project-tiny-context-harness 0.8.16 → 0.11.0

package/dist/lib/long-task-finalization-identity.js

@@ -0,0 +1,58 @@
+import { captureStoredExternalConfirmationArtifactIdentities } from "./long-task-external-confirmation-artifacts.js";
+import { captureStoredExternalConfirmationChallengeIdentities } from "./long-task-external-confirmation-challenge.js";
+import { readStoredExternalConfirmationRecord } from "./long-task-external-confirmation-state.js";
+import { captureStoredExternalConfirmationRecordIdentities } from "./long-task-external-confirmation-state.js";
+import { captureProtectedAuthorityInputsIdentity } from "./long-task-freshness.js";
+import { canonicalValueJson, sha256Hex } from "./strict-codec.js";
+export async function captureFinalizationIdentity(input) {
+    const confirmationRefs = input.compiled.global.acceptance.external_confirmations
+        .map((confirmation) => confirmation.key)
+        .sort();
+    const [protectedAuthorityInputs, externalRecords, externalChallenges, externalArtifacts,] = await Promise.all([
+        captureProtectedAuthorityInputsIdentity(input.compiled),
+        captureStoredExternalConfirmationRecordIdentities(input.repository, input.compiled.workdir, confirmationRefs),
+        captureStoredExternalConfirmationChallengeIdentities(input.repository, input.compiled.workdir, confirmationRefs),
+        captureExternalArtifactIdentities(input.repository, input.compiled.workdir, confirmationRefs),
+    ]);
+    return {
+        active_authority_identity: input.active.active_authority_identity,
+        authority_revision: input.active.authority_revision,
+        verifier_identity_sha256: input.compiled.verifier_identity.bundle_sha256,
+        candidate: {
+            git_head: input.candidate.git_head,
+            git_tree: input.candidate.git_tree,
+            workspace_fingerprint: typeof input.workspace_fingerprint === "string"
+                ? input.workspace_fingerprint
+                : input.workspace_fingerprint.identity,
+        },
+        compiled_identity: input.compiled.compiled_identity,
+        raw_contract_sha256: protectedAuthorityInputs.snapshot.raw_contract_sha256,
+        protected_authority_inputs_identity: protectedAuthorityInputs.identity,
+        external_records: externalRecords,
+        external_challenges: externalChallenges,
+        external_artifacts: externalArtifacts,
+    };
+}
+export function finalizationIdentityDigest(identity) {
+    return sha256Hex(canonicalValueJson(identity));
+}
+async function captureExternalArtifactIdentities(repository, workdir, confirmationRefs) {
+    const result = {};
+    for (const confirmationRef of confirmationRefs) {
+        const stored = await readStoredExternalConfirmationRecord(repository, workdir, confirmationRef);
+        if (stored.error)
+            throw new Error(`finalization_external_record_invalid:${confirmationRef}:${stored.error}`);
+        if (!stored.record ||
+            stored.record.schema_version !==
+                "long-task-external-confirmation-record-v2")
+            continue;
+        const identities = await captureStoredExternalConfirmationArtifactIdentities(repository, workdir, stored.record.artifact_snapshots);
+        for (const [storeRef, identity] of Object.entries(identities)) {
+            const previous = result[storeRef];
+            if (previous && previous !== identity)
+                throw new Error(`finalization_external_artifact_identity_conflict:${storeRef}`);
+            result[storeRef] = identity;
+        }
+    }
+    return Object.fromEntries(Object.entries(result).sort(([left], [right]) => left.localeCompare(right)));
+}

package/dist/lib/long-task-finding-context.d.ts

@@ -1,3 +1,3 @@
 import type { CheckExecutionResultV2, CompiledDeliveryContractV2, LongTaskFindingV2 } from "./long-task-delivery-types.js";
 export declare function enrichCheckResultFindings(compiled: CompiledDeliveryContractV2, result: CheckExecutionResultV2): CheckExecutionResultV2;
-export declare function enrichFinding(compiled: CompiledDeliveryContractV2, finding: LongTaskFindingV2): LongTaskFindingV2;
+export declare function enrichFinding(compiled: CompiledDeliveryContractV2, finding: LongTaskFindingV2, result?: CheckExecutionResultV2): LongTaskFindingV2;

package/dist/lib/long-task-finding-context.js

@@ -1,29 +1,155 @@
 import { resolveAcceptanceAssertion } from "./long-task-acceptance-reference.js";
+import { deriveMaterialSourceFragments } from "./long-task-source-fragments.js";
 export function enrichCheckResultFindings(compiled, result) {
     return {
         ...result,
-        findings: result.findings.map((finding) => enrichFinding(compiled, finding)),
+        findings: result.findings.map((finding) => enrichFinding(compiled, finding, result)),
     };
 }
-export function enrichFinding(compiled, finding) {
+export function enrichFinding(compiled, finding, result) {
+    const context = resolveFindingContext(compiled, finding);
+    const { check, outcome, sourceClaims, sourceTargets } = context;
+    const { authorities, expectations } = context;
+    const factRefs = unique([
+        ...(finding.fact_refs ?? []),
+        ...authorities.flatMap((authority) => authority.fact_ref ? [authority.fact_ref] : []),
+        ...expectations.map((expectation) => expectation.fact_ref),
+    ]);
+    const proofRefs = unique([
+        ...(finding.proof_obligation_refs ?? []),
+        ...authorities.map((authority) => authority.obligation_ref),
+        ...expectations.map((expectation) => expectation.proof_ref),
+    ]);
+    const expectedAuthorityRefs = unique([
+        ...(finding.expected_authority_refs ?? []),
+        ...(finding.assertion_key &&
+            check?.expected_authority_refs[finding.assertion_key]
+            ? [check.expected_authority_refs[finding.assertion_key]]
+            : []),
+    ]);
+    const actualEvidenceRefs = unique([
+        ...(finding.actual_evidence_refs ?? []),
+        ...(result ? [`execution:${result.execution_identity}`] : []),
+        ...Object.keys(result?.artifact_hashes ?? {}).map((artifact) => `artifact:${artifact}`),
+    ]);
+    const sourceFragmentRefs = unique([
+        ...(finding.source_fragment_refs ?? []),
+        ...fragmentsForSourceClaims(compiled, sourceClaims),
+    ]);
+    const rerunObligationRefs = unique([
+        ...(finding.rerun_obligation_refs ?? []),
+        ...proofRefs,
+        ...authorities.map((authority) => authority.obligation_ref),
+        ...normalizedClaimRefs(finding),
+    ]);
+    const enriched = {
+        ...finding,
+        invalidation_reasons: unique([
+            ...(finding.invalidation_reasons ?? []),
+            finding.code,
+        ]),
+    };
+    applyFindingReferences(enriched, {
+        sourceClaims,
+        sourceTargets,
+        sourceFragmentRefs,
+        factRefs,
+        proofRefs,
+        expectedAuthorityRefs,
+        actualEvidenceRefs,
+        rerunObligationRefs,
+    });
+    applyFindingOwners(enriched, outcome, check);
+    return enriched;
+}
+function resolveFindingContext(compiled, finding) {
     const outcome = finding.outcome_key
-        ? compiled.outcomes.find((item) => item.key === finding.outcome_key)
+        ? (compiled.outcomes.find((item) => item.key === finding.outcome_key) ??
+            null)
         : null;
     const sourceClaims = sourceClaimsForFinding(compiled, finding);
-    const sourceTargets = compiled.source_claims
+    const sourceTargets = unique(compiled.source_claims
         .filter((source) => sourceClaims.includes(source.key))
-        .flatMap((source) => dispositionTargetRefs(source.disposition))
-        .filter((reference, index, all) => all.indexOf(reference) === index)
-        .sort();
+        .flatMap((source) => dispositionTargetRefs(source.disposition)));
+    const check = finding.check_key
+        ? (allChecks(compiled).find((item) => item.outcome_key === finding.outcome_key &&
+            item.key === finding.check_key) ?? null)
+        : null;
+    const authorities = check
+        ? check.observation_authorities.filter((authority) => !finding.assertion_key ||
+            authority.assertion_ref === finding.assertion_key)
+        : [];
+    const expectations = check
+        ? check.semantic_fact_expectations.filter((expectation) => !finding.assertion_key ||
+            expectation.assertion_ref === finding.assertion_key)
+        : [];
     return {
-        ...finding,
-        ...(sourceClaims.length ? { source_claim_keys: sourceClaims } : {}),
-        ...(sourceTargets.length ? { source_target_refs: sourceTargets } : {}),
-        ...(outcome && !finding.owner_paths
-            ? { owner_paths: outcome.product.owner.path_globs }
-            : {}),
+        outcome,
+        check,
+        sourceClaims,
+        sourceTargets,
+        authorities,
+        expectations,
     };
 }
+function applyFindingReferences(finding, refs) {
+    if (refs.sourceClaims.length)
+        finding.source_claim_keys = refs.sourceClaims;
+    if (refs.sourceTargets.length)
+        finding.source_target_refs = refs.sourceTargets;
+    if (refs.sourceFragmentRefs.length)
+        finding.source_fragment_refs = refs.sourceFragmentRefs;
+    if (refs.factRefs.length)
+        finding.fact_refs = refs.factRefs;
+    if (refs.proofRefs.length)
+        finding.proof_obligation_refs = refs.proofRefs;
+    if (refs.expectedAuthorityRefs.length)
+        finding.expected_authority_refs = refs.expectedAuthorityRefs;
+    if (refs.actualEvidenceRefs.length)
+        finding.actual_evidence_refs = refs.actualEvidenceRefs;
+    if (refs.rerunObligationRefs.length)
+        finding.rerun_obligation_refs = refs.rerunObligationRefs;
+}
+function applyFindingOwners(finding, outcome, check) {
+    if (outcome && !finding.owner_paths)
+        finding.owner_paths = outcome.product.owner.path_globs;
+    if (outcome)
+        finding.implementation_owner = {
+            label: outcome.product.owner.label,
+            path_globs: [...outcome.product.owner.path_globs],
+        };
+    if (check)
+        finding.verification_owner = {
+            kind: "machine_check",
+            outcome_key: check.outcome_key,
+            check_key: check.key,
+            runner_target: check.runner.resolved_target,
+            input_paths: unique([...check.input_paths, ...check.verification_inputs]),
+        };
+}
+function allChecks(compiled) {
+    return [
+        ...compiled.global.acceptance.checks,
+        ...compiled.outcomes.flatMap((outcome) => outcome.acceptance.checks),
+    ];
+}
+function fragmentsForSourceClaims(compiled, sourceClaimKeys) {
+    const sourceClaims = compiled.source_claims.filter((claim) => sourceClaimKeys.includes(claim.key));
+    const items = compiled.source_items.filter((item) => sourceClaims.some((claim) => {
+        const [sourcePath, anchor] = claim.source_ref.split("#");
+        return (item.source_path === sourcePath &&
+            (item.key === claim.key || !anchor || item.key === anchor));
+    }));
+    return unique(items.flatMap((item) => deriveMaterialSourceFragments(item).map((fragment) => fragment.key)));
+}
+function normalizedClaimRefs(finding) {
+    return (finding.claim_keys ?? []).map((claim) => finding.outcome_key && !claim.startsWith(`${finding.outcome_key}.`)
+        ? `${finding.outcome_key}.${claim}`
+        : claim);
+}
+function unique(values) {
+    return [...new Set(values)].sort();
+}
 function dispositionTargetRefs(disposition) {
     if (disposition.type === "outcome_result")
         return [disposition.ref];

package/dist/lib/long-task-freshness.d.ts

@@ -1,3 +1,30 @@
 import type { CompiledDeliveryContractV2, VerifierIdentityV2 } from "./long-task-delivery-types.js";
+import type { DesignAuthorityIdentityV1 } from "./design-authority-types.js";
+export interface ProtectedAuthorityInputsSnapshotV1 {
+    schema_version: "long-task-protected-authority-inputs-v1";
+    raw_contract_sha256: string;
+    contract_files: Record<string, string>;
+    source_files: Record<string, string>;
+    context: {
+        mode: "referenced" | "full";
+        topology_sha256: string;
+        files: string[];
+        file_sha256: Record<string, string>;
+    };
+    project_design_authority: DesignAuthorityIdentityV1 | null;
+    runner_frozen_files: Record<string, Record<string, string>>;
+    verification_inputs: Record<string, Record<string, string>>;
+    verifier_identity: VerifierIdentityV2;
+    external_public_keys: Record<string, {
+        key_id: string;
+        public_key_ref: string;
+        sha256: string;
+    }>;
+}
+export interface ProtectedAuthorityInputsIdentityV1 {
+    identity: string;
+    snapshot: ProtectedAuthorityInputsSnapshotV1;
+}
+export declare function captureProtectedAuthorityInputsIdentity(compiled: CompiledDeliveryContractV2): Promise<ProtectedAuthorityInputsIdentityV1>;
 export declare function deliveryCompileFreshness(compiled: CompiledDeliveryContractV2): Promise<string[]>;
 export declare function assertVerifierAuthorityCurrent(repositoryRoot: string, expected: VerifierIdentityV2): Promise<void>;

package/dist/lib/long-task-freshness.js

@@ -1,14 +1,93 @@
 import { readFile } from "node:fs/promises";
 import path from "node:path";
-import { captureContextGraphSnapshot } from "./context-graph-snapshot.js";
+import { captureContextGraphSnapshot, captureContextGraphSnapshotWithPhysicalFiles, } from "./context-graph-snapshot.js";
 import { canonicalValueJson, sha256Hex } from "./strict-codec.js";
 import { captureVerifierIdentity } from "./long-task-verifier-identity.js";
 import { verifierAuthorityDiff } from "./long-task-verifier-authority.js";
 import { parseDeliveryContractBundle } from "./long-task-delivery-parser.js";
+import { assertProtectedRepositoryFile } from "./repository-path-safety.js";
+import { inspectDesignAuthorityClosure } from "./design-authority-closure.js";
+export async function captureProtectedAuthorityInputsIdentity(compiled) {
+    const repository = compiled.repository_root;
+    const checks = allChecks(compiled);
+    const fileHashCache = new Map();
+    const hashRepositoryFile = (relativeInput, label, absoluteInput) => {
+        const relative = relativeInput.replace(/\\/gu, "/");
+        const cacheKey = absoluteInput ?? relative;
+        const existing = fileHashCache.get(cacheKey);
+        if (existing)
+            return existing;
+        const captured = (async () => {
+            const file = await assertProtectedRepositoryFile(repository, absoluteInput ?? path.join(repository, ...relative.split("/")), label);
+            return sha256Hex(await readFile(file));
+        })();
+        fileHashCache.set(cacheKey, captured);
+        return captured;
+    };
+    const hashFiles = async (files, label, physicalFiles) => Object.fromEntries(await Promise.all([...new Set(files)]
+        .sort()
+        .map(async (file) => [
+        file,
+        await hashRepositoryFile(file, `${label}:${file}`, requiredPhysicalFile(physicalFiles, file)),
+    ])));
+    const contextCapture = await captureContextGraphSnapshotWithPhysicalFiles(repository, compiled.task.context_refs, compiled.context_snapshot.mode);
+    const context = contextCapture.snapshot;
+    const [contractFiles, sourceFiles, contextFiles, runnerFrozenFiles, verificationInputs, verifierIdentity, externalPublicKeys, projectDesignAuthority,] = await Promise.all([
+        hashFiles(Object.keys(compiled.contract_files), "protected_contract"),
+        hashFiles(Object.keys(compiled.source_hashes), "protected_source"),
+        hashFiles(context.files, "protected_context", contextCapture.physical_files),
+        captureCheckFileIdentities(checks, (check) => check.runner.frozen_files, hashFiles, "protected_runner"),
+        captureCheckFileIdentities(checks, (check) => check.verification_input_hashes, hashFiles, "protected_verification_input"),
+        captureVerifierIdentity(repository, compiled.verifier_identity.hook_sha256 !== "not-required"),
+        captureExternalPublicKeyIdentities(compiled, hashRepositoryFile),
+        captureCurrentProjectDesignAuthority(compiled),
+    ]);
+    const rawContractSha256 = contractFiles[compiled.contract_file] ??
+        (await hashRepositoryFile(compiled.contract_file, "protected_raw_contract"));
+    const snapshot = {
+        schema_version: "long-task-protected-authority-inputs-v1",
+        raw_contract_sha256: rawContractSha256,
+        contract_files: contractFiles,
+        source_files: sourceFiles,
+        context: {
+            mode: context.mode,
+            topology_sha256: context.topology_sha256,
+            files: context.files,
+            file_sha256: contextFiles,
+        },
+        project_design_authority: projectDesignAuthority,
+        runner_frozen_files: runnerFrozenFiles,
+        verification_inputs: verificationInputs,
+        verifier_identity: verifierIdentity,
+        external_public_keys: externalPublicKeys,
+    };
+    return {
+        identity: sha256Hex(canonicalValueJson(snapshot)),
+        snapshot,
+    };
+}
+function requiredPhysicalFile(physicalFiles, file) {
+    if (!physicalFiles)
+        return undefined;
+    const physical = physicalFiles.get(file);
+    if (!physical)
+        throw new Error(`protected_context_physical_file_missing:${file}`);
+    return physical;
+}
 export async function deliveryCompileFreshness(compiled) {
     const findings = [];
+    if (compiled.project_design_authority)
+        try {
+            const current = await captureCurrentProjectDesignAuthority(compiled);
+            if (canonicalValueJson(current) !==
+                canonicalValueJson(compiled.project_design_authority))
+                findings.push("project_design_authority_changed_after_compile");
+        }
+        catch {
+            findings.push("project_design_authority_changed_after_compile");
+        }
     try {
-        const currentContract = await parseDeliveryContractBundle(compiled.workdir);
+        const currentContract = await parseDeliveryContractBundle(compiled.workdir, compiled.repository_root, { validate_structure: false });
         if (sha256Hex(canonicalValueJson(currentContract.contract)) !==
             compiled.contract_sha256)
             findings.push(`contract_changed_after_compile:${compiled.contract_file}`);
@@ -45,15 +124,26 @@ export async function deliveryCompileFreshness(compiled) {
     catch {
         findings.push("verifier_changed_after_compile:bundle");
     }
-    const checks = [
-        ...compiled.global.acceptance.checks,
-        ...compiled.outcomes.flatMap((outcome) => outcome.acceptance.checks),
-    ];
+    const checks = allChecks(compiled);
     for (const check of checks)
         for (const [file, hash] of Object.entries(check.runner.frozen_files))
             await compareFile(path.join(compiled.repository_root, file), hash, `runner_changed_after_compile:${check.internal_id}:${file}`, findings);
+    for (const check of checks)
+        for (const [file, hash] of Object.entries(check.verification_input_hashes))
+            await compareFile(path.join(compiled.repository_root, file), hash, `verification_input_changed_after_compile:${check.internal_id}:${file}`, findings);
+    for (const [confirmationRef, assurance] of Object.entries(compiled.external_confirmation_identity_assurances))
+        if (assurance.scheme === "ed25519")
+            await compareFile(path.join(compiled.repository_root, assurance.public_key_ref), assurance.public_key_sha256, `external_public_key_changed_after_compile:${confirmationRef}:${assurance.public_key_ref}`, findings);
     return [...new Set(findings)].sort();
 }
+async function captureCurrentProjectDesignAuthority(compiled) {
+    if (!compiled.project_design_authority)
+        return null;
+    const inspection = await inspectDesignAuthorityClosure(compiled.repository_root);
+    if (inspection.status !== "valid" || !inspection.identity)
+        throw new Error("project_design_authority_invalid");
+    return inspection.identity;
+}
 export async function assertVerifierAuthorityCurrent(repositoryRoot, expected) {
     let current;
     try {
@@ -75,6 +165,39 @@ async function compareFile(file, expected, finding, findings) {
         findings.push(finding);
     }
 }
+function allChecks(compiled) {
+    return [
+        ...compiled.global.acceptance.checks,
+        ...compiled.outcomes.flatMap((outcome) => outcome.acceptance.checks),
+    ];
+}
+async function captureCheckFileIdentities(checks, select, hashFiles, label) {
+    const rows = await Promise.all(checks.map(async (check) => [
+        check.internal_id,
+        await hashFiles(Object.keys(select(check)), `${label}:${check.internal_id}`),
+    ]));
+    if (new Set(rows.map(([checkRef]) => checkRef)).size !== rows.length)
+        throw new Error("protected_authority_check_identity_duplicated");
+    return Object.fromEntries(rows.sort(([left], [right]) => left.localeCompare(right)));
+}
+async function captureExternalPublicKeyIdentities(compiled, hashRepositoryFile) {
+    const rows = await Promise.all(Object.entries(compiled.external_confirmation_identity_assurances)
+        .filter(([, assurance]) => assurance.scheme === "ed25519")
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(async ([confirmationRef, assurance]) => {
+        if (assurance.scheme !== "ed25519")
+            throw new Error("protected_external_public_key_scheme_invalid");
+        return [
+            confirmationRef,
+            {
+                key_id: assurance.key_id,
+                public_key_ref: assurance.public_key_ref,
+                sha256: await hashRepositoryFile(assurance.public_key_ref, `protected_external_public_key:${confirmationRef}`),
+            },
+        ];
+    }));
+    return Object.fromEntries(rows);
+}
 function message(error) {
     return error instanceof Error ? error.message : String(error);
 }

package/dist/lib/long-task-git.js

@@ -1,5 +1,5 @@
 import { spawn } from "node:child_process";
-import { stat } from "node:fs/promises";
+import { realpath, stat } from "node:fs/promises";
 import path from "node:path";
 export class GitCommandError extends Error {
     exitCode;
@@ -20,8 +20,8 @@ export async function repositoryRoot(start) {
     const resolved = path.resolve(start);
     const gitEntry = await stat(path.join(resolved, ".git")).catch(() => null);
     if (gitEntry?.isDirectory() || gitEntry?.isFile())
-        return resolved;
-    return path.resolve(await gitOutput(resolved, ["rev-parse", "--show-toplevel"]));
+        return realpath(resolved);
+    return realpath(path.resolve(await gitOutput(resolved, ["rev-parse", "--show-toplevel"])));
 }
 export async function gitCommonDir(root) {
     return path.resolve(await gitOutput(root, [

package/dist/lib/long-task-material-input-closure.d.ts

@@ -0,0 +1,3 @@
+import type { CompiledSourceItemV2, MaterialTextInputV2 } from "./long-task-source-authority-types.js";
+import type { SemanticFactManifestV1 } from "./semantic-fact-types.js";
+export declare function deriveMaterialTextInputs(repository: string, sourceItems: CompiledSourceItemV2[], manifest: SemanticFactManifestV1, designOwnedSourceItems: ReadonlySet<string>): Promise<MaterialTextInputV2[]>;

package/dist/lib/long-task-material-input-closure.js

@@ -0,0 +1,92 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { TextDecoder } from "node:util";
+import { assertProtectedRepositoryFile } from "./long-task-protected-files.js";
+import { semanticFactClosureInvalid } from "./long-task-semantic-fact-closure-primitives.js";
+import { sourceAuthorityDomain } from "./long-task-source-fragments.js";
+import { sha256Hex } from "./strict-codec.js";
+const MATERIAL_RESOURCE_KINDS = new Set([
+    "attachment",
+    "canonical_spec",
+    "repository_preservation",
+    "external_constraint",
+    "delegated_instruction",
+    "design_resource",
+]);
+export async function deriveMaterialTextInputs(repository, sourceItems, manifest, designOwnedSourceItems) {
+    const sourceByKey = new Map(sourceItems.map((item) => [item.key, item]));
+    const result = sourceItems.map((item) => ({
+        input_key: item.key,
+        input_kind: "source_item",
+        source_ref: item.source_path,
+        sha256: item.text_sha256,
+        authority_source_item_refs: [item.key],
+        authority_domain: sourceAuthorityDomain(item, designOwnedSourceItems.has(item.key)),
+        normalized_text: normalizeText(item.normalized_text),
+    }));
+    for (const input of manifest.inputs) {
+        if (!MATERIAL_RESOURCE_KINDS.has(input.kind))
+            continue;
+        const file = await assertProtectedRepositoryFile(repository, path.resolve(repository, ...input.source_ref.split("/")), `material_text_input:${input.key}`);
+        const bytes = await readFile(file);
+        if (sha256Hex(bytes) !== input.sha256)
+            semanticFactClosureInvalid("material_text_input_digest_mismatch", `${input.key}:${input.source_ref}`);
+        const decoded = decodeStrictUtf8(bytes);
+        if (decoded === null) {
+            if (input.kind === "design_resource" && input.disposition === "ui_design")
+                continue;
+            semanticFactClosureInvalid("material_text_input_invalid_utf8", `${input.key}:${input.source_ref}`);
+        }
+        if (!decoded.trim())
+            semanticFactClosureInvalid("material_text_input_empty_or_ambiguous", `${input.key}:${input.source_ref}`);
+        const authoritySourceItemRefs = authoritySources(input, manifest, sourceByKey);
+        const authorityDomain = input.kind === "design_resource"
+            ? "design"
+            : oneAuthorityDomain(input.key, authoritySourceItemRefs.map((ref) => sourceAuthorityDomain(sourceByKey.get(ref), designOwnedSourceItems.has(ref))));
+        result.push({
+            input_key: input.key,
+            input_kind: input.kind,
+            source_ref: input.source_ref,
+            sha256: input.sha256,
+            authority_source_item_refs: authoritySourceItemRefs,
+            authority_domain: authorityDomain,
+            normalized_text: normalizeText(decoded),
+        });
+    }
+    return result.sort((left, right) => left.input_key.localeCompare(right.input_key));
+}
+function authoritySources(input, manifest, sourceByKey) {
+    const facts = new Map(manifest.facts.map((fact) => [fact.key, fact]));
+    const directRefs = new Set();
+    for (const basisRef of input.basis_refs)
+        if (sourceByKey.has(basisRef))
+            directRefs.add(basisRef);
+    if (directRefs.size)
+        return [...directRefs].sort();
+    const refs = new Set();
+    for (const factRef of input.fact_refs)
+        for (const sourceRef of facts.get(factRef)?.source_item_refs ?? [])
+            if (sourceByKey.has(sourceRef))
+                refs.add(sourceRef);
+    if (!refs.size)
+        semanticFactClosureInvalid("material_text_input_authority_source_required", input.key);
+    return [...refs].sort();
+}
+function oneAuthorityDomain(inputKey, domains) {
+    const unique = [...new Set(domains)];
+    if (unique.length !== 1)
+        semanticFactClosureInvalid("material_text_input_authority_domain_ambiguous", `${inputKey}:${unique.sort().join(",")}`);
+    return unique[0];
+}
+function decodeStrictUtf8(bytes) {
+    try {
+        const decoded = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+        return decoded.includes("\0") ? null : decoded;
+    }
+    catch {
+        return null;
+    }
+}
+function normalizeText(value) {
+    return value.replace(/\r\n?/gu, "\n");
+}

package/dist/lib/long-task-obligation-authority-resolution.d.ts

@@ -0,0 +1,12 @@
+import type { ExternalAuthorityRouteV1, MachineAuthorityRouteV1, ObligationAuthorityCandidatesV1 } from "./long-task-acceptance-reachability-types.js";
+export type ObligationAuthorityResolutionV1 = {
+    status: "machine_admitted";
+    machine: MachineAuthorityRouteV1;
+} | {
+    status: "external_candidate";
+    external: ExternalAuthorityRouteV1;
+} | {
+    status: "unreachable";
+    reason: "machine_external_authority_conflict" | "authority_route_ambiguous" | "proof_surface_authority_ambiguous" | "no_admitted_proof_route";
+};
+export declare function resolveObligationAuthority(candidates: ObligationAuthorityCandidatesV1): ObligationAuthorityResolutionV1;

package/dist/lib/long-task-obligation-authority-resolution.js

@@ -0,0 +1,57 @@
+export function resolveObligationAuthority(candidates) {
+    const machine = candidates.machine_candidates;
+    const external = candidates.external_candidates;
+    if (external.some((route) => route.authority_ambiguous))
+        return { status: "unreachable", reason: "authority_route_ambiguous" };
+    if (external.some((route) => route.authority_unresolved))
+        return {
+            status: "unreachable",
+            reason: "proof_surface_authority_ambiguous",
+        };
+    if (candidates.proof_surface_selection === "optional") {
+        if (machine.length > 1 ||
+            new Set(external.map((route) => route.proof_surface)).size !==
+                external.length)
+            return { status: "unreachable", reason: "authority_route_ambiguous" };
+        if (machine.length === 1 && external.length > 0) {
+            if (external.some((route) => route.proof_surface === machine[0].proof_surface))
+                return {
+                    status: "unreachable",
+                    reason: "machine_external_authority_conflict",
+                };
+            if (external.some((route) => route.advisory_to_machine !== true &&
+                route.semantic_identity !== null &&
+                route.semantic_identity !== undefined))
+                return {
+                    status: "unreachable",
+                    reason: "machine_external_authority_conflict",
+                };
+            if (external.some((route) => route.advisory_to_machine !== true))
+                return {
+                    status: "unreachable",
+                    reason: "proof_surface_authority_ambiguous",
+                };
+            const routes = [machine[0], ...external];
+            const semanticProfiles = new Set(routes.flatMap((route) => route.semantic_identity ? [route.semantic_identity] : []));
+            if (routes.some((route) => !route.semantic_identity) ||
+                semanticProfiles.size > 1)
+                return {
+                    status: "unreachable",
+                    reason: "proof_surface_authority_ambiguous",
+                };
+            return { status: "machine_admitted", machine: machine[0] };
+        }
+    }
+    if (machine.length && external.length)
+        return {
+            status: "unreachable",
+            reason: "machine_external_authority_conflict",
+        };
+    if (machine.length > 1 || external.length > 1)
+        return { status: "unreachable", reason: "authority_route_ambiguous" };
+    if (machine.length === 1)
+        return { status: "machine_admitted", machine: machine[0] };
+    if (external.length === 1)
+        return { status: "external_candidate", external: external[0] };
+    return { status: "unreachable", reason: "no_admitted_proof_route" };
+}

package/dist/lib/long-task-obligation-semantic-identity.d.ts

@@ -0,0 +1,16 @@
+import type { CompiledObservationAuthorityV2, DeliveryContractV2, EvidenceCapabilityV2 } from "./long-task-delivery-types.js";
+import type { AcceptanceReachabilityInputV1, ExpectedExternalObligation } from "./long-task-acceptance-reachability-types.js";
+export interface ObjectiveClaimSemanticIdentityInputV1 {
+    contract: Pick<DeliveryContractV2, "global" | "outcomes">;
+    outcome_key: string | null;
+    claim_ref: string;
+    local_claim_ref: string;
+    applicability_ref: string;
+    required_polarity: "positive" | "negative";
+    expected_authority_ref: string;
+    method: string;
+    required_evidence_capabilities: readonly EvidenceCapabilityV2[];
+    observation_authority: CompiledObservationAuthorityV2;
+}
+export declare function objectiveClaimSemanticIdentity(input: ObjectiveClaimSemanticIdentityInputV1): string | null;
+export declare function effectiveExternalObligationSemanticIdentity(input: AcceptanceReachabilityInputV1, expected: ExpectedExternalObligation): string | null;