contract-assay 0.1.3__tar.gz

contract_assay-0.1.3/.github/ISSUE_TEMPLATE/adapter.md

@@ -0,0 +1,15 @@
+---
+name: New adapter
+about: A source of records the corpus does not have
+labels: corpus
+---
+
+**The population** — audit review, incident archive, or something else:
+
+**What the source publishes** — enough to pin bytes and locate a defect, or
+not, and what has to be resolved:
+
+**What your adapter refuses** — the cases it drops rather than guesses, and the
+count it reports for them:
+
+**Sample** — two or three records it produces, verified:

contract_assay-0.1.3/.github/ISSUE_TEMPLATE/record.md

@@ -0,0 +1,21 @@
+---
+name: New corpus record
+about: A defect with a reproducible basis
+labels: corpus
+---
+
+**Where the claim comes from** (report URL, contest, or incident):
+
+**The pin** — repository and commit, or chain id and address plus fork point:
+
+**The locator** — file, contract, function, start and end line:
+
+**Where the locator came from** — stated in the source, or resolved by you, and
+if resolved, from what:
+
+**Class** — one of the nine in `VulnerabilityClass`, and why that one:
+
+**What you have checked**
+
+- [ ] `contract-assay verify` passes for this record against a fetched checkout
+- [ ] The claim is in my own words; no report prose is copied

contract_assay-0.1.3/.github/ISSUE_TEMPLATE/result.md

@@ -0,0 +1,19 @@
+---
+name: Published result
+about: A pointer to a score document you stand behind
+labels: results
+---
+
+**Submission id** and one sentence on what the harness does:
+
+**Where the document is** — a URL that will keep resolving:
+
+**The six fields** — engine version, corpus digest, strength floor, weights,
+predictions per unit, main model. Two results compare only when these agree.
+
+**Who adjudicated the predictions** — and their relationship to the harness's
+author. A harness's author cannot adjudicate its own predictions.
+
+- [ ] The pointer was built from the document with `pointer_from_document`,
+      not typed by hand
+- [ ] I have read `results/README.md` on what a pointer does not establish

contract_assay-0.1.3/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,19 @@
+## What this changes
+
+<!-- One sentence. If it changes a published figure, say which and to what. -->
+
+## What it establishes
+
+<!-- For a record: the pinned bytes, the locator, and where the locator came
+     from. For an adapter: which population, and what it refuses. For a result:
+     the pointer and the document it was built from. For code: the measurement
+     that shows it works, not the argument that it should. -->
+
+## Checks
+
+- [ ] `ruff check . && ruff format --check . && mypy && pytest -q -m offline`
+- [ ] New or changed behaviour has a test that fails when the behaviour is
+      reverted (a count is not a behaviour — assert the reason)
+- [ ] Any figure stated in code, docs or the commit message was measured, and
+      the command that measured it is in the message
+- [ ] For a record: `contract-assay verify corpus/records --source-root ./checkout`

contract_assay-0.1.3/.github/workflows/ci.yml

@@ -0,0 +1,131 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  gate:
+    # The offline gate: no model, no network, no sandbox runtime, no solc.
+    # It must stay fast and deterministic, because a gate that is slow or flaky
+    # gets bypassed, and a bypassed gate is the reason broken detectors survive.
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12"]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e . --group dev
+
+      - name: Lint
+        run: ruff check --output-format=github .
+
+      - name: Format
+        run: ruff format --check .
+
+      - name: Types
+        run: mypy
+
+      - name: Types (tools)
+        # `tools/` is outside the package and so outside `packages = [...]`, but
+        # it is what built the corpus: `harvest_sherlock.py` reuses one loop
+        # variable for `SkipCause` and `NormalizeCause`, which mypy caught and
+        # which would have printed one stage's losses under the other's name.
+        # A script that produced records is not a scratch file.
+        run: mypy tools
+
+      - name: Tests
+        run: pytest -m offline --cov=contract_assay --cov-report=term-missing --cov-fail-under=90
+      - name: Published result pointers
+        # `results/README.md` says "open a pull request with that one file" and
+        # nothing checked the file. `load_pointers` is all-or-nothing by design
+        # -- a directory that silently drops a result is a comparison over a
+        # subset nobody chose -- so one bad merged pointer makes
+        # `contract-assay results` exit 1 for every user until somebody reverts
+        # it. The gate is where that is caught, on the pull request that adds it.
+        run: contract-assay results results
+
+  clean-install:
+    # A clean install on a machine whose Python has no CA bundle wired in.
+    #
+    # `contract-assay fetch` -- the documented first step -- failed on all 141
+    # pins after either documented install, because `certifi` was used when
+    # importable and never declared. Two earlier reviews found that and fixed
+    # the *mypy* consequence twice: every job here is `ubuntu-latest`, where
+    # urllib does consult the system store, and the one test that covered the
+    # mitigation was an `importorskip` that skipped in exactly the environment
+    # where the bug bites. This job is the environment.
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install as the docs say
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e . --group dev
+
+      - name: Fetch the pinned source
+        run: contract-assay fetch corpus/records --source-root ./checkout
+
+      - name: The gate, on this platform
+        run: pytest -m offline
+
+  figures:
+    # The numbers the docstrings publish, checked against a real checkout.
+    #
+    # Eight review rounds found, every time, a figure re-measured on one side of
+    # a comparison and not the other -- a before/after drawn from two submission
+    # files, a table mixing two checkouts, an honest ceiling published three
+    # ways. The generator was structural: the figures lived in prose and nothing
+    # recomputed them. This job is the fix, so a figure that moves fails here
+    # instead of waiting for somebody to re-derive it by hand.
+    #
+    # Separate from `gate` because it needs the network: the checkout is fetched
+    # from the coordinates the corpus pins. The offline gate stays offline.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e . --group dev
+
+      - name: Fetch the pinned source
+        run: contract-assay fetch corpus/records --source-root ./checkout
+
+      - name: Verify the corpus against it
+        # Exits 1 on the shipped corpus: one record pins verified source for a
+        # deployed address, which no repository checkout can hold. The gate is
+        # that no *new* record joins it, so the count is asserted rather than
+        # the exit code.
+        run: |
+          contract-assay verify corpus/records --source-root ./checkout > verify.txt || true
+          cat verify.txt
+          grep -q "477 records admitted; 1 of 478" verify.txt
+
+      - name: Published figures
+        run: pytest -m checkout

contract_assay-0.1.3/.github/workflows/release.yml

@@ -0,0 +1,171 @@
+name: Release
+
+# Publishes on a tag, after **the same gate that guards a commit** has run
+# against the artefact that will be uploaded. The first version of this file
+# claimed that and did not do it: it installed `pytest` and never called it,
+# ran three asserts, and `ci.yml` does not trigger on a tag push at all -- so a
+# commit whose tests failed could be tagged and published with a green check.
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      # As `ci.yml` sets it. Without this the matrix cancels the surviving leg,
+      # so a failure on one interpreter hides whether the other would have
+      # passed.
+      fail-fast: false
+      matrix:
+        # The same matrix `ci.yml` uses. A release tested on fewer interpreters
+        # than the commits it contains is a weaker claim than the commits made.
+        python-version: ["3.11", "3.12"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: The version in the package must be the version in the tag
+        # Nothing tied them before. `report/wire.py` writes `__version__` into
+        # every score document as `engine_version`, and `engine_version` is one
+        # of the fields two published results must agree on -- so a tag ahead of
+        # the package would publish documents claiming a version the package
+        # does not have, grouping with genuine results of that version. PyPI
+        # does not allow re-uploading a version, so the only remedy would be
+        # burning one.
+        if: startsWith(github.ref, 'refs/tags/v')
+        run: |
+          set -euo pipefail
+          tagged="${GITHUB_REF_NAME#v}"
+          declared="$(sed -n 's/^__version__ = "\(.*\)"$/\1/p' src/contract_assay/__init__.py)"
+          echo "tag=${tagged} package=${declared}"
+          test -n "${declared}"
+          test "${tagged}" = "${declared}"
+
+      - name: Build the wheel and the sdist
+        run: |
+          set -euo pipefail
+          python -m pip install --upgrade pip build
+          python -m build
+
+      - name: Install the built wheel, not the source tree
+        # The point of the step. `pip install -e .` proves the repository works;
+        # it does not prove the wheel does, and the two differ exactly where a
+        # release goes wrong -- a file the package data missed, a module the
+        # discovery skipped, `py.typed` absent so a typed consumer cannot import
+        # it at all, which this project has shipped once already.
+        #
+        # No `|| pip install <wheel>` fallback. The earlier one masked the one
+        # failure it existed to catch: an extra whose constraint has become
+        # unsatisfiable publishes with a green check and a broken `[slither]`.
+        # The extra is installed in its own step below, which is allowed to fail
+        # loudly without blocking a release that does not depend on it.
+        run: |
+          set -euo pipefail
+          python -m pip install "$(ls dist/*.whl)"
+          # The project's own tool *bounds*, not whatever resolves today -- and
+          # bounds rather than pins, which is worth saying precisely because the
+          # first version of this comment said "pinned". `pyproject.toml`
+          # declares `ruff>=0.16.7,<0.17`, so a release can still resolve 0.16.8
+          # against a CI run that resolved 0.16.7. What the upper bound buys is
+          # that the failure named below cannot happen; what it does not buy is
+          # two identical resolutions.
+          # `ruff format --check` and new lint rules are version-sensitive, so
+          # unpinned tools mean the first ruff 0.17 turns every tagged release
+          # red under a check `ci.yml` never applied -- which is not "the same
+          # gate", whatever the step is called. A review measured the drift
+          # already: the release env resolved ruff 0.16.8 against the project's
+          # 0.16.7.
+          python -m pip install --group dev
+
+      - name: The gate, against the installed wheel
+        # `ruff`, `ruff format --check`, `mypy` and the offline suite with the
+        # same coverage floor `ci.yml` applies. Run from the checkout for the
+        # tests and the linters, with the *wheel* on `sys.path` rather than the
+        # source tree, so what is exercised is what will be uploaded.
+        run: |
+          set -euo pipefail
+          ruff check .
+          ruff format --check .
+          mypy
+          python -m pytest -q -m offline --cov=contract_assay --cov-fail-under=90
+          # `ci.yml`'s last step, which this omitted while the header claimed
+          # "the same gate that guards a commit". It exits 1 on a malformed
+          # published pointer, and nothing else validates `results/`.
+          contract-assay results results
+
+      - name: The documented entry points, from the wheel and nowhere near the checkout
+        run: |
+          set -euo pipefail
+          cd "$(mktemp -d)"
+          python - <<'PY'
+          from pathlib import Path
+          import contract_assay
+          assert (Path(contract_assay.__file__).parent / "py.typed").is_file(), "py.typed missing"
+          from contract_assay.detectors import API_VERSION, PredicateDetector
+          from contract_assay.evidence import Syntax, run_all
+          from contract_assay.harness import SourceUnit, run_submission
+          from contract_assay.models import Outcome, VulnerabilityClass as V
+
+          class Baseline(PredicateDetector):
+              detector_id = "release-smoke"
+              class_id = V.ACCESS_CONTROL
+              api_version = API_VERSION
+
+          src = "contract V { address o; function setO(address w) external { o = w; } }"
+          parsed = Syntax.of(src)
+          assert parsed is not None, "the shipped parser could not read a contract"
+          refs = run_all(parsed, "V.sol", classes=[V.ACCESS_CONTROL])
+          assert refs, "the shipped evidence layer established nothing"
+          runs = list(run_submission([Baseline()], [SourceUnit("x", "V.sol", src)]))
+          assert len(runs) == 1
+          # A finding, not just an evidence item: the earlier gate imported
+          # `run_submission` and never called it, while the commit message said
+          # it produced a finding.
+          assert runs[0].outcome is Outcome.VULNERABLE, runs[0].outcome
+          assert runs[0].findings, "the baseline produced no finding from the wheel"
+          assert runs[0].produced_without_a_model is True
+          print(f"{contract_assay.__version__}: {len(refs)} evidence item(s), "
+                f"{len(runs[0].findings)} finding(s)")
+          PY
+          contract-assay --version
+
+      - name: The slither extra, allowed to fail without blocking the release
+        continue-on-error: true
+        run: python -m pip install "$(ls dist/*.whl)[slither]"
+
+      - uses: actions/upload-artifact@v4
+        if: matrix.python-version == '3.11'
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    needs: build
+    # A tag only. `workflow_dispatch` builds and gates from any ref, which is
+    # useful; publishing from one is not, and the header comment said "publishes
+    # on a tag" while the button published from wherever it was pressed.
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    environment: pypi
+    # Trusted publishing: no token is stored in this repository. A long-lived
+    # PyPI token in repository secrets is a credential that outlives every
+    # reason it was created for.
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1

contract_assay-0.1.3/.gitignore

@@ -0,0 +1,43 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+build/
+dist/
+.venv/
+venv/
+
+# Tooling caches
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+.coverage
+htmlcov/
+
+# Corpus working area (pointer-based records are tracked; fetched sources are not)
+corpus/_fetched/
+corpus/_build/
+
+# Run artifacts
+runs/
+*.jsonl
+
+# Editor / OS
+.DS_Store
+.idea/
+.vscode/
+
+# A fetched source checkout. 134 files, reproducible from the pins.
+# Anchored: an unanchored `checkout/` also ignored `tests/checkout/`, which is
+# how the module that pins the published figures went missing from its own
+# commit.
+/checkout/
+
+# Tool caches. Anchored, for the reason `/checkout/` is: an unanchored rule
+# here would also ignore a directory of the same name under `tests/`.
+# The measurements in `docs/measurements/` are tracked; the thousands of cached
+# HTTP and JSON-RPC responses they were computed from are not.
+/.harvest-cache/
+/.c4-cache/
+/.incident-cache/
+/.proxy-cache/

contract_assay-0.1.3/AGENTS.md

@@ -0,0 +1,30 @@
+# contract-assay
+
+A benchmark that scores smart-contract vulnerability detectors against a corpus of located, digest-pinned records, and ranks them without inventing a figure it cannot measure.
+
+## Setup and the gate
+
+```console
+$ pip install -e . --group dev          # needs pip >= 25.1
+$ ruff check . && ruff format --check . && mypy && mypy tools
+$ pytest -m offline --cov=contract_assay --cov-fail-under=90
+$ contract-assay results results
+```
+
+That is what CI runs first. Its other jobs need `contract-assay fetch corpus/records --source-root ./checkout`, then `pytest -m checkout`. Read the real exit code of each command; do not pipe a gate into `tail`.
+
+A change is done when the local gate and the remote CI run are both green.
+
+## Rules that are easy to break
+
+- **An absent figure is a reason, never a number.** Code that cannot compute a figure returns the sentence saying why; it does not return 0 or rank the row last.
+- **No third-party report text in the repository**, including tests and fixtures. A record states its claim in its own words and cites its source by URL.
+- **The version lives only in `__version__`.** A bump also updates `CITATION.cff`. Any change to what `score` or `rank` writes is a bump, because `engine_version` is part of what makes two results comparable.
+- **Published figures are tested.** A scoring change that moves a number in the docs must update the checkout tests and the counts CI checks, in the same change.
+- `contract-assay verify` exits 1 on the shipped corpus by design (one record pins a deployed address). The gate is "no new rejection", not exit 0.
+
+## Where to read more
+
+- Why the scoring works the way it does: `docs/design.md` (long; search it, don't read it whole).
+- The CLI and the documents it writes: `docs/api.md`.
+- Adding or changing a record: `docs/contributing.md` and `docs/curation.md`.

contract_assay-0.1.3/CITATION.cff

@@ -0,0 +1,32 @@
+cff-version: 1.2.0
+title: contract-assay
+message: >-
+  If you use this benchmark, or report a figure measured with it, please cite it
+  and say which corpus commit you measured against. A figure without the corpus
+  commit is not reproducible: the records, their locators and the pinned sources
+  all move between releases.
+type: software
+authors:
+  - given-names: Boik
+    family-names: Su
+    email: boik.su@cycraft.com
+    affiliation: CyCraft Technology
+    orcid: https://orcid.org/0009-0000-4700-7128
+repository-code: https://github.com/qazbnm456/contract-assay
+license: MIT
+version: 0.1.3
+abstract: >-
+  Benchmark infrastructure for LLM smart contract auditing. A prediction is
+  scored only if it quotes the source at the lines it names, and the quote is
+  checked against a pinned commit before scoring, so a detector that names a
+  plausible line without reading the file measures nothing. Ships a corpus of
+  478 verified records across nine vulnerability classes, drawn from public
+  audit platforms, with the adjudication for each record recorded next to it.
+keywords:
+  - smart-contract
+  - security
+  - benchmark
+  - llm
+  - solidity
+  - audit
+  - vulnerability-detection

contract_assay-0.1.3/CONTRIBUTING.md

@@ -0,0 +1,25 @@
+# Contributing
+
+The bar, the record format and what each kind of contribution has to establish are in **[docs/contributing.md](docs/contributing.md)**. This file exists so that the link is where a contributor looks for it.
+
+Three things worth knowing before you start:
+
+- **A record is a claim with a reproducible basis**, not a link to a report. It pins the bytes by digest, it locates the defect by file, contract, function and line span, and it says where its locator came from. A record that cannot be verified against the pinned source is refused by `contract-assay verify`.
+- **No report prose is vendored.** A record cites its source by URL and states the claim in its own words; the third party's writing stays theirs.
+- **The figures in `results/` are self-reported.** `results/README.md` says what a pointer does and does not establish before it says how to add one.
+
+Run the gate the same way CI does. CI runs everything down to `pytest`; the two commands after the blank line need a checkout and are yours to run before proposing a record.
+
+```console
+$ python -m pip install --upgrade pip      # `--group` needs pip >= 25.1
+$ pip install -e . --group dev
+$ ruff check . && ruff format --check . && mypy && mypy tools
+$ pytest -m offline --cov=contract_assay --cov-fail-under=90
+$ contract-assay results results
+
+$ contract-assay fetch corpus/records --source-root ./checkout
+$ contract-assay verify corpus/records --source-root ./checkout
+$ pytest -m checkout        # the figures the docs publish, over that checkout
+```
+
+`verify` **exits 1 on the shipped corpus** and that is not a failure you have caused: 477 of 478 records are admitted and the last one pins verified source for a deployed address, which no repository checkout can hold. The gate is that your change adds no *new* rejection: run it before and after. `./checkout` is 174 files and is already in `.gitignore`.

contract_assay-0.1.3/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Boik Su
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

contract_assay-0.1.3/Makefile

@@ -0,0 +1,89 @@
+# contract-assay — the commands a submission is built with.
+#
+# Two audiences, and the split is the first thing to understand:
+#
+#   make help / setup / corpus / run / score / self-check
+#       A participant preparing a submission. Everything here runs on your
+#       machine against the PUBLIC split. Nothing here talks to an arena.
+#
+#   make check / format
+#       A contributor to the benchmark itself.
+#
+# Every target is a thin wrapper around one documented command. Where a target
+# would have to decide something on your behalf it asks instead, because a
+# Makefile that quietly picks a model, a budget or a weighting has made the
+# statement `docs/api.md` §8 says you have to make yourself.
+
+PY ?= .venv/bin/python
+CLI ?= .venv/bin/contract-assay
+
+RECORDS  ?= corpus/records
+CHECKOUT ?= checkout
+OUT      ?= runs.jsonl
+SCORE    ?= score.json
+
+.DEFAULT_GOAL := help
+.PHONY: help setup corpus run score self-check check format clean
+
+help: ## Show this list.
+	@echo "contract-assay — building a submission"
+	@echo
+	@grep -hE '^[a-z-]+:.*?## ' $(MAKEFILE_LIST) \
+		| awk -F':.*?## ' '{printf "  \033[36m%-12s\033[0m %s\n", $$1, $$2}'
+	@echo
+	@echo "Variables: RECORDS=$(RECORDS) CHECKOUT=$(CHECKOUT) OUT=$(OUT)"
+	@echo "Start with: make setup && make corpus"
+
+setup: ## Install the benchmark and check the install.
+	$(PY) -m pip install -q -e . --group dev
+	@$(CLI) --help >/dev/null && echo "contract-assay is installed."
+	@echo "Next: make corpus"
+
+corpus: ## Build the source checkout the records point at.
+	@# Every figure rests on re-reading the quotes a submission cites, so a
+	@# checkout is not optional. `fetch` verifies each file's digest against
+	@# the pin, which is what makes two people's runs comparable at all.
+	$(CLI) fetch $(RECORDS) --source-root $(CHECKOUT)
+	@echo "Next: write a harness, then: make run MANIFEST=your.json"
+
+run: ## Run your harness over the corpus. MANIFEST=... [MODEL_CALLER=...]
+ifndef MANIFEST
+	$(error MANIFEST is unset. Point it at your submission manifest: make run MANIFEST=my-harness.json)
+endif
+	@# No model is called unless you name one. A deterministic submission is a
+	@# real submission and this benchmark's own control group, so the default
+	@# is not a fallback -- see `contract-assay run --help`.
+	$(CLI) run --manifest $(MANIFEST) --records $(RECORDS) \
+		--source-root $(CHECKOUT) --out $(OUT) \
+		$(if $(MODEL_CALLER),--model-caller $(MODEL_CALLER),)
+	@echo "Next: make score"
+
+score: ## Score your own runs. [WEIGHTS=weights.json]
+	@# Without --weights there is no aggregate, and that is correct rather
+	@# than broken: a weighting states what an exercise values and this engine
+	@# ships none. The per-class figures are all there.
+	$(CLI) score $(OUT) --records $(RECORDS) --source-root $(CHECKOUT) \
+		--submission-id self --out $(SCORE) \
+		$(if $(WEIGHTS),--weights $(WEIGHTS),)
+	@echo "Wrote $(SCORE)"
+
+self-check: corpus run score ## corpus, run and score in one go. MANIFEST=...
+	@echo
+	@echo "If scoring said predictions await adjudication, that is expected:"
+	@echo "precision needs every prediction judged, and on your own machine"
+	@echo "nothing has judged them. Read recall and bpref instead."
+
+check: ## Lint, type-check and test the benchmark itself.
+	.venv/bin/ruff check .
+	.venv/bin/ruff format --check .
+	.venv/bin/mypy
+	.venv/bin/mypy tools
+	$(PY) -m pytest -q -m offline --cov=contract_assay --cov-fail-under=90
+	$(CLI) results results
+
+format: ## Apply formatting.
+	.venv/bin/ruff check --fix .
+	.venv/bin/ruff format .
+
+clean: ## Remove generated run and score files. Never touches the corpus.
+	rm -f $(OUT) $(SCORE)