eval-quality 0.2.0 → 0.3.0

package/dist/core/schemas/pointer.js

@@ -16,10 +16,11 @@ export const EVIDENCE_CHANNELS = [
     'stdout',
     'stderr',
     'exit-code',
+    'artifact',
 ];
 export const EvidenceChannel = z.enum(EVIDENCE_CHANNELS).meta({
     id: 'EvidenceChannel',
-    description: "AD-26's closed evidence channel vocabulary. The same seven the interaction-rooted pointer addresses; a channel outside this set is a syntax error rather than an unreachable-evidence finding.",
+    description: "AD-26's closed evidence channel vocabulary. The same eight the interaction-rooted pointer addresses; a channel outside this set is a syntax error rather than an unreachable-evidence finding.",
 });
 /**
  * AD-19's four transport channels. `call-inputs` alone has no declared
@@ -31,11 +32,37 @@ export const TransportChannel = z.enum(TRANSPORT_CHANNELS).meta({
     id: 'TransportChannel',
     description: "AD-19's four transport channels. They are the segment `call-inputs` takes before its tail, and the four keys an observation's recorded call inputs are keyed by.",
 });
-// The three-way partition (tail-bearing, scalar, transport-rooted) is spelled
-// out and typed against the enum rather than rebuilt from it, so a typo fails
-// the typecheck; a test asserts it stays disjoint and exhaustive. A status or
-// exit code is scalar, so a pointer into one is a syntax error rather than an
-// unreachable-evidence finding.
+/**
+ * The four channels a command-kind operation accepts input on. They sit beside
+ * the transport channels because this module owns channel vocabulary, and the
+ * request shape that declares them has to name them without forward-declaring
+ * a tuple it does not own.
+ *
+ * `stdin` is the command analogue of `body` and inherits its asymmetry: a
+ * request shape declares it as a key map, while one witness leg supplies it as
+ * a tagged body value.
+ */
+export const COMMAND_CHANNELS = [
+    'argument',
+    'option',
+    'environment',
+    'stdin',
+];
+/**
+ * Every channel `call-inputs` may take as its next segment, both kinds
+ * together. A pointer is parsed with no contract in hand, so the grammar
+ * admits all eight and the question of which four a given operation may use is
+ * answered by reachability, which has the operation.
+ */
+export const INPUT_CHANNELS = [
+    ...TRANSPORT_CHANNELS,
+    ...COMMAND_CHANNELS,
+];
+// The four-way partition (tail-bearing, scalar, transport-rooted,
+// identifier-rooted) is spelled out and typed against the enum rather than
+// rebuilt from it, so a typo fails the typecheck; a test asserts it stays
+// disjoint and exhaustive. A status or exit code is scalar, so a pointer into
+// one is a syntax error rather than an unreachable-evidence finding.
 export const TAIL_BEARING_CHANNELS = [
     'response-body',
     'response-headers',
@@ -47,13 +74,67 @@ export const SCALAR_CHANNELS = [
     'exit-code',
 ];
 export const TRANSPORT_ROOTED_CHANNEL = 'call-inputs';
+// A fourth class rather than a fourth rule. AD-26's repair for `call-inputs`
+// is that "a channel that names one of several things needs a declared segment
+// to resolve against", and a written file is the same situation: an operation
+// may write several, so the pointer names which one before its tail. The only
+// difference from `call-inputs` is that the segment is an open identifier
+// rather than a closed enum, because the artifact names are the contract
+// author's own. What the segment resolves against is the operation's declared
+// `artifacts` list, and a name absent from it is `unresolved-artifact-reference`
+// rather than evidence that resolves absent.
+export const IDENTIFIER_ROOTED_CHANNEL = 'artifact';
+/**
+ * The response-side channels each kind produces, and neither produces the
+ * other's. Declared here rather than rebuilt from a description, so a channel
+ * added to the vocabulary has to be assigned to a side and a test can assert
+ * the two partition the response side exactly.
+ *
+ * `call-inputs` belongs to neither: it carries what was sent rather than what
+ * came back, and both kinds have it.
+ */
+export const API_RESPONSE_CHANNELS = [
+    'response-body',
+    'response-headers',
+    'response-status',
+];
+export const COMMAND_RESPONSE_CHANNELS = [
+    'stdout',
+    'stderr',
+    'exit-code',
+    'artifact',
+];
+/**
+ * Every channel but the identifier-rooted one, in the vocabulary's own order.
+ *
+ * Spelled out and typed against the enum rather than filtered from it: a filter
+ * widens to `EvidenceChannelName[]` and `z.enum` needs a tuple, and the whole
+ * point of the list is that adding a ninth channel has to be a decision about
+ * which side of this line it falls on rather than something a filter absorbs.
+ * `tests/schemas/pointer.test.ts` asserts it partitions the vocabulary with
+ * `IDENTIFIER_ROOTED_CHANNEL` exactly.
+ */
+export const NON_IDENTIFIER_ROOTED_CHANNELS = [
+    'response-body',
+    'response-headers',
+    'response-status',
+    'call-inputs',
+    'stdout',
+    'stderr',
+    'exit-code',
+];
+/** Every channel that carries what came back, whichever kind produced it. */
+export const RESPONSE_SIDE_CHANNELS = [
+    ...API_RESPONSE_CHANNELS,
+    ...COMMAND_RESPONSE_CHANNELS,
+];
 // An RFC 6901 reference token: any character but "/" and "~", plus the two
 // escapes. A token may be empty, which is RFC 6901's spelling for a key that is
 // the empty string.
 const TOKEN = '(?:[^/~]|~[01])*';
 const TAIL = `(?:/${TOKEN})*`;
 const alternation = (members) => members.join('|');
-export const INTERACTION_POINTER_PATTERN = new RegExp(`^/interactions/${IDENTIFIER_CHARSET_SOURCE}/(?:(?:${alternation(TAIL_BEARING_CHANNELS)})${TAIL}|(?:${alternation(SCALAR_CHANNELS)})|${TRANSPORT_ROOTED_CHANNEL}/(?:${alternation(TRANSPORT_CHANNELS)})${TAIL})$`);
+export const INTERACTION_POINTER_PATTERN = new RegExp(`^/interactions/${IDENTIFIER_CHARSET_SOURCE}/(?:(?:${alternation(TAIL_BEARING_CHANNELS)})${TAIL}|(?:${alternation(SCALAR_CHANNELS)})|${TRANSPORT_ROOTED_CHANNEL}/(?:${alternation(INPUT_CHANNELS)})${TAIL}|${IDENTIFIER_ROOTED_CHANNEL}/${IDENTIFIER_CHARSET_SOURCE}${TAIL})$`);
 export const BOUND_ELEMENT_POINTER_PATTERN = new RegExp(`^@(?:/${TOKEN})+$`);
 export const DESCRIPTOR_POINTER_PATTERN = new RegExp(`^(?:/${TOKEN})*$`);
 /**
@@ -63,7 +144,7 @@ export const DESCRIPTOR_POINTER_PATTERN = new RegExp(`^(?:/${TOKEN})*$`);
 export const InteractionPointer = z
     .string()
     .regex(INTERACTION_POINTER_PATTERN)
-    .describe('AD-26 interaction-rooted pointer: "/interactions/{stepId}/" followed by one channel of the closed vocabulary. `call-inputs` takes one of the four transport channels as its next segment; `response-status` and `exit-code` take no tail. Syntax only: whether the step exists and whether the evidence is reachable are compile-time checks, not schema checks.');
+    .describe('AD-26 interaction-rooted pointer: "/interactions/{stepId}/" followed by one channel of the closed vocabulary. `call-inputs` takes one input channel as its next segment, one of the four transport channels or one of the four command channels; `artifact` takes the identifier of a file the operation declares it writes; `response-status` and `exit-code` take no tail. Syntax only: whether the step exists and whether the evidence is reachable are compile-time checks, not schema checks.');
 /**
  * Spelling 2, bound-element relative. Consumer: a `{ pointer }` operand inside
  * a quantifier predicate. Never an evidence target, because AD-3 computes

package/dist/core/schemas/port-messages.d.ts

@@ -29,19 +29,16 @@ export declare const FileWriteResponse: z.ZodObject<{
     byteLength: z.ZodInt;
 }, z.core.$strict>;
 /**
- * AD-35: the request names a logical interface identifier and never a URL,
- * host, or port. Mapping the identifier to an authorized target is the
- * adapter's, from configuration outside the contract.
- *
- * No credential appears here. AD-18 forbids a credential value in a
- * declaration, and the values that reach this shape come from a declaration;
- * authorization material is the adapter's, supplied by the same mapping that
- * authorizes the target.
+ * A request to an interface that speaks HTTP. Tagged on `kind` so an adapter
+ * knows what it is being asked to do before it reads anything else, and so the
+ * two shapes cannot be confused for one another by a field that happens to be
+ * absent.
  */
-export declare const ProbeRequest: z.ZodObject<{
+export declare const ApiProbeRequest: z.ZodObject<{
     probeId: z.ZodString;
     interfaceId: z.ZodString;
     operationId: z.ZodString;
+    kind: z.ZodLiteral<"api">;
     method: z.ZodEnum<{
         DELETE: "DELETE";
         GET: "GET";
@@ -64,6 +61,90 @@ export declare const ProbeRequest: z.ZodObject<{
         }, z.core.$strict>], "kind">;
     }, z.core.$strict>;
 }, z.core.$strict>;
+/**
+ * A request to run a command.
+ *
+ * AD-35's rule is that a contract names a logical identifier and the caller
+ * maps it, and the analogue for a command is exactly the same shape: the
+ * `executable` is the logical name the contract declared, and the adapter maps
+ * it to something runnable from configuration outside the contract. No
+ * filesystem path, no interpreter, no shell string. The adapter builds the
+ * argument vector; it is never handed one to execute.
+ *
+ * `environment` is string-valued for the reason `header` is, and carries no
+ * credential for the reason AD-18 gives: authorization material is the
+ * adapter's, supplied by the same mapping that authorizes the target.
+ */
+export declare const CommandProbeRequest: z.ZodObject<{
+    probeId: z.ZodString;
+    interfaceId: z.ZodString;
+    operationId: z.ZodString;
+    kind: z.ZodLiteral<"cli">;
+    executable: z.ZodString;
+    subcommandPath: z.ZodArray<z.ZodString>;
+    channels: z.ZodObject<{
+        argument: z.ZodRecord<z.ZodString, z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>;
+        option: z.ZodRecord<z.ZodString, z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>;
+        environment: z.ZodRecord<z.ZodString, z.ZodString>;
+        stdin: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"json">;
+            value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"text">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"absent">;
+        }, z.core.$strict>], "kind">;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const ProbeRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    probeId: z.ZodString;
+    interfaceId: z.ZodString;
+    operationId: z.ZodString;
+    kind: z.ZodLiteral<"api">;
+    method: z.ZodEnum<{
+        DELETE: "DELETE";
+        GET: "GET";
+        HEAD: "HEAD";
+        OPTIONS: "OPTIONS";
+        PATCH: "PATCH";
+        POST: "POST";
+        PUT: "PUT";
+    }>;
+    pathTemplate: z.ZodString;
+    channels: z.ZodObject<{
+        path: z.ZodRecord<z.ZodString, z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>;
+        query: z.ZodRecord<z.ZodString, z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>;
+        header: z.ZodRecord<z.ZodString, z.ZodString>;
+        body: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"json">;
+            value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"absent">;
+        }, z.core.$strict>], "kind">;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    probeId: z.ZodString;
+    interfaceId: z.ZodString;
+    operationId: z.ZodString;
+    kind: z.ZodLiteral<"cli">;
+    executable: z.ZodString;
+    subcommandPath: z.ZodArray<z.ZodString>;
+    channels: z.ZodObject<{
+        argument: z.ZodRecord<z.ZodString, z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>;
+        option: z.ZodRecord<z.ZodString, z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>;
+        environment: z.ZodRecord<z.ZodString, z.ZodString>;
+        stdin: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"json">;
+            value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"text">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"absent">;
+        }, z.core.$strict>], "kind">;
+    }, z.core.$strict>;
+}, z.core.$strict>], "kind">;
 /**
  * What the adapter observed. Deliberately response content only: no elapsed
  * time, no redirect count, no retry count. AD-35's caps are safety limits, so
@@ -75,10 +156,11 @@ export declare const ProbeRequest: z.ZodObject<{
  * policy denial, a cap, an abort, or a transport failure throws; a 500 is the
  * payload AD-10's seeded-fault check reads, never an error.
  */
-export declare const ProbeObservation: z.ZodObject<{
+export declare const ApiProbeObservation: z.ZodObject<{
     probeId: z.ZodString;
     interfaceId: z.ZodString;
     operationId: z.ZodString;
+    kind: z.ZodLiteral<"api">;
     status: z.ZodInt;
     headers: z.ZodRecord<z.ZodString, z.ZodString>;
     body: z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -91,6 +173,104 @@ export declare const ProbeObservation: z.ZodObject<{
         kind: z.ZodLiteral<"absent">;
     }, z.core.$strict>], "kind">;
 }, z.core.$strict>;
+/**
+ * What the adapter observed of a command run: its two streams, its exit code,
+ * and the files it wrote.
+ *
+ * `exitCode` is signed, unlike an HTTP status, because a process terminated by
+ * a signal is conventionally reported as a negative code and this field records
+ * what happened rather than what is tidy. A non-zero exit is an observation
+ * exactly as a 500 is: only a policy denial, a cap, an abort, or a failure to
+ * start the process throws.
+ *
+ * `artifacts` is keyed by the identifier the operation declared, not by a
+ * filesystem path. Which path each identifier names is the adapter's mapping,
+ * the same disclosure boundary AD-35 draws around the executable itself.
+ */
+export declare const CommandProbeObservation: z.ZodObject<{
+    probeId: z.ZodString;
+    interfaceId: z.ZodString;
+    operationId: z.ZodString;
+    kind: z.ZodLiteral<"cli">;
+    exitCode: z.ZodInt;
+    stdout: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"json">;
+        value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"text">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"absent">;
+    }, z.core.$strict>], "kind">;
+    stderr: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"json">;
+        value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"text">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"absent">;
+    }, z.core.$strict>], "kind">;
+    artifacts: z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"json">;
+        value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"text">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"absent">;
+    }, z.core.$strict>], "kind">>;
+}, z.core.$strict>;
+export declare const ProbeObservation: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    probeId: z.ZodString;
+    interfaceId: z.ZodString;
+    operationId: z.ZodString;
+    kind: z.ZodLiteral<"api">;
+    status: z.ZodInt;
+    headers: z.ZodRecord<z.ZodString, z.ZodString>;
+    body: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"json">;
+        value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"text">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"absent">;
+    }, z.core.$strict>], "kind">;
+}, z.core.$strict>, z.ZodObject<{
+    probeId: z.ZodString;
+    interfaceId: z.ZodString;
+    operationId: z.ZodString;
+    kind: z.ZodLiteral<"cli">;
+    exitCode: z.ZodInt;
+    stdout: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"json">;
+        value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"text">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"absent">;
+    }, z.core.$strict>], "kind">;
+    stderr: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"json">;
+        value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"text">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"absent">;
+    }, z.core.$strict>], "kind">;
+    artifacts: z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"json">;
+        value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"text">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"absent">;
+    }, z.core.$strict>], "kind">>;
+}, z.core.$strict>], "kind">;
 export type CorpusResolveRequest = z.infer<typeof CorpusResolveRequest>;
 export type CorpusResolveResponse = z.infer<typeof CorpusResolveResponse>;
 export type ClockReadRequest = z.infer<typeof ClockReadRequest>;
@@ -99,5 +279,9 @@ export type FileReadRequest = z.infer<typeof FileReadRequest>;
 export type FileReadResponse = z.infer<typeof FileReadResponse>;
 export type FileWriteRequest = z.infer<typeof FileWriteRequest>;
 export type FileWriteResponse = z.infer<typeof FileWriteResponse>;
+export type ApiProbeRequest = z.infer<typeof ApiProbeRequest>;
+export type CommandProbeRequest = z.infer<typeof CommandProbeRequest>;
 export type ProbeRequest = z.infer<typeof ProbeRequest>;
+export type ApiProbeObservation = z.infer<typeof ApiProbeObservation>;
+export type CommandProbeObservation = z.infer<typeof CommandProbeObservation>;
 export type ProbeObservation = z.infer<typeof ProbeObservation>;

package/dist/core/schemas/port-messages.js

@@ -2,7 +2,7 @@
 import { z } from 'zod';
 import { HttpMethod, PathTemplate } from './interface.js';
 import { Identifier, JsonValue, KeyName, Rfc3339Utc } from './primitives.js';
-import { ProbeObservedBody, ProbeRequestBody } from './probe-body.js';
+import { ProbeObservedBody, ProbeRequestBody, ProbeRequestStdin, } from './probe-body.js';
 export { ProbeObservedBody, ProbeRequestBody } from './probe-body.js';
 // AD-8: the corpus port resolves an opaque reference to bytes from a
 // caller-owned location. It does not check the digest: AD-8 puts digest
@@ -52,10 +52,20 @@ export const FileWriteResponse = z.strictObject({
  * authorization material is the adapter's, supplied by the same mapping that
  * authorizes the target.
  */
-export const ProbeRequest = z.strictObject({
+const probeCorrelation = {
     probeId: Identifier.describe('An opaque correlation label minted by the pre-flight plan and echoed unchanged on the observation. Two witnesses of one operation, and the three observations a state-reset differential needs, are otherwise distinguishable only by array position, which NFR9 forbids any stage from reading.'),
     interfaceId: Identifier,
     operationId: Identifier,
+};
+/**
+ * A request to an interface that speaks HTTP. Tagged on `kind` so an adapter
+ * knows what it is being asked to do before it reads anything else, and so the
+ * two shapes cannot be confused for one another by a field that happens to be
+ * absent.
+ */
+export const ApiProbeRequest = z.strictObject({
+    ...probeCorrelation,
+    kind: z.literal('api'),
     method: HttpMethod,
     pathTemplate: PathTemplate,
     channels: z.strictObject({
@@ -67,6 +77,38 @@ export const ProbeRequest = z.strictObject({
         body: ProbeRequestBody,
     }),
 });
+/**
+ * A request to run a command.
+ *
+ * AD-35's rule is that a contract names a logical identifier and the caller
+ * maps it, and the analogue for a command is exactly the same shape: the
+ * `executable` is the logical name the contract declared, and the adapter maps
+ * it to something runnable from configuration outside the contract. No
+ * filesystem path, no interpreter, no shell string. The adapter builds the
+ * argument vector; it is never handed one to execute.
+ *
+ * `environment` is string-valued for the reason `header` is, and carries no
+ * credential for the reason AD-18 gives: authorization material is the
+ * adapter's, supplied by the same mapping that authorizes the target.
+ */
+export const CommandProbeRequest = z.strictObject({
+    ...probeCorrelation,
+    kind: z.literal('cli'),
+    executable: Identifier.describe('A logical executable name, never a filesystem path, a URL, a host, or a port (AD-35). The adapter maps it to an authorized target through configuration outside the contract.'),
+    subcommandPath: z.array(Identifier),
+    channels: z.strictObject({
+        argument: z.record(KeyName, JsonValue),
+        option: z.record(KeyName, JsonValue),
+        environment: z
+            .record(KeyName, z.string())
+            .describe('String-valued because an environment variable is a string to the process; the other channels carry the declared JSON value.'),
+        stdin: ProbeRequestStdin,
+    }),
+});
+export const ProbeRequest = z.discriminatedUnion('kind', [
+    ApiProbeRequest,
+    CommandProbeRequest,
+]);
 /**
  * What the adapter observed. Deliberately response content only: no elapsed
  * time, no redirect count, no retry count. AD-35's caps are safety limits, so
@@ -78,13 +120,38 @@ export const ProbeRequest = z.strictObject({
  * policy denial, a cap, an abort, or a transport failure throws; a 500 is the
  * payload AD-10's seeded-fault check reads, never an error.
  */
-export const ProbeObservation = z.strictObject({
-    probeId: Identifier,
-    interfaceId: Identifier,
-    operationId: Identifier,
+export const ApiProbeObservation = z.strictObject({
+    ...probeCorrelation,
+    kind: z.literal('api'),
     status: z.int().min(100).max(599),
     headers: z
         .record(KeyName, z.string())
         .describe('Repeated headers are joined with ", " per RFC 9110 before they reach this shape. `set-cookie` is the one header that rule is wrong for, and it is dropped rather than mangled: nothing in AD-10 reads it, and a joined `set-cookie` is a value no consumer can split back.'),
     body: ProbeObservedBody,
 });
+/**
+ * What the adapter observed of a command run: its two streams, its exit code,
+ * and the files it wrote.
+ *
+ * `exitCode` is signed, unlike an HTTP status, because a process terminated by
+ * a signal is conventionally reported as a negative code and this field records
+ * what happened rather than what is tidy. A non-zero exit is an observation
+ * exactly as a 500 is: only a policy denial, a cap, an abort, or a failure to
+ * start the process throws.
+ *
+ * `artifacts` is keyed by the identifier the operation declared, not by a
+ * filesystem path. Which path each identifier names is the adapter's mapping,
+ * the same disclosure boundary AD-35 draws around the executable itself.
+ */
+export const CommandProbeObservation = z.strictObject({
+    ...probeCorrelation,
+    kind: z.literal('cli'),
+    exitCode: z.int(),
+    stdout: ProbeObservedBody,
+    stderr: ProbeObservedBody,
+    artifacts: z.record(Identifier, ProbeObservedBody),
+});
+export const ProbeObservation = z.discriminatedUnion('kind', [
+    ApiProbeObservation,
+    CommandProbeObservation,
+]);

package/dist/core/schemas/probe-body.d.ts

@@ -21,5 +21,23 @@ export declare const ProbeObservedBody: z.ZodDiscriminatedUnion<[z.ZodObject<{
 }, z.core.$strict>, z.ZodObject<{
     kind: z.ZodLiteral<"absent">;
 }, z.core.$strict>], "kind">;
+/**
+ * What one leg writes to a command's standard input. Three arms, like the
+ * observed body rather than the request body: standard input is a byte stream,
+ * so a command that reads a prompt receives text that was never JSON, and
+ * routing it through the `json` arm as a JSON string would make the leg claim
+ * a serialisation the command never sees. `absent` is the leg that writes
+ * nothing and closes the stream.
+ */
+export declare const ProbeRequestStdin: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"json">;
+    value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"text">;
+    value: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"absent">;
+}, z.core.$strict>], "kind">;
 export type ProbeRequestBody = z.infer<typeof ProbeRequestBody>;
 export type ProbeObservedBody = z.infer<typeof ProbeObservedBody>;
+export type ProbeRequestStdin = z.infer<typeof ProbeRequestStdin>;

package/dist/core/schemas/probe-body.js

@@ -21,3 +21,16 @@ export const ProbeObservedBody = z.discriminatedUnion('kind', [
     z.strictObject({ kind: z.literal('text'), value: z.string() }),
     z.strictObject({ kind: z.literal('absent') }),
 ]);
+/**
+ * What one leg writes to a command's standard input. Three arms, like the
+ * observed body rather than the request body: standard input is a byte stream,
+ * so a command that reads a prompt receives text that was never JSON, and
+ * routing it through the `json` arm as a JSON string would make the leg claim
+ * a serialisation the command never sees. `absent` is the leg that writes
+ * nothing and closes the stream.
+ */
+export const ProbeRequestStdin = z.discriminatedUnion('kind', [
+    z.strictObject({ kind: z.literal('json'), value: JsonValue }),
+    z.strictObject({ kind: z.literal('text'), value: z.string() }),
+    z.strictObject({ kind: z.literal('absent') }),
+]);