project-tiny-context-harness 0.8.12 → 0.8.13

package/dist/lib/long-task-runner-freeze.js

@@ -1,14 +1,16 @@
 import { readFile, stat } from "node:fs/promises";
 import path from "node:path";
 import { computeRawExecutionIdentity } from "./long-task-check-execution-policy.js";
-import { assertRepositoryPattern, classifyRepositoryPatternOverlap, matchesRepoPattern, normalizeRepositoryFile, } from "./long-task-paths.js";
+import { assertRepositoryPattern, classifyRepositoryPatternOverlap, matchesRepoPattern, normalizeRepositoryFile, proveRepositoryPatternSubset, } from "./long-task-paths.js";
 import { assertProtectedRepositoryFile } from "./long-task-protected-files.js";
 import { nearestRunnerFile, npmCliPath, npxCliPath, } from "./long-task-runner-files.js";
 import { canonicalValueJson, sha256Hex } from "./strict-codec.js";
 import { repoRelative, resolveInsideRepository, } from "./long-task-workspace.js";
 import { evidenceAdapterForRunner } from "./long-task-evidence-adapter-policy.js";
 import { freezeLocalVerifierDependencyClosure, packageScriptVerifierRoots, } from "./long-task-verifier-dependency-closure.js";
-export async function freezeDeliveryCheck(check, outcomeKey, repository, baseline, executionTarget, knownExecutionTargets, designConformanceTargets, semanticFactExpectations, protectedAuthorityPaths = []) {
+import { compileObservationAuthorityPlan } from "./long-task-observation-authority.js";
+import { compileProcessRuntimeClosure } from "./long-task-process-runtime-closure.js";
+export async function freezeDeliveryCheck(check, outcomeKey, repository, baseline, executionTarget, knownExecutionTargets, designConformanceTargets, semanticFactExpectations, productionBindings, productionOwnerPaths, sourceBackedExecutionTarget, protectedAuthorityPaths = []) {
     const prefix = outcomeKey ? `CHECK.${outcomeKey}` : "CHECK.GLOBAL";
     const expectedOutputs = check.expected_output_paths.map((pattern, index) => assertRepositoryPattern(repository, pattern, `${check.key}.expected_output_paths[${index}]`));
     const protectedAuthorityFiles = protectedAuthorityPaths.map((file, index) => normalizeRepositoryFile(file, `${check.key}.protected_authority_paths[${index}]`));
@@ -17,27 +19,54 @@ export async function freezeDeliveryCheck(check, outcomeKey, repository, baselin
         if (!baseline.files.some((file) => matchesRepoPattern(file.path, normalized)) &&
             !protectedAuthorityFiles.some((file) => matchesRepoPattern(file, normalized)) &&
             !expectedOutputs.some((output) => classifyRepositoryPatternOverlap(output, normalized).status ===
-                "proven_overlap"))
+                "proven_overlap") &&
+            !plannedBindingMayProvideInput(productionBindings, normalized))
             throw new Error(`input_path_not_found:${check.key}:${pattern}`);
     }
     check.artifact_globs.forEach((pattern, index) => assertRepositoryPattern(repository, pattern, `${check.key}.artifact_globs[${index}]`));
     const cwd = resolveInsideRepository(repository, check.runner.cwd, `${check.key}.cwd`);
     if (!(await stat(cwd).catch(() => null))?.isDirectory())
         throw new Error(`runner_cwd_not_found:${check.key}:${check.runner.cwd}`);
-    const target = await resolvedRunnerTarget(check, repository, cwd);
-    const verificationInputHashes = await freezeVerificationInputs(check, repository, baseline, cwd, target);
+    const target = await resolvedRunnerTarget(check, repository, cwd, executionTarget, productionBindings, sourceBackedExecutionTarget);
+    const verificationInputHashes = await freezeVerificationInputs(check, repository, baseline, cwd, target, executionTarget);
     validateSemanticFactOracleInputs(check.key, semanticFactExpectations, verificationInputHashes);
+    const runner = await freezeRunner(check, repository, cwd, target, verificationInputHashes);
+    const observationAuthorities = compileObservationAuthorityPlan({
+        check,
+        outcome_key: outcomeKey,
+        runner,
+        execution_target: executionTarget,
+        design_targets: designConformanceTargets,
+        semantic_fact_expectations: semanticFactExpectations,
+        production_bindings: productionBindings,
+        production_owner_paths: productionOwnerPaths,
+        source_backed_execution_target: sourceBackedExecutionTarget,
+        workspace_manifest: baseline,
+        protected_authority_paths: protectedAuthorityPaths,
+    });
+    const processRuntimeClosure = compileProcessRuntimeClosure({
+        check,
+        runner,
+        execution_target: executionTarget,
+        observation_authorities: observationAuthorities,
+        production_bindings: productionBindings,
+        production_owner_paths: productionOwnerPaths,
+        source_backed_execution_target: sourceBackedExecutionTarget,
+        protected_authority_paths: protectedAuthorityPaths,
+    });
     const compiled = {
         ...check,
         internal_id: `${prefix}.${check.key}`,
         outcome_key: outcomeKey,
         evidence_adapter: evidenceAdapterForRunner(check.runner.type),
-        runner: await freezeRunner(check, repository, cwd, target, verificationInputHashes),
+        runner,
         verification_input_hashes: verificationInputHashes,
         execution_target_definition: executionTarget,
         known_execution_targets: knownExecutionTargets,
         design_conformance_targets: designConformanceTargets,
         semantic_fact_expectations: semanticFactExpectations,
+        observation_authorities: observationAuthorities,
+        process_runtime_closure: processRuntimeClosure,
     };
     return {
         ...compiled,
@@ -56,7 +85,7 @@ function validateSemanticFactOracleInputs(checkKey, expectations, verificationIn
             throw new Error(`semantic_fact_oracle_verification_input_mismatch:${checkKey}:${oracle.key}:${oracle.identity}`);
     }
 }
-async function resolvedRunnerTarget(check, repository, cwd) {
+async function resolvedRunnerTarget(check, repository, cwd, executionTarget, productionBindings, sourceBackedExecutionTarget) {
     if (check.runner.type === "package_script") {
         const packageFile = await nearestRunnerFile(cwd, repository, "package.json");
         if (!packageFile)
@@ -64,12 +93,50 @@ async function resolvedRunnerTarget(check, repository, cwd) {
         return assertProtectedRepositoryFile(repository, packageFile, `${check.key}.package_json`);
     }
     const target = resolveInsideRepository(cwd, check.runner.target, `${check.key}.target`);
-    if (!(await stat(target).catch(() => null))?.isFile())
+    const targetInfo = await stat(target).catch(() => null);
+    if (!targetInfo?.isFile()) {
+        const relativeTarget = repoRelative(repository, target);
+        if (!targetInfo &&
+            plannedDirectProductRoot({
+                check,
+                executionTarget,
+                productionBindings,
+                sourceBackedExecutionTarget,
+                relativeTarget,
+            }))
+            return target;
         throw new Error(`${check.runner.type}_path_not_found:${check.key}:${check.runner.target}`);
+    }
     const protectedTarget = await assertProtectedRepositoryFile(repository, target, `${check.key}.runner_target`);
     repoRelative(repository, protectedTarget);
     return protectedTarget;
 }
+function plannedBindingMayProvideInput(bindings, inputPattern) {
+    return bindings.some((scoped) => scoped.binding.existence === "planned" &&
+        scoped.binding.carrier_paths.some((carrier) => isExactRepositoryFile(carrier, `${scoped.binding_ref}.carrier`) &&
+            proveRepositoryPatternSubset(carrier, inputPattern).status ===
+                "proven_subset"));
+}
+function plannedDirectProductRoot(input) {
+    return (input.check.runner.type === "project_binary" &&
+        input.check.execution_target.entrypoint === "root" &&
+        input.executionTarget.role === "product" &&
+        input.executionTarget.runtime_family === "process" &&
+        input.sourceBackedExecutionTarget?.target_ref ===
+            input.executionTarget.key &&
+        input.relativeTarget === input.executionTarget.root_entrypoint &&
+        input.productionBindings.some((scoped) => scoped.binding.existence === "planned" &&
+            scoped.binding.carrier_paths.some((carrier) => isExactRepositoryFile(carrier, `${scoped.binding_ref}.carrier`) &&
+                carrier === input.relativeTarget)));
+}
+function isExactRepositoryFile(value, label) {
+    try {
+        return normalizeRepositoryFile(value, label) === value;
+    }
+    catch {
+        return false;
+    }
+}
 async function freezeRunner(check, repository, cwd, target, verificationInputHashes) {
     const runner = check.runner;
     if (runner.argv.some((value) => value.includes("\0")))
@@ -137,7 +204,7 @@ async function freezeRunner(check, repository, cwd, target, verificationInputHas
         })),
     };
 }
-async function freezeVerificationInputs(check, repository, manifest, cwd, target) {
+async function freezeVerificationInputs(check, repository, manifest, cwd, target, executionTarget) {
     const result = {};
     for (const [index, source] of check.verification_inputs.entries()) {
         const pattern = assertRepositoryPattern(repository, source, `${check.key}.verification_inputs[${index}]`);
@@ -149,31 +216,42 @@ async function freezeVerificationInputs(check, repository, manifest, cwd, target
             result[file.path] = sha256Hex(await readFile(protectedFile));
         }
     }
-    const automatic = new Set([repoRelative(repository, target)]);
-    const packageFile = await nearestRunnerFile(cwd, repository, "package.json");
-    if (packageFile)
-        automatic.add(repoRelative(repository, packageFile));
-    for (const name of [
-        "package-lock.json",
-        "npm-shrinkwrap.json",
-        "pnpm-lock.yaml",
-        "yarn.lock",
-    ]) {
-        const file = await nearestRunnerFile(cwd, repository, name);
-        if (file)
-            automatic.add(repoRelative(repository, file));
-    }
-    if (check.runner.type === "playwright_test")
+    const directProductRoot = check.runner.type === "project_binary" &&
+        executionTarget.role === "product" &&
+        executionTarget.runtime_family === "process" &&
+        check.execution_target.entrypoint === "root";
+    const automatic = new Set(directProductRoot ? [] : [repoRelative(repository, target)]);
+    if (!directProductRoot) {
+        const packageFile = await nearestRunnerFile(cwd, repository, "package.json");
+        if (packageFile)
+            automatic.add(repoRelative(repository, packageFile));
         for (const name of [
-            "playwright.config.ts",
-            "playwright.config.js",
-            "playwright.config.mjs",
-            "playwright.config.cjs",
+            "package-lock.json",
+            "npm-shrinkwrap.json",
+            "pnpm-lock.yaml",
+            "yarn.lock",
         ]) {
             const file = await nearestRunnerFile(cwd, repository, name);
             if (file)
                 automatic.add(repoRelative(repository, file));
         }
+    }
+    if (check.runner.type === "playwright_test")
+        if (playwrightConfigArgument(check.runner.argv)) {
+            const file = resolveInsideRepository(cwd, playwrightConfigArgument(check.runner.argv), `${check.key}.playwright_config`);
+            automatic.add(repoRelative(repository, file));
+        }
+        else
+            for (const name of [
+                "playwright.config.ts",
+                "playwright.config.js",
+                "playwright.config.mjs",
+                "playwright.config.cjs",
+            ]) {
+                const file = await nearestRunnerFile(cwd, repository, name);
+                if (file)
+                    automatic.add(repoRelative(repository, file));
+            }
     for (const relative of automatic) {
         const file = manifest.files.find((candidate) => candidate.path === relative);
         if (!file)
@@ -198,6 +276,28 @@ async function freezeVerificationInputs(check, repository, manifest, cwd, target
     ]));
     return sortRecord(result);
 }
+export function playwrightConfigArgument(argv) {
+    const values = [];
+    for (let index = 0; index < argv.length; index += 1) {
+        const value = argv[index];
+        if (value === "--config") {
+            const next = argv[index + 1];
+            if (!next || next.startsWith("-"))
+                throw new Error("playwright_config_argument_missing");
+            values.push(next);
+            index += 1;
+        }
+        else if (value.startsWith("--config=")) {
+            const config = value.slice("--config=".length);
+            if (!config)
+                throw new Error("playwright_config_argument_missing");
+            values.push(config);
+        }
+    }
+    if (values.length > 1)
+        throw new Error("playwright_config_argument_ambiguous");
+    return values[0] ?? null;
+}
 function sortRecord(value) {
     return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)));
 }

package/dist/lib/long-task-runtime-types.d.ts

@@ -8,6 +8,7 @@ import type { EffectiveRiskLevel, RiskFactName } from "./long-task-risk-types.js
 import type { SemanticFactExpectationV2 } from "./semantic-fact-types.js";
 import type { CompiledSourceItemV2 } from "./long-task-source-authority-types.js";
 import type { WorkspaceManifestV2 } from "./long-task-workspace-runtime-types.js";
+import type { JsonPointerExactObservation } from "./long-task-json-pointer-observation.js";
 export interface FrozenRunnerV2 extends DeliveryRunnerV2 {
     executable: string;
     executable_argv_prefix: string[];
@@ -18,6 +19,74 @@ export interface FrozenRunnerV2 extends DeliveryRunnerV2 {
     package_script: string | null;
     execution_identity: string;
 }
+export type CompiledObservationAuthorityKindV2 = "package_static_json_exact" | "package_process_json_exact" | "external_confirmation";
+export type CompiledObservationActualProjectionV2 = "raw_exact" | "presence_boolean" | "truthy_boolean" | "falsy_boolean";
+export interface CompiledObservationAuthorityV2 {
+    obligation_ref: string;
+    fact_ref: string | null;
+    assertion_ref: string;
+    claim_refs: string[];
+    target_ref: string;
+    proof_surface: ProofSurface;
+    method: string;
+    evidence_capabilities: EvidenceCapabilityV2[];
+    authority: CompiledObservationAuthorityKindV2;
+    expected_identity: string;
+    expected_value_sha256: string;
+    actual_projection: CompiledObservationActualProjectionV2;
+    observation_identity: string;
+    comparison: {
+        comparator: string;
+        mode: string;
+        parameters_sha256: string | null;
+        tolerance_sha256: string | null;
+        mask_sha256: string | null;
+    };
+    locator_policy: {
+        kind: "fixed_json_pointer";
+        value: string;
+    };
+    carrier_refs: Array<{
+        binding_ref: string;
+        carrier_paths: string[];
+    }>;
+    runtime_requirements: {
+        runtime_family: ExecutionTargetV2["runtime_family"];
+        target_role: ExecutionTargetV2["role"];
+        entrypoint: DeliveryCheckV2["execution_target"]["entrypoint"];
+        runner_type: DeliveryRunnerV2["type"];
+        resolved_runner_target: string;
+        declared_root_entrypoint: string;
+        resolved_runner_argv: string[];
+        declared_root_argv: string[] | null;
+        effect: DeliveryRunnerV2["effect"];
+        direct_root_match: boolean;
+    };
+}
+export interface SourceBackedExecutionTargetV2 {
+    target_ref: string;
+    canonical_target_ref: string;
+    source_claim_key: string;
+    source_item_key: string;
+    source_path: string;
+    source_text_sha256: string;
+    target_identity: string;
+}
+export interface CompiledProcessRuntimeClosureV2 {
+    target_ref: string;
+    source_target: SourceBackedExecutionTargetV2;
+    root_target: string;
+    root_argv_files: string[];
+    production_carrier_files: string[];
+    allowed_runtime_files: string[];
+    production_binding_refs: string[];
+    forbidden_role_matches: Array<{
+        path: string;
+        role: "expected_authority" | "verification" | "evidence";
+        pattern: string;
+    }>;
+    closure_identity: string;
+}
 export interface CompiledCheckV2 extends Omit<DeliveryCheckV2, "runner"> {
     internal_id: string;
     outcome_key: string | null;
@@ -29,6 +98,8 @@ export interface CompiledCheckV2 extends Omit<DeliveryCheckV2, "runner"> {
     known_execution_targets: ExecutionTargetV2[];
     design_conformance_targets: CompiledDesignTargetV2[];
     semantic_fact_expectations: SemanticFactExpectationV2[];
+    observation_authorities: CompiledObservationAuthorityV2[];
+    process_runtime_closure: CompiledProcessRuntimeClosureV2 | null;
 }
 export interface ProductClaimV2 {
     id: string;
@@ -160,6 +231,46 @@ export interface RawCommandExecutionV2 {
     attempts: number;
     duration_ms: number;
     error: string | null;
+    package_observations?: PackageObservationValueV2[];
+    host_execution_attestation?: HostExecutionAttestationV2 | null;
+}
+export interface PackageObservationValueV2 {
+    authority: Exclude<CompiledObservationAuthorityKindV2, "external_confirmation">;
+    observation_identity: string;
+    assertion_ref: string;
+    obligation_ref: string;
+    method: string;
+    raw_value: unknown;
+    observation: JsonPointerExactObservation | null;
+    reason: string | null;
+}
+export interface PackageProcessObservationV1 {
+    schema_version: "ty-context-product-observation-v1";
+    artifact_sha256: string;
+    observations: Record<string, unknown>;
+    value_sha256_by_identity: Record<string, string>;
+    package_observations: PackageObservationValueV2[];
+}
+export interface HostExecutionAttestationV2 {
+    raw_execution_identity: string;
+    executable_path: string;
+    declared_root_entrypoint: string;
+    actual_argv: string[];
+    declared_root_argv: string[];
+    direct_root_match: boolean;
+    pid: number;
+    started_at: string;
+    completed_at: string;
+    exit_code: number;
+    snapshot_sha256: string;
+    observation_execution_nonce: string;
+    observation_artifact_sha256: string;
+    process_runtime_closure_identity: string;
+}
+export interface CheckRunnerExecutionContextV2 {
+    snapshot_sha256?: string;
+    observation_authorities?: readonly CompiledObservationAuthorityV2[];
+    process_runtime_closure_identity?: string;
 }
 export interface CheckExecutionResultV2 {
     internal_id: string;

package/dist/lib/long-task-scoped-binding.d.ts

@@ -0,0 +1,13 @@
+import type { DeliveryBindingV2 } from "./long-task-delivery-types.js";
+/**
+ * Ephemeral compiler identity for one authored Outcome-local Binding.
+ * Authored Contracts keep their existing local Binding keys.
+ */
+export interface ScopedDeliveryBindingV2 {
+    outcome_key: string;
+    local_key: string;
+    binding_ref: string;
+    binding: DeliveryBindingV2;
+}
+export declare function scopeDeliveryBinding(outcomeKey: string, binding: DeliveryBindingV2): ScopedDeliveryBindingV2;
+export declare function scopeDeliveryBindings(outcomeKey: string, bindings: readonly DeliveryBindingV2[]): ScopedDeliveryBindingV2[];

package/dist/lib/long-task-scoped-binding.js

@@ -0,0 +1,11 @@
+export function scopeDeliveryBinding(outcomeKey, binding) {
+    return {
+        outcome_key: outcomeKey,
+        local_key: binding.key,
+        binding_ref: `${outcomeKey}.${binding.key}`,
+        binding,
+    };
+}
+export function scopeDeliveryBindings(outcomeKey, bindings) {
+    return bindings.map((binding) => scopeDeliveryBinding(outcomeKey, binding));
+}

package/dist/lib/long-task-semantic-contract-types.d.ts

@@ -22,6 +22,7 @@ export interface ExecutionTargetV2 {
     role: "product" | "support" | "observer";
     runtime_family: ExecutionTargetRuntimeFamilyV2;
     root_entrypoint: string;
+    root_argv?: string[];
     capabilities: ExecutionTargetCapabilityV2[];
 }
 export interface DeliveryStageV2 {

package/dist/lib/long-task-semantic-fact-contract-closure.js

@@ -19,9 +19,9 @@ export function validateSemanticFactContractProjection(contract, manifest, index
             assertSameSemanticFactClosureSet(bindings.proofs.map((item) => revisionPair(item.proof_ref, item.obligation_revision_digest, `contract_obligation_revision:${outcome.key}`)), proofs.map((item) => revisionPair(item.key, obligationRevisions.get(item.key), `source_obligation_revision:${outcome.key}`)), `contract_obligation_revision_set:${outcome.key}`);
         }
         assertSameSemanticFactClosureSet(bindings.proofs.map((item) => item.proof_ref), proofs.map((item) => item.key), `contract_proof_set:${outcome.key}`);
-        uniqueSemanticFactClosureValues(bindings.proofs.map((item) => item.authority === "machine"
-            ? `${item.check_ref}\0${item.assertion_ref}`
-            : `external\0${item.confirmation_ref}`), `contract_proof_target:${outcome.key}`);
+        uniqueSemanticFactClosureValues(bindings.proofs
+            .filter((item) => item.authority === "machine")
+            .map((item) => `${item.check_ref}\0${item.assertion_ref}`), `contract_proof_target:${outcome.key}`);
         validateSemanticFactOutcomeBindings(outcome, manifest, index, allFactBindings, factRevisions, revisionsRequired);
         validateSemanticFactProofBindings(contract, outcome, manifest, index, targetByRef, expectations, allProofBindings, factRevisions, obligationRevisions, revisionsRequired);
     }

package/dist/lib/long-task-semantic-fact-evidence.d.ts

@@ -3,7 +3,7 @@ type SemanticRecord = Extract<EvidenceCapabilityRecordV2, {
     capability: "semantic_fact";
 }>;
 export declare function validateSemanticFactEvidence(check: CompiledCheckV2, record: SemanticRecord, artifactHashes: Record<string, string>): string | null;
-export declare function semanticFactComparisonResultIdentity(value: {
+type SemanticFactExactComparisonMaterial = {
     fact_ref: string;
     proof_ref: string;
     fact_key?: string;
@@ -18,8 +18,8 @@ export declare function semanticFactComparisonResultIdentity(value: {
     parameters_sha256: string;
     tolerance_sha256: string | null;
     mask_sha256: string | null;
-    passed: boolean;
-}): string;
+};
+export declare function semanticFactComparisonResultIdentity(value: SemanticFactExactComparisonMaterial): string;
 export declare function validateDistinctSemanticFactEvidence(records: EvidenceCapabilityRecordV2[]): string | null;
 export declare const typed_semantic_fact_runtime_evidence = "obligation_key+obligation_revision_digest->fact_key+fact_revision_digest+actual+comparison+verdict+oracle+environment";
 export {};

package/dist/lib/long-task-semantic-fact-evidence.js

@@ -1,4 +1,5 @@
-import { canonicalValueJson, sha256Hex } from "./strict-codec.js";
+import { evaluateExactDigestComparison, } from "./long-task-exact-comparison.js";
+import { canonicalValueJson } from "./strict-codec.js";
 export function validateSemanticFactEvidence(check, record, artifactHashes) {
     const expectations = check.semantic_fact_expectations.filter((item) => item.assertion_ref === record.assertion_key);
     if (expectations.length !== 1)
@@ -15,8 +16,6 @@ export function validateSemanticFactEvidence(check, record, artifactHashes) {
     const observerError = validateSemanticFactObservers(record, expected, artifactHashes);
     if (observerError)
         return observerError;
-    if (record.verdict !== "passed" || record.comparison.passed !== true)
-        return "semantic_fact_failed";
     return null;
 }
 function validateSemanticFactEvidenceAuthority(check, record, expected) {
@@ -34,28 +33,9 @@ function validateSemanticFactEvidenceAuthority(check, record, expected) {
         return "semantic_fact_expected_value_mismatch";
     if (!sameSemanticFactComparisonAuthority(record, expected))
         return "semantic_fact_comparison_authority_mismatch";
-    if (record.comparison.result_sha256 !==
-        semanticFactComparisonResultIdentity({
-            fact_ref: record.fact_ref,
-            proof_ref: record.proof_ref,
-            fact_key: record.fact_key,
-            fact_revision_digest: record.fact_revision_digest,
-            obligation_key: record.obligation_key,
-            obligation_revision_digest: record.obligation_revision_digest,
-            target_ref: record.target_ref,
-            actual_value_sha256: record.actual_observation.value_sha256,
-            expected_value_sha256: expected.expected.sha256,
-            comparator: record.comparison.comparator,
-            mode: record.comparison.mode,
-            parameters_sha256: record.comparison.parameters.sha256,
-            tolerance_sha256: record.comparison.tolerance?.sha256 ?? null,
-            mask_sha256: record.comparison.mask?.sha256 ?? null,
-            passed: record.comparison.passed,
-        }))
-        return "semantic_fact_comparison_result_identity_mismatch";
-    if (record.comparison.comparator === "exact_value" &&
-        record.actual_observation.value_sha256 !== expected.expected.sha256)
-        return "semantic_fact_exact_value_mismatch";
+    const exactError = validateSemanticFactExactComparison(record, expected);
+    if (exactError)
+        return exactError;
     if (canonicalValueJson(record.oracle) !== canonicalValueJson(expected.oracle) ||
         canonicalValueJson(record.environment) !==
             canonicalValueJson(expected.environment))
@@ -93,7 +73,11 @@ function validSemanticFactRedaction(sensitivity, redaction) {
         (sensitivity === "protected" && redaction !== null));
 }
 function sameSemanticFactComparisonAuthority(record, expected) {
-    return (record.comparison.comparator === expected.comparison.comparator &&
+    return (expected.comparison.comparator === "exact_value" &&
+        expected.comparison.mode === "exact" &&
+        expected.comparison.tolerance === null &&
+        expected.comparison.mask === null &&
+        record.comparison.comparator === expected.comparison.comparator &&
         record.comparison.mode === expected.comparison.mode &&
         canonicalValueJson(record.comparison.parameters) ===
             canonicalValueJson(expected.comparison.parameters) &&
@@ -102,6 +86,17 @@ function sameSemanticFactComparisonAuthority(record, expected) {
         canonicalValueJson(record.comparison.mask) ===
             canonicalValueJson(expected.comparison.mask));
 }
+function validateSemanticFactExactComparison(record, expected) {
+    const recomputed = evaluateSemanticFactExactComparison(expected, record.target_ref, record.actual_observation.value_sha256);
+    if (!recomputed.passed)
+        return "semantic_fact_exact_value_mismatch";
+    if (record.comparison.passed !== recomputed.passed ||
+        record.verdict !== semanticFactVerdict(recomputed.passed))
+        return "project_submitted_verdict_disagrees_with_harness";
+    return record.comparison.result_sha256 === recomputed.result_sha256
+        ? null
+        : "semantic_fact_comparison_result_identity_mismatch";
+}
 function validateSemanticFactArtifacts(record, expected, artifactHashes) {
     if (artifactHashes[record.actual_observation.artifact_path] !==
         record.actual_observation.artifact_sha256)
@@ -129,52 +124,74 @@ function validateSemanticFactObservers(record, expected, artifactHashes) {
         observerObservations.add(observation);
         if (artifactHashes[observer.artifact_path] !== observer.artifact_sha256)
             return "semantic_fact_observer_artifact_mismatch";
-        if (observer.passed !== true ||
-            (record.comparison.comparator === "exact_value" &&
-                observer.value_sha256 !== expected.expected.sha256))
+        const recomputed = evaluateSemanticFactExactComparison(expected, observer.target_ref, observer.value_sha256);
+        if (!recomputed.passed)
             return "semantic_fact_observer_failed";
-        if (observer.comparison_result_sha256 !==
-            semanticFactComparisonResultIdentity({
-                fact_ref: record.fact_ref,
-                proof_ref: record.proof_ref,
-                fact_key: record.fact_key,
-                fact_revision_digest: record.fact_revision_digest,
-                obligation_key: record.obligation_key,
-                obligation_revision_digest: record.obligation_revision_digest,
-                target_ref: observer.target_ref,
-                actual_value_sha256: observer.value_sha256,
-                expected_value_sha256: expected.expected.sha256,
-                comparator: record.comparison.comparator,
-                mode: record.comparison.mode,
-                parameters_sha256: record.comparison.parameters.sha256,
-                tolerance_sha256: record.comparison.tolerance?.sha256 ?? null,
-                mask_sha256: record.comparison.mask?.sha256 ?? null,
-                passed: observer.passed,
-            }))
+        if (observer.passed !== recomputed.passed)
+            return "project_submitted_verdict_disagrees_with_harness";
+        if (observer.comparison_result_sha256 !== recomputed.result_sha256)
             return "semantic_fact_observer_comparison_identity_mismatch";
     }
     return null;
 }
 export function semanticFactComparisonResultIdentity(value) {
+    return evaluateSemanticFactExactComparisonMaterial(value).result_sha256;
+}
+function evaluateSemanticFactExactComparison(expected, targetRef, actualValueSha256) {
+    return evaluateSemanticFactExactComparisonMaterial({
+        fact_ref: expected.fact_ref,
+        proof_ref: expected.proof_ref,
+        fact_key: expected.fact_key,
+        fact_revision_digest: expected.fact_revision_digest,
+        obligation_key: expected.obligation_key,
+        obligation_revision_digest: expected.obligation_revision_digest,
+        target_ref: targetRef,
+        actual_value_sha256: actualValueSha256,
+        expected_value_sha256: expected.expected.sha256,
+        comparator: expected.comparison.comparator,
+        mode: expected.comparison.mode,
+        parameters_sha256: expected.comparison.parameters.sha256,
+        tolerance_sha256: expected.comparison.tolerance?.sha256 ?? null,
+        mask_sha256: expected.comparison.mask?.sha256 ?? null,
+    });
+}
+function evaluateSemanticFactExactComparisonMaterial(value) {
+    return evaluateExactDigestComparison({
+        identity: semanticFactComparisonIdentity(value),
+        actual_value_sha256: value.actual_value_sha256,
+        expected_value_sha256: value.expected_value_sha256,
+        comparator: value.comparator,
+        mode: value.mode,
+        parameters_sha256: value.parameters_sha256,
+        tolerance_sha256: value.tolerance_sha256,
+        mask_sha256: value.mask_sha256,
+    });
+}
+function semanticFactComparisonIdentity(value) {
     const revisionIdentityPresent = value.fact_key !== undefined ||
         value.fact_revision_digest !== undefined ||
         value.obligation_key !== undefined ||
         value.obligation_revision_digest !== undefined;
-    return sha256Hex(canonicalValueJson(revisionIdentityPresent
-        ? value
+    return revisionIdentityPresent
+        ? {
+            kind: "semantic_fact_non_ui",
+            fact_ref: value.fact_ref,
+            proof_ref: value.proof_ref,
+            fact_key: value.fact_key,
+            fact_revision_digest: value.fact_revision_digest,
+            obligation_key: value.obligation_key,
+            obligation_revision_digest: value.obligation_revision_digest,
+            target_ref: value.target_ref,
+        }
         : {
+            kind: "semantic_fact_non_ui",
             fact_ref: value.fact_ref,
             proof_ref: value.proof_ref,
             target_ref: value.target_ref,
-            actual_value_sha256: value.actual_value_sha256,
-            expected_value_sha256: value.expected_value_sha256,
-            comparator: value.comparator,
-            mode: value.mode,
-            parameters_sha256: value.parameters_sha256,
-            tolerance_sha256: value.tolerance_sha256,
-            mask_sha256: value.mask_sha256,
-            passed: value.passed,
-        }));
+        };
+}
+function semanticFactVerdict(passed) {
+    return passed ? "passed" : "failed";
 }
 export function validateDistinctSemanticFactEvidence(records) {
     const observations = new Set();

package/dist/lib/long-task-source-claim-validation.js

@@ -1,11 +1,13 @@
 import { resolveAcceptanceAssertion } from "./long-task-acceptance-reference.js";
 import { fail } from "./long-task-delivery-shape.js";
+import { executionTargetSourceTargetRef } from "./long-task-source-target-index.js";
 export function validateSourceClaimMappings(contract, compiledClaims, report) {
     validateSourcePresence(contract, report);
     const sources = new Set(contract.task.source_paths);
     const productClaims = new Set(Object.values(compiledClaims.by_outcome)
         .flat()
         .map((claim) => claim.id));
+    const executionTargetClaims = new Set(contract.task.execution_targets.map((target) => executionTargetSourceTargetRef(target.key)));
     const globalClaims = new Map(compiledClaims.by_global.map((claim) => [claim.local_key, claim]));
     const coveredGlobalClaims = new Set(Object.entries(compiledClaims.summary.claims_by_global)
         .filter(([, value]) => value.covered)
@@ -22,7 +24,8 @@ export function validateSourceClaimMappings(contract, compiledClaims, report) {
             for (const reference of disposition.refs) {
                 if (reference.endsWith(".result"))
                     issue(report, "source_claim_result_overcompression", `${claim.key}:${reference}`);
-                if (!productClaims.has(reference))
+                if (!productClaims.has(reference) &&
+                    !executionTargetClaims.has(reference))
                     issue(report, "source_claim_product_ref_unknown", `${claim.key}:${reference}`);
             }
         if (disposition.type === "acceptance") {