project-tiny-context-harness 0.11.0 → 0.12.0

package/dist/lib/long-task-activation-validation.js

@@ -1,246 +0,0 @@
-import { captureContextGraphSnapshotWithPhysicalFiles } from "./context-graph-snapshot.js";
-import { addDiagnosticError } from "./long-task-authoring-preflight-diagnostics.js";
-import { compileProductClaimCoverage, } from "./long-task-claims.js";
-import { hashDeclaredFiles, validateCounterfactualPaths, validateTechnicalPaths, validateVerificationInputSeparation, } from "./long-task-delivery-preflight.js";
-import { validateClaimEvidenceSensitivity } from "./long-task-evidence-sensitivity-policy.js";
-import { validateSemanticConformance } from "./long-task-conformance-policy.js";
-import { deliveryContractStructureDiagnostics, validateResolvedCompletionAuthorityClosure, validateDeliveryContractStructure, } from "./long-task-delivery-validation.js";
-import { validateRawExecutionObservationOwnership } from "./long-task-observation-ownership.js";
-import { validateLongTaskDesignResourceHandoffs } from "./long-task-design-resource-handoff.js";
-import { exactExternalDesignObligationRefs } from "./long-task-design-obligation.js";
-import { validateLongTaskSemanticFactClosure } from "./long-task-semantic-fact-closure.js";
-import { proofAdequacyCheckKey, validateLongTaskProofAdequacy, } from "./long-task-proof-adequacy.js";
-import { freezeDeliveryCheck } from "./long-task-runner-freeze.js";
-import { scopeDeliveryBindings } from "./long-task-scoped-binding.js";
-import { classifyLongTaskRisk, validateRiskProof, } from "./long-task-risk.js";
-import { validateSourceContinuity } from "./long-task-source-continuity.js";
-import { compileSourceInventory } from "./long-task-source-inventory.js";
-import { validateSourceTargetContinuity } from "./long-task-source-target-continuity.js";
-import { validateSourceAnchors } from "./long-task-source-validation.js";
-import { assertAcceptanceReachable, compileAcceptanceReachability, } from "./long-task-acceptance-reachability.js";
-import { exactExternalClaimActualObligationRefsByAssertion } from "./long-task-acceptance-reachability-helpers.js";
-import { captureWorkspaceManifest, repoRelative, } from "./long-task-workspace.js";
-export async function validateContractForActivation(options) {
-    const { contract, repository, workdir, mode } = options;
-    const diagnostics = options.diagnostics ?? [];
-    const structureOptions = {
-        allowDeferredDesignComponentBindingClosure: true,
-        deferCompletionAuthorityClosure: true,
-    };
-    if (mode === "collect")
-        for (const error of deliveryContractStructureDiagnostics(contract, structureOptions))
-            addDiagnosticError(diagnostics, error);
-    else
-        validateDeliveryContractStructure(contract, structureOptions);
-    const claims = await attempt(mode, diagnostics, () => compileProductClaimCoverage(contract));
-    if (mode === "fail_fast") {
-        const decisions = contract.source_claims
-            .filter((claim) => claim.disposition.type === "decision_required")
-            .map((claim) => claim.key);
-        if (decisions.length)
-            throw new Error(`source_claim_decision_required:${decisions.join(",")}`);
-    }
-    const sourceHashes = await attempt(mode, diagnostics, () => hashDeclaredFiles(repository, contract.task.source_paths, "source"));
-    await attempt(mode, diagnostics, () => validateSourceAnchors(repository, contract.source_claims));
-    let sourceBackedExecutionTargets = new Map();
-    const sourceItems = await attempt(mode, diagnostics, async () => {
-        const items = await compileSourceInventory(repository, contract.task.source_paths);
-        validateSourceContinuity(contract, items, mode === "collect"
-            ? (error) => addDiagnosticError(diagnostics, new Error(error))
-            : undefined);
-        sourceBackedExecutionTargets = validateSourceTargetContinuity(contract, items, mode === "collect"
-            ? (error) => addDiagnosticError(diagnostics, new Error(error))
-            : undefined);
-        return items;
-    });
-    const designHandoffs = await attempt(mode, diagnostics, () => validateLongTaskDesignResourceHandoffs(contract, repository, sourceItems ?? []));
-    const projectDesignAuthority = designHandoffs?.find((handoff) => handoff.project_design_authority_resolution.identity !== null)?.project_design_authority_resolution.identity ?? null;
-    const risk = await attempt(mode, diagnostics, () => {
-        return classifyLongTaskRisk(contract);
-    });
-    const contextCapture = await attempt(mode, diagnostics, () => captureContextGraphSnapshotWithPhysicalFiles(repository, contract.task.context_refs, contract.task.context_snapshot_mode));
-    const context = contextCapture?.snapshot ?? null;
-    const semanticFactClosure = sourceItems && contextCapture
-        ? await attempt(mode, diagnostics, () => validateLongTaskSemanticFactClosure(contract, repository, sourceItems, contextCapture, designHandoffs ?? undefined))
-        : null;
-    const proofAdequacy = semanticFactClosure
-        ? await attempt(mode, diagnostics, () => validateLongTaskProofAdequacy(contract, semanticFactClosure.manifest, semanticFactClosure.expectations_by_check))
-        : null;
-    const workdirRelative = repoRelative(repository, workdir);
-    const workspace = await attempt(mode, diagnostics, async () => {
-        const manifest = await captureWorkspaceManifest(repository, workdir);
-        validateTechnicalPaths(contract, repository, workdirRelative, manifest);
-        return manifest;
-    });
-    if (!workspace)
-        return emptyCompiledResult(claims, risk, sourceHashes, sourceItems, context);
-    const observationAuthorityPaths = [
-        ...new Set([
-            ...workspace.files
-                .map((file) => file.path)
-                .filter((file) => file === workdirRelative || file.startsWith(`${workdirRelative}/`)),
-            `${workdirRelative}/delivery-contract.yaml`,
-            ...Object.keys(sourceHashes ?? {}),
-            ...(context?.files ?? []),
-            ...(designHandoffs ?? []).flatMap((handoff) => handoff.project_design_authority_resolution.member_paths),
-        ]),
-    ].sort((left, right) => Buffer.from(left).compare(Buffer.from(right)));
-    const globalChecks = [];
-    for (const check of contract.global.acceptance.checks) {
-        const executionTarget = contract.task.execution_targets.find((target) => target.key === check.execution_target.target_ref);
-        if (!executionTarget)
-            continue;
-        const frozen = await attempt(mode, diagnostics, () => freezeDeliveryCheck(check, null, repository, workspace, executionTarget, contract.task.execution_targets, [], [], contract.outcomes.flatMap((outcome) => scopeDeliveryBindings(outcome.key, outcome.technical.bindings)), contract.outcomes.flatMap((outcome) => outcome.product.owner.path_globs), sourceBackedExecutionTargets.get(executionTarget.key) ?? null, observationAuthorityPaths, proofAdequacy?.[proofAdequacyCheckKey(null, check.key)], new Set(), exactExternalClaimActualObligationRefsByAssertion(contract, null, check, proofAdequacy?.[proofAdequacyCheckKey(null, check.key)]
-            ?.expected_authority_refs ?? {})), null, check.key);
-        if (frozen)
-            globalChecks.push(frozen);
-    }
-    const outcomes = [];
-    for (const outcome of contract.outcomes) {
-        const checks = [];
-        const blockedDesignAssertionRefsByCheck = new Map();
-        for (const check of outcome.acceptance.checks) {
-            const executionTarget = contract.task.execution_targets.find((target) => target.key === check.execution_target.target_ref);
-            if (!executionTarget)
-                continue;
-            const designTargets = designTargetsForCheck(outcome, check.key);
-            const externalDesignObligationRefs = exactExternalDesignObligationRefs(contract, outcome.key, check.key);
-            const externalClaimObligationRefsByAssertion = exactExternalClaimActualObligationRefsByAssertion(contract, outcome.key, check, proofAdequacy?.[proofAdequacyCheckKey(outcome.key, check.key)]
-                ?.expected_authority_refs ?? {});
-            const frozen = await attempt(mode, diagnostics, () => freezeDeliveryCheck(check, outcome.key, repository, workspace, executionTarget, contract.task.execution_targets, designTargets, semanticFactClosure?.expectations_by_check.get(check.key) ?? [], scopeDeliveryBindings(outcome.key, outcome.technical.bindings), outcome.product.owner.path_globs, sourceBackedExecutionTargets.get(executionTarget.key) ?? null, observationAuthorityPaths, proofAdequacy?.[proofAdequacyCheckKey(outcome.key, check.key)], externalDesignObligationRefs, externalClaimObligationRefsByAssertion), outcome.key, check.key);
-            if (frozen) {
-                blockedDesignAssertionRefsByCheck.set(check.key, removedAssertionRefs(check, frozen));
-                checks.push(frozen);
-            }
-        }
-        outcomes.push({
-            ...outcome,
-            internal_id: `OUT.${outcome.key}`,
-            generated_claims: claims?.by_outcome[outcome.key] ?? [],
-            risk_reasons: risk?.reasons_by_outcome[outcome.key] ?? [],
-            acceptance: {
-                ...outcome.acceptance,
-                checks,
-                counterfactual_controls: outcome.acceptance.counterfactual_controls.map((control) => projectCounterfactualControl(control, outcome.acceptance.checks.find((check) => check.key === control.check_key), blockedDesignAssertionRefsByCheck.get(control.check_key) ??
-                    new Set())),
-            },
-        });
-    }
-    const allChecks = [
-        ...globalChecks,
-        ...outcomes.flatMap((outcome) => outcome.acceptance.checks),
-    ];
-    const acceptanceReachability = claims && semanticFactClosure
-        ? compileAcceptanceReachability({
-            contract,
-            claims,
-            manifest: semanticFactClosure.manifest,
-            compiled_checks: allChecks,
-        })
-        : null;
-    await attempt(mode, diagnostics, () => validateResolvedCompletionAuthorityClosure(contract, globalChecks, outcomes, acceptanceReachability, mode === "collect"
-        ? (error) => addDiagnosticError(diagnostics, new Error(error))
-        : undefined));
-    if (risk)
-        await attempt(mode, diagnostics, () => validateRiskProof(contract, risk, acceptanceReachability, outcomes));
-    if (acceptanceReachability) {
-        if (mode === "fail_fast")
-            assertAcceptanceReachable(acceptanceReachability);
-        else
-            for (const obligation of acceptanceReachability.obligations)
-                if (obligation.status === "unreachable")
-                    addDiagnosticError(diagnostics, new Error(`acceptance_obligation_unreachable:${obligation.source_obligation_ref}:${obligation.reason}`), obligation.outcome_key);
-    }
-    await attempt(mode, diagnostics, () => validateVerificationInputSeparation(contract, allChecks, workdirRelative));
-    await attempt(mode, diagnostics, () => validateRawExecutionObservationOwnership(allChecks));
-    if (allGlobalChecksFrozen(contract, globalChecks) &&
-        allOutcomeChecksFrozen(contract, outcomes)) {
-        await attempt(mode, diagnostics, () => validateCounterfactualPaths(contract, globalChecks, outcomes, repository, workdirRelative, [
-            ...contract.task.source_paths,
-            ...(context?.files ?? contract.task.context_refs),
-        ]));
-        await attempt(mode, diagnostics, () => validateClaimEvidenceSensitivity(contract, globalChecks, outcomes, mode === "collect"
-            ? (error) => addDiagnosticError(diagnostics, new Error(error))
-            : undefined));
-        if (risk)
-            await attempt(mode, diagnostics, () => validateSemanticConformance(contract, risk.effective_level, allChecks, mode === "collect"
-                ? (error) => addDiagnosticError(diagnostics, new Error(error))
-                : undefined, acceptanceReachability));
-    }
-    return {
-        claims,
-        risk,
-        source_hashes: sourceHashes,
-        source_items: sourceItems,
-        context_snapshot: context,
-        project_design_authority: projectDesignAuthority,
-        workspace,
-        global_checks: globalChecks,
-        outcomes,
-        proof_adequacy: proofAdequacy,
-        acceptance_reachability: acceptanceReachability,
-    };
-}
-function designTargetsForCheck(outcome, checkKey) {
-    return (outcome.product.surface_bindings ?? []).flatMap((binding) => binding.design_targets
-        .filter((target) => target.conformance_check_ref === checkKey)
-        .map((target) => ({
-        ...target,
-        surface_binding_ref: binding.key,
-        surface_ref: binding.surface_ref,
-        target_ref: binding.target_ref,
-    })));
-}
-function removedAssertionRefs(source, compiled) {
-    const retained = new Set([...compiled.positive_assertions, ...compiled.negative_assertions].map((assertion) => assertion.key));
-    return new Set([...source.positive_assertions, ...source.negative_assertions]
-        .map((assertion) => assertion.key)
-        .filter((assertionRef) => !retained.has(assertionRef)));
-}
-function projectCounterfactualControl(control, check, externallyBlockedAssertionRefs) {
-    if (!check || !externallyBlockedAssertionRefs.size)
-        return control;
-    const externallyBlockedClaims = new Set([...check.positive_assertions, ...check.negative_assertions]
-        .filter((assertion) => externallyBlockedAssertionRefs.has(assertion.key))
-        .flatMap((assertion) => assertion.claims));
-    return {
-        ...control,
-        claims: control.claims.filter((claimRef) => !externallyBlockedClaims.has(claimRef)),
-        expected_assertion_failures: control.expected_assertion_failures.filter((assertionRef) => !externallyBlockedAssertionRefs.has(assertionRef)),
-        preserved_assertions: control.preserved_assertions.filter((assertionRef) => !externallyBlockedAssertionRefs.has(assertionRef)),
-    };
-}
-async function attempt(mode, diagnostics, action, outcomeKey, checkKey) {
-    try {
-        return await action();
-    }
-    catch (error) {
-        if (mode === "fail_fast")
-            throw error;
-        addDiagnosticError(diagnostics, error, outcomeKey, checkKey);
-        return null;
-    }
-}
-function emptyCompiledResult(claims, risk, sourceHashes, sourceItems, context) {
-    return {
-        claims,
-        risk,
-        source_hashes: sourceHashes,
-        source_items: sourceItems,
-        context_snapshot: context,
-        project_design_authority: null,
-        workspace: null,
-        global_checks: [],
-        outcomes: [],
-        proof_adequacy: null,
-        acceptance_reachability: null,
-    };
-}
-function allGlobalChecksFrozen(contract, checks) {
-    return checks.length === contract.global.acceptance.checks.length;
-}
-function allOutcomeChecksFrozen(contract, outcomes) {
-    return outcomes.every((outcome) => outcome.acceptance.checks.length ===
-        contract.outcomes.find((item) => item.key === outcome.key).acceptance
-            .checks.length);
-}

package/dist/lib/long-task-active-authority-lock-context.d.ts

@@ -1,4 +0,0 @@
-import type { ActiveAuthorityLockToken } from "./long-task-state.js";
-export declare function runWithActiveAuthorityLockToken<T>(token: ActiveAuthorityLockToken, action: () => Promise<T>): Promise<T>;
-export declare function assertActiveAuthorityLockToken(token: ActiveAuthorityLockToken, repositoryRoot: string): void;
-export declare function currentActiveAuthorityLockToken(repositoryRoot: string): ActiveAuthorityLockToken | null;

package/dist/lib/long-task-active-authority-lock-context.js

@@ -1,29 +0,0 @@
-import { AsyncLocalStorage } from "node:async_hooks";
-import path from "node:path";
-const activeAuthorityLockTokens = new WeakSet();
-const activeAuthorityLockContext = new AsyncLocalStorage();
-export async function runWithActiveAuthorityLockToken(token, action) {
-    activeAuthorityLockTokens.add(token);
-    try {
-        return await activeAuthorityLockContext.run(token, action);
-    }
-    finally {
-        activeAuthorityLockTokens.delete(token);
-    }
-}
-export function assertActiveAuthorityLockToken(token, repositoryRoot) {
-    if (!activeAuthorityLockTokens.has(token) ||
-        normalizePath(token.repository_root) !== normalizePath(repositoryRoot))
-        throw new Error("active_authority_lock_token_invalid");
-}
-export function currentActiveAuthorityLockToken(repositoryRoot) {
-    const token = activeAuthorityLockContext.getStore();
-    if (!token)
-        return null;
-    assertActiveAuthorityLockToken(token, repositoryRoot);
-    return token;
-}
-function normalizePath(value) {
-    const normalized = path.resolve(value).replace(/\\/gu, "/");
-    return process.platform === "win32" ? normalized.toLowerCase() : normalized;
-}

package/dist/lib/long-task-admitted-observation-records.d.ts

@@ -1,25 +0,0 @@
-import type { EvidenceCapabilityRecordV2 } from "./long-task-delivery-types.js";
-import type { JsonPointerExactLocator } from "./long-task-json-pointer-observation.js";
-export type AdmittedObservationCandidate = {
-    assertion_key: string;
-    identity_ref: string;
-    method: string;
-    actual_observation: {
-        artifact_path: string;
-        locator: JsonPointerExactLocator;
-        sensitivity: string;
-    };
-    comparison: {
-        comparator: string;
-        mode: string;
-        tolerance: unknown;
-        mask: unknown;
-    };
-    oracle: {
-        trust: string;
-        identity: string;
-        version: string;
-        sha256: string | null;
-    };
-};
-export declare function admittedObservationCandidates(records: EvidenceCapabilityRecordV2[]): AdmittedObservationCandidate[];

package/dist/lib/long-task-admitted-observation-records.js

@@ -1,40 +0,0 @@
-export function admittedObservationCandidates(records) {
-    const candidates = [];
-    for (const record of records) {
-        if (record.capability === "semantic_fact") {
-            candidates.push({
-                assertion_key: record.assertion_key,
-                identity_ref: record.fact_ref,
-                method: record.method,
-                actual_observation: record.actual_observation,
-                comparison: record.comparison,
-                oracle: record.oracle,
-            });
-            continue;
-        }
-        if (record.capability !== "design_method")
-            continue;
-        if ("fact_model" in record)
-            for (const result of record.rule_results)
-                candidates.push({
-                    assertion_key: record.assertion_key,
-                    identity_ref: result.obligation_ref,
-                    method: record.method,
-                    actual_observation: result.actual_observation,
-                    comparison: result.comparison,
-                    oracle: result.oracle,
-                });
-        else
-            for (const cell of record.cells)
-                for (const result of cell.fact_results)
-                    candidates.push({
-                        assertion_key: record.assertion_key,
-                        identity_ref: result.fact_ref,
-                        method: record.method,
-                        actual_observation: result.actual_observation,
-                        comparison: result.comparison,
-                        oracle: result.oracle,
-                    });
-    }
-    return candidates;
-}

package/dist/lib/long-task-admitted-observation.d.ts

@@ -1,93 +0,0 @@
-import type { CompiledCheckV2, CompiledObservationAuthorityV2, EvidenceCapabilityRecordV2, PackageObservationValueV2 } from "./long-task-delivery-types.js";
-import { type ExactDigestComparisonResult } from "./long-task-exact-comparison.js";
-import { JSON_POINTER_EXACT_CAPABILITY, type JsonPointerExactLocator, type JsonPointerExactObservation } from "./long-task-json-pointer-observation.js";
-export { JSON_POINTER_EXACT_CAPABILITY, JSON_POINTER_EXACT_LIMITS, JSON_POINTER_EXACT_METHODS, JSON_POINTER_EXACT_ORACLE_IDENTITY, JSON_POINTER_EXACT_ORACLE_VERSION, JSON_POINTER_EXACT_SPEC_SHA256, createJsonPointerExactBudget, extractJsonPointerExactObservationFromBytes, isJsonPointerExactOracle, } from "./long-task-json-pointer-observation.js";
-export type { JsonPointerExactBudget, JsonPointerExactLocator, JsonPointerExactObservation, } from "./long-task-json-pointer-observation.js";
-export { extractJsonPointerExactObservation } from "./long-task-observation-artifact.js";
-export interface PreparedAdmittedObservation {
-    assertion_key: string;
-    identity_ref: string;
-    authority_key: string | null;
-    obligation_ref: string | null;
-    method: string;
-    observation_key: string;
-    authority: CompiledObservationAuthorityV2["authority"] | null;
-    raw_value: unknown;
-    observation: JsonPointerExactObservation | null;
-    comparison: ExactDigestComparisonResult | null;
-    reason: string | null;
-}
-export interface PreparedAdmittedObservationSet {
-    readonly by_observation_key: ReadonlyMap<string, PreparedAdmittedObservation>;
-    readonly by_authority_key: ReadonlyMap<string, PreparedAdmittedObservation>;
-    readonly entries: readonly PreparedAdmittedObservation[];
-}
-export declare function prepareAdmittedObservations(input: {
-    check: CompiledCheckV2;
-    records: EvidenceCapabilityRecordV2[];
-    snapshot_root: string;
-    authority_paths?: readonly string[];
-    package_observations?: readonly PackageObservationValueV2[];
-}): Promise<PreparedAdmittedObservationSet>;
-export declare function admittedObservationAuthorityKey(authority: Pick<CompiledObservationAuthorityV2, "assertion_ref" | "obligation_ref" | "method">): string;
-export declare function resolveObservationAuthority(check: CompiledCheckV2, candidate: {
-    assertion_key: string;
-    identity_ref: string;
-    method: string;
-}): {
-    authority: CompiledObservationAuthorityV2;
-    reason: null;
-} | {
-    authority: null;
-    reason: string;
-};
-export declare function admittedObservationKey(artifactPath: string, locator: JsonPointerExactLocator): string;
-export declare function jsonPointerExactLocatorForIdentity(identity: string): {
-    kind: "json_pointer";
-    value: string;
-};
-export type ObservationCarrierRole = "expected_authority_forbidden" | "product_carrier" | "current_observer_artifact" | "unadmitted_evidence";
-export type MachineObservationCarrierRoleConflict = "expected_authority" | "evidence_role";
-export declare function classifyMachineObservationCarrierRoleConflict(input: {
-    carrier_pattern: string;
-    expected_authority_patterns: readonly string[];
-    evidence_role_patterns: readonly string[];
-}): MachineObservationCarrierRoleConflict | null;
-export declare function classifyObservationCarrier(input: {
-    artifact_path: string;
-    source_paths: string[];
-    expected_authority_paths: string[];
-    product_carrier_paths: string[];
-    current_observer_artifact_paths: string[];
-}): ObservationCarrierRole;
-export interface ObservationAdmissionInput {
-    method: string;
-    comparator: string;
-    mode: string;
-    tolerance: unknown;
-    mask: unknown;
-    sensitivity: string;
-    locator: JsonPointerExactLocator;
-    oracle: {
-        trust?: string;
-        identity?: string;
-        version?: string;
-        sha256?: string | null;
-    };
-    target_family: string;
-    observed_target_family?: string;
-    required_method?: string;
-    current_static_artifact: boolean;
-    historical_session?: boolean;
-    snapshot_matches?: boolean;
-}
-export type ObservationAdmissionDecision = {
-    authority: "machine";
-    reason: null;
-    capability: typeof JSON_POINTER_EXACT_CAPABILITY;
-} | {
-    authority: "external_confirmation";
-    reason: string;
-    capability: null;
-};
-export declare function observationAdmissionDecision(input: ObservationAdmissionInput): ObservationAdmissionDecision;

package/dist/lib/long-task-admitted-observation.js

@@ -1,201 +0,0 @@
-import { classifyRepositoryPatternOverlap, matchesRepoPattern, } from "./long-task-paths.js";
-import { canonicalValueJson, sha256Hex } from "./strict-codec.js";
-import { evaluateExactDigestComparison, } from "./long-task-exact-comparison.js";
-import { JSON_POINTER_EXACT_CAPABILITY, JSON_POINTER_EXACT_METHODS, isJsonPointerExactOracle, normalizeObservationArtifactPath, validateJsonPointerExactLocator, } from "./long-task-json-pointer-observation.js";
-export { JSON_POINTER_EXACT_CAPABILITY, JSON_POINTER_EXACT_LIMITS, JSON_POINTER_EXACT_METHODS, JSON_POINTER_EXACT_ORACLE_IDENTITY, JSON_POINTER_EXACT_ORACLE_VERSION, JSON_POINTER_EXACT_SPEC_SHA256, createJsonPointerExactBudget, extractJsonPointerExactObservationFromBytes, isJsonPointerExactOracle, } from "./long-task-json-pointer-observation.js";
-export { extractJsonPointerExactObservation } from "./long-task-observation-artifact.js";
-export async function prepareAdmittedObservations(input) {
-    const entries = [];
-    const entriesByAuthority = new Map();
-    for (const authority of input.check.observation_authorities ?? []) {
-        const authorityKey = admittedObservationAuthorityKey(authority);
-        const candidates = (input.package_observations ?? []).filter((candidate) => candidate.authority === authority.authority &&
-            candidate.observation_identity === authority.observation_identity &&
-            candidate.assertion_ref === authority.assertion_ref &&
-            candidate.obligation_ref === authority.obligation_ref &&
-            candidate.method === authority.method);
-        const candidate = candidates.length === 1 ? candidates[0] : null;
-        let reason = null;
-        let comparison = null;
-        if (authority.authority === "external_confirmation")
-            reason = "unsupported_observer_requires_external_confirmation";
-        else if (candidates.length > 1)
-            reason = "admitted_observation_duplicate";
-        else if (!candidate)
-            reason =
-                authority.authority === "package_process_json_exact"
-                    ? "admitted_observation_runtime_required"
-                    : "admitted_observation_missing";
-        else if (candidate.reason)
-            reason = candidate.reason;
-        else if (!candidate.observation)
-            reason = "admitted_observation_missing";
-        else if (candidate.observation.locator.kind !== "json_pointer" ||
-            candidate.observation.locator.value !== authority.locator_policy.value)
-            reason = "observation_locator_identity_mismatch";
-        else {
-            try {
-                comparison = evaluateExactDigestComparison({
-                    identity: {
-                        kind: "compiled_observation_authority",
-                        expected_identity: authority.expected_identity,
-                        obligation_ref: authority.obligation_ref,
-                        observation_identity: authority.observation_identity,
-                        target_ref: authority.target_ref,
-                        method: authority.method,
-                    },
-                    actual_value_sha256: projectedActualValueSha256(authority, candidate),
-                    expected_value_sha256: authority.expected_value_sha256,
-                    comparator: authority.comparison.comparator,
-                    mode: authority.comparison.mode,
-                    parameters_sha256: authority.comparison.parameters_sha256 ?? "",
-                    tolerance_sha256: authority.comparison.tolerance_sha256,
-                    mask_sha256: authority.comparison.mask_sha256,
-                });
-            }
-            catch (error) {
-                reason = error instanceof Error ? error.message : String(error);
-            }
-        }
-        const entry = {
-            assertion_key: authority.assertion_ref,
-            identity_ref: authority.observation_identity,
-            authority_key: authorityKey,
-            obligation_ref: authority.obligation_ref,
-            method: authority.method,
-            observation_key: candidate?.observation
-                ? admittedObservationKey(candidate.observation.artifact_path, candidate.observation.locator)
-                : `compiled-authority\0${authorityKey}`,
-            authority: authority.authority,
-            raw_value: candidate?.raw_value,
-            observation: candidate?.observation ?? null,
-            comparison,
-            reason,
-        };
-        entries.push(entry);
-        entriesByAuthority.set(authorityKey, entry);
-    }
-    for (const candidate of input.package_observations ?? []) {
-        const matches = (input.check.observation_authorities ?? []).filter((authority) => authority.authority === candidate.authority &&
-            authority.observation_identity === candidate.observation_identity &&
-            authority.assertion_ref === candidate.assertion_ref &&
-            authority.obligation_ref === candidate.obligation_ref &&
-            authority.method === candidate.method);
-        if (matches.length)
-            continue;
-        entries.push({
-            assertion_key: "",
-            identity_ref: candidate.observation_identity,
-            authority_key: null,
-            obligation_ref: null,
-            method: "exact_value",
-            observation_key: candidate.observation
-                ? admittedObservationKey(candidate.observation.artifact_path, candidate.observation.locator)
-                : `unbound-package-observation\0${candidate.observation_identity}`,
-            authority: null,
-            raw_value: candidate.raw_value,
-            observation: candidate.observation,
-            comparison: null,
-            reason: "machine_observer_not_admitted",
-        });
-    }
-    return {
-        by_observation_key: new Map(entries.map((entry) => [entry.observation_key, entry])),
-        by_authority_key: entriesByAuthority,
-        entries,
-    };
-}
-function projectedActualValueSha256(authority, candidate) {
-    if (!candidate.observation)
-        throw new Error("admitted_observation_missing");
-    if (authority.actual_projection === "raw_exact")
-        return candidate.observation.value_sha256;
-    const projected = authority.actual_projection === "presence_boolean"
-        ? true
-        : Boolean(candidate.raw_value);
-    return sha256Hex(canonicalValueJson(projected));
-}
-export function admittedObservationAuthorityKey(authority) {
-    return `${authority.assertion_ref}\0${authority.obligation_ref}\0${authority.method}`;
-}
-export function resolveObservationAuthority(check, candidate) {
-    const matches = (check.observation_authorities ?? []).filter((authority) => authority.assertion_ref === candidate.assertion_key &&
-        authority.method === candidate.method &&
-        authority.observation_identity === candidate.identity_ref);
-    if (matches.length === 1)
-        return { authority: matches[0], reason: null };
-    return {
-        authority: null,
-        reason: matches.length === 0
-            ? "machine_observer_not_admitted"
-            : "machine_observer_authority_ambiguous",
-    };
-}
-export function admittedObservationKey(artifactPath, locator) {
-    return `${artifactPath}\0${canonicalValueJson(locator)}`;
-}
-export function jsonPointerExactLocatorForIdentity(identity) {
-    return {
-        kind: "json_pointer",
-        value: `/observations/${identity.replace(/~/gu, "~0").replace(/\//gu, "~1")}`,
-    };
-}
-export function classifyMachineObservationCarrierRoleConflict(input) {
-    if (input.expected_authority_patterns.some((pattern) => classifyRepositoryPatternOverlap(input.carrier_pattern, pattern)
-        .status === "proven_overlap"))
-        return "expected_authority";
-    if (input.evidence_role_patterns.some((pattern) => classifyRepositoryPatternOverlap(input.carrier_pattern, pattern)
-        .status === "proven_overlap"))
-        return "evidence_role";
-    return null;
-}
-export function classifyObservationCarrier(input) {
-    const artifactPath = normalizeObservationArtifactPath(input.artifact_path);
-    if (matchesAny(artifactPath, input.source_paths) ||
-        matchesAny(artifactPath, input.expected_authority_paths))
-        return "expected_authority_forbidden";
-    if (matchesAny(artifactPath, input.product_carrier_paths))
-        return "product_carrier";
-    if (matchesAny(artifactPath, input.current_observer_artifact_paths))
-        return "current_observer_artifact";
-    return "unadmitted_evidence";
-}
-export function observationAdmissionDecision(input) {
-    if (input.observed_target_family !== undefined &&
-        input.observed_target_family !== input.target_family)
-        return external("observation_target_proxy_mismatch");
-    if (input.required_method && input.required_method !== input.method)
-        return external("observation_capability_mismatch");
-    if (input.target_family !== "process" ||
-        input.historical_session === true ||
-        !input.current_static_artifact ||
-        input.snapshot_matches === false)
-        return external("observation_current_static_target_required");
-    if (!isJsonPointerExactOracle(input.oracle))
-        return external("observation_oracle_not_admitted");
-    if (!JSON_POINTER_EXACT_METHODS.some((method) => method === input.method) ||
-        input.comparator !== "exact_value" ||
-        input.mode !== "exact" ||
-        input.tolerance !== null ||
-        input.mask !== null)
-        return external("observation_method_not_admitted");
-    if (input.sensitivity !== "plain")
-        return external("observation_protected_requires_frozen_adapter");
-    try {
-        validateJsonPointerExactLocator(input.locator);
-    }
-    catch {
-        return external("observation_locator_not_admitted");
-    }
-    return {
-        authority: "machine",
-        reason: null,
-        capability: JSON_POINTER_EXACT_CAPABILITY,
-    };
-}
-function external(reason) {
-    return { authority: "external_confirmation", reason, capability: null };
-}
-function matchesAny(candidate, patterns) {
-    return patterns.some((pattern) => matchesRepoPattern(candidate, pattern));
-}