feat(probability): add verified finite-table mutual information (#1300)

* refactor(checkers): let declarations own provider runtimes

Compose declaration-owned clean-process runtimes with the latest batched checker-identity path. Existing checker families retain the legacy registry; new declarations may carry one unassigned provider runtime, and the composition root batches identity material across the full declaration set before authorization.

* fix(checkers): defer declaration runtime measurement

Store passive provider-runtime factories on exact replay declarations and realize each runtime once, at installation. Importing domain declarations no longer identifies or hashes checker source, while the existing installer and authorization boundary keep the same resolved runtime contract.

* refactor(checkers): keep direct runtime migration compatibility

Retain the existing direct provider_runtime constructor as a temporary compatibility seam while making provider_runtime_factory lazy and cached. Reject dual ownership and preserve pre-authorization invariants for both forms.

* fix(checkers): type the lazy runtime accessor

Declare the compatibility accessor's dynamic return as Any so mypy accepts the dataclass field interception while the public provider_runtime field retains its precise declared type.

* feat(probability): add bounded native mutual information

Rebuild the finite-table mutual-information port as one domain-owned commit on the corrected declaration-runtime base. Keep native Fraction semantics separate from canonical wire contracts, preflight bounded collections, recognize rational powers of composite bases, and independently replay large exact products without decimal-conversion limits.

* test: include check-all in the primary help contract

* fix declaration-owned checker runtime compatibility

* bound mutual-information replay inputs and certificates

* fix(checkers): satisfy static validation

* fix(probability): harden mutual-information boundaries

* fix(probability): bind mutual-information candidate support

* fix(probability): keep import isolation in approved process suite

* fix(probability): bound replay candidates by producer limits

* fix(probability): enforce native input rational bounds

Author: morluto

src/jacobian/domains/probability/bundle.py

@@ -9,6 +9,9 @@
 from jacobian.domains.probability.gaussian_inputs import (
     CanonicalGaussianPolynomialMomentRequest,
 )
+from jacobian.domains.probability.mutual_information import (
+    MUTUAL_INFORMATION_CAPABILITY,
+)
 from jacobian.domains.probability.operations import FINITE_PROBABILITY_CAPABILITIES
 from jacobian.operations import DomainDiagnostics, DomainSemantics
 from jacobian.provider_runtime import PYTHON_FLINT_VERSION
@@ -34,12 +37,13 @@ def build_finite_probability_bundle() -> DomainBundle:
         schema_namespace="jacobian.validated-analysis",
         semantics=DomainSemantics(
             name="jacobian.probability",
-            version="4",
+            version="5",
             definition={
                 "description": "bounded exact rational probability operations",
                 "scope": (
                     "raw moments, explicit event mass and conditioning, total "
-                    "pushforwards, independent finite convolutions, and one fixed-order "
+                    "pushforwards, independent finite convolutions, exact mutual "
+                    "information for bounded rational joint tables, one fixed-order "
                     "moment of a sparse complex-rational polynomial in independent "
                     "standard real Gaussian variables, and exact small-graph terminal "
                     "connection reliability"
@@ -49,18 +53,22 @@ def build_finite_probability_bundle() -> DomainBundle:
         ),
         provider_runtime=python_flint_probability_provider_runtime(),
         backend_version=f"python-flint-{PYTHON_FLINT_VERSION}",
-        capabilities=tuple(
-            _operation_with_canonical_gaussian_input(operation)
-            for operation in FINITE_PROBABILITY_CAPABILITIES
+        capabilities=(
+            MUTUAL_INFORMATION_CAPABILITY,
+            *(
+                _operation_with_canonical_gaussian_input(operation)
+                for operation in FINITE_PROBABILITY_CAPABILITIES
+            ),
         ),
         diagnostics=DomainDiagnostics(
             invalid_request=CapabilityDiagnostic(
                 code="INVALID_FINITE_PROBABILITY_REQUEST",
                 stage="finite_probability_input_validation",
                 message="Input does not satisfy the bounded exact-probability contract.",
                 hint=(
-                    "Use a bounded normalized finite distribution or a bounded "
-                    "Gaussian polynomial request, or a fully weighted small graph."
+                    "Use a bounded normalized finite distribution or joint table, "
+                    "a bounded Gaussian polynomial request, or a fully weighted "
+                    "small graph."
                 ),
             )
         ),

src/jacobian/domains/probability/checkers.py

@@ -1,7 +1,10 @@
 """Independent checker declarations owned by the probability domain."""
 
 from jacobian.checker_operations import ExactReplayCheckerDeclaration
-from jacobian.contracts.capabilities import CapabilityProviderRuntime
+from jacobian.contracts.capabilities import (
+    CapabilityInstallTier,
+    CapabilityProviderRuntime,
+)
 from jacobian.contracts.probability import (
     FiniteConvolutionRequest,
     FiniteEventRequest,
@@ -12,6 +15,10 @@
 from jacobian.domains.probability.gaussian_inputs import (
     CanonicalGaussianPolynomialMomentRequest,
 )
+from jacobian.domains.probability.mutual_information import (
+    FiniteJointTableMutualInformationRequest,
+)
+from jacobian.provider_runtime import source_provider_runtime
 from jacobian.providers import flint_runtime
 
 _ENTRYPOINT = "jacobian_checkers.exact_probability_operations"
@@ -21,6 +28,24 @@
 )
 
 
+def _mutual_information_checker_runtime(
+    *, checker_ids: tuple[str, ...] = ()
+) -> CapabilityProviderRuntime:
+    """Measure the checker source only when authorization installs it."""
+
+    return source_provider_runtime(
+        "jacobian.mutual-information-checker",
+        version="1",
+        entrypoint=(
+            "jacobian_checkers.mutual_information:check_finite_joint_mutual_information"
+        ),
+        install_tier=CapabilityInstallTier.T1,
+        license_id="MIT",
+        features=("standard-library-fraction-replay", "clean-process-checker"),
+        checker_ids=checker_ids,
+    )
+
+
 def _probability_runtime(
     *, checker_ids: tuple[str, ...] = ()
 ) -> CapabilityProviderRuntime:
@@ -30,6 +55,33 @@ def _probability_runtime(
 
 
 PROBABILITY_EXACT_REPLAY_CHECKERS = (
+    ExactReplayCheckerDeclaration(
+        "probability.joint.mutual_information.compute",
+        FiniteJointTableMutualInformationRequest,
+        "check_finite_joint_mutual_information",
+        "probability.finite-joint-mutual-information.fraction-replay",
+        entrypoint_module="jacobian_checkers.mutual_information",
+        replay_method="standard-library Fraction logarithmic-product replay",
+        reason=(
+            "operator-authorized standard-library Fraction checker independently "
+            "reconstructs marginals, likelihood ratios, and the scaled log product"
+        ),
+        provider_runtime_factory=_mutual_information_checker_runtime,
+        verification_capability_id="probability.joint.mutual_information.verify",
+        verification_title="Verify a finite-table mutual-information certificate",
+        verification_description=(
+            "Independently reconstruct ordered marginals, positive-support "
+            "likelihood ratios, and the exact scaled logarithmic product for one "
+            "bounded normalized rational joint table."
+        ),
+        verification_tags=(
+            "verification",
+            "exact",
+            "probability",
+            "information-theory",
+            "mutual-information",
+        ),
+    ),
     ExactReplayCheckerDeclaration(
         "probability.finite_distribution.raw_moment.compute",
         FiniteRawMomentRequest,