eval-quality 0.2.0 → 0.5.0

package/dist/core/schemas/sensitivity-witness.d.ts

@@ -11,7 +11,7 @@ import { Expression } from './expression.ts';
  * leg the plan could not map onto a `ProbeRequest` would declare work nothing
  * runs.
  */
-export declare const WitnessInputs: z.ZodObject<{
+export declare const ApiWitnessInputs: z.ZodObject<{
     path: z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>;
     query: z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>;
     header: z.ZodRecord<z.ZodString, z.ZodString>;
@@ -22,6 +22,72 @@ export declare const WitnessInputs: z.ZodObject<{
         kind: z.ZodLiteral<"absent">;
     }, z.core.$strict>], "kind">;
 }, z.core.$strict>;
+export type ApiWitnessInputs = z.infer<typeof ApiWitnessInputs>;
+/**
+ * The same, for a leg supplied to a command-kind operation. `stdin` is a
+ * tagged value rather than a key map for exactly the reason `body` is: one leg
+ * supplies a value and has to tell an absent standard input from one carrying
+ * JSON null, which a key map cannot express. The request shape's `stdin` stays
+ * a key map, because a declaration says which keys an operation accepts.
+ * `suppliedKeys` is the code that bridges the two spellings and it
+ * special-cases `stdin` alongside `body`.
+ *
+ * AD-18 applies to `environment` the way it applies to `header`, so an
+ * environment value carries no credential.
+ */
+export declare const CommandWitnessInputs: z.ZodObject<{
+    argument: z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>;
+    option: z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>;
+    environment: z.ZodRecord<z.ZodString, z.ZodString>;
+    stdin: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"json">;
+        value: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"text">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"absent">;
+    }, z.core.$strict>], "kind">;
+}, z.core.$strict>;
+export type CommandWitnessInputs = z.infer<typeof CommandWitnessInputs>;
+/**
+ * Either spelling. A plain union rather than a discriminated one for the same
+ * reason `InputBinding` is: the leg names an operation and the kind of the
+ * interface declaring it lives in another subtree, so no discriminator is
+ * available to the schema and the agreement is a compile-time check.
+ *
+ * Only the sensitivity leg takes the union. `ManifestationWitness` and
+ * `FixtureReset` keep the transport spelling, which keeps the probe artifact
+ * byte-identical and keeps this shape's widening inside the eval contract's own
+ * version bump. That is truthful rather than merely convenient: both of those
+ * legs are issued through the environment-probe port, whose `ProbeRequest`
+ * carries a method, a path template, and the four transport channels, and
+ * pre-flight rejects a non-api interface for exactly that reason.
+ */
+export declare const WitnessInputs: z.ZodUnion<readonly [z.ZodObject<{
+    path: z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>;
+    query: z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>;
+    header: z.ZodRecord<z.ZodString, z.ZodString>;
+    body: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"json">;
+        value: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"absent">;
+    }, z.core.$strict>], "kind">;
+}, z.core.$strict>, z.ZodObject<{
+    argument: z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>;
+    option: z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>;
+    environment: z.ZodRecord<z.ZodString, z.ZodString>;
+    stdin: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"json">;
+        value: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"text">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"absent">;
+    }, z.core.$strict>], "kind">;
+}, z.core.$strict>]>;
 export type WitnessInputs = z.infer<typeof WitnessInputs>;
 /**
  * Half a witness pair. `legId` roots the relation's pointers, which address this
@@ -30,7 +96,7 @@ export type WitnessInputs = z.infer<typeof WitnessInputs>;
  */
 export declare const SensitivityWitnessLeg: z.ZodObject<{
     legId: z.ZodString;
-    inputs: z.ZodObject<{
+    inputs: z.ZodUnion<readonly [z.ZodObject<{
         path: z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>;
         query: z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>;
         header: z.ZodRecord<z.ZodString, z.ZodString>;
@@ -40,14 +106,33 @@ export declare const SensitivityWitnessLeg: z.ZodObject<{
         }, z.core.$strict>, z.ZodObject<{
             kind: z.ZodLiteral<"absent">;
         }, z.core.$strict>], "kind">;
-    }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        argument: z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>;
+        option: z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>;
+        environment: z.ZodRecord<z.ZodString, z.ZodString>;
+        stdin: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"json">;
+            value: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"text">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"absent">;
+        }, z.core.$strict>], "kind">;
+    }, z.core.$strict>]>;
 }, z.core.$strict>;
 export type SensitivityWitnessLeg = z.infer<typeof SensitivityWitnessLeg>;
-export declare const WITNESS_CHANNELS: readonly ['path', 'query', 'body'];
+export declare const API_WITNESS_CHANNELS: readonly ['path', 'query', 'body'];
+export declare const COMMAND_WITNESS_CHANNELS: readonly ['argument', 'option', 'environment', 'stdin'];
+export declare const WITNESS_CHANNELS: readonly ["path", "query", "body", "argument", "option", "environment", "stdin"];
 export declare const WitnessChannel: z.ZodEnum<{
+    argument: "argument";
     body: "body";
+    environment: "environment";
+    option: "option";
     path: "path";
     query: "query";
+    stdin: "stdin";
 }>;
 export type WitnessChannel = z.infer<typeof WitnessChannel>;
 /**
@@ -67,13 +152,17 @@ export type WitnessChannel = z.infer<typeof WitnessChannel>;
 export declare const SensitivityWitness: z.ZodObject<{
     witnessId: z.ZodString;
     channel: z.ZodEnum<{
+        argument: "argument";
         body: "body";
+        environment: "environment";
+        option: "option";
         path: "path";
         query: "query";
+        stdin: "stdin";
     }>;
     legs: z.ZodArray<z.ZodObject<{
         legId: z.ZodString;
-        inputs: z.ZodObject<{
+        inputs: z.ZodUnion<readonly [z.ZodObject<{
             path: z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>;
             query: z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>;
             header: z.ZodRecord<z.ZodString, z.ZodString>;
@@ -83,7 +172,20 @@ export declare const SensitivityWitness: z.ZodObject<{
             }, z.core.$strict>, z.ZodObject<{
                 kind: z.ZodLiteral<"absent">;
             }, z.core.$strict>], "kind">;
-        }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            argument: z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>;
+            option: z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>;
+            environment: z.ZodRecord<z.ZodString, z.ZodString>;
+            stdin: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"json">;
+                value: z.ZodType<import("./primitives.ts").JsonValue, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonValue, unknown>>;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"text">;
+                value: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"absent">;
+            }, z.core.$strict>], "kind">;
+        }, z.core.$strict>]>;
     }, z.core.$strict>>;
     relation: z.ZodType<Expression, unknown, z.core.$ZodTypeInternals<Expression, unknown>>;
 }, z.core.$strict>;

package/dist/core/schemas/sensitivity-witness.js

@@ -2,7 +2,7 @@
 import { z } from 'zod';
 import { Expression } from './expression.js';
 import { Identifier, JsonObjectValue, KeyName } from './primitives.js';
-import { ProbeRequestBody } from './probe-body.js';
+import { ProbeRequestBody, ProbeRequestStdin } from './probe-body.js';
 /**
  * The four transport channels one probe leg supplies, as values. `RequestShape`
  * declares what an operation accepts; this declares what one leg sends. AD-18
@@ -13,7 +13,7 @@ import { ProbeRequestBody } from './probe-body.js';
  * leg the plan could not map onto a `ProbeRequest` would declare work nothing
  * runs.
  */
-export const WitnessInputs = z
+export const ApiWitnessInputs = z
     .strictObject({
     path: JsonObjectValue,
     query: JsonObjectValue,
@@ -24,6 +24,46 @@ export const WitnessInputs = z
     id: 'WitnessInputs',
     description: "One probe leg's supplied inputs, keyed by AD-19 transport channel, in the spelling the environment-probe port accepts. Shared by both witness kinds and by the fixture reset, so the export carries it once.",
 });
+/**
+ * The same, for a leg supplied to a command-kind operation. `stdin` is a
+ * tagged value rather than a key map for exactly the reason `body` is: one leg
+ * supplies a value and has to tell an absent standard input from one carrying
+ * JSON null, which a key map cannot express. The request shape's `stdin` stays
+ * a key map, because a declaration says which keys an operation accepts.
+ * `suppliedKeys` is the code that bridges the two spellings and it
+ * special-cases `stdin` alongside `body`.
+ *
+ * AD-18 applies to `environment` the way it applies to `header`, so an
+ * environment value carries no credential.
+ */
+// Bare, with no `.meta({ id })`, and the reason is a published-schema one
+// rather than a size one. A `$ref`'d definition's own errors reach ajv with a
+// schema path relative to that definition, so two definitions under one
+// `anyOf` report `#/required` and `#/additionalProperties` at the same
+// instance path and nothing tells them apart. AD-13's mutation sweep needs one
+// keyword deletion to be attributable to one occurrence, and the branch is
+// attributable only while it is spelled in place.
+export const CommandWitnessInputs = z.strictObject({
+    argument: JsonObjectValue,
+    option: JsonObjectValue,
+    environment: z.record(KeyName, z.string()),
+    stdin: ProbeRequestStdin,
+});
+/**
+ * Either spelling. A plain union rather than a discriminated one for the same
+ * reason `InputBinding` is: the leg names an operation and the kind of the
+ * interface declaring it lives in another subtree, so no discriminator is
+ * available to the schema and the agreement is a compile-time check.
+ *
+ * Only the sensitivity leg takes the union. `ManifestationWitness` and
+ * `FixtureReset` keep the transport spelling, which keeps the probe artifact
+ * byte-identical and keeps this shape's widening inside the eval contract's own
+ * version bump. That is truthful rather than merely convenient: both of those
+ * legs are issued through the environment-probe port, whose `ProbeRequest`
+ * carries a method, a path template, and the four transport channels, and
+ * pre-flight rejects a non-api interface for exactly that reason.
+ */
+export const WitnessInputs = z.union([ApiWitnessInputs, CommandWitnessInputs]);
 /**
  * Half a witness pair. `legId` roots the relation's pointers, which address this
  * leg's response as `/interactions/{legId}/response-body/...`, so it shares one
@@ -36,7 +76,23 @@ export const SensitivityWitnessLeg = z.strictObject({
 // AD-10 selects the differential channel by the operation's state-change
 // marker: `path` or `query` where the marker is false, `body` where it is true.
 // `header` is absent on purpose; no AD names a header differential.
-export const WITNESS_CHANNELS = ['path', 'query', 'body'];
+export const API_WITNESS_CHANNELS = ['path', 'query', 'body'];
+// A command operation's differential channel. All four are admitted rather
+// than two: AD-10's marker rule selects `path` or `query` against `body`
+// because an HTTP read carries its identifier in the URL and a write carries
+// it in the body, and a command carries its inputs the same way whether or not
+// it changes state, so the marker decides nothing here. Which channel a given
+// command witness may use is the contract author's choice.
+export const COMMAND_WITNESS_CHANNELS = [
+    'argument',
+    'option',
+    'environment',
+    'stdin',
+];
+export const WITNESS_CHANNELS = [
+    ...API_WITNESS_CHANNELS,
+    ...COMMAND_WITNESS_CHANNELS,
+];
 export const WitnessChannel = z.enum(WITNESS_CHANNELS);
 /**
  * AD-10's typed sensitivity witness: a pair of inputs and the AD-4 relation
@@ -70,7 +126,7 @@ export const ManifestationWitness = z.strictObject({
     legId: Identifier,
     interfaceId: Identifier,
     operationId: Identifier,
-    inputs: WitnessInputs,
+    inputs: ApiWitnessInputs,
     relation: Expression,
 });
 /**
@@ -82,5 +138,5 @@ export const FixtureReset = z.strictObject({
     legId: Identifier,
     interfaceId: Identifier,
     operationId: Identifier,
-    inputs: WitnessInputs,
+    inputs: ApiWitnessInputs,
 });

package/dist/core/score/bindings.d.ts

@@ -1,6 +1,6 @@
 import { type ResolvedValue } from '../evaluate/resolved-value.ts';
 import type { InteractionStep } from '../schemas/plan.ts';
-import { type TransportChannelName } from '../schemas/pointer.ts';
+import type { InputChannelName } from '../schemas/pointer.ts';
 import type { JsonValue } from '../schemas/primitives.ts';
 import type { Observation } from '../schemas/sealed-run-record.ts';
 import { type PlanIndex } from '../seal/plan-index.ts';
@@ -30,7 +30,7 @@ export type CapturedResolution = {
  * JSON-encoded rather than delimiter-joined, since a parameter key is arbitrary
  * caller-supplied text and could contain any separator.
  */
-export declare function bindingSiteKey(stepId: string, transportChannel: TransportChannelName, key: string): string;
+export declare function bindingSiteKey(stepId: string, transportChannel: InputChannelName, key: string): string;
 /**
  * Resolves one captured pointer against the record.
  *

package/dist/core/score/bindings.js

@@ -13,10 +13,10 @@
  * evidence, and no AD-6 outcome state is assigned.
  */
 import { capturedBindings } from '../compile/bindings.js';
+import { boundChannelsOf, requestShapeOf } from '../declared-inputs.js';
 import { channelRoot, walkTail } from '../evaluate/evidence-resolution.js';
 import { ABSENT } from '../evaluate/resolved-value.js';
-import { TRANSPORT_CHANNELS, } from '../schemas/pointer.js';
-import { parseEvidenceTarget } from '../seal/plan-index.js';
+import { anyOperationOf, parseEvidenceTarget, } from '../seal/plan-index.js';
 import { bindingOrder } from './binding-order.js';
 import { selectObservations } from './selection.js';
 const ABSENT_RESOLUTION = { status: 'absent' };
@@ -183,21 +183,22 @@ function capturedFloor(step, resolved) {
  *   irrelevant.
  * - `{ captured: p }`: the observed value deep-equals the resolved captured
  *   value. The ordering half is `capturedFloor`'s, applied before this runs.
- * - `{ matcher: 'any' }` and `{ principal }`: the key is present, and nothing
- *   more. Neither declares a value the contract knows: a principal's value is
- *   provisioned by the harness at runtime, which is the whole reason the
- *   binding exists. The consequence is that two steps differing only by which
- *   principal they bind cannot be separated here, because no field of a sealed
- *   run record says which principal the harness used.
+ * - `{ matcher: 'any' }`: the key is present, and nothing more.
+ * - `{ principal }`: the key is present AND the observation names the same
+ *   principal. The value behind the name is provisioned by the harness at
+ *   runtime, which is the whole reason the binding exists, so the name is all
+ *   either side can compare. `Observation.principal` is what makes that
+ *   comparison possible: without it two steps differing only by which
+ *   principal they bind both matched every observation and both resolved
+ *   `several`.
  * - `{ matcher: 'type-violating' }`: the observed value's JSON type differs
  *   from the operation's declared type for that key. A key whose declared type
  *   is absent or `null` fails closed: an indeterminate type cannot prove a
  *   violation.
  */
 function satisfiesBindings(step, observation, index, resolved) {
-    const operation = index.operationOf(step.operationId);
-    for (const channel of TRANSPORT_CHANNELS) {
-        const binding = step.inputBinding[channel];
+    const operation = anyOperationOf(index, step.operationId);
+    for (const { channel, bound: binding } of boundChannelsOf(step.inputBinding)) {
         if (binding === null)
             continue;
         const observed = observation.callInputs[channel];
@@ -224,11 +225,22 @@ function satisfiesBindings(step, observation, index, resolved) {
                     return false;
                 continue;
             }
-            if ('principal' in value)
+            // Presence plus identity. The contract declares a name and the
+            // harness provisions the value behind it, so the name is all either
+            // side can compare; comparing it is what separates two steps of one
+            // operation that differ only in the account they act as. A record
+            // naming no principal matches no principal-bound step, rather than
+            // matching every one of them.
+            if ('principal' in value) {
+                if (observation.principal !== value.principal)
+                    return false;
                 continue;
+            }
             if (value.matcher === 'any')
                 continue;
-            const declared = operation?.requestShape[channel].types[key];
+            const declared = operation === undefined
+                ? undefined
+                : requestShapeOf(operation, channel)?.types[key];
             if (declared === undefined || declared === null)
                 return false;
             if (jsonTypeOf(actual) === declared)

package/dist/core/score/qualification.d.ts

@@ -1,11 +1,11 @@
 import { type DefectSignature } from '../schemas/defect-signature.ts';
-import type { Operation, PermittedInterface } from '../schemas/interface.ts';
+import type { AnyOperation, PermittedInterface } from '../schemas/interface.ts';
 import type { Probe } from '../schemas/probe.ts';
 /**
  * The closed reason set. Nothing outside it can come back from `qualifyProbe`,
  * so a caller routing a rejection to a rung has a finite table to write.
  */
-export declare const QUALIFICATION_FAILURES: readonly ['qualification-route-incompatible', 'qualification-defect-sources-mixed', 'qualification-evidence-unverified', 'signature-absent', 'signature-present-on-canary', 'signature-interface-kind-unsupported', 'signature-observable-channel-not-response-side', 'condition-channels-underspecified', 'condition-disjunct-without-response-channel', 'condition-selector-key-undeclared', 'condition-pointer-not-observation-rooted', 'condition-pointer-unwritable', 'condition-text-channel-on-api', 'condition-reference-set-operand', 'condition-operand-illegal', 'condition-regex-illegal', 'condition-quantifier-nesting', 'condition-quantifier-over-non-collection', 'condition-bound-element-outside-quantifier'];
+export declare const QUALIFICATION_FAILURES: readonly ['qualification-route-incompatible', 'qualification-defect-sources-mixed', 'qualification-evidence-unverified', 'signature-absent', 'signature-present-on-canary', 'signature-interface-kind-unsupported', 'signature-observable-channel-not-response-side', 'condition-channels-underspecified', 'condition-disjunct-without-response-channel', 'condition-selector-key-undeclared', 'condition-pointer-not-observation-rooted', 'condition-pointer-unwritable', 'condition-artifact-channel-contract-local', 'condition-text-channel-on-api', 'condition-reference-set-operand', 'condition-operand-illegal', 'condition-regex-illegal', 'condition-quantifier-nesting', 'condition-quantifier-over-non-collection', 'condition-bound-element-outside-quantifier'];
 export type QualificationFailureCode = (typeof QUALIFICATION_FAILURES)[number];
 export type QualificationFailure = {
     readonly code: QualificationFailureCode;
@@ -36,14 +36,14 @@ export type QualificationResult = {
  * failed compilation under `duplicate-operation-signature`, so the first match
  * is the only match for any contract that compiled.
  */
-export declare function resolveHomeOperation(signature: DefectSignature, interfaces: readonly PermittedInterface[]): Operation | null;
+export declare function resolveHomeOperation(signature: DefectSignature, interfaces: readonly PermittedInterface[]): AnyOperation | null;
 /**
  * AD-9's gate over one probe. `homeOperation` is the operation the signature
  * resolves to in whatever inventory the caller is qualifying against, or `null`
  * when there is none to qualify against; the three declaration-dependent checks
  * are skipped in that case and `declarationChecksRan` says so.
  */
-export declare function qualifyProbe(probe: Probe, homeOperation: Operation | null): QualificationResult;
+export declare function qualifyProbe(probe: Probe, homeOperation: AnyOperation | null): QualificationResult;
 export type QualifiedProbe = {
     readonly probe: Probe;
     readonly result: QualificationResult;
@@ -80,4 +80,4 @@ export type SealedProbeSet = {
  * no inventory writes `() => null` at the call site, where the choice shows up
  * in a diff.
  */
-export declare function sealProbeSet(probes: readonly Probe[], homeOperationOf: (probe: Probe) => Operation | null): SealedProbeSet;
+export declare function sealProbeSet(probes: readonly Probe[], homeOperationOf: (probe: Probe) => AnyOperation | null): SealedProbeSet;

package/dist/core/score/qualification.js

@@ -15,11 +15,13 @@
  * `Error`.
  */
 import { checkExpressionOperandLegality, checkExpressionQuantifierNesting, checkExpressionQuantifierOverNonCollection, checkExpressionRegexConstructs, walkExpression, } from '../compile/expression-legality.js';
-import { operationSignature } from '../compile/interface-inventory.js';
+import { anyOperationSignature, commandSignature, operationSignature, } from '../compile/interface-inventory.js';
 import { checkExpressionBoundElementScope, checkExpressionEvidenceReachability, forEachExpressionPointer, } from '../compile/reachability.js';
+import { requestShapeOf } from '../declared-inputs.js';
 import { StructuralFailure } from '../failure-codes.js';
 import { OBSERVED_STEP_ID, } from '../schemas/defect-signature.js';
-import { TRANSPORT_CHANNELS, } from '../schemas/pointer.js';
+import { operationsOf } from '../schemas/interface.js';
+import { API_RESPONSE_CHANNELS, COMMAND_RESPONSE_CHANNELS, IDENTIFIER_ROOTED_CHANNEL, INPUT_CHANNELS, RESPONSE_SIDE_CHANNELS, } from '../schemas/pointer.js';
 import { parseEvidenceTarget } from '../seal/plan-index.js';
 /**
  * The closed reason set. Nothing outside it can come back from `qualifyProbe`,
@@ -38,6 +40,7 @@ export const QUALIFICATION_FAILURES = [
     'condition-selector-key-undeclared',
     'condition-pointer-not-observation-rooted',
     'condition-pointer-unwritable',
+    'condition-artifact-channel-contract-local',
     'condition-text-channel-on-api',
     'condition-reference-set-operand',
     'condition-operand-illegal',
@@ -55,10 +58,20 @@ export const QUALIFICATION_FAILURES = [
  * is the only match for any contract that compiled.
  */
 export function resolveHomeOperation(signature, interfaces) {
-    const wanted = operationSignature(signature);
+    // The identity is compared within its own kind. A signature declaring a
+    // method and a path template can only name an operation declaring the same
+    // pair, and one declaring an invocation can only name an operation
+    // declaring one; comparing the rendered strings across kinds would let
+    // `GET /notes` collide with an executable literally named that.
+    const command = signature.interfaceKind === 'cli';
+    const wanted = command
+        ? commandSignature(signature)
+        : operationSignature(signature);
     for (const iface of interfaces) {
-        for (const operation of iface.operations) {
-            if (operationSignature(operation) === wanted)
+        if ((iface.kind === 'cli') !== command)
+            continue;
+        for (const operation of operationsOf(iface)) {
+            if (anyOperationSignature(operation) === wanted)
                 return operation;
         }
     }
@@ -67,24 +80,14 @@ export function resolveHomeOperation(signature, interfaces) {
 // AD-26's channels that carry what came back, as opposed to what was sent. The
 // channel rule below needs at least one of these, or a condition naming two
 // channels could name `call-inputs` twice and pass.
-const RESPONSE_SIDE_CHANNELS = new Set([
-    'response-body',
-    'response-headers',
-    'response-status',
-    'stdout',
-    'stderr',
-    'exit-code',
-]);
-// The three channels an `api` signature can never manifest in. The contract
-// side cannot decide this: reachability rejects a tailed `stdout` pointer and
-// returns reachable for a bare one unconditionally, because an operation
-// carries no interface kind. The signature's own declared kind is what makes
-// the rule decidable, so it is spent here rather than left as prose.
-const TEXT_CHANNELS = new Set([
-    'stdout',
-    'stderr',
-    'exit-code',
-]);
+//
+// Derived from the vocabulary rather than transcribed: these were two
+// hand-maintained string sets, and a string set does not fail a typecheck when
+// a channel joins the enum, so a new channel would have gone unassigned and
+// silently answered "no" to both questions below.
+const RESPONSE_SIDE = new Set(RESPONSE_SIDE_CHANNELS);
+/** The channels a signature of this kind can never manifest in. */
+const foreignChannels = (kind) => new Set(kind === 'cli' ? API_RESPONSE_CHANNELS : COMMAND_RESPONSE_CHANNELS);
 const probePath = (probe, tail) => `Probe[probeId=${probe.probeId}]${tail}`;
 /**
  * Which routes this probe's class and control status admit. An empty list is
@@ -234,12 +237,32 @@ function checkOperandsAndCollectChannels(probe, signature, failures) {
             return;
         }
         channels.add(target.channel);
-        if (signature.interfaceKind === 'api' &&
-            TEXT_CHANNELS.has(target.channel)) {
+        if (target.channel === IDENTIFIER_ROOTED_CHANNEL) {
+            // AD-40 dropped `operationId` from the resolution key because it is
+            // contract-local: two contracts name the same operation differently, so
+            // a signature carrying one resolves against exactly the contract it was
+            // authored on. An artifact identifier is contract-local in the same way.
+            // It is minted by whoever declared the operation's artifact descriptor,
+            // so `/artifact/report` names one file in this contract and nothing at
+            // all in the next one, and a signature quantified over it stops being
+            // portable while still parsing and compiling clean.
+            //
+            // The restriction lifts the day the vocabulary reserves an identifier
+            // meaning "the artifact this operation describes", the way
+            // `OBSERVED_STEP_ID` reserves one for the step. Until then a signature
+            // reaches a written file through the descriptor channel of whatever
+            // operation it binds, which is kind-neutral and needs no identifier.
+            failures.push({
+                code: 'condition-artifact-channel-contract-local',
+                artifactPath: `${conditionPath}${path}`,
+                detail: `"${pointer}" names artifact "${target.artifactId}"; an artifact identifier is minted per contract, so a signature carrying one resolves only against the contract it was authored on, which is what AD-40 dropped operationId to avoid`,
+            });
+        }
+        if (foreignChannels(signature.interfaceKind).has(target.channel)) {
             failures.push({
                 code: 'condition-text-channel-on-api',
                 artifactPath: `${conditionPath}${path}`,
-                detail: `"${pointer}" addresses ${target.channel}, which an api interface never produces (AD-19, AD-26)`,
+                detail: `"${pointer}" addresses ${target.channel}, which ${signature.interfaceKind === 'cli' ? 'an interface behind a command' : 'an api interface'} never produces (AD-19, AD-26)`,
             });
         }
     });
@@ -265,11 +288,18 @@ function checkOperandsAndCollectChannels(probe, signature, failures) {
  */
 function checkSelectorKeys(probe, signature, operation, failures) {
     const { inputBinding } = signature.condition.selector;
-    for (const channel of TRANSPORT_CHANNELS) {
+    for (const channel of INPUT_CHANNELS) {
         const binding = inputBinding[channel];
         if (binding === null)
             continue;
-        const { requiredKeys, permittedKeys, types } = operation.requestShape[channel];
+        const shape = requestShapeOf(operation, channel);
+        // A channel the operation does not accept input on declares no key,
+        // which is exactly the condition the first check below reports.
+        const { requiredKeys, permittedKeys, types } = shape ?? {
+            requiredKeys: [],
+            permittedKeys: [],
+            types: {},
+        };
         for (const key of Object.keys(binding)) {
             const at = probePath(probe, `.defectSignature.condition.selector.inputBinding.${channel}[${JSON.stringify(key)}]`);
             if (!requiredKeys.includes(key) && !permittedKeys.includes(key)) {
@@ -317,7 +347,7 @@ function checkSelectorKeys(probe, signature, operation, failures) {
  */
 function checkObservableChannel(probe, signature, failures) {
     const path = probePath(probe, '.defectSignature.observableChannel');
-    if (!RESPONSE_SIDE_CHANNELS.has(signature.observableChannel)) {
+    if (!RESPONSE_SIDE.has(signature.observableChannel)) {
         failures.push({
             code: 'signature-observable-channel-not-response-side',
             artifactPath: path,
@@ -325,12 +355,11 @@ function checkObservableChannel(probe, signature, failures) {
         });
         return;
     }
-    if (signature.interfaceKind === 'api' &&
-        TEXT_CHANNELS.has(signature.observableChannel)) {
+    if (foreignChannels(signature.interfaceKind).has(signature.observableChannel)) {
         failures.push({
             code: 'condition-text-channel-on-api',
             artifactPath: path,
-            detail: `declares observableChannel "${signature.observableChannel}", which an api interface never produces (AD-19, AD-26)`,
+            detail: `declares observableChannel "${signature.observableChannel}", which ${signature.interfaceKind === 'cli' ? 'an interface behind a command' : 'an api interface'} never produces (AD-19, AD-26)`,
         });
     }
 }
@@ -352,11 +381,11 @@ function checkChannels(probe, signature, channels, failures) {
     // reject, arriving through the field that names the rule. The declared
     // channel is rejected outright one check up, and this guard keeps the rule
     // true of this function on its own.
-    if (RESPONSE_SIDE_CHANNELS.has(signature.observableChannel) &&
+    if (RESPONSE_SIDE.has(signature.observableChannel) &&
         channels.has(signature.observableChannel))
         return;
     const namesTwo = channels.size >= 2;
-    const namesResponse = [...channels].some((channel) => RESPONSE_SIDE_CHANNELS.has(channel));
+    const namesResponse = [...channels].some((channel) => RESPONSE_SIDE.has(channel));
     if (namesTwo && namesResponse)
         return;
     failures.push({
@@ -421,7 +450,7 @@ function checkDisjuncts(probe, signature, failures) {
     const conditionPath = probePath(probe, '.defectSignature.condition.predicate');
     walkAnyNodes(signature.condition.predicate, '', null, (operand, path, bound) => {
         const named = channelsNamedBy(operand, bound);
-        if ([...named].some((channel) => RESPONSE_SIDE_CHANNELS.has(channel))) {
+        if ([...named].some((channel) => RESPONSE_SIDE.has(channel))) {
             return;
         }
         failures.push({
@@ -560,11 +589,12 @@ export function qualifyProbe(probe, homeOperation) {
         }
     }
     if (signature !== null) {
-        if (signature.interfaceKind !== 'api') {
+        if (signature.interfaceKind !== 'api' &&
+            signature.interfaceKind !== 'cli') {
             failures.push({
                 code: 'signature-interface-kind-unsupported',
                 artifactPath: probePath(probe, '.defectSignature.interfaceKind'),
-                detail: `"${signature.interfaceKind}" declares a method and a path template that mean nothing off an api interface; v0 keeps all four kinds in the enum so unsupported-interface-kind stays fireable contract-side (AD-19)`,
+                detail: `"${signature.interfaceKind}" declares a method and a path template with no per-kind semantics behind them; the kinds stay in the enum so unsupported-interface-kind stays fireable contract-side (AD-19)`,
             });
         }
         checkObservableChannel(probe, signature, failures);

package/dist/core/score/quotation.d.ts

@@ -4,30 +4,7 @@ type DefectFinding = Extract<SealedRunRecord['findings'][number], {
     findingType: 'defect';
 }>;
 type QuotedEvidence = DefectFinding['quotedEvidence'][number];
-/**
- * One evidence channel of one observation, rendered as the text a quotation is
- * asked to be a substring of.
- *
- * `stdout` and `stderr` project as themselves; `response-status` and
- * `exit-code` through the ordinary integer rendering; `response-body`,
- * `response-headers`, and `call-inputs` through the same RFC 8785 serialization
- * the digest uses.
- *
- * No case folding and no whitespace normalization: AD-23 requires the evidence
- * verbatim, and a normalizing match would accept a quote the record does not
- * contain. Canonical serialization re-spells a body with sorted keys and no
- * whitespace, so a quote taken from a pretty-printed rendering is not a
- * substring of it. The record stores JSON values and has no pretty-printed form
- * to quote.
- *
- * A `null` channel projects to nothing and witnesses nothing. On
- * `response-body` that also swallows a body that genuinely was JSON `null`,
- * which is the schema's own stated cost of one uniform spelling for "absent".
- *
- * Should canonicalization fault on a caller's record, the fault propagates,
- * which is what keeps this procedure from being circular with it.
- */
-export declare function projectChannel(observation: Observation, channel: EvidenceChannelName, artifactPath: string): string | null;
+export declare function projectChannel(observation: Observation, channel: EvidenceChannelName, artifactPath: string, artifactId?: string | null): string | null;
 export type UnwitnessedQuotation = {
     readonly findingId: string;
     /** the position of the quotation within the finding's own list. */