project-tiny-context-harness 0.8.10 → 0.8.12

package/dist/lib/design-resource-symbolic-manifest-shape.js

@@ -0,0 +1,155 @@
+import { parseDesignResourceEnvironments, parseDesignResourceOracles, } from "./design-resource-fact-manifest-shape-evidence.js";
+import { parseDesignResourceProperties } from "./design-resource-fact-manifest-shape-facts.js";
+import { parseDesignResourceFactManifestInspector, parseDesignResourceManifestDesignSystem, } from "./design-resource-fact-manifest-shape-inspector.js";
+import { parseDesignResourceHandoffBlockers } from "./design-resource-handoff-shape-evidence.js";
+import { contractKey, sha256, sourceItemKeys, stableKey, stableKeys, } from "./design-resource-handoff-shape-primitives.js";
+import { parseDesignResourceHandoffSubjects } from "./design-resource-handoff-shape-structure.js";
+import { parseSymbolicStructuralApplicability } from "./design-resource-symbolic-applicability-shape.js";
+import { parseSymbolicNoninterferenceProof } from "./design-resource-symbolic-noninterference-shape.js";
+import { parseSymbolicAxisDomains, parseSymbolicPredicate, } from "./design-resource-symbolic-predicate-shape.js";
+import { parseSymbolicFactRules, parseSymbolicObligation, parseSymbolicPopulations, parseSymbolicQuantifier, } from "./design-resource-symbolic-rule-shape.js";
+import { array, literal, nullable, object, string, } from "./long-task-shape-primitives.js";
+export function parseDesignResourceObservableRuleManifestJson(content) {
+    let value;
+    try {
+        value = JSON.parse(content);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`design_resource_symbolic_manifest_invalid:json:${message}`);
+    }
+    return parseDesignResourceObservableRuleManifestShape(value);
+}
+export function parseDesignResourceObservableRuleManifestShape(value) {
+    const label = "design_resource_symbolic_manifest";
+    const root = object(value, label, [
+        "schema_version",
+        "scope_key",
+        "target_key",
+        "inspector",
+        "design_system",
+        "axis_domains",
+        "reachable_region",
+        "subjects",
+        "populations",
+        "properties",
+        "fact_rules",
+        "disposition_regions",
+        "semantic_proof_obligations",
+        "dependency_edges",
+        "noninterference_certificates",
+        "oracles",
+        "environments",
+        "acceptance_blockers",
+    ], ["structural_applicability"]);
+    return {
+        schema_version: literal(root.schema_version, ["design-resource-observable-rule-manifest-v2"], `${label}.schema_version`),
+        scope_key: contractKey(root.scope_key, `${label}.scope_key`),
+        target_key: contractKey(root.target_key, `${label}.target_key`),
+        inspector: parseDesignResourceFactManifestInspector(root.inspector, `${label}.inspector`),
+        design_system: parseDesignResourceManifestDesignSystem(root.design_system, `${label}.design_system`),
+        axis_domains: parseSymbolicAxisDomains(root.axis_domains, `${label}.axis_domains`),
+        reachable_region: parseSymbolicPredicate(root.reachable_region, `${label}.reachable_region`),
+        subjects: parseDesignResourceHandoffSubjects(root.subjects),
+        populations: parseSymbolicPopulations(root.populations, `${label}.populations`),
+        properties: parseDesignResourceProperties(root.properties, `${label}.properties`),
+        fact_rules: parseSymbolicFactRules(root.fact_rules, `${label}.fact_rules`),
+        disposition_regions: parseDispositionRegions(root.disposition_regions, label),
+        semantic_proof_obligations: array(root.semantic_proof_obligations, `${label}.semantic_proof_obligations`).map((item, index) => parseSymbolicObligation(item, `${label}.semantic_proof_obligations[${index}]`)),
+        dependency_edges: parseDependencyEdges(root.dependency_edges, label),
+        noninterference_certificates: parseNoninterferenceCertificates(root.noninterference_certificates, label),
+        oracles: parseDesignResourceOracles(root.oracles, `${label}.oracles`),
+        environments: parseDesignResourceEnvironments(root.environments, `${label}.environments`),
+        acceptance_blockers: parseDesignResourceHandoffBlockers(root.acceptance_blockers),
+        ...(root.structural_applicability === undefined
+            ? {}
+            : {
+                structural_applicability: parseSymbolicStructuralApplicability(root.structural_applicability, `${label}.structural_applicability`),
+            }),
+    };
+}
+function parseDispositionRegions(value, label) {
+    return array(value, `${label}.disposition_regions`).map((item, index) => {
+        const itemLabel = `${label}.disposition_regions[${index}]`;
+        const row = object(item, itemLabel, [
+            "key",
+            "subject_or_relation_ref",
+            "target_ref",
+            "property_ref",
+            "population_ref",
+            "quantifier",
+            "region",
+            "disposition",
+            "census_refs",
+            "source_item_refs",
+            "basis_refs",
+            "rationale",
+        ]);
+        return {
+            key: stableKey(row.key, `${itemLabel}.key`),
+            subject_or_relation_ref: stableKey(row.subject_or_relation_ref, `${itemLabel}.subject_or_relation_ref`),
+            target_ref: contractKey(row.target_ref, `${itemLabel}.target_ref`),
+            property_ref: stableKey(row.property_ref, `${itemLabel}.property_ref`),
+            population_ref: nullable(row.population_ref, (entry) => stableKey(entry, `${itemLabel}.population_ref`)),
+            quantifier: parseSymbolicQuantifier(row.quantifier, `${itemLabel}.quantifier`),
+            region: parseSymbolicPredicate(row.region, `${itemLabel}.region`),
+            disposition: literal(row.disposition, [
+                "not_applicable",
+                "excluded",
+                "decision_required",
+                "unavailable",
+                "blocking",
+            ], `${itemLabel}.disposition`),
+            census_refs: stableKeys(row.census_refs, `${itemLabel}.census_refs`),
+            source_item_refs: sourceItemKeys(row.source_item_refs, `${itemLabel}.source_item_refs`),
+            basis_refs: stableKeys(row.basis_refs, `${itemLabel}.basis_refs`),
+            rationale: string(row.rationale, `${itemLabel}.rationale`),
+        };
+    });
+}
+function parseDependencyEdges(value, label) {
+    return array(value, `${label}.dependency_edges`).map((item, index) => {
+        const itemLabel = `${label}.dependency_edges[${index}]`;
+        const row = object(item, itemLabel, [
+            "key",
+            "axis_ref",
+            "fact_rule_ref",
+            "effects",
+        ]);
+        return {
+            key: stableKey(row.key, `${itemLabel}.key`),
+            axis_ref: stableKey(row.axis_ref, `${itemLabel}.axis_ref`),
+            fact_rule_ref: stableKey(row.fact_rule_ref, `${itemLabel}.fact_rule_ref`),
+            effects: array(row.effects, `${itemLabel}.effects`).map((effect, effectIndex) => literal(effect, ["disposition", "expected_semantics", "proof_denotation"], `${itemLabel}.effects[${effectIndex}]`)),
+        };
+    });
+}
+function parseNoninterferenceCertificates(value, label) {
+    return array(value, `${label}.noninterference_certificates`).map((item, index) => {
+        const itemLabel = `${label}.noninterference_certificates[${index}]`;
+        const row = object(item, itemLabel, [
+            "key",
+            "fact_rule_refs",
+            "omitted_axis_refs",
+            "dependency_edge_refs",
+            "canonical_rule_dag_sha256",
+        ], ["source_noninterference_proof", "production_noninterference_proof"]);
+        return {
+            key: stableKey(row.key, `${itemLabel}.key`),
+            fact_rule_refs: stableKeys(row.fact_rule_refs, `${itemLabel}.fact_rule_refs`),
+            omitted_axis_refs: stableKeys(row.omitted_axis_refs, `${itemLabel}.omitted_axis_refs`),
+            dependency_edge_refs: stableKeys(row.dependency_edge_refs, `${itemLabel}.dependency_edge_refs`),
+            canonical_rule_dag_sha256: sha256(row.canonical_rule_dag_sha256, `${itemLabel}.canonical_rule_dag_sha256`),
+            ...(row.source_noninterference_proof === undefined
+                ? {}
+                : {
+                    source_noninterference_proof: nullable(row.source_noninterference_proof, (entry) => parseSymbolicNoninterferenceProof(entry, `${itemLabel}.source_noninterference_proof`)),
+                }),
+            ...(row.production_noninterference_proof === undefined
+                ? {}
+                : {
+                    production_noninterference_proof: nullable(row.production_noninterference_proof, (entry) => parseSymbolicNoninterferenceProof(entry, `${itemLabel}.production_noninterference_proof`)),
+                }),
+        };
+    });
+}

package/dist/lib/design-resource-symbolic-manifest-validation.d.ts

@@ -0,0 +1,6 @@
+import type { DesignResource } from "./design-resource-handoff-file-primitives.js";
+import type { DesignResourceHandoffPreflightV2, DesignResourceObservableRuleManifestV2, ParsedDesignResourceHandoffV2 } from "./design-resource-symbolic-fact-types.js";
+export declare function validateDesignResourceSymbolicManifest(manifest: DesignResourceObservableRuleManifestV2, parsed: ParsedDesignResourceHandoffV2, resources: Map<string, DesignResource>, contents: Map<string, Buffer>): {
+    ruleProjections: DesignResourceHandoffPreflightV2["rule_projections"];
+    metrics: DesignResourceHandoffPreflightV2["metrics"];
+};

package/dist/lib/design-resource-symbolic-manifest-validation.js

@@ -0,0 +1,132 @@
+import { validateDesignResourceLocatedDigest } from "./design-resource-fact-locator-validation.js";
+import { buildSymbolicApplicabilityIndex } from "./design-resource-symbolic-applicability-validation.js";
+import { createDesignResourceSymbolicCompilationSession } from "./design-resource-symbolic-compilation.js";
+import { validateSymbolicDispositions } from "./design-resource-symbolic-disposition-validation.js";
+import { validateSymbolicCertificates, validateSymbolicObligations, } from "./design-resource-symbolic-proof-validation.js";
+import { aggregateSymbolicCanonicalMetrics, validateSymbolicApplicabilityClosure, validateSymbolicPopulationAndQuantifier, validateSymbolicRegionWithinReachable, } from "./design-resource-symbolic-region-validation.js";
+import { validateSymbolicInspectorAndResources, validateSymbolicPropertyCatalog, } from "./design-resource-symbolic-resource-validation.js";
+import { validateSymbolicExactTargetCoverage, validateSymbolicReadinessClosure, } from "./design-resource-symbolic-safety-validation.js";
+import { validateSymbolicCensusClosure, validateSymbolicSubjectPopulationClosure, } from "./design-resource-symbolic-structural-closure-validation.js";
+import { buildSymbolicManifestIndexes, } from "./design-resource-symbolic-indexes.js";
+import { designResourceSymbolicRuleKey, invalid, omitRuleIdentityFields, requireKnownRefs, stableJson, unique, } from "./design-resource-symbolic-validation-support.js";
+export function validateDesignResourceSymbolicManifest(manifest, parsed, resources, contents) {
+    validateManifestIdentities(manifest);
+    validateSymbolicReadinessClosure(manifest);
+    const target = parsed.handoff.targets[0];
+    if (!manifest.subjects.length || !manifest.properties.length)
+        invalid("v2_subject_property_universe_required", target.key);
+    const compilation = createDesignResourceSymbolicCompilationSession(manifest);
+    const reachable = compilation.compile(manifest.reachable_region);
+    if (reachable.canonical_dag.root_ref === "terminal.false")
+        invalid("v2_reachable_region_empty", target.key);
+    validateSymbolicInspectorAndResources(manifest, target, resources, contents);
+    validateSymbolicPropertyCatalog(manifest.properties);
+    const indexes = buildSymbolicManifestIndexes(manifest, parsed);
+    validateSymbolicSubjectPopulationClosure(manifest, target, indexes, resources, contents, compilation);
+    const applicability = buildSymbolicApplicabilityIndex(manifest, indexes);
+    const ruleProjections = validateRules(manifest, target, indexes, resources, contents, compilation);
+    validateSymbolicCensusClosure(manifest, indexes);
+    validateSymbolicDispositions(manifest, target.key, indexes, compilation);
+    const certificateMetrics = validateSymbolicCertificates(manifest, ruleProjections, indexes, compilation, target, resources, contents);
+    validateSymbolicApplicabilityClosure(manifest, reachable, indexes, applicability, compilation);
+    validateSymbolicObligations(manifest, ruleProjections, indexes.properties, indexes.oracles, indexes.environments, target, resources, contents);
+    validateSymbolicExactTargetCoverage(target.interpretation, manifest, ruleProjections, reachable, compilation);
+    const dagMetrics = aggregateSymbolicCanonicalMetrics(ruleProjections);
+    return {
+        ruleProjections,
+        metrics: {
+            semantic_obligations: manifest.semantic_proof_obligations.length,
+            certificate_obligations: manifest.noninterference_certificates.length,
+            certificate_covered_omitted_axes: certificateMetrics.coveredOmittedAxes,
+            certificate_covered_dependency_edges: certificateMetrics.coveredDependencyEdges,
+            canonical_dag_nodes: dagMetrics.nodes,
+            canonical_partition_edges: dagMetrics.edges,
+            canonical_bytes: dagMetrics.bytes,
+            theoretical_ground_cardinality: reachable.theoretical_ground_cardinality,
+        },
+    };
+}
+function validateManifestIdentities(manifest) {
+    for (const [label, keys] of [
+        ["inspector_census", manifest.inspector.census.map((item) => item.key)],
+        ["axis_domain", manifest.axis_domains.map((item) => item.key)],
+        ["subject", manifest.subjects.map((item) => item.key)],
+        ["population", manifest.populations.map((item) => item.key)],
+        ["property", manifest.properties.map((item) => item.key)],
+        ["fact_rule", manifest.fact_rules.map((item) => item.key)],
+        [
+            "disposition_region",
+            manifest.disposition_regions.map((item) => item.key),
+        ],
+        [
+            "semantic_obligation",
+            manifest.semantic_proof_obligations.map((item) => item.key),
+        ],
+        ["dependency_edge", manifest.dependency_edges.map((item) => item.key)],
+        [
+            "certificate",
+            manifest.noninterference_certificates.map((item) => item.key),
+        ],
+        ["oracle", manifest.oracles.map((item) => item.key)],
+        ["environment", manifest.environments.map((item) => item.key)],
+        [
+            "acceptance_blocker",
+            manifest.acceptance_blockers.map((item) => item.key),
+        ],
+    ])
+        unique(keys, `v2_${label}_key_duplicate`);
+}
+function validateRules(manifest, target, indexes, resources, contents, compilation) {
+    const reachableRegionDigests = new Set();
+    return manifest.fact_rules.map((rule) => {
+        const compiled = compilation.compile(rule.region);
+        if (!reachableRegionDigests.has(compiled.canonical_sha256)) {
+            validateSymbolicRegionWithinReachable(rule.region, manifest.reachable_region, rule.key, compilation);
+            reachableRegionDigests.add(compiled.canonical_sha256);
+        }
+        const subject = indexes.subjects.get(rule.subject_or_relation_ref);
+        const property = indexes.properties.get(rule.property_ref);
+        if (!subject)
+            invalid("v2_rule_subject_unknown", rule.key);
+        if (!property)
+            invalid("v2_rule_property_unknown", rule.key);
+        if (rule.target_ref !== target.key)
+            invalid("v2_rule_target_mismatch", rule.key);
+        validateRuleAuthority(rule, subject.population_ref, property, indexes);
+        validateRuleValues(rule, compiled.canonical_sha256, new Set(target.resource_refs), resources, contents);
+        return { rule, compiled_region: compiled };
+    });
+}
+function validateRuleAuthority(rule, subjectPopulationRef, property, indexes) {
+    unique(rule.census_refs, `v2_rule_census_ref_duplicate:${rule.key}`);
+    unique(rule.source_item_refs, `v2_rule_source_item_ref_duplicate:${rule.key}`);
+    unique(rule.semantic_obligation_refs, `v2_rule_obligation_ref_duplicate:${rule.key}`);
+    validateSymbolicPopulationAndQuantifier(rule, subjectPopulationRef, indexes.populations);
+    requireKnownRefs(rule.census_refs, indexes.census, "v2_rule_census_unknown");
+    requireKnownRefs(rule.source_item_refs, indexes.sourceItems, "v2_rule_source_item_unknown");
+    requireKnownRefs(property.census_refs, indexes.census, "v2_property_census_unknown");
+    if (!property.census_refs.length)
+        invalid("v2_rule_property_census_required", rule.key);
+    const subject = indexes.subjects.get(rule.subject_or_relation_ref);
+    for (const ref of [...subject.census_refs, ...property.census_refs])
+        if (!rule.census_refs.includes(ref))
+            invalid("v2_rule_required_census_ref_missing", `${rule.key}:${ref}`);
+    for (const capability of property.inspector_capability_refs)
+        if (!indexes.inspectorCapabilities.has(capability))
+            invalid("v2_rule_inspector_capability_missing", `${rule.key}:${capability}`);
+    if (rule.value_kind !== property.value_kind)
+        invalid("v2_rule_value_kind_mismatch", rule.key);
+}
+function validateRuleValues(rule, regionSha256, targetResources, resources, contents) {
+    validateDesignResourceLocatedDigest(rule.expected, resources, contents, `rule.${rule.key}.expected`);
+    validateDesignResourceLocatedDigest(rule.lineage.resolved_value, resources, contents, `rule.${rule.key}.lineage.resolved_value`);
+    for (const located of [rule.expected, rule.lineage.resolved_value])
+        if (targetResources.size &&
+            !targetResources.has(located.locator.resource_ref))
+            invalid("v2_rule_resource_outside_target", `${rule.key}:${located.locator.resource_ref}`);
+    if (stableJson(rule.expected) !== stableJson(rule.lineage.resolved_value))
+        invalid("v2_rule_expected_lineage_mismatch", rule.key);
+    const expectedKey = designResourceSymbolicRuleKey(omitRuleIdentityFields(rule), regionSha256);
+    if (rule.key !== expectedKey)
+        invalid("v2_rule_identity_mismatch", `${rule.key}:${expectedKey}`);
+}

package/dist/lib/design-resource-symbolic-noninterference-artifact.d.ts

@@ -0,0 +1,33 @@
+import { Buffer } from "node:buffer";
+import type { DesignResource } from "./design-resource-handoff-file-primitives.js";
+import type { DesignResourceObservableRuleManifestV2, DesignResourceSymbolicHandoffTargetV2, DesignResourceSymbolicNoninterferenceArtifactV2, DesignResourceSymbolicNoninterferenceCertificateV2, DesignResourceSymbolicNoninterferenceFailureWitnessV1, DesignResourceSymbolicNoninterferenceProofV2 } from "./design-resource-symbolic-fact-types.js";
+export declare const SYMBOLIC_NONINTERFERENCE_ORACLE_IDENTITY: "ty-context-symbolic-noninterference-oracle";
+export declare const SYMBOLIC_NONINTERFERENCE_ORACLE_VERSION: "2.1.0";
+export declare const SYMBOLIC_NONINTERFERENCE_ORACLE_IMPLEMENTATION_SHA256: string;
+export interface SymbolicNoninterferenceArtifactBindingV1 {
+    static_dependency_nodes: DesignResourceSymbolicNoninterferenceProofV2["static_dependency_nodes"];
+    static_rule_roots: DesignResourceSymbolicNoninterferenceProofV2["static_rule_roots"];
+    equivalence_cases: DesignResourceSymbolicNoninterferenceProofV2["equivalence_cases"];
+    complete_domain_cardinality: string | null;
+    oracle_version: string;
+    oracle_implementation_sha256: string;
+    oracle_capability: string;
+    environment_sha256: string;
+    input_snapshot_sha256: string;
+    source_manifest_snapshot_sha256: string | null;
+    target_snapshot_sha256: string;
+    certificate_scope_sha256: string;
+    rule_scope_sha256: string;
+    omitted_axis_refs: string[];
+    method_result_sha256: string;
+    artifact_resource_ref: string;
+    artifact_path: string;
+    artifact_sha256: string;
+    failure_witness: DesignResourceSymbolicNoninterferenceFailureWitnessV1 | null;
+}
+export declare function createSymbolicNoninterferenceArtifactBinding(manifest: DesignResourceObservableRuleManifestV2, certificate: DesignResourceSymbolicNoninterferenceCertificateV2, proof: DesignResourceSymbolicNoninterferenceProofV2, target: DesignResourceSymbolicHandoffTargetV2, resources: ReadonlyMap<string, DesignResource>, contents: ReadonlyMap<string, Buffer>, artifactResourceRef: string, artifactPath: string): {
+    artifact: DesignResourceSymbolicNoninterferenceArtifactV2;
+    text: string;
+    binding: SymbolicNoninterferenceArtifactBindingV1;
+};
+export declare function validateSymbolicNoninterferenceArtifact(manifest: DesignResourceObservableRuleManifestV2, certificate: DesignResourceSymbolicNoninterferenceCertificateV2, proof: DesignResourceSymbolicNoninterferenceProofV2, target: DesignResourceSymbolicHandoffTargetV2, resources: ReadonlyMap<string, DesignResource>, contents: ReadonlyMap<string, Buffer>): void;

package/dist/lib/design-resource-symbolic-noninterference-artifact.js

@@ -0,0 +1,110 @@
+import { invalid, stableJson, } from "./design-resource-symbolic-validation-support.js";
+import { recomputeSymbolicNoninterferenceArtifact } from "./design-resource-symbolic-noninterference-recompute.js";
+import { fingerprintExecutableModuleClosure } from "./design-resource-symbolic-oracle-fingerprint.js";
+import { canonicalJson, sha256Hex } from "./strict-codec.js";
+export const SYMBOLIC_NONINTERFERENCE_ORACLE_IDENTITY = "ty-context-symbolic-noninterference-oracle";
+export const SYMBOLIC_NONINTERFERENCE_ORACLE_VERSION = "2.1.0";
+export const SYMBOLIC_NONINTERFERENCE_ORACLE_IMPLEMENTATION_SHA256 = fingerprintExecutableModuleClosure([
+    import.meta.url,
+    new URL("./design-resource-symbolic-noninterference-validation.js", import.meta.url).href,
+    new URL("./design-resource-symbolic-static-dependency-validation.js", import.meta.url).href,
+    new URL("./symbolic-denotation-engine.js", import.meta.url).href,
+]);
+export function createSymbolicNoninterferenceArtifactBinding(manifest, certificate, proof, target, resources, contents, artifactResourceRef, artifactPath) {
+    const artifact = recomputeSymbolicNoninterferenceArtifact(manifest, certificate, proof, target, resources, contents);
+    const text = canonicalJson(artifact);
+    return {
+        artifact,
+        text,
+        binding: {
+            static_dependency_nodes: structuredClone(artifact.derived_result.static_dependency_nodes),
+            static_rule_roots: structuredClone(artifact.derived_result.static_rule_roots),
+            equivalence_cases: structuredClone(artifact.derived_result.equivalence_cases),
+            complete_domain_cardinality: artifact.derived_result.complete_domain_cardinality,
+            oracle_version: artifact.oracle_version,
+            oracle_implementation_sha256: artifact.oracle_implementation_sha256,
+            oracle_capability: artifact.oracle_capability,
+            environment_sha256: artifact.environment_sha256,
+            input_snapshot_sha256: artifact.input_snapshot_sha256,
+            source_manifest_snapshot_sha256: artifact.source_manifest_snapshot_sha256,
+            target_snapshot_sha256: artifact.target_snapshot_sha256,
+            certificate_scope_sha256: artifact.certificate_scope_sha256,
+            rule_scope_sha256: artifact.rule_scope_sha256,
+            omitted_axis_refs: [...artifact.omitted_axis_refs],
+            method_result_sha256: artifact.method_result_sha256,
+            artifact_resource_ref: artifactResourceRef,
+            artifact_path: artifactPath,
+            artifact_sha256: sha256Hex(text),
+            failure_witness: artifact.failure_witness
+                ? structuredClone(artifact.failure_witness)
+                : null,
+        },
+    };
+}
+export function validateSymbolicNoninterferenceArtifact(manifest, certificate, proof, target, resources, contents) {
+    const oracle = manifest.oracles.find((item) => item.key === proof.oracle_ref);
+    if (oracle?.identity !== SYMBOLIC_NONINTERFERENCE_ORACLE_IDENTITY ||
+        oracle.version !== SYMBOLIC_NONINTERFERENCE_ORACLE_VERSION ||
+        oracle.sha256 !== SYMBOLIC_NONINTERFERENCE_ORACLE_IMPLEMENTATION_SHA256)
+        invalid("v2_noninterference_package_oracle_identity_mismatch", proof.oracle_ref);
+    const expected = recomputeSymbolicNoninterferenceArtifact(manifest, certificate, proof, target, resources, contents);
+    const resource = resources.get(proof.artifact_resource_ref);
+    const bytes = contents.get(proof.artifact_resource_ref);
+    if (!resource ||
+        !bytes ||
+        resource.role !== "supporting" ||
+        resource.path !== proof.artifact_path ||
+        resource.sha256 !== proof.artifact_sha256 ||
+        sha256Hex(bytes) !== proof.artifact_sha256 ||
+        !target.resource_refs.includes(proof.artifact_resource_ref))
+        invalid("v2_noninterference_artifact_resource_mismatch", `${certificate.key}:${proof.side}:${proof.artifact_resource_ref}`);
+    const expectedText = canonicalJson(expected);
+    if (bytes.toString("utf8") !== expectedText)
+        invalid("v2_noninterference_artifact_current_input_mismatch", `${certificate.key}:${proof.side}`);
+    const binding = {
+        oracle_version: proof.oracle_version,
+        oracle_implementation_sha256: proof.oracle_implementation_sha256,
+        oracle_capability: proof.oracle_capability,
+        environment_sha256: proof.environment_sha256,
+        input_snapshot_sha256: proof.input_snapshot_sha256,
+        source_manifest_snapshot_sha256: proof.source_manifest_snapshot_sha256,
+        target_snapshot_sha256: proof.target_snapshot_sha256,
+        certificate_scope_sha256: proof.certificate_scope_sha256,
+        rule_scope_sha256: proof.rule_scope_sha256,
+        omitted_axis_refs: proof.omitted_axis_refs,
+        method_result_sha256: proof.method_result_sha256,
+        failure_witness: proof.failure_witness,
+    };
+    const expectedBinding = {
+        oracle_version: expected.oracle_version,
+        oracle_implementation_sha256: expected.oracle_implementation_sha256,
+        oracle_capability: expected.oracle_capability,
+        environment_sha256: expected.environment_sha256,
+        input_snapshot_sha256: expected.input_snapshot_sha256,
+        source_manifest_snapshot_sha256: expected.source_manifest_snapshot_sha256,
+        target_snapshot_sha256: expected.target_snapshot_sha256,
+        certificate_scope_sha256: expected.certificate_scope_sha256,
+        rule_scope_sha256: expected.rule_scope_sha256,
+        omitted_axis_refs: expected.omitted_axis_refs,
+        method_result_sha256: expected.method_result_sha256,
+        failure_witness: expected.failure_witness,
+    };
+    if (stableJson(binding) !== stableJson(expectedBinding))
+        invalid("v2_noninterference_artifact_binding_mismatch", `${certificate.key}:${proof.side}`);
+    if (proof.side === "source" &&
+        stableJson({
+            static_dependency_nodes: proof.static_dependency_nodes,
+            static_rule_roots: proof.static_rule_roots,
+            equivalence_cases: proof.equivalence_cases,
+            complete_domain_cardinality: proof.complete_domain_cardinality,
+        }) !==
+            stableJson({
+                static_dependency_nodes: expected.derived_result.static_dependency_nodes,
+                static_rule_roots: expected.derived_result.static_rule_roots,
+                equivalence_cases: expected.derived_result.equivalence_cases,
+                complete_domain_cardinality: expected.derived_result.complete_domain_cardinality,
+            }))
+        invalid("v2_source_noninterference_proof_cache_mismatch", `${certificate.key}:${proof.method}`);
+    if (expected.verdict !== "passed" || expected.failure_witness)
+        invalid("v2_noninterference_current_input_counterexample", stableJson(expected.failure_witness));
+}

package/dist/lib/design-resource-symbolic-noninterference-equivalence.d.ts

@@ -0,0 +1,3 @@
+import type { DesignResourceSymbolicCompilationSession } from "./design-resource-symbolic-compilation.js";
+import type { DesignResourceHandoffPreflightV2, DesignResourceObservableRuleManifestV2, DesignResourceSymbolicNoninterferenceCertificateV2, DesignResourceSymbolicNoninterferenceProofV2 } from "./design-resource-symbolic-fact-types.js";
+export declare function validateSymbolicNoninterferenceEquivalence(proof: DesignResourceSymbolicNoninterferenceProofV2, manifest: DesignResourceObservableRuleManifestV2, certificate: DesignResourceSymbolicNoninterferenceCertificateV2, projections: DesignResourceHandoffPreflightV2["rule_projections"], compilation: DesignResourceSymbolicCompilationSession): void;

package/dist/lib/design-resource-symbolic-noninterference-equivalence.js

@@ -0,0 +1,77 @@
+import { assertSameSet, invalid, unique, } from "./design-resource-symbolic-validation-support.js";
+import { evaluateCanonicalSymbolicDenotation } from "./symbolic-denotation-engine.js";
+const MAX_EXHAUSTIVE_DOMAIN_CARDINALITY = 100000n;
+export function validateSymbolicNoninterferenceEquivalence(proof, manifest, certificate, projections, compilation) {
+    if (proof.static_dependency_nodes.length || proof.static_rule_roots.length)
+        invalid("v2_equivalence_static_graph_forbidden", certificate.key);
+    const caseRuleRefs = proof.equivalence_cases.flatMap((item) => item.fact_rule_refs);
+    unique(caseRuleRefs, `v2_equivalence_rule_ref_duplicate:${certificate.key}`);
+    assertSameSet(caseRuleRefs, certificate.fact_rule_refs, "v2_equivalence_rule_set_mismatch", certificate.key);
+    const projectionByRule = new Map(projections.map((projection) => [projection.rule.key, projection]));
+    const exhaustive = proof.method === "finite_complete_domain_exhaustive_equivalence";
+    const cardinality = BigInt(projections[0].compiled_region.theoretical_ground_cardinality);
+    validateDomainCardinality(proof, certificate.key, exhaustive, cardinality);
+    for (const proofCase of proof.equivalence_cases) {
+        if (!proofCase.fact_rule_refs.length)
+            invalid("v2_equivalence_case_rules_required", certificate.key);
+        const side = compilation.compile(proofCase.side_predicate);
+        const candidate = compilation.compile(proofCase.axis_erased_predicate);
+        for (const axisRef of certificate.omitted_axis_refs)
+            if (!candidate.omitted_axis_refs.includes(axisRef))
+                invalid("v2_equivalence_candidate_axis_not_erased", `${certificate.key}:${axisRef}`);
+        for (const ruleRef of proofCase.fact_rule_refs) {
+            const projection = projectionByRule.get(ruleRef);
+            if (!projection)
+                invalid("v2_equivalence_rule_unknown", `${certificate.key}:${ruleRef}`);
+            if (exhaustive)
+                assertExhaustivelyEquivalentChain(manifest.axis_domains, projection.compiled_region, side, candidate, `${certificate.key}:${ruleRef}`);
+            else
+                assertSymbolicallyEquivalent(projection.compiled_region, side, candidate, certificate.key, ruleRef);
+        }
+    }
+}
+function validateDomainCardinality(proof, certificateKey, exhaustive, cardinality) {
+    if (exhaustive) {
+        if (proof.complete_domain_cardinality !== cardinality.toString())
+            invalid("v2_exhaustive_domain_cardinality_mismatch", certificateKey);
+        if (cardinality > MAX_EXHAUSTIVE_DOMAIN_CARDINALITY)
+            invalid("v2_exhaustive_domain_capacity_exceeded", `${certificateKey}:${cardinality}`);
+    }
+    else if (proof.complete_domain_cardinality !== null)
+        invalid("v2_symbolic_equivalence_cardinality_forbidden", certificateKey);
+}
+function assertSymbolicallyEquivalent(rule, side, candidate, certificateKey, ruleRef) {
+    if (rule.canonical_sha256 !== side.canonical_sha256)
+        invalid("v2_side_predicate_rule_mismatch", `${certificateKey}:${ruleRef}`);
+    if (side.canonical_sha256 !== candidate.canonical_sha256)
+        invalid("v2_symbolic_equivalence_mismatch", `${certificateKey}:${ruleRef}`);
+}
+function assertExhaustivelyEquivalentChain(domains, rule, side, erased, label) {
+    forEachAssignment(domains, 0, {}, (assignment) => {
+        if (evaluateCanonicalSymbolicDenotation(rule.canonical_dag, assignment) !==
+            evaluateCanonicalSymbolicDenotation(side.canonical_dag, assignment) ||
+            evaluateCanonicalSymbolicDenotation(side.canonical_dag, assignment) !==
+                evaluateCanonicalSymbolicDenotation(erased.canonical_dag, assignment))
+            invalid("v2_exhaustive_equivalence_mismatch", label);
+    });
+}
+function forEachAssignment(domains, index, assignment, visit) {
+    if (index === domains.length) {
+        visit(assignment);
+        return;
+    }
+    const domain = domains[index];
+    if (domain.kind === "enum") {
+        for (const value of domain.values) {
+            assignment[domain.key] = value;
+            forEachAssignment(domains, index + 1, assignment, visit);
+        }
+    }
+    else {
+        for (let value = domain.minimum; value <= domain.maximum; value += 1) {
+            assignment[domain.key] = value;
+            forEachAssignment(domains, index + 1, assignment, visit);
+        }
+    }
+    delete assignment[domain.key];
+}

package/dist/lib/design-resource-symbolic-noninterference-recompute.d.ts

@@ -0,0 +1,4 @@
+import { Buffer } from "node:buffer";
+import type { DesignResource } from "./design-resource-handoff-file-primitives.js";
+import type { DesignResourceObservableRuleManifestV2, DesignResourceSymbolicHandoffTargetV2, DesignResourceSymbolicNoninterferenceArtifactV2, DesignResourceSymbolicNoninterferenceCertificateV2, DesignResourceSymbolicNoninterferenceProofV2 } from "./design-resource-symbolic-fact-types.js";
+export declare function recomputeSymbolicNoninterferenceArtifact(manifest: DesignResourceObservableRuleManifestV2, certificate: DesignResourceSymbolicNoninterferenceCertificateV2, proof: DesignResourceSymbolicNoninterferenceProofV2, target: DesignResourceSymbolicHandoffTargetV2, resources: ReadonlyMap<string, DesignResource>, contents: ReadonlyMap<string, Buffer>): DesignResourceSymbolicNoninterferenceArtifactV2;