project-tiny-context-harness 0.8.11 → 0.8.13

package/dist/lib/long-task-counterfactual-sandbox.js

@@ -1,7 +1,7 @@
 import { copyFile, cp, lstat, mkdir, mkdtemp, readlink, realpath, rm, symlink, } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
-import { matchesRepoPattern } from "./long-task-paths.js";
+import { matchesRepoPattern, normalizeRepositoryFile, } from "./long-task-paths.js";
 const TRANSIENT_REMOVE_CODES = new Set([
     "EBUSY",
     "EMFILE",
@@ -11,7 +11,7 @@ const TRANSIENT_REMOVE_CODES = new Set([
 ]);
 const REMOVE_RETRY_LIMIT = process.platform === "win32" ? 6 : 2;
 const REMOVE_RETRY_DELAY_MS = 100;
-export async function createCounterfactualSandbox(snapshotRoot, check, control, bindingCarrierPaths, manifest) {
+export async function createCounterfactualSandbox(snapshotRoot, check, control, bindingCarrierPaths, manifest, protectedAuthorityPaths = []) {
     const root = await mkdtemp(path.join(os.tmpdir(), "ty-context-counterfactual-"));
     if (!manifest) {
         await cp(snapshotRoot, root, {
@@ -24,6 +24,7 @@ export async function createCounterfactualSandbox(snapshotRoot, check, control,
     const exactPaths = new Set([
         ...Object.keys(check.runner.frozen_files),
         ...Object.keys(check.verification_input_hashes),
+        ...(check.process_runtime_closure?.allowed_runtime_files ?? []),
         check.runner.resolved_target,
         ...(control.mutation.type === "replace_file"
             ? [control.mutation.fixture_path]
@@ -44,9 +45,11 @@ export async function createCounterfactualSandbox(snapshotRoot, check, control,
         if (requirement.kind === "directory")
             patterns.push(`${requirement.target}/**`);
     }
-    const selected = manifest.files
-        .map((file) => file.path)
-        .filter((relative) => exactPaths.has(relative) ||
+    const candidates = new Set([
+        ...manifest.files.map((file) => file.path),
+        ...protectedAuthorityPaths.map((file, index) => normalizeRepositoryFile(file, `counterfactual.protected_authority_paths[${index}]`)),
+    ]);
+    const selected = [...candidates].filter((relative) => exactPaths.has(relative) ||
         patterns.some((pattern) => matchesRepoPattern(relative, pattern)));
     await copyInBatches(snapshotRoot, root, selected);
     await mkdir(path.join(root, check.runner.resolved_cwd), { recursive: true });

package/dist/lib/long-task-counterfactual-types.d.ts

@@ -24,6 +24,7 @@ export interface CounterfactualControlV2 {
     mutation: CounterfactualMutationV2;
     expected_assertion_failures: string[];
     preserved_assertions: string[];
+    allowed_fanout_assertions: string[];
 }
 export interface GlobalCounterfactualControlV2 {
     key: string;
@@ -33,4 +34,5 @@ export interface GlobalCounterfactualControlV2 {
     mutation: CounterfactualMutationV2;
     expected_assertion_failures: string[];
     preserved_assertions: string[];
+    allowed_fanout_assertions: string[];
 }

package/dist/lib/long-task-delivery-compiler.js

@@ -86,6 +86,8 @@ export async function compileDeliveryContract(workdirInput, projectRootInput = p
             verification_inputs: check.verification_input_hashes,
             raw_execution_identity: check.raw_execution_identity,
             evidence_adapter: check.evidence_adapter,
+            observation_authorities: check.observation_authorities,
+            process_runtime_closure: check.process_runtime_closure,
         })),
     }));
     let authorityRevision = options.authority_revision ?? previous?.authority_revision ?? 1;

package/dist/lib/long-task-delivery-parser.d.ts

@@ -11,3 +11,4 @@ export interface ParseDeliveryContractOptions {
 export declare function parseDeliveryContract(workdir: string): Promise<DeliveryContractV2>;
 export declare function parseDeliveryContractBundle(workdirInput: string, repositoryInput?: string, options?: ParseDeliveryContractOptions): Promise<ParsedDeliveryContractV2>;
 export declare function parseDeliveryContractText(raw: string): DeliveryContractV2;
+export declare function parseDeliveryContractTextForMigration(raw: string): DeliveryContractV2;

package/dist/lib/long-task-delivery-parser.js

@@ -1,5 +1,6 @@
 import { readFile } from "node:fs/promises";
 import path from "node:path";
+import { materializeLongTaskCompactCarrier, materializeLongTaskCompactCarrierForMigration, } from "./long-task-compact-carrier.js";
 import { parseStrictYaml, sha256Hex } from "./strict-codec.js";
 import { validateDeliveryContractStructure } from "./long-task-delivery-validation.js";
 import { parseOutcome, parseOutcomeFragment, safeFragmentPath, } from "./long-task-outcome-parser.js";
@@ -20,7 +21,11 @@ export async function parseDeliveryContractBundle(workdirInput, repositoryInput,
         ? path.resolve(repositoryInput)
         : await repositoryRoot(workdir);
     const raw = await readFile(await assertProtectedRepositoryFile(repository, file, "delivery_contract"), "utf8");
-    const root = parseRoot(raw, true);
+    let root = parseRoot(raw, true);
+    if (Object.hasOwn(root, "compact_semantic_carrier")) {
+        root = materializeLongTaskCompactCarrier(root).root;
+        assertNoSemanticDriftMigration(semanticDriftMigrationFields(root));
+    }
     const hasInline = Object.hasOwn(root, "outcomes");
     const hasFiles = Object.hasOwn(root, "outcome_files");
     if (hasInline === hasFiles)
@@ -64,7 +69,19 @@ export async function parseDeliveryContractBundle(workdirInput, repositoryInput,
     };
 }
 export function parseDeliveryContractText(raw) {
-    const root = parseRoot(raw, false);
+    return parseDeliveryContractTextInternal(raw, false);
+}
+export function parseDeliveryContractTextForMigration(raw) {
+    return parseDeliveryContractTextInternal(raw, true);
+}
+function parseDeliveryContractTextInternal(raw, allowLegacyCarrier) {
+    let root = parseRoot(raw, false);
+    if (Object.hasOwn(root, "compact_semantic_carrier")) {
+        root = (allowLegacyCarrier
+            ? materializeLongTaskCompactCarrierForMigration(root)
+            : materializeLongTaskCompactCarrier(root)).root;
+        assertNoSemanticDriftMigration(semanticDriftMigrationFields(root));
+    }
     const contract = parseContractRoot(root, array(root.outcomes, "outcomes").map((item, index) => parseOutcome(item, `outcomes[${index}]`)));
     validateDeliveryContractStructure(contract);
     return contract;
@@ -77,16 +94,31 @@ function parseRoot(raw, bundle) {
         decoded.schema_version ===
             "long-task-delivery-v1")
         throw new Error("long_task_delivery_v1_retired_use_v2");
-    assertNoSemanticDriftMigration(semanticDriftMigrationFields(decoded));
-    return object(decoded, "$", [
+    if (!decoded ||
+        typeof decoded !== "object" ||
+        Array.isArray(decoded) ||
+        !Object.hasOwn(decoded, "compact_semantic_carrier"))
+        assertNoSemanticDriftMigration(semanticDriftMigrationFields(decoded));
+    const root = object(decoded, "$", [
         "schema_version",
         "semantic_fact_manifest",
         "task",
-        "source_claims",
         "stages",
         "risk",
         "global",
-    ], bundle ? ["outcomes", "outcome_files"] : ["outcomes"]);
+    ], bundle
+        ? [
+            "source_claims",
+            "compact_semantic_carrier",
+            "outcomes",
+            "outcome_files",
+        ]
+        : ["source_claims", "compact_semantic_carrier", "outcomes"]);
+    const hasExpanded = Object.hasOwn(root, "source_claims");
+    const hasCompact = Object.hasOwn(root, "compact_semantic_carrier");
+    if (hasExpanded === hasCompact)
+        throw new Error("delivery_contract_invalid:$:exactly one of source_claims or compact_semantic_carrier is required");
+    return root;
 }
 function parseContractRoot(root, outcomes) {
     literal(root.schema_version, ["long-task-delivery-v2"], "schema_version");

package/dist/lib/long-task-design-resource-handoff.d.ts

@@ -1,4 +1,5 @@
 import type { DesignResourceHandoffPreflightV1, DesignResourceHandoffTargetV1 } from "./design-resource-handoff-types.js";
+import type { DesignResourceHandoffPreflightV2 } from "./design-resource-symbolic-fact-types.js";
 import type { DeliveryContractV2 } from "./long-task-delivery-types.js";
 export interface ContractDesignTarget {
     outcome_key: string;
@@ -10,7 +11,7 @@ export interface IndexedHandoffTarget {
     target: DesignResourceHandoffTargetV1;
 }
 export interface LongTaskDesignHandoffConsumer {
-    consume(preflight: DesignResourceHandoffPreflightV1): void;
+    consume(preflight: DesignResourceHandoffPreflightV1 | DesignResourceHandoffPreflightV2): void;
     finish(): void;
 }
 export declare function validateLongTaskDesignResourceHandoffs(contract: DeliveryContractV2, repository: string): Promise<void>;

package/dist/lib/long-task-design-resource-handoff.js

@@ -2,8 +2,8 @@ import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { containsDesignResourceHandoff, parseDesignResourceHandoffMarkdown, } from "./design-resource-handoff-parser.js";
 import { createDesignResourceHandoffSetIntegrity } from "./design-resource-handoff-set-integrity.js";
-import { preflightParsedDesignResourceHandoff } from "./design-resource-handoff-validation.js";
-import { assertSameSet, designSourceItemClaims, invalid, validateTargetIdentity, validateVerificationMethodBindings, } from "./long-task-design-resource-method-binding.js";
+import { preflightParsedDesignResourceHandoffAny } from "./design-resource-handoff-validation.js";
+import { assertSameSet, designSourceItemClaims, invalid, validateTargetIdentity, validateSymbolicTargetIdentity, validateSymbolicVerificationMethodBindings, validateVerificationMethodBindings, } from "./long-task-design-resource-method-binding.js";
 import { validateLongTaskDesignTargetCapabilities } from "./long-task-design-target-capabilities.js";
 import { assertProtectedRepositoryFile } from "./long-task-protected-files.js";
 export async function validateLongTaskDesignResourceHandoffs(contract, repository) {
@@ -15,7 +15,7 @@ export async function validateLongTaskDesignResourceHandoffs(contract, repositor
         const content = await readFile(file, "utf8");
         if (!containsDesignResourceHandoff(content))
             continue;
-        consumer.consume(await preflightParsedDesignResourceHandoff(repository, parseDesignResourceHandoffMarkdown(sourcePath, content)));
+        consumer.consume(await preflightParsedDesignResourceHandoffAny(repository, parseDesignResourceHandoffMarkdown(sourcePath, content)));
     }
     consumer.finish();
 }
@@ -32,9 +32,30 @@ export function createLongTaskDesignHandoffConsumer(contract) {
     let duplicate = null;
     const unbound = [];
     const handoffSetIntegrity = createDesignResourceHandoffSetIntegrity(invalid);
+    const allSourceItems = new Set();
+    const resourcePaths = new Map();
+    let crossVersionIssue = null;
+    const recordCrossVersionIssue = (code, detail) => {
+        crossVersionIssue ??= { code, detail };
+    };
     return {
         consume(preflight) {
-            handoffSetIntegrity.consume(preflight);
+            for (const sourceItem of preflight.source_item_keys) {
+                if (allSourceItems.has(sourceItem))
+                    recordCrossVersionIssue("handoff_set_source_item_duplicate", sourceItem);
+                else
+                    allSourceItems.add(sourceItem);
+            }
+            for (const resource of preflight.handoff.resources) {
+                const identity = JSON.stringify(resource);
+                const previous = resourcePaths.get(resource.path);
+                if (previous && previous !== identity)
+                    recordCrossVersionIssue("handoff_set_resource_path_conflict", resource.path);
+                else
+                    resourcePaths.set(resource.path, identity);
+            }
+            if (!("preflight_schema_version" in preflight))
+                handoffSetIntegrity.consume(preflight);
             for (const target of preflight.handoff.targets) {
                 if (indexedTargetKeys.has(target.key)) {
                     duplicate ??= target.key;
@@ -46,13 +67,27 @@ export function createLongTaskDesignHandoffConsumer(contract) {
                     unbound.push(target.key);
                     continue;
                 }
-                const indexedTarget = { preflight, target };
                 consumed.add(target.key);
                 try {
-                    validateTargetIdentity(contractTarget, indexedTarget);
-                    validateLongTaskDesignTargetCapabilities(contract, contractTarget, indexedTarget);
-                    validateCoverageClaims(contract, contractTarget, indexedTarget);
-                    validateBlockerBindings(contract, contractTarget, indexedTarget);
+                    if ("preflight_schema_version" in preflight) {
+                        const indexedTarget = {
+                            preflight,
+                            target,
+                        };
+                        validateSymbolicTargetIdentity(contractTarget, indexedTarget);
+                        validateSymbolicCoverageClaims(contract, contractTarget, indexedTarget);
+                        validateBlockerBindings(contract, contractTarget, indexedTarget);
+                    }
+                    else {
+                        const indexedTarget = {
+                            preflight,
+                            target: target,
+                        };
+                        validateTargetIdentity(contractTarget, indexedTarget);
+                        validateLongTaskDesignTargetCapabilities(contract, contractTarget, indexedTarget);
+                        validateCoverageClaims(contract, contractTarget, indexedTarget);
+                        validateBlockerBindings(contract, contractTarget, indexedTarget);
+                    }
                 }
                 catch (error) {
                     validationErrors.set(target.key, error);
@@ -63,6 +98,8 @@ export function createLongTaskDesignHandoffConsumer(contract) {
             if (duplicate)
                 invalid("handoff_target_duplicate", duplicate);
             handoffSetIntegrity.finish();
+            if (crossVersionIssue)
+                invalid(crossVersionIssue.code, crossVersionIssue.detail);
             for (const contractTarget of contractTargets) {
                 if (!consumed.has(contractTarget.target.key))
                     invalid("target_handoff_missing", contractTarget.target.key);
@@ -74,6 +111,23 @@ export function createLongTaskDesignHandoffConsumer(contract) {
         },
     };
 }
+function validateSymbolicCoverageClaims(contract, contractTarget, indexed) {
+    const claims = new Map(contract.source_claims.map((item) => [item.key, item]));
+    const rows = indexed.preflight.handoff.coverage.filter((row) => row.target_ref === contractTarget.target.key);
+    if (!rows.length)
+        invalid("v2_target_covered_claims_required", contractTarget.target.key);
+    const sourceItemRefs = [
+        ...new Set([
+            ...rows.flatMap((row) => row.source_item_refs),
+            ...indexed.preflight.manifest.fact_rules.flatMap((rule) => rule.source_item_refs),
+            ...indexed.preflight.manifest.disposition_regions.flatMap((region) => region.source_item_refs),
+        ]),
+    ];
+    const claimsBySourceItem = new Map();
+    for (const sourceItemRef of sourceItemRefs)
+        claimsBySourceItem.set(sourceItemRef, designSourceItemClaims(contract, contractTarget, indexed, sourceItemRef, claims));
+    validateSymbolicVerificationMethodBindings(contract, contractTarget, indexed, claimsBySourceItem);
+}
 function validateCoverageClaims(contract, contractTarget, indexed) {
     const target = contractTarget.target;
     const check = contract.outcomes
@@ -103,8 +157,14 @@ function validateBlockerBindings(contract, contractTarget, indexed) {
         item.key,
         item,
     ]));
-    const availableMethods = new Set(contractTarget.target.verification_method_bindings.map((item) => item.method));
-    for (const blocker of indexed.preflight.handoff.acceptance_blockers) {
+    const availableMethods = new Set([
+        ...contractTarget.target.verification_method_bindings,
+        ...(contractTarget.target.symbolic_method_bindings ?? []),
+    ].map((item) => item.method));
+    const blockers = "preflight_schema_version" in indexed.preflight
+        ? indexed.preflight.manifest.acceptance_blockers
+        : indexed.preflight.handoff.acceptance_blockers;
+    for (const blocker of blockers) {
         if (!blocker.target_refs.includes(contractTarget.target.key))
             continue;
         const contractBlocker = bound.get(blocker.key);

package/dist/lib/long-task-design-resource-method-binding.d.ts

@@ -1,8 +1,15 @@
 import type { DesignResourceHandoffPreflightV1 } from "./design-resource-handoff-types.js";
+import type { DesignResourceHandoffPreflightV2, DesignResourceSymbolicHandoffTargetV2 } from "./design-resource-symbolic-fact-types.js";
 import type { DeliveryContractV2 } from "./long-task-delivery-types.js";
 import type { ContractDesignTarget, IndexedHandoffTarget } from "./long-task-design-resource-handoff.js";
 export declare function validateTargetIdentity(contractTarget: ContractDesignTarget, indexed: IndexedHandoffTarget): void;
-export declare function designSourceItemClaims(contract: DeliveryContractV2, contractTarget: ContractDesignTarget, indexed: IndexedHandoffTarget, sourceItemRef: string, claims?: Map<string, import("./long-task-contract-types.js").SourceClaimV2>): string[];
+export interface IndexedSymbolicHandoffTarget {
+    preflight: DesignResourceHandoffPreflightV2;
+    target: DesignResourceSymbolicHandoffTargetV2;
+}
+export declare function validateSymbolicTargetIdentity(contractTarget: ContractDesignTarget, indexed: IndexedSymbolicHandoffTarget): void;
+export declare function validateSymbolicVerificationMethodBindings(contract: DeliveryContractV2, contractTarget: ContractDesignTarget, indexed: IndexedSymbolicHandoffTarget, claimsBySourceItem: Map<string, string[]>): void;
+export declare function designSourceItemClaims(contract: DeliveryContractV2, contractTarget: ContractDesignTarget, indexed: IndexedHandoffTarget | IndexedSymbolicHandoffTarget, sourceItemRef: string, claims?: Map<string, import("./long-task-contract-types.js").SourceClaimV2>): string[];
 export declare function validateVerificationMethodBindings(target: ContractDesignTarget["target"], check: DeliveryContractV2["outcomes"][number]["acceptance"]["checks"][number], facts: DesignResourceHandoffPreflightV1["handoff"]["facts"], proofs: DesignResourceHandoffPreflightV1["handoff"]["proof_obligations"], indexed: IndexedHandoffTarget, claimsBySourceItem: Map<string, string[]>): void;
 export declare function assertSameSet(actual: string[], expected: string[], code: string, detail: string): void;
 export declare function invalid(code: string, detail: string): never;

package/dist/lib/long-task-design-resource-method-binding.js

@@ -1,5 +1,9 @@
+import { designResourceSymbolicNoninterferenceProofDigest } from "./design-resource-symbolic-validation-support.js";
+import { matchesRepoPattern } from "./long-task-paths.js";
 export function validateTargetIdentity(contractTarget, indexed) {
     const { target } = contractTarget;
+    if (target.fact_model !== undefined)
+        invalid("v1_target_fact_model_must_be_absent", target.key);
     const handoffTarget = indexed.target;
     if (target.interpretation !== handoffTarget.interpretation)
         invalid("target_interpretation_mismatch", `${target.key}:${target.interpretation}:${handoffTarget.interpretation}`);
@@ -8,6 +12,110 @@ export function validateTargetIdentity(contractTarget, indexed) {
         .path);
     assertSameSet(target.source_paths, [indexed.preflight.handoff_path, ...resourcePaths], "target_source_paths_mismatch", target.key);
 }
+export function validateSymbolicTargetIdentity(contractTarget, indexed) {
+    const { target } = contractTarget;
+    const handoffTarget = indexed.target;
+    if (target.fact_model !== "symbolic_rules_v2")
+        invalid("v2_target_fact_model_required", target.key);
+    if (target.interpretation !== handoffTarget.interpretation)
+        invalid("target_interpretation_mismatch", `${target.key}:${target.interpretation}:${handoffTarget.interpretation}`);
+    if (target.condition_keys.length)
+        invalid("v2_ground_condition_keys_forbidden", target.key);
+    if (target.verification_method_bindings.length)
+        invalid("v2_ground_method_bindings_forbidden", target.key);
+    const resourcePaths = handoffTarget.resource_refs.map((ref) => indexed.preflight.handoff.resources.find((item) => item.key === ref)
+        .path);
+    assertSameSet(target.source_paths, [indexed.preflight.handoff_path, ...resourcePaths], "target_source_paths_mismatch", target.key);
+}
+export function validateSymbolicVerificationMethodBindings(contract, contractTarget, indexed, claimsBySourceItem) {
+    const target = contractTarget.target;
+    const preflight = indexed.preflight;
+    const check = contract.outcomes
+        .find((item) => item.key === contractTarget.outcome_key)
+        .acceptance.checks.find((item) => item.key === target.conformance_check_ref);
+    const bindings = target.symbolic_method_bindings ?? [];
+    const expectedMethods = [
+        ...new Set(preflight.manifest.semantic_proof_obligations.map((item) => item.method)),
+    ];
+    assertSameSet(bindings.map((item) => item.method), expectedMethods, "v2_verification_methods_mismatch", target.key);
+    const assertionRefs = bindings.map((item) => item.assertion_ref);
+    if (new Set(assertionRefs).size !== assertionRefs.length)
+        invalid("v2_verification_method_assertion_duplicate", target.key);
+    if (assertionRefs.includes(target.conformance_assertion_ref))
+        invalid("v2_verification_method_assertion_must_be_independent", target.key);
+    const boundObligationRefs = [];
+    const artifactPaths = new Set();
+    for (const binding of bindings) {
+        const assertion = check.positive_assertions.find((item) => item.key === binding.assertion_ref);
+        if (!assertion)
+            invalid("v2_verification_method_assertion_unknown", `${target.key}:${binding.method}:${binding.assertion_ref}`);
+        for (const capability of requiredCapabilities(binding.method))
+            if (!assertion.evidence_capabilities.includes(capability))
+                invalid("v2_verification_method_capability_required", `${target.key}:${binding.method}:${capability}`);
+        const expected = preflight.manifest.semantic_proof_obligations
+            .filter((obligation) => obligation.method === binding.method)
+            .map((obligation) => symbolicRuleExpectation(preflight, obligation.key));
+        assertCanonicalRowsByKey(binding.rule_expectations, expected, "obligation_ref", "v2_rule_expectations_mismatch", `${target.key}:${binding.method}`);
+        for (const expectation of expected) {
+            const rule = preflight.manifest.fact_rules.find((item) => item.key === expectation.fact_rule_ref);
+            for (const sourceItemRef of rule.source_item_refs)
+                for (const claimRef of claimsBySourceItem.get(sourceItemRef) ?? [])
+                    if (!assertion.claims.includes(claimRef))
+                        invalid("v2_verification_method_claim_not_asserted", `${target.key}:${binding.method}:${sourceItemRef}:${claimRef}`);
+            boundObligationRefs.push(expectation.obligation_ref);
+        }
+        for (const artifactPath of [
+            binding.artifact_path,
+            binding.observation_path,
+        ]) {
+            if (artifactPaths.has(artifactPath))
+                invalid("v2_evidence_artifact_reused", `${target.key}:${artifactPath}`);
+            artifactPaths.add(artifactPath);
+            if (!check.artifact_globs.some((pattern) => matchesRepoPattern(artifactPath, pattern)))
+                invalid("v2_evidence_artifact_glob_missing", artifactPath);
+        }
+    }
+    assertSameSet(boundObligationRefs, preflight.manifest.semantic_proof_obligations.map((item) => item.key), "v2_semantic_obligation_binding_mismatch", target.key);
+    validateSymbolicCertificateBinding(target, preflight, check, assertionRefs, artifactPaths);
+}
+function validateSymbolicCertificateBinding(target, preflight, check, assertionRefs, artifactPaths) {
+    const certificateBinding = target.symbolic_certificate_binding;
+    if (!certificateBinding)
+        invalid("v2_certificate_binding_required", target.key);
+    const certificateAssertion = check.positive_assertions.find((item) => item.key === certificateBinding.assertion_ref);
+    if (!certificateAssertion)
+        invalid("v2_certificate_assertion_unknown", `${target.key}:${certificateBinding.assertion_ref}`);
+    if (certificateBinding.assertion_ref === target.conformance_assertion_ref ||
+        assertionRefs.includes(certificateBinding.assertion_ref))
+        invalid("v2_certificate_assertion_must_be_independent", target.key);
+    if (!certificateAssertion.evidence_capabilities.includes("design_symbolic_certificate"))
+        invalid("v2_certificate_capability_required", `${target.key}:${certificateBinding.assertion_ref}`);
+    const expectedCertificates = preflight.manifest.noninterference_certificates.map((certificate) => {
+        const sourceProofDigest = designResourceSymbolicNoninterferenceProofDigest(certificate.source_noninterference_proof);
+        const productionProofDigest = designResourceSymbolicNoninterferenceProofDigest(certificate.production_noninterference_proof);
+        return {
+            certificate_ref: certificate.key,
+            fact_rule_refs: [...certificate.fact_rule_refs],
+            omitted_axis_refs: [...certificate.omitted_axis_refs],
+            dependency_edge_refs: [...certificate.dependency_edge_refs],
+            canonical_rule_dag_sha256: certificate.canonical_rule_dag_sha256,
+            ...(sourceProofDigest
+                ? { source_noninterference_proof_sha256: sourceProofDigest }
+                : {}),
+            ...(productionProofDigest
+                ? { production_noninterference_proof_sha256: productionProofDigest }
+                : {}),
+        };
+    });
+    assertCanonicalRowsByKey(certificateBinding.expectations, expectedCertificates, "certificate_ref", "v2_certificate_expectations_mismatch", target.key);
+    if (canonicalJson(certificateBinding.metrics) !==
+        canonicalJson(preflight.metrics))
+        invalid("v2_certificate_metrics_mismatch", target.key);
+    if (!check.artifact_globs.some((pattern) => matchesRepoPattern(certificateBinding.artifact_path, pattern)))
+        invalid("v2_certificate_artifact_glob_missing", certificateBinding.artifact_path);
+    if (artifactPaths.has(certificateBinding.artifact_path))
+        invalid("v2_certificate_artifact_reused", `${target.key}:${certificateBinding.artifact_path}`);
+}
 export function designSourceItemClaims(contract, contractTarget, indexed, sourceItemRef, claims = new Map(contract.source_claims.map((item) => [item.key, item]))) {
     const claim = claims.get(sourceItemRef);
     if (!claim)
@@ -93,6 +201,40 @@ function designFactExpectation(indexed, factRef, proofRef) {
         },
     };
 }
+function symbolicRuleExpectation(preflight, obligationRef) {
+    const obligation = preflight.manifest.semantic_proof_obligations.find((item) => item.key === obligationRef);
+    const rule = preflight.manifest.fact_rules.find((item) => item.key === obligation.fact_rule_ref);
+    const oracle = preflight.manifest.oracles.find((item) => item.key === obligation.oracle_ref);
+    const environment = preflight.manifest.environments.find((item) => item.key === obligation.environment_ref);
+    return {
+        obligation_ref: obligation.key,
+        fact_rule_ref: rule.key,
+        region_sha256: obligation.region_sha256,
+        subject_or_relation_ref: rule.subject_or_relation_ref,
+        property_ref: rule.property_ref,
+        population_ref: rule.population_ref,
+        quantifier: structuredClone(rule.quantifier),
+        observation_sensitivity: rule.observation_sensitivity,
+        expected: structuredClone(rule.expected),
+        proof_surface: obligation.proof_surface,
+        observation_boundary: obligation.observation_boundary,
+        comparison: structuredClone(obligation.comparison),
+        oracle: {
+            key: oracle.key,
+            trust: oracle.trust,
+            identity: oracle.identity,
+            version: oracle.version,
+            sha256: oracle.sha256,
+        },
+        environment: {
+            key: environment.key,
+            identity: environment.identity,
+            definition: structuredClone(environment.definition),
+        },
+        protected_value_policy: obligation.protected_value_policy,
+        completion_effect: obligation.completion_effect,
+    };
+}
 function assertCanonicalRows(actual, expected, code, detail) {
     const left = new Map(actual.map((item) => [item.fact_ref, canonicalJson(item)]));
     const right = new Map(expected.map((item) => [item.fact_ref, canonicalJson(item)]));
@@ -101,6 +243,14 @@ function assertCanonicalRows(actual, expected, code, detail) {
         if (left.get(key) !== value)
             invalid(code, `${detail}:${key}`);
 }
+function assertCanonicalRowsByKey(actual, expected, keyName, code, detail) {
+    const left = new Map(actual.map((item) => [String(item[keyName]), canonicalJson(item)]));
+    const right = new Map(expected.map((item) => [String(item[keyName]), canonicalJson(item)]));
+    assertSameSet([...left.keys()], [...right.keys()], code, detail);
+    for (const [key, value] of right)
+        if (left.get(key) !== value)
+            invalid(code, `${detail}:${key}`);
+}
 function canonicalJson(value) {
     if (Array.isArray(value))
         return `[${value.map((item) => canonicalJson(item)).join(",")}]`;