project-tiny-context-harness 0.8.11 → 0.8.13

package/dist/lib/long-task-evidence-capability-runtime.js

@@ -1,8 +1,14 @@
+import { evaluateExactDigestComparison, exactComparisonResultIdentity, } from "./long-task-exact-comparison.js";
+import { admittedObservationAuthorityKey, isJsonPointerExactOracle, resolveObservationAuthority, } from "./long-task-admitted-observation.js";
 import { validateSemanticFactEvidence } from "./long-task-semantic-fact-evidence.js";
-export function validateRuntimeEvidenceRecord(check, record, artifactHashes) {
+export { evaluateExactDigestComparison, exactComparisonResultIdentity };
+export function validateRuntimeEvidenceRecord(check, record, artifactHashes, admittedObservations, hostAttestation = null) {
+    const admittedObservationIssue = validateAdmittedObservationRecord(check, record, admittedObservations);
+    if (admittedObservationIssue)
+        return admittedObservationIssue;
     switch (record.capability) {
         case "interaction_trace":
-            return validateInteractionTrace(check, record);
+            return validateInteractionTrace(check, record, hostAttestation);
         case "state_delta":
             if (record.before_sha256 === record.after_sha256)
                 return "state_unchanged";
@@ -30,15 +36,92 @@ export function validateRuntimeEvidenceRecord(check, record, artifactHashes) {
             return validateDesignConformance(check, record, artifactHashes);
         case "design_method":
             return validateDesignMethod(check, record, artifactHashes);
+        case "design_symbolic_certificate":
+            return validateDesignSymbolicCertificate(check, record, artifactHashes);
         case "semantic_fact":
             return validateSemanticFactEvidence(check, record, artifactHashes);
         case "target_runtime":
-            return validateTargetRuntime(check, record);
+            return validateTargetRuntime(check, record, hostAttestation);
         case "input_variation":
             return validateInputVariation(record);
     }
 }
+function validateAdmittedObservationRecord(check, record, admitted) {
+    if (record.capability === "semantic_fact" &&
+        record.observer_results.length > 0)
+        return "semantic_fact_machine_observer_not_admitted";
+    const candidates = runtimeAdmittedObservationCandidates(record);
+    for (const candidate of candidates) {
+        if (!isJsonPointerExactOracle(candidate.oracle))
+            return "custom_oracle_machine_completion_forbidden";
+        const authorityResolution = resolveObservationAuthority(check, {
+            assertion_key: record.assertion_key,
+            identity_ref: candidate.identity_ref,
+            method: record.capability === "semantic_fact" ||
+                record.capability === "design_method"
+                ? record.method
+                : "exact_value",
+        });
+        if (!authorityResolution.authority)
+            return authorityResolution.reason;
+        if (authorityResolution.authority.authority === "external_confirmation")
+            return "unsupported_observer_requires_external_confirmation";
+        if (!admitted)
+            return "admitted_observation_runtime_required";
+        const key = admittedObservationAuthorityKey(authorityResolution.authority);
+        const prepared = admitted.by_authority_key.get(key);
+        if (!prepared ||
+            prepared.obligation_ref !== authorityResolution.authority.obligation_ref)
+            return "admitted_observation_missing";
+        if (prepared.reason)
+            return prepared.reason;
+        if (!prepared.observation)
+            return "admitted_observation_missing";
+        if (authorityResolution.authority.authority === "package_static_json_exact" &&
+            (prepared.observation.artifact_path !==
+                candidate.actual_observation.artifact_path ||
+                prepared.observation.artifact_sha256 !==
+                    candidate.actual_observation.artifact_sha256))
+            return "admitted_observation_artifact_mismatch";
+        if (candidate.actual_observation.locator.kind !== "json_pointer" ||
+            candidate.actual_observation.locator.value !==
+                authorityResolution.authority.locator_policy.value)
+            return "observation_locator_identity_mismatch";
+        if (prepared.observation.value_sha256 !==
+            candidate.actual_observation.value_sha256)
+            return "admitted_observation_value_mismatch";
+    }
+    return null;
+}
+function runtimeAdmittedObservationCandidates(record) {
+    if (record.capability === "semantic_fact")
+        return [
+            {
+                identity_ref: record.fact_ref,
+                actual_observation: record.actual_observation,
+                oracle: record.oracle,
+            },
+        ];
+    if (record.capability !== "design_method")
+        return [];
+    return "fact_model" in record
+        ? record.rule_results.map((result) => ({
+            identity_ref: result.obligation_ref,
+            actual_observation: result.actual_observation,
+            oracle: result.oracle,
+        }))
+        : record.cells.flatMap((cell) => cell.fact_results.map((result) => ({
+            identity_ref: result.fact_ref,
+            actual_observation: result.actual_observation,
+            oracle: result.oracle,
+        })));
+}
 function validateDesignMethod(check, record, artifactHashes) {
+    return "fact_model" in record
+        ? validateSymbolicDesignMethod(check, record, artifactHashes)
+        : validateGroundDesignMethod(check, record, artifactHashes);
+}
+function validateGroundDesignMethod(check, record, artifactHashes) {
     const target = (check.design_conformance_targets ?? []).find((item) => item.key === record.design_target_ref &&
         item.verification_method_bindings.some((binding) => binding.assertion_ref === record.assertion_key &&
             binding.method === record.method));
@@ -49,6 +132,9 @@ function validateDesignMethod(check, record, artifactHashes) {
         return "target_mismatch";
     const binding = target.verification_method_bindings.find((item) => item.assertion_ref === record.assertion_key &&
         item.method === record.method);
+    return validateGroundDesignCells(target, binding, record, artifactHashes);
+}
+function validateGroundDesignCells(target, binding, record, artifactHashes) {
     if (!same([...record.cells.map((item) => item.condition_key)].sort(), [...target.condition_keys].sort()))
         return "design_method_conditions_mismatch";
     const expected = new Map(binding.evidence_artifacts.map((item) => [
@@ -62,6 +148,9 @@ function validateDesignMethod(check, record, artifactHashes) {
     ]));
     if (record.cells.length !== expected.size)
         return "design_method_cell_count_mismatch";
+    return validateGroundCellSet(record, expected, artifactHashes);
+}
+function validateGroundCellSet(record, expected, artifactHashes) {
     for (const cell of record.cells) {
         const expectedCell = expected.get(cell.condition_key);
         if (expectedCell?.artifact_path !== cell.artifact_path ||
@@ -75,68 +164,326 @@ function validateDesignMethod(check, record, artifactHashes) {
             return "design_method_artifact_missing";
         if (!artifactHashes[cell.observation_artifact_path])
             return "design_method_observation_artifact_missing";
-        const expectations = new Map((expectedCell?.fact_expectations ?? []).map((item) => [
-            item.fact_ref,
-            item,
-        ]));
-        const actualIdentities = new Set();
-        const comparisonIdentities = new Set();
-        for (const result of cell.fact_results) {
-            const expectation = expectations.get(result.fact_ref);
-            if (!expectation)
-                return "design_method_fact_expectation_missing";
-            if (result.subject_ref !== expectation.subject_ref ||
-                result.variation_ref !== expectation.variation_ref ||
-                result.property_ref !== expectation.property_ref ||
-                result.actual_observation.sensitivity !==
-                    expectation.observation_sensitivity)
-                return "design_method_fact_identity_mismatch";
-            if ((result.actual_observation.sensitivity === "plain" &&
-                result.actual_observation.redaction !== null) ||
-                (result.actual_observation.sensitivity === "protected" &&
-                    result.actual_observation.redaction === null))
-                return "design_method_observation_protection_mismatch";
-            if (canonicalJson(result.expected) !== canonicalJson(expectation.expected))
-                return "design_method_expected_value_mismatch";
-            if (result.comparison.comparator !== expectation.comparison.comparator ||
-                result.comparison.mode !== expectation.comparison.mode ||
-                canonicalJson(result.comparison.parameters) !==
-                    canonicalJson(expectation.comparison.parameters) ||
-                canonicalJson(result.comparison.tolerance) !==
-                    canonicalJson(expectation.comparison.tolerance) ||
-                canonicalJson(result.comparison.mask) !==
-                    canonicalJson(expectation.comparison.mask))
-                return "design_method_comparison_authority_mismatch";
-            if (canonicalJson(result.oracle) !== canonicalJson(expectation.oracle) ||
-                canonicalJson(result.environment) !==
-                    canonicalJson(expectation.environment))
-                return "design_method_oracle_environment_mismatch";
-            if (result.actual_observation.artifact_path !==
-                cell.observation_artifact_path ||
-                result.actual_observation.artifact_sha256 !==
-                    artifactHashes[cell.observation_artifact_path])
-                return "design_method_actual_observation_mismatch";
-            if (result.actual_environment.artifact_path !==
-                cell.observation_artifact_path ||
-                result.actual_environment.artifact_sha256 !==
-                    artifactHashes[cell.observation_artifact_path] ||
-                result.actual_environment.value_sha256 !==
-                    expectation.environment.definition.sha256)
-                return "design_method_actual_environment_mismatch";
-            if (result.comparison.artifact_path !== cell.artifact_path ||
-                result.comparison.artifact_sha256 !== artifactHashes[cell.artifact_path])
-                return "design_method_comparison_artifact_mismatch";
-            const actualIdentity = `${result.actual_observation.artifact_path}\0${canonicalJson(result.actual_observation.locator)}`;
-            if (actualIdentities.has(actualIdentity))
-                return "design_method_actual_observation_reused";
-            actualIdentities.add(actualIdentity);
-            const comparisonIdentity = `${result.comparison.artifact_path}\0${canonicalJson(result.comparison.locator)}`;
-            if (comparisonIdentities.has(comparisonIdentity))
-                return "design_method_comparison_result_reused";
-            comparisonIdentities.add(comparisonIdentity);
-            if (result.verdict !== "passed" || result.comparison.passed !== true)
-                return "design_method_fact_failed";
-        }
+        const resultIssue = validateGroundCellResults(cell, expectedCell, artifactHashes);
+        if (resultIssue)
+            return resultIssue;
+    }
+    return null;
+}
+function validateGroundCellResults(cell, expectedCell, artifactHashes) {
+    const expectations = new Map(expectedCell.fact_expectations.map((item) => [item.fact_ref, item]));
+    const actualIdentities = new Set();
+    const comparisonIdentities = new Set();
+    for (const result of cell.fact_results) {
+        const expectation = expectations.get(result.fact_ref);
+        if (!expectation)
+            return "design_method_fact_expectation_missing";
+        const identityIssue = validateGroundFactIdentity(result, expectation);
+        if (identityIssue)
+            return identityIssue;
+        const authorityIssue = validateGroundFactAuthority(result, expectation);
+        if (authorityIssue)
+            return authorityIssue;
+        const artifactIssue = validateGroundFactArtifacts(result, expectation, cell, artifactHashes);
+        if (artifactIssue)
+            return artifactIssue;
+        const exactIssue = validateGroundExactComparison(result);
+        if (exactIssue)
+            return exactIssue;
+        const actualIdentity = `${result.actual_observation.artifact_path}\0${canonicalJson(result.actual_observation.locator)}`;
+        if (actualIdentities.has(actualIdentity))
+            return "design_method_actual_observation_reused";
+        actualIdentities.add(actualIdentity);
+        const comparisonIdentity = `${result.comparison.artifact_path}\0${canonicalJson(result.comparison.locator)}`;
+        if (comparisonIdentities.has(comparisonIdentity))
+            return "design_method_comparison_result_reused";
+        comparisonIdentities.add(comparisonIdentity);
+        if (result.verdict !== "passed" || result.comparison.passed !== true)
+            return "design_method_fact_failed";
+    }
+    return null;
+}
+function validateGroundExactComparison(result) {
+    if (result.comparison.comparator !== "exact_value" ||
+        result.comparison.mode !== "exact")
+        return null;
+    if (result.comparison.tolerance !== null || result.comparison.mask !== null)
+        return "design_method_comparison_authority_mismatch";
+    const recomputed = evaluateExactDigestComparison({
+        identity: {
+            kind: "selected_design_ground_v1",
+            fact_ref: result.fact_ref,
+            subject_ref: result.subject_ref,
+            variation_ref: result.variation_ref,
+            property_ref: result.property_ref,
+        },
+        ...exactComparisonMaterial(result),
+    });
+    if (!recomputed.passed)
+        return "design_method_exact_value_mismatch";
+    return result.comparison.result_sha256 === recomputed.result_sha256
+        ? null
+        : "design_method_comparison_result_identity_mismatch";
+}
+function validateGroundFactIdentity(result, expectation) {
+    if (result.subject_ref !== expectation.subject_ref ||
+        result.variation_ref !== expectation.variation_ref ||
+        result.property_ref !== expectation.property_ref ||
+        result.actual_observation.sensitivity !==
+            expectation.observation_sensitivity)
+        return "design_method_fact_identity_mismatch";
+    if ((result.actual_observation.sensitivity === "plain" &&
+        result.actual_observation.redaction !== null) ||
+        (result.actual_observation.sensitivity === "protected" &&
+            result.actual_observation.redaction === null))
+        return "design_method_observation_protection_mismatch";
+    return canonicalJson(result.expected) === canonicalJson(expectation.expected)
+        ? null
+        : "design_method_expected_value_mismatch";
+}
+function validateGroundFactAuthority(result, expectation) {
+    if (result.comparison.comparator !== expectation.comparison.comparator ||
+        result.comparison.mode !== expectation.comparison.mode ||
+        canonicalJson(result.comparison.parameters) !==
+            canonicalJson(expectation.comparison.parameters) ||
+        canonicalJson(result.comparison.tolerance) !==
+            canonicalJson(expectation.comparison.tolerance) ||
+        canonicalJson(result.comparison.mask) !==
+            canonicalJson(expectation.comparison.mask))
+        return "design_method_comparison_authority_mismatch";
+    return canonicalJson(result.oracle) === canonicalJson(expectation.oracle) &&
+        canonicalJson(result.environment) === canonicalJson(expectation.environment)
+        ? null
+        : "design_method_oracle_environment_mismatch";
+}
+function validateGroundFactArtifacts(result, expectation, cell, artifactHashes) {
+    if (result.actual_observation.artifact_path !==
+        cell.observation_artifact_path ||
+        result.actual_observation.artifact_sha256 !==
+            artifactHashes[cell.observation_artifact_path])
+        return "design_method_actual_observation_mismatch";
+    if (result.actual_environment.artifact_path !==
+        cell.observation_artifact_path ||
+        result.actual_environment.artifact_sha256 !==
+            artifactHashes[cell.observation_artifact_path] ||
+        result.actual_environment.value_sha256 !==
+            expectation.environment.definition.sha256)
+        return "design_method_actual_environment_mismatch";
+    return result.comparison.artifact_path === cell.artifact_path &&
+        result.comparison.artifact_sha256 === artifactHashes[cell.artifact_path]
+        ? null
+        : "design_method_comparison_artifact_mismatch";
+}
+function validateSymbolicDesignMethod(check, record, artifactHashes) {
+    const target = (check.design_conformance_targets ?? []).find((item) => item.key === record.design_target_ref &&
+        item.fact_model === "symbolic_rules_v2" &&
+        (item.symbolic_method_bindings ?? []).some((binding) => binding.assertion_ref === record.assertion_key &&
+            binding.method === record.method));
+    if (!target)
+        return "design_symbolic_method_binding_unknown";
+    if (target.target_ref !== record.target_ref ||
+        target.target_ref !== check.execution_target.target_ref)
+        return "target_mismatch";
+    const binding = target.symbolic_method_bindings.find((item) => item.assertion_ref === record.assertion_key &&
+        item.method === record.method);
+    if (binding.artifact_path !== record.artifact_path ||
+        binding.observation_path !== record.observation_artifact_path)
+        return "design_symbolic_method_artifact_path_mismatch";
+    if (!artifactHashes[record.artifact_path])
+        return "design_symbolic_method_artifact_missing";
+    if (!artifactHashes[record.observation_artifact_path])
+        return "design_symbolic_method_observation_artifact_missing";
+    const expectedRefs = binding.rule_expectations
+        .map((item) => item.obligation_ref)
+        .sort();
+    const actualRefs = record.rule_results
+        .map((item) => item.obligation_ref)
+        .sort();
+    if (new Set(actualRefs).size !== actualRefs.length ||
+        !same(actualRefs, expectedRefs))
+        return "design_symbolic_method_obligations_mismatch";
+    return validateSymbolicRuleResults(binding, record, artifactHashes);
+}
+function validateSymbolicRuleResults(binding, record, artifactHashes) {
+    const expectations = new Map(binding.rule_expectations.map((item) => [item.obligation_ref, item]));
+    const actualIdentities = new Set();
+    const comparisonIdentities = new Set();
+    for (const result of record.rule_results) {
+        const expectation = expectations.get(result.obligation_ref);
+        if (!expectation)
+            return "design_symbolic_method_expectation_missing";
+        const identityIssue = validateSymbolicResultIdentity(result, expectation);
+        if (identityIssue)
+            return identityIssue;
+        const authorityIssue = validateSymbolicResultAuthority(result, expectation);
+        if (authorityIssue)
+            return authorityIssue;
+        const artifactIssue = validateSymbolicResultArtifacts(result, expectation, record, artifactHashes);
+        if (artifactIssue)
+            return artifactIssue;
+        const exactIssue = validateSymbolicExactComparison(result);
+        if (exactIssue)
+            return exactIssue;
+        const actualIdentity = `${result.actual_observation.artifact_path}\0${canonicalJson(result.actual_observation.locator)}`;
+        if (actualIdentities.has(actualIdentity))
+            return "design_symbolic_method_actual_observation_reused";
+        actualIdentities.add(actualIdentity);
+        const comparisonIdentity = `${result.comparison.artifact_path}\0${canonicalJson(result.comparison.locator)}`;
+        if (comparisonIdentities.has(comparisonIdentity))
+            return "design_symbolic_method_comparison_result_reused";
+        comparisonIdentities.add(comparisonIdentity);
+        if (result.verdict !== "passed" || result.comparison.passed !== true)
+            return "design_symbolic_method_obligation_failed";
+    }
+    return null;
+}
+function validateSymbolicExactComparison(result) {
+    if (result.comparison.comparator !== "exact_value" ||
+        result.comparison.mode !== "exact")
+        return null;
+    if (result.comparison.tolerance !== null || result.comparison.mask !== null)
+        return "design_symbolic_method_comparison_authority_mismatch";
+    const recomputed = evaluateExactDigestComparison({
+        identity: {
+            kind: "selected_design_symbolic_v2",
+            obligation_ref: result.obligation_ref,
+            fact_rule_ref: result.fact_rule_ref,
+            region_sha256: result.region_sha256,
+            subject_or_relation_ref: result.subject_or_relation_ref,
+            property_ref: result.property_ref,
+            population_ref: result.population_ref,
+            quantifier: result.quantifier,
+        },
+        ...exactComparisonMaterial(result),
+    });
+    if (!recomputed.passed)
+        return "design_symbolic_method_exact_value_mismatch";
+    return result.comparison.result_sha256 === recomputed.result_sha256
+        ? null
+        : "design_symbolic_method_comparison_result_identity_mismatch";
+}
+function exactComparisonMaterial(result) {
+    return {
+        actual_value_sha256: result.actual_observation.value_sha256,
+        expected_value_sha256: result.expected.sha256,
+        comparator: result.comparison.comparator,
+        mode: result.comparison.mode,
+        parameters_sha256: result.comparison.parameters.sha256,
+        tolerance_sha256: result.comparison.tolerance?.sha256 ?? null,
+        mask_sha256: result.comparison.mask?.sha256 ?? null,
+    };
+}
+function validateSymbolicResultIdentity(result, expectation) {
+    if (result.fact_rule_ref !== expectation.fact_rule_ref ||
+        result.region_sha256 !== expectation.region_sha256 ||
+        result.subject_or_relation_ref !== expectation.subject_or_relation_ref ||
+        result.property_ref !== expectation.property_ref ||
+        result.population_ref !== expectation.population_ref ||
+        canonicalJson(result.quantifier) !==
+            canonicalJson(expectation.quantifier) ||
+        result.observation_sensitivity !== expectation.observation_sensitivity)
+        return "design_symbolic_method_identity_mismatch";
+    if (result.actual_observation.sensitivity !==
+        expectation.observation_sensitivity ||
+        (result.actual_observation.sensitivity === "plain" &&
+            result.actual_observation.redaction !== null) ||
+        (result.actual_observation.sensitivity === "protected" &&
+            result.actual_observation.redaction === null))
+        return "design_symbolic_method_observation_protection_mismatch";
+    return canonicalJson(result.expected) === canonicalJson(expectation.expected)
+        ? null
+        : "design_symbolic_method_expected_value_mismatch";
+}
+function validateSymbolicResultAuthority(result, expectation) {
+    if (result.proof_surface !== expectation.proof_surface ||
+        result.observation_boundary !== expectation.observation_boundary ||
+        result.protected_value_policy !== expectation.protected_value_policy ||
+        result.completion_effect !== expectation.completion_effect)
+        return "design_symbolic_method_proof_denotation_mismatch";
+    if (result.comparison.comparator !== expectation.comparison.comparator ||
+        result.comparison.mode !== expectation.comparison.mode ||
+        canonicalJson(result.comparison.parameters) !==
+            canonicalJson(expectation.comparison.parameters) ||
+        canonicalJson(result.comparison.tolerance) !==
+            canonicalJson(expectation.comparison.tolerance) ||
+        canonicalJson(result.comparison.mask) !==
+            canonicalJson(expectation.comparison.mask))
+        return "design_symbolic_method_comparison_authority_mismatch";
+    return canonicalJson(result.oracle) === canonicalJson(expectation.oracle) &&
+        canonicalJson(result.environment) === canonicalJson(expectation.environment)
+        ? null
+        : "design_symbolic_method_oracle_environment_mismatch";
+}
+function validateSymbolicResultArtifacts(result, expectation, record, artifactHashes) {
+    if (result.actual_observation.artifact_path !==
+        record.observation_artifact_path ||
+        result.actual_observation.artifact_sha256 !==
+            artifactHashes[record.observation_artifact_path])
+        return "design_symbolic_method_actual_observation_mismatch";
+    if (result.actual_environment.artifact_path !==
+        record.observation_artifact_path ||
+        result.actual_environment.artifact_sha256 !==
+            artifactHashes[record.observation_artifact_path] ||
+        result.actual_environment.value_sha256 !==
+            expectation.environment.definition.sha256)
+        return "design_symbolic_method_actual_environment_mismatch";
+    return result.comparison.artifact_path === record.artifact_path &&
+        result.comparison.artifact_sha256 === artifactHashes[record.artifact_path]
+        ? null
+        : "design_symbolic_method_comparison_artifact_mismatch";
+}
+function validateDesignSymbolicCertificate(check, record, artifactHashes) {
+    const target = (check.design_conformance_targets ?? []).find((item) => item.key === record.design_target_ref &&
+        item.fact_model === "symbolic_rules_v2" &&
+        item.symbolic_certificate_binding?.assertion_ref === record.assertion_key);
+    if (!target)
+        return "design_symbolic_certificate_binding_unknown";
+    if (target.target_ref !== record.target_ref ||
+        target.target_ref !== check.execution_target.target_ref)
+        return "target_mismatch";
+    const binding = target.symbolic_certificate_binding;
+    if (record.artifact_path !== binding.artifact_path)
+        return "design_symbolic_certificate_artifact_path_mismatch";
+    if (artifactHashes[record.artifact_path] !== record.artifact_sha256)
+        return "design_symbolic_certificate_artifact_hash_mismatch";
+    if (canonicalJson(record.metrics) !== canonicalJson(binding.metrics))
+        return "design_symbolic_certificate_metrics_mismatch";
+    const expectedRefs = binding.expectations
+        .map((item) => item.certificate_ref)
+        .sort();
+    const actualRefs = record.certificate_results
+        .map((item) => item.certificate_ref)
+        .sort();
+    if (new Set(actualRefs).size !== actualRefs.length ||
+        !same(actualRefs, expectedRefs))
+        return "design_symbolic_certificate_results_mismatch";
+    const expectations = new Map(binding.expectations.map((item) => [item.certificate_ref, item]));
+    for (const result of record.certificate_results) {
+        const expectation = expectations.get(result.certificate_ref);
+        if (!expectation)
+            return "design_symbolic_certificate_expectation_missing";
+        if (canonicalJson({
+            certificate_ref: result.certificate_ref,
+            fact_rule_refs: result.fact_rule_refs,
+            omitted_axis_refs: result.omitted_axis_refs,
+            dependency_edge_refs: result.dependency_edge_refs,
+            canonical_rule_dag_sha256: result.canonical_rule_dag_sha256,
+            ...(result.source_noninterference_proof_sha256 === undefined
+                ? {}
+                : {
+                    source_noninterference_proof_sha256: result.source_noninterference_proof_sha256,
+                }),
+            ...(result.production_noninterference_proof_sha256 === undefined
+                ? {}
+                : {
+                    production_noninterference_proof_sha256: result.production_noninterference_proof_sha256,
+                }),
+        }) !== canonicalJson(expectation))
+            return "design_symbolic_certificate_denotation_mismatch";
+        if (result.recomputed !== true)
+            return "design_symbolic_certificate_not_recomputed";
+        if (result.verdict !== "passed")
+            return "design_symbolic_certificate_failed";
     }
     return null;
 }
@@ -171,9 +518,12 @@ function validateDesignConformance(check, record, artifactHashes) {
 }
 function designTargetUsesAssertion(target, assertionKey) {
     return (target.conformance_assertion_ref === assertionKey ||
-        target.verification_method_bindings.some((item) => item.assertion_ref === assertionKey));
+        target.verification_method_bindings.some((item) => item.assertion_ref === assertionKey) ||
+        (target.symbolic_method_bindings ?? []).some((item) => item.assertion_ref === assertionKey));
 }
-function validateInteractionTrace(check, record) {
+function validateInteractionTrace(check, record, hostAttestation) {
+    if (!hostAttestation?.direct_root_match)
+        return "legacy_interaction_trace_non_authoritative";
     if (record.target_ref !== check.execution_target.target_ref)
         return "target_mismatch";
     if (!same(record.given_keys, check.scenario.given.map((step) => step.key)))
@@ -202,7 +552,9 @@ function validateObserverEvidence(check, observerTargetRef) {
         return "check_must_execute_on_observer";
     return null;
 }
-function validateTargetRuntime(check, record) {
+function validateTargetRuntime(check, record, hostAttestation) {
+    if (!hostAttestation?.direct_root_match)
+        return "legacy_target_runtime_non_authoritative";
     if (record.target_ref !== check.execution_target.target_ref)
         return "target_mismatch";
     if (record.root_entrypoint !== check.execution_target_definition.root_entrypoint)

package/dist/lib/long-task-evidence-capability-types.d.ts

@@ -77,7 +77,7 @@ export interface TargetRuntimeEvidenceV2 extends EvidenceRecordBaseV2 {
     session_id: string;
     cold_start: boolean;
 }
-export interface DesignMethodEvidenceV2 extends EvidenceRecordBaseV2 {
+export interface DesignGroundMethodEvidenceV2 extends EvidenceRecordBaseV2 {
     capability: "design_method";
     design_target_ref: string;
     target_ref: string;
@@ -140,12 +140,80 @@ export interface DesignFactResultV2 {
         definition: DesignResourceLocatedDigestV1;
     };
 }
+export interface DesignSymbolicMethodEvidenceV2 extends EvidenceRecordBaseV2 {
+    capability: "design_method";
+    fact_model: "symbolic_rules_v2";
+    design_target_ref: string;
+    target_ref: string;
+    method: DesignResourceVerificationMethod;
+    artifact_path: string;
+    observation_artifact_path: string;
+    rule_results: DesignSymbolicRuleResultV2[];
+}
+export interface DesignSymbolicRuleResultV2 {
+    obligation_ref: string;
+    fact_rule_ref: string;
+    region_sha256: string;
+    subject_or_relation_ref: string;
+    property_ref: string;
+    population_ref: string | null;
+    quantifier: {
+        kind: "one" | "all" | "any" | "none" | "exactly" | "at_least" | "at_most" | "range";
+        minimum: number | null;
+        maximum: number | null;
+    };
+    actual_observation: DesignFactResultV2["actual_observation"];
+    actual_environment: DesignFactResultV2["actual_environment"];
+    observation_sensitivity: "plain" | "protected";
+    expected: DesignResourceLocatedDigestV1;
+    proof_surface: string;
+    observation_boundary: string;
+    comparison: DesignFactResultV2["comparison"];
+    verdict: "passed" | "failed";
+    oracle: DesignFactResultV2["oracle"];
+    environment: DesignFactResultV2["environment"];
+    protected_value_policy: string;
+    completion_effect: string;
+}
+export type DesignMethodEvidenceV2 = DesignGroundMethodEvidenceV2 | DesignSymbolicMethodEvidenceV2;
+export interface DesignSymbolicCertificateEvidenceV2 extends EvidenceRecordBaseV2 {
+    capability: "design_symbolic_certificate";
+    design_target_ref: string;
+    target_ref: string;
+    artifact_path: string;
+    artifact_sha256: string;
+    metrics: {
+        semantic_obligations: number;
+        certificate_obligations: number;
+        certificate_covered_omitted_axes: number;
+        certificate_covered_dependency_edges: number;
+        canonical_dag_nodes: number;
+        canonical_partition_edges: number;
+        canonical_bytes: number;
+        theoretical_ground_cardinality: string;
+    };
+    certificate_results: Array<{
+        certificate_ref: string;
+        fact_rule_refs: string[];
+        omitted_axis_refs: string[];
+        dependency_edge_refs: string[];
+        canonical_rule_dag_sha256: string;
+        source_noninterference_proof_sha256?: string;
+        production_noninterference_proof_sha256?: string;
+        recomputed: true;
+        verdict: "passed" | "failed";
+    }>;
+}
 export interface SemanticFactEvidenceV2 extends EvidenceRecordBaseV2 {
     capability: "semantic_fact";
     manifest_ref: string;
     manifest_sha256: string;
     outcome_ref: string;
     target_ref: string;
+    fact_key?: string;
+    fact_revision_digest?: string;
+    obligation_key?: string;
+    obligation_revision_digest?: string;
     fact_ref: string;
     proof_ref: string;
     method: string;
@@ -204,5 +272,5 @@ export interface InputVariationEvidenceV2 extends EvidenceRecordBaseV2 {
     }>;
     failure_case_observed: boolean;
 }
-export type EvidenceCapabilityRecordV2 = InteractionTraceEvidenceV2 | StateDeltaEvidenceV2 | CrossSurfaceConsistencyEvidenceV2 | DurableReadbackEvidenceV2 | BoundaryInvocationEvidenceV2 | ExternalSideEffectEvidenceV2 | FailureInjectionEvidenceV2 | VisualRenderEvidenceV2 | DesignConformanceEvidenceV2 | DesignMethodEvidenceV2 | SemanticFactEvidenceV2 | TargetRuntimeEvidenceV2 | InputVariationEvidenceV2;
+export type EvidenceCapabilityRecordV2 = InteractionTraceEvidenceV2 | StateDeltaEvidenceV2 | CrossSurfaceConsistencyEvidenceV2 | DurableReadbackEvidenceV2 | BoundaryInvocationEvidenceV2 | ExternalSideEffectEvidenceV2 | FailureInjectionEvidenceV2 | VisualRenderEvidenceV2 | DesignConformanceEvidenceV2 | DesignMethodEvidenceV2 | DesignSymbolicCertificateEvidenceV2 | SemanticFactEvidenceV2 | TargetRuntimeEvidenceV2 | InputVariationEvidenceV2;
 export {};

package/dist/lib/long-task-evidence-sensitivity-policy.d.ts

@@ -1,4 +1,13 @@
 import type { CompiledCheckV2, CompiledOutcomeV2, DeliveryContractV2 } from "./long-task-delivery-types.js";
+export declare function validateCounterfactualObservationImpact(input: {
+    baseline_by_fact: Record<string, string>;
+    mutated_by_fact: Record<string, string>;
+    expected_affected_fact_refs: string[];
+    preserved_fact_refs: string[];
+    allowed_fanout_fact_refs?: string[];
+    target_live: boolean;
+    carrier_role: "product" | "evidence";
+}): string | null;
 export declare function validateClaimEvidenceSensitivity(contract: DeliveryContractV2, globalChecks: CompiledCheckV2[], outcomes: CompiledOutcomeV2[], report?: ValidationReporter): void;
 type ValidationReporter = (message: string) => void;
 export {};