refactor(checkers): let declarations own provider runtimes

Author: morluto

src/jacobian/checker_operations.py

@@ -90,6 +90,11 @@ class ExactReplayCheckerDeclaration:
     tags are used as written. If the domain omits the metadata, all four fields
     are strictly constructed from the producer capability ID so that no
     verifier metadata is absent at installation.
+
+    A declaration may own its complete clean-process provider runtime directly.
+    Existing built-in families may continue to use the legacy central runtime
+    registry while they are migrated. Direct runtimes must not carry checker
+    IDs before operator authorization.
     """
 
     capability_id: str
@@ -102,6 +107,7 @@ class ExactReplayCheckerDeclaration:
         "operator-authorized Python-FLINT exact replay independent of the "
         "SymPy producer"
     )
+    provider_runtime: CapabilityProviderRuntime | None = None
     verification_capability_id: str | None = None
     verification_title: str | None = None
     verification_description: str | None = None
@@ -120,6 +126,10 @@ def __post_init__(self) -> None:
                 raise ValueError(
                     f"exact replay checker declaration {field} must not be empty"
                 )
+        if self.provider_runtime is not None and self.provider_runtime.checker_ids:
+            raise ValueError(
+                "declaration-owned provider runtime must not pre-authorize checker IDs"
+            )
         derived_id = derive_verification_capability_id(self.capability_id)
         explicit_text = (
             self.verification_title,

src/jacobian/exact_domain_checkers.py

@@ -159,6 +159,8 @@ class _InstalledDeclaration:
 
 
 def _provider_runtime_key(declaration: ExactReplayCheckerDeclaration) -> str:
+    if declaration.provider_runtime is not None:
+        return f"declaration:{declaration.capability_id}"
     if declaration.entrypoint_module == "jacobian_checkers.linear":
         return {
             "check_rational_solution": "linear-solution",
@@ -233,17 +235,30 @@ def install_exact_domain_checkers(
             features=("standard-library-rational-replay", "clean-process-checker"),
         ),
     }
+    available_declarations = _available_declaration_bundles(bundles)
     provider_runtimes = {
         runtime_key: factory() for runtime_key, factory in runtime_factories.items()
     }
+    for _installed, declaration in available_declarations:
+        if declaration.provider_runtime is None:
+            continue
+        runtime_key = _provider_runtime_key(declaration)
+        previous = provider_runtimes.setdefault(
+            runtime_key,
+            declaration.provider_runtime,
+        )
+        if previous != declaration.provider_runtime:
+            raise ValueError(
+                "exact replay declarations disagree on their owned provider runtime"
+            )
     checker_ids: dict[str, str | None] = {}
     declarations_by_id: dict[str, ExactReplayCheckerDeclaration] = {}
     diagnostics: list[CapabilityDiagnostic] = []
     exact_checker_source_available = (
         exact_domain_checker_source_provider_runtime().availability
         is CapabilityProviderAvailability.AVAILABLE
     )
-    for installed, declaration in _available_declaration_bundles(bundles):
+    for installed, declaration in available_declarations:
         declarations_by_id[declaration.capability_id] = declaration
         runtime_key = _provider_runtime_key(declaration)
         provider_runtime = provider_runtimes[runtime_key]
@@ -309,13 +324,21 @@ def install_exact_domain_checkers(
         )
         for runtime_key in provider_runtimes
     }
+    resolved_provider_runtimes: dict[str, CapabilityProviderRuntime] = {}
+    for runtime_key, provider_runtime in provider_runtimes.items():
+        checker_ids_for_runtime = authorized_ids[runtime_key]
+        factory = runtime_factories.get(runtime_key)
+        resolved_provider_runtimes[runtime_key] = (
+            factory(checker_ids=checker_ids_for_runtime)
+            if factory is not None
+            else provider_runtime.model_copy(
+                update={"checker_ids": checker_ids_for_runtime}
+            )
+        )
     return ExactDomainCheckerInstallation(
         checker_ids=checker_ids,
         diagnostics=tuple(diagnostics),
-        provider_runtimes={
-            runtime_key: factory(checker_ids=authorized_ids[runtime_key])
-            for runtime_key, factory in runtime_factories.items()
-        },
+        provider_runtimes=resolved_provider_runtimes,
     )
 
 

tests/unit/test_checker_declaration_runtime.py

@@ -0,0 +1,48 @@
+from __future__ import annotations
+
+import pytest
+
+from jacobian.checker_operations import ExactReplayCheckerDeclaration
+from jacobian.contracts.capabilities import CapabilityInstallTier
+from jacobian.contracts.exact import CanonicalRational
+from jacobian.provider_runtime import source_provider_runtime
+
+
+def _runtime():
+    return source_provider_runtime(
+        "jacobian.test-declaration-checker",
+        version="1",
+        entrypoint="jacobian_checkers.linear:check_rational_solution",
+        install_tier=CapabilityInstallTier.T1,
+        license_id="MIT",
+        features=("clean-process-checker",),
+    )
+
+
+def test_exact_replay_declaration_owns_unassigned_provider_runtime() -> None:
+    runtime = _runtime()
+    declaration = ExactReplayCheckerDeclaration(
+        "test.compute.value",
+        CanonicalRational,
+        "check_rational_solution",
+        "test.value.replay",
+        entrypoint_module="jacobian_checkers.linear",
+        provider_runtime=runtime,
+    )
+
+    assert declaration.provider_runtime == runtime
+    assert declaration.provider_runtime.checker_ids == ()
+
+
+def test_exact_replay_declaration_rejects_preauthorized_runtime() -> None:
+    runtime = _runtime().model_copy(update={"checker_ids": ("checker:test",)})
+
+    with pytest.raises(ValueError, match="must not pre-authorize checker IDs"):
+        ExactReplayCheckerDeclaration(
+            "test.compute.value",
+            CanonicalRational,
+            "check_rational_solution",
+            "test.value.replay",
+            entrypoint_module="jacobian_checkers.linear",
+            provider_runtime=runtime,
+        )