feat(core): select from explicit WCAG feasibility (#296-B)

.cargo/mutants.toml

@@ -25,6 +25,7 @@ examine_globs = [
     "crates/labcolors-core/src/wcag22_evidence.rs",
     "crates/labcolors-core/src/wcag22_feasibility.rs",
     "crates/labcolors-core/src/wcag22_feasibility/explicit.rs",
+    "crates/labcolors-core/src/wcag22_feasibility/explicit/selection.rs",
     "crates/labcolors-core/src/wcag22/kernel.rs",
 ]
 

.github/workflows/ci.yml

@@ -317,6 +317,8 @@ jobs:
         run: python3 scripts/verify_wcag22_feasibility_identity.py
       - name: verify explicit WCAG22 feasibility identity and anti-vacuum mutations
         run: python3 scripts/verify_wcag22_explicit_feasibility_identity.py --self-test
+      - name: verify explicit WCAG22 selection identity and anti-vacuum mutations
+        run: python3 scripts/verify_wcag22_explicit_selection_identity.py --self-test
       - name: validate historical and current WCAG22 feasibility benchmark evidence
         run: |
           historical_artifact="crates/labcolors-core/contracts/wcag22-feasibility-benchmark-v1.json"
@@ -332,7 +334,7 @@ jobs:
           )
           historical_checker_snapshot=6001cf41e0a8364f25543e7955ceaf64d50129b4
           historical_applicability_snapshot=94efeeeb1811f5515558ab2d79014a5e4c3a570a
-          historical_root="$RUNNER_TEMP/wcag22-feasibility-slice-a-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+          historical_root="$RUNNER_TEMP/wcag22-feasibility-history-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
           git worktree add --detach "$historical_root" "$historical_checker_snapshot"
           cleanup_history() {
             git worktree remove --force "$historical_root"
@@ -356,11 +358,38 @@ jobs:
               --self-test
           )
           cleanup_history
+
+          v2_artifact="crates/labcolors-core/contracts/wcag22-feasibility-benchmark-v2.json"
+          v2_snapshot=4afe61b124b05e13b999f83a9de580ef43405080
+          v2_protocol=(
+            --admit-revision 965eb42642beb1c072a74886be1d016027afeae5
+            --admit-rustc-release 1.96.0
+            --admit-target-triple aarch64-apple-darwin
+            --admit-target-arch aarch64
+            --admit-target-os macos
+            --admit-pointer-width-bits 64
+            --admit-package-version 0.2.0
+            --admit-sample-count 5
+          )
+          git worktree add --detach "$historical_root" "$v2_snapshot"
+          (
+            cd "$historical_root"
+            python3 scripts/check_wcag22_feasibility_benchmark.py \
+              "$v2_artifact" "${v2_protocol[@]}" \
+              --verify-current-subjects \
+              --artifact-sha256 d8d5c7f3eda834bca9912d835fe3ada13d9dcd5a11cb47a131736716b0b51202 \
+              --self-test
+            python3 scripts/check_wcag22_feasibility_applicability.py \
+              "$v2_artifact" \
+              --artifact-sha256 d8d5c7f3eda834bca9912d835fe3ada13d9dcd5a11cb47a131736716b0b51202 \
+              --self-test
+          )
+          cleanup_history
           trap - EXIT
 
-          current_artifact="crates/labcolors-core/contracts/wcag22-feasibility-benchmark-v2.json"
+          current_artifact="crates/labcolors-core/contracts/wcag22-feasibility-benchmark-v3.json"
           current_protocol=(
-            --admit-revision 965eb42642beb1c072a74886be1d016027afeae5
+            --admit-revision 6c8f66b9d0634763465d20f32b422bf1be66ab7d
             --admit-rustc-release 1.96.0
             --admit-target-triple aarch64-apple-darwin
             --admit-target-arch aarch64
@@ -372,11 +401,11 @@ jobs:
           python3 scripts/check_wcag22_feasibility_benchmark.py \
             "$current_artifact" "${current_protocol[@]}" \
             --verify-current-subjects \
-            --artifact-sha256 d8d5c7f3eda834bca9912d835fe3ada13d9dcd5a11cb47a131736716b0b51202 \
+            --artifact-sha256 b7c7e00c644cccc38f9b9a4998975a0eb1321886d71bc72f00a964b5d2ed0982 \
             --self-test
           python3 scripts/check_wcag22_feasibility_applicability.py \
             "$current_artifact" \
-            --artifact-sha256 d8d5c7f3eda834bca9912d835fe3ada13d9dcd5a11cb47a131736716b0b51202 \
+            --artifact-sha256 b7c7e00c644cccc38f9b9a4998975a0eb1321886d71bc72f00a964b5d2ed0982 \
             --self-test
 
   audit:
@@ -483,25 +512,25 @@ jobs:
           node-version: ${{ env.NODE_TOOLCHAIN }}
           cache: npm
           cache-dependency-path: packages/colors/package-lock.json
-      - name: "verify committed #296-A canonical whole-call WASM boundary evidence"
+      - name: "verify committed #296-B canonical whole-call WASM boundary evidence"
         # The admitted JSON binds exact deterministic bytes/shapes and the
         # reviewed Uint8Array package root to this built Linux x64 WASM. Fresh
         # latency/maxRSS/pages remain observations only.
         working-directory: packages/colors
         run: >-
           node bench/wcag22-feasibility-boundary.bench.mjs
           --verify
-      - name: independently fingerprint the exact #296-A WASM
+      - name: independently fingerprint the exact #296-B WASM
         run: |
           bytes="$(wc -c < packages/colors/pkg/labcolors_bg.wasm | tr -d '[:space:]')"
           sha256="$(sha256sum packages/colors/pkg/labcolors_bg.wasm | cut -d ' ' -f1)"
           echo "canonical candidate raw=${bytes}B sha256=${sha256}"
-      - name: "upload exact #296-A verified whole-call evidence"
+      - name: "upload exact #296-B verified whole-call evidence"
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: wcag22-feasibility-wasm-boundary-${{ github.sha }}-attempt-${{ github.run_attempt }}
           path: |
-            packages/colors/bench/wcag22-feasibility-wasm-boundary-v1.json
+            packages/colors/bench/wcag22-feasibility-wasm-boundary-v2.json
             packages/colors/pkg/labcolors_bg.wasm
           if-no-files-found: error
           retention-days: 30

CHANGELOG.md

@@ -32,6 +32,10 @@ Migration-note: [exact alpha / typed Glow](docs/migrations/exact-alpha-glow.md),
   финальный sRGB8», канонизирует точные UTF-8-байты ID и использует тот же
   exhaustive kernel. Возможность включена в default Core, но не проецируется в
   Protocol/WASM/FFI/npm/Swift.
+- Только полный `Feasible`-терминал минтит sealed capability выбора. Клиент
+  передаёт непрозрачный ID политики и порядок кандидатов; Core полностью
+  проверяет декларацию, выбирает первый feasible ID и повторно проверяет его
+  строку тем же exact evaluator без heap-allocation после создания source/policy.
 - Conformance pack 5.0.0 добавляет ровно одно семейство
   `wcag22-feasibility.json`: exact 7/2/0/92/59, mixed/all NotApplicable,
   typed conflict/resource failures и opaque-ID law. Шесть прежних family
@@ -75,11 +79,20 @@ Migration-note: [exact alpha / typed Glow](docs/migrations/exact-alpha-glow.md),
   `evidence/wcag22-srgb8-q55-proof-v1.json` не меняются: это отдельные version
   domains, а доказанная математика и finite artifact прежние.
 - WASM size history стала append-only: immutable V1 сохраняет допуск #284
-  (`454385 B`), V2 — transport #295 (`521240 B` / `d37841…9ca0`), а V3 —
-  Core-срез #296-A (`521231 B` / `779379…e029`). Каждый допуск имеет нулевой
-  headroom и точную ссылку на неизменяемый V1 build recipe; V1/V2 не переписаны.
-  Canonical whole-call artifact фиксирует 10 крайних форм × 5 свежих процессов;
-  latency, process maxRSS и WASM pages остаются наблюдениями, не SLO.
+  (`454385 B`), V2 — transport #295 (`521240 B` / `d37841…9ca0`), V3 —
+  Core-срез #296-A (`521231 B` / `779379…e029`), а текущий V4 — #296-B
+  (`520920 B` / `7e9c3b…84c0`). Каждый допуск имеет нулевой headroom и точную
+  ссылку на неизменяемый V1 build recipe; V1/V2/V3 не переписаны. Whole-call V2
+  сохраняет детерминированную request/outcome-проекцию 10 крайних форм × 5
+  свежих процессов из V1 и привязан к текущему native admission; latency,
+  process maxRSS и WASM pages остаются наблюдениями, не SLO.
+- Native feasibility admission также append-only относительно принятого
+  `main`: V1/V2 проверяются в исторических snapshots, а текущий V3 связывает
+  полный Core source tree с measurement revision `6c8f66b` и artifact SHA
+  `b7c7e00c644cccc38f9b9a4998975a0eb1321886d71bc72f00a964b5d2ed0982`.
+  Сырые наблюдения сохранены без timing threshold; durable-проверка делегирует
+  структурную совместимость исторического `Cargo.lock` одному applicability-
+  checker, а промежуточные draft-артефакты не становятся публичной историей.
 - Conformance pack 4.0.0 добавил `wcag22.json`; pack 5.0.0 добавляет только
   versioned complete-feasibility transport family, поэтому `packDigest`
   закономерно изменён. `manifest.numericalCapabilities` зеркалит single public

crates/labcolors-core/Cargo.toml

@@ -66,3 +66,11 @@ required-features = ["wcag22-feasibility"]
 [[test]]
 name = "wcag22_explicit_feasibility"
 required-features = ["wcag22-explicit-feasibility"]
+
+[[test]]
+name = "wcag22_explicit_selection"
+required-features = ["wcag22-explicit-feasibility"]
+
+[[test]]
+name = "wcag22_explicit_selection_alloc"
+required-features = ["wcag22-explicit-feasibility"]

crates/labcolors-core/README.md

@@ -57,7 +57,8 @@ Core-only API и не попадает в транспортный артефа
 их повторы и сам выводит мощность, digest, матрицу и partition. Разные ID с
 одинаковыми физическими байтами остаются разными кандидатами. Ни один из входов
 не выводит размер текста, компонентную семантику, применимость или предпочтение
-из ID; выбор среди допустимых кандидатов в этот контракт не входит.
+из ID. Feasibility сам ничего не ранжирует; явный клиентский порядок применяется
+только отдельным запечатанным selection-шагом после полного доказательства.
 
 Для `C` кандидатов и `E` канонических применимых рёбер выполняется ровно
 `W=C×E` атомарных проверок. При `E>0` единственный упакованный буфер имеет
@@ -124,6 +125,9 @@ use labcolors_core::{
         OccurrenceId, RelationId, RelationV1, ResourceProfileIdV1,
         explicit::{
             CandidateId, CandidateV1, DomainRequestV1, RequestV1, evaluate,
+            selection::{
+                FirstFeasibleInDeclaredOrderV1, PolicyId, SelectionOutcomeV1, select,
+            },
         },
     },
 };
@@ -145,11 +149,38 @@ let result = evaluate(RequestV1::try_new(
 )?)?;
 
 assert_eq!(result.evaluated().map(|value| value.candidates().len()), Some(2));
+let source = result
+    .selection_source()
+    .expect("this fixture has at least one feasible candidate");
+let policy = FirstFeasibleInDeclaredOrderV1::try_new(
+    PolicyId::try_new("article/foreground-order")?,
+    vec![
+        CandidateId::try_new("brand/paper")?,
+        CandidateId::try_new("brand/ink")?,
+    ],
+)?;
+let outcome = select(source, policy)?;
+let selected = match &outcome {
+    SelectionOutcomeV1::Selected { selected, .. } => {
+        selected.candidate().candidate_id().as_str()
+    }
+    SelectionOutcomeV1::NoSelection { .. } => panic!("fixture must select"),
+};
+assert_eq!(selected, "brand/ink");
 # Ok(())
 # }
 # fn main() {}
 ```
 
+`selection_source()` возвращает `Some` только для `Feasible`: `Infeasible` и
+`NotEvaluated` не могут начать выбор. Политика перечисляет допустимое подмножество
+ID в точном клиентском порядке. Core сначала проверяет весь список, затем берёт
+первый уже доказанный feasible-ID и повторно проверяет его ровно по всем `E`
+каноническим применимым рёбрам тем же вычислителем WCAG. Валидный список без
+feasible-ID возвращает исчерпывающий `NoSelection`; неизвестный/повторный ID и
+расхождение финальной проверки являются разными типизированными отказами, без
+fallback.
+
 В примере `Sc143TextDefault` означает явно объявленный клиентом критерий
 SC 1.4.3 для обычного текста с отношением 4.5:1; Core не угадывает его по ID или
 типографике. `0x75` и `0x76` — вычисленные граничные результаты именно для двух

crates/labcolors-core/benches/wcag22_feasibility_admission.rs

@@ -13,7 +13,7 @@
 //!
 //! ```text
 //! LABCOLORS_WCAG22_BENCH_SAMPLES=5 \
-//! LABCOLORS_WCAG22_BENCH_OUTPUT=/private/tmp/labcolors-wcag22-feasibility-admission-raw-v2.json \
+//! LABCOLORS_WCAG22_BENCH_OUTPUT=/private/tmp/labcolors-wcag22-feasibility-admission-raw-v3.json \
 //! cargo bench -p labcolors-core --bench wcag22_feasibility_admission
 //! ```
 
@@ -39,8 +39,8 @@ use labcolors_core::wcag22_feasibility::{
 #[path = "../src/sha256.rs"]
 mod subject_sha256;
 
-const ARTIFACT_ID: &str = "wcag22-feasibility-admission-raw-v2";
-const DEFAULT_OUTPUT_FILENAME: &str = "labcolors-wcag22-feasibility-admission-raw-v2.json";
+const ARTIFACT_ID: &str = "wcag22-feasibility-admission-raw-v3";
+const DEFAULT_OUTPUT_FILENAME: &str = "labcolors-wcag22-feasibility-admission-raw-v3.json";
 const CANDIDATE_COUNT: u64 = 256;
 const PAGE_BYTES: u64 = 65_536;
 const DECISION_SLOT_BYTES: u64 = 32;

crates/labcolors-core/contracts/wcag22-explicit-selection-identity-v1.json

@@ -0,0 +1 @@
+{"artifactId":"wcag22-explicit-selection-identity-v1","encoding":{"byteString":"u64-length-then-exact-bytes","digest":"raw-32-byte-sha256-in-preimage-lowercase-hex-in-json","integer":"u64-big-endian","policyOrder":"client-declared-exact-utf8-bytes-no-normalization","policyPreimageOrder":["separator","length-prefixed-policy-kind","length-prefixed-policy-id","declared-candidate-count","length-prefixed-candidate-ids-in-declared-order"],"receiptPreimageOrder":["separator","length-prefixed-receipt-kind","evaluation-id","relation-set-digest","policy-digest","selected-policy-ordinal","length-prefixed-selected-candidate-id","selected-srgb8","length-prefixed-profile-artifact-bound-proof-keys","proof-sha256","verified-applicable-edge-count","canonical-applicable-relation-records-with-edge-records"],"verifiedEdgeRecord":["edge-ordinal-u64","actual-foreground-srgb8","actual-background-srgb8","verified-pass-tag-01"],"verifiedRelationRecord":["canonical-relation-ordinal-u64","length-prefixed-relation-id","length-prefixed-actual-criterion-key","relation-edge-count-u64","verified-edge-records"]},"fixture":{"canonicalCandidates":[{"candidateId":"é","candidateIdUtf8Hex":"65cc81","emitted":[117,117,117]},{"candidateId":"é","candidateIdUtf8Hex":"c3a9","emitted":[117,117,117]},{"candidateId":"海","candidateIdUtf8Hex":"e6b5b7","emitted":[0,0,0]}],"canonicalRelations":[{"kind":"notApplicable","occurrenceId":"ornament","reasonId":"client/не-применимо","relationId":"00-not-applicable"},{"adjacent":[[0,0,0]],"criterion":"sc-1.4.3-text-default","kind":"applicable","occurrenceId":"hover/🎨","relationId":"alpha"},{"adjacent":[[0,0,0],[255,255,255]],"criterion":"sc-1.4.11-graphical-object","kind":"applicable","occurrenceId":"focus/🎨","relationId":"beta"}],"declaredCandidates":[{"candidateId":"海","emitted":[0,0,0]},{"candidateId":"é","emitted":[117,117,117]},{"candidateId":"é","emitted":[117,117,117]}],"domainDigestSha256":"9c99082645e713daf56f65e15012d21e80b3b491763d28ec7ddf8fa966164f17","evaluationIdSha256":"bcba480573a4a7249e8f4745dffcc69f13616e822dd82a705fd6bad2f1e66e07","failureMatrixHex":"c000","layout":{"applicableEdges":3,"applicableRelations":2,"candidateCount":3,"canonicalRelations":3,"failureMatrixBytes":2,"logicalAssessments":9,"notApplicableRelations":1,"packedResultBytes":3,"partitionBytes":1},"matrixSha256":"e9aff84fdb699ca706c0a1fed47bb095cb25e3c95aa5d1c5d216ff2cfbcd4998","partitionHex":"03","policies":[{"orderedCandidateIds":["海","é","é"],"outcome":"selected","policyDigestSha256":"60f67cfa7931a33f7968740343936e52209abbf322525933c83c919eac61f4d7","policyId":"brand/выбор/🎨","selectedCandidateId":"é","selectedEmitted":[117,117,117],"selectedPolicyOrdinal":1,"selectionReceiptDigestSha256":"972f0ebc717fb1a9b1190425aed76b63c212734253da68b558f9c2d6f3ffb230","verifiedApplicableEdges":3,"verifiedRelations":[{"criterion":"sc-1.4.3-text-default","edges":[{"background":[0,0,0],"decisionTag":1,"edgeOrdinal":0,"foreground":[117,117,117]}],"relationId":"alpha","relationOrdinal":1},{"criterion":"sc-1.4.11-graphical-object","edges":[{"background":[0,0,0],"decisionTag":1,"edgeOrdinal":1,"foreground":[117,117,117]},{"background":[255,255,255],"decisionTag":1,"edgeOrdinal":2,"foreground":[117,117,117]}],"relationId":"beta","relationOrdinal":2}]},{"orderedCandidateIds":["海","é","é"],"outcome":"selected","policyDigestSha256":"422bc9682e4829d6155ea319cf79ca2198c23373760763baee84057f38ccca25","policyId":"brand/выбор/🎨","selectedCandidateId":"é","selectedEmitted":[117,117,117],"selectedPolicyOrdinal":1,"selectionReceiptDigestSha256":"9290de999db124bfaaa97d7d67c5248e83599399a74e764cbf177e1cfcc891b9","verifiedApplicableEdges":3,"verifiedRelations":[{"criterion":"sc-1.4.3-text-default","edges":[{"background":[0,0,0],"decisionTag":1,"edgeOrdinal":0,"foreground":[117,117,117]}],"relationId":"alpha","relationOrdinal":1},{"criterion":"sc-1.4.11-graphical-object","edges":[{"background":[0,0,0],"decisionTag":1,"edgeOrdinal":1,"foreground":[117,117,117]},{"background":[255,255,255],"decisionTag":1,"edgeOrdinal":2,"foreground":[117,117,117]}],"relationId":"beta","relationOrdinal":2}]},{"orderedCandidateIds":["海"],"outcome":"noSelection","policyDigestSha256":"25906476eb6f6baf6378f0d421ea953291de5fa33d8d7733313b353660756c62","policyId":"brand/выбор/🎨","selectionReceiptDigestSha256":null}],"relationSetDigestSha256":"dc8b8a796fdf6ba47114c435b7c7da7c8664af888acbd7c7a7ece341e3dd8eca"},"schemaVersion":1}