onto-mcp 0.4.12 → 0.4.13

package/dist/core-runtime/reconstruct/mock-llm-realization.js

@@ -3,6 +3,44 @@ import { ontologySeedClaimProjections } from "./seed-claim-projections.js";
 export const RECONSTRUCT_MOCK_REALIZATION_ENV = REVIEW_MOCK_REALIZATION_ENV;
 export const RECONSTRUCT_MOCK_AUTHOR_ID = "reconstruct-mock-semantic-author";
 export const RECONSTRUCT_MOCK_CONFIRMATION_PROVIDER_ID = "reconstruct-mock-confirmation-provider";
+/**
+ * Layer-2 semantic-map author capability — MOCK realization (wiring design 20260702 §7-W5).
+ *
+ * Wraps a directive author with the deterministic capability PAIR (the production direct-call
+ * author deliberately does NOT implement it — real-LLM authoring is a separate owner-approved
+ * cut, so the live path stays default-off). Pure functions of their input:
+ *  - synthesize: one boundary at the node's first value-shape seam when one exists (reconciled
+ *    anchored) plus ALWAYS one at row_start — emission is unconditional; the deterministic
+ *    reconcile CLASSIFIES it (unanchored → adversarial verify path — whenever no seam lies
+ *    within ±1 of row_start, which holds for every non-seam-adjacent region start);
+ *  - verify: confirmed on even rows, refuted on odd (exercises kept AND disclosed dispositions).
+ * The two-path description above is the mock's FUNCTION CONTRACT given seam-ful input; the W5
+ * E2E fixture is seam-less through the production observer (adversary F1, probe-confirmed), so
+ * the E2E itself traverses only the unanchored→refuted path — anchored/confirmed execution
+ * coverage lives in semantic-map-stage.test.ts.
+ * Mock output verifies wiring/contracts only — never product semantic quality.
+ */
+export function withMockSemanticMapCapability(author) {
+    return {
+        ...author,
+        async synthesizeSemanticMapNode(input) {
+            const seam = input.value_shape_seams[0];
+            return {
+                semantic_summary: `mock ${input.node_ref.sheet}#${input.node_ref.column_index}:` +
+                    `${input.node_ref.row_start}-${input.node_ref.row_end} kids=${input.child_summaries.length}`,
+                boundaries: [
+                    ...(seam
+                        ? [{ row: seam.row, character_before: "seam-prev", character_after: "seam-next" }]
+                        : []),
+                    { row: input.node_ref.row_start, character_before: "prev", character_after: "next" },
+                ],
+            };
+        },
+        async verifySemanticMapBoundary(input) {
+            return input.boundary.row % 2 === 0 ? "adversarial_confirmed" : "adversarial_refuted";
+        },
+    };
+}
 export function isReconstructMockLlmRealizationEnabled(env = process.env) {
     return env[RECONSTRUCT_MOCK_REALIZATION_ENV] === "1";
 }
@@ -805,9 +843,38 @@ export function callReconstructMockLlm(systemPrompt, userPrompt) {
         });
     }
     else if (systemPrompt.includes("Author answer-support-ledger.yaml")) {
-        text = JSON.stringify({
-            evidence_clusters: [],
-        });
+        // Defect-3 G4: derive a deterministic direct_authority cluster from the
+        // prompt's frontier questions + prompt-visible observations. With the shared
+        // empty-frontier mock (questions:[]) this yields [] so the ~12 full-pipeline
+        // completion tests are unaffected; a non-empty-frontier fixture exercises the
+        // real G1/G2/G3 per-evidence-ref path (the path the empty mock hid).
+        const frontierQuestions = (input.questions ?? []);
+        const promptVisibleObservationIds = (input.prompt_visible_observation_ids ?? []);
+        const questionRefs = frontierQuestions
+            .map((question) => question.question_id)
+            .filter((id) => typeof id === "string" && id.length > 0);
+        if (questionRefs.length === 0 || promptVisibleObservationIds.length === 0) {
+            text = JSON.stringify({ evidence_clusters: [] });
+        }
+        else {
+            text = JSON.stringify({
+                evidence_clusters: [
+                    {
+                        evidence_cluster_id: "mock-evidence-cluster-1",
+                        question_refs: questionRefs,
+                        support_mode: "direct_authority",
+                        proposed_answer_summary: "Mock direct-authority support derived from the observed runtime-target source.",
+                        evidence_observation_ids: [promptVisibleObservationIds[0]],
+                        proof_refs: [],
+                        user_confirmation_refs: [],
+                        authority_response_refs: [],
+                        independence_basis: "Deterministic mock structural observation of the runtime-target source.",
+                        contradiction_refs: [],
+                        limitation_refs: [],
+                    },
+                ],
+            });
+        }
     }
     else if (systemPrompt.includes("Author answer-support-judgment.yaml")) {
         // Mirrors the judge author payload shape: per-cluster
@@ -834,6 +901,43 @@ export function callReconstructMockLlm(systemPrompt, userPrompt) {
             expansions: [],
         });
     }
+    else if (systemPrompt.includes("Read provisional column labels for a low-confidence")) {
+        // P1-C2-A §11 R10 / P1-C2-B′ §3: the leaf-reader (CAPTURE) fixture branch. Returns one
+        // provisional label per known column PLUS a deterministic capture (role/note) so the generalized
+        // capture path is exercised. The mock model_id is a constant ("reconstruct-mock-model" in the
+        // result below), so the model-identity-rotation test must mutate the PRODUCTION LlmCallConfig,
+        // never this constant (avoids CG-2 contamination).
+        const columns = (input.columns ?? []);
+        // Deterministic role rotation across the bounded vocabulary (mock only — no domain meaning).
+        const mockRoles = ["category", "measure", "identifier", "free_text", "reference"];
+        text = JSON.stringify({
+            labels: columns.map((column, i) => ({
+                column_index: column.column_index,
+                tentative_label: `provisional column ${column.column_index}`,
+                semantic_role: mockRoles[i % mockRoles.length],
+                captured_note: `mock capture for column ${column.column_index}`,
+            })),
+            unread_columns: [],
+        });
+    }
+    else if (systemPrompt.includes("Select spreadsheet cell locations")) {
+        // Maturation value-read location pick (design §15.4). Echo the FIRST allowed grid scope so an
+        // incidental value-read exercises the cell-read path; an empty allowed set yields no pick (honest).
+        const allowed = (input.allowed_locations ?? []);
+        text = JSON.stringify({
+            picked_locations: allowed.length > 0 ? [allowed[0]] : [],
+        });
+    }
+    else if (systemPrompt.includes("Judge whether read spreadsheet cell values")) {
+        // Value-read judgment (design §15.4). Default INCONCLUSIVE so an incidental value-read in an
+        // existing full mock run discharges nothing (regression-0 / byte-parity — never flips a row to
+        // value_resolved). A dedicated value-read E2E drives `satisfied` via a stub llmCall, not this
+        // dispatcher. Honest "ran but discharged zero".
+        text = JSON.stringify({
+            satisfaction_status: "inconclusive",
+            rationale: "mock value-read judgment: read values do not decide the limitation",
+        });
+    }
     else if (systemPrompt.includes("writing the final reconstruct result")) {
         text = [
             "# Reconstruct Result",

package/dist/core-runtime/reconstruct/obligation-assertion.js

@@ -0,0 +1,18 @@
+/**
+ * G(a) — obligation recorder (INV-OBLIGATION-COVERAGE-1).
+ *
+ * A validator calls `assertObligation(acc, id)` at an UNCONDITIONAL position before each
+ * check-block's guard, accumulating the obligation ids whose enforcer block was reached.
+ * The accumulator is emitted as `asserted_obligation_ids: string[]` on the validation
+ * artifact (off the reuse-hash five). The obligation-coverage harvest test re-derives this
+ * set dynamically (deleting the call reds the harvest) and the gate proves every active
+ * `(validator_id, obligation_id)` is either recorded here or parked in the pending ledger.
+ *
+ * Scope honesty: this records that control REACHED the enforcer block — NOT that the
+ * enforcer is semantically correct. Idempotent: a repeat id is not pushed twice.
+ */
+export function assertObligation(asserted, obligationId) {
+    if (!asserted.includes(obligationId)) {
+        asserted.push(obligationId);
+    }
+}

package/dist/core-runtime/reconstruct/ontology-seed-validation.js

@@ -3,6 +3,7 @@ import path from "node:path";
 import { parse as parseYaml } from "yaml";
 import { assertArrayField, atomicWriteYamlDocument as writeYamlDocument } from "../artifact-io.js";
 import { loadReconstructContractRegistry, } from "./contract-registry.js";
+import { assertObligation } from "./obligation-assertion.js";
 function isoNow() {
     return new Date().toISOString();
 }
@@ -199,6 +200,17 @@ function candidateValidationViolation(args) {
 export function validateCandidateDisposition(args) {
     assertArrayField(args.sourceObservations.observations, "source-observations", "observations");
     const violations = [];
+    // G(a) obligation recorder (INV-OBLIGATION-COVERAGE-1): record that control reached the
+    // per-candidate / per-disposition enforcement loops below. Unconditional, before any per-row
+    // guard so a zero-candidate/zero-disposition input still stamps. Only the four obligations with a
+    // distinct, name-matching enforcer are recorded; salience-scoped and surface/purpose/limitation/
+    // frontier obligations are PARKED (this validator is salience-blind and takes no purpose-frame or
+    // surface input) — see obligation-coverage-ledger.yaml.
+    const assertedObligationIds = [];
+    assertObligation(assertedObligationIds, "validate_candidate_inventory_candidate_kind_against_candidate_kind_registry");
+    assertObligation(assertedObligationIds, "validate_candidate_disposition_against_candidate_disposition_registry");
+    assertObligation(assertedObligationIds, "require_rationale_and_evidence_refs_for_each_disposition");
+    assertObligation(assertedObligationIds, "validate_promoted_candidate_target_seed_refs_are_declared_for_promoted_dispositions");
     const addShapeViolation = (_code, message) => {
         violations.push(candidateValidationViolation({
             code: "schema_shape_invalid",
@@ -387,6 +399,7 @@ export function validateCandidateDisposition(args) {
         validation_results: violations.length === 0
             ? ["candidate_disposition_valid"]
             : ["candidate_disposition_invalid"],
+        asserted_obligation_ids: assertedObligationIds,
         violations,
     };
 }
@@ -737,6 +750,19 @@ export function validateOntologySeed(args) {
     const addShapeViolation = (_code, message) => {
         violations.push(seedValidationViolation({ code: "schema_shape_invalid", message }));
     };
+    // G(a) slice 26: record the six obligations this validator FULLY enforces with a distinct,
+    // name-matching site (stamped before the per-root/per-row guards so a zero-row seed still records).
+    // Parked (see obligation-coverage-ledger.yaml notes): surface_dimension_closure / closure_status /
+    // mixed-member-lineage / dynamic_boundaries name fields this function never reads; the three
+    // purpose-projection/confirmation obligations are activation_gated_dormant (their conditional inputs
+    // — source-purpose-candidates-validation / purpose-confirmation-validation — are never received here).
+    const assertedObligationIds = [];
+    assertObligation(assertedObligationIds, "require_static_kinetic_dynamic_actionability_coverage_axes");
+    assertObligation(assertedObligationIds, "validate_purpose_required_element_seed_ref_refs_against_known_seed_refs");
+    assertObligation(assertedObligationIds, "validate_promoted_candidate_target_seed_refs_are_realized");
+    assertObligation(assertedObligationIds, "validate_instance_assertion_mapping_status");
+    assertObligation(assertedObligationIds, "require_limitation_ref_when_instance_availability_status_is_absent_or_unknown");
+    assertObligation(assertedObligationIds, "require_ready_ontology_handoff_mappings_to_have_substantive_content_or_limitation_refs");
     const seed = readRecord(args.ontologySeed, "ontology_seed", addShapeViolation);
     const disposition = readRecord(args.candidateDisposition, "candidate_disposition", addShapeViolation);
     const sessionId = optionalString(disposition?.session_id) ??
@@ -1914,6 +1940,7 @@ export function validateOntologySeed(args) {
         validation_results: violations.length === 0
             ? ["ontology_seed_valid"]
             : ["ontology_seed_invalid"],
+        asserted_obligation_ids: assertedObligationIds,
         violations,
     };
 }

package/dist/core-runtime/reconstruct/output-budget.js

@@ -0,0 +1,6 @@
+export const RECONSTRUCT_SEMANTIC_AUTHOR_OUTPUT_CEILINGS = {
+    candidate_disposition: 4_000,
+    ontology_seed: 9_000,
+    json_parse_repair: 16_000,
+};
+export const RECONSTRUCT_SEMANTIC_AUTHOR_MAX_BASE_OUTPUT_TOKENS = Math.max(...Object.values(RECONSTRUCT_SEMANTIC_AUTHOR_OUTPUT_CEILINGS));

package/dist/core-runtime/reconstruct/pipeline-execution-ledger.js

@@ -3,6 +3,7 @@ import path from "node:path";
 import { parse as parseYaml } from "yaml";
 import { PIPELINE_EXECUTION_LEDGER_SCHEMA_VERSION, buildLedgerTrust, buildOutputHashes, isTrustedLedgerUnit, normalizeLedgerRefs, } from "../pipeline-execution-ledger.js";
 import { terminalFailureMessageFromTelemetry } from "./execution-telemetry.js";
+import { DispatchFallbackOutcomeSchema, projectDispatchFallbackRecordBlock, } from "./dispatch-fallback-artifacts.js";
 const RECONSTRUCT_LEDGER_STAGE_SPECS = [
     {
         unitId: "run_control",
@@ -193,6 +194,23 @@ const RECONSTRUCT_LEDGER_STAGE_SPECS = [
             "source_observation_reentry_validation",
         ],
     },
+    {
+        // Layer-2 semantic_map stage (W3 review: codex W3-002 ≡ onto issue-001/002/006 — 4-lens
+        // convergence on audit-graph registration). The LIVE run does not consume this ledger (it is a
+        // post-hoc audit projection derived from the record), so this row is descriptive evidence, not
+        // continuation authority. Authored-artifact reuse still folds the stage fingerprint into the
+        // seed key; breaker recovery is stage-local and consumes dispatch-incomplete.yaml only after
+        // semantic-map-resume-validation.yaml validates retained census/sidecar rows. unitKind is NOT
+        // "semantic_map" — that kind name is already taken by claim_realization (pre-existing vocabulary
+        // collision).
+        unitId: "semantic_map",
+        unitKind: "semantic_map_accumulation",
+        owner: "host_llm",
+        artifactKey: "semantic_map_census",
+        // DATA dependency (ultracode audit E: the earlier lineage-validation edge was a false/temporal
+        // edge — the stage reads source_observations' inventory tiles, nothing from the lineage index).
+        upstreamUnitIds: ["source_observation"],
+    },
     {
         unitId: "source_purpose_candidates",
         unitKind: "semantic_source_purpose",
@@ -286,6 +304,16 @@ const RECONSTRUCT_LEDGER_STAGE_SPECS = [
         artifactKey: "seed_authoring_readiness_validation",
         upstreamUnitIds: ["seed_authoring_readiness"],
     },
+    {
+        // M3c: runtime snapshot of the pre-maturation seed-stage projected observations,
+        // captured at the seed-authoring gate; the conserved authority the resume truncation
+        // fallback measures. Runtime-owned, derived from the source-observation unit.
+        unitId: "seed_stage_prompt_source_observations",
+        unitKind: "source_observation_snapshot",
+        owner: "runtime",
+        artifactKey: "seed_stage_prompt_source_observations",
+        upstreamUnitIds: ["source_observation", "seed_authoring_readiness_validation"],
+    },
     {
         unitId: "ontology_seed",
         unitKind: "semantic_ontology_seed",
@@ -633,6 +661,7 @@ const RECONSTRUCT_LEDGER_STAGE_SPECS = [
             "baseline_actionability_matrix_validation",
             "maturation_answer_claims_validation",
             "ontology_expansion_validation",
+            "maturation_question_frontier_validation",
         ],
     },
     {
@@ -645,6 +674,7 @@ const RECONSTRUCT_LEDGER_STAGE_SPECS = [
             "maturation_baseline_validation",
             "maturation_answer_claims_validation",
             "ontology_expansion_validation",
+            "maturation_question_frontier_validation",
         ],
     },
     {
@@ -842,6 +872,19 @@ const RECONSTRUCT_LEDGER_STAGE_SPECS = [
         upstreamUnitIds: ["record_assembly"],
     },
 ];
+export function reconstructStageIdForArtifactRef(artifactRef) {
+    const artifactKey = path.basename(artifactRef, path.extname(artifactRef))
+        .replaceAll("-", "_");
+    return RECONSTRUCT_LEDGER_STAGE_SPECS.find((spec) => spec.artifactKey === artifactKey)?.unitId ?? null;
+}
+export function reconstructStageOwner(stageId) {
+    const owner = RECONSTRUCT_LEDGER_STAGE_SPECS.find((spec) => spec.unitId === stageId)?.owner;
+    if (owner === "runtime" || owner === "host_llm")
+        return owner;
+    if (owner === "user_or_host_mediated")
+        return "host_or_user";
+    return null;
+}
 const VALIDATION_GATE_BY_AUTHORED_UNIT = new Map([
     ["observation_directive", "observation_directive_validation"],
     ["source_frontier", "source_frontier_validation"],
@@ -1093,6 +1136,31 @@ export async function buildReconstructPipelineExecutionLedger(params) {
             }),
         ]),
     ]));
+    const dispatchFallback = params.reconstructRecord.dispatch_fallback;
+    if (dispatchFallback) {
+        const semanticMapManifestStep = manifestStepByUnitId.get("semantic_map");
+        if (!semanticMapManifestStep?.artifact_refs.includes(dispatchFallback.outcome_ref)) {
+            throw new Error("dispatch fallback record/manifest mismatch: semantic_map step must consume the completed outcome ref.");
+        }
+        const parsedOutcome = DispatchFallbackOutcomeSchema.safeParse(parseYaml(await fs.readFile(dispatchFallback.outcome_ref, "utf8")));
+        if (!parsedOutcome.success || parsedOutcome.data.status !== "completed") {
+            throw new Error("dispatch fallback record/ledger mismatch: outcome artifact is not a valid completed canonical outcome.");
+        }
+        const canonicalBlock = projectDispatchFallbackRecordBlock({
+            outcome: parsedOutcome.data,
+            outcomeIntegrity: {
+                path: dispatchFallback.outcome_ref,
+                sha256: dispatchFallback.outcome_sha256,
+            },
+        });
+        if (Object.entries(canonicalBlock).some(([key, value]) => JSON.stringify(dispatchFallback[key]) !== JSON.stringify(value))) {
+            throw new Error("dispatch fallback record/ledger mismatch: record block is not the canonical outcome projection.");
+        }
+        artifactRefsByUnitId.set("semantic_map", normalizeLedgerRefs([
+            ...(artifactRefsByUnitId.get("semantic_map") ?? []),
+            dispatchFallback.outcome_ref,
+        ]));
+    }
     const sourceDeltaFrontierKind = await sourceObservationDeltaFrontierKind(artifactRefsByUnitId.get("source_observation_delta") ?? []);
     const sourceObservationReentryPresent = (artifactRefsByUnitId.get("source_observation_reentry_validation") ?? [])
         .length > 0;
@@ -1111,6 +1179,12 @@ export async function buildReconstructPipelineExecutionLedger(params) {
         const outputRefs = artifactRefsByUnitId.get(spec.unitId) ?? [];
         const outputHashes = await buildOutputHashes(outputRefs);
         outputHashesByUnitId.set(spec.unitId, outputHashes);
+        if (spec.unitId === "semantic_map" &&
+            dispatchFallback &&
+            outputHashes[dispatchFallback.outcome_ref] !==
+                dispatchFallback.outcome_sha256) {
+            throw new Error("dispatch fallback record/ledger mismatch: outcome file hash does not match the completed record block.");
+        }
         if (spec.unitKind === "runtime_validation") {
             validationStatusesByUnitId.set(spec.unitId, await runtimeValidationOutputStatus(outputRefs));
         }
@@ -1137,12 +1211,22 @@ export async function buildReconstructPipelineExecutionLedger(params) {
                 }
                 return trustedUnitIds.has(unitId);
             });
+            // Pre-stage sessions (ultracode audit E, read-path): when a manifest IS provided but carries
+            // NO step for this unit, the run predates the unit's registration — the terminal validator
+            // (manifest_step_missing, W3-004) forces every CURRENT manifest to carry every stage, so an
+            // absent step can only mean "this run never had the stage". Reporting it "missing" would raise
+            // a false defect signal on every historical session each time a stage is added.
+            const predatesUnit = params.reconstructRunManifest != null &&
+                manifestStatus(params.reconstructRunManifest, spec.unitId) == null &&
+                !manifestStepByUnitId.has(spec.unitId);
             const status = manifestStatus(params.reconstructRunManifest, spec.unitId) ??
                 (outputPresent
                     ? "completed"
-                    : upstreamTrusted
-                        ? "missing"
-                        : "not_reached");
+                    : predatesUnit
+                        ? "not_reached"
+                        : upstreamTrusted
+                            ? "missing"
+                            : "not_reached");
             const trust = trustForReconstructUnit({
                 spec,
                 status,

package/dist/core-runtime/reconstruct/post-seed-validation.js

@@ -2,6 +2,7 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { parse as parseYaml } from "yaml";
 import { atomicWriteYamlDocument as writeYamlDocument } from "../artifact-io.js";
+import { assertObligation } from "./obligation-assertion.js";
 import { ontologySeedClaimProjections, ontologySeedExcludedClaimIds, } from "./seed-claim-projections.js";
 import { collectOntologySeedRefs } from "./ontology-seed-validation.js";
 import { loadReconstructContractRegistry, } from "./contract-registry.js";
@@ -78,6 +79,16 @@ const REVISION_ACTIONS = [
     "reject",
     "defer",
 ];
+// Shared revision-proposal predicates (M4: one blocker predicate used identically at the
+// stop gate (run.ts) and the continuation gate (maturation-validation.ts); both import from
+// here, the revision-proposal concept owner, so the two gates cannot drift). reject|defer
+// block continuation/stop; every non-reuse proposal is disclosed.
+export function isRevisionBlocker(proposal) {
+    return proposal.action === "reject" || proposal.action === "defer";
+}
+export function isRevisionDisclosed(proposal) {
+    return proposal.action !== "reuse";
+}
 function isoNow() {
     return new Date().toISOString();
 }
@@ -163,7 +174,7 @@ function seedLimitationIds(seed) {
         .map((record) => stringField(record, "limitation_id"))
         .filter((id) => id !== null));
 }
-function knownSeedRefs(seed) {
+export function knownSeedRefs(seed) {
     if (!seed)
         return new Set();
     const refs = collectOntologySeedRefs(seed);
@@ -564,6 +575,14 @@ function validateClaimRealizationMapAgainstClaims(args) {
     const seen = new Set();
     const stanceCounts = initCountMap(CLAIM_REALIZATION_STANCES);
     const observations = observationsById(args.sourceObservations);
+    // G(a) slice 7: record the three claim-realization obligations before the per-realization loop so
+    // they are proven wired on a zero-realization map. Each was audited to a distinct enforcement region
+    // (no laundering): require_exactly_one = duplicate_id (in-loop) + missing_required_coverage (the
+    // coverage loop below); claim_ids = unknown_id; evidence_refs = validateEvidenceRef vs source obs.
+    const assertedObligationIds = [];
+    assertObligation(assertedObligationIds, "require_exactly_one_realization_for_each_seed_claim");
+    assertObligation(assertedObligationIds, "validate_realization_claim_ids_against_ontology_seed_claim_ids");
+    assertObligation(assertedObligationIds, "validate_realization_evidence_refs_against_source_observations");
     for (const realization of args.claimRealizationMap.claim_realizations) {
         const subjectId = realization.claim_id;
         if (seen.has(subjectId)) {
@@ -636,6 +655,7 @@ function validateClaimRealizationMapAgainstClaims(args) {
         validation_results: violations.length === 0
             ? ["claim_realization_map_valid"]
             : ["claim_realization_map_invalid"],
+        asserted_obligation_ids: assertedObligationIds,
         violations,
     };
 }
@@ -891,6 +911,41 @@ export function validateCompetencyQuestionsForOntologySeed(args) {
 }
 function validateCompetencyQuestionsAgainstEligibleClaims(args) {
     const violations = [];
+    // G(a) slice 27: record the 9 obligations this validator FULLY enforces with a distinct,
+    // name-matching site. These are the REF-RESOLUTION obligations ("validate X refs against/close-to
+    // authority Y" — every PRESENT ref must resolve to its registry/seed/manifest authority), plus
+    // question-id uniqueness and the exactly-one admitted-competency disposition rule. Authority-backed
+    // stamps are GATED on the authoritative input being supplied (codex #142 R1): the thin
+    // validateCompetencyQuestions path passes no registry/seed/governing-snapshot, so a zero-question
+    // artifact must NOT claim those obligations were enforced against an absent authority. Each stamp is
+    // before the per-question loop so a zero-question set still records once the authority is present; the
+    // enforcement code always runs, only the stamp is gated.
+    // Parked (see obligation-coverage-ledger.yaml notes): emit_required_evidence_scope (PROJECTION_ONLY);
+    // classification_level_axis / hidden_label facet coverage (NOT_FOUND — fields absent); p3-diagnostic
+    // (no code); query/visualization/graph refs (presence-only — codex #142 R1); and — codex #142 R2 — the
+    // 8 *_facet_coverage obligations (presence-only: resolve present facets but never require facets when
+    // the axis is applicable) and validate_required_ontology_handoff_axis_coverage_or_limitation_backed_
+    // disposition (counts inactive/unsupported questions as coverage; no active/limitation-backed filter).
+    const assertedObligationIds = [];
+    // Pure question-set check — enforceable with no external authority.
+    assertObligation(assertedObligationIds, "require_unique_question_id");
+    // Registry-backed ref resolution — only when the contract registry authority is supplied.
+    if (args.contractRegistry) {
+        assertObligation(assertedObligationIds, "validate_coverage_axes_against_coverage_axis_registry");
+        assertObligation(assertedObligationIds, "validate_ontology_handoff_axes_against_ontology_handoff_axis_registry");
+        assertObligation(assertedObligationIds, "validate_reference_standard_refs_against_reference_standard_registry");
+        assertObligation(assertedObligationIds, "validate_pattern_catalog_refs_against_reference_pattern_catalog_registry");
+    }
+    // Seed-backed closure — only when the ontology seed authority is supplied.
+    if (args.ontologySeed) {
+        assertObligation(assertedObligationIds, "validate_seed_ref_refs_close_against_known_seed_refs");
+        assertObligation(assertedObligationIds, "validate_limitation_refs_close_against_handoff_limitations");
+    }
+    // Run-manifest governing-snapshot authority — only when the snapshot is supplied.
+    if (args.governingSnapshot) {
+        assertObligation(assertedObligationIds, "validate_domain_competency_trace_refs_against_run_manifest_context_snapshot");
+        assertObligation(assertedObligationIds, "enforce_admitted_domain_competency_disposition_rule");
+    }
     const normalizedCompetencyQuestions = normalizeCompetencyQuestionsAtBoundary(args.competencyQuestions);
     violations.push(...normalizedCompetencyQuestions.violations);
     const eligibleClaims = new Set(args.eligibleClaimIds);
@@ -1275,11 +1330,36 @@ function validateCompetencyQuestionsAgainstEligibleClaims(args) {
         validation_results: violations.length === 0
             ? ["competency_questions_valid"]
             : ["competency_questions_invalid"],
+        asserted_obligation_ids: assertedObligationIds,
         violations,
     };
 }
 export function validateCompetencyQuestionAssessment(args) {
     const violations = [];
+    // G(a) slice 12: record the three obligations with a distinct, name-matching enforcement site,
+    // stamped unconditionally before the per-assessment / per-question loops so they fire on a
+    // zero-assessment artifact:
+    //   - require_exactly_one_assessment_per_authoritative_question (duplicate_id on a repeat +
+    //     missing_required_coverage when a question has no assessment → exactly one).
+    //   - validate_downstream_effect_consistent_with_answer_status (downstream_effect must equal
+    //     expectedDownstreamEffect(answer_status): invalid_enum).
+    //   - validate_required_seed_refs_close_against_question_seed_refs (bidirectional closure:
+    //     unknown_id for a ref outside the question, missing_required_coverage for a missing one).
+    // PARKED (not recorded), name broader than code — honest declared≠wired, NOT laundered (see
+    // obligation-coverage-ledger.yaml notes):
+    //   - validate_answer_status_against_active_answerability_contract: the validator checks enum
+    //     validity + per-status STRUCTURAL requirements (answerable→evidence_refs/required_seed_refs,
+    //     unsupported/deferred→missing_source_or_confirmation), but never verifies the answer_status
+    //     reflects actual answerability from evidence CONTENT — the answerability judgment is the
+    //     content-blind host-LLM step, not validated here.
+    //   - validate_answerability_trace_refs_close_against_seed_evidence_limitations_and_proofs: there
+    //     is no answerability_trace_refs / limitation_refs / proof_refs field; the validator closes
+    //     only evidence_refs and required_seed_refs (the latter already recorded above), never
+    //     limitations or proofs.
+    const assertedObligationIds = [];
+    assertObligation(assertedObligationIds, "require_exactly_one_assessment_per_authoritative_question");
+    assertObligation(assertedObligationIds, "validate_downstream_effect_consistent_with_answer_status");
+    assertObligation(assertedObligationIds, "validate_required_seed_refs_close_against_question_seed_refs");
     const questionIds = new Set(args.competencyQuestions.questions.map((question) => question.question_id));
     const questionById = new Map(args.competencyQuestions.questions.map((question) => [
         question.question_id,
@@ -1454,6 +1534,7 @@ export function validateCompetencyQuestionAssessment(args) {
         validation_results: violations.length === 0
             ? ["competency_question_assessment_valid"]
             : ["competency_question_assessment_invalid"],
+        asserted_obligation_ids: assertedObligationIds,
         violations,
     };
 }
@@ -1531,7 +1612,25 @@ export function validateFailureClassification(args) {
 }
 export function validateRevisionProposal(args) {
     const violations = [];
+    // Every published proposal is carry-forward scope, so its target must resolve
+    // to a real authority — not just the `failure` case. Claim/question targets
+    // come from the failures' own claim_id/question_id; seed targets from the
+    // ontology-seed's seed_refs (knownSeedRefs). An unresolved target is a
+    // fabricated/stale carry-forward and is rejected as unknown_id.
     const failureIds = new Set(args.failureClassification.failures.map((failure) => failure.failure_id));
+    const failureClaimIds = new Set(args.failureClassification.failures
+        .map((failure) => failure.claim_id)
+        .filter((claimId) => Boolean(claimId)));
+    const failureQuestionIds = new Set(args.failureClassification.failures
+        .map((failure) => failure.question_id)
+        .filter((questionId) => Boolean(questionId)));
+    const seedRefs = knownSeedRefs(args.ontologySeed);
+    const targetAuthorities = {
+        failure: { ids: failureIds, authority: "failure" },
+        claim: { ids: failureClaimIds, authority: "failure claim" },
+        question: { ids: failureQuestionIds, authority: "failure question" },
+        seed: { ids: seedRefs, authority: "ontology-seed seed_ref" },
+    };
     const seen = new Set();
     const actionCounts = initCountMap(REVISION_ACTIONS);
     for (const proposal of args.revisionProposal.proposals) {
@@ -1543,11 +1642,23 @@ export function validateRevisionProposal(args) {
             }));
         }
         seen.add(proposal.proposal_id);
-        if (proposal.target_type === "failure" &&
-            !failureIds.has(proposal.target_id)) {
+        // target_type is the typed union for fresh-authored proposals, but resume /
+        // manual artifact validation loads it from YAML, so a stale value (e.g. the
+        // removed domain_context) can reach here. An unknown type has no authority to
+        // validate against, so reject it as invalid_enum instead of skipping the
+        // authority check and disclosing an unbacked target as carry-forward.
+        const targetAuthority = targetAuthorities[proposal.target_type];
+        if (!targetAuthority) {
+            violations.push(violation({
+                code: "invalid_enum",
+                message: `invalid proposal target_type: ${proposal.target_type}`,
+                subjectId: proposal.proposal_id,
+            }));
+        }
+        else if (!targetAuthority.ids.has(proposal.target_id)) {
             violations.push(violation({
                 code: "unknown_id",
-                message: `proposal references unknown failure: ${proposal.target_id}`,
+                message: `proposal references unknown ${targetAuthority.authority}: ${proposal.target_id}`,
                 subjectId: proposal.proposal_id,
             }));
         }
@@ -1750,13 +1861,15 @@ export async function writeFailureClassificationValidationArtifact(args) {
     return validation;
 }
 export async function writeRevisionProposalValidationArtifact(args) {
-    const [revisionProposal, failureClassification] = await Promise.all([
+    const [revisionProposal, failureClassification, ontologySeed] = await Promise.all([
         readYamlDocument(args.revisionProposalPath),
         readYamlDocument(args.failureClassificationPath),
+        readYamlDocument(args.ontologySeedPath),
     ]);
     const validation = validateRevisionProposal({
         revisionProposal,
         failureClassification,
+        ontologySeed,
         revisionProposalRef: path.resolve(args.revisionProposalPath),
         failureClassificationRef: path.resolve(args.failureClassificationPath),
     });