onto-mcp 0.4.12 → 0.4.13

package/dist/core-runtime/reconstruct/source-safety-validation.js

@@ -3,11 +3,10 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { parse as parseYaml } from "yaml";
 import { assertArrayField, atomicWriteYamlDocument as writeYamlDocument } from "../artifact-io.js";
+import { assertObligation } from "./obligation-assertion.js";
 const SOURCE_SAFETY_CANONICAL_AXES = [
     "lifecycle_state",
     "authorization_state",
-    "privacy_state",
-    "redaction_state",
     "proof_sufficiency_state",
     "replay_state",
 ];
@@ -28,26 +27,13 @@ const AUTHORIZATION_STATES = [
     "unknown",
     "not_required",
 ];
-const PRIVACY_STATES = [
-    "non_sensitive",
-    "privacy_sensitive",
-    "unknown",
-];
-const REDACTION_STATES = [
-    "none",
-    "redacted",
-    "required",
-    "insufficient",
-];
 const PROOF_SUFFICIENCY_STATES = [
     "sufficient_for_claim",
     "insufficient_for_claim",
-    "trace_only",
     "unavailable",
 ];
 const REPLAY_STATES = [
     "replay_allowed",
-    "replay_with_redaction",
     "no_replay_use",
     "unknown",
 ];
@@ -61,32 +47,9 @@ const INTENDED_CONSUMPTIONS = [
 const VISIBILITY_TIERS = [
     "consumption_allowed",
     "internal_only",
-    "redacted_output_only",
     "no_prompt_use",
     "no_replay_use",
 ];
-const ALLOWED_PROOF_FORMS = [
-    "raw_value",
-    "hash",
-    "bounded_summary",
-    "source_ref_only",
-    "unavailable",
-];
-const SAFE_REDACTED_PROOF_FORMS = new Set([
-    "hash",
-    "bounded_summary",
-    "source_ref_only",
-]);
-const SENSITIVE_SOURCE_PATTERNS = [
-    /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/,
-    /\b(?:api[_-]?key|secret|password|passwd|pwd|token)\b\s*[:=]\s*['"]?[^'"\s]{8,}/i,
-    /\bAuthorization:\s*Bearer\s+[A-Za-z0-9._~+/=-]{12,}/i,
-    /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/,
-    /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/i,
-    /\b\d{3}-\d{2}-\d{4}\b/,
-    /\b\d{6}-[1-4]\d{6}\b/,
-    /\b(?:\+?\d{1,3}[-.\s]?)?(?:\(?\d{2,4}\)?[-.\s]?)\d{3,4}[-.\s]?\d{4}\b/,
-];
 function isoNow() {
     return new Date().toISOString();
 }
@@ -107,24 +70,9 @@ function violation(args) {
 function inList(value, allowed) {
     return typeof value === "string" && allowed.includes(value);
 }
-function arrayValues(value, allowed) {
-    if (!Array.isArray(value))
-        return [];
-    return value.filter((item) => inList(item, allowed));
-}
 export function sourceSafetyRowIdForObservation(observation, intendedConsumption = "prompt_context") {
     return `source_safety:${observation.observation_id}:${intendedConsumption}`;
 }
-function observationContentExcerpt(observation) {
-    const excerpt = observation.structural_data.content_excerpt;
-    return typeof excerpt === "string" ? excerpt : null;
-}
-function hasSensitiveSourceEvidence(observation) {
-    const excerpt = observationContentExcerpt(observation);
-    if (!excerpt)
-        return false;
-    return SENSITIVE_SOURCE_PATTERNS.some((pattern) => pattern.test(excerpt));
-}
 function explicitConsumptionAuthorizations(observation) {
     const rawAuthorizations = observation.structural_data.source_safety_consumption_authorizations;
     if (!Array.isArray(rawAuthorizations))
@@ -144,9 +92,6 @@ function stableRuleRef(row) {
         .slice(0, 16);
     return `source-safety-visibility-v1:${digest}`;
 }
-function hasSafeRedactedProofForm(row) {
-    return row.redaction_evidence.allowed_proof_forms.some((form) => SAFE_REDACTED_PROOF_FORMS.has(form));
-}
 export function deriveSourceSafetyVisibilityTier(row) {
     const intendedConsumption = row.visibility_derivation.intended_consumption;
     if (intendedConsumption === "replay" &&
@@ -159,9 +104,7 @@ export function deriveSourceSafetyVisibilityTier(row) {
         row.authorization_state === "unknown") {
         return "no_prompt_use";
     }
-    if (row.proof_sufficiency_state === "unavailable" ||
-        row.redaction_state === "insufficient" ||
-        row.redaction_evidence.allowed_proof_forms.includes("unavailable")) {
+    if (row.proof_sufficiency_state === "unavailable") {
         return "no_prompt_use";
     }
     if (intendedConsumption === "material_claim" &&
@@ -172,15 +115,6 @@ export function deriveSourceSafetyVisibilityTier(row) {
         row.proof_sufficiency_state !== "sufficient_for_claim") {
         return "internal_only";
     }
-    if (row.redaction_state === "redacted" ||
-        row.redaction_state === "required" ||
-        row.replay_state === "replay_with_redaction" ||
-        row.privacy_state === "privacy_sensitive") {
-        return hasSafeRedactedProofForm(row) ? "redacted_output_only" : "internal_only";
-    }
-    if (row.privacy_state === "unknown") {
-        return hasSafeRedactedProofForm(row) ? "redacted_output_only" : "internal_only";
-    }
     if (intendedConsumption === "public_output" ||
         intendedConsumption === "prompt_context" ||
         intendedConsumption === "material_claim") {
@@ -189,40 +123,29 @@ export function deriveSourceSafetyVisibilityTier(row) {
     return "internal_only";
 }
 function buildSafetyRowForObservation(observation, intendedConsumption) {
-    const sensitive = hasSensitiveSourceEvidence(observation);
-    const excerpt = observationContentExcerpt(observation);
     const explicitlyAuthorized = explicitConsumptionAuthorizations(observation)
         .has(intendedConsumption);
-    const consumptionAuthorized = runtimeInternalConsumption(intendedConsumption) || explicitlyAuthorized;
-    const allowedProofForms = sensitive
-        ? ["hash", "bounded_summary", "source_ref_only"]
-        : !consumptionAuthorized
-            ? ["hash", "bounded_summary", "source_ref_only"]
-            : excerpt
-                ? ["raw_value", "hash", "bounded_summary", "source_ref_only"]
-                : ["hash", "bounded_summary", "source_ref_only"];
+    // Defect-3 basis A (runtime-target provenance): a user-provided reconstruct
+    // runtime-target source authorizes the outward tiers (material_claim,
+    // public_output) by provenance. Scoped to the two upper tiers only — the
+    // internal tiers are already covered by runtimeInternalConsumption, and a
+    // non-target observation (is_runtime_target_source absent/false) never gets
+    // basis A, so this cannot leak to frontier-discovered sources.
+    const provenanceAuthorized = observation.is_runtime_target_source === true &&
+        (intendedConsumption === "material_claim" ||
+            intendedConsumption === "public_output");
+    const consumptionAuthorized = runtimeInternalConsumption(intendedConsumption) || explicitlyAuthorized ||
+        provenanceAuthorized;
     const rowBase = {
         safety_row_id: sourceSafetyRowIdForObservation(observation, intendedConsumption),
         subject_ref: observation.source_ref,
         subject_kind: "source_ref",
         lifecycle_state: "active",
         authorization_state: consumptionAuthorized ? "authorized" : "unknown",
-        privacy_state: sensitive
-            ? "privacy_sensitive"
-            : consumptionAuthorized
-                ? "non_sensitive"
-                : "unknown",
-        redaction_state: sensitive ? "required" : consumptionAuthorized ? "none" : "insufficient",
-        proof_sufficiency_state: sensitive
-            ? "trace_only"
-            : consumptionAuthorized
-                ? "sufficient_for_claim"
-                : "insufficient_for_claim",
-        replay_state: sensitive
-            ? "replay_with_redaction"
-            : consumptionAuthorized
-                ? "replay_allowed"
-                : "unknown",
+        proof_sufficiency_state: consumptionAuthorized
+            ? "sufficient_for_claim"
+            : "insufficient_for_claim",
+        replay_state: consumptionAuthorized ? "replay_allowed" : "unknown",
         visibility_tier: "internal_only",
         visibility_derivation: {
             intended_consumption: intendedConsumption,
@@ -237,11 +160,6 @@ function buildSafetyRowForObservation(observation, intendedConsumption) {
                 ? "source_safety_explicit_consumption_authorization"
                 : "runtime_target_ref_read_scope"
             : null,
-        redaction_evidence: {
-            raw_value_available: excerpt !== null,
-            allowed_proof_forms: allowedProofForms,
-            redaction_rule_ref: sensitive ? "source-safety-sensitive-source-pattern-v1" : null,
-        },
         tombstone: {
             tombstone_ref: null,
             reason: null,
@@ -249,9 +167,6 @@ function buildSafetyRowForObservation(observation, intendedConsumption) {
             downstream_refs: [],
         },
         limitation_refs: [
-            ...(sensitive
-                ? [`source-safety-sensitive-source:${observation.observation_id}`]
-                : []),
             ...(!consumptionAuthorized
                 ? [
                     `source-safety-consumption-authorization-gap:${observation.observation_id}:${intendedConsumption}`,
@@ -296,55 +211,8 @@ function validateCanonicalAxes(args) {
         SOURCE_SAFETY_CANONICAL_AXES.some((axis) => !axisSet.has(axis))) {
         args.violations.push(violation({
             code: "visibility_axis_set_invalid",
-            message: "visibility_derivation.derived_from_axes must contain exactly the six canonical source-safety axes",
-            subjectId: args.row.safety_row_id,
-        }));
-    }
-}
-function validateSupportingDetailConsistency(args) {
-    if (args.row.redaction_state !== "none" &&
-        args.row.redaction_evidence.allowed_proof_forms.includes("raw_value")) {
-        args.violations.push(violation({
-            code: "supporting_detail_contradiction",
-            message: "redaction_evidence.allowed_proof_forms cannot grant raw_value when top-level redaction_state requires or applies redaction",
-            subjectId: args.row.safety_row_id,
-            axis: "redaction_state",
-        }));
-    }
-    if (args.row.redaction_state === "none" &&
-        args.row.redaction_evidence.redaction_rule_ref) {
-        args.violations.push(violation({
-            code: "supporting_detail_contradiction",
-            message: "redaction_evidence.redaction_rule_ref must be null when top-level redaction_state is none",
-            subjectId: args.row.safety_row_id,
-            axis: "redaction_state",
-        }));
-    }
-    if (args.row.proof_sufficiency_state === "unavailable" &&
-        !args.row.redaction_evidence.allowed_proof_forms.includes("unavailable")) {
-        args.violations.push(violation({
-            code: "supporting_detail_contradiction",
-            message: "proof_sufficiency_state unavailable must be supported by allowed_proof_forms including unavailable",
+            message: "visibility_derivation.derived_from_axes must contain exactly the four canonical source-safety axes",
             subjectId: args.row.safety_row_id,
-            axis: "proof_sufficiency_state",
-        }));
-    }
-    if (args.row.redaction_evidence.allowed_proof_forms.includes("unavailable") &&
-        args.row.proof_sufficiency_state !== "unavailable") {
-        args.violations.push(violation({
-            code: "supporting_detail_contradiction",
-            message: "allowed_proof_forms unavailable contradicts a top-level proof_sufficiency_state that is not unavailable",
-            subjectId: args.row.safety_row_id,
-            axis: "proof_sufficiency_state",
-        }));
-    }
-    if (args.row.redaction_evidence.raw_value_available === false &&
-        args.row.redaction_evidence.allowed_proof_forms.includes("raw_value")) {
-        args.violations.push(violation({
-            code: "supporting_detail_contradiction",
-            message: "redaction_evidence cannot allow raw_value when raw_value_available is false",
-            subjectId: args.row.safety_row_id,
-            axis: "redaction_state",
         }));
     }
 }
@@ -354,9 +222,6 @@ function normalizeSafetyRow(rawRow) {
     const derivation = isRecord(rawRow.visibility_derivation)
         ? rawRow.visibility_derivation
         : {};
-    const redactionEvidence = isRecord(rawRow.redaction_evidence)
-        ? rawRow.redaction_evidence
-        : {};
     const tombstone = isRecord(rawRow.tombstone) ? rawRow.tombstone : {};
     return {
         safety_row_id: typeof rawRow.safety_row_id === "string" ? rawRow.safety_row_id : "",
@@ -370,12 +235,6 @@ function normalizeSafetyRow(rawRow) {
         authorization_state: inList(rawRow.authorization_state, AUTHORIZATION_STATES)
             ? rawRow.authorization_state
             : "",
-        privacy_state: inList(rawRow.privacy_state, PRIVACY_STATES)
-            ? rawRow.privacy_state
-            : "",
-        redaction_state: inList(rawRow.redaction_state, REDACTION_STATES)
-            ? rawRow.redaction_state
-            : "",
         proof_sufficiency_state: inList(rawRow.proof_sufficiency_state, PROOF_SUFFICIENCY_STATES)
             ? rawRow.proof_sufficiency_state
             : "",
@@ -389,7 +248,13 @@ function normalizeSafetyRow(rawRow) {
             intended_consumption: inList(derivation.intended_consumption, INTENDED_CONSUMPTIONS)
                 ? derivation.intended_consumption
                 : "",
-            derived_from_axes: arrayValues(derivation.derived_from_axes, SOURCE_SAFETY_CANONICAL_AXES),
+            // Keep every string entry as-is (do NOT filter to the canonical set): a stale
+            // or tampered row carrying retired axes (e.g. privacy_state/redaction_state)
+            // must reach validateCanonicalAxes and fail `visibility_axis_set_invalid`,
+            // not be silently laundered down to exactly the four canonical axes.
+            derived_from_axes: (Array.isArray(derivation.derived_from_axes)
+                ? derivation.derived_from_axes.filter((axis) => typeof axis === "string")
+                : []),
             derivation_rule_ref: typeof derivation.derivation_rule_ref === "string"
                 ? derivation.derivation_rule_ref
                 : "",
@@ -397,13 +262,6 @@ function normalizeSafetyRow(rawRow) {
         authorization_scope_ref: typeof rawRow.authorization_scope_ref === "string"
             ? rawRow.authorization_scope_ref
             : null,
-        redaction_evidence: {
-            raw_value_available: redactionEvidence.raw_value_available === true,
-            allowed_proof_forms: arrayValues(redactionEvidence.allowed_proof_forms, ALLOWED_PROOF_FORMS),
-            redaction_rule_ref: typeof redactionEvidence.redaction_rule_ref === "string"
-                ? redactionEvidence.redaction_rule_ref
-                : null,
-        },
         tombstone: {
             tombstone_ref: typeof tombstone.tombstone_ref === "string" ? tombstone.tombstone_ref : null,
             reason: typeof tombstone.reason === "string" ? tombstone.reason : null,
@@ -420,6 +278,23 @@ function normalizeSafetyRow(rawRow) {
 export function validateSourceSafetyLedger(args) {
     assertArrayField(args.sourceObservations.observations, "source-observations", "observations");
     const violations = [];
+    // G(a) deferred-7 slice 1: record the three obligations this validator fully enforces. Stamped here,
+    // before the per-row loop, so they fire on zero-row input (the enforcement sites exist unconditionally).
+    // asserted_obligation_ids is in-memory-only telemetry (Stage 0 #145): it is stripped at the write
+    // boundary and excluded from reuseMatchArtifactHash, so stamping this reuse-hashed validation artifact
+    // does not rotate reuse provenance. PARKED (see obligation-coverage-ledger.yaml):
+    //  - preserve_..._consumption_boundaries: no independent "no substitution" enforcer (the per-consumption
+    //    required rows are the only related check), so it cannot bind non-overlappingly.
+    //  - validate_every_observation_has_source_safety_rows_for_each_intended_consumption (codex #147 P1):
+    //    the required-row pass only proves each source_safety:<obs>:<consumption> ID STRING is present; it
+    //    never binds that ID suffix to the row's visibility_derivation.intended_consumption (the field
+    //    deriveSourceSafetyVisibilityTier uses). So a public_output-ID row can carry prompt_context
+    //    derivation and a tier derived for the wrong consumption, pass, and mislead downstream lookup-by-ID.
+    //    PARK pending an ID-suffix ↔ intended_consumption binding.
+    const assertedObligationIds = [];
+    assertObligation(assertedObligationIds, "validate_exactly_four_canonical_source_safety_axes");
+    assertObligation(assertedObligationIds, "validate_source_safety_subject_refs_against_observed_source_refs");
+    assertObligation(assertedObligationIds, "validate_visibility_tier_is_derived_not_independent_authority");
     const rawLedger = args.sourceSafetyLedger;
     if (!isRecord(rawLedger) || !Array.isArray(rawLedger.safety_rows)) {
         violations.push(violation({
@@ -510,13 +385,6 @@ export function validateSourceSafetyLedger(args) {
                 allowed: AUTHORIZATION_STATES,
                 axis: "authorization_state",
             },
-            { field: "privacy_state", value: row.privacy_state, allowed: PRIVACY_STATES, axis: "privacy_state" },
-            {
-                field: "redaction_state",
-                value: row.redaction_state,
-                allowed: REDACTION_STATES,
-                axis: "redaction_state",
-            },
             {
                 field: "proof_sufficiency_state",
                 value: row.proof_sufficiency_state,
@@ -543,15 +411,7 @@ export function validateSourceSafetyLedger(args) {
                 subjectId: row.safety_row_id,
             }));
         }
-        if (row.redaction_evidence.allowed_proof_forms.length === 0) {
-            violations.push(violation({
-                code: "missing_required_field",
-                message: "source safety row must name at least one allowed proof form",
-                subjectId: row.safety_row_id,
-            }));
-        }
         validateCanonicalAxes({ row, violations });
-        validateSupportingDetailConsistency({ row, violations });
         if (VISIBILITY_TIERS.includes(row.visibility_tier)) {
             const expected = deriveSourceSafetyVisibilityTier(row);
             if (row.visibility_tier !== expected) {
@@ -562,6 +422,34 @@ export function validateSourceSafetyLedger(args) {
                 }));
             }
         }
+        // Defect-3 D3 (basis-attribution enforcement): an outward consumption tier
+        // (material_claim/public_output) that actually REACHES consumption_allowed MUST
+        // be justified by a canonical basis — A (the observation is the runtime target,
+        // is_runtime_target_source) or B (explicit source self-declaration). Without
+        // this, a forged/replayed row could reach consumption_allowed on a
+        // frontier-discovered/non-target source (the four axes alone don't bind to the
+        // basis). The trigger keys on the DERIVED outcome, not a single
+        // authorization_state literal: both "authorized" AND "not_required" derive to
+        // consumption_allowed for these tiers, so checking only "authorized" left a
+        // "not_required" bypass. Internal tiers are exempt (runtime read scope), and a
+        // legit non-target row derives to no_prompt_use (producer emits "unknown"), so
+        // D3 stays silent there.
+        const consumption = row.visibility_derivation.intended_consumption;
+        if ((consumption === "material_claim" || consumption === "public_output") &&
+            deriveSourceSafetyVisibilityTier(row) === "consumption_allowed" &&
+            expectedObservation) {
+            const basisA = expectedObservation.is_runtime_target_source === true;
+            const basisB = explicitConsumptionAuthorizations(expectedObservation)
+                .has(consumption);
+            if (!basisA && !basisB) {
+                violations.push(violation({
+                    code: "unjustified_consumption_authorization",
+                    message: `source safety row ${row.safety_row_id} reaches consumption_allowed for ${consumption} without a runtime-target-provenance (A) or explicit-source (B) authorization basis`,
+                    subjectId: row.safety_row_id,
+                    axis: "authorization_state",
+                }));
+            }
+        }
     }
     for (const requiredSafetyRowId of requiredSafetyRowIds) {
         if (!rowIds.has(requiredSafetyRowId)) {
@@ -583,10 +471,10 @@ export function validateSourceSafetyLedger(args) {
         safety_row_count: rows.length,
         no_prompt_use_count: rows.filter((row) => row.visibility_tier === "no_prompt_use")
             .length,
-        redacted_output_only_count: rows.filter((row) => row.visibility_tier === "redacted_output_only").length,
         validation_results: violations.length === 0
             ? ["source_safety_ledger_valid"]
             : ["source_safety_ledger_invalid"],
+        asserted_obligation_ids: assertedObligationIds,
         violations,
     };
 }

package/dist/core-runtime/reconstruct/source-scout-pack-validation.js

@@ -3,6 +3,7 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { parse as parseYaml } from "yaml";
 import { assertArrayField, atomicWriteYamlDocument as writeYamlDocument } from "../artifact-io.js";
+import { assertObligation } from "./obligation-assertion.js";
 import { sourceSafetyRowIdForObservation } from "./source-safety-validation.js";
 const SIGNAL_AXES = [
     "actor",
@@ -172,7 +173,6 @@ function visibilityStateForSafetyRow(row) {
         case "consumption_allowed":
             return "prompt_visible";
         case "internal_only":
-        case "redacted_output_only":
             return "redacted";
         case "no_prompt_use":
         case "no_replay_use":
@@ -405,6 +405,41 @@ export async function validateSourceScoutPack(args) {
     assertArrayField(args.sourceObservations.observations, "source-observations", "observations");
     assertArrayField(args.sourceScoutPack.profile_scout_coverage_slots, "source-scout-pack", "profile_scout_coverage_slots");
     const violations = [];
+    // G(a) deferred-7 slice 5 (LAST): ONE mode-agnostic fn is shared by THREE registry validator_ids
+    // (source-scout-pack[-pre-seed|-post-maturation]-validator) — no mode arg, one uniform check set. The harvest
+    // attributes this asserted set to ALL 3 validator_ids; recording only an obligation registered for all 3
+    // (no registry-absent pair). asserted_obligation_ids is in-memory-only telemetry (Stage 0 #145) on a
+    // reuse-hashed (run.ts source_scout_pack_validation_sha256) + scout-captured (sha256File raw-file) artifact,
+    // so stamping rotates neither channel. Stamped before the per-row loop so it fires on zero signal rows.
+    //
+    // RECORD 1 (shared across all 3 modes, uniformly enforced):
+    //  - validate_signal_rows_resolve_to_source_observations → signal_observation_missing (per-row, UNCONDITIONAL:
+    //    every signal row's observation_id must resolve in source-observations; +per-row content-sha match). The
+    //    passed observations are bound to the chain via source_observations_hash_mismatch (pack snapshot hash vs
+    //    sha256File(ref)); the resolution check itself does not depend on that pinning.
+    //
+    // PARKED 8 (ledger notes carry detail):
+    //  - validate_prompt_visible_rows_have_source_safety_validation_refs (×3): the named per-row field
+    //    source_safety_ledger_validation_ref is BUILT but never read by the validator — it checks source_safety_
+    //    row_id (ledger row) + global validation_status + tier instead, so the named validation-ref field is
+    //    unenforced (a row with valid row_id but null/wrong validation_ref passes).
+    //  - validate_group_and_coverage_refs_resolve (base): "group" has no enforcement surface (no group structure);
+    //    only coverage_slot→signal_row resolution (coverage_slot_signal_missing) is checked → compound, half missing.
+    //  - validate_scout_pack_is_profile_local_and_contains_no_selected_purpose_required_element_refs (base):
+    //    validateNoSelectedPurposeLeak is a JSON substring search (no-purpose-leak half, fragile); "profile-local"
+    //    is never checked → compound, half missing.
+    //  - validate_scout_scope_derives_from_target_material_profile_validation (base) /
+    //    validate_snapshot_scope_derives_from_target_material_profile_validation (pre-seed+post-maturation):
+    //    scout_scope is copied from the pack; only internal consistency (unsupported_scope_overclaimed) is checked,
+    //    never recomputed/derived from the target-material-profile-validation content (scoutScopeState() unused here).
+    //  - validate_snapshot_lineage_validation_ref_and_hash_match_current_lineage_authority (pre-seed+post-maturation):
+    //    slice-3 null-read + caller-authority — sha256File(null)=null so a null lineage ref + null pack hash passes,
+    //    and the "current lineage authority" is the caller-supplied ref, not derived from the chain.
+    //  - validate_pre_seed_scout_snapshot_is_immutable_consumed_authority (pre-seed) /
+    //    validate_post_maturation_scout_snapshot_is_immutable_audit_authority (post-maturation): only INPUT-artifact
+    //    hashes (freshness) are checked; snapshot immutability / consumed-or-audit authority state is not enforced.
+    const assertedObligationIds = [];
+    assertObligation(assertedObligationIds, "validate_signal_rows_resolve_to_source_observations");
     // signal_rows is this validator's primary subject and is already shape-checked
     // gracefully below (→ schema_shape_invalid violation), so it is NOT asserted.
     const rawPack = args.sourceScoutPack;
@@ -653,6 +688,7 @@ export async function validateSourceScoutPack(args) {
         validation_results: violations.length === 0
             ? ["source_scout_pack_valid"]
             : ["source_scout_pack_invalid"],
+        asserted_obligation_ids: assertedObligationIds,
         violations,
     };
 }