eval-quality 1.4.1 → 2.0.0

package/dist/core/compile/interface-inventory.d.ts

@@ -1,5 +1,38 @@
 import type { EvalContract } from '../schemas/eval-contract.ts';
-import type { AnyOperation } from '../schemas/interface.ts';
+import type { AnyOperation, InterfaceKindName } from '../schemas/interface.ts';
+/**
+ * The kinds whose probe semantics AD-10 requires before it opens one. `cli` and
+ * `mcp` declare theirs, so both run; `web` declares none and fails here, which
+ * keeps this code fireable and AD-10's sentence true of it.
+ *
+ * Each tuple is spelled out and typed against `INTERFACE_KINDS`, on the
+ * reasoning `pointer.ts` records for `NON_IDENTIFIER_ROOTED_CHANNELS`: adding a
+ * fifth kind is then a decision about which side of this line it falls on, and
+ * a test asserts the partition. Exported because two other gates assert the
+ * same fact: `preflight/plan.ts`, which a caller can reach by assembling a plan
+ * by hand, and `score/qualification.ts`, which reads a probe's declared kind
+ * where these two read a contract's.
+ */
+export declare const SUPPORTED_INTERFACE_KINDS: readonly ["api", "cli", "mcp"];
+export declare const UNSUPPORTED_INTERFACE_KINDS: readonly ["web"];
+/**
+ * Whether `compile`, the pre-flight plan, and the probe qualification gate
+ * admit a declared kind. All three call this, so what a contract may declare
+ * and what a defect signature may declare against cannot disagree.
+ */
+export declare const isSupportedInterfaceKind: (kind: InterfaceKindName) => boolean;
+/**
+ * A quoted kind list with its own verb, for a diagnostic that names what is
+ * supported. A function so the one-element form has a test: closing a kind is a
+ * move the tuple below is built to allow, and the general form would render one
+ * element as a leading " and ".
+ */
+export declare const kindsClause: (kinds: readonly string[]) => string;
+/**
+ * The supported list as both throwers spell it, rendered from the tuple so a
+ * message cannot claim a set the check does not enforce.
+ */
+export declare const SUPPORTED_KINDS_CLAUSE: string;
 export declare function checkInterfaceKind(contract: EvalContract): void;
 /**
  * The transport identity AD-40 resolves a defect signature against: the method
@@ -32,9 +65,45 @@ export declare function commandSignature(operation: {
         readonly subcommandPath: readonly string[];
     };
 }): string;
-/** The transport identity of an operation of either kind. */
+/**
+ * The transport identity of a tool call: the published tool name, alone and
+ * compared literally.
+ *
+ * There is nothing to erase and nothing to join. Every MCP call shares the one
+ * transport identity `tools/call`, so the tool name is the whole of what tells
+ * two calls apart, and a method and a path template would render one signature
+ * for every tool a server publishes. Takes the field rather than an
+ * `McpOperation`, on `operationSignature`'s own terms: AD-40's corpus-side
+ * signature declares the same name and must produce the same string from it.
+ */
+export declare function mcpSignature(operation: {
+    readonly toolName: string;
+}): string;
+/** The transport identity of an operation of any kind. */
 export declare const anyOperationSignature: (operation: AnyOperation) => string;
-/** Finds duplicate method and path signatures across the full inventory. */
+export type SignatureFamily = 'api' | 'cli' | 'mcp';
+/**
+ * The shape family an interface kind's transport identity is rendered in.
+ * Three renderings, and `api` and `web` share one because they share an
+ * operation shape.
+ *
+ * Typed against the kind vocabulary rather than `string`, so a fifth
+ * `INTERFACE_KINDS` member fails the typecheck here instead of landing in the
+ * `api` family and rendering a method and a path template it does not have.
+ */
+export declare const signatureFamilyOf: (kind: InterfaceKindName) => SignatureFamily;
+/**
+ * Finds duplicate transport identities across the full inventory.
+ *
+ * Keyed on the declaring kind's shape family beside the rendered string,
+ * because the three renderings draw from different namespaces: a tool named
+ * `notes` and an executable named `notes` both render `notes` while naming
+ * different things on different machines, and refusing that pair would be a
+ * collision the author cannot fix. `api` and `web` share one family, so two
+ * operations sharing a method and a path template across those two kinds still
+ * collide. `resolveHomeOperation` compares within a family for the same reason,
+ * so the two agree about what a collision is.
+ */
 export declare function checkDuplicateOperationSignature(contract: EvalContract): void;
 /**
  * `unresolved-artifact-reference`: an artifact identifier nothing declares.
@@ -45,6 +114,15 @@ export declare function checkDuplicateOperationSignature(contract: EvalContract)
  * resolving `absent`, on AD-26's own precedent for a dangling reference-set
  * identifier: `absent` is defined over pointers that do not resolve against
  * observed evidence, and a dangling declaration is neither.
+ *
+ * Resolving the pointer's step segment against the interaction plan is the
+ * route for an oracle check, an oracle direction's evidence target and a rubric
+ * criterion. A sensitivity-witness relation takes the other route, because a leg
+ * identifier shares the step namespace without being a step and the plan lookup
+ * cannot answer for one. The witness scope is what decides it, and preferring it
+ * over the plan matters for ordering: this check runs at `compile.ts` ahead of
+ * `checkWitnessLegIdentifiers`, so a leg id colliding with a step id is still
+ * present here and the plan route would answer it against the wrong operation.
  */
 export declare function checkArtifactReferences(contract: EvalContract): void;
 /**

package/dist/core/compile/interface-inventory.js

@@ -2,24 +2,59 @@
  * Checks interface kinds, inventory-wide operation signatures, and step input
  * bindings against each operation's request shape.
  */
-import { boundChannelsOf, declaredArtifactsOf, descriptorArtifactOf, isCommandOperation, requestShapeOf, } from '../declared-inputs.js';
+import { boundChannelsOf, declaredArtifactsOf, descriptorArtifactOf, isCommandOperation, isMcpOperation, requestShapeOf, } from '../declared-inputs.js';
 import { StructuralFailure } from '../failure-codes.js';
 import { operationsOf } from '../schemas/interface.js';
 import { anyOperationOf, buildPlanIndex, parseEvidenceTarget, } from '../seal/plan-index.js';
 import { forEachArtifactPointer } from './reachability.js';
 /**
- * Rejects permitted interface kinds whose probe semantics are undeclared.
+ * The kinds whose probe semantics AD-10 requires before it opens one. `cli` and
+ * `mcp` declare theirs, so both run; `web` declares none and fails here, which
+ * keeps this code fireable and AD-10's sentence true of it.
  *
- * AD-10 closed all three non-api kinds and named the condition for opening
- * one: the semantics have to be declared. They are declared for `cli`, so it
- * runs; `web` and `mcp` are still undeclared and still fail here, which is
- * what keeps this code fireable and keeps AD-10's sentence true of them.
+ * Each tuple is spelled out and typed against `INTERFACE_KINDS`, on the
+ * reasoning `pointer.ts` records for `NON_IDENTIFIER_ROOTED_CHANNELS`: adding a
+ * fifth kind is then a decision about which side of this line it falls on, and
+ * a test asserts the partition. Exported because two other gates assert the
+ * same fact: `preflight/plan.ts`, which a caller can reach by assembling a plan
+ * by hand, and `score/qualification.ts`, which reads a probe's declared kind
+ * where these two read a contract's.
  */
-const SUPPORTED_INTERFACE_KINDS = ['api', 'cli'];
+export const SUPPORTED_INTERFACE_KINDS = [
+    'api',
+    'cli',
+    'mcp',
+];
+export const UNSUPPORTED_INTERFACE_KINDS = [
+    'web',
+];
+/**
+ * Whether `compile`, the pre-flight plan, and the probe qualification gate
+ * admit a declared kind. All three call this, so what a contract may declare
+ * and what a defect signature may declare against cannot disagree.
+ */
+export const isSupportedInterfaceKind = (kind) => SUPPORTED_INTERFACE_KINDS.includes(kind);
+/**
+ * A quoted kind list with its own verb, for a diagnostic that names what is
+ * supported. A function so the one-element form has a test: closing a kind is a
+ * move the tuple below is built to allow, and the general form would render one
+ * element as a leading " and ".
+ */
+export const kindsClause = (kinds) => {
+    const quoted = kinds.map((kind) => `"${kind}"`);
+    return quoted.length === 1
+        ? `${quoted.join('')} is`
+        : `${quoted.slice(0, -1).join(', ')} and ${quoted.slice(-1).join('')} are`;
+};
+/**
+ * The supported list as both throwers spell it, rendered from the tuple so a
+ * message cannot claim a set the check does not enforce.
+ */
+export const SUPPORTED_KINDS_CLAUSE = kindsClause(SUPPORTED_INTERFACE_KINDS);
 export function checkInterfaceKind(contract) {
     for (const iface of contract.permittedInterfaces) {
-        if (!SUPPORTED_INTERFACE_KINDS.includes(iface.kind)) {
-            throw new StructuralFailure('unsupported-interface-kind', `EvalContract.permittedInterfaces[logicalId=${iface.logicalId}].kind`, `"${iface.kind}" is not supported; "api" and "cli" are (AD-10)`);
+        if (!isSupportedInterfaceKind(iface.kind)) {
+            throw new StructuralFailure('unsupported-interface-kind', `EvalContract.permittedInterfaces[logicalId=${iface.logicalId}].kind`, `"${iface.kind}" is not supported; ${SUPPORTED_KINDS_CLAUSE} (AD-10)`);
         }
     }
 }
@@ -56,21 +91,79 @@ export function commandSignature(operation) {
         ...operation.invocation.subcommandPath,
     ].join(COMMAND_SIGNATURE_SEPARATOR);
 }
-/** The transport identity of an operation of either kind. */
-export const anyOperationSignature = (operation) => isCommandOperation(operation)
-    ? commandSignature(operation)
-    : operationSignature(operation);
-/** Finds duplicate method and path signatures across the full inventory. */
+/**
+ * The transport identity of a tool call: the published tool name, alone and
+ * compared literally.
+ *
+ * There is nothing to erase and nothing to join. Every MCP call shares the one
+ * transport identity `tools/call`, so the tool name is the whole of what tells
+ * two calls apart, and a method and a path template would render one signature
+ * for every tool a server publishes. Takes the field rather than an
+ * `McpOperation`, on `operationSignature`'s own terms: AD-40's corpus-side
+ * signature declares the same name and must produce the same string from it.
+ */
+export function mcpSignature(operation) {
+    return operation.toolName;
+}
+/** The transport identity of an operation of any kind. */
+export const anyOperationSignature = (operation) => {
+    if (isCommandOperation(operation))
+        return commandSignature(operation);
+    if (isMcpOperation(operation))
+        return mcpSignature(operation);
+    return operationSignature(operation);
+};
+/**
+ * The shape family an interface kind's transport identity is rendered in.
+ * Three renderings, and `api` and `web` share one because they share an
+ * operation shape.
+ *
+ * Typed against the kind vocabulary rather than `string`, so a fifth
+ * `INTERFACE_KINDS` member fails the typecheck here instead of landing in the
+ * `api` family and rendering a method and a path template it does not have.
+ */
+export const signatureFamilyOf = (kind) => {
+    switch (kind) {
+        case 'cli':
+            return 'cli';
+        case 'mcp':
+            return 'mcp';
+        case 'api':
+        case 'web':
+            return 'api';
+    }
+};
+/**
+ * Finds duplicate transport identities across the full inventory.
+ *
+ * Keyed on the declaring kind's shape family beside the rendered string,
+ * because the three renderings draw from different namespaces: a tool named
+ * `notes` and an executable named `notes` both render `notes` while naming
+ * different things on different machines, and refusing that pair would be a
+ * collision the author cannot fix. `api` and `web` share one family, so two
+ * operations sharing a method and a path template across those two kinds still
+ * collide. `resolveHomeOperation` compares within a family for the same reason,
+ * so the two agree about what a collision is.
+ */
 export function checkDuplicateOperationSignature(contract) {
     const seen = new Map();
     for (const iface of contract.permittedInterfaces) {
         for (const operation of operationsOf(iface)) {
             const signature = anyOperationSignature(operation);
-            const collision = seen.get(signature);
+            const family = signatureFamilyOf(iface.kind);
+            const key = `${family} ${signature}`;
+            const collision = seen.get(key);
             if (collision !== undefined) {
-                throw new StructuralFailure('duplicate-operation-signature', `EvalContract.permittedInterfaces[logicalId=${iface.logicalId}].operations[operationId=${operation.operationId}]`, `collides with permittedInterfaces[logicalId=${collision.logicalId}].operations[operationId=${collision.operation.operationId}] after parameter-name erasure ("${signature}") (AD-19, AD-40)`);
+                // The message names the family, because the identity alone no
+                // longer says which namespace it was compared in, and the
+                // erasure clause is scoped to the family it applies to: a tool
+                // name and an executable path carry no parameters to erase.
+                const how = family === 'api'
+                    ? 'after parameter-name erasure'
+                    : 'on the identity it renders';
+                throw new StructuralFailure('duplicate-operation-signature', `EvalContract.permittedInterfaces[logicalId=${iface.logicalId}].operations[operationId=${operation.operationId}]`, `collides with permittedInterfaces[logicalId=${collision.logicalId}].operations[operationId=${collision.operation.operationId}] ${how} ("${signature}") among ${family}-shaped operations (AD-19, AD-40)`);
             }
-            seen.set(signature, { logicalId: iface.logicalId, operation });
+            seen.set(key, { logicalId: iface.logicalId, operation });
         }
     }
 }
@@ -83,6 +176,15 @@ export function checkDuplicateOperationSignature(contract) {
  * resolving `absent`, on AD-26's own precedent for a dangling reference-set
  * identifier: `absent` is defined over pointers that do not resolve against
  * observed evidence, and a dangling declaration is neither.
+ *
+ * Resolving the pointer's step segment against the interaction plan is the
+ * route for an oracle check, an oracle direction's evidence target and a rubric
+ * criterion. A sensitivity-witness relation takes the other route, because a leg
+ * identifier shares the step namespace without being a step and the plan lookup
+ * cannot answer for one. The witness scope is what decides it, and preferring it
+ * over the plan matters for ordering: this check runs at `compile.ts` ahead of
+ * `checkWitnessLegIdentifiers`, so a leg id colliding with a step id is still
+ * present here and the plan route would answer it against the wrong operation.
  */
 export function checkArtifactReferences(contract) {
     for (const iface of contract.permittedInterfaces) {
@@ -95,14 +197,23 @@ export function checkArtifactReferences(contract) {
         }
     }
     const index = buildPlanIndex(contract.interactionPlan, contract.permittedInterfaces, { duplicateIds: 'unresolved' });
-    forEachArtifactPointer(contract, (pointer, path) => {
+    const operationFor = (witnessScope, stepId) => {
+        // A relation pointer rooted at anything but its own leg is
+        // `checkWitnessLegality`'s, which names the witness and the stray root.
+        if (witnessScope !== null)
+            return witnessScope.legIds.includes(stepId)
+                ? witnessScope.operation
+                : undefined;
+        const step = index.stepOf(stepId);
+        if (step === undefined)
+            return undefined;
+        return anyOperationOf(index, step.operationId);
+    };
+    forEachArtifactPointer(contract, (pointer, path, witnessScope) => {
         const target = parseEvidenceTarget(pointer);
         if (target.artifactId === null)
             return;
-        const step = index.stepOf(target.stepId);
-        if (step === undefined)
-            return;
-        const operation = anyOperationOf(index, step.operationId);
+        const operation = operationFor(witnessScope, target.stepId);
         // An unresolvable step or operation is `unreachable-check-evidence`'s,
         // at a higher rung; this check has nothing to compare against.
         if (operation === undefined)
@@ -138,7 +249,7 @@ export function checkUndeclaredMandatoryInput(contract) {
             if (binding === null)
                 continue;
             const shape = requestShapeOf(operation, channel);
-            // A step binding a channel of the other kind has no declared shape
+            // A step binding a channel of another kind has no declared shape
             // to answer to. Reporting it as an undeclared input is true as far
             // as it goes: the operation declares no such channel, and so
             // declares no such key on it.

package/dist/core/compile/reachability.d.ts

@@ -2,6 +2,21 @@ import type { EvalContract } from '../schemas/eval-contract.ts';
 import type { Expression } from '../schemas/expression.ts';
 import type { AnyOperation } from '../schemas/interface.ts';
 import { type PlanIndex } from '../seal/plan-index.ts';
+/**
+ * A sensitivity witness's own resolution context: the operation it is declared
+ * on, and the leg identifiers its relation's pointers may root at. Both halves
+ * are needed. The operation is the only one a leg can be issued against, and a
+ * pointer rooted at anything else is `checkWitnessLegality`'s to report, so a
+ * consumer answers for a leg and abstains on the rest.
+ *
+ * `ExpressionSite.witnessScope` in `expression-legality.ts` carries the same
+ * pair for the same reason. Two spellings of one idea, kept apart while each
+ * has one consumer.
+ */
+export type WitnessScope = {
+    readonly operation: AnyOperation;
+    readonly legIds: readonly string[];
+};
 /**
  * Every interaction-rooted pointer the contract writes down, wherever it sits:
  * an oracle's check and its direction's evidence targets, a rubric criterion's
@@ -10,8 +25,17 @@ import { type PlanIndex } from '../seal/plan-index.ts';
  * Broader than `forEachCheckPointer`, which walks oracle checks alone, because
  * an artifact identifier is an authoring fault at every site that names one and
  * a check that walked only the checks would report half of them.
+ *
+ * The third argument is the witness scope, supplied at a sensitivity-witness
+ * relation and `null` everywhere else. A witness leg carries no operation of its
+ * own: it probes the operation declaring the witness, and its `legId` roots the
+ * relation's pointers in the same namespace as interaction-plan step ids
+ * without being a step. So a caller resolving the pointer's own step segment
+ * against the plan finds nothing at a witness site and has to be handed the
+ * scope instead. Everywhere else the pointer's step segment is the only thing
+ * that names an operation.
  */
-export declare function forEachArtifactPointer(contract: EvalContract, visit: (pointer: string, artifactPath: string) => void): void;
+export declare function forEachArtifactPointer(contract: EvalContract, visit: (pointer: string, artifactPath: string, witnessScope: WitnessScope | null) => void): void;
 export declare function checkBoundElementScope(contract: EvalContract): void;
 /** `checkBoundElementScope` over one bare `Expression`. */
 export declare function checkExpressionBoundElementScope(expression: Expression, artifactPath: string): void;
@@ -24,6 +48,54 @@ export declare function checkExpressionBoundElementScope(expression: Expression,
 export declare function forEachExpressionPointer(expression: Expression, visit: (pointer: string, path: string) => void): void;
 /** `checkEvidenceReachability` over one bare `Expression` and one operation. */
 export declare function checkExpressionEvidenceReachability(expression: Expression, artifactPath: string, operation: AnyOperation): void;
+/**
+ * `unreachable-check-evidence` for a pointer at a channel a witness leg never
+ * carries.
+ *
+ * `evaluateReachabilityAgainstOperation` answers for a sealed run record, where
+ * every channel the interface produces is observed. A witness leg is narrower.
+ * `evidenceOf` builds one from a single probe observation and writes every
+ * channel that observation does not describe blank, so a bare pointer at one
+ * resolves absent on both legs however reachable it looks against the
+ * declaration. `deep-equality` over an absent side is `false` and the enclosing
+ * `not` then certifies the operation sensitive on every run.
+ *
+ * What a leg carries is the operation's own described channel, its transport
+ * inputs, and the channels its transport produces with no descriptor of their
+ * own: the status and the headers off an interface that speaks HTTP, the exit
+ * code off a command, the error flag alone off a tool call. `response-headers`
+ * stays legal for HTTP deliberately, matching the note on `projectObservation`
+ * that the projection does not carry headers and the relation reads them raw;
+ * a tool call has none to read.
+ *
+ * The artifact channel narrows once more. A leg carries the one artifact the
+ * descriptor nominates, so a pointer at any other declared artifact is blank
+ * even though the contract declares the operation writes it.
+ */
+export declare function checkExpressionLegChannel(expression: Expression, artifactPath: string, operation: AnyOperation): void;
+/**
+ * `unreachable-check-evidence` for a pointer at a field the operation declares
+ * volatile. Reachability answers the descriptor question and this answers the
+ * projection one, so a caller that runs both gets the whole answer.
+ *
+ * Only a sensitivity-witness relation asks. `projectObservation` prunes every
+ * volatile pointer from the described channel before `evidenceOf` builds the
+ * leg the relation reads, so a relation addressing one resolves absent on both
+ * legs. `deep-equality` over an absent side is `false`, and the enclosing `not`
+ * then reports the operation sensitive on every run from a pair of pointers that
+ * never resolved. It is one of two ways a leg comes back blank, and
+ * `checkExpressionLegChannel` above covers the other. An oracle
+ * is scored against a sealed run record, which carries no projection, so the
+ * same pointer is legitimate there.
+ *
+ * The empty pointer is RFC 6901's whole document, and `pruneVolatile` reads it
+ * that way, so an operation declaring it makes every pointer at the described
+ * channel volatile. `pruneVolatile` prunes a `json` body alone, so a body
+ * arriving as text is never pruned and a differential over it would work.
+ * Refusing it anyway is the right default: a descriptor declaring `requiredKeys`
+ * and `types` says the body is json, and compile cannot see what arrives.
+ */
+export declare function checkExpressionVolatility(expression: Expression, artifactPath: string, operation: AnyOperation): void;
 type ReachabilityResult = {
     readonly reachable: true;
 } | {

package/dist/core/compile/reachability.js

@@ -7,12 +7,12 @@
  * `evaluatePointerReachability` is exported separately as the non-throwing
  * per-pointer core, for reuse and direct testing.
  */
-import { declaredArtifactsOf, descriptorArtifactOf, descriptorChannelOf, isCommandOperation, requestShapeOf, } from '../declared-inputs.js';
+import { declaredArtifactsOf, descriptorArtifactOf, descriptorChannelOf, isCommandOperation, isMcpOperation, requestShapeOf, } from '../declared-inputs.js';
 import { ARRAY_INDEX_PATTERN } from '../evaluate/evidence-resolution.js';
 import { StructuralFailure } from '../failure-codes.js';
 import { operationsOf } from '../schemas/interface.js';
 import { JsonTypeName } from '../schemas/primitives.js';
-import { anyOperationOf, buildPlanIndex, parseEvidenceTarget, } from '../seal/plan-index.js';
+import { anyOperationOf, buildPlanIndex, decodeTail, parseEvidenceTarget, } from '../seal/plan-index.js';
 function visitOperand(operand, path, insideQuantifier, visit) {
     if ('pointer' in operand)
         visit({ pointer: operand.pointer, path, insideQuantifier });
@@ -62,23 +62,32 @@ function forEachCheckPointer(contract, visit) {
  * Broader than `forEachCheckPointer`, which walks oracle checks alone, because
  * an artifact identifier is an authoring fault at every site that names one and
  * a check that walked only the checks would report half of them.
+ *
+ * The third argument is the witness scope, supplied at a sensitivity-witness
+ * relation and `null` everywhere else. A witness leg carries no operation of its
+ * own: it probes the operation declaring the witness, and its `legId` roots the
+ * relation's pointers in the same namespace as interaction-plan step ids
+ * without being a step. So a caller resolving the pointer's own step segment
+ * against the plan finds nothing at a witness site and has to be handed the
+ * scope instead. Everywhere else the pointer's step segment is the only thing
+ * that names an operation.
  */
 export function forEachArtifactPointer(contract, visit) {
-    const seen = (pointer, artifactPath) => {
+    const seen = (pointer, artifactPath, witnessScope) => {
         if (pointer.startsWith('@'))
             return;
-        visit(pointer, artifactPath);
+        visit(pointer, artifactPath, witnessScope);
     };
     contract.oracles.forEach((oracle) => {
         if (oracle.check !== null)
-            visitExpression(oracle.check, 'check', false, (site) => seen(site.pointer, `EvalContract.oracles[id=${oracle.id}].${site.path}`));
+            visitExpression(oracle.check, 'check', false, (site) => seen(site.pointer, `EvalContract.oracles[id=${oracle.id}].${site.path}`, null));
         oracle.direction?.evidenceTargets.forEach((target, index) => {
-            seen(target, `EvalContract.oracles[id=${oracle.id}].direction.evidenceTargets[${index}]`);
+            seen(target, `EvalContract.oracles[id=${oracle.id}].direction.evidenceTargets[${index}]`, null);
         });
     });
     contract.rubrics.forEach((rubric) => {
         rubric.criteria.forEach((criterion) => {
-            seen(criterion.evidence, `EvalContract.rubrics[id=${rubric.id}].criteria[id=${criterion.id}].evidence`);
+            seen(criterion.evidence, `EvalContract.rubrics[id=${rubric.id}].criteria[id=${criterion.id}].evidence`, null);
         });
     });
     contract.permittedInterfaces.forEach((iface, interfaceIndex) => {
@@ -86,7 +95,11 @@ export function forEachArtifactPointer(contract, visit) {
             const witness = operation.sensitivityWitness;
             if (witness === null)
                 return;
-            visitExpression(witness.relation, 'relation', false, (site) => seen(site.pointer, `EvalContract.permittedInterfaces[${interfaceIndex}].operations[${operationIndex}].sensitivityWitness.${site.path}`));
+            const scope = {
+                operation,
+                legIds: witness.legs.map((leg) => leg.legId),
+            };
+            visitExpression(witness.relation, 'relation', false, (site) => seen(site.pointer, `EvalContract.permittedInterfaces[${interfaceIndex}].operations[${operationIndex}].sensitivityWitness.${site.path}`, scope));
         });
     });
 }
@@ -126,6 +139,93 @@ export function checkExpressionEvidenceReachability(expression, artifactPath, op
         }
     });
 }
+/**
+ * `unreachable-check-evidence` for a pointer at a channel a witness leg never
+ * carries.
+ *
+ * `evaluateReachabilityAgainstOperation` answers for a sealed run record, where
+ * every channel the interface produces is observed. A witness leg is narrower.
+ * `evidenceOf` builds one from a single probe observation and writes every
+ * channel that observation does not describe blank, so a bare pointer at one
+ * resolves absent on both legs however reachable it looks against the
+ * declaration. `deep-equality` over an absent side is `false` and the enclosing
+ * `not` then certifies the operation sensitive on every run.
+ *
+ * What a leg carries is the operation's own described channel, its transport
+ * inputs, and the channels its transport produces with no descriptor of their
+ * own: the status and the headers off an interface that speaks HTTP, the exit
+ * code off a command, the error flag alone off a tool call. `response-headers`
+ * stays legal for HTTP deliberately, matching the note on `projectObservation`
+ * that the projection does not carry headers and the relation reads them raw;
+ * a tool call has none to read.
+ *
+ * The artifact channel narrows once more. A leg carries the one artifact the
+ * descriptor nominates, so a pointer at any other declared artifact is blank
+ * even though the contract declares the operation writes it.
+ */
+export function checkExpressionLegChannel(expression, artifactPath, operation) {
+    const described = descriptorChannelOf(operation);
+    const describedArtifact = descriptorArtifactOf(operation);
+    const carried = isCommandOperation(operation)
+        ? [described, 'exit-code', 'call-inputs']
+        : isMcpOperation(operation)
+            ? [described, 'response-status', 'call-inputs']
+            : [described, 'response-headers', 'response-status', 'call-inputs'];
+    visitExpression(expression, '', false, (site) => {
+        if (site.pointer.startsWith('@'))
+            return;
+        const target = parseEvidenceTarget(site.pointer);
+        const refuse = (reason) => {
+            throw new StructuralFailure('unreachable-check-evidence', `${artifactPath}${site.path}`, `"${site.pointer}" ${reason}`);
+        };
+        if (!carried.includes(target.channel))
+            refuse(`addresses ${target.channel}, which a witness leg of operation "${operation.operationId}" does not carry; pre-flight builds each leg from ${carried.join(', ')} alone`);
+        if (target.artifactId !== null && target.artifactId !== describedArtifact)
+            refuse(`addresses the "${target.artifactId}" artifact, which operation "${operation.operationId}" declares it writes and its descriptor does not nominate, so a witness leg carries nothing for it`);
+    });
+}
+/**
+ * `unreachable-check-evidence` for a pointer at a field the operation declares
+ * volatile. Reachability answers the descriptor question and this answers the
+ * projection one, so a caller that runs both gets the whole answer.
+ *
+ * Only a sensitivity-witness relation asks. `projectObservation` prunes every
+ * volatile pointer from the described channel before `evidenceOf` builds the
+ * leg the relation reads, so a relation addressing one resolves absent on both
+ * legs. `deep-equality` over an absent side is `false`, and the enclosing `not`
+ * then reports the operation sensitive on every run from a pair of pointers that
+ * never resolved. It is one of two ways a leg comes back blank, and
+ * `checkExpressionLegChannel` above covers the other. An oracle
+ * is scored against a sealed run record, which carries no projection, so the
+ * same pointer is legitimate there.
+ *
+ * The empty pointer is RFC 6901's whole document, and `pruneVolatile` reads it
+ * that way, so an operation declaring it makes every pointer at the described
+ * channel volatile. `pruneVolatile` prunes a `json` body alone, so a body
+ * arriving as text is never pruned and a differential over it would work.
+ * Refusing it anyway is the right default: a descriptor declaring `requiredKeys`
+ * and `types` says the body is json, and compile cannot see what arrives.
+ */
+export function checkExpressionVolatility(expression, artifactPath, operation) {
+    if (operation.volatilePointers.length === 0)
+        return;
+    const channel = descriptorChannelOf(operation);
+    const describedArtifact = descriptorArtifactOf(operation);
+    const volatileTails = operation.volatilePointers.map(decodeTail);
+    visitExpression(expression, '', false, (site) => {
+        if (site.pointer.startsWith('@'))
+            return;
+        const target = parseEvidenceTarget(site.pointer);
+        if (target.channel !== channel)
+            return;
+        if (target.artifactId !== null && target.artifactId !== describedArtifact)
+            return;
+        const pruned = volatileTails.find((tokens) => tokens.every((token, index) => target.tail[index] === token));
+        if (pruned === undefined)
+            return;
+        throw new StructuralFailure('unreachable-check-evidence', `${artifactPath}${site.path}`, `"${site.pointer}" addresses "${`/${pruned.join('/')}`}", which operation "${operation.operationId}" declares volatile, so the projection the relation reads has already removed it`);
+    });
+}
 const reachable = () => ({ reachable: true });
 const unreachable = (reason) => ({
     reachable: false,
@@ -251,6 +351,16 @@ function evaluateReachabilityAgainstOperation(pointer, operation) {
     if (target.channel === descriptorChannel) {
         return descendThroughDescriptor(operation.responseDescriptor, target, operation.operationId, target.channel);
     }
+    // A tool call produces its structured result on the descriptor's channel and
+    // its error flag on `response-status`, and nothing else: no HTTP headers, no
+    // process exit code, no stream, and no written file. Placed ahead of the
+    // residue below, which answers reachable for three channels a tool call
+    // never fills.
+    if (isMcpOperation(operation) &&
+        target.channel !== 'response-status' &&
+        target.channel !== 'call-inputs') {
+        return unreachable(`addresses ${target.channel} on operation "${operation.operationId}", which is a tool call and carries its result on ${descriptorChannel} and its error flag on response-status alone`);
+    }
     if (target.channel === 'stdout' || target.channel === 'stderr') {
         // The stream this operation's descriptor does not describe carries no
         // declared structure, so a non-empty tail proves the pointer
@@ -267,28 +377,33 @@ function evaluateReachabilityAgainstOperation(pointer, operation) {
         return unreachable(`addresses ${target.channel} on operation "${operation.operationId}", which runs behind a command and produces no HTTP response`);
     }
     if (target.channel === 'call-inputs') {
-        if (target.tail.length === 0)
-            return reachable();
-        const { transportChannel } = target;
-        if (transportChannel === null) {
+        const { inputChannel } = target;
+        if (inputChannel === null) {
             // Unreachable: parseEvidenceTarget's own guarantee.
-            throw new TypeError('call-inputs evidence target carries no transport channel');
+            throw new TypeError('call-inputs evidence target carries no input channel');
+        }
+        // The channel test runs ahead of the tail test, because a tail-less
+        // pointer at a channel the operation does not accept is unreachable
+        // too: the recorded call inputs carry no key for it, so the pointer
+        // resolves absent on every run and no run can change that. Asking about
+        // the tail first admitted every such pointer, on all nine channels.
+        const shape = requestShapeOf(operation, inputChannel);
+        if (shape === undefined) {
+            return unreachable(`addresses call-inputs ${inputChannel}, a channel operation "${operation.operationId}" does not accept input on`);
         }
+        if (target.tail.length === 0)
+            return reachable();
         const firstToken = target.tail[0];
         if (firstToken === undefined) {
             throw new TypeError('evidence-target tail is non-empty but has no first token');
         }
-        const shape = requestShapeOf(operation, transportChannel);
-        if (shape === undefined) {
-            return unreachable(`addresses call-inputs ${transportChannel}, a channel operation "${operation.operationId}" does not accept input on`);
-        }
         const { requiredKeys, permittedKeys, types } = shape;
         if (!requiredKeys.includes(firstToken) &&
             !permittedKeys.includes(firstToken)) {
-            return unreachable(`addresses call-inputs ${transportChannel} field "${firstToken}", which operation "${operation.operationId}" declares in neither requiredKeys nor permittedKeys`);
+            return unreachable(`addresses call-inputs ${inputChannel} field "${firstToken}", which operation "${operation.operationId}" declares in neither requiredKeys nor permittedKeys`);
         }
         if (descendsIntoDeclaredScalar(types, target.tail, firstToken)) {
-            return unreachable(`descends into call-inputs ${transportChannel} field "${firstToken}", which operation "${operation.operationId}" declares a scalar with no further structure`);
+            return unreachable(`descends into call-inputs ${inputChannel} field "${firstToken}", which operation "${operation.operationId}" declares a scalar with no further structure`);
         }
         return reachable();
     }