eval-quality 1.3.0 → 1.4.1

package/dist/application/index.d.ts

@@ -15,6 +15,8 @@ export type { RuntimeFaultCode } from '../core/schemas/faults.ts';
 export { RUNTIME_FAULT_CODES, RuntimeFault } from '../core/schemas/faults.ts';
 export type { EvaluatorRecommendation, Verdict, } from '../core/schemas/verdict.ts';
 export { EVALUATOR_RECOMMENDATIONS, VERDICTS, } from '../core/schemas/verdict.ts';
+export type { QualificationFailure, QualificationFailureCode, QualificationResult, } from '../core/score/qualification.ts';
+export { QUALIFICATION_FAILURES } from '../core/score/qualification.ts';
 export { compile } from './compile.ts';
 export type { Diagnostic, DiagnosticSink } from './diagnostics.ts';
 export type { PreflightFromObservationsOptions, RunPreflightOptions, } from './preflight.ts';

package/dist/application/index.js

@@ -11,6 +11,7 @@ export { validateLineageChain } from '../core/lineage/chain.js';
 export { INTERCHANGE_ARTIFACT_KEYS } from '../core/schemas/artifact.js';
 export { RUNTIME_FAULT_CODES, RuntimeFault } from '../core/schemas/faults.js';
 export { EVALUATOR_RECOMMENDATIONS, VERDICTS, } from '../core/schemas/verdict.js';
+export { QUALIFICATION_FAILURES } from '../core/score/qualification.js';
 export { compile } from './compile.js';
 export { preflightFromObservations, runPreflight } from './preflight.js';
 export { runScore } from './score.js';

package/dist/application/score.d.ts

@@ -8,6 +8,7 @@ import { Probe } from '../core/schemas/probe.ts';
 import { ScoringPolicy } from '../core/schemas/scoring-policy.ts';
 import { SealedRunRecord } from '../core/schemas/sealed-run-record.ts';
 import type { LadderResolution } from '../core/score/ladder.ts';
+import type { QualificationResult } from '../core/score/qualification.ts';
 import { type CorpusPort } from '../ports/corpus-port.ts';
 export type RunScoreOptions = {
     readonly record: SealedRunRecord;
@@ -44,5 +45,16 @@ export type RunScoreResult = {
      */
     readonly artifact: EvidenceArtifact | null;
     readonly ladder: LadderResolution;
+    /**
+     * AD-9's gate over `options.probe`, carried out of `score` unchanged. A
+     * rejected probe resolves an oracle to `infrastructure-error` wherever no
+     * higher-precedence AD-33 row already resolved it, and any of those states
+     * lands the run on the Invalid rung, where `artifact` is `null` and there
+     * is no artifact field for the reason to travel in. A contract declaring no
+     * oracles resolves no outcome at all: that run mints an artifact carrying
+     * no trace of the rejection. `failures` is the reason in both cases, in the
+     * closed `QualificationFailureCode` vocabulary.
+     */
+    readonly qualification: QualificationResult;
 };
 export declare function runScore(options: RunScoreOptions): Promise<RunScoreResult>;

package/dist/application/score.js

@@ -176,11 +176,19 @@ export async function runScore(options) {
     // identical gap.
     'none', false);
     if (scored.ladder.verdict === null) {
-        return { artifact: null, ladder: scored.ladder };
+        return {
+            artifact: null,
+            ladder: scored.ladder,
+            qualification: scored.probeQualification,
+        };
     }
     const artifact = emit(scored, corpusDigest, 
     // AD-11 names the same fixture digest `PreflightVerdict.fixtureDigest`
     // already carries: restated, never re-derived.
     preflightVerdict.fixtureDigest, record.evaluatorConfigurationDigest);
-    return { artifact, ladder: scored.ladder };
+    return {
+        artifact,
+        ladder: scored.ladder,
+        qualification: scored.probeQualification,
+    };
 }

package/dist/cli/render.d.ts

@@ -1,4 +1,4 @@
-import { type Diagnostic } from '../application/index.ts';
+import { type Diagnostic, type QualificationFailure } from '../application/index.ts';
 /**
  * Delegates to `serializeArtifact`; the canonical bytes are not re-derived
  * here, so the text written to stdout is the text `digestArtifact` hashes.
@@ -14,6 +14,14 @@ export declare function renderDiagnostic(diagnostic: Diagnostic): string;
  * own code looks like from outside.
  */
 export declare function renderError(error: unknown): string;
+/**
+ * One AD-9 qualification failure, in the same
+ * `<code>: <artifactPath>: <detail>` shape `renderError` uses. An unqualified
+ * probe is a domain outcome the ladder resolves to Invalid, so no
+ * `StructuralFailure` and no `RuntimeFault` carries it. It reads like one on
+ * stderr because the reader's question is the same.
+ */
+export declare function renderQualificationFailure(failure: QualificationFailure): string;
 /**
  * AD-21's seven exit codes, one line each. The `--help` output and the README
  * table are this text, so the two cannot drift.

package/dist/cli/render.js

@@ -1,7 +1,8 @@
 /**
  * The four shapes the binary writes, and the exit-code table two documents
  * share. Every line the CLI emits is produced here, so a format change is one
- * file.
+ * file. Five renderers over the four shapes: a qualification failure and an
+ * error both print `<code>: <artifactPath>: <detail>`.
  */
 import { z } from 'zod';
 import { RuntimeFault, StructuralFailure, serializeArtifact, } from '../application/index.js';
@@ -81,6 +82,16 @@ export function renderError(error) {
     }
     return `${PREFIX}: ${String(error)}`;
 }
+/**
+ * One AD-9 qualification failure, in the same
+ * `<code>: <artifactPath>: <detail>` shape `renderError` uses. An unqualified
+ * probe is a domain outcome the ladder resolves to Invalid, so no
+ * `StructuralFailure` and no `RuntimeFault` carries it. It reads like one on
+ * stderr because the reader's question is the same.
+ */
+export function renderQualificationFailure(failure) {
+    return `${PREFIX}: ${failure.code}: ${failure.artifactPath}: ${failure.detail}`;
+}
 /**
  * AD-21's seven exit codes, one line each. The `--help` output and the README
  * table are this text, so the two cannot drift.

package/dist/cli/run.js

@@ -6,7 +6,7 @@
  * run in memory.
  */
 import { compile, preflightFromObservations, RuntimeFault, runScore, StructuralFailure, seal, } from '../application/index.js';
-import { EXIT_CODE_TABLE, renderArtifact, renderDiagnostic, renderError, renderUsage, } from './render.js';
+import { EXIT_CODE_TABLE, renderArtifact, renderDiagnostic, renderError, renderQualificationFailure, renderUsage, } from './render.js';
 export const APPLICATION = {
     compile,
     seal,
@@ -316,6 +316,14 @@ async function runScoreCommand(invocation, environment, application, target) {
         port: corpusRoot === null ? undefined : environment.corpusPort(corpusRoot),
         signal: environment.signal,
     });
+    // A rejected probe resolves an oracle to `infrastructure-error` wherever no
+    // higher-precedence AD-33 row already resolved it, and no artifact field
+    // carries the reason on any rung. Written whatever the rung, since the gate
+    // also runs on a probe the ladder never invalidated, a contract declaring
+    // no oracles above all: the reasons are the same either way.
+    for (const failure of result.qualification.failures) {
+        environment.writeDiagnostic(renderQualificationFailure(failure));
+    }
     if (result.artifact !== null) {
         await emitArtifact(environment, result.artifact, 'score', target);
     }

package/dist/core/evaluate/operators.d.ts

@@ -59,11 +59,15 @@ export declare function regexMatch(value: ResolvedValue, pattern: string, matchS
  */
 export declare function ordering(collection: ResolvedValue, key: string, order: 'ascending' | 'descending', _artifactPath: string): boolean;
 /**
- * An empty array is a legitimate zero count, never special-cased; the
- * resolver in `resolution.ts` intercepts before this runs on a genuinely
- * empty collection. The allowed deviation is compared unrounded: `actual` is
- * an integer, so `<=` against a fractional deviation is already exact, and
- * rounding either direction would move the declared boundary.
+ * An empty array is a legitimate zero count, never special-cased, and this
+ * function is called with one. `count-tolerance` reads the collection's
+ * cardinality, so `resolution.ts` marks it `total` over a collection observed
+ * to be present and empty and hands the `[]` straight through; the guard below
+ * is load-bearing on `collection.length === 0`. A collection-typed pointer
+ * that resolved `absent` is still intercepted there and never reaches here.
+ * The allowed deviation is compared unrounded: `actual` is an integer, so `<=`
+ * against a fractional deviation is already exact, and rounding either
+ * direction would move the declared boundary.
  */
 export declare function countTolerance(collection: ResolvedValue, expected: number, tolerance: number, relative: boolean, _artifactPath: string): boolean;
 /**

package/dist/core/evaluate/operators.js

@@ -249,11 +249,15 @@ export function ordering(collection, key, order, _artifactPath) {
     return true;
 }
 /**
- * An empty array is a legitimate zero count, never special-cased; the
- * resolver in `resolution.ts` intercepts before this runs on a genuinely
- * empty collection. The allowed deviation is compared unrounded: `actual` is
- * an integer, so `<=` against a fractional deviation is already exact, and
- * rounding either direction would move the declared boundary.
+ * An empty array is a legitimate zero count, never special-cased, and this
+ * function is called with one. `count-tolerance` reads the collection's
+ * cardinality, so `resolution.ts` marks it `total` over a collection observed
+ * to be present and empty and hands the `[]` straight through; the guard below
+ * is load-bearing on `collection.length === 0`. A collection-typed pointer
+ * that resolved `absent` is still intercepted there and never reaches here.
+ * The allowed deviation is compared unrounded: `actual` is an integer, so `<=`
+ * against a fractional deviation is already exact, and rounding either
+ * direction would move the declared boundary.
  */
 export function countTolerance(collection, expected, tolerance, relative, _artifactPath) {
     if (collection === ABSENT || !Array.isArray(collection))

package/dist/core/evaluate/resolution.js

@@ -1,21 +1,28 @@
 import { absence, containment, countTolerance, coversByKey, deepEquality, equality, existence, keyValueOf, ordering, regexMatch, setMembership, shape, } from './operators.js';
 import { ABSENT } from './resolved-value.js';
 /**
- * AD-4's one closed introduction condition, checked per operand and applied
- * uniformly: the resolved value and its operand are the only inputs.
+ * AD-4's one closed introduction condition, checked per operand. Two inputs
+ * decide it: what the operand resolved to, and whether the operator can answer
+ * from an empty collection.
  *
- * Two permanent consequences of that uniform reading, the same class as a
- * `{ literal: [] }` operand tripping it: a `count-tolerance` node asserting
- * `expected: 0` over a genuinely empty collection can never resolve `true`,
- * because this interception fires first; and `existence` over a pointer
- * resolving to a present-but-empty array resolves `insufficient-evidence`, not
- * `true`, even though `existence` only asks about presence.
+ * An operand that resolved to a present, empty array reached an evidence
+ * channel that worked and had nothing in it. That stops a `needs-a-member`
+ * operator, which would otherwise report a vacuous truth over no elements.
+ * A `total` operator has its answer: the cardinality is zero, the value is
+ * present. AD-4's own rule keeps a detected defect a detection, and that is
+ * what makes the second case a resolution.
+ *
+ * The `absent` branch does not vary. A collection-typed pointer that did not
+ * resolve is the missing page AD-4 folds into this condition to close the
+ * soft-delete fail-open, and no operator gets to read a missing collection as
+ * an empty one.
  */
-function operandDenotesEmptyCollection(resolved, operand, pointerDenotesCollection) {
-    if (Array.isArray(resolved) && resolved.length === 0)
-        return true;
-    if (resolved !== ABSENT)
-        return false;
+function operandDenotesEmptyCollection(resolved, operand, pointerDenotesCollection, totality) {
+    if (resolved !== ABSENT) {
+        if (totality === 'total')
+            return false;
+        return Array.isArray(resolved) && resolved.length === 0;
+    }
     // Only a `{ pointer }` operand can carry a declared collection type.
     // `{ literal }` never resolves ABSENT, and an ABSENT `{ referenceSet }`
     // means `unresolved-reference-set` slipped past compilation, which this
@@ -38,8 +45,8 @@ function booleanResult(result) {
 }
 // Checked across every operand before any operator runs, so the interception
 // replaces a leaf's own two-valued answer outright.
-function anyOperandEmpty(pairs, pointerDenotesCollection) {
-    return pairs.some(({ operand, resolved }) => operandDenotesEmptyCollection(resolved, operand, pointerDenotesCollection));
+function anyOperandEmpty(pairs, pointerDenotesCollection, totality) {
+    return pairs.some(({ operand, resolved }) => operandDenotesEmptyCollection(resolved, operand, pointerDenotesCollection, totality));
 }
 /** `not(insufficient-evidence)` is terminal under both polarities (AD-4). */
 function notOf(child) {
@@ -107,10 +114,12 @@ function resolveQuantifier(op, collectionOperand, predicate, boundElement, ctx)
     };
 }
 // Shared by the six single-operand leaves: resolve, intercept on the
-// empty-collection condition, otherwise hand the value to the operator.
-function resolveSingleOperand(operand, boundElement, ctx, evaluate) {
+// empty-collection condition, otherwise hand the value to the operator. Each
+// caller declares its own totality, since that is the one thing the six
+// disagree on.
+function resolveSingleOperand(operand, boundElement, ctx, totality, evaluate) {
     const resolved = ctx.resolveOperand(operand, boundElement, ctx.artifactPath);
-    if (anyOperandEmpty([{ operand, resolved }], ctx.pointerDenotesCollection)) {
+    if (anyOperandEmpty([{ operand, resolved }], ctx.pointerDenotesCollection, totality)) {
         return emptyCollectionResult();
     }
     return booleanResult(evaluate(resolved));
@@ -124,7 +133,7 @@ function resolveEqualityLike(operands, evaluate, boundElement, ctx) {
     if (anyOperandEmpty([
         { operand: aOperand, resolved: a },
         { operand: bOperand, resolved: b },
-    ], ctx.pointerDenotesCollection)) {
+    ], ctx.pointerDenotesCollection, 'needs-a-member')) {
         return emptyCollectionResult();
     }
     return booleanResult(evaluate(a, b, ctx.artifactPath));
@@ -212,7 +221,7 @@ function resolveContainmentNode(expression, boundElement, ctx) {
     if (anyOperandEmpty([
         { operand: containerOperand, resolved: container },
         { operand: candidateOperand, resolved: candidate },
-    ], ctx.pointerDenotesCollection)) {
+    ], ctx.pointerDenotesCollection, 'needs-a-member')) {
         return emptyCollectionResult();
     }
     // The array-narrowing guard applies only to a `{ referenceSet }` candidate.
@@ -231,16 +240,16 @@ function resolveContainmentNode(expression, boundElement, ctx) {
 }
 function resolveExistenceNode(expression, boundElement, ctx) {
     const [operand] = expression.operands;
-    return resolveSingleOperand(operand, boundElement, ctx, (resolved) => existence(resolved, ctx.artifactPath));
+    return resolveSingleOperand(operand, boundElement, ctx, 'total', (resolved) => existence(resolved, ctx.artifactPath));
 }
 function resolveAbsenceNode(expression, boundElement, ctx) {
     const [operand] = expression.operands;
-    return resolveSingleOperand(operand, boundElement, ctx, (resolved) => absence(resolved, ctx.artifactPath));
+    return resolveSingleOperand(operand, boundElement, ctx, 'total', (resolved) => absence(resolved, ctx.artifactPath));
 }
 function resolveRegexNode(expression, boundElement, ctx) {
     const [operand] = expression.operands;
     const { pattern } = expression;
-    return resolveSingleOperand(operand, boundElement, ctx, (resolved) => regexMatch(resolved, pattern, ctx.regexMatchStepBudget, ctx.artifactPath));
+    return resolveSingleOperand(operand, boundElement, ctx, 'needs-a-member', (resolved) => regexMatch(resolved, pattern, ctx.regexMatchStepBudget, ctx.artifactPath));
 }
 /**
  * Reads the single declared key off each member of a `{ referenceSet }` set
@@ -308,7 +317,7 @@ function resolveSetMembershipNode(expression, boundElement, ctx) {
     if (anyOperandEmpty([
         { operand: valueOperand, resolved: value },
         { operand: setOperand, resolved: resolvedSet },
-    ], ctx.pointerDenotesCollection)) {
+    ], ctx.pointerDenotesCollection, 'needs-a-member')) {
         return emptyCollectionResult();
     }
     // The set position needs the `JsonValue[]` the schema already guarantees
@@ -326,17 +335,17 @@ function resolveSetMembershipNode(expression, boundElement, ctx) {
 function resolveOrderingNode(expression, boundElement, ctx) {
     const [operand] = expression.operands;
     const { key, order } = expression;
-    return resolveSingleOperand(operand, boundElement, ctx, (resolved) => ordering(resolved, key, order, ctx.artifactPath));
+    return resolveSingleOperand(operand, boundElement, ctx, 'needs-a-member', (resolved) => ordering(resolved, key, order, ctx.artifactPath));
 }
 function resolveCountToleranceNode(expression, boundElement, ctx) {
     const [operand] = expression.operands;
     const { expected, tolerance, relative } = expression;
-    return resolveSingleOperand(operand, boundElement, ctx, (resolved) => countTolerance(resolved, expected, tolerance, relative, ctx.artifactPath));
+    return resolveSingleOperand(operand, boundElement, ctx, 'total', (resolved) => countTolerance(resolved, expected, tolerance, relative, ctx.artifactPath));
 }
 function resolveShapeNode(expression, boundElement, ctx) {
     const [operand] = expression.operands;
     const { descriptor } = expression;
-    return resolveSingleOperand(operand, boundElement, ctx, (resolved) => shape(resolved, descriptor, ctx.artifactPath));
+    return resolveSingleOperand(operand, boundElement, ctx, 'needs-a-member', (resolved) => shape(resolved, descriptor, ctx.artifactPath));
 }
 // One entry per `Expression['op']`; the mapped type below fails to compile if
 // an op is missing or misassigned, since each key demands the handler typed

package/dist/core/preflight/reduce.js

@@ -65,6 +65,62 @@ const sameFixtureState = (left, right) => {
     return (digestArtifact(state(left), PREFLIGHT_ARTIFACT_PATH) ===
         digestArtifact(state(right), PREFLIGHT_ARTIFACT_PATH));
 };
+/**
+ * The canonical digest of one value, or `null` where the value holds something
+ * RFC 8785 cannot serialise. `JsonValue` admits an integer outside the safe
+ * range and a lone surrogate, and a 64-bit identifier in a query parameter is
+ * ordinary, so this is reachable from a contract that parses. A verdict is what
+ * this stage owes its caller, and `null` compares equal to nothing, so a value
+ * that cannot be digested leaves the two sides distinguishable and the check
+ * still reads the leg.
+ */
+const digestOrNull = (value) => {
+    try {
+        return digestArtifact(value, PREFLIGHT_ARTIFACT_PATH);
+    }
+    catch (error) {
+        if (error instanceof RuntimeFault)
+            return null;
+        throw error;
+    }
+};
+/**
+ * Whether two legs issued one request and received one answer, which makes them
+ * one probe under two labels. A manifestation witness firing on such a leg is
+ * the fault leg's own manifestation read a second time, and it establishes
+ * nothing about where the defect is scoped.
+ *
+ * Both halves are required. Answers alone would drop AD-10's own worked example,
+ * two distinct nonexistent identifiers both returning 404: those legs ask
+ * different questions and are exactly the legs this check exists to read.
+ * Requests alone are what the plan can see, and identical requests can still be
+ * answered differently, which is why the comparison lives here where the
+ * answers are in hand.
+ *
+ * The answer half compares the evidence, which is everything a relation can
+ * address: two legs with equal evidence resolve one relation to one value. It
+ * carries AD-11's projected body, so a field the operation declares volatile is
+ * already out of it and a server-minted identifier stops being a difference,
+ * which is what makes the same request to a mutating operation comparable at
+ * all. The raw observation is the wrong side of this comparison for that exact
+ * reason: two writes to one collection differ on a minted id by design, and
+ * reading that as a difference puts the false failure this check just lost back
+ * one stage over.
+ *
+ * The correlation identifiers are neutralised on both sides, since they are the
+ * leg id and differ by construction. A digest that comes back `null` matches
+ * nothing, so a pair that cannot be compared stays a pair the check reads.
+ */
+const answeredAlike = (left, right) => {
+    const request = (state) => digestOrNull({ ...state.leg.request, probeId: '' });
+    const answer = (state) => digestOrNull({ ...state.evidence, observationId: '' });
+    const leftRequest = request(left);
+    const leftAnswer = answer(left);
+    return (leftRequest !== null &&
+        leftAnswer !== null &&
+        leftRequest === request(right) &&
+        leftAnswer === answer(right));
+};
 /**
  * Resolves a manifestation witness against one leg. Returns `null` when that
  * leg produced no observation, which the two seeded-fault rows read
@@ -175,7 +231,36 @@ export const reducePreflight = (plan, { observations }) => {
             }
             case 'seeded-faults-scoped': {
                 const { witness, defectId } = planned;
+                const fault = states.get(witness.legId);
+                // The legs that answered a different question than the fault leg's, and
+                // the legs dropped for answering the same one.
+                const examined = [];
+                const dropped = [];
                 for (const legId of planned.cleanLegIds) {
+                    const state = states.get(legId);
+                    if (state !== undefined &&
+                        fault !== undefined &&
+                        answeredAlike(state, fault)) {
+                        dropped.push(legId);
+                        continue;
+                    }
+                    examined.push(legId);
+                }
+                // Emptiness is tested on what survived the drop. A check over no clean
+                // leg examined nothing, and a check that examined nothing has
+                // established nothing, which is the rule the `input-sensitivity` row
+                // above already runs on. Satisfied here would certify scoping from zero
+                // evidence on the three contracts least able to afford it: one whose
+                // defect names the only leg its operation has, one whose every other leg
+                // repeats the fault leg's probe, and one where the plan named legs and
+                // the drop took all of them. The note says which.
+                if (examined.length === 0) {
+                    const named = dropped.map((legId) => `"${legId}"`).join(', ');
+                    return check(planned.kind, witness.operationId, 'failed', dropped.length === 0
+                        ? `${defectId}: the operation has no leg besides the fault leg, so nothing here establishes that the defect is scoped to it`
+                        : `${defectId}: every other leg of the operation issued the fault leg's own request and received its answer (${named}), so nothing here establishes that the defect is scoped to it`);
+                }
+                for (const legId of examined) {
                     const resolved = resolveAgainst(witness, states.get(legId), plan, PREFLIGHT_ARTIFACT_PATH);
                     if (resolved === 'true')
                         return check(planned.kind, witness.operationId, 'failed', `${defectId}: the manifestation witness fires on clean leg "${legId}"`);

package/dist/core/schemas/evidence-artifact.js

@@ -231,7 +231,7 @@ const evidenceCommonFields = {
     runId: z.string().min(1),
     scoringVersion: Digest.describe('AD-11: computed by the scorer over the six named inputs below and never caller-supplied.'),
     scoringVersionInputs: ScoringVersionInputs,
-    comparabilityKey: Digest.describe("AD-7's declared key: the scoring policy digest plus the corpus digest restricted to the probes both results cover. Deliberately weaker than the scoring version, so adding a probe narrows a comparison rather than voiding every prior result."),
+    comparabilityKey: Digest.describe("AD-7's declared key, computed by `emit` over the scoring policy digest and the sorted list of admitted probe identifiers. AD-7 words it as the scoring policy digest plus the corpus digest restricted to the probes both results cover, and that identifier list is what the restriction resolves to: the corpus digest bytes are not an input, so two results over one scoring policy and one admitted set share a key whatever corpus each was attested against. Deliberately weaker than the scoring version, so adding a probe narrows a comparison rather than voiding every prior result."),
     excludedProbeIds: z
         .array(ProbeId)
         .describe('The probes a narrowed comparison excluded, per AD-7. Empty is the ordinary case.'),

package/dist/core/schemas/sensitivity-witness.d.ts

@@ -56,13 +56,16 @@ export type CommandWitnessInputs = z.infer<typeof CommandWitnessInputs>;
  * interface declaring it lives in another subtree, so no discriminator is
  * available to the schema and the agreement is a compile-time check.
  *
- * Only the sensitivity leg takes the union. `ManifestationWitness` and
- * `FixtureReset` keep the transport spelling, which keeps the probe artifact
- * byte-identical and keeps this shape's widening inside the eval contract's own
- * version bump. That is truthful rather than merely convenient: both of those
- * legs are issued through the environment-probe port, whose `ProbeRequest`
- * carries a method, a path template, and the four transport channels, and
- * pre-flight rejects a non-api interface for exactly that reason.
+ * All three leg shapes take it: `SensitivityWitnessLeg.inputs`,
+ * `ManifestationWitness.inputs`, and `FixtureReset.inputs`. The sensitivity leg
+ * took it from 0.3.0 and the other two followed in 1.3.0, since the transport
+ * spelling left a seeded defect against a command-line system under test
+ * unrepresentable. The reach is the port's: all three legs are issued through
+ * the environment-probe port, whose `ProbeRequest` is itself a union of
+ * `ApiProbeRequest` and `CommandProbeRequest`, and `preflight/plan.ts` admits
+ * `api` and `cli`, rejecting `web` and `mcp` under `unsupported-interface-kind`.
+ * A leg shape narrower than the port it feeds leaves a kind the adapter can run
+ * with no way to declare a leg for it.
  */
 export declare const WitnessInputs: z.ZodUnion<readonly [z.ZodObject<{
     path: z.ZodType<import("./primitives.ts").JsonObject, unknown, z.core.$ZodTypeInternals<import("./primitives.ts").JsonObject, unknown>>;

package/dist/core/schemas/sensitivity-witness.js

@@ -55,13 +55,16 @@ export const CommandWitnessInputs = z.strictObject({
  * interface declaring it lives in another subtree, so no discriminator is
  * available to the schema and the agreement is a compile-time check.
  *
- * Only the sensitivity leg takes the union. `ManifestationWitness` and
- * `FixtureReset` keep the transport spelling, which keeps the probe artifact
- * byte-identical and keeps this shape's widening inside the eval contract's own
- * version bump. That is truthful rather than merely convenient: both of those
- * legs are issued through the environment-probe port, whose `ProbeRequest`
- * carries a method, a path template, and the four transport channels, and
- * pre-flight rejects a non-api interface for exactly that reason.
+ * All three leg shapes take it: `SensitivityWitnessLeg.inputs`,
+ * `ManifestationWitness.inputs`, and `FixtureReset.inputs`. The sensitivity leg
+ * took it from 0.3.0 and the other two followed in 1.3.0, since the transport
+ * spelling left a seeded defect against a command-line system under test
+ * unrepresentable. The reach is the port's: all three legs are issued through
+ * the environment-probe port, whose `ProbeRequest` is itself a union of
+ * `ApiProbeRequest` and `CommandProbeRequest`, and `preflight/plan.ts` admits
+ * `api` and `cli`, rejecting `web` and `mcp` under `unsupported-interface-kind`.
+ * A leg shape narrower than the port it feeds leaves a kind the adapter can run
+ * with no way to declare a leg for it.
  */
 export const WitnessInputs = z.union([ApiWitnessInputs, CommandWitnessInputs]);
 /**

package/dist/core/score/score.d.ts

@@ -35,7 +35,7 @@ import type { Probe } from '../schemas/probe.ts';
 import type { ScoringPolicy } from '../schemas/scoring-policy.ts';
 import type { ScoreStage } from '../stage-contracts.ts';
 import type { ContractAssessment, LadderResolution, ProductionAssessment } from './ladder.ts';
-import { type SealedProbeSet } from './qualification.ts';
+import { type QualificationResult, type SealedProbeSet } from './qualification.ts';
 import { type TrialSetResult } from './reduce-trials.ts';
 /**
  * `score`'s owned product: the assessment/ladder pairing AD-24 names, "the
@@ -56,6 +56,13 @@ export type ScoredOutcomesAndVerdict = {
     readonly policy: ScoringPolicy;
     readonly probe: Probe;
     readonly sealedProbes: SealedProbeSet;
+    /**
+     * The one probe's own qualification result, lifted out of `sealedProbes`
+     * so a caller reading a run's product holds the closed reason set that
+     * decided it. `emit` mints no field from this: AD-9's reasons stay off the
+     * `EvidenceArtifact` and travel the return path.
+     */
+    readonly probeQualification: QualificationResult;
     /** this probe's own AD-7 trial-set fold, keyed by `emit` under `probe.probeId` to build the strength vector. */
     readonly trialSetResult: TrialSetResult;
     /** the full `EvidenceArtifact.outcomes` shape, a parallel array to `ScoredOutcome[]` above: `ScoredOutcome` carries `resolution` but not `disposition` or the raw `CheckResolution` tree this shape needs, so the two are not reconstructible from one another. */

package/dist/core/score/score.js

@@ -37,7 +37,7 @@ import { buildPlanIndex } from '../seal/plan-index.js';
 import { resolveCapturedBindings, selectWithBindings } from './bindings.js';
 import { resolveContractVerdict, resolveProductionVerdict } from './ladder.js';
 import { FINDING_BUCKETS, resolveOutcome, uncitedDefectFindingGaps, uncitedFindingIds, } from './outcome.js';
-import { resolveHomeOperation, sealProbeSet, } from './qualification.js';
+import { qualifyProbe, resolveHomeOperation, sealProbeSet, } from './qualification.js';
 import { reduceTrialSet, TRIAL_VOTE_STATES, } from './reduce-trials.js';
 import { mapFindings, matchProbeWitness } from './witness.js';
 /** A mutable copy of the two record-shaped arrays every witness/finding function this stage calls wants, since `ValidatedObservations`' own arrays are `readonly`. */
@@ -245,8 +245,17 @@ export const score = (contract, trials, probe, preflightVerdict, policy, waiver,
         ? null
         : resolveHomeOperation(candidate.defectSignature, contract.permittedInterfaces);
     const sealedProbes = sealProbeSet([probe], homeOperationOf);
-    const qualifiedEntry = sealedProbes.admitted[0] ?? sealedProbes.rejected[0];
-    const probeQualified = qualifiedEntry === undefined ? false : qualifiedEntry.result.qualified;
+    // `sealProbeSet` over a one-probe array puts that probe in exactly one
+    // bucket, so the third branch is unreachable. It re-runs the gate rather
+    // than composing a result here: `qualifyProbe` holds
+    // `qualified === (failures.length === 0)`, and a hand-built
+    // `{ qualified: false, failures: [] }` would hand a consumer a rejection
+    // with no code to route on, which is the silent state this field removes.
+    // The gate is pure, so a second call over the same probe answers the same.
+    const probeQualification = sealedProbes.admitted[0]?.result ??
+        sealedProbes.rejected[0]?.result ??
+        qualifyProbe(probe, homeOperationOf(probe));
+    const probeQualified = probeQualification.qualified;
     const signedProbe = signedProbeOf(probe);
     const designatedOracleId = designatedOracleIdOf(probe, contract);
     const probeSigned = !probe.expectedClean && probe.defectSignature !== null;
@@ -578,6 +587,7 @@ export const score = (contract, trials, probe, preflightVerdict, policy, waiver,
             policy,
             probe,
             sealedProbes,
+            probeQualification,
             trialSetResult: reduced,
             outcomes,
             uncitedFindings,
@@ -600,6 +610,7 @@ export const score = (contract, trials, probe, preflightVerdict, policy, waiver,
         policy,
         probe,
         sealedProbes,
+        probeQualification,
         trialSetResult: reduced,
         outcomes,
         uncitedFindings,

package/dist/index.d.ts

@@ -12,4 +12,4 @@ export type { ScoringPolicy } from './core/schemas/scoring-policy.ts';
 export type { SealedEvaluatorBrief } from './core/schemas/sealed-evaluator-brief.ts';
 export type { SealedRunRecord } from './core/schemas/sealed-run-record.ts';
 export type { FixtureReset, ManifestationWitness, SensitivityWitness, SensitivityWitnessLeg, WitnessChannel, WitnessInputs, } from './core/schemas/sensitivity-witness.ts';
-export declare const VERSION = "1.3.0";
+export declare const VERSION = "1.4.1";

package/dist/index.js

@@ -19,4 +19,4 @@
 // subpath, where AD-37 puts the conformance definition an adapter author
 // reads; the reference adapters stay at `eval-quality/adapters`.
 export * from './application/index.js';
-export const VERSION = '1.3.0';
+export const VERSION = '1.4.1';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eval-quality",
-  "version": "1.3.0",
+  "version": "1.4.1",
   "description": "Compile disciplined Behavioral Evaluation Contracts and score their ability to catch known defects.",
   "author": "Murat Ozcan",
   "license": "Apache-2.0",

package/schemas/evidence-artifact.schema.json

@@ -86,7 +86,7 @@
         "comparabilityKey": {
           "type": "string",
           "pattern": "^sha256:[0-9a-f]{64}$",
-          "description": "AD-7's declared key: the scoring policy digest plus the corpus digest restricted to the probes both results cover. Deliberately weaker than the scoring version, so adding a probe narrows a comparison rather than voiding every prior result."
+          "description": "AD-7's declared key, computed by `emit` over the scoring policy digest and the sorted list of admitted probe identifiers. AD-7 words it as the scoring policy digest plus the corpus digest restricted to the probes both results cover, and that identifier list is what the restriction resolves to: the corpus digest bytes are not an input, so two results over one scoring policy and one admitted set share a key whatever corpus each was attested against. Deliberately weaker than the scoring version, so adding a probe narrows a comparison rather than voiding every prior result."
         },
         "excludedProbeIds": {
           "type": "array",
@@ -666,7 +666,7 @@
         "comparabilityKey": {
           "type": "string",
           "pattern": "^sha256:[0-9a-f]{64}$",
-          "description": "AD-7's declared key: the scoring policy digest plus the corpus digest restricted to the probes both results cover. Deliberately weaker than the scoring version, so adding a probe narrows a comparison rather than voiding every prior result."
+          "description": "AD-7's declared key, computed by `emit` over the scoring policy digest and the sorted list of admitted probe identifiers. AD-7 words it as the scoring policy digest plus the corpus digest restricted to the probes both results cover, and that identifier list is what the restriction resolves to: the corpus digest bytes are not an input, so two results over one scoring policy and one admitted set share a key whatever corpus each was attested against. Deliberately weaker than the scoring version, so adding a probe narrows a comparison rather than voiding every prior result."
         },
         "excludedProbeIds": {
           "type": "array",