project-tiny-context-harness 0.8.4 → 0.8.5

package/dist/lib/long-task-semantic-fact-evidence.js

@@ -0,0 +1,165 @@
+import { canonicalValueJson, sha256Hex } from "./strict-codec.js";
+export function validateSemanticFactEvidence(check, record, artifactHashes) {
+    const expectations = check.semantic_fact_expectations.filter((item) => item.assertion_ref === record.assertion_key);
+    if (expectations.length !== 1)
+        return expectations.length
+            ? "semantic_fact_expectation_duplicate"
+            : "semantic_fact_expectation_missing";
+    const expected = expectations[0];
+    const authorityError = validateSemanticFactEvidenceAuthority(check, record, expected);
+    if (authorityError)
+        return authorityError;
+    const artifactError = validateSemanticFactArtifacts(record, expected, artifactHashes);
+    if (artifactError)
+        return artifactError;
+    const observerError = validateSemanticFactObservers(record, expected, artifactHashes);
+    if (observerError)
+        return observerError;
+    if (record.verdict !== "passed" || record.comparison.passed !== true)
+        return "semantic_fact_failed";
+    return null;
+}
+function validateSemanticFactEvidenceAuthority(check, record, expected) {
+    if (!sameSemanticFactIdentity(record, expected))
+        return "semantic_fact_identity_mismatch";
+    if (record.target_ref !== check.execution_target.target_ref ||
+        expected.check_ref !== check.key)
+        return "semantic_fact_target_mismatch";
+    if (record.actual_observation.sensitivity !== expected.observation_sensitivity)
+        return "semantic_fact_sensitivity_mismatch";
+    if (!validSemanticFactRedaction(record.actual_observation.sensitivity, record.actual_observation.redaction))
+        return "semantic_fact_redaction_mismatch";
+    if (canonicalValueJson(record.expected) !==
+        canonicalValueJson(expected.expected))
+        return "semantic_fact_expected_value_mismatch";
+    if (!sameSemanticFactComparisonAuthority(record, expected))
+        return "semantic_fact_comparison_authority_mismatch";
+    if (record.comparison.result_sha256 !==
+        semanticFactComparisonResultIdentity({
+            fact_ref: record.fact_ref,
+            proof_ref: record.proof_ref,
+            target_ref: record.target_ref,
+            actual_value_sha256: record.actual_observation.value_sha256,
+            expected_value_sha256: expected.expected.sha256,
+            comparator: record.comparison.comparator,
+            mode: record.comparison.mode,
+            parameters_sha256: record.comparison.parameters.sha256,
+            tolerance_sha256: record.comparison.tolerance?.sha256 ?? null,
+            mask_sha256: record.comparison.mask?.sha256 ?? null,
+            passed: record.comparison.passed,
+        }))
+        return "semantic_fact_comparison_result_identity_mismatch";
+    if (record.comparison.comparator === "exact_value" &&
+        record.actual_observation.value_sha256 !== expected.expected.sha256)
+        return "semantic_fact_exact_value_mismatch";
+    if (canonicalValueJson(record.oracle) !== canonicalValueJson(expected.oracle) ||
+        canonicalValueJson(record.environment) !==
+            canonicalValueJson(expected.environment))
+        return "semantic_fact_oracle_environment_mismatch";
+    return null;
+}
+function sameSemanticFactIdentity(record, expected) {
+    return (record.manifest_ref === expected.manifest_ref &&
+        record.manifest_sha256 === expected.manifest_sha256 &&
+        record.outcome_ref === expected.outcome_ref &&
+        record.fact_ref === expected.fact_ref &&
+        record.proof_ref === expected.proof_ref &&
+        record.method === expected.method &&
+        record.subject_ref === expected.subject_ref &&
+        record.condition_ref === expected.condition_ref &&
+        record.property_ref === expected.property_ref);
+}
+function validSemanticFactRedaction(sensitivity, redaction) {
+    return ((sensitivity === "plain" && redaction === null) ||
+        (sensitivity === "protected" && redaction !== null));
+}
+function sameSemanticFactComparisonAuthority(record, expected) {
+    return (record.comparison.comparator === expected.comparison.comparator &&
+        record.comparison.mode === expected.comparison.mode &&
+        canonicalValueJson(record.comparison.parameters) ===
+            canonicalValueJson(expected.comparison.parameters) &&
+        canonicalValueJson(record.comparison.tolerance) ===
+            canonicalValueJson(expected.comparison.tolerance) &&
+        canonicalValueJson(record.comparison.mask) ===
+            canonicalValueJson(expected.comparison.mask));
+}
+function validateSemanticFactArtifacts(record, expected, artifactHashes) {
+    if (artifactHashes[record.actual_observation.artifact_path] !==
+        record.actual_observation.artifact_sha256)
+        return "semantic_fact_observation_artifact_mismatch";
+    if (artifactHashes[record.actual_environment.artifact_path] !==
+        record.actual_environment.artifact_sha256 ||
+        record.actual_environment.value_sha256 !==
+            expected.environment.definition.sha256)
+        return "semantic_fact_environment_observation_mismatch";
+    if (artifactHashes[record.comparison.artifact_path] !==
+        record.comparison.artifact_sha256)
+        return "semantic_fact_comparison_artifact_mismatch";
+    return null;
+}
+function validateSemanticFactObservers(record, expected, artifactHashes) {
+    if (!sameSet(record.observer_results.map((item) => item.target_ref), expected.observer_refs))
+        return "semantic_fact_observer_set_mismatch";
+    const observerObservations = new Set();
+    const primaryObservation = `${record.actual_observation.artifact_path}\0${canonicalValueJson(record.actual_observation.locator)}`;
+    for (const observer of record.observer_results) {
+        const observation = `${observer.artifact_path}\0${canonicalValueJson(observer.locator)}`;
+        if (observation === primaryObservation ||
+            observerObservations.has(observation))
+            return "semantic_fact_observer_observation_reused";
+        observerObservations.add(observation);
+        if (artifactHashes[observer.artifact_path] !== observer.artifact_sha256)
+            return "semantic_fact_observer_artifact_mismatch";
+        if (observer.passed !== true ||
+            (record.comparison.comparator === "exact_value" &&
+                observer.value_sha256 !== expected.expected.sha256))
+            return "semantic_fact_observer_failed";
+        if (observer.comparison_result_sha256 !==
+            semanticFactComparisonResultIdentity({
+                fact_ref: record.fact_ref,
+                proof_ref: record.proof_ref,
+                target_ref: observer.target_ref,
+                actual_value_sha256: observer.value_sha256,
+                expected_value_sha256: expected.expected.sha256,
+                comparator: record.comparison.comparator,
+                mode: record.comparison.mode,
+                parameters_sha256: record.comparison.parameters.sha256,
+                tolerance_sha256: record.comparison.tolerance?.sha256 ?? null,
+                mask_sha256: record.comparison.mask?.sha256 ?? null,
+                passed: observer.passed,
+            }))
+            return "semantic_fact_observer_comparison_identity_mismatch";
+    }
+    return null;
+}
+export function semanticFactComparisonResultIdentity(value) {
+    return sha256Hex(canonicalValueJson(value));
+}
+export function validateDistinctSemanticFactEvidence(records) {
+    const observations = new Set();
+    const comparisons = new Set();
+    const identities = new Set();
+    for (const record of records) {
+        if (record.capability !== "semantic_fact")
+            continue;
+        const identity = `${record.fact_ref}\0${record.proof_ref}`;
+        if (identities.has(identity))
+            return "semantic_fact_result_duplicate";
+        identities.add(identity);
+        const observation = `${record.actual_observation.artifact_path}\0${canonicalValueJson(record.actual_observation.locator)}`;
+        if (observations.has(observation))
+            return "semantic_fact_observation_reused";
+        observations.add(observation);
+        const comparison = `${record.comparison.artifact_path}\0${canonicalValueJson(record.comparison.locator)}`;
+        if (comparisons.has(comparison))
+            return "semantic_fact_comparison_reused";
+        comparisons.add(comparison);
+    }
+    return null;
+}
+function sameSet(left, right) {
+    return (left.length === right.length &&
+        new Set(left).size === left.length &&
+        left.every((item) => right.includes(item)));
+}
+export const typed_semantic_fact_runtime_evidence = "fact_ref+actual+comparison+verdict+oracle+environment";

package/dist/lib/long-task-semantic-fact-input-closure.d.ts

@@ -0,0 +1,4 @@
+import type { CompiledSourceItemV2 } from "./long-task-source-authority-types.js";
+import type { SemanticFactManifestV1 } from "./semantic-fact-types.js";
+export declare function collectDesignOwnedSemanticFactSourceItems(repository: string, sourcePaths: string[]): Promise<Set<string>>;
+export declare function validateSemanticFactInputInventory(repository: string, sourceItems: CompiledSourceItemV2[], contextFiles: string[], manifest: SemanticFactManifestV1, designOwnedSourceItems: Set<string>): Promise<void>;

package/dist/lib/long-task-semantic-fact-input-closure.js

@@ -0,0 +1,101 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { containsDesignResourceHandoff, parseDesignResourceHandoffMarkdown, } from "./design-resource-handoff-parser.js";
+import { assertSameSemanticFactClosureSet, semanticFactClosureInvalid, uniqueSemanticFactClosureValues, } from "./long-task-semantic-fact-closure-primitives.js";
+import { validateSemanticFactProvenance } from "./long-task-semantic-fact-provenance-closure.js";
+import { assertProtectedRepositoryFile } from "./long-task-protected-files.js";
+import { sha256Hex } from "./strict-codec.js";
+export async function collectDesignOwnedSemanticFactSourceItems(repository, sourcePaths) {
+    const result = new Set();
+    for (const sourcePath of sourcePaths) {
+        const file = await assertProtectedRepositoryFile(repository, path.resolve(repository, ...sourcePath.split("/")), `semantic_fact_design_source:${sourcePath}`);
+        const content = await readFile(file, "utf8");
+        if (!containsDesignResourceHandoff(content))
+            continue;
+        const parsed = parseDesignResourceHandoffMarkdown(sourcePath, content);
+        for (const key of parsed.source_item_keys)
+            result.add(key);
+    }
+    return result;
+}
+export async function validateSemanticFactInputInventory(repository, sourceItems, contextFiles, manifest, designOwnedSourceItems) {
+    const sourceItemByKey = new Map(sourceItems.map((item) => [item.key, item]));
+    const sourceInputs = manifest.inputs.filter((item) => item.kind === "source_item");
+    assertSameSemanticFactClosureSet(manifest.scope.source_item_refs, sourceItems.map((item) => item.key), "manifest_source_item_universe");
+    assertSameSemanticFactClosureSet(sourceInputs.map((item) => item.source_ref), sourceItems.map((item) => item.key), "input_source_item_universe");
+    validateSourceInputDigests(sourceInputs, sourceItemByKey, designOwnedSourceItems);
+    const contextInputs = manifest.inputs.filter((item) => item.kind === "context");
+    assertSameSemanticFactClosureSet(contextInputs.map((item) => item.source_ref), contextFiles, "input_context_universe");
+    for (const input of manifest.inputs)
+        await validateInput(repository, manifest, input, designOwnedSourceItems);
+    validateInputFactLineage(manifest, sourceInputs);
+    validateSemanticFactProvenance(manifest, sourceItems);
+}
+function validateSourceInputDigests(sourceInputs, sourceItemByKey, designOwnedSourceItems) {
+    for (const input of sourceInputs) {
+        const sourceItem = sourceItemByKey.get(input.source_ref);
+        if (input.sha256 !== sourceItem.text_sha256)
+            semanticFactClosureInvalid("input_source_item_digest_mismatch", `${input.key}:${input.source_ref}`);
+        const designOwned = designOwnedSourceItems.has(input.source_ref);
+        if (designOwned
+            ? !["ui_design", "non_ui_material"].includes(input.disposition)
+            : input.disposition !== "non_ui_material")
+            semanticFactClosureInvalid("material_source_item_disposition_mismatch", `${input.key}:${input.source_ref}:${input.disposition}:${designOwned ? "ui_design_or_non_ui_material" : "non_ui_material"}`);
+    }
+}
+async function validateInput(repository, manifest, input, designOwnedSourceItems) {
+    uniqueSemanticFactClosureValues(input.fact_refs, `input_fact_refs:${input.key}`);
+    uniqueSemanticFactClosureValues(input.basis_refs, `input_basis_refs:${input.key}`);
+    if (input.disposition === "non_ui_material"
+        ? !input.fact_refs.length
+        : input.fact_refs.length)
+        semanticFactClosureInvalid("input_fact_disposition_mismatch", `${input.key}:${input.disposition}`);
+    if (input.disposition !== "non_ui_material" && !input.rationale.trim())
+        semanticFactClosureInvalid("input_disposition_rationale_required", input.key);
+    if (["canonical_spec", "external_constraint", "delegated_instruction"].includes(input.kind) &&
+        input.disposition !== "non_ui_material")
+        semanticFactClosureInvalid("material_input_disposition_mismatch", `${input.key}:${input.kind}:${input.disposition}`);
+    const uiDesignInput = input.kind === "design_resource" ||
+        (input.kind === "source_item" &&
+            designOwnedSourceItems.has(input.source_ref));
+    if (uiDesignInput
+        ? !["ui_design", "non_ui_material"].includes(input.disposition)
+        : input.disposition === "ui_design")
+        semanticFactClosureInvalid("ui_design_input_kind_mismatch", `${input.key}:${input.kind}:${input.disposition}`);
+    if (input.disposition === "excluded_by_scope" &&
+        !manifest.scope.exclusions.some((exclusion) => exclusion.affected_refs.includes(input.key)))
+        semanticFactClosureInvalid("input_scope_exclusion_missing", input.key);
+    if (input.kind === "source_item")
+        return;
+    const file = await assertProtectedRepositoryFile(repository, path.resolve(repository, ...input.source_ref.split("/")), `semantic_fact_input:${input.key}`);
+    const digest = sha256Hex(await readFile(file));
+    if (digest !== input.sha256)
+        semanticFactClosureInvalid("input_resource_digest_mismatch", `${input.key}:${input.source_ref}`);
+}
+function validateInputFactLineage(manifest, sourceInputs) {
+    const facts = new Map(manifest.facts.map((item) => [item.key, item]));
+    for (const input of manifest.inputs)
+        for (const factRef of input.fact_refs)
+            if (!facts.has(factRef))
+                semanticFactClosureInvalid("input_fact_unknown", `${input.key}:${factRef}`);
+            else {
+                const fact = facts.get(factRef);
+                if (input.kind === "source_item"
+                    ? !fact.source_item_refs.includes(input.source_ref)
+                    : !fact.provenance.basis_refs.includes(input.key))
+                    semanticFactClosureInvalid("input_fact_lineage_mismatch", `${input.key}:${factRef}`);
+            }
+    for (const fact of manifest.facts) {
+        const sourceInputRefs = fact.source_item_refs.map((sourceItemRef) => {
+            const input = sourceInputs.find((item) => item.source_ref === sourceItemRef);
+            if (!input)
+                semanticFactClosureInvalid("fact_source_input_missing", `${fact.key}:${sourceItemRef}`);
+            if (input.disposition !== "non_ui_material" ||
+                !input.fact_refs.includes(fact.key))
+                semanticFactClosureInvalid("fact_source_input_lineage_mismatch", `${fact.key}:${input.key}`);
+            return input.key;
+        });
+        if (!sourceInputRefs.length)
+            semanticFactClosureInvalid("fact_source_input_required", fact.key);
+    }
+}

package/dist/lib/long-task-semantic-fact-provenance-closure.d.ts

@@ -0,0 +1,4 @@
+import type { CompiledSourceItemV2 } from "./long-task-source-authority-types.js";
+import type { SemanticFactManifestV1 } from "./semantic-fact-types.js";
+export declare function validateSemanticFactProvenance(manifest: SemanticFactManifestV1, sourceItems: CompiledSourceItemV2[]): void;
+export declare function validateSemanticFactBasisClosure(manifest: SemanticFactManifestV1, sourceItems: CompiledSourceItemV2[]): void;

package/dist/lib/long-task-semantic-fact-provenance-closure.js

@@ -0,0 +1,140 @@
+import { semanticFactClosureInvalid } from "./long-task-semantic-fact-closure-primitives.js";
+export function validateSemanticFactProvenance(manifest, sourceItems) {
+    const sourceRefs = new Set(sourceItems.map((item) => item.key));
+    const inputByKey = new Map(manifest.inputs.map((item) => [item.key, item]));
+    const materialInputRefs = new Set(manifest.inputs
+        .filter((item) => item.disposition === "non_ui_material")
+        .map((item) => item.key));
+    const facts = new Map(manifest.facts.map((item) => [item.key, item]));
+    const isMaterialAuthority = (ref) => sourceRefs.has(ref) || materialInputRefs.has(ref);
+    for (const fact of manifest.facts)
+        validateFactAuthority(fact, facts, sourceRefs, inputByKey, isMaterialAuthority);
+    const grounded = new Map();
+    const visit = (factRef, active) => {
+        const cached = grounded.get(factRef);
+        if (cached !== undefined)
+            return cached;
+        if (active.has(factRef))
+            semanticFactClosureInvalid("fact_provenance_cycle", [...active, factRef].join("->"));
+        const fact = facts.get(factRef);
+        const next = new Set(active);
+        next.add(factRef);
+        const result = fact.provenance.basis_refs.some((ref) => isMaterialAuthority(ref) || (facts.has(ref) && visit(ref, next)));
+        grounded.set(factRef, result);
+        return result;
+    };
+    for (const fact of manifest.facts)
+        if (!visit(fact.key, new Set()))
+            semanticFactClosureInvalid("fact_provenance_ungrounded", fact.key);
+}
+function validateFactAuthority(fact, facts, sourceRefs, inputByKey, isMaterialAuthority) {
+    const authorityRef = fact.provenance.authority_ref;
+    if (!fact.provenance.basis_refs.includes(authorityRef))
+        semanticFactClosureInvalid("fact_authority_basis_missing", `${fact.key}:${authorityRef}`);
+    if (authorityRef === fact.key)
+        semanticFactClosureInvalid("fact_authority_self_reference", fact.key);
+    if (!isMaterialAuthority(authorityRef) && !facts.has(authorityRef))
+        semanticFactClosureInvalid("fact_authority_not_groundable", `${fact.key}:${authorityRef}`);
+    if (fact.provenance.kind !== "logically_derived" &&
+        !isMaterialAuthority(authorityRef))
+        semanticFactClosureInvalid("fact_direct_authority_required", `${fact.key}:${fact.provenance.kind}:${authorityRef}`);
+    if (sourceRefs.has(authorityRef) &&
+        !fact.source_item_refs.includes(authorityRef))
+        semanticFactClosureInvalid("fact_authority_source_lineage_mismatch", `${fact.key}:${authorityRef}`);
+    const authorityInput = inputByKey.get(authorityRef);
+    if (authorityInput && !authorityInput.fact_refs.includes(fact.key))
+        semanticFactClosureInvalid("fact_authority_input_lineage_mismatch", `${fact.key}:${authorityRef}`);
+    if (fact.provenance.kind === "explicitly_delegated" &&
+        authorityInput &&
+        authorityInput.kind !== "delegated_instruction" &&
+        authorityInput.kind !== "source_item")
+        semanticFactClosureInvalid("delegated_fact_authority_kind_mismatch", `${fact.key}:${authorityInput.kind}`);
+    if (fact.provenance.kind === "evidence_backed_preservation" &&
+        authorityInput &&
+        !["repository_preservation", "context", "source_item"].includes(authorityInput.kind))
+        semanticFactClosureInvalid("preservation_fact_authority_kind_mismatch", `${fact.key}:${authorityInput.kind}`);
+}
+export function validateSemanticFactBasisClosure(manifest, sourceItems) {
+    const known = semanticFactKnownBasisRefs(manifest, sourceItems);
+    const rows = [];
+    const collect = (label, values) => rows.push(...values.map((item) => ({
+        label: `${label}:${item.key}`,
+        refs: item.basis_refs,
+    })));
+    collect("scope_exclusion", manifest.scope.exclusions);
+    collect("input", manifest.inputs);
+    collect("census", manifest.inspector.census);
+    collect("family", manifest.family_dispositions);
+    collect("subject", manifest.subjects);
+    collect("relation", manifest.relations);
+    collect("population", manifest.populations);
+    collect("axis", manifest.axis_dispositions);
+    collect("axis_value", manifest.axis_dispositions.flatMap((item) => item.values));
+    collect("condition_rule", manifest.condition_rules);
+    collect("condition", manifest.conditions);
+    collect("condition_exclusion", manifest.condition_exclusions);
+    collect("property", manifest.property_dispositions);
+    collect("fact_cell", manifest.fact_cells);
+    addSpecialBasisRows(manifest, rows);
+    for (const row of rows)
+        for (const ref of row.refs)
+            if (!known.has(ref))
+                semanticFactClosureInvalid("basis_ref_unknown", `${row.label}:${ref}`);
+}
+function semanticFactKnownBasisRefs(manifest, sourceItems) {
+    return new Set([
+        manifest.key,
+        ...sourceItems.map((item) => item.key),
+        ...manifest.scope.exclusions.map((item) => item.key),
+        ...manifest.inputs.map((item) => item.key),
+        ...manifest.inspector.census.map((item) => item.key),
+        ...manifest.family_dispositions.map((item) => item.key),
+        ...manifest.subjects.map((item) => item.key),
+        ...manifest.relations.map((item) => item.key),
+        ...manifest.populations.map((item) => item.key),
+        ...manifest.axis_dispositions.map((item) => item.key),
+        ...manifest.axis_dispositions.flatMap((item) => item.values.map((value) => value.key)),
+        ...manifest.condition_rules.map((item) => item.key),
+        ...manifest.conditions.map((item) => item.key),
+        ...manifest.condition_exclusions.map((item) => item.key),
+        ...manifest.property_dispositions.map((item) => item.key),
+        ...manifest.fact_cells.map((item) => item.key),
+        ...manifest.facts.map((item) => item.key),
+        ...manifest.proof_obligations.map((item) => item.key),
+        ...manifest.oracles.map((item) => item.key),
+        ...manifest.environments.map((item) => item.key),
+        ...manifest.blockers.map((item) => item.key),
+    ]);
+}
+function addSpecialBasisRows(manifest, rows) {
+    for (const fact of manifest.facts)
+        rows.push({
+            label: `fact_provenance:${fact.key}`,
+            refs: fact.provenance.basis_refs,
+        });
+    for (const proof of manifest.proof_obligations)
+        rows.push({
+            label: `proof_counterfactual:${proof.key}`,
+            refs: proof.counterfactual.basis_refs,
+        });
+    for (const exclusion of manifest.scope.exclusions)
+        rows.push({
+            label: `scope_exclusion_affected:${exclusion.key}`,
+            refs: exclusion.affected_refs,
+        });
+    for (const population of manifest.populations)
+        rows.push({
+            label: `population_exclusions:${population.key}`,
+            refs: population.exclusion_refs,
+        });
+    for (const blocker of manifest.blockers)
+        rows.push({
+            label: `blocker_affected:${blocker.key}`,
+            refs: blocker.affected_refs,
+        });
+    for (const fact of manifest.facts)
+        rows.push({
+            label: `fact_authority:${fact.key}`,
+            refs: [fact.provenance.authority_ref],
+        });
+}

package/dist/lib/long-task-semantic-fact-shape.d.ts

@@ -0,0 +1,3 @@
+import type { SemanticFactManifestRefV2, SemanticFactOutcomeBindingsV2 } from "./semantic-fact-types.js";
+export declare function parseSemanticFactManifestRef(value: unknown, label: string): SemanticFactManifestRefV2;
+export declare function parseSemanticFactOutcomeBindings(value: unknown, label: string): SemanticFactOutcomeBindingsV2;

package/dist/lib/long-task-semantic-fact-shape.js

@@ -0,0 +1,89 @@
+import { array, EVIDENCE_CAPABILITIES, fail, literal, object, PROOF_SURFACES, repositoryFile, string, } from "./long-task-delivery-shape.js";
+export function parseSemanticFactManifestRef(value, label) {
+    const row = object(value, label, ["key", "source_path", "sha256"]);
+    return {
+        key: semanticRef(row.key, `${label}.key`),
+        source_path: repositoryFile(row.source_path, `${label}.source_path`),
+        sha256: sha256(row.sha256, `${label}.sha256`),
+    };
+}
+export function parseSemanticFactOutcomeBindings(value, label) {
+    const row = object(value, label, ["manifest_ref", "facts", "proofs"]);
+    return {
+        manifest_ref: semanticRef(row.manifest_ref, `${label}.manifest_ref`),
+        facts: array(row.facts, `${label}.facts`).map((item, index) => {
+            const itemLabel = `${label}.facts[${index}]`;
+            const entry = object(item, itemLabel, [
+                "fact_ref",
+                "claim_ref",
+                "applicability_ref",
+            ]);
+            return {
+                fact_ref: semanticRef(entry.fact_ref, `${itemLabel}.fact_ref`),
+                claim_ref: semanticRef(entry.claim_ref, `${itemLabel}.claim_ref`),
+                applicability_ref: semanticRef(entry.applicability_ref, `${itemLabel}.applicability_ref`),
+            };
+        }),
+        proofs: array(row.proofs, `${label}.proofs`).map((item, index) => {
+            const itemLabel = `${label}.proofs[${index}]`;
+            const preliminary = object(item, itemLabel, [
+                "proof_ref",
+                "fact_ref",
+                "method",
+                "proof_surface",
+                "evidence_capabilities",
+                "authority",
+            ], ["check_ref", "assertion_ref", "confirmation_ref"]);
+            const authority = literal(preliminary.authority, ["machine", "external_confirmation"], `${itemLabel}.authority`);
+            if (authority === "machine") {
+                requireOwned(preliminary, itemLabel, ["check_ref", "assertion_ref"]);
+                forbidOwned(preliminary, itemLabel, ["confirmation_ref"]);
+            }
+            else {
+                requireOwned(preliminary, itemLabel, ["confirmation_ref"]);
+                forbidOwned(preliminary, itemLabel, ["check_ref", "assertion_ref"]);
+            }
+            const base = {
+                proof_ref: semanticRef(preliminary.proof_ref, `${itemLabel}.proof_ref`),
+                fact_ref: semanticRef(preliminary.fact_ref, `${itemLabel}.fact_ref`),
+                method: semanticRef(preliminary.method, `${itemLabel}.method`),
+                proof_surface: literal(preliminary.proof_surface, PROOF_SURFACES, `${itemLabel}.proof_surface`),
+                evidence_capabilities: array(preliminary.evidence_capabilities, `${itemLabel}.evidence_capabilities`).map((capability, capabilityIndex) => literal(capability, EVIDENCE_CAPABILITIES, `${itemLabel}.evidence_capabilities[${capabilityIndex}]`)),
+            };
+            return authority === "machine"
+                ? {
+                    ...base,
+                    authority,
+                    check_ref: semanticRef(preliminary.check_ref, `${itemLabel}.check_ref`),
+                    assertion_ref: semanticRef(preliminary.assertion_ref, `${itemLabel}.assertion_ref`),
+                }
+                : {
+                    ...base,
+                    authority,
+                    confirmation_ref: semanticRef(preliminary.confirmation_ref, `${itemLabel}.confirmation_ref`),
+                };
+        }),
+    };
+}
+function semanticRef(value, label) {
+    const result = string(value, label);
+    if (!/^[a-z0-9][a-z0-9._:-]*$/u.test(result))
+        fail(label, "must be a stable lowercase semantic reference");
+    return result;
+}
+function sha256(value, label) {
+    const result = string(value, label);
+    if (!/^[a-f0-9]{64}$/u.test(result))
+        fail(label, "must be a lowercase SHA-256 digest");
+    return result;
+}
+function requireOwned(row, label, fields) {
+    const missing = fields.filter((field) => !Object.hasOwn(row, field));
+    if (missing.length)
+        fail(label, `missing keys: ${missing.join(",")}`);
+}
+function forbidOwned(row, label, fields) {
+    const present = fields.filter((field) => Object.hasOwn(row, field));
+    if (present.length)
+        fail(label, `forbidden keys: ${present.join(",")}`);
+}

package/dist/lib/long-task-semantic-fact-value-closure.d.ts

@@ -0,0 +1,3 @@
+import type { CompiledSourceItemV2 } from "./long-task-source-authority-types.js";
+import type { SemanticFactManifestV1 } from "./semantic-fact-types.js";
+export declare function validateSemanticFactLocatedValues(repository: string, manifest: SemanticFactManifestV1, sourceItems: CompiledSourceItemV2[]): Promise<void>;

package/dist/lib/long-task-semantic-fact-value-closure.js

@@ -0,0 +1,110 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { resolveSemanticFactPointer, semanticFactClosureInvalid, } from "./long-task-semantic-fact-closure-primitives.js";
+import { assertProtectedRepositoryFile } from "./long-task-protected-files.js";
+import { canonicalValueJson, parseStrictYaml, sha256Hex, } from "./strict-codec.js";
+export async function validateSemanticFactLocatedValues(repository, manifest, sourceItems) {
+    const values = collectLocatedValues(manifest);
+    const inputs = new Map(manifest.inputs.map((item) => [item.key, item]));
+    const sourceItemByKey = new Map(sourceItems.map((item) => [item.key, item]));
+    const resourceCache = new Map();
+    for (const entry of values) {
+        const located = entry.value;
+        if (located.representation === "digest_only")
+            continue;
+        const resolved = await resolveLocatedValue(repository, manifest, entry.label, located, inputs, sourceItemByKey, resourceCache);
+        if (resolved.external)
+            continue;
+        if (located.representation === "inline" &&
+            canonicalValueJson(resolved.value) !== canonicalValueJson(located.value))
+            semanticFactClosureInvalid("inline_value_locator_mismatch", entry.label);
+        const digest = sha256Hex(canonicalValueJson(resolved.value));
+        if (digest !== located.sha256)
+            semanticFactClosureInvalid("located_value_digest_mismatch", `${entry.label}:${located.sha256}:${digest}`);
+    }
+}
+function collectLocatedValues(manifest) {
+    return [
+        ...manifest.populations.map((item) => ({
+            label: `population:${item.key}:universe`,
+            value: item.universe,
+        })),
+        ...manifest.facts.map((item) => ({
+            label: `fact:${item.key}:expected`,
+            value: item.expected,
+        })),
+        ...manifest.proof_obligations.flatMap((item) => [
+            {
+                label: `proof:${item.key}:parameters`,
+                value: item.comparison.parameters,
+            },
+            ...(item.comparison.tolerance
+                ? [
+                    {
+                        label: `proof:${item.key}:tolerance`,
+                        value: item.comparison.tolerance,
+                    },
+                ]
+                : []),
+            ...(item.comparison.mask
+                ? [
+                    {
+                        label: `proof:${item.key}:mask`,
+                        value: item.comparison.mask,
+                    },
+                ]
+                : []),
+        ]),
+        ...manifest.environments.map((item) => ({
+            label: `environment:${item.key}`,
+            value: item.definition,
+        })),
+    ];
+}
+async function resolveLocatedValue(repository, manifest, label, located, inputs, sourceItemByKey, resourceCache) {
+    if (located.locator.kind === "manifest_pointer")
+        return {
+            external: false,
+            value: resolveSemanticFactPointer(manifest, located.locator.value, label),
+        };
+    const input = inputs.get(located.locator.material_ref);
+    if (!input)
+        semanticFactClosureInvalid("located_value_input_unknown", `${label}:${located.locator.material_ref}`);
+    if (located.locator.kind === "source_item") {
+        if (input.kind !== "source_item")
+            semanticFactClosureInvalid("located_value_source_item_kind_mismatch", label);
+        const sourceItem = sourceItemByKey.get(input.source_ref);
+        if (!sourceItem)
+            semanticFactClosureInvalid("located_value_source_item_unknown", label);
+        return { external: false, value: sourceItem.normalized_text };
+    }
+    const resource = await loadLocatedResource(repository, input.source_ref, label, located.locator.kind, resourceCache);
+    if (located.locator.kind === "whole_resource")
+        return { external: false, value: resource.raw };
+    if (located.locator.kind === "json_pointer" ||
+        located.locator.kind === "yaml_pointer" ||
+        located.locator.kind === "schema_pointer")
+        return {
+            external: false,
+            value: resolveSemanticFactPointer(resource.parsed, located.locator.value, label),
+        };
+    if (manifest.inspector.trust !== "named_external_tcb" ||
+        !manifest.inspector.capabilities.includes(`resolve.${located.locator.kind}`))
+        semanticFactClosureInvalid("located_value_external_resolver_required", `${label}:${located.locator.kind}`);
+    return { external: true, value: undefined };
+}
+async function loadLocatedResource(repository, sourceRef, label, locatorKind, cache) {
+    const cached = cache.get(sourceRef);
+    if (cached)
+        return cached;
+    const file = await assertProtectedRepositoryFile(repository, path.resolve(repository, ...sourceRef.split("/")), `semantic_fact_located_value:${label}`);
+    const raw = await readFile(file, "utf8");
+    let parsed = raw;
+    if (locatorKind === "json_pointer" || locatorKind === "schema_pointer")
+        parsed = JSON.parse(raw);
+    else if (locatorKind === "yaml_pointer")
+        parsed = parseStrictYaml(raw);
+    const resource = { raw, parsed };
+    cache.set(sourceRef, resource);
+    return resource;
+}

package/dist/lib/long-task-shape-primitives.d.ts

@@ -13,8 +13,9 @@ export declare function repositoryCwd(value: unknown, label: string): string;
 export declare function repositorySourceRef(value: unknown, label: string): string;
 export declare function literal<T extends string>(value: unknown, allowed: readonly T[], label: string): T;
 export declare function key(value: unknown, label: string): string;
+export declare function semanticRef(value: unknown, label: string): string;
 export declare function nullable<T>(value: unknown, parser: (value: unknown) => T): T | null;
 export declare const PROOF_SURFACES: readonly ["ui_browser", "runtime_behavior", "api_contract", "data_state", "security_boundary", "population_coverage", "implementation_structure"];
 export declare const JOURNEY_ROLES: readonly ["success", "degradation", "recovery", "stage_gate", "conformance"];
-export declare const EVIDENCE_CAPABILITIES: readonly ["presence", "interaction_trace", "state_delta", "cross_surface_consistency", "durable_readback", "boundary_invocation", "external_side_effect", "failure_injection", "visual_render", "design_conformance", "design_method", "target_runtime", "input_variation"];
+export declare const EVIDENCE_CAPABILITIES: readonly ["presence", "interaction_trace", "state_delta", "cross_surface_consistency", "durable_readback", "boundary_invocation", "external_side_effect", "failure_injection", "visual_render", "design_conformance", "design_method", "semantic_fact", "target_runtime", "input_variation"];
 export declare function fail(label: string, message: string): never;