eval-quality 0.1.0

package/corpus/dev/contracts/split-indicator-oracle.json

@@ -0,0 +1 @@
+{"behaviors":[{"description":"A created thing is readable back in the list of things.","id":"B-001","observableSuccessCriterion":"A list call after a create returns one element per seeded thing, carrying the name the create call sent.","oracles":["O-001","O-002","O-003","O-004","O-005","O-006","O-007"],"requirementLinks":[{"id":"REQ-1","scheme":"local"}],"riskLinks":[{"id":"RISK-1","scheme":"local-risk"}],"severity":"critical"}],"budgets":{"maxCostUsd":"0.25","maxToolCalls":20,"maxWallClockMinutes":5},"contractId":"split-indicator-oracle","fixtureReset":null,"forbiddenInputs":["original-spec","source-code","repository","builder-transcript","implementation-logs","comparator-results","human-labels"],"interactionPlan":[{"after":null,"inputBinding":{"body":{"name":{"matcher":"any"}},"header":null,"path":null,"query":null},"operationId":"create-thing","stepId":"create"},{"after":"create","inputBinding":{"body":null,"header":null,"path":null,"query":{"limit":{"literal":10}}},"operationId":"list-things","stepId":"list"},{"after":null,"inputBinding":{"body":{"name":{"matcher":"type-violating"}},"header":null,"path":null,"query":null},"operationId":"create-thing","stepId":"malformed-create"},{"after":null,"inputBinding":{"body":null,"header":null,"path":null,"query":{"limit":{"matcher":"type-violating"}}},"operationId":"list-things","stepId":"malformed-list"}],"oracles":[{"check":{"actualKey":"id","expectedKey":"id","op":"covers-by-key","operands":[{"referenceSet":"expected-things"},{"pointer":"/interactions/list/response-body/items"}]},"commentary":"Reconciles the whole list against the declared set.","direction":{"evidenceTargets":["/interactions/list/response-body/items"],"negativeDomain":"A list omitting a seeded thing, or repeating one.","polarity":"expects-hold","relation":"covers-by-key","scope":"One list call over the seeded set."},"id":"O-001","polarity":"expects-hold"},{"check":{"op":"existence","operands":[{"pointer":"/interactions/create/response-body/ok"}]},"commentary":null,"direction":{"evidenceTargets":["/interactions/create/response-body/ok"],"negativeDomain":"A create response carrying no indicator at all.","polarity":"expects-hold","relation":"existence","scope":"The create response indicator, read on its own."},"id":"O-002","polarity":"expects-hold"},{"check":{"op":"all","operands":[{"op":"existence","operands":[{"pointer":"/interactions/list/response-body/items"}]},{"op":"absence","operands":[{"pointer":"/interactions/list/response-body/error"}]}]},"commentary":null,"direction":{"evidenceTargets":["/interactions/list/response-body/items","/interactions/list/response-body/error"],"negativeDomain":"A list carrying items alongside a diagnostic field.","polarity":"expects-hold","relation":"all","scope":"The list response taken as a whole."},"id":"O-003","polarity":"expects-hold"},{"check":{"op":"all","operands":[{"op":"existence","operands":[{"pointer":"/interactions/malformed-create/response-body/error"}]},{"op":"existence","operands":[{"pointer":"/interactions/malformed-list/response-body/error"}]}]},"commentary":null,"direction":{"evidenceTargets":["/interactions/malformed-create/response-body/error","/interactions/malformed-list/response-body/error"],"negativeDomain":"One sibling rejecting the malformed input while the other accepts it.","polarity":"expects-hold","relation":"all","scope":"Both sibling operations, each given an input that violates its declared type."},"id":"O-004","polarity":"expects-hold"},{"check":{"op":"all","operands":[{"op":"existence","operands":[{"pointer":"/interactions/create/call-inputs/body/name"}]},{"op":"existence","operands":[{"pointer":"/interactions/list/call-inputs/query/limit"}]}]},"commentary":null,"direction":{"evidenceTargets":["/interactions/create/call-inputs/body/name","/interactions/list/call-inputs/query/limit"],"negativeDomain":"One parameter carried and the other dropped.","polarity":"expects-hold","relation":"all","scope":"The two sibling parameters, as sent."},"id":"O-005","polarity":"expects-hold"},{"check":{"op":"containment","operands":[{"pointer":"/interactions/list/response-body/items"},{"pointer":"/interactions/create/call-inputs/body/name"}]},"commentary":null,"direction":{"evidenceTargets":["/interactions/list/response-body/items","/interactions/create/call-inputs/body/name"],"negativeDomain":"A create reporting success whose thing never appears in a later list.","polarity":"expects-hold","relation":"containment","scope":"The list read after the create, against the name the create sent."},"id":"O-006","polarity":"expects-hold"},{"check":{"collection":{"pointer":"/interactions/list/response-body/items"},"op":"for-all","predicate":{"op":"existence","operands":[{"pointer":"@/id"}]}},"commentary":null,"direction":{"evidenceTargets":["/interactions/list/response-body/items"],"negativeDomain":"A list whose first element carries an identifier and whose later elements do not.","polarity":"expects-hold","relation":"for-all","scope":"Every element of the returned list."},"id":"O-007","polarity":"expects-hold"}],"parentDigest":null,"permittedInterfaces":[{"kind":"api","logicalId":"thing-api","operations":[{"method":"POST","operationId":"create-thing","pathTemplate":"/things","requestShape":{"body":{"permittedKeys":["name"],"requiredKeys":["name"],"types":{"name":"string"}},"header":{"permittedKeys":[],"requiredKeys":[],"types":{}},"path":{"permittedKeys":[],"requiredKeys":[],"types":{}},"query":{"permittedKeys":[],"requiredKeys":[],"types":{}}},"responseDescriptor":{"channelRoles":{"/error":"diagnostic","/id":"payload","/ok":"success-indicator"},"collectionLocations":[],"permittedKeys":["id","ok","error"],"requiredKeys":["id","ok"],"successIndicator":"/ok","types":{"error":"string","id":"string","ok":"boolean"}},"sensitivityWitness":{"channel":"body","legs":[{"inputs":{"body":{"kind":"json","value":{"name":"alpha"}},"header":{},"path":{},"query":{}},"legId":"create-witness-a"},{"inputs":{"body":{"kind":"json","value":{"name":"beta"}},"header":{},"path":{},"query":{}},"legId":"create-witness-b"}],"relation":{"op":"not","operands":[{"op":"deep-equality","operands":[{"pointer":"/interactions/create-witness-a/response-body"},{"pointer":"/interactions/create-witness-b/response-body"}]}]},"witnessId":"create-thing-sensitivity"},"stateChangeMarker":true,"volatilePointers":["/id"]},{"method":"GET","operationId":"list-things","pathTemplate":"/things","requestShape":{"body":{"permittedKeys":[],"requiredKeys":[],"types":{}},"header":{"permittedKeys":[],"requiredKeys":[],"types":{}},"path":{"permittedKeys":[],"requiredKeys":[],"types":{}},"query":{"permittedKeys":["limit"],"requiredKeys":[],"types":{"limit":"number"}}},"responseDescriptor":{"channelRoles":{"/error":"diagnostic","/items":"collection"},"collectionLocations":[{"expectedCardinality":{"count":3,"mode":"exact"},"pointer":"/items","referenceSet":"expected-things"}],"permittedKeys":["items","error"],"requiredKeys":["items"],"successIndicator":"/items","types":{"error":"string","items":"array"}},"sensitivityWitness":{"channel":"query","legs":[{"inputs":{"body":{"kind":"absent"},"header":{},"path":{},"query":{"limit":1}},"legId":"list-witness-a"},{"inputs":{"body":{"kind":"absent"},"header":{},"path":{},"query":{"limit":2}},"legId":"list-witness-b"}],"relation":{"op":"not","operands":[{"op":"deep-equality","operands":[{"pointer":"/interactions/list-witness-a/response-body"},{"pointer":"/interactions/list-witness-b/response-body"}]}]},"witnessId":"list-things-sensitivity"},"stateChangeMarker":false,"volatilePointers":[]}]}],"probeStepBound":8,"referenceSets":{"expected-things":{"commentary":null,"keys":["id"],"members":[{"id":"t-1"},{"id":"t-2"},{"id":"t-3"}]}},"requiredEvidence":["Request and response pair for every call, in order."],"revisionCount":0,"rubrics":[{"criteria":[{"evidence":"/interactions/list/response-body/items","id":"RC-001","text":"Does the returned list carry every expected identifier?"}],"failureModePenalties":[{"description":"An expected thing is missing.","name":"omission"}],"id":"R-001","maxLength":400,"scaleLevels":[{"anchor":"Every expected thing is present.","level":1}]}],"safetyLimits":["No request to any host other than the mapped thing-api target."],"schemaVersion":1,"scopedResources":null,"siblingGroups":{"operations":[["create-thing","list-things"]],"parameters":[["limit","name"]]},"sourceSpecDigest":null,"testData":{"cleanup":"Delete every thing created during the run.","setup":"Seed exactly three things with identifiers t-1, t-2, t-3."},"waivers":[{"approval":"gate-c-reviewer","condition":null,"expiresAt":"2027-01-01T00:00:00Z","id":"W-001","rationale":"The upstream seed is unavailable in the sandbox environment.","rule":"omission-and-completeness"}]}

package/corpus/dev/contracts/unaddressed-parameter-sibling.json

@@ -0,0 +1 @@
+{"behaviors":[{"description":"A created thing is readable back in the list of things.","id":"B-001","observableSuccessCriterion":"A list call after a create returns one element per seeded thing, carrying the name the create call sent.","oracles":["O-001","O-002","O-003","O-004","O-005","O-006","O-007"],"requirementLinks":[{"id":"REQ-1","scheme":"local"}],"riskLinks":[{"id":"RISK-1","scheme":"local-risk"}],"severity":"critical"}],"budgets":{"maxCostUsd":"0.25","maxToolCalls":20,"maxWallClockMinutes":5},"contractId":"unaddressed-parameter-sibling","fixtureReset":null,"forbiddenInputs":["original-spec","source-code","repository","builder-transcript","implementation-logs","comparator-results","human-labels"],"interactionPlan":[{"after":null,"inputBinding":{"body":{"name":{"matcher":"any"}},"header":null,"path":null,"query":null},"operationId":"create-thing","stepId":"create"},{"after":"create","inputBinding":{"body":null,"header":null,"path":null,"query":{"limit":{"literal":10}}},"operationId":"list-things","stepId":"list"},{"after":null,"inputBinding":{"body":{"name":{"matcher":"type-violating"}},"header":null,"path":null,"query":null},"operationId":"create-thing","stepId":"malformed-create"},{"after":null,"inputBinding":{"body":null,"header":null,"path":null,"query":{"limit":{"matcher":"type-violating"}}},"operationId":"list-things","stepId":"malformed-list"}],"oracles":[{"check":{"actualKey":"id","expectedKey":"id","op":"covers-by-key","operands":[{"referenceSet":"expected-things"},{"pointer":"/interactions/list/response-body/items"}]},"commentary":"Reconciles the whole list against the declared set.","direction":{"evidenceTargets":["/interactions/list/response-body/items"],"negativeDomain":"A list omitting a seeded thing, or repeating one.","polarity":"expects-hold","relation":"covers-by-key","scope":"One list call over the seeded set."},"id":"O-001","polarity":"expects-hold"},{"check":{"op":"all","operands":[{"op":"existence","operands":[{"pointer":"/interactions/create/response-body/ok"}]},{"op":"existence","operands":[{"pointer":"/interactions/create/response-body/id"}]},{"op":"absence","operands":[{"pointer":"/interactions/create/response-body/error"}]}]},"commentary":null,"direction":{"evidenceTargets":["/interactions/create/response-body/ok","/interactions/create/response-body/id","/interactions/create/response-body/error"],"negativeDomain":"A create reporting success with no identifier, or with a diagnostic beside it.","polarity":"expects-hold","relation":"all","scope":"The whole create response."},"id":"O-002","polarity":"expects-hold"},{"check":{"op":"all","operands":[{"op":"existence","operands":[{"pointer":"/interactions/list/response-body/items"}]},{"op":"absence","operands":[{"pointer":"/interactions/list/response-body/error"}]}]},"commentary":null,"direction":{"evidenceTargets":["/interactions/list/response-body/items","/interactions/list/response-body/error"],"negativeDomain":"A list carrying items alongside a diagnostic field.","polarity":"expects-hold","relation":"all","scope":"The list response taken as a whole."},"id":"O-003","polarity":"expects-hold"},{"check":{"op":"all","operands":[{"op":"existence","operands":[{"pointer":"/interactions/malformed-create/response-body/error"}]},{"op":"existence","operands":[{"pointer":"/interactions/malformed-list/response-body/error"}]}]},"commentary":null,"direction":{"evidenceTargets":["/interactions/malformed-create/response-body/error","/interactions/malformed-list/response-body/error"],"negativeDomain":"One sibling rejecting the malformed input while the other accepts it.","polarity":"expects-hold","relation":"all","scope":"Both sibling operations, each given an input that violates its declared type."},"id":"O-004","polarity":"expects-hold"},{"check":{"op":"all","operands":[{"op":"existence","operands":[{"pointer":"/interactions/create/call-inputs/body/name"}]},{"op":"existence","operands":[{"pointer":"/interactions/list/call-inputs/query/limit"}]}]},"commentary":null,"direction":{"evidenceTargets":["/interactions/create/call-inputs/body/name","/interactions/list/call-inputs/query/limit"],"negativeDomain":"One parameter carried and the other dropped.","polarity":"expects-hold","relation":"all","scope":"The two sibling parameters, as sent."},"id":"O-005","polarity":"expects-hold"},{"check":{"op":"containment","operands":[{"pointer":"/interactions/list/response-body/items"},{"pointer":"/interactions/create/call-inputs/body/name"}]},"commentary":null,"direction":{"evidenceTargets":["/interactions/list/response-body/items","/interactions/create/call-inputs/body/name"],"negativeDomain":"A create reporting success whose thing never appears in a later list.","polarity":"expects-hold","relation":"containment","scope":"The list read after the create, against the name the create sent."},"id":"O-006","polarity":"expects-hold"},{"check":{"collection":{"pointer":"/interactions/list/response-body/items"},"op":"for-all","predicate":{"op":"existence","operands":[{"pointer":"@/id"}]}},"commentary":null,"direction":{"evidenceTargets":["/interactions/list/response-body/items"],"negativeDomain":"A list whose first element carries an identifier and whose later elements do not.","polarity":"expects-hold","relation":"for-all","scope":"Every element of the returned list."},"id":"O-007","polarity":"expects-hold"}],"parentDigest":null,"permittedInterfaces":[{"kind":"api","logicalId":"thing-api","operations":[{"method":"POST","operationId":"create-thing","pathTemplate":"/things","requestShape":{"body":{"permittedKeys":["name"],"requiredKeys":["name"],"types":{"name":"string"}},"header":{"permittedKeys":[],"requiredKeys":[],"types":{}},"path":{"permittedKeys":[],"requiredKeys":[],"types":{}},"query":{"permittedKeys":[],"requiredKeys":[],"types":{}}},"responseDescriptor":{"channelRoles":{"/error":"diagnostic","/id":"payload","/ok":"success-indicator"},"collectionLocations":[],"permittedKeys":["id","ok","error"],"requiredKeys":["id","ok"],"successIndicator":"/ok","types":{"error":"string","id":"string","ok":"boolean"}},"sensitivityWitness":{"channel":"body","legs":[{"inputs":{"body":{"kind":"json","value":{"name":"alpha"}},"header":{},"path":{},"query":{}},"legId":"create-witness-a"},{"inputs":{"body":{"kind":"json","value":{"name":"beta"}},"header":{},"path":{},"query":{}},"legId":"create-witness-b"}],"relation":{"op":"not","operands":[{"op":"deep-equality","operands":[{"pointer":"/interactions/create-witness-a/response-body"},{"pointer":"/interactions/create-witness-b/response-body"}]}]},"witnessId":"create-thing-sensitivity"},"stateChangeMarker":true,"volatilePointers":["/id"]},{"method":"GET","operationId":"list-things","pathTemplate":"/things","requestShape":{"body":{"permittedKeys":[],"requiredKeys":[],"types":{}},"header":{"permittedKeys":[],"requiredKeys":[],"types":{}},"path":{"permittedKeys":[],"requiredKeys":[],"types":{}},"query":{"permittedKeys":["limit"],"requiredKeys":[],"types":{"limit":"number"}}},"responseDescriptor":{"channelRoles":{"/error":"diagnostic","/items":"collection"},"collectionLocations":[{"expectedCardinality":{"count":3,"mode":"exact"},"pointer":"/items","referenceSet":"expected-things"}],"permittedKeys":["items","error"],"requiredKeys":["items"],"successIndicator":"/items","types":{"error":"string","items":"array"}},"sensitivityWitness":{"channel":"query","legs":[{"inputs":{"body":{"kind":"absent"},"header":{},"path":{},"query":{"limit":1}},"legId":"list-witness-a"},{"inputs":{"body":{"kind":"absent"},"header":{},"path":{},"query":{"limit":2}},"legId":"list-witness-b"}],"relation":{"op":"not","operands":[{"op":"deep-equality","operands":[{"pointer":"/interactions/list-witness-a/response-body"},{"pointer":"/interactions/list-witness-b/response-body"}]}]},"witnessId":"list-things-sensitivity"},"stateChangeMarker":false,"volatilePointers":[]}]}],"probeStepBound":8,"referenceSets":{"expected-things":{"commentary":null,"keys":["id"],"members":[{"id":"t-1"},{"id":"t-2"},{"id":"t-3"}]}},"requiredEvidence":["Request and response pair for every call, in order."],"revisionCount":0,"rubrics":[{"criteria":[{"evidence":"/interactions/list/response-body/items","id":"RC-001","text":"Does the returned list carry every expected identifier?"}],"failureModePenalties":[{"description":"An expected thing is missing.","name":"omission"}],"id":"R-001","maxLength":400,"scaleLevels":[{"anchor":"Every expected thing is present.","level":1}]}],"safetyLimits":["No request to any host other than the mapped thing-api target."],"schemaVersion":1,"scopedResources":null,"siblingGroups":{"operations":[["create-thing","list-things"]],"parameters":[["limit","offset"]]},"sourceSpecDigest":null,"testData":{"cleanup":"Delete every thing created during the run.","setup":"Seed exactly three things with identifiers t-1, t-2, t-3."},"waivers":[{"approval":"gate-c-reviewer","condition":null,"expiresAt":"2027-01-01T00:00:00Z","id":"W-001","rationale":"The upstream seed is unavailable in the sandbox environment.","rule":"omission-and-completeness"}]}

package/corpus/dev/contracts/unnamed-reference-set.json

@@ -0,0 +1 @@
+{"behaviors":[{"description":"A created thing is readable back in the list of things.","id":"B-001","observableSuccessCriterion":"A list call after a create returns one element per seeded thing, carrying the name the create call sent.","oracles":["O-001","O-002","O-003","O-004","O-005","O-006","O-007"],"requirementLinks":[{"id":"REQ-1","scheme":"local"}],"riskLinks":[{"id":"RISK-1","scheme":"local-risk"}],"severity":"critical"}],"budgets":{"maxCostUsd":"0.25","maxToolCalls":20,"maxWallClockMinutes":5},"contractId":"unnamed-reference-set","fixtureReset":null,"forbiddenInputs":["original-spec","source-code","repository","builder-transcript","implementation-logs","comparator-results","human-labels"],"interactionPlan":[{"after":null,"inputBinding":{"body":{"name":{"matcher":"any"}},"header":null,"path":null,"query":null},"operationId":"create-thing","stepId":"create"},{"after":"create","inputBinding":{"body":null,"header":null,"path":null,"query":{"limit":{"literal":10}}},"operationId":"list-things","stepId":"list"},{"after":null,"inputBinding":{"body":{"name":{"matcher":"type-violating"}},"header":null,"path":null,"query":null},"operationId":"create-thing","stepId":"malformed-create"},{"after":null,"inputBinding":{"body":null,"header":null,"path":null,"query":{"limit":{"matcher":"type-violating"}}},"operationId":"list-things","stepId":"malformed-list"}],"oracles":[{"check":{"actualKey":"id","expectedKey":"id","op":"covers-by-key","operands":[{"referenceSet":"expected-things"},{"pointer":"/interactions/list/response-body/items"}]},"commentary":"Reconciles the whole list against the declared set.","direction":{"evidenceTargets":["/interactions/list/response-body/items"],"negativeDomain":"A list omitting a seeded thing, or repeating one.","polarity":"expects-hold","relation":"covers-by-key","scope":"One list call over the seeded set."},"id":"O-001","polarity":"expects-hold"},{"check":{"op":"all","operands":[{"op":"existence","operands":[{"pointer":"/interactions/create/response-body/ok"}]},{"op":"existence","operands":[{"pointer":"/interactions/create/response-body/id"}]},{"op":"absence","operands":[{"pointer":"/interactions/create/response-body/error"}]}]},"commentary":null,"direction":{"evidenceTargets":["/interactions/create/response-body/ok","/interactions/create/response-body/id","/interactions/create/response-body/error"],"negativeDomain":"A create reporting success with no identifier, or with a diagnostic beside it.","polarity":"expects-hold","relation":"all","scope":"The whole create response."},"id":"O-002","polarity":"expects-hold"},{"check":{"op":"all","operands":[{"op":"existence","operands":[{"pointer":"/interactions/list/response-body/items"}]},{"op":"absence","operands":[{"pointer":"/interactions/list/response-body/error"}]}]},"commentary":null,"direction":{"evidenceTargets":["/interactions/list/response-body/items","/interactions/list/response-body/error"],"negativeDomain":"A list carrying items alongside a diagnostic field.","polarity":"expects-hold","relation":"all","scope":"The list response taken as a whole."},"id":"O-003","polarity":"expects-hold"},{"check":{"op":"all","operands":[{"op":"existence","operands":[{"pointer":"/interactions/malformed-create/response-body/error"}]},{"op":"existence","operands":[{"pointer":"/interactions/malformed-list/response-body/error"}]}]},"commentary":null,"direction":{"evidenceTargets":["/interactions/malformed-create/response-body/error","/interactions/malformed-list/response-body/error"],"negativeDomain":"One sibling rejecting the malformed input while the other accepts it.","polarity":"expects-hold","relation":"all","scope":"Both sibling operations, each given an input that violates its declared type."},"id":"O-004","polarity":"expects-hold"},{"check":{"op":"all","operands":[{"op":"existence","operands":[{"pointer":"/interactions/create/call-inputs/body/name"}]},{"op":"existence","operands":[{"pointer":"/interactions/list/call-inputs/query/limit"}]}]},"commentary":null,"direction":{"evidenceTargets":["/interactions/create/call-inputs/body/name","/interactions/list/call-inputs/query/limit"],"negativeDomain":"One parameter carried and the other dropped.","polarity":"expects-hold","relation":"all","scope":"The two sibling parameters, as sent."},"id":"O-005","polarity":"expects-hold"},{"check":{"op":"containment","operands":[{"pointer":"/interactions/list/response-body/items"},{"pointer":"/interactions/create/call-inputs/body/name"}]},"commentary":null,"direction":{"evidenceTargets":["/interactions/list/response-body/items","/interactions/create/call-inputs/body/name"],"negativeDomain":"A create reporting success whose thing never appears in a later list.","polarity":"expects-hold","relation":"containment","scope":"The list read after the create, against the name the create sent."},"id":"O-006","polarity":"expects-hold"},{"check":{"collection":{"pointer":"/interactions/list/response-body/items"},"op":"for-all","predicate":{"op":"existence","operands":[{"pointer":"@/id"}]}},"commentary":null,"direction":{"evidenceTargets":["/interactions/list/response-body/items"],"negativeDomain":"A list whose first element carries an identifier and whose later elements do not.","polarity":"expects-hold","relation":"for-all","scope":"Every element of the returned list."},"id":"O-007","polarity":"expects-hold"}],"parentDigest":null,"permittedInterfaces":[{"kind":"api","logicalId":"thing-api","operations":[{"method":"POST","operationId":"create-thing","pathTemplate":"/things","requestShape":{"body":{"permittedKeys":["name"],"requiredKeys":["name"],"types":{"name":"string"}},"header":{"permittedKeys":[],"requiredKeys":[],"types":{}},"path":{"permittedKeys":[],"requiredKeys":[],"types":{}},"query":{"permittedKeys":[],"requiredKeys":[],"types":{}}},"responseDescriptor":{"channelRoles":{"/error":"diagnostic","/id":"payload","/ok":"success-indicator"},"collectionLocations":[],"permittedKeys":["id","ok","error"],"requiredKeys":["id","ok"],"successIndicator":"/ok","types":{"error":"string","id":"string","ok":"boolean"}},"sensitivityWitness":{"channel":"body","legs":[{"inputs":{"body":{"kind":"json","value":{"name":"alpha"}},"header":{},"path":{},"query":{}},"legId":"create-witness-a"},{"inputs":{"body":{"kind":"json","value":{"name":"beta"}},"header":{},"path":{},"query":{}},"legId":"create-witness-b"}],"relation":{"op":"not","operands":[{"op":"deep-equality","operands":[{"pointer":"/interactions/create-witness-a/response-body"},{"pointer":"/interactions/create-witness-b/response-body"}]}]},"witnessId":"create-thing-sensitivity"},"stateChangeMarker":true,"volatilePointers":["/id"]},{"method":"GET","operationId":"list-things","pathTemplate":"/things","requestShape":{"body":{"permittedKeys":[],"requiredKeys":[],"types":{}},"header":{"permittedKeys":[],"requiredKeys":[],"types":{}},"path":{"permittedKeys":[],"requiredKeys":[],"types":{}},"query":{"permittedKeys":["limit"],"requiredKeys":[],"types":{"limit":"number"}}},"responseDescriptor":{"channelRoles":{"/error":"diagnostic","/items":"collection"},"collectionLocations":[{"expectedCardinality":{"count":3,"mode":"exact"},"pointer":"/items","referenceSet":null}],"permittedKeys":["items","error"],"requiredKeys":["items"],"successIndicator":"/items","types":{"error":"string","items":"array"}},"sensitivityWitness":{"channel":"query","legs":[{"inputs":{"body":{"kind":"absent"},"header":{},"path":{},"query":{"limit":1}},"legId":"list-witness-a"},{"inputs":{"body":{"kind":"absent"},"header":{},"path":{},"query":{"limit":2}},"legId":"list-witness-b"}],"relation":{"op":"not","operands":[{"op":"deep-equality","operands":[{"pointer":"/interactions/list-witness-a/response-body"},{"pointer":"/interactions/list-witness-b/response-body"}]}]},"witnessId":"list-things-sensitivity"},"stateChangeMarker":false,"volatilePointers":[]}]}],"probeStepBound":8,"referenceSets":{"expected-things":{"commentary":null,"keys":["id"],"members":[{"id":"t-1"},{"id":"t-2"},{"id":"t-3"}]}},"requiredEvidence":["Request and response pair for every call, in order."],"revisionCount":0,"rubrics":[{"criteria":[{"evidence":"/interactions/list/response-body/items","id":"RC-001","text":"Does the returned list carry every expected identifier?"}],"failureModePenalties":[{"description":"An expected thing is missing.","name":"omission"}],"id":"R-001","maxLength":400,"scaleLevels":[{"anchor":"Every expected thing is present.","level":1}]}],"safetyLimits":["No request to any host other than the mapped thing-api target."],"schemaVersion":1,"scopedResources":null,"siblingGroups":{"operations":[["create-thing","list-things"]],"parameters":[["limit","name"]]},"sourceSpecDigest":null,"testData":{"cleanup":"Delete every thing created during the run.","setup":"Seed exactly three things with identifiers t-1, t-2, t-3."},"waivers":[{"approval":"gate-c-reviewer","condition":null,"expiresAt":"2027-01-01T00:00:00Z","id":"W-001","rationale":"The upstream seed is unavailable in the sandbox environment.","rule":"omission-and-completeness"}]}

package/corpus/dev/contracts/wrong-cardinality-form.json

@@ -0,0 +1 @@
+{"behaviors":[{"description":"A created thing is readable back in the list of things.","id":"B-001","observableSuccessCriterion":"A list call after a create returns one element per seeded thing, carrying the name the create call sent.","oracles":["O-001","O-002","O-003","O-004","O-005","O-006","O-007"],"requirementLinks":[{"id":"REQ-1","scheme":"local"}],"riskLinks":[{"id":"RISK-1","scheme":"local-risk"}],"severity":"critical"}],"budgets":{"maxCostUsd":"0.25","maxToolCalls":20,"maxWallClockMinutes":5},"contractId":"wrong-cardinality-form","fixtureReset":null,"forbiddenInputs":["original-spec","source-code","repository","builder-transcript","implementation-logs","comparator-results","human-labels"],"interactionPlan":[{"after":null,"inputBinding":{"body":{"name":{"matcher":"any"}},"header":null,"path":null,"query":null},"operationId":"create-thing","stepId":"create"},{"after":"create","inputBinding":{"body":null,"header":null,"path":null,"query":{"limit":{"literal":10}}},"operationId":"list-things","stepId":"list"},{"after":null,"inputBinding":{"body":{"name":{"matcher":"type-violating"}},"header":null,"path":null,"query":null},"operationId":"create-thing","stepId":"malformed-create"},{"after":null,"inputBinding":{"body":null,"header":null,"path":null,"query":{"limit":{"matcher":"type-violating"}}},"operationId":"list-things","stepId":"malformed-list"}],"oracles":[{"check":{"actualKey":"id","expectedKey":"id","op":"covers-by-key","operands":[{"referenceSet":"expected-things"},{"pointer":"/interactions/list/response-body/items"}]},"commentary":"Reconciles the whole list against the declared set.","direction":{"evidenceTargets":["/interactions/list/response-body/items"],"negativeDomain":"A list omitting a seeded thing, or repeating one.","polarity":"expects-hold","relation":"covers-by-key","scope":"One list call over the seeded set."},"id":"O-001","polarity":"expects-hold"},{"check":{"op":"all","operands":[{"op":"existence","operands":[{"pointer":"/interactions/create/response-body/ok"}]},{"op":"existence","operands":[{"pointer":"/interactions/create/response-body/id"}]},{"op":"absence","operands":[{"pointer":"/interactions/create/response-body/error"}]}]},"commentary":null,"direction":{"evidenceTargets":["/interactions/create/response-body/ok","/interactions/create/response-body/id","/interactions/create/response-body/error"],"negativeDomain":"A create reporting success with no identifier, or with a diagnostic beside it.","polarity":"expects-hold","relation":"all","scope":"The whole create response."},"id":"O-002","polarity":"expects-hold"},{"check":{"op":"all","operands":[{"op":"existence","operands":[{"pointer":"/interactions/list/response-body/items"}]},{"op":"absence","operands":[{"pointer":"/interactions/list/response-body/error"}]}]},"commentary":null,"direction":{"evidenceTargets":["/interactions/list/response-body/items","/interactions/list/response-body/error"],"negativeDomain":"A list carrying items alongside a diagnostic field.","polarity":"expects-hold","relation":"all","scope":"The list response taken as a whole."},"id":"O-003","polarity":"expects-hold"},{"check":{"op":"all","operands":[{"op":"existence","operands":[{"pointer":"/interactions/malformed-create/response-body/error"}]},{"op":"existence","operands":[{"pointer":"/interactions/malformed-list/response-body/error"}]}]},"commentary":null,"direction":{"evidenceTargets":["/interactions/malformed-create/response-body/error","/interactions/malformed-list/response-body/error"],"negativeDomain":"One sibling rejecting the malformed input while the other accepts it.","polarity":"expects-hold","relation":"all","scope":"Both sibling operations, each given an input that violates its declared type."},"id":"O-004","polarity":"expects-hold"},{"check":{"op":"all","operands":[{"op":"existence","operands":[{"pointer":"/interactions/create/call-inputs/body/name"}]},{"op":"existence","operands":[{"pointer":"/interactions/list/call-inputs/query/limit"}]}]},"commentary":null,"direction":{"evidenceTargets":["/interactions/create/call-inputs/body/name","/interactions/list/call-inputs/query/limit"],"negativeDomain":"One parameter carried and the other dropped.","polarity":"expects-hold","relation":"all","scope":"The two sibling parameters, as sent."},"id":"O-005","polarity":"expects-hold"},{"check":{"op":"containment","operands":[{"pointer":"/interactions/list/response-body/items"},{"pointer":"/interactions/create/call-inputs/body/name"}]},"commentary":null,"direction":{"evidenceTargets":["/interactions/list/response-body/items","/interactions/create/call-inputs/body/name"],"negativeDomain":"A create reporting success whose thing never appears in a later list.","polarity":"expects-hold","relation":"containment","scope":"The list read after the create, against the name the create sent."},"id":"O-006","polarity":"expects-hold"},{"check":{"collection":{"pointer":"/interactions/list/response-body/items"},"op":"for-all","predicate":{"op":"existence","operands":[{"pointer":"@/id"}]}},"commentary":null,"direction":{"evidenceTargets":["/interactions/list/response-body/items"],"negativeDomain":"A list whose first element carries an identifier and whose later elements do not.","polarity":"expects-hold","relation":"for-all","scope":"Every element of the returned list."},"id":"O-007","polarity":"expects-hold"}],"parentDigest":null,"permittedInterfaces":[{"kind":"api","logicalId":"thing-api","operations":[{"method":"POST","operationId":"create-thing","pathTemplate":"/things","requestShape":{"body":{"permittedKeys":["name"],"requiredKeys":["name"],"types":{"name":"string"}},"header":{"permittedKeys":[],"requiredKeys":[],"types":{}},"path":{"permittedKeys":[],"requiredKeys":[],"types":{}},"query":{"permittedKeys":[],"requiredKeys":[],"types":{}}},"responseDescriptor":{"channelRoles":{"/error":"diagnostic","/id":"payload","/ok":"success-indicator"},"collectionLocations":[],"permittedKeys":["id","ok","error"],"requiredKeys":["id","ok"],"successIndicator":"/ok","types":{"error":"string","id":"string","ok":"boolean"}},"sensitivityWitness":{"channel":"body","legs":[{"inputs":{"body":{"kind":"json","value":{"name":"alpha"}},"header":{},"path":{},"query":{}},"legId":"create-witness-a"},{"inputs":{"body":{"kind":"json","value":{"name":"beta"}},"header":{},"path":{},"query":{}},"legId":"create-witness-b"}],"relation":{"op":"not","operands":[{"op":"deep-equality","operands":[{"pointer":"/interactions/create-witness-a/response-body"},{"pointer":"/interactions/create-witness-b/response-body"}]}]},"witnessId":"create-thing-sensitivity"},"stateChangeMarker":true,"volatilePointers":["/id"]},{"method":"GET","operationId":"list-things","pathTemplate":"/things","requestShape":{"body":{"permittedKeys":[],"requiredKeys":[],"types":{}},"header":{"permittedKeys":[],"requiredKeys":[],"types":{}},"path":{"permittedKeys":[],"requiredKeys":[],"types":{}},"query":{"permittedKeys":["limit"],"requiredKeys":[],"types":{"limit":"number"}}},"responseDescriptor":{"channelRoles":{"/error":"diagnostic","/items":"collection"},"collectionLocations":[{"expectedCardinality":{"max":20,"mode":"page-bounded"},"pointer":"/items","referenceSet":"expected-things"}],"permittedKeys":["items","error"],"requiredKeys":["items"],"successIndicator":"/items","types":{"error":"string","items":"array"}},"sensitivityWitness":{"channel":"query","legs":[{"inputs":{"body":{"kind":"absent"},"header":{},"path":{},"query":{"limit":1}},"legId":"list-witness-a"},{"inputs":{"body":{"kind":"absent"},"header":{},"path":{},"query":{"limit":2}},"legId":"list-witness-b"}],"relation":{"op":"not","operands":[{"op":"deep-equality","operands":[{"pointer":"/interactions/list-witness-a/response-body"},{"pointer":"/interactions/list-witness-b/response-body"}]}]},"witnessId":"list-things-sensitivity"},"stateChangeMarker":false,"volatilePointers":[]}]}],"probeStepBound":8,"referenceSets":{"expected-things":{"commentary":null,"keys":["id"],"members":[{"id":"t-1"},{"id":"t-2"},{"id":"t-3"}]}},"requiredEvidence":["Request and response pair for every call, in order."],"revisionCount":0,"rubrics":[{"criteria":[{"evidence":"/interactions/list/response-body/items","id":"RC-001","text":"Does the returned list carry every expected identifier?"}],"failureModePenalties":[{"description":"An expected thing is missing.","name":"omission"}],"id":"R-001","maxLength":400,"scaleLevels":[{"anchor":"Every expected thing is present.","level":1}]}],"safetyLimits":["No request to any host other than the mapped thing-api target."],"schemaVersion":1,"scopedResources":null,"siblingGroups":{"operations":[["create-thing","list-things"]],"parameters":[["limit","name"]]},"sourceSpecDigest":null,"testData":{"cleanup":"Delete every thing created during the run.","setup":"Seed exactly three things with identifiers t-1, t-2, t-3."},"waivers":[{"approval":"gate-c-reviewer","condition":null,"expiresAt":"2027-01-01T00:00:00Z","id":"W-001","rationale":"The upstream seed is unavailable in the sandbox environment.","rule":"omission-and-completeness"}]}

package/corpus/dev/index.json

@@ -0,0 +1 @@
+{"entries":[{"digest":"sha256:678b28f21ed407e910d7a28d90c538fe1d538452c6e2aed73b63fa26bca6c261","kind":"readme","path":"corpus/dev/README.md"},{"digest":"sha256:93236f18b20c5e2e12695a02ae08029f5922969b309889cdf228acf1d8cbff0f","kind":"sealed-evaluator-brief","path":"corpus/dev/compile-seal-example/brief.json"},{"digest":"sha256:72bf8d824e4fca47c85a92a3da948ba4ff28e7f79fed5a8a2d5a9bbf77520c9f","kind":"contract","path":"corpus/dev/compile-seal-example/contract.json"},{"digest":"sha256:c704e4dde0274e37b5eece21426b9df08a3c100bcdaa2d942732af9496a1b864","kind":"contract","path":"corpus/dev/contracts/absent-collection-locations.json"},{"digest":"sha256:f14492a3c241ad25d733c156aaa6d22db2a3a98e213ffacf598ad3c56a702aa8","kind":"contract","path":"corpus/dev/contracts/absent-sibling-groups.json"},{"digest":"sha256:3beb5f7da47894a0012c3305acdad189c82c4ad0fb2c87f684c60ec97afd3fa2","kind":"contract","path":"corpus/dev/contracts/absent-success-indicator.json"},{"digest":"sha256:8975e0f522bf4b7061eab079d99e71066066131e6f0c2c6436a1cce4c7f83962","kind":"contract","path":"corpus/dev/contracts/empty-channel-roles.json"},{"digest":"sha256:c3074bb286c3b5511d46592e2651ce8197a67e7b7c11245e64b8225cbab33dba","kind":"contract","path":"corpus/dev/contracts/empty-collection-locations.json"},{"digest":"sha256:6134ce42e9527411547ade38350b01cc63cbb0f628f24f79ae44fdadfa8f9490","kind":"contract","path":"corpus/dev/contracts/empty-request-shapes.json","structuralFailure":"unreachable-check-evidence"},{"digest":"sha256:a185b05780198cbd3e34f11bd66f1ab6282db1ebe9039fc3eb5e6c4bbda10915","kind":"contract","path":"corpus/dev/contracts/empty-sibling-groups.json"},{"digest":"sha256:fdafe7821a1da815a10ecda53a4cb5aba140aad69b2aa8db5c9cbab0955a2255","kind":"contract","path":"corpus/dev/contracts/no-collection-quantifier.json"},{"digest":"sha256:ed3bce99108bb0962df4a165d28800428646b38d1a64be50a553a9da0356bbeb","kind":"contract","path":"corpus/dev/contracts/no-operation-inventory.json","structuralFailure":"unreachable-check-evidence"},{"digest":"sha256:358c1935f404c895c4f44c7da09747f22d1e11e0979f25f115242bc9021d4364","kind":"contract","path":"corpus/dev/contracts/no-read-back-relation.json"},{"digest":"sha256:e16fd44d0c867cba232623550b06772c7a3e8f34a9508aa667ab88104b18c125","kind":"contract","path":"corpus/dev/contracts/no-state-change-marker.json","structuralFailure":"undeclared-mandatory-input"},{"digest":"sha256:de356728c2da74ffc33068e0bb2613cb4ba9ac0e06541bfb184aa4726a7f345b","kind":"contract","path":"corpus/dev/contracts/no-type-violating-step.json"},{"digest":"sha256:7903eba8fbe4da5b54bb0b92f20e79603acb15d2b9967ae5328c7cfc402b0641","kind":"contract","path":"corpus/dev/contracts/per-key-split-oracles.json"},{"digest":"sha256:72bf8d824e4fca47c85a92a3da948ba4ff28e7f79fed5a8a2d5a9bbf77520c9f","kind":"contract","path":"corpus/dev/contracts/satisfied-declarations.json"},{"digest":"sha256:ef9efd8c852ba94f96c21d8b57fa25cf0c9aca0631fafb0e2bb3344cabd5c76d","kind":"contract","path":"corpus/dev/contracts/single-required-response-key.json"},{"digest":"sha256:ebda9682a128039dd426ca9698de86f648597670be67be8fec1f72a4896ef9cb","kind":"contract","path":"corpus/dev/contracts/split-indicator-oracle.json"},{"digest":"sha256:bf30708c3102e01a1e9a6797510a2e5a334f9f31b19750abdbfcbfcbc036f1eb","kind":"contract","path":"corpus/dev/contracts/unaddressed-parameter-sibling.json"},{"digest":"sha256:fd057febc0f27b82f949f0f5d57d78bc6249542502965739c021b0deb620cc4b","kind":"contract","path":"corpus/dev/contracts/unnamed-reference-set.json"},{"digest":"sha256:57d2e54261f6204eb77b99405a87ad8e5a69a87b85377ad3ce8f3e80eca446f3","kind":"contract","path":"corpus/dev/contracts/wrong-cardinality-form.json"}]}

package/dist/adapters/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The reference adapters, published at the `./adapters` subpath. AD-28 calls
+ * them conveniences and never a required path, so they sit behind their own
+ * subpath and the root barrel keeps the `root -> adapters` edge the matrix
+ * does not grant.
+ */
+export type { CorpusMechanism } from './local-corpus-adapter.ts';
+export { createLocalCorpusAdapter } from './local-corpus-adapter.ts';
+export type { FileSystemMechanism } from './node-file-system-adapter.ts';
+export { createNodeFileSystemAdapter } from './node-file-system-adapter.ts';
+export type { ClockMechanism } from './system-clock-adapter.ts';
+export { createSystemClockAdapter } from './system-clock-adapter.ts';

package/dist/adapters/index.js

@@ -0,0 +1,3 @@
+export { createLocalCorpusAdapter } from './local-corpus-adapter.js';
+export { createNodeFileSystemAdapter } from './node-file-system-adapter.js';
+export { createSystemClockAdapter } from './system-clock-adapter.js';

package/dist/adapters/local-corpus-adapter.d.ts

@@ -0,0 +1,7 @@
+import type { CorpusPort } from '../ports/corpus-port.ts';
+/** Returns `unknown` so the response parse stays falsifiable; see `port-boundary.ts`. */
+export type CorpusMechanism = (resolvedPath: string, signal: AbortSignal) => Promise<unknown>;
+export declare function createLocalCorpusAdapter(options: {
+    readonly root: string;
+    readonly mechanism?: CorpusMechanism;
+}): CorpusPort;

package/dist/adapters/local-corpus-adapter.js

@@ -0,0 +1,78 @@
+/** AD-8's corpus port over a caller-supplied root directory. */
+import { readFile, realpath } from 'node:fs/promises';
+import { isAbsolute, posix, relative, resolve, sep } from 'node:path';
+import { RuntimeFault } from '../core/schemas/faults.js';
+import { corpusResolveParsers } from '../ports/corpus-port.js';
+import { runPortMethod } from './port-boundary.js';
+const nodeCorpus = (path, signal) => readFile(path, { signal });
+function escaped(privateRef, detail) {
+    return new RuntimeFault('port-failure', 'CorpusResolveRequest', `the private reference "${privateRef}" ${detail}`);
+}
+/**
+ * The lexical half of the escape check, before any filesystem call. AD-8 calls
+ * the reference opaque and AD-18 keeps a private path out of an artifact; an
+ * opaque handle spellable as `../../etc/passwd` is neither.
+ */
+function assertNoLexicalEscape(privateRef) {
+    const normalized = posix.normalize(privateRef);
+    if (posix.isAbsolute(normalized)) {
+        throw escaped(privateRef, 'is absolute');
+    }
+    if (normalized.split('/').some((segment) => segment === '..')) {
+        throw escaped(privateRef, 'still contains a ".." segment after normalizing');
+    }
+}
+/**
+ * The real-path half. It needs a filesystem call, so it runs after the read,
+ * and it catches a symlink inside the root pointing outside it. The bytes are
+ * discarded. Running it first would make an absent file fail before the
+ * mechanism was called, and `single-underlying-call-on-failure` counts that
+ * call.
+ */
+async function assertInsideRoot(root, privateRef, target) {
+    let realRoot;
+    let realTarget;
+    try {
+        realRoot = await realpath(root);
+        realTarget = await realpath(target);
+    }
+    catch (error) {
+        throw new RuntimeFault('port-failure', 'CorpusResolveRequest', `the private reference "${privateRef}" could not be resolved to a real path inside the root`, { cause: error });
+    }
+    // `relative`, never a prefix compare: a root of `/` makes the prefix `//`,
+    // which no valid target starts with, so a prefix check rejects every file
+    // under a filesystem-root corpus.
+    const inside = relative(realRoot, realTarget);
+    if (inside !== '' &&
+        (isAbsolute(inside) || inside === '..' || inside.startsWith(`..${sep}`))) {
+        throw escaped(privateRef, 'resolves outside the corpus root');
+    }
+}
+export function createLocalCorpusAdapter(options) {
+    const mechanism = options.mechanism ?? nodeCorpus;
+    return {
+        resolve: (request, signal) => {
+            // Captured per call so `postcheck` reads the same path the mechanism
+            // was given.
+            let target = '';
+            return runPortMethod({
+                request,
+                requestParser: corpusResolveParsers.request,
+                responseParser: corpusResolveParsers.response,
+                requestPath: 'CorpusResolveRequest',
+                responsePath: 'CorpusResolveResponse',
+                signal,
+                precheck: (parsed) => {
+                    assertNoLexicalEscape(parsed.privateRef);
+                    target = resolve(options.root, parsed.privateRef);
+                },
+                mechanism: (_parsed, innerSignal) => mechanism(target, innerSignal),
+                postcheck: (parsed) => assertInsideRoot(options.root, parsed.privateRef, target),
+                assemble: (raw, parsed) => ({
+                    privateRef: parsed.privateRef,
+                    bytes: raw,
+                }),
+            });
+        },
+    };
+}

package/dist/adapters/node-file-system-adapter.d.ts

@@ -0,0 +1,7 @@
+import type { FileSystemPort } from '../ports/file-system-port.ts';
+/** Both return `unknown` so the response parse stays falsifiable; see `port-boundary.ts`. */
+export type FileSystemMechanism = {
+    readonly readFile: (path: string, signal: AbortSignal) => Promise<unknown>;
+    readonly writeFile: (path: string, bytes: Uint8Array, signal: AbortSignal) => Promise<unknown>;
+};
+export declare function createNodeFileSystemAdapter(mechanism?: FileSystemMechanism): FileSystemPort;

package/dist/adapters/node-file-system-adapter.js

@@ -0,0 +1,39 @@
+/** the file-system port over `node:fs/promises`. */
+import { readFile, writeFile } from 'node:fs/promises';
+import { fileReadParsers, fileWriteParsers } from '../ports/file-system-port.js';
+import { runPortMethod } from './port-boundary.js';
+const nodeFileSystem = {
+    readFile: (path, signal) => readFile(path, { signal }),
+    // `fs.writeFile` resolves to `undefined`, so the mechanism returns the byte
+    // count itself. Take it from the request and `FileWriteResponse.byteLength`
+    // is assembled from a value the adapter already holds, so the parse could
+    // never reject for `writeFile`.
+    writeFile: async (path, bytes, signal) => {
+        await writeFile(path, bytes, { signal });
+        return bytes.length;
+    },
+};
+export function createNodeFileSystemAdapter(mechanism = nodeFileSystem) {
+    return {
+        readFile: (request, signal) => runPortMethod({
+            request,
+            requestParser: fileReadParsers.request,
+            responseParser: fileReadParsers.response,
+            requestPath: 'FileReadRequest',
+            responsePath: 'FileReadResponse',
+            signal,
+            mechanism: (parsed, innerSignal) => mechanism.readFile(parsed.path, innerSignal),
+            assemble: (raw, parsed) => ({ path: parsed.path, bytes: raw }),
+        }),
+        writeFile: (request, signal) => runPortMethod({
+            request,
+            requestParser: fileWriteParsers.request,
+            responseParser: fileWriteParsers.response,
+            requestPath: 'FileWriteRequest',
+            responsePath: 'FileWriteResponse',
+            signal,
+            mechanism: (parsed, innerSignal) => mechanism.writeFile(parsed.path, parsed.bytes, innerSignal),
+            assemble: (raw, parsed) => ({ path: parsed.path, byteLength: raw }),
+        }),
+    };
+}

package/dist/adapters/port-boundary.d.ts

@@ -0,0 +1,18 @@
+import type { BoundaryParser } from '../ports/port.ts';
+export type PortMethodOptions<Request, Response> = {
+    readonly request: unknown;
+    readonly requestParser: BoundaryParser<Request>;
+    readonly responseParser: BoundaryParser<Response>;
+    /** the message schema's own name, matching `invokePort`. */
+    readonly requestPath: string;
+    readonly responsePath: string;
+    readonly signal: AbortSignal;
+    /** After the request parses, before the mechanism runs, so a refusal here costs no I/O. Throws its own `RuntimeFault`. */
+    readonly precheck?: (request: Request) => void;
+    readonly mechanism: (request: Request, signal: AbortSignal) => Promise<unknown>;
+    /** After the mechanism returns, for a check needing I/O of its own. Throws its own `RuntimeFault`. */
+    readonly postcheck?: (request: Request) => Promise<void>;
+    /** Builds the response shape from the mechanism's `unknown` result. */
+    readonly assemble: (raw: unknown, request: Request) => unknown;
+};
+export declare function runPortMethod<Request, Response>(options: PortMethodOptions<Request, Response>): Promise<Response>;

package/dist/adapters/port-boundary.js

@@ -0,0 +1,83 @@
+/**
+ * The five steps every adapter method runs. Three adapters share four port
+ * methods, and four hand-copied bodies would be four chances for one boundary
+ * to drift.
+ *
+ * Step 3 is where these adapters differ from `src/application/invoke-port.ts`.
+ * `invokePort` awaits the port and reads `signal.aborted` only in its `catch`,
+ * so a port that never settles makes `invokePort` never settle. AD-28 obliges
+ * a caller-supplied port to honour the signal itself, so `invokePort` may
+ * assume it; an adapter is what that obligation lands on. Fixture 54 asserts
+ * the divergence.
+ */
+import { RuntimeFault } from '../core/schemas/faults.js';
+/** Races one mechanism call against the signal. The listener is `{ once: true }` and removed in a `finally`, so nothing leaks. */
+async function raceAbort(signal, responsePath, call) {
+    if (signal.aborted) {
+        throw new RuntimeFault('aborted', responsePath, 'the signal aborted before the raced work began', { cause: signal.reason });
+    }
+    // Suppress unhandled late rejections if the race is won by abort
+    call.catch(() => { });
+    let listener;
+    try {
+        const aborted = new Promise((_resolve, reject) => {
+            listener = () => {
+                reject(new RuntimeFault('aborted', responsePath, 'the signal aborted while the mechanism was in flight', { cause: signal.reason }));
+            };
+            signal.addEventListener('abort', listener, { once: true });
+        });
+        return await Promise.race([call, aborted]);
+    }
+    finally {
+        if (listener !== undefined)
+            signal.removeEventListener('abort', listener);
+    }
+}
+export async function runPortMethod(options) {
+    const { request, requestParser, responseParser, requestPath, responsePath, signal, precheck, mechanism, postcheck, assemble, } = options;
+    // 1. An aborted call does not validate a request nobody will send.
+    if (signal.aborted) {
+        throw new RuntimeFault('aborted', requestPath, 'signal was already aborted before the port call', { cause: signal.reason });
+    }
+    // 2.
+    const parsedRequest = requestParser.safeParse(request);
+    if (!parsedRequest.success) {
+        throw new RuntimeFault('schema-parse-failure', requestPath, 'outbound request failed boundary validation', { cause: parsedRequest.error });
+    }
+    // 3. Exactly one mechanism call, raced against the abort.
+    let raw;
+    try {
+        precheck?.(parsedRequest.data);
+        raw = await raceAbort(signal, responsePath, mechanism(parsedRequest.data, signal));
+    }
+    catch (error) {
+        if (error instanceof RuntimeFault)
+            throw error;
+        if (signal.aborted) {
+            throw new RuntimeFault('aborted', responsePath, 'signal was aborted before the mechanism settled', { cause: error });
+        }
+        throw new RuntimeFault('port-failure', responsePath, 'the underlying mechanism threw or rejected', { cause: error });
+    }
+    // Raced too: `postcheck` does its own I/O (a `realpath` pair, for the corpus
+    // adapter), and an abort during that work has to reject rather than wait.
+    if (postcheck !== undefined) {
+        try {
+            await raceAbort(signal, responsePath, postcheck(parsedRequest.data));
+        }
+        catch (error) {
+            if (error instanceof RuntimeFault)
+                throw error;
+            throw new RuntimeFault('port-failure', responsePath, 'a post-call check threw or rejected', { cause: error });
+        }
+    }
+    // 4. A partial result or an in-band error object fails here like any other
+    // schema mismatch. That is why every mechanism returns `unknown`: give it a
+    // precise type and the adapter assembles the response from a value it
+    // already holds, so this parse could never reject.
+    const parsedResponse = responseParser.safeParse(assemble(raw, parsedRequest.data));
+    if (!parsedResponse.success) {
+        throw new RuntimeFault('port-contract-violation', responsePath, 'the mechanism result failed boundary validation', { cause: parsedResponse.error });
+    }
+    // 5.
+    return parsedResponse.data;
+}

package/dist/adapters/system-clock-adapter.d.ts

@@ -0,0 +1,10 @@
+/** AD-1's clock read, in the layer where a clock read is legal. */
+import type { ClockPort } from '../ports/clock-port.ts';
+/**
+ * `unknown`, and an `AbortSignal` even though a clock read cannot block. The
+ * suite counts underlying calls and drives an `in-band-error` scenario;
+ * neither is constructible against a mechanism whose return type already
+ * satisfies the response schema.
+ */
+export type ClockMechanism = (signal: AbortSignal) => Promise<unknown>;
+export declare function createSystemClockAdapter(mechanism?: ClockMechanism): ClockPort;

package/dist/adapters/system-clock-adapter.js

@@ -0,0 +1,18 @@
+/** AD-1's clock read, in the layer where a clock read is legal. */
+import { clockReadParsers } from '../ports/clock-port.js';
+import { runPortMethod } from './port-boundary.js';
+const systemClock = async () => new Date().toISOString();
+export function createSystemClockAdapter(mechanism = systemClock) {
+    return {
+        read: (request, signal) => runPortMethod({
+            request,
+            requestParser: clockReadParsers.request,
+            responseParser: clockReadParsers.response,
+            requestPath: 'ClockReadRequest',
+            responsePath: 'ClockReadResponse',
+            signal,
+            mechanism: (_parsed, innerSignal) => mechanism(innerSignal),
+            assemble: (raw) => ({ now: raw }),
+        }),
+    };
+}

package/dist/application/compile.d.ts

@@ -0,0 +1,4 @@
+import { EvalContract } from '../core/schemas/eval-contract.ts';
+export declare function compile(input: unknown, options?: {
+    readonly strict?: boolean;
+}): EvalContract;

package/dist/application/compile.js

@@ -0,0 +1,24 @@
+/**
+ * The synchronous application boundary for the compile stage: parses unknown
+ * input against `EvalContract`, applies AD-4's default-on strict mode, and
+ * delegates every structural decision to `core/compile/compile.ts`. Check
+ * selection, ordering, and structural decisions stay in core; this layer
+ * only validates and delegates.
+ *
+ * AD-34: compile needs no external observation, so this stays a plain
+ * synchronous function with no plan, reducer, promise, port, or `await`.
+ */
+import { compile as compileContract } from '../core/compile/compile.js';
+import { freezeArtifact } from '../core/lineage/freeze.js';
+import { EvalContract } from '../core/schemas/eval-contract.js';
+import { RuntimeFault } from '../core/schemas/faults.js';
+export function compile(input, options) {
+    const parsed = EvalContract.safeParse(input);
+    if (!parsed.success) {
+        throw new RuntimeFault('schema-parse-failure', 'EvalContract', 'input does not conform to the EvalContract schema', { cause: parsed.error });
+    }
+    // `parsed.data` is Zod's own deep clone of `input` on success, so the
+    // returned contract shares no mutable state with the caller's object.
+    // Every failure below propagates unchanged: nothing here catches.
+    return freezeArtifact(compileContract(parsed.data, { strict: options?.strict ?? true }));
+}

package/dist/application/diagnostics.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The caller-supplied diagnostic sink and the shape it receives. A plain
+ * callback: it returns nothing the core reads, so there is nothing to validate
+ * and nothing to await, which is why the logging convention keeps it out of
+ * `ports/`.
+ *
+ * Only stages carrying a run identifier emit. `compile` and `seal` take no run
+ * identifier, so a line either of them wrote would carry no run id and no
+ * stage, and they emit nothing.
+ */
+/** One diagnostic. `stage` is the emitting stage, never the command. */
+export type Diagnostic = {
+    readonly runId: string;
+    readonly stage: 'preflight';
+    readonly message: string;
+};
+export type DiagnosticSink = (diagnostic: Diagnostic) => void;
+/**
+ * Emits when a sink is present. A throwing sink is the caller's defect and
+ * propagates: discarding it would make a broken sink look like a quiet run.
+ */
+export declare function emit(sink: DiagnosticSink | undefined, diagnostic: Diagnostic): void;

package/dist/application/diagnostics.js

@@ -0,0 +1,18 @@
+/**
+ * The caller-supplied diagnostic sink and the shape it receives. A plain
+ * callback: it returns nothing the core reads, so there is nothing to validate
+ * and nothing to await, which is why the logging convention keeps it out of
+ * `ports/`.
+ *
+ * Only stages carrying a run identifier emit. `compile` and `seal` take no run
+ * identifier, so a line either of them wrote would carry no run id and no
+ * stage, and they emit nothing.
+ */
+/**
+ * Emits when a sink is present. A throwing sink is the caller's defect and
+ * propagates: discarding it would make a broken sink look like a quiet run.
+ */
+export function emit(sink, diagnostic) {
+    if (sink !== undefined)
+        sink(diagnostic);
+}

package/dist/application/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The application layer's published surface. `cli/` may import this layer and
+ * `adapters/` and nothing else; `src/index.ts` may import this layer and
+ * `core/schemas` and nothing else. Anything either of them needs out of
+ * `core/` is re-exported here, which is what keeps the dependency matrix
+ * unamended.
+ */
+export { digestArtifact, digestBytes, digestComposite, } from '../core/canonical/digest.ts';
+export type { FailureCode } from '../core/failure-codes.ts';
+export { FAILURE_CODES, StructuralFailure } from '../core/failure-codes.ts';
+export type { LineageChainReport, LineageFinding, } from '../core/lineage/chain.ts';
+export { validateLineageChain } from '../core/lineage/chain.ts';
+export { INTERCHANGE_ARTIFACT_KEYS } from '../core/schemas/artifact.ts';
+export type { RuntimeFaultCode } from '../core/schemas/faults.ts';
+export { RUNTIME_FAULT_CODES, RuntimeFault } from '../core/schemas/faults.ts';
+export type { EvaluatorRecommendation, Verdict, } from '../core/schemas/verdict.ts';
+export { EVALUATOR_RECOMMENDATIONS, VERDICTS, } from '../core/schemas/verdict.ts';
+export { compile } from './compile.ts';
+export type { Diagnostic, DiagnosticSink } from './diagnostics.ts';
+export type { PreflightFromObservationsOptions, RunPreflightOptions, } from './preflight.ts';
+export { preflightFromObservations, runPreflight } from './preflight.ts';
+export { seal } from './seal.ts';
+export { serializeArtifact } from './serialize.ts';

package/dist/application/index.js

@@ -0,0 +1,17 @@
+/**
+ * The application layer's published surface. `cli/` may import this layer and
+ * `adapters/` and nothing else; `src/index.ts` may import this layer and
+ * `core/schemas` and nothing else. Anything either of them needs out of
+ * `core/` is re-exported here, which is what keeps the dependency matrix
+ * unamended.
+ */
+export { digestArtifact, digestBytes, digestComposite, } from '../core/canonical/digest.js';
+export { FAILURE_CODES, StructuralFailure } from '../core/failure-codes.js';
+export { validateLineageChain } from '../core/lineage/chain.js';
+export { INTERCHANGE_ARTIFACT_KEYS } from '../core/schemas/artifact.js';
+export { RUNTIME_FAULT_CODES, RuntimeFault } from '../core/schemas/faults.js';
+export { EVALUATOR_RECOMMENDATIONS, VERDICTS, } from '../core/schemas/verdict.js';
+export { compile } from './compile.js';
+export { preflightFromObservations, runPreflight } from './preflight.js';
+export { seal } from './seal.js';
+export { serializeArtifact } from './serialize.js';

package/dist/application/invoke-port.d.ts

@@ -0,0 +1,2 @@
+import type { InvokePortOptions } from '../ports/port.ts';
+export declare function invokePort<Request, Response>(options: InvokePortOptions<Request, Response>): Promise<Response>;

package/dist/application/invoke-port.js

@@ -0,0 +1,45 @@
+/**
+ * The sole generic seam that awaits a port (AD-34: `application/` is the
+ * only layer that awaits). Validates both sides of a port call, invokes the
+ * supplied port method exactly once, preserves any declared `RuntimeFault`
+ * unchanged, and translates every other boundary failure into one of AD-28's
+ * three port-boundary codes. No retry, back-off, fallback call, logging,
+ * caching, mutation, or verdict conversion. Re-execution is a trial/cap
+ * decision under AD-6.
+ */
+import { RuntimeFault } from '../core/schemas/faults.js';
+export async function invokePort(options) {
+    const { request, requestParser, responseParser, port, signal, requestPath, responsePath, } = options;
+    // Checked before request validation: an aborted call never spends effort
+    // validating a request nobody will send.
+    if (signal.aborted) {
+        throw new RuntimeFault('aborted', requestPath, 'signal was already aborted before the port call', { cause: signal.reason });
+    }
+    const parsedRequest = requestParser.safeParse(request);
+    if (!parsedRequest.success) {
+        throw new RuntimeFault('schema-parse-failure', requestPath, 'outbound request failed boundary validation', { cause: parsedRequest.error });
+    }
+    let resolved;
+    try {
+        resolved = await port(parsedRequest.data, signal);
+    }
+    catch (error) {
+        if (error instanceof RuntimeFault)
+            throw error;
+        // Undeclared error: if the signal aborted while the call was in
+        // flight, that abort is the more meaningful fault; otherwise it is a
+        // genuine port failure.
+        if (signal.aborted) {
+            throw new RuntimeFault('aborted', responsePath, 'signal was aborted before the port settled', { cause: error });
+        }
+        throw new RuntimeFault('port-failure', responsePath, 'the port implementation threw or rejected', { cause: error });
+    }
+    // A partial result or an in-band error object fails validation like any
+    // other schema mismatch: invokePort never special-cases a shape with an
+    // "error" field itself; that is the response schema's job.
+    const parsedResponse = responseParser.safeParse(resolved);
+    if (!parsedResponse.success) {
+        throw new RuntimeFault('port-contract-violation', responsePath, 'the resolved value failed boundary validation', { cause: parsedResponse.error });
+    }
+    return parsedResponse.data;
+}