project-tiny-context-harness 0.8.11 → 0.8.13

package/dist/lib/design-resource-symbolic-safety-validation.js

@@ -0,0 +1,29 @@
+import { EXACT_TARGET_FULL_TARGET_METHODS } from "./design-resource-fact-policy.js";
+import { invalid } from "./design-resource-symbolic-validation-support.js";
+export function validateSymbolicReadinessClosure(manifest) {
+    if (manifest.acceptance_blockers.length)
+        invalid("acceptance_blockers_unresolved", manifest.acceptance_blockers.map((item) => item.key).join(","));
+}
+export function assertNoUnprovedOmittedAxes(compiled, label) {
+    if (compiled.omitted_axis_refs.length)
+        invalid("v2_noninterference_proof_unavailable", `${label}:${compiled.omitted_axis_refs.join(",")}`);
+}
+export function validateSymbolicExactTargetCoverage(interpretation, manifest, projections, reachable, compilation) {
+    if (interpretation !== "exact_target")
+        return;
+    const obligations = new Map(manifest.semantic_proof_obligations.map((item) => [item.key, item]));
+    for (const method of EXACT_TARGET_FULL_TARGET_METHODS) {
+        const regions = projections
+            .filter(({ rule }) => rule.observation_scope === "full_target" &&
+            rule.semantic_obligation_refs.some((ref) => obligations.get(ref)?.method === method))
+            .map(({ rule }) => rule.region);
+        if (!regions.length)
+            invalid("v2_exact_target_full_target_method_missing", method);
+        const covered = compilation.compile({
+            op: "any",
+            predicates: regions,
+        });
+        if (covered.canonical_sha256 !== reachable.canonical_sha256)
+            invalid("v2_exact_target_full_target_region_gap", method);
+    }
+}

package/dist/lib/design-resource-symbolic-source-ir-evaluation.d.ts

@@ -0,0 +1,19 @@
+import type { CompiledSymbolicDenotationV1, SymbolicDenotationAxisDomain, SymbolicDenotationScalar } from "./symbolic-denotation-types.js";
+export declare const MAX_SOURCE_EXHAUSTIVE_DOMAIN_CARDINALITY = 100000n;
+export interface SymbolicSourceExhaustiveCaseV1 {
+    fact_rule_refs: string[];
+    source: CompiledSymbolicDenotationV1;
+    rule: CompiledSymbolicDenotationV1;
+}
+export interface SymbolicSourceExhaustiveCounterexampleV1 {
+    kind: "source_rule_denotation_mismatch" | "complete_domain_counterexample";
+    axis_ref: string | null;
+    fact_rule_ref: string;
+    assignment: Record<string, SymbolicDenotationScalar>;
+    detail: string;
+}
+export declare function evaluateCompleteSymbolicSourceDomain(domains: SymbolicDenotationAxisDomain[], omittedAxisRefs: string[], cases: SymbolicSourceExhaustiveCaseV1[]): {
+    cardinality: string;
+    evaluation_sha256: string;
+    counterexample: SymbolicSourceExhaustiveCounterexampleV1 | null;
+};

package/dist/lib/design-resource-symbolic-source-ir-evaluation.js

@@ -0,0 +1,74 @@
+import { createHash } from "node:crypto";
+import { evaluateCanonicalSymbolicDenotation } from "./symbolic-denotation-engine.js";
+import { domainCardinality } from "./symbolic-denotation-support.js";
+import { compareText, stableJson, } from "./design-resource-symbolic-validation-support.js";
+export const MAX_SOURCE_EXHAUSTIVE_DOMAIN_CARDINALITY = 100000n;
+export function evaluateCompleteSymbolicSourceDomain(domains, omittedAxisRefs, cases) {
+    const sortedDomains = [...domains].sort((left, right) => compareText(left.key, right.key));
+    const cardinality = sortedDomains.reduce((total, domain) => total * domainCardinality(domain), 1n);
+    if (cardinality > MAX_SOURCE_EXHAUSTIVE_DOMAIN_CARDINALITY)
+        throw new Error(`source_complete_domain_capacity_exceeded:actual=${cardinality}:limit=${MAX_SOURCE_EXHAUSTIVE_DOMAIN_CARDINALITY}`);
+    const omitted = new Set(omittedAxisRefs);
+    const anchor = Object.fromEntries(sortedDomains.map((domain) => [domain.key, domainValues(domain)[0]]));
+    const hash = createHash("sha256");
+    let independenceCounterexample = null;
+    let ruleCounterexample = null;
+    for (const assignment of enumerateAssignments(sortedDomains)) {
+        const axisErasedAssignment = { ...assignment };
+        for (const axisRef of omitted)
+            axisErasedAssignment[axisRef] = anchor[axisRef];
+        for (const proofCase of cases) {
+            const source = evaluateCanonicalSymbolicDenotation(proofCase.source.canonical_dag, assignment);
+            const rule = evaluateCanonicalSymbolicDenotation(proofCase.rule.canonical_dag, assignment);
+            const axisErased = evaluateCanonicalSymbolicDenotation(proofCase.source.canonical_dag, axisErasedAssignment);
+            hash.update(stableJson({
+                assignment,
+                axis_erased: axisErased,
+                rule,
+                source,
+                rule_refs: proofCase.fact_rule_refs,
+            }));
+            hash.update("\n");
+            if (!independenceCounterexample && source !== axisErased) {
+                const axisRef = omittedAxisRefs.find((ref) => assignment[ref] !== anchor[ref]);
+                independenceCounterexample = {
+                    kind: "complete_domain_counterexample",
+                    axis_ref: axisRef ?? omittedAxisRefs[0] ?? null,
+                    fact_rule_ref: proofCase.fact_rule_refs[0],
+                    assignment: { ...assignment },
+                    detail: "current Source denotation changes after omitted axes are erased",
+                };
+            }
+            if (!ruleCounterexample && source !== rule)
+                ruleCounterexample = {
+                    kind: "source_rule_denotation_mismatch",
+                    axis_ref: null,
+                    fact_rule_ref: proofCase.fact_rule_refs[0],
+                    assignment: { ...assignment },
+                    detail: "current Source denotation differs from the current Rule region",
+                };
+        }
+    }
+    return {
+        cardinality: cardinality.toString(),
+        evaluation_sha256: hash.digest("hex"),
+        counterexample: independenceCounterexample ?? ruleCounterexample,
+    };
+}
+function* enumerateAssignments(domains, index = 0, current = {}) {
+    if (index === domains.length) {
+        yield { ...current };
+        return;
+    }
+    const domain = domains[index];
+    for (const value of domainValues(domain)) {
+        current[domain.key] = value;
+        yield* enumerateAssignments(domains, index + 1, current);
+    }
+    delete current[domain.key];
+}
+function domainValues(domain) {
+    if (domain.kind === "enum")
+        return [...domain.values];
+    return Array.from({ length: domain.maximum - domain.minimum + 1 }, (_, index) => domain.minimum + index);
+}

package/dist/lib/design-resource-symbolic-source-ir-evidence.d.ts

@@ -0,0 +1,44 @@
+import type { DesignResource } from "./design-resource-handoff-file-primitives.js";
+import type { DesignResourceObservableRuleManifestV2, DesignResourceSymbolicNoninterferenceDerivedResultV2, DesignResourceSymbolicNoninterferenceFailureWitnessV1, DesignResourceSymbolicNoninterferenceProofMethodV2 } from "./design-resource-symbolic-fact-types.js";
+import type { CompiledSymbolicDenotationV1, SymbolicDenotationPredicate } from "./symbolic-denotation-types.js";
+export interface DerivedCurrentSourceNoninterferenceEvidenceV2 {
+    derived_result: DesignResourceSymbolicNoninterferenceDerivedResultV2;
+    failure_witness: DesignResourceSymbolicNoninterferenceFailureWitnessV1 | null;
+}
+export interface DerivedSourceCase {
+    index: number;
+    region: {
+        rule_region_sha256: string;
+        predicate: SymbolicDenotationPredicate;
+    };
+    compiledSource: CompiledSymbolicDenotationV1;
+    compiledRule: CompiledSymbolicDenotationV1;
+    factRuleRefs: string[];
+}
+export declare function derivedSourceResult(method: DesignResourceSymbolicNoninterferenceProofMethodV2, sourceResourceRef: string, cases: DerivedSourceCase[], manifest: DesignResourceObservableRuleManifestV2): DesignResourceSymbolicNoninterferenceDerivedResultV2;
+export declare function emptyDerivedSourceResult(method: DesignResourceSymbolicNoninterferenceProofMethodV2, sourceResourceRef?: string | null): DesignResourceSymbolicNoninterferenceDerivedResultV2;
+export declare function sourceCaseWitness({ certificateScopeSha256, resource, source, proofCase, kind, axisRef, assignment, detail, }: {
+    certificateScopeSha256: string;
+    resource: DesignResource;
+    source: string;
+    proofCase: DerivedSourceCase;
+    kind: DesignResourceSymbolicNoninterferenceFailureWitnessV1["kind"];
+    axisRef?: string | null;
+    assignment?: DesignResourceSymbolicNoninterferenceFailureWitnessV1["assignment"];
+    detail: string;
+}): DesignResourceSymbolicNoninterferenceFailureWitnessV1;
+export declare function sourceNoninterferenceWitness({ certificateScopeSha256, kind, axisRef, factRuleRef, resource, locator, nodeRef, byteOffset, assignment, detail, }: {
+    certificateScopeSha256: string;
+    kind?: DesignResourceSymbolicNoninterferenceFailureWitnessV1["kind"];
+    axisRef?: string | null;
+    factRuleRef?: string | null;
+    resource?: DesignResource;
+    locator?: string | null;
+    nodeRef?: string | null;
+    byteOffset?: number | null;
+    assignment?: DesignResourceSymbolicNoninterferenceFailureWitnessV1["assignment"];
+    detail: string;
+}): DesignResourceSymbolicNoninterferenceFailureWitnessV1;
+export declare function failedSourceEvidence(derivedResult: DesignResourceSymbolicNoninterferenceDerivedResultV2, failureWitness: DesignResourceSymbolicNoninterferenceFailureWitnessV1): DerivedCurrentSourceNoninterferenceEvidenceV2;
+export declare function sameStringSet(left: string[], right: string[]): boolean;
+export declare function sourceOracleErrorText(error: unknown): string;

package/dist/lib/design-resource-symbolic-source-ir-evidence.js

@@ -0,0 +1,88 @@
+import { Buffer } from "node:buffer";
+import { compareText, stableJson, } from "./design-resource-symbolic-validation-support.js";
+export function derivedSourceResult(method, sourceResourceRef, cases, manifest) {
+    const result = emptyDerivedSourceResult(method, sourceResourceRef);
+    if (method === "closed_world_static_dependency_closure") {
+        const inputNodeRef = "source.input.complete";
+        result.static_dependency_nodes = [
+            {
+                key: inputNodeRef,
+                axis_refs: [],
+                dependency_refs: [],
+                input_resource_refs: manifest.inspector.input_resources
+                    .map((input) => input.resource_ref)
+                    .sort(compareText),
+            },
+            ...cases.map((proofCase) => ({
+                key: `source.region.${proofCase.region.rule_region_sha256}`,
+                axis_refs: [...proofCase.compiledSource.referenced_axis_refs].sort(compareText),
+                dependency_refs: [inputNodeRef],
+                input_resource_refs: [],
+            })),
+        ];
+        result.static_rule_roots = cases.map((proofCase) => ({
+            fact_rule_refs: [...proofCase.factRuleRefs],
+            node_ref: `source.region.${proofCase.region.rule_region_sha256}`,
+        }));
+        return result;
+    }
+    result.equivalence_cases = cases.map((proofCase) => ({
+        fact_rule_refs: [...proofCase.factRuleRefs],
+        side_predicate: structuredClone(proofCase.region.predicate),
+        axis_erased_predicate: structuredClone(proofCase.region.predicate),
+    }));
+    return result;
+}
+export function emptyDerivedSourceResult(method, sourceResourceRef = null) {
+    return {
+        source_ir_resource_ref: sourceResourceRef,
+        static_dependency_nodes: [],
+        static_rule_roots: [],
+        equivalence_cases: [],
+        complete_domain_cardinality: method === "finite_complete_domain_exhaustive_equivalence" ? "0" : null,
+        exhaustive_evaluation_sha256: null,
+    };
+}
+export function sourceCaseWitness({ certificateScopeSha256, resource, source, proofCase, kind, axisRef = null, assignment = null, detail, }) {
+    const locator = `/certificate_scopes/*/regions/${proofCase.index}/predicate`;
+    const needle = axisRef ?? proofCase.region.rule_region_sha256;
+    const offset = source.indexOf(needle);
+    return sourceNoninterferenceWitness({
+        certificateScopeSha256,
+        kind,
+        axisRef,
+        factRuleRef: proofCase.factRuleRefs[0] ?? null,
+        resource,
+        locator,
+        nodeRef: `source.region.${proofCase.region.rule_region_sha256}`,
+        byteOffset: offset < 0 ? null : Buffer.byteLength(source.slice(0, offset), "utf8"),
+        assignment,
+        detail,
+    });
+}
+export function sourceNoninterferenceWitness({ certificateScopeSha256, kind = "unsupported_dependency", axisRef = null, factRuleRef = null, resource, locator = null, nodeRef = null, byteOffset = null, assignment = null, detail, }) {
+    return {
+        kind,
+        side: "source",
+        certificate_scope_sha256: certificateScopeSha256,
+        axis_ref: axisRef,
+        fact_rule_ref: factRuleRef,
+        resource_ref: resource?.key ?? null,
+        path: resource?.path ?? null,
+        locator,
+        node_ref: nodeRef,
+        byte_offset: byteOffset,
+        assignment,
+        detail,
+    };
+}
+export function failedSourceEvidence(derivedResult, failureWitness) {
+    return { derived_result: derivedResult, failure_witness: failureWitness };
+}
+export function sameStringSet(left, right) {
+    return (stableJson([...new Set(left)].sort(compareText)) ===
+        stableJson([...new Set(right)].sort(compareText)));
+}
+export function sourceOracleErrorText(error) {
+    return error instanceof Error ? error.message : String(error);
+}

package/dist/lib/design-resource-symbolic-source-ir-oracle.d.ts

@@ -0,0 +1,13 @@
+import { Buffer } from "node:buffer";
+import type { DesignResource } from "./design-resource-handoff-file-primitives.js";
+import type { DesignResourceObservableRuleManifestV2, DesignResourceSymbolicHandoffTargetV2, DesignResourceSymbolicNoninterferenceCertificateV2, DesignResourceSymbolicNoninterferenceProofMethodV2 } from "./design-resource-symbolic-fact-types.js";
+import { type DerivedCurrentSourceNoninterferenceEvidenceV2 } from "./design-resource-symbolic-source-ir-evidence.js";
+export type { DerivedCurrentSourceNoninterferenceEvidenceV2 } from "./design-resource-symbolic-source-ir-evidence.js";
+export declare function deriveCurrentSourceNoninterferenceEvidence({ manifest, certificate, method, target, resources, contents, }: {
+    manifest: DesignResourceObservableRuleManifestV2;
+    certificate: DesignResourceSymbolicNoninterferenceCertificateV2;
+    method: DesignResourceSymbolicNoninterferenceProofMethodV2;
+    target: DesignResourceSymbolicHandoffTargetV2;
+    resources: ReadonlyMap<string, DesignResource>;
+    contents: ReadonlyMap<string, Buffer>;
+}): DerivedCurrentSourceNoninterferenceEvidenceV2;

package/dist/lib/design-resource-symbolic-source-ir-oracle.js

@@ -0,0 +1,96 @@
+import { symbolicNoninterferenceCertificateScopeSha256, symbolicNoninterferenceRuleScopeSha256, } from "./design-resource-symbolic-noninterference-scope.js";
+import { productionClosureFailure } from "./design-resource-symbolic-production-closure.js";
+import { emptyDerivedSourceResult, failedSourceEvidence, sourceNoninterferenceWitness, sourceOracleErrorText, } from "./design-resource-symbolic-source-ir-evidence.js";
+import { deriveCurrentSourceScopeEvidence } from "./design-resource-symbolic-source-ir-proof.js";
+import { parseDesignResourceSymbolicSourceIr } from "./design-resource-symbolic-source-ir-shape.js";
+import { DESIGN_RESOURCE_SYMBOLIC_SOURCE_IR_MEDIA_TYPE } from "./design-resource-symbolic-source-ir-types.js";
+import { canonicalJson } from "./strict-codec.js";
+export function deriveCurrentSourceNoninterferenceEvidence({ manifest, certificate, method, target, resources, contents, }) {
+    const certificateScopeSha256 = symbolicNoninterferenceCertificateScopeSha256(certificate);
+    const ruleScopeSha256 = symbolicNoninterferenceRuleScopeSha256(manifest, certificate);
+    const empty = emptyDerivedSourceResult(method);
+    const closureFailure = currentSourceClosureFailure(manifest, certificate, target, resources, contents);
+    if (closureFailure)
+        return { derived_result: empty, failure_witness: closureFailure };
+    const sourceResourceRefs = manifest.inspector.input_resources
+        .map((input) => input.resource_ref)
+        .filter((ref) => resources.get(ref)?.media_type ===
+        DESIGN_RESOURCE_SYMBOLIC_SOURCE_IR_MEDIA_TYPE);
+    if (sourceResourceRefs.length !== 1)
+        return failedSourceEvidence(empty, sourceNoninterferenceWitness({
+            certificateScopeSha256,
+            detail: `symbolic_source_ir_count:${sourceResourceRefs.length}`,
+        }));
+    const sourceResourceRef = sourceResourceRefs[0];
+    const resource = resources.get(sourceResourceRef);
+    const bytes = contents.get(sourceResourceRef);
+    const source = bytes.toString("utf8");
+    let parsed;
+    try {
+        const raw = JSON.parse(source);
+        if (canonicalJson(raw) !== source)
+            throw new Error("symbolic Source IR must use canonical JSON bytes");
+        parsed = parseDesignResourceSymbolicSourceIr(raw, `symbolic_source_ir:${sourceResourceRef}`);
+    }
+    catch (error) {
+        return failedSourceEvidence({ ...empty, source_ir_resource_ref: sourceResourceRef }, sourceNoninterferenceWitness({
+            certificateScopeSha256,
+            resource,
+            detail: `invalid_symbolic_source_ir:${sourceOracleErrorText(error)}`,
+        }));
+    }
+    if (parsed.target_ref !== target.key)
+        return failedSourceEvidence({ ...empty, source_ir_resource_ref: sourceResourceRef }, sourceNoninterferenceWitness({
+            certificateScopeSha256,
+            resource,
+            locator: "/target_ref",
+            detail: `symbolic_source_ir_target_mismatch:${parsed.target_ref}:${target.key}`,
+        }));
+    const matches = parsed.certificate_scopes.filter((scope) => scope.certificate_scope_sha256 === certificateScopeSha256 &&
+        scope.rule_scope_sha256 === ruleScopeSha256);
+    if (matches.length !== 1)
+        return failedSourceEvidence({ ...empty, source_ir_resource_ref: sourceResourceRef }, sourceNoninterferenceWitness({
+            certificateScopeSha256,
+            resource,
+            locator: "/certificate_scopes",
+            detail: `symbolic_source_ir_scope_match_count:${matches.length}:rule_scope=${ruleScopeSha256}`,
+        }));
+    try {
+        return deriveCurrentSourceScopeEvidence({
+            manifest,
+            certificate,
+            method,
+            resource,
+            source,
+            sourceResourceRef,
+            scope: matches[0],
+            certificateScopeSha256,
+        });
+    }
+    catch (error) {
+        return failedSourceEvidence({ ...empty, source_ir_resource_ref: sourceResourceRef }, sourceNoninterferenceWitness({
+            certificateScopeSha256,
+            resource,
+            locator: "/certificate_scopes",
+            detail: `unsupported_symbolic_source_ir:${sourceOracleErrorText(error)}`,
+        }));
+    }
+}
+function currentSourceClosureFailure(manifest, certificate, target, resources, contents) {
+    const inputRefs = manifest.inspector.input_resources.map((input) => input.resource_ref);
+    const failure = productionClosureFailure({
+        ...target,
+        resource_refs: inputRefs,
+        source_profile: {
+            ...target.source_profile,
+            dependency_resource_refs: inputRefs.filter((ref) => ref !== target.source_profile.entry_resource_ref),
+        },
+    }, certificate, resources, contents);
+    return failure
+        ? {
+            ...failure,
+            side: "source",
+            detail: `unsupported_source:${failure.detail}`,
+        }
+        : null;
+}

package/dist/lib/design-resource-symbolic-source-ir-proof.d.ts

@@ -0,0 +1,14 @@
+import type { DesignResource } from "./design-resource-handoff-file-primitives.js";
+import type { DesignResourceObservableRuleManifestV2, DesignResourceSymbolicNoninterferenceCertificateV2, DesignResourceSymbolicNoninterferenceProofMethodV2 } from "./design-resource-symbolic-fact-types.js";
+import { type DerivedCurrentSourceNoninterferenceEvidenceV2 } from "./design-resource-symbolic-source-ir-evidence.js";
+import type { DesignResourceSymbolicSourceIrCertificateScopeV1 } from "./design-resource-symbolic-source-ir-types.js";
+export declare function deriveCurrentSourceScopeEvidence({ manifest, certificate, method, resource, source, sourceResourceRef, scope, certificateScopeSha256, }: {
+    manifest: DesignResourceObservableRuleManifestV2;
+    certificate: DesignResourceSymbolicNoninterferenceCertificateV2;
+    method: DesignResourceSymbolicNoninterferenceProofMethodV2;
+    resource: DesignResource;
+    source: string;
+    sourceResourceRef: string;
+    scope: DesignResourceSymbolicSourceIrCertificateScopeV1;
+    certificateScopeSha256: string;
+}): DerivedCurrentSourceNoninterferenceEvidenceV2;

package/dist/lib/design-resource-symbolic-source-ir-proof.js

@@ -0,0 +1,98 @@
+import { compareText } from "./design-resource-symbolic-validation-support.js";
+import { derivedSourceResult, emptyDerivedSourceResult, failedSourceEvidence, sameStringSet, sourceCaseWitness, sourceNoninterferenceWitness, } from "./design-resource-symbolic-source-ir-evidence.js";
+import { evaluateCompleteSymbolicSourceDomain } from "./design-resource-symbolic-source-ir-evaluation.js";
+import { createSymbolicDenotationCompilationSession } from "./symbolic-denotation-engine.js";
+export function deriveCurrentSourceScopeEvidence({ manifest, certificate, method, resource, source, sourceResourceRef, scope, certificateScopeSha256, }) {
+    const ruleIndex = new Map(manifest.fact_rules.map((rule) => [rule.key, rule]));
+    const rules = certificate.fact_rule_refs.map((ruleRef) => {
+        const rule = ruleIndex.get(ruleRef);
+        if (!rule)
+            throw new Error(`certificate_rule_unknown:${ruleRef}`);
+        return rule;
+    });
+    const compilation = createSymbolicDenotationCompilationSession(manifest.axis_domains, [
+        ...rules.map((rule) => rule.region),
+        ...scope.regions.map((row) => row.predicate),
+    ]);
+    const rulesByRegion = new Map();
+    for (const rule of rules) {
+        const compiled = compilation.compile(rule.region);
+        const current = rulesByRegion.get(compiled.canonical_sha256) ?? {
+            factRuleRefs: [],
+            compiled,
+        };
+        current.factRuleRefs.push(rule.key);
+        rulesByRegion.set(compiled.canonical_sha256, current);
+    }
+    const declaredRegionRefs = scope.regions.map((row) => row.rule_region_sha256);
+    if (new Set(declaredRegionRefs).size !== declaredRegionRefs.length)
+        throw new Error("symbolic_source_ir_region_duplicate");
+    if (!sameStringSet(declaredRegionRefs, [...rulesByRegion.keys()]))
+        return failedSourceEvidence(emptyDerivedSourceResult(method, sourceResourceRef), sourceNoninterferenceWitness({
+            certificateScopeSha256,
+            resource,
+            locator: "/certificate_scopes/*/regions",
+            detail: `source_rule_region_set_mismatch:${declaredRegionRefs.join(",")}:${[
+                ...rulesByRegion.keys(),
+            ].join(",")}`,
+            kind: "source_rule_denotation_mismatch",
+        }));
+    const cases = scope.regions.map((region, index) => {
+        const expected = rulesByRegion.get(region.rule_region_sha256);
+        return {
+            index,
+            region,
+            compiledSource: compilation.compile(region.predicate),
+            compiledRule: expected.compiled,
+            factRuleRefs: [...expected.factRuleRefs].sort(compareText),
+        };
+    });
+    const derived = derivedSourceResult(method, sourceResourceRef, cases, manifest);
+    if (method !== "finite_complete_domain_exhaustive_equivalence") {
+        for (const proofCase of cases) {
+            const omittedAxisRef = proofCase.compiledSource.referenced_axis_refs.find((axisRef) => certificate.omitted_axis_refs.includes(axisRef));
+            if (omittedAxisRef)
+                return failedSourceEvidence(derived, sourceCaseWitness({
+                    certificateScopeSha256,
+                    resource,
+                    source,
+                    proofCase,
+                    axisRef: omittedAxisRef,
+                    kind: "omitted_axis_dependency",
+                    detail: "current Source expression branches on an omitted axis",
+                }));
+            if (proofCase.compiledSource.canonical_sha256 !==
+                proofCase.compiledRule.canonical_sha256)
+                return failedSourceEvidence(derived, sourceCaseWitness({
+                    certificateScopeSha256,
+                    resource,
+                    source,
+                    proofCase,
+                    kind: "source_rule_denotation_mismatch",
+                    detail: "current Source predicate differs from the current Rule region",
+                }));
+        }
+        return { derived_result: derived, failure_witness: null };
+    }
+    const exhaustive = evaluateCompleteSymbolicSourceDomain(manifest.axis_domains, certificate.omitted_axis_refs, cases.map((proofCase) => ({
+        fact_rule_refs: proofCase.factRuleRefs,
+        source: proofCase.compiledSource,
+        rule: proofCase.compiledRule,
+    })));
+    derived.complete_domain_cardinality = exhaustive.cardinality;
+    derived.exhaustive_evaluation_sha256 = exhaustive.evaluation_sha256;
+    if (exhaustive.counterexample) {
+        const proofCase = cases.find((item) => item.factRuleRefs.includes(exhaustive.counterexample.fact_rule_ref));
+        return failedSourceEvidence(derived, sourceCaseWitness({
+            certificateScopeSha256,
+            resource,
+            source,
+            proofCase,
+            kind: exhaustive.counterexample.kind,
+            axisRef: exhaustive.counterexample.axis_ref,
+            assignment: exhaustive.counterexample.assignment,
+            detail: exhaustive.counterexample.detail,
+        }));
+    }
+    return { derived_result: derived, failure_witness: null };
+}

package/dist/lib/design-resource-symbolic-source-ir-shape.d.ts

@@ -0,0 +1,2 @@
+import { type DesignResourceSymbolicSourceIrV1 } from "./design-resource-symbolic-source-ir-types.js";
+export declare function parseDesignResourceSymbolicSourceIr(value: unknown, label: string): DesignResourceSymbolicSourceIrV1;

package/dist/lib/design-resource-symbolic-source-ir-shape.js

@@ -0,0 +1,38 @@
+import { sha256, stableKey, } from "./design-resource-handoff-shape-primitives.js";
+import { parseSymbolicPredicate } from "./design-resource-symbolic-predicate-shape.js";
+import { DESIGN_RESOURCE_SYMBOLIC_SOURCE_IR_SCHEMA_VERSION, } from "./design-resource-symbolic-source-ir-types.js";
+import { array, literal, object } from "./long-task-shape-primitives.js";
+export function parseDesignResourceSymbolicSourceIr(value, label) {
+    const root = object(value, label, [
+        "schema_version",
+        "target_ref",
+        "certificate_scopes",
+    ]);
+    return {
+        schema_version: literal(root.schema_version, [DESIGN_RESOURCE_SYMBOLIC_SOURCE_IR_SCHEMA_VERSION], `${label}.schema_version`),
+        target_ref: stableKey(root.target_ref, `${label}.target_ref`),
+        certificate_scopes: array(root.certificate_scopes, `${label}.certificate_scopes`).map((scope, scopeIndex) => {
+            const scopeLabel = `${label}.certificate_scopes[${scopeIndex}]`;
+            const row = object(scope, scopeLabel, [
+                "certificate_scope_sha256",
+                "rule_scope_sha256",
+                "regions",
+            ]);
+            return {
+                certificate_scope_sha256: sha256(row.certificate_scope_sha256, `${scopeLabel}.certificate_scope_sha256`),
+                rule_scope_sha256: sha256(row.rule_scope_sha256, `${scopeLabel}.rule_scope_sha256`),
+                regions: array(row.regions, `${scopeLabel}.regions`).map((region, regionIndex) => {
+                    const regionLabel = `${scopeLabel}.regions[${regionIndex}]`;
+                    const entry = object(region, regionLabel, [
+                        "rule_region_sha256",
+                        "predicate",
+                    ]);
+                    return {
+                        rule_region_sha256: sha256(entry.rule_region_sha256, `${regionLabel}.rule_region_sha256`),
+                        predicate: parseSymbolicPredicate(entry.predicate, `${regionLabel}.predicate`),
+                    };
+                }),
+            };
+        }),
+    };
+}

package/dist/lib/design-resource-symbolic-source-ir-types.d.ts

@@ -0,0 +1,17 @@
+import type { SymbolicDenotationPredicate } from "./symbolic-denotation-types.js";
+export declare const DESIGN_RESOURCE_SYMBOLIC_SOURCE_IR_SCHEMA_VERSION: "design-resource-symbolic-source-ir-v1";
+export declare const DESIGN_RESOURCE_SYMBOLIC_SOURCE_IR_MEDIA_TYPE: "application/vnd.ty-context.symbolic-source-ir+json";
+export interface DesignResourceSymbolicSourceIrRegionV1 {
+    rule_region_sha256: string;
+    predicate: SymbolicDenotationPredicate;
+}
+export interface DesignResourceSymbolicSourceIrCertificateScopeV1 {
+    certificate_scope_sha256: string;
+    rule_scope_sha256: string;
+    regions: DesignResourceSymbolicSourceIrRegionV1[];
+}
+export interface DesignResourceSymbolicSourceIrV1 {
+    schema_version: typeof DESIGN_RESOURCE_SYMBOLIC_SOURCE_IR_SCHEMA_VERSION;
+    target_ref: string;
+    certificate_scopes: DesignResourceSymbolicSourceIrCertificateScopeV1[];
+}

package/dist/lib/design-resource-symbolic-source-ir-types.js

@@ -0,0 +1,2 @@
+export const DESIGN_RESOURCE_SYMBOLIC_SOURCE_IR_SCHEMA_VERSION = "design-resource-symbolic-source-ir-v1";
+export const DESIGN_RESOURCE_SYMBOLIC_SOURCE_IR_MEDIA_TYPE = "application/vnd.ty-context.symbolic-source-ir+json";

package/dist/lib/design-resource-symbolic-static-dependency-validation.d.ts

@@ -0,0 +1,2 @@
+import type { DesignResourceHandoffPreflightV2, DesignResourceObservableRuleManifestV2, DesignResourceSymbolicNoninterferenceCertificateV2, DesignResourceSymbolicNoninterferenceProofV2 } from "./design-resource-symbolic-fact-types.js";
+export declare function validateStaticDependencyClosure(proof: DesignResourceSymbolicNoninterferenceProofV2, certificate: DesignResourceSymbolicNoninterferenceCertificateV2, projections: DesignResourceHandoffPreflightV2["rule_projections"], manifest: DesignResourceObservableRuleManifestV2): void;

package/dist/lib/design-resource-symbolic-static-dependency-validation.js

@@ -0,0 +1,83 @@
+import { assertSameSet, invalid, requireKnownRefs, unique, } from "./design-resource-symbolic-validation-support.js";
+const MAX_STATIC_DEPENDENCY_NODES = 8_192;
+const MAX_STATIC_DEPENDENCY_EDGES = 65_536;
+const MAX_STATIC_DEPENDENCY_DEPTH = 512;
+export function validateStaticDependencyClosure(proof, certificate, projections, manifest) {
+    if (proof.equivalence_cases.length ||
+        proof.complete_domain_cardinality !== null)
+        invalid("v2_static_dependency_proof_shape_invalid", certificate.key);
+    if (!proof.static_dependency_nodes.length || !proof.static_rule_roots.length)
+        invalid("v2_static_dependency_graph_required", certificate.key);
+    if (proof.static_dependency_nodes.length > MAX_STATIC_DEPENDENCY_NODES)
+        invalid("v2_static_dependency_node_limit_exceeded", certificate.key);
+    if (proof.static_dependency_nodes.reduce((total, node) => total + node.dependency_refs.length, 0) > MAX_STATIC_DEPENDENCY_EDGES)
+        invalid("v2_static_dependency_edge_limit_exceeded", certificate.key);
+    const nodes = new Map(proof.static_dependency_nodes.map((node) => [node.key, node]));
+    unique(proof.static_dependency_nodes.map((node) => node.key), `v2_static_dependency_node_duplicate:${certificate.key}`);
+    validateNodes(proof, manifest, nodes, certificate.key);
+    const rootedRuleRefs = proof.static_rule_roots.flatMap((root) => root.fact_rule_refs ?? certificate.fact_rule_refs);
+    unique(rootedRuleRefs, `v2_static_dependency_rule_duplicate:${certificate.key}`);
+    assertSameSet(rootedRuleRefs, certificate.fact_rule_refs, "v2_static_dependency_rule_set_mismatch", certificate.key);
+    const projectionsByRule = new Map(projections.map((projection) => [projection.rule.key, projection]));
+    const reachedNodes = new Set();
+    const reachedResources = new Set();
+    const closureMemo = new Map();
+    for (const root of proof.static_rule_roots) {
+        const rootRuleRefs = root.fact_rule_refs ?? certificate.fact_rule_refs;
+        if (!rootRuleRefs.length)
+            invalid("v2_static_dependency_root_rules_required", certificate.key);
+        const closure = collectClosure(root.node_ref, nodes, new Set(), reachedNodes, certificate.key, closureMemo);
+        if (closure.maximumDepth > MAX_STATIC_DEPENDENCY_DEPTH)
+            invalid("v2_static_dependency_depth_limit_exceeded", certificate.key);
+        closure.inputResourceRefs.forEach((ref) => reachedResources.add(ref));
+        for (const ruleRef of rootRuleRefs) {
+            const projection = projectionsByRule.get(ruleRef);
+            if (!projection)
+                invalid("v2_static_dependency_rule_unknown", `${certificate.key}:${ruleRef}`);
+            assertSameSet([...closure.axisRefs], projection.compiled_region.referenced_axis_refs, "v2_static_dependency_closure_mismatch", `${certificate.key}:${ruleRef}`);
+            if (certificate.omitted_axis_refs.some((axisRef) => closure.axisRefs.has(axisRef)))
+                invalid("v2_static_dependency_omitted_axis_conflict", `${certificate.key}:${ruleRef}`);
+        }
+    }
+    assertSameSet([...reachedNodes], [...nodes.keys()], "v2_static_dependency_unreachable_node", certificate.key);
+    assertSameSet([...reachedResources], proof.input_resource_refs, "v2_static_dependency_input_graph_mismatch", certificate.key);
+}
+function validateNodes(proof, manifest, nodes, label) {
+    const axes = new Set(manifest.axis_domains.map((axis) => axis.key));
+    for (const node of nodes.values()) {
+        unique(node.axis_refs, `v2_static_dependency_axis_duplicate:${node.key}`);
+        unique(node.dependency_refs, `v2_static_dependency_ref_duplicate:${node.key}`);
+        unique(node.input_resource_refs, `v2_static_dependency_input_duplicate:${node.key}`);
+        requireKnownRefs(node.axis_refs, axes, "v2_static_dependency_axis_unknown");
+        requireKnownRefs(node.dependency_refs, nodes, "v2_static_dependency_node_unknown");
+        requireKnownRefs(node.input_resource_refs, new Set(manifest.inspector.input_resources.map((resource) => resource.resource_ref)), "v2_static_dependency_input_unknown");
+    }
+    requireKnownRefs(proof.static_rule_roots.map((root) => root.node_ref), nodes, "v2_static_dependency_root_unknown");
+    if (!proof.input_resource_refs.length)
+        invalid("v2_noninterference_inputs_required", label);
+}
+function collectClosure(nodeRef, nodes, visiting, reached, label, memo) {
+    if (visiting.has(nodeRef))
+        invalid("v2_static_dependency_cycle", `${label}:${nodeRef}`);
+    const cached = memo.get(nodeRef);
+    if (cached)
+        return cached;
+    const node = nodes.get(nodeRef);
+    if (!node)
+        invalid("v2_static_dependency_node_unknown", `${label}:${nodeRef}`);
+    visiting.add(nodeRef);
+    reached.add(nodeRef);
+    const axisRefs = new Set(node.axis_refs);
+    const inputResourceRefs = new Set(node.input_resource_refs);
+    let maximumDepth = 1;
+    for (const dependencyRef of node.dependency_refs) {
+        const dependency = collectClosure(dependencyRef, nodes, visiting, reached, label, memo);
+        dependency.axisRefs.forEach((ref) => axisRefs.add(ref));
+        dependency.inputResourceRefs.forEach((ref) => inputResourceRefs.add(ref));
+        maximumDepth = Math.max(maximumDepth, dependency.maximumDepth + 1);
+    }
+    visiting.delete(nodeRef);
+    const result = { axisRefs, inputResourceRefs, maximumDepth };
+    memo.set(nodeRef, result);
+    return result;
+}

package/dist/lib/design-resource-symbolic-structural-closure-validation.d.ts

@@ -0,0 +1,6 @@
+import type { DesignResource } from "./design-resource-handoff-file-primitives.js";
+import type { DesignResourceSymbolicCompilationSession } from "./design-resource-symbolic-compilation.js";
+import type { SymbolicManifestIndexes } from "./design-resource-symbolic-indexes.js";
+import type { DesignResourceObservableRuleManifestV2, DesignResourceSymbolicHandoffTargetV2 } from "./design-resource-symbolic-fact-types.js";
+export declare function validateSymbolicSubjectPopulationClosure(manifest: DesignResourceObservableRuleManifestV2, target: DesignResourceSymbolicHandoffTargetV2, indexes: SymbolicManifestIndexes, resources: Map<string, DesignResource>, contents: Map<string, Buffer>, compilation: DesignResourceSymbolicCompilationSession): void;
+export declare function validateSymbolicCensusClosure(manifest: DesignResourceObservableRuleManifestV2, indexes: SymbolicManifestIndexes): void;