eval-quality 0.2.0 → 0.3.0

package/dist/core/compile/bindings.d.ts

@@ -1,10 +1,23 @@
 import type { EvalContract } from '../schemas/eval-contract.ts';
 import type { InteractionStep } from '../schemas/plan.ts';
-import { type TransportChannelName } from '../schemas/pointer.ts';
+import type { InputChannelName } from '../schemas/pointer.ts';
 import { type EvidenceTarget } from '../seal/plan-index.ts';
+/**
+ * The one channel a captured pointer may name: whichever channel the
+ * referenced operation's own response descriptor describes.
+ *
+ * `ResponseDescriptor` declares `requiredKeys`, `permittedKeys`, `types`,
+ * `successIndicator`, `channelRoles`, and `collectionLocations`, and every one
+ * of them is about the channel the operation nominates. Off an interface that
+ * speaks HTTP that is the response body; off a command it is the stream the
+ * operation names. `response-headers` and `response-status` are never it,
+ * because `Observation.responseHeaders` admits objects, arrays, numbers, and
+ * `null`, so a header capture compiled as a `string` could resolve to an
+ * object at score time.
+ */
 /** One `{ captured }` binding, resolved to the pointer target it addresses. */
 export type CapturedBinding = {
-    readonly transportChannel: TransportChannelName;
+    readonly transportChannel: InputChannelName;
     readonly key: string;
     readonly pointer: string;
     readonly target: EvidenceTarget;
@@ -45,11 +58,17 @@ export declare function capturedBindings(step: InteractionStep): readonly Captur
 export declare function checkBindingCycle(contract: EvalContract): void;
 /**
  * `captured-channel-undeclared`: a captured pointer naming any AD-26 channel
- * but `response-body`. `call-inputs` addresses a step's own request,
- * `stdout`, `stderr`, and `exit-code` are process channels no operation
- * surviving `unsupported-interface-kind` produces, and `response-headers` and
- * `response-status` have no declared structure to give a captured value a
- * type.
+ * but the one the referenced operation's response descriptor describes. That
+ * is `response-body` off an interface that speaks HTTP and whichever channel
+ * `descriptorChannel` nominates off one that runs behind a command, which is
+ * the same rule read against the declaration rather than assumed.
+ *
+ * Every other channel is refused for a reason that does not depend on the
+ * kind: `call-inputs` addresses a step's own request, and `response-headers`,
+ * `response-status`, and `exit-code` have no declared structure to give a
+ * captured value a type. On the `artifact` channel the identifier is compared
+ * too, so a capture from a file the operation writes but does not describe is
+ * refused alongside one from a file it never writes.
  */
 export declare function checkCapturedChannel(contract: EvalContract): void;
 /**

package/dist/core/compile/bindings.js

@@ -15,25 +15,12 @@
  * scalar-descent half. The scalar determination, the one-segment tail rule, and
  * type equality are this module's own.
  */
+import { boundChannelsOf, descriptorChannelOf, requestShapeOf, targetsDescribedChannel, } from '../declared-inputs.js';
 import { ARRAY_INDEX_PATTERN } from '../evaluate/evidence-resolution.js';
 import { StructuralFailure } from '../failure-codes.js';
-import { TRANSPORT_CHANNELS, } from '../schemas/pointer.js';
 import { JsonTypeName } from '../schemas/primitives.js';
-import { buildPlanIndex, parseEvidenceTarget, resolveOperation, resolveStep, } from '../seal/plan-index.js';
+import { anyOperationOf, buildPlanIndex, parseEvidenceTarget, resolveStep, } from '../seal/plan-index.js';
 import { evaluatePointerReachability } from './reachability.js';
-/**
- * The one channel a captured pointer may name. `ResponseDescriptor` declares
- * `requiredKeys`, `permittedKeys`, `types`, `successIndicator`, `channelRoles`,
- * and `collectionLocations`, every one of them about the body, so the body is
- * the one channel it declares and the criterion's "a channel the referenced
- * operation's response descriptor does not declare" is literally true of the
- * other six. Admitting `response-headers` and `response-status` was tried and
- * dropped: their types would have to be invented by fiat, and
- * `Observation.responseHeaders` admits objects, arrays, numbers, and `null`, so
- * a header capture compiled as a `string` could resolve to an object at score
- * time.
- */
-const CAPTURABLE_CHANNEL = 'response-body';
 /**
  * Every captured binding one step declares, in fixed transport-channel order
  * then by key name, so which binding a check reports never depends on a
@@ -42,8 +29,7 @@ const CAPTURABLE_CHANNEL = 'response-body';
  */
 export function capturedBindings(step) {
     const captures = [];
-    for (const transportChannel of TRANSPORT_CHANNELS) {
-        const map = step.inputBinding[transportChannel];
+    for (const { channel: transportChannel, bound: map } of boundChannelsOf(step.inputBinding)) {
         if (map === null)
             continue;
         for (const key of Object.keys(map).sort()) {
@@ -172,17 +158,38 @@ function stronglyConnectedComponents(nodes, edgesFrom) {
 // ---- captured-channel-undeclared -----------------------------------------
 /**
  * `captured-channel-undeclared`: a captured pointer naming any AD-26 channel
- * but `response-body`. `call-inputs` addresses a step's own request,
- * `stdout`, `stderr`, and `exit-code` are process channels no operation
- * surviving `unsupported-interface-kind` produces, and `response-headers` and
- * `response-status` have no declared structure to give a captured value a
- * type.
+ * but the one the referenced operation's response descriptor describes. That
+ * is `response-body` off an interface that speaks HTTP and whichever channel
+ * `descriptorChannel` nominates off one that runs behind a command, which is
+ * the same rule read against the declaration rather than assumed.
+ *
+ * Every other channel is refused for a reason that does not depend on the
+ * kind: `call-inputs` addresses a step's own request, and `response-headers`,
+ * `response-status`, and `exit-code` have no declared structure to give a
+ * captured value a type. On the `artifact` channel the identifier is compared
+ * too, so a capture from a file the operation writes but does not describe is
+ * refused alongside one from a file it never writes.
  */
 export function checkCapturedChannel(contract) {
+    let index;
     for (const step of contract.interactionPlan) {
         for (const capture of capturedBindings(step)) {
-            if (capture.target.channel === CAPTURABLE_CHANNEL)
+            index ??= buildPlanIndex(contract.interactionPlan, contract.permittedInterfaces, { duplicateIds: 'unresolved' });
+            const referenced = index.stepOf(capture.target.stepId);
+            const operation = referenced === undefined
+                ? undefined
+                : anyOperationOf(index, referenced.operationId);
+            // An unresolvable reference is `checkCapturedReachability`'s, at a
+            // higher rung. With nothing to ask, this check falls back to the
+            // api answer so an unresolvable off-body capture still reports.
+            const capturable = operation === undefined
+                ? 'response-body'
+                : descriptorChannelOf(operation);
+            if (operation === undefined
+                ? capture.target.channel === capturable
+                : targetsDescribedChannel(operation, capture.target)) {
                 continue;
+            }
             throw new StructuralFailure('captured-channel-undeclared', bindingPath(step, capture), `captured pointer "${capture.pointer}" names the ${capture.target.channel} channel, which the referenced operation's response descriptor does not declare (AD-26)`);
         }
     }
@@ -197,10 +204,11 @@ const SCALAR_TYPES = new Set(JsonTypeName.options.filter((name) => name !== 'obj
  * `evaluatePointerReachability` admits the index against a root collection.
  */
 function capturedType(target, index) {
+    const channel = target.channel;
     const segments = target.tail.length;
     if (segments !== 1) {
         return {
-            reason: `addresses ${segments === 0 ? 'the whole response body' : `a response-body path ${segments} segments deep`}, which declares no scalar to capture`,
+            reason: `addresses ${segments === 0 ? `the whole ${channel}` : `a ${channel} path ${segments} segments deep`}, which declares no scalar to capture`,
         };
     }
     const key = target.tail[0];
@@ -210,20 +218,23 @@ function capturedType(target, index) {
     }
     if (ARRAY_INDEX_PATTERN.test(key)) {
         return {
-            reason: `addresses response-body element ${key}, which no declaration gives a type`,
+            reason: `addresses ${channel} element ${key}, which no declaration gives a type`,
         };
     }
     const step = resolveStep(index, target.stepId);
-    const operation = resolveOperation(index, step.operationId);
+    const operation = anyOperationOf(index, step.operationId);
+    if (operation === undefined) {
+        throw new TypeError(`step names an operation the permitted interfaces do not declare: ${step.operationId}`);
+    }
     const declared = operation.responseDescriptor.types[key];
     if (declared === undefined || declared === null) {
         return {
-            reason: `addresses response-body field "${key}", whose type operation "${operation.operationId}" ${declared === undefined ? 'does not declare' : 'declares indeterminate'}`,
+            reason: `addresses ${channel} field "${key}", whose type operation "${operation.operationId}" ${declared === undefined ? 'does not declare' : 'declares indeterminate'}`,
         };
     }
     if (!SCALAR_TYPES.has(declared)) {
         return {
-            reason: `addresses response-body field "${key}", which operation "${operation.operationId}" declares "${declared}" rather than a scalar`,
+            reason: `addresses ${channel} field "${key}", which operation "${operation.operationId}" declares "${declared}" rather than a scalar`,
         };
     }
     return { type: declared };
@@ -237,10 +248,15 @@ function capturedType(target, index) {
  * cross-field rule.
  */
 function boundParameterType(step, capture, index) {
-    const operation = index.operationOf(step.operationId);
+    const operation = anyOperationOf(index, step.operationId);
     if (operation === undefined)
         return null;
-    const shape = operation.requestShape[capture.transportChannel];
+    const shape = requestShapeOf(operation, capture.transportChannel);
+    // A channel the operation does not accept input on declares no type for
+    // the key either, so there is nothing to compare and the check abstains
+    // for the same reason the undeclared-key branch below does.
+    if (shape === undefined)
+        return null;
     // A key the operation declares in neither list is an input the contract did
     // not declare, which is `undeclared-mandatory-input`'s and strict-only under
     // AD-4. This check runs unconditionally, so claiming it here would reject a
@@ -290,10 +306,11 @@ export function checkCapturedReachability(contract) {
             if (referenced === undefined) {
                 throw new StructuralFailure('unreachable-check-evidence', path, `captured pointer "${capture.pointer}" names a step the interaction plan does not declare`);
             }
-            if (index.operationOf(referenced.operationId) === undefined) {
+            const operation = anyOperationOf(index, referenced.operationId);
+            if (operation === undefined) {
                 throw new StructuralFailure('unreachable-check-evidence', path, `captured pointer "${capture.pointer}" names step "${capture.target.stepId}", which names operation "${referenced.operationId}", not declared by any permitted interface`);
             }
-            if (capture.target.channel !== CAPTURABLE_CHANNEL)
+            if (!targetsDescribedChannel(operation, capture.target))
                 continue;
             const reachability = evaluatePointerReachability(capture.pointer, index);
             if (!reachability.reachable) {

package/dist/core/compile/compile.d.ts

@@ -18,6 +18,18 @@
  * Grouping it with the two codes owed item 3 added, at the inserted position
  * below, would let a lower-ranked code win on a contract carrying both defects.
  *
+ * `checkArtifactReferences` fires `unresolved-artifact-reference`, the
+ * registry's last code, but runs near the front for the reason its own call
+ * site records: it names a fault that reachability can only describe the
+ * consequence of, and reachability abstains on the same pointer so the two
+ * never race.
+ *
+ * `checkStepReferenceReducibility` runs last, after every other check has had
+ * its say. It is the only check that reports what a LATER stage cannot do
+ * rather than what this contract declares wrongly, so a contract with an
+ * ordinary declaration fault should hear about that fault rather than about
+ * the sealing consequence of it.
+ *
  * `checkRubricIdentifiers` fires `rubric-unanchored` but runs ahead of
  * `checkRubricReasoningProse`, which outranks it in the registry. A duplicated
  * rubric or criterion id makes every `rubrics[id=...]` path the other three

package/dist/core/compile/compile.js

@@ -18,26 +18,51 @@
  * Grouping it with the two codes owed item 3 added, at the inserted position
  * below, would let a lower-ranked code win on a contract carrying both defects.
  *
+ * `checkArtifactReferences` fires `unresolved-artifact-reference`, the
+ * registry's last code, but runs near the front for the reason its own call
+ * site records: it names a fault that reachability can only describe the
+ * consequence of, and reachability abstains on the same pointer so the two
+ * never race.
+ *
+ * `checkStepReferenceReducibility` runs last, after every other check has had
+ * its say. It is the only check that reports what a LATER stage cannot do
+ * rather than what this contract declares wrongly, so a contract with an
+ * ordinary declaration fault should hear about that fault rather than about
+ * the sealing consequence of it.
+ *
  * `checkRubricIdentifiers` fires `rubric-unanchored` but runs ahead of
  * `checkRubricReasoningProse`, which outranks it in the registry. A duplicated
  * rubric or criterion id makes every `rubrics[id=...]` path the other three
  * rubric checks emit address two things, so identifiers are settled before any
  * of them reports.
  */
+import { EVAL_CONTRACT_SCHEMA_VERSION } from '../schemas/eval-contract.js';
 import { checkBindingCycle, checkCapturedChannel, checkCapturedReachability, } from './bindings.js';
 import { checkObservableSuccessCriterion, checkRequirementLinkage, } from './declarations.js';
+import { checkExcludedContent } from './excluded-content.js';
 import { checkOperandLegality, checkQuantifierNesting, checkQuantifierOverNonCollection, checkReferenceSetResolution, checkRegexConstructs, } from './expression-legality.js';
 import { checkForbiddenInputFloor, checkScopedResourceReferences, } from './forbidden-inputs.js';
-import { checkDuplicateOperationSignature, checkInterfaceKind, checkUndeclaredMandatoryInput, } from './interface-inventory.js';
+import { checkArtifactReferences, checkDuplicateOperationSignature, checkInterfaceKind, checkUndeclaredMandatoryInput, } from './interface-inventory.js';
 import { checkOracleAlignment, checkOracleChannel } from './oracle-alignment.js';
 import { checkBoundElementScope, checkEvidenceReachability, } from './reachability.js';
 import { checkRubricAnchoring, checkRubricEvidenceReachability, checkRubricIdentifiers, checkRubricReasoningProse, } from './rubrics.js';
+import { checkSchemaVersion } from './schema-version.js';
 import { checkNestedTemporalClause, checkScriptingBound, } from './scripting-bound.js';
 import { checkSensitivityWitnessDeclared, checkWitnessLegality, checkWitnessLegIdentifiers, } from './sensitivity-witness.js';
+import { checkStepReferenceReducibility } from './step-reference.js';
 import { checkWaiverCompleteness } from './waivers.js';
 export function compile(contract, options) {
+    // First, and before any check reads a declaration. AD-11 makes an unequal
+    // stamp a rejection rather than a degraded read, and every check below is
+    // written against this version's field shapes.
+    checkSchemaVersion(contract.schemaVersion, EVAL_CONTRACT_SCHEMA_VERSION, 'EvalContract.schemaVersion');
     checkRequirementLinkage(contract);
     checkObservableSuccessCriterion(contract);
+    // Ahead of reachability, because a pointer naming an artifact nothing
+    // declares has no operation shape to be reachable against, and the code
+    // that names the fault directly should not lose the race to the code that
+    // describes its consequence.
+    checkArtifactReferences(contract);
     checkEvidenceReachability(contract);
     checkCapturedReachability(contract);
     checkBoundElementScope(contract);
@@ -63,8 +88,10 @@ export function compile(contract, options) {
     checkRubricAnchoring(contract);
     checkRubricEvidenceReachability(contract);
     checkForbiddenInputFloor(contract);
+    checkExcludedContent(contract);
     checkScopedResourceReferences(contract);
     checkWaiverCompleteness(contract);
+    checkStepReferenceReducibility(contract);
     // Identifiers before legality. A duplicated or plan-colliding leg id makes
     // the legality check's question ("does the relation address both legs?")
     // unanswerable, so legality-first reports an unreachable-evidence failure on

package/dist/core/compile/excluded-content.d.ts

@@ -0,0 +1,11 @@
+import type { EvalContract } from '../schemas/eval-contract.ts';
+/**
+ * `excluded-content-in-declaration`: the contract carries a value-shaped secret.
+ *
+ * The first hit is reported and the rest are dropped. A contract carrying one
+ * has to be re-authored before it compiles at all, so enumerating the others
+ * would print more of the secret material into a failure message that gets
+ * pasted into a terminal, an issue, and a log. The message names the category
+ * and the path and quotes nothing.
+ */
+export declare function checkExcludedContent(contract: EvalContract): void;

package/dist/core/compile/excluded-content.js

@@ -0,0 +1,42 @@
+/**
+ * AD-18's exclusion, read against the contract rather than against a directory.
+ *
+ * AD-18 excludes credentials, tokens, real names, email addresses, account
+ * identifiers, and transaction content from every artifact this package produces
+ * or publishes, and says so binds "published examples and test fixtures as
+ * strictly as real runs". The only mechanism enforcing it was a test that greps
+ * `corpus/dev`, which reaches the corpus this repository ships and no contract an
+ * adopter authors. A token written into a contract therefore compiled clean and
+ * travelled onward: `seal` copies permitted interfaces onto the sealed brief, so
+ * the value reaches the one artifact AD-16 hands to an evaluator, and `emit`
+ * copies quoted evidence onto the evidence artifact.
+ *
+ * The whole contract is scanned, not a chosen subtree. Choosing one would have to
+ * be right about where an author pastes a secret, and the answer is wherever the
+ * field they were filling in happened to be: a witness input value, a fixture
+ * reset payload, an oracle's expected operand, a behaviour description. The
+ * scan's cost is one walk of an already-parsed object.
+ *
+ * Unconditional rather than strict-gated, unlike `undeclared-mandatory-input`
+ * next to it. That code is strict-only because AD-4 leaves a contract two
+ * legitimate readings of how completely it declares its inputs. AD-18 has one
+ * reading and no lenient mode: a credential that reaches a published artifact is
+ * unrecoverable, which is the harm the decision names.
+ */
+import { scanExcludedContent } from '../excluded-content.js';
+import { StructuralFailure } from '../failure-codes.js';
+/**
+ * `excluded-content-in-declaration`: the contract carries a value-shaped secret.
+ *
+ * The first hit is reported and the rest are dropped. A contract carrying one
+ * has to be re-authored before it compiles at all, so enumerating the others
+ * would print more of the secret material into a failure message that gets
+ * pasted into a terminal, an issue, and a log. The message names the category
+ * and the path and quotes nothing.
+ */
+export function checkExcludedContent(contract) {
+    const hit = scanExcludedContent(contract, 'EvalContract')[0];
+    if (hit === undefined)
+        return;
+    throw new StructuralFailure('excluded-content-in-declaration', hit.path, `carries a value shaped like ${hit.category}, which AD-18 excludes from every artifact this package produces; store a digest or an AD-8 opaque reference instead. The matched text is not quoted here, since a failure message travels further than the contract does`);
+}

package/dist/core/compile/expression-legality.d.ts

@@ -1,6 +1,6 @@
 import type { EvalContract } from '../schemas/eval-contract.ts';
 import type { Expression, Operand, SetOperand } from '../schemas/expression.ts';
-import type { Operation } from '../schemas/interface.ts';
+import type { AnyOperation } from '../schemas/interface.ts';
 type OperandPosition = 0 | 1 | 'collection';
 type OperandBearingOp = Exclude<Expression['op'], 'not' | 'all' | 'any'>;
 type Visitor = {
@@ -50,7 +50,7 @@ export declare function checkQuantifierNesting(contract: EvalContract): void;
  * disagree with the compiler on a committed fixture.
  */
 export declare function checkExpressionQuantifierOverNonCollection(expression: Expression, artifactPath: string, scope: {
-    readonly operation: Operation;
+    readonly operation: AnyOperation;
     readonly legIds: readonly string[];
 }): void;
 /** Checks response-body collection pointers, after bound-element substitution. */

package/dist/core/compile/expression-legality.js

@@ -3,9 +3,11 @@
  * reference-set resolution. Each check reports the first structural failure.
  */
 import { digestArtifact } from '../canonical/digest.js';
+import { targetsDescribedChannel } from '../declared-inputs.js';
 import { StructuralFailure } from '../failure-codes.js';
+import { operationsOf } from '../schemas/interface.js';
 import { JsonTypeName } from '../schemas/primitives.js';
-import { buildPlanIndex, parseEvidenceTarget, } from '../seal/plan-index.js';
+import { anyOperationOf, buildPlanIndex, parseEvidenceTarget, } from '../seal/plan-index.js';
 import { substitutePointer } from './oracle-alignment.js';
 /**
  * The one expression walker in this package. Contract-free and a superset of
@@ -68,7 +70,7 @@ function forEachContractExpression(contract, visit) {
         });
     });
     contract.permittedInterfaces.forEach((iface, interfaceIndex) => {
-        iface.operations.forEach((operation, operationIndex) => {
+        operationsOf(iface).forEach((operation, operationIndex) => {
             const witness = operation.sensitivityWitness;
             if (witness === null)
                 return;
@@ -180,6 +182,19 @@ export function checkExpressionQuantifierNesting(expression, artifactPath) {
         },
     });
 }
+/**
+ * The declaration a reference-set operand names, and `undefined` when the
+ * contract declares none by that identifier. An undeclared identifier is
+ * `checkReferenceSetResolution`'s `unresolved-reference-set`, so the
+ * shape-aware checks below stay quiet about it.
+ */
+function declaredReferenceSetOf(contract, referenceSetId) {
+    const declarations = contract.referenceSets;
+    if (declarations === null || !Object.hasOwn(declarations, referenceSetId)) {
+        return undefined;
+    }
+    return declarations[referenceSetId];
+}
 /** Checks each operator's operands against its position-specific constraints. */
 export function checkOperandLegality(contract) {
     forEachContractExpression(contract, (site) => {
@@ -187,22 +202,50 @@ export function checkOperandLegality(contract) {
             onOperand: (operand, op, position, path) => {
                 checkOperandAtPosition(operand, op, position, `${site.artifactPath}${path}`);
             },
+            // Fires only for `set-membership`'s set position, which is the one
+            // position that reads a reference set by its single declared key
+            // (`reference-set.ts`). `keys` is `.min(1)` with no maximum, so a
+            // two-key set names no one key to read there, and a member missing
+            // the declared key has nothing to read at all. AD-26 assigns
+            // `malformed-operator-expression` to an operand type the operator
+            // does not accept, which is what each of those is. Rejecting them
+            // here is what makes the resolver's projection total.
+            onSetOperand: (setOperand, path) => {
+                if (!('referenceSet' in setOperand))
+                    return;
+                const { referenceSet } = setOperand;
+                const declaration = declaredReferenceSetOf(contract, referenceSet);
+                if (declaration === undefined)
+                    return;
+                if (declaration.keys.length !== 1) {
+                    throw new StructuralFailure('malformed-operator-expression', `${site.artifactPath}${path}`, `referenceSet "${referenceSet}" declares ${declaration.keys.length} keys, and set-membership reads exactly one, so only a single-key set is legal in its set position (AD-4, AD-26)`);
+                }
+                const key = declaration.keys[0];
+                for (const [index, member] of declaration.members.entries()) {
+                    if (Object.hasOwn(member, key))
+                        continue;
+                    throw new StructuralFailure('malformed-operator-expression', `EvalContract.referenceSets[id=${referenceSet}].members[${index}]${artifactKey(key)}`, `referenceSet "${referenceSet}" has a member carrying no key "${key}", which it declares and which set-membership reads (AD-4, AD-26)`);
+                }
+            },
             onCoversByKey: (expr) => {
                 const expected = expr.operands[0];
                 if (!('referenceSet' in expected))
                     return;
-                const declarations = contract.referenceSets;
-                if (declarations === null ||
-                    !Object.hasOwn(declarations, expected.referenceSet))
-                    return;
-                const declaration = declarations[expected.referenceSet];
+                const declaration = declaredReferenceSetOf(contract, expected.referenceSet);
                 if (declaration === undefined)
                     return;
                 const seen = new Set();
                 for (const [index, member] of declaration.members.entries()) {
-                    if (!Object.hasOwn(member, expr.expectedKey))
-                        continue;
                     const memberPath = `EvalContract.referenceSets[id=${expected.referenceSet}].members[${index}]${artifactKey(expr.expectedKey)}`;
+                    // `coversByKey` returns false for the whole collection when one
+                    // declared member lacks `expectedKey`, which reads as a detected
+                    // defect in the system under test, when it is an authoring
+                    // mistake. This check used to walk past that member to keep the
+                    // duplicate-detection loop total, which left the compiler silent
+                    // about the one shape that makes the operator answer wrongly.
+                    if (!Object.hasOwn(member, expr.expectedKey)) {
+                        throw new StructuralFailure('malformed-operator-expression', memberPath, `referenceSet "${expected.referenceSet}" has a member carrying no expectedKey "${expr.expectedKey}", which covers-by-key reads on every member (AD-4)`);
+                    }
                     const digest = digestArtifact(member[expr.expectedKey], memberPath);
                     if (seen.has(digest)) {
                         throw new StructuralFailure('malformed-operator-expression', memberPath, `referenceSet "${expected.referenceSet}" repeats expectedKey "${expr.expectedKey}" for covers-by-key (AD-4)`);
@@ -341,11 +384,14 @@ function forEachQuantifierCollection(expr, boundElementRoot, path, visit) {
 function checkQuantifiersAgainst(expression, artifactPath, operationFor) {
     forEachQuantifierCollection(expression, null, '', (pointer, path) => {
         const target = parseEvidenceTarget(pointer);
-        if (target.channel !== 'response-body')
-            return;
         const operation = operationFor(target.stepId);
         if (operation === undefined)
             return;
+        // The operation is resolved before the target is tested, because which
+        // channel carries the declared structure is the operation's own answer,
+        // and on the artifact channel so is which file.
+        if (!targetsDescribedChannel(operation, target))
+            return;
         const firstToken = target.tail.length === 1 ? target.tail[0] : undefined;
         const declaredType = firstToken === undefined
             ? undefined
@@ -385,7 +431,7 @@ export function checkQuantifierOverNonCollection(contract) {
         const step = index.stepOf(stepId);
         if (step === undefined)
             return undefined;
-        return index.operationOf(step.operationId);
+        return anyOperationOf(index, step.operationId);
     };
     forEachContractExpression(contract, (site) => {
         checkQuantifiersAgainst(site.expression, site.artifactPath, (stepId) => operationFor(site, stepId));

package/dist/core/compile/interface-inventory.d.ts

@@ -1,5 +1,5 @@
 import type { EvalContract } from '../schemas/eval-contract.ts';
-/** Rejects permitted interface kinds that this contract version cannot run. */
+import type { AnyOperation } from '../schemas/interface.ts';
 export declare function checkInterfaceKind(contract: EvalContract): void;
 /**
  * The transport identity AD-40 resolves a defect signature against: the method
@@ -12,8 +12,41 @@ export declare function operationSignature(operation: {
     readonly method: string;
     readonly pathTemplate: string;
 }): string;
+/**
+ * The separator between a command's executable and each subcommand segment,
+ * declared once so the contract side and AD-40's corpus side cannot disagree
+ * about it. A space, matching the way the identity is written on a terminal.
+ */
+export declare const COMMAND_SIGNATURE_SEPARATOR = " ";
+/**
+ * The command counterpart of `operationSignature`, compared literally.
+ *
+ * There is no erasure step. A subcommand path carries no parameters: a
+ * command's variable inputs are its arguments and options, which live in the
+ * request shape. Erasing a subcommand segment would make `tool review` and
+ * `tool report` one signature, which is the opposite of what erasure is for.
+ */
+export declare function commandSignature(operation: {
+    readonly invocation: {
+        readonly executable: string;
+        readonly subcommandPath: readonly string[];
+    };
+}): string;
+/** The transport identity of an operation of either kind. */
+export declare const anyOperationSignature: (operation: AnyOperation) => string;
 /** Finds duplicate method and path signatures across the full inventory. */
 export declare function checkDuplicateOperationSignature(contract: EvalContract): void;
+/**
+ * `unresolved-artifact-reference`: an artifact identifier nothing declares.
+ *
+ * Two sites name one: an evidence pointer's identifier segment, and a command
+ * operation's own `descriptorChannel` when it nominates an artifact. Both are
+ * authoring faults the compiler can see, and both take a code rather than
+ * resolving `absent`, on AD-26's own precedent for a dangling reference-set
+ * identifier: `absent` is defined over pointers that do not resolve against
+ * observed evidence, and a dangling declaration is neither.
+ */
+export declare function checkArtifactReferences(contract: EvalContract): void;
 /**
  * Checks each binding key against its operation's request shape, and each
  * `{ principal }` value against the contract's declared principals.