project-tiny-context-harness 0.8.11 → 0.8.13

package/dist/lib/design-resource-symbolic-structural-closure-validation.js

@@ -0,0 +1,79 @@
+import { validateDesignResourceLocatedDigest } from "./design-resource-fact-locator-validation.js";
+import { validateSymbolicQuantifier, validateSymbolicRegionWithinReachable, } from "./design-resource-symbolic-region-validation.js";
+import { assertNoUnprovedOmittedAxes } from "./design-resource-symbolic-safety-validation.js";
+import { assertSameSet, invalid, requireKnownRefs, unique, } from "./design-resource-symbolic-validation-support.js";
+export function validateSymbolicSubjectPopulationClosure(manifest, target, indexes, resources, contents, compilation) {
+    validateSubjects(manifest, target.key, indexes);
+    validatePopulations(manifest, target, indexes, resources, contents, compilation);
+}
+export function validateSymbolicCensusClosure(manifest, indexes) {
+    validateCensusClosure(manifest, indexes);
+}
+function validateSubjects(manifest, targetKey, indexes) {
+    const stableKeys = [];
+    for (const subject of manifest.subjects) {
+        if (!subject.stable_keys.length)
+            invalid("v2_subject_stable_keys_required", subject.key);
+        unique(subject.stable_keys, `v2_subject_stable_key_duplicate:${subject.key}`);
+        stableKeys.push(...subject.stable_keys);
+        assertSameSet(subject.target_refs, [targetKey], "v2_subject_target_mismatch", subject.key);
+        requireKnownRefs(subject.census_refs, indexes.census, "v2_subject_census_unknown");
+        if (subject.population_ref &&
+            !indexes.populations.has(subject.population_ref))
+            invalid("v2_subject_population_unknown", subject.key);
+        for (const ref of [
+            subject.parent_ref,
+            subject.instance_of_ref,
+            subject.override_of_ref,
+            subject.family_ref,
+            subject.portal_host_ref,
+        ])
+            if (ref !== null && !indexes.subjects.has(ref))
+                invalid("v2_subject_hierarchy_ref_unknown", `${subject.key}:${ref}`);
+        unique(subject.relation_endpoints.map((item) => item.role), `v2_relation_endpoint_role_duplicate:${subject.key}`);
+        for (const endpoint of subject.relation_endpoints)
+            if (!indexes.subjects.has(endpoint.subject_ref))
+                invalid("v2_relation_endpoint_subject_unknown", `${subject.key}:${endpoint.subject_ref}`);
+        if (subject.kind === "relation" && subject.relation_endpoints.length < 2)
+            invalid("v2_relation_endpoints_incomplete", subject.key);
+        if (subject.presence === "always" && subject.presence_rule_ref !== null)
+            invalid("v2_subject_always_presence_rule_forbidden", subject.key);
+    }
+    unique(stableKeys, "v2_subject_stable_key_ambiguous");
+}
+function validatePopulations(manifest, target, indexes, resources, contents, compilation) {
+    const targetResources = new Set(target.resource_refs);
+    for (const population of manifest.populations) {
+        requireKnownRefs(population.member_subject_refs, indexes.subjects, "v2_population_subject_unknown");
+        assertSameSet(population.member_subject_refs, manifest.subjects
+            .filter((subject) => subject.population_ref === population.key)
+            .map((subject) => subject.key), "v2_population_member_set_mismatch", population.key);
+        if ((population.kind === "static" && population.enumeration !== "complete") ||
+            (population.kind === "dynamic" &&
+                population.enumeration !== "symbolic_partition"))
+            invalid("v2_population_enumeration_mismatch", population.key);
+        validateDesignResourceLocatedDigest(population.universe, resources, contents, `v2.population.${population.key}.universe`);
+        if (!targetResources.has(population.universe.locator.resource_ref))
+            invalid("v2_population_resource_outside_target", population.key);
+        validateSymbolicQuantifier(population.quantifier, population.key);
+        unique(population.exclusions.map((item) => item.key), `v2_population_exclusion_key_duplicate:${population.key}`);
+        for (const exclusion of population.exclusions) {
+            if (!exclusion.basis_refs.length)
+                invalid("v2_population_exclusion_basis_required", exclusion.key);
+            const compiled = compilation.compile(exclusion.region);
+            assertNoUnprovedOmittedAxes(compiled, exclusion.key);
+            validateSymbolicRegionWithinReachable(exclusion.region, manifest.reachable_region, exclusion.key, compilation);
+        }
+    }
+}
+function validateCensusClosure(manifest, indexes) {
+    const rules = new Map(manifest.fact_rules.map((item) => [item.key, item]));
+    for (const row of manifest.inspector.census) {
+        requireKnownRefs(row.fact_refs, rules, "v2_census_rule_unknown");
+        requireKnownRefs(row.source_item_refs, indexes.sourceItems, "v2_census_source_item_unknown");
+        if (!row.source_item_refs.length || !row.basis_refs.length)
+            invalid("v2_census_basis_source_required", row.key);
+        unique(row.fact_refs, `v2_census_rule_ref_duplicate:${row.key}`);
+        assertSameSet(row.fact_refs, (indexes.rulesByCensus.get(row.key) ?? []).map((rule) => rule.key), "v2_census_rule_set_mismatch", row.key);
+    }
+}

package/dist/lib/design-resource-symbolic-validation-support.d.ts

@@ -0,0 +1,29 @@
+import type { DesignResourceObservableRuleManifestV2, DesignResourceSymbolicDependencyEdgeV2, DesignResourceSymbolicFactRuleV2, DesignResourceSymbolicNoninterferenceCertificateV2 } from "./design-resource-symbolic-fact-types.js";
+export declare function designResourceSymbolicRuleKey(rule: Omit<DesignResourceSymbolicFactRuleV2, "key" | "semantic_obligation_refs">, regionSha256: string): string;
+export declare function designResourceSymbolicObligationKey(obligation: Omit<DesignResourceObservableRuleManifestV2["semantic_proof_obligations"][number], "key">): string;
+export declare function designResourceSymbolicDependencyEdge(axisRef: string, factRuleRef: string): DesignResourceSymbolicDependencyEdgeV2;
+export declare function designResourceSymbolicCertificateKey(certificate: Omit<DesignResourceSymbolicNoninterferenceCertificateV2, "key">): string;
+export declare function designResourceSymbolicNoninterferenceProofDigest(proof: DesignResourceSymbolicNoninterferenceCertificateV2["source_noninterference_proof"]): string | null;
+export declare function designResourceSymbolicCombinedRuleDigest(ruleProjections: Array<{
+    rule: {
+        key: string;
+    };
+    compiled_region: {
+        canonical_sha256: string;
+    };
+}>): string;
+export declare function omitRuleIdentityFields(rule: DesignResourceSymbolicFactRuleV2): Omit<DesignResourceSymbolicFactRuleV2, "key" | "semantic_obligation_refs">;
+export declare function omitKey<T extends {
+    key: string;
+}>(value: T): Omit<T, "key">;
+export declare function requireExactRefs<T>(refs: string[], values: Map<string, T>, code: string): void;
+export declare function requireKnownRefs(refs: string[], values: ReadonlyMap<string, unknown> | ReadonlySet<string>, code: string): void;
+export declare function unique(values: string[], code: string): void;
+export declare function assertSameSet(actual: string[], expected: string[], code: string, detail: string): void;
+export declare function assertCanonicalSet<T extends {
+    key: string;
+}>(actual: T[], expected: T[], code: string): void;
+export declare function stableJson(value: unknown): string;
+export declare function sha256(value: string): string;
+export declare function compareText(left: string, right: string): number;
+export declare function invalid(code: string, detail: string): never;

package/dist/lib/design-resource-symbolic-validation-support.js

@@ -0,0 +1,111 @@
+import { createHash } from "node:crypto";
+import { invalidDesignResourceHandoff } from "./design-resource-handoff-validation-primitives.js";
+const ALL_EFFECTS = [
+    "disposition",
+    "expected_semantics",
+    "proof_denotation",
+];
+export function designResourceSymbolicRuleKey(rule, regionSha256) {
+    return `rule.${sha256(stableJson({
+        subject_or_relation_ref: rule.subject_or_relation_ref,
+        target_ref: rule.target_ref,
+        property_ref: rule.property_ref,
+        population_ref: rule.population_ref,
+        quantifier: rule.quantifier,
+        region_sha256: regionSha256,
+        expected: rule.expected,
+        value_kind: rule.value_kind,
+        provenance_ref: rule.provenance_ref,
+        observation_scope: rule.observation_scope,
+        observation_sensitivity: rule.observation_sensitivity,
+        lineage: rule.lineage,
+        evidence_refs: [...rule.evidence_refs].sort(compareText),
+        census_refs: [...rule.census_refs].sort(compareText),
+        source_item_refs: [...rule.source_item_refs].sort(compareText),
+    }))}`;
+}
+export function designResourceSymbolicObligationKey(obligation) {
+    return `obligation.${sha256(stableJson(obligation))}`;
+}
+export function designResourceSymbolicDependencyEdge(axisRef, factRuleRef) {
+    const body = {
+        axis_ref: axisRef,
+        fact_rule_ref: factRuleRef,
+        effects: [...ALL_EFFECTS],
+    };
+    return { key: `edge.${sha256(stableJson(body))}`, ...body };
+}
+export function designResourceSymbolicCertificateKey(certificate) {
+    return `certificate.${sha256(stableJson({
+        ...certificate,
+        fact_rule_refs: [...certificate.fact_rule_refs].sort(compareText),
+        omitted_axis_refs: [...certificate.omitted_axis_refs].sort(compareText),
+        dependency_edge_refs: [...certificate.dependency_edge_refs].sort(compareText),
+    }))}`;
+}
+export function designResourceSymbolicNoninterferenceProofDigest(proof) {
+    return proof ? sha256(stableJson(proof)) : null;
+}
+export function designResourceSymbolicCombinedRuleDigest(ruleProjections) {
+    return sha256(stableJson(ruleProjections
+        .map((projection) => ({
+        rule_ref: projection.rule.key,
+        region_sha256: projection.compiled_region.canonical_sha256,
+    }))
+        .sort((left, right) => compareText(left.rule_ref, right.rule_ref))));
+}
+export function omitRuleIdentityFields(rule) {
+    const { key: _key, semantic_obligation_refs: _refs, ...value } = rule;
+    return value;
+}
+export function omitKey(value) {
+    const { key: _key, ...rest } = value;
+    return rest;
+}
+export function requireExactRefs(refs, values, code) {
+    unique(refs, `${code}_duplicate`);
+    requireKnownRefs(refs, values, `${code}_unknown`);
+}
+export function requireKnownRefs(refs, values, code) {
+    for (const ref of refs)
+        if (!values.has(ref))
+            invalid(code, ref);
+}
+export function unique(values, code) {
+    if (new Set(values).size !== values.length)
+        invalid(code, "");
+}
+export function assertSameSet(actual, expected, code, detail) {
+    const left = [...new Set(actual)].sort(compareText);
+    const right = [...new Set(expected)].sort(compareText);
+    if (left.length !== right.length ||
+        left.some((item, index) => item !== right[index]))
+        invalid(code, `${detail}:${left.join(",")}:${right.join(",")}`);
+}
+export function assertCanonicalSet(actual, expected, code) {
+    const left = new Map(actual.map((item) => [item.key, stableJson(item)]));
+    const right = new Map(expected.map((item) => [item.key, stableJson(item)]));
+    assertSameSet([...left.keys()], [...right.keys()], code, "keys");
+    for (const [key, value] of right)
+        if (left.get(key) !== value)
+            invalid(code, key);
+}
+export function stableJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map((item) => stableJson(item)).join(",")}]`;
+    if (value && typeof value === "object")
+        return `{${Object.entries(value)
+            .sort(([left], [right]) => compareText(left, right))
+            .map(([key, entry]) => `${JSON.stringify(key)}:${stableJson(entry)}`)
+            .join(",")}}`;
+    return JSON.stringify(value);
+}
+export function sha256(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+export function compareText(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+export function invalid(code, detail) {
+    invalidDesignResourceHandoff(code, detail);
+}

package/dist/lib/design-resource-v1-capacity-header.d.ts

@@ -0,0 +1,8 @@
+declare const V1_SCHEMA = "design-resource-observable-fact-manifest-v1";
+export declare const DESIGN_RESOURCE_V1_REGENERATION_GUIDANCE = "regenerate_as=design-resource-handoff-v2:fact_model=symbolic_rules_v2";
+export interface DesignResourceV1CapacityHeader {
+    schema_version: typeof V1_SCHEMA;
+    collection_counts: ReadonlyMap<string, number>;
+}
+export declare function parseDesignResourceV1CapacityHeader(prefix: string): DesignResourceV1CapacityHeader;
+export {};

package/dist/lib/design-resource-v1-capacity-header.js

@@ -0,0 +1,231 @@
+import { invalidDesignResourceHandoff } from "./design-resource-handoff-validation-primitives.js";
+import { DESIGN_RESOURCE_SYMBOLIC_FACT_POLICY } from "./design-resource-symbolic-fact-policy.js";
+const V1_SCHEMA = "design-resource-observable-fact-manifest-v1";
+export const DESIGN_RESOURCE_V1_REGENERATION_GUIDANCE = "regenerate_as=design-resource-handoff-v2:fact_model=symbolic_rules_v2";
+export function parseDesignResourceV1CapacityHeader(prefix) {
+    try {
+        const reader = new BoundedJsonReader(prefix);
+        const header = reader.readRootHeader();
+        if (header.first_key !== "schema_version")
+            invalid("v1_manifest_capacity_header_order_invalid", `first_key=${header.first_key ?? "missing"}:required=schema_version`);
+        if (header.schema_version !== V1_SCHEMA)
+            invalid("v1_manifest_capacity_header_schema_invalid", `schema_version=${String(header.schema_version)}`);
+        if (!header.generation)
+            invalid("v1_manifest_capacity_header_missing_or_late", `prefix_limit=${DESIGN_RESOURCE_SYMBOLIC_FACT_POLICY.v1_capacity.capacity_header_prefix_max_bytes}:${DESIGN_RESOURCE_V1_REGENERATION_GUIDANCE}`);
+        const collections = objectValue(header.generation, "v1_manifest_capacity_header_generation_invalid").collections;
+        if (!Array.isArray(collections))
+            invalid("v1_manifest_capacity_header_collections_invalid", "not_array");
+        const collectionCounts = new Map();
+        for (const value of collections) {
+            const collection = objectValue(value, "v1_manifest_capacity_header_collection_invalid");
+            if (typeof collection.name !== "string" || !collection.name)
+                invalid("v1_manifest_capacity_header_collection_name_invalid", "");
+            if (typeof collection.expected_count !== "number" ||
+                !Number.isSafeInteger(collection.expected_count) ||
+                collection.expected_count < 0)
+                invalid("v1_manifest_capacity_header_expected_count_invalid", collection.name);
+            if (collectionCounts.has(collection.name))
+                invalid("v1_manifest_capacity_header_collection_duplicate", collection.name);
+            collectionCounts.set(collection.name, collection.expected_count);
+        }
+        return {
+            schema_version: V1_SCHEMA,
+            collection_counts: collectionCounts,
+        };
+    }
+    catch (error) {
+        if (error instanceof Error &&
+            error.message.startsWith("design_resource_handoff_invalid:"))
+            throw error;
+        const message = error instanceof Error ? error.message : String(error);
+        invalid("v1_manifest_capacity_header_missing_or_late", `prefix_limit=${DESIGN_RESOURCE_SYMBOLIC_FACT_POLICY.v1_capacity.capacity_header_prefix_max_bytes}:reason=${message}:${DESIGN_RESOURCE_V1_REGENERATION_GUIDANCE}`);
+    }
+}
+class BoundedJsonReader {
+    input;
+    offset = 0;
+    depth = 0;
+    constructor(input) {
+        this.input = input;
+    }
+    readRootHeader() {
+        this.whitespace();
+        this.character("{");
+        const result = {
+            first_key: null,
+            schema_version: undefined,
+            generation: undefined,
+        };
+        this.whitespace();
+        if (this.peek() === "}")
+            throw new Error("root_empty");
+        for (;;) {
+            const key = this.string();
+            result.first_key ??= key;
+            this.whitespace();
+            this.character(":");
+            this.whitespace();
+            const value = this.value();
+            if (key === "schema_version")
+                result.schema_version = value;
+            if (key === "generation") {
+                result.generation = value;
+                return result;
+            }
+            this.whitespace();
+            const delimiter = this.peek();
+            if (delimiter === "}")
+                return result;
+            this.character(",");
+            this.whitespace();
+        }
+    }
+    value() {
+        if (++this.depth > 64)
+            throw new Error("depth_limit");
+        try {
+            const next = this.peek();
+            if (next === '"')
+                return this.string();
+            if (next === "{")
+                return this.object();
+            if (next === "[")
+                return this.array();
+            if (next === "t")
+                return this.literal("true", true);
+            if (next === "f")
+                return this.literal("false", false);
+            if (next === "n")
+                return this.literal("null", null);
+            return this.number();
+        }
+        finally {
+            this.depth -= 1;
+        }
+    }
+    object() {
+        const value = {};
+        this.character("{");
+        this.whitespace();
+        if (this.peek() === "}") {
+            this.offset += 1;
+            return value;
+        }
+        for (;;) {
+            const key = this.string();
+            if (Object.hasOwn(value, key))
+                throw new Error(`duplicate_key:${key}`);
+            this.whitespace();
+            this.character(":");
+            this.whitespace();
+            value[key] = this.value();
+            this.whitespace();
+            if (this.peek() === "}") {
+                this.offset += 1;
+                return value;
+            }
+            this.character(",");
+            this.whitespace();
+        }
+    }
+    array() {
+        const value = [];
+        this.character("[");
+        this.whitespace();
+        if (this.peek() === "]") {
+            this.offset += 1;
+            return value;
+        }
+        for (;;) {
+            value.push(this.value());
+            this.whitespace();
+            if (this.peek() === "]") {
+                this.offset += 1;
+                return value;
+            }
+            this.character(",");
+            this.whitespace();
+        }
+    }
+    string() {
+        this.character('"');
+        let value = "";
+        for (;;) {
+            if (this.offset >= this.input.length)
+                throw new Error("prefix_ended");
+            const character = this.input[this.offset++];
+            if (character === '"')
+                return value;
+            if (character === "\\") {
+                if (this.offset >= this.input.length)
+                    throw new Error("prefix_ended");
+                const escaped = this.input[this.offset++];
+                const simple = {
+                    '"': '"',
+                    "\\": "\\",
+                    "/": "/",
+                    b: "\b",
+                    f: "\f",
+                    n: "\n",
+                    r: "\r",
+                    t: "\t",
+                };
+                if (escaped in simple)
+                    value += simple[escaped];
+                else if (escaped === "u") {
+                    const hex = this.input.slice(this.offset, this.offset + 4);
+                    if (!/^[0-9a-fA-F]{4}$/u.test(hex))
+                        throw new Error("unicode_escape_invalid");
+                    value += String.fromCharCode(Number.parseInt(hex, 16));
+                    this.offset += 4;
+                }
+                else
+                    throw new Error("escape_invalid");
+            }
+            else {
+                if (character.charCodeAt(0) < 0x20)
+                    throw new Error("string_control_character");
+                value += character;
+            }
+        }
+    }
+    number() {
+        const remaining = this.input.slice(this.offset);
+        const match = /^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?/u.exec(remaining);
+        if (!match)
+            throw new Error("number_invalid");
+        this.offset += match[0].length;
+        const value = Number(match[0]);
+        if (!Number.isFinite(value))
+            throw new Error("number_non_finite");
+        return value;
+    }
+    literal(token, value) {
+        if (this.input.slice(this.offset, this.offset + token.length) !== token)
+            throw new Error(`literal_invalid:${token}`);
+        this.offset += token.length;
+        return value;
+    }
+    whitespace() {
+        while (/\s/u.test(this.input[this.offset] ?? ""))
+            this.offset += 1;
+    }
+    character(expected) {
+        if (this.input[this.offset] !== expected)
+            throw new Error(`expected:${expected}:at=${this.offset}`);
+        this.offset += 1;
+    }
+    peek() {
+        if (this.offset >= this.input.length)
+            throw new Error("prefix_ended");
+        return this.input[this.offset];
+    }
+}
+function objectValue(value, code) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        invalid(code, "not_object");
+    return value;
+}
+function invalid(code, detail) {
+    invalidDesignResourceHandoff(code, detail);
+}

package/dist/lib/design-resource-v1-capacity.d.ts

@@ -0,0 +1,5 @@
+import { type DesignResourceV1CapacityHeader } from "./design-resource-v1-capacity-header.js";
+export { parseDesignResourceV1CapacityHeader } from "./design-resource-v1-capacity-header.js";
+export type { DesignResourceV1CapacityHeader } from "./design-resource-v1-capacity-header.js";
+export declare function assertDesignResourceV1HandoffCapacity(file: string): Promise<void>;
+export declare function assertDesignResourceV1ManifestCapacity(file: string): Promise<DesignResourceV1CapacityHeader>;

package/dist/lib/design-resource-v1-capacity.js

@@ -0,0 +1,45 @@
+import { open, stat } from "node:fs/promises";
+import { invalidDesignResourceHandoff } from "./design-resource-handoff-validation-primitives.js";
+import { DESIGN_RESOURCE_SYMBOLIC_FACT_POLICY } from "./design-resource-symbolic-fact-policy.js";
+import { DESIGN_RESOURCE_V1_REGENERATION_GUIDANCE, parseDesignResourceV1CapacityHeader, } from "./design-resource-v1-capacity-header.js";
+export { parseDesignResourceV1CapacityHeader } from "./design-resource-v1-capacity-header.js";
+export async function assertDesignResourceV1HandoffCapacity(file) {
+    const bytes = (await stat(file)).size;
+    const limit = DESIGN_RESOURCE_SYMBOLIC_FACT_POLICY.v1_capacity.embedded_handoff_max_bytes;
+    if (bytes > limit)
+        invalid("v1_handoff_capacity_exceeded", `bytes=${bytes}:limit=${limit}:${DESIGN_RESOURCE_V1_REGENERATION_GUIDANCE}`);
+}
+export async function assertDesignResourceV1ManifestCapacity(file) {
+    const bytes = (await stat(file)).size;
+    const policy = DESIGN_RESOURCE_SYMBOLIC_FACT_POLICY.v1_capacity;
+    if (bytes > policy.canonical_manifest_max_bytes)
+        invalid("v1_manifest_capacity_exceeded", `bytes=${bytes}:limit=${policy.canonical_manifest_max_bytes}:${DESIGN_RESOURCE_V1_REGENERATION_GUIDANCE}`);
+    const prefixBytes = Math.min(bytes, policy.capacity_header_prefix_max_bytes);
+    const buffer = Buffer.alloc(prefixBytes);
+    const handle = await open(file, "r");
+    try {
+        let offset = 0;
+        while (offset < prefixBytes) {
+            const result = await handle.read(buffer, offset, prefixBytes - offset, offset);
+            if (result.bytesRead === 0)
+                break;
+            offset += result.bytesRead;
+        }
+        if (offset !== prefixBytes)
+            invalid("v1_manifest_capacity_header_read_incomplete", `bytes_read=${offset}:expected=${prefixBytes}`);
+    }
+    finally {
+        await handle.close();
+    }
+    const text = new TextDecoder("utf-8", { fatal: true }).decode(buffer);
+    const header = parseDesignResourceV1CapacityHeader(text);
+    const expectedFactCells = header.collection_counts.get("fact_cells");
+    if (expectedFactCells === undefined)
+        invalid("v1_manifest_capacity_header_fact_cells_missing", DESIGN_RESOURCE_V1_REGENERATION_GUIDANCE);
+    if (expectedFactCells > policy.expected_fact_cells_max)
+        invalid("v1_fact_cell_capacity_exceeded", `expected_count=${expectedFactCells}:limit=${policy.expected_fact_cells_max}:${DESIGN_RESOURCE_V1_REGENERATION_GUIDANCE}`);
+    return header;
+}
+function invalid(code, detail) {
+    invalidDesignResourceHandoff(code, detail);
+}

package/dist/lib/init.js

@@ -25,6 +25,7 @@ export async function runInit(projectRoot, options) {
     await createDesignMd(projectRoot, report);
     const syncReport = await runSync(projectRoot);
     report.push(`sync changed=${syncReport.changed.length} skipped=${syncReport.skipped.length} blocked=${syncReport.blocked.length}`);
+    report.push(...(syncReport.notices ?? []));
     report.push(options.adopt ? "adopt mode complete" : "init complete");
     return report;
 }

package/dist/lib/long-task-acceptance-shape.js

@@ -10,7 +10,7 @@ export function parseCounterfactuals(value, label) {
             "check_key",
             "mutation",
             "expected_assertion_failures",
-        ], ["preserved_assertions"]);
+        ], ["preserved_assertions", "allowed_fanout_assertions"]);
         const mutation = object(row.mutation, `${itemLabel}.mutation`, ["type"], [
             "paths",
             "path",
@@ -36,6 +36,9 @@ export function parseCounterfactuals(value, label) {
             preserved_assertions: Object.hasOwn(row, "preserved_assertions")
                 ? strings(row.preserved_assertions, `${itemLabel}.preserved_assertions`).map((item, assertionIndex) => key(item, `${itemLabel}.preserved_assertions[${assertionIndex}]`))
                 : [],
+            allowed_fanout_assertions: Object.hasOwn(row, "allowed_fanout_assertions")
+                ? strings(row.allowed_fanout_assertions, `${itemLabel}.allowed_fanout_assertions`).map((item, assertionIndex) => key(item, `${itemLabel}.allowed_fanout_assertions[${assertionIndex}]`))
+                : [],
         };
     });
 }
@@ -49,7 +52,7 @@ export function parseGlobalCounterfactuals(value, label) {
             "check_key",
             "mutation",
             "expected_assertion_failures",
-        ], ["preserved_assertions"]);
+        ], ["preserved_assertions", "allowed_fanout_assertions"]);
         const bindingRef = string(row.binding_ref, `${itemLabel}.binding_ref`);
         if (!/^[a-z0-9][a-z0-9-]*\.[a-z0-9][a-z0-9-]*$/u.test(bindingRef))
             fail(`${itemLabel}.binding_ref`, "must be <outcome-key>.<binding-key>");
@@ -69,6 +72,9 @@ export function parseGlobalCounterfactuals(value, label) {
             preserved_assertions: Object.hasOwn(row, "preserved_assertions")
                 ? strings(row.preserved_assertions, `${itemLabel}.preserved_assertions`).map((entry, assertionIndex) => key(entry, `${itemLabel}.preserved_assertions[${assertionIndex}]`))
                 : [],
+            allowed_fanout_assertions: Object.hasOwn(row, "allowed_fanout_assertions")
+                ? strings(row.allowed_fanout_assertions, `${itemLabel}.allowed_fanout_assertions`).map((entry, assertionIndex) => key(entry, `${itemLabel}.allowed_fanout_assertions[${assertionIndex}]`))
+                : [],
         };
     });
 }

package/dist/lib/long-task-activation-validation.js

@@ -9,6 +9,7 @@ import { validateRawExecutionObservationOwnership } from "./long-task-observatio
 import { validateLongTaskDesignResourceHandoffs } from "./long-task-design-resource-handoff.js";
 import { validateLongTaskSemanticFactClosure } from "./long-task-semantic-fact-closure.js";
 import { freezeDeliveryCheck } from "./long-task-runner-freeze.js";
+import { scopeDeliveryBindings } from "./long-task-scoped-binding.js";
 import { classifyLongTaskRisk, validateRiskProof, } from "./long-task-risk.js";
 import { validateSourceContinuity } from "./long-task-source-continuity.js";
 import { compileSourceInventory } from "./long-task-source-inventory.js";
@@ -33,12 +34,13 @@ export async function validateContractForActivation(options) {
     }
     const sourceHashes = await attempt(mode, diagnostics, () => hashDeclaredFiles(repository, contract.task.source_paths, "source"));
     await attempt(mode, diagnostics, () => validateSourceAnchors(repository, contract.source_claims));
+    let sourceBackedExecutionTargets = new Map();
     const sourceItems = await attempt(mode, diagnostics, async () => {
         const items = await compileSourceInventory(repository, contract.task.source_paths);
         validateSourceContinuity(contract, items, mode === "collect"
             ? (error) => addDiagnosticError(diagnostics, new Error(error))
             : undefined);
-        validateSourceTargetContinuity(contract, items, mode === "collect"
+        sourceBackedExecutionTargets = validateSourceTargetContinuity(contract, items, mode === "collect"
             ? (error) => addDiagnosticError(diagnostics, new Error(error))
             : undefined);
         return items;
@@ -61,12 +63,20 @@ export async function validateContractForActivation(options) {
     });
     if (!workspace)
         return emptyCompiledResult(claims, risk, sourceHashes, sourceItems, context);
+    const observationAuthorityPaths = [
+        ...workspace.files
+            .map((file) => file.path)
+            .filter((file) => file === workdirRelative || file.startsWith(`${workdirRelative}/`)),
+        `${workdirRelative}/delivery-contract.yaml`,
+        ...Object.keys(sourceHashes ?? {}),
+        ...(context?.files ?? []),
+    ];
     const globalChecks = [];
     for (const check of contract.global.acceptance.checks) {
         const executionTarget = contract.task.execution_targets.find((target) => target.key === check.execution_target.target_ref);
         if (!executionTarget)
             continue;
-        const frozen = await attempt(mode, diagnostics, () => freezeDeliveryCheck(check, null, repository, workspace, executionTarget, contract.task.execution_targets, [], []), null, check.key);
+        const frozen = await attempt(mode, diagnostics, () => freezeDeliveryCheck(check, null, repository, workspace, executionTarget, contract.task.execution_targets, [], [], contract.outcomes.flatMap((outcome) => scopeDeliveryBindings(outcome.key, outcome.technical.bindings)), contract.outcomes.flatMap((outcome) => outcome.product.owner.path_globs), sourceBackedExecutionTargets.get(executionTarget.key) ?? null, observationAuthorityPaths), null, check.key);
         if (frozen)
             globalChecks.push(frozen);
     }
@@ -77,7 +87,7 @@ export async function validateContractForActivation(options) {
             const executionTarget = contract.task.execution_targets.find((target) => target.key === check.execution_target.target_ref);
             if (!executionTarget)
                 continue;
-            const frozen = await attempt(mode, diagnostics, () => freezeDeliveryCheck(check, outcome.key, repository, workspace, executionTarget, contract.task.execution_targets, designTargetsForCheck(outcome, check.key), semanticFactClosure?.expectations_by_check.get(check.key) ?? []), outcome.key, check.key);
+            const frozen = await attempt(mode, diagnostics, () => freezeDeliveryCheck(check, outcome.key, repository, workspace, executionTarget, contract.task.execution_targets, designTargetsForCheck(outcome, check.key), semanticFactClosure?.expectations_by_check.get(check.key) ?? [], scopeDeliveryBindings(outcome.key, outcome.technical.bindings), outcome.product.owner.path_globs, sourceBackedExecutionTargets.get(executionTarget.key) ?? null, observationAuthorityPaths), outcome.key, check.key);
             if (frozen)
                 checks.push(frozen);
         }

package/dist/lib/long-task-admitted-observation-records.d.ts

@@ -0,0 +1,25 @@
+import type { EvidenceCapabilityRecordV2 } from "./long-task-delivery-types.js";
+import type { JsonPointerExactLocator } from "./long-task-json-pointer-observation.js";
+export type AdmittedObservationCandidate = {
+    assertion_key: string;
+    identity_ref: string;
+    method: string;
+    actual_observation: {
+        artifact_path: string;
+        locator: JsonPointerExactLocator;
+        sensitivity: string;
+    };
+    comparison: {
+        comparator: string;
+        mode: string;
+        tolerance: unknown;
+        mask: unknown;
+    };
+    oracle: {
+        trust: string;
+        identity: string;
+        version: string;
+        sha256: string | null;
+    };
+};
+export declare function admittedObservationCandidates(records: EvidenceCapabilityRecordV2[]): AdmittedObservationCandidate[];