eval-quality 0.2.0 → 0.3.0

package/dist/core/compile/sensitivity-witness.js

@@ -4,28 +4,65 @@
  * execute it, and that its leg identifiers are distinct from each other and
  * from every interaction-plan step.
  *
- * No new AD-5 code is minted. The registry is closed at twenty-three and
- * `check:ad5-registry` pins it against the spine, so each defect below takes the
- * code that already names it. Two rows stretch that reading: a leg-id equality
+ * No new AD-5 code is minted here. `check:ad5-registry` pins the registry
+ * against the spine's own table, so each defect below takes the code that
+ * already names it. Two rows stretch that reading: a leg-id equality
  * and a leg-id/step-id collision are identifier collisions, and
  * `malformed-operator-expression` is the closest available code because the
  * relation is illegal in its position once its operands cannot be told apart.
  */
-import { declaresNoRequestKeys } from '../declared-inputs.js';
+import { declaresNoRequestKeys, isCommandOperation, requestChannelsOf, } from '../declared-inputs.js';
 import { StructuralFailure } from '../failure-codes.js';
-import { TRANSPORT_CHANNELS, } from '../schemas/pointer.js';
+import { operationsOf } from '../schemas/interface.js';
+import { COMMAND_WITNESS_CHANNELS, } from '../schemas/sensitivity-witness.js';
 import { parseEvidenceTarget } from '../seal/plan-index.js';
 export { declaresNoRequestKeys };
+/** Which spelling this leg uses. `stdin` is the command shape's own key. */
+const isCommandWitnessInputs = (inputs) => 'stdin' in inputs;
 /**
- * The keys one set of witness inputs supplies on one channel. A body that is
- * absent, or JSON that is not an object, supplies no keys: the channel is
- * declared as a keyed shape, so such a leg omits every required key rather
- * than being exempt from the comparison.
+ * The transport spelling, for the consumers that can only send one: the probe
+ * port carries a method, a path template, and the four transport channels.
  */
-export function suppliedKeys(inputs, channel) {
-    if (channel !== 'body')
-        return Object.keys(inputs[channel]);
-    const { body } = inputs;
+export const isApiWitnessInputs = (inputs) => 'body' in inputs;
+/**
+ * Whether the leg supplies this channel as an undifferentiated stream.
+ *
+ * Standard input written as text is one such stream. A `KeyedShapeDescriptor`
+ * can say what keys a channel carries and cannot say "one opaque stream", so a
+ * command that reads a prompt is declared by naming the one thing the stream
+ * carries, and the leg supplies that thing as the text it actually is.
+ */
+export function suppliesOpaquely(inputs, channel) {
+    return (isCommandWitnessInputs(inputs) &&
+        channel === 'stdin' &&
+        inputs.stdin.kind === 'text');
+}
+/**
+ * What an opaque stream fills, and when it cannot say.
+ *
+ * A text leg supplies the channel's ONE declared key: the stream is the value
+ * of the single thing the operation says it reads. Where the channel declares
+ * no required key there is nothing for the text to be, and where it declares
+ * more than one there is no way to say which the text fills, so both are the
+ * authoring fault this reports rather than a comparison that quietly abstains.
+ *
+ * That is what a keyed `stdin` means for a command that reads text, and it is
+ * the reason the declaration stays keyed: an operation that genuinely parses a
+ * structured document off standard input declares several keys and supplies
+ * them through the leg's `json` arm, and the same descriptor serves both.
+ */
+function checkOpaqueStream(shape, channel, operationId, owner, artifactPath) {
+    if (shape.requiredKeys.length === 1)
+        return;
+    throw new StructuralFailure('undeclared-mandatory-input', artifactPath, `${owner} supplies its ${channel} channel as text, which fills the one key the channel declares, but operation "${operationId}" declares ${shape.requiredKeys.length === 0 ? 'no required key there, so the text fills nothing' : `${shape.requiredKeys.length} required keys there, so nothing says which the text fills`} (AD-10, AD-19)`);
+}
+/**
+ * The keys a tagged body value supplies. A body that is absent, or JSON that
+ * is not an object, supplies no keys: the channel is declared as a keyed
+ * shape, so such a leg omits every required key rather than being exempt from
+ * the comparison.
+ */
+function bodyKeys(body) {
     if (body.kind !== 'json')
         return [];
     const { value } = body;
@@ -33,6 +70,37 @@ export function suppliedKeys(inputs, channel) {
         return [];
     return Object.keys(value);
 }
+/**
+ * The keys one set of witness inputs supplies on one channel, or none where
+ * the leg's spelling has no such channel.
+ *
+ * `body` and `stdin` are the two channels a leg supplies as a tagged value
+ * rather than as a key map, because a leg has to tell an absent value from one
+ * carrying JSON null. This function is the bridge between that spelling and
+ * the keyed shape the request declares.
+ */
+export function suppliedKeys(inputs, channel) {
+    if (isCommandWitnessInputs(inputs)) {
+        if (channel === 'stdin')
+            return bodyKeys(inputs.stdin);
+        if (channel === 'argument' || channel === 'option')
+            return Object.keys(inputs[channel]);
+        if (channel === 'environment')
+            return Object.keys(inputs.environment);
+        return [];
+    }
+    if (channel === 'body')
+        return bodyKeys(inputs.body);
+    if (channel === 'path' || channel === 'query')
+        return Object.keys(inputs[channel]);
+    if (channel === 'header')
+        return Object.keys(inputs.header);
+    return [];
+}
+/** One channel's supplied value, for the differential comparison. */
+export function suppliedValue(inputs, channel) {
+    return inputs[channel];
+}
 /**
  * Every channel of one set of witness inputs against the operation that will
  * receive them. All four, not only the differential channel: `planPreflight`
@@ -59,8 +127,11 @@ export function suppliedKeys(inputs, channel) {
  * check, and what pre-flight probes is a fixture.
  */
 export function checkInputsAgainstShape(inputs, operation, owner, artifactPath) {
-    for (const channel of TRANSPORT_CHANNELS) {
-        const shape = operation.requestShape[channel];
+    for (const { channel, shape } of requestChannelsOf(operation)) {
+        if (suppliesOpaquely(inputs, channel)) {
+            checkOpaqueStream(shape, channel, operation.operationId, owner, artifactPath);
+            continue;
+        }
         const supplied = suppliedKeys(inputs, channel);
         for (const key of shape.requiredKeys) {
             if (supplied.includes(key))
@@ -78,7 +149,7 @@ export function checkInputsAgainstShape(inputs, operation, owner, artifactPath)
 const operationPath = (interfaceIndex, operationIndex) => `EvalContract.permittedInterfaces[${interfaceIndex}].operations[${operationIndex}]`;
 function forEachWitness(contract, visit) {
     contract.permittedInterfaces.forEach((iface, interfaceIndex) => {
-        iface.operations.forEach((operation, operationIndex) => {
+        operationsOf(iface).forEach((operation, operationIndex) => {
             const witness = operation.sensitivityWitness;
             if (witness === null)
                 return;
@@ -94,13 +165,13 @@ function forEachWitness(contract, visit) {
  */
 export function checkSensitivityWitnessDeclared(contract) {
     contract.permittedInterfaces.forEach((iface, interfaceIndex) => {
-        iface.operations.forEach((operation, operationIndex) => {
+        operationsOf(iface).forEach((operation, operationIndex) => {
             const path = operationPath(interfaceIndex, operationIndex);
             const witness = operation.sensitivityWitness;
             if (witness === null) {
                 if (declaresNoRequestKeys(operation))
                     return;
-                throw new StructuralFailure('undeclared-mandatory-input', path, `operation "${operation.operationId}" declares request keys but no sensitivity witness; only an operation declaring no keys in any channel is exempt (AD-10)`);
+                throw new StructuralFailure('undeclared-mandatory-input', path, `operation "${operation.operationId}" declares request keys but no sensitivity witness; only an operation declaring no keys in any channel is exempt (AD-10). The relation is the author's to choose and need not assert the two legs differ: an operation that is insensitive to its declared inputs by design declares a witness whose relation says so, which is a true and checkable claim about it, and gets the weaker guarantee that follows`);
             }
             witness.legs.forEach((leg, legIndex) => {
                 checkInputsAgainstShape(leg.inputs, operation, `leg "${leg.legId}"`, `${path}.sensitivityWitness.legs[${legIndex}]`);
@@ -137,8 +208,22 @@ function addressedStepIds(expression) {
     walk(expression);
     return found;
 }
-/** the channel AD-10 selects for an operation, by its state-change marker. */
-const legalChannels = (operation) => operation.stateChangeMarker ? ['body'] : ['path', 'query'];
+const MUTATING_CHANNELS = ['body'];
+const READ_CHANNELS = ['path', 'query'];
+/**
+ * The channels AD-10 admits for an operation's witness.
+ *
+ * Off an interface that speaks HTTP the state-change marker selects one, since
+ * a read carries its identifier in the URL and a write carries it in the body.
+ * A command carries its inputs the same way whether or not it changes state,
+ * so the marker selects nothing there and all four command channels are
+ * admitted. The author picks the one their operation is actually sensitive on.
+ */
+const legalChannels = (operation) => {
+    if (isCommandOperation(operation))
+        return COMMAND_WITNESS_CHANNELS;
+    return operation.stateChangeMarker ? MUTATING_CHANNELS : READ_CHANNELS;
+};
 /**
  * The shape rules: the differential channel agrees with the state-change
  * marker, the relation reads both legs and nothing else, and a declared
@@ -158,8 +243,8 @@ export function checkWitnessLegality(contract) {
         const [first, second] = witness.legs;
         if (first !== undefined &&
             second !== undefined &&
-            JSON.stringify(first.inputs[witness.channel]) ===
-                JSON.stringify(second.inputs[witness.channel])) {
+            JSON.stringify(suppliedValue(first.inputs, witness.channel)) ===
+                JSON.stringify(suppliedValue(second.inputs, witness.channel))) {
             throw new StructuralFailure('malformed-operator-expression', `${path}.sensitivityWitness.legs`, `both legs of witness "${witness.witnessId}" supply the same ${witness.channel} value, so the pair is not a differential (AD-10)`);
         }
         const legIds = witness.legs.map((leg) => leg.legId);
@@ -181,7 +266,9 @@ export function checkWitnessLegality(contract) {
     if (reset === null)
         return;
     const iface = contract.permittedInterfaces.find((candidate) => candidate.logicalId === reset.interfaceId);
-    const operation = iface?.operations.find((candidate) => candidate.operationId === reset.operationId);
+    const operation = iface === undefined
+        ? undefined
+        : operationsOf(iface).find((candidate) => candidate.operationId === reset.operationId);
     if (operation === undefined) {
         throw new StructuralFailure('unreachable-check-evidence', 'EvalContract.fixtureReset', `the fixture reset names operation "${reset.operationId}" on interface "${reset.interfaceId}", which the contract does not declare (AD-10)`);
     }

package/dist/core/compile/step-reference.d.ts

@@ -0,0 +1,2 @@
+import type { EvalContract } from '../schemas/eval-contract.ts';
+export declare function checkStepReferenceReducibility(contract: EvalContract): void;

package/dist/core/compile/step-reference.js

@@ -0,0 +1,49 @@
+/**
+ * `irreducible-step-reference`: two steps one direction references render to
+ * the same derived reference even after full escalation.
+ *
+ * AD-16 keeps step identifiers out of the sealed brief, so a direction names
+ * each step it references by a phrase derived from what the contract declares
+ * about it. Where two steps of one operation declare nothing that tells them
+ * apart, the escalation ladder runs out and the renderer has no way to name one
+ * without naming the other.
+ *
+ * The check runs the seal-side renderer rather than reimplementing its ladder.
+ * A second implementation of a three-rung escalation with a budget would be a
+ * second thing to keep in step with the first, and the failure this reports is
+ * defined as "what that renderer cannot do" rather than as a rule of its own.
+ * That is the same reasoning `checkEvidenceReachability` follows in reusing
+ * `evaluatePointerReachability`.
+ *
+ * Without it a contract passes every other check and then fails inside `seal`,
+ * which is the one authoring fault in the tree that reached a caller as a
+ * stack trace instead of a code and a path.
+ */
+import { StructuralFailure } from '../failure-codes.js';
+import { renderEvidenceReferences } from '../seal/derived-reference.js';
+import { buildPlanIndex } from '../seal/plan-index.js';
+export function checkStepReferenceReducibility(contract) {
+    let index;
+    for (const oracle of contract.oracles) {
+        const { direction } = oracle;
+        if (direction === null || direction.evidenceTargets.length === 0)
+            continue;
+        index ??= buildPlanIndex(contract.interactionPlan, contract.permittedInterfaces, { duplicateIds: 'unresolved' });
+        try {
+            renderEvidenceReferences(direction.evidenceTargets, index);
+        }
+        catch (error) {
+            if (!(error instanceof StructuralFailure)) {
+                // Every other way this renderer fails is a precondition violation
+                // on input `compile` has already checked, so it is a fault rather
+                // than an authoring fault and propagates unchanged.
+                throw error;
+            }
+            // Re-thrown with the contract-side address. `StructuralFailure`
+            // carries the code and the path and folds the detail into its
+            // message, so the detail is recovered from the message rather than
+            // from a field the class does not expose.
+            throw new StructuralFailure(error.code, `EvalContract.oracles[id=${oracle.id}].direction.evidenceTargets`, error.message.slice(`${error.code} in ${error.artifactPath}: `.length));
+        }
+    }
+}

package/dist/core/coverage/operations.d.ts

@@ -0,0 +1,62 @@
+/**
+ * One declared operation joined to the interface that declares it, plus the
+ * two facts the coverage predicates need and neither the operation nor the
+ * interface states: where a response descriptor's pointers resolve, and which
+ * channels a call's inputs may be keyed by.
+ *
+ * `relevance.ts` and `satisfaction.ts` each flattened `permittedInterfaces`
+ * with `flatMap((declared) => declared.operations)` and dropped the interface
+ * one line before every loop that ranges over it, so six of AD-20's seven
+ * rules could not see the kind that declared the operation they were grading.
+ * This is that flattening, written once and keeping the join.
+ *
+ * Nothing here throws, which is the promise both predicate modules make in
+ * their own headers and which `evaluateCoverage`'s callers rely on. Every
+ * field is read off an already-parsed contract, so there is no precondition
+ * left to assert.
+ */
+import { type RequestChannel } from '../declared-inputs.ts';
+import type { EvalContract } from '../schemas/eval-contract.ts';
+import type { AnyOperation, InterfaceKindName, ResponseDescriptor } from '../schemas/interface.ts';
+import type { InputChannelName } from '../schemas/pointer.ts';
+/**
+ * RFC 6901 escaping, `~` before `/`. Lives here rather than beside the
+ * pointer-building helpers that use it, because the descriptor root is built
+ * here and both spellings have to escape the same way.
+ */
+export declare const encodeToken: (token: string) => string;
+export type ResolvedOperation = {
+    readonly operation: AnyOperation;
+    /** the declaring interface's kind. An operation states no kind of its own. */
+    readonly kind: InterfaceKindName;
+    /** the declaring interface. Two interfaces may declare one `operationId`, and this is what separates them. */
+    readonly logicalId: string;
+    readonly descriptor: ResponseDescriptor;
+    /**
+     * The interaction-rooted segment a descriptor pointer hangs off, which is
+     * the channel this operation's own descriptor describes, and on the artifact
+     * channel the file as well. `/artifact` alone is not a root any real
+     * evidence pointer starts with, since an artifact pointer carries its
+     * identifier before its tail, so a root without it matched nothing and made
+     * every pointer-building rule answer against a pointer that cannot exist.
+     */
+    readonly descriptorRoot: string;
+    /**
+     * The channels a call's inputs may be keyed by. Names only: the two sites
+     * that build candidate pointers need the names and never the shapes.
+     */
+    readonly transportChannels: readonly InputChannelName[];
+    /**
+     * The same channels already paired with the shapes they declare. Predicates
+     * that read a declared shape take these rather than indexing the request
+     * shape with a name, because under the operation union TypeScript cannot
+     * prove a name drawn from one kind's tuple is a key of the other's shape.
+     */
+    readonly requestChannels: readonly RequestChannel[];
+};
+/**
+ * Every declared operation, in declaration order, each carrying the interface
+ * that declares it. Six of AD-20's seven rules range over this list; rule 5 is
+ * contract-level and reads the sibling groups instead.
+ */
+export declare function resolveOperations(contract: EvalContract): readonly ResolvedOperation[];

package/dist/core/coverage/operations.js

@@ -0,0 +1,57 @@
+/**
+ * One declared operation joined to the interface that declares it, plus the
+ * two facts the coverage predicates need and neither the operation nor the
+ * interface states: where a response descriptor's pointers resolve, and which
+ * channels a call's inputs may be keyed by.
+ *
+ * `relevance.ts` and `satisfaction.ts` each flattened `permittedInterfaces`
+ * with `flatMap((declared) => declared.operations)` and dropped the interface
+ * one line before every loop that ranges over it, so six of AD-20's seven
+ * rules could not see the kind that declared the operation they were grading.
+ * This is that flattening, written once and keeping the join.
+ *
+ * Nothing here throws, which is the promise both predicate modules make in
+ * their own headers and which `evaluateCoverage`'s callers rely on. Every
+ * field is read off an already-parsed contract, so there is no precondition
+ * left to assert.
+ */
+import { descriptorArtifactOf, descriptorChannelOf, inputChannelsOf, requestChannelsOf, } from '../declared-inputs.js';
+import { operationsOf } from '../schemas/interface.js';
+/**
+ * RFC 6901 escaping, `~` before `/`. Lives here rather than beside the
+ * pointer-building helpers that use it, because the descriptor root is built
+ * here and both spellings have to escape the same way.
+ */
+export const encodeToken = (token) => token.replace(/~/g, '~0').replace(/\//g, '~1');
+/**
+ * Where a descriptor-relative pointer hangs off an interaction root for this
+ * operation. Two segments on the artifact channel, one everywhere else.
+ */
+const descriptorRootOf = (operation) => {
+    const channel = descriptorChannelOf(operation);
+    if (channel !== 'artifact')
+        return `/${channel}`;
+    const artifactId = descriptorArtifactOf(operation);
+    // Unreachable: `descriptorChannelOf` answers `artifact` only for the arm
+    // that carries an identifier.
+    if (artifactId === null) {
+        throw new TypeError(`operation "${operation.operationId}" describes an artifact and names none`);
+    }
+    return `/${channel}/${encodeToken(artifactId)}`;
+};
+/**
+ * Every declared operation, in declaration order, each carrying the interface
+ * that declares it. Six of AD-20's seven rules range over this list; rule 5 is
+ * contract-level and reads the sibling groups instead.
+ */
+export function resolveOperations(contract) {
+    return contract.permittedInterfaces.flatMap((declared) => operationsOf(declared).map((operation) => ({
+        operation,
+        kind: declared.kind,
+        logicalId: declared.logicalId,
+        descriptor: operation.responseDescriptor,
+        descriptorRoot: descriptorRootOf(operation),
+        transportChannels: inputChannelsOf(operation),
+        requestChannels: requestChannelsOf(operation),
+    })));
+}

package/dist/core/coverage/relevance.d.ts

@@ -32,8 +32,10 @@ export declare function successIndicatorSeparationRelevance(contract: EvalContra
  */
 export declare function wholeBodyRelevance(contract: EvalContract): RelevanceVerdict;
 /**
- * Rule 3: some operation declares a request key on any of AD-19's four
- * transport channels. The site is the whole channel triple. A key with no
+ * Rule 3: some operation declares a request key on any of its own input
+ * channels, AD-19's four transport channels off an interface that speaks HTTP
+ * and the four command channels off one that does not. The site is the whole
+ * channel triple. A key with no
  * `types` entry has an absent type, a key typed `null` has AD-31's
  * indeterminate one, and both are relevant, so declaring an input and leaving
  * it untyped buys no irrelevance.

package/dist/core/coverage/relevance.js

@@ -1,4 +1,4 @@
-import { TRANSPORT_CHANNELS } from '../schemas/pointer.js';
+import { resolveOperations } from './operations.js';
 import { DISCIPLINE_RULES, relevancePredicateId, } from './rules.js';
 const verdict = (rule, relevant, reason) => ({
     rule,
@@ -8,8 +8,6 @@ const verdict = (rule, relevant, reason) => ({
 });
 /** `1 collection location`, `2 collection locations`. A reason is read by people. */
 const plural = (count, noun) => `${count} ${noun}${count === 1 ? '' : 's'}`;
-/** Every declared operation, flattened. Six of the seven rules range over this list. */
-const operationsOf = (contract) => contract.permittedInterfaces.flatMap((declared) => declared.operations);
 /** A contract declaring no operation leaves six of the rules nothing to read. */
 export const NO_OPERATION = 'the contract declares no operation, so the declaration this rule reads is absent';
 /**
@@ -20,11 +18,11 @@ export const NO_OPERATION = 'the contract declares no operation, so the declarat
  */
 export function successIndicatorSeparationRelevance(contract) {
     const rule = 'success-indicator-separation';
-    const operations = operationsOf(contract);
+    const operations = resolveOperations(contract);
     if (operations.length === 0)
         return verdict(rule, true, NO_OPERATION);
-    for (const operation of operations) {
-        const { successIndicator, channelRoles } = operation.responseDescriptor;
+    for (const { operation, descriptor } of operations) {
+        const { successIndicator, channelRoles } = descriptor;
         // `=== null`: `DescriptorPointer` admits the empty string, which
         // nominates the whole response body.
         if (successIndicator === null) {
@@ -48,11 +46,11 @@ export function successIndicatorSeparationRelevance(contract) {
  */
 export function wholeBodyRelevance(contract) {
     const rule = 'whole-body';
-    const operations = operationsOf(contract);
+    const operations = resolveOperations(contract);
     if (operations.length === 0)
         return verdict(rule, true, NO_OPERATION);
-    for (const operation of operations) {
-        const distinct = new Set(operation.responseDescriptor.requiredKeys);
+    for (const { operation, descriptor } of operations) {
+        const distinct = new Set(descriptor.requiredKeys);
         if (distinct.size > 1) {
             return verdict(rule, true, `operation ${operation.operationId} declares ${plural(distinct.size, 'distinct required response key')}`);
         }
@@ -60,20 +58,21 @@ export function wholeBodyRelevance(contract) {
     return verdict(rule, false, 'no operation declares more than one distinct required response key');
 }
 /**
- * Rule 3: some operation declares a request key on any of AD-19's four
- * transport channels. The site is the whole channel triple. A key with no
+ * Rule 3: some operation declares a request key on any of its own input
+ * channels, AD-19's four transport channels off an interface that speaks HTTP
+ * and the four command channels off one that does not. The site is the whole
+ * channel triple. A key with no
  * `types` entry has an absent type, a key typed `null` has AD-31's
  * indeterminate one, and both are relevant, so declaring an input and leaving
  * it untyped buys no irrelevance.
  */
 export function malformedInputRelevance(contract) {
     const rule = 'malformed-input';
-    const operations = operationsOf(contract);
+    const operations = resolveOperations(contract);
     if (operations.length === 0)
         return verdict(rule, true, NO_OPERATION);
-    for (const operation of operations) {
-        for (const channel of TRANSPORT_CHANNELS) {
-            const shape = operation.requestShape[channel];
+    for (const { operation, requestChannels } of operations) {
+        for (const { channel, shape } of requestChannels) {
             // `Object.keys` enumerates own keys only. `KeyName` admits
             // `constructor`, which a keyed lookup would find on the prototype.
             const key = shape.requiredKeys[0] ??
@@ -92,11 +91,11 @@ export function malformedInputRelevance(contract) {
  */
 export function perRecordRelevance(contract) {
     const rule = 'per-record';
-    const operations = operationsOf(contract);
+    const operations = resolveOperations(contract);
     if (operations.length === 0)
         return verdict(rule, true, NO_OPERATION);
-    for (const operation of operations) {
-        const { collectionLocations } = operation.responseDescriptor;
+    for (const { operation, descriptor } of operations) {
+        const { collectionLocations } = descriptor;
         if (collectionLocations === null) {
             return verdict(rule, true, `operation ${operation.operationId} declares no collection-location list, so no collection is declared to range over`);
         }
@@ -132,11 +131,11 @@ export function siblingCrossCheckRelevance(contract) {
  */
 export function omissionAndCompletenessRelevance(contract) {
     const rule = 'omission-and-completeness';
-    const operations = operationsOf(contract);
+    const operations = resolveOperations(contract);
     if (operations.length === 0)
         return verdict(rule, true, NO_OPERATION);
-    for (const operation of operations) {
-        const { collectionLocations } = operation.responseDescriptor;
+    for (const { operation, descriptor } of operations) {
+        const { collectionLocations } = descriptor;
         if (collectionLocations === null) {
             return verdict(rule, true, `operation ${operation.operationId} declares no collection-location list, so no location can name a reference set`);
         }
@@ -155,10 +154,10 @@ export function omissionAndCompletenessRelevance(contract) {
  */
 export function stateChangeReadBackRelevance(contract) {
     const rule = 'state-change-read-back';
-    const operations = operationsOf(contract);
+    const operations = resolveOperations(contract);
     if (operations.length === 0)
         return verdict(rule, true, NO_OPERATION);
-    for (const operation of operations) {
+    for (const { operation } of operations) {
         if (operation.stateChangeMarker) {
             return verdict(rule, true, `operation ${operation.operationId} declares stateChangeMarker: true`);
         }

package/dist/core/coverage/satisfaction.d.ts

@@ -1,7 +1,7 @@
 import { type EvalContract } from '../schemas/eval-contract.ts';
 import type { Expression } from '../schemas/expression.ts';
-import type { Operation } from '../schemas/interface.ts';
 import { type PlanIndex } from '../seal/plan-index.ts';
+import { type ResolvedOperation } from './operations.ts';
 import { type DisciplineRule } from './rules.ts';
 export type SatisfactionVerdict = {
     readonly rule: DisciplineRule;
@@ -40,7 +40,7 @@ type OracleView = {
  * own, which is what every per-rule fixture does.
  */
 export type SatisfactionContext = {
-    readonly operations: readonly Operation[];
+    readonly operations: readonly ResolvedOperation[];
     readonly index: PlanIndex;
     readonly oracles: readonly OracleView[];
 };