project-tiny-context-harness 0.11.0 → 0.12.0

package/dist/lib/design-resource-symbolic-manifest-validation.js

@@ -1,132 +0,0 @@
-import { validateDesignResourceLocatedDigest } from "./design-resource-fact-locator-validation.js";
-import { buildSymbolicApplicabilityIndex } from "./design-resource-symbolic-applicability-validation.js";
-import { createDesignResourceSymbolicCompilationSession } from "./design-resource-symbolic-compilation.js";
-import { validateSymbolicDispositions } from "./design-resource-symbolic-disposition-validation.js";
-import { validateSymbolicCertificates, validateSymbolicObligations, } from "./design-resource-symbolic-proof-validation.js";
-import { aggregateSymbolicCanonicalMetrics, validateSymbolicApplicabilityClosure, validateSymbolicPopulationAndQuantifier, validateSymbolicRegionWithinReachable, } from "./design-resource-symbolic-region-validation.js";
-import { validateSymbolicInspectorAndResources, validateSymbolicPropertyCatalog, } from "./design-resource-symbolic-resource-validation.js";
-import { validateSymbolicExactTargetCoverage, validateSymbolicReadinessClosure, } from "./design-resource-symbolic-safety-validation.js";
-import { validateSymbolicCensusClosure, validateSymbolicSubjectPopulationClosure, } from "./design-resource-symbolic-structural-closure-validation.js";
-import { buildSymbolicManifestIndexes, } from "./design-resource-symbolic-indexes.js";
-import { designResourceSymbolicRuleKey, invalid, omitRuleIdentityFields, requireKnownRefs, stableJson, unique, } from "./design-resource-symbolic-validation-support.js";
-export function validateDesignResourceSymbolicManifest(manifest, parsed, resources, contents) {
-    validateManifestIdentities(manifest);
-    validateSymbolicReadinessClosure(manifest);
-    const target = parsed.handoff.targets[0];
-    if (!manifest.subjects.length || !manifest.properties.length)
-        invalid("v2_subject_property_universe_required", target.key);
-    const compilation = createDesignResourceSymbolicCompilationSession(manifest);
-    const reachable = compilation.compile(manifest.reachable_region);
-    if (reachable.canonical_dag.root_ref === "terminal.false")
-        invalid("v2_reachable_region_empty", target.key);
-    validateSymbolicInspectorAndResources(manifest, target, resources, contents);
-    validateSymbolicPropertyCatalog(manifest.properties);
-    const indexes = buildSymbolicManifestIndexes(manifest, parsed);
-    validateSymbolicSubjectPopulationClosure(manifest, target, indexes, resources, contents, compilation);
-    const applicability = buildSymbolicApplicabilityIndex(manifest, indexes);
-    const ruleProjections = validateRules(manifest, target, indexes, resources, contents, compilation);
-    validateSymbolicCensusClosure(manifest, indexes);
-    validateSymbolicDispositions(manifest, target.key, indexes, compilation);
-    const certificateMetrics = validateSymbolicCertificates(manifest, ruleProjections, indexes, compilation, target, resources, contents);
-    validateSymbolicApplicabilityClosure(manifest, reachable, indexes, applicability, compilation);
-    validateSymbolicObligations(manifest, ruleProjections, indexes.properties, indexes.oracles, indexes.environments, target, resources, contents);
-    validateSymbolicExactTargetCoverage(target.interpretation, manifest, ruleProjections, reachable, compilation);
-    const dagMetrics = aggregateSymbolicCanonicalMetrics(ruleProjections);
-    return {
-        ruleProjections,
-        metrics: {
-            semantic_obligations: manifest.semantic_proof_obligations.length,
-            certificate_obligations: manifest.noninterference_certificates.length,
-            certificate_covered_omitted_axes: certificateMetrics.coveredOmittedAxes,
-            certificate_covered_dependency_edges: certificateMetrics.coveredDependencyEdges,
-            canonical_dag_nodes: dagMetrics.nodes,
-            canonical_partition_edges: dagMetrics.edges,
-            canonical_bytes: dagMetrics.bytes,
-            theoretical_ground_cardinality: reachable.theoretical_ground_cardinality,
-        },
-    };
-}
-function validateManifestIdentities(manifest) {
-    for (const [label, keys] of [
-        ["inspector_census", manifest.inspector.census.map((item) => item.key)],
-        ["axis_domain", manifest.axis_domains.map((item) => item.key)],
-        ["subject", manifest.subjects.map((item) => item.key)],
-        ["population", manifest.populations.map((item) => item.key)],
-        ["property", manifest.properties.map((item) => item.key)],
-        ["fact_rule", manifest.fact_rules.map((item) => item.key)],
-        [
-            "disposition_region",
-            manifest.disposition_regions.map((item) => item.key),
-        ],
-        [
-            "semantic_obligation",
-            manifest.semantic_proof_obligations.map((item) => item.key),
-        ],
-        ["dependency_edge", manifest.dependency_edges.map((item) => item.key)],
-        [
-            "certificate",
-            manifest.noninterference_certificates.map((item) => item.key),
-        ],
-        ["oracle", manifest.oracles.map((item) => item.key)],
-        ["environment", manifest.environments.map((item) => item.key)],
-        [
-            "acceptance_blocker",
-            manifest.acceptance_blockers.map((item) => item.key),
-        ],
-    ])
-        unique(keys, `v2_${label}_key_duplicate`);
-}
-function validateRules(manifest, target, indexes, resources, contents, compilation) {
-    const reachableRegionDigests = new Set();
-    return manifest.fact_rules.map((rule) => {
-        const compiled = compilation.compile(rule.region);
-        if (!reachableRegionDigests.has(compiled.canonical_sha256)) {
-            validateSymbolicRegionWithinReachable(rule.region, manifest.reachable_region, rule.key, compilation);
-            reachableRegionDigests.add(compiled.canonical_sha256);
-        }
-        const subject = indexes.subjects.get(rule.subject_or_relation_ref);
-        const property = indexes.properties.get(rule.property_ref);
-        if (!subject)
-            invalid("v2_rule_subject_unknown", rule.key);
-        if (!property)
-            invalid("v2_rule_property_unknown", rule.key);
-        if (rule.target_ref !== target.key)
-            invalid("v2_rule_target_mismatch", rule.key);
-        validateRuleAuthority(rule, subject.population_ref, property, indexes);
-        validateRuleValues(rule, compiled.canonical_sha256, new Set(target.resource_refs), resources, contents);
-        return { rule, compiled_region: compiled };
-    });
-}
-function validateRuleAuthority(rule, subjectPopulationRef, property, indexes) {
-    unique(rule.census_refs, `v2_rule_census_ref_duplicate:${rule.key}`);
-    unique(rule.source_item_refs, `v2_rule_source_item_ref_duplicate:${rule.key}`);
-    unique(rule.semantic_obligation_refs, `v2_rule_obligation_ref_duplicate:${rule.key}`);
-    validateSymbolicPopulationAndQuantifier(rule, subjectPopulationRef, indexes.populations);
-    requireKnownRefs(rule.census_refs, indexes.census, "v2_rule_census_unknown");
-    requireKnownRefs(rule.source_item_refs, indexes.sourceItems, "v2_rule_source_item_unknown");
-    requireKnownRefs(property.census_refs, indexes.census, "v2_property_census_unknown");
-    if (!property.census_refs.length)
-        invalid("v2_rule_property_census_required", rule.key);
-    const subject = indexes.subjects.get(rule.subject_or_relation_ref);
-    for (const ref of [...subject.census_refs, ...property.census_refs])
-        if (!rule.census_refs.includes(ref))
-            invalid("v2_rule_required_census_ref_missing", `${rule.key}:${ref}`);
-    for (const capability of property.inspector_capability_refs)
-        if (!indexes.inspectorCapabilities.has(capability))
-            invalid("v2_rule_inspector_capability_missing", `${rule.key}:${capability}`);
-    if (rule.value_kind !== property.value_kind)
-        invalid("v2_rule_value_kind_mismatch", rule.key);
-}
-function validateRuleValues(rule, regionSha256, targetResources, resources, contents) {
-    validateDesignResourceLocatedDigest(rule.expected, resources, contents, `rule.${rule.key}.expected`);
-    validateDesignResourceLocatedDigest(rule.lineage.resolved_value, resources, contents, `rule.${rule.key}.lineage.resolved_value`);
-    for (const located of [rule.expected, rule.lineage.resolved_value])
-        if (targetResources.size &&
-            !targetResources.has(located.locator.resource_ref))
-            invalid("v2_rule_resource_outside_target", `${rule.key}:${located.locator.resource_ref}`);
-    if (stableJson(rule.expected) !== stableJson(rule.lineage.resolved_value))
-        invalid("v2_rule_expected_lineage_mismatch", rule.key);
-    const expectedKey = designResourceSymbolicRuleKey(omitRuleIdentityFields(rule), regionSha256);
-    if (rule.key !== expectedKey)
-        invalid("v2_rule_identity_mismatch", `${rule.key}:${expectedKey}`);
-}

package/dist/lib/design-resource-symbolic-noninterference-artifact.d.ts

@@ -1,33 +0,0 @@
-import { Buffer } from "node:buffer";
-import type { DesignResource } from "./design-resource-handoff-file-primitives.js";
-import type { DesignResourceObservableRuleManifestV2, DesignResourceSymbolicHandoffTargetV2, DesignResourceSymbolicNoninterferenceArtifactV2, DesignResourceSymbolicNoninterferenceCertificateV2, DesignResourceSymbolicNoninterferenceFailureWitnessV1, DesignResourceSymbolicNoninterferenceProofV2 } from "./design-resource-symbolic-fact-types.js";
-export declare const SYMBOLIC_NONINTERFERENCE_ORACLE_IDENTITY: "ty-context-symbolic-noninterference-oracle";
-export declare const SYMBOLIC_NONINTERFERENCE_ORACLE_VERSION: "2.1.0";
-export declare const SYMBOLIC_NONINTERFERENCE_ORACLE_IMPLEMENTATION_SHA256: string;
-export interface SymbolicNoninterferenceArtifactBindingV1 {
-    static_dependency_nodes: DesignResourceSymbolicNoninterferenceProofV2["static_dependency_nodes"];
-    static_rule_roots: DesignResourceSymbolicNoninterferenceProofV2["static_rule_roots"];
-    equivalence_cases: DesignResourceSymbolicNoninterferenceProofV2["equivalence_cases"];
-    complete_domain_cardinality: string | null;
-    oracle_version: string;
-    oracle_implementation_sha256: string;
-    oracle_capability: string;
-    environment_sha256: string;
-    input_snapshot_sha256: string;
-    source_manifest_snapshot_sha256: string | null;
-    target_snapshot_sha256: string;
-    certificate_scope_sha256: string;
-    rule_scope_sha256: string;
-    omitted_axis_refs: string[];
-    method_result_sha256: string;
-    artifact_resource_ref: string;
-    artifact_path: string;
-    artifact_sha256: string;
-    failure_witness: DesignResourceSymbolicNoninterferenceFailureWitnessV1 | null;
-}
-export declare function createSymbolicNoninterferenceArtifactBinding(manifest: DesignResourceObservableRuleManifestV2, certificate: DesignResourceSymbolicNoninterferenceCertificateV2, proof: DesignResourceSymbolicNoninterferenceProofV2, target: DesignResourceSymbolicHandoffTargetV2, resources: ReadonlyMap<string, DesignResource>, contents: ReadonlyMap<string, Buffer>, artifactResourceRef: string, artifactPath: string): {
-    artifact: DesignResourceSymbolicNoninterferenceArtifactV2;
-    text: string;
-    binding: SymbolicNoninterferenceArtifactBindingV1;
-};
-export declare function validateSymbolicNoninterferenceArtifact(manifest: DesignResourceObservableRuleManifestV2, certificate: DesignResourceSymbolicNoninterferenceCertificateV2, proof: DesignResourceSymbolicNoninterferenceProofV2, target: DesignResourceSymbolicHandoffTargetV2, resources: ReadonlyMap<string, DesignResource>, contents: ReadonlyMap<string, Buffer>): void;

package/dist/lib/design-resource-symbolic-noninterference-artifact.js

@@ -1,110 +0,0 @@
-import { invalid, stableJson, } from "./design-resource-symbolic-validation-support.js";
-import { recomputeSymbolicNoninterferenceArtifact } from "./design-resource-symbolic-noninterference-recompute.js";
-import { fingerprintExecutableModuleClosure } from "./design-resource-symbolic-oracle-fingerprint.js";
-import { canonicalJson, sha256Hex } from "./strict-codec.js";
-export const SYMBOLIC_NONINTERFERENCE_ORACLE_IDENTITY = "ty-context-symbolic-noninterference-oracle";
-export const SYMBOLIC_NONINTERFERENCE_ORACLE_VERSION = "2.1.0";
-export const SYMBOLIC_NONINTERFERENCE_ORACLE_IMPLEMENTATION_SHA256 = fingerprintExecutableModuleClosure([
-    import.meta.url,
-    new URL("./design-resource-symbolic-noninterference-validation.js", import.meta.url).href,
-    new URL("./design-resource-symbolic-static-dependency-validation.js", import.meta.url).href,
-    new URL("./symbolic-denotation-engine.js", import.meta.url).href,
-]);
-export function createSymbolicNoninterferenceArtifactBinding(manifest, certificate, proof, target, resources, contents, artifactResourceRef, artifactPath) {
-    const artifact = recomputeSymbolicNoninterferenceArtifact(manifest, certificate, proof, target, resources, contents);
-    const text = canonicalJson(artifact);
-    return {
-        artifact,
-        text,
-        binding: {
-            static_dependency_nodes: structuredClone(artifact.derived_result.static_dependency_nodes),
-            static_rule_roots: structuredClone(artifact.derived_result.static_rule_roots),
-            equivalence_cases: structuredClone(artifact.derived_result.equivalence_cases),
-            complete_domain_cardinality: artifact.derived_result.complete_domain_cardinality,
-            oracle_version: artifact.oracle_version,
-            oracle_implementation_sha256: artifact.oracle_implementation_sha256,
-            oracle_capability: artifact.oracle_capability,
-            environment_sha256: artifact.environment_sha256,
-            input_snapshot_sha256: artifact.input_snapshot_sha256,
-            source_manifest_snapshot_sha256: artifact.source_manifest_snapshot_sha256,
-            target_snapshot_sha256: artifact.target_snapshot_sha256,
-            certificate_scope_sha256: artifact.certificate_scope_sha256,
-            rule_scope_sha256: artifact.rule_scope_sha256,
-            omitted_axis_refs: [...artifact.omitted_axis_refs],
-            method_result_sha256: artifact.method_result_sha256,
-            artifact_resource_ref: artifactResourceRef,
-            artifact_path: artifactPath,
-            artifact_sha256: sha256Hex(text),
-            failure_witness: artifact.failure_witness
-                ? structuredClone(artifact.failure_witness)
-                : null,
-        },
-    };
-}
-export function validateSymbolicNoninterferenceArtifact(manifest, certificate, proof, target, resources, contents) {
-    const oracle = manifest.oracles.find((item) => item.key === proof.oracle_ref);
-    if (oracle?.identity !== SYMBOLIC_NONINTERFERENCE_ORACLE_IDENTITY ||
-        oracle.version !== SYMBOLIC_NONINTERFERENCE_ORACLE_VERSION ||
-        oracle.sha256 !== SYMBOLIC_NONINTERFERENCE_ORACLE_IMPLEMENTATION_SHA256)
-        invalid("v2_noninterference_package_oracle_identity_mismatch", proof.oracle_ref);
-    const expected = recomputeSymbolicNoninterferenceArtifact(manifest, certificate, proof, target, resources, contents);
-    const resource = resources.get(proof.artifact_resource_ref);
-    const bytes = contents.get(proof.artifact_resource_ref);
-    if (!resource ||
-        !bytes ||
-        resource.role !== "supporting" ||
-        resource.path !== proof.artifact_path ||
-        resource.sha256 !== proof.artifact_sha256 ||
-        sha256Hex(bytes) !== proof.artifact_sha256 ||
-        !target.resource_refs.includes(proof.artifact_resource_ref))
-        invalid("v2_noninterference_artifact_resource_mismatch", `${certificate.key}:${proof.side}:${proof.artifact_resource_ref}`);
-    const expectedText = canonicalJson(expected);
-    if (bytes.toString("utf8") !== expectedText)
-        invalid("v2_noninterference_artifact_current_input_mismatch", `${certificate.key}:${proof.side}`);
-    const binding = {
-        oracle_version: proof.oracle_version,
-        oracle_implementation_sha256: proof.oracle_implementation_sha256,
-        oracle_capability: proof.oracle_capability,
-        environment_sha256: proof.environment_sha256,
-        input_snapshot_sha256: proof.input_snapshot_sha256,
-        source_manifest_snapshot_sha256: proof.source_manifest_snapshot_sha256,
-        target_snapshot_sha256: proof.target_snapshot_sha256,
-        certificate_scope_sha256: proof.certificate_scope_sha256,
-        rule_scope_sha256: proof.rule_scope_sha256,
-        omitted_axis_refs: proof.omitted_axis_refs,
-        method_result_sha256: proof.method_result_sha256,
-        failure_witness: proof.failure_witness,
-    };
-    const expectedBinding = {
-        oracle_version: expected.oracle_version,
-        oracle_implementation_sha256: expected.oracle_implementation_sha256,
-        oracle_capability: expected.oracle_capability,
-        environment_sha256: expected.environment_sha256,
-        input_snapshot_sha256: expected.input_snapshot_sha256,
-        source_manifest_snapshot_sha256: expected.source_manifest_snapshot_sha256,
-        target_snapshot_sha256: expected.target_snapshot_sha256,
-        certificate_scope_sha256: expected.certificate_scope_sha256,
-        rule_scope_sha256: expected.rule_scope_sha256,
-        omitted_axis_refs: expected.omitted_axis_refs,
-        method_result_sha256: expected.method_result_sha256,
-        failure_witness: expected.failure_witness,
-    };
-    if (stableJson(binding) !== stableJson(expectedBinding))
-        invalid("v2_noninterference_artifact_binding_mismatch", `${certificate.key}:${proof.side}`);
-    if (proof.side === "source" &&
-        stableJson({
-            static_dependency_nodes: proof.static_dependency_nodes,
-            static_rule_roots: proof.static_rule_roots,
-            equivalence_cases: proof.equivalence_cases,
-            complete_domain_cardinality: proof.complete_domain_cardinality,
-        }) !==
-            stableJson({
-                static_dependency_nodes: expected.derived_result.static_dependency_nodes,
-                static_rule_roots: expected.derived_result.static_rule_roots,
-                equivalence_cases: expected.derived_result.equivalence_cases,
-                complete_domain_cardinality: expected.derived_result.complete_domain_cardinality,
-            }))
-        invalid("v2_source_noninterference_proof_cache_mismatch", `${certificate.key}:${proof.method}`);
-    if (expected.verdict !== "passed" || expected.failure_witness)
-        invalid("v2_noninterference_current_input_counterexample", stableJson(expected.failure_witness));
-}

package/dist/lib/design-resource-symbolic-noninterference-equivalence.d.ts

@@ -1,3 +0,0 @@
-import type { DesignResourceSymbolicCompilationSession } from "./design-resource-symbolic-compilation.js";
-import type { DesignResourceHandoffPreflightV2, DesignResourceObservableRuleManifestV2, DesignResourceSymbolicNoninterferenceCertificateV2, DesignResourceSymbolicNoninterferenceProofV2 } from "./design-resource-symbolic-fact-types.js";
-export declare function validateSymbolicNoninterferenceEquivalence(proof: DesignResourceSymbolicNoninterferenceProofV2, manifest: DesignResourceObservableRuleManifestV2, certificate: DesignResourceSymbolicNoninterferenceCertificateV2, projections: DesignResourceHandoffPreflightV2["rule_projections"], compilation: DesignResourceSymbolicCompilationSession): void;

package/dist/lib/design-resource-symbolic-noninterference-equivalence.js

@@ -1,77 +0,0 @@
-import { assertSameSet, invalid, unique, } from "./design-resource-symbolic-validation-support.js";
-import { evaluateCanonicalSymbolicDenotation } from "./symbolic-denotation-engine.js";
-const MAX_EXHAUSTIVE_DOMAIN_CARDINALITY = 100000n;
-export function validateSymbolicNoninterferenceEquivalence(proof, manifest, certificate, projections, compilation) {
-    if (proof.static_dependency_nodes.length || proof.static_rule_roots.length)
-        invalid("v2_equivalence_static_graph_forbidden", certificate.key);
-    const caseRuleRefs = proof.equivalence_cases.flatMap((item) => item.fact_rule_refs);
-    unique(caseRuleRefs, `v2_equivalence_rule_ref_duplicate:${certificate.key}`);
-    assertSameSet(caseRuleRefs, certificate.fact_rule_refs, "v2_equivalence_rule_set_mismatch", certificate.key);
-    const projectionByRule = new Map(projections.map((projection) => [projection.rule.key, projection]));
-    const exhaustive = proof.method === "finite_complete_domain_exhaustive_equivalence";
-    const cardinality = BigInt(projections[0].compiled_region.theoretical_ground_cardinality);
-    validateDomainCardinality(proof, certificate.key, exhaustive, cardinality);
-    for (const proofCase of proof.equivalence_cases) {
-        if (!proofCase.fact_rule_refs.length)
-            invalid("v2_equivalence_case_rules_required", certificate.key);
-        const side = compilation.compile(proofCase.side_predicate);
-        const candidate = compilation.compile(proofCase.axis_erased_predicate);
-        for (const axisRef of certificate.omitted_axis_refs)
-            if (!candidate.omitted_axis_refs.includes(axisRef))
-                invalid("v2_equivalence_candidate_axis_not_erased", `${certificate.key}:${axisRef}`);
-        for (const ruleRef of proofCase.fact_rule_refs) {
-            const projection = projectionByRule.get(ruleRef);
-            if (!projection)
-                invalid("v2_equivalence_rule_unknown", `${certificate.key}:${ruleRef}`);
-            if (exhaustive)
-                assertExhaustivelyEquivalentChain(manifest.axis_domains, projection.compiled_region, side, candidate, `${certificate.key}:${ruleRef}`);
-            else
-                assertSymbolicallyEquivalent(projection.compiled_region, side, candidate, certificate.key, ruleRef);
-        }
-    }
-}
-function validateDomainCardinality(proof, certificateKey, exhaustive, cardinality) {
-    if (exhaustive) {
-        if (proof.complete_domain_cardinality !== cardinality.toString())
-            invalid("v2_exhaustive_domain_cardinality_mismatch", certificateKey);
-        if (cardinality > MAX_EXHAUSTIVE_DOMAIN_CARDINALITY)
-            invalid("v2_exhaustive_domain_capacity_exceeded", `${certificateKey}:${cardinality}`);
-    }
-    else if (proof.complete_domain_cardinality !== null)
-        invalid("v2_symbolic_equivalence_cardinality_forbidden", certificateKey);
-}
-function assertSymbolicallyEquivalent(rule, side, candidate, certificateKey, ruleRef) {
-    if (rule.canonical_sha256 !== side.canonical_sha256)
-        invalid("v2_side_predicate_rule_mismatch", `${certificateKey}:${ruleRef}`);
-    if (side.canonical_sha256 !== candidate.canonical_sha256)
-        invalid("v2_symbolic_equivalence_mismatch", `${certificateKey}:${ruleRef}`);
-}
-function assertExhaustivelyEquivalentChain(domains, rule, side, erased, label) {
-    forEachAssignment(domains, 0, {}, (assignment) => {
-        if (evaluateCanonicalSymbolicDenotation(rule.canonical_dag, assignment) !==
-            evaluateCanonicalSymbolicDenotation(side.canonical_dag, assignment) ||
-            evaluateCanonicalSymbolicDenotation(side.canonical_dag, assignment) !==
-                evaluateCanonicalSymbolicDenotation(erased.canonical_dag, assignment))
-            invalid("v2_exhaustive_equivalence_mismatch", label);
-    });
-}
-function forEachAssignment(domains, index, assignment, visit) {
-    if (index === domains.length) {
-        visit(assignment);
-        return;
-    }
-    const domain = domains[index];
-    if (domain.kind === "enum") {
-        for (const value of domain.values) {
-            assignment[domain.key] = value;
-            forEachAssignment(domains, index + 1, assignment, visit);
-        }
-    }
-    else {
-        for (let value = domain.minimum; value <= domain.maximum; value += 1) {
-            assignment[domain.key] = value;
-            forEachAssignment(domains, index + 1, assignment, visit);
-        }
-    }
-    delete assignment[domain.key];
-}

package/dist/lib/design-resource-symbolic-noninterference-recompute.d.ts

@@ -1,4 +0,0 @@
-import { Buffer } from "node:buffer";
-import type { DesignResource } from "./design-resource-handoff-file-primitives.js";
-import type { DesignResourceObservableRuleManifestV2, DesignResourceSymbolicHandoffTargetV2, DesignResourceSymbolicNoninterferenceArtifactV2, DesignResourceSymbolicNoninterferenceCertificateV2, DesignResourceSymbolicNoninterferenceProofV2 } from "./design-resource-symbolic-fact-types.js";
-export declare function recomputeSymbolicNoninterferenceArtifact(manifest: DesignResourceObservableRuleManifestV2, certificate: DesignResourceSymbolicNoninterferenceCertificateV2, proof: DesignResourceSymbolicNoninterferenceProofV2, target: DesignResourceSymbolicHandoffTargetV2, resources: ReadonlyMap<string, DesignResource>, contents: ReadonlyMap<string, Buffer>): DesignResourceSymbolicNoninterferenceArtifactV2;

package/dist/lib/design-resource-symbolic-noninterference-recompute.js

@@ -1,146 +0,0 @@
-import { compareText, invalid, sha256, stableJson, } from "./design-resource-symbolic-validation-support.js";
-import { sha256Hex } from "./strict-codec.js";
-import { productionClosureFailure } from "./design-resource-symbolic-production-closure.js";
-import { symbolicNoninterferenceCertificateScopeSha256, symbolicNoninterferenceArtifactResourceRefs, symbolicNoninterferenceProductionTargetSnapshot, symbolicNoninterferenceRuleScopeSha256, symbolicNoninterferenceSourceManifestSnapshot, } from "./design-resource-symbolic-noninterference-scope.js";
-import { deriveCurrentSourceNoninterferenceEvidence } from "./design-resource-symbolic-source-ir-oracle.js";
-export function recomputeSymbolicNoninterferenceArtifact(manifest, certificate, proof, target, resources, contents) {
-    const oracle = manifest.oracles.find((item) => item.key === proof.oracle_ref);
-    const environment = manifest.environments.find((item) => item.key === proof.environment_ref);
-    if (!oracle)
-        invalid("v2_noninterference_oracle_unknown", proof.oracle_ref);
-    if (!environment)
-        invalid("v2_noninterference_environment_unknown", proof.environment_ref);
-    const inputs = inputSnapshot(manifest, resources, contents);
-    const certificateScopeSha256 = symbolicNoninterferenceCertificateScopeSha256(certificate);
-    const ruleScopeSha256 = symbolicNoninterferenceRuleScopeSha256(manifest, certificate);
-    const oracleCapability = `symbolic_noninterference.${proof.side}.${proof.method}`;
-    const current = proof.side === "source"
-        ? deriveCurrentSourceNoninterferenceEvidence({
-            manifest,
-            certificate,
-            method: proof.method,
-            target,
-            resources,
-            contents,
-        })
-        : {
-            derived_result: productionDerivedResult(proof),
-            failure_witness: currentProductionDependencyFailure(manifest, certificate, proof, target, resources, contents),
-        };
-    const sourceManifestSnapshotSha256 = proof.side === "source"
-        ? sha256(stableJson(symbolicNoninterferenceSourceManifestSnapshot(manifest)))
-        : null;
-    const methodMaterial = {
-        method: proof.method,
-        oracle_capability: oracleCapability,
-        derived_result: current.derived_result,
-        current_dependency_result: current.failure_witness,
-    };
-    return {
-        schema_version: "design-resource-symbolic-noninterference-artifact-v2",
-        side: proof.side,
-        method: proof.method,
-        oracle_identity: oracle.identity,
-        oracle_version: oracle.version,
-        oracle_implementation_sha256: oracle.sha256 ?? "0".repeat(64),
-        oracle_capability: oracleCapability,
-        environment_sha256: sha256(stableJson(environment)),
-        input_resources: inputs.map((input) => ({
-            resource_ref: input.resource_ref,
-            path: input.path,
-            declared_sha256: input.declared_sha256,
-            current_sha256: input.current_sha256,
-        })),
-        input_snapshot_sha256: sha256(stableJson(inputs)),
-        source_manifest_snapshot_sha256: sourceManifestSnapshotSha256,
-        target_snapshot_sha256: proof.side === "source"
-            ? sourceSnapshot(sourceManifestSnapshotSha256, certificateScopeSha256, ruleScopeSha256, inputs)
-            : productionSnapshot(manifest, target, inputs),
-        certificate_scope_sha256: certificateScopeSha256,
-        rule_scope_sha256: ruleScopeSha256,
-        omitted_axis_refs: [...certificate.omitted_axis_refs].sort(compareText),
-        derived_result: current.derived_result,
-        method_result_sha256: sha256(stableJson(methodMaterial)),
-        verdict: current.failure_witness ? "failed" : "passed",
-        failure_witness: current.failure_witness,
-    };
-}
-function inputSnapshot(manifest, resources, contents) {
-    const artifactRefs = symbolicNoninterferenceArtifactResourceRefs(manifest);
-    return manifest.inspector.input_resources
-        .map((input) => {
-        if (artifactRefs.has(input.resource_ref))
-            invalid("v2_noninterference_artifact_self_reference", input.resource_ref);
-        const resource = resources.get(input.resource_ref);
-        const bytes = contents.get(input.resource_ref);
-        if (!resource ||
-            !bytes ||
-            resource.path !== input.path ||
-            resource.sha256 !== input.sha256)
-            invalid("v2_noninterference_input_resource_missing", input.resource_ref);
-        return {
-            resource_ref: input.resource_ref,
-            path: input.path,
-            declared_sha256: input.sha256,
-            current_sha256: sha256Hex(bytes),
-        };
-    })
-        .sort((left, right) => compareText(left.resource_ref, right.resource_ref));
-}
-function sourceSnapshot(sourceManifestSnapshotSha256, certificateScopeSha256, ruleScopeSha256, inputs) {
-    return sha256(stableJson({
-        source_manifest_snapshot_sha256: sourceManifestSnapshotSha256,
-        certificate_scope_sha256: certificateScopeSha256,
-        rule_scope_sha256: ruleScopeSha256,
-        inputs,
-    }));
-}
-function productionSnapshot(manifest, target, inputs) {
-    return sha256(stableJson({
-        target: symbolicNoninterferenceProductionTargetSnapshot(manifest, target),
-        inputs,
-    }));
-}
-function currentProductionDependencyFailure(manifest, certificate, proof, target, resources, contents) {
-    if (proof.dynamic_dependency_kinds.length ||
-        proof.external_device_refs.length)
-        return unsupportedWitness(certificate, `declared:${[
-            ...proof.dynamic_dependency_kinds,
-            ...proof.external_device_refs,
-        ].join(",")}`);
-    const inputRefs = manifest.inspector.input_resources.map((input) => input.resource_ref);
-    return productionClosureFailure({
-        ...target,
-        resource_refs: inputRefs,
-        source_profile: {
-            ...target.source_profile,
-            dependency_resource_refs: inputRefs.filter((ref) => ref !== target.source_profile.entry_resource_ref),
-        },
-    }, certificate, resources, contents);
-}
-function unsupportedWitness(certificate, detail) {
-    return {
-        kind: "unsupported_dependency",
-        side: "production",
-        certificate_scope_sha256: symbolicNoninterferenceCertificateScopeSha256(certificate),
-        axis_ref: null,
-        fact_rule_ref: null,
-        resource_ref: null,
-        path: null,
-        locator: null,
-        node_ref: null,
-        byte_offset: null,
-        assignment: null,
-        detail,
-    };
-}
-function productionDerivedResult(proof) {
-    return {
-        source_ir_resource_ref: null,
-        static_dependency_nodes: structuredClone(proof.static_dependency_nodes),
-        static_rule_roots: structuredClone(proof.static_rule_roots),
-        equivalence_cases: structuredClone(proof.equivalence_cases),
-        complete_domain_cardinality: proof.complete_domain_cardinality,
-        exhaustive_evaluation_sha256: null,
-    };
-}

package/dist/lib/design-resource-symbolic-noninterference-scope.d.ts

@@ -1,7 +0,0 @@
-import type { DesignResourceObservableRuleManifestV2, DesignResourceSymbolicHandoffTargetV2, DesignResourceSymbolicNoninterferenceCertificateV2 } from "./design-resource-symbolic-fact-types.js";
-export declare function symbolicNoninterferenceCertificateScope(certificate: DesignResourceSymbolicNoninterferenceCertificateV2): Record<string, unknown>;
-export declare function symbolicNoninterferenceCertificateScopeSha256(certificate: DesignResourceSymbolicNoninterferenceCertificateV2): string;
-export declare function symbolicNoninterferenceRuleScopeSha256(manifest: DesignResourceObservableRuleManifestV2, certificate: DesignResourceSymbolicNoninterferenceCertificateV2): string;
-export declare function symbolicNoninterferenceSourceManifestSnapshot(manifest: DesignResourceObservableRuleManifestV2): Record<string, unknown>;
-export declare function symbolicNoninterferenceArtifactResourceRefs(manifest: DesignResourceObservableRuleManifestV2): Set<string>;
-export declare function symbolicNoninterferenceProductionTargetSnapshot(manifest: DesignResourceObservableRuleManifestV2, target: DesignResourceSymbolicHandoffTargetV2): Record<string, unknown>;

package/dist/lib/design-resource-symbolic-noninterference-scope.js

@@ -1,49 +0,0 @@
-import { compareText, sha256, stableJson, } from "./design-resource-symbolic-validation-support.js";
-export function symbolicNoninterferenceCertificateScope(certificate) {
-    const { key: _key, source_noninterference_proof: _sourceProof, production_noninterference_proof: _productionProof, ...scope } = certificate;
-    return {
-        ...scope,
-        fact_rule_refs: [...scope.fact_rule_refs].sort(compareText),
-        omitted_axis_refs: [...scope.omitted_axis_refs].sort(compareText),
-        dependency_edge_refs: [...scope.dependency_edge_refs].sort(compareText),
-    };
-}
-export function symbolicNoninterferenceCertificateScopeSha256(certificate) {
-    return sha256(stableJson(symbolicNoninterferenceCertificateScope(certificate)));
-}
-export function symbolicNoninterferenceRuleScopeSha256(manifest, certificate) {
-    const rules = new Map(manifest.fact_rules.map((rule) => [rule.key, rule]));
-    return sha256(stableJson([...certificate.fact_rule_refs].sort(compareText).map((ruleRef) => ({
-        rule_ref: ruleRef,
-        rule: rules.get(ruleRef) ?? null,
-    }))));
-}
-export function symbolicNoninterferenceSourceManifestSnapshot(manifest) {
-    return {
-        ...manifest,
-        noninterference_certificates: manifest.noninterference_certificates.map(symbolicNoninterferenceCertificateScope),
-    };
-}
-export function symbolicNoninterferenceArtifactResourceRefs(manifest) {
-    return new Set(manifest.noninterference_certificates.flatMap((certificate) => [
-        certificate.source_noninterference_proof,
-        certificate.production_noninterference_proof,
-    ]
-        .filter((proof) => proof != null)
-        .map((proof) => proof.artifact_resource_ref)));
-}
-export function symbolicNoninterferenceProductionTargetSnapshot(manifest, target) {
-    const artifacts = symbolicNoninterferenceArtifactResourceRefs(manifest);
-    const semanticInputs = new Set(manifest.inspector.input_resources.map((input) => input.resource_ref));
-    const keep = (ref) => semanticInputs.has(ref) && !artifacts.has(ref);
-    return {
-        ...target,
-        resource_refs: target.resource_refs.filter(keep).sort(compareText),
-        source_profile: {
-            ...target.source_profile,
-            dependency_resource_refs: target.source_profile.dependency_resource_refs
-                .filter(keep)
-                .sort(compareText),
-        },
-    };
-}

package/dist/lib/design-resource-symbolic-noninterference-shape.d.ts

@@ -1,2 +0,0 @@
-import type { DesignResourceSymbolicNoninterferenceProofV2 } from "./design-resource-symbolic-fact-types.js";
-export declare function parseSymbolicNoninterferenceProof(value: unknown, label: string): DesignResourceSymbolicNoninterferenceProofV2;