plumb-line-provenance 0.2.0 → 0.3.0

package/audit.mjs

@@ -20,9 +20,14 @@ export function auditMeta(meta) {
     );
   }
 
+  // An unknown confidence on a step is laundering, not "no signal": treat it as
+  // the `none` floor (mirroring weakestConfidence), so audit is never laxer than
+  // the combination law. A step that records *no* confidence is still skipped —
+  // absence is genuinely unrankable and must not manufacture a false over-claim.
   const lineageConfidences = lineage
     .map((s) => s?.confidence)
-    .filter((c) => CONFIDENCE.includes(c));
+    .filter((c) => c != null)
+    .map((c) => (CONFIDENCE.includes(c) ? c : "none"));
   if (lineageConfidences.length > 0) {
     const weakest = weakestConfidence(...lineageConfidences);
     if (CONFIDENCE.indexOf(meta.confidence) > CONFIDENCE.indexOf(weakest)) {

package/marked.mjs

@@ -18,7 +18,7 @@ const META_KEYS = [
 const OVERRIDE_KEYS = ["source", "confidence", "confidenceScore", "basis", "adapter"];
 
 export function mark(value, metaInput = {}) {
-  return { value, ...makeMeta(metaInput) };
+  return Object.freeze({ value, ...makeMeta(metaInput) });
 }
 
 export function unwrap(marked) {
@@ -39,11 +39,15 @@ export function derive(inputs, fn, metaOverride = {}) {
   for (const key of OVERRIDE_KEYS) {
     if (key in metaOverride) safeOverride[key] = metaOverride[key];
   }
-  const merged = {
+  // Route the override through makeMeta so derive is never weaker than the
+  // constructor: an out-of-range confidenceScore (or unrankable weakestSource)
+  // is dropped by the same validation, not stored raw. derivedFromMock is
+  // force-OR'd *before* the call, so taint still cannot be cleared (the one law).
+  const merged = makeMeta({
     ...combined,
     ...safeOverride,
     derivedFromMock:
       combined.derivedFromMock || Boolean(metaOverride.derivedFromMock),
-  };
-  return { value, ...merged };
+  });
+  return Object.freeze({ value, ...merged });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "plumb-line-provenance",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Conservative provenance/confidence/lineage envelope with a taint-propagation combination law. Mock or low-confidence data cannot launder itself clean.",
   "type": "module",
   "main": "./index.mjs",

package/provenance.mjs

@@ -36,7 +36,15 @@ export function makeMeta({
       derivedFromMock === undefined
         ? source === "mock"
         : Boolean(derivedFromMock),
-    lineage: Array.isArray(lineage) ? [...lineage] : [],
+    // Each meta owns a *frozen copy* of its lineage. Steps are cloned then
+    // frozen so (a) an envelope's recorded history can't be rewritten in place,
+    // and (b) a step shared across parent/child metas can't leak a mutation from
+    // one into the other — the audit trail an auditMeta() trusts stays intact.
+    lineage: Object.freeze(
+      (Array.isArray(lineage) ? lineage : []).map((s) =>
+        s && typeof s === "object" ? Object.freeze({ ...s }) : s,
+      ),
+    ),
   };
   // Optional numeric confidence — a finer-grained companion to the ordinal
   // `confidence`, never a replacement. Stored only when it is a valid score.
@@ -46,7 +54,7 @@ export function makeMeta({
   if (STATUS.includes(weakestSource)) meta.weakestSource = weakestSource;
   if (basis !== undefined) meta.basis = basis;
   if (adapter !== undefined) meta.adapter = adapter;
-  return meta;
+  return Object.freeze(meta);
 }
 
 export function weakestConfidence(...levels) {
@@ -83,6 +91,8 @@ export function combineConfidenceScore(scores) {
 }
 
 let __stepCounter = 0;
+// Test-only: exposed so test suites can isolate step counter state between runs.
+// Not intended for production use; call sites should use combineProvenance/derive.
 export function __resetStepCounter() {
   __stepCounter = 0;
 }