onto-mcp 0.4.12 → 0.4.13

package/dist/core-runtime/reconstruct/purpose-authority-validation.js

@@ -2,6 +2,8 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { parse as parseYaml } from "yaml";
 import { atomicWriteYamlDocument as writeYamlDocument } from "../artifact-io.js";
+import { assertObligation } from "./obligation-assertion.js";
+import { TARGET_MATERIAL_KINDS } from "../target-material-kind.js";
 const PURPOSE_EVIDENCE_KINDS = [
     "P1",
     "P2",
@@ -9,6 +11,12 @@ const PURPOSE_EVIDENCE_KINDS = [
     "P4",
     "P5",
 ];
+const PURPOSE_FRAME_STATUSES = [
+    "source_declared",
+    "evidence_inferred",
+    "limitation_backed",
+    "unresolved",
+];
 function isoNow() {
     return new Date().toISOString();
 }
@@ -93,6 +101,22 @@ function hasNonEmptyString(value) {
 export function validateSourcePurposeCandidates(args) {
     const artifact = args.sourcePurposeCandidates;
     const violations = [];
+    // G(a) slice 24 — record the obligations this validator FULLY enforces with a distinct violation
+    // (RECORD 6/10). The other 4 stay parked (see obligation-coverage-ledger.yaml notes): derive_
+    // confirmation_required and expose_selected_..._id are PROJECTION-ONLY (computed into the return
+    // object with no violation → no breaching binding); require_purpose_candidate_status_field_to_be_
+    // purpose_source_status is PARTIAL (only the artifact-level alias-field rejection is enforced, no
+    // per-candidate purpose_source_status enum check); and require_exactly_one_primary_..._when_selected
+    // is enforced UNCONDITIONALLY (blind to the "when selected" discriminator the contract scopes it to —
+    // slice-20 superset-blind park). Stamped before any per-candidate guard so the recorder fires on
+    // zero-candidate input.
+    const assertedObligationIds = [];
+    assertObligation(assertedObligationIds, "preserve_contradictions_in_candidate_status_or_limitations");
+    assertObligation(assertedObligationIds, "reject_p5_only_primary_purpose_candidate");
+    assertObligation(assertedObligationIds, "require_mixed_purpose_frame_elements_to_carry_member_scope_refs_member_target_material_kind_member_source_refs_and_cross_material_ref_refs_or_validated_exclusion");
+    assertObligation(assertedObligationIds, "require_non_p1_primary_to_have_two_evidence_kinds_and_one_p2_p3_or_p4");
+    assertObligation(assertedObligationIds, "require_purpose_adequacy_frame_elements_to_have_surface_dimension_facet_and_evidence_or_limitation_state");
+    assertObligation(assertedObligationIds, "validate_purpose_candidate_evidence_refs_against_source_observations");
     const evidenceIndex = observationEvidenceIndex(args.sourceObservations);
     const rawArtifact = artifact;
     if ("source_purpose_status" in rawArtifact || "inference_status" in rawArtifact) {
@@ -217,12 +241,74 @@ export function validateSourcePurposeCandidates(args) {
                 subjectId: candidate.purpose_candidate_id,
             }));
         }
-        if (!Array.isArray(frame.required_elements) || frame.required_elements.length === 0) {
+        // The frame header (frame_kind, frame_status, material_kind_requirements) is required for
+        // every candidate regardless of rank. The direct-call mapper enforces it on the authoring
+        // path; this validator must enforce it on the disk/reuse path (source-purpose-candidates.yaml
+        // is parsed without schema validation) so a malformed frame is never blessed as valid. Only
+        // required_elements is rank-dependent — a rejected candidate may leave it empty (below).
+        if (!hasNonEmptyString(frame.frame_kind)) {
+            violations.push(violation({
+                code: "required_element_missing",
+                message: `${candidatePath}.adequacy_frame.frame_kind must be non-empty`,
+                subjectId: candidate.purpose_candidate_id,
+            }));
+        }
+        if (!PURPOSE_FRAME_STATUSES.includes(frame.frame_status)) {
+            violations.push(violation({
+                code: "invalid_enum",
+                message: `${candidatePath}.adequacy_frame.frame_status is not a valid frame status`,
+                subjectId: candidate.purpose_candidate_id,
+            }));
+        }
+        const requirements = frame.material_kind_requirements;
+        if (typeof requirements !== "object" || requirements === null) {
             violations.push(violation({
                 code: "required_element_missing",
-                message: `${candidatePath}.adequacy_frame.required_elements must not be empty`,
+                message: `${candidatePath}.adequacy_frame.material_kind_requirements is required`,
                 subjectId: candidate.purpose_candidate_id,
             }));
+        }
+        else {
+            if (!TARGET_MATERIAL_KINDS.includes(requirements.target_material_kind)) {
+                violations.push(violation({
+                    code: "invalid_enum",
+                    message: `${candidatePath}.adequacy_frame.material_kind_requirements.target_material_kind is invalid`,
+                    subjectId: candidate.purpose_candidate_id,
+                }));
+            }
+            if (!Array.isArray(requirements.required_facets)) {
+                violations.push(violation({
+                    code: "required_element_missing",
+                    message: `${candidatePath}.adequacy_frame.material_kind_requirements.required_facets must be an array`,
+                    subjectId: candidate.purpose_candidate_id,
+                }));
+            }
+            if (!hasNonEmptyString(requirements.rationale)) {
+                violations.push(violation({
+                    code: "required_element_missing",
+                    message: `${candidatePath}.adequacy_frame.material_kind_requirements.rationale must be non-empty`,
+                    subjectId: candidate.purpose_candidate_id,
+                }));
+            }
+        }
+        if (!Array.isArray(frame.required_elements) || frame.required_elements.length === 0) {
+            // Rejected candidates record a considered-and-excluded alternative for provenance,
+            // not an active adequacy frame, so they may leave required_elements as an empty array
+            // (the full frame header above is still required for every rank). Mirrors the rejected
+            // exemption for supporting evidence. Only the empty-array case is exempt: a non-array
+            // required_elements still violates the artifact contract for every rank, and
+            // non-rejected candidates must still carry frame elements. When a rejected candidate
+            // does provide elements, the element-format checks below still apply.
+            const rejectedEmptyArray = candidate.rank === "rejected" &&
+                Array.isArray(frame.required_elements) &&
+                frame.required_elements.length === 0;
+            if (!rejectedEmptyArray) {
+                violations.push(violation({
+                    code: "required_element_missing",
+                    message: `${candidatePath}.adequacy_frame.required_elements must not be empty`,
+                    subjectId: candidate.purpose_candidate_id,
+                }));
+            }
             continue;
         }
         for (const [elementIndex, element] of frame.required_elements.entries()) {
@@ -289,6 +375,7 @@ export function validateSourcePurposeCandidates(args) {
         validation_results: violations.length === 0
             ? ["source_purpose_candidates_valid"]
             : ["source_purpose_candidates_invalid"],
+        asserted_obligation_ids: assertedObligationIds,
         violations,
     };
 }
@@ -296,6 +383,33 @@ export function validatePurposeConfirmation(args) {
     const confirmation = args.purposeConfirmation;
     const sourceValidation = args.sourcePurposeCandidatesValidation;
     const violations = [];
+    // G(a) slice 11: record the three obligations whose enforcement matches the authoritative contract
+    // (ontology-seeding-and-maturation-design.md §purpose-confirmation; confirmation_required is the
+    // derived inferred/limitation_backed predicate and "the only source for the purpose-confirmation
+    // gate"). All three reach a distinct, name-matching enforcement site below; stamped unconditionally
+    // up front so they fire on any input:
+    //   - validate_confirmation_status_against_selected_purpose_candidate (selected_primary_mismatch
+    //     when purpose_candidate_id != selected_purpose_candidate_id — distinct site).
+    //   - require_confirmation_for_inferred_or_limitation_backed_purpose (when confirmation_required is
+    //     true a non-confirmed status — e.g. not_required — blocks: conflicting_state). Per the contract
+    //     the validator consumes confirmation_required rather than re-deriving inferred/limitation_backed.
+    //   - block_seed_readiness_when_confirmation_is_pending_rejected_unavailable_or_evidence_check_pending
+    //     (each of those statuses blocks seed readiness even when confirmation is not required).
+    // The two former obligations are DISTINCT facets with non-overlapping breaching inputs: ob "require"
+    // is bound by confirmation_required=true + status=not_required (a status not in the "block" list);
+    // ob "block" is bound by confirmation_required=false + status=pending (no confirmation required, yet
+    // it still blocks). PARKED (not recorded), name broader than code — honest declared≠wired, NOT
+    // laundered (see obligation-coverage-ledger.yaml notes):
+    //   - require_revised_confirmation_to_preserve_source_conflict_or_trigger_purpose_discovery_rerun:
+    //     only the rerun arm is enforced (revised_pending_evidence_check → must_rerun_purpose_discovery);
+    //     the "preserve source conflict" arm is never checked — source_conflict_policy is never read.
+    //   - validate_confirmation_status_against_source_purpose_candidate_status_and_validation_confirmation_required:
+    //     the validator reads only sourceValidation.validation_status and confirmation_required, never the
+    //     candidate's own purpose_source_status the name references.
+    const assertedObligationIds = [];
+    assertObligation(assertedObligationIds, "validate_confirmation_status_against_selected_purpose_candidate");
+    assertObligation(assertedObligationIds, "require_confirmation_for_inferred_or_limitation_backed_purpose");
+    assertObligation(assertedObligationIds, "block_seed_readiness_when_confirmation_is_pending_rejected_unavailable_or_evidence_check_pending");
     if (confirmation.session_id !== sourceValidation.session_id) {
         violations.push(violation({
             code: "session_id_mismatch",
@@ -384,6 +498,7 @@ export function validatePurposeConfirmation(args) {
         validation_results: violations.length === 0
             ? ["purpose_confirmation_valid"]
             : ["purpose_confirmation_invalid"],
+        asserted_obligation_ids: assertedObligationIds,
         violations,
     };
 }

package/dist/core-runtime/reconstruct/record.js

@@ -15,11 +15,21 @@ const RECORD_ARTIFACT_KEYS = [
     "source_inventory",
     "initial_source_frontier",
     "source_observations",
+    "seed_stage_prompt_source_observations",
     "source_observation_delta",
     "source_observation_delta_validation",
     "source_observation_reentry_validation",
     "source_observation_lineage_index",
     "source_observation_lineage_index_validation",
+    // W3 code review W3-001: normalizeRefs silently DROPS any typed ref key missing from this list —
+    // leaf_read_census was typed on ReconstructRecordArtifactRefs but dropped here (pre-existing
+    // latent type↔behavior mismatch); registered together with the semantic_map refs so the record
+    // (the durable primary evidence artifact) carries what the type declares.
+    "leaf_read_census",
+    "dispatch_incomplete",
+    "semantic_map_census",
+    "semantic_map_sidecar",
+    "semantic_map_resume_validation",
     "source_safety_ledger",
     "source_safety_ledger_validation",
     "source_scout_pack",
@@ -306,6 +316,30 @@ function buildWarnings(args) {
     }
     return warnings;
 }
+/**
+ * The single canonical terminal-status projection over a reconstruct record (design §16.7).
+ *
+ * "Is this run done, and how?" is judged here and nowhere else: `getRunStatus` (the `status`
+ * field), `deriveReconstructProgress` (liveness / poll interval) and the TUI `deriveWorkflowStatus`
+ * all derive from this one function, so a graceful terminal is treated uniformly as terminal
+ * without each consumer re-checking `record_stage === "completed"` (the removed "diamond").
+ * `terminal_disposition` present ⇒ blocked/limited (terminal, stop polling, NOT "completed");
+ * else the raw `record_stage` ("completed" when the pipeline finished, otherwise in-progress).
+ */
+export function reconstructTerminalStatus(record) {
+    return record.terminal_disposition ?? record.record_stage;
+}
+/**
+ * Record-validator invariant (design §16.7): a graceful terminal never reached the terminal stage,
+ * so `terminal_disposition` and `record_stage === "completed"` are mutually exclusive. Enforced at
+ * the write authority ({@link assembleReconstructRecord}) so no consumer can observe an incoherent
+ * pairing that {@link reconstructTerminalStatus} could not sensibly project.
+ */
+export function assertReconstructTerminalDispositionCoherent(recordStage, terminalDisposition) {
+    if (terminalDisposition && recordStage === "completed") {
+        throw new Error(`reconstruct record invariant: terminal_disposition=${terminalDisposition} cannot pair with record_stage="completed"`);
+    }
+}
 export async function assembleReconstructRecord(params) {
     const sessionRoot = path.resolve(params.sessionRoot);
     const sessionId = path.basename(sessionRoot);
@@ -380,17 +414,25 @@ export async function assembleReconstructRecord(params) {
         stopDecisionPresent: await exists(artifactRefs.stop_decision),
         finalOutputPresent: await exists(artifactRefs.final_output),
     });
+    assertReconstructTerminalDispositionCoherent(recordStage, params.terminalDisposition);
     const record = {
         schema_version: "1",
         reconstruct_record_id: `reconstruct-record:${sessionId}`,
         session_id: sessionId,
         entrypoint: "reconstruct",
         record_stage: recordStage,
+        // Present only on a graceful terminal; conditional spread keeps a normal record byte-identical.
+        ...(params.terminalDisposition
+            ? { terminal_disposition: params.terminalDisposition }
+            : {}),
         created_at: now,
         updated_at: now,
         target_material_kind: targetMaterialProfile?.target_material_kind ?? null,
         support_status: targetMaterialProfile?.support_status ?? null,
         artifact_refs: artifactRefs,
+        ...(params.dispatchFallback && recordStage === "completed"
+            ? { dispatch_fallback: structuredClone(params.dispatchFallback) }
+            : {}),
         artifact_integrity: artifactIntegrity,
         validation_summary: {
             target_material_profile_status: targetMaterialProfileStatus,

package/dist/core-runtime/reconstruct/registry-verification-validation.js

@@ -3,6 +3,7 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { parse as parseYaml } from "yaml";
 import { assertArrayField, atomicWriteYamlDocument as writeYamlDocument } from "../artifact-io.js";
+import { assertObligation } from "./obligation-assertion.js";
 import { loadReconstructContractRegistry, } from "./contract-registry.js";
 function isoNow() {
     return new Date().toISOString();
@@ -157,6 +158,20 @@ export function validateRegistryVerificationEvidence(args) {
     assertArrayField(args.contractRegistry.validation_gate_catalog, "contract-registry", "validation_gate_catalog");
     assertArrayField(args.contractRegistry.required_when_predicate_catalog, "contract-registry", "required_when_predicate_catalog");
     const violations = [];
+    // G(a) obligation recorder (INV-OBLIGATION-COVERAGE-1): record that control
+    // reached each enforcer block below. Unconditional, before any per-row/per-loop
+    // guard so a zero-row clean input still stamps every recorded obligation.
+    // (validate_registry_snapshot_hash_matches_current_registry_file is PARKED: the
+    // match check is gated on the caller-supplied optional expectedRegistrySha256,
+    // not enforced internally — see obligation-coverage-ledger.yaml.)
+    const assertedObligationIds = [];
+    assertObligation(assertedObligationIds, "validate_registry_snapshot_hash_is_recorded");
+    assertObligation(assertedObligationIds, "validate_active_artifact_gate_validator_predicate_and_source_profile_ids_are_unique");
+    assertObligation(assertedObligationIds, "validate_active_registry_subject_lists_match_current_registry_catalogs");
+    assertObligation(assertedObligationIds, "validate_every_active_gate_has_a_validator_record");
+    assertObligation(assertedObligationIds, "validate_every_validator_gate_ref_resolves_to_an_active_gate");
+    assertObligation(assertedObligationIds, "validate_every_active_gate_required_when_predicate_resolves");
+    assertObligation(assertedObligationIds, "require_evidence_row_for_each_current_registry_subject_id");
     const expectedRegistryRef = args.expectedRegistryRef
         ? path.resolve(args.expectedRegistryRef)
         : null;
@@ -353,6 +368,7 @@ export function validateRegistryVerificationEvidence(args) {
         validation_results: violations.length === 0
             ? ["registry_verification_evidence_valid"]
             : ["registry_verification_evidence_invalid"],
+        asserted_obligation_ids: assertedObligationIds,
         violations,
     };
 }