worldvm 0.0.0-stage → 0.1.0

package/dist/_internal/reconciler/outputs.js

@@ -0,0 +1,132 @@
+import { contextOf } from "./context.js";
+import { ReadSet } from "./dependencies.js";
+import {} from "./model.js";
+import { evaluate } from "./requirements.js";
+export const allOf = (statuses) => {
+    const live = statuses.filter((s) => s !== "NotApplicable" && s !== "Waived");
+    if (statuses.length > 0 && live.length === 0)
+        return "NotApplicable";
+    if (live.includes("Overdue"))
+        return "Overdue";
+    if (live.includes("Open"))
+        return "Open";
+    if (live.includes("Unknown"))
+        return "Unknown";
+    return "Satisfied";
+};
+export const anyOf = (statuses) => {
+    const live = statuses.filter((s) => s !== "NotApplicable");
+    if (statuses.length > 0 && live.length === 0)
+        return "NotApplicable";
+    if (live.includes("Satisfied") || live.includes("Waived"))
+        return "Satisfied";
+    if (live.includes("Unknown"))
+        return "Unknown";
+    if (live.includes("Overdue") && !live.includes("Open"))
+        return "Overdue";
+    return "Open";
+};
+export const outputTexts = new WeakMap();
+export const outputText = (o) => {
+    let text = outputTexts.get(o);
+    if (text === undefined) {
+        text = `(${o.op} ${o.paths.map((path) => path.segments.join(".")).join(" ")})`;
+        outputTexts.set(o, text);
+    }
+    return text;
+};
+export function requirementStatus(ctx, inst, name) {
+    const partial = ctx.evaluating.get(inst.id)?.get(name);
+    if (partial)
+        return partial.status;
+    return ctx.state.status(inst, name);
+}
+export function statusAt(ctx, owner, segments, focus, reads) {
+    const [head, ...rest] = segments;
+    if (rest.length === 0) {
+        // An instance's own outputs read its requirements while it is still being evaluated.
+        const partial = ctx.evaluating.get(owner.id);
+        const r = partial ? undefined : evaluate(ctx, owner);
+        const output = ctx.programOf
+            .get(owner.id)
+            .components.get(owner.component)
+            .outputs.find((o) => o.name === head);
+        const own = partial?.get(head)?.status ??
+            r?.outputs.find((o) => o.name === head)?.status ??
+            r?.requirements.find((q) => q.name === head)?.status ??
+            (partial && output ? outputStatus(ctx, owner, output) : undefined);
+        if (own) {
+            reads.add({ kind: "status", instance: owner.id, name: head, value: own });
+            return own;
+        }
+    }
+    const slot = owner.children.find((s) => s.name === head);
+    if (!slot)
+        return "Unknown";
+    reads.add({
+        kind: "slot",
+        instance: owner.id,
+        name: head,
+        value: {
+            applies: slot.applies,
+            instances: [...slot.instances],
+        },
+    });
+    if (slot.applies === false)
+        return "NotApplicable";
+    if (slot.applies === "unknown")
+        return "Unknown";
+    const candidates = slot.instances.map((id) => ctx.instances.get(id));
+    const target = candidates.find((c) => {
+        if (focus === undefined)
+            return false;
+        reads.add({ kind: "members", instance: c.id, value: c.attached });
+        return c.attached.includes(focus);
+    }) ?? candidates.at(-1);
+    if (!target)
+        return "Unknown";
+    if (rest.length === 0)
+        return allOf(ctx.programOf
+            .get(target.id)
+            .components.get(target.component)
+            .outputs.map((output) => {
+            const value = ctx.state.status(target, output.name);
+            reads.add({ kind: "status", instance: target.id, name: output.name, value });
+            return value;
+        }));
+    return statusAt(ctx, target, rest, focus, reads);
+}
+export function outputStatus(ctx, inst, output) {
+    const key = JSON.stringify([inst.id, output.name]);
+    if (ctx.resolvingOutputs.has(key))
+        return "Unknown";
+    ctx.resolvingOutputs.add(key);
+    try {
+        const statuses = output.paths.map((path) => statusAt(ctx, inst, path.segments, ctx.rootFocus.get(inst.id), contextOf(ctx, inst).reads));
+        return output.op === "all-of"
+            ? allOf(statuses)
+            : output.op === "any-of"
+                ? anyOf(statuses)
+                : statuses[0];
+    }
+    finally {
+        ctx.resolvingOutputs.delete(key);
+    }
+}
+export const readStatus = (ctx, inst, name) => {
+    // Requirements are evaluated before children, so a child may read its parent's.
+    const partial = ctx.evaluating.get(inst.id)?.get(name);
+    if (partial)
+        return partial.status;
+    if (ctx.evaluating.has(inst.id)) {
+        const output = ctx.programOf
+            .get(inst.id)
+            .components.get(inst.component)
+            .outputs.find((output) => output.name === name);
+        return output ? outputStatus(ctx, inst, output) : "Unknown";
+    }
+    const r = evaluate(ctx, inst);
+    return (r.requirements.find((q) => q.name === name)?.status ??
+        r.outputs.find((o) => o.name === name)?.status ??
+        "Unknown");
+};

package/dist/_internal/reconciler/parameters.d.ts

@@ -0,0 +1,4 @@
+import type * as IR from "../world-ir/types.generated.js";
+import { type Program, type Value } from "./model.js";
+/** A shared occurrence receives the tightening intersection of its actual parent bindings. */
+export declare const compositionParameters: (p: Program, c: IR.Component, overrides: ReadonlyArray<NonNullable<IR.Slot["with"]>[number]>) => ReadonlyMap<string, Value> | undefined;

package/dist/_internal/reconciler/parameters.js

@@ -0,0 +1,27 @@
+import { Unknown } from "./model.js";
+/** A shared occurrence receives the tightening intersection of its actual parent bindings. */
+export const compositionParameters = (p, c, overrides) => {
+    if (!overrides.length)
+        return;
+    const values = new Map();
+    for (const item of overrides) {
+        const bound = c.paramBounds.find((b) => b.name === item.name);
+        const base = values.get(item.name) ??
+            p.params.get(item.name) ??
+            (bound.default.unit === "integer"
+                ? bound.default.n
+                : { n: bound.default.n, unit: bound.default.unit });
+        const n = typeof base === "number"
+            ? base
+            : base && typeof base === "object" && "n" in base
+                ? base.n
+                : null;
+        if (n === null) {
+            values.set(item.name, new Unknown(`Unknown composition parameter ${item.name}`));
+            continue;
+        }
+        const next = bound.tighten === "lower" ? Math.min(n, item.value.n) : Math.max(n, item.value.n);
+        values.set(item.name, bound.default.unit === "integer" ? next : { n: next, unit: bound.default.unit });
+    }
+    return new Map([...values].sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)));
+};

package/dist/_internal/reconciler/policies.d.ts

@@ -0,0 +1,22 @@
+import type * as IR from "../world-ir/types.generated.js";
+import { type Cx, type Truth, type Value } from "./model.js";
+export declare const occurrencePolicies: (cx: Cx) => readonly IR.AccountPolicy[];
+export declare const policyActive: (cx: Cx, policy: IR.AccountPolicy) => Truth;
+export declare const policyParameter: (cx: Cx, name: string, base: Value | undefined) => Value;
+export declare const policyRequirements: (cx: Cx) => {
+    label: string;
+    outcome: "unknown" | "passed" | "failed";
+    detail: string;
+    at: IR.Span;
+    truth: Truth;
+}[];
+export interface AuthorityConstraint {
+    readonly id: string | null;
+    readonly kind: "entity" | "group";
+    readonly policy: string;
+}
+export declare const policyAssignments: (cx: Cx, action: IR.Action) => readonly AuthorityConstraint[];
+export declare const permitsConstraints: (constraints: readonly AuthorityConstraint[], actor: {
+    readonly id: string;
+    readonly groups: readonly string[];
+}) => boolean;

package/dist/_internal/reconciler/policies.js

@@ -0,0 +1,94 @@
+import { and, evaluateIn, isUnknown, truth } from "./evaluation.js";
+import { readEffective } from "./effective.js";
+import { Unknown } from "./model.js";
+export const occurrencePolicies = (cx) => cx.inst ? (cx.p.account.policies ?? []).filter((p) => p.of === cx.inst.component) : [];
+export const policyActive = (cx, policy) => {
+    const guard = { ...cx, policyGuard: true };
+    const effective = policy.effective ? readEffective(guard, policy.effective).truth : true;
+    if (effective === false)
+        return false;
+    return and([effective, policy.when ? truth(evaluateIn(guard, policy.when)) : true]);
+};
+const numberValue = (n) => n.unit === "integer" ? n.n : { n: n.n, unit: n.unit };
+export const policyParameter = (cx, name, base) => {
+    const bound = cx.inst && cx.p.components.get(cx.inst.component).paramBounds?.find((b) => b.name === name);
+    if (!bound)
+        return base ?? new Unknown(`no ${name}`);
+    let value = base ?? numberValue(bound.default);
+    if (cx.policyGuard)
+        return value;
+    for (const policy of occurrencePolicies(cx)) {
+        const override = policy.params.find((p) => p.name === name);
+        if (!override)
+            continue;
+        const active = policyActive(cx, policy);
+        if (active === false)
+            continue;
+        if (active === "unknown")
+            return new Unknown(`Policy ${policy.name}: applicability unknown`);
+        const n = typeof value === "number"
+            ? value
+            : typeof value === "object" && value && "n" in value
+                ? value.n
+                : null;
+        if (n === null)
+            return new Unknown(`Policy ${policy.name}: unknown parameter ${name}`);
+        const next = bound.tighten === "lower" ? Math.min(n, override.value.n) : Math.max(n, override.value.n);
+        value = numberValue({ n: next, unit: bound.default.unit });
+    }
+    return value;
+};
+export const policyRequirements = (cx) => occurrencePolicies(cx).flatMap((policy) => {
+    if (!policy.require)
+        return [];
+    const active = policyActive(cx, policy);
+    if (active === false)
+        return [];
+    const value = evaluateIn(cx, policy.require);
+    const required = truth(value);
+    // An unknown guard cannot prove that an unsatisfied extra condition is inapplicable.
+    const result = active === true ? required : required === true ? true : "unknown";
+    return [
+        {
+            label: `Policy ${policy.name}`,
+            outcome: result === true
+                ? "passed"
+                : result === false
+                    ? "failed"
+                    : "unknown",
+            detail: `${policy.cites.map((c) => `${c.source} ${c.clause}`).join(", ")}: ${isUnknown(value) ? value.why : String(value)}${active === "unknown" ? "; applicability unknown" : ""}`,
+            at: policy.at,
+            truth: result,
+        },
+    ];
+});
+export const policyAssignments = (cx, action) => {
+    const restrictions = occurrencePolicies(cx).flatMap((policy) => {
+        const assignment = policy.assign.find((a) => a.action === action.name);
+        if (!assignment)
+            return [];
+        const active = policyActive(cx, policy);
+        if (active === false)
+            return [];
+        const value = active === true ? evaluateIn(cx, assignment.assignee) : null;
+        return [
+            {
+                id: typeof value === "string" && value.length ? value : null,
+                kind: assignment.assigneeKind,
+                policy: policy.name,
+            },
+        ];
+    });
+    if (!restrictions.length)
+        return [];
+    const base = action.assignee ? evaluateIn(cx, action.assignee) : null;
+    return [
+        {
+            id: typeof base === "string" && base.length ? base : null,
+            kind: action.assigneeKind ?? "entity",
+            policy: "library",
+        },
+        ...restrictions,
+    ];
+};
+export const permitsConstraints = (constraints, actor) => constraints.every((c) => c.id !== null && (c.kind === "entity" ? c.id === actor.id : actor.groups.includes(c.id)));

package/dist/_internal/reconciler/policy-edits.d.ts

@@ -0,0 +1,11 @@
+import type { Basis } from "./basis.js";
+import type { Program, WorldReconciliation, UpgradeConsequence } from "./model.js";
+export interface PolicyParameterPreview {
+    readonly program: Program;
+    readonly current: WorldReconciliation;
+    readonly candidate: WorldReconciliation;
+    readonly impact: readonly UpgradeConsequence[];
+}
+/** Account data edits change only bounded values in an already compiled policy. Authoring
+ * targets, guards, citations and authority still goes through the language compiler. */
+export declare const previewPolicyParameters: (program: Program, name: string, input: unknown, snapshot: Basis) => PolicyParameterPreview;

package/dist/_internal/reconciler/policy-edits.js

@@ -0,0 +1,42 @@
+import { Schema } from "effect";
+import { PolicyNumber } from "../world-ir/schema.generated.js";
+import { link } from "./linking.js";
+import { reconcile } from "./reconcile.js";
+import { planUpgrade } from "./upgrades.js";
+const decode = Schema.decodeUnknownSync(Schema.Record(Schema.String, PolicyNumber));
+/** Account data edits change only bounded values in an already compiled policy. Authoring
+ * targets, guards, citations and authority still goes through the language compiler. */
+export const previewPolicyParameters = (program, name, input, snapshot) => {
+    const parameters = decode(input, { onExcessProperty: "error" });
+    if (!Object.keys(parameters).length)
+        throw new Error("A policy edit needs at least one parameter");
+    const policy = program.sourceIR.accounts
+        .find((a) => a.name === program.account.name)
+        ?.policies?.find((p) => p.name === name);
+    if (!policy)
+        throw new Error(`No published account policy ${name}`);
+    const byName = new Map(policy.params.map((p) => [p.name, p]));
+    for (const [key, value] of Object.entries(parameters))
+        byName.set(key, { name: key, value: { n: value.n, unit: value.unit }, at: policy.at });
+    const next = {
+        ...policy,
+        params: [...byName.values()].sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0)),
+    };
+    const ir = {
+        ...program.sourceIR,
+        accounts: program.sourceIR.accounts.map((a) => a.name !== program.account.name
+            ? a
+            : {
+                ...a,
+                policies: a.policies.map((p) => (p.name === name ? next : p)),
+            }),
+    };
+    const candidateProgram = link(ir, program.account.name);
+    const current = reconcile([program], snapshot), candidate = reconcile([candidateProgram], snapshot);
+    return {
+        program: candidateProgram,
+        current,
+        candidate,
+        impact: planUpgrade(current, candidate, snapshot.now),
+    };
+};

package/dist/_internal/reconciler/policy-linking.d.ts

@@ -0,0 +1,4 @@
+import type * as IR from "../world-ir/types.generated.js";
+import type { Program } from "./model.js";
+export declare const policyRelease: (account: IR.Account, library: IR.Library) => string;
+export declare const validatePolicies: (program: Program) => void;

package/dist/_internal/reconciler/policy-linking.js

@@ -0,0 +1,104 @@
+import { policyBoundValid, policyValueWithin, policyParameterType, principalKinds, principalActionKey, } from "../ir-checks/index.js";
+import { isDuration } from "./evaluation.js";
+import { semanticJson } from "./result-digest.js";
+import { sha256 } from "./sha256.js";
+export const policyRelease = (account, library) => {
+    const legacy = `${library.name}@${library.version} · ${library.digest.slice(0, 6)}`;
+    return account.policies?.length
+        ? `${legacy} · ${sha256(semanticJson({ account, library: library.digest }))}`
+        : legacy;
+};
+export const validatePolicies = (program) => {
+    const fail = (message) => {
+        throw new Error(`E_POLICY_LOOSENS: ${message}. Republish bounded policy data.`);
+    };
+    for (const component of program.components.values()) {
+        const names = new Set();
+        for (const bound of component.paramBounds ?? []) {
+            const param = component.params.find((p) => p.name === bound.name);
+            if (names.has(bound.name) ||
+                !policyBoundValid(bound) ||
+                !param ||
+                policyParameterType(param.type, program.ir.types) !==
+                    (bound.default.unit === "integer" ? "integer" : "duration"))
+                fail(`Invalid bounds for ${component.name}.${bound.name}`);
+            names.add(bound.name);
+            const value = program.params.get(bound.name);
+            if (value !== undefined &&
+                !policyValueWithin(bound, typeof value === "number"
+                    ? { n: value, unit: "integer" }
+                    : // Policy bounds compare exact day/year/hour/minute counts; months are not bounded.
+                        isDuration(value) && value.unit !== "months"
+                            ? { n: value.n, unit: value.unit }
+                            : { n: -1, unit: "integer" }))
+                fail(`Invalid account parameter ${bound.name}`);
+        }
+    }
+    const names = new Set();
+    for (const policy of program.account.policies ?? []) {
+        const component = program.components.get(policy.of);
+        if (names.has(policy.name) || !component || !policy.cites.length || !policy.doc.trim())
+            fail(`Invalid policy ${policy.name}`);
+        const closed = (expr, guard = false, bound = new Set()) => {
+            if (expr.k === "var" &&
+                !bound.has(expr.name) &&
+                (expr.name === "self" ||
+                    component.requirements.some((r) => r.name === expr.name) ||
+                    component.inputs.some((i) => i.name === expr.name && !component.key.includes(i.name)) ||
+                    (guard && component.params.some((p) => p.name === expr.name))))
+                fail(`Circular or non-keyed policy expression ${policy.name}`);
+            if (expr.k === "inst" ||
+                (expr.k === "ref" && expr.kind !== "evidence" && expr.kind !== "calendar"))
+                fail(`Policy status projection ${policy.name}`);
+            if (expr.k === "call")
+                expr.args.forEach((e) => closed(e, guard, bound));
+            if (expr.k === "list")
+                expr.items.forEach((e) => closed(e, guard, bound));
+            if (expr.k === "if")
+                [expr.test, expr.then, expr.else].forEach((e) => closed(e, guard, bound));
+            if (expr.k === "fn")
+                closed(expr.body, guard, new Set([...bound, ...expr.params]));
+            if (expr.k === "read" || expr.k === "attr")
+                closed(expr.of, guard, bound);
+        };
+        if (policy.when)
+            closed(policy.when, true);
+        if (policy.require)
+            closed(policy.require);
+        policy.assign.forEach((a) => closed(a.assignee));
+        names.add(policy.name);
+        const params = new Set();
+        for (const override of policy.params) {
+            const bound = component.paramBounds?.find((b) => b.name === override.name);
+            if (params.has(override.name) || !bound || !policyValueWithin(bound, override.value))
+                fail(`Invalid policy override ${policy.name}.${override.name}`);
+            params.add(override.name);
+        }
+        const actions = new Set();
+        for (const restriction of policy.assign) {
+            const action = component.actions.find((a) => a.name === restriction.action);
+            if (actions.has(restriction.action) || !action?.assignee || action.via.kind !== "interaction")
+                fail(`Invalid policy assignment ${policy.name}.${restriction.action}`);
+            const kinds = principalKinds({
+                ...program.ir,
+                components: program.ir.components.map((c) => c.name === component.name
+                    ? {
+                        ...c,
+                        actions: [
+                            {
+                                ...action,
+                                assignee: restriction.assignee,
+                                assigneeKind: restriction.assigneeKind,
+                            },
+                        ],
+                    }
+                    : c),
+            }, true);
+            if (kinds.diagnostics.length ||
+                kinds.assignees.get(principalActionKey(component.name, restriction.action)) !==
+                    restriction.assigneeKind)
+                fail(`Invalid policy principal ${policy.name}`);
+            actions.add(restriction.action);
+        }
+    }
+};

package/dist/_internal/reconciler/principal-types.d.ts

@@ -0,0 +1,2 @@
+import type * as IR from "../world-ir/types.generated.js";
+export declare const withPrincipalKinds: (ir: IR.WorldIR) => IR.WorldIR;

package/dist/_internal/reconciler/principal-types.js

@@ -0,0 +1,38 @@
+import { principalActionKey, principalEscalationKey, principalKinds } from "../ir-checks/index.js";
+const checked = new WeakMap();
+export const withPrincipalKinds = (ir) => {
+    const cached = checked.get(ir);
+    if (cached)
+        return cached;
+    const kinds = principalKinds(ir, true), diagnostic = kinds.diagnostics[0];
+    if (diagnostic) {
+        const at = diagnostic.at;
+        throw new Error(`${diagnostic.code}: ${diagnostic.message}${at ? ` (${at.src}:${at.line}:${at.col})` : ""} ${diagnostic.help} Republish this model.`);
+    }
+    const components = ir.components.map((component) => ({
+        ...component,
+        requirements: component.requirements.map((requirement) => requirement.escalate
+            ? {
+                ...requirement,
+                escalate: requirement.escalate.map((step, index) => {
+                    const kind = kinds.escalations.get(principalEscalationKey(component.name, requirement.name, index));
+                    return { ...step, whoKind: kind };
+                }),
+            }
+            : requirement),
+        actions: component.actions.map((action) => {
+            const kind = kinds.assignees.get(principalActionKey(component.name, action.name));
+            return kind && action.assigneeKind === undefined ? { ...action, assigneeKind: kind } : action;
+        }),
+    }));
+    const decisions = ir.decisions?.map((decision) => {
+        const kind = kinds.authorities.get(decision.name);
+        return decision.byKind === undefined && kind
+            ? { ...decision, byKind: kind === "entity" ? "individual" : "group" }
+            : decision;
+    });
+    const normalized = { ...ir, components, ...(decisions ? { decisions } : {}) };
+    checked.set(ir, normalized);
+    checked.set(normalized, normalized);
+    return normalized;
+};

package/dist/_internal/reconciler/prior-decisions.d.ts

@@ -0,0 +1,3 @@
+import type * as IR from "../world-ir/types.generated.js";
+/** Elaborate prior-cycle sugar from canonical metadata, never entity scans. */
+export declare const withPriorDecisions: (ir: IR.WorldIR) => IR.WorldIR;

package/dist/_internal/reconciler/prior-decisions.js

@@ -0,0 +1,34 @@
+import { priorCycleDecisions } from "../ir-checks/index.js";
+/** Elaborate prior-cycle sugar from canonical metadata, never entity scans. */
+export const withPriorDecisions = (ir) => {
+    const added = [];
+    for (const component of ir.components)
+        for (const requirement of component.requirements)
+            if (requirement.accepts?.from && !requirement.accepts.with) {
+                const path = component.home.path;
+                let by = { k: "var", name: path[0], at: requirement.at };
+                for (const field of path.slice(1))
+                    by = { k: "inst", of: by, field, at: requirement.at };
+                if (requirement.accepts.confirm)
+                    by = requirement.accepts.confirm;
+                const definitions = priorCycleDecisions({
+                    component: component.name,
+                    requirement: requirement.name,
+                    by,
+                    ...(!requirement.accepts.confirm ? { byKind: "individual" } : {}),
+                    at: requirement.at,
+                    ...(requirement.cites ? { cites: requirement.cites } : {}),
+                });
+                const explicit = ir.decisions?.find((d) => d.of === component.name &&
+                    d.applies === requirement.name &&
+                    d.effect === "accept" &&
+                    d.name !== definitions[0].name);
+                const contracts = explicit
+                    ? [{ ...explicit, name: definitions[1].name, effect: "reject" }]
+                    : definitions;
+                for (const definition of contracts)
+                    if (!ir.decisions?.some((d) => d.name === definition.name && d.of === definition.of))
+                        added.push(definition);
+            }
+    return added.length ? { ...ir, decisions: [...(ir.decisions ?? []), ...added] } : ir;
+};

package/dist/_internal/reconciler/projections.d.ts

@@ -0,0 +1,4 @@
+import { type EvaluationContext } from "./context.js";
+import { type WorldReconciliation } from "./model.js";
+import { discoveryProvenance } from "./provenance.js";
+export declare const finishReconciliation: (ctx: EvaluationContext, discovery: ReturnType<typeof discoveryProvenance>) => WorldReconciliation;

package/dist/_internal/reconciler/projections.js

@@ -0,0 +1,85 @@
+import { resolveWorkConflicts } from "./work.js";
+import {} from "./context.js";
+import { DependencyMap, isLocalDependency, ReadSet } from "./dependencies.js";
+import { occurrenceHome } from "./homes.js";
+import {} from "./model.js";
+import { discoveryProvenance } from "./provenance.js";
+import { makeResultDigester } from "./result-digest.js";
+import { nextWake } from "./temporal.js";
+export const finishReconciliation = (ctx, discovery) => {
+    resolveWorkConflicts(ctx);
+    const scope = ctx.scope;
+    let discoveryReads = discovery;
+    const selected = scope
+        ? new Map([...ctx.instances].filter(([, inst]) => scope.select(inst)))
+        : ctx.instances;
+    const projectedResults = scope
+        ? new Map([...ctx.results].filter(([id]) => selected.has(id)))
+        : ctx.results;
+    const selectedResults = new Map();
+    const groups = new Map();
+    const discoveryByGroup = new Map();
+    const footprints = new Map();
+    for (const [id] of projectedResults) {
+        const inst = ctx.instances.get(id), p = ctx.programOf.get(id);
+        const home = occurrenceHome(p, inst, ctx.instances);
+        let homes = groups.get(p);
+        if (!homes) {
+            homes = new Map();
+            groups.set(p, homes);
+        }
+        const homeKey = home?.id ?? id;
+        let shared = homes.get(homeKey);
+        if (!shared) {
+            shared = new ReadSet();
+            homes.set(homeKey, shared);
+            const discovered = home ? discoveryReads(p, home.id) : new Map();
+            for (const [key, d] of discovered)
+                if (!isLocalDependency(d))
+                    shared.add(d, key);
+            discoveryByGroup.set(shared, discovered);
+        }
+        const local = new ReadSet();
+        for (const [key, d] of ctx.contexts.get(id).reads.entries())
+            (isLocalDependency(d) ? local : shared).add(d, key);
+        local.merge(discoveryByGroup.get(shared), isLocalDependency);
+        footprints.set(id, { shared, local: local.snapshot() });
+    }
+    if (scope)
+        scope.reads.merge(discoveryReads(ctx.programs[0], scope.home.id));
+    // All discovery closures have been materialized; release temporary projection graphs.
+    ctx.discoveryReadSets = new Map();
+    discoveryReads = undefined;
+    ctx.contexts.clear();
+    ctx.observations.clear();
+    ctx.predictions.clear();
+    const dependencies = new Map();
+    for (const [id, footprint] of footprints)
+        dependencies.set(id, new DependencyMap(footprint.shared.snapshot(), footprint.local));
+    footprints.clear();
+    groups.clear();
+    discoveryByGroup.clear();
+    const digester = makeResultDigester();
+    for (const [id, result] of projectedResults) {
+        const dependsOn = dependencies.get(id);
+        const complete = { ...result, ...nextWake(dependsOn.local.values(), ctx.now), dependsOn };
+        selectedResults.set(id, {
+            ...complete,
+            digest: digester.digest(ctx.instances.get(id), complete),
+        });
+    }
+    if (scope)
+        for (const result of selectedResults.values())
+            scope.reads.merge(result.dependsOn);
+    return {
+        releases: [...new Set(ctx.programs.map((p) => p.release))],
+        now: ctx.now,
+        roots: scope ? ctx.roots.filter((r) => selected.has(r.instance)) : ctx.roots,
+        instances: selected,
+        results: selectedResults,
+        blockedTotal: scope
+            ? [...selectedResults.values()].reduce((n, r) => n + r.blocked.length, 0)
+            : ctx.blockedTotal,
+        programs: ctx.programs,
+    };
+};

package/dist/_internal/reconciler/proofs.d.ts

@@ -0,0 +1,9 @@
+import { type LocalDate } from "./dates.js";
+import { type RequirementResult } from "./model.js";
+/** SHA-256 over canonical JSON data; key insertion order never affects the digest. */
+export declare const digest: (value: unknown) => string;
+/** The decision projection deliberately excludes source spans and presentation labels. */
+export declare const canonicalDecision: (release: string, now: LocalDate, r: RequirementResult) => string;
+/** A decision digest is reproducible, not a signature or a durable basis proof. */
+export declare const proofOf: (release: string, now: LocalDate, r: RequirementResult) => string;
+export declare const verifyProof: (proof: string, release: string, now: LocalDate, r: RequirementResult) => boolean;

package/dist/_internal/reconciler/proofs.js

@@ -0,0 +1,24 @@
+import {} from "./dates.js";
+import {} from "./model.js";
+import { canonicalJson } from "./result-digest.js";
+import { sha256 } from "./sha256.js";
+/** SHA-256 over canonical JSON data; key insertion order never affects the digest. */
+export const digest = (value) => sha256(canonicalJson(value));
+/** The decision projection deliberately excludes source spans and presentation labels. */
+export const canonicalDecision = (release, now, r) => canonicalJson({
+    format: "worldvm/decision@1",
+    release,
+    occurrence: r.occurrence,
+    status: r.status,
+    reasons: r.reasons.map((x) => [x.label, x.outcome, x.detail]),
+    evidence: r.evidence?.id ?? null,
+    ...(r.decision ? { decision: r.decision } : {}),
+    ...(r.decisionVotes ? { votes: r.decisionVotes } : {}),
+    ...(r.addition ? { addition: r.addition } : {}),
+    ...(r.additionVotes ? { additionVotes: r.additionVotes } : {}),
+    due: r.due,
+    now: r.status === "Overdue" || r.status === "Open" ? now : null,
+});
+/** A decision digest is reproducible, not a signature or a durable basis proof. */
+export const proofOf = (release, now, r) => `d:${sha256(canonicalDecision(release, now, r))}`;
+export const verifyProof = (proof, release, now, r) => proof === proofOf(release, now, r);