eval-quality 0.1.0

package/dist/core/schemas/sealed-run-record.js

@@ -0,0 +1,215 @@
+/** the caller's inbound record of one sealed evaluator trial. */
+import { z } from 'zod';
+import { ArtifactReference } from './artifact-reference.js';
+import { Severity } from './eval-contract.js';
+import { lineageFields } from './lineage.js';
+import { EvidenceChannel } from './pointer.js';
+import { BehaviorId, Digest, FindingId, Identifier, JsonObjectValue, JsonValue, OracleId, ProbeId, RubricCriterionId, RubricId, UnsignedDecimalString, } from './primitives.js';
+import { EvaluatorRecommendation } from './verdict.js';
+/**
+ * AD-23's verbatim quotation, paired with the channel it came from: a
+ * quotation with no channel cannot be audited against its source observation
+ * (ADR-009 Decision 2).
+ */
+export const QuotedEvidence = z.strictObject({
+    quote: z
+        .string()
+        .min(1)
+        .describe("The evaluator's verbatim quotation, per AD-23. Non-empty: an empty quotation quotes nothing, no AD-5 code names the condition, and under the admit-rule's second clause the schema is therefore the enforcement point. That this text appears in at least one of the finding's cited observations is NOT checked here; it is an AD-32 declared-versus-observed inconsistency that invalidates at ingest, and ADR-009 Decision 2 settles the precedence: \"cited identifiers govern the witness match; quotation audits it.\""),
+    channel: EvidenceChannel,
+});
+// Spread into each finding branch rather than shared as a base object: a
+// spread adds no `$defs` entry, so each branch exports as a complete shape a
+// non-TypeScript consumer can read without following a reference (AD-13).
+const findingCommonFields = {
+    findingId: FindingId,
+    oracleId: OracleId.nullable().describe('The oracle this finding answers. Nullable because AD-23 is explicit that "a finding citing no oracle is retained as an uncited finding rather than discarded", and it is often the evaluator-chosen detection the AD exists to preserve. The carve-out is oracle-only and is deliberately not extended to `probeId`.'),
+    probeId: ProbeId.describe("Required, unlike `oracleId`. AD-23 carves out the no-oracle case and nothing else; a finding arises during some probe's run, so citing the probe is always possible, and AD-7's per-class vector cannot attribute a finding that names no probe."),
+    behaviorId: BehaviorId.nullable().describe('The behaviour at issue, where the finding names one. `null` for a finding that answers no declared behaviour, which is the same case `oracleId: null` records.'),
+    severity: Severity,
+    summary: z.string().min(1),
+    confidence: z
+        .number()
+        .min(0)
+        .max(1)
+        .describe('AD-24 requires per-finding confidence "on a declared scale" and declares no scale, so the closed unit interval is declared here: 0 through 1 inclusive. It exports `minimum` and `maximum` natively, and it is the same scale the scoring policy\'s `confidenceThreshold` uses, or AD-21\'s "a finding whose confidence falls below the policy threshold" would compare two different scales.'),
+    observationIds: z
+        .array(Identifier)
+        .describe("The observations this finding relies on. Declared on every branch, not only on `defect`: AD-23's word is *additionally*, which is a floor on `defect` rather than a prohibition on the other two, and the architecture's own worked record carries observation identifiers on a `confirmation` and on an `observation` finding. A defect-only field would turn those into `unrecognized_keys` failures for no AD reason. That a cited identifier matches a declared observation is a cross-artifact rule with no AD-5 code and is left to ingest."),
+    evidenceArtifacts: z
+        .array(ArtifactReference)
+        .describe("References to the evidence this finding rests on. Nothing to do with this package's `EvidenceArtifact`, which is the scored output `emit` owns: two unrelated things one word apart, named here so a reader does not reach for the wrong type."),
+};
+/**
+ * `defect` findings additionally require observation identifiers and quoted
+ * evidence (AD-23). A nullable field can't express "required on this branch
+ * only", so this is a discriminated union, the house treatment for a
+ * conditional (AD-13).
+ */
+export const Finding = z
+    .discriminatedUnion('findingType', [
+    z
+        .strictObject({
+        findingType: z.literal('defect'),
+        ...findingCommonFields,
+        observationIds: z
+            .array(Identifier)
+            .min(1)
+            .describe('Tightened to at least one on this branch, which is AD-23\'s "additionally" expressed structurally: a defect claim citing no witness is what AD-40 calls an invalidating declared-versus-observed inconsistency, and the minimum is the half of that rule a schema can carry.'),
+        quotedEvidence: z
+            .array(QuotedEvidence)
+            .min(1)
+            .describe('Required and non-empty on this branch alone, per AD-23. Only `defect` findings enter a detection measure, and a detection claim with no quotation is the shape AD-40 records revision 4 having no way to match.'),
+    })
+        .describe('A claimed defect. The only finding type that enters a detection measure under AD-23, and the only one carrying required quoted evidence.'),
+    z
+        .strictObject({
+        findingType: z.literal('observation'),
+        ...findingCommonFields,
+    })
+        .describe('A non-defect note about the interface or the evidence. Carries no quoted evidence requirement and never enters a detection measure.'),
+    z
+        .strictObject({
+        findingType: z.literal('confirmation'),
+        ...findingCommonFields,
+    })
+        .describe('A record that a behaviour held. AD-6 resolves it to `confirmed`, the state revision 3 added after `passed-clean-control` was being misused for it.'),
+])
+    .meta({ id: 'Finding' });
+/**
+ * AD-23 requires one disposition per required oracle: held, violated, or
+ * not-attempted. The three words are AD-23's own vocabulary.
+ */
+export const ORACLE_DISPOSITIONS = [
+    'held',
+    'violated',
+    'not-attempted',
+];
+export const OracleDispositionValue = z.enum(ORACLE_DISPOSITIONS);
+export const OracleDisposition = z.strictObject({
+    oracleId: OracleId,
+    disposition: OracleDispositionValue,
+    observationIds: z
+        .array(Identifier)
+        .describe('Required and permitted to be empty. AD-33 requires "every disposition citing supporting observations, and an unsupported disposition invalidating cross-artifact agreement rather than being believed", so an unsupported disposition has to stay representable for the scorer to invalidate it. That one disposition exists per required oracle is likewise not refined: AD-23 makes a missing disposition an AD-21 invalidating condition, so the schema admits the shape and ingest fires the rung.'),
+    note: z.string().nullable(),
+});
+/**
+ * A flat map would break pointer addressing: AD-26 keys `call-inputs` by
+ * transport channel, so a pointer like
+ * `/interactions/write/call-inputs/body/title` needs that segment to resolve
+ * against. A four-key strict object rather than a record over the transport
+ * enum, for the same reason as `RequestShape` and `InputBinding`: a record
+ * demands every enum member at parse time, but a real observation binds only
+ * a subset.
+ */
+export const ObservedCallInputs = z.strictObject({
+    path: JsonObjectValue.nullable(),
+    query: JsonObjectValue.nullable(),
+    header: JsonObjectValue.nullable(),
+    body: JsonObjectValue.nullable(),
+});
+/**
+ * One ingested observation, carrying AD-26's closed channel set so every
+ * pointer in the addressing grammar has something to resolve against.
+ *
+ * Observation ordering is deliberately absent (Owed item 2): ADR-006 forbids
+ * using array position as ordering, and the fix, a monotonic sequence, arrives
+ * as an additive `schemaVersion` bump under AD-11.
+ */
+export const Observation = z.strictObject({
+    observationId: Identifier,
+    operationId: Identifier.describe('The operation this observation exercised. `Operation.operationId` is scoped to a `PermittedInterface`, so two interfaces may declare the same one; that collision is a cross-artifact rule with no AD-5 code, since `duplicate-operation-signature` covers method plus path template only, and it is left to ingest.'),
+    provenance: z
+        .enum(['baseline', 'evaluator-chosen'])
+        .describe("AD-23: `baseline` for a pre-canned or deterministic test, `evaluator-chosen` for an action the evaluator selected. The distinction is the one the product's central finding rests on: what a sealed evaluator detects beyond the pre-canned baseline. It lives on the observation, never on the finding."),
+    callInputs: ObservedCallInputs,
+    responseBody: JsonValue.nullable().describe('AD-26\'s `response-body` channel. The null branch is redundant against the value container, which already admits `null`; it is kept so all ten observation fields read the same way, and it means "no body observed" and "a body that was JSON null" are indistinguishable here, which is an accepted cost of one uniform spelling.'),
+    responseHeaders: JsonObjectValue.nullable().describe('A name-to-value map, not the open value container. AD-26 gives `response-headers` a tail, so a pointer resolves INTO this channel; a scalar here would leave `/interactions/x/response-headers/Content-Type` addressing nothing. That is the difference from `responseBody`, where a scalar or an array is a legitimate body and the open container is correct.'),
+    responseStatus: z
+        .int()
+        .min(0)
+        .nullable()
+        .describe('Deliberately not bounded to a protocol range. A negative status is meaningless and excluded, but the upper end is left open: AD-19 declares four interface kinds and v0 rejects three of them at compile time under `unsupported-interface-kind`, so bounding this to HTTP would encode a protocol assumption the artifact outlives. `null` where the channel does not apply.'),
+    stdout: z.string().nullable(),
+    stderr: z.string().nullable(),
+    exitCode: z
+        .int()
+        .nullable()
+        .describe('Signed on purpose, unlike `responseStatus`: a process terminated by a signal is conventionally reported as a negative code, and this field records what was observed rather than what is tidy.'),
+});
+/**
+ * AD-17: judge results arrive inside the sealed run record and the package
+ * never calls a judge.
+ */
+export const JudgeResult = z.strictObject({
+    rubricId: RubricId,
+    criterionId: RubricCriterionId,
+    score: z
+        .int()
+        .nullable()
+        .describe("An integer, because AD-22 puts the scale on the rubric's own anchored levels and `ScaleLevel.level` is already `z.int()`; no second scale is minted here. `null` is the shape AD-6's `judge-error` fires on, so it must parse. That the criterion is one the cited rubric declares, and that a conforming record shows one judge call scoring all named criteria, are AD-17 cross-artifact rules a schema over one artifact cannot see."),
+    note: z.string().nullable(),
+});
+/** the prior art's five members, with money as a string per AD-36. */
+export const ResourceUse = z.strictObject({
+    toolCalls: z.int().min(0),
+    inputTokens: z.int().min(0),
+    outputTokens: z.int().min(0),
+    wallClockSeconds: z
+        .number()
+        .min(0)
+        .describe("Stays a number where money becomes a string: a measured duration is not currency, and the worked example's 62.5 is an exact binary64 inside AD-36's value domain."),
+    costUsd: UnsignedDecimalString.describe("Money, so AD-36 carries it as a string in a declared format. The prior art's number does not survive; an AD-24 divergence."),
+});
+/**
+ * AD-21's FAIL rung reads on evidence that is incomplete, over-truncated,
+ * unavailable, or internally inconsistent (AD-17), but no artifact declares
+ * those fields. Two of the four are caller statements and land here; the other
+ * two are derived and declared nowhere.
+ */
+export const EvidenceDisclosure = z.strictObject({
+    truncationBound: z
+        .int()
+        .min(0)
+        .nullable()
+        .describe('AD-17 requires truncation to be "deterministic, disclosed with its bound". `null` is untruncated. The unit is left to the caller and stated rather than encoded, following the `RubricBody.maxLength` precedent for AD-22\'s equally unitless "bounded length". The over-truncated condition compares this bound against the evidence carried in this same artifact, which is why the disclosure and the evidence travel together.'),
+    reportedIncomplete: z
+        .boolean()
+        .describe('AD-17: "a case that cannot be bounded without discarding disconfirming material is reported incomplete". This is the operand AD-21\'s incomplete condition reads. The remaining two conditions read no field here: unavailable is an `ArtifactReference` that does not resolve through the corpus port, and internally inconsistent is AD-32\'s cross-artifact agreement check. AD-17\'s "must retain evidence contradicting the leading verdict" is decidable by none of them and is recorded as unenforced in v0.'),
+});
+export const SealedRunRecord = z
+    .strictObject({
+    ...lineageFields,
+    runId: z
+        .string()
+        .min(1)
+        .describe('An opaque caller label. Carried over from the prior art unchanged.'),
+    conditionArm: z
+        .string()
+        .min(1)
+        .describe("An opaque caller label with no product semantics, per AD-24. The prior art's five-member enum does not survive, and its own extension history is the reason: an enum a local amendment had to widen once for `self-review` will be widened again."),
+    trialIndex: z
+        .int()
+        .min(1)
+        .describe("Which trial this record is. AD-24 excludes the trial index from the Evaluator Configuration \"so trials pool into one scoring version\", which requires it somewhere else, and a Sealed Run Record is the only artifact carrying exactly one trial. One-based, matching the only instance that exists. AD-6's aggregate of trial count, invalidated attempts, and each attempt's reason is the Evidence Artifact's; asking one run to report its siblings is what no stage signature can do."),
+    contractDigest: Digest,
+    sealedBriefDigest: Digest,
+    evaluatorConfigurationDigest: Digest.describe('A bare digest rather than an `ArtifactReference`, and required on both this record and the isolation manifest. AD-32 requires the two to *agree*, and an `ArtifactReference` on one side against a bare digest on the other makes the comparison lopsided; AD-2 already has ingest receiving the Evaluator Configuration as its own input, so nothing needs resolving through a reference. The agreement itself is a cross-artifact rule no schema can see.'),
+    evaluatorRecommendation: EvaluatorRecommendation,
+    oracleDispositions: z.array(OracleDisposition),
+    findings: z.array(Finding),
+    observations: z.array(Observation),
+    judgeResults: z
+        .array(JudgeResult)
+        .describe('Empty is legal: a contract with no rubric produces no judge call.'),
+    actionsArtifact: ArtifactReference,
+    isolationManifestArtifact: ArtifactReference,
+    resourceUse: ResourceUse,
+    evidenceDisclosure: EvidenceDisclosure,
+    invalidReason: z.string().nullable(),
+})
+    .meta({
+    id: 'SealedRunRecord',
+    description: "One sealed evaluator trial, as the caller presents it. Succeeds the prior-art `h0-run-result` schema per AD-24, keeping its run identifier, condition arm, findings, action-log reference, resource use, invalidation reason, evaluator recommendation as a closed enum, and per-finding confidence on a declared scale. Divergences: `condition` is demoted to the opaque `conditionArm`, `verdict` becomes `evaluatorRecommendation` without `NOT_APPLICABLE`, money is a decimal string, and `taskId`, `note`, and per-finding `actionIds` do not survive: the contract is pinned by `contractDigest`, an unstructured orchestrator annotation is the free-prose channel the Conventions close everywhere else, and two citation vocabularies on one finding is the ambiguity ADR-009 removed. Two constructions are deliberately absent and each is owed to an open item: the run MODE, which AD-21 requires to be fixed before ingest and to enter AD-11's identity inputs rather than appearing first in the evidence artifact (Owed item 4), and observation ORDERING, which ADR-006 forbids reading off array position (Owed item 2). Both arrive as additive `schemaVersion` bumps under AD-11.",
+});

package/dist/core/schemas/sensitivity-witness.d.ts

@@ -0,0 +1,138 @@
+/** AD-10's typed witnesses and the fixture-reset declaration. */
+import { z } from 'zod';
+import { Expression } from './expression.ts';
+/**
+ * The four transport channels one probe leg supplies, as values. `RequestShape`
+ * declares what an operation accepts; this declares what one leg sends. AD-18
+ * applies here too, so a header value carries no credential.
+ *
+ * `header` and `body` use the port's own spelling: a header value is a string
+ * at the boundary, and a body has to tell an absent body from a JSON null. A
+ * leg the plan could not map onto a `ProbeRequest` would declare work nothing
+ * runs.
+ */
+export declare const WitnessInputs: z.ZodObject<{
+    path: z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>;
+    query: z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>;
+    header: z.ZodRecord<z.ZodString, z.ZodString>;
+    body: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"json">;
+        value: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"absent">;
+    }, z.core.$strict>], "kind">;
+}, z.core.$strict>;
+export type WitnessInputs = z.infer<typeof WitnessInputs>;
+/**
+ * Half a witness pair. `legId` roots the relation's pointers, which address this
+ * leg's response as `/interactions/{legId}/response-body/...`, so it shares one
+ * namespace with interaction-plan step ids.
+ */
+export declare const SensitivityWitnessLeg: z.ZodObject<{
+    legId: z.ZodString;
+    inputs: z.ZodObject<{
+        path: z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>;
+        query: z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>;
+        header: z.ZodRecord<z.ZodString, z.ZodString>;
+        body: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"json">;
+            value: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"absent">;
+        }, z.core.$strict>], "kind">;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type SensitivityWitnessLeg = z.infer<typeof SensitivityWitnessLeg>;
+export declare const WITNESS_CHANNELS: readonly ['path', 'query', 'body'];
+export declare const WitnessChannel: z.ZodEnum<{
+    body: "body";
+    path: "path";
+    query: "query";
+}>;
+export type WitnessChannel = z.infer<typeof WitnessChannel>;
+/**
+ * AD-10's typed sensitivity witness: a pair of inputs and the AD-4 relation
+ * their responses must satisfy. Per operation, because an interface-scoped
+ * check let an identifier-blind read pass on a body-sensitive sibling, and
+ * cannot be performed at all on a read-only interface.
+ *
+ * The relation is declared because inequality decides nothing on its own: two
+ * distinct nonexistent identifiers both return the same 404, and an input-blind
+ * response carrying a request identifier differs every time.
+ *
+ * `legs` is a length-pinned array. `z.tuple` exports `prefixItems` with no
+ * length keyword, so `.length(2)` is what puts `minItems` and `maxItems` in the
+ * published schema.
+ */
+export declare const SensitivityWitness: z.ZodObject<{
+    witnessId: z.ZodString;
+    channel: z.ZodEnum<{
+        body: "body";
+        path: "path";
+        query: "query";
+    }>;
+    legs: z.ZodArray<z.ZodObject<{
+        legId: z.ZodString;
+        inputs: z.ZodObject<{
+            path: z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>;
+            query: z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>;
+            header: z.ZodRecord<z.ZodString, z.ZodString>;
+            body: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"json">;
+                value: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"absent">;
+            }, z.core.$strict>], "kind">;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
+    relation: z.ZodType<Expression, unknown, z.core.$ZodTypeInternals<Expression, unknown>>;
+}, z.core.$strict>;
+export type SensitivityWitness = z.infer<typeof SensitivityWitness>;
+/**
+ * AD-10's manifestation witness: which operation to probe, with what inputs, and
+ * the AD-4 relation that is true exactly when the seeded fault has fired.
+ *
+ * A different mechanism from AD-40's DEFECT SIGNATURE, which matches a
+ * scoring-side finding against an observation. This one never enters a score; it
+ * makes "every declared seeded fault observed to fire" decidable at pre-flight.
+ */
+export declare const ManifestationWitness: z.ZodObject<{
+    legId: z.ZodString;
+    interfaceId: z.ZodString;
+    operationId: z.ZodString;
+    inputs: z.ZodObject<{
+        path: z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>;
+        query: z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>;
+        header: z.ZodRecord<z.ZodString, z.ZodString>;
+        body: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"json">;
+            value: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"absent">;
+        }, z.core.$strict>], "kind">;
+    }, z.core.$strict>;
+    relation: z.ZodType<Expression, unknown, z.core.$ZodTypeInternals<Expression, unknown>>;
+}, z.core.$strict>;
+export type ManifestationWitness = z.infer<typeof ManifestationWitness>;
+/**
+ * The operation that returns the fixture to its clean state. AD-10 verifies the
+ * per-run reset differentially, and the reset is an ordinary declared operation,
+ * so it goes through the same port as every other leg.
+ */
+export declare const FixtureReset: z.ZodObject<{
+    legId: z.ZodString;
+    interfaceId: z.ZodString;
+    operationId: z.ZodString;
+    inputs: z.ZodObject<{
+        path: z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>;
+        query: z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>;
+        header: z.ZodRecord<z.ZodString, z.ZodString>;
+        body: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"json">;
+            value: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"absent">;
+        }, z.core.$strict>], "kind">;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type FixtureReset = z.infer<typeof FixtureReset>;

package/dist/core/schemas/sensitivity-witness.js

@@ -0,0 +1,86 @@
+/** AD-10's typed witnesses and the fixture-reset declaration. */
+import { z } from 'zod';
+import { Expression } from './expression.js';
+import { Identifier, JsonObjectValue, KeyName } from './primitives.js';
+import { ProbeRequestBody } from './probe-body.js';
+/**
+ * The four transport channels one probe leg supplies, as values. `RequestShape`
+ * declares what an operation accepts; this declares what one leg sends. AD-18
+ * applies here too, so a header value carries no credential.
+ *
+ * `header` and `body` use the port's own spelling: a header value is a string
+ * at the boundary, and a body has to tell an absent body from a JSON null. A
+ * leg the plan could not map onto a `ProbeRequest` would declare work nothing
+ * runs.
+ */
+export const WitnessInputs = z
+    .strictObject({
+    path: JsonObjectValue,
+    query: JsonObjectValue,
+    header: z.record(KeyName, z.string()),
+    body: ProbeRequestBody,
+})
+    .meta({
+    id: 'WitnessInputs',
+    description: "One probe leg's supplied inputs, keyed by AD-19 transport channel, in the spelling the environment-probe port accepts. Shared by both witness kinds and by the fixture reset, so the export carries it once.",
+});
+/**
+ * Half a witness pair. `legId` roots the relation's pointers, which address this
+ * leg's response as `/interactions/{legId}/response-body/...`, so it shares one
+ * namespace with interaction-plan step ids.
+ */
+export const SensitivityWitnessLeg = z.strictObject({
+    legId: Identifier,
+    inputs: WitnessInputs,
+});
+// AD-10 selects the differential channel by the operation's state-change
+// marker: `path` or `query` where the marker is false, `body` where it is true.
+// `header` is absent on purpose; no AD names a header differential.
+export const WITNESS_CHANNELS = ['path', 'query', 'body'];
+export const WitnessChannel = z.enum(WITNESS_CHANNELS);
+/**
+ * AD-10's typed sensitivity witness: a pair of inputs and the AD-4 relation
+ * their responses must satisfy. Per operation, because an interface-scoped
+ * check let an identifier-blind read pass on a body-sensitive sibling, and
+ * cannot be performed at all on a read-only interface.
+ *
+ * The relation is declared because inequality decides nothing on its own: two
+ * distinct nonexistent identifiers both return the same 404, and an input-blind
+ * response carrying a request identifier differs every time.
+ *
+ * `legs` is a length-pinned array. `z.tuple` exports `prefixItems` with no
+ * length keyword, so `.length(2)` is what puts `minItems` and `maxItems` in the
+ * published schema.
+ */
+export const SensitivityWitness = z.strictObject({
+    witnessId: Identifier,
+    channel: WitnessChannel,
+    legs: z.array(SensitivityWitnessLeg).length(2),
+    relation: Expression,
+});
+/**
+ * AD-10's manifestation witness: which operation to probe, with what inputs, and
+ * the AD-4 relation that is true exactly when the seeded fault has fired.
+ *
+ * A different mechanism from AD-40's DEFECT SIGNATURE, which matches a
+ * scoring-side finding against an observation. This one never enters a score; it
+ * makes "every declared seeded fault observed to fire" decidable at pre-flight.
+ */
+export const ManifestationWitness = z.strictObject({
+    legId: Identifier,
+    interfaceId: Identifier,
+    operationId: Identifier,
+    inputs: WitnessInputs,
+    relation: Expression,
+});
+/**
+ * The operation that returns the fixture to its clean state. AD-10 verifies the
+ * per-run reset differentially, and the reset is an ordinary declared operation,
+ * so it goes through the same port as every other leg.
+ */
+export const FixtureReset = z.strictObject({
+    legId: Identifier,
+    interfaceId: Identifier,
+    operationId: Identifier,
+    inputs: WitnessInputs,
+});

package/dist/core/schemas/verdict.d.ts

@@ -0,0 +1,25 @@
+/** AD-21's four verdicts and AD-24's closed evaluator recommendation. */
+import { z } from 'zod';
+/**
+ * The other named exception to this package's lowercase kebab-case enum
+ * convention is the HTTP method.
+ */
+export declare const VERDICTS: readonly ['PASS', 'WAIVED', 'CONCERNS', 'FAIL'];
+export declare const Verdict: z.ZodEnum<{
+    CONCERNS: "CONCERNS";
+    FAIL: "FAIL";
+    PASS: "PASS";
+    WAIVED: "WAIVED";
+}>;
+/**
+ * The verdict vocabulary minus `WAIVED`, reusing the uppercase exception
+ * rather than adding a third one.
+ */
+export declare const EVALUATOR_RECOMMENDATIONS: readonly ['PASS', 'CONCERNS', 'FAIL'];
+export declare const EvaluatorRecommendation: z.ZodEnum<{
+    CONCERNS: "CONCERNS";
+    FAIL: "FAIL";
+    PASS: "PASS";
+}>;
+export type Verdict = z.infer<typeof Verdict>;
+export type EvaluatorRecommendation = z.infer<typeof EvaluatorRecommendation>;

package/dist/core/schemas/verdict.js

@@ -0,0 +1,20 @@
+/** AD-21's four verdicts and AD-24's closed evaluator recommendation. */
+import { z } from 'zod';
+/**
+ * The other named exception to this package's lowercase kebab-case enum
+ * convention is the HTTP method.
+ */
+export const VERDICTS = ['PASS', 'WAIVED', 'CONCERNS', 'FAIL'];
+export const Verdict = z.enum(VERDICTS).meta({
+    id: 'Verdict',
+    description: "AD-21's four verdicts. Uppercase is one of the two named exceptions to the lowercase kebab-case enum convention. Exit codes are AD-21's and belong to the CLI rather than to this value: PASS, WAIVED, and CONCERNS exit zero and FAIL exits two.",
+});
+/**
+ * The verdict vocabulary minus `WAIVED`, reusing the uppercase exception
+ * rather than adding a third one.
+ */
+export const EVALUATOR_RECOMMENDATIONS = ['PASS', 'CONCERNS', 'FAIL'];
+export const EvaluatorRecommendation = z.enum(EVALUATOR_RECOMMENDATIONS).meta({
+    id: 'EvaluatorRecommendation',
+    description: "The evaluator's own recommendation, ingested and never promoted to a verdict in contract-scoring mode. AD-24 requires a closed enum; the prior art's `NOT_APPLICABLE` is dropped with the `scripted` arm it belonged to. Consequence recorded here because it closes a rung: AD-21's Invalid condition for \"an unrecognised evaluator recommendation value\" is unreachable for a schema-valid artifact, since an unrecognised value fails to parse and becomes an AD-28 `schema-parse-failure` fault, and a fault never becomes a verdict. An ingesting reader either validates this field leniently and maps an unrecognised value to that rung, or accepts that the rung fires only as a fault.",
+});

package/dist/core/schemas/waiver.d.ts

@@ -0,0 +1,17 @@
+/** a contract-carried waiver. */
+import { z } from 'zod';
+/**
+ * AD-5: a validated waiver requires the named rule, an explicit rationale, a
+ * machine-checkable context condition where one exists, the recorded
+ * approval, and an RFC 3339 expiry. Every part except the identifier is a
+ * required key with a nullable value, so an incomplete waiver stays
+ * representable and `waiver-incomplete` keeps a shape to fire on.
+ */
+export declare const Waiver: z.ZodObject<{
+    id: z.ZodString;
+    rule: z.ZodNullable<z.ZodString>;
+    rationale: z.ZodNullable<z.ZodString>;
+    condition: z.ZodNullable<z.ZodString>;
+    approval: z.ZodNullable<z.ZodString>;
+    expiresAt: z.ZodNullable<z.ZodISODateTime>;
+}, z.core.$strict>;

package/dist/core/schemas/waiver.js

@@ -0,0 +1,24 @@
+/** a contract-carried waiver. */
+import { z } from 'zod';
+import { Rfc3339Utc, WaiverId } from './primitives.js';
+/**
+ * AD-5: a validated waiver requires the named rule, an explicit rationale, a
+ * machine-checkable context condition where one exists, the recorded
+ * approval, and an RFC 3339 expiry. Every part except the identifier is a
+ * required key with a nullable value, so an incomplete waiver stays
+ * representable and `waiver-incomplete` keeps a shape to fire on.
+ */
+export const Waiver = z.strictObject({
+    id: WaiverId,
+    rule: z
+        .string()
+        .nullable()
+        .describe('The AD-20 discipline rule this waiver names. An opaque string rather than an enum: AD-20 enumerates seven rules in prose and assigns them no identifiers, and minting them here would invent a vocabulary that AD-20 enforcement would then have to match.'),
+    rationale: z.string().nullable(),
+    condition: z
+        .string()
+        .nullable()
+        .describe('A machine-checkable context condition. AD-5 requires one "where one exists", so `null` here is a complete waiver rather than an incomplete one.'),
+    approval: z.string().nullable(),
+    expiresAt: Rfc3339Utc.nullable(),
+});

package/dist/core/seal/derived-reference.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The derived-reference vocabulary (AD-16). Renders an evidence-target
+ * pointer, or a temporally-paired pair, as a description of the step's
+ * operation and selection predicate; the step's own identifier never appears.
+ * Resolves pointers through a `PlanIndex` into a phrase, kept apart from
+ * `plan-index.ts`'s resolving and `direction-prose.ts`'s relation templates.
+ */
+import type { Operation } from '../schemas/interface.ts';
+import type { InteractionStep } from '../schemas/plan.ts';
+import { type PlanIndex } from './plan-index.ts';
+/**
+ * Escalates through `ESCALATION_LEVELS` in order until every step in
+ * `siblings` renders distinctly.
+ *
+ * `siblings` is direction-scoped: the caller passes only the steps the
+ * current direction's own resolved evidence targets share this operation
+ * with, not every step in the plan (AD-16), so an unrelated collision
+ * elsewhere never blocks an otherwise renderable direction.
+ *
+ * Throws the same precondition-violation `TypeError` as `buildPlanIndex`'s
+ * duplicate `stepId` check if two siblings still collide after full
+ * escalation.
+ */
+export declare function renderStepReference(step: InteractionStep, operation: Operation, siblings: readonly InteractionStep[]): string;
+/**
+ * Renders every evidence target a direction declares as one canonically
+ * ordered, order-independent clause: byte-identical under any permutation of
+ * `evidenceTargets`, `interactionPlan`, or `permittedInterfaces`, since every
+ * phrase comes from Map-keyed lookups and structural properties, never array
+ * position.
+ *
+ * A repeated pointer is deduplicated first: left in place it would push its
+ * step out of the "exactly one target" shape temporal pairing requires,
+ * silently disabling the relational phrase for an otherwise-valid pair.
+ */
+export declare function renderEvidenceReferences(pointers: readonly string[], index: PlanIndex): string;