project-tiny-context-harness 0.8.12 → 0.8.13

package/dist/lib/long-task-json-pointer-observation.js

@@ -0,0 +1,184 @@
+import path from "node:path";
+import { canonicalValueJson, parseStrictYaml, sha256Hex, } from "./strict-codec.js";
+export const JSON_POINTER_EXACT_CAPABILITY = "json-pointer-exact-v1";
+export const JSON_POINTER_EXACT_ORACLE_IDENTITY = "ty-context-json-pointer-exact";
+export const JSON_POINTER_EXACT_ORACLE_VERSION = "1.0.0";
+export const JSON_POINTER_EXACT_METHODS = Object.freeze([
+    "exact_value",
+    "content",
+    "component_state",
+]);
+export const JSON_POINTER_EXACT_LIMITS = Object.freeze({
+    max_file_bytes: 1_048_576,
+    max_depth: 64,
+    max_pointer_bytes: 4_096,
+    max_pointer_segments: 128,
+    max_canonical_value_bytes: 262_144,
+    max_artifacts_per_check: 256,
+    max_total_artifact_bytes: 16_777_216,
+});
+export const JSON_POINTER_EXACT_SPEC_SHA256 = sha256Hex(canonicalValueJson({
+    capability: JSON_POINTER_EXACT_CAPABILITY,
+    oracle_identity: JSON_POINTER_EXACT_ORACLE_IDENTITY,
+    oracle_version: JSON_POINTER_EXACT_ORACLE_VERSION,
+    media_type: "application/json",
+    encoding: "utf-8",
+    locator: "rfc6901-json-pointer",
+    canonicalization: "canonical-json-v1",
+    methods: JSON_POINTER_EXACT_METHODS,
+    comparator: "exact_value",
+    mode: "exact",
+    sensitivity: "plain",
+    limits: JSON_POINTER_EXACT_LIMITS,
+}));
+export function createJsonPointerExactBudget() {
+    return { seen_artifact_paths: new Set(), total_artifact_bytes: 0 };
+}
+export function isJsonPointerExactOracle(oracle) {
+    return (oracle.trust === "named_external_tcb" &&
+        oracle.identity === JSON_POINTER_EXACT_ORACLE_IDENTITY &&
+        oracle.version === JSON_POINTER_EXACT_ORACLE_VERSION &&
+        oracle.sha256 === null);
+}
+export function extractJsonPointerExactObservationFromBytes(input) {
+    const artifactPath = normalizeObservationArtifactPath(input.artifact_path);
+    if (input.sensitivity !== "plain")
+        throw invalidObservation("observation_protected_requires_frozen_adapter");
+    if (input.bytes.byteLength > JSON_POINTER_EXACT_LIMITS.max_file_bytes)
+        throw invalidObservation("observation_artifact_size_limit");
+    accountForArtifact(input.budget, artifactPath, input.bytes.byteLength);
+    const locator = validateJsonPointerExactLocator(input.locator);
+    const parsed = parseJsonWithoutDuplicateKeys(decodeUtf8Json(input.bytes));
+    assertJsonTree(parsed, 0);
+    const canonical = canonicalValueJson(resolveJsonPointer(parsed, locator.value));
+    const canonicalBytes = Buffer.byteLength(canonical, "utf8");
+    if (canonicalBytes > JSON_POINTER_EXACT_LIMITS.max_canonical_value_bytes)
+        throw invalidObservation("observation_canonical_value_size_limit");
+    return {
+        capability: JSON_POINTER_EXACT_CAPABILITY,
+        artifact_path: artifactPath,
+        artifact_sha256: sha256Hex(input.bytes),
+        locator,
+        value_sha256: sha256Hex(canonical),
+        canonical_value_bytes: canonicalBytes,
+        sensitivity: "plain",
+    };
+}
+export function validateJsonPointerExactLocator(locator) {
+    if (locator.kind !== "json_pointer" ||
+        typeof locator.value !== "string" ||
+        locator.value.startsWith("#") ||
+        (locator.value !== "" && !locator.value.startsWith("/")) ||
+        Buffer.byteLength(locator.value, "utf8") >
+            JSON_POINTER_EXACT_LIMITS.max_pointer_bytes)
+        throw invalidObservation("observation_locator_not_admitted");
+    const encoded = locator.value === "" ? [] : locator.value.slice(1).split("/");
+    if (encoded.length > JSON_POINTER_EXACT_LIMITS.max_pointer_segments)
+        throw invalidObservation("observation_locator_segment_limit");
+    for (const token of encoded)
+        if (/~(?:[^01]|$)/u.test(token))
+            throw invalidObservation("observation_locator_not_admitted");
+    return { kind: "json_pointer", value: locator.value };
+}
+export function normalizeObservationArtifactPath(value) {
+    if (!value ||
+        value.includes("\\") ||
+        value.includes("\0") ||
+        path.posix.isAbsolute(value) ||
+        /^[a-z]:/iu.test(value))
+        throw invalidObservation("observation_artifact_path_escape");
+    const segments = value.split("/");
+    if (segments.some((segment) => !segment || segment === "." || segment === ".."))
+        throw invalidObservation("observation_artifact_path_escape");
+    return segments.join("/");
+}
+export function invalidObservation(code) {
+    return new Error(code);
+}
+export function observationErrorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+export function resolveJsonPointer(root, pointer) {
+    let current = root;
+    if (pointer === "")
+        return current;
+    for (const encoded of pointer.slice(1).split("/")) {
+        const token = encoded.replace(/~1/gu, "/").replace(/~0/gu, "~");
+        if (Array.isArray(current)) {
+            if (!/^(?:0|[1-9]\d*)$/u.test(token))
+                throw invalidObservation("observation_locator_array_index_invalid");
+            const index = Number(token);
+            if (!Number.isSafeInteger(index) || index >= current.length)
+                throw invalidObservation("observation_locator_not_found");
+            current = current[index];
+            continue;
+        }
+        if (!current ||
+            typeof current !== "object" ||
+            !Object.hasOwn(current, token))
+            throw invalidObservation("observation_locator_not_found");
+        current = current[token];
+    }
+    return current;
+}
+export function parseJsonWithoutDuplicateKeys(content) {
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch {
+        throw invalidObservation("observation_json_invalid");
+    }
+    try {
+        const strict = parseStrictYaml(content);
+        if (canonicalValueJson(strict) !== canonicalValueJson(parsed))
+            throw invalidObservation("observation_json_canonicalization_mismatch");
+    }
+    catch (error) {
+        if (observationErrorMessage(error).includes("unique"))
+            throw invalidObservation("observation_json_duplicate_key");
+        if (observationErrorMessage(error).startsWith("observation_"))
+            throw error;
+        throw invalidObservation("observation_json_invalid");
+    }
+    return parsed;
+}
+export function decodeUtf8Json(bytes) {
+    if (bytes.byteLength >= 3 &&
+        bytes[0] === 0xef &&
+        bytes[1] === 0xbb &&
+        bytes[2] === 0xbf)
+        throw invalidObservation("observation_json_utf8_invalid");
+    try {
+        return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    }
+    catch {
+        throw invalidObservation("observation_json_utf8_invalid");
+    }
+}
+export function assertJsonTree(value, depth) {
+    if (depth > JSON_POINTER_EXACT_LIMITS.max_depth)
+        throw invalidObservation("observation_json_depth_limit");
+    if (typeof value === "number" && !Number.isFinite(value))
+        throw invalidObservation("observation_json_number_invalid");
+    if (Array.isArray(value)) {
+        for (const entry of value)
+            assertJsonTree(entry, depth + 1);
+        return;
+    }
+    if (value && typeof value === "object")
+        for (const entry of Object.values(value))
+            assertJsonTree(entry, depth + 1);
+}
+function accountForArtifact(budget, artifactPath, bytes) {
+    if (!budget || budget.seen_artifact_paths.has(artifactPath))
+        return;
+    if (budget.seen_artifact_paths.size >=
+        JSON_POINTER_EXACT_LIMITS.max_artifacts_per_check)
+        throw invalidObservation("observation_artifact_count_limit");
+    if (budget.total_artifact_bytes + bytes >
+        JSON_POINTER_EXACT_LIMITS.max_total_artifact_bytes)
+        throw invalidObservation("observation_artifact_total_size_limit");
+    budget.seen_artifact_paths.add(artifactPath);
+    budget.total_artifact_bytes += bytes;
+}

package/dist/lib/long-task-observation-artifact.d.ts

@@ -0,0 +1,8 @@
+import { type JsonPointerExactBudget, type JsonPointerExactLocator, type JsonPointerExactObservation } from "./long-task-json-pointer-observation.js";
+export declare function extractJsonPointerExactObservation(input: {
+    root: string;
+    artifact_path: string;
+    locator: JsonPointerExactLocator;
+    sensitivity: string;
+    budget?: JsonPointerExactBudget;
+}): Promise<JsonPointerExactObservation>;

package/dist/lib/long-task-observation-artifact.js

@@ -0,0 +1,58 @@
+import { lstat, open, realpath } from "node:fs/promises";
+import path from "node:path";
+import { JSON_POINTER_EXACT_LIMITS, extractJsonPointerExactObservationFromBytes, invalidObservation, normalizeObservationArtifactPath, } from "./long-task-json-pointer-observation.js";
+export async function extractJsonPointerExactObservation(input) {
+    const artifactPath = normalizeObservationArtifactPath(input.artifact_path);
+    const root = path.resolve(input.root);
+    const resolved = path.resolve(root, ...artifactPath.split("/"));
+    assertContained(root, resolved);
+    await rejectSymbolicPath(root, artifactPath);
+    const [rootReal, fileReal] = await Promise.all([
+        realpath(root),
+        realpath(resolved),
+    ]);
+    assertContained(rootReal, fileReal);
+    const before = await lstat(resolved);
+    if (!before.isFile())
+        throw invalidObservation("observation_artifact_not_file");
+    if (before.size > JSON_POINTER_EXACT_LIMITS.max_file_bytes)
+        throw invalidObservation("observation_artifact_size_limit");
+    const handle = await open(resolved, "r");
+    try {
+        const opened = await handle.stat();
+        assertSameFile(before, opened);
+        const bytes = await handle.readFile();
+        const after = await handle.stat();
+        assertSameFile(opened, after);
+        return extractJsonPointerExactObservationFromBytes({
+            artifact_path: artifactPath,
+            bytes,
+            locator: input.locator,
+            sensitivity: input.sensitivity,
+            budget: input.budget,
+        });
+    }
+    finally {
+        await handle.close();
+    }
+}
+function assertContained(root, target) {
+    const relative = path.relative(root, target);
+    if (!relative || relative.startsWith("..") || path.isAbsolute(relative))
+        throw invalidObservation("observation_artifact_path_escape");
+}
+async function rejectSymbolicPath(root, relative) {
+    let current = root;
+    for (const segment of relative.split("/")) {
+        current = path.join(current, segment);
+        const entry = await lstat(current);
+        if (entry.isSymbolicLink())
+            throw invalidObservation("observation_artifact_symlink");
+    }
+}
+function assertSameFile(before, after) {
+    if (before.dev !== after.dev ||
+        before.ino !== after.ino ||
+        before.size !== after.size)
+        throw invalidObservation("observation_artifact_changed_during_read");
+}

package/dist/lib/long-task-observation-authority.d.ts

@@ -0,0 +1,17 @@
+import type { CompiledDesignTargetV2, CompiledObservationAuthorityV2, DeliveryCheckV2, ExecutionTargetV2, FrozenRunnerV2, SemanticFactExpectationV2, SourceBackedExecutionTargetV2, WorkspaceManifestV2 } from "./long-task-delivery-types.js";
+import type { ScopedDeliveryBindingV2 } from "./long-task-scoped-binding.js";
+interface CompileObservationAuthorityPlanInput {
+    check: DeliveryCheckV2;
+    outcome_key: string | null;
+    runner: FrozenRunnerV2;
+    execution_target: ExecutionTargetV2;
+    design_targets: CompiledDesignTargetV2[];
+    semantic_fact_expectations: SemanticFactExpectationV2[];
+    production_bindings: ScopedDeliveryBindingV2[];
+    production_owner_paths: string[];
+    source_backed_execution_target: SourceBackedExecutionTargetV2 | null;
+    workspace_manifest: WorkspaceManifestV2;
+    protected_authority_paths?: readonly string[];
+}
+export declare function compileObservationAuthorityPlan(input: CompileObservationAuthorityPlanInput): CompiledObservationAuthorityV2[];
+export {};

package/dist/lib/long-task-observation-authority.js

@@ -0,0 +1,348 @@
+import { JSON_POINTER_EXACT_METHODS, isJsonPointerExactOracle, } from "./long-task-json-pointer-observation.js";
+import { classifyMachineObservationCarrierRoleConflict } from "./long-task-admitted-observation.js";
+import { canonicalValueJson, sha256Hex } from "./strict-codec.js";
+import { classifyRepositoryPatternOverlap, normalizeRepositoryFile, } from "./long-task-paths.js";
+const PROCESS_DERIVED_CAPABILITIES = new Set([
+    "presence",
+    "target_runtime",
+]);
+const PROCESS_CAPABILITIES_REQUIRING_A_SEPARATE_PACKAGE_DERIVATION = new Set([
+    "interaction_trace",
+    "state_delta",
+    "design_conformance",
+]);
+const STATIC_DERIVED_CAPABILITIES = new Set(["presence"]);
+export function compileObservationAuthorityPlan(input) {
+    const assertions = new Map([
+        ...input.check.positive_assertions,
+        ...input.check.negative_assertions,
+    ].map((assertion) => [assertion.key, assertion]));
+    const candidates = [];
+    const factBoundAssertions = new Set();
+    for (const expectation of input.semantic_fact_expectations) {
+        if (expectation.observer_refs.length)
+            fail("semantic_fact_machine_observer_not_admitted", `${expectation.proof_ref}:observer_results_package_channel_unavailable:${expectation.observer_refs.join(",")}`);
+        const assertion = requiredAssertion(assertions, expectation.assertion_ref, `semantic_fact_machine_observer_not_admitted:${expectation.proof_ref}`);
+        factBoundAssertions.add(assertion.key);
+        candidates.push({
+            obligation_ref: expectation.proof_ref,
+            observation_identity: expectation.fact_ref,
+            fact_ref: expectation.fact_ref,
+            assertion,
+            target_ref: input.check.execution_target.target_ref,
+            method: expectation.method,
+            expected_value_sha256: expectation.expected.sha256,
+            actual_projection: "raw_exact",
+            comparison: {
+                comparator: expectation.comparison.comparator,
+                mode: expectation.comparison.mode,
+                parameters_sha256: expectation.comparison.parameters.sha256,
+                tolerance_sha256: expectation.comparison.tolerance?.sha256 ?? null,
+                mask_sha256: expectation.comparison.mask?.sha256 ?? null,
+            },
+            sensitivity: expectation.observation_sensitivity,
+            oracle: expectation.oracle,
+            diagnostic_scope: "semantic_fact",
+        });
+    }
+    for (const target of input.design_targets) {
+        if (target.target_ref !== input.check.execution_target.target_ref)
+            fail("machine_observer_not_admitted", `${target.key}:target_mismatch:${target.target_ref}:${input.check.execution_target.target_ref}`);
+        for (const binding of target.verification_method_bindings)
+            for (const artifact of binding.evidence_artifacts)
+                for (const expectation of artifact.fact_expectations) {
+                    const assertion = requiredAssertion(assertions, binding.assertion_ref, `machine_observer_not_admitted:${target.key}:${binding.method}`);
+                    factBoundAssertions.add(assertion.key);
+                    candidates.push({
+                        obligation_ref: designGroundObligationRef(target.key, binding.method, artifact.condition_key, expectation.fact_ref),
+                        observation_identity: expectation.fact_ref,
+                        fact_ref: expectation.fact_ref,
+                        assertion,
+                        target_ref: target.target_ref,
+                        method: binding.method,
+                        expected_value_sha256: expectation.expected.sha256,
+                        actual_projection: "raw_exact",
+                        comparison: {
+                            comparator: expectation.comparison.comparator,
+                            mode: expectation.comparison.mode,
+                            parameters_sha256: expectation.comparison.parameters.sha256,
+                            tolerance_sha256: expectation.comparison.tolerance?.sha256 ?? null,
+                            mask_sha256: expectation.comparison.mask?.sha256 ?? null,
+                        },
+                        sensitivity: expectation.observation_sensitivity,
+                        oracle: expectation.oracle,
+                        diagnostic_scope: "design_fact",
+                    });
+                }
+        for (const binding of target.symbolic_method_bindings ?? [])
+            for (const expectation of binding.rule_expectations) {
+                const assertion = requiredAssertion(assertions, binding.assertion_ref, `machine_observer_not_admitted:${target.key}:${binding.method}`);
+                factBoundAssertions.add(assertion.key);
+                if (expectation.proof_surface !== input.check.proof_surface)
+                    fail("unsupported_observer_requires_external_confirmation", `${target.key}:${expectation.obligation_ref}:proof_surface_mismatch`);
+                candidates.push({
+                    obligation_ref: expectation.obligation_ref,
+                    observation_identity: expectation.obligation_ref,
+                    fact_ref: expectation.fact_rule_ref,
+                    assertion,
+                    target_ref: target.target_ref,
+                    method: binding.method,
+                    expected_value_sha256: expectation.expected.sha256,
+                    actual_projection: "raw_exact",
+                    comparison: {
+                        comparator: expectation.comparison.comparator,
+                        mode: expectation.comparison.mode,
+                        parameters_sha256: expectation.comparison.parameters.sha256,
+                        tolerance_sha256: expectation.comparison.tolerance?.sha256 ?? null,
+                        mask_sha256: expectation.comparison.mask?.sha256 ?? null,
+                    },
+                    sensitivity: expectation.observation_sensitivity,
+                    oracle: expectation.oracle,
+                    diagnostic_scope: "design_fact",
+                });
+            }
+    }
+    for (const assertion of assertions.values()) {
+        if (factBoundAssertions.has(assertion.key))
+            continue;
+        const expected = exactAssertionExpected(assertion);
+        const obligationRef = assertionObligationRef(input.outcome_key, input.check.key, assertion.key);
+        candidates.push({
+            obligation_ref: obligationRef,
+            observation_identity: obligationRef,
+            fact_ref: null,
+            assertion,
+            target_ref: input.check.execution_target.target_ref,
+            method: "exact_value",
+            expected_value_sha256: sha256Hex(canonicalValueJson(expected)),
+            actual_projection: assertionActualProjection(assertion),
+            comparison: {
+                comparator: "exact_value",
+                mode: "exact",
+                parameters_sha256: sha256Hex(canonicalValueJson({ comparator: "exact_value" })),
+                tolerance_sha256: null,
+                mask_sha256: null,
+            },
+            sensitivity: "plain",
+            diagnostic_scope: "assertion",
+        });
+    }
+    const rows = candidates.map((candidate) => compileCandidate(input, candidate));
+    assertUniqueRows(rows);
+    return rows.sort((left, right) => canonicalValueJson(left).localeCompare(canonicalValueJson(right)));
+}
+function compileCandidate(input, candidate) {
+    const unimplementedDerivedCapability = candidate.assertion.evidence_capabilities.find((capability) => PROCESS_CAPABILITIES_REQUIRING_A_SEPARATE_PACKAGE_DERIVATION.has(capability));
+    if (unimplementedDerivedCapability)
+        fail("unsupported_observer_requires_external_confirmation", `${candidate.obligation_ref}:${unimplementedDerivedCapability}:package_derivation_required`);
+    if (candidate.oracle && !isJsonPointerExactOracle(candidate.oracle))
+        fail("custom_oracle_machine_completion_forbidden", `${candidate.diagnostic_scope}:${candidate.obligation_ref}:${candidate.oracle.identity ?? "unknown"}`);
+    if (!JSON_POINTER_EXACT_METHODS.includes(candidate.method) ||
+        candidate.comparison.comparator !== "exact_value" ||
+        candidate.comparison.mode !== "exact" ||
+        candidate.comparison.tolerance_sha256 !== null ||
+        candidate.comparison.mask_sha256 !== null ||
+        candidate.sensitivity !== "plain")
+        fail(candidate.diagnostic_scope === "semantic_fact"
+            ? "semantic_fact_machine_observer_not_admitted"
+            : "unsupported_observer_requires_external_confirmation", `${candidate.diagnostic_scope}:${candidate.obligation_ref}:plain_exact_json_required`);
+    const authority = selectAuthority(input, candidate);
+    const carrierRefs = productionCarrierRefs(input);
+    if (authority === "package_static_json_exact") {
+        if (!carrierRefs.length)
+            fail("machine_observer_not_admitted", `${candidate.obligation_ref}:production_binding_carrier_required`);
+        if (carrierRefs.length !== 1)
+            fail("machine_observer_not_admitted", `${candidate.obligation_ref}:static_production_binding_ambiguous`);
+        const staticPaths = carrierRefs[0].carrier_paths;
+        if (staticPaths.length !== 1 || !isExactRepositoryFile(staticPaths[0]))
+            fail("machine_observer_not_admitted", `${candidate.obligation_ref}:static_production_carrier_exact_path_required`);
+    }
+    if (authority === "package_static_json_exact")
+        for (const carrierPath of carrierRefs.flatMap((carrier) => carrier.carrier_paths)) {
+            const carrierRoleIssue = staticObservationCarrierRoleConflict(input, carrierPath);
+            if (carrierRoleIssue)
+                fail("machine_observer_not_admitted", `${candidate.obligation_ref}:${carrierRoleIssue}`);
+        }
+    const comparison = candidate.comparison;
+    const expectedIdentity = sha256Hex(canonicalValueJson({
+        obligation_ref: candidate.obligation_ref,
+        fact_ref: candidate.fact_ref,
+        method: candidate.method,
+        expected_value_sha256: candidate.expected_value_sha256,
+        comparison,
+        actual_projection: candidate.actual_projection,
+        carrier_refs: carrierRefs,
+    }));
+    return {
+        obligation_ref: candidate.obligation_ref,
+        fact_ref: candidate.fact_ref,
+        assertion_ref: candidate.assertion.key,
+        claim_refs: [...candidate.assertion.claims].sort(),
+        target_ref: candidate.target_ref,
+        proof_surface: input.check.proof_surface,
+        method: candidate.method,
+        evidence_capabilities: [
+            ...candidate.assertion.evidence_capabilities,
+        ].sort(),
+        authority,
+        expected_identity: expectedIdentity,
+        expected_value_sha256: candidate.expected_value_sha256,
+        actual_projection: candidate.actual_projection,
+        observation_identity: candidate.observation_identity,
+        comparison,
+        locator_policy: {
+            kind: "fixed_json_pointer",
+            value: observationPointer(candidate.observation_identity),
+        },
+        carrier_refs: carrierRefs,
+        runtime_requirements: runtimeRequirements(input),
+    };
+}
+function selectAuthority(input, candidate) {
+    const target = input.execution_target;
+    if (target.role !== "product")
+        fail("unsupported_observer_requires_external_confirmation", `${candidate.obligation_ref}:product_target_required`);
+    if (input.check.proof_surface === "implementation_structure") {
+        if (!input.check.input_paths.length)
+            fail("machine_observer_not_admitted", `${candidate.obligation_ref}:static_carrier_required`);
+        if (!capabilitiesAdmitted(candidate.assertion.evidence_capabilities, admittedCapabilities(candidate, STATIC_DERIVED_CAPABILITIES)))
+            fail("unsupported_observer_requires_external_confirmation", `${candidate.obligation_ref}:static_capability_not_admitted`);
+        return "package_static_json_exact";
+    }
+    if (target.runtime_family !== "process" ||
+        input.check.proof_surface === "ui_browser" ||
+        input.check.proof_surface === "population_coverage")
+        fail("unsupported_observer_requires_external_confirmation", `${candidate.obligation_ref}:${target.runtime_family}:${input.check.proof_surface}`);
+    if (input.check.runner.type !== "project_binary" ||
+        input.check.execution_target.entrypoint !== "root" ||
+        input.runner.resolved_target !== target.root_entrypoint)
+        fail("process_observer_direct_root_required", `${candidate.obligation_ref}:${input.runner.resolved_target}:${target.root_entrypoint}`);
+    if (!target.root_argv)
+        fail("process_observer_root_invocation_required", candidate.obligation_ref);
+    if (!sameStringArray(input.check.runner.argv, target.root_argv))
+        fail("process_observer_root_argv_mismatch", `${candidate.obligation_ref}:${canonicalValueJson(input.check.runner.argv)}:${canonicalValueJson(target.root_argv)}`);
+    if (!capabilitiesAdmitted(candidate.assertion.evidence_capabilities, admittedCapabilities(candidate, PROCESS_DERIVED_CAPABILITIES)))
+        fail("unsupported_observer_requires_external_confirmation", `${candidate.obligation_ref}:process_capability_not_admitted`);
+    return "package_process_json_exact";
+}
+function runtimeRequirements(input) {
+    return {
+        runtime_family: input.execution_target.runtime_family,
+        target_role: input.execution_target.role,
+        entrypoint: input.check.execution_target.entrypoint,
+        runner_type: input.check.runner.type,
+        resolved_runner_target: input.runner.resolved_target,
+        declared_root_entrypoint: input.execution_target.root_entrypoint,
+        resolved_runner_argv: [...input.runner.argv],
+        declared_root_argv: input.execution_target.root_argv
+            ? [...input.execution_target.root_argv]
+            : null,
+        effect: input.check.runner.effect,
+        direct_root_match: input.check.runner.type === "project_binary" &&
+            input.check.execution_target.entrypoint === "root" &&
+            input.runner.resolved_target === input.execution_target.root_entrypoint &&
+            input.execution_target.root_argv !== undefined &&
+            sameStringArray(input.check.runner.argv, input.execution_target.root_argv),
+    };
+}
+function assertionActualProjection(assertion) {
+    if (assertion.operator === "equals")
+        return "raw_exact";
+    if (assertion.operator === "exists")
+        return "presence_boolean";
+    if (assertion.operator === "truthy")
+        return "truthy_boolean";
+    if (assertion.operator === "falsy")
+        return "falsy_boolean";
+    fail("machine_observer_not_admitted", `${assertion.key}:exact_equals_or_host_boolean_required`);
+}
+function staticObservationCarrierRoleConflict(input, carrierPath) {
+    const expectedAuthorityPatterns = [
+        ...Object.keys(input.runner.frozen_files),
+        ...(input.protected_authority_paths ?? []),
+    ];
+    const evidencePatterns = [
+        ...input.check.expected_output_paths,
+        ...input.check.artifact_globs,
+    ];
+    const conflict = classifyMachineObservationCarrierRoleConflict({
+        carrier_pattern: carrierPath,
+        expected_authority_patterns: expectedAuthorityPatterns,
+        evidence_role_patterns: evidencePatterns,
+    });
+    if (!conflict)
+        return null;
+    return `static_carrier_${conflict}_forbidden`;
+}
+function sameStringArray(left, right) {
+    return (left.length === right.length &&
+        left.every((value, index) => value === right[index]));
+}
+function capabilitiesAdmitted(capabilities, admitted) {
+    return capabilities.every((capability) => admitted.has(capability));
+}
+function admittedCapabilities(candidate, derived) {
+    const admitted = new Set(derived);
+    if (candidate.diagnostic_scope === "semantic_fact")
+        admitted.add("semantic_fact");
+    else if (candidate.diagnostic_scope === "design_fact")
+        admitted.add("design_method");
+    return admitted;
+}
+function productionCarrierRefs(input) {
+    return input.production_bindings
+        .map((scoped) => ({
+        binding_ref: scoped.binding_ref,
+        carrier_paths: scoped.binding.carrier_paths
+            .filter((carrier) => input.check.input_paths.some((inputPath) => classifyRepositoryPatternOverlap(carrier, inputPath).status ===
+            "proven_overlap"))
+            .sort(),
+    }))
+        .filter((binding) => binding.carrier_paths.length)
+        .sort((left, right) => left.binding_ref.localeCompare(right.binding_ref));
+}
+function isExactRepositoryFile(value) {
+    try {
+        normalizeRepositoryFile(value, "static_observation_carrier");
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function exactAssertionExpected(assertion) {
+    if (assertion.operator === "equals")
+        return assertion.expected;
+    if (assertion.operator === "truthy" || assertion.operator === "exists")
+        return true;
+    if (assertion.operator === "falsy")
+        return false;
+    fail("machine_observer_not_admitted", `${assertion.key}:exact_equals_or_host_boolean_required`);
+}
+function requiredAssertion(assertions, assertionRef, diagnostic) {
+    const assertion = assertions.get(assertionRef);
+    if (!assertion)
+        throw new Error(diagnostic);
+    return assertion;
+}
+function assertionObligationRef(outcomeKey, checkKey, assertionKey) {
+    return `assertion.${outcomeKey ?? "GLOBAL"}.${checkKey}.${assertionKey}`;
+}
+function designGroundObligationRef(targetKey, method, conditionKey, factRef) {
+    return `design.${targetKey}.${method}.${conditionKey}.${factRef}`;
+}
+function observationPointer(identity) {
+    return `/observations/${identity.replace(/~/gu, "~0").replace(/\//gu, "~1")}`;
+}
+function assertUniqueRows(rows) {
+    const identities = new Set();
+    for (const row of rows) {
+        const identity = `${row.assertion_ref}\0${row.obligation_ref}\0${row.method}`;
+        if (identities.has(identity))
+            fail("machine_observer_not_admitted", `duplicate:${identity}`);
+        identities.add(identity);
+    }
+}
+function fail(code, detail) {
+    throw new Error(`${code}:${detail}`);
+}

package/dist/lib/long-task-paths.js

@@ -405,7 +405,7 @@ function canonicalRepositoryPath(value, label, kind) {
         throw new Error(`non_canonical_repository_path_dot_segment:${label}:${value}`);
     if (segments.includes(".."))
         throw new Error(`unsafe_path:${label}:${value}`);
-    if (kind !== "pattern" && /[*?\[\]{}()]/u.test(normalized))
+    if (kind !== "pattern" && /[*?\[\]{}]/u.test(normalized))
         throw new Error(`unsupported_repository_path_syntax:${label}:${value}`);
     return normalized;
 }

package/dist/lib/long-task-process-observation.d.ts

@@ -0,0 +1,6 @@
+import type { CompiledObservationAuthorityV2, PackageProcessObservationV1 } from "./long-task-runtime-types.js";
+export declare const PRODUCT_OBSERVATION_SCHEMA_VERSION: "ty-context-product-observation-v1";
+export declare function decodeProductObservationEnvelope(input: {
+    bytes: Uint8Array;
+    authorities: readonly CompiledObservationAuthorityV2[];
+}): PackageProcessObservationV1;