project-tiny-context-harness 0.8.4 → 0.8.5

package/dist/lib/long-task-evidence-capability-codec.js

@@ -1,4 +1,6 @@
 import { DESIGN_RESOURCE_VERIFICATION_METHODS } from "./design-resource-handoff-types.js";
+import { DESIGN_RESOURCE_COMPARATORS } from "./design-resource-fact-manifest-types.js";
+import { DESIGN_RESOURCE_LOCATOR_KINDS } from "./design-resource-handoff-types.js";
 export function decodeEvidenceCapabilityRecords(value) {
     if (!Array.isArray(value))
         throw invalidRecord("must_be_array");
@@ -203,42 +205,398 @@ function decodeRecord(value, index) {
                         "artifact_path",
                         "observation_artifact_path",
                         "fact_refs",
+                        "fact_results",
                     ]);
                     return {
                         condition_key: key(cell.condition_key, `${cellLabel}.condition_key`),
                         artifact_path: nonEmpty(cell.artifact_path, `${cellLabel}.artifact_path`),
                         observation_artifact_path: nonEmpty(cell.observation_artifact_path, `${cellLabel}.observation_artifact_path`),
                         fact_refs: designFactRefs(cell.fact_refs, `${cellLabel}.fact_refs`),
+                        fact_results: array(cell.fact_results, `${cellLabel}.fact_results`).map((result, resultIndex) => decodeDesignFactResult(result, `${cellLabel}.fact_results[${resultIndex}]`)),
                     };
                 }),
             };
+        case "semantic_fact":
+            return decodeSemanticFactEvidence(row, label, base);
         case "input_variation":
-            exact(row, label, [
-                "assertion_key",
-                "capability",
-                "cases",
-                "failure_case_observed",
-            ]);
-            if (typeof row.failure_case_observed !== "boolean")
-                throw invalidRecord(`${label}.failure_case_observed`);
-            return {
-                ...base,
-                capability,
-                cases: array(row.cases, `${label}.cases`).map((item, caseIndex) => {
-                    const caseLabel = `${label}.cases[${caseIndex}]`;
-                    const entry = record(item, caseLabel);
-                    exact(entry, caseLabel, ["input_sha256", "output_sha256"]);
-                    return {
-                        input_sha256: sha(entry.input_sha256, `${caseLabel}.input_sha256`),
-                        output_sha256: sha(entry.output_sha256, `${caseLabel}.output_sha256`),
-                    };
-                }),
-                failure_case_observed: row.failure_case_observed,
-            };
+            return decodeInputVariationEvidence(row, label, base);
         default:
             throw invalidRecord(`${label}.capability_unsupported:${capability}`);
     }
 }
+function decodeInputVariationEvidence(row, label, base) {
+    exact(row, label, [
+        "assertion_key",
+        "capability",
+        "cases",
+        "failure_case_observed",
+    ]);
+    if (typeof row.failure_case_observed !== "boolean")
+        throw invalidRecord(`${label}.failure_case_observed`);
+    return {
+        ...base,
+        capability: "input_variation",
+        cases: array(row.cases, `${label}.cases`).map((item, caseIndex) => {
+            const caseLabel = `${label}.cases[${caseIndex}]`;
+            const entry = record(item, caseLabel);
+            exact(entry, caseLabel, ["input_sha256", "output_sha256"]);
+            return {
+                input_sha256: sha(entry.input_sha256, `${caseLabel}.input_sha256`),
+                output_sha256: sha(entry.output_sha256, `${caseLabel}.output_sha256`),
+            };
+        }),
+        failure_case_observed: row.failure_case_observed,
+    };
+}
+function decodeSemanticFactEvidence(row, label, base) {
+    exact(row, label, [
+        "assertion_key",
+        "capability",
+        "manifest_ref",
+        "manifest_sha256",
+        "outcome_ref",
+        "target_ref",
+        "fact_ref",
+        "proof_ref",
+        "method",
+        "subject_ref",
+        "condition_ref",
+        "property_ref",
+        "actual_observation",
+        "actual_environment",
+        "expected",
+        "comparison",
+        "verdict",
+        "oracle",
+        "environment",
+        "observer_results",
+    ]);
+    const actual = record(row.actual_observation, `${label}.actual_observation`);
+    exact(actual, `${label}.actual_observation`, [
+        "artifact_path",
+        "artifact_sha256",
+        "locator",
+        "value_sha256",
+        "sensitivity",
+        "redaction",
+    ]);
+    const actualEnvironment = record(row.actual_environment, `${label}.actual_environment`);
+    exact(actualEnvironment, `${label}.actual_environment`, [
+        "artifact_path",
+        "artifact_sha256",
+        "locator",
+        "value_sha256",
+    ]);
+    const comparison = record(row.comparison, `${label}.comparison`);
+    exact(comparison, `${label}.comparison`, [
+        "artifact_path",
+        "artifact_sha256",
+        "locator",
+        "result_sha256",
+        "comparator",
+        "mode",
+        "parameters",
+        "tolerance",
+        "mask",
+        "passed",
+    ]);
+    if (typeof comparison.passed !== "boolean")
+        throw invalidRecord(`${label}.comparison.passed`);
+    const oracle = record(row.oracle, `${label}.oracle`);
+    exact(oracle, `${label}.oracle`, [
+        "key",
+        "trust",
+        "identity",
+        "version",
+        "sha256",
+        "capabilities",
+    ]);
+    const environment = record(row.environment, `${label}.environment`);
+    exact(environment, `${label}.environment`, ["key", "identity", "definition"]);
+    return {
+        ...base,
+        capability: "semantic_fact",
+        manifest_ref: semanticFactRef(row.manifest_ref, `${label}.manifest_ref`),
+        manifest_sha256: sha(row.manifest_sha256, `${label}.manifest_sha256`),
+        outcome_ref: semanticFactRef(row.outcome_ref, `${label}.outcome_ref`),
+        target_ref: key(row.target_ref, `${label}.target_ref`),
+        fact_ref: semanticFactRef(row.fact_ref, `${label}.fact_ref`),
+        proof_ref: semanticFactRef(row.proof_ref, `${label}.proof_ref`),
+        method: semanticFactRef(row.method, `${label}.method`),
+        subject_ref: semanticFactRef(row.subject_ref, `${label}.subject_ref`),
+        condition_ref: semanticFactRef(row.condition_ref, `${label}.condition_ref`),
+        property_ref: semanticFactRef(row.property_ref, `${label}.property_ref`),
+        actual_observation: {
+            artifact_path: nonEmpty(actual.artifact_path, `${label}.actual_observation.artifact_path`),
+            artifact_sha256: sha(actual.artifact_sha256, `${label}.actual_observation.artifact_sha256`),
+            locator: decodeEvidenceLocator(actual.locator, `${label}.actual_observation.locator`),
+            value_sha256: sha(actual.value_sha256, `${label}.actual_observation.value_sha256`),
+            sensitivity: literal(actual.sensitivity, ["plain", "protected"], `${label}.actual_observation.sensitivity`),
+            redaction: nullable(actual.redaction, (value) => {
+                const entry = record(value, `${label}.actual_observation.redaction`);
+                exact(entry, `${label}.actual_observation.redaction`, [
+                    "policy_ref",
+                    "representation",
+                    "raw_persisted",
+                ]);
+                if (entry.raw_persisted !== false)
+                    throw invalidRecord(`${label}.actual_observation.redaction.raw_persisted`);
+                return {
+                    policy_ref: semanticFactRef(entry.policy_ref, `${label}.actual_observation.redaction.policy_ref`),
+                    representation: literal(entry.representation, ["digest_only", "redacted_structured"], `${label}.actual_observation.redaction.representation`),
+                    raw_persisted: false,
+                };
+            }),
+        },
+        actual_environment: {
+            artifact_path: nonEmpty(actualEnvironment.artifact_path, `${label}.actual_environment.artifact_path`),
+            artifact_sha256: sha(actualEnvironment.artifact_sha256, `${label}.actual_environment.artifact_sha256`),
+            locator: decodeEvidenceLocator(actualEnvironment.locator, `${label}.actual_environment.locator`),
+            value_sha256: sha(actualEnvironment.value_sha256, `${label}.actual_environment.value_sha256`),
+        },
+        expected: decodeSemanticLocatedValue(row.expected, `${label}.expected`),
+        comparison: {
+            artifact_path: nonEmpty(comparison.artifact_path, `${label}.comparison.artifact_path`),
+            artifact_sha256: sha(comparison.artifact_sha256, `${label}.comparison.artifact_sha256`),
+            locator: decodeEvidenceLocator(comparison.locator, `${label}.comparison.locator`),
+            result_sha256: sha(comparison.result_sha256, `${label}.comparison.result_sha256`),
+            comparator: semanticFactRef(comparison.comparator, `${label}.comparison.comparator`),
+            mode: literal(comparison.mode, ["exact", "tolerance"], `${label}.comparison.mode`),
+            parameters: decodeSemanticLocatedValue(comparison.parameters, `${label}.comparison.parameters`),
+            tolerance: nullable(comparison.tolerance, (value) => decodeSemanticLocatedValue(value, `${label}.comparison.tolerance`)),
+            mask: nullable(comparison.mask, (value) => decodeSemanticLocatedValue(value, `${label}.comparison.mask`)),
+            passed: comparison.passed,
+        },
+        verdict: literal(row.verdict, ["passed", "failed"], `${label}.verdict`),
+        oracle: {
+            key: semanticFactRef(oracle.key, `${label}.oracle.key`),
+            trust: literal(oracle.trust, ["frozen_executable", "named_external_tcb"], `${label}.oracle.trust`),
+            identity: nonEmpty(oracle.identity, `${label}.oracle.identity`),
+            version: nonEmpty(oracle.version, `${label}.oracle.version`),
+            sha256: nullableSha(oracle.sha256, `${label}.oracle.sha256`),
+            capabilities: semanticFactRefs(oracle.capabilities, `${label}.oracle.capabilities`),
+        },
+        environment: {
+            key: semanticFactRef(environment.key, `${label}.environment.key`),
+            identity: nonEmpty(environment.identity, `${label}.environment.identity`),
+            definition: decodeSemanticLocatedValue(environment.definition, `${label}.environment.definition`),
+        },
+        observer_results: array(row.observer_results, `${label}.observer_results`).map((item, index) => {
+            const itemLabel = `${label}.observer_results[${index}]`;
+            const entry = record(item, itemLabel);
+            exact(entry, itemLabel, [
+                "target_ref",
+                "artifact_path",
+                "artifact_sha256",
+                "locator",
+                "value_sha256",
+                "comparison_result_sha256",
+                "passed",
+            ]);
+            if (typeof entry.passed !== "boolean")
+                throw invalidRecord(`${itemLabel}.passed`);
+            return {
+                target_ref: key(entry.target_ref, `${itemLabel}.target_ref`),
+                artifact_path: nonEmpty(entry.artifact_path, `${itemLabel}.artifact_path`),
+                artifact_sha256: sha(entry.artifact_sha256, `${itemLabel}.artifact_sha256`),
+                locator: decodeEvidenceLocator(entry.locator, `${itemLabel}.locator`),
+                value_sha256: sha(entry.value_sha256, `${itemLabel}.value_sha256`),
+                comparison_result_sha256: sha(entry.comparison_result_sha256, `${itemLabel}.comparison_result_sha256`),
+                passed: entry.passed,
+            };
+        }),
+    };
+}
+function decodeSemanticLocatedValue(value, label) {
+    const row = record(value, label);
+    const representation = literal(row.representation, ["inline", "located", "digest_only"], `${label}.representation`);
+    exact(row, label, representation === "inline"
+        ? ["representation", "locator", "sha256", "value"]
+        : ["representation", "locator", "sha256"]);
+    const locator = record(row.locator, `${label}.locator`);
+    exact(locator, `${label}.locator`, ["material_ref", "kind", "value"]);
+    return {
+        representation,
+        locator: {
+            material_ref: semanticFactRef(locator.material_ref, `${label}.locator.material_ref`),
+            kind: literal(locator.kind, [
+                "source_item",
+                "manifest_pointer",
+                "json_pointer",
+                "yaml_pointer",
+                "whole_resource",
+                "schema_pointer",
+                "api_operation",
+                "code_symbol",
+                "custom",
+            ], `${label}.locator.kind`),
+            value: nonEmpty(locator.value, `${label}.locator.value`),
+        },
+        sha256: sha(row.sha256, `${label}.sha256`),
+        ...(representation === "inline" ? { value: row.value } : {}),
+    };
+}
+function decodeDesignFactResult(value, label) {
+    const row = record(value, label);
+    exact(row, label, [
+        "fact_ref",
+        "subject_ref",
+        "variation_ref",
+        "property_ref",
+        "actual_observation",
+        "actual_environment",
+        "expected",
+        "comparison",
+        "verdict",
+        "oracle",
+        "environment",
+    ]);
+    const actual = record(row.actual_observation, `${label}.actual_observation`);
+    exact(actual, `${label}.actual_observation`, [
+        "artifact_path",
+        "artifact_sha256",
+        "locator",
+        "value_sha256",
+        "sensitivity",
+        "redaction",
+    ]);
+    const expected = decodeLocatedDigest(row.expected, `${label}.expected`);
+    const actualEnvironment = record(row.actual_environment, `${label}.actual_environment`);
+    exact(actualEnvironment, `${label}.actual_environment`, [
+        "artifact_path",
+        "artifact_sha256",
+        "locator",
+        "value_sha256",
+    ]);
+    const comparison = record(row.comparison, `${label}.comparison`);
+    exact(comparison, `${label}.comparison`, [
+        "artifact_path",
+        "artifact_sha256",
+        "locator",
+        "result_sha256",
+        "comparator",
+        "mode",
+        "parameters",
+        "tolerance",
+        "mask",
+        "passed",
+    ]);
+    const comparator = nonEmpty(comparison.comparator, `${label}.comparison.comparator`);
+    if (!DESIGN_RESOURCE_COMPARATORS.includes(comparator) &&
+        !/^custom\.[a-z0-9][a-z0-9._-]*$/u.test(comparator))
+        throw invalidRecord(`${label}.comparison.comparator`);
+    if (typeof comparison.passed !== "boolean")
+        throw invalidRecord(`${label}.comparison.passed`);
+    const oracle = record(row.oracle, `${label}.oracle`);
+    exact(oracle, `${label}.oracle`, [
+        "key",
+        "trust",
+        "identity",
+        "version",
+        "sha256",
+    ]);
+    const environment = record(row.environment, `${label}.environment`);
+    exact(environment, `${label}.environment`, ["key", "identity", "definition"]);
+    return {
+        fact_ref: designFactRef(row.fact_ref, `${label}.fact_ref`),
+        subject_ref: designFactRef(row.subject_ref, `${label}.subject_ref`),
+        variation_ref: designFactRef(row.variation_ref, `${label}.variation_ref`),
+        property_ref: designFactRef(row.property_ref, `${label}.property_ref`),
+        actual_observation: {
+            artifact_path: nonEmpty(actual.artifact_path, `${label}.actual_observation.artifact_path`),
+            artifact_sha256: sha(actual.artifact_sha256, `${label}.actual_observation.artifact_sha256`),
+            locator: decodeEvidenceLocator(actual.locator, `${label}.actual_observation.locator`),
+            value_sha256: sha(actual.value_sha256, `${label}.actual_observation.value_sha256`),
+            sensitivity: literal(actual.sensitivity, ["plain", "protected"], `${label}.actual_observation.sensitivity`),
+            redaction: nullable(actual.redaction, (value) => {
+                const redaction = record(value, `${label}.actual_observation.redaction`);
+                exact(redaction, `${label}.actual_observation.redaction`, [
+                    "policy_ref",
+                    "representation",
+                    "raw_persisted",
+                ]);
+                if (redaction.raw_persisted !== false)
+                    throw invalidRecord(`${label}.actual_observation.redaction.raw_persisted`);
+                return {
+                    policy_ref: designFactRef(redaction.policy_ref, `${label}.actual_observation.redaction.policy_ref`),
+                    representation: literal(redaction.representation, ["digest_only", "redacted_structured"], `${label}.actual_observation.redaction.representation`),
+                    raw_persisted: false,
+                };
+            }),
+        },
+        actual_environment: {
+            artifact_path: nonEmpty(actualEnvironment.artifact_path, `${label}.actual_environment.artifact_path`),
+            artifact_sha256: sha(actualEnvironment.artifact_sha256, `${label}.actual_environment.artifact_sha256`),
+            locator: decodeEvidenceLocator(actualEnvironment.locator, `${label}.actual_environment.locator`),
+            value_sha256: sha(actualEnvironment.value_sha256, `${label}.actual_environment.value_sha256`),
+        },
+        expected,
+        comparison: {
+            artifact_path: nonEmpty(comparison.artifact_path, `${label}.comparison.artifact_path`),
+            artifact_sha256: sha(comparison.artifact_sha256, `${label}.comparison.artifact_sha256`),
+            locator: decodeEvidenceLocator(comparison.locator, `${label}.comparison.locator`),
+            result_sha256: sha(comparison.result_sha256, `${label}.comparison.result_sha256`),
+            comparator,
+            mode: literal(comparison.mode, ["exact", "tolerance"], `${label}.comparison.mode`),
+            parameters: decodeLocatedDigest(comparison.parameters, `${label}.comparison.parameters`),
+            tolerance: nullable(comparison.tolerance, (value) => decodeLocatedDigest(value, `${label}.comparison.tolerance`)),
+            mask: nullable(comparison.mask, (value) => decodeLocatedDigest(value, `${label}.comparison.mask`)),
+            passed: comparison.passed,
+        },
+        verdict: literal(row.verdict, ["passed", "failed"], `${label}.verdict`),
+        oracle: {
+            key: designFactRef(oracle.key, `${label}.oracle.key`),
+            trust: literal(oracle.trust, ["frozen_executable", "named_external_tcb"], `${label}.oracle.trust`),
+            identity: nonEmpty(oracle.identity, `${label}.oracle.identity`),
+            version: nonEmpty(oracle.version, `${label}.oracle.version`),
+            sha256: nullableSha(oracle.sha256, `${label}.oracle.sha256`),
+        },
+        environment: {
+            key: designFactRef(environment.key, `${label}.environment.key`),
+            identity: nonEmpty(environment.identity, `${label}.environment.identity`),
+            definition: decodeLocatedDigest(environment.definition, `${label}.environment.definition`),
+        },
+    };
+}
+export function decodeDesignFactResults(value, label) {
+    return array(value, label).map((item, index) => decodeDesignFactResult(item, `${label}[${index}]`));
+}
+function decodeLocatedDigest(value, label) {
+    const row = record(value, label);
+    exact(row, label, ["locator", "sha256"]);
+    const locator = record(row.locator, `${label}.locator`);
+    exact(locator, `${label}.locator`, ["resource_ref", "kind", "value"]);
+    return {
+        locator: {
+            resource_ref: designFactRef(locator.resource_ref, `${label}.locator.resource_ref`),
+            kind: literal(locator.kind, DESIGN_RESOURCE_LOCATOR_KINDS, `${label}.locator.kind`),
+            value: nonEmpty(locator.value, `${label}.locator.value`),
+        },
+        sha256: sha(row.sha256, `${label}.sha256`),
+    };
+}
+function decodeEvidenceLocator(value, label) {
+    const row = record(value, label);
+    exact(row, label, ["kind", "value"]);
+    return {
+        kind: literal(row.kind, [
+            "json_pointer",
+            "image_region",
+            "semantic_node",
+            "trace_event",
+            "timeline_sample",
+            "asset_ref",
+            "custom",
+        ], `${label}.kind`),
+        value: nonEmpty(row.value, `${label}.value`),
+    };
+}
+function nullableSha(value, label) {
+    return value === null ? null : sha(value, label);
+}
+function nullable(value, decode) {
+    return value === null ? null : decode(value);
+}
 function invalidRecord(detail) {
     return new Error(`check_evidence_records_invalid:${detail}`);
 }
@@ -283,6 +641,21 @@ function designFactRefs(value, label) {
         return result;
     });
 }
+function designFactRef(value, label) {
+    const result = nonEmpty(value, label);
+    if (!/^[a-z0-9][a-z0-9._-]*$/u.test(result))
+        throw invalidRecord(label);
+    return result;
+}
+function semanticFactRefs(value, label) {
+    return array(value, label).map((item, index) => semanticFactRef(item, `${label}[${index}]`));
+}
+function semanticFactRef(value, label) {
+    const result = nonEmpty(value, label);
+    if (!/^[a-z0-9][a-z0-9._:-]*$/u.test(result))
+        throw invalidRecord(label);
+    return result;
+}
 function sha(value, label) {
     const result = nonEmpty(value, label);
     if (!/^[a-f0-9]{64}$/u.test(result))

package/dist/lib/long-task-evidence-capability-policy.js

@@ -1,4 +1,5 @@
 import { validateRuntimeEvidenceRecord } from "./long-task-evidence-capability-runtime.js";
+import { validateDistinctSemanticFactEvidence } from "./long-task-semantic-fact-evidence.js";
 import { checkFinding } from "./long-task-evidence-findings.js";
 export { decodeEvidenceCapabilityRecords } from "./long-task-evidence-capability-codec.js";
 export function validateEvidenceCapabilityDeclarations(contract, report) {
@@ -31,6 +32,10 @@ function validateAssertionEvidenceCapabilityDeclarations(assertion, check, targe
     if (assertion.operator === "exists" &&
         !assertion.evidence_capabilities.includes("presence"))
         issue(report, "exists_requires_presence_capability", label);
+    validateArtifactCapabilityDeclarations(assertion, check, label, report);
+    validateRunnerCapabilityDeclarations(assertion, check, targets, label, report);
+}
+function validateArtifactCapabilityDeclarations(assertion, check, label, report) {
     if (assertion.evidence_capabilities.includes("visual_render") &&
         !check.artifact_globs.length)
         issue(report, "visual_render_artifact_required", label);
@@ -40,6 +45,11 @@ function validateAssertionEvidenceCapabilityDeclarations(assertion, check, targe
     if (assertion.evidence_capabilities.includes("design_method") &&
         !check.artifact_globs.length)
         issue(report, "design_method_artifact_required", label);
+    if (assertion.evidence_capabilities.includes("semantic_fact") &&
+        !check.artifact_globs.length)
+        issue(report, "semantic_fact_artifact_required", label);
+}
+function validateRunnerCapabilityDeclarations(assertion, check, targets, label, report) {
     if (assertion.evidence_capabilities.includes("interaction_trace") &&
         !check.scenario.when.length)
         issue(report, "interaction_trace_actions_required", label);
@@ -48,6 +58,7 @@ function validateAssertionEvidenceCapabilityDeclarations(assertion, check, targe
             capability !== "interaction_trace" &&
             capability !== "design_conformance" &&
             capability !== "design_method" &&
+            capability !== "semantic_fact" &&
             capability !== "target_runtime"))
         issue(report, "playwright_evidence_capability_unsupported", label);
     if (["boundary_invocation", "external_side_effect"].some((capability) => assertion.evidence_capabilities.includes(capability)) &&
@@ -137,6 +148,13 @@ export function evaluateEvidenceCapabilities(check, records, artifactHashes) {
         complete[assertion.key] = assertionComplete;
     }
     validateDistinctDesignMethodArtifacts(check, runtimeRecords, artifactHashes, findings);
+    const semanticDistinctness = validateDistinctSemanticFactEvidence(runtimeRecords);
+    if (semanticDistinctness)
+        findings.push({
+            ...checkFinding(check, "semantic_fact_evidence_reused", `Semantic Fact evidence is not independently attributable: ${semanticDistinctness}.`, "Emit exactly one independently located current observation and comparison result for every Fact-by-method obligation."),
+            expected: "unique_fact_proof_and_artifact_locator_identity",
+            actual: semanticDistinctness,
+        });
     return { complete, findings };
 }
 function validateDistinctDesignMethodArtifacts(check, records, artifactHashes, findings) {

package/dist/lib/long-task-evidence-capability-runtime.js

@@ -1,3 +1,4 @@
+import { validateSemanticFactEvidence } from "./long-task-semantic-fact-evidence.js";
 export function validateRuntimeEvidenceRecord(check, record, artifactHashes) {
     switch (record.capability) {
         case "interaction_trace":
@@ -29,6 +30,8 @@ export function validateRuntimeEvidenceRecord(check, record, artifactHashes) {
             return validateDesignConformance(check, record, artifactHashes);
         case "design_method":
             return validateDesignMethod(check, record, artifactHashes);
+        case "semantic_fact":
+            return validateSemanticFactEvidence(check, record, artifactHashes);
         case "target_runtime":
             return validateTargetRuntime(check, record);
         case "input_variation":
@@ -54,6 +57,7 @@ function validateDesignMethod(check, record, artifactHashes) {
             artifact_path: item.path,
             observation_artifact_path: item.observation_path,
             fact_refs: item.fact_refs,
+            fact_expectations: item.fact_expectations,
         },
     ]));
     if (record.cells.length !== expected.size)
@@ -65,13 +69,87 @@ function validateDesignMethod(check, record, artifactHashes) {
             return "design_method_artifact_path_mismatch";
         if (!same([...cell.fact_refs].sort(), [...(expectedCell?.fact_refs ?? [])].sort()))
             return "design_method_fact_refs_mismatch";
+        if (!same([...cell.fact_results.map((item) => item.fact_ref)].sort(), [...(expectedCell?.fact_refs ?? [])].sort()))
+            return "design_method_fact_results_mismatch";
         if (!artifactHashes[cell.artifact_path])
             return "design_method_artifact_missing";
         if (!artifactHashes[cell.observation_artifact_path])
             return "design_method_observation_artifact_missing";
+        const expectations = new Map((expectedCell?.fact_expectations ?? []).map((item) => [
+            item.fact_ref,
+            item,
+        ]));
+        const actualIdentities = new Set();
+        const comparisonIdentities = new Set();
+        for (const result of cell.fact_results) {
+            const expectation = expectations.get(result.fact_ref);
+            if (!expectation)
+                return "design_method_fact_expectation_missing";
+            if (result.subject_ref !== expectation.subject_ref ||
+                result.variation_ref !== expectation.variation_ref ||
+                result.property_ref !== expectation.property_ref ||
+                result.actual_observation.sensitivity !==
+                    expectation.observation_sensitivity)
+                return "design_method_fact_identity_mismatch";
+            if ((result.actual_observation.sensitivity === "plain" &&
+                result.actual_observation.redaction !== null) ||
+                (result.actual_observation.sensitivity === "protected" &&
+                    result.actual_observation.redaction === null))
+                return "design_method_observation_protection_mismatch";
+            if (canonicalJson(result.expected) !== canonicalJson(expectation.expected))
+                return "design_method_expected_value_mismatch";
+            if (result.comparison.comparator !== expectation.comparison.comparator ||
+                result.comparison.mode !== expectation.comparison.mode ||
+                canonicalJson(result.comparison.parameters) !==
+                    canonicalJson(expectation.comparison.parameters) ||
+                canonicalJson(result.comparison.tolerance) !==
+                    canonicalJson(expectation.comparison.tolerance) ||
+                canonicalJson(result.comparison.mask) !==
+                    canonicalJson(expectation.comparison.mask))
+                return "design_method_comparison_authority_mismatch";
+            if (canonicalJson(result.oracle) !== canonicalJson(expectation.oracle) ||
+                canonicalJson(result.environment) !==
+                    canonicalJson(expectation.environment))
+                return "design_method_oracle_environment_mismatch";
+            if (result.actual_observation.artifact_path !==
+                cell.observation_artifact_path ||
+                result.actual_observation.artifact_sha256 !==
+                    artifactHashes[cell.observation_artifact_path])
+                return "design_method_actual_observation_mismatch";
+            if (result.actual_environment.artifact_path !==
+                cell.observation_artifact_path ||
+                result.actual_environment.artifact_sha256 !==
+                    artifactHashes[cell.observation_artifact_path] ||
+                result.actual_environment.value_sha256 !==
+                    expectation.environment.definition.sha256)
+                return "design_method_actual_environment_mismatch";
+            if (result.comparison.artifact_path !== cell.artifact_path ||
+                result.comparison.artifact_sha256 !== artifactHashes[cell.artifact_path])
+                return "design_method_comparison_artifact_mismatch";
+            const actualIdentity = `${result.actual_observation.artifact_path}\0${canonicalJson(result.actual_observation.locator)}`;
+            if (actualIdentities.has(actualIdentity))
+                return "design_method_actual_observation_reused";
+            actualIdentities.add(actualIdentity);
+            const comparisonIdentity = `${result.comparison.artifact_path}\0${canonicalJson(result.comparison.locator)}`;
+            if (comparisonIdentities.has(comparisonIdentity))
+                return "design_method_comparison_result_reused";
+            comparisonIdentities.add(comparisonIdentity);
+            if (result.verdict !== "passed" || result.comparison.passed !== true)
+                return "design_method_fact_failed";
+        }
     }
     return null;
 }
+function canonicalJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map((item) => canonicalJson(item)).join(",")}]`;
+    if (value && typeof value === "object")
+        return `{${Object.entries(value)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, entry]) => `${JSON.stringify(key)}:${canonicalJson(entry)}`)
+            .join(",")}}`;
+    return JSON.stringify(value);
+}
 function validateDesignConformance(check, record, artifactHashes) {
     const target = (check.design_conformance_targets ?? []).find((item) => item.key === record.design_target_ref &&
         designTargetUsesAssertion(item, record.assertion_key));