eval-quality 1.4.2 → 3.0.0

package/dist/adapters/mcp-adapter.js

@@ -0,0 +1,357 @@
+/**
+ * The environment-probe port over one MCP tool call, for the `mcp` mechanism.
+ * `evaluateMcpTarget` closes the authorization half; this file closes the
+ * execution half.
+ *
+ * Every rule below is what "what's a tool server allowed to do" resolves to, a
+ * decision settled here in the implementation, with no architecture revision
+ * behind it:
+ *
+ * 1. stdio, and no other transport. MCP defines two: stdio launches the server
+ *    as a subprocess and speaks JSON-RPC over its standard streams, and
+ *    Streamable HTTP speaks the same JSON-RPC over HTTP to a URL. AD-2 is
+ *    unconditional that no module in the package performs network I/O and that
+ *    v0 ships no network adapter at all, and its own history says that
+ *    exception was deleted rather than narrowed. Launching a subprocess is
+ *    mechanically what `command-line-adapter.ts` already does and opens no
+ *    socket. A server behind a URL is the caller's own `EnvironmentProbePort`,
+ *    proven with AD-37's suite, which is the same division that leaves `api`
+ *    with no reference adapter here.
+ * 2. `target` is spawned directly with an argv array (`shell: false`, Node's
+ *    own default, stated anyway since it is the one thing this adapter must
+ *    never turn off). The tool's arguments travel inside the JSON-RPC frame
+ *    and never as argv, so no channel value reaches a command line at all.
+ *    `serverEnvironment` passes through as declared, over the host's own
+ *    `PATH` so a `target` naming a bare command still resolves; a declared
+ *    `PATH` key wins over that default. Nothing else of the host environment
+ *    reaches the server.
+ * 3. One session per port invocation, opened and torn down inside `callTool`.
+ *    AD-37's `single-underlying-call-on-success` counts the underlying
+ *    mechanism, so a session reused across invocations would make the count
+ *    depend on which one ran first. AD-35's caps are per-invocation, and a
+ *    session held across legs leaves a hung server with no cap to catch it on
+ *    the legs that follow. AD-10's state-reset differential compares two legs
+ *    that must describe the same fixture state, so adapter-side state carried
+ *    between them is a confound on the one measurement it exists to make.
+ *    `maxElapsedMs` bounds the whole invocation, from launch through
+ *    `initialize`, `tools/call`, and teardown: a handshake that never
+ *    completes and a tool call that never answers are the same event to the
+ *    caller. `maxOutputBytes` applies to the server's stdout and, separately,
+ *    to its stderr, which the stdio transport reserves for logging; an
+ *    undrained stderr pipe deadlocks the server once the OS buffer fills, and
+ *    a drained one with no cap is an unbounded allocation. Teardown closes the
+ *    server's stdin and then kills its whole process group: `npx -y <server>`
+ *    is the ordinary launch shape, so killing the direct child alone leaves
+ *    the server it started running, which is the state this rule exists to
+ *    prevent.
+ * 4. A tool result carrying `isError: true` is an observation, and so is a
+ *    JSON-RPC error answering `tools/call`. The server answered, and a server
+ *    refusing a tool the contract declares is precisely the defect an oracle
+ *    should be able to assert on; throwing would make it invisible. A server
+ *    that refuses the `initialize` handshake answered a different question:
+ *    the session never opened, so nothing observed the system, and that throws
+ *    `port-failure` alongside a failure to start and a malformed frame. Only a
+ *    policy denial, a cap, an abort, or a failure to establish the session
+ *    throws.
+ */
+import { spawn } from 'node:child_process';
+import { StringDecoder } from 'node:string_decoder';
+import { RuntimeFault } from '../core/schemas/faults.js';
+import { probeParsers } from '../ports/environment-probe-port.js';
+import { evaluateMcpTarget } from './mcp-target-policy.js';
+import { runPortMethod } from './port-boundary.js';
+/** The protocol revision this client announces. A server free to answer with a different one has still opened the session; a server that answers with a JSON-RPC error has refused it, and rule 4 says what happens then. */
+const PROTOCOL_VERSION = '2025-06-18';
+const INITIALIZE_ID = 1;
+const CALL_TOOL_ID = 2;
+function capped(detail) {
+    return new RuntimeFault('budget-exhausted', 'McpProbeRequest', detail);
+}
+function forbidden(detail) {
+    return new RuntimeFault('forbidden-target', 'ProbeRequest', detail);
+}
+function buildEnv(declared) {
+    const base = {};
+    if (process.env.PATH !== undefined)
+        base.PATH = process.env.PATH;
+    return { ...base, ...declared };
+}
+const isJsonObject = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+/**
+ * A detached child leads its own process group, so the negative pid reaches
+ * every process it started. Windows has no process groups and throws here, so
+ * the direct child is the fallback.
+ */
+function killProcessGroup(child) {
+    const { pid } = child;
+    if (pid === undefined) {
+        child.kill('SIGKILL');
+        return;
+    }
+    try {
+        process.kill(-pid, 'SIGKILL');
+    }
+    catch {
+        child.kill('SIGKILL');
+    }
+}
+/**
+ * Launches the server and frames JSON-RPC over its standard streams: one
+ * message per line, which is what the stdio transport specifies.
+ *
+ * Every way the session can die reaches the caller through one rejected
+ * `failure` promise that each request races against, so a cap, a malformed
+ * frame, a spawn failure, and an early exit all surface at the await that was
+ * waiting on the server. A listener that rejected nothing would leave the call
+ * to run out its elapsed budget for a fault already known.
+ */
+function startSession(request, signal) {
+    const child = spawn(request.target, [...request.targetArgs], {
+        cwd: request.cwd,
+        env: { ...request.env },
+        shell: false,
+        signal,
+        detached: true,
+        stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    // Keyed by the id as text: JSON-RPC admits a string id, and a server that
+    // echoes `1` back as `"1"` is correlating correctly.
+    const pending = new Map();
+    let closed = false;
+    let broken = false;
+    let phase = 'launch';
+    let rejectFailure = () => { };
+    const failure = new Promise((_resolve, reject) => {
+        rejectFailure = reject;
+    });
+    // The race is usually won by a response, which leaves this rejection
+    // unobserved; without the handler that is an unhandled rejection.
+    failure.catch(() => { });
+    const fail = (error) => {
+        if (broken)
+            return;
+        broken = true;
+        rejectFailure(error);
+    };
+    const timer = setTimeout(() => {
+        fail(capped(`the session exceeded maxElapsedMs (${request.maxElapsedMs}ms) during ${phase} and was torn down`));
+    }, request.maxElapsedMs);
+    let stdoutBytes = 0;
+    let stdoutBuffer = '';
+    let stderrBytes = 0;
+    // Chunk boundaries fall inside multi-byte characters, and decoding each
+    // chunk on its own replaces the split character with U+FFFD. The corruption
+    // survives `JSON.parse`, so it would reach the observation body an oracle
+    // asserts on and the fixture digest covers.
+    const decoder = new StringDecoder('utf8');
+    const handleLine = (line) => {
+        let message;
+        try {
+            message = JSON.parse(line);
+        }
+        catch {
+            fail(new Error(`the server wrote bytes on stdout that are not a JSON-RPC message: ${line.slice(0, 200)}`));
+            return;
+        }
+        if (!isJsonObject(message))
+            return;
+        const { id } = message;
+        if (typeof id !== 'number' && typeof id !== 'string')
+            return;
+        if (message.method !== undefined)
+            return;
+        const settle = pending.get(String(id));
+        if (settle === undefined)
+            return;
+        pending.delete(String(id));
+        settle({ result: message.result, error: message.error });
+    };
+    const drainLines = () => {
+        let newlineAt = stdoutBuffer.indexOf('\n');
+        while (newlineAt !== -1) {
+            const line = stdoutBuffer.slice(0, newlineAt);
+            stdoutBuffer = stdoutBuffer.slice(newlineAt + 1);
+            if (line.trim() !== '')
+                handleLine(line);
+            newlineAt = stdoutBuffer.indexOf('\n');
+        }
+    };
+    child.stdout?.on('data', (chunk) => {
+        stdoutBytes += chunk.byteLength;
+        if (stdoutBytes > request.maxOutputBytes) {
+            fail(capped(`the server wrote past maxOutputBytes (${request.maxOutputBytes}) on stdout and the session was torn down`));
+            return;
+        }
+        stdoutBuffer += decoder.write(chunk);
+        drainLines();
+    });
+    // A server that wrote a whole frame and closed without a trailing newline
+    // has answered, and dropping the residue would report a fault for a
+    // complete response.
+    child.stdout?.on('end', () => {
+        stdoutBuffer += decoder.end();
+        drainLines();
+        const residual = stdoutBuffer;
+        stdoutBuffer = '';
+        if (residual.trim() !== '')
+            handleLine(residual);
+    });
+    // Drained rather than ignored: the transport reserves stderr for logging and
+    // an unread pipe deadlocks the server once the OS buffer fills.
+    child.stderr?.on('data', (chunk) => {
+        stderrBytes += chunk.byteLength;
+        if (stderrBytes > request.maxOutputBytes) {
+            fail(capped(`the server wrote past maxOutputBytes (${request.maxOutputBytes}) on its own stderr and the session was torn down`));
+        }
+    });
+    // A server that exits before reading its stdin raises EPIPE on this stream
+    // rather than on `child`; with no listener that crashes the host process.
+    child.stdin?.on('error', () => { });
+    child.once('error', (error) => {
+        fail(error);
+    });
+    child.once('close', () => {
+        if (closed)
+            return;
+        fail(new Error(`the server exited during ${phase}`));
+    });
+    const send = (message) => {
+        child.stdin?.write(`${JSON.stringify(message)}\n`);
+    };
+    return {
+        request: (id, method, params) => {
+            phase = method;
+            return Promise.race([
+                new Promise((settle) => {
+                    pending.set(String(id), settle);
+                    send({ jsonrpc: '2.0', id, method, params });
+                }),
+                failure,
+            ]);
+        },
+        notify: (method, params) => {
+            send({ jsonrpc: '2.0', method, params });
+        },
+        close: () => {
+            closed = true;
+            // Set here too, so a late over-cap chunk or a malformed residual line
+            // arriving after teardown cannot reject a settled session.
+            broken = true;
+            clearTimeout(timer);
+            // The stdio transport's own teardown order: close the server's input
+            // stream first, since a well-behaved server exits when it ends.
+            child.stdin?.end();
+            killProcessGroup(child);
+        },
+    };
+}
+/** Whether a JSON-RPC frame carried an error. An explicit `null` is the absence of one. */
+const errorOf = (response) => response.error === undefined || response.error === null
+    ? undefined
+    : response.error;
+/** The result the tool published, or the error object the server answered with. */
+function resultOf(response) {
+    const error = errorOf(response);
+    if (error !== undefined)
+        return { isError: true, structuredResult: error };
+    if (!isJsonObject(response.result))
+        return { isError: false };
+    const { structuredContent, isError } = response.result;
+    if (structuredContent === undefined)
+        return { isError: isError === true };
+    return { isError: isError === true, structuredResult: structuredContent };
+}
+async function callToolOverStdio(request, signal) {
+    const session = startSession(request, signal);
+    try {
+        const handshake = await session.request(INITIALIZE_ID, 'initialize', {
+            protocolVersion: PROTOCOL_VERSION,
+            capabilities: {},
+            clientInfo: { name: 'eval-quality', version: '0' },
+        });
+        const refusal = errorOf(handshake);
+        if (refusal !== undefined) {
+            throw new Error(`the server refused the initialize handshake: ${JSON.stringify(refusal)}`);
+        }
+        // JSON-RPC requires exactly one of `result` and `error`. A frame with
+        // neither says nothing about whether the session opened, and reading it
+        // as consent is the same failure as reading a refusal that way.
+        if (handshake.result === undefined) {
+            throw new Error('the server answered the initialize handshake with neither a result nor an error');
+        }
+        session.notify('notifications/initialized', {});
+        const response = await session.request(CALL_TOOL_ID, 'tools/call', {
+            name: request.toolName,
+            arguments: { ...request.arguments },
+        });
+        return resultOf(response);
+    }
+    finally {
+        session.close();
+    }
+}
+/**
+ * The real mechanism: an actual server process over an actual stdio session.
+ * Exported for the same reason `nodeCommandMechanism` is: AD-37's conformance
+ * subject for this port has to exercise a real handshake, a real cap, and a
+ * real teardown, and a synthetic mechanism would prove nothing about the one
+ * thing this adapter exists to get right.
+ */
+export const nodeStdioMcpMechanism = {
+    callTool: callToolOverStdio,
+};
+const bodyOf = (structuredResult) => structuredResult === undefined
+    ? { kind: 'absent' }
+    : { kind: 'json', value: structuredResult };
+export function createMcpAdapter(policy, mechanism = nodeStdioMcpMechanism) {
+    return {
+        probe: (request, signal) => runPortMethod({
+            request,
+            requestParser: probeParsers.request,
+            responseParser: probeParsers.response,
+            requestPath: 'ProbeRequest',
+            responsePath: 'ProbeObservation',
+            signal,
+            mechanism: async (parsed, innerSignal) => {
+                if (parsed.kind !== 'mcp') {
+                    // This adapter authorizes no target of any other kind, so such
+                    // a request meets the same "the mapping names nothing" denial an
+                    // unmapped interfaceId would, before any server starts. The
+                    // message names the kind that arrived, because the request union
+                    // carries more than one kind this adapter refuses.
+                    throw forbidden(`this adapter runs mcp requests only; no ${parsed.kind} target is ever authorized`);
+                }
+                const decision = evaluateMcpTarget(policy, {
+                    interfaceId: parsed.interfaceId,
+                    toolName: parsed.toolName,
+                });
+                if (!decision.allowed)
+                    throw forbidden(decision.detail);
+                const { authorization } = decision;
+                const callResult = await mechanism.callTool({
+                    target: authorization.target,
+                    targetArgs: authorization.targetArgs,
+                    toolName: parsed.toolName,
+                    arguments: parsed.channels.arguments,
+                    env: buildEnv(authorization.serverEnvironment),
+                    cwd: authorization.cwd,
+                    maxElapsedMs: authorization.maxElapsedMs,
+                    maxOutputBytes: authorization.maxOutputBytes,
+                }, innerSignal);
+                return { parsed, callResult };
+            },
+            assemble: (raw) => {
+                const { parsed, callResult } = raw;
+                const observation = {
+                    kind: 'mcp',
+                    probeId: parsed.probeId,
+                    interfaceId: parsed.interfaceId,
+                    operationId: parsed.operationId,
+                    isError: callResult.isError,
+                    result: bodyOf(callResult.structuredResult),
+                };
+                return observation;
+            },
+        }),
+    };
+}

package/dist/adapters/mcp-target-policy.d.ts

@@ -0,0 +1,39 @@
+/**
+ * AD-35's default-deny decision for the `mcp` mechanism, as a pure function.
+ *
+ * Lives under `adapters/` for the reason `command-target-policy.ts` records
+ * for itself: the mechanically-enforced dependency direction permits
+ * `adapters/` to import `core/schemas` and never `core/`, so a
+ * target-authorization decision a shipped adapter calls has to be
+ * adapter-owned. The declared shapes stay in `core/schemas/probe-policy.ts`
+ * beside the other two, which keeps all three mappings comparable in one file.
+ */
+import type { McpTargetAuthorization, McpTargetPolicy } from '../core/schemas/probe-policy.ts';
+/** Why a tool server target was denied. Thrown as the single AD-28 `forbidden-target` fault, same as the HTTP and command reasons. */
+export declare const MCP_DENIAL_REASONS: readonly ['interface-not-authorized', 'tool-not-authorized'];
+export type McpDenialReason = (typeof MCP_DENIAL_REASONS)[number];
+export type McpResolvedTarget = {
+    readonly interfaceId: string;
+    readonly toolName: string;
+};
+export type McpPolicyDecision = {
+    readonly allowed: true;
+    readonly authorization: McpTargetAuthorization;
+} | {
+    readonly allowed: false;
+    readonly reason: McpDenialReason;
+    readonly detail: string;
+};
+/**
+ * The interface check runs first, so an unmapped server never reaches the tool
+ * comparison and the two denials stay distinguishable.
+ *
+ * The first authorization naming the interface is the only one consulted, and
+ * `McpTargetPolicy` refuses a second entry naming it. For this mechanism the
+ * interface identifier is the server identity, so searching on past a
+ * non-matching tool list would let one logical interface resolve to a second
+ * binary depending on which tool was asked for. `evaluateCommandTarget` does
+ * search on, and can: its entries are keyed by `(interfaceId, executable)`, so
+ * every candidate it considers runs the same executable.
+ */
+export declare function evaluateMcpTarget(policy: McpTargetPolicy, target: McpResolvedTarget): McpPolicyDecision;

package/dist/adapters/mcp-target-policy.js

@@ -0,0 +1,30 @@
+/** Why a tool server target was denied. Thrown as the single AD-28 `forbidden-target` fault, same as the HTTP and command reasons. */
+export const MCP_DENIAL_REASONS = [
+    'interface-not-authorized',
+    'tool-not-authorized',
+];
+function deny(reason, detail) {
+    return { allowed: false, reason, detail };
+}
+/**
+ * The interface check runs first, so an unmapped server never reaches the tool
+ * comparison and the two denials stay distinguishable.
+ *
+ * The first authorization naming the interface is the only one consulted, and
+ * `McpTargetPolicy` refuses a second entry naming it. For this mechanism the
+ * interface identifier is the server identity, so searching on past a
+ * non-matching tool list would let one logical interface resolve to a second
+ * binary depending on which tool was asked for. `evaluateCommandTarget` does
+ * search on, and can: its entries are keyed by `(interfaceId, executable)`, so
+ * every candidate it considers runs the same executable.
+ */
+export function evaluateMcpTarget(policy, target) {
+    const authorization = policy.authorizations.find((candidate) => candidate.interfaceId === target.interfaceId);
+    if (authorization === undefined) {
+        return deny('interface-not-authorized', `no authorization names interface "${target.interfaceId}"`);
+    }
+    if (authorization.tools.includes(target.toolName)) {
+        return { allowed: true, authorization };
+    }
+    return deny('tool-not-authorized', `tool "${target.toolName}" is not among the authorized tools for interface "${target.interfaceId}"`);
+}

package/dist/cli/render.d.ts

@@ -23,9 +23,14 @@ export declare function renderError(error: unknown): string;
  */
 export declare function renderQualificationFailure(failure: QualificationFailure): string;
 /**
- * AD-21's seven exit codes, one line each. The `--help` output and the README
- * table are this text, so the two cannot drift.
+ * The seven codes the binary can take, one line each: AD-21's six, plus
+ * `EX_USAGE`, which `exit-codes.ts` records as sitting outside AD-21.
+ *
+ * The `--help` output is this text, and `docs/reference/cli-commands.md`
+ * transcribes it. `tests/cli/render.test.ts` holds the README's markdown table
+ * against these rows, and `check:doc-claims` holds the transcription against
+ * this string, so neither copy can drift.
  */
-export declare const EXIT_CODE_TABLE = "Exit codes (AD-21):\n  0   success, and every verdict other than FAIL or a promoted CONCERNS\n  1   CONCERNS promoted by --strict\n  2   FAIL\n  3   invalid: a failed pre-flight, or any other AD-21 invalidating condition\n  4   structural failure\n  5   runtime fault\n  64  usage error\n\n  --strict never promotes a CONCERNS whose firing conditions are all evidence\n  conditions: those report that the measurement fell short of the policy.\n  1 and 2 come from the score command's verdict ladder. 3 comes from a failed\n  pre-flight, which the preflight command reports, or from any other\n  invalidating condition score finds.";
+export declare const EXIT_CODE_TABLE = "Exit codes (AD-21's six, plus 64 from sysexits.h):\n  0   success, and every verdict other than FAIL or a promoted CONCERNS\n  1   CONCERNS promoted by --strict\n  2   FAIL\n  3   invalid: a failed pre-flight, or any other AD-21 invalidating condition\n  4   structural failure\n  5   runtime fault\n  64  usage error\n\n  --strict never promotes a CONCERNS whose firing conditions are all evidence\n  conditions: those report that the measurement fell short of the policy.\n  1 and 2 come from the score command's verdict ladder. 3 comes from a failed\n  pre-flight, which the preflight command reports, or from any other\n  invalidating condition score finds.";
 /** `eval-quality: usage: <message>` */
 export declare function renderUsage(message: string): string;

package/dist/cli/render.js

@@ -1,8 +1,10 @@
 /**
  * The four shapes the binary writes, and the exit-code table two documents
- * share. Every line the CLI emits is produced here, so a format change is one
- * file. Five renderers over the four shapes: a qualification failure and an
- * error both print `<code>: <artifactPath>: <detail>`.
+ * share. Every line the CLI emits is produced here apart from what `main.ts`
+ * writes for a rethrown defect, which is that error's own stack or message, so a
+ * format change is one file. Five
+ * renderers over the four shapes: a qualification failure and an error both
+ * print `<code>: <artifactPath>: <detail>`.
  */
 import { z } from 'zod';
 import { RuntimeFault, StructuralFailure, serializeArtifact, } from '../application/index.js';
@@ -93,10 +95,15 @@ export function renderQualificationFailure(failure) {
     return `${PREFIX}: ${failure.code}: ${failure.artifactPath}: ${failure.detail}`;
 }
 /**
- * AD-21's seven exit codes, one line each. The `--help` output and the README
- * table are this text, so the two cannot drift.
+ * The seven codes the binary can take, one line each: AD-21's six, plus
+ * `EX_USAGE`, which `exit-codes.ts` records as sitting outside AD-21.
+ *
+ * The `--help` output is this text, and `docs/reference/cli-commands.md`
+ * transcribes it. `tests/cli/render.test.ts` holds the README's markdown table
+ * against these rows, and `check:doc-claims` holds the transcription against
+ * this string, so neither copy can drift.
  */
-export const EXIT_CODE_TABLE = `Exit codes (AD-21):
+export const EXIT_CODE_TABLE = `Exit codes (AD-21's six, plus 64 from sysexits.h):
   0   success, and every verdict other than FAIL or a promoted CONCERNS
   1   CONCERNS promoted by --strict
   2   FAIL

package/dist/cli/run.js

@@ -232,7 +232,8 @@ async function runCommand(invocation, environment, application) {
             environment.writeDiagnostic(renderError(error));
             return { outcome: { kind: 'fault' } };
         }
-        // A defect in our own code surfaces as a stack, never as exit 5.
+        // A defect in our own code is rethrown, and `main.ts` writes its stack and
+        // takes exit 5 for it.
         throw error;
     }
 }

package/dist/core/compile/bindings.d.ts

@@ -2,28 +2,15 @@ import type { EvalContract } from '../schemas/eval-contract.ts';
 import type { InteractionStep } from '../schemas/plan.ts';
 import type { InputChannelName } from '../schemas/pointer.ts';
 import { type EvidenceTarget } from '../seal/plan-index.ts';
-/**
- * The one channel a captured pointer may name: whichever channel the
- * referenced operation's own response descriptor describes.
- *
- * `ResponseDescriptor` declares `requiredKeys`, `permittedKeys`, `types`,
- * `successIndicator`, `channelRoles`, and `collectionLocations`, and every one
- * of them is about the channel the operation nominates. Off an interface that
- * speaks HTTP that is the response body; off a command it is the stream the
- * operation names. `response-headers` and `response-status` are never it,
- * because `Observation.responseHeaders` admits objects, arrays, numbers, and
- * `null`, so a header capture compiled as a `string` could resolve to an
- * object at score time.
- */
 /** One `{ captured }` binding, resolved to the pointer target it addresses. */
 export type CapturedBinding = {
-    readonly transportChannel: InputChannelName;
+    readonly inputChannel: InputChannelName;
     readonly key: string;
     readonly pointer: string;
     readonly target: EvidenceTarget;
 };
 /**
- * Every captured binding one step declares, in fixed transport-channel order
+ * Every captured binding one step declares, in fixed input-channel order
  * then by key name, so which binding a check reports never depends on a
  * caller-keyed map's insertion order. Exported because `score/binding-order.ts`
  * and `score/bindings.ts` need the same reading of which bindings are captures.
@@ -66,9 +53,12 @@ export declare function checkBindingCycle(contract: EvalContract): void;
  * Every other channel is refused for a reason that does not depend on the
  * kind: `call-inputs` addresses a step's own request, and `response-headers`,
  * `response-status`, and `exit-code` have no declared structure to give a
- * captured value a type. On the `artifact` channel the identifier is compared
- * too, so a capture from a file the operation writes but does not describe is
- * refused alongside one from a file it never writes.
+ * captured value a type. `response-headers` is the sharpest of the three,
+ * because `Observation.responseHeaders` admits objects, arrays, numbers, and
+ * `null`, so a header capture compiled as a `string` could resolve to an object
+ * at score time. On the `artifact` channel the identifier is compared too, so a
+ * capture from a file the operation writes but does not describe is refused
+ * alongside one from a file it never writes.
  */
 export declare function checkCapturedChannel(contract: EvalContract): void;
 /**

package/dist/core/compile/bindings.js

@@ -22,14 +22,14 @@ import { JsonTypeName } from '../schemas/primitives.js';
 import { anyOperationOf, buildPlanIndex, parseEvidenceTarget, resolveStep, } from '../seal/plan-index.js';
 import { evaluatePointerReachability } from './reachability.js';
 /**
- * Every captured binding one step declares, in fixed transport-channel order
+ * Every captured binding one step declares, in fixed input-channel order
  * then by key name, so which binding a check reports never depends on a
  * caller-keyed map's insertion order. Exported because `score/binding-order.ts`
  * and `score/bindings.ts` need the same reading of which bindings are captures.
  */
 export function capturedBindings(step) {
     const captures = [];
-    for (const { channel: transportChannel, bound: map } of boundChannelsOf(step.inputBinding)) {
+    for (const { channel: inputChannel, bound: map } of boundChannelsOf(step.inputBinding)) {
         if (map === null)
             continue;
         for (const key of Object.keys(map).sort()) {
@@ -37,7 +37,7 @@ export function capturedBindings(step) {
             if (value === undefined || !('captured' in value))
                 continue;
             captures.push({
-                transportChannel,
+                inputChannel,
                 key,
                 pointer: value.captured,
                 target: parseEvidenceTarget(value.captured),
@@ -50,7 +50,7 @@ export function capturedBindings(step) {
 // (`interface-inventory.ts`'s undeclared-key throw), reused so the two new
 // codes and the widened `undeclared-mandatory-input` agree on one spelling.
 function bindingPath(step, capture) {
-    return `EvalContract.interactionPlan[stepId=${step.stepId}].inputBinding.${capture.transportChannel}[${JSON.stringify(capture.key)}]`;
+    return `EvalContract.interactionPlan[stepId=${step.stepId}].inputBinding.${capture.inputChannel}[${JSON.stringify(capture.key)}]`;
 }
 // ---- binding-cycle -------------------------------------------------------
 /**
@@ -166,9 +166,12 @@ function stronglyConnectedComponents(nodes, edgesFrom) {
  * Every other channel is refused for a reason that does not depend on the
  * kind: `call-inputs` addresses a step's own request, and `response-headers`,
  * `response-status`, and `exit-code` have no declared structure to give a
- * captured value a type. On the `artifact` channel the identifier is compared
- * too, so a capture from a file the operation writes but does not describe is
- * refused alongside one from a file it never writes.
+ * captured value a type. `response-headers` is the sharpest of the three,
+ * because `Observation.responseHeaders` admits objects, arrays, numbers, and
+ * `null`, so a header capture compiled as a `string` could resolve to an object
+ * at score time. On the `artifact` channel the identifier is compared too, so a
+ * capture from a file the operation writes but does not describe is refused
+ * alongside one from a file it never writes.
  */
 export function checkCapturedChannel(contract) {
     let index;
@@ -251,7 +254,7 @@ function boundParameterType(step, capture, index) {
     const operation = anyOperationOf(index, step.operationId);
     if (operation === undefined)
         return null;
-    const shape = requestShapeOf(operation, capture.transportChannel);
+    const shape = requestShapeOf(operation, capture.inputChannel);
     // A channel the operation does not accept input on declares no type for
     // the key either, so there is nothing to compare and the check abstains
     // for the same reason the undeclared-key branch below does.
@@ -269,7 +272,7 @@ function boundParameterType(step, capture, index) {
     const declared = shape.types[capture.key];
     if (declared === undefined || declared === null) {
         return {
-            reason: `binds ${capture.transportChannel} parameter "${capture.key}", whose type operation "${operation.operationId}" ${declared === undefined ? 'does not declare' : 'declares indeterminate'}, so no type equality is decidable`,
+            reason: `binds ${capture.inputChannel} parameter "${capture.key}", whose type operation "${operation.operationId}" ${declared === undefined ? 'does not declare' : 'declares indeterminate'}, so no type equality is decidable`,
         };
     }
     return { type: declared };
@@ -327,7 +330,7 @@ export function checkCapturedReachability(contract) {
                 throw new StructuralFailure('unreachable-check-evidence', path, `captured pointer "${capture.pointer}" resolves to a declared "${captured.type}", but the step ${bound.reason}`);
             }
             if (bound.type !== captured.type) {
-                throw new StructuralFailure('unreachable-check-evidence', path, `captured pointer "${capture.pointer}" resolves to a declared "${captured.type}", which is not the "${bound.type}" the bound ${capture.transportChannel} parameter "${capture.key}" is declared as`);
+                throw new StructuralFailure('unreachable-check-evidence', path, `captured pointer "${capture.pointer}" resolves to a declared "${captured.type}", which is not the "${bound.type}" the bound ${capture.inputChannel} parameter "${capture.key}" is declared as`);
             }
         }
     }

package/dist/core/compile/compile.js

@@ -55,7 +55,12 @@ export function compile(contract, options) {
     // First, and before any check reads a declaration. AD-11 makes an unequal
     // stamp a rejection rather than a degraded read, and every check below is
     // written against this version's field shapes.
-    checkSchemaVersion(contract.schemaVersion, EVAL_CONTRACT_SCHEMA_VERSION, 'EvalContract.schemaVersion');
+    checkSchemaVersion({
+        stamped: contract.schemaVersion,
+        accepted: EVAL_CONTRACT_SCHEMA_VERSION,
+        artifactPath: 'EvalContract.schemaVersion',
+        consequence: 'since its stale version would travel into the scoring version',
+    });
     checkRequirementLinkage(contract);
     checkObservableSuccessCriterion(contract);
     // Ahead of reachability, because a pointer naming an artifact nothing