset.interfaceId, resetOperation, reset.inputs, 'EvalContract.fixtureReset.legId');
+            controlLegIds.push(reset.legId);
+        }
+        const last = mintControl('preflight-control-observe');
+        observe(last);
+        checks.push({ kind: 'state-reset', legIds: [first, last] });
+        // AD-10's own worked example is two distinct nonexistent identifiers both
+        // returning 404, so a `clean-control` reading sensitivity legs would fail
+        // on a contract that followed the architecture verbatim.
+        checks.push({ kind: 'clean-control', legIds: [...controlLegIds] });
+    }
+    // 5. one leg and two checks per seeded defect
+    for (const probe of probes) {
+        if (probe.expectedClean)
+            continue;
+        for (const defect of probe.defects) {
+            const witness = defect.manifestationWitness;
+            const path = `Probe[probeId=${probe.probeId}].defects[defectId=${defect.defectId}].manifestationWitness`;
+            if (witness === null) {
+                checks.push({
+                    kind: 'seeded-fault-fired',
+                    defectId: defect.defectId,
+                    witness: null,
+                    operation: null,
+                });
+                continue;
+            }
+            const iface = contract.permittedInterfaces.find((candidate) => candidate.logicalId === witness.interfaceId);
+            const operation = iface?.operations.find((candidate) => candidate.operationId === witness.operationId);
+            if (operation === undefined) {
+                throw new StructuralFailure('unreachable-check-evidence', path, `the manifestation witness names operation "${witness.operationId}" on interface "${witness.interfaceId}", which the contract does not declare (AD-10)`);
+            }
+            // A manifestation witness lives on the probe, so the compiler never sees
+            // its inputs. They reach the port all the same, so they are checked here.
+            checkInputsAgainstShape(witness.inputs, operation, `the manifestation witness of ${defect.defectId}`, `${path}.inputs`);
+            // Read before the fault leg joins the group, which keeps the fault leg out
+            // of its own clean-leg set.
+            const cleanLegIds = [
+                ...(legIdsByOperation.get(scopeKey(witness.interfaceId, operation.operationId)) ?? []),
+            ];
+            addLeg(witness.legId, 'seeded-fault', witness.interfaceId, operation, witness.inputs, `${path}.legId`);
+            checks.push({
+                kind: 'seeded-faults-scoped',
+                defectId: defect.defectId,
+                witness,
+                operation,
+                cleanLegIds,
+            });
+            checks.push({
+                kind: 'seeded-fault-fired',
+                defectId: defect.defectId,
+                witness,
+                operation,
+            });
+        }
+    }
+    // Two legs sharing an identifier would share a `probeId`, and the reducer
+    // indexes observations by it, so one leg would answer for the other. The
+    // contract side is already checked at compile; a manifestation witness is
+    // not, since `Probe` is not part of the contract.
+    const seen = new Set();
+    for (const origin of origins) {
+        if (seen.has(origin.leg.legId)) {
+            throw new StructuralFailure('malformed-operator-expression', origin.artifactPath, `leg id "${origin.leg.legId}" is already claimed by another planned leg; two legs sharing a probeId cannot be told apart (AD-10, NFR9)`);
+        }
+        seen.add(origin.leg.legId);
+    }
+    // AD-11 makes the fixture digest a required field of the verdict, and a digest
+    // over no observation would certify a pre-flight that verified nothing. A
+    // contract that offers pre-flight nothing to probe is refused here, where the
+    // contract is in hand and the failure can carry a code.
+    if (origins.length === 0) {
+        throw new StructuralFailure('unreachable-check-evidence', 'EvalContract.permittedInterfaces', 'the contract declares no operation pre-flight can probe, so there is no fixture to verify or digest (AD-10, AD-11)');
+    }
+    // 2. one interface-present check per operation that has a leg, in
+    // declaration order, ahead of the rest
+    const presence = [...legIdsByOperation].map(([key, legIds]) => {
+        const [interfaceId = '', operationId = ''] = key.split('\u0000');
+        return {
+            kind: 'interface-present',
+            interfaceId,
+            operationId,
+            legIds: [...legIds],
+        };
+    });
+    return {
+        runId,
+        legs: origins.map((origin) => origin.leg),
+        checks: [...presence, ...checks],
+        referenceSets: referenceSetMembers(contract),
+    };
+};

package/dist/core/preflight/projection.d.ts

@@ -0,0 +1,40 @@
+import type { Operation } from '../schemas/interface.ts';
+import type { ProbeObservation, ProbeObservedBody } from '../schemas/port-messages.ts';
+export declare const PREFLIGHT_ARTIFACT_PATH = "PreflightVerdict";
+/**
+ * The five fields and no others. Response headers are outside the projection
+ * because `volatilePointers` is a `DescriptorPointer` and the response
+ * descriptor is body-scoped, so no declaration can mark a header volatile, and
+ * unprunable headers would fail the repeated-read immutability branch on any
+ * fixture that echoes a request identifier back in one.
+ *
+ * Two costs to know about: two fixture versions differing only in a response
+ * header digest identically, and a witness relation can read a header this
+ * projection cannot see. The projection says what the fixture is; a relation
+ * addressing a header is the author asserting that header is stable.
+ */
+export type ProjectedObservation = {
+    readonly legId: string;
+    readonly interfaceId: string;
+    readonly operationId: string;
+    readonly status: number;
+    readonly body: ProbeObservedBody;
+};
+/**
+ * Removes every declared volatile pointer from a `json` body. `text` and
+ * `absent` pass through untouched, so a body that changed its content type
+ * stays visible to the digest. The input is cloned before anything is deleted.
+ */
+export declare function pruneVolatile(body: ProbeObservedBody, volatilePointers: readonly string[], artifactPath: string): ProbeObservedBody;
+/** One observation reduced to the projection, with its volatile pointers gone. */
+export declare function projectObservation(observation: ProbeObservation, operation: Operation, artifactPath: string): ProjectedObservation;
+/**
+ * AD-11's fixture digest. Sorted by leg id first, because NFR9 forbids any
+ * stage from reading array position: two runs whose observations arrived in a
+ * different order describe the same fixture and must digest the same.
+ *
+ * The empty case throws here. `digestComposite` rejects an empty field bag, and
+ * `{ observations: [] }` has one field, so it would happily digest a pre-flight
+ * that verified nothing.
+ */
+export declare function fixtureDigest(projections: readonly ProjectedObservation[], artifactPath: string): string;

package/dist/core/preflight/projection.js

@@ -0,0 +1,96 @@
+/**
+ * AD-11's named closed projection of a probe observation, and the fixture
+ * digest computed over it. The projection is what "the fixture" means for a
+ * scoring version: two runs whose projections agree describe the same fixture.
+ */
+import { digestComposite } from '../canonical/digest.js';
+import { DESCRIPTOR_POINTER_PATTERN } from '../schemas/pointer.js';
+import { decodeTail } from '../seal/plan-index.js';
+export const PREFLIGHT_ARTIFACT_PATH = 'PreflightVerdict';
+const isJsonObject = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const ARRAY_INDEX = /^(?:0|[1-9][0-9]*)$/;
+/** Deletes one already-decoded pointer from a cloned body value, in place. */
+function deleteAt(root, tokens) {
+    let parent = root;
+    for (const token of tokens.slice(0, -1)) {
+        if (Array.isArray(parent)) {
+            if (!ARRAY_INDEX.test(token))
+                return;
+            const next = parent[Number(token)];
+            if (next === undefined)
+                return;
+            parent = next;
+            continue;
+        }
+        if (!isJsonObject(parent) || !Object.hasOwn(parent, token))
+            return;
+        parent = parent[token];
+    }
+    const last = tokens.at(-1);
+    if (last === undefined)
+        return;
+    if (Array.isArray(parent)) {
+        if (!ARRAY_INDEX.test(last))
+            return;
+        const index = Number(last);
+        if (index >= parent.length)
+            return;
+        parent.splice(index, 1);
+        return;
+    }
+    if (!isJsonObject(parent))
+        return;
+    // A pointer that resolves to nothing is a no-op: a volatile field the fixture
+    // did not return this time is exactly what the declaration exists for.
+    if (!Object.hasOwn(parent, last))
+        return;
+    delete parent[last];
+}
+/**
+ * Removes every declared volatile pointer from a `json` body. `text` and
+ * `absent` pass through untouched, so a body that changed its content type
+ * stays visible to the digest. The input is cloned before anything is deleted.
+ */
+export function pruneVolatile(body, volatilePointers, artifactPath) {
+    for (const pointer of volatilePointers) {
+        if (DESCRIPTOR_POINTER_PATTERN.test(pointer))
+            continue;
+        throw new TypeError(`${artifactPath}: "${pointer}" is not a descriptor-relative pointer`);
+    }
+    if (body.kind !== 'json' || volatilePointers.length === 0)
+        return body;
+    // RFC 6901's empty pointer addresses the whole document, so a contract
+    // declaring it says the entire body is volatile.
+    if (volatilePointers.some((pointer) => pointer === ''))
+        return { kind: 'absent' };
+    const value = structuredClone(body.value);
+    for (const pointer of volatilePointers)
+        deleteAt(value, decodeTail(pointer));
+    return { kind: 'json', value };
+}
+/** One observation reduced to the projection, with its volatile pointers gone. */
+export function projectObservation(observation, operation, artifactPath) {
+    return {
+        legId: observation.probeId,
+        interfaceId: observation.interfaceId,
+        operationId: observation.operationId,
+        status: observation.status,
+        body: pruneVolatile(observation.body, operation.volatilePointers, artifactPath),
+    };
+}
+/**
+ * AD-11's fixture digest. Sorted by leg id first, because NFR9 forbids any
+ * stage from reading array position: two runs whose observations arrived in a
+ * different order describe the same fixture and must digest the same.
+ *
+ * The empty case throws here. `digestComposite` rejects an empty field bag, and
+ * `{ observations: [] }` has one field, so it would happily digest a pre-flight
+ * that verified nothing.
+ */
+export function fixtureDigest(projections, artifactPath) {
+    if (projections.length === 0) {
+        throw new TypeError(`${artifactPath}: a fixture digest over no observation would certify a pre-flight that verified nothing`);
+    }
+    const sorted = [...projections].sort((left, right) => left.legId < right.legId ? -1 : left.legId > right.legId ? 1 : 0);
+    return digestComposite({ observations: sorted }, artifactPath);
+}

package/dist/core/preflight/reduce.d.ts

@@ -0,0 +1,8 @@
+import type { ProbeObservation } from '../schemas/port-messages.ts';
+import type { PreflightVerdict } from '../schemas/preflight-verdict.ts';
+import type { ReduceStage } from '../stage-contracts.ts';
+import type { PreflightPlan } from './plan.ts';
+export type PreflightObservations = {
+    readonly observations: readonly ProbeObservation[];
+};
+export declare const reducePreflight: ReduceStage<PreflightPlan, PreflightObservations, PreflightVerdict>;

package/dist/core/preflight/reduce.js

@@ -0,0 +1,180 @@
+/**
+ * AD-34's reducing half: the plan plus the observations the port returned,
+ * reduced to a `PreflightVerdict`. Pure over the observations, and the only
+ * place AD-10's verdict semantics live.
+ *
+ * Observations are indexed by `probeId` (NFR9), and one `PreflightCheck` is
+ * emitted per `PlannedCheck`, so a verdict carries only the kinds its plan
+ * asked for.
+ */
+import { digestArtifact } from '../canonical/digest.js';
+import { declaresNoRequestKeys } from '../declared-inputs.js';
+import { freezeArtifact } from '../lineage/freeze.js';
+import { RuntimeFault } from '../schemas/faults.js';
+import { fixtureDigest, PREFLIGHT_ARTIFACT_PATH, projectObservation, } from './projection.js';
+import { evidenceOf, resolveWitnessRelation } from './witness-evidence.js';
+/**
+ * AD-10 names no threshold, and this is the one the repository already speaks:
+ * the published conformance suite ships `probe/observe-anomalous-status`, and
+ * `ProbeObservation.status` is bounded to 100-599 at the port, so HTTP is
+ * already assumed at that boundary.
+ */
+const ANOMALOUS_STATUS = 400;
+const check = (kind, operationId, outcome, note) => ({ kind, operationId, outcome, note });
+/**
+ * Two projections describe the same fixture state. `legId` is excluded because
+ * it is the one field that necessarily differs between the two legs compared, so
+ * deep-equality over the whole projection could never be satisfied.
+ *
+ * Compared through the canonical digest, because `JSON.stringify` is key-order
+ * sensitive: two adapters serialising one body's keys in different orders
+ * describe the same fixture, and failing there would invalidate a run over a
+ * difference that is not one.
+ */
+const sameFixtureState = (left, right) => {
+    const state = ({ legId: _legId, ...rest }) => rest;
+    return (digestArtifact(state(left), PREFLIGHT_ARTIFACT_PATH) ===
+        digestArtifact(state(right), PREFLIGHT_ARTIFACT_PATH));
+};
+/**
+ * Resolves a manifestation witness against one leg. Returns `null` when that
+ * leg produced no observation, which the two seeded-fault rows read
+ * differently: the fired row fails on it, the scoped row has nothing to
+ * contradict.
+ */
+const resolveAgainst = (witness, state, plan, artifactPath) => {
+    if (state === undefined)
+        return null;
+    // Keyed by the witness's own leg id, since the relation addresses
+    // `/interactions/{witness.legId}/…`. The scoped row asks whether that same
+    // relation would fire on a clean leg's observation.
+    return resolveWitnessRelation(witness.relation, { [witness.legId]: state.evidence }, state.leg.operation, plan.referenceSets, artifactPath).resolution;
+};
+export const reducePreflight = (plan, { observations }) => {
+    const byProbeId = new Map();
+    for (const observation of observations) {
+        // A repeated `probeId` is a broken echo: `ProbeRequest.probeId` comes
+        // back unchanged by contract, so two observations claiming one leg means
+        // the port answered a request nobody made. Left as a last-write-wins
+        // `Map` it would also make the verdict depend on array order, which is
+        // the class AD-30's permutation family exists to catch.
+        if (byProbeId.has(observation.probeId)) {
+            throw new RuntimeFault('port-contract-violation', PREFLIGHT_ARTIFACT_PATH, `two observations echoed the probe id "${observation.probeId}", so one leg was answered twice`);
+        }
+        byProbeId.set(observation.probeId, observation);
+    }
+    const states = new Map();
+    for (const leg of plan.legs) {
+        const observation = byProbeId.get(leg.legId);
+        if (observation === undefined)
+            continue;
+        const projected = projectObservation(observation, leg.operation, PREFLIGHT_ARTIFACT_PATH);
+        states.set(leg.legId, {
+            leg,
+            observation,
+            projected,
+            evidence: evidenceOf(projected, observation, leg.inputs),
+        });
+    }
+    const reduceCheck = (planned) => {
+        switch (planned.kind) {
+            case 'interface-present': {
+                for (const legId of planned.legIds) {
+                    const state = states.get(legId);
+                    if (state === undefined)
+                        return check(planned.kind, planned.operationId, 'failed', `leg "${legId}" produced no observation`);
+                    const { request } = state.leg;
+                    const echoed = state.observation;
+                    if (echoed.probeId !== request.probeId ||
+                        echoed.interfaceId !== request.interfaceId ||
+                        echoed.operationId !== request.operationId)
+                        return check(planned.kind, planned.operationId, 'failed', `leg "${legId}" echoed an identifier the request did not carry`);
+                }
+                return check(planned.kind, planned.operationId, 'satisfied', null);
+            }
+            case 'input-sensitivity': {
+                const { witness, operation } = planned;
+                if (witness === null)
+                    return check(planned.kind, planned.operationId, declaresNoRequestKeys(operation) ? 'exempt' : 'failed', declaresNoRequestKeys(operation)
+                        ? 'The operation declares no inputs in any channel.'
+                        : 'The operation declares request keys and no sensitivity witness.');
+                const evidence = {};
+                for (const leg of witness.legs) {
+                    const state = states.get(leg.legId);
+                    if (state === undefined)
+                        return check(planned.kind, planned.operationId, 'failed', `witness leg "${leg.legId}" produced no observation`);
+                    evidence[leg.legId] = state.evidence;
+                }
+                const { resolution } = resolveWitnessRelation(witness.relation, evidence, operation, plan.referenceSets, PREFLIGHT_ARTIFACT_PATH);
+                // AD-10's own sentence, and the most load-bearing line here: a
+                // sensitivity check that examined nothing has established nothing,
+                // so `insufficient-evidence` fails.
+                if (resolution === 'insufficient-evidence')
+                    return check(planned.kind, planned.operationId, 'failed', 'The witness relation resolved insufficient-evidence.');
+                return check(planned.kind, planned.operationId, resolution === 'true' ? 'satisfied' : 'failed', resolution === 'true' ? null : 'The witness relation resolved false.');
+            }
+            case 'state-reset': {
+                const [firstId, lastId] = planned.legIds;
+                const first = states.get(firstId);
+                const last = states.get(lastId);
+                if (first === undefined || last === undefined)
+                    return check(planned.kind, null, 'failed', 'a control-observe leg produced no observation');
+                return sameFixtureState(first.projected, last.projected)
+                    ? check(planned.kind, null, 'satisfied', null)
+                    : check(planned.kind, null, 'failed', `the projections of "${firstId}" and "${lastId}" differ`);
+            }
+            case 'clean-control': {
+                for (const legId of planned.legIds) {
+                    const state = states.get(legId);
+                    if (state === undefined)
+                        return check(planned.kind, null, 'failed', `control leg "${legId}" produced no observation`);
+                    if (state.observation.status >= ANOMALOUS_STATUS)
+                        return check(planned.kind, null, 'failed', `control leg "${legId}" observed status ${state.observation.status}`);
+                }
+                return check(planned.kind, null, 'satisfied', null);
+            }
+            case 'seeded-faults-scoped': {
+                const { witness, defectId } = planned;
+                for (const legId of planned.cleanLegIds) {
+                    const resolved = resolveAgainst(witness, states.get(legId), plan, PREFLIGHT_ARTIFACT_PATH);
+                    if (resolved === 'true')
+                        return check(planned.kind, witness.operationId, 'failed', `${defectId}: the manifestation witness fires on clean leg "${legId}"`);
+                }
+                return check(planned.kind, witness.operationId, 'satisfied', defectId);
+            }
+            case 'seeded-fault-fired': {
+                const { witness, defectId } = planned;
+                if (witness === null)
+                    return check(planned.kind, null, 'failed', `${defectId}: the defect declares no manifestation witness, so it cannot be observed to fire`);
+                const resolved = resolveAgainst(witness, states.get(witness.legId), plan, PREFLIGHT_ARTIFACT_PATH);
+                if (resolved === 'true')
+                    return check(planned.kind, witness.operationId, 'satisfied', defectId);
+                return check(planned.kind, witness.operationId, 'failed', resolved === null
+                    ? `${defectId}: the fault leg produced no observation`
+                    : `${defectId}: the manifestation witness resolved ${resolved} on its own fault leg`);
+            }
+        }
+    };
+    // The plan named legs and not one observation answered to a planned
+    // `probeId`. `ProbeRequest.probeId` is echoed unchanged by contract, so the
+    // port broke that contract and there is no observation to digest a fixture
+    // from. Thrown here as a typed fault: `fixtureDigest` would otherwise raise
+    // an untyped throw from inside the returned object literal, discarding the
+    // checks already computed.
+    if (states.size === 0) {
+        throw new RuntimeFault('port-contract-violation', PREFLIGHT_ARTIFACT_PATH, `no observation echoed any of the ${plan.legs.length} planned probe ids, so no fixture was observed`);
+    }
+    const checks = plan.checks.map(reduceCheck);
+    const projections = [...states.values()].map((state) => state.projected);
+    return freezeArtifact({
+        // A pre-flight verdict is an origin artifact, so AD-29's lineage fields
+        // carry their origin values.
+        schemaVersion: 1,
+        parentDigest: null,
+        revisionCount: 0,
+        runId: plan.runId,
+        fixtureDigest: fixtureDigest(projections, PREFLIGHT_ARTIFACT_PATH),
+        passed: checks.every((entry) => entry.outcome !== 'failed'),
+        checks,
+    });
+};