omk-protocol 0.98.3 → 0.98.5

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## [Unreleased]
+
+## [0.98.5] - 2026-09-12
+
+### Added
+
+- Added immutable verified-run contracts and validated start, candidate-resume, writer-restart and task-retry commands, plus bounded static DAG types and ordering helpers. Protocol data does not execute or approve work by itself.
+
+## [0.98.4] - 2026-09-10
+
+### Added
+
+- Added bounded `explainBlockingCut()` metadata and opt-in `witnessIndependence: "explicit-groups"`. The compatibility default remains observation-ID grouping.
+
+### Fixed
+
+- Shared DAG branches can share a repair instead of choosing incompatible local minima. Composite-local obligations remain visible. A bounded-search greedy fallback explicitly does not claim minimum cardinality.
+
 ## [0.98.3] - 2026-09-06
 
 ### Added

package/README.md

@@ -12,6 +12,21 @@ TaskSpec -> ExecutionAttempt -> Observation -> EvaluationResult -> RuntimeDecisi
 - `TaskSpec`, `ExecutionAttempt`, `Observation`, `ClaimPredicate`
 - `ClaimEvaluation`, `EvaluationResult`, `RuntimeDecision`, `WaiverRecord`
 - Runtime parsers for every top-level record
+- Opt-in command/scripted-agent profiles: immutable `RunContract`, `RunScriptedWriter`,
+  `RunStartCommand`, `parseRunContract()` and `parseRunStartCommand()`
+  (`omk.verified-run.v1` and `omk.verified-command.v1`). The scripted profile bounds
+  approved steps and offline logical requests. Parsing never grants approval or executes work.
+- `RunResumeCommand`, `parseRunResumeCommand()` and `MAX_VERIFIED_RUN_GENERATIONS`:
+  candidate/contract/revision/generation-bound intent for host-governed recovery.
+  The runtime must still verify owner, clock, budget, process termination and evidence.
+- `RunWriterRestartCommand` / `parseRunWriterRestartCommand()` separately bind a local
+  writer restart to an immutable input checkpoint. They grant no remote replay authority.
+- Bounded `linux-command-dag-v1`: `RunDagWriter`, `RunDagTask`, `orderRunDag()`,
+  `runDagAncestors()`, `MAX_RUN_DAG_TASKS` and `MAX_RUN_TASK_ATTEMPTS`. Pure graph
+  ordering/closure does not schedule or authorize a process.
+- `RunTaskRetryCommand` / `parseRunTaskRetryCommand()` bind a failed/interrupted task
+  selection to the original input and exact revision/generation. Empty selections
+  request pending-only continuation, not permission to omit a failed dependency.
 - `evaluateTask()` and `reduceRuntimeDecision()`
 - Claim Closure Graph v1: `evaluateProofClosure()`, `validateClaimGraph()`,
   `minimalBlockingCut()` and the readonly claim/observation/waiver vocabulary
@@ -21,6 +36,35 @@ trust floors, witness groups, expiry, workspace completeness and unresolved-effe
 boundaries; those supplied facts remain caller trust boundaries. It does not attest a
 runner or automatically decide an ordinary chat turn.
 
+## Claim closure and blocking explanations
+
+`evaluateProofClosure()` evaluates qualified witnesses on an all/any claim DAG.
+Set `witnessIndependence: "explicit-groups"` for a strict profile: multi-witness
+claims (`requiredWitnesses > 1`) then require explicit, nonempty `independenceGroup`
+values. Merely changing an observation ID does not create another independent
+witness in that profile. Single-witness claims keep their existing behavior.
+
+The compatibility default remains `legacy-observation-id`; the result reports the
+resolved policy. Existing callers must opt into the strict profile deliberately.
+Group identities still need binding to real evidence origins by a trusted caller;
+the reducer cannot authenticate an arbitrary caller-supplied label.
+
+`explainBlockingCut()` returns a bounded antichain repair explanation. Shared DAG
+branches can share one repair. Composite-local counterexamples and scope obligations
+are retained alongside child obligations rather than being hidden by them.
+
+- `blockingCut.optimality: "minimum"` means minimum cardinality in this snapshot's
+  repair model, not semantic correctness after a real change.
+- At the candidate/operation limit, `algorithm: "greedy"`, `truncated: true`, and
+  `optimality: "not-proven"` identify a fallback with no minimality guarantee.
+- The legacy `minimalBlockingCut` array remains as a compatibility projection.
+  Consumers needing optimality must read the explanation metadata. Older results
+  without that metadata do not establish a minimum.
+
+Repair explanations never close claims, reconcile effects, issue waivers, or authorize
+merges. Re-evaluate evidence after a change. Set operations depend on candidate and
+set sizes; the shared-DAG optimization is not a linear-time minimum-cut algorithm.
+
 The package does not execute tools, persist records, schedule work, choose providers, or infer topology. Retry and failover counts are derived from attempt records rather than stored counters.
 
 See [OMK Run Protocol v1](https://github.com/dmae97/omk/blob/main/packages/coding-agent/docs/run-protocol.md) for evaluation rules, receipt bridging, migration status, and authority boundaries.

package/dist/claims/claim-blocking-cut.d.ts

@@ -1,17 +1,10 @@
-/**
- * Minimal blocking cut: the smallest set of leaf claims whose closure would
- * unblock every blocking root, so a user sees "fix these two" instead of a
- * dump of every intermediate claim on the path.
- *
- * The graph is an all/any DAG, so the cut is computed by one memoized pass:
- * an `all` node needs every blocking required child's cut, an `any` node
- * needs only the cheapest child's cut (ties broken by claim id, so the
- * explanation is stable across runs), and a node that is blocked without any
- * blocking required child — a composite with its own counterexample — is its
- * own cut. Advisory children never enter a cut: they cannot block a parent.
- * Bounded by O(V + E); no general minimum-hitting-set search.
- */
-import type { ClaimClosureEvaluation, ClaimNode, ClaimVerdict } from "./claim-types.ts";
+import { type BlockingCutExplanation, type ClaimClosureEvaluation, type ClaimNode, type ClaimVerdict } from "./claim-types.ts";
+export declare const MAX_BLOCKING_CUT_CANDIDATES = 128;
+type Cut = readonly string[];
 export declare function isBlockingVerdict(verdict: ClaimVerdict): boolean;
-export declare function minimalBlockingCut(claims: ReadonlyMap<string, ClaimNode>, evaluations: ReadonlyMap<string, ClaimClosureEvaluation>, rootIds: readonly string[]): readonly string[];
+/** Prefer this API over the legacy array-only projection when optimality matters. */
+export declare function explainBlockingCut(claims: ReadonlyMap<string, ClaimNode>, evaluations: ReadonlyMap<string, ClaimClosureEvaluation>, rootIds: readonly string[]): BlockingCutExplanation;
+/** Compatibility name: on a bounded-search fallback this array is not guaranteed minimal. */
+export declare function minimalBlockingCut(claims: ReadonlyMap<string, ClaimNode>, evaluations: ReadonlyMap<string, ClaimClosureEvaluation>, rootIds: readonly string[]): Cut;
+export {};
 //# sourceMappingURL=claim-blocking-cut.d.ts.map

package/dist/claims/claim-blocking-cut.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claim-blocking-cut.d.ts","sourceRoot":"","sources":["../../src/claims/claim-blocking-cut.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAUxF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAEhE;AAoBD,wBAAgB,kBAAkB,CACjC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,EACtC,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,sBAAsB,CAAC,EACxD,OAAO,EAAE,SAAS,MAAM,EAAE,GACxB,SAAS,MAAM,EAAE,CAqBnB","sourcesContent":["/**\n * Minimal blocking cut: the smallest set of leaf claims whose closure would\n * unblock every blocking root, so a user sees \"fix these two\" instead of a\n * dump of every intermediate claim on the path.\n *\n * The graph is an all/any DAG, so the cut is computed by one memoized pass:\n * an `all` node needs every blocking required child's cut, an `any` node\n * needs only the cheapest child's cut (ties broken by claim id, so the\n * explanation is stable across runs), and a node that is blocked without any\n * blocking required child — a composite with its own counterexample — is its\n * own cut. Advisory children never enter a cut: they cannot block a parent.\n * Bounded by O(V + E); no general minimum-hitting-set search.\n */\n\nimport type { ClaimClosureEvaluation, ClaimNode, ClaimVerdict } from \"./claim-types.ts\";\n\nconst BLOCKING_VERDICTS: readonly ClaimVerdict[] = [\n\t\"violated\",\n\t\"stale\",\n\t\"incomplete_scope\",\n\t\"insufficient_trust\",\n\t\"missing\",\n];\n\nexport function isBlockingVerdict(verdict: ClaimVerdict): boolean {\n\treturn BLOCKING_VERDICTS.includes(verdict);\n}\n\nfunction compareCodeUnits(left: string, right: string): number {\n\tif (left === right) return 0;\n\treturn left < right ? -1 : 1;\n}\n\nfunction compareCuts(left: readonly string[], right: readonly string[]): number {\n\tif (left.length !== right.length) return left.length - right.length;\n\tfor (let index = 0; index < left.length; index++) {\n\t\tconst order = compareCodeUnits(left[index], right[index]);\n\t\tif (order !== 0) return order;\n\t}\n\treturn 0;\n}\n\nfunction unionSorted(sets: readonly (readonly string[])[]): string[] {\n\treturn [...new Set(sets.flat())].sort(compareCodeUnits);\n}\n\nexport function minimalBlockingCut(\n\tclaims: ReadonlyMap<string, ClaimNode>,\n\tevaluations: ReadonlyMap<string, ClaimClosureEvaluation>,\n\trootIds: readonly string[],\n): readonly string[] {\n\tconst memo = new Map<string, readonly string[]>();\n\tconst cutFor = (claimId: string): readonly string[] => {\n\t\tconst cached = memo.get(claimId);\n\t\tif (cached !== undefined) return cached;\n\t\tconst evaluation = evaluations.get(claimId);\n\t\tconst claim = claims.get(claimId);\n\t\tlet cut: readonly string[] = [];\n\t\tif (claim !== undefined && evaluation !== undefined && isBlockingVerdict(evaluation.verdict)) {\n\t\t\tconst childCuts = claim.satisfaction.inputs\n\t\t\t\t.filter((input) => claims.get(input)?.severity === \"required\")\n\t\t\t\t.map(cutFor)\n\t\t\t\t.filter((childCut) => childCut.length > 0);\n\t\t\tif (childCuts.length === 0) cut = [claimId];\n\t\t\telse if (claim.satisfaction.rule === \"all\") cut = unionSorted(childCuts);\n\t\t\telse cut = [...childCuts].sort(compareCuts)[0];\n\t\t}\n\t\tmemo.set(claimId, cut);\n\t\treturn cut;\n\t};\n\treturn unionSorted(rootIds.map(cutFor));\n}\n"]}
+{"version":3,"file":"claim-blocking-cut.d.ts","sourceRoot":"","sources":["../../src/claims/claim-blocking-cut.ts"],"names":[],"mappings":"AAQA,OAAO,EACN,KAAK,sBAAsB,EAE3B,KAAK,sBAAsB,EAC3B,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,MAAM,kBAAkB,CAAC;AAS1B,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAG/C,KAAK,GAAG,GAAG,SAAS,MAAM,EAAE,CAAC;AAc7B,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAEhE;AAyID,qFAAqF;AACrF,wBAAgB,kBAAkB,CACjC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,EACtC,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,sBAAsB,CAAC,EACxD,OAAO,EAAE,SAAS,MAAM,EAAE,GACxB,sBAAsB,CA2BxB;AAED,6FAA6F;AAC7F,wBAAgB,kBAAkB,CACjC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,EACtC,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,sBAAsB,CAAC,EACxD,OAAO,EAAE,SAAS,MAAM,EAAE,GACxB,GAAG,CAEL","sourcesContent":["/**\n * Bounded blocking explanations for a validated all/any claim DAG.\n * Shared subgraphs require alternative repair sets, not a local cheapest branch.\n * Exact antichains can grow exponentially; bounds fall back to a deterministic,\n * not-proven explanation. Set-operation cost also depends on output-set size.\n * A repair is an explanatory obligation, never permission to satisfy a claim.\n */\nimport { ClaimGraphError, topologicalClaimOrder } from \"./claim-graph.ts\";\nimport {\n\ttype BlockingCutExplanation,\n\tCLAIM_GRAPH_SCHEMA_VERSION,\n\ttype ClaimClosureEvaluation,\n\ttype ClaimNode,\n\ttype ClaimVerdict,\n} from \"./claim-types.ts\";\n\nconst BLOCKING_VERDICTS: readonly ClaimVerdict[] = [\n\t\"violated\",\n\t\"stale\",\n\t\"incomplete_scope\",\n\t\"insufficient_trust\",\n\t\"missing\",\n];\nexport const MAX_BLOCKING_CUT_CANDIDATES = 128;\nconst MAX_CUT_OPERATIONS = 65536;\nclass CutSearchLimit extends Error {}\ntype Cut = readonly string[];\ntype Family = readonly Cut[];\ninterface CutNode {\n\treadonly id: string;\n\treadonly rule: \"all\" | \"any\";\n\treadonly inputs: readonly string[];\n\treadonly closed: boolean;\n\treadonly local: boolean;\n}\n/** Search-owned mutable accounting, including work before a limit is reached. */\ninterface CutSearchBudget {\n\toperations: number;\n}\n\nexport function isBlockingVerdict(verdict: ClaimVerdict): boolean {\n\treturn BLOCKING_VERDICTS.includes(verdict);\n}\nfunction compareIds(left: string, right: string): number {\n\tif (left === right) return 0;\n\treturn left < right ? -1 : 1;\n}\nfunction compareCuts(left: Cut, right: Cut): number {\n\tif (left.length !== right.length) return left.length - right.length;\n\tfor (let i = 0; i < left.length; i++) {\n\t\tconst order = compareIds(left[i], right[i]);\n\t\tif (order) return order;\n\t}\n\treturn 0;\n}\nfunction union(sets: readonly Cut[]): Cut {\n\treturn [...new Set(sets.flat())].sort(compareIds);\n}\nfunction* unions(left: Family, right: Family): Generator<Cut> {\n\tfor (const a of left) for (const b of right) yield union([a, b]);\n}\nfunction* alternatives(families: readonly Family[]): Generator<Cut> {\n\tfor (const family of families) yield* family;\n}\n\nfunction cutNodes(\n\tclaims: ReadonlyMap<string, ClaimNode>,\n\tevaluations: ReadonlyMap<string, ClaimClosureEvaluation>,\n): CutNode[] {\n\tconst ordered = topologicalClaimOrder(\n\t\t{ schemaVersion: CLAIM_GRAPH_SCHEMA_VERSION, claims: [...claims.values()] },\n\t\tclaims,\n\t);\n\treturn ordered.map((claim) => {\n\t\tconst evaluation = evaluations.get(claim.claimId);\n\t\tif (\n\t\t\t!evaluation ||\n\t\t\t(!isBlockingVerdict(evaluation.verdict) &&\n\t\t\t\tevaluation.verdict !== \"satisfied\" &&\n\t\t\t\tevaluation.verdict !== \"waived\")\n\t\t) {\n\t\t\tthrow new ClaimGraphError(\"invalid_input\", \"Blocking explanation requires a valid evaluation for every claim\");\n\t\t}\n\t\tconst inputs = claim.satisfaction.inputs.filter((id) => claims.get(id)?.severity === \"required\").sort(compareIds);\n\t\tconst inferredLocal =\n\t\t\t(evaluation.verdict === \"violated\" && evaluation.observationIds.length > 0) ||\n\t\t\t(evaluation.verdict === \"incomplete_scope\" && claim.scopeSensitive === true);\n\t\treturn {\n\t\t\tid: claim.claimId,\n\t\t\trule: claim.satisfaction.rule,\n\t\t\tinputs,\n\t\t\tclosed: !isBlockingVerdict(evaluation.verdict),\n\t\t\tlocal:\n\t\t\t\tinputs.length === 0 ||\n\t\t\t\tevaluation.blockingOrigin === \"local\" ||\n\t\t\t\t(evaluation.blockingOrigin === undefined && inferredLocal),\n\t\t};\n\t});\n}\nfunction reachableNodes(ordered: CutNode[], roots: readonly string[]): CutNode[] {\n\tconst byId = new Map(ordered.map((node) => [node.id, node]));\n\tconst reachable = new Set<string>();\n\tconst pending = [...roots];\n\twhile (pending.length) {\n\t\tconst id = pending.pop();\n\t\tif (id === undefined || reachable.has(id)) continue;\n\t\treachable.add(id);\n\t\tconst node = byId.get(id);\n\t\tif (node && !node.closed) pending.push(...node.inputs);\n\t}\n\treturn ordered.filter((node) => reachable.has(node.id));\n}\nfunction step(budget: CutSearchBudget): void {\n\tif (budget.operations >= MAX_CUT_OPERATIONS) throw new CutSearchLimit();\n\tbudget.operations++;\n}\nfunction prune(candidates: Iterable<Cut>, budget: CutSearchBudget): Family {\n\tlet kept: Cut[] = [];\n\tfor (const candidate of candidates) {\n\t\tstep(budget);\n\t\tconst set = new Set(candidate);\n\t\tif (\n\t\t\tkept.some((other) => {\n\t\t\t\tstep(budget);\n\t\t\t\treturn other.every((id) => set.has(id));\n\t\t\t})\n\t\t)\n\t\t\tcontinue;\n\t\tkept = kept.filter((other) => {\n\t\t\tstep(budget);\n\t\t\tconst existing = new Set(other);\n\t\t\treturn !candidate.every((id) => existing.has(id));\n\t\t});\n\t\tkept.push(candidate);\n\t\tif (kept.length > MAX_BLOCKING_CUT_CANDIDATES) throw new CutSearchLimit();\n\t}\n\treturn kept.sort(compareCuts);\n}\nfunction combineAll(families: readonly Family[], budget: CutSearchBudget): Family {\n\tlet result: Family = [[]];\n\tfor (const family of families) result = prune(unions(result, family), budget);\n\treturn result;\n}\nfunction exactCut(nodes: readonly CutNode[], roots: readonly string[], budget: CutSearchBudget): Cut {\n\tconst families = new Map<string, Family>();\n\tfor (const node of nodes) {\n\t\tif (node.closed) {\n\t\t\tfamilies.set(node.id, [[]]);\n\t\t\tcontinue;\n\t\t}\n\t\tconst children = node.inputs.map((id) => families.get(id) ?? []);\n\t\tlet family: Family = [[]];\n\t\tif (children.length) {\n\t\t\tfamily = node.rule === \"all\" ? combineAll(children, budget) : prune(alternatives(children), budget);\n\t\t}\n\t\tif (node.local) family = prune(unions(family, [[node.id]]), budget);\n\t\tfamilies.set(node.id, family);\n\t}\n\treturn (\n\t\tcombineAll(\n\t\t\troots.map((id) => families.get(id) ?? []),\n\t\t\tbudget,\n\t\t)[0] ?? []\n\t);\n}\nfunction greedyCut(nodes: readonly CutNode[], roots: readonly string[]): Cut {\n\tconst cuts = new Map<string, Cut>();\n\tfor (const node of nodes) {\n\t\tif (node.closed) {\n\t\t\tcuts.set(node.id, []);\n\t\t\tcontinue;\n\t\t}\n\t\tconst children = node.inputs.map((id) => cuts.get(id) ?? []);\n\t\tconst childCut = node.rule === \"all\" ? union(children) : ([...children].sort(compareCuts)[0] ?? []);\n\t\tcuts.set(node.id, node.local ? union([childCut, [node.id]]) : childCut);\n\t}\n\treturn union(roots.map((id) => cuts.get(id) ?? []));\n}\n\n/** Prefer this API over the legacy array-only projection when optimality matters. */\nexport function explainBlockingCut(\n\tclaims: ReadonlyMap<string, ClaimNode>,\n\tevaluations: ReadonlyMap<string, ClaimClosureEvaluation>,\n\trootIds: readonly string[],\n): BlockingCutExplanation {\n\tconst roots = [...new Set(rootIds)].sort(compareIds);\n\tfor (const id of roots) if (!claims.has(id)) throw new ClaimGraphError(\"unknown_input\", \"Unknown blocking root\");\n\tconst nodes = reachableNodes(cutNodes(claims, evaluations), roots);\n\tconst budget: CutSearchBudget = { operations: 0 };\n\tlet claimIds: Cut;\n\tlet truncated = false;\n\ttry {\n\t\tclaimIds = exactCut(nodes, roots, budget);\n\t} catch (error) {\n\t\tif (!(error instanceof CutSearchLimit)) throw error;\n\t\ttruncated = true;\n\t\tclaimIds = greedyCut(nodes, roots);\n\t}\n\tconst selected = new Set(claimIds);\n\treturn Object.freeze({\n\t\tclaimIds: Object.freeze([...claimIds]),\n\t\talgorithm: truncated ? \"greedy\" : \"exact-antichain\",\n\t\toptimality: truncated ? \"not-proven\" : \"minimum\",\n\t\ttruncated,\n\t\texploredStates: budget.operations,\n\t\tlocalClaimIds: Object.freeze(\n\t\t\tnodes\n\t\t\t\t.flatMap((node) => (node.local && node.inputs.length > 0 && selected.has(node.id) ? [node.id] : []))\n\t\t\t\t.sort(compareIds),\n\t\t),\n\t});\n}\n\n/** Compatibility name: on a bounded-search fallback this array is not guaranteed minimal. */\nexport function minimalBlockingCut(\n\tclaims: ReadonlyMap<string, ClaimNode>,\n\tevaluations: ReadonlyMap<string, ClaimClosureEvaluation>,\n\trootIds: readonly string[],\n): Cut {\n\treturn explainBlockingCut(claims, evaluations, rootIds).claimIds;\n}\n"]}

package/dist/claims/claim-blocking-cut.js

@@ -1,16 +1,12 @@
 /**
- * Minimal blocking cut: the smallest set of leaf claims whose closure would
- * unblock every blocking root, so a user sees "fix these two" instead of a
- * dump of every intermediate claim on the path.
- *
- * The graph is an all/any DAG, so the cut is computed by one memoized pass:
- * an `all` node needs every blocking required child's cut, an `any` node
- * needs only the cheapest child's cut (ties broken by claim id, so the
- * explanation is stable across runs), and a node that is blocked without any
- * blocking required child — a composite with its own counterexample — is its
- * own cut. Advisory children never enter a cut: they cannot block a parent.
- * Bounded by O(V + E); no general minimum-hitting-set search.
+ * Bounded blocking explanations for a validated all/any claim DAG.
+ * Shared subgraphs require alternative repair sets, not a local cheapest branch.
+ * Exact antichains can grow exponentially; bounds fall back to a deterministic,
+ * not-proven explanation. Set-operation cost also depends on output-set size.
+ * A repair is an explanatory obligation, never permission to satisfy a claim.
  */
+import { ClaimGraphError, topologicalClaimOrder } from "./claim-graph.js";
+import { CLAIM_GRAPH_SCHEMA_VERSION, } from "./claim-types.js";
 const BLOCKING_VERDICTS = [
     "violated",
     "stale",
@@ -18,10 +14,14 @@ const BLOCKING_VERDICTS = [
     "insufficient_trust",
     "missing",
 ];
+export const MAX_BLOCKING_CUT_CANDIDATES = 128;
+const MAX_CUT_OPERATIONS = 65536;
+class CutSearchLimit extends Error {
+}
 export function isBlockingVerdict(verdict) {
     return BLOCKING_VERDICTS.includes(verdict);
 }
-function compareCodeUnits(left, right) {
+function compareIds(left, right) {
     if (left === right)
         return 0;
     return left < right ? -1 : 1;
@@ -29,40 +29,160 @@ function compareCodeUnits(left, right) {
 function compareCuts(left, right) {
     if (left.length !== right.length)
         return left.length - right.length;
-    for (let index = 0; index < left.length; index++) {
-        const order = compareCodeUnits(left[index], right[index]);
-        if (order !== 0)
+    for (let i = 0; i < left.length; i++) {
+        const order = compareIds(left[i], right[i]);
+        if (order)
             return order;
     }
     return 0;
 }
-function unionSorted(sets) {
-    return [...new Set(sets.flat())].sort(compareCodeUnits);
+function union(sets) {
+    return [...new Set(sets.flat())].sort(compareIds);
 }
-export function minimalBlockingCut(claims, evaluations, rootIds) {
-    const memo = new Map();
-    const cutFor = (claimId) => {
-        const cached = memo.get(claimId);
-        if (cached !== undefined)
-            return cached;
-        const evaluation = evaluations.get(claimId);
-        const claim = claims.get(claimId);
-        let cut = [];
-        if (claim !== undefined && evaluation !== undefined && isBlockingVerdict(evaluation.verdict)) {
-            const childCuts = claim.satisfaction.inputs
-                .filter((input) => claims.get(input)?.severity === "required")
-                .map(cutFor)
-                .filter((childCut) => childCut.length > 0);
-            if (childCuts.length === 0)
-                cut = [claimId];
-            else if (claim.satisfaction.rule === "all")
-                cut = unionSorted(childCuts);
-            else
-                cut = [...childCuts].sort(compareCuts)[0];
+function* unions(left, right) {
+    for (const a of left)
+        for (const b of right)
+            yield union([a, b]);
+}
+function* alternatives(families) {
+    for (const family of families)
+        yield* family;
+}
+function cutNodes(claims, evaluations) {
+    const ordered = topologicalClaimOrder({ schemaVersion: CLAIM_GRAPH_SCHEMA_VERSION, claims: [...claims.values()] }, claims);
+    return ordered.map((claim) => {
+        const evaluation = evaluations.get(claim.claimId);
+        if (!evaluation ||
+            (!isBlockingVerdict(evaluation.verdict) &&
+                evaluation.verdict !== "satisfied" &&
+                evaluation.verdict !== "waived")) {
+            throw new ClaimGraphError("invalid_input", "Blocking explanation requires a valid evaluation for every claim");
+        }
+        const inputs = claim.satisfaction.inputs.filter((id) => claims.get(id)?.severity === "required").sort(compareIds);
+        const inferredLocal = (evaluation.verdict === "violated" && evaluation.observationIds.length > 0) ||
+            (evaluation.verdict === "incomplete_scope" && claim.scopeSensitive === true);
+        return {
+            id: claim.claimId,
+            rule: claim.satisfaction.rule,
+            inputs,
+            closed: !isBlockingVerdict(evaluation.verdict),
+            local: inputs.length === 0 ||
+                evaluation.blockingOrigin === "local" ||
+                (evaluation.blockingOrigin === undefined && inferredLocal),
+        };
+    });
+}
+function reachableNodes(ordered, roots) {
+    const byId = new Map(ordered.map((node) => [node.id, node]));
+    const reachable = new Set();
+    const pending = [...roots];
+    while (pending.length) {
+        const id = pending.pop();
+        if (id === undefined || reachable.has(id))
+            continue;
+        reachable.add(id);
+        const node = byId.get(id);
+        if (node && !node.closed)
+            pending.push(...node.inputs);
+    }
+    return ordered.filter((node) => reachable.has(node.id));
+}
+function step(budget) {
+    if (budget.operations >= MAX_CUT_OPERATIONS)
+        throw new CutSearchLimit();
+    budget.operations++;
+}
+function prune(candidates, budget) {
+    let kept = [];
+    for (const candidate of candidates) {
+        step(budget);
+        const set = new Set(candidate);
+        if (kept.some((other) => {
+            step(budget);
+            return other.every((id) => set.has(id));
+        }))
+            continue;
+        kept = kept.filter((other) => {
+            step(budget);
+            const existing = new Set(other);
+            return !candidate.every((id) => existing.has(id));
+        });
+        kept.push(candidate);
+        if (kept.length > MAX_BLOCKING_CUT_CANDIDATES)
+            throw new CutSearchLimit();
+    }
+    return kept.sort(compareCuts);
+}
+function combineAll(families, budget) {
+    let result = [[]];
+    for (const family of families)
+        result = prune(unions(result, family), budget);
+    return result;
+}
+function exactCut(nodes, roots, budget) {
+    const families = new Map();
+    for (const node of nodes) {
+        if (node.closed) {
+            families.set(node.id, [[]]);
+            continue;
+        }
+        const children = node.inputs.map((id) => families.get(id) ?? []);
+        let family = [[]];
+        if (children.length) {
+            family = node.rule === "all" ? combineAll(children, budget) : prune(alternatives(children), budget);
+        }
+        if (node.local)
+            family = prune(unions(family, [[node.id]]), budget);
+        families.set(node.id, family);
+    }
+    return (combineAll(roots.map((id) => families.get(id) ?? []), budget)[0] ?? []);
+}
+function greedyCut(nodes, roots) {
+    const cuts = new Map();
+    for (const node of nodes) {
+        if (node.closed) {
+            cuts.set(node.id, []);
+            continue;
         }
-        memo.set(claimId, cut);
-        return cut;
-    };
-    return unionSorted(rootIds.map(cutFor));
+        const children = node.inputs.map((id) => cuts.get(id) ?? []);
+        const childCut = node.rule === "all" ? union(children) : ([...children].sort(compareCuts)[0] ?? []);
+        cuts.set(node.id, node.local ? union([childCut, [node.id]]) : childCut);
+    }
+    return union(roots.map((id) => cuts.get(id) ?? []));
+}
+/** Prefer this API over the legacy array-only projection when optimality matters. */
+export function explainBlockingCut(claims, evaluations, rootIds) {
+    const roots = [...new Set(rootIds)].sort(compareIds);
+    for (const id of roots)
+        if (!claims.has(id))
+            throw new ClaimGraphError("unknown_input", "Unknown blocking root");
+    const nodes = reachableNodes(cutNodes(claims, evaluations), roots);
+    const budget = { operations: 0 };
+    let claimIds;
+    let truncated = false;
+    try {
+        claimIds = exactCut(nodes, roots, budget);
+    }
+    catch (error) {
+        if (!(error instanceof CutSearchLimit))
+            throw error;
+        truncated = true;
+        claimIds = greedyCut(nodes, roots);
+    }
+    const selected = new Set(claimIds);
+    return Object.freeze({
+        claimIds: Object.freeze([...claimIds]),
+        algorithm: truncated ? "greedy" : "exact-antichain",
+        optimality: truncated ? "not-proven" : "minimum",
+        truncated,
+        exploredStates: budget.operations,
+        localClaimIds: Object.freeze(nodes
+            .flatMap((node) => (node.local && node.inputs.length > 0 && selected.has(node.id) ? [node.id] : []))
+            .sort(compareIds)),
+    });
+}
+/** Compatibility name: on a bounded-search fallback this array is not guaranteed minimal. */
+export function minimalBlockingCut(claims, evaluations, rootIds) {
+    return explainBlockingCut(claims, evaluations, rootIds).claimIds;
 }
 //# sourceMappingURL=claim-blocking-cut.js.map

package/dist/claims/claim-blocking-cut.js.map

@@ -1 +1 @@
-{"version":3,"file":"claim-blocking-cut.js","sourceRoot":"","sources":["../../src/claims/claim-blocking-cut.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,MAAM,iBAAiB,GAA4B;IAClD,UAAU;IACV,OAAO;IACP,kBAAkB;IAClB,oBAAoB;IACpB,SAAS;CACT,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,OAAqB,EAAW;IACjE,OAAO,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAAA,CAC3C;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,KAAa,EAAU;IAC9D,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,CAAC,CAAC;IAC7B,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAAA,CAC7B;AAED,SAAS,WAAW,CAAC,IAAuB,EAAE,KAAwB,EAAU;IAC/E,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IACpE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,IAAI,KAAK,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IAC/B,CAAC;IACD,OAAO,CAAC,CAAC;AAAA,CACT;AAED,SAAS,WAAW,CAAC,IAAoC,EAAY;IACpE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;AAAA,CACxD;AAED,MAAM,UAAU,kBAAkB,CACjC,MAAsC,EACtC,WAAwD,EACxD,OAA0B,EACN;IACpB,MAAM,IAAI,GAAG,IAAI,GAAG,EAA6B,CAAC;IAClD,MAAM,MAAM,GAAG,CAAC,OAAe,EAAqB,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QACxC,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,GAAG,GAAsB,EAAE,CAAC;QAChC,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,IAAI,iBAAiB,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9F,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM;iBACzC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,QAAQ,KAAK,UAAU,CAAC;iBAC7D,GAAG,CAAC,MAAM,CAAC;iBACX,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC5C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;iBACvC,IAAI,KAAK,CAAC,YAAY,CAAC,IAAI,KAAK,KAAK;gBAAE,GAAG,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;;gBACpE,GAAG,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACvB,OAAO,GAAG,CAAC;IAAA,CACX,CAAC;IACF,OAAO,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAAA,CACxC","sourcesContent":["/**\n * Minimal blocking cut: the smallest set of leaf claims whose closure would\n * unblock every blocking root, so a user sees \"fix these two\" instead of a\n * dump of every intermediate claim on the path.\n *\n * The graph is an all/any DAG, so the cut is computed by one memoized pass:\n * an `all` node needs every blocking required child's cut, an `any` node\n * needs only the cheapest child's cut (ties broken by claim id, so the\n * explanation is stable across runs), and a node that is blocked without any\n * blocking required child — a composite with its own counterexample — is its\n * own cut. Advisory children never enter a cut: they cannot block a parent.\n * Bounded by O(V + E); no general minimum-hitting-set search.\n */\n\nimport type { ClaimClosureEvaluation, ClaimNode, ClaimVerdict } from \"./claim-types.ts\";\n\nconst BLOCKING_VERDICTS: readonly ClaimVerdict[] = [\n\t\"violated\",\n\t\"stale\",\n\t\"incomplete_scope\",\n\t\"insufficient_trust\",\n\t\"missing\",\n];\n\nexport function isBlockingVerdict(verdict: ClaimVerdict): boolean {\n\treturn BLOCKING_VERDICTS.includes(verdict);\n}\n\nfunction compareCodeUnits(left: string, right: string): number {\n\tif (left === right) return 0;\n\treturn left < right ? -1 : 1;\n}\n\nfunction compareCuts(left: readonly string[], right: readonly string[]): number {\n\tif (left.length !== right.length) return left.length - right.length;\n\tfor (let index = 0; index < left.length; index++) {\n\t\tconst order = compareCodeUnits(left[index], right[index]);\n\t\tif (order !== 0) return order;\n\t}\n\treturn 0;\n}\n\nfunction unionSorted(sets: readonly (readonly string[])[]): string[] {\n\treturn [...new Set(sets.flat())].sort(compareCodeUnits);\n}\n\nexport function minimalBlockingCut(\n\tclaims: ReadonlyMap<string, ClaimNode>,\n\tevaluations: ReadonlyMap<string, ClaimClosureEvaluation>,\n\trootIds: readonly string[],\n): readonly string[] {\n\tconst memo = new Map<string, readonly string[]>();\n\tconst cutFor = (claimId: string): readonly string[] => {\n\t\tconst cached = memo.get(claimId);\n\t\tif (cached !== undefined) return cached;\n\t\tconst evaluation = evaluations.get(claimId);\n\t\tconst claim = claims.get(claimId);\n\t\tlet cut: readonly string[] = [];\n\t\tif (claim !== undefined && evaluation !== undefined && isBlockingVerdict(evaluation.verdict)) {\n\t\t\tconst childCuts = claim.satisfaction.inputs\n\t\t\t\t.filter((input) => claims.get(input)?.severity === \"required\")\n\t\t\t\t.map(cutFor)\n\t\t\t\t.filter((childCut) => childCut.length > 0);\n\t\t\tif (childCuts.length === 0) cut = [claimId];\n\t\t\telse if (claim.satisfaction.rule === \"all\") cut = unionSorted(childCuts);\n\t\t\telse cut = [...childCuts].sort(compareCuts)[0];\n\t\t}\n\t\tmemo.set(claimId, cut);\n\t\treturn cut;\n\t};\n\treturn unionSorted(rootIds.map(cutFor));\n}\n"]}
+{"version":3,"file":"claim-blocking-cut.js","sourceRoot":"","sources":["../../src/claims/claim-blocking-cut.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAEN,0BAA0B,GAI1B,MAAM,kBAAkB,CAAC;AAE1B,MAAM,iBAAiB,GAA4B;IAClD,UAAU;IACV,OAAO;IACP,kBAAkB;IAClB,oBAAoB;IACpB,SAAS;CACT,CAAC;AACF,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAC/C,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,cAAe,SAAQ,KAAK;CAAG;AAerC,MAAM,UAAU,iBAAiB,CAAC,OAAqB,EAAW;IACjE,OAAO,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAAA,CAC3C;AACD,SAAS,UAAU,CAAC,IAAY,EAAE,KAAa,EAAU;IACxD,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,CAAC,CAAC;IAC7B,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAAA,CAC7B;AACD,SAAS,WAAW,CAAC,IAAS,EAAE,KAAU,EAAU;IACnD,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IACpE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,CAAC;AAAA,CACT;AACD,SAAS,KAAK,CAAC,IAAoB,EAAO;IACzC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAAA,CAClD;AACD,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAY,EAAE,KAAa,EAAkB;IAC7D,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAAA,CACjE;AACD,QAAQ,CAAC,CAAC,YAAY,CAAC,QAA2B,EAAkB;IACnE,KAAK,MAAM,MAAM,IAAI,QAAQ;QAAE,KAAK,CAAC,CAAC,MAAM,CAAC;AAAA,CAC7C;AAED,SAAS,QAAQ,CAChB,MAAsC,EACtC,WAAwD,EAC5C;IACZ,MAAM,OAAO,GAAG,qBAAqB,CACpC,EAAE,aAAa,EAAE,0BAA0B,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAC3E,MAAM,CACN,CAAC;IACF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClD,IACC,CAAC,UAAU;YACX,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,OAAO,CAAC;gBACtC,UAAU,CAAC,OAAO,KAAK,WAAW;gBAClC,UAAU,CAAC,OAAO,KAAK,QAAQ,CAAC,EAChC,CAAC;YACF,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,kEAAkE,CAAC,CAAC;QAChH,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,QAAQ,KAAK,UAAU,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClH,MAAM,aAAa,GAClB,CAAC,UAAU,CAAC,OAAO,KAAK,UAAU,IAAI,UAAU,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;YAC3E,CAAC,UAAU,CAAC,OAAO,KAAK,kBAAkB,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC;QAC9E,OAAO;YACN,EAAE,EAAE,KAAK,CAAC,OAAO;YACjB,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,IAAI;YAC7B,MAAM;YACN,MAAM,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,OAAO,CAAC;YAC9C,KAAK,EACJ,MAAM,CAAC,MAAM,KAAK,CAAC;gBACnB,UAAU,CAAC,cAAc,KAAK,OAAO;gBACrC,CAAC,UAAU,CAAC,cAAc,KAAK,SAAS,IAAI,aAAa,CAAC;SAC3D,CAAC;IAAA,CACF,CAAC,CAAC;AAAA,CACH;AACD,SAAS,cAAc,CAAC,OAAkB,EAAE,KAAwB,EAAa;IAChF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IAC3B,OAAO,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,EAAE,KAAK,SAAS,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QACpD,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAAA,CACxD;AACD,SAAS,IAAI,CAAC,MAAuB,EAAQ;IAC5C,IAAI,MAAM,CAAC,UAAU,IAAI,kBAAkB;QAAE,MAAM,IAAI,cAAc,EAAE,CAAC;IACxE,MAAM,CAAC,UAAU,EAAE,CAAC;AAAA,CACpB;AACD,SAAS,KAAK,CAAC,UAAyB,EAAE,MAAuB,EAAU;IAC1E,IAAI,IAAI,GAAU,EAAE,CAAC;IACrB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,CAAC;QACb,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,IACC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,CAAC;YACb,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAAA,CACxC,CAAC;YAEF,SAAS;QACV,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,CAAC;YACb,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;YAChC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAAA,CAClD,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrB,IAAI,IAAI,CAAC,MAAM,GAAG,2BAA2B;YAAE,MAAM,IAAI,cAAc,EAAE,CAAC;IAC3E,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AAAA,CAC9B;AACD,SAAS,UAAU,CAAC,QAA2B,EAAE,MAAuB,EAAU;IACjF,IAAI,MAAM,GAAW,CAAC,EAAE,CAAC,CAAC;IAC1B,KAAK,MAAM,MAAM,IAAI,QAAQ;QAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9E,OAAO,MAAM,CAAC;AAAA,CACd;AACD,SAAS,QAAQ,CAAC,KAAyB,EAAE,KAAwB,EAAE,MAAuB,EAAO;IACpG,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5B,SAAS;QACV,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,IAAI,MAAM,GAAW,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACrB,MAAM,GAAG,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,IAAI,CAAC,KAAK;YAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACpE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,CACN,UAAU,CACT,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EACzC,MAAM,CACN,CAAC,CAAC,CAAC,IAAI,EAAE,CACV,CAAC;AAAA,CACF;AACD,SAAS,SAAS,CAAC,KAAyB,EAAE,KAAwB,EAAO;IAC5E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAe,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACtB,SAAS;QACV,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAAA,CACpD;AAED,qFAAqF;AACrF,MAAM,UAAU,kBAAkB,CACjC,MAAsC,EACtC,WAAwD,EACxD,OAA0B,EACD;IACzB,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrD,KAAK,MAAM,EAAE,IAAI,KAAK;QAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;IACjH,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC;IACnE,MAAM,MAAM,GAAoB,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;IAClD,IAAI,QAAa,CAAC;IAClB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QACJ,QAAQ,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC,CAAC,KAAK,YAAY,cAAc,CAAC;YAAE,MAAM,KAAK,CAAC;QACpD,SAAS,GAAG,IAAI,CAAC;QACjB,QAAQ,GAAG,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC;QACtC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB;QACnD,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QAChD,SAAS;QACT,cAAc,EAAE,MAAM,CAAC,UAAU;QACjC,aAAa,EAAE,MAAM,CAAC,MAAM,CAC3B,KAAK;aACH,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aACnG,IAAI,CAAC,UAAU,CAAC,CAClB;KACD,CAAC,CAAC;AAAA,CACH;AAED,6FAA6F;AAC7F,MAAM,UAAU,kBAAkB,CACjC,MAAsC,EACtC,WAAwD,EACxD,OAA0B,EACpB;IACN,OAAO,kBAAkB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC;AAAA,CACjE","sourcesContent":["/**\n * Bounded blocking explanations for a validated all/any claim DAG.\n * Shared subgraphs require alternative repair sets, not a local cheapest branch.\n * Exact antichains can grow exponentially; bounds fall back to a deterministic,\n * not-proven explanation. Set-operation cost also depends on output-set size.\n * A repair is an explanatory obligation, never permission to satisfy a claim.\n */\nimport { ClaimGraphError, topologicalClaimOrder } from \"./claim-graph.ts\";\nimport {\n\ttype BlockingCutExplanation,\n\tCLAIM_GRAPH_SCHEMA_VERSION,\n\ttype ClaimClosureEvaluation,\n\ttype ClaimNode,\n\ttype ClaimVerdict,\n} from \"./claim-types.ts\";\n\nconst BLOCKING_VERDICTS: readonly ClaimVerdict[] = [\n\t\"violated\",\n\t\"stale\",\n\t\"incomplete_scope\",\n\t\"insufficient_trust\",\n\t\"missing\",\n];\nexport const MAX_BLOCKING_CUT_CANDIDATES = 128;\nconst MAX_CUT_OPERATIONS = 65536;\nclass CutSearchLimit extends Error {}\ntype Cut = readonly string[];\ntype Family = readonly Cut[];\ninterface CutNode {\n\treadonly id: string;\n\treadonly rule: \"all\" | \"any\";\n\treadonly inputs: readonly string[];\n\treadonly closed: boolean;\n\treadonly local: boolean;\n}\n/** Search-owned mutable accounting, including work before a limit is reached. */\ninterface CutSearchBudget {\n\toperations: number;\n}\n\nexport function isBlockingVerdict(verdict: ClaimVerdict): boolean {\n\treturn BLOCKING_VERDICTS.includes(verdict);\n}\nfunction compareIds(left: string, right: string): number {\n\tif (left === right) return 0;\n\treturn left < right ? -1 : 1;\n}\nfunction compareCuts(left: Cut, right: Cut): number {\n\tif (left.length !== right.length) return left.length - right.length;\n\tfor (let i = 0; i < left.length; i++) {\n\t\tconst order = compareIds(left[i], right[i]);\n\t\tif (order) return order;\n\t}\n\treturn 0;\n}\nfunction union(sets: readonly Cut[]): Cut {\n\treturn [...new Set(sets.flat())].sort(compareIds);\n}\nfunction* unions(left: Family, right: Family): Generator<Cut> {\n\tfor (const a of left) for (const b of right) yield union([a, b]);\n}\nfunction* alternatives(families: readonly Family[]): Generator<Cut> {\n\tfor (const family of families) yield* family;\n}\n\nfunction cutNodes(\n\tclaims: ReadonlyMap<string, ClaimNode>,\n\tevaluations: ReadonlyMap<string, ClaimClosureEvaluation>,\n): CutNode[] {\n\tconst ordered = topologicalClaimOrder(\n\t\t{ schemaVersion: CLAIM_GRAPH_SCHEMA_VERSION, claims: [...claims.values()] },\n\t\tclaims,\n\t);\n\treturn ordered.map((claim) => {\n\t\tconst evaluation = evaluations.get(claim.claimId);\n\t\tif (\n\t\t\t!evaluation ||\n\t\t\t(!isBlockingVerdict(evaluation.verdict) &&\n\t\t\t\tevaluation.verdict !== \"satisfied\" &&\n\t\t\t\tevaluation.verdict !== \"waived\")\n\t\t) {\n\t\t\tthrow new ClaimGraphError(\"invalid_input\", \"Blocking explanation requires a valid evaluation for every claim\");\n\t\t}\n\t\tconst inputs = claim.satisfaction.inputs.filter((id) => claims.get(id)?.severity === \"required\").sort(compareIds);\n\t\tconst inferredLocal =\n\t\t\t(evaluation.verdict === \"violated\" && evaluation.observationIds.length > 0) ||\n\t\t\t(evaluation.verdict === \"incomplete_scope\" && claim.scopeSensitive === true);\n\t\treturn {\n\t\t\tid: claim.claimId,\n\t\t\trule: claim.satisfaction.rule,\n\t\t\tinputs,\n\t\t\tclosed: !isBlockingVerdict(evaluation.verdict),\n\t\t\tlocal:\n\t\t\t\tinputs.length === 0 ||\n\t\t\t\tevaluation.blockingOrigin === \"local\" ||\n\t\t\t\t(evaluation.blockingOrigin === undefined && inferredLocal),\n\t\t};\n\t});\n}\nfunction reachableNodes(ordered: CutNode[], roots: readonly string[]): CutNode[] {\n\tconst byId = new Map(ordered.map((node) => [node.id, node]));\n\tconst reachable = new Set<string>();\n\tconst pending = [...roots];\n\twhile (pending.length) {\n\t\tconst id = pending.pop();\n\t\tif (id === undefined || reachable.has(id)) continue;\n\t\treachable.add(id);\n\t\tconst node = byId.get(id);\n\t\tif (node && !node.closed) pending.push(...node.inputs);\n\t}\n\treturn ordered.filter((node) => reachable.has(node.id));\n}\nfunction step(budget: CutSearchBudget): void {\n\tif (budget.operations >= MAX_CUT_OPERATIONS) throw new CutSearchLimit();\n\tbudget.operations++;\n}\nfunction prune(candidates: Iterable<Cut>, budget: CutSearchBudget): Family {\n\tlet kept: Cut[] = [];\n\tfor (const candidate of candidates) {\n\t\tstep(budget);\n\t\tconst set = new Set(candidate);\n\t\tif (\n\t\t\tkept.some((other) => {\n\t\t\t\tstep(budget);\n\t\t\t\treturn other.every((id) => set.has(id));\n\t\t\t})\n\t\t)\n\t\t\tcontinue;\n\t\tkept = kept.filter((other) => {\n\t\t\tstep(budget);\n\t\t\tconst existing = new Set(other);\n\t\t\treturn !candidate.every((id) => existing.has(id));\n\t\t});\n\t\tkept.push(candidate);\n\t\tif (kept.length > MAX_BLOCKING_CUT_CANDIDATES) throw new CutSearchLimit();\n\t}\n\treturn kept.sort(compareCuts);\n}\nfunction combineAll(families: readonly Family[], budget: CutSearchBudget): Family {\n\tlet result: Family = [[]];\n\tfor (const family of families) result = prune(unions(result, family), budget);\n\treturn result;\n}\nfunction exactCut(nodes: readonly CutNode[], roots: readonly string[], budget: CutSearchBudget): Cut {\n\tconst families = new Map<string, Family>();\n\tfor (const node of nodes) {\n\t\tif (node.closed) {\n\t\t\tfamilies.set(node.id, [[]]);\n\t\t\tcontinue;\n\t\t}\n\t\tconst children = node.inputs.map((id) => families.get(id) ?? []);\n\t\tlet family: Family = [[]];\n\t\tif (children.length) {\n\t\t\tfamily = node.rule === \"all\" ? combineAll(children, budget) : prune(alternatives(children), budget);\n\t\t}\n\t\tif (node.local) family = prune(unions(family, [[node.id]]), budget);\n\t\tfamilies.set(node.id, family);\n\t}\n\treturn (\n\t\tcombineAll(\n\t\t\troots.map((id) => families.get(id) ?? []),\n\t\t\tbudget,\n\t\t)[0] ?? []\n\t);\n}\nfunction greedyCut(nodes: readonly CutNode[], roots: readonly string[]): Cut {\n\tconst cuts = new Map<string, Cut>();\n\tfor (const node of nodes) {\n\t\tif (node.closed) {\n\t\t\tcuts.set(node.id, []);\n\t\t\tcontinue;\n\t\t}\n\t\tconst children = node.inputs.map((id) => cuts.get(id) ?? []);\n\t\tconst childCut = node.rule === \"all\" ? union(children) : ([...children].sort(compareCuts)[0] ?? []);\n\t\tcuts.set(node.id, node.local ? union([childCut, [node.id]]) : childCut);\n\t}\n\treturn union(roots.map((id) => cuts.get(id) ?? []));\n}\n\n/** Prefer this API over the legacy array-only projection when optimality matters. */\nexport function explainBlockingCut(\n\tclaims: ReadonlyMap<string, ClaimNode>,\n\tevaluations: ReadonlyMap<string, ClaimClosureEvaluation>,\n\trootIds: readonly string[],\n): BlockingCutExplanation {\n\tconst roots = [...new Set(rootIds)].sort(compareIds);\n\tfor (const id of roots) if (!claims.has(id)) throw new ClaimGraphError(\"unknown_input\", \"Unknown blocking root\");\n\tconst nodes = reachableNodes(cutNodes(claims, evaluations), roots);\n\tconst budget: CutSearchBudget = { operations: 0 };\n\tlet claimIds: Cut;\n\tlet truncated = false;\n\ttry {\n\t\tclaimIds = exactCut(nodes, roots, budget);\n\t} catch (error) {\n\t\tif (!(error instanceof CutSearchLimit)) throw error;\n\t\ttruncated = true;\n\t\tclaimIds = greedyCut(nodes, roots);\n\t}\n\tconst selected = new Set(claimIds);\n\treturn Object.freeze({\n\t\tclaimIds: Object.freeze([...claimIds]),\n\t\talgorithm: truncated ? \"greedy\" : \"exact-antichain\",\n\t\toptimality: truncated ? \"not-proven\" : \"minimum\",\n\t\ttruncated,\n\t\texploredStates: budget.operations,\n\t\tlocalClaimIds: Object.freeze(\n\t\t\tnodes\n\t\t\t\t.flatMap((node) => (node.local && node.inputs.length > 0 && selected.has(node.id) ? [node.id] : []))\n\t\t\t\t.sort(compareIds),\n\t\t),\n\t});\n}\n\n/** Compatibility name: on a bounded-search fallback this array is not guaranteed minimal. */\nexport function minimalBlockingCut(\n\tclaims: ReadonlyMap<string, ClaimNode>,\n\tevaluations: ReadonlyMap<string, ClaimClosureEvaluation>,\n\trootIds: readonly string[],\n): Cut {\n\treturn explainBlockingCut(claims, evaluations, rootIds).claimIds;\n}\n"]}

package/dist/claims/claim-closure.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claim-closure.d.ts","sourceRoot":"","sources":["../../src/claims/claim-closure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,EAQN,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EAGvB,MAAM,kBAAkB,CAAC;AAqJ1B,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,GAAG,kBAAkB,CAiDjF","sourcesContent":["/**\n * Proof closure evaluation over a claim graph (plan §5.5).\n *\n * Order of operations, each step pure and deterministic:\n *\n * 1. Drop observations bound to another source root or environment.\n * 2. Classify expired observations and observations missing one of a claim's\n *    invalidation keys as stale for that claim.\n * 3. A qualified counterexample decides `violated` before any witness counts.\n * 4. Leaf witnesses below the claim's trust floor never count; distinct\n *    independence groups must reach `requiredWitnesses`.\n * 5. Composite claims fold their *required* children (`all` = worst child,\n *    `any` = best child) in topological order, so a parent is never read\n *    before its inputs. Advisory children are reported but never fold into a\n *    parent, and a composite with no required children is witnessed like a leaf.\n * 6. A scope-sensitive claim is blocked while the workspace witness is not\n *    complete; an unresolved effect blocks the whole closure.\n * 7. A waiver removes an unclosed claim from the required set. It never\n *    removes a violated one: a counterexample beats a waiver.\n *\n * The public verdict is decided by the required *roots* (claims nobody lists\n * as an input): `verified` only when every required root is closed, no effect\n * is unresolved, and the workspace witness is complete. A required leaf under\n * an `any` parent therefore blocks nothing once a sibling branch closes — that\n * is what `any` means — while `blockingClaimIds` still lists every required\n * claim on a blocking path so the cause is explainable.\n */\n\nimport { isBlockingVerdict, minimalBlockingCut } from \"./claim-blocking-cut.ts\";\nimport { ClaimGraphError, rootClaimIds, topologicalClaimOrder, validateClaimGraph } from \"./claim-graph.ts\";\nimport {\n\tCLAIM_VERDICT_PRECEDENCE,\n\ttype ClaimClosureEvaluation,\n\ttype ClaimNode,\n\ttype ClaimReasonCode,\n\ttype ClaimVerdict,\n\tOBSERVATION_TRUST_RANK,\n\ttype ObservationNode,\n\ttype ProofClosureInput,\n\ttype ProofClosureResult,\n\ttype VerificationVerdict,\n\ttype WaiverNode,\n} from \"./claim-types.ts\";\n\nconst ISO_TIMESTAMP = /^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$/;\n\ninterface Witnesses {\n\treadonly supporting: ObservationNode[];\n\treadonly violating: ObservationNode[];\n\treadonly stale: ObservationNode[];\n}\n\nfunction compareCodeUnits(left: string, right: string): number {\n\tif (left === right) return 0;\n\treturn left < right ? -1 : 1;\n}\n\nfunction requireTimestamp(value: string, label: string): string {\n\tif (!ISO_TIMESTAMP.test(value))\n\t\tthrow new ClaimGraphError(\"invalid_input\", `${label} must be an ISO-8601 UTC instant`);\n\treturn value;\n}\n\nfunction reasonFor(verdict: ClaimVerdict): ClaimReasonCode {\n\treturn `claim.${verdict}` as ClaimReasonCode;\n}\n\nfunction worst(verdicts: readonly ClaimVerdict[]): ClaimVerdict {\n\treturn [...verdicts].sort((a, b) => CLAIM_VERDICT_PRECEDENCE.indexOf(a) - CLAIM_VERDICT_PRECEDENCE.indexOf(b))[0];\n}\n\nfunction best(verdicts: readonly ClaimVerdict[]): ClaimVerdict {\n\treturn [...verdicts].sort((a, b) => CLAIM_VERDICT_PRECEDENCE.indexOf(b) - CLAIM_VERDICT_PRECEDENCE.indexOf(a))[0];\n}\n\n/** Steps 1–2: bind observations to claims, dropping foreign ones and marking stale ones. */\nfunction indexWitnesses(input: ProofClosureInput, claims: ReadonlyMap<string, ClaimNode>): Map<string, Witnesses> {\n\tconst index = new Map<string, Witnesses>();\n\tfor (const claim of claims.values()) index.set(claim.claimId, { supporting: [], violating: [], stale: [] });\n\tfor (const observation of input.observations) {\n\t\tif (observation.sourceRoot !== input.sourceRoot || observation.environmentDigest !== input.environmentDigest)\n\t\t\tcontinue;\n\t\tconst expired =\n\t\t\tobservation.validUntil !== undefined && requireTimestamp(observation.validUntil, \"validUntil\") <= input.now;\n\t\tconst attested = observation.invalidationKeys ?? [];\n\t\tfor (const claimId of observation.claimIds) {\n\t\t\tconst claim = claims.get(claimId);\n\t\t\tconst witnesses = index.get(claimId);\n\t\t\tif (claim === undefined || witnesses === undefined) continue;\n\t\t\tconst missingKey = claim.invalidationKeys.some((key) => !attested.includes(key));\n\t\t\tif (expired || missingKey) witnesses.stale.push(observation);\n\t\t\telse if (observation.polarity === \"violates\") witnesses.violating.push(observation);\n\t\t\telse witnesses.supporting.push(observation);\n\t\t}\n\t}\n\treturn index;\n}\n\nfunction ids(observations: readonly ObservationNode[]): readonly string[] {\n\treturn observations.map((observation) => observation.observationId).sort(compareCodeUnits);\n}\n\n/** Steps 3–4 for a leaf claim. */\nfunction evaluateLeaf(\n\tclaim: ClaimNode,\n\twitnesses: Witnesses,\n): { verdict: ClaimVerdict; observationIds: readonly string[] } {\n\tif (witnesses.violating.length > 0) return { verdict: \"violated\", observationIds: ids(witnesses.violating) };\n\tconst floor = OBSERVATION_TRUST_RANK[claim.trustFloor];\n\tconst trusted = witnesses.supporting.filter((observation) => OBSERVATION_TRUST_RANK[observation.source] >= floor);\n\tconst groups = new Set(trusted.map((observation) => observation.independenceGroup ?? observation.observationId));\n\tif (groups.size >= (claim.requiredWitnesses ?? 1)) return { verdict: \"satisfied\", observationIds: ids(trusted) };\n\tif (trusted.length > 0) return { verdict: \"missing\", observationIds: ids(trusted) };\n\tif (witnesses.supporting.length > 0)\n\t\treturn { verdict: \"insufficient_trust\", observationIds: ids(witnesses.supporting) };\n\tif (witnesses.stale.length > 0) return { verdict: \"stale\", observationIds: ids(witnesses.stale) };\n\treturn { verdict: \"missing\", observationIds: [] };\n}\n\n/** Inputs that take part in a parent's fold: advisory children are informational only. */\nfunction requiredInputs(claim: ClaimNode, claims: ReadonlyMap<string, ClaimNode>): readonly string[] {\n\treturn claim.satisfaction.inputs.filter((input) => claims.get(input)?.severity === \"required\");\n}\n\nfunction isClosed(verdict: ClaimVerdict): boolean {\n\treturn verdict === \"satisfied\" || verdict === \"waived\";\n}\n\n/** Step 5 for a composite claim; its required children are already evaluated. */\nfunction evaluateComposite(\n\tclaim: ClaimNode,\n\tinputs: readonly string[],\n\twitnesses: Witnesses,\n\tevaluations: ReadonlyMap<string, ClaimClosureEvaluation>,\n): { verdict: ClaimVerdict; observationIds: readonly string[] } {\n\tif (witnesses.violating.length > 0) return { verdict: \"violated\", observationIds: ids(witnesses.violating) };\n\tconst childVerdicts = inputs.map((input) => evaluations.get(input)?.verdict ?? \"missing\");\n\tif (claim.satisfaction.rule === \"all\") {\n\t\tconst open = childVerdicts.filter((verdict) => !isClosed(verdict));\n\t\treturn { verdict: open.length === 0 ? \"satisfied\" : worst(open), observationIds: [] };\n\t}\n\tif (childVerdicts.some(isClosed)) return { verdict: \"satisfied\", observationIds: [] };\n\treturn { verdict: best(childVerdicts), observationIds: [] };\n}\n\n/** Step 7: the lexically first valid waiver for a claim, or none. */\nfunction indexWaivers(input: ProofClosureInput, claims: ReadonlyMap<string, ClaimNode>): Map<string, WaiverNode> {\n\tconst byClaim = new Map<string, WaiverNode>();\n\tfor (const waiver of [...input.waivers].sort((a, b) => compareCodeUnits(a.waiverId, b.waiverId))) {\n\t\tif (!claims.has(waiver.claimId))\n\t\t\tthrow new ClaimGraphError(\"unknown_input\", `${waiver.waiverId} waives unknown ${waiver.claimId}`);\n\t\tif (waiver.sourceRoot !== input.sourceRoot) continue;\n\t\tif (requireTimestamp(waiver.expiresAt, \"expiresAt\") <= input.now) continue;\n\t\tif (!byClaim.has(waiver.claimId)) byClaim.set(waiver.claimId, waiver);\n\t}\n\treturn byClaim;\n}\n\n/** Required claims on a blocking path from a blocking required root, in graph order. */\nfunction blockingPathClaimIds(\n\tclaims: ReadonlyMap<string, ClaimNode>,\n\tevaluations: ReadonlyMap<string, ClaimClosureEvaluation>,\n\tblockingRoots: readonly string[],\n\tgraphOrder: readonly string[],\n): readonly string[] {\n\tconst onPath = new Set<string>();\n\tconst visit = (claimId: string): void => {\n\t\tif (onPath.has(claimId)) return;\n\t\tconst claim = claims.get(claimId);\n\t\tconst verdict = evaluations.get(claimId)?.verdict;\n\t\tif (claim === undefined || verdict === undefined || !isBlockingVerdict(verdict)) return;\n\t\tonPath.add(claimId);\n\t\tfor (const input of requiredInputs(claim, claims)) visit(input);\n\t};\n\tfor (const root of blockingRoots) visit(root);\n\treturn graphOrder.filter((claimId) => onPath.has(claimId));\n}\n\nfunction globalVerdict(\n\trequiredRoots: readonly ClaimClosureEvaluation[],\n\tinput: ProofClosureInput,\n): VerificationVerdict {\n\tif (requiredRoots.length === 0) return \"unverified\";\n\tif (requiredRoots.some((root) => root.verdict === \"violated\")) return \"violated\";\n\tconst closure =\n\t\trequiredRoots.every((root) => isClosed(root.verdict)) &&\n\t\tinput.unresolvedEffectIds.length === 0 &&\n\t\tinput.workspaceCompleteness === \"complete\";\n\treturn closure ? \"verified\" : \"inconclusive\";\n}\n\nexport function evaluateProofClosure(input: ProofClosureInput): ProofClosureResult {\n\tconst claims = validateClaimGraph(input.graph);\n\trequireTimestamp(input.now, \"now\");\n\tconst witnesses = indexWitnesses(input, claims);\n\tconst waivers = indexWaivers(input, claims);\n\tconst evaluations = new Map<string, ClaimClosureEvaluation>();\n\tfor (const claim of topologicalClaimOrder(input.graph, claims)) {\n\t\tconst claimWitnesses = witnesses.get(claim.claimId) as Witnesses;\n\t\tconst inputs = requiredInputs(claim, claims);\n\t\tconst local =\n\t\t\tinputs.length === 0\n\t\t\t\t? evaluateLeaf(claim, claimWitnesses)\n\t\t\t\t: evaluateComposite(claim, inputs, claimWitnesses, evaluations);\n\t\tlet verdict = local.verdict;\n\t\tif (verdict !== \"violated\" && claim.scopeSensitive === true && input.workspaceCompleteness !== \"complete\") {\n\t\t\tverdict = \"incomplete_scope\";\n\t\t}\n\t\tconst waiver = waivers.get(claim.claimId);\n\t\tconst waived = waiver !== undefined && verdict !== \"violated\" && verdict !== \"satisfied\";\n\t\tif (waived) verdict = \"waived\";\n\t\tevaluations.set(\n\t\t\tclaim.claimId,\n\t\t\tObject.freeze({\n\t\t\t\tclaimId: claim.claimId,\n\t\t\t\tseverity: claim.severity,\n\t\t\t\tverdict,\n\t\t\t\treasonCode: reasonFor(verdict),\n\t\t\t\tobservationIds: Object.freeze([...local.observationIds]),\n\t\t\t\t...(waived ? { waiverId: waiver.waiverId } : {}),\n\t\t\t}),\n\t\t);\n\t}\n\tconst graphOrder = input.graph.claims.map((claim) => claim.claimId);\n\tconst ordered = graphOrder.map((claimId) => evaluations.get(claimId) as ClaimClosureEvaluation);\n\tconst requiredRoots = rootClaimIds(input.graph)\n\t\t.map((claimId) => evaluations.get(claimId) as ClaimClosureEvaluation)\n\t\t.filter((evaluation) => evaluation.severity === \"required\");\n\tconst blockingRoots = requiredRoots\n\t\t.filter((evaluation) => isBlockingVerdict(evaluation.verdict))\n\t\t.map((evaluation) => evaluation.claimId);\n\tconst blockingClaimIds = blockingPathClaimIds(claims, evaluations, blockingRoots, graphOrder);\n\treturn Object.freeze({\n\t\tverdict: globalVerdict(requiredRoots, input),\n\t\tclaimEvaluations: Object.freeze(ordered),\n\t\tblockingClaimIds: Object.freeze(blockingClaimIds),\n\t\tminimalBlockingCut: Object.freeze([...minimalBlockingCut(claims, evaluations, blockingRoots)]),\n\t\tunresolvedEffectIds: Object.freeze([...input.unresolvedEffectIds].sort(compareCodeUnits)),\n\t\tworkspaceCompleteness: input.workspaceCompleteness,\n\t});\n}\n"]}
+{"version":3,"file":"claim-closure.d.ts","sourceRoot":"","sources":["../../src/claims/claim-closure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,EAQN,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EAIvB,MAAM,kBAAkB,CAAC;AAmK1B,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,GAAG,kBAAkB,CAmEjF","sourcesContent":["/**\n * Proof closure evaluation over a claim graph (plan §5.5).\n *\n * Order of operations, each step pure and deterministic:\n *\n * 1. Drop observations bound to another source root or environment.\n * 2. Classify expired observations and observations missing one of a claim's\n *    invalidation keys as stale for that claim.\n * 3. A qualified counterexample decides `violated` before any witness counts.\n * 4. Leaf witnesses below the claim's trust floor never count; distinct\n *    independence groups must reach `requiredWitnesses`.\n * 5. Composite claims fold their *required* children (`all` = worst child,\n *    `any` = best child) in topological order, so a parent is never read\n *    before its inputs. Advisory children are reported but never fold into a\n *    parent, and a composite with no required children is witnessed like a leaf.\n * 6. A scope-sensitive claim is blocked while the workspace witness is not\n *    complete; an unresolved effect blocks the whole closure.\n * 7. A waiver removes an unclosed claim from the required set. It never\n *    removes a violated one: a counterexample beats a waiver.\n *\n * The public verdict is decided by the required *roots* (claims nobody lists\n * as an input): `verified` only when every required root is closed, no effect\n * is unresolved, and the workspace witness is complete. A required leaf under\n * an `any` parent therefore blocks nothing once a sibling branch closes — that\n * is what `any` means — while `blockingClaimIds` still lists every required\n * claim on a blocking path so the cause is explainable.\n */\n\nimport { explainBlockingCut, isBlockingVerdict } from \"./claim-blocking-cut.ts\";\nimport { ClaimGraphError, rootClaimIds, topologicalClaimOrder, validateClaimGraph } from \"./claim-graph.ts\";\nimport {\n\tCLAIM_VERDICT_PRECEDENCE,\n\ttype ClaimClosureEvaluation,\n\ttype ClaimNode,\n\ttype ClaimReasonCode,\n\ttype ClaimVerdict,\n\tOBSERVATION_TRUST_RANK,\n\ttype ObservationNode,\n\ttype ProofClosureInput,\n\ttype ProofClosureResult,\n\ttype VerificationVerdict,\n\ttype WaiverNode,\n\ttype WitnessIndependencePolicy,\n} from \"./claim-types.ts\";\n\nconst ISO_TIMESTAMP = /^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$/;\n\ninterface Witnesses {\n\treadonly supporting: ObservationNode[];\n\treadonly violating: ObservationNode[];\n\treadonly stale: ObservationNode[];\n}\n\nfunction compareCodeUnits(left: string, right: string): number {\n\tif (left === right) return 0;\n\treturn left < right ? -1 : 1;\n}\n\nfunction requireTimestamp(value: string, label: string): string {\n\tif (!ISO_TIMESTAMP.test(value))\n\t\tthrow new ClaimGraphError(\"invalid_input\", `${label} must be an ISO-8601 UTC instant`);\n\treturn value;\n}\n\nfunction reasonFor(verdict: ClaimVerdict): ClaimReasonCode {\n\treturn `claim.${verdict}` as ClaimReasonCode;\n}\n\nfunction worst(verdicts: readonly ClaimVerdict[]): ClaimVerdict {\n\treturn [...verdicts].sort((a, b) => CLAIM_VERDICT_PRECEDENCE.indexOf(a) - CLAIM_VERDICT_PRECEDENCE.indexOf(b))[0];\n}\n\nfunction best(verdicts: readonly ClaimVerdict[]): ClaimVerdict {\n\treturn [...verdicts].sort((a, b) => CLAIM_VERDICT_PRECEDENCE.indexOf(b) - CLAIM_VERDICT_PRECEDENCE.indexOf(a))[0];\n}\n\n/** Steps 1–2: bind observations to claims, dropping foreign ones and marking stale ones. */\nfunction indexWitnesses(input: ProofClosureInput, claims: ReadonlyMap<string, ClaimNode>): Map<string, Witnesses> {\n\tconst index = new Map<string, Witnesses>();\n\tfor (const claim of claims.values()) index.set(claim.claimId, { supporting: [], violating: [], stale: [] });\n\tfor (const observation of input.observations) {\n\t\tif (observation.sourceRoot !== input.sourceRoot || observation.environmentDigest !== input.environmentDigest)\n\t\t\tcontinue;\n\t\tconst expired =\n\t\t\tobservation.validUntil !== undefined && requireTimestamp(observation.validUntil, \"validUntil\") <= input.now;\n\t\tconst attested = observation.invalidationKeys ?? [];\n\t\tfor (const claimId of observation.claimIds) {\n\t\t\tconst claim = claims.get(claimId);\n\t\t\tconst witnesses = index.get(claimId);\n\t\t\tif (claim === undefined || witnesses === undefined) continue;\n\t\t\tconst missingKey = claim.invalidationKeys.some((key) => !attested.includes(key));\n\t\t\tif (expired || missingKey) witnesses.stale.push(observation);\n\t\t\telse if (observation.polarity === \"violates\") witnesses.violating.push(observation);\n\t\t\telse witnesses.supporting.push(observation);\n\t\t}\n\t}\n\treturn index;\n}\n\nfunction ids(observations: readonly ObservationNode[]): readonly string[] {\n\treturn observations.map((observation) => observation.observationId).sort(compareCodeUnits);\n}\n\n/** Steps 3–4 for a leaf claim. */\nfunction evaluateLeaf(\n\tclaim: ClaimNode,\n\twitnesses: Witnesses,\n\tindependence: WitnessIndependencePolicy,\n): { verdict: ClaimVerdict; observationIds: readonly string[] } {\n\tif (witnesses.violating.length > 0) return { verdict: \"violated\", observationIds: ids(witnesses.violating) };\n\tconst floor = OBSERVATION_TRUST_RANK[claim.trustFloor];\n\tconst trusted = witnesses.supporting.filter((observation) => OBSERVATION_TRUST_RANK[observation.source] >= floor);\n\tconst requiredWitnesses = claim.requiredWitnesses ?? 1;\n\tconst attributable = trusted.filter(\n\t\t(observation) =>\n\t\t\tindependence === \"legacy-observation-id\" ||\n\t\t\trequiredWitnesses === 1 ||\n\t\t\tBoolean(observation.independenceGroup?.trim()),\n\t);\n\tconst groups = new Set(\n\t\tattributable.map(\n\t\t\t(observation) =>\n\t\t\t\tobservation.independenceGroup ??\n\t\t\t\t(independence === \"legacy-observation-id\" ? observation.observationId : undefined),\n\t\t),\n\t);\n\tif (groups.size >= requiredWitnesses) return { verdict: \"satisfied\", observationIds: ids(trusted) };\n\tif (trusted.length > 0) return { verdict: \"missing\", observationIds: ids(trusted) };\n\tif (witnesses.supporting.length > 0)\n\t\treturn { verdict: \"insufficient_trust\", observationIds: ids(witnesses.supporting) };\n\tif (witnesses.stale.length > 0) return { verdict: \"stale\", observationIds: ids(witnesses.stale) };\n\treturn { verdict: \"missing\", observationIds: [] };\n}\n\n/** Inputs that take part in a parent's fold: advisory children are informational only. */\nfunction requiredInputs(claim: ClaimNode, claims: ReadonlyMap<string, ClaimNode>): readonly string[] {\n\treturn claim.satisfaction.inputs.filter((input) => claims.get(input)?.severity === \"required\");\n}\n\nfunction isClosed(verdict: ClaimVerdict): boolean {\n\treturn verdict === \"satisfied\" || verdict === \"waived\";\n}\n\n/** Step 5 for a composite claim; its required children are already evaluated. */\nfunction evaluateComposite(\n\tclaim: ClaimNode,\n\tinputs: readonly string[],\n\twitnesses: Witnesses,\n\tevaluations: ReadonlyMap<string, ClaimClosureEvaluation>,\n): { verdict: ClaimVerdict; observationIds: readonly string[] } {\n\tif (witnesses.violating.length > 0) return { verdict: \"violated\", observationIds: ids(witnesses.violating) };\n\tconst childVerdicts = inputs.map((input) => evaluations.get(input)?.verdict ?? \"missing\");\n\tif (claim.satisfaction.rule === \"all\") {\n\t\tconst open = childVerdicts.filter((verdict) => !isClosed(verdict));\n\t\treturn { verdict: open.length === 0 ? \"satisfied\" : worst(open), observationIds: [] };\n\t}\n\tif (childVerdicts.some(isClosed)) return { verdict: \"satisfied\", observationIds: [] };\n\treturn { verdict: best(childVerdicts), observationIds: [] };\n}\n\n/** Step 7: the lexically first valid waiver for a claim, or none. */\nfunction indexWaivers(input: ProofClosureInput, claims: ReadonlyMap<string, ClaimNode>): Map<string, WaiverNode> {\n\tconst byClaim = new Map<string, WaiverNode>();\n\tfor (const waiver of [...input.waivers].sort((a, b) => compareCodeUnits(a.waiverId, b.waiverId))) {\n\t\tif (!claims.has(waiver.claimId))\n\t\t\tthrow new ClaimGraphError(\"unknown_input\", `${waiver.waiverId} waives unknown ${waiver.claimId}`);\n\t\tif (waiver.sourceRoot !== input.sourceRoot) continue;\n\t\tif (requireTimestamp(waiver.expiresAt, \"expiresAt\") <= input.now) continue;\n\t\tif (!byClaim.has(waiver.claimId)) byClaim.set(waiver.claimId, waiver);\n\t}\n\treturn byClaim;\n}\n\n/** Required claims on a blocking path from a blocking required root, in graph order. */\nfunction blockingPathClaimIds(\n\tclaims: ReadonlyMap<string, ClaimNode>,\n\tevaluations: ReadonlyMap<string, ClaimClosureEvaluation>,\n\tblockingRoots: readonly string[],\n\tgraphOrder: readonly string[],\n): readonly string[] {\n\tconst onPath = new Set<string>();\n\tconst visit = (claimId: string): void => {\n\t\tif (onPath.has(claimId)) return;\n\t\tconst claim = claims.get(claimId);\n\t\tconst verdict = evaluations.get(claimId)?.verdict;\n\t\tif (claim === undefined || verdict === undefined || !isBlockingVerdict(verdict)) return;\n\t\tonPath.add(claimId);\n\t\tfor (const input of requiredInputs(claim, claims)) visit(input);\n\t};\n\tfor (const root of blockingRoots) visit(root);\n\treturn graphOrder.filter((claimId) => onPath.has(claimId));\n}\n\nfunction globalVerdict(\n\trequiredRoots: readonly ClaimClosureEvaluation[],\n\tinput: ProofClosureInput,\n): VerificationVerdict {\n\tif (requiredRoots.length === 0) return \"unverified\";\n\tif (requiredRoots.some((root) => root.verdict === \"violated\")) return \"violated\";\n\tconst closure =\n\t\trequiredRoots.every((root) => isClosed(root.verdict)) &&\n\t\tinput.unresolvedEffectIds.length === 0 &&\n\t\tinput.workspaceCompleteness === \"complete\";\n\treturn closure ? \"verified\" : \"inconclusive\";\n}\n\nexport function evaluateProofClosure(input: ProofClosureInput): ProofClosureResult {\n\tconst claims = validateClaimGraph(input.graph);\n\tconst witnessIndependence =\n\t\tinput.witnessIndependence === undefined ? \"legacy-observation-id\" : input.witnessIndependence;\n\tif (witnessIndependence !== \"legacy-observation-id\" && witnessIndependence !== \"explicit-groups\") {\n\t\tthrow new ClaimGraphError(\"invalid_input\", \"Unknown witness independence policy\");\n\t}\n\trequireTimestamp(input.now, \"now\");\n\tconst witnesses = indexWitnesses(input, claims);\n\tconst waivers = indexWaivers(input, claims);\n\tconst evaluations = new Map<string, ClaimClosureEvaluation>();\n\tfor (const claim of topologicalClaimOrder(input.graph, claims)) {\n\t\tconst claimWitnesses = witnesses.get(claim.claimId) as Witnesses;\n\t\tconst inputs = requiredInputs(claim, claims);\n\t\tconst local =\n\t\t\tinputs.length === 0\n\t\t\t\t? evaluateLeaf(claim, claimWitnesses, witnessIndependence)\n\t\t\t\t: evaluateComposite(claim, inputs, claimWitnesses, evaluations);\n\t\tlet verdict = local.verdict;\n\t\tif (verdict !== \"violated\" && claim.scopeSensitive === true && input.workspaceCompleteness !== \"complete\") {\n\t\t\tverdict = \"incomplete_scope\";\n\t\t}\n\t\tconst waiver = waivers.get(claim.claimId);\n\t\tconst waived = waiver !== undefined && verdict !== \"violated\" && verdict !== \"satisfied\";\n\t\tif (waived) verdict = \"waived\";\n\t\tevaluations.set(\n\t\t\tclaim.claimId,\n\t\t\tObject.freeze({\n\t\t\t\tclaimId: claim.claimId,\n\t\t\t\tseverity: claim.severity,\n\t\t\t\tverdict,\n\t\t\t\treasonCode: reasonFor(verdict),\n\t\t\t\tobservationIds: Object.freeze([...local.observationIds]),\n\t\t\t\t...(waived ? { waiverId: waiver.waiverId } : {}),\n\t\t\t\t...(isBlockingVerdict(verdict)\n\t\t\t\t\t? {\n\t\t\t\t\t\t\tblockingOrigin:\n\t\t\t\t\t\t\t\tinputs.length === 0 ||\n\t\t\t\t\t\t\t\tclaimWitnesses.violating.length > 0 ||\n\t\t\t\t\t\t\t\t(claim.scopeSensitive === true && input.workspaceCompleteness !== \"complete\")\n\t\t\t\t\t\t\t\t\t? (\"local\" as const)\n\t\t\t\t\t\t\t\t\t: (\"children\" as const),\n\t\t\t\t\t\t}\n\t\t\t\t\t: {}),\n\t\t\t}),\n\t\t);\n\t}\n\tconst graphOrder = input.graph.claims.map((claim) => claim.claimId);\n\tconst ordered = graphOrder.map((claimId) => evaluations.get(claimId) as ClaimClosureEvaluation);\n\tconst requiredRoots = rootClaimIds(input.graph)\n\t\t.map((claimId) => evaluations.get(claimId) as ClaimClosureEvaluation)\n\t\t.filter((evaluation) => evaluation.severity === \"required\");\n\tconst blockingRoots = requiredRoots\n\t\t.filter((evaluation) => isBlockingVerdict(evaluation.verdict))\n\t\t.map((evaluation) => evaluation.claimId);\n\tconst blockingClaimIds = blockingPathClaimIds(claims, evaluations, blockingRoots, graphOrder);\n\tconst blockingCut = explainBlockingCut(claims, evaluations, blockingRoots);\n\treturn Object.freeze({\n\t\tverdict: globalVerdict(requiredRoots, input),\n\t\twitnessIndependence,\n\t\tclaimEvaluations: Object.freeze(ordered),\n\t\tblockingClaimIds: Object.freeze(blockingClaimIds),\n\t\tminimalBlockingCut: blockingCut.claimIds,\n\t\tblockingCut,\n\t\tunresolvedEffectIds: Object.freeze([...input.unresolvedEffectIds].sort(compareCodeUnits)),\n\t\tworkspaceCompleteness: input.workspaceCompleteness,\n\t});\n}\n"]}

package/dist/claims/claim-closure.js

@@ -25,7 +25,7 @@
  * is what `any` means — while `blockingClaimIds` still lists every required
  * claim on a blocking path so the cause is explainable.
  */
-import { isBlockingVerdict, minimalBlockingCut } from "./claim-blocking-cut.js";
+import { explainBlockingCut, isBlockingVerdict } from "./claim-blocking-cut.js";
 import { ClaimGraphError, rootClaimIds, topologicalClaimOrder, validateClaimGraph } from "./claim-graph.js";
 import { CLAIM_VERDICT_PRECEDENCE, OBSERVATION_TRUST_RANK, } from "./claim-types.js";
 const ISO_TIMESTAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
@@ -78,13 +78,18 @@ function ids(observations) {
     return observations.map((observation) => observation.observationId).sort(compareCodeUnits);
 }
 /** Steps 3–4 for a leaf claim. */
-function evaluateLeaf(claim, witnesses) {
+function evaluateLeaf(claim, witnesses, independence) {
     if (witnesses.violating.length > 0)
         return { verdict: "violated", observationIds: ids(witnesses.violating) };
     const floor = OBSERVATION_TRUST_RANK[claim.trustFloor];
     const trusted = witnesses.supporting.filter((observation) => OBSERVATION_TRUST_RANK[observation.source] >= floor);
-    const groups = new Set(trusted.map((observation) => observation.independenceGroup ?? observation.observationId));
-    if (groups.size >= (claim.requiredWitnesses ?? 1))
+    const requiredWitnesses = claim.requiredWitnesses ?? 1;
+    const attributable = trusted.filter((observation) => independence === "legacy-observation-id" ||
+        requiredWitnesses === 1 ||
+        Boolean(observation.independenceGroup?.trim()));
+    const groups = new Set(attributable.map((observation) => observation.independenceGroup ??
+        (independence === "legacy-observation-id" ? observation.observationId : undefined)));
+    if (groups.size >= requiredWitnesses)
         return { verdict: "satisfied", observationIds: ids(trusted) };
     if (trusted.length > 0)
         return { verdict: "missing", observationIds: ids(trusted) };
@@ -159,6 +164,10 @@ function globalVerdict(requiredRoots, input) {
 }
 export function evaluateProofClosure(input) {
     const claims = validateClaimGraph(input.graph);
+    const witnessIndependence = input.witnessIndependence === undefined ? "legacy-observation-id" : input.witnessIndependence;
+    if (witnessIndependence !== "legacy-observation-id" && witnessIndependence !== "explicit-groups") {
+        throw new ClaimGraphError("invalid_input", "Unknown witness independence policy");
+    }
     requireTimestamp(input.now, "now");
     const witnesses = indexWitnesses(input, claims);
     const waivers = indexWaivers(input, claims);
@@ -167,7 +176,7 @@ export function evaluateProofClosure(input) {
         const claimWitnesses = witnesses.get(claim.claimId);
         const inputs = requiredInputs(claim, claims);
         const local = inputs.length === 0
-            ? evaluateLeaf(claim, claimWitnesses)
+            ? evaluateLeaf(claim, claimWitnesses, witnessIndependence)
             : evaluateComposite(claim, inputs, claimWitnesses, evaluations);
         let verdict = local.verdict;
         if (verdict !== "violated" && claim.scopeSensitive === true && input.workspaceCompleteness !== "complete") {
@@ -184,6 +193,15 @@ export function evaluateProofClosure(input) {
             reasonCode: reasonFor(verdict),
             observationIds: Object.freeze([...local.observationIds]),
             ...(waived ? { waiverId: waiver.waiverId } : {}),
+            ...(isBlockingVerdict(verdict)
+                ? {
+                    blockingOrigin: inputs.length === 0 ||
+                        claimWitnesses.violating.length > 0 ||
+                        (claim.scopeSensitive === true && input.workspaceCompleteness !== "complete")
+                        ? "local"
+                        : "children",
+                }
+                : {}),
         }));
     }
     const graphOrder = input.graph.claims.map((claim) => claim.claimId);
@@ -195,11 +213,14 @@ export function evaluateProofClosure(input) {
         .filter((evaluation) => isBlockingVerdict(evaluation.verdict))
         .map((evaluation) => evaluation.claimId);
     const blockingClaimIds = blockingPathClaimIds(claims, evaluations, blockingRoots, graphOrder);
+    const blockingCut = explainBlockingCut(claims, evaluations, blockingRoots);
     return Object.freeze({
         verdict: globalVerdict(requiredRoots, input),
+        witnessIndependence,
         claimEvaluations: Object.freeze(ordered),
         blockingClaimIds: Object.freeze(blockingClaimIds),
-        minimalBlockingCut: Object.freeze([...minimalBlockingCut(claims, evaluations, blockingRoots)]),
+        minimalBlockingCut: blockingCut.claimIds,
+        blockingCut,
         unresolvedEffectIds: Object.freeze([...input.unresolvedEffectIds].sort(compareCodeUnits)),
         workspaceCompleteness: input.workspaceCompleteness,
     });