onto-mcp 0.4.12 → 0.4.13

package/dist/core-runtime/discovery/supported-models.js

@@ -7,9 +7,12 @@
  * provider calls) and by the G7 committed-config guard (which covers every
  * committed seat). Review-side runtime enforcement is a noted follow-up, so the
  * runtime gate today is wired on the reconstruct live path only. An unlisted
- * (provider, model) is rejected fail-loud at those gate points. Settings
- * resolution itself stays a PURE projection and does NOT apply this gate (see
- * settings-chain). The
+ * (provider, model) is rejected fail-loud at those gate points. The only
+ * runtime-owned exception is the B7 bench-candidate option passed explicitly by
+ * a benchmark harness: it can rescue an UNREGISTERED pair only at an exact
+ * allowlisted route path, and it never rescues registered role mismatches.
+ * Settings resolution itself stays a PURE projection and does NOT apply this
+ * gate (see settings-chain). The
  * authority ships with the onto install (it is located from the install root,
  * like core-lens-registry.yaml), so it is always present. The registry is data
  * (human-curated, evidence-cited); this module loads it and provides the
@@ -29,22 +32,154 @@ import { fileURLToPath } from "node:url";
 import { parse as parseYaml } from "yaml";
 import { z } from "zod";
 import { resolveInstallationPath } from "./installation-paths.js";
+import { REVIEW_EXECUTION_UNIT_IDS } from "./review-execution-units.js";
 export const SUPPORTED_MODELS_AUTHORITY_PATH = ".onto/authority/supported-models.yaml";
+/**
+ * Role vocabulary — the sealed 6-role set, each grounded in an existing code
+ * seat (INV-MODEL-1 role-aware design §2.1; `review` added by the 2026-07-11
+ * review-role registration design): `author` (semantic_author actor, certified
+ * by golden full-pipeline completion), `semantic_map_synthesize` /
+ * `semantic_map_verify` (the semantic-map capability pair), `answer_support_judge`
+ * (the judge adoption dispatch), `confirmation_provider` (confirmation actor),
+ * `review` (the review execution seats — actors teamlead/lens/synthesize and
+ * their unit overrides). The vocabulary is sealed here; which roles are
+ * LISTABLE in a registry entry is governed separately by {@link CONTRACTED_ROLES}.
+ */
+export const SUPPORTED_MODEL_ROLES = [
+    "author",
+    "semantic_map_synthesize",
+    "semantic_map_verify",
+    "answer_support_judge",
+    "confirmation_provider",
+    "review",
+];
+/**
+ * Roles with a DEFINED evidence contract — the only roles an entry may list in
+ * `roles`. Listing a vocabulary role without a contract fails registry load
+ * (fail-closed): certification must never outrun its evidence definition.
+ * Growing this set means defining that role's evidence contract and carries an
+ * INVARIANT-CHANGE: INV-MODEL-1 marker (role authority change).
+ */
+export const CONTRACTED_ROLES = [
+    "author",
+    "semantic_map_synthesize",
+    // Evidence contract: review-cert/v2 (2026-07-11 review-role registration
+    // design §4) — per-check pass-rate vs a contemporaneous baseline arm,
+    // absolute core-check floors, pinned check universe, R7 human curation.
+    "review",
+];
 const SupportedModelEntrySchema = z
     .object({
     provider: z.string().min(1),
     model: z.string().min(1),
     verified_at: z.string().min(1),
     benchmark_evidence_refs: z.array(z.string().min(1)).min(1),
+    // Role-restricted certification (INV-MODEL-1 role-aware design §2.2).
+    // ABSENT = grandfathered full-route allowance: the entry predates the role
+    // dimension and keeps its flat-registry permissions (an owner
+    // backward-compatibility decision, NOT a stage-traversal evidence claim).
+    // PRESENT = evidence-contracted certification: the model is valid ONLY at
+    // dispatches whose required role is listed. Values are further restricted
+    // to CONTRACTED_ROLES at load (see assertContractedRoles).
+    roles: z.array(z.enum(SUPPORTED_MODEL_ROLES)).min(1).optional(),
     notes: z.string().optional(),
+    // Active (provider, model) context window in tokens — the SSOT the
+    // reconstruct projection-budget helper (deriveDocumentExcerptProjectionBudget)
+    // reads to scale a single text document's seed-stage excerpt to the model.
+    // Optional: an entry without it falls back to the static projection FLOOR
+    // (model-agnostic, no regression). INV-MODEL-1; the window field is
+    // G4-protected (a change requires an INVARIANT-CHANGE: INV-MODEL-1 marker).
+    context_window_tokens: z.number().int().positive().optional(),
+    // Citation for context_window_tokens, kept SEPARATE from
+    // benchmark_evidence_refs: a context window is a published model spec, not a
+    // benchmark result. Required whenever context_window_tokens is present so a
+    // window value is never unsourced (C7).
+    context_window_provenance: z.string().min(1).optional(),
+    // Provider-published maximum output ceiling. Reconstruct direct-API
+    // headroom preflight consumes this value before any provider call.
+    // INV-MODEL-1 / G4 protected, independently provenance-backed.
+    max_output_tokens: z.number().int().positive().safe().optional(),
+    max_output_tokens_provenance: z.string().min(1).optional(),
+})
+    .strict()
+    .refine((entry) => entry.context_window_tokens === undefined ||
+    entry.context_window_provenance !== undefined, {
+    message: "context_window_tokens requires context_window_provenance (a window value must cite its source)",
+    path: ["context_window_provenance"],
 })
-    .strict();
+    .refine((entry) => entry.max_output_tokens === undefined ||
+    entry.max_output_tokens_provenance !== undefined, {
+    message: "max_output_tokens requires max_output_tokens_provenance (an output limit must cite its source)",
+    path: ["max_output_tokens_provenance"],
+});
 const SupportedModelRegistrySchema = z
     .object({
     schema_version: z.string().min(1),
     supported_models: z.array(SupportedModelEntrySchema),
 })
-    .strict();
+    .strict()
+    .superRefine((registry, ctx) => {
+    const seen = new Set();
+    registry.supported_models.forEach((entry, index) => {
+        const key = `${entry.provider}\u0000${entry.model}`;
+        if (seen.has(key)) {
+            ctx.addIssue({
+                code: "custom",
+                path: ["supported_models", index],
+                message: `duplicate supported model pair: ${entry.provider}/${entry.model}`,
+            });
+        }
+        seen.add(key);
+    });
+});
+export const RECONSTRUCT_SEMANTIC_MAP_SYNTHESIZE_LLM_ROUTE_PATH = "reconstruct.execution.actors.semantic_map_synthesize.llm";
+export const RECONSTRUCT_DISPATCH_FALLBACK_LLM_ROUTE_PATH = "reconstruct.execution.dispatch_fallback.llm";
+/**
+ * Single owner of dispatch → required-role derivation (design §2.3).
+ * Settings seats without a finer mapping require `author` — the strongest
+ * certification (golden full-pipeline completion) — so a role-restricted entry
+ * can never occupy an unmapped seat (fail-closed default).
+ */
+/** Bounded matcher for the review execution seats (review-role design §3):
+ * the three actor seats (nested and legacy settings forms — the same fixed
+ * actor names the settings schema accepts) and unit overrides restricted to
+ * the KNOWN unit-id vocabulary. The bound is load-bearing: G7 walks raw
+ * parsed YAML without the strict zod layer, so an unknown actor or unit key
+ * DOES reach the resolver — it must fall through to the fail-closed `author`
+ * default, never be adopted as a review seat. Salvage transcription
+ * (`...retry.salvage.transcription_llm`) deliberately does not match. */
+const REVIEW_ACTOR_SEAT_PATH = /^review\.execution\.(?:actors\.)?(?:teamlead|lens|synthesize)\.llm$/;
+const REVIEW_UNIT_SEAT_PATH = /^review\.execution\.units\.([^.[]+)\.llm$/;
+function isReviewSeatPath(path) {
+    if (REVIEW_ACTOR_SEAT_PATH.test(path))
+        return true;
+    const unit = REVIEW_UNIT_SEAT_PATH.exec(path);
+    return unit !== null &&
+        REVIEW_EXECUTION_UNIT_IDS.includes(unit[1]);
+}
+export function requiredSupportedModelRoleForDispatch(dispatch) {
+    if (dispatch.kind === "request_judge")
+        return "answer_support_judge";
+    if (dispatch.kind === "semantic_map_synthesize")
+        return "semantic_map_synthesize";
+    if (dispatch.kind === "semantic_map_verify")
+        return "semantic_map_verify";
+    switch (dispatch.path) {
+        case "reconstruct.execution.actors.semantic_author.llm":
+            return "author";
+        case "reconstruct.execution.actors.confirmation_provider.llm":
+            return "confirmation_provider";
+        case RECONSTRUCT_SEMANTIC_MAP_SYNTHESIZE_LLM_ROUTE_PATH:
+            return "semantic_map_synthesize";
+        default:
+            if (isReviewSeatPath(dispatch.path))
+                return "review";
+            // Salvage transcription, top-level llm, unknown review actor/unit keys,
+            // and any future unmapped path: require the strongest certification
+            // (fail-closed).
+            return "author";
+    }
+}
 /** Locates the authority registry shipped with the install by walking up from
  * this module to the install root's `.onto/authority/` — the same resolver
  * core-lens-registry.yaml uses. The authority is an install resource, not a
@@ -67,12 +202,12 @@ function findSupportedModelsAuthorityPath() {
         "This authority file is the source of truth for selectable models and " +
         "must ship with the onto installation.");
 }
-/** Loads and shape-validates the supported-model registry from the install root.
- * Strict: the authority always ships, so a missing or malformed file is an
- * installation error, not a skip. */
-export function loadSupportedModelRegistry() {
-    const filePath = findSupportedModelsAuthorityPath();
-    const parsed = SupportedModelRegistrySchema.safeParse(parseYaml(fs.readFileSync(filePath, "utf8")));
+/** Shape-validates raw (already-parsed) registry data. The one validation path
+ * both {@link loadSupportedModelRegistry} (disk) and tests use, so the schema
+ * contract — strict shape, positive-int `context_window_tokens`, a window value
+ * only with its provenance — is exercised without touching the install file. */
+export function parseSupportedModelRegistry(raw) {
+    const parsed = SupportedModelRegistrySchema.safeParse(raw);
     if (!parsed.success) {
         throw new Error(`Malformed supported-model registry at ${SUPPORTED_MODELS_AUTHORITY_PATH}: ` +
             parsed.error.issues
@@ -80,8 +215,35 @@ export function loadSupportedModelRegistry() {
                 .join("; "));
     }
     assertRepoRelativeEvidenceRefs(parsed.data);
+    assertContractedRoles(parsed.data);
     return parsed.data;
 }
+/** Fail-closed listable-role check: every role an entry LISTS must have a
+ * defined evidence contract ({@link CONTRACTED_ROLES}). The zod enum admits the
+ * full sealed vocabulary so role names never drift, but a certification without
+ * an evidence contract must not exist — reject at load, not at gate time. */
+export function assertContractedRoles(registry) {
+    const bad = [];
+    for (const entry of registry.supported_models) {
+        for (const role of entry.roles ?? []) {
+            if (!CONTRACTED_ROLES.includes(role)) {
+                bad.push(`${entry.provider}/${entry.model}: ${role}`);
+            }
+        }
+    }
+    if (bad.length > 0) {
+        throw new Error(`Malformed supported-model registry at ${SUPPORTED_MODELS_AUTHORITY_PATH}: ` +
+            "roles lists role(s) without a defined evidence contract (listable roles: " +
+            `${CONTRACTED_ROLES.join(", ")}):\n${bad.map((b) => `  - ${b}`).join("\n")}`);
+    }
+}
+/** Loads and shape-validates the supported-model registry from the install root.
+ * Strict: the authority always ships, so a missing or malformed file is an
+ * installation error, not a skip. */
+export function loadSupportedModelRegistry() {
+    const filePath = findSupportedModelsAuthorityPath();
+    return parseSupportedModelRegistry(parseYaml(fs.readFileSync(filePath, "utf8")));
+}
 /** Validates that every `benchmark_evidence_refs` entry is a repo-relative path
  * (not absolute, no `..` escape), so the cited evidence is an in-repo auditable
  * artifact rather than an out-of-tree file. Pure string check — safe at runtime
@@ -147,13 +309,31 @@ export function collectModelSelections(settings) {
         if (value === null || typeof value !== "object")
             return;
         const record = value;
+        if (trail === RECONSTRUCT_DISPATCH_FALLBACK_LLM_ROUTE_PATH) {
+            const provider = typeof record.provider === "string" ? record.provider : undefined;
+            const model = typeof record.model === "string" ? record.model : undefined;
+            for (const kind of ["semantic_map_synthesize", "semantic_map_verify"]) {
+                out.push({
+                    provider,
+                    model,
+                    path: `${trail}#${kind}`,
+                    requiredRole: requiredSupportedModelRoleForDispatch({ kind }),
+                });
+            }
+            return;
+        }
         if (typeof record.model === "string" || typeof record.provider === "string") {
+            const path = trail || "(root)";
             out.push({
                 provider: typeof record.provider === "string"
                     ? record.provider
                     : undefined,
                 model: typeof record.model === "string" ? record.model : undefined,
-                path: trail || "(root)",
+                path,
+                requiredRole: requiredSupportedModelRoleForDispatch({
+                    kind: "settings_path",
+                    path,
+                }),
             });
         }
         for (const [key, child] of Object.entries(record)) {
@@ -163,37 +343,110 @@ export function collectModelSelections(settings) {
     visit(settings, "");
     return out;
 }
+/** Canonical settings-to-dispatch collector consumed by runtime and G7. */
+export const collectSupportedModelDispatches = collectModelSelections;
+/** Does `entry` cover `role`? Absent `roles` = grandfathered full-route
+ * allowance (covers every role — flat-registry backward compatibility);
+ * present = covers exactly the listed roles. */
+function entryCoversRole(entry, role) {
+    return entry.roles === undefined || entry.roles.includes(role);
+}
+function supportedModelEntryFor(registry, provider, model) {
+    return registry.supported_models.find((entry) => entry.provider === provider && entry.model === model);
+}
+export function supportedModelMaxOutputTokens(registry, provider, model) {
+    return supportedModelEntryFor(registry, provider, model)?.max_output_tokens;
+}
+function isAllowedUnregisteredBenchCandidate(route, registry, options) {
+    if (route.provider === undefined || route.model === undefined)
+        return false;
+    if (supportedModelEntryFor(registry, route.provider, route.model) !== undefined) {
+        return false;
+    }
+    return (options?.benchCandidates ?? []).some((candidate) => candidate.provider === route.provider &&
+        candidate.model === route.model &&
+        candidate.allowedRoutePaths.includes(route.path));
+}
 /** Non-throwing membership check: is (provider, model) a benchmark-verified
- * supported route? Reuses the same verified-pair set as
+ * supported route FOR THIS DISPATCH? Reuses the same registry as
  * {@link assertSupportedModelRoutes}, but returns a boolean so opt-in callers
  * (e.g. the answer-support judge per-stage model override) can DEGRADE to the
  * inherited config when an override is unsupported, instead of failing the run.
- * An unresolved provider or model is not verified. */
-export function isSupportedModelRoute(provider, model, registry) {
+ * The dispatch parameter is REQUIRED (no default) so every caller names its
+ * dispatch and a role-restricted entry can never be adopted at a dispatch it
+ * is not certified for (F6-b leak closure). An unresolved provider or model is
+ * not verified. */
+export function isSupportedModelRoute(provider, model, registry, dispatch) {
     if (provider === undefined || model === undefined)
         return false;
-    return registry.supported_models.some((entry) => entry.provider === provider && entry.model === model);
+    const role = requiredSupportedModelRoleForDispatch(dispatch);
+    const entry = supportedModelEntryFor(registry, provider, model);
+    return entry !== undefined && entryCoversRole(entry, role);
 }
 /** Throws if any effective route is not a benchmark-verified (provider, model)
- * pair. A route whose effective provider OR model could not be resolved is
- * rejected (fail-loud) rather than leniently accepted — the route must resolve
- * to a verified pair, otherwise the runtime would dispatch a route the gate
- * cannot verify. */
-export function assertSupportedModelRoutes(routes, registry) {
-    const verified = new Set(registry.supported_models.map((entry) => `${entry.provider} ${entry.model}`));
-    const violations = routes.filter((route) => route.provider === undefined ||
-        route.model === undefined ||
-        !verified.has(`${route.provider} ${route.model}`));
+ * pair CERTIFIED for the route's required role. A route whose effective
+ * provider OR model could not be resolved is rejected (fail-loud) rather than
+ * leniently accepted — the route must resolve to a verified pair, otherwise
+ * the runtime would dispatch a route the gate cannot verify. A pair that is
+ * registered but role-restricted (entry.roles present) is rejected at any
+ * route whose requiredRole it does not list. */
+export function assertSupportedModelRoutes(routes, registry, options) {
+    const violations = routes.filter((route) => {
+        if (route.provider === undefined || route.model === undefined)
+            return true;
+        const entry = supportedModelEntryFor(registry, route.provider, route.model);
+        if (entry !== undefined)
+            return !entryCoversRole(entry, route.requiredRole);
+        return !isAllowedUnregisteredBenchCandidate(route, registry, options);
+    });
     if (violations.length === 0)
         return;
     const detail = violations
-        .map((route) => `- ${route.path}: ${route.provider ? `${route.provider}/` : "(unresolved provider)/"}${route.model ?? "(unresolved model)"}`)
+        .map((route) => {
+        const pair = `${route.provider ? `${route.provider}/` : "(unresolved provider)/"}${route.model ?? "(unresolved model)"}`;
+        const entry = route.provider !== undefined && route.model !== undefined
+            ? supportedModelEntryFor(registry, route.provider, route.model)
+            : undefined;
+        const reason = entry?.roles
+            ? ` — certified for [${entry.roles.join(", ")}], seat requires ${route.requiredRole}`
+            : "";
+        return `- ${route.path}: ${pair}${reason}`;
+    })
         .join("\n");
     const allowed = registry.supported_models
-        .map((entry) => `${entry.provider}/${entry.model}`)
+        .map((entry) => `${entry.provider}/${entry.model}${entry.roles ? ` (roles: ${entry.roles.join(", ")})` : ""}`)
         .join(", ");
     throw new Error("settings.json selects model route(s) not verified as supported by benchmark " +
         `(see ${SUPPORTED_MODELS_AUTHORITY_PATH}):\n${detail}\n` +
-        `Benchmark-verified selectable models: ${allowed}. Add a model only after ` +
-        "a benchmark record shows it completing a pipeline run.");
+        `Benchmark-verified selectable models: ${allowed}. Add a model (or role) ` +
+        "only with the evidence its contract requires (see the registry header).");
+}
+export function assertB4BenchCandidateDispatchAllowed(args) {
+    const registry = args.registry ?? loadSupportedModelRegistry();
+    const route = {
+        provider: args.provider,
+        model: args.model,
+        path: RECONSTRUCT_SEMANTIC_MAP_SYNTHESIZE_LLM_ROUTE_PATH,
+        requiredRole: requiredSupportedModelRoleForDispatch({
+            kind: "settings_path",
+            path: RECONSTRUCT_SEMANTIC_MAP_SYNTHESIZE_LLM_ROUTE_PATH,
+        }),
+    };
+    try {
+        assertSupportedModelRoutes([route], registry);
+        return { allowance: "registered_supported", route };
+    }
+    catch (error) {
+        if (supportedModelEntryFor(registry, args.provider, args.model) !== undefined) {
+            throw error;
+        }
+    }
+    assertSupportedModelRoutes([route], registry, {
+        benchCandidates: [{
+                provider: args.provider,
+                model: args.model,
+                allowedRoutePaths: [RECONSTRUCT_SEMANTIC_MAP_SYNTHESIZE_LLM_ROUTE_PATH],
+            }],
+    });
+    return { allowance: "bench_candidate", route };
 }

package/dist/core-runtime/discovery/synthesize-cert-assemble.js

@@ -0,0 +1,197 @@
+/**
+ * S7 — `synthesize-cert/v1` record assembly for the B4 bench (design
+ * 20260706-b4-r8-harness-design v3 §9/§15.7).
+ *
+ * Pure projection from the run's real lineage (sampled entries → frozen
+ * packets → judgement rows) into the frozen record contract. The declared
+ * aggregates are filled by CALLING the validator module's own
+ * `computeSynthesizeCertAggregates` (§6.3 parser-ownership: the
+ * declared-vs-recomputed comparison then only fails on post-hoc tampering),
+ * and the negative_arm block comes from the mutation module's single source —
+ * the record can never cite a transform the harness did not run.
+ *
+ * The assembler shape-validates its own output (schema parse, fail-loud) but
+ * does NOT run the semantic recompute: publishing is the orchestrator's gate —
+ * `validateSynthesizeCertRecord(record) === []` AND the capsule binding gate
+ * (synthesize-cert-capsule.ts) must both pass before anything is persisted as
+ * evidence (§9-4). `created_at` is caller-supplied (the harness core stays
+ * deterministic and replayable).
+ */
+import { buildInputCorruptionV1NegativeArm } from "./synthesize-cert-mutation.js";
+import { computeSynthesizeCertAggregates, parseSynthesizeCertRecord, SYNTHESIZE_CERT_ARMS, SYNTHESIZE_CERT_CONTRACT, SynthesizeCertDispatchConfigSchema, } from "./synthesize-cert-record.js";
+/**
+ * record.input_manifest from the sampled entries + their frozen packets.
+ * The packet is the sha AUTHORITY (§4 input_sha256 exists only post-freeze);
+ * every lineage disagreement (missing packet, fixture or facts drift) throws.
+ */
+export function buildSynthesizeCertInputManifest(entries, packets) {
+    const packetByInputId = new Map(packets.map((p) => [p.input_id, p]));
+    return entries.map((entry) => {
+        const packet = packetByInputId.get(entry.input_id);
+        if (!packet) {
+            throw new Error(`synthesize-cert-assemble: sampled input ${entry.input_id} has no frozen packet`);
+        }
+        if (packet.fixture_id !== entry.fixture_id ||
+            packet.deterministic_facts_sha256 !== entry.deterministic_facts_sha256) {
+            throw new Error(`synthesize-cert-assemble: packet lineage for ${entry.input_id} disagrees with its sampled entry (fixture or deterministic facts drift)`);
+        }
+        return {
+            fixture_id: entry.fixture_id,
+            input_id: entry.input_id,
+            input_sha256: packet.input_sha256,
+            stratum: { seam: entry.stratum.seam, merge: entry.stratum.merge },
+        };
+    });
+}
+/**
+ * Pure capture→arm_dispatch projection (effort-witness design §4.5.1-8).
+ * Groups the run's capture lines (parsed live-calls.jsonl objects) by the
+ * three record arm roles — reference/judge lines are not record arms and are
+ * ignored. Line semantics (design §4.5.1-10): a line WITHOUT a `dispatch` key
+ * is a pre-field legacy line = NO EVIDENCE, never normalized to "dispatched
+ * with no knobs" (the sonnet-5 20260708 legacy lines were in fact effort-low
+ * dispatches — that normalization would fabricate a false witness). A line
+ * with `dispatch: {}` IS the witness "no knob on the dispatched config".
+ * All-legacy → { legacy: true }; mixed legacy/new, an empty arm, a malformed
+ * dispatch shape, or within-arm inconsistency → violations (fail-loud).
+ * LIMIT: B4 arms are single-call `synthesizeSemanticMapNode` seats today; if
+ * a future arm adds base-effort verify calls, per-arm consistency must gain a
+ * call-kind axis or it will false-throw on a legitimate mix (design §4.5.1-11).
+ */
+export function projectSynthesizeCertArmDispatch(captureLines) {
+    const byArm = new Map(SYNTHESIZE_CERT_ARMS.map((arm) => [arm, []]));
+    for (const raw of captureLines) {
+        if (typeof raw !== "object" || raw === null)
+            continue;
+        const line = raw;
+        const role = line.role;
+        if (typeof role !== "string" || !byArm.has(role))
+            continue;
+        byArm.get(role).push({
+            seq: line.seq,
+            dispatch: line.dispatch,
+            hasKey: Object.hasOwn(line, "dispatch"),
+        });
+    }
+    const armLineTotal = [...byArm.values()].reduce((n, lines) => n + lines.length, 0);
+    const legacyTotal = [...byArm.values()].reduce((n, lines) => n + lines.filter((l) => !l.hasKey).length, 0);
+    if (armLineTotal > 0 && legacyTotal === armLineTotal) {
+        return { armDispatch: null, legacy: true, violations: [] };
+    }
+    const violations = [];
+    const armDispatch = {};
+    for (const arm of SYNTHESIZE_CERT_ARMS) {
+        const lines = byArm.get(arm);
+        if (lines.length === 0) {
+            violations.push(`arm ${arm}: no captured calls — a declared dispatch without witness is not certifiable`);
+            continue;
+        }
+        let witnessed = null;
+        for (const line of lines) {
+            if (!line.hasKey) {
+                violations.push(`arm ${arm}: capture line seq=${String(line.seq)} predates the dispatch witness (mixed legacy/new capture — no evidence line in a witnessing run)`);
+                continue;
+            }
+            const parsed = SynthesizeCertDispatchConfigSchema.safeParse(line.dispatch);
+            if (!parsed.success) {
+                violations.push(`arm ${arm}: capture line seq=${String(line.seq)} carries a malformed dispatch witness: ${parsed.error.issues.map((i) => i.message).join("; ")}`);
+                continue;
+            }
+            if (witnessed === null) {
+                witnessed = parsed.data;
+            }
+            else if (witnessed.reasoning_effort !== parsed.data.reasoning_effort ||
+                witnessed.thinking_mode !== parsed.data.thinking_mode) {
+                violations.push(`arm ${arm}: inconsistent dispatch within one arm (${JSON.stringify(witnessed)} vs ${JSON.stringify(parsed.data)} at seq=${String(line.seq)})`);
+            }
+        }
+        if (witnessed !== null)
+            armDispatch[arm] = witnessed;
+    }
+    if (violations.length > 0)
+        return { armDispatch: null, legacy: false, violations };
+    return {
+        armDispatch: armDispatch,
+        legacy: false,
+        violations: [],
+    };
+}
+/**
+ * Pure declared-vs-witnessed dispatch guard (effort-witness design §3 verify +
+ * §4.5.1-9). Compares the preflight DECLARATION against the capture WITNESS
+ * knob-by-knob per arm, plus two deterministic realization-boundary rules
+ * keyed on each arm's DECLARED provider brand:
+ *  (a) an openai(codex-route) arm must witness a present `reasoning_effort` —
+ *      a knobless codex dispatch inherits an unobservable host-TOML effort and
+ *      is not certifiable as any effort;
+ *  (b) no arm may witness `reasoning_effort` and `thinking_mode` together —
+ *      the anthropic route ignores effort once thinking is disabled, so that
+ *      certification claim would be unrealized.
+ * Returns violation strings; empty = the certified dispatch is the dispatched
+ * dispatch.
+ */
+export function synthesizeCertDispatchGuardViolations(args) {
+    const violations = [];
+    for (const arm of SYNTHESIZE_CERT_ARMS) {
+        const declared = args.declared[arm];
+        const witnessed = args.witnessed[arm];
+        if (declared.reasoning_effort !== witnessed.reasoning_effort) {
+            violations.push(`arm ${arm}: declared reasoning_effort=${declared.reasoning_effort ?? "(absent)"} but witnessed ${witnessed.reasoning_effort ?? "(absent)"}`);
+        }
+        if (declared.thinking_mode !== witnessed.thinking_mode) {
+            violations.push(`arm ${arm}: declared thinking_mode=${declared.thinking_mode ?? "(absent)"} but witnessed ${witnessed.thinking_mode ?? "(absent)"}`);
+        }
+        if (args.armProviders[arm] === "openai" && witnessed.reasoning_effort === undefined) {
+            violations.push(`arm ${arm}: openai(codex-route) arm witnessed NO reasoning_effort — the worker would inherit an unobservable host-TOML effort; declare and dispatch an explicit effort`);
+        }
+        if (witnessed.reasoning_effort !== undefined && witnessed.thinking_mode !== undefined) {
+            violations.push(`arm ${arm}: witnessed BOTH reasoning_effort and thinking_mode — the anthropic route ignores effort once thinking is disabled, so this certification claim would be unrealized`);
+        }
+    }
+    return violations;
+}
+export function assembleSynthesizeCertRecord(args) {
+    const inputManifest = buildSynthesizeCertInputManifest(args.entries, args.packets);
+    const judgementRows = [...args.judgementRows];
+    const negative = buildInputCorruptionV1NegativeArm(args.mutationSeed);
+    const record = {
+        record_contract: SYNTHESIZE_CERT_CONTRACT,
+        created_at: args.createdAt,
+        provider: args.candidateModel.provider,
+        model: args.candidateModel.model,
+        declared_reps: args.declaredReps,
+        arm_prompt_sha256: {
+            baseline: args.promptSha256,
+            candidate: args.promptSha256,
+            negative_control: args.promptSha256,
+        },
+        arm_model: {
+            baseline: { provider: args.baselineModel.provider, model: args.baselineModel.model },
+            candidate: { provider: args.candidateModel.provider, model: args.candidateModel.model },
+            negative_control: {
+                provider: args.candidateModel.provider,
+                model: args.candidateModel.model,
+            },
+        },
+        ...(args.armDispatch !== undefined ? { arm_dispatch: args.armDispatch } : {}),
+        negative_arm: negative,
+        input_manifest: inputManifest,
+        judgement_rows: judgementRows,
+        declared_aggregates: computeSynthesizeCertAggregates({
+            inputManifest,
+            judgementRows,
+        }),
+        reproduction: {
+            command: args.reproduction.command,
+            source_paths: [...args.reproduction.source_paths],
+            limitations: args.reproduction.limitations,
+        },
+    };
+    const parsed = parseSynthesizeCertRecord(record);
+    if (!parsed.record) {
+        throw new Error(`synthesize-cert-assemble: assembled record failed the contract schema — ${parsed.violations
+            .map((v) => v.message)
+            .join("; ")}`);
+    }
+    return parsed.record;
+}