LispexConsumerEvidence.settlement

A portable receipt binds the complete semantic request identity to its completed canonical settlement. Complete values, deterministic SemanticFailure outcomes, and deterministic LimitExhaustion outcomes are eligible. Admission refusal, interrupted evaluation, and engine defect do not produce evaluation receipts.

The portable receipt request identity binds the complete semantic request, including its resource model and declared finite limits. Retain LispexRequest separately when its decoded fields are needed to interpret or reconstruct the request. It excludes work_used, cache state, wall time, host paths, engine identity, and issuance details. Source provenance and execution observations attach separately.

LispexConsumerArtifact is an immutable validated container for a portable receipt and optional execution evidence. The portable core records the semantic request and settlement. Attached execution evidence describes the product and engine artifact and binds that description to the same request and outcome.

Issuer identity, issuance time, and signatures belong to a separate evidence envelope. Their presence does not change the portable receipt or canonical settlement. Optional absent evidence is represented as absent data rather than fabricated authentication success.

evaluateWithEvidence(rule, input, limits, profile, hostLimits) returns Result<LispexEvidenceOutcome, LispexAttemptError>. It uses the same base request, guest evaluation events, and evaluation limits as evaluate. The LispexProfileRequest selects additional profile requirements and their versioned check contract.

Additional profile admission, input schema checks, output qualification, and evidence work use hostLimits as one separate finite profile host budget. The budget is recorded with profile work identity. It never increases or reduces the preparation or evaluation budgets and cannot change the first guest language failure.

Profile work identity binds the submitted request data, the versioned profile work contract, and the complete declared host budget. The contract fixes the profile, schemas, evidence requirements, and host checks. Reports preserve that identity across admission, qualification, and evidence stages.

Input schema refusal or exhausted profile host budget before guest entry returns Admission with a boundary report. That report retains the refused submission and verified identities. It produces no canonical evaluation outcome or evaluation receipt.

Canonical input decoding and canonical result or failure encoding remain evaluation work. They are not charged to the profile host budget. A narrower profile can require additional checks without changing the accepted request's canonical evaluation charges.

After a Complete settlement, output qualification checks the returned Datum against the selected output schema. It preserves exact values and text and performs no coercion. A schema mismatch refuses the profile result while preserving the original Complete settlement. Qualification does not rerun the guest.

A SemanticFailure or LimitExhaustion settlement remains that canonical failure during later host work. Evidence refusal cannot replace it with a business decision, a host budget resource stop, or a different language failure. The report retains the original failure class.

LispexEvidenceOutcome.Portable(evidence) is returned when the required profile work completes and an artifact is available. LispexConsumerEvidence.request and settlement are the same verified request and canonical settlement produced by the base evaluation. Its artifact binds exactly those values.

LispexEvidenceOutcome.Unrecorded(evaluation, report) preserves a completed LispexEvaluation when required qualification or evidence work refuses or cannot produce the artifact. The report identifies the profile work, stage, and reason. It preserves evaluation receipt eligibility without claiming that a receipt artifact exists.

An outer Interrupted or EngineDefect error applies when a conforming evaluation did not complete. A later host failure in qualification or evidence work returns Unrecorded with the completed evaluation and its profile report. It does not discard a known canonical settlement.

inspectConsumerArtifact(package, bytes, hostLimits) snapshots the supplied bytes and validates structure, integrity, supported contracts, request and outcome bindings, and any included execution evidence bindings. It returns an inspection containing the admitted artifact, portable receipt, and optional execution evidence. Invalid or incompatible bytes return a typed boundary or evidence failure.

Artifact inspection uses the selected package and separate finite host limits. It performs no guest evaluation or fresh replay and does not fetch replacement components. It preserves the artifact's domain and never promotes a historical portable core to a new language contract.

Artifact inspection does not authenticate the issuer or apply an unstated trust policy. A declared issuer, signature field, or binding to a receipt is descriptive data until the caller requests authentication under an explicit policy.

authenticateEvidence(artifact, trust, hostLimits) returns Result<LispexAuthentication, LispexEvidenceError>. It validates the envelope against the exact signed request and outcome binding and the supplied LispexTrustPolicy. A successful result identifies the authenticated artifact, issuer, key and algorithm. The caller retains the explicit trust policy supplied for that decision.

Absent required evidence, malformed envelopes, invalid signatures, mismatched bindings, unsupported signing contracts, rejected trust policy inputs, and exhausted authentication host limits return the applicable typed evidence failure. The operation preserves the admitted artifact and canonical outcome and performs no guest evaluation.

Authentication uses the caller supplied policy and captured verification inputs. It performs no implicit key discovery, network retrieval, trust widening, or guest callback. Its result establishes authentication of that record under that policy and does not establish policy correctness or authorize a host action.

Artifact and portable receipt serialization occur within the finite host work and result limits of the creating operation. Failure returns no artifact or successful byte prefix. consumerArtifactBytes and portableCoreBytes read retained immutable bytes without fresh serialization or another budget.

Receipt, envelope, signature, identity, and profile report encodings remain owned by their selected Lispex 2.0 contracts. Topaz preserves their distinctions without assigning current Lispex 1.x bytes, hashing conventions, or observed usage counters to the new contract.

LispexProfileRequest.profile and evidence are exact selectors from a supported admitted profile work contract. None() for a schema adds no caller supplied schema. Mandatory schemas from the selected profile still apply. Some(bytes) adds a schema constraint interpreted under that contract. Every mandatory profile constraint still applies, so both the profile and supplied schema must accept the value. Unknown selectors and malformed schemas refuse before guest entry.

An early profile admission report includes the established profile work identity in LispexBoundaryReport.verified even when canonical program or input identities are not yet available. It never inserts a proposed identity as a verified fact.

These APIs perform no implicit signing and read no hidden signing credentials. If the selected evidence contract requires an unavailable signature, evidence work refuses explicitly while preserving the completed evaluation. A host may supply an externally signed artifact to inspectConsumerArtifact and authenticateEvidence.