eval-quality 0.2.0 → 0.5.0

package/dist/core/schemas/probe.d.ts

@@ -431,10 +431,90 @@ export declare const Probe: z.ZodDiscriminatedUnion<[z.ZodObject<{
             relation: z.ZodType<import("./expression.ts").Expression, unknown, z.core.$ZodTypeInternals<import("./expression.ts").Expression, unknown>>;
         }, z.core.$strict>>;
     }, z.core.$strict>>;
-    defectSignature: z.ZodNullable<z.ZodObject<{
+    defectSignature: z.ZodNullable<z.ZodUnion<readonly [z.ZodObject<{
+        observableChannel: z.ZodEnum<{
+            artifact: "artifact";
+            "call-inputs": "call-inputs";
+            "exit-code": "exit-code";
+            "response-body": "response-body";
+            "response-headers": "response-headers";
+            "response-status": "response-status";
+            stderr: "stderr";
+            stdout: "stdout";
+        }>;
+        condition: z.ZodObject<{
+            selector: z.ZodObject<{
+                inputBinding: z.ZodObject<{
+                    path: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
+                    query: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
+                    header: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
+                    body: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
+                    argument: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
+                    option: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
+                    environment: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
+                    stdin: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
+                }, z.core.$strict>;
+            }, z.core.$strict>;
+            predicate: z.ZodType<import("./expression.ts").Expression, unknown, z.core.$ZodTypeInternals<import("./expression.ts").Expression, unknown>>;
+        }, z.core.$strict>;
         interfaceKind: z.ZodEnum<{
             api: "api";
-            cli: "cli";
             mcp: "mcp";
             web: "web";
         }>;
@@ -448,7 +528,9 @@ export declare const Probe: z.ZodDiscriminatedUnion<[z.ZodObject<{
             PUT: "PUT";
         }>;
         pathTemplate: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
         observableChannel: z.ZodEnum<{
+            artifact: "artifact";
             "call-inputs": "call-inputs";
             "exit-code": "exit-code";
             "response-body": "response-body";
@@ -492,10 +574,47 @@ export declare const Probe: z.ZodDiscriminatedUnion<[z.ZodObject<{
                             "type-violating": "type-violating";
                         }>;
                     }, z.core.$strict>]>>>;
+                    argument: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
+                    option: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
+                    environment: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
+                    stdin: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                        literal: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+                    }, z.core.$strict>, z.ZodObject<{
+                        matcher: z.ZodEnum<{
+                            any: "any";
+                            "type-violating": "type-violating";
+                        }>;
+                    }, z.core.$strict>]>>>;
                 }, z.core.$strict>;
             }, z.core.$strict>;
             predicate: z.ZodType<import("./expression.ts").Expression, unknown, z.core.$ZodTypeInternals<import("./expression.ts").Expression, unknown>>;
         }, z.core.$strict>;
-    }, z.core.$strict>>;
+        interfaceKind: z.ZodLiteral<"cli">;
+        invocation: z.ZodObject<{
+            executable: z.ZodString;
+            subcommandPath: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>;
+    }, z.core.$strict>]>>;
 }, z.core.$strict>], "expectedClean">;
 export type Probe = z.infer<typeof Probe>;

package/dist/core/schemas/probe.js

@@ -82,5 +82,5 @@ export const Probe = z
 ])
     .meta({
     id: 'Probe',
-    description: "One corpus probe. Succeeds the prior-art `h0-ground-truth` schema per AD-24, carrying its system identifier, implementation digest, `expectedClean` flag, seeded defects, and rationale, and adding AD-9's probe class and AD-9's per-probe artifact and commit digests. Divergences: `implementationSha` becomes `implementationDigest`, `taskId` does not survive because the probe pins what it describes by digest, and `expectedGate` does not survive because AD-40 makes detection a signature match rather than a verdict comparison and AD-7 keeps comparisons inside the dominance vector, so carrying an expected gate would invite a comparison the architecture forbids. Two constructions landed here together under one BREAKING `schemaVersion` bump: AD-9's per-class QUALIFICATION record, as a five-route tagged union required on every branch, and AD-40's machine-readable DEFECT SIGNATURE on the `expectedClean: false` branch, carrying the interface kind, the home operation as a method and a path template, the observable channel, and the discriminating condition. Both are required rather than optional, which is what makes the bump breaking under AD-11: every corpus written against version 1 fails to parse. What the schema still does not decide is stated rather than hidden. AD-9's \"an unqualified probe cannot enter a sealed set\" is a corpus-construction invariant enforced by the qualification gate in `core/score/qualification.ts`, not by this schema: all eight class-and-`expectedClean` pairings parse, a route incompatible with the pair parses, and a signature-less non-canary parses, each so the gate can return a reason code carrying an artifact path instead of an anonymous parse failure. The constraint ledger carries both gaps.",
+    description: "One corpus probe. Succeeds the prior-art `h0-ground-truth` schema per AD-24, carrying its system identifier, implementation digest, `expectedClean` flag, seeded defects, and rationale, and adding AD-9's probe class and AD-9's per-probe artifact and commit digests. Divergences: `implementationSha` becomes `implementationDigest`, `taskId` does not survive because the probe pins what it describes by digest, and `expectedGate` does not survive because AD-40 makes detection a signature match rather than a verdict comparison and AD-7 keeps comparisons inside the dominance vector, so carrying an expected gate would invite a comparison the architecture forbids. Two constructions landed here together under one BREAKING `schemaVersion` bump: AD-9's per-class QUALIFICATION record, as a five-route tagged union required on every branch, and AD-40's machine-readable DEFECT SIGNATURE on the `expectedClean: false` branch, carrying the interface kind, the home operation as a method and a path template, the observable channel, and the discriminating condition. Both are required rather than optional, which is what makes the bump breaking under AD-11: every corpus written against version 1 fails to parse. Version 3 opened the signature to a second interface kind: it is a union on `interfaceKind`, where the `cli` branch declares a logical invocation in place of a method and a path template, and the selector's input binding carries the four command channels beside the four transport ones. What the schema still does not decide is stated rather than hidden. AD-9's \"an unqualified probe cannot enter a sealed set\" is a corpus-construction invariant enforced by the qualification gate in `core/score/qualification.ts`, not by this schema: all eight class-and-`expectedClean` pairings parse, a route incompatible with the pair parses, and a signature-less non-canary parses, each so the gate can return a reason code carrying an artifact path instead of an anonymous parse failure. The constraint ledger carries both gaps.",
 });

package/dist/core/schemas/sealed-run-record.d.ts

@@ -5,8 +5,38 @@ import { JsonValue } from './primitives.ts';
  * AD-23's verbatim quotation, paired with the channel it came from: a
  * quotation with no channel cannot be audited against its source observation
  * (ADR-009 Decision 2).
+ *
+ * Two arms rather than one shape with a nullable identifier and a `.refine()`
+ * over the pair. The identifier is meaningful on exactly one channel, and the
+ * first spelling of this field said so in prose while admitting every other
+ * combination: `channel: "response-body"` with a non-null `artifactId` parsed,
+ * and `projectChannel` reads the identifier only on the artifact channel, so
+ * the quotation was audited against the response body and a record naming a
+ * file it never consulted produced no condition at all. That is a narrower
+ * spelling of the wrong-file hole `artifactId` was added to close.
+ *
+ * A refinement would not have closed it either, for the reason
+ * `evidence-artifact.ts` records where it narrows a mode to a literal instead:
+ * a refinement never exports, so the published document keeps admitting the
+ * disagreement, and AD-13's corpus-mutation generator synthesises witnesses
+ * from a branch's own JSON Schema with no knowledge of a Zod-only cross-field
+ * rule. Narrowing the schema removes the gap at its source.
+ *
+ * A plain union rather than a discriminated one, on `DefectSignature`'s own
+ * reasoning: the discriminator would be `channel`, and one arm carries seven
+ * values for it. The two arms are told apart by the channel they name.
+ *
+ * The `EvidenceChannel` `$ref` is not carried at this site, since neither arm
+ * accepts the whole vocabulary. A non-TypeScript consumer reads a literal on
+ * one arm and a seven-member enum on the other, which is the rule itself
+ * rather than a reference plus a sentence about it.
  */
-export declare const QuotedEvidence: z.ZodObject<{
+export declare const ArtifactQuotedEvidence: z.ZodObject<{
+    quote: z.ZodString;
+    channel: z.ZodLiteral<"artifact">;
+    artifactId: z.ZodString;
+}, z.core.$strict>;
+export declare const ChannelQuotedEvidence: z.ZodObject<{
     quote: z.ZodString;
     channel: z.ZodEnum<{
         "call-inputs": "call-inputs";
@@ -17,7 +47,25 @@ export declare const QuotedEvidence: z.ZodObject<{
         stderr: "stderr";
         stdout: "stdout";
     }>;
+    artifactId: z.ZodNull;
 }, z.core.$strict>;
+export declare const QuotedEvidence: z.ZodUnion<readonly [z.ZodObject<{
+    quote: z.ZodString;
+    channel: z.ZodLiteral<"artifact">;
+    artifactId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    quote: z.ZodString;
+    channel: z.ZodEnum<{
+        "call-inputs": "call-inputs";
+        "exit-code": "exit-code";
+        "response-body": "response-body";
+        "response-headers": "response-headers";
+        "response-status": "response-status";
+        stderr: "stderr";
+        stdout: "stdout";
+    }>;
+    artifactId: z.ZodNull;
+}, z.core.$strict>]>;
 /**
  * `defect` findings additionally require observation identifiers and quoted
  * evidence (AD-23). A nullable field can't express "required on this branch
@@ -49,7 +97,11 @@ export declare const Finding: z.ZodDiscriminatedUnion<[z.ZodObject<{
     }, z.core.$strict>], "storage">>;
     findingType: z.ZodLiteral<"defect">;
     observationIds: z.ZodArray<z.ZodString>;
-    quotedEvidence: z.ZodArray<z.ZodObject<{
+    quotedEvidence: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        quote: z.ZodString;
+        channel: z.ZodLiteral<"artifact">;
+        artifactId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
         quote: z.ZodString;
         channel: z.ZodEnum<{
             "call-inputs": "call-inputs";
@@ -60,7 +112,8 @@ export declare const Finding: z.ZodDiscriminatedUnion<[z.ZodObject<{
             stderr: "stderr";
             stdout: "stdout";
         }>;
-    }, z.core.$strict>>;
+        artifactId: z.ZodNull;
+    }, z.core.$strict>]>>;
 }, z.core.$strict>, z.ZodObject<{
     findingId: z.ZodString;
     oracleId: z.ZodNullable<z.ZodString>;
@@ -147,6 +200,10 @@ export declare const ObservedCallInputs: z.ZodObject<{
     query: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
     header: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
     body: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
+    argument: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
+    option: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
+    environment: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
+    stdin: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
 }, z.core.$strict>;
 /** the constraint identifier the ledger carries for the check below. */
 export declare const OBSERVATION_SEQUENCE_UNIQUE = "observation-sequence-unique";
@@ -166,18 +223,48 @@ export declare const Observation: z.ZodObject<{
         baseline: "baseline";
         "evaluator-chosen": "evaluator-chosen";
     }>;
+    principal: z.ZodNullable<z.ZodString>;
     callInputs: z.ZodObject<{
         path: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
         query: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
         header: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
         body: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
+        argument: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
+        option: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
+        environment: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
+        stdin: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
     }, z.core.$strict>;
     responseBody: z.ZodNullable<z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>;
     responseHeaders: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
     responseStatus: z.ZodNullable<z.ZodInt>;
-    stdout: z.ZodNullable<z.ZodString>;
-    stderr: z.ZodNullable<z.ZodString>;
+    stdout: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"json">;
+        value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"text">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"absent">;
+    }, z.core.$strict>], "kind">;
+    stderr: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"json">;
+        value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"text">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"absent">;
+    }, z.core.$strict>], "kind">;
     exitCode: z.ZodNullable<z.ZodInt>;
+    artifacts: z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"json">;
+        value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"text">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"absent">;
+    }, z.core.$strict>], "kind">>;
 }, z.core.$strict>;
 export type ObservedCallInputs = z.infer<typeof ObservedCallInputs>;
 export type Observation = z.infer<typeof Observation>;
@@ -281,7 +368,11 @@ export declare const SealedRunRecord: z.ZodObject<{
         }, z.core.$strict>], "storage">>;
         findingType: z.ZodLiteral<"defect">;
         observationIds: z.ZodArray<z.ZodString>;
-        quotedEvidence: z.ZodArray<z.ZodObject<{
+        quotedEvidence: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+            quote: z.ZodString;
+            channel: z.ZodLiteral<"artifact">;
+            artifactId: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
             quote: z.ZodString;
             channel: z.ZodEnum<{
                 "call-inputs": "call-inputs";
@@ -292,7 +383,8 @@ export declare const SealedRunRecord: z.ZodObject<{
                 stderr: "stderr";
                 stdout: "stdout";
             }>;
-        }, z.core.$strict>>;
+            artifactId: z.ZodNull;
+        }, z.core.$strict>]>>;
     }, z.core.$strict>, z.ZodObject<{
         findingId: z.ZodString;
         oracleId: z.ZodNullable<z.ZodString>;
@@ -352,18 +444,48 @@ export declare const SealedRunRecord: z.ZodObject<{
             baseline: "baseline";
             "evaluator-chosen": "evaluator-chosen";
         }>;
+        principal: z.ZodNullable<z.ZodString>;
         callInputs: z.ZodObject<{
             path: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
             query: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
             header: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
             body: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
+            argument: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
+            option: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
+            environment: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
+            stdin: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
         }, z.core.$strict>;
         responseBody: z.ZodNullable<z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>;
         responseHeaders: z.ZodNullable<z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>>;
         responseStatus: z.ZodNullable<z.ZodInt>;
-        stdout: z.ZodNullable<z.ZodString>;
-        stderr: z.ZodNullable<z.ZodString>;
+        stdout: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"json">;
+            value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"text">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"absent">;
+        }, z.core.$strict>], "kind">;
+        stderr: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"json">;
+            value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"text">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"absent">;
+        }, z.core.$strict>], "kind">;
         exitCode: z.ZodNullable<z.ZodInt>;
+        artifacts: z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"json">;
+            value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"text">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"absent">;
+        }, z.core.$strict>], "kind">>;
     }, z.core.$strict>>;
     judgeResults: z.ZodArray<z.ZodObject<{
         rubricId: z.ZodString;

package/dist/core/schemas/sealed-run-record.js

@@ -3,21 +3,58 @@ import { z } from 'zod';
 import { ArtifactReference } from './artifact-reference.js';
 import { Severity } from './eval-contract.js';
 import { lineageFields } from './lineage.js';
-import { EvidenceChannel } from './pointer.js';
+import { IDENTIFIER_ROOTED_CHANNEL, NON_IDENTIFIER_ROOTED_CHANNELS, } from './pointer.js';
 import { BehaviorId, Digest, FindingId, Identifier, JsonObjectValue, JsonValue, OracleId, ProbeId, RubricCriterionId, RubricId, UnsignedDecimalString, } from './primitives.js';
+import { ProbeObservedBody } from './probe-body.js';
 import { EvaluatorRecommendation } from './verdict.js';
+const QUOTE_DESCRIPTION = "The evaluator's verbatim quotation, per AD-23. Non-empty: an empty quotation quotes nothing, no AD-5 code names the condition, and under the admit-rule's second clause the schema is therefore the enforcement point. That this text appears in at least one of the finding's cited observations is NOT checked here; it is an AD-32 declared-versus-observed inconsistency that invalidates at ingest, and ADR-009 Decision 2 settles the precedence: \"cited identifiers govern the witness match; quotation audits it.\"";
+const quote = z.string().min(1).describe(QUOTE_DESCRIPTION);
 /**
  * AD-23's verbatim quotation, paired with the channel it came from: a
  * quotation with no channel cannot be audited against its source observation
  * (ADR-009 Decision 2).
+ *
+ * Two arms rather than one shape with a nullable identifier and a `.refine()`
+ * over the pair. The identifier is meaningful on exactly one channel, and the
+ * first spelling of this field said so in prose while admitting every other
+ * combination: `channel: "response-body"` with a non-null `artifactId` parsed,
+ * and `projectChannel` reads the identifier only on the artifact channel, so
+ * the quotation was audited against the response body and a record naming a
+ * file it never consulted produced no condition at all. That is a narrower
+ * spelling of the wrong-file hole `artifactId` was added to close.
+ *
+ * A refinement would not have closed it either, for the reason
+ * `evidence-artifact.ts` records where it narrows a mode to a literal instead:
+ * a refinement never exports, so the published document keeps admitting the
+ * disagreement, and AD-13's corpus-mutation generator synthesises witnesses
+ * from a branch's own JSON Schema with no knowledge of a Zod-only cross-field
+ * rule. Narrowing the schema removes the gap at its source.
+ *
+ * A plain union rather than a discriminated one, on `DefectSignature`'s own
+ * reasoning: the discriminator would be `channel`, and one arm carries seven
+ * values for it. The two arms are told apart by the channel they name.
+ *
+ * The `EvidenceChannel` `$ref` is not carried at this site, since neither arm
+ * accepts the whole vocabulary. A non-TypeScript consumer reads a literal on
+ * one arm and a seven-member enum on the other, which is the rule itself
+ * rather than a reference plus a sentence about it.
  */
-export const QuotedEvidence = z.strictObject({
-    quote: z
-        .string()
-        .min(1)
-        .describe("The evaluator's verbatim quotation, per AD-23. Non-empty: an empty quotation quotes nothing, no AD-5 code names the condition, and under the admit-rule's second clause the schema is therefore the enforcement point. That this text appears in at least one of the finding's cited observations is NOT checked here; it is an AD-32 declared-versus-observed inconsistency that invalidates at ingest, and ADR-009 Decision 2 settles the precedence: \"cited identifiers govern the witness match; quotation audits it.\""),
-    channel: EvidenceChannel,
+export const ArtifactQuotedEvidence = z.strictObject({
+    quote,
+    channel: z.literal(IDENTIFIER_ROOTED_CHANNEL),
+    artifactId: Identifier.describe("Which written file the quotation came from. A channel alone does not identify one: an operation may write several, and an audit that searched all of them at once accepted a quotation lifted from a file the finding never cited, which is the opposite of what AD-23's verbatim requirement is for."),
+});
+export const ChannelQuotedEvidence = z.strictObject({
+    quote,
+    channel: z.enum(NON_IDENTIFIER_ROOTED_CHANNELS),
+    artifactId: z
+        .null()
+        .describe('Null on every channel but `artifact`, and required rather than optional so a record cannot omit the question. Only a written file needs naming; every other channel is one thing per observation.'),
 });
+export const QuotedEvidence = z.union([
+    ArtifactQuotedEvidence,
+    ChannelQuotedEvidence,
+]);
 // Spread into each finding branch rather than shared as a base object: a
 // spread adds no `$defs` entry, so each branch exports as a complete shape a
 // non-TypeScript consumer can read without following a reference (AD-13).
@@ -108,6 +145,10 @@ export const ObservedCallInputs = z.strictObject({
     query: JsonObjectValue.nullable(),
     header: JsonObjectValue.nullable(),
     body: JsonObjectValue.nullable(),
+    argument: JsonObjectValue.nullable(),
+    option: JsonObjectValue.nullable(),
+    environment: JsonObjectValue.nullable(),
+    stdin: JsonObjectValue.nullable(),
 });
 /** the constraint identifier the ledger carries for the check below. */
 export const OBSERVATION_SEQUENCE_UNIQUE = 'observation-sequence-unique';
@@ -129,6 +170,7 @@ export const Observation = z.strictObject({
     provenance: z
         .enum(['baseline', 'evaluator-chosen'])
         .describe("AD-23: `baseline` for a pre-canned or deterministic test, `evaluator-chosen` for an action the evaluator selected. The distinction is the one the product's central finding rests on: what a sealed evaluator detects beyond the pre-canned baseline. It lives on the observation, never on the finding."),
+    principal: Identifier.nullable().describe("The declared principal the harness acted as, or `null` where the run named none. Owed item 3's other half: a `{ principal }` input binding is presence-only by construction, since the contract declares a name and the harness provisions the value, so without this field two steps of one operation binding `owner` and `other-user` both match every observation and both resolve `several`. That is exactly the act-as-A-read-as-B shape the two critical-severity cross-user behaviours need, and it was unscoreable while the record said nothing about which account was used. An opaque label carrying no account identifier or credential, on `testData.principals`' own AD-18 terms."),
     callInputs: ObservedCallInputs,
     responseBody: JsonValue.nullable().describe('AD-26\'s `response-body` channel. The null branch is redundant against the value container, which already admits `null`; it is kept so all ten observation fields read the same way, and it means "no body observed" and "a body that was JSON null" are indistinguishable here, which is an accepted cost of one uniform spelling.'),
     responseHeaders: JsonObjectValue.nullable().describe('A name-to-value map, not the open value container. AD-26 gives `response-headers` a tail, so a pointer resolves INTO this channel; a scalar here would leave `/interactions/x/response-headers/Content-Type` addressing nothing. That is the difference from `responseBody`, where a scalar or an array is a legitimate body and the open container is correct.'),
@@ -137,12 +179,15 @@ export const Observation = z.strictObject({
         .min(0)
         .nullable()
         .describe('Deliberately not bounded to a protocol range. A negative status is meaningless and excluded, but the upper end is left open: AD-19 declares four interface kinds and v0 rejects three of them at compile time under `unsupported-interface-kind`, so bounding this to HTTP would encode a protocol assumption the artifact outlives. `null` where the channel does not apply.'),
-    stdout: z.string().nullable(),
-    stderr: z.string().nullable(),
+    stdout: ProbeObservedBody.describe('AD-26\'s `stdout` channel, tagged rather than a bare string. An operation may nominate standard output as the channel its response descriptor describes, in which case a pointer descends into it, and an untagged string could not tell output that was JSON from output that was only ever text. `{ "kind": "absent" }` is the channel a run did not observe.'),
+    stderr: ProbeObservedBody.describe("AD-26's `stderr` channel, tagged on the same terms as `stdout`."),
     exitCode: z
         .int()
         .nullable()
         .describe('Signed on purpose, unlike `responseStatus`: a process terminated by a signal is conventionally reported as a negative code, and this field records what was observed rather than what is tidy.'),
+    artifacts: z
+        .record(Identifier, ProbeObservedBody)
+        .describe("AD-26's `artifact` channel, keyed by the identifier the operation declares it writes, which is the segment an artifact pointer carries before its tail. Caller-keyed and expected to be partial: a run that wrote no files carries `{}`. Tagged on the same terms as `stdout`, since a written report may be JSON, may be prose, and may not have been written at all."),
 });
 /**
  * AD-17: judge results arrive inside the sealed run record and the package
@@ -154,7 +199,7 @@ export const JudgeResult = z.strictObject({
     score: z
         .int()
         .nullable()
-        .describe("An integer, because AD-22 puts the scale on the rubric's own anchored levels and `ScaleLevel.level` is already `z.int()`; no second scale is minted here. `null` is the shape AD-6's `judge-error` fires on, so it must parse. That the criterion is one the cited rubric declares, and that a conforming record shows one judge call scoring all named criteria, are AD-17 cross-artifact rules a schema over one artifact cannot see."),
+        .describe("An integer, because AD-22 puts the scale on the rubric's own anchored levels and `ScaleLevel.level` is already `z.int()`; no second scale is minted here. `null` is the shape AD-6's `judge-error` fires on, so it must parse. Two AD-17 rules sit over this field and only one of them is decidable from a record. That a criterion is scored at most once IS: `core/ingest` reports a repeated `rubricId`/`criterionId` pair as a `duplicate-record-identifier` condition, since a criterion scored twice is not one judge call's product whatever else the record says. That a scored criterion is one the cited rubric DECLARES is not, and never will be from inside this package: the rubric is not among ingest's declared inputs, no stage row names it, and a schema over one artifact has no second operand. That half is the caller's, on the same terms AD-12 states for the remediation cap, and it is a stated boundary rather than an unimplemented rule."),
     note: z.string().nullable(),
 });
 /** the prior art's five members, with money as a string per AD-36. */
@@ -243,5 +288,5 @@ export const SealedRunRecord = z
 })
     .meta({
     id: 'SealedRunRecord',
-    description: "One sealed evaluator trial, as the caller presents it. Succeeds the prior-art `h0-run-result` schema per AD-24, keeping its run identifier, condition arm, findings, action-log reference, resource use, invalidation reason, evaluator recommendation as a closed enum, and per-finding confidence on a declared scale. Divergences: `condition` is demoted to the opaque `conditionArm`, `verdict` becomes `evaluatorRecommendation` without `NOT_APPLICABLE`, money is a decimal string, and `taskId`, `note`, and per-finding `actionIds` do not survive: the contract is pinned by `contractDigest`, an unstructured orchestrator annotation is the free-prose channel the Conventions close everywhere else, and two citation vocabularies on one finding is the ambiguity ADR-009 removed. The run MODE landed here as a required field under a BREAKING `schemaVersion` bump, which is where AD-21's \"fixed before ingest\" puts it; owed item 4 is now closed: mode enters AD-11's identity inputs as `ScoringVersionInputs`'s sixth field, and `core/score/ladder.ts` carries `ProductionAssessment`/`ContractAssessment` as the two assessment input types with their own total ladders. Observation ORDERING landed here too, under its own BREAKING `schemaVersion` bump: `sequence` is required and unique per record, closing owed item 2's ADR-006 gap, since array position was never a legal ordering.",
+    description: "One sealed evaluator trial, as the caller presents it. Succeeds the prior-art `h0-run-result` schema per AD-24, keeping its run identifier, condition arm, findings, action-log reference, resource use, invalidation reason, evaluator recommendation as a closed enum, and per-finding confidence on a declared scale. Divergences: `condition` is demoted to the opaque `conditionArm`, `verdict` becomes `evaluatorRecommendation` without `NOT_APPLICABLE`, money is a decimal string, and `taskId`, `note`, and per-finding `actionIds` do not survive: the contract is pinned by `contractDigest`, an unstructured orchestrator annotation is the free-prose channel the Conventions close everywhere else, and two citation vocabularies on one finding is the ambiguity ADR-009 removed. The run MODE landed here as a required field under a BREAKING `schemaVersion` bump, which is where AD-21's \"fixed before ingest\" puts it; owed item 4 is now closed: mode enters AD-11's identity inputs as `ScoringVersionInputs`'s sixth field, and `core/score/ladder.ts` carries `ProductionAssessment`/`ContractAssessment` as the two assessment input types with their own total ladders. Observation ORDERING landed here too, under its own BREAKING `schemaVersion` bump: `sequence` is required and unique per record, closing owed item 2's ADR-006 gap, since array position was never a legal ordering. Version 4 opened the record to a system under test that runs behind a command: `callInputs` carries the four command channels beside the four transport ones, `stdout` and `stderr` are tagged rather than bare strings so a nominated output channel can be descended into, and `artifacts` records the files the run wrote, keyed by the identifier the operation declares.",
 });