hypgraph 0.7.28__tar.gz → 0.8.0__tar.gz

{hypgraph-0.7.28 → hypgraph-0.8.0}/CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## 0.8.0 — 2026-11-01: typed claim assertions
+
+Eight independent audits (HG-020 → HG-028) found the same class of failure, each time in a new wording: to decide
+whether a count backs or contradicts a claim, the checks read words — the result's key and the claimant's
+measurement name for what was counted, the statement for what is asserted and which clause a count belongs to — and
+the claimant writes most of those words. Each fix narrowed one wording; the next audit found another. 0.8.0 stops
+inferring that structure from words.
+
+- **Typed counts.** A count may say what it counted: `population` (a path, `route/passenger` lies within `route`),
+  `property` and `unit`, beside `k`, `n`, `figure` and `op`. The result's author writes them; the instrument, on its
+  own results.
+- **Typed assertions.** A claim may carry `asserts`, atoms `{quantifier none | all | some | exactly, population,
+  property, op, figure, unit, n, k, measurement}`. Each is decided against its bound count by sets on the number line
+  and population paths (`src/hypgraph/assertions.py`): supported, contradicted, or unresolved with the field that
+  blocked it. No words are read, so a true atom can't lend anything to a false one (HG-028-01) and "all 4 routes"
+  meets its counterexample however the set is enumerated (HG-028-02). New codes `ASSERTION_CONTRADICTED` (tracked in
+  conduct like `COUNT_CONTRADICTS`, `by_assertion`) and `ASSERTION_UNRESOLVED`.
+- **Typed investigations.** `typed_claims: true` on an investigation (or a profile's `typed_claims`) makes atoms the
+  check: a statement that asserts an absolute, an extreme or a count needs an atom for each part that does
+  (`ASSERTION_MISSING`, with atoms drafted from the statement and its typed counts — never trusted, checked once
+  written), and the word interpretation stands down there: measurement names and keys aren't read for what was
+  counted, and the absolute / counterexample / extreme checks don't run. Numbers in the statement must still be bound;
+  every other check runs as before.
+- **Standing.** A claim's state carries `assertions` (each atom rendered as the sentence it asserts, with its verdict
+  against the count as it stands now), `assertion_contradicted` when a count revised later makes an atom false (the
+  claim joins the revalidation queue), and `checked_by`: `typed`, `wording` or `none`. Bundles carry the verdicts, and
+  the verifier checks them against the rows. The Atlas claim drawer shows the atoms as the headline and the author's
+  sentence beneath, labelled as prose.
+- **A count is whole, for everyone** (HG-028-03). `k` and `n` must be whole numbers (an int or an integral float),
+  finite, `0 ≤ k ≤ n`, `n ≥ 1`, on creation and on revision (`VALUE_NOT_A_COUNT`); counts used to be truncated, so 0.9
+  of 4 read as 0 of 4 and backed "none". A typed count must be complete (`VALUE_TYPE_INVALID`).
+- **The word checks are frozen.** Outside a typed investigation they run as in 0.7.28 and are documented as heuristics;
+  HG-028-01 and -02 remain limits of untyped mode. Replaying the 1,900 recorded adversarial entries changes none, and
+  every trial's standing is the same.
+- Tests: `tests/test_assertions.py` (the interval logic checked against enumeration over every op and quantifier, paths,
+  units, the gate, standing, bundles, the draft) and `tests/test_typed_audits.py` (92 attack sentences from the audits
+  and their holdouts, around fixed atoms: none changes a verdict).
+
 ## 0.7.28 — 2026-11-01: a figure said twice, a comparison in another tense
 
 Fixes from an independent audit of 0.7.27 (HG-027-01, -02) and from paraphrases written after the first fix; each case

{hypgraph-0.7.28 → hypgraph-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: hypgraph
-Version: 0.7.28
+Version: 0.8.0
 Summary: The evidence layer for AI research agents: a hash-chained research record that checks every claim as it is written and derives how well each is known.
 Project-URL: Homepage, https://hypgraph.com
 Project-URL: Documentation, https://hypgraph.com/engineers/

{hypgraph-0.7.28 → hypgraph-0.8.0}/docs/PLAN.md

@@ -109,7 +109,7 @@ claim's derived standing.
 Multi-writer sync between graphs (bundles cover sharing), authentication (the host's job; the HTTP server binds to
 loopback and is read-only unless started with `--writable`), and a hosted service.
 
-## Status at 0.7.28 (2026-11-01)
+## Status at 0.8.0 (2026-11-01)
 
 All seven phases are done: the library, bundles, the server and UI, the MCP server, the website, Pegasus running on
 the package, and releases to PyPI from tags with trusted publishing. What came after the plan, by release, is in

{hypgraph-0.7.28 → hypgraph-0.8.0}/docs/RELEASE-READINESS.md

@@ -213,6 +213,27 @@ was taken from a changelog without being checked against the code.*
 > checked against a counterexample. This is still word matching; the typed claim layer the audits recommend is not
 > built. Released as 0.7.28.
 
+> **Audit of 0.7.28 (2026-11-01): the class, not the symptom.** A ninth independent audit named three defects, all
+> reproduced on the PyPI 0.7.28 wheel (9 of 12 reproducer cases failed, the 3 controls passed): a true absolute about
+> one thing still lent its words to a false one about another in the same statement (HG-028-01); an enumerated "all 4
+> routes" skipped the counterexample check (HG-028-02); and fractional counts were truncated, so 0.9 of 4 read as 0 of
+> 4 (HG-028-03). The first two are the class every audit since HG-020 found: the checks infer from the claimant's
+> words what a count measured, what a claim asserts and which clause a count belongs to. That is now addressed
+> structurally rather than per wording: counts carry types (population, property, unit), claims carry typed atoms, and
+> an atom is decided against its count by interval logic and population paths, reading no words
+> (`src/hypgraph/assertions.py`). The audit's typed-predicate recommendation is the design. Fractional and impossible
+> counts are refused for everyone (`VALUE_NOT_A_COUNT`).
+>
+> **Where that stands.** Typed checking is opt-in per investigation (`typed_claims`), additive to `hypgraph/1`.
+> Inside it, the audits' 92 attack sentences around fixed atoms change no verdict, and the interval logic is checked
+> against enumeration for every op and quantifier. Outside it the word checks are frozen at 0.7.28 and labelled
+> heuristic: HG-028-01 and -02 are known limits of untyped mode, closed only by typed mode. Typed checking covers
+> count-based assertions (none / all / some / exactly, and extremes as pairs); comparisons between two measured arms
+> and significance are still word-checked. In typed mode the prose remains the author's: a sentence that asserts
+> more than its atoms is refused (`ASSERTION_MISSING`), but a detection miss leaves prose unverified rather than
+> verified, and the record shows the atoms, not the sentence, as what it checked. Replaying the 1,900 recorded
+> adversarial entries changes none. #102 is merged with green CI (17 of 17 checks). Released as 0.8.0.
+
 ## Recommendation: CONDITIONAL GO
 
 HypGraph is ready for a public developer preview once #59, #60 and #61 are merged with green CI and released as one

{hypgraph-0.7.28 → hypgraph-0.8.0}/docs/spec.md

@@ -20,10 +20,10 @@ correction is a new row, never an edited one.
 
 | type | code | fields (\* required) | what it is |
 |---|---|---|---|
-| `investigation` | INV | **title**\*, **objective**\*, success_criteria, scope, state, reviewers, constants, strict_claims, keywords, projects, doi, note, legacy_case | The study: an objective, its scope, who reviews it. Every other node belongs to one. |
+| `investigation` | INV | **title**\*, **objective**\*, success_criteria, scope, state, reviewers, constants, strict_claims, typed_claims, keywords, projects, doi, note, legacy_case | The study: an objective, its scope, who reviews it. Every other node belongs to one. |
 | `question` | Q | **text**\*, why | Something you want to know. |
 | `hypothesis` | H | **statement**\*, assumptions, **predictions**\*, distinguishing, open_questions | A possible answer, with the predictions that would show it wrong. |
-| `claim` | CL | **statement**\*, scope, limitations, kind, measurements, evidence_note, exposure, exposure_unit, legacy | What you assert is known, with its scope and its numbers bound to results. |
+| `claim` | CL | **statement**\*, scope, limitations, kind, measurements, asserts, evidence_note, exposure, exposure_unit, legacy | What you assert is known, with its scope and its numbers bound to results. |
 | `experiment` | X | **aim**\*, **protocol**\*, controls, **success_criteria**\*, method, budget, power_check, cost_minutes, seed | A planned test: aim, protocol, controls, success criteria, and what each hypothesis expects. |
 | `run` | RUN | **kind**\*, job_id, name, state, code, inputs, outputs, args, config, seed, env, started, finished, exit_code, log_sha256, note | One execution: code, inputs and outputs hashed, seed, state. `kind=lab` only from an instrument. |
 | `result` | RS | **summary**\*, kind, outcome, values, expected, limitations, power, evidence_note, legacy | What a run (or an observation, or a citation) found: values, outcome, power. |
@@ -59,6 +59,21 @@ correction is a new row, never an edited one.
 Field kinds and lengths: `hypgraph schema --json` (or `/schema/hypgraph-1.json` on the site). A claim's
 `measurements` are `{name, value | k & n | lo & hi, result: <result id>, key: <field of that result's values>}`.
 
+**Counts and typed counts.** A result value with `k` or `n` is a count: `k` of `n`, both whole numbers (an int, or a
+float with no fraction), finite, `0 ≤ k ≤ n`, `n ≥ 1`. It may say what it compared: `figure` and `op` (one of `<` `<=`
+`=` `!=` `>=` `>`). A **typed count** also says what it counted: `population`, a path such as `route/passenger` (lower
+case; `a/b` lies within `a`), `property`, an id (`length`), and optionally `unit`. `{"k": 1, "n": 4, "figure": 26,
+"op": ">", "population": "route", "property": "length", "unit": "km"}` is 1 of 4 routes with length > 26 km. The
+types are the result's author's; on an instrument-filed result they are the instrument's.
+
+**Typed assertions (`asserts`).** A claim may state what it asserts as atoms, each checked against a typed count
+(§7): `{quantifier, population, property, op, figure, unit?, n?, k?, measurement}`, where `quantifier` is `none`
+(nothing in the population meets `property op figure`), `all` (everything does), `some` (at least one does) or
+`exactly` (`k` of them do; `k` required), `n` is the population's size as the claim states it, and `measurement` is the
+0-based index of the claim's measurement whose count decides it. An extreme is two atoms: "the longest route is 26 km"
+is `none` `>` 26 and `some` `>=` 26. An investigation with `typed_claims: true` (or a profile that sets it) checks its
+claims this way.
+
 Verdicts: positive `checked`, `pass`, `reproduced`, `replicated`, `separate_implementation`, `generalizes`; negative
 `fail`, `not_reproduced`, `not_replicated`, `does_not_generalize`; and `objection`, `resolved`, `inconclusive`,
 `comment`.
@@ -169,7 +184,8 @@ published and signed, and what each check does and doesn't show: [verification.m
 verifier must check every fact in it that the rows fix: which investigations it covers (the scope's, or every
 investigation node), which investigations the list shows (each once), which nodes each investigation's graph shows
 (all of them, unless capped at 5,000) and which live (unretracted) links among them, each node's `type`, `code`, `inv`,
-`by`, `at`, `v`, `title`, `kind` and `state.lifecycle`, and each link's `id`, ends, versions, `rel`, `data`, `at`,
+`by`, `at`, `v`, `title`, `kind` and `state.lifecycle`, each typed assertion's verdict (`state.assertions`, a function
+of the claim's and its results' latest rows), and each link's `id`, ends, versions, `rel`, `data`, `at`,
 `by` and `why`. Every one of these must be **present**, not only equal where present: a viewer fills a missing fact
 with a default, and a withdrawn claim without its lifecycle would read as active. The lifecycle is derived from the
 verified rows (withdrawn when a withdrawal exists; superseded when a live `supersedes` or `corrects` replacement is
@@ -212,6 +228,11 @@ Implementations must derive these, never store them:
   - A replication edge on the run raises the profile according to its `differs`.
   - A result of `kind=cited` is external only if it `cites` a source node.
 - **basis_changed** (decisions): a `based_on` edge whose target's version has moved past the pinned `dst_v`.
+- **assertions** (claims with `asserts`): each atom with its verdict against its count as the record holds it now
+  (§7, *Typed claims*) and its rendered sentence ("no route/passenger (of 4) has length > 26 km"). The rendered atoms
+  are what the record verified; the statement is the author's prose. **assertion_contradicted**: the atoms a count
+  revised since the claim was written now makes false. **checked_by**: `typed` when the claim's investigation checks
+  typed atoms, `wording` when the word checks applied, `none` with `strict_claims: false`.
 - **written blind** (results): a work order with `blind: true` opens a window at its creation event and closes it at
   the first release (return or cancel) or withdrawal of any order in its rework chain. A result its assignee
   created inside the window, and has not revised since it closed, is written blind under that order, provided the
@@ -227,6 +248,9 @@ Implementations must derive these, never store them:
 - Only the instrument files a `kind=lab` run, and only the instrument records what that run `produced`.
 - Claims must pass the checks in §7, unless written by the operator or importer, or in an investigation with
   `strict_claims: false`.
+- A result's counts must be counts (`VALUE_NOT_A_NUMBER`, `VALUE_NOT_A_COUNT`), and a typed count must be complete
+  (`VALUE_TYPE_INVALID`: `population` a path, `property` an id, `op` one of the six, `figure` a number) — on creation
+  and on revision.
 - Nobody officially reviews their own node.
 - Writes into an `archived` or `published` investigation are refused (reserved authors excepted).
 - Only the importer may set a write's time. Everyone else's comes from the writer's clock.
@@ -264,6 +288,31 @@ smallest detectable difference uses 80% power at two-sided α = 0.05.
 | 10 | `EXCLUSION_WITHOUT_POWER` | `kind: exclusion`, or wording that says an effect is absent (no effect, no difference, makes no difference, does not affect, rules out, ineffective, …) in a finding, without a supporting result with `power: demonstrated` or one produced by a run of an experiment with a `power_check`. With two counts, the message gives the smallest detectable difference. |
 | 11 | `UNCORRECTED_EFFECT` | a finding asserts an effect (changes, lowers, differs, affects, significant, …) on an outcome, while a live result in the investigation holds that outcome's corrected p-value (a field named with holm / bonferroni / fdr / adjusted / corrected …) at or above 0.05, or a count of 0 outcomes surviving correction (`n_holm_sig`), and the effect word is neither qualified within 20 words as uncorrected (uncorrected, unadjusted, nominally, without correction, …) nor names the correction with a corrected value bound as a measurement. A family-wide value (`min_adjusted_p`) applies when the claim binds a nominal p < 0.05. Thresholds (`bonferroni_alpha_threshold`) are not evidence. Honest forms: bind the corrected p and say "not significant after correction", or file `kind: lead`. |
 
+**Typed claims.** An atom (§2) is decided by its bound count alone; no words are read. Let S_e = {x : x op_e f_e} (what
+was counted, k of n inside it, n − k outside) and S_a = {x : x op_a f_a} (what is asserted); P_e and P_a the
+populations. The property must equal the count's and the unit match it (spellings of one unit are one unit; nothing is
+converted); a stated `n` must equal the count's.
+
+- `none` S_a: **supported** when a side of the count with 0 inside it contains S_a and P_a lies within P_e;
+  **contradicted** when a side with more than 0 lies inside S_a and P_e lies within P_a.
+- `some` S_a: supported when a side with more than 0 lies inside S_a and P_e within P_a; contradicted when a side with
+  0 contains S_a and P_a lies within P_e.
+- `all` S_a is `none` of the complement of S_a. `exactly` k needs the same population and the same set (or its
+  complement, counted n − k), then compares k.
+- Anything else is **unresolved**, and names the field that blocked it.
+
+| Code | Refused when |
+|---|---|
+| `ASSERTION_CONTRADICTED` | an atom is false by its count. The refusal log tracks it like a count contradiction (§8). |
+| `ASSERTION_UNRESOLVED` | an atom its count can't settle: another property or unit, a population neither within nor containing the count's, a condition the count's doesn't decide, an untyped count, a malformed atom. |
+| `ASSERTION_MISSING` | in a `typed_claims` investigation, the statement has more parts that assert an absolute, an extreme or a count than the claim has atoms. Detection reads words only to ask for atoms; a missed word leaves prose unverified, never an atom verified. The refusal proposes atoms drafted from the statement and the claim's typed counts, which are checked like any other once written. |
+
+Atoms are checked in every investigation that has them. In a `typed_claims` investigation the word interpretation
+stands down: a measurement's name and key are not read for what was counted, and rule 5 (absolutes, with the
+counterexample, extreme and unreached-figure checks behind it) does not run. Every other rule runs as before. Outside
+one, rule 5 and those checks are heuristics, frozen as of 0.7.28: they read a claim's words for what a count measured,
+what the claim asserts and which clause a count belongs to, and the claimant writes those words.
+
 **Exposure.** A claim may set `exposure` (how many uses, users or units it will be applied to) and `exposure_unit`.
 Absolute refusals then state how many failures the bound leaves unruled out at that scale. An accepted claim's
 standing carries `bounds` (per count: k, n, rate, lo, hi and, with exposure, `unruled_out`), its sentence reads

{hypgraph-0.7.28 → hypgraph-0.8.0}/src/hypgraph/__init__.py

@@ -16,7 +16,7 @@ Standing is derived on every read, never stored; every write is an event in a SH
 their numbers; reviews pin versions; independence is counted, not assumed. See https://hypgraph.com.
 """
 
-__version__ = "0.7.28"
+__version__ = "0.8.0"
 
 from .bundle import anchored, verify_bundle  # noqa: E402
 from .graph import Author, Graph, GraphError, file_sha256  # noqa: E402

hypgraph-0.8.0/src/hypgraph/assertions.py

@@ -0,0 +1,384 @@
+"""
+Typed claim assertions: what a claim asserts about a count, stated as data and checked against the count's own typed
+fields. Nothing here reads words.
+
+The word checks (checks.py) work out from prose what a count measured, what a claim asserts and which clause a count
+belongs to. The claimant writes most of those words, and eight audits (HG-020 → HG-028) each found a new wording that
+steered one of those inferences. Here the instrument types what it counted and the claimant types what it asserts:
+
+  a count     {"k": 1, "n": 4, "figure": 26, "op": ">", "population": "route/passenger", "property": "length",
+               "unit": "km"}  — 1 of the 4 passenger routes has length > 26 km
+  an atom     {"quantifier": "none", "population": "route/passenger", "property": "length", "op": ">",
+               "figure": 26, "unit": "km", "n": 4, "measurement": 0}  — no passenger route is longer than 26 km,
+               checked against the claim's first measurement
+
+  quantifier  none (nothing in the population meets ``property op figure``) · all (everything does) · some (at least
+              one does) · exactly (``k`` of them do). An extreme is two atoms: "the highest is 93" is none > 93 and
+              some >= 93.
+  population  a path: ``route/passenger`` lies within ``route``, so a count of 0 over every route also settles
+              "no passenger route"; a count of the passenger routes says nothing of the cargo routes.
+  property    an id, compared for equality ("length" is not "speed").
+  unit        compared for equality, spellings of one unit read as one ("km" = "kilometres"); never converted.
+  n           optional: the population's size as the claim states it; must be the count's n.
+
+Each atom is decided on its own, by sets on the number line — S_e = {x : x op_e figure_e} (what was counted) and
+S_a = {x : x op_a figure_a} (what is asserted) — and the paths. A count of k in S_e is also a count of n - k outside it.
+
+  none S_a    supported when some count of 0 is over a set containing S_a and a population containing the atom's;
+              contradicted when a count above 0 is over a set inside S_a and a population inside the atom's
+  some S_a    the mirror: a count above 0 inside S_a supports it, a count of 0 containing S_a contradicts it
+  all S_a     none of the complement of S_a
+  exactly     the same set and the same population, then k compared
+
+Anything else is unresolved, and the verdict names the field that blocked it. One count can back two atoms only if
+each checks out against it on its own, so a true absolute can't lend anything to a false one (HG-028-01), and "all"
+is checked against its counterexample whatever the sentence enumerates (HG-028-02).
+"""
+
+from __future__ import annotations
+
+import json
+import re
+
+from . import stats
+from .derive import Snap, result_value
+
+OPS = ("<", "<=", "=", "!=", ">=", ">")
+COMPLEMENT = {"<": ">=", "<=": ">", "=": "!=", "!=": "=", ">=": "<", ">": "<="}
+QUANTIFIERS = ("none", "all", "some", "exactly")
+FIELDS = ("quantifier", "population", "property", "op", "figure", "unit", "n", "k", "measurement")
+SHOW_OP = {"<": "<", "<=": "≤", "=": "=", "!=": "≠", ">=": "≥", ">": ">"}
+_SEGMENT = re.compile(r"^[a-z0-9][a-z0-9 _.-]*$")
+
+
+def _num(x) -> bool:
+    return isinstance(x, (int, float)) and not isinstance(x, bool) and x == x and abs(x) != float("inf")
+
+
+def path(p) -> tuple[str, ...] | None:
+    """A population path as its segments (lower-cased, trimmed), or None when it isn't one."""
+    if not isinstance(p, str) or not p.strip():
+        return None
+    segs = tuple(" ".join(x.strip().lower().split()) for x in p.strip().strip("/").split("/"))
+    return segs if all(_SEGMENT.match(x) for x in segs) else None
+
+
+def within(inner: tuple, outer: tuple) -> bool:
+    """Does every member of ``inner`` belong to ``outer``? route/passenger lies within route."""
+    return inner[:len(outer)] == outer
+
+
+def prop(p) -> str | None:
+    """A property id, compared for equality: case, spaces, hyphens and underscores don't matter."""
+    if not isinstance(p, str) or not p.strip():
+        return None
+    return re.sub(r"[\s_-]+", "_", p.strip().lower())
+
+
+def _unit(u) -> frozenset | None:
+    """A unit as the set of names it could be ("km" → {kilometre}); None when there's none."""
+    if u is None or (isinstance(u, str) and not u.strip()):
+        return None
+    from .checks import _UNIT_OF                           # one table of unit spellings, shared with the word checks
+    w = str(u).strip().lower()
+    return frozenset(c for _f, c in _UNIT_OF.get(w, ())) or frozenset({w})
+
+
+def same_unit(a, b) -> bool:
+    ua, ub = _unit(a), _unit(b)
+    return (ua is None and ub is None) or (ua is not None and ub is not None and bool(ua & ub))
+
+
+def holds(x: float, op: str, f: float) -> bool:
+    return {"<": x < f, "<=": x <= f, "=": x == f, "!=": x != f, ">=": x >= f, ">": x > f}[op]
+
+
+def subset(a: tuple, b: tuple) -> bool:
+    """Is {x : x a[0] a[1]} inside {x : x b[0] b[1]}? Both sets are unions of intervals with ends at the two figures,
+    so membership is constant on each piece between them: checking one point per piece decides it."""
+    pts = sorted({float(a[1]), float(b[1])})
+    probes = pts + [pts[0] - 1, pts[-1] + 1] + [(x + y) / 2 for x, y in zip(pts, pts[1:])]
+    return all(holds(x, *b) for x in probes if holds(x, *a))
+
+
+def same_set(a: tuple, b: tuple) -> bool:
+    return subset(a, b) and subset(b, a)
+
+
+def count_fields(rv) -> tuple[dict | None, str]:
+    """A result value as a typed count {k, n, op, figure, population, property, unit}, or (None, what's missing)."""
+    if not isinstance(rv, dict):
+        return None, "the bound value is not a count"
+    k, n = rv.get("k"), rv.get("n")
+    if not (stats.whole(k) and stats.whole(n) and n >= 1 and 0 <= k <= n):
+        return None, "the bound value is not a count (whole k of n)"
+    for f in ("population", "property"):
+        if not rv.get(f):
+            return None, f"the count has no {f}: the result's author types what was counted"
+    if rv.get("op") not in OPS:
+        return None, "the count has no op (one of < <= = != >= >)"
+    if not _num(rv.get("figure")):
+        return None, "the count has no figure"
+    pop = path(rv["population"])
+    if pop is None:
+        return None, "the count's population is not a path (route/passenger)"
+    return {"k": int(k), "n": int(n), "op": rv["op"], "figure": float(rv["figure"]), "population": pop,
+            "property": prop(rv["property"]), "unit": rv.get("unit")}, ""
+
+
+def atom_shape(a, meas: list | None) -> tuple[str, str]:
+    """(field, why) when an atom is malformed; ("", "") when it is well formed. ``meas`` None: the measurement index
+    isn't checked."""
+    if not isinstance(a, dict):
+        return "atom", "an assertion is an object {quantifier, population, property, op, figure, measurement}"
+    extra = sorted(set(a) - set(FIELDS))
+    if extra:
+        return extra[0], f"unknown field {extra[0]!r} (fields: {', '.join(FIELDS)})"
+    if a.get("quantifier") not in QUANTIFIERS:
+        return "quantifier", "quantifier must be one of none, all, some, exactly"
+    if path(a.get("population")) is None:
+        return "population", "population must be a path such as route or route/passenger"
+    if prop(a.get("property")) is None:
+        return "property", "property must name what is compared (length, speed, wait)"
+    if a.get("op") not in OPS:
+        return "op", "op must be one of < <= = != >= >"
+    if not _num(a.get("figure")):
+        return "figure", "figure must be a number"
+    if "unit" in a and a["unit"] is not None and not isinstance(a["unit"], str):
+        return "unit", "unit must be text"
+    if "n" in a and not (stats.whole(a["n"]) and a["n"] >= 1):
+        return "n", "n must be a whole number of at least 1"
+    if a["quantifier"] == "exactly" and not (stats.whole(a.get("k")) and a["k"] >= 0):
+        return "k", "'exactly' needs k, a whole number"
+    if "k" in a and a["quantifier"] != "exactly":
+        return "k", "k is for 'exactly'; none / all / some say it themselves"
+    i = a.get("measurement")
+    if meas is None:
+        return "", ""
+    if not (stats.whole(i) and 0 <= i < len(meas) and isinstance(meas[int(i)], dict)):
+        return "measurement", f"measurement must index the claim's measurements (0..{len(meas) - 1})" if meas else \
+            "measurement must index the claim's measurements, and the claim binds none"
+    return "", ""
+
+
+def _pop(p: tuple) -> str:
+    return "/".join(p)
+
+
+def _cond(a: dict) -> str:
+    u = f" {a['unit']}" if a.get("unit") else ""
+    fig = stats_fmt(a["figure"])
+    return f"{a['property']} {SHOW_OP.get(a['op'], a['op'])} {fig}{u}"
+
+
+def stats_fmt(v) -> str:
+    v = float(v)
+    return str(int(v)) if v.is_integer() else f"{v:g}"
+
+
+def render(a: dict) -> str:
+    """An atom as the sentence it asserts — what the record shows as verified."""
+    if atom_shape(a, None)[0]:
+        return json.dumps(a, sort_keys=True)[:300] if isinstance(a, dict) else str(a)[:300]
+    pop, cond = "/".join(path(a["population"]) or ()), _cond(a)
+    among = f" (of {int(a['n'])})" if "n" in a else ""
+    q = a["quantifier"]
+    if q == "none":
+        return f"no {pop}{among} has {cond}"
+    if q == "all":
+        return f"every {pop}{among} has {cond}"
+    if q == "some":
+        return f"at least one {pop}{among} has {cond}"
+    return f"exactly {int(a['k'])} of {int(a['n']) if 'n' in a else 'the'} {pop} have {cond}"
+
+
+def render_count(e: dict) -> str:
+    u = f" {e['unit']}" if e.get("unit") else ""
+    return (f"{e['k']} of {e['n']} {_pop(e['population'])} counted with {e['property']} "
+            f"{SHOW_OP[e['op']]} {stats_fmt(e['figure'])}{u}")
+
+
+def _rid(s: Snap, ref: str, inv: str) -> str:
+    if ref in s.nodes:
+        return ref
+    hits = [i for i, n in s.nodes.items() if n["type"] == "result" and n["code"].lower() == ref.lower()
+            and (not inv or n["inv"] == inv)]
+    return hits[0] if len(hits) == 1 else ref
+
+
+def _decide(a: dict, e: dict) -> tuple[str, str, str]:
+    """(verdict, field that blocked it, why) for a well-formed atom against a typed count."""
+    pa, pe = path(a["population"]), e["population"]
+    if prop(a["property"]) != e["property"]:
+        return "unresolved", "property", (f"the count is of {e['property']}, the assertion is about "
+                                          f"{prop(a['property'])}")
+    if not same_unit(a.get("unit"), e.get("unit")):
+        return "unresolved", "unit", (f"the count is in {e.get('unit') or 'no unit'}, the assertion in "
+                                      f"{a.get('unit') or 'no unit'}: state the figure in the count's unit")
+    if not (within(pa, pe) or within(pe, pa)):
+        return "unresolved", "population", (f"the count is of {_pop(pe)}, the assertion is about {_pop(pa)}: "
+                                            "neither lies within the other")
+    if "n" in a and int(a["n"]) != e["n"]:
+        if pa == pe:
+            return "contradicted", "n", f"the assertion says {int(a['n'])} {_pop(pa)}; the count has {e['n']}"
+        return "unresolved", "n", (f"the assertion's n ({int(a['n'])}) is the size of {_pop(pa)}, which the count of "
+                                   f"{_pop(pe)} ({e['n']}) doesn't give")
+    # what was counted, both ways: k inside S_e and n - k outside it
+    sides = [((e["op"], e["figure"]), e["k"]), ((COMPLEMENT[e["op"]], e["figure"]), e["n"] - e["k"])]
+    q, t = a["quantifier"], (a["op"], float(a["figure"]))
+    got = _settle(q, t, sides, pa, pe, a)
+    if got:
+        return got
+    if _settle(q, t, sides, pa, pa, a):         # it would settle over the same population: the paths blocked it
+        return "unresolved", "population", (f"a count over {_pop(pe)} doesn't settle this about {_pop(pa)} (a count "
+                                            "of a larger population settles 'none' and 'all'; a counterexample in a "
+                                            "smaller one settles 'some' and refutes 'none')")
+    return "unresolved", "op", (f"the count compared {e['property']} {SHOW_OP[e['op']]} {stats_fmt(e['figure'])}, "
+                                f"which settles neither way whether {render(a)}")
+
+
+def _settle(q: str, t: tuple, sides: list, pa: tuple, pe: tuple, a: dict) -> tuple[str, str, str] | None:
+    """The verdict when the count settles the atom, else None."""
+    if q == "exactly":
+        if pa != pe:
+            return None
+        for side, c in sides:
+            if same_set(t, side):
+                ok = int(a["k"]) == c
+                return ("supported" if ok else "contradicted", "" if ok else "k",
+                        f"the count finds {c}" + ("" if ok else f", not {int(a['k'])}"))
+        return None
+    neg = "that don't" if q == "all" else "that do"
+    if q == "all":                               # everything meets it: nothing meets its complement
+        q, t = "none", (COMPLEMENT[t[0]], t[1])
+    if q == "none":
+        for side, c in sides:
+            if c > 0 and subset(side, t) and within(pe, pa):
+                return "contradicted", "", f"the count finds {c} {neg}"
+        for side, c in sides:
+            if c == 0 and subset(t, side) and within(pa, pe):
+                return "supported", "", f"the count finds none {neg}"
+    else:                                        # some
+        for side, c in sides:
+            if c > 0 and subset(side, t) and within(pe, pa):
+                return "supported", "", f"the count finds {c}"
+        for side, c in sides:
+            if c == 0 and subset(t, side) and within(pa, pe):
+                return "contradicted", "", "the count finds none"
+    return None
+
+
+def verify(s: Snap, body: dict, inv: str = "") -> list[dict]:
+    """Each atom of a claim with its verdict: supported | contradicted | unresolved, the rendered sentence, the
+    count it was decided on and, when it wasn't supported, the field and the reason."""
+    def lookup(ref: str, key: str) -> tuple[str, dict | None, int | None]:
+        rid = _rid(s, ref, inv)
+        return rid, result_value(s, rid, key), s.nodes[rid]["v"] if rid in s.nodes else None
+    return verify_with(body, lookup)
+
+
+def verify_with(body: dict, lookup) -> list[dict]:
+    """``verify`` over any store: ``lookup(result, key)`` gives (result id, the value under key or None, its
+    version). The bundle verifier passes the verified rows, so a view can't show an atom supported that its rows
+    make false."""
+    meas = body.get("measurements") or []
+    out = []
+    for i, a in enumerate(body.get("asserts") or []):
+        row = {"atom": i, "text": render(a)}
+        field, why = atom_shape(a, meas)
+        if field:
+            out.append({**row, "verdict": "unresolved", "field": field, "why": why})
+            continue
+        m = meas[int(a["measurement"])]
+        rid, rv, ver = lookup(str(m.get("result") or ""), str(m.get("key") or ""))
+        e, why = count_fields(rv)
+        row.update(result=rid, key=str(m.get("key") or ""), version=ver)
+        if e is None:
+            out.append({**row, "verdict": "unresolved", "field": "measurement", "why": why})
+            continue
+        verdict, field, why = _decide(a, e)
+        out.append({**row, "verdict": verdict, "field": field, "why": why, "k": e["k"], "n": e["n"],
+                    "counted": render_count(e)})
+    return out
+
+
+def key(a) -> str:
+    """What an atom asserts, as a stable string: the same assertion written again has the same key, whatever its
+    measurement or spelling of the unit."""
+    if atom_shape(a, None)[0]:
+        return json.dumps(a, sort_keys=True, default=str)[:300]
+    u = _unit(a.get("unit"))
+    return json.dumps([a["quantifier"], "/".join(path(a["population"]) or ()), prop(a["property"]), a["op"],
+                       float(a["figure"]), sorted(u) if u else None, a.get("n"), a.get("k")], default=str)
+
+
+def numbers(body: dict) -> list[float]:
+    """The figures, k and n the atoms state: a statement may say them."""
+    out: list[float] = []
+    for a in body.get("asserts") or []:
+        if isinstance(a, dict):
+            out += [float(a[f]) for f in ("figure", "n", "k") if _num(a.get(f))]
+    return out
+
+
+# ── the drafting aid: proposes atoms from the prose and the typed counts; never trusted ────────────────────────────
+
+def _op_of(comp: tuple | None) -> str | None:
+    if not comp:
+        return None
+    _axis, sign, strict = comp
+    return (">" if strict else ">=") if sign > 0 else ("<" if strict else "<=")
+
+
+def draft(s: Snap, body: dict, inv: str = "") -> list[dict]:
+    """Atoms a claim's statement seems to assert, filled from its typed counts. The word checks' parsers propose them;
+    nothing proposed here is trusted — each must be written into ``asserts`` by the claimant and is then checked like
+    any other. Empty when nothing can be proposed."""
+    from . import checks as C
+    from . import language as L
+    stmt = body.get("statement", "") or ""
+    meas = body.get("measurements") or []
+    typed = []
+    for i, m in enumerate(meas):
+        if isinstance(m, dict):
+            rid = _rid(s, str(m.get("result") or ""), inv)
+            e, _ = count_fields(result_value(s, rid, str(m.get("key") or "")))
+            if e:
+                typed.append((i, e))
+    if not typed:
+        return []
+    out: list[dict] = []
+
+    def add(a: dict, e: dict) -> None:
+        if e.get("unit"):
+            a["unit"] = e["unit"]
+        if a not in out:
+            out.append(a)
+
+    for part in C.asserting_parts(stmt):            # one clause at a time: its own quantifier, its own figures
+        said = [w.lower() for w in L.asserted(L.ABSOLUTE, part)]
+        if said:
+            q = "all" if any(C._ALL.match(w) for w in said) else "none"
+            for fig, comp in C._clause_comparisons(part, after_no=True):
+                op = _op_of(comp)
+                if op is None:
+                    continue
+                # the counts made at this figure, when there are any: the figure is the one fact the clause and
+                # the count share without reading what either is about
+                pool = [(i, e) for i, e in typed if e["figure"] == fig] or typed
+                for i, e in pool:
+                    add({"quantifier": q, "population": _pop(e["population"]), "property": e["property"], "op": op,
+                         "figure": int(fig) if float(fig).is_integer() else fig, "n": e["n"], "measurement": i}, e)
+        figs = {v for v, *_ in C.numbers(part)}
+        for k, n in ((int(a.replace(",", "")), int(b.replace(",", ""))) for a, b in C._STATED_COUNT.findall(part)):
+            # what the clause says, true or not — the check decides; counts at a figure the clause names first
+            pool = [(i, e) for i, e in typed if e["n"] == n]
+            for i, e in [x for x in pool if x[1]["figure"] in figs] or pool:
+                add({"quantifier": "exactly", "population": _pop(e["population"]), "property": e["property"],
+                     "op": e["op"], "figure": int(e["figure"]) if e["figure"].is_integer() else e["figure"],
+                     "k": k, "n": n, "measurement": i}, e)
+    return out[:6]
+
+
+__all__ = ["COMPLEMENT", "OPS", "QUANTIFIERS", "atom_shape", "count_fields", "draft", "holds", "key", "numbers", "path",
+           "render", "render_count", "same_set", "same_unit", "subset", "verify", "verify_with", "within"]

{hypgraph-0.7.28 → hypgraph-0.8.0}/src/hypgraph/bundle.py

@@ -33,7 +33,7 @@ import os
 from pathlib import Path
 from typing import TYPE_CHECKING, Any
 
-from . import __version__
+from . import __version__, assertions
 from .schema import RELS, SAME_TYPE
 from .store import GENESIS, ROW_TABLES, check_rows, event_body, now
 
@@ -349,8 +349,9 @@ def _derived_problem(b: dict, tables: dict, historical: list | None = None, unco
                      redacted: int = 0) -> str:
     """The derived views are presentation, but a viewer shows them beside a verified chain: every fact in them that
     the rows fix — which investigations there are, which nodes and live links each has, each node's type, code,
-    author, time, version, title and lifecycle, each link's ends and fields — must be present and agree with the
-    verified rows. A view that leaves a fact out fails: a viewer would fill the gap with a default (a withdrawn claim
+    author, time, version, title and lifecycle, each link's ends and fields, and each typed assertion's verdict (a
+    function of the claim's and its results' rows, assertions.py) — must be present and agree with the verified
+    rows. A view that leaves a fact out fails: a viewer would fill the gap with a default (a withdrawn claim
     shown as active). The rest of standing can't be checked this way.
 
     A lifecycle is checked against the current rule only. One that matches only 0.3's rule (the end of a chain of
@@ -414,6 +415,17 @@ def _derived_problem(b: dict, tables: dict, historical: list | None = None, unco
         st = x.get("state")
         if not isinstance(st, dict) or "lifecycle" not in st:
             return f"{where} shows {name} without its lifecycle"
+        if n["type"] == "claim" and body.get("asserts"):
+            def lookup(ref: str, key: str) -> tuple:
+                ver, rb = latest.get(ref, (None, {}))
+                rv = (rb.get("values") or {}).get(key) if ref in nodes and nodes[ref]["type"] == "result" else None
+                rv = {"value": rv} if isinstance(rv, (int, float)) and not isinstance(rv, bool) else rv
+                return ref, rv if isinstance(rv, dict) else None, ver
+            want_v = [a["verdict"] for a in assertions.verify_with(body, lookup)]
+            got_v = [a.get("verdict") if isinstance(a, dict) else None for a in st.get("assertions") or []]
+            if got_v != want_v:
+                return (f"{where} shows {name}'s typed assertions as {_j(got_v)}; its rows make them {_j(want_v)}"
+                        if got_v else f"{where} shows {name} without its typed assertions")
         w, shown = lifecycle(n["id"], True), st["lifecycle"]
         if shown == w:
             return ""