# Input and interpretation contract

The reader accepts immutable UTF-8 JSON bytes. It refuses duplicate keys,
unsupported fields, malformed scalar values and inputs outside its bounds.
`case.json` and `policy.json` are separate inputs. A case cannot select its own
principal key, observation window or scan inventory.

The input profiles are `probity.authority-effect-case/v1` and
`probity.authority-effect-policy/v1`. They are names for these finite synthetic
controls. They do not extend a producer's protocol or define a live admission
system.

The authorization intent contains the operation, chain, exact target string,
calldata digest, canonical decimal value, expected effect digest and validity
interval. Its commitment is SHA-256 over Vectors' JCS serialization of
`{"profile":"probity.authority-effect-intent/v1","intent":<intent>}`. The test
signature covers the domain `probity.authority-effect-authorization/v1`, a NUL
byte and the decoded commitment bytes. The public seed exists only for fixture
regeneration.

| Conclusion | What the reader compares |
| --- | --- |
| `commitmentRecomputed` | Every supplied intent field against the declared commitment. |
| `signatureUnderSelectedKey` | The signature against the policy's selected test key and declared commitment. |
| `authorizationTimeAtUse` | The supplied submission time against the signed interval. |
| `destinationAuthorized` | Operation, chain and exact target after commitment, signature and interval checks. |
| `callEnvelopeAuthorized` | The destination fields, calldata digest and value after those checks. |
| `reportedTargetMatchesRuntime` | The producer's report against the declared runtime target. |
| `historicalCompletionReported` | The producer's supplied completion flag. |
| `reportedDispatchMatchesObservation` | The supplied observation envelope against the declared runtime envelope. |
| `observationFresh` | The supplied observation time against the selected reference time and age limit. |
| `suppliedCurrentEffectMatches` | The supplied current effect digest against the intent, after freshness and envelope checks. |
| `observationProvenanceAuthenticated` | Unevaluated. These inputs contain no observer authentication. |
| `coverageComplete` | Every unit in the nonempty consumer-selected inventory was reported scanned. |
| `noFindingReported` | No finding appears in the supplied scan report. |
| `processExitMatchesCoverage` | The supplied exit matches the fixture's complete/clean or refused process contract. |
| `truncationNoticePresent` | The expected notice appears when units were skipped. |

An unavailable record gives a null conclusion. An invalid commitment, signature
or validity interval leaves authorization conclusions null. Neither a report nor
an observation repairs that failure. Exact strings remain exact, including a
trailing slash.

The coverage bridge runs a reduced synthetic scanner as a child process and
retains its complete outputs. Verify checks selected text spans in those bytes.
The owned reader checks the process exit on a separate axis. A successful process
exit never establishes complete coverage by itself. An unavailable source or
stale capture remains `not_established` under Verify's own contract.

Every matrix case and selected policy has a SHA-256 entry in `manifest.json`.
The gate checks the exact population and each digest before it starts a child.
An output directory must be absent or empty. A retained run is not overwritten.

Installed qualification compares the package population and every package file
with the selected wheel. It also compares the wheel's metadata files. Missing,
changed and additional payloads are refused even if installation metadata names
the expected wheel digest. The installed distribution must use filesystem
paths; ZIP-backed metadata distributions are outside this identity profile and
are refused. The checker selects the metadata directory from the wheel before
it accesses installed metadata properties. Missing or malformed installed
`METADATA` must fail the byte comparison without invoking its version parser.
The installer rewrites `RECORD`. Its additional
`INSTALLER`, `REQUESTED`, `direct_url.json`, `uv_cache.json` and `uv_build.json` files are recorded
separately with their actual byte counts and digests. These exact names permit
installer additions, while a file present in the selected wheel still requires
equal bytes. Unknown metadata additions are refused. Generated bytecode is
outside this source-byte comparison.
Every selected wheel metadata path must remain present, including the rewritten
`RECORD`. Wheel symlink members and installed payload symlinks are refused.
The observed uv installer writes `uv_cache.json` in
[its pinned metadata writer](https://github.com/astral-sh/uv/blob/68209e5c61ce4b76c2e685bea7913876bc929dc9/crates/uv-install-wheel/src/wheel.rs).
The recorded archive URL must identify the selected wheel. A recorded SHA-256
must match its bytes. PyPA permits an empty `archive_info`; an absent recorded
SHA-256 is reported as `NOT_EMITTED`. Complete installed-payload comparison
remains mandatory regardless of whether the installer emits that metadata.
See the [PyPA archive URL rules](https://packaging.python.org/en/latest/specifications/direct-url-data-structure/#archive-urls).

Source-byte identity and executed bytecode remain separate. The qualifier checks
all selected installed source, metadata and console-script bytes before it imports
the installed package. It uses checker source from the caller-selected wheel.
The selected wheel and baseline interpreter are trusted inputs, not sandboxed code.

The console command uses its installed interpreter with isolated mode, disabled
bytecode writes and an actual fresh private cache prefix. The module and API
control routes create a new empty private prefix, pass it with `-X pycache_prefix`,
and check `sys.pycache_prefix` before any target import. Every control retains
that profile without changing the reader's report. The launcher ignores user
`PYTHONPATH` and user-site packages under the interpreter's isolated mode. This
does not establish protection from changes to the baseline interpreter or its
installed site initialization. A bare library import keeps the caller's interpreter
and cache boundary. No global cache is removed.

The gate tests legitimate compiled twins and meaningful unchecked-hash cache
changes for the package initializer, reader and CLI. It preserves legacy cache
bytes while the protected routes read source through their fresh prefix. The
gate also tests changed installed source that would create an unwanted effect,
then checks that qualification refuses it before the effect occurs.

The source-distribution route installs the selected archive and compares its
installed payload with a separately rebuilt wheel from the same archive. The
report records the archive digest and selected comparison-wheel digest separately.
It does not assert that the installer exposes its internal build-wheel bytes.

The test gate measures the absolute installed package directory. It does not
measure the source checkout in place of the installed wheel. Every required
module must meet the coverage threshold and retain the source path and bytes
identified by installed qualification. A same-named module elsewhere, changed
source bytes or a missing module cannot satisfy the coverage gate.

These comparisons establish facts about supplied synthetic records. They do not
establish a real authorization principal, dispatch destination, historical key
custody, trustworthy clock, observation source, causation or persistence.