Bound 0.1.5: published contracts and native walk

CITATION.cff

@@ -2,7 +2,7 @@ cff-version: 1.2.0
 message: "Cite it by the paper it rests on, Two-Sided Constraints on a Valued Lattice."
 type: software
 title: "@lapxo/bound"
-version: "0.1.4"
+version: "0.1.5"
 authors:
   - name: "Lapxo"
 license: "MIT"

LICENSE

@@ -1,4 +1,3 @@
-the license this place is bound by
 MIT License
 
 Copyright (c) 2026 Lapxo

README.md

@@ -5,14 +5,31 @@
 Declare what must hold. Read what does. Keep the evidence
 
 ```bash
-npx @lapxo/[email protected].4 fold --as help
-npx @lapxo/[email protected].4 fold
+npx @lapxo/[email protected].5 fold --as help
+npx @lapxo/[email protected].5 fold
 ```
 
 ## How Bound reads a project
 
 Bound reads a project's admitted statements and observations through its selected Topos, then renders the declared views and records their inputs in receipts. The example below explains the object; a file-fold alone does not calculate its intervals.
 
+## Use Bound in a project
+
+From a project with an admitted lock and selected views, inspect its standing, ask for its evidence, then verify the committed outputs:
+
+```sh
+npx @lapxo/[email protected] fold --as lines
+npx @lapxo/[email protected] fold --as receipts@1
+npx @lapxo/[email protected] fold --check
+```
+
+Use this flow to review a project change or check a dependency's declared contract. `--check` verifies existing evidence; it does not execute a missing reading. A file fold names readings and explicitly says that it computed no encounters.
+
+Independent observations are judged through the declared typed cells view. The selected topos supplies the form, origin evidence and bounds. Bound keeps attribution and exact-ID withdrawals through the fold.
+
+A selected form can instead describe a set of artifacts, a delivery interval or another domain's values. The project declares the form, origin evidence and views; Bound does not infer them from filenames or units.
+
+
 ## A meeting everyone can understand
 
 Ana is available from 10 to 14, Luis from 12 to 16, and the room from 10 to 13. Their common availability is 12 to 13. A boss available from 18 to 20 makes the encounter incompatible. Withdrawing that exact reading restores the overlap; Ana, Luis and the room remain.
@@ -49,11 +66,11 @@ lot_dir="$(mktemp -d)"
 Have the selected view produce a proposal at `$lot_dir/proposal.bound`, or prepare the project's permitted lines there for review. Unsigned proposals use `by=target`, without a preassigned epoch or `sig`. Lots stay outside the repository; the committed bound files are only `TARGET.bound` and `receipts.bound`.
 
 ```sh
-npx @lapxo/[email protected].4 sign "$lot_dir/proposal.bound" \
+npx @lapxo/[email protected].5 sign "$lot_dir/proposal.bound" \
   --key "$BOUND_KEY_ID" --key-file "$BOUND_KEY_FILE" \
   > "$lot_dir/signed.bound" &&
-npx @lapxo/[email protected].4 land "$lot_dir/signed.bound" &&
-npx @lapxo/[email protected].4 fold
+npx @lapxo/[email protected].5 land "$lot_dir/signed.bound" &&
+npx @lapxo/[email protected].5 fold
 ```
 
 `sign` assigns the admitted epoch and writes the signed lot to stdout. `land` validates the whole lot before admission. A refusal is evidence to inspect; it is not success. Do not proceed after a failed signature or admission. The key file is a PKCS8 private key matching the admitted public key; do not put it in the lot, source tree, package or CI artifacts.
@@ -97,3 +114,7 @@ A pin names standing, not a download URL or runtime entry. Its declared artifact
 Use Bound where independently attributed observations must be judged against an accepted contract: compatibility between components, operational limits, or a team's project requirements. The selected topos must supply the actual measurements; a digest identifies the evidence without declaring it true.
 
 [Contribute a counterexample or a proposed lot](CONTRIBUTING.md).
+
+## Foundations and related libraries
+
+The two-sided constraint object is described in Nahum Ochoa's [Two-Sided Constraints on a Valued Lattice](https://doi.org/10.5281/zenodo.21858428), DOI `10.5281/zenodo.21858428`. Bound uses the object through [Obligations](https://github.com/Lapxo/obligations); [Topos](https://github.com/Lapxo/topos) supplies the wire and contracts for forms, views and selected worlds. Bound admits, folds and retains evidence across those declared boundaries. A digest identifies bytes; it does not certify that an observation is true.

docs/contracts/archive-conformance.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/pipeline/archive",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/archive.md",
+      "digest": "sha256:eedbd0ca544377080763c035053e532bfc46ddd496c3794e0cac2e0d6286e3a9"
+    },
+    {
+      "role": "yes",
+      "path": "samples/yes/archive-conformance.json",
+      "digest": "sha256:1e2a1ce055edb12da86e1ddbbf78e1f9cb910ad6fe14f57fc3e360751e604a4c"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/archive-conformance.json",
+      "digest": "sha256:c9e9566f19db9feb6a8a7619315bdb19d66f2cd7bba90f911fc047b89f4ebd8f"
+    },
+    {
+      "role": "no",
+      "path": "samples/no/archive-conformance.json",
+      "digest": "sha256:e14e5007e6b097be39964a749a09fb7143f652129869a8902743eee3ec9b89ea"
+    }
+  ]
+}

docs/contracts/archive.md

@@ -0,0 +1,11 @@
+# Exact release artifact
+
+Packing is a host operation. An archive digest names those archive bytes; it is not the identity of a Topos standing. The release pipeline makes one archive and transfers that same file to its destinations. Repeating a pack operation is not a proof of identical bytes.
+
+The archive conformance vector declares the host package command, digest algorithm, execution deadline, response bound and its sample packages. It packs each sample once, hashes the resulting bytes, verifies both destination copies, installs offline without package scripts and compares every listed installed member with the input bytes. It executes the installed entry and checks its declared output. Changed archive bytes refuse by digest before they can be treated as the named artifact. The negative control fails when that verification is removed.
+
+The samples use independent packages with different contents. Their outputs and member digests are captured by the executable vector; their file presence alone is not evidence. The selected publication reader measures this quartet through the existing process contract, and native receipts supply its member status to the plan.
+
+This is conformance of the packaging recipe. Acceptance of a particular Bound candidate additionally requires the exact archive audit, clean installation and product CLI captures for that archive. A previous archive's captures cannot certify changed implementation bytes. The final candidate must be rebuilt after admitted metadata changes, with every changed member accounted for. The product witness uses the installed reader directly, without a checkout ledger or source conditions.
+
+Rendering and installation are different boundaries. README, the manifest and the standard MIT text remain native renders. Publication to a registry or forge is a later owner action; this vector does not publish, authenticate to an account, create a tag or infer an external release from a local file.

docs/contracts/attest-evidence.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/attest-evidence-view",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/evidence-view.md",
+      "digest": "sha256:522740051150e3b35dcca31bcc398b18b8cc8b5f9b18417ec4c676f5ea59e61d"
+    },
+    {
+      "role": "yes",
+      "path": "samples/yes/native-views.json",
+      "digest": "sha256:888de96de74e6944d18d425245093845c54dd8374adc6c56f589c3e40da9f2e3"
+    },
+    {
+      "role": "no",
+      "path": "samples/no/native-views.json",
+      "digest": "sha256:7750551a70599cbecb37ee5659797ba8ff1dd84a11e17cbbe0c77ff62aecb3a5"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/native-views.json",
+      "digest": "sha256:1f17bde653377103acf8888717b0ad5c2b83b79860a4833be93270532b76c0dc"
+    }
+  ]
+}

docs/contracts/cli-fold.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/cli/fold",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/cli.md",
+      "digest": "sha256:97cddb7dac0c426b40c51d852d6176ae8f389351cc3366206f8acb0e58c7117a"
+    },
+    {
+      "role": "yes",
+      "path": "samples/yes/native-views.json",
+      "digest": "sha256:888de96de74e6944d18d425245093845c54dd8374adc6c56f589c3e40da9f2e3"
+    },
+    {
+      "role": "no",
+      "path": "samples/no/native-views.json",
+      "digest": "sha256:7750551a70599cbecb37ee5659797ba8ff1dd84a11e17cbbe0c77ff62aecb3a5"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/native-views.json",
+      "digest": "sha256:1f17bde653377103acf8888717b0ad5c2b83b79860a4833be93270532b76c0dc"
+    }
+  ]
+}

docs/contracts/cli-land.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/cli/land",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/cli.md",
+      "digest": "sha256:97cddb7dac0c426b40c51d852d6176ae8f389351cc3366206f8acb0e58c7117a"
+    },
+    {
+      "role": "yes",
+      "path": "samples/yes/native-views.json",
+      "digest": "sha256:888de96de74e6944d18d425245093845c54dd8374adc6c56f589c3e40da9f2e3"
+    },
+    {
+      "role": "no",
+      "path": "samples/no/native-views.json",
+      "digest": "sha256:7750551a70599cbecb37ee5659797ba8ff1dd84a11e17cbbe0c77ff62aecb3a5"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/native-views.json",
+      "digest": "sha256:1f17bde653377103acf8888717b0ad5c2b83b79860a4833be93270532b76c0dc"
+    }
+  ]
+}

docs/contracts/cli-sign.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/cli/sign",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/cli.md",
+      "digest": "sha256:97cddb7dac0c426b40c51d852d6176ae8f389351cc3366206f8acb0e58c7117a"
+    },
+    {
+      "role": "yes",
+      "path": "samples/yes/signing-port.json",
+      "digest": "sha256:2bbf951b29ba00e715443c1ea24884a46296ee2a5bf7fd03f6fd681ea0eacb69"
+    },
+    {
+      "role": "no",
+      "path": "samples/no/signing-port.json",
+      "digest": "sha256:bb45e5385c5efad77607edfcd79af5faa5cb064d30b2d27a0b9c79de807bca15"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/signing-port.json",
+      "digest": "sha256:53cc8abaccbcb37385fdc1acd1d251c4d3d77ca44df4f8436ee498acf40d4fde"
+    }
+  ]
+}

docs/contracts/cli.md

@@ -0,0 +1,11 @@
+# fold
+
+`bound fold` reads the admitted place. Configuration output names readings and says no encounters computed; its counts are not independent-origin states. A declared cells view projects admitted typed history into Obligations. A selected world defines other views; its contract decides when empty output is valid. A refusal or nonzero status wins over any parseable diagnostic stdout. `--check` verifies receipts without inventing a missing reading. The published evidence vector folds fresh places, preserves admitted key attribution, reads a native receipt and checks exact withdrawals. The typed-object quartet covers object states separately.
+
+# land
+
+`bound land <lot>` admits authenticated lines through the same boundary used by signing and previews. Authority, coverage, historical wire and typed context remain distinct checks. Unknown wire and tampered signatures refuse. Exact redelivery returns ONCE; it does not append another origin or grant new authority. Withdrawals remain exact under their declared contract. A refusal does not append a partial act. The published evidence vector lands fresh places, refuses unauthorized writes and tampering, redelivers signed bytes and exercises exact withdrawals. The signing-port vector additionally checks interrupted or invalid command responses do not land a partial lot.
+
+# sign
+
+`bound sign <lot>` returns canonical signed lines after validating the whole lot. The admitted key selects a declared signer; `--signer` selects the same port explicitly. File and command mechanisms use one port. Topos signing-lot/1 frames canonical bytes in lot order, one invocation per lot, and returns signatures and public-key IDs. Verification checks the admitted public key, independently of the mechanism. A command is invoked without a shell and under declared bounds. No secret output is disclosed in refusals. Missing, invalid, partial, timed-out or failed responses refuse; `land` cannot commit their partial output. The sample compares file and command signatures and landed lines, checks invocation count and ledger hashes, and refuses an unknown wire version. The sample uses ephemeral keys outside the place; no owner key is included.

docs/contracts/documents.md

@@ -0,0 +1,35 @@
+# Explanation — historical profile
+
+The declared view selects idea, what-holds and refuses from the byte-pinned historical document provider. The place owns its language and prose. Idea renders its own heading and body. The other two regions require their declared law readings or captured refusals; absent evidence supplies no invented result. The executable sample uses two unrelated places, checks the complete explanation file, repeats the product fold without a file difference and asks the named view directly. It also refuses a well-formed view asking an unoffered region. This quartet proves own-prose projection and absence under this profile; it does not certify law readings, a rejection corpus, typed-object states or the pending general document contract. Bound does not parse this prose.
+
+# README — historical profile
+
+The declared view selects hero@3, commands@3 and idea@3 from the byte-pinned historical document provider. The place supplies its name, tagline, language, sentence rule and idea. Commands and measured badges are absent in the sample: no command, number or success is invented to fill them. Two unrelated places check the generated README, a second unchanged product fold and the named view; a declared unoffered region refuses by name. The implementation member is verified against the admitted historical artifact. This quartet proves the selected prose profile, not command execution, badges with measured values or a general document grammar. The eight text@3 demands remain unpaid.
+
+# Citation file — historical profile
+
+The declared view asks the pinned document provider for cff at resolution 3. It projects the place name, version and optional citation metadata into CFF text. The sample uses the exact implementation member from the admitted historical artifact, names its hash and license, and exercises two unrelated places through the compiled CLI. It checks complete citation bytes and two equal readings; title and version follow each place. An unoffered region refuses by view name. Missing optional metadata is omitted; missing name can produce an empty answer under this historical profile. Rendering is not verification of a scientific claim or an external DOI. This pinned profile does not implement the pending general document contract.
+
+# Guide — historical profile
+
+The declared view asks seq from the pinned historical document provider. The place owns page/seq lines and their heading. Canonical input order supplies the steps; the provider numbers that order and writes the requested shape. The executable sample uses two unrelated procedures, checks their complete Markdown and reads each view twice without differences. A declared view with an unoffered region refuses by name. An empty step set may have an empty answer; it is not invented evidence. A rendered instruction does not prove that instruction was executed. The implementation bytes remain the existing pinned profile, not a document grammar inside Bound.
+
+# Reference — historical profile
+
+The declared view combines term, set and ref from the pinned historical document provider. The profile projects the place term and meaning, its selected world names and links to its declared Markdown shapes. The executable sample runs two unrelated places, checks their own term and meaning, the actual selected world and relative guide link, and captures two identical CLI readings. A view asking an unoffered region refuses by name. Missing terms or links can yield empty component answers; these are not measurements or a claim that obligations were paid. These historical regions and selectors belong to the selected Topos; Bound supplies verified inputs and dispatch only. The general document contract remains unpaid.
+
+# Manifest render profile
+
+This declared view uses the selected verbatim-prose provider at text@3. The place assigns its complete manifest text to its output shape; Bound verifies and dispatches the selected offer and writes that shape. The provider does not infer a package schema, dependency graph or fields from the filename. The sample renders two places with distinct JSON bodies twice and checks exact file bytes. Two distinct prose bodies assigned to the same shape refuse; earlier outputs remain unchanged. This proves rendering, not that arbitrary JSON is an installable package.
+
+# Workflow render profile
+
+This declared view uses the selected verbatim-prose provider at text@3. The place owns the workflow text and its shape; Bound does not infer a forge or manufacture pipeline steps. The sample writes distinct YAML bodies in two places, reads the rendered files twice and compares exact bytes. Conflicting bodies for one shape refuse without replacing prior outputs. This is a render contract, not evidence that a forge executed, staged or published a release. The release pipeline has its separate artifact gate.
+
+# Usage render profile
+
+This declared view uses the selected verbatim-prose provider at text@3. A prose line with measure=text and the requested shape supplies its own body. The sample renders distinct Markdown bodies in two places twice and compares exact bytes. Multiple identical bodies are one text; differing bodies for one shape refuse. It invents no sections or documentation schema. This existing profile does not pay the eight general-document demands or validate commands that prose happens to mention; executable commands require their own captured vectors.
+
+# Build configuration — historical profile
+
+The declared tsconfig view asks the admitted package provider for its build region. It projects the place's build/* lines whose shape matches the requested file: true and false become JSON booleans, other option values remain strings, and include separates its declared alternatives. The byte-fixed fixture names the implementation member and its artifact independently; Bound does not interpret compiler options. Two unrelated places exercise the compiled CLI, check the complete generated configuration and two byte-identical readings. A declared view asking an unoffered region refuses by name. This profile renders configuration; it does not validate compiler options or claim a successful build. An empty option set renders an empty compilerOptions object. It is a pinned historical profile, not the pending general document contract.

docs/contracts/evidence-view.md

@@ -0,0 +1,6 @@
+# Authenticated evidence view
+
+The declared evidence@8 view projects authenticated delivery history of this place. It preserves signatures and key attribution, including admitted receipts from an attest-class key. Evidence is not normative configuration, proof of truth, or an independent observation origin. Authority and coverage are checked by the existing Topos contract; no consumer or device type changes that boundary.
+
+
+The no sample specifies an uncovered write and tampered signed bytes. Both must refuse by name. Exact withdrawals remove only covered normative lines; authenticated evidence remains inspectable. The vectors assert status, signature verification and observable CLI output. No private key bytes are printed or shipped.