project-tiny-context-harness 0.8.10 → 0.8.12

package/dist/lib/design-resource-symbolic-resource-validation.js

@@ -0,0 +1,90 @@
+import { DESIGN_RESOURCE_STANDARD_PROPERTIES } from "./design-resource-fact-manifest-catalog.js";
+import { resolveDesignResourceLocatorValue } from "./design-resource-fact-locator-validation.js";
+import { assertSameSet, compareText, invalid, stableJson, } from "./design-resource-symbolic-validation-support.js";
+export function validateSymbolicInspectorAndResources(manifest, target, resources, contents) {
+    if ((manifest.inspector.trust === "frozen_executable" &&
+        manifest.inspector.implementation_sha256 === null) ||
+        (manifest.inspector.trust === "named_external_tcb" &&
+            manifest.inspector.implementation_sha256 !== null))
+        invalid("v2_inspector_trust_digest_mismatch", target.key);
+    if (manifest.inspector.traversal !== "complete_enumeration" ||
+        manifest.inspector.dynamic_discovery !== "fully_enumerated")
+        invalid("v2_inspector_incomplete", target.key);
+    if (manifest.inspector.entry_resource_ref !==
+        target.source_profile.entry_resource_ref)
+        invalid("v2_inspector_entry_mismatch", target.key);
+    assertSameSet(manifest.inspector.input_resources.map((item) => item.resource_ref), inspectorInputResourceRefs(manifest, target), "v2_inspector_input_resource_set_mismatch", target.key);
+    for (const input of manifest.inspector.input_resources) {
+        const resource = resources.get(input.resource_ref);
+        if (!resource ||
+            resource.path !== input.path ||
+            resource.sha256 !== input.sha256 ||
+            !contents.has(input.resource_ref))
+            invalid("v2_inspector_input_resource_mismatch", input.resource_ref);
+    }
+    for (const row of manifest.inspector.census) {
+        const resource = resources.get(row.resource_ref);
+        const bytes = contents.get(row.resource_ref);
+        if (!resource || !bytes)
+            invalid("v2_census_resource_unknown", row.key);
+        if (!manifest.inspector.input_resources.some((input) => input.resource_ref === row.resource_ref))
+            invalid("v2_census_resource_outside_inspector_inputs", row.key);
+        resolveDesignResourceLocatorValue({ resource_ref: row.resource_ref, ...row.locator }, resource, bytes, `v2.inspector.census.${row.key}`);
+        if (row.disposition === "covered" && !row.fact_refs.length)
+            invalid("v2_census_rule_refs_required", row.key);
+        if (row.disposition === "non_material" && row.fact_refs.length)
+            invalid("v2_non_material_census_rule_refs_forbidden", row.key);
+        if (row.fact_cell_refs.length)
+            invalid("v2_census_ground_fact_cell_refs_forbidden", row.key);
+    }
+    if (manifest.design_system.disposition === "used") {
+        const resource = resources.get(manifest.design_system.resource_ref);
+        if (!resource || resource.sha256 !== manifest.design_system.sha256)
+            invalid("v2_design_system_resource_mismatch", target.key);
+    }
+}
+function inspectorInputResourceRefs(manifest, target) {
+    const proofArtifactRefs = new Set(manifest.noninterference_certificates.flatMap((certificate) => [
+        certificate.source_noninterference_proof,
+        certificate.production_noninterference_proof,
+    ]
+        .filter((proof) => proof != null)
+        .map((proof) => proof.artifact_resource_ref)));
+    return target.resource_refs.filter((ref) => ref !== target.source_profile.fact_manifest_resource_ref &&
+        !proofArtifactRefs.has(ref));
+}
+export function validateSymbolicPropertyCatalog(properties) {
+    const actual = new Map(properties.map((property) => [property.key, property]));
+    for (const standard of DESIGN_RESOURCE_STANDARD_PROPERTIES) {
+        const candidate = actual.get(standard.key);
+        if (!candidate)
+            invalid("v2_standard_property_missing", standard.key);
+        if (stableJson(propertyPolicy(candidate)) !==
+            stableJson(propertyPolicy(standard)))
+            invalid("v2_standard_property_definition_mismatch", standard.key);
+    }
+    for (const property of properties)
+        validatePropertyAuthority(property);
+}
+function validatePropertyAuthority(property) {
+    if (property.standard) {
+        if (!DESIGN_RESOURCE_STANDARD_PROPERTIES.some((item) => item.key === property.key))
+            invalid("v2_unknown_standard_property", property.key);
+        return;
+    }
+    if (!property.key.startsWith("custom.") ||
+        !property.inspector_capability_refs.length ||
+        !property.census_refs.length)
+        invalid("v2_custom_property_authority_incomplete", property.key);
+}
+function propertyPolicy(property) {
+    return {
+        key: property.key,
+        family: property.family,
+        dimension: property.dimension,
+        value_kind: property.value_kind,
+        required_methods: [...property.required_methods].sort(compareText),
+        standard: property.standard,
+        inspector_capability_refs: [...property.inspector_capability_refs].sort(compareText),
+    };
+}

package/dist/lib/design-resource-symbolic-rule-shape.d.ts

@@ -0,0 +1,27 @@
+import type { DesignResourceSymbolicFactRuleV2, DesignResourceSymbolicPopulationV2 } from "./design-resource-symbolic-fact-types.js";
+export declare function parseSymbolicPopulations(value: unknown, label: string): DesignResourceSymbolicPopulationV2[];
+export declare function parseSymbolicFactRules(value: unknown, label: string): DesignResourceSymbolicFactRuleV2[];
+export declare function parseSymbolicObligation(value: unknown, label: string): {
+    key: string;
+    fact_rule_ref: string;
+    method: "accessibility_navigation" | "accessibility_semantics" | "accessibility_visual" | "asset_integrity" | "component_state" | "content" | "design_token" | "gesture_trace" | "haptic_feedback" | "input_method" | "interaction_trace" | "layout_geometry" | "localization" | "motion_timeline" | "responsive_reflow" | "scroll_navigation" | "sound_feedback" | "system_ui" | "visual_pixel";
+    region_sha256: string;
+    proof_surface: string;
+    observation_boundary: string;
+    comparison: {
+        comparator: string;
+        mode: "exact" | "tolerance";
+        parameters: import("./design-resource-fact-types.js").DesignResourceLocatedDigestV1;
+        tolerance: import("./design-resource-fact-types.js").DesignResourceLocatedDigestV1 | null;
+        mask: import("./design-resource-fact-types.js").DesignResourceLocatedDigestV1 | null;
+    };
+    oracle_ref: string;
+    environment_ref: string;
+    protected_value_policy: string;
+    completion_effect: string;
+};
+export declare function parseSymbolicQuantifier(value: unknown, label: string): {
+    kind: "all" | "any" | "at_least" | "at_most" | "exactly" | "none" | "one" | "range";
+    minimum: number | null;
+    maximum: number | null;
+};

package/dist/lib/design-resource-symbolic-rule-shape.js

@@ -0,0 +1,158 @@
+import { parseDesignResourceLocatedDigest } from "./design-resource-fact-shape-primitives.js";
+import { contractKey, sha256, sourceItemKeys, stableKey, stableKeys, } from "./design-resource-handoff-shape-primitives.js";
+import { DESIGN_RESOURCE_VERIFICATION_METHODS } from "./design-resource-handoff-types.js";
+import { parseSymbolicNonnegativeInteger, parseSymbolicPredicate, } from "./design-resource-symbolic-predicate-shape.js";
+import { array, literal, nullable, object, string, } from "./long-task-shape-primitives.js";
+export function parseSymbolicPopulations(value, label) {
+    return array(value, label).map((item, index) => {
+        const itemLabel = `${label}[${index}]`;
+        const row = object(item, itemLabel, [
+            "key",
+            "kind",
+            "member_subject_refs",
+            "universe",
+            "enumeration",
+            "exclusions",
+            "quantifier",
+        ]);
+        return {
+            key: stableKey(row.key, `${itemLabel}.key`),
+            kind: literal(row.kind, ["static", "dynamic"], `${itemLabel}.kind`),
+            member_subject_refs: stableKeys(row.member_subject_refs, `${itemLabel}.member_subject_refs`),
+            universe: parseDesignResourceLocatedDigest(row.universe, `${itemLabel}.universe`),
+            enumeration: literal(row.enumeration, ["complete", "symbolic_partition"], `${itemLabel}.enumeration`),
+            exclusions: array(row.exclusions, `${itemLabel}.exclusions`).map((entry, exclusionIndex) => parsePopulationExclusion(entry, `${itemLabel}.exclusions[${exclusionIndex}]`)),
+            quantifier: parseSymbolicQuantifier(row.quantifier, `${itemLabel}.quantifier`),
+        };
+    });
+}
+function parsePopulationExclusion(value, label) {
+    const row = object(value, label, [
+        "key",
+        "region",
+        "basis_refs",
+        "rationale",
+    ]);
+    return {
+        key: stableKey(row.key, `${label}.key`),
+        region: parseSymbolicPredicate(row.region, `${label}.region`),
+        basis_refs: stableKeys(row.basis_refs, `${label}.basis_refs`),
+        rationale: string(row.rationale, `${label}.rationale`),
+    };
+}
+export function parseSymbolicFactRules(value, label) {
+    return array(value, label).map((item, index) => parseSymbolicFactRule(item, `${label}[${index}]`));
+}
+function parseSymbolicFactRule(value, label) {
+    const row = object(value, label, [
+        "key",
+        "subject_or_relation_ref",
+        "target_ref",
+        "property_ref",
+        "population_ref",
+        "quantifier",
+        "region",
+        "expected",
+        "value_kind",
+        "provenance_ref",
+        "observation_scope",
+        "observation_sensitivity",
+        "lineage",
+        "evidence_refs",
+        "census_refs",
+        "source_item_refs",
+        "semantic_obligation_refs",
+    ]);
+    const lineage = object(row.lineage, `${label}.lineage`, [
+        "design_system_ref",
+        "token_chain_refs",
+        "override_chain_refs",
+        "resolved_value",
+        "conflict_status",
+        "conflict_resolution",
+    ]);
+    return {
+        key: stableKey(row.key, `${label}.key`),
+        subject_or_relation_ref: stableKey(row.subject_or_relation_ref, `${label}.subject_or_relation_ref`),
+        target_ref: contractKey(row.target_ref, `${label}.target_ref`),
+        property_ref: stableKey(row.property_ref, `${label}.property_ref`),
+        population_ref: nullable(row.population_ref, (entry) => stableKey(entry, `${label}.population_ref`)),
+        quantifier: parseSymbolicQuantifier(row.quantifier, `${label}.quantifier`),
+        region: parseSymbolicPredicate(row.region, `${label}.region`),
+        expected: parseDesignResourceLocatedDigest(row.expected, `${label}.expected`),
+        value_kind: stableKey(row.value_kind, `${label}.value_kind`),
+        provenance_ref: string(row.provenance_ref, `${label}.provenance_ref`),
+        observation_scope: literal(row.observation_scope, ["subject", "full_target"], `${label}.observation_scope`),
+        observation_sensitivity: literal(row.observation_sensitivity, ["plain", "protected"], `${label}.observation_sensitivity`),
+        lineage: {
+            design_system_ref: nullable(lineage.design_system_ref, (entry) => stableKey(entry, `${label}.lineage.design_system_ref`)),
+            token_chain_refs: stableKeys(lineage.token_chain_refs, `${label}.lineage.token_chain_refs`),
+            override_chain_refs: stableKeys(lineage.override_chain_refs, `${label}.lineage.override_chain_refs`),
+            resolved_value: parseDesignResourceLocatedDigest(lineage.resolved_value, `${label}.lineage.resolved_value`),
+            conflict_status: literal(lineage.conflict_status, ["none", "resolved"], `${label}.lineage.conflict_status`),
+            conflict_resolution: string(lineage.conflict_resolution, `${label}.lineage.conflict_resolution`),
+        },
+        evidence_refs: stableKeys(row.evidence_refs, `${label}.evidence_refs`),
+        census_refs: stableKeys(row.census_refs, `${label}.census_refs`),
+        source_item_refs: sourceItemKeys(row.source_item_refs, `${label}.source_item_refs`),
+        semantic_obligation_refs: stableKeys(row.semantic_obligation_refs, `${label}.semantic_obligation_refs`),
+    };
+}
+export function parseSymbolicObligation(value, label) {
+    const row = object(value, label, [
+        "key",
+        "fact_rule_ref",
+        "method",
+        "region_sha256",
+        "proof_surface",
+        "observation_boundary",
+        "comparison",
+        "oracle_ref",
+        "environment_ref",
+        "protected_value_policy",
+        "completion_effect",
+    ]);
+    const comparison = object(row.comparison, `${label}.comparison`, [
+        "comparator",
+        "mode",
+        "parameters",
+        "tolerance",
+        "mask",
+    ]);
+    return {
+        key: stableKey(row.key, `${label}.key`),
+        fact_rule_ref: stableKey(row.fact_rule_ref, `${label}.fact_rule_ref`),
+        method: literal(row.method, DESIGN_RESOURCE_VERIFICATION_METHODS, `${label}.method`),
+        region_sha256: sha256(row.region_sha256, `${label}.region_sha256`),
+        proof_surface: string(row.proof_surface, `${label}.proof_surface`),
+        observation_boundary: string(row.observation_boundary, `${label}.observation_boundary`),
+        comparison: {
+            comparator: string(comparison.comparator, `${label}.comparison.comparator`),
+            mode: literal(comparison.mode, ["exact", "tolerance"], `${label}.comparison.mode`),
+            parameters: parseDesignResourceLocatedDigest(comparison.parameters, `${label}.comparison.parameters`),
+            tolerance: nullable(comparison.tolerance, (entry) => parseDesignResourceLocatedDigest(entry, `${label}.comparison.tolerance`)),
+            mask: nullable(comparison.mask, (entry) => parseDesignResourceLocatedDigest(entry, `${label}.comparison.mask`)),
+        },
+        oracle_ref: stableKey(row.oracle_ref, `${label}.oracle_ref`),
+        environment_ref: stableKey(row.environment_ref, `${label}.environment_ref`),
+        protected_value_policy: string(row.protected_value_policy, `${label}.protected_value_policy`),
+        completion_effect: string(row.completion_effect, `${label}.completion_effect`),
+    };
+}
+export function parseSymbolicQuantifier(value, label) {
+    const row = object(value, label, ["kind", "minimum", "maximum"]);
+    return {
+        kind: literal(row.kind, [
+            "one",
+            "all",
+            "any",
+            "none",
+            "exactly",
+            "at_least",
+            "at_most",
+            "range",
+        ], `${label}.kind`),
+        minimum: nullable(row.minimum, (entry) => parseSymbolicNonnegativeInteger(entry, `${label}.minimum`)),
+        maximum: nullable(row.maximum, (entry) => parseSymbolicNonnegativeInteger(entry, `${label}.maximum`)),
+    };
+}

package/dist/lib/design-resource-symbolic-safety-validation.d.ts

@@ -0,0 +1,6 @@
+import type { DesignResourceHandoffPreflightV2, DesignResourceObservableRuleManifestV2 } from "./design-resource-symbolic-fact-types.js";
+import type { DesignResourceSymbolicCompilationSession } from "./design-resource-symbolic-compilation.js";
+import type { CompiledSymbolicDenotationV1 } from "./symbolic-denotation-types.js";
+export declare function validateSymbolicReadinessClosure(manifest: DesignResourceObservableRuleManifestV2): void;
+export declare function assertNoUnprovedOmittedAxes(compiled: CompiledSymbolicDenotationV1, label: string): void;
+export declare function validateSymbolicExactTargetCoverage(interpretation: "exact_target" | "constraint", manifest: DesignResourceObservableRuleManifestV2, projections: DesignResourceHandoffPreflightV2["rule_projections"], reachable: CompiledSymbolicDenotationV1, compilation: DesignResourceSymbolicCompilationSession): void;

package/dist/lib/design-resource-symbolic-safety-validation.js

@@ -0,0 +1,29 @@
+import { EXACT_TARGET_FULL_TARGET_METHODS } from "./design-resource-fact-policy.js";
+import { invalid } from "./design-resource-symbolic-validation-support.js";
+export function validateSymbolicReadinessClosure(manifest) {
+    if (manifest.acceptance_blockers.length)
+        invalid("acceptance_blockers_unresolved", manifest.acceptance_blockers.map((item) => item.key).join(","));
+}
+export function assertNoUnprovedOmittedAxes(compiled, label) {
+    if (compiled.omitted_axis_refs.length)
+        invalid("v2_noninterference_proof_unavailable", `${label}:${compiled.omitted_axis_refs.join(",")}`);
+}
+export function validateSymbolicExactTargetCoverage(interpretation, manifest, projections, reachable, compilation) {
+    if (interpretation !== "exact_target")
+        return;
+    const obligations = new Map(manifest.semantic_proof_obligations.map((item) => [item.key, item]));
+    for (const method of EXACT_TARGET_FULL_TARGET_METHODS) {
+        const regions = projections
+            .filter(({ rule }) => rule.observation_scope === "full_target" &&
+            rule.semantic_obligation_refs.some((ref) => obligations.get(ref)?.method === method))
+            .map(({ rule }) => rule.region);
+        if (!regions.length)
+            invalid("v2_exact_target_full_target_method_missing", method);
+        const covered = compilation.compile({
+            op: "any",
+            predicates: regions,
+        });
+        if (covered.canonical_sha256 !== reachable.canonical_sha256)
+            invalid("v2_exact_target_full_target_region_gap", method);
+    }
+}

package/dist/lib/design-resource-symbolic-source-ir-evaluation.d.ts

@@ -0,0 +1,19 @@
+import type { CompiledSymbolicDenotationV1, SymbolicDenotationAxisDomain, SymbolicDenotationScalar } from "./symbolic-denotation-types.js";
+export declare const MAX_SOURCE_EXHAUSTIVE_DOMAIN_CARDINALITY = 100000n;
+export interface SymbolicSourceExhaustiveCaseV1 {
+    fact_rule_refs: string[];
+    source: CompiledSymbolicDenotationV1;
+    rule: CompiledSymbolicDenotationV1;
+}
+export interface SymbolicSourceExhaustiveCounterexampleV1 {
+    kind: "source_rule_denotation_mismatch" | "complete_domain_counterexample";
+    axis_ref: string | null;
+    fact_rule_ref: string;
+    assignment: Record<string, SymbolicDenotationScalar>;
+    detail: string;
+}
+export declare function evaluateCompleteSymbolicSourceDomain(domains: SymbolicDenotationAxisDomain[], omittedAxisRefs: string[], cases: SymbolicSourceExhaustiveCaseV1[]): {
+    cardinality: string;
+    evaluation_sha256: string;
+    counterexample: SymbolicSourceExhaustiveCounterexampleV1 | null;
+};

package/dist/lib/design-resource-symbolic-source-ir-evaluation.js

@@ -0,0 +1,74 @@
+import { createHash } from "node:crypto";
+import { evaluateCanonicalSymbolicDenotation } from "./symbolic-denotation-engine.js";
+import { domainCardinality } from "./symbolic-denotation-support.js";
+import { compareText, stableJson, } from "./design-resource-symbolic-validation-support.js";
+export const MAX_SOURCE_EXHAUSTIVE_DOMAIN_CARDINALITY = 100000n;
+export function evaluateCompleteSymbolicSourceDomain(domains, omittedAxisRefs, cases) {
+    const sortedDomains = [...domains].sort((left, right) => compareText(left.key, right.key));
+    const cardinality = sortedDomains.reduce((total, domain) => total * domainCardinality(domain), 1n);
+    if (cardinality > MAX_SOURCE_EXHAUSTIVE_DOMAIN_CARDINALITY)
+        throw new Error(`source_complete_domain_capacity_exceeded:actual=${cardinality}:limit=${MAX_SOURCE_EXHAUSTIVE_DOMAIN_CARDINALITY}`);
+    const omitted = new Set(omittedAxisRefs);
+    const anchor = Object.fromEntries(sortedDomains.map((domain) => [domain.key, domainValues(domain)[0]]));
+    const hash = createHash("sha256");
+    let independenceCounterexample = null;
+    let ruleCounterexample = null;
+    for (const assignment of enumerateAssignments(sortedDomains)) {
+        const axisErasedAssignment = { ...assignment };
+        for (const axisRef of omitted)
+            axisErasedAssignment[axisRef] = anchor[axisRef];
+        for (const proofCase of cases) {
+            const source = evaluateCanonicalSymbolicDenotation(proofCase.source.canonical_dag, assignment);
+            const rule = evaluateCanonicalSymbolicDenotation(proofCase.rule.canonical_dag, assignment);
+            const axisErased = evaluateCanonicalSymbolicDenotation(proofCase.source.canonical_dag, axisErasedAssignment);
+            hash.update(stableJson({
+                assignment,
+                axis_erased: axisErased,
+                rule,
+                source,
+                rule_refs: proofCase.fact_rule_refs,
+            }));
+            hash.update("\n");
+            if (!independenceCounterexample && source !== axisErased) {
+                const axisRef = omittedAxisRefs.find((ref) => assignment[ref] !== anchor[ref]);
+                independenceCounterexample = {
+                    kind: "complete_domain_counterexample",
+                    axis_ref: axisRef ?? omittedAxisRefs[0] ?? null,
+                    fact_rule_ref: proofCase.fact_rule_refs[0],
+                    assignment: { ...assignment },
+                    detail: "current Source denotation changes after omitted axes are erased",
+                };
+            }
+            if (!ruleCounterexample && source !== rule)
+                ruleCounterexample = {
+                    kind: "source_rule_denotation_mismatch",
+                    axis_ref: null,
+                    fact_rule_ref: proofCase.fact_rule_refs[0],
+                    assignment: { ...assignment },
+                    detail: "current Source denotation differs from the current Rule region",
+                };
+        }
+    }
+    return {
+        cardinality: cardinality.toString(),
+        evaluation_sha256: hash.digest("hex"),
+        counterexample: independenceCounterexample ?? ruleCounterexample,
+    };
+}
+function* enumerateAssignments(domains, index = 0, current = {}) {
+    if (index === domains.length) {
+        yield { ...current };
+        return;
+    }
+    const domain = domains[index];
+    for (const value of domainValues(domain)) {
+        current[domain.key] = value;
+        yield* enumerateAssignments(domains, index + 1, current);
+    }
+    delete current[domain.key];
+}
+function domainValues(domain) {
+    if (domain.kind === "enum")
+        return [...domain.values];
+    return Array.from({ length: domain.maximum - domain.minimum + 1 }, (_, index) => domain.minimum + index);
+}

package/dist/lib/design-resource-symbolic-source-ir-evidence.d.ts

@@ -0,0 +1,44 @@
+import type { DesignResource } from "./design-resource-handoff-file-primitives.js";
+import type { DesignResourceObservableRuleManifestV2, DesignResourceSymbolicNoninterferenceDerivedResultV2, DesignResourceSymbolicNoninterferenceFailureWitnessV1, DesignResourceSymbolicNoninterferenceProofMethodV2 } from "./design-resource-symbolic-fact-types.js";
+import type { CompiledSymbolicDenotationV1, SymbolicDenotationPredicate } from "./symbolic-denotation-types.js";
+export interface DerivedCurrentSourceNoninterferenceEvidenceV2 {
+    derived_result: DesignResourceSymbolicNoninterferenceDerivedResultV2;
+    failure_witness: DesignResourceSymbolicNoninterferenceFailureWitnessV1 | null;
+}
+export interface DerivedSourceCase {
+    index: number;
+    region: {
+        rule_region_sha256: string;
+        predicate: SymbolicDenotationPredicate;
+    };
+    compiledSource: CompiledSymbolicDenotationV1;
+    compiledRule: CompiledSymbolicDenotationV1;
+    factRuleRefs: string[];
+}
+export declare function derivedSourceResult(method: DesignResourceSymbolicNoninterferenceProofMethodV2, sourceResourceRef: string, cases: DerivedSourceCase[], manifest: DesignResourceObservableRuleManifestV2): DesignResourceSymbolicNoninterferenceDerivedResultV2;
+export declare function emptyDerivedSourceResult(method: DesignResourceSymbolicNoninterferenceProofMethodV2, sourceResourceRef?: string | null): DesignResourceSymbolicNoninterferenceDerivedResultV2;
+export declare function sourceCaseWitness({ certificateScopeSha256, resource, source, proofCase, kind, axisRef, assignment, detail, }: {
+    certificateScopeSha256: string;
+    resource: DesignResource;
+    source: string;
+    proofCase: DerivedSourceCase;
+    kind: DesignResourceSymbolicNoninterferenceFailureWitnessV1["kind"];
+    axisRef?: string | null;
+    assignment?: DesignResourceSymbolicNoninterferenceFailureWitnessV1["assignment"];
+    detail: string;
+}): DesignResourceSymbolicNoninterferenceFailureWitnessV1;
+export declare function sourceNoninterferenceWitness({ certificateScopeSha256, kind, axisRef, factRuleRef, resource, locator, nodeRef, byteOffset, assignment, detail, }: {
+    certificateScopeSha256: string;
+    kind?: DesignResourceSymbolicNoninterferenceFailureWitnessV1["kind"];
+    axisRef?: string | null;
+    factRuleRef?: string | null;
+    resource?: DesignResource;
+    locator?: string | null;
+    nodeRef?: string | null;
+    byteOffset?: number | null;
+    assignment?: DesignResourceSymbolicNoninterferenceFailureWitnessV1["assignment"];
+    detail: string;
+}): DesignResourceSymbolicNoninterferenceFailureWitnessV1;
+export declare function failedSourceEvidence(derivedResult: DesignResourceSymbolicNoninterferenceDerivedResultV2, failureWitness: DesignResourceSymbolicNoninterferenceFailureWitnessV1): DerivedCurrentSourceNoninterferenceEvidenceV2;
+export declare function sameStringSet(left: string[], right: string[]): boolean;
+export declare function sourceOracleErrorText(error: unknown): string;

package/dist/lib/design-resource-symbolic-source-ir-evidence.js

@@ -0,0 +1,88 @@
+import { Buffer } from "node:buffer";
+import { compareText, stableJson, } from "./design-resource-symbolic-validation-support.js";
+export function derivedSourceResult(method, sourceResourceRef, cases, manifest) {
+    const result = emptyDerivedSourceResult(method, sourceResourceRef);
+    if (method === "closed_world_static_dependency_closure") {
+        const inputNodeRef = "source.input.complete";
+        result.static_dependency_nodes = [
+            {
+                key: inputNodeRef,
+                axis_refs: [],
+                dependency_refs: [],
+                input_resource_refs: manifest.inspector.input_resources
+                    .map((input) => input.resource_ref)
+                    .sort(compareText),
+            },
+            ...cases.map((proofCase) => ({
+                key: `source.region.${proofCase.region.rule_region_sha256}`,
+                axis_refs: [...proofCase.compiledSource.referenced_axis_refs].sort(compareText),
+                dependency_refs: [inputNodeRef],
+                input_resource_refs: [],
+            })),
+        ];
+        result.static_rule_roots = cases.map((proofCase) => ({
+            fact_rule_refs: [...proofCase.factRuleRefs],
+            node_ref: `source.region.${proofCase.region.rule_region_sha256}`,
+        }));
+        return result;
+    }
+    result.equivalence_cases = cases.map((proofCase) => ({
+        fact_rule_refs: [...proofCase.factRuleRefs],
+        side_predicate: structuredClone(proofCase.region.predicate),
+        axis_erased_predicate: structuredClone(proofCase.region.predicate),
+    }));
+    return result;
+}
+export function emptyDerivedSourceResult(method, sourceResourceRef = null) {
+    return {
+        source_ir_resource_ref: sourceResourceRef,
+        static_dependency_nodes: [],
+        static_rule_roots: [],
+        equivalence_cases: [],
+        complete_domain_cardinality: method === "finite_complete_domain_exhaustive_equivalence" ? "0" : null,
+        exhaustive_evaluation_sha256: null,
+    };
+}
+export function sourceCaseWitness({ certificateScopeSha256, resource, source, proofCase, kind, axisRef = null, assignment = null, detail, }) {
+    const locator = `/certificate_scopes/*/regions/${proofCase.index}/predicate`;
+    const needle = axisRef ?? proofCase.region.rule_region_sha256;
+    const offset = source.indexOf(needle);
+    return sourceNoninterferenceWitness({
+        certificateScopeSha256,
+        kind,
+        axisRef,
+        factRuleRef: proofCase.factRuleRefs[0] ?? null,
+        resource,
+        locator,
+        nodeRef: `source.region.${proofCase.region.rule_region_sha256}`,
+        byteOffset: offset < 0 ? null : Buffer.byteLength(source.slice(0, offset), "utf8"),
+        assignment,
+        detail,
+    });
+}
+export function sourceNoninterferenceWitness({ certificateScopeSha256, kind = "unsupported_dependency", axisRef = null, factRuleRef = null, resource, locator = null, nodeRef = null, byteOffset = null, assignment = null, detail, }) {
+    return {
+        kind,
+        side: "source",
+        certificate_scope_sha256: certificateScopeSha256,
+        axis_ref: axisRef,
+        fact_rule_ref: factRuleRef,
+        resource_ref: resource?.key ?? null,
+        path: resource?.path ?? null,
+        locator,
+        node_ref: nodeRef,
+        byte_offset: byteOffset,
+        assignment,
+        detail,
+    };
+}
+export function failedSourceEvidence(derivedResult, failureWitness) {
+    return { derived_result: derivedResult, failure_witness: failureWitness };
+}
+export function sameStringSet(left, right) {
+    return (stableJson([...new Set(left)].sort(compareText)) ===
+        stableJson([...new Set(right)].sort(compareText)));
+}
+export function sourceOracleErrorText(error) {
+    return error instanceof Error ? error.message : String(error);
+}

package/dist/lib/design-resource-symbolic-source-ir-oracle.d.ts

@@ -0,0 +1,13 @@
+import { Buffer } from "node:buffer";
+import type { DesignResource } from "./design-resource-handoff-file-primitives.js";
+import type { DesignResourceObservableRuleManifestV2, DesignResourceSymbolicHandoffTargetV2, DesignResourceSymbolicNoninterferenceCertificateV2, DesignResourceSymbolicNoninterferenceProofMethodV2 } from "./design-resource-symbolic-fact-types.js";
+import { type DerivedCurrentSourceNoninterferenceEvidenceV2 } from "./design-resource-symbolic-source-ir-evidence.js";
+export type { DerivedCurrentSourceNoninterferenceEvidenceV2 } from "./design-resource-symbolic-source-ir-evidence.js";
+export declare function deriveCurrentSourceNoninterferenceEvidence({ manifest, certificate, method, target, resources, contents, }: {
+    manifest: DesignResourceObservableRuleManifestV2;
+    certificate: DesignResourceSymbolicNoninterferenceCertificateV2;
+    method: DesignResourceSymbolicNoninterferenceProofMethodV2;
+    target: DesignResourceSymbolicHandoffTargetV2;
+    resources: ReadonlyMap<string, DesignResource>;
+    contents: ReadonlyMap<string, Buffer>;
+}): DerivedCurrentSourceNoninterferenceEvidenceV2;

package/dist/lib/design-resource-symbolic-source-ir-oracle.js

@@ -0,0 +1,96 @@
+import { symbolicNoninterferenceCertificateScopeSha256, symbolicNoninterferenceRuleScopeSha256, } from "./design-resource-symbolic-noninterference-scope.js";
+import { productionClosureFailure } from "./design-resource-symbolic-production-closure.js";
+import { emptyDerivedSourceResult, failedSourceEvidence, sourceNoninterferenceWitness, sourceOracleErrorText, } from "./design-resource-symbolic-source-ir-evidence.js";
+import { deriveCurrentSourceScopeEvidence } from "./design-resource-symbolic-source-ir-proof.js";
+import { parseDesignResourceSymbolicSourceIr } from "./design-resource-symbolic-source-ir-shape.js";
+import { DESIGN_RESOURCE_SYMBOLIC_SOURCE_IR_MEDIA_TYPE } from "./design-resource-symbolic-source-ir-types.js";
+import { canonicalJson } from "./strict-codec.js";
+export function deriveCurrentSourceNoninterferenceEvidence({ manifest, certificate, method, target, resources, contents, }) {
+    const certificateScopeSha256 = symbolicNoninterferenceCertificateScopeSha256(certificate);
+    const ruleScopeSha256 = symbolicNoninterferenceRuleScopeSha256(manifest, certificate);
+    const empty = emptyDerivedSourceResult(method);
+    const closureFailure = currentSourceClosureFailure(manifest, certificate, target, resources, contents);
+    if (closureFailure)
+        return { derived_result: empty, failure_witness: closureFailure };
+    const sourceResourceRefs = manifest.inspector.input_resources
+        .map((input) => input.resource_ref)
+        .filter((ref) => resources.get(ref)?.media_type ===
+        DESIGN_RESOURCE_SYMBOLIC_SOURCE_IR_MEDIA_TYPE);
+    if (sourceResourceRefs.length !== 1)
+        return failedSourceEvidence(empty, sourceNoninterferenceWitness({
+            certificateScopeSha256,
+            detail: `symbolic_source_ir_count:${sourceResourceRefs.length}`,
+        }));
+    const sourceResourceRef = sourceResourceRefs[0];
+    const resource = resources.get(sourceResourceRef);
+    const bytes = contents.get(sourceResourceRef);
+    const source = bytes.toString("utf8");
+    let parsed;
+    try {
+        const raw = JSON.parse(source);
+        if (canonicalJson(raw) !== source)
+            throw new Error("symbolic Source IR must use canonical JSON bytes");
+        parsed = parseDesignResourceSymbolicSourceIr(raw, `symbolic_source_ir:${sourceResourceRef}`);
+    }
+    catch (error) {
+        return failedSourceEvidence({ ...empty, source_ir_resource_ref: sourceResourceRef }, sourceNoninterferenceWitness({
+            certificateScopeSha256,
+            resource,
+            detail: `invalid_symbolic_source_ir:${sourceOracleErrorText(error)}`,
+        }));
+    }
+    if (parsed.target_ref !== target.key)
+        return failedSourceEvidence({ ...empty, source_ir_resource_ref: sourceResourceRef }, sourceNoninterferenceWitness({
+            certificateScopeSha256,
+            resource,
+            locator: "/target_ref",
+            detail: `symbolic_source_ir_target_mismatch:${parsed.target_ref}:${target.key}`,
+        }));
+    const matches = parsed.certificate_scopes.filter((scope) => scope.certificate_scope_sha256 === certificateScopeSha256 &&
+        scope.rule_scope_sha256 === ruleScopeSha256);
+    if (matches.length !== 1)
+        return failedSourceEvidence({ ...empty, source_ir_resource_ref: sourceResourceRef }, sourceNoninterferenceWitness({
+            certificateScopeSha256,
+            resource,
+            locator: "/certificate_scopes",
+            detail: `symbolic_source_ir_scope_match_count:${matches.length}:rule_scope=${ruleScopeSha256}`,
+        }));
+    try {
+        return deriveCurrentSourceScopeEvidence({
+            manifest,
+            certificate,
+            method,
+            resource,
+            source,
+            sourceResourceRef,
+            scope: matches[0],
+            certificateScopeSha256,
+        });
+    }
+    catch (error) {
+        return failedSourceEvidence({ ...empty, source_ir_resource_ref: sourceResourceRef }, sourceNoninterferenceWitness({
+            certificateScopeSha256,
+            resource,
+            locator: "/certificate_scopes",
+            detail: `unsupported_symbolic_source_ir:${sourceOracleErrorText(error)}`,
+        }));
+    }
+}
+function currentSourceClosureFailure(manifest, certificate, target, resources, contents) {
+    const inputRefs = manifest.inspector.input_resources.map((input) => input.resource_ref);
+    const failure = productionClosureFailure({
+        ...target,
+        resource_refs: inputRefs,
+        source_profile: {
+            ...target.source_profile,
+            dependency_resource_refs: inputRefs.filter((ref) => ref !== target.source_profile.entry_resource_ref),
+        },
+    }, certificate, resources, contents);
+    return failure
+        ? {
+            ...failure,
+            side: "source",
+            detail: `unsupported_source:${failure.detail}`,
+        }
+        : null;
+}