@a-company/gnomon 0.0.0-stage → 8.0.2

package/dist/index.d.ts

@@ -0,0 +1,3477 @@
+import { S as Signer, K as KeyRing, D as DOMAINS_BY_KEY_CLASS, a as KeyClass, b as KeyCustody, c as SIGNATURE_DOMAINS, d as SignatureDomain, e as SignerDomainError, f as SoftwareEd25519Signer, g as answerDigest, h as approveMessage, i as decisionMessage, j as ed25519KeyId, p as p256KeyId, s as signaturePreimage, u as usesDecisionV2 } from './signer-CQ3Bpe7G.js';
+import { ReleaseManifestV1, ReleaseArtifactV1, ReleaseArtifactName, RefusedError, RefusalCode, KindOwner, Audience, Sensitivity, EventLabels, EventV1, EventScopeV1, OfferSpecV1, GrantRowKind, CardV1 } from '@a-company/gnomon-contracts';
+export { VOICE_IO_REQUIREMENT } from '@a-company/gnomon-contracts';
+import * as fs from 'node:fs';
+import 'node:crypto';
+
+/**
+ * @symbol #identity
+ *
+ * #identity (spec §3.1 key classes, I5; M1.4 slice) — the `RootAuthority` seam.
+ *
+ * The root key is non-exportable hardware P-256 (Secure Enclave via the signed
+ * helper / Windows Hello in the Passport KSP) with presence per signature, and
+ * it is the ONLY signer of registry rows (I5). That custody arrives with M1.3,
+ * which is blocked on the founder's provisioning profile. Until then:
+ *
+ *   - `UnprovisionedRootAuthority` (the production default): no trust set. It
+ *     verifies nothing and signs nothing; `signRow` refuses `UNSUPPORTED`
+ *     naming M1.3. With it, no registry row ever resolves, so no device can
+ *     authenticate and no client can verify `serverSig` against a registered
+ *     kernel key. That is the honest production posture before M1.3 — never a
+ *     software fallback (§3.1 failure modes).
+ *   - `HardwareRootAuthority` (identity/hardware.ts, M1.3): the Secure Enclave
+ *     root behind the signed helper, provisioned by `gnomon identity init`.
+ *   - `DevTestRootAuthority`: a SOFTWARE P-256 key in memory, constructible
+ *     only by code that passes the literal acknowledgement `DEV_TEST_ROOT_ACK`.
+ *     No env var or flag selects it (§15.3: the daemon reads no `GNOMON_*`),
+ *     and no file does for the daemon: `gnomond` never constructs it and
+ *     refuses a dev home. The ONE file exception is honoured only by the
+ *     `gnomon` CLI's `dev up` (#dev-launch): a DEV home's ack-bearing marker
+ *     plus its 0600 root key file. It exists so tests can drive
+ *     the full mutual-auth path, and so `gnomon dev up` (#dev-launch, the
+ *     unsigned dogfood path until M1.3) can run a kernel IN ITS OWN PROCESS on
+ *     a separate, marked DEV home — never `~/.gnomon`. Everything it touches reports
+ *     `state: 'dev-test'` (status, daemon.start) so it can never pass silently.
+ *
+ * Row signatures use the §3.1 `gnomon:row-sig:v1` domain over the canonical
+ * JSON of the row, ECDSA P-256 / SHA-256 in IEEE-P1363 encoding — the same
+ * bytes `KeyRing.verify(…, 'row', …)` checks, so a hardware root drops in
+ * behind this interface without changing a verifier.
+ */
+
+type RootState = 'unprovisioned' | 'dev-test' | 'hardware';
+interface RootAuthority {
+    readonly state: RootState;
+    /** `gkey-p256:v1:<sha256(spki DER)>`, or null when no root exists. */
+    readonly rootKeyId: string | null;
+    /** The trust-set namespace, or null when no root exists. */
+    readonly ns: string | null;
+    /** Verify a registry row signature: true only for THIS root (the 8.0 trust set, I5). */
+    verifyRow(signer: string, row: unknown, sigB64: string): boolean;
+    /** Sign a registry row; throws RootUnavailableError when there is no usable root. */
+    signRow(row: unknown): {
+        signer: string;
+        sig: string;
+    };
+    /** Asynchronous form (M1.3 hardware root: the daemon's helper, so a presence prompt never blocks the event loop). */
+    signRowAsync?(row: unknown): Promise<{
+        signer: string;
+        sig: string;
+    }>;
+}
+
+/** Anything that verifies rows from the trust set (RootAuthority or a client's RootVerifier). */
+interface RowVerifier {
+    readonly rootKeyId: string | null;
+    readonly ns: string | null;
+    verifyRow(signer: string, row: unknown, sigB64: string): boolean;
+}
+
+/**
+ * @symbol #release-pins
+ *
+ * #release-pins (TD-2026-10-21-758 zero-build, G-HLP-01; T-2026-10-21-028) — the exact native bytes THIS kernel
+ * build accepts. The pins are COMPILED INTO THE BUNDLE, never read from a file at runtime (Aegis M1 review):
+ * `npm run build:release` (scripts/build-release.mjs) writes a release-manifest:v1 (gnomon-contracts) from the signed
+ * bin/ outputs, then rebuilds with tsup `define` (tsup.config.ts, env GNOMON_RELEASE_MANIFEST):
+ * __GNOMON_RELEASE__ = true and __GNOMON_RELEASE_MANIFEST__ = the manifest JSON.
+ *
+ *   - release: every helper pin (identity/helper.ts pinHelper) and every voice-io install and pre-spawn re-check
+ *     (voice/voice-install.ts) must match the compiled sha256 for this arch, ON TOP of the code-signing requirement
+ *     and the version floor. A mismatch, or no entry for this arch, is refused `checksum`. Deleting or editing
+ *     dist/build-id.json, loading dist/index.js, or copying dist elsewhere changes nothing: the hashes travel with
+ *     the code (the stamp's `release` copy is informational only, for status and the upgrade card).
+ *   - broken: compiled as a release but the compiled manifest is missing or invalid: EVERY pin is refused; a
+ *     release never degrades to dev.
+ *   - dev: not compiled as a release (a plain `npm run build`, a test run from src): signature plus version floor
+ *     only. `gnomon daemon status` says `build: dev` and the setup helper row says so.
+ * Residual: a dev tree's dist is session-writable, so its code (and so its pins) is only as strong as the tree; the
+ * signed app bundle's seal is what makes a release's compiled pins hold.
+ */
+
+type ReleasePins = {
+    readonly mode: 'release';
+    readonly manifest: ReleaseManifestV1;
+} | {
+    readonly mode: 'dev';
+    readonly why: string;
+} | {
+    readonly mode: 'broken';
+    readonly why: string;
+};
+type ReleaseMode = ReleasePins['mode'];
+declare const DEV_PINS: ReleasePins;
+/** The pins a build carries: not a release ⇒ dev; a release ⇒ its compiled manifest must be present and valid, else broken. */
+declare function releasePinsFromCompiled(release: boolean, manifestJson: string | null | undefined): ReleasePins;
+/** The pins compiled into the bundle this process runs (computed once). */
+declare function loadedReleasePins(): ReleasePins;
+/** What a verifier must enforce for one artifact on this arch. */
+type ArtifactPin = {
+    readonly kind: 'dev';
+} | {
+    readonly kind: 'pinned';
+    readonly artifact: ReleaseArtifactV1;
+} | {
+    readonly kind: 'refuse';
+    readonly why: string;
+};
+declare function artifactPin(pins: ReleasePins, name: ReleaseArtifactName, arch?: string): ArtifactPin;
+/** One line for status surfaces: `release 8.0.0 (sha256-pinned)`, `dev (…)`, `broken (…)`. */
+declare function describeReleasePins(pins: ReleasePins): string;
+
+type releasePins_ArtifactPin = ArtifactPin;
+declare const releasePins_DEV_PINS: typeof DEV_PINS;
+type releasePins_ReleaseMode = ReleaseMode;
+type releasePins_ReleasePins = ReleasePins;
+declare const releasePins_artifactPin: typeof artifactPin;
+declare const releasePins_describeReleasePins: typeof describeReleasePins;
+declare const releasePins_loadedReleasePins: typeof loadedReleasePins;
+declare const releasePins_releasePinsFromCompiled: typeof releasePinsFromCompiled;
+declare namespace releasePins {
+  export { releasePins_DEV_PINS as DEV_PINS, releasePins_artifactPin as artifactPin, releasePins_describeReleasePins as describeReleasePins, releasePins_loadedReleasePins as loadedReleasePins, releasePins_releasePinsFromCompiled as releasePinsFromCompiled };
+  export type { releasePins_ArtifactPin as ArtifactPin, releasePins_ReleaseMode as ReleaseMode, releasePins_ReleasePins as ReleasePins };
+}
+
+/**
+ * Aegis H1 (c): identifier + team is not enough (every binary the team signs
+ * as gnomon.helper passes it, an old one included). After spawn and before
+ * any request the kernel asks `info` and refuses a helper whose protocol is
+ * not HELPER_PROTOCOL or whose version is below this floor (the floor moves
+ * with every security-relevant helper change). Chosen over a CDHash
+ * allowlist: a timestamped signature changes the CDHash-bearing bytes on
+ * every founder build, so an allowlist shipped with the kernel would break on
+ * each rebuild; the floor stops downgrades to known-weaker helpers.
+ */
+declare const MIN_HELPER_VERSION = "1.6.0";
+/** The designated requirement the helper must satisfy (Developer ID, this team, this identifier). */
+declare const HELPER_REQUIREMENT = "anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] exists and certificate leaf[field.1.2.840.113635.100.6.1.13] exists and certificate leaf[subject.OU] = \"SW4BMQ8PNL\" and identifier \"gnomon.helper\"";
+interface HelperVerifier {
+    /** Throws HelperUnavailableError when `exe` is not the signed helper. */
+    verify(exe: string): void;
+    /** After spawn, before the first request: throws when the RUNNING child is not the signed helper (H5). */
+    verifyRunning(pid: number): void;
+    readonly kind: 'codesign' | 'dev-test' | 'unavailable';
+}
+interface PinnedHelper {
+    readonly exe: string;
+    readonly sha256: string;
+    readonly verifier: HelperVerifier;
+    /** Synchronous re-check right before a spawn: same path, inode, size, mtime and sha256. Throws HelperUnavailableError. */
+    recheck(): void;
+}
+/**
+ * Resolve once; HASH, then VERIFY the signature, then RE-HASH and compare
+ * (Aegis H5: a file swapped between the codesign check and the hash would
+ * otherwise pin bytes nobody verified); record the facts the pre-spawn
+ * re-check compares.
+ */
+declare function pinHelper(exePath: string, o?: {
+    verifier?: HelperVerifier;
+    expectedSha256?: string;
+    pins?: ReleasePins;
+}): PinnedHelper;
+/**
+ * G-HLP-01 (T-2026-10-21-028): the sha256 a release build pins for the helper on this arch, or undefined in a dev
+ * build (signature + version floor only). A release that pins no helper for this arch, pins it under another
+ * signing requirement, or pins one below MIN_HELPER_VERSION refuses before anything is verified or run.
+ */
+declare function releaseHelperSha256(pins: ReleasePins, arch?: string): string | undefined;
+
+declare const FORBIDDEN_FLAGS: readonly string[];
+declare const SETTING_SOURCES: readonly ["user", "project", "local"];
+type SettingSource = (typeof SETTING_SOURCES)[number];
+/**
+ * "Your hooks inside sessions" (founder decision OPEN, T-2026-10-18-010 L4;
+ * docs/private/gnomon-founder-steps.html): which Claude settings layers a
+ * Gnomon-started session loads — and so whose hooks run inside it, with no
+ * trust prompt in `-p` mode. A ROOT-SIGNED config switch
+ * (`config.sessions.hooks`, budget/config.ts), never env/project/CLI:
+ *   - `audited` (DEFAULT, founder ruling P8-D94): user only, plus the repo's
+ *     project/local hooks the KERNEL extracted and the human approved per
+ *     hook (kernel/supervisor/repo-hooks.ts), written into the session's own
+ *     policy.json (`--settings`); unapproved, denied or unsafe hooks never run.
+ *     P8-D97: the repo's CONTEXT still loads — `--add-dir` memory dirs (with
+ *     REPO_CONTEXT_ENV) and a kernel-staged `--plugin-dir` of its skills,
+ *     agents and commands with frontmatter hooks stripped
+ *     (kernel/supervisor/repo-context.ts; probe p10m-repo-context);
+ *   - `all` (the slice-1 behaviour): user, project, local — your hooks AND
+ *     any hooks committed in the repo's `.claude/settings.json`, raw;
+ *   - `user-only`: user — your own hooks, never the repo's;
+ *   - `none`: no layer — only Gnomon's generated policy.json applies.
+ * Managed settings load regardless (p01: outside the switch).
+ */
+declare const SESSION_HOOKS_MODES: readonly ["audited", "all", "user-only", "none"];
+type SessionHooksMode = (typeof SESSION_HOOKS_MODES)[number];
+declare const DEFAULT_SESSION_HOOKS: SessionHooksMode;
+/** P8-D97: only `audited` loads the repo's context through the kernel (`all` loads it natively; the others not at all). */
+declare function repoContextFor(mode: SessionHooksMode): boolean;
+declare function settingSourcesFor(mode: SessionHooksMode): readonly SettingSource[];
+/** P8-D96: the only permission-channel values (p01b: `host` needs `--permission-prompt-tool stdio`). */
+declare const PERMISSION_PROMPTS: "host";
+declare const PERMISSION_PROMPT_TOOL: "stdio";
+/** Exactly one `--permission-prompts host` and one `--permission-prompt-tool stdio` (also in `--flag=value` form); anything else throws. */
+declare function assertPermissionChannel(argv: readonly string[]): void;
+declare class ForbiddenFlagError extends Error {
+    readonly flag: string;
+    constructor(flag: string);
+}
+interface ClaudeArgvInput {
+    /** `--session-id` for a new session, `--resume` for a respawn. */
+    uuid: string;
+    resume?: boolean;
+    policyPath: string;
+    mcpConfigPath: string;
+    /** Explicit subset (p01: user, project, local); empty = none. */
+    settingSources: readonly SettingSource[];
+    appendSystemPrompt?: string;
+    model?: string;
+    /** P8-D97: kernel-staged plugin dirs (`--plugin-dir`, each once) — the repo's stripped skills, agents, commands. */
+    pluginDirs?: readonly string[];
+    /** P8-D97: memory dirs (`--add-dir`, each once) — loaded as CLAUDE.md dirs with REPO_CONTEXT_ENV. */
+    addDirs?: readonly string[];
+    /** Extra flags (never a forbidden one). */
+    extra?: readonly string[];
+}
+/** Throws ForbiddenFlagError for any forbidden flag, also in `--flag=value` form. */
+declare function assertNoForbiddenFlags(argv: readonly string[]): void;
+/** Q6 (Aegis): the ONLY flags a caller may pass in `extra`, with their arity. Every other flag is refused. */
+declare const EXTRA_FLAGS: Readonly<Record<string, 0 | 1>>;
+type FlagSpec = {
+    arity: 0 | 1 | '*';
+    min: number;
+    max: number;
+};
+/**
+ * Q6: the whole argv grammar. Every kernel-owned flag appears exactly once (min = max = 1) or at most once; `--agents`
+ * and `--tools` are kernel-owned and the kernel never sets them, so they may not appear at all. `--session-id` and
+ * `--resume` are exactly one between them. `--add-dir` is ONE variadic flag.
+ */
+declare const ARGV_GRAMMAR: Readonly<Record<string, FlagSpec>>;
+/** Q6: walk an argv against a grammar (arity-aware, `--flag=value` included); throws TypeError on any unknown flag, stray value or wrong count. */
+declare function assertArgv(argv: readonly string[], grammar?: Readonly<Record<string, FlagSpec>>, enforceMin?: boolean): Map<string, number>;
+declare function buildClaudeArgv(i: ClaudeArgvInput): string[];
+/**
+ * The user message for one turn. `guidance` (#gnomon-voice table talk, TD-2026-10-20-294) rides as a SECOND text
+ * block after the human's text; the first block is always the human's text alone (its bytes are the contentHash).
+ */
+declare function userMessageLine(text: string, guidance?: string | null): string;
+declare function controlInterruptLine(requestId?: string): string;
+/**
+ * The mid-session model switch (probe p-set-model). The model must pass claudeModelProblem (an alias or a strict
+ * `claude-…` id); the request id must be a REQUEST_ID (the kernel matches the control_response by it).
+ */
+declare function controlSetModelLine(requestId: string, model: string): string;
+/** P8-D96 allow: `updatedInput` is ALWAYS the kernel-held input of the request (never a client's); no updatedPermissions. */
+declare function permissionAllowLine(requestId: string, updatedInput: unknown): string;
+declare function permissionDenyLine(requestId: string, message: string, interrupt?: boolean): string;
+/** The answer to a control_request subtype the kernel does not serve. */
+/** #kernel-mcp: the answer to an `mcp_message` control request (the SDK server shape: response.mcp_response). */
+declare function mcpResponseLine(requestId: string, mcpResponse: unknown): string;
+declare function controlErrorLine(requestId: string, error: string): string;
+interface Usage {
+    tokens: number;
+}
+type AdapterEvent = {
+    kind: 'init';
+    type: string;
+    sessionId: string | null;
+    model: string | null;
+    apiKeySource: string | null;
+}
+/**
+ * A stream_event line. parentToolUseId: null on the main chain (a sub-agent's stream sets it). stopReason: the
+ * message_delta's stop_reason when this line carries one (the #gnomon-voice busy guard ends a reply at the main-chain
+ * message_stop after an end_turn delta, TD-2026-10-20 voice drops fix).
+ */
+ | {
+    kind: 'partial';
+    type: string;
+    bytes: number;
+    usage?: {
+        messageId: string | null;
+        tokens: number;
+    };
+    parentToolUseId: string | null;
+    stopReason: string | null;
+} | {
+    kind: 'message';
+    type: string;
+    messageId: string | null;
+    tokens: number | null;
+    toolUses: Array<{
+        id: string | null;
+        name: string;
+        input: unknown;
+    }>;
+    quota: boolean;
+    model: string | null;
+    parentToolUseId: string | null;
+    stopReason: string | null;
+} | {
+    kind: 'user';
+    type: string;
+    replay: boolean;
+    toolResults: ToolResultSeen[];
+} | {
+    kind: 'result';
+    type: string;
+    subtype: string | null;
+    isError: boolean;
+    tokens: number | null;
+    split: UsageSplit | null;
+    costUsd: number | null;
+    permissionDenials: number;
+    quota: boolean;
+} | {
+    kind: 'control';
+    type: string;
+    subtype: string | null;
+    requestId: string | null;
+    error: string | null;
+    errorCode: string | null;
+} | {
+    kind: 'permission-request';
+    type: 'control_request.can_use_tool';
+    requestId: string;
+    toolName: string;
+    toolUseId: string | null;
+    input: Record<string, unknown>;
+} | {
+    kind: 'control-cancel';
+    type: 'control_cancel_request';
+    requestId: string;
+} | {
+    kind: 'permission-malformed';
+    type: 'control_request.can_use_tool';
+    requestId: string;
+} | {
+    kind: 'control-request-unknown';
+    type: string;
+    subtype: string;
+    requestId: string | null;
+} | {
+    kind: 'mcp-message';
+    type: 'control_request.mcp_message';
+    requestId: string;
+    serverName: string;
+    message: unknown;
+} | {
+    kind: 'unknown';
+    type: string;
+} | {
+    kind: 'malformed';
+    type: string;
+    bytes: number;
+};
+/** One tool_result in a `user` line: its tool_use id, is_error, and Claude's permission decision (`accept` | `reject`) when reported. */
+interface ToolResultSeen {
+    toolUseId: string;
+    isError: boolean;
+    decision: string | null;
+}
+/** A control request id we answer: printable, bounded (p01b: Claude sends UUIDs). */
+declare const REQUEST_ID: RegExp;
+/** The turn's usage by kind (#ledger-mod): numbers only, from result.usage. */
+interface UsageSplit {
+    in: number;
+    out: number;
+    cacheRead: number;
+    cacheWrite: number;
+}
+/** input / output / cache read / cache creation; null when no usage object. */
+declare function usageSplit(u: unknown): UsageSplit | null;
+/** input + output + cache creation + cache read; null when no usage object. */
+declare function usageTokens(u: unknown): number | null;
+declare function parseStreamLine(line: string): AdapterEvent;
+/**
+ * The kernel's facts about one hook line, read from the FULL line before the line is stored (Aegis M2: a hook that
+ * prints past EVENT_LINE_CAP pushes its line to hash-only storage, so a reader of the stored row could not see a block).
+ * The supervisor logs them as `turn.event.hook`; readers use them first and parse the line only as a fallback.
+ */
+interface HookFacts {
+    id: string | null;
+    event: string | null;
+    name: string | null;
+    /** hook_response only: the exit code and Claude's outcome (success | error | cancelled) */
+    exit: number | null;
+    outcome: string | null;
+    /** hook_response only: the hook blocked (exit 2, or exit 0 with stdout JSON `{decision: 'block'}`) */
+    blocked: boolean;
+}
+/** Per hook output field (stdout, stderr, output): kept inline up to this many bytes, above it `{bytes, sha256}` (Aegis L2). */
+declare const HOOK_OUTPUT_INLINE_CAP = 4096;
+/** A hook_response that blocked (claude 2.1.309): exit 2, or exit 0 (or none) with stdout a JSON object whose decision is 'block'. */
+declare function stopHookBlocked(o: Record<string, unknown>): boolean;
+/** The facts of a system.hook_started / hook_response line, or null for any other line. */
+declare function hookFactsOf(line: string): HookFacts | null;
+/**
+ * Aegis L2: the hook_response line as the log keeps it. stdout, stderr and output stay inline up to
+ * HOOK_OUTPUT_INLINE_CAP bytes each (after `redact`), above it `{bytes, sha256}`; `output` is dropped when it is exactly
+ * stdout + stderr (Claude writes both). Null for any other line (it is stored as received).
+ */
+declare function hookStoredLine(line: string, redact?: (s: string) => {
+    text: string;
+    count: number;
+}): {
+    line: string;
+    redacted: number;
+    hashed: string[];
+    dropped: string[];
+} | null;
+/**
+ * Aegis 2026-10-23: Claude's SYNTHETIC user line (`isSynthetic: true`, e.g. "Stop hook feedback:\n[<command>]: <reason>")
+ * carries hook output fed back to the model, so it is kept like hook output: each text block's text inline up to
+ * HOOK_OUTPUT_INLINE_CAP bytes (after `redact`), above it `{bytes, sha256}`. Null for any other line: a real user line
+ * (the human's replay, tool results) is stored as received.
+ */
+declare function syntheticStoredLine(line: string, redact?: (s: string) => {
+    text: string;
+    count: number;
+}): {
+    line: string;
+    redacted: number;
+    hashed: string[];
+    dropped: string[];
+} | null;
+/** A control_response error made safe to show: sanitised (§4.5), one line, at most 256 characters. */
+declare function controlErrorText(raw: string, max?: number): string;
+/** The two tool uses that become cards (§3.3): AskUserQuestion ⇒ ask-user, ExitPlanMode ⇒ plan. */
+declare function cardKindOfTool(name: string): 'ask-user' | 'plan' | null;
+/** Per-turn usage deltas (no double count across repeated message usage and the result total). */
+declare class UsageMeter {
+    #private;
+    /** A message's cumulative usage; returns the tokens not yet charged. */
+    message(messageId: string | null, tokens: number): number;
+    /** The turn's total from `result.usage`; returns what the messages did not charge, and resets the turn. */
+    result(total: number | null): number;
+}
+/**
+ * Line splitter with the §3.3 caps: a stdout line over `maxLine` bytes is
+ * dropped and reported ONCE (with its total size, at its end), never buffered
+ * without bound. Linear: each chunk is measured once (no re-measuring of the
+ * accumulated buffer).
+ */
+declare class LineSplitter {
+    #private;
+    constructor(maxLine: number);
+    push(chunk: string, onLine: (line: string) => void, onDropped: (bytes: number) => void): void;
+}
+
+declare const adapter_ARGV_GRAMMAR: typeof ARGV_GRAMMAR;
+type adapter_AdapterEvent = AdapterEvent;
+type adapter_ClaudeArgvInput = ClaudeArgvInput;
+declare const adapter_DEFAULT_SESSION_HOOKS: typeof DEFAULT_SESSION_HOOKS;
+declare const adapter_EXTRA_FLAGS: typeof EXTRA_FLAGS;
+declare const adapter_FORBIDDEN_FLAGS: typeof FORBIDDEN_FLAGS;
+type adapter_ForbiddenFlagError = ForbiddenFlagError;
+declare const adapter_ForbiddenFlagError: typeof ForbiddenFlagError;
+declare const adapter_HOOK_OUTPUT_INLINE_CAP: typeof HOOK_OUTPUT_INLINE_CAP;
+type adapter_HookFacts = HookFacts;
+type adapter_LineSplitter = LineSplitter;
+declare const adapter_LineSplitter: typeof LineSplitter;
+declare const adapter_PERMISSION_PROMPTS: typeof PERMISSION_PROMPTS;
+declare const adapter_PERMISSION_PROMPT_TOOL: typeof PERMISSION_PROMPT_TOOL;
+declare const adapter_REQUEST_ID: typeof REQUEST_ID;
+declare const adapter_SESSION_HOOKS_MODES: typeof SESSION_HOOKS_MODES;
+declare const adapter_SETTING_SOURCES: typeof SETTING_SOURCES;
+type adapter_SessionHooksMode = SessionHooksMode;
+type adapter_SettingSource = SettingSource;
+type adapter_ToolResultSeen = ToolResultSeen;
+type adapter_Usage = Usage;
+type adapter_UsageMeter = UsageMeter;
+declare const adapter_UsageMeter: typeof UsageMeter;
+type adapter_UsageSplit = UsageSplit;
+declare const adapter_assertArgv: typeof assertArgv;
+declare const adapter_assertNoForbiddenFlags: typeof assertNoForbiddenFlags;
+declare const adapter_assertPermissionChannel: typeof assertPermissionChannel;
+declare const adapter_buildClaudeArgv: typeof buildClaudeArgv;
+declare const adapter_cardKindOfTool: typeof cardKindOfTool;
+declare const adapter_controlErrorLine: typeof controlErrorLine;
+declare const adapter_controlErrorText: typeof controlErrorText;
+declare const adapter_controlInterruptLine: typeof controlInterruptLine;
+declare const adapter_controlSetModelLine: typeof controlSetModelLine;
+declare const adapter_hookFactsOf: typeof hookFactsOf;
+declare const adapter_hookStoredLine: typeof hookStoredLine;
+declare const adapter_mcpResponseLine: typeof mcpResponseLine;
+declare const adapter_parseStreamLine: typeof parseStreamLine;
+declare const adapter_permissionAllowLine: typeof permissionAllowLine;
+declare const adapter_permissionDenyLine: typeof permissionDenyLine;
+declare const adapter_repoContextFor: typeof repoContextFor;
+declare const adapter_settingSourcesFor: typeof settingSourcesFor;
+declare const adapter_stopHookBlocked: typeof stopHookBlocked;
+declare const adapter_syntheticStoredLine: typeof syntheticStoredLine;
+declare const adapter_usageSplit: typeof usageSplit;
+declare const adapter_usageTokens: typeof usageTokens;
+declare const adapter_userMessageLine: typeof userMessageLine;
+declare namespace adapter {
+  export { adapter_ARGV_GRAMMAR as ARGV_GRAMMAR, adapter_DEFAULT_SESSION_HOOKS as DEFAULT_SESSION_HOOKS, adapter_EXTRA_FLAGS as EXTRA_FLAGS, adapter_FORBIDDEN_FLAGS as FORBIDDEN_FLAGS, adapter_ForbiddenFlagError as ForbiddenFlagError, adapter_HOOK_OUTPUT_INLINE_CAP as HOOK_OUTPUT_INLINE_CAP, adapter_LineSplitter as LineSplitter, adapter_PERMISSION_PROMPTS as PERMISSION_PROMPTS, adapter_PERMISSION_PROMPT_TOOL as PERMISSION_PROMPT_TOOL, adapter_REQUEST_ID as REQUEST_ID, adapter_SESSION_HOOKS_MODES as SESSION_HOOKS_MODES, adapter_SETTING_SOURCES as SETTING_SOURCES, adapter_UsageMeter as UsageMeter, adapter_assertArgv as assertArgv, adapter_assertNoForbiddenFlags as assertNoForbiddenFlags, adapter_assertPermissionChannel as assertPermissionChannel, adapter_buildClaudeArgv as buildClaudeArgv, adapter_cardKindOfTool as cardKindOfTool, adapter_controlErrorLine as controlErrorLine, adapter_controlErrorText as controlErrorText, adapter_controlInterruptLine as controlInterruptLine, adapter_controlSetModelLine as controlSetModelLine, adapter_hookFactsOf as hookFactsOf, adapter_hookStoredLine as hookStoredLine, adapter_mcpResponseLine as mcpResponseLine, adapter_parseStreamLine as parseStreamLine, adapter_permissionAllowLine as permissionAllowLine, adapter_permissionDenyLine as permissionDenyLine, adapter_repoContextFor as repoContextFor, adapter_settingSourcesFor as settingSourcesFor, adapter_stopHookBlocked as stopHookBlocked, adapter_syntheticStoredLine as syntheticStoredLine, adapter_usageSplit as usageSplit, adapter_usageTokens as usageTokens, adapter_userMessageLine as userMessageLine };
+  export type { adapter_AdapterEvent as AdapterEvent, adapter_ClaudeArgvInput as ClaudeArgvInput, adapter_HookFacts as HookFacts, adapter_SessionHooksMode as SessionHooksMode, adapter_SettingSource as SettingSource, adapter_ToolResultSeen as ToolResultSeen, adapter_Usage as Usage, adapter_UsageSplit as UsageSplit };
+}
+
+declare const SESSION_POLICY_SCHEMA: "gnomon-session-policy:v1";
+/** §15.5 `session` denies that are not file paths (platform-neutral names). */
+declare const SESSION_DENY_CLASSES: readonly ["unix-socket:tmux", "unix-socket:screen", "ipc:helper-service", "ipc:process-table-service", "automation:apple-events", "service-manager", "media:microphone", "media:camera", "launchers", "process-info:others", "loopback:endpoint-port"];
+type SessionDenyClass = (typeof SESSION_DENY_CLASSES)[number];
+/**
+ * `steering` (P8-D97 R1): under `path`, at ANY depth and in ANY letter case, a `CLAUDE*.md` file or anything in a
+ * `.claude` dir — the memory and settings Claude Code may load from a subtree. Write-deny only.
+ */
+/**
+ * `dep-steering` (P8-D97 F2): under `path`, inside ANY `node_modules` at any depth, in any case, a `CLAUDE*.md` file or
+ * anything in a `.claude` dir — dependency-shipped memory the subtree audit does not walk. Read-deny only.
+ */
+/**
+ * `worktree-guard` (#git-verbs, T-2026-10-23-002): `path` is a kernel worktrees dir W (`<root>/.gnomon/worktrees`).
+ * Write-deny of each worktree's own entry `W/<name>` (no create, remove or rename: only the kernel adds or removes a
+ * worktree), its `.git` pointer file `W/<name>/.git` and its `W/<name>/.mcp.json` (any case).
+ * `worktree-gitdir`: `path` is `<commonDir>/worktrees`. Write-deny of each worktree's private git dir entry and its
+ * `commondir`, `gitdir` and `config.worktree` (what tells git where the config lives); HEAD, index and logs stay writable.
+ */
+/**
+ * `dotgit-any` (Aegis round 2 M5): under `path` (a session root), at ANY depth and in any case, an entry named `.git`
+ * (a planted nested repo or gitfile the human's git would later read). Only the entry itself: an existing nested repo's
+ * contents stay as they were. The kernel worktrees' pointers are below it too (and guarded by worktree-guard).
+ */
+type PathMatch = 'subpath' | 'literal' | 'prefix' | 'steering' | 'dep-steering' | 'worktree-guard' | 'worktree-gitdir' | 'dotgit-any';
+/** Where the kernel makes a session's worktrees, relative to a session root (#git-verbs git.worktree.add). */
+declare const KERNEL_WORKTREES_REL = ".gnomon/worktrees";
+interface PolicyPath {
+    path: string;
+    match: PathMatch;
+    /** why the deny exists (the §15.5 class) */
+    class: 'keys' | 'kernel-log' | 'warpline-tokens' | 'browser-profile' | 'gnomon-home' | 'settings' | 'linked-folder' | 'git' | 'binary' | 'persistence' | 'transcripts' | 'session-env' | 'worktrees' | 'root' | 'temp' | 'cache';
+}
+interface SessionPolicy {
+    schemaVersion: typeof SESSION_POLICY_SCHEMA;
+    profile: 'session';
+    denyRead: PolicyPath[];
+    /**
+     * M1.7 slice 2 (T-2026-10-18-010): the ONLY reads carved back out of the
+     * read-denied Gnomon home — the session's own dir, the binary the kernel
+     * execs from `<home>/bin`, the pinned runner copy. Never under keys/,
+     * the kernel log, or another session's dir (buildSessionPolicy refuses).
+     */
+    allowRead: PolicyPath[];
+    /** metadata only (lstat, for realpath) on the literal ancestors of allowRead inside the home; no listing, no data */
+    allowReadMetadata: PolicyPath[];
+    /** re-denied AFTER allowRead (belt and braces: keys + the kernel log stay unreadable whatever is allowed) */
+    denyReadAlways: PolicyPath[];
+    denyWrite: PolicyPath[];
+    /**
+     * TD-2026-10-19-814 item 1 (probe p-resume, darwin): writes carved back out of denyWrite, rendered AFTER it (last
+     * match wins). Only ever `<userClaudeDir>/projects` (subpath) — Claude Code's transcripts, so `--resume` works —
+     * and `<userClaudeDir>/session-env/<uuid>` (subpath) — THIS session's dir Claude Code creates before any command
+     * hook runs (never the whole session-env, Aegis H1) — and only for a Claude session (`claudeTranscripts` / `claudeSessionEnv`). Never an input path: no
+     * manifest or caller can name one.
+     */
+    allowWrite: PolicyPath[];
+    /**
+     * T-2026-10-23-004 (Aegis, the root fix): session file writes are DENY BY DEFAULT. The profile opens with
+     * `(deny file-write*)` and allows ONLY these (rendered before denyWrite, so every deny still wins inside them): the
+     * session roots (subpath; the kernel worktrees live under them), the session's temp (its TMPDIR's per-user
+     * /private/var/folders/<a>/<b> dir, /private/tmp, /private/var/tmp) and the measured tool caches
+     * (WRITE_CACHE_PATHS under the user home). The transcript and session-env carve-backs stay allowWrite. A policy
+     * object without the field allows nothing but those carve-backs and the device files (fail closed).
+     */
+    writeAllow?: PolicyPath[];
+    /**
+     * re-denied AFTER allowWrite so the carve-back reopens nothing else: each allowWrite root itself (literal — it can
+     * be neither removed, renamed nor replaced; Aegis M1), the denyWrite entries inside it, and the steering regexes
+     * re-rooted at it (Aegis L3)
+     */
+    denyWriteAlways: PolicyPath[];
+    /** why the transcript carve-back was withheld (fail closed: no allow), when `claudeTranscripts` asked for it */
+    allowWriteRefused?: string;
+    /** why the session-env carve-back was withheld (fail closed: no allow), when `claudeSessionEnv` asked for it */
+    sessionEnvRefused?: string;
+    /** outbound loopback connects refused to these ports (the web endpoint) */
+    denyLoopbackPorts: number[];
+    /** process-info on every process but self (process-info*, sysctl process lists, the sysmond lookup on macOS) */
+    processInfo: 'deny-others';
+    /** launcher escapes (open/osascript/lsregister on macOS; job limits on Windows) — realised by M1.7 */
+    launchers: 'deny';
+    /** platform-neutral deny classes (SESSION_DENY_CLASSES); mapped per platform in src/platform/session-denies.ts */
+    denyClasses: SessionDenyClass[];
+    /** the M1.7 step that turns this data into a platform profile */
+    realisedBy: 'M1.7';
+}
+interface SessionPolicyInput {
+    home: string;
+    cwd: string;
+    worktree?: string;
+    userClaudeDir: string;
+    managedSettingsPaths: readonly string[];
+    linkedFolders: readonly string[];
+    /** the web endpoint port, or null when the endpoint is not listening */
+    endpointPort: number | null;
+    /** platform-specific browser profile + wrapper WebView data dirs (S29-K7) */
+    browserProfileDirs?: readonly string[];
+    /** `~/.claude.json` (default: beside userClaudeDir) */
+    userClaudeJson?: string;
+    /**
+     * M1.7 (Aegis M2): the user's home — its persistence paths are write-denied
+     * (PERSISTENCE_PATHS: LaunchAgents, shell rc files, git config, ~/.ssh).
+     */
+    userHome?: string;
+    /**
+     * M1.7 (Aegis H1): extra write denies the supervisor computes, ALREADY
+     * resolved (a symlink's own path must stay literal: the claude binary's
+     * known-location links, its realpath and its versions dir).
+     */
+    extraDenyWrite?: readonly PolicyPath[];
+    /**
+     * M1.8 slice 2 round 3 (Aegis H1, node half): the root-signed local runner. EVERY session profile — Claude
+     * and local alike — denies writes to its node binary, node's install prefix (bin/ + lib/libnode) and the
+     * pinned runner source dir, so no running session can swap what the next local session execs.
+     */
+    localRunner?: {
+        node: string;
+        dir: string;
+    };
+    /**
+     * M1.7 slice 2 (T-2026-10-18-010): what the session may READ inside the
+     * read-denied Gnomon home. Each entry must sit strictly inside one of
+     * HOME_READABLE_ROOTS (`sessions/<short>/…`, `bin/<file>`,
+     * `runners/<tree>/…`); anything else refuses the policy (fail closed).
+     */
+    homeReadable?: ReadonlyArray<{
+        path: string;
+        match: 'literal' | 'subpath';
+    }>;
+    /**
+     * P8-D97 (Aegis M1): the memory chain (the cwd and its ancestors up to the git top-level). Each dir's `CLAUDE*`
+     * (prefix) and `.claude/**` join the settings write denies, so a session cannot plant steering that a later
+     * session loads (`--add-dir` memory, or an ancestor's `.claude`).
+     */
+    memoryDirs?: readonly string[];
+    /**
+     * P8-D97 (Aegis R1): the memory subtree root (the git top-level, else the cwd). Every `CLAUDE*.md` and `.claude/**`
+     * below it, in any case, joins the settings write denies (`steering` match: an SBPL regex), because Claude Code
+     * loads a subdirectory's CLAUDE.md lazily.
+     */
+    memorySubtree?: string;
+    /**
+     * P8-D97 (Aegis F3): every in-repo `@` import target the memory audit resolved, existing or not. Each is a
+     * settings-class write-deny literal, so a session cannot plant or rewrite what an approved memory file imports.
+     */
+    memoryImports?: readonly string[];
+    /**
+     * TD-2026-10-19-814 item 1: a Claude Code session — carve `<userClaudeDir>/projects` (its transcripts) back out of
+     * the `~/.claude` write deny. A flag, not a path: the carve-back is derived here and nowhere else, so nothing a
+     * project supplies can widen it to another `~/.claude` path. Withheld (allowWriteRefused) when its realpath is not
+     * exactly `realpath(userClaudeDir)/projects` or another write deny covers it.
+     */
+    claudeTranscripts?: boolean;
+    /**
+     * T-2026-10-21 (hooks fix; Aegis H1/M1 rework): the backend session uuid (`--session-id` / `--resume`) of a Claude
+     * Code session — carve ONLY `<userClaudeDir>/session-env/<uuid>` back out of the `~/.claude` write deny. Claude Code
+     * creates `session-env/<session-id>/` before it runs ANY command hook; with it denied, every hook fails with
+     * `EPERM mkdir`. Not a path: a uuid, checked against a strict lowercase RFC 4122 shape, so it can never name
+     * `..`, a separator or a sibling. Writing another session's dir would let this session plant that session's
+     * CLAUDE_ENV_FILE, which Claude Code sources as shell before its Bash commands (the user's unsandboxed Claude Code
+     * included) — so siblings stay denied. `session-env` and `session-env/<uuid>` are both literal re-denied (neither
+     * can be removed, renamed or swapped for a link). Withheld (sessionEnvRefused) on a malformed uuid, when the dir's
+     * realpath is not exactly `realpath(userClaudeDir)/session-env/<uuid>`, or another write deny covers it.
+     */
+    claudeSessionEnv?: string;
+    /**
+     * #git-verbs (T-2026-10-23-002): the session may work in kernel-made worktrees under `<root>/.gnomon/worktrees/<name>`
+     * (git.worktree.add runs outside the sandbox). Ordinary files there stay writable (they are under the root); what
+     * steers Claude or git there is write-denied: `<root>/.gnomon` and W as literals (never renamed or removed), each
+     * worktree's own entry, `.git` pointer and `.mcp.json` (worktree-guard), every CLAUDE*.md and `.claude/**` below W
+     * (steering), and each worktree git dir's entry, commondir, gitdir and config.worktree (worktree-gitdir). The common
+     * dir's hooks, config and info stay denied as for any root.
+     */
+    kernelWorktrees?: boolean;
+    /** T-2026-10-23-004 / Aegis round 2 M1: the session's TMPDIR — only its own realpath is writable (a Gnomon-made dir for a Claude session) */
+    tmpdir?: string;
+    /** Aegis round 2 H: the session's Gnomon-made tool cache dir (SESSION_CACHE_ENV); writable */
+    sessionCache?: string;
+    /**
+     * Aegis round 3 M (measured, probe p10m-write-allow): Claude Code writes its task outputs under
+     * /private/tmp/claude-<uid>/<encoded cwd>/<session uuid>/, a tree the human's own unsandboxed Claude Code shares. The
+     * whole /private/tmp/claude-<uid> is write-denied and only this session's subtree is carved back (literal re-denied,
+     * so it is never removed or swapped); the supervisor makes its parents first. Absent ⇒ the whole tree stays denied.
+     */
+    claudeTmp?: {
+        uid: number;
+        uuid: string;
+        cwds: readonly string[];
+    };
+    /** TEST RIG ONLY (the supervisor passes it only with allowScripts): the fake claude's own dir, where it writes its trace */
+    testWriteAllow?: readonly string[];
+}
+/**
+ * T-2026-10-23-004: the tool caches under the user home a session may write (deny-by-default writes). MEASURED, not
+ * guessed: what Claude Code and an `npm install` in a root wrote under the profile (test/session-sandbox.test.ts,
+ * probes/p10m-write-allow). Anything else under the home stays denied; add one only when measured, narrowly.
+ */
+declare const WRITE_CACHE_PATHS: readonly string[];
+/**
+ * Aegis round 2 H (T-2026-10-23-004): a session never writes the human's own tool caches (~/.npm/_npx is run unsandboxed
+ * by the human's npx). Each session gets a Gnomon-made cache per repo (SESSION_CACHE_ENV points the tools at it,
+ * `sessionCache` is its write allow) and a Gnomon-made 0700 TMPDIR (`tmpdir`), both made by the supervisor.
+ */
+declare const SESSION_CACHE_ENV: Readonly<Record<string, string>>;
+/** Aegis round 2 M6: credential stores a session can neither read nor write (subpath / literal / prefix, under the user home). */
+declare const CREDENTIAL_READ_DENY: ReadonlyArray<{
+    rel: string;
+    match: PathMatch;
+}>;
+/** T-2026-10-23-004: the shared temp dirs every session may write. */
+declare const WRITE_TEMP_PATHS: readonly string[];
+/** Aegis round 2 M1: the TMPDIR a session may write is exactly its realpath (never the per-user /private/var/folders parent). */
+declare function userTempRoot(tmpdir: string): string;
+/** The one write carve-back (TD-2026-10-19-814): Claude Code's transcript dir, relative to the user Claude dir. */
+declare const CLAUDE_TRANSCRIPTS_REL = "projects";
+/** The second write carve-back: Claude Code's per-session hook environment dir, relative to the user Claude dir. */
+declare const CLAUDE_SESSION_ENV_REL = "session-env";
+/** The only session id shape the session-env carve-back accepts (lowercase RFC 4122, as `randomUUID()` mints). */
+declare const SESSION_UUID_RE: RegExp;
+/** The only top-level home entries a session may be granted a read under (one level below them, never the root itself). */
+declare const HOME_READABLE_ROOTS: readonly string[];
+/** The kernel log files inside the home (spec §3.2; kernel-log.ts ACTIVE_DB + SEGMENTS_DIR): read-denied by name too. */
+declare const KERNEL_LOG_PATHS: ReadonlyArray<{
+    rel: string;
+    match: PathMatch;
+}>;
+/** The write denies for the local runner's node install and source dir (realpath'd; a prefix that is /, the user home or above it narrows to node's own dir). */
+declare function localRunnerDenies(r: {
+    node: string;
+    dir: string;
+}, userHome?: string): PolicyPath[];
+/** Aegis M2: user persistence paths a session may not write (relative to the user's home). */
+declare const PERSISTENCE_PATHS: ReadonlyArray<{
+    rel: string;
+    match: PathMatch;
+}>;
+/** Realpath the longest existing prefix of `p` and append the rest. */
+declare function realpathLoose(p: string): string;
+/** A path whose symlinks cannot be followed to an answer (a loop, too many hops, a component that cannot be lstat'd). */
+declare class UnresolvablePath extends Error {
+}
+/**
+ * Aegis H1 (run modes): the path a WRITE to `p` actually lands on. Unlike realpathLoose, a DANGLING symlink is
+ * followed (readlink, textually, as the OS does when it creates the target), so `scripts/x -> ../.git/hooks/pre-commit`
+ * resolves to the hook, not to `scripts/x`. Components past the first missing one are appended as text. Throws
+ * UnresolvablePath on a loop (more than 40 hops) or on an lstat/readlink failure other than ENOENT/ENOTDIR — the
+ * caller treats that as denied/carded, never as a plain name.
+ */
+declare function realpathFollow(p: string): string;
+declare function buildSessionPolicy(inp: SessionPolicyInput): SessionPolicy;
+declare function policyHash(p: SessionPolicy): string;
+/**
+ * P8-D96 (Aegis C2, probe p01b (h)): every tool that writes, runs or fetches is ALWAYS asked. An `allow` rule in
+ * any loaded settings layer would otherwise run it with no can_use_tool request (no card); `ask` wins over `allow`,
+ * so the request reaches the kernel and the card stays the gate. `deny` still wins over `ask`.
+ */
+declare const ALWAYS_ASK_TOOLS: readonly string[];
+/** The `policy.json` permissions block: the sandbox deny mirror (§6.1 step 6) and the always-ask tools (P8-D96). */
+/**
+ * F7 (TD-2026-10-20-086): settings env for every Claude session. CLAUDE_BASH_MAINTAIN_PROJECT_WORKING_DIR=1 makes
+ * Claude Code return to the project dir after each Bash command, so its idea of the cwd matches the anchored
+ * read-only pass (#shell-readonly K1, which stays the proof: it cds into the root itself).
+ */
+declare const CLAUDE_SESSION_ENV: Readonly<Record<string, string>>;
+declare function claudePermissions(p: SessionPolicy, platform?: string): {
+    permissions: {
+        deny: string[];
+        ask: string[];
+    };
+    env: Record<string, string>;
+};
+
+/**
+ * @symbol #claude-adapter
+ * @symbol #session-runner
+ *
+ * Platform registry for Claude Code (spec §3.3 Preflight, §3.4 "Law 7 inside
+ * the broker", §16 "Claude Code preflight paths"; p01). DATA ONLY: kernel code
+ * looks a row up by platform key and never branches on the platform itself
+ * (G-WIN-05).
+ *
+ *   knownBinaries — where the `claude` binary is looked for when the
+ *     root-signed config names none. NEVER a `PATH` lookup (p01: the native
+ *     installer's ~/.local/bin is not on a non-login PATH, and the daemon's
+ *     clean env has no shell profile). `~` = the user's home.
+ *   managedSettings — the managed-policy sources the CLI always loads (not
+ *     controllable by --setting-sources, p01) and the law-7 scan must read.
+ *     A source that is not JSON (a managed-preferences plist, a registry key)
+ *     is scanned fail-closed: present but unreadable as JSON ⇒ a hit (B5).
+ *   managedUnscannable — sources the kernel cannot read at all on that
+ *     platform yet (Windows HKLM/HKCU policy keys need the helper, parity
+ *     phase P8-D78): reported in status, never silently skipped.
+ *   minVersion — `claudeCli.ts:13` floor (2.1.288).
+ */
+type ClaudePlatform = 'darwin' | 'win32' | 'linux';
+interface ClaudeCodePlatformRow {
+    knownBinaries: readonly string[];
+    /** `~` = the user's home. Globs are not expanded: a `*.json` directory source is listed via managedSettingsDirs. */
+    managedSettings: readonly string[];
+    /** Directories whose `*.json` files are managed sources. */
+    managedSettingsDirs: readonly string[];
+    managedUnscannable: readonly string[];
+    /** The user's Claude dir relative to home. */
+    userClaudeDir: string;
+}
+declare const CLAUDE_CODE_PLATFORMS: Readonly<Record<ClaudePlatform, ClaudeCodePlatformRow>>;
+
+interface DarwinSessionExtras {
+    uid: number;
+    /** the daemon's TMPDIR (screen's socket dir lives under it) */
+    tmpdir: string;
+    home: string;
+    /** cwd + worktree: their git pointer files / config.worktree / modules are denied */
+    roots: readonly string[];
+    /** Aegis round 3 H: the ssh-agent sockets the daemon's env names (SSH_AUTH_SOCK), denied by path beside the known ones */
+    agentSockets?: readonly string[];
+}
+
+type MacosProbe = () => number | null;
+/** true = enabled; false = disabled or partially disabled; null = unknown (fail closed) */
+type SipProbe = () => boolean | null;
+
+interface SessionLaunchInput {
+    policy: SessionPolicy;
+    /** realpath of the driver binary (claude) */
+    binaryReal: string;
+    argv: string[];
+    extras: DarwinSessionExtras;
+    /** the session's hsid (win32: its own restricting SID, sessionSidFor) */
+    hsid?: string;
+}
+interface SessionLaunchPlan {
+    command: string;
+    args: string[];
+    sandbox: 'full' | 'partial';
+    profile: string;
+    profileHash: string;
+    /** what this launch could not deny (Aegis M1, PR #52): logged on the session.sandbox row, never dropped */
+    partial?: readonly string[];
+}
+interface FloorResult {
+    ok: boolean;
+    /** which floor failed: the macOS major, or System Integrity Protection */
+    floor?: 'macos' | 'sip';
+    have: number | string | null;
+    need: number | string;
+}
+/**
+ * The darwin floor (platform data): below SESSION_SANDBOX_MIN_MACOS, or with
+ * SIP disabled / partially disabled / unknown, the backend refuses — never a
+ * weaker profile. macOS is checked first. `probe`/`sip` are test seams.
+ */
+declare function darwinFloor(probe?: MacosProbe, sip?: SipProbe): FloorResult;
+/** Aegis round 2 M6: what the darwin session profile does not deny yet (the egress proxy is 8.1, spec §6.6). */
+declare const NETWORK_EGRESS_PARTIAL = "network:egress open (outbound connections are not limited to localhost; only the Gnomon endpoint port is denied; the egress proxy is 8.1)";
+/** Aegis round 3 H: what the profile cannot stop — a gh token stored in the login keychain is readable with `security`. */
+declare const KEYCHAIN_TOKEN_PARTIAL = "credentials:keychain a gh token in the login keychain is readable with security find-generic-password -s gh:github.com (security is not denied); use gh auth login --insecure-storage (its file is read-denied)";
+/** Platform registry of session sandbox backends (G-WIN-05). */
+declare const SESSION_SANDBOX_BACKENDS: Readonly<Partial<Record<string, (i: SessionLaunchInput, probe?: MacosProbe, sip?: SipProbe) => SessionLaunchPlan>>>;
+/** `probe` reads the OS version and `sip` System Integrity Protection (platform code); tests pass fixed ones to exercise the floor refusals. */
+declare function sessionLaunchPlan(i: SessionLaunchInput, platform?: string, probe?: MacosProbe, sip?: SipProbe): SessionLaunchPlan;
+/** status: the session profile's fidelity on `platform` — full only with a backend and every class full (G-WIN-06). */
+declare function sessionSandboxFidelity(platform?: string, probe?: MacosProbe, sip?: SipProbe): {
+    fidelity: 'full' | 'partial' | 'none' | 'unavailable';
+    classes: Record<string, string>;
+    reason?: string;
+    have?: number | string | null;
+    need?: number | string;
+};
+
+type session_FloorResult = FloorResult;
+declare const session_KEYCHAIN_TOKEN_PARTIAL: typeof KEYCHAIN_TOKEN_PARTIAL;
+declare const session_NETWORK_EGRESS_PARTIAL: typeof NETWORK_EGRESS_PARTIAL;
+declare const session_SESSION_SANDBOX_BACKENDS: typeof SESSION_SANDBOX_BACKENDS;
+type session_SessionLaunchInput = SessionLaunchInput;
+type session_SessionLaunchPlan = SessionLaunchPlan;
+declare const session_darwinFloor: typeof darwinFloor;
+declare const session_sessionLaunchPlan: typeof sessionLaunchPlan;
+declare const session_sessionSandboxFidelity: typeof sessionSandboxFidelity;
+declare namespace session {
+  export { session_KEYCHAIN_TOKEN_PARTIAL as KEYCHAIN_TOKEN_PARTIAL, session_NETWORK_EGRESS_PARTIAL as NETWORK_EGRESS_PARTIAL, session_SESSION_SANDBOX_BACKENDS as SESSION_SANDBOX_BACKENDS, session_darwinFloor as darwinFloor, session_sessionLaunchPlan as sessionLaunchPlan, session_sessionSandboxFidelity as sessionSandboxFidelity };
+  export type { session_FloorResult as FloorResult, session_SessionLaunchInput as SessionLaunchInput, session_SessionLaunchPlan as SessionLaunchPlan };
+}
+
+declare const LAYERS_HASH_SCHEMA: "gnomon-layers:v1";
+declare const GIT_HASH_SCHEMA: "gnomon-git-layers:v1";
+interface HashInput {
+    /** `<scope>:<path>`; normalised by normalizeLayerKey. */
+    key: string;
+    /** null = absent. */
+    bytes: Uint8Array | null;
+    /** The absolute path read (not hashed; lets the policy test prove every layer is write-denied). */
+    abs?: string;
+}
+/** CRLF → LF (A23-4). */
+declare function normalizeContent(b: Uint8Array): Uint8Array;
+/** Posix separators, no `./`, NFC, case-folded. */
+declare function normalizeLayerKey(key: string): string;
+declare function digestInputs(schema: string, inputs: readonly HashInput[]): string;
+interface LayersInput {
+    /** The session cwd (project layer). */
+    cwd: string;
+    /** The session worktree, when it differs from cwd. */
+    worktree?: string;
+    /** The user's `~/.claude` (platform-resolved by the caller). */
+    userClaudeDir: string;
+    /** Managed settings files (platform-specific paths, from the caller / root-signed config). */
+    managedPaths: readonly string[];
+    /** `~/.claude.json` (default: beside userClaudeDir). */
+    userClaudeJson?: string;
+    /** M1.7: leave ~/.claude.json out (the mid-session watch hashes only its law-7 projection). */
+    excludeClaudeJson?: boolean;
+}
+declare function defaultClaudeJson(userClaudeDir: string): string;
+/** The inputs of `layersHash` (exposed for tests and for `session.layers.changed{which}`). */
+declare function collectLayerInputs(inp: LayersInput): HashInput[];
+declare function layersHash(inp: LayersInput): string;
+/** Resolve `<repo>/.git` to {gitDir, commonDir}; a `.git` file (`gitdir: …`) is followed. */
+declare function resolveGitDirs(repo: string): {
+    gitDir: string;
+    commonDir: string;
+} | null;
+declare function collectGitInputs(repo: string): HashInput[];
+declare function gitHash(repo: string): string;
+declare function gateClassPathRule(relPath: string): string | null;
+/** A gate-class file a loop check may read (the loop config closure): never a directory rule, a memory file or an alias. */
+declare function isClosureName(name: string): boolean;
+/** TD-2026-10-23-268 (Aegis L1): a loop env file may not be named like a config tools run (a `.env*` dotenv is fine). */
+declare function isConfigNamedEnvFile(name: string): boolean;
+
+declare const BUNDLED_RUNNER_DIR = "gnomon-local";
+declare const BUNDLED_RUNNER_ENTRY = "cli.js";
+/** The tree hash this build compiled for its bundled runner, or null (no bundled runner in this build). */
+declare function compiledLocalRunnerPin(): string | null;
+type DefaultRunner = {
+    ok: true;
+    dir: string;
+    source: 'bundled';
+    treeSha256: string;
+} | {
+    ok: true;
+    dir: string;
+    source: 'clone';
+    treeSha256: null;
+} | {
+    ok: false;
+    why: string;
+};
+/**
+ * The default runner dir. `from` is the directory of the running kernel module (dist/ or dist/cli/ in a build,
+ * src/kernel/local in tests); `pin` defaults to the compiled one.
+ */
+declare function defaultLocalRunner(from?: string, pin?: string | null): DefaultRunner;
+/**
+ * The gnomon-local version of a runner dir, for the card and status.local: the compiled one when `tree` is this
+ * build's bundled pin; else the `@a-company/gnomon-local` package.json one level up (a clone's dist); else null.
+ */
+declare function runnerVersionOf(dir: string, tree: string | null): string | null;
+/** The pinned node's version when it is the kernel's own node (the bundled one in the app), else null (never exec'd to ask). */
+declare function nodeVersionOf(node: string): string | null;
+
+declare const bundledRunner_BUNDLED_RUNNER_DIR: typeof BUNDLED_RUNNER_DIR;
+declare const bundledRunner_BUNDLED_RUNNER_ENTRY: typeof BUNDLED_RUNNER_ENTRY;
+type bundledRunner_DefaultRunner = DefaultRunner;
+declare const bundledRunner_compiledLocalRunnerPin: typeof compiledLocalRunnerPin;
+declare const bundledRunner_defaultLocalRunner: typeof defaultLocalRunner;
+declare const bundledRunner_nodeVersionOf: typeof nodeVersionOf;
+declare const bundledRunner_runnerVersionOf: typeof runnerVersionOf;
+declare namespace bundledRunner {
+  export { bundledRunner_BUNDLED_RUNNER_DIR as BUNDLED_RUNNER_DIR, bundledRunner_BUNDLED_RUNNER_ENTRY as BUNDLED_RUNNER_ENTRY, bundledRunner_compiledLocalRunnerPin as compiledLocalRunnerPin, bundledRunner_defaultLocalRunner as defaultLocalRunner, bundledRunner_nodeVersionOf as nodeVersionOf, bundledRunner_runnerVersionOf as runnerVersionOf };
+  export type { bundledRunner_DefaultRunner as DefaultRunner };
+}
+
+/** Aegis H1: every path a session could use to swap the binary the kernel runs next — write-denied. */
+declare function binaryDenies(row: ClaudeCodePlatformRow, userHome: string, sourceReal: string, explicit?: string): PolicyPath[];
+
+declare const GENESIS_PREFIX: "gnomon-log-genesis:";
+/** `sha256:<hex>` of a UTF-8 string (node:crypto; same digest as contracts' sha256Tagged). */
+declare function sha256TaggedFast(text: string): string;
+/** prev of seq 1. `logId` is the full `log:<ULID>` id, as in `envelope.log`. */
+declare function genesisPrev(logId: string): string;
+/** The text that is hashed (and stored in `chain.envelope`): canonical(envelope minus hash, sig). */
+declare function hashPreimage(envelope: Record<string, unknown>): string;
+/** Namespaces whose events MUST carry a signature (§3.2, verbatim list). */
+declare const SIG_MANDATORY_NAMESPACES: readonly ["approval", "budget", "permit", "key", "manifest", "config", "billing", "verdict"];
+/**
+ * Single kinds whose events MUST carry a signature (§3.2), plus the
+ * integrity rows of the log itself (research 33 S34-06, P8-D83): a stripped
+ * signature on a gap / segment / lag / anchor-failure / socket-theft row would
+ * otherwise pass verify as a "diagnostic".
+ */
+declare const SIG_MANDATORY_KINDS: readonly ["oracle.result", "daemon.log.gap", "daemon.log.quarantined", "daemon.segment", "daemon.anchor.lag", "daemon.anchor.failed", "socket.auth.theft"];
+/** Diagnostics that MAY be unsigned (§3.2): the ONLY unsigned rows the log accepts. */
+declare const DIAGNOSTIC_NAMESPACES: readonly ["daemon", "socket", "schedule"];
+declare function isSigMandatory(kind: string): boolean;
+declare function isDiagnostic(kind: string): boolean;
+/**
+ * May this kind be appended unsigned? Only diagnostics. §3.2 also says
+ * "kernel-appended events are signed by the kernel key" and "every event
+ * appended by a keyed principal" is signed, so outside the three diagnostic
+ * namespaces an unsigned row is refused at append and fails verify — a
+ * superset of the mandatory list (G-LOG-08 tests the mandatory list). The
+ * sig-mandatory diagnostic kinds (daemon.log.gap etc., S34-06) are excluded.
+ */
+declare function mayBeUnsigned(kind: string): boolean;
+/**
+ * The labels an append gets: the kind's §9.1 default, optionally TIGHTENED by
+ * the appending component. Relaxing (a lower sensitivity, a wider audience)
+ * is refused; an unregistered kind is refused — never guessed (`G-LOG-09`).
+ */
+declare function resolveLabels(kind: string, requested?: {
+    audience?: Audience;
+    sensitivity?: Sensitivity;
+}): EventLabels;
+/** L7: a kernel appender never writes a userland kind, and vice versa. */
+declare function assertOwner(kind: string, as: KindOwner): void;
+type LogRefusalReason = 'unregistered-kind' | 'label-relaxed' | 'kind-owner' | 'unsigned-mandatory' | 'unsigned-kind' | 'bad-envelope' | 'bad-payload' | 'missing-db' | 'anchor-missing' | 'anchor-mismatch' | 'anchor-lag' | 'anchor-failed' | 'truncated' | 'tip-moved' | 'segment-broken' | 'reader-unsupported' | 'reserved-kind' | 'closed' | 'no-gap' | 'presence-required' | 'tamper' | 'unauthenticated-lead' | 'anchor-faulted' | 'rotation-failed' | 'kernel-key-required' | 'not-genesis' | 'not-a-home' | 'nothing-to-quarantine' | 'daemon-running' | 'quarantine-pending' | 'home-busy' | 'install-busy' | 'no-space' | 'not-interactive' | 'not-confirmed';
+/** A refusal:v1 thrown by the log; `reason` is also in `refusal.data.reason`. */
+declare class LogRefusal extends RefusedError {
+    readonly reason: LogRefusalReason;
+    constructor(code: RefusalCode, reason: LogRefusalReason, message: string, data?: Record<string, unknown>);
+}
+declare function logRefusal(code: RefusalCode, reason: LogRefusalReason, message: string, data?: Record<string, unknown>): LogRefusal;
+
+declare const HEAD_SCHEMA: "gnomonHead:v1";
+interface HeadAnchor {
+    schemaVersion: typeof HEAD_SCHEMA;
+    log: string;
+    segment: number;
+    /** 0 = genesis, no row yet; `hash` is then the genesis prev. */
+    seq: number;
+    hash: string;
+    at: string;
+    /** Written only by a clean close (S33-07 clean-close marker); cleared durably on the next open. */
+    closed?: true;
+    /** S33-10: boot session the anchor was written in (`kern.bootsessionuuid` / `boot_id` / `unknown`). Absent on pre-D83 anchors. */
+    boot?: string;
+}
+type AnchorReadResult = {
+    state: 'present';
+    head: HeadAnchor;
+} | {
+    state: 'absent';
+} | {
+    state: 'unavailable';
+    why: string;
+} | {
+    state: 'malformed';
+    why: string;
+};
+interface AnchorStore {
+    readonly name: 'file' | 'keystore';
+    read(): AnchorReadResult;
+    /** `durable` = fsync before returning (genesis, rotation, close). May be async (helper IPC, P04). */
+    write(head: HeadAnchor, durable: boolean): void | Promise<void>;
+}
+declare class FileAnchorStore implements AnchorStore {
+    readonly name: "file";
+    readonly path: string;
+    constructor(home: string);
+    read(): AnchorReadResult;
+    write(head: HeadAnchor, durable: boolean): void;
+}
+/**
+ * The helper-backed keystore anchor (`gnomon-head`). SEAM ONLY in PR-4: the
+ * signed helper that owns the Keychain / Credential Manager item does not
+ * exist yet, so reads report `unavailable` and writes are no-ops. Never
+ * falls back to a second file — a second file in the same home would add no
+ * protection against a same-user rewrite (§3.2 scope statement).
+ */
+declare class KeystoreAnchorStore implements AnchorStore {
+    readonly name: "keystore";
+    read(): AnchorReadResult;
+    write(): void;
+}
+/** fsync a file by path (Windows: an 'r+' handle, which FlushFileBuffers requires). */
+declare function fsyncFile(file: string): void;
+/** True for an error that only says the directory fsync is unsupported (S34-28). */
+declare function isBenignDirFsyncError(err: unknown): boolean;
+/**
+ * fsync a directory so a rename inside it is durable. Skipped on win32 (see
+ * the seam note above). On POSIX an unsupported directory fsync is a no-op
+ * (isBenignDirFsyncError); every other error — EIO above all — is rethrown.
+ */
+declare function fsyncDir(dir: string): void;
+
+/**
+ * @symbol #kernel-log
+ *
+ * #kernel-log (spec §3.2; research 33 S33-05..S33-07, S33-10; P8-D82, P8-D83) — the head-anchor
+ * WRITE POLICY: when the file anchor and the keystore anchor are written, which
+ * kinds force both anchors before `append` resolves, and the lag bounds that
+ * open() enforces. Pure constants and predicates; kernel-log.ts applies them.
+ *
+ * Measured basis (probes/p-log-fsync, research 33 table): a tmp+rename after
+ * every commit (arm B) leaves dirty APFS metadata that the next WAL fsync must
+ * flush — 0.94 % of appends over 5 ms. Coalescing to 1 rename per 64 rows
+ * (arm D) or per 50 ms (arm E) is indistinguishable from raw SQLite (arm A).
+ *
+ * Off-by-one, stated: the commit and the anchor write are not atomic, so a
+ * crash right after the commit that triggers an anchor leaves lag = trigger.
+ * The spec's open bound is "lag > 63 ⇒ INTEGRITY_BROKEN", so the in-path
+ * trigger fires when the un-anchored row count REACHES 63 (rename rate 1/63,
+ * ≈ arm D's 1/64). Same for the keystore: trigger at 1023, bound 1023.
+ */
+/** S33-07: open refuses INTEGRITY_BROKEN{anchor-lag} when the file anchor lags by more than this. */
+declare const FILE_ANCHOR_MAX_LAG = 63;
+/** S33-05: file anchor written within this many ms of the first un-anchored row (unref'd timer). */
+declare const FILE_ANCHOR_MAX_MS = 50;
+/** S33-07: keystore lag above this on open ⇒ a kernel-signed `daemon.anchor.lag{rows, which}`. */
+declare const KEYSTORE_ANCHOR_MAX_LAG = 1023;
+/** S33-05: keystore anchor written (async, off the append path) within this many ms. Provisional until P04. */
+declare const KEYSTORE_ANCHOR_MAX_MS = 1000;
+/** S33-06 telemetry: forcedAnchorRate is computed over this many most recent rows. */
+declare const FORCED_ANCHOR_WINDOW = 10000;
+/** S33-06: above this forced-anchor rate the bulk p99 is outside the measured envelope (arm D). */
+declare const FORCED_ANCHOR_ENVELOPE: number;
+/**
+ * S33-06 — the CRITICAL kinds (research 33, "The list"). A critical append
+ * commits (bulk durability — no F_FULLFSYNC since S33-10 / P8-D83), renames
+ * the file anchor in and awaits the keystore anchor, in that order, and only
+ * then resolves; no effect of the event may be released before the promise
+ * resolves. That is an ordering guarantee against a same-user process, not a
+ * power-loss guarantee (an anchor ahead of the db after a power loss is
+ * classified on open, kernel-log.ts).
+ *
+ * Deviations from the spec list, stated:
+ *   - `manifest.*` "(decisions)": the whole manifest namespace is treated as
+ *     critical (conservative; every manifest kind is a human-speed event).
+ *   - `grant.*`: no `grant` namespace is registered in contracts yet
+ *     (permit.grant / request.grant are other namespaces); the prefix is kept
+ *     so a future `grant.*` kind is critical on registration.
+ *   - `link.*` (pair/renew/revoke) maps to the registered kinds
+ *     link.pair.offered, link.paired, link.renewed, link.revoked.
+ *   - `approval.rule.revoked` (P8-D98, Aegis M1) is added beside
+ *     `approval.rule.learned`: a lost revoke silently widens permission
+ *     (the rule comes back), so it is anchored like the learn it undoes.
+ *   - `approval.rule.disabled` (8.0:rules-view) likewise: a lost "off" silently
+ *     turns the rule back on. (`approval.rule.enabled` is not critical: a lost
+ *     one leaves the rule off, the narrow side.)
+ */
+declare const CRITICAL_ANCHOR_KINDS: Readonly<{
+    ref: "research 33 S33-06 (P8-D82)";
+    kinds: readonly ["approval.decide", "approval.suspect", "approval.presence.denied", "approval.rule.learned", "approval.rule.revoked", "approval.rule.disabled", "approval.voice.arm", "approval.voice.disarm", "link.pair.offered", "link.paired", "link.renewed", "link.revoked", "socket.auth.theft"];
+    namespaces: readonly ["key", "grant", "config", "manifest", "billing", "verdict"];
+    /** Kinds critical only for some payloads: session.inject{origin:'peer'} (L2 for peer bytes). */
+    byPayload: Readonly<{
+        'session.inject': Readonly<{
+            field: "origin";
+            equals: "peer";
+        }>;
+    }>;
+}>;
+/** Is this (kind, payload) a S33-06 critical append? */
+declare function isCriticalKind(kind: string, payload?: unknown): boolean;
+
+declare const BOOT_UNKNOWN: "unknown";
+/** Validate a raw boot id: trimmed UUID, else `unknown`. */
+declare function normalizeBootId(raw: string): string;
+/**
+ * The current boot session id (`kern.bootsessionuuid` / `boot_id`), or
+ * `unknown`. A real id is cached per process; `unknown` is NOT cached (a
+ * transient sysctl failure is retried on the next open; the log emits an
+ * onDiagnostic `boot.unknown`).
+ */
+declare function readBootSession(): string;
+
+type ReaderClass = {
+    class: 'human';
+} | {
+    class: 'read-token';
+} | {
+    class: 'community-client';
+} | {
+    class: 'session';
+    hsid: string;
+} | {
+    class: 'mod';
+    name: string;
+    grantedKinds?: readonly string[];
+} | {
+    class: 'peer';
+} | {
+    class: 'agent';
+} | {
+    class: 'voice';
+    hsid?: string | null;
+};
+/** `{kind, hsid, at, hash}` — what a redacting reader gets for a sensitive-column row (§9.3). */
+interface LogStub {
+    kind: string;
+    hsid?: string;
+    at: string;
+    /** Present only in a full-class reader's stub (never for limited views). */
+    hash?: string;
+}
+/** A projected event: limited views omit hash, sig, prev, idem and refHash. */
+type ProjectedEvent = Omit<EventV1, 'hash' | 'sig' | 'prev' | 'idem' | 'refHash'> & Partial<Pick<EventV1, 'hash' | 'sig' | 'prev' | 'idem' | 'refHash'>>;
+type LogView = {
+    seq: number;
+    view: 'full';
+    event: ProjectedEvent;
+} | {
+    seq: number;
+    view: 'stub';
+    stub: LogStub;
+};
+interface RedactedField {
+    redacted: true;
+}
+/** Projection counter (tests: per-commit fan-out must not project). */
+declare const projectionStats: {
+    calls: number;
+};
+/** The strictest of the registered default, the envelope label and the stored column label (never widens). */
+declare function effectiveSensitivity(e: Pick<EventV1, 'kind' | 'sensitivity'>, storedLabel?: string): Sensitivity;
+declare const SESSION_NEVER_FIELDS: ReadonlyArray<{
+    kind: (k: string) => boolean;
+    field: string;
+    when?: (p: Record<string, unknown>) => boolean;
+}>;
+/**
+ * Could `reader` see this row at all? Metadata only (kind, labels, session) —
+ * no projection, no copy, no hash: the subscription fan-out on the commit path
+ * uses it to decide whether to wake a pump. Over-approximates nothing that
+ * projectForReader would show; it may say yes for rows a scope filter drops.
+ */
+declare function mayBeVisible(e: Pick<EventV1, 'kind' | 'sensitivity' | 'session'>, reader: ReaderClass): boolean;
+/**
+ * Project one row for one reader. `undefined` = the reader does not see the
+ * row at all. A projected (field-redacted) event no longer hashes to its
+ * `hash`; it is a view, the chain row is untouched.
+ */
+declare function projectForReader(e: EventV1, reader: ReaderClass, storedLabel?: string): LogView | undefined;
+
+declare const DEFAULT_SEGMENT_ROWS = 1000000;
+declare const SEGMENT_SCHEMA: "gnomonLogSegment:v1";
+declare const ACTIVE_DB = "kernel.db";
+declare const SEGMENTS_DIR: string;
+type Durability = 'process-crash' | 'power-loss';
+interface KernelLogOptions {
+    /** The Gnomon home (`~/.gnomon`), already created 0700 by $daemon-lifecycle. */
+    home: string;
+    /** The kernel principal `p:<ns>/kernel` — appender of daemon.segment rows. */
+    kernelPrincipal: string;
+    /** The kernel key. `null` = no key loaded: only diagnostics can be appended. */
+    signer: Signer | null;
+    /** Public keys for verify; the signer's own key is added automatically. */
+    keyRing?: KeyRing;
+    segmentRows?: number;
+    durability?: Durability;
+    /** Keys exist on this machine (M1.3 supplies it): a missing db is then INTEGRITY_BROKEN, never a fresh genesis. */
+    keysPresent?: boolean;
+    /** S34-23 test seam: file-anchor coalescing window in ms (default FILE_ANCHOR_MAX_MS). */
+    fileAnchorMaxMs?: number;
+    /** S34-11: per-write keystore anchor timeout, measured from DEQUEUE (default KEYSTORE_WRITE_TIMEOUT_MS). */
+    keystoreTimeoutMs?: number;
+    /** Earlier kernel key ids (rotated keys) accepted on kernel-principal rows at verify; the signer's own key is added. */
+    kernelKeyIds?: readonly string[];
+    clock?: () => number;
+    /** PASSIVE WAL checkpoint after this many ms without an append (default 250). */
+    checkpointIdleMs?: number;
+    /** Hard WAL bound: inline PASSIVE checkpoint every N appends (default 20 000). */
+    checkpointEvery?: number;
+    onDiagnostic?: (d: {
+        what: string;
+        detail: Record<string, unknown>;
+    }) => void;
+}
+interface AppendInput {
+    kind: string;
+    principal: string;
+    payload?: unknown;
+    session?: string;
+    connId?: string;
+    deviceId?: string;
+    idem?: string;
+    scope?: EventScopeV1;
+    causes?: string[];
+    ref?: string;
+    refHash?: string;
+    /** Tighten only (L6). Omitted = the §9.1 default for the kind. */
+    audience?: Audience;
+    sensitivity?: Sensitivity;
+    /** Which side appends (L7). Default 'kernel'. */
+    as?: KindOwner;
+    /** Override the signer for this row (e.g. a hardware key later); `null` = unsigned (diagnostics only). */
+    signer?: Signer | null;
+}
+type AnchorState = 'ok' | 'lagging-repaired' | 'created' | 'unavailable' | 'ahead';
+/** S34-03: how a critical row was anchored — `file-only` while the keystore anchor is the unavailable stub (until M1.3). */
+type Anchoring = 'both' | 'file-only';
+/** Default per-write keystore anchor timeout (S34-11). */
+declare const KEYSTORE_WRITE_TIMEOUT_MS = 5000;
+/** S33-10: why an anchor is ahead of the db. Classifies, never downgrades: both are INTEGRITY_BROKEN{truncated}. */
+type TruncationCause = 'tamper' | 'unclean-reboot';
+/** An anchor ahead of the db (S33-10), as found on open. */
+interface TruncationReport {
+    cause: TruncationCause;
+    /** Which anchor was ahead (the keystore anchor wins when both are). */
+    anchor: 'file' | 'keystore';
+    /** First and last lost seq; `lostHash` is the anchor's hash for row `lostTo`. */
+    lostFrom: number;
+    lostTo: number;
+    lostHash: string;
+    /** The authoritative (keystore) anchor's boot session, `unknown` if none/unreadable. */
+    bootPrev: string;
+    bootNow: string;
+    /** The authoritative anchor was written by a clean close. */
+    cleanClose: boolean;
+    /** Which anchors are ahead of the db (S34-04 / report nit). */
+    ahead: {
+        file: boolean;
+        keystore: boolean;
+    };
+    /**
+     * S34-24: rows the FILE anchor lags the db by while the keystore anchor is
+     * ahead (0 when the file anchor is ahead or exact). Not bounded by the > 63
+     * file-anchor bound here: the keystore anchor classifies the truncation.
+     */
+    fileLag: number;
+    /**
+     * S34-04: only the FILE anchor leads while a keystore anchor is present and
+     * not ahead — the lead is unauthenticated (a same-user process can write the
+     * file anchor), so acknowledgeGap refuses FORBIDDEN{unauthenticated-lead}.
+     */
+    unauthenticatedLead: boolean;
+}
+/** Live integrity state (S34-14): `report.integrity` is the open-time snapshot, `log.integrity` is now. */
+type LogIntegrity = {
+    state: 'ok';
+} | ({
+    state: 'truncated';
+} & TruncationReport) | {
+    state: 'anchor-faulted';
+    failed: FaultEntry[];
+};
+/** A critical row whose anchoring failed after COMMIT; `markerSeq` = its committed daemon.anchor.failed row. */
+interface FaultEntry {
+    seq: number;
+    kind: string;
+    recorded: boolean;
+    markerSeq?: number;
+}
+/** What `close()` resolves to (S34-12): a failed clean-close keystore write is surfaced, never swallowed. */
+interface CloseReport {
+    keystore: 'ok' | 'failed' | 'skipped-truncated';
+    error?: string;
+    /** S34-17: anchor-fault outcome — `recovered` = markers recorded and anchored by the closing anchors. */
+    fault: 'none' | 'recovered' | 'pending';
+}
+interface OpenReport {
+    logId: string;
+    created: boolean;
+    recoveredRotation: boolean;
+    /** Rows the file anchor lagged the db by at open (crash between commit and anchor write; ≤ 63, or > 63 relaxed across a boot change with a daemon.anchor.lag{which: 'file'} row (P8-D85), or refused). */
+    anchorLag: number;
+    /** Rows the keystore anchor lagged by at open (> 1023 ⇒ a daemon.anchor.lag row was appended). */
+    keystoreLag: number;
+    anchors: {
+        file: AnchorState;
+        keystore: AnchorState;
+    };
+    /** The boot session this open recorded into every anchor (S33-10). */
+    boot: string;
+    /** `ok`, or (only via `openForRecovery`) the truncation the log refuses appends for. */
+    integrity: {
+        state: 'ok';
+    } | ({
+        state: 'truncated';
+    } & TruncationReport);
+}
+/**
+ * What `append` resolves to. `anchored` (S34-03): `false` for bulk rows; for
+ * critical kinds (S33-06) `'both'` = file + keystore anchors written before
+ * resolving, `'file-only'` = the keystore anchor is the unavailable stub.
+ */
+interface AppendResult {
+    seq: number;
+    hash: string;
+    anchored: false | Anchoring;
+    event: EventV1;
+}
+/** `status.log` anchor telemetry (S33-06). */
+interface AnchorStatus {
+    /** Forced (critical) anchors per row over the last ≤ 10⁴ rows. */
+    forcedAnchorRate: number;
+    /** false ⇒ forcedAnchorRate > 1/64: bulk p99 is outside the measured envelope; re-probe. */
+    withinEnvelope: boolean;
+    /** Rows committed since the last file anchor write / the last CONFIRMED (resolved) keystore anchor write (S34-15). */
+    fileLag: number;
+    keystoreLag: number;
+    /** S34-03: `file-only` while the keystore anchor is unavailable (stub). */
+    anchoring: Anchoring;
+    /** S34-02: true while critical appends must re-anchor first (see `integrity`). */
+    faulted: boolean;
+    fileAnchors: number;
+    keystoreAnchors: number;
+    forcedAnchors: number;
+    checkpoints: number;
+}
+interface SegmentInfo {
+    segment: number;
+    file: string;
+    baseSeq: number;
+    basePrev: string;
+    /** baseSeq - 1 when empty. */
+    lastSeq: number;
+    lastHash: string;
+    lastKind: string | null;
+    sealed: boolean;
+}
+type VerifyFailureCode = 'seq-gap' | 'envelope' | 'hash' | 'prev' | 'log' | 'column-mismatch' | 'sig' | 'unknown-key' | 'unsigned' | 'unregistered-kind' | 'label-relaxed' | 'meta' | 'segment-link' | 'segment-unsealed' | 'anchor' | 'kernel-key' | 'reserved-binding';
+interface VerifyFailure {
+    code: VerifyFailureCode;
+    segment: number;
+    seq?: number;
+    detail: string;
+}
+interface VerifyReport {
+    ok: boolean;
+    rows: number;
+    segments: Array<{
+        segment: number;
+        firstSeq: number;
+        lastSeq: number;
+        rows: number;
+        ok: boolean;
+    }>;
+    failures: VerifyFailure[];
+    /**
+     * S34-18: were kernel rows (reserved kinds, kernel principal) bound to the
+     * kernel identity? `not-checked` when verify ran without it (standalone
+     * verifyLog without kernelPrincipal/kernelKeyIds) — `ok` alone then says
+     * nothing about who wrote the log's own rows.
+     */
+    kernelBinding: 'ok' | 'failed' | 'not-checked';
+    anchors: {
+        file: 'ok' | 'lagging' | 'mismatch' | 'missing' | 'not-checked';
+        keystore: 'ok' | 'lagging' | 'unavailable' | 'mismatch' | 'not-checked';
+    };
+}
+/** List sealed segment files, ascending. */
+declare function listSealedSegments(home: string): Array<{
+    segment: number;
+    file: string;
+}>;
+declare class KernelLog {
+    #private;
+    readonly home: string;
+    readonly logId: string;
+    readonly report: OpenReport;
+    private constructor();
+    /**
+     * Open (or, on a machine with no log, no anchor and no keys, create) the
+     * kernel log. Production only: the keystore anchor is the store the kernel
+     * builds itself and the boot session is read from the OS.
+     */
+    static open(opts: KernelLogOptions): KernelLog;
+    /**
+     * T-2026-10-17-009(a) — the successor log of a quarantined home. `opts.home`
+     * must hold NO log (no db, no anchor, no segment): the log is created and
+     * its genesis row (seq 1) is the kernel-signed reserved
+     * `daemon.log.quarantined{quarantinedLog, quarantinedHead, evidencePath,
+     * authorizedBy}`, then both anchors are written durably. This is the ONLY
+     * way that kind is appended (append() refuses it as reserved, and verify
+     * flags it anywhere but seq 1), so it can never be appended to, or
+     * downgrade, an existing log. Refused: an existing log
+     * (BAD_REQUEST{not-genesis}); no kernel key (FORBIDDEN{kernel-key-required}).
+     * The caller (quarantine.ts) closes the returned log.
+     */
+    static createQuarantineSuccessor(opts: KernelLogOptions, payload: QuarantinedPayload): Promise<KernelLog>;
+    get activePath(): string;
+    get keyRing(): KeyRing;
+    /** The `at` of the chain's last event (S-L2: the fuse's day windows), `''` on an empty chain. */
+    lastEventAt(): string;
+    /** Is this one of the kernel's signing keys (current or recorded)? */
+    isKernelKey(keyId: string): boolean;
+    /** `{log, segment, seq, hash}` of the chain head. */
+    head(): {
+        log: string;
+        segment: number;
+        seq: number;
+        hash: string;
+    };
+    /** S33-06 telemetry (`status.log.forcedAnchorRate`): forced anchors per row over the last ≤ 10⁴ rows. */
+    get forcedAnchorRate(): number;
+    /** The `status.log` anchor block (S33-06/07). */
+    get anchorStatus(): AnchorStatus;
+    /**
+     * Append one event. The commit is durable per the durability policy before
+     * the promise resolves — so a caller that must log BEFORE acting (L2,
+     * `session.inject` before the child reads, G-LOG-03) sequences on it.
+     *
+     * Critical kinds (CRITICAL_ANCHOR_KINDS, S33-06/S33-10) resolve only after
+     * the commit, the file-anchor rename and the keystore anchor write have
+     * completed, in that order: `{anchored: 'both' | 'file-only'}`. The commit
+     * uses the bulk durability (no F_FULLFSYNC, P8-D83): this orders the anchor
+     * before any effect against a same-user process; it is not a power-loss
+     * guarantee. NO EFFECT of a critical event (tool release, card result,
+     * grant) may be released before this resolves. Any failure after COMMIT
+     * rejects ENGINE{anchor-failed} (the row is committed but must be treated
+     * as not having happened) and faults the log (S34-02, header).
+     *
+     * The first append after open waits for the keystore re-stamp (S34-01).
+     */
+    append(input: AppendInput): Promise<AppendResult>;
+    /** PASSIVE WAL checkpoint (never blocks on readers); also renames in a pending file anchor (S33-05 "on idle checkpoint"). */
+    checkpoint(): void;
+    /** Write both anchors for the current head now and wait for the keystore write (daemon shutdown paths, tests). */
+    flushAnchors(): Promise<void>;
+    /** Every segment, sealed first, then the active one. */
+    segments(): SegmentInfo[];
+    /**
+     * Rows in seq order, projected for `reader` (audience/sensitivity, §9.3).
+     * Rows the reader may not see are skipped; sensitive-column rows reach
+     * redacting readers as `{kind, hsid, at, hash}` stubs.
+     */
+    read(opts: {
+        reader: ReaderClass;
+        fromSeq?: number;
+        toSeq?: number;
+        kinds?: readonly string[];
+        limit?: number;
+    }): Generator<LogView>;
+    /**
+     * RELEASED HEAD (D83 ordering, M1.4 slice 2 round 2): the highest seq with
+     * no unresolved critical row at or below it. A critical row is committed
+     * before its anchors resolve; until they do, neither it nor any later row
+     * is readable or streamed. It advances when the critical append's anchors
+     * resolve (success) or fail — a failed row is then FAILED: withheld from
+     * every read (its daemon.anchor.failed marker row is the visible record).
+     */
+    releasedHead(): number;
+    /**
+     * M1.4 slice 2 read primitive (cursor paging + subscriptions). Scans rows
+     * with `afterSeq < seq <= min(untilSeq, releasedHead())` in seq order, at
+     * most `maxScan` of them. Per row: FAILED seqs (anchoring failed) are
+     * skipped; for a non-human reader the projection runs FIRST (a row the
+     * reader cannot see costs no hash and leaves no integrity signal); then the
+     * envelope is RE-HASHED against its stored hash, its seq/kind/id checked
+     * against the columns, and its `prev` checked against the previous row's
+     * hash (linkage across contiguous rows; the page start is checked against
+     * the stored hash of row afterSeq). A failing row is withheld from every
+     * reader and counted. RESIDUAL: a same-user writer who rewrites a row AND
+     * every later row's prev/hash consistently passes these checks — only
+     * signature verification (kernel key) would catch it; that writer can read
+     * kernel.db directly anyway, so it widens nothing for socket principals.
+     * `visit` returns false to stop AFTER consuming that row; `lastScanned` is
+     * the seq to resume after (stable: seqs are immutable).
+     */
+    readPage(opts: {
+        reader: ReaderClass;
+        afterSeq: number;
+        untilSeq?: number;
+        maxScan: number;
+        kinds?: ReadonlySet<string> | ((kind: string) => boolean);
+        match?: (v: LogView) => boolean;
+        visit: (v: LogView) => boolean;
+    }): {
+        lastScanned: number;
+        scanned: number;
+        withheld: number;
+        head: number;
+        caughtUp: boolean;
+    };
+    /**
+     * `ev:<ULID>` lookup (#ref-resolver, §3.7). `undefined` = no such row, the
+     * reader may not see it, it is above the released head, or its anchoring
+     * failed — one answer, no existence oracle. Visibility is decided BEFORE
+     * the hash check, so `'withheld'` (hash/column mismatch) is only ever
+     * returned for a row the reader could otherwise see.
+     */
+    getById(id: string, reader: ReaderClass): LogView | 'withheld' | undefined;
+    /**
+     * Observe every committed row (read-side tail for #socket subscriptions).
+     * Called synchronously after COMMIT, in seq order, BEFORE the row is
+     * released (a committed critical row may still be unreadable); a listener
+     * must not append re-entrantly (defer) and its exceptions never reach the
+     * appender. Pair with onRelease to learn when rows become readable.
+     */
+    onCommit(listener: (e: EventV1) => void): () => void;
+    /** Called with the new releasedHead() whenever a critical row's anchoring resolves (or fails). */
+    onRelease(listener: (head: number) => void): () => void;
+    /** The truncation this (recovery-mode) log refuses appends for, if any. */
+    get truncation(): TruncationReport | undefined;
+    /** S34-14: the LIVE integrity state (`report.integrity` is the open-time snapshot). */
+    get integrity(): LogIntegrity;
+    /** `gnomon log verify`: the full chain (every segment + both anchors), or one segment. */
+    verify(opts?: {
+        segment?: number;
+    }): VerifyReport;
+    /**
+     * Clean close: both anchors durably, carrying the clean-close marker
+     * (S33-07; the keystore copy is the authoritative one, S34-05), then a
+     * TRUNCATE checkpoint. The db work is synchronous; the returned promise
+     * resolves when the keystore write settles and REPORTS a failed write
+     * (S34-12) — `{keystore: 'failed', error}` — instead of swallowing it. A
+     * truncated (recovery-mode) log writes no anchor: `skipped-truncated`. An
+     * anchor-faulted log first commits any pending daemon.anchor.failed markers;
+     * `fault` reports whether the closing anchors cleared the fault (S34-17).
+     */
+    close(): Promise<CloseReport>;
+}
+/** Kinds only the log itself appends (rotation, open, recovery, anchor faults); verify binds them to the kernel identity (S34-18). */
+declare const RESERVED_KINDS: readonly string[];
+/** T-2026-10-17-009(a): the reserved kind that may only be a log's GENESIS row (seq 1): the successor of a quarantined home. */
+declare const QUARANTINE_GENESIS_KIND: "daemon.log.quarantined";
+/** daemon.log.quarantined payload (contracts RESERVED_KIND_PAYLOADS, P8-D89). `evidencePath` is a sensitive field label. */
+interface QuarantinedPayload {
+    quarantinedLog: string;
+    quarantinedHead: {
+        seq: number;
+        hash: string;
+        segment: number;
+    };
+    evidencePath: string;
+    /** How the human was proved: `interactive-confirm` (a TTY confirmation) until presence lands (M1.3). */
+    authorizedBy: 'interactive-confirm';
+}
+interface VerifyLogOptions {
+    keyRing: KeyRing;
+    segment?: number;
+    kernelPrincipal?: string;
+    kernelKeyIds?: readonly string[];
+    /**
+     * Called once per row, in seq order, with the exact bytes this pass checked
+     * (M1.12 replay folds inside verify's single pass, Aegis C2). A consumer
+     * must discard what it saw unless the report is `ok`.
+     */
+    onRow?: (row: VerifiedRow) => void;
+}
+/** A row as verify read it (the bytes its checks ran on). */
+interface VerifiedRow {
+    seq: number;
+    kind: string;
+    envelope: string;
+    hash: string;
+}
+declare function verifyLog(home: string, opts: VerifyLogOptions): VerifyReport;
+
+declare const QUARANTINE_JOURNAL = "quarantine-journal.json";
+declare const QUARANTINE_JOURNAL_SCHEMA: "gnomonQuarantineJournal:v1";
+/** Crash points of the move, in order (the test seam injects a crash after each). */
+declare const QUARANTINE_STEPS: readonly ["identity-read", "staging-created", "staged", "evidence-renamed", "moved", "installed"];
+type QuarantineStep = (typeof QUARANTINE_STEPS)[number];
+interface QuarantineOptions {
+    /** The Gnomon home to quarantine (absolute). */
+    home: string;
+    /** The NEW log's kernel key (the genesis row is signed by it; its public half is recorded in the new home). */
+    signer: Signer | null;
+    /** The kernel principal for the new log (`p:<ns>/kernel`, from the same root authority as the daemon). */
+    kernelPrincipal: string;
+    /** How the human was proved; only `interactive-confirm` (no proof of presence) until M1.3. */
+    authorizedBy: QuarantinedPayload['authorizedBy'];
+    /** The daemon socket path, for the liveness check alongside the pidfile. */
+    socketPath?: string;
+    clock?: () => number;
+}
+type HeadSource = 'db' | 'segment' | 'file-anchor' | 'keystore-anchor';
+interface ObservedHead {
+    source: HeadSource;
+    log: string;
+    seq: number;
+    hash: string;
+    segment: number;
+}
+/** The quarantined log as found. `head` is the HIGHEST observed seq; `observed` lists every source. */
+interface QuarantineIdentity {
+    log: string;
+    head: {
+        seq: number;
+        hash: string;
+        segment: number;
+    };
+    source: HeadSource;
+    observed: ObservedHead[];
+    /** The sources disagree (seq, hash or log id): e.g. a truncated db behind its anchor. */
+    disagree: boolean;
+    /** Sources present but unreadable (copy or open failed) — shown, never silently dropped. */
+    unreadable: Array<{
+        source: 'db' | 'segment';
+        reason: string;
+    }>;
+}
+type QuarantineReport = {
+    outcome: 'quarantined';
+    home: string;
+    evidencePath: string;
+    evidenceName: string;
+    quarantined: QuarantineIdentity;
+    newLogId: string;
+    genesis: {
+        seq: number;
+        hash: string;
+    };
+    /** `another-process`: the step-5 rename found staging gone — a daemon start installed it (completePendingQuarantine). */
+    installedBy: 'this' | 'another-process';
+    /** Abandoned (incomplete, unverifiable or pre-move) staging dirs left in place. */
+    abandoned: string[];
+} | {
+    outcome: 'completed-pending';
+    home: string;
+    evidencePath: string;
+    evidenceName: string;
+    newLogId: string;
+    staging: string;
+    abandoned: string[];
+};
+interface PendingQuarantine {
+    /** A staging dir installed as the home by this call (a crash between the two renames). */
+    completed: {
+        staging: string;
+        evidence: string;
+        newLog: string;
+    } | null;
+    /** Staging dirs that never became a home (left in place, never deleted), with why. */
+    abandoned: string[];
+    /** A valid journal names this home while the home AND its evidence both exist. */
+    conflict: string | null;
+    /** Our own lock pidfile left in the evidence by a crash between the step-4 rename and its release (reported, never deleted). */
+    lockResidue: string | null;
+}
+/** Test seam (internal test entry only): replace the step-4/5 renames to simulate EPERM etc. */
+interface QuarantineFsOps {
+    rename(from: string, to: string): void;
+}
+/** `<base>.quarantine-<YYYYMMDDTHHMMSSZ>-<8 hex>`: valid on every platform (no Windows-reserved character, no trailing dot/space). */
+declare function evidenceNameFor(base: string, at: Date, rand?: string): string;
+/**
+ * Finish a quarantine interrupted between its two renames (evidence present,
+ * home absent, staging complete and verified). Run before anything creates a home.
+ */
+declare function completePendingQuarantine(home: string): PendingQuarantine;
+/**
+ * The quarantined log's id and head from every source, without writing
+ * anything in the home. The keystore anchor is per OS USER, not per home
+ * (spec §22 OPEN 19): it is consulted only for the default home (`keystore`
+ * defaults to `home` === resolveGnomonHome()) — never for an evidence dir or
+ * a non-default --home, where it would speak for a different log.
+ */
+declare function readQuarantineIdentity(home: string, opts?: {
+    keystore?: boolean;
+}): QuarantineIdentity | undefined;
+/** `gnomon log quarantine` (see the header). */
+declare function quarantineLog(opts: QuarantineOptions): Promise<QuarantineReport>;
+
+/**
+ * @symbol #loop-runner
+ *
+ * The run ledger (docs/specs/gnomon-loops.md §4 "#loop-runner", "Restart"; LL6). A PURE fold of the runner's
+ * kernel-signed rows, so everything the runner knows after a restart comes back from the log:
+ *
+ *   loop.run.started{runId, loopId, scope, repoKey, contentHash, trigger, budgets, parentRunId?}
+ *   loop.node{runId, loopId, nodeId, type, visit, round, verdict, edge, next, durationMs, evidenceRef, evidence?, …}
+ *   loop.round{runId, loopId, round, nodeVisits, escalations}
+ *   loop.notified{runId, loopId, nodeId, as, text, cardId?}
+ *   loop.run.ended{runId, loopId, scope, repoKey, reason, terminal?, rounds, computeMs}  (terminal: the @goal/@stop/@pause
+ *                                                                                     the walk reached, when it did)
+ *
+ *   - **Open runs** (a start with no end) are what the boot sweep closes `daemon-restart`; nothing resumes mid-step.
+ *   - **Day windows** come from chain time (the row's `at`), as the fuse's do: top-level runs started and compute
+ *     spent per loop key and globally, per local calendar day. The counters are their OWN fold, never touched by the
+ *     eviction of run records (Aegis step 5 #1), and a callee's compute is charged to the ROOT caller's key (`rootKey`
+ *     on loop.run.started, else the parent run's), so the caller's day.computeSec funds its calls (§3.4).
+ *   - **Replay (G-LOOP-17).** Every loop.node row names the edge it took (`edge`, the verdict or choice key) and
+ *     where it went (`next`); `replayLoopRuns` reproduces each run's walk from the rows alone and reports a
+ *     divergence when a row's `next` is not the node the following row ran, or the end does not match the terminal.
+ *
+ * - **Model tokens (step 8).** A loop model step's spawn permit names the paying loop (`permit.grant{permit.scope.loop}`
+ *   = the root caller's key); the ledger maps each such permitId to that key and folds the permit's `budget.usage`
+ *   tokens into the same per-day counters (the key and '*'), so `day.tokens` and the global day cap survive a restart.
+ *
+ * Only rows from the kernel principal (and, when given, a kernel key) are folded: a forged row changes nothing.
+ */
+
+interface LoopReplayRun {
+    loopId: string;
+    /** [nodeId, verdict, edge, next] per visit, in log order */
+    edges: Array<[string, string, string | null, string | null]>;
+    ended: string | null;
+    /** #loop-events (step 7): the `loop.trigger.fired` trigger the run started from; present only for event-started runs */
+    why?: Record<string, unknown>;
+}
+
+declare const REPLAY_PROJECTION: "gnomon-replay:v1";
+interface ReplayInput {
+    seq: number;
+    kind: 'session.inject' | 'turn.sent';
+    hash: string;
+    origin?: string;
+    bytes?: number;
+    turn?: string;
+    permitId?: string;
+}
+interface ReplayProjection {
+    schema: typeof REPLAY_PROJECTION;
+    log: string | null;
+    head: {
+        seq: number;
+        hash: string;
+    } | null;
+    kinds: Record<string, number>;
+    sessions: Record<string, {
+        inputs: ReplayInput[];
+        host: Array<{
+            seq: number;
+            kind: string;
+            hashes: Record<string, string>;
+        }>;
+    }>;
+    cards: Record<string, {
+        state: string;
+        seq: number;
+    }>;
+    /** #loop-runner (G-LOOP-17): every loop run's walk, each edge taken; present only when the log has loop runs */
+    loops?: Record<string, LoopReplayRun>;
+}
+interface ReplayDivergence {
+    seq: number;
+    reason: 'input-mismatch' | 'inject-plaintext' | 'malformed-envelope' | 'loop-edge-mismatch' | DecisionSigDivergence | RootDecisionDivergence;
+    detail: string;
+}
+interface ReplayReport {
+    ok: boolean;
+    verify: VerifyReport;
+    /** Absent when verify failed (an unverified log is never folded). */
+    projection?: ReplayProjection;
+    projectionHash?: string;
+    divergences: ReplayDivergence[];
+    /** `verified` when decisionKeys was given (every approval.decide checked), else `unchecked`. */
+    decisionSigs: 'verified' | 'unchecked';
+    /** The seq of the decisionSig v2 cutover marker row, when one was seen (verified mode only). */
+    decisionCutoverSeq?: number;
+    /** Set when `expect` was given. */
+    expected?: {
+        hash: string;
+        matches: boolean;
+    };
+}
+type Row = VerifiedRow;
+/** The fold, pure over the rows (exported so a test can feed it rows directly). */
+declare function foldReplay(rows: Iterable<Row>): {
+    projection: ReplayProjection;
+    divergences: ReplayDivergence[];
+};
+/** Divergences of the decisionSig check (P8-D98). */
+type DecisionSigDivergence = 'decision-sig-bad' | 'decision-sig-v1-after-cutover' | 'decision-sig-unverifiable';
+interface DecisionKeys {
+    /** The approvals key ids (in the key ring) of an approver principal; none ⇒ the row cannot verify (fail closed). */
+    keyIdsFor(principal: string): readonly string[];
+}
+/**
+ * Verify every approval.decide decisionSig over its layout, with the per-log cutover (see the header).
+ * Pure over the rows, in seq order; exported so a test can feed rows directly.
+ */
+declare function checkDecisionSigs(rows: Iterable<Row>, keyRing: KeyRing, keys: DecisionKeys): {
+    divergences: ReplayDivergence[];
+    cutoverSeq?: number;
+};
+/** Aegis C1f (TD-2026-10-20-514): divergences of the v2 root-decision check. */
+type RootDecisionDivergence = 'root-rows-missing' | 'root-rows-digest' | 'root-sig-bad';
+/**
+ * Aegis C1f: every approval.decide carrying a rowsDigest (a v2 root decision) is checked against the card the log
+ * showed. Its approval.request card's root-rows node detail must hash to the card's contentHash, and
+ * sha256(canonicalJson(detail.rootRows)) must be the logged rowsDigest. With `root` (the pinned root key), the
+ * logged rootSig must verify over the gnomon-root-decision:v2 row rebuilt from the logged fields. Pure over the rows.
+ */
+declare function checkRootDecisions(rows: Iterable<Row>, root?: {
+    readonly rootKeyId: string | null;
+    verifyRow(signer: string, row: unknown, sigB64: string): boolean;
+}): ReplayDivergence[];
+declare function replayProjectionHash(p: ReplayProjection): string;
+/**
+ * verifyLog with the fold (and, given decisionKeys, the decisionSig check) inside its single pass; `expect`
+ * compares the projection hash. ok ⇔ verified ∧ no divergence ∧ (no expect ∨ it matches).
+ */
+declare function replayLog(home: string, opts: Omit<VerifyLogOptions, 'onRow'> & {
+    expect?: string;
+    decisionKeys?: DecisionKeys;
+    root?: Parameters<typeof checkRootDecisions>[1];
+}): ReplayReport;
+
+/**
+ * @symbol #kernel-log
+ *
+ * #kernel-log (spec §3.2, M1.2) — public surface of the kernel log module.
+ */
+
+declare const index$1_ACTIVE_DB: typeof ACTIVE_DB;
+type index$1_AnchorReadResult = AnchorReadResult;
+type index$1_AnchorState = AnchorState;
+type index$1_AnchorStatus = AnchorStatus;
+type index$1_AnchorStore = AnchorStore;
+type index$1_Anchoring = Anchoring;
+type index$1_AppendInput = AppendInput;
+type index$1_AppendResult = AppendResult;
+declare const index$1_BOOT_UNKNOWN: typeof BOOT_UNKNOWN;
+declare const index$1_CRITICAL_ANCHOR_KINDS: typeof CRITICAL_ANCHOR_KINDS;
+type index$1_CloseReport = CloseReport;
+declare const index$1_DEFAULT_SEGMENT_ROWS: typeof DEFAULT_SEGMENT_ROWS;
+declare const index$1_DIAGNOSTIC_NAMESPACES: typeof DIAGNOSTIC_NAMESPACES;
+declare const index$1_DOMAINS_BY_KEY_CLASS: typeof DOMAINS_BY_KEY_CLASS;
+type index$1_DecisionKeys = DecisionKeys;
+type index$1_DecisionSigDivergence = DecisionSigDivergence;
+type index$1_Durability = Durability;
+declare const index$1_FILE_ANCHOR_MAX_LAG: typeof FILE_ANCHOR_MAX_LAG;
+declare const index$1_FILE_ANCHOR_MAX_MS: typeof FILE_ANCHOR_MAX_MS;
+declare const index$1_FORCED_ANCHOR_ENVELOPE: typeof FORCED_ANCHOR_ENVELOPE;
+declare const index$1_FORCED_ANCHOR_WINDOW: typeof FORCED_ANCHOR_WINDOW;
+type index$1_FaultEntry = FaultEntry;
+type index$1_FileAnchorStore = FileAnchorStore;
+declare const index$1_FileAnchorStore: typeof FileAnchorStore;
+declare const index$1_GENESIS_PREFIX: typeof GENESIS_PREFIX;
+declare const index$1_HEAD_SCHEMA: typeof HEAD_SCHEMA;
+type index$1_HeadAnchor = HeadAnchor;
+type index$1_HeadSource = HeadSource;
+declare const index$1_KEYSTORE_ANCHOR_MAX_LAG: typeof KEYSTORE_ANCHOR_MAX_LAG;
+declare const index$1_KEYSTORE_ANCHOR_MAX_MS: typeof KEYSTORE_ANCHOR_MAX_MS;
+declare const index$1_KEYSTORE_WRITE_TIMEOUT_MS: typeof KEYSTORE_WRITE_TIMEOUT_MS;
+type index$1_KernelLog = KernelLog;
+declare const index$1_KernelLog: typeof KernelLog;
+type index$1_KernelLogOptions = KernelLogOptions;
+declare const index$1_KeyClass: typeof KeyClass;
+declare const index$1_KeyCustody: typeof KeyCustody;
+declare const index$1_KeyRing: typeof KeyRing;
+type index$1_KeystoreAnchorStore = KeystoreAnchorStore;
+declare const index$1_KeystoreAnchorStore: typeof KeystoreAnchorStore;
+type index$1_LogIntegrity = LogIntegrity;
+type index$1_LogRefusal = LogRefusal;
+declare const index$1_LogRefusal: typeof LogRefusal;
+type index$1_LogRefusalReason = LogRefusalReason;
+type index$1_LogStub = LogStub;
+type index$1_LogView = LogView;
+type index$1_ObservedHead = ObservedHead;
+type index$1_OpenReport = OpenReport;
+type index$1_PendingQuarantine = PendingQuarantine;
+type index$1_ProjectedEvent = ProjectedEvent;
+declare const index$1_QUARANTINE_GENESIS_KIND: typeof QUARANTINE_GENESIS_KIND;
+declare const index$1_QUARANTINE_JOURNAL: typeof QUARANTINE_JOURNAL;
+declare const index$1_QUARANTINE_JOURNAL_SCHEMA: typeof QUARANTINE_JOURNAL_SCHEMA;
+declare const index$1_QUARANTINE_STEPS: typeof QUARANTINE_STEPS;
+type index$1_QuarantineFsOps = QuarantineFsOps;
+type index$1_QuarantineIdentity = QuarantineIdentity;
+type index$1_QuarantineOptions = QuarantineOptions;
+type index$1_QuarantineReport = QuarantineReport;
+type index$1_QuarantineStep = QuarantineStep;
+type index$1_QuarantinedPayload = QuarantinedPayload;
+declare const index$1_REPLAY_PROJECTION: typeof REPLAY_PROJECTION;
+declare const index$1_RESERVED_KINDS: typeof RESERVED_KINDS;
+type index$1_ReaderClass = ReaderClass;
+type index$1_RedactedField = RedactedField;
+type index$1_ReplayDivergence = ReplayDivergence;
+type index$1_ReplayInput = ReplayInput;
+type index$1_ReplayProjection = ReplayProjection;
+type index$1_ReplayReport = ReplayReport;
+type index$1_RootDecisionDivergence = RootDecisionDivergence;
+declare const index$1_SEGMENTS_DIR: typeof SEGMENTS_DIR;
+declare const index$1_SEGMENT_SCHEMA: typeof SEGMENT_SCHEMA;
+declare const index$1_SESSION_NEVER_FIELDS: typeof SESSION_NEVER_FIELDS;
+declare const index$1_SIGNATURE_DOMAINS: typeof SIGNATURE_DOMAINS;
+declare const index$1_SIG_MANDATORY_KINDS: typeof SIG_MANDATORY_KINDS;
+declare const index$1_SIG_MANDATORY_NAMESPACES: typeof SIG_MANDATORY_NAMESPACES;
+type index$1_SegmentInfo = SegmentInfo;
+declare const index$1_SignatureDomain: typeof SignatureDomain;
+declare const index$1_Signer: typeof Signer;
+declare const index$1_SignerDomainError: typeof SignerDomainError;
+declare const index$1_SoftwareEd25519Signer: typeof SoftwareEd25519Signer;
+type index$1_TruncationCause = TruncationCause;
+type index$1_TruncationReport = TruncationReport;
+type index$1_VerifiedRow = VerifiedRow;
+type index$1_VerifyFailure = VerifyFailure;
+type index$1_VerifyFailureCode = VerifyFailureCode;
+type index$1_VerifyLogOptions = VerifyLogOptions;
+type index$1_VerifyReport = VerifyReport;
+declare const index$1_answerDigest: typeof answerDigest;
+declare const index$1_approveMessage: typeof approveMessage;
+declare const index$1_assertOwner: typeof assertOwner;
+declare const index$1_checkDecisionSigs: typeof checkDecisionSigs;
+declare const index$1_checkRootDecisions: typeof checkRootDecisions;
+declare const index$1_completePendingQuarantine: typeof completePendingQuarantine;
+declare const index$1_decisionMessage: typeof decisionMessage;
+declare const index$1_ed25519KeyId: typeof ed25519KeyId;
+declare const index$1_effectiveSensitivity: typeof effectiveSensitivity;
+declare const index$1_evidenceNameFor: typeof evidenceNameFor;
+declare const index$1_foldReplay: typeof foldReplay;
+declare const index$1_fsyncDir: typeof fsyncDir;
+declare const index$1_fsyncFile: typeof fsyncFile;
+declare const index$1_genesisPrev: typeof genesisPrev;
+declare const index$1_hashPreimage: typeof hashPreimage;
+declare const index$1_isBenignDirFsyncError: typeof isBenignDirFsyncError;
+declare const index$1_isCriticalKind: typeof isCriticalKind;
+declare const index$1_isDiagnostic: typeof isDiagnostic;
+declare const index$1_isSigMandatory: typeof isSigMandatory;
+declare const index$1_listSealedSegments: typeof listSealedSegments;
+declare const index$1_logRefusal: typeof logRefusal;
+declare const index$1_mayBeUnsigned: typeof mayBeUnsigned;
+declare const index$1_mayBeVisible: typeof mayBeVisible;
+declare const index$1_normalizeBootId: typeof normalizeBootId;
+declare const index$1_p256KeyId: typeof p256KeyId;
+declare const index$1_projectForReader: typeof projectForReader;
+declare const index$1_projectionStats: typeof projectionStats;
+declare const index$1_quarantineLog: typeof quarantineLog;
+declare const index$1_readBootSession: typeof readBootSession;
+declare const index$1_readQuarantineIdentity: typeof readQuarantineIdentity;
+declare const index$1_replayLog: typeof replayLog;
+declare const index$1_replayProjectionHash: typeof replayProjectionHash;
+declare const index$1_resolveLabels: typeof resolveLabels;
+declare const index$1_sha256TaggedFast: typeof sha256TaggedFast;
+declare const index$1_signaturePreimage: typeof signaturePreimage;
+declare const index$1_usesDecisionV2: typeof usesDecisionV2;
+declare const index$1_verifyLog: typeof verifyLog;
+declare namespace index$1 {
+  export { index$1_ACTIVE_DB as ACTIVE_DB, index$1_BOOT_UNKNOWN as BOOT_UNKNOWN, index$1_CRITICAL_ANCHOR_KINDS as CRITICAL_ANCHOR_KINDS, index$1_DEFAULT_SEGMENT_ROWS as DEFAULT_SEGMENT_ROWS, index$1_DIAGNOSTIC_NAMESPACES as DIAGNOSTIC_NAMESPACES, index$1_DOMAINS_BY_KEY_CLASS as DOMAINS_BY_KEY_CLASS, index$1_FILE_ANCHOR_MAX_LAG as FILE_ANCHOR_MAX_LAG, index$1_FILE_ANCHOR_MAX_MS as FILE_ANCHOR_MAX_MS, index$1_FORCED_ANCHOR_ENVELOPE as FORCED_ANCHOR_ENVELOPE, index$1_FORCED_ANCHOR_WINDOW as FORCED_ANCHOR_WINDOW, index$1_FileAnchorStore as FileAnchorStore, index$1_GENESIS_PREFIX as GENESIS_PREFIX, index$1_HEAD_SCHEMA as HEAD_SCHEMA, index$1_KEYSTORE_ANCHOR_MAX_LAG as KEYSTORE_ANCHOR_MAX_LAG, index$1_KEYSTORE_ANCHOR_MAX_MS as KEYSTORE_ANCHOR_MAX_MS, index$1_KEYSTORE_WRITE_TIMEOUT_MS as KEYSTORE_WRITE_TIMEOUT_MS, index$1_KernelLog as KernelLog, index$1_KeyClass as KeyClass, index$1_KeyCustody as KeyCustody, index$1_KeyRing as KeyRing, index$1_KeystoreAnchorStore as KeystoreAnchorStore, index$1_LogRefusal as LogRefusal, index$1_QUARANTINE_GENESIS_KIND as QUARANTINE_GENESIS_KIND, index$1_QUARANTINE_JOURNAL as QUARANTINE_JOURNAL, index$1_QUARANTINE_JOURNAL_SCHEMA as QUARANTINE_JOURNAL_SCHEMA, index$1_QUARANTINE_STEPS as QUARANTINE_STEPS, index$1_REPLAY_PROJECTION as REPLAY_PROJECTION, index$1_RESERVED_KINDS as RESERVED_KINDS, index$1_SEGMENTS_DIR as SEGMENTS_DIR, index$1_SEGMENT_SCHEMA as SEGMENT_SCHEMA, index$1_SESSION_NEVER_FIELDS as SESSION_NEVER_FIELDS, index$1_SIGNATURE_DOMAINS as SIGNATURE_DOMAINS, index$1_SIG_MANDATORY_KINDS as SIG_MANDATORY_KINDS, index$1_SIG_MANDATORY_NAMESPACES as SIG_MANDATORY_NAMESPACES, index$1_SignatureDomain as SignatureDomain, index$1_Signer as Signer, index$1_SignerDomainError as SignerDomainError, index$1_SoftwareEd25519Signer as SoftwareEd25519Signer, index$1_answerDigest as answerDigest, index$1_approveMessage as approveMessage, index$1_assertOwner as assertOwner, index$1_checkDecisionSigs as checkDecisionSigs, index$1_checkRootDecisions as checkRootDecisions, index$1_completePendingQuarantine as completePendingQuarantine, index$1_decisionMessage as decisionMessage, index$1_ed25519KeyId as ed25519KeyId, index$1_effectiveSensitivity as effectiveSensitivity, index$1_evidenceNameFor as evidenceNameFor, index$1_foldReplay as foldReplay, index$1_fsyncDir as fsyncDir, index$1_fsyncFile as fsyncFile, index$1_genesisPrev as genesisPrev, index$1_hashPreimage as hashPreimage, index$1_isBenignDirFsyncError as isBenignDirFsyncError, index$1_isCriticalKind as isCriticalKind, index$1_isDiagnostic as isDiagnostic, index$1_isSigMandatory as isSigMandatory, index$1_listSealedSegments as listSealedSegments, index$1_logRefusal as logRefusal, index$1_mayBeUnsigned as mayBeUnsigned, index$1_mayBeVisible as mayBeVisible, index$1_normalizeBootId as normalizeBootId, index$1_p256KeyId as p256KeyId, index$1_projectForReader as projectForReader, index$1_projectionStats as projectionStats, index$1_quarantineLog as quarantineLog, index$1_readBootSession as readBootSession, index$1_readQuarantineIdentity as readQuarantineIdentity, index$1_replayLog as replayLog, index$1_replayProjectionHash as replayProjectionHash, index$1_resolveLabels as resolveLabels, index$1_sha256TaggedFast as sha256TaggedFast, index$1_signaturePreimage as signaturePreimage, index$1_usesDecisionV2 as usesDecisionV2, index$1_verifyLog as verifyLog };
+  export type { index$1_AnchorReadResult as AnchorReadResult, index$1_AnchorState as AnchorState, index$1_AnchorStatus as AnchorStatus, index$1_AnchorStore as AnchorStore, index$1_Anchoring as Anchoring, index$1_AppendInput as AppendInput, index$1_AppendResult as AppendResult, index$1_CloseReport as CloseReport, index$1_DecisionKeys as DecisionKeys, index$1_DecisionSigDivergence as DecisionSigDivergence, index$1_Durability as Durability, index$1_FaultEntry as FaultEntry, index$1_HeadAnchor as HeadAnchor, index$1_HeadSource as HeadSource, index$1_KernelLogOptions as KernelLogOptions, index$1_LogIntegrity as LogIntegrity, index$1_LogRefusalReason as LogRefusalReason, index$1_LogStub as LogStub, index$1_LogView as LogView, index$1_ObservedHead as ObservedHead, index$1_OpenReport as OpenReport, index$1_PendingQuarantine as PendingQuarantine, index$1_ProjectedEvent as ProjectedEvent, index$1_QuarantineFsOps as QuarantineFsOps, index$1_QuarantineIdentity as QuarantineIdentity, index$1_QuarantineOptions as QuarantineOptions, index$1_QuarantineReport as QuarantineReport, index$1_QuarantineStep as QuarantineStep, index$1_QuarantinedPayload as QuarantinedPayload, index$1_ReaderClass as ReaderClass, index$1_RedactedField as RedactedField, index$1_ReplayDivergence as ReplayDivergence, index$1_ReplayInput as ReplayInput, index$1_ReplayProjection as ReplayProjection, index$1_ReplayReport as ReplayReport, index$1_RootDecisionDivergence as RootDecisionDivergence, index$1_SegmentInfo as SegmentInfo, index$1_TruncationCause as TruncationCause, index$1_TruncationReport as TruncationReport, index$1_VerifiedRow as VerifiedRow, index$1_VerifyFailure as VerifyFailure, index$1_VerifyFailureCode as VerifyFailureCode, index$1_VerifyLogOptions as VerifyLogOptions, index$1_VerifyReport as VerifyReport };
+}
+
+/** Kernel version. test/version.test.ts keeps this equal to package.json. */
+declare const GNOMON_VERSION: "8.0.2";
+
+/** The thirteen kernel modules of spec §18, in spec order. */
+declare const KERNEL_MODULES: readonly ["identity", "log", "runner", "supervisor", "broker", "budget", "scheduler", "manifest", "refs", "socket", "web", "sandbox", "modhost"];
+type KernelModule = (typeof KERNEL_MODULES)[number];
+/** The single non-`node:` package the kernel may import (G-KRN-02). */
+declare const KERNEL_ALLOWED_PACKAGE: "@a-company/gnomon-contracts";
+
+/**
+ * @symbol #manifest-loader
+ *
+ * #manifest-loader refusals (spec §3.6, §4.6, §12.5). Every refusal is a
+ * contracts `refusal:v1` (refuse()) carried by a RefusedError, so the socket
+ * maps it with the §4.9 code map unchanged.
+ *
+ * The manifest-specific code (`SNAPSHOT`, `LOCKFILE`, …) rides in
+ * `refusal.data.manifestCode`, the same token the `manifest.refuse{code}`
+ * event carries (§12.5: `manifest.refuse{code:'SNAPSHOT'}`). It is NOT put in
+ * `data.reason`: `refusal.reason` is an additive enum hashed into
+ * `clientApiId` (contracts rpc.ts ADDITIVE_ENUMS), so naming new reasons there
+ * would move the pinned id. For the same reason no detail key is named
+ * `reason` (strict refusal:v1 validation checks `data.reason` against that enum). Adding these codes to REFUSAL_REASONS is a batch
+ * candidate for the next clientApiId move (reported in the M1.5 hand-off).
+ */
+
+/** Manifest refusal codes (kernel-internal; `manifest.refuse{code}` and `refusal.data.manifestCode`). */
+declare const MANIFEST_REFUSAL_CODES: readonly ["SCHEMA", "ABI", "NAME", "TIER", "CAPABILITY", "EGRESS", "KNOWLEDGE", "SNAPSHOT", "LOCKFILE", "POSTINSTALL", "GRANT", "INTEGRITY", "GENERATED", "NOT_INSTALLED", "FORMAT", "ENGINE", "PUBLISHER", "COLLISION"];
+type ManifestRefusalCode = (typeof MANIFEST_REFUSAL_CODES)[number];
+declare class ManifestRefusal extends RefusedError {
+    readonly manifestCode: ManifestRefusalCode;
+    readonly detail: Readonly<Record<string, unknown>>;
+    constructor(manifestCode: ManifestRefusalCode, message: string, detail?: Record<string, unknown>);
+}
+declare function isManifestRefusal(err: unknown): err is ManifestRefusal;
+/** The kernel event sink (§9.1 kinds; the caller appends them to #kernel-log). */
+type ManifestEventSink = (kind: string, payload: Record<string, unknown>) => void;
+declare const noEvents: ManifestEventSink;
+
+/**
+ * @symbol #manifest-loader
+ *
+ * #manifest-loader egress policy (spec §3.6, §4.3, §15.4; G-MAN-01). Anthropic
+ * API hosts are refused in a manifest's `requires.egress` and in every
+ * `grant.egress` row: a mod never talks to Anthropic directly (law 7 — the
+ * subscription path is the kernel's, never a mod's).
+ *
+ * Matching is fail-closed: the host is lower-cased, a trailing dot and a
+ * `:port` are stripped, and a WILDCARD that could match an Anthropic host
+ * (`*`, `*.com`, `*.anthropic.com`) is refused as well. Malformed hosts
+ * (empty, whitespace, a scheme, a path, `@`) are refused as not-a-host.
+ *
+ * Also refused (Aegis F8): any port (`host:443` — the egress proxy decides
+ * ports, a grant names hosts only); numeric hosts in any form (an all-numeric
+ * last label covers dotted-quad and decimal, a `0x…`/octal label the hex and
+ * octal forms); single-label names; and local/private names (`localhost`,
+ * `*.localhost`, `.local`, `.internal`, `.lan`, `.home.arpa`, `.localdomain`).
+ * The resolved-IP check against Anthropic and private ranges is the egress
+ * proxy's (M1.7); this is the name-level gate.
+ */
+/** Registrable domains whose hosts are Anthropic API / product endpoints. */
+declare const ANTHROPIC_DOMAINS: readonly string[];
+/** Normalise a host for comparison, or null when it is not a plain host[:port]. */
+declare function normalizeHost(raw: unknown): string | null;
+/** True when the (possibly wildcard) host could reach an Anthropic domain. */
+declare function isAnthropicHost(raw: unknown): boolean;
+type EgressRefusalWhy = 'anthropic' | 'not-a-host' | 'port' | 'numeric' | 'single-label' | 'private-name';
+type EgressVerdict = {
+    ok: true;
+    host: string;
+} | {
+    ok: false;
+    host: string;
+    why: EgressRefusalWhy;
+};
+declare const PRIVATE_NAME_SUFFIXES: readonly string[];
+/** Check one egress host. */
+declare function checkEgressHost(raw: unknown): EgressVerdict;
+
+declare const MANIFEST_FILE = "gnomon-manifest.json";
+declare const MOD_ABI_V1: "mod-abi:v1";
+declare const KNOWN_ABIS: readonly "mod-abi:v1"[];
+declare const MANIFEST_KINDS: readonly ["distro", "mod", "provider", "adapter", "skill-pack"];
+type ManifestKind = (typeof MANIFEST_KINDS)[number];
+/** Kinds accepted only from the first-party trust tier (A23-2, S25-H4). */
+declare const FIRST_PARTY_ONLY_KINDS: readonly ManifestKind[];
+declare const TOOL_EFFECTS: readonly ["read", "write", "network", "spend"];
+type ToolEffect = (typeof TOOL_EFFECTS)[number];
+/** §12.2 reserved decision keys (and the digits): never bindable by a mod (`G-MOD-06`). */
+declare const RESERVED_DECISION_KEYS: readonly string[];
+/** Trust tiers (§12.4 "Trust"): judged on provenance + hash, never self-description. */
+type TrustTier = 'first-party' | 'local' | `signed:${string}`;
+declare const TRUST_TIER_PATTERN: RegExp;
+/** Capabilities no mod manifest may request whatever its tier (§12.4 "Trust"). */
+declare const NEVER_REQUESTABLE: readonly string[];
+/** Keys whose meaning never changes across manifest formats (S0b §3). */
+declare const FORMAT_INVARIANT_KEYS: readonly string[];
+declare const MANIFEST_FORMAT_CURRENT: 2;
+declare const MANIFEST_FORMATS_ACCEPTED: readonly number[];
+/** The version cap (semver, ≤ 64) and the prerelease bound (≤ 4 identifiers of ≤ 16 characters). */
+declare const VERSION_MAX = 64;
+interface ManifestTool {
+    name: string;
+    schema?: Record<string, unknown>;
+    effects: ToolEffect[];
+}
+interface ManifestView {
+    id: string;
+    slot: string;
+    placement: 'append' | 'replace';
+    fixtures?: string[];
+}
+interface ManifestCommand {
+    id: string;
+    title: string;
+    args?: Record<string, unknown>;
+}
+interface ManifestKeybinding {
+    key: string;
+    command: string;
+}
+interface ManifestKnowledge {
+    name: string;
+    scheme: string;
+    query: string;
+    maxTier: string;
+}
+interface ManifestHook {
+    event: string;
+    command: string;
+}
+/** A manifest:2 provides.mcp entry: no `name` (the kernel derives it: mcpServerName(id)). */
+interface ManifestMcp {
+    command: string;
+    args?: string[];
+    /** what a per-user override may replace (TD-2026-10-20-812): absent = nothing (the manifest's command runs as is) */
+    config?: ManifestMcpConfig;
+}
+/** The author-declared override surface of one provides.mcp server (closed). */
+interface ManifestMcpConfig {
+    command?: true;
+    args?: true;
+    /** env var NAMES the user may set (never a launch-critical name, MCP_ENV_DENY) */
+    env?: string[];
+    /** env names (a subset of env) that hold SECRETS; refused in a per-user override until a secret store exists (Aegis S1 M2) */
+    secret?: string[];
+}
+/** A per-user override of a provides.mcp server's launch (validateMcpUserConfig); only what config permits. */
+interface McpUserConfig {
+    command?: string;
+    args?: string[];
+    env?: Record<string, string>;
+}
+/**
+ * A declarable env name: uppercase only. Lowercase names (http_proxy, no_proxy, …, which curl and others honour) are
+ * therefore unreachable by construction, so the denylist below lists only uppercase forms.
+ */
+declare const MCP_ENV_NAME: RegExp;
+/**
+ * Env names no override may set (Aegis M1): they change how a process loads code, resolves a binary, trusts TLS,
+ * routes traffic, finds its home/temp/config, or where its keys live.
+ */
+declare const MCP_ENV_DENY: ReadonlySet<string>;
+/** Prefix families no override may set (no bare GO prefix: GOOGLE_… stays declarable; the Go names are exact above). */
+declare const MCP_ENV_DENY_PREFIXES: readonly string[];
+/**
+ * Below the first-party tier a declared env name must start with the mod's own prefix (S0b: `<PUB>__<NAME>__`, double
+ * underscore, contracts modEnvPrefix) or be a credential (`…_API_KEY`, `…_TOKEN`). The denylist runs after and is never skipped.
+ */
+declare function mcpEnvOwnPrefix(modId: string): string;
+declare const MCP_CONFIG_LIMITS: Readonly<{
+    env: 16;
+    args: 64;
+    value: 4096;
+}>;
+interface ManifestEgress {
+    host: string;
+    purpose: string;
+}
+interface ManifestV2 {
+    manifest: 2;
+    kind: ManifestKind;
+    publisher: string;
+    name: string;
+    version: string;
+    /** compatibility: `engines.gnomon` comparators (S0b §3), refused ENGINE at stage and load */
+    engines?: {
+        gnomon?: string;
+    };
+    abi?: string;
+    description?: string;
+    compat?: {
+        kernel?: string;
+        claudeCode?: string;
+    };
+    provides?: {
+        mcp?: ManifestMcp[];
+        skills?: unknown[];
+        agents?: unknown[];
+        hooks?: ManifestHook[];
+        bands?: unknown[];
+        steps?: unknown[];
+        resolvers?: unknown[];
+        blocks?: unknown[];
+        oracles?: unknown[];
+        tools?: ManifestTool[];
+        views?: ManifestView[];
+        events?: string[];
+        commands?: ManifestCommand[];
+        keybindings?: ManifestKeybinding[];
+        knowledge?: ManifestKnowledge[];
+        /** the Desk (TD-2026-10-20-812): playbook offers, offer-spec:v1, at most OFFERS_PER_MOD_MAX */
+        offers?: OfferSpecV1[];
+    };
+    requires?: {
+        capabilities?: string[];
+        egress?: 'none' | ManifestEgress[];
+    };
+    config_schema?: Record<string, unknown>;
+}
+/** Mod names reserved outright (Aegis, Desk reviews): never a mod name at any tier or publisher. */
+declare const RESERVED_MOD_NAMES: ReadonlySet<string>;
+/**
+ * Names of the first-party mods (contracts FIRST_PARTY_MOD_NAMES). S0b: the tier rule is the publisher now (gnomon ⇔
+ * first-party); the old name-prefix list is gone, and a NON-gnomon publisher is refused any first-party display name,
+ * as the name, a prefix of it, or a skeleton of either (FIRST_PARTY_DISPLAY_NAMES).
+ */
+declare const FIRST_PARTY_MOD_NAMES: ReadonlySet<string>;
+/** Namespace tokens the kernel owns (the §9.1 registry's namespaces + the reserved prefixes). */
+declare const KERNEL_NAMESPACE_TOKENS: ReadonlySet<string>;
+/** S0b: `sha256:<hex>` of the manifest file's RAW bytes (what the human approved, byte for byte). */
+declare function manifestHash(raw: Uint8Array | string): string;
+/**
+ * `sha256:<hex>` of the canonical JSON of a manifest object: the format-1 manifestHash (the hash every pre-S0b grant
+ * row was signed over), the upgradedHash of an upgraded V2 object, and the distro generator's marker.
+ */
+declare function canonicalManifestHash(m: unknown): string;
+declare const ENGINES_MAX = 64;
+declare const ENGINE_OPS: readonly [">=", "<=", ">", "<", "="];
+type EngineOp = (typeof ENGINE_OPS)[number];
+/**
+ * Parse `engines.gnomon`: space-joined comparators (AND), each one of `>= > <= < =` followed by `x.y.z`; at most
+ * ENGINES_MAX characters. Returns the comparators or null when malformed.
+ */
+declare function parseEngines(range: unknown): Array<{
+    op: EngineOp;
+    v: [number, number, number];
+}> | null;
+/** Does `engines.gnomon` admit this kernel version? null when the range is malformed. */
+declare function enginesAdmit(range: unknown, version?: string): boolean | null;
+/** Compare two semver strings by their core (prerelease sorts below its release); null if either is not semver. */
+declare function compareVersions(a: string, b: string): number | null;
+/** The §15.4 form a capability string instantiates, or undefined. */
+declare function capabilityForm(cap: string): string | undefined;
+interface ValidateManifestOptions {
+    /** The trust tier of the install (provenance, recorded on the card and the grant.trust row). */
+    tier: TrustTier;
+    /**
+     * Only for a format-1 manifest upgraded under the frozen alias table (grants.ts LEGACY_ALIASES): the bare legacy
+     * name, whose `modns.<legacyName>.*` the mod may keep writing (S0b §4). Never set for a format-2 manifest.
+     */
+    legacyName?: string;
+    /** The kernel assigned `local` (the format-1 alias mapping); a manifest that declares `local` itself is refused. */
+    kernelAssignedLocal?: boolean;
+}
+/**
+ * The PURE format-1 upgrader (S0b §3): reads only the raw object and the kernel-derived publisher (the alias table:
+ * `gnomon` or `local`), never the disk, never mutates its input. provides.mcp entries lose `name`; a `local` mod's
+ * `modns.<N>.` kinds and log.append become `modns.local.<N>.` (only alias-table `gnomon` mods keep their legacy
+ * namespace). The full V2 validator always runs after (readManifest).
+ */
+declare function upgradeManifestV1(raw: unknown, publisher: 'gnomon' | 'local'): Record<string, unknown>;
+interface ReadManifestOptions extends Omit<ValidateManifestOptions, 'legacyName' | 'kernelAssignedLocal'> {
+    /**
+     * The alias publisher of a format-1 manifest (grants.ts aliasOf, or `gnomon` for a historical first-party
+     * packageHash at stage). Absent ⇒ format 1 is a FRESH install and is refused FORMAT.
+     */
+    legacyPublisher?: 'gnomon' | 'local';
+}
+interface ReadManifestResult {
+    manifest: ManifestV2;
+    /** raw-bytes hash (format 2); the legacy canonical hash its rows were signed over (format 1) */
+    manifestHash: string;
+    format: 1 | 2;
+    /** format 1 only: canonicalManifestHash of the upgraded V2 object (recorded on the install grant) */
+    upgradedHash?: string;
+}
+/** THE manifest entry (S0b): raw bytes → a validated V2 manifest and its hashes. Throws ManifestRefusal. */
+declare function readManifest(raw: Uint8Array | string, opts: ReadManifestOptions): ReadManifestResult;
+/**
+ * The stricter class for every COMMAND-RUNNING field (mcp.command, mcp.args,
+ * hooks.command, hooks.event; Aegis round 2 C1): C0/C1 plus Zl (U+2028), Zp
+ * (U+2029) and Cf (format characters: bidi controls, zero-widths, tags). The
+ * §4.5 sanitizer turns LS/PS into a newline, so one in a hook command could
+ * draw a fake install-card line; here they are refused SCHEMA instead.
+ */
+declare const COMMAND_UNSAFE: RegExp;
+/**
+ * Validate a parsed manifest. Returns the manifest (typed) or throws a
+ * ManifestRefusal naming the manifest code.
+ */
+declare function validateManifest(value: unknown, opts: ValidateManifestOptions): ManifestV2;
+/**
+ * Validate a per-user override of one provides.mcp server (TD-2026-10-20-812: first-party servers launch as
+ * `node <absolute path>` from another repo, so the manifest's fixed command cannot name them). Closed: only what the
+ * manifest entry's `config` permits; the same COMMAND_UNSAFE rule as the manifest; env names from the declared list
+ * only. Throws ManifestRefusal SCHEMA.
+ */
+declare function validateMcpUserConfig(entry: ManifestMcp, value: unknown): McpUserConfig;
+/** The launch of one provides.mcp server under an optional per-user override (validated here). */
+declare function resolveMcpLaunch(entry: ManifestMcp, override?: unknown): {
+    command: string;
+    args: string[];
+    env: Record<string, string>;
+};
+/** §12.5's list plus `mcp` and `hooks` (Aegis F3): both run commands, so an addition is always a widening; plus
+ * `offers` (TD-2026-10-20-812): a new offer is a new way the model may steer the human to the mod. */
+declare const WIDENING_FIELDS: readonly ["effects", "egress", "capabilities", "events", "tools", "views", "commands", "keybindings", "knowledge", "mcp", "hooks", "offers"];
+type WideningField = (typeof WIDENING_FIELDS)[number];
+interface WideningEntry {
+    field: WideningField;
+    added: string[];
+}
+/**
+ * Any ADDITION between two snapshots' manifests, by field (`prev = null`
+ * means a first install: everything is an addition). An empty result means
+ * the new manifest asks for nothing the old one did not.
+ */
+declare function detectWidening(prev: ManifestV2 | null, next: ManifestV2): WideningEntry[];
+
+declare const PACKAGE_TREE_SCHEMA: "gnomon-package-tree:v1";
+declare const NPM_LOCKFILES: readonly string[];
+declare const OTHER_LOCKFILES: readonly string[];
+declare const LIFECYCLE_INSTALL_SCRIPTS: readonly string[];
+type SnapshotRefusalReason = 'symlink' | 'hardlink' | 'native-addon' | 'escape' | 'special-file' | 'case-collision' | 'not-a-folder' | 'changed-during-copy';
+interface TreeFile {
+    /** posix path relative to the package root */
+    path: string;
+    sha256: string;
+    size: number;
+}
+interface PackageTree {
+    files: TreeFile[];
+    packageHash: string;
+    /** `package@version` from the npm lockfile when node_modules is present. */
+    packages: string[];
+    lockfile: string | null;
+}
+declare function computePackageHash(files: readonly TreeFile[]): string;
+/** The hex part of a `sha256:<hex>` hash (the snapshot directory name). */
+declare function hashHex(h: string): string;
+interface WalkEntry {
+    rel: string;
+    abs: string;
+    stat: fs.Stats;
+}
+/** Walk a source folder applying every copier refusal; returns regular files only. */
+declare function walkSource(root: string, name: string, emit: ManifestEventSink): WalkEntry[];
+/** Read one file once, refusing a swap since the walk (dev/ino/nlink/type re-checked by fstat). */
+declare function readChecked(e: WalkEntry, name: string, emit: ManifestEventSink): Buffer;
+/** Hash a source folder in place (no copy) under the copier's refusals — the "full rehash". */
+declare function hashSourceTree(root: string, name: string, emit: ManifestEventSink): PackageTree & {
+    bytes: Map<string, Buffer>;
+};
+/** Hash a pinned snapshot directory (no refusals needed beyond a plain walk; integrity = equality). */
+declare function hashPinnedTree(dir: string): TreeFile[];
+declare function modDir(home: string, name: string): string;
+declare function pinnedDir(home: string, name: string, packageHash: string): string;
+/** Make a read-only tree writable again and remove it (snapshots are 0500/0400). */
+declare function removeTree(p: string): void;
+interface SnapshotResult extends PackageTree {
+    dir: string;
+    /** false when an identical snapshot was already pinned (content-addressed reuse). */
+    created: boolean;
+}
+/**
+ * Copy `source` into a content-addressed snapshot for mod `name`. The copy is
+ * hashed after it is written (packageHash is over the copy, §12.5), then
+ * renamed into `pinned/<hex>/` and made read-only.
+ */
+declare function snapshotFolder(home: string, source: string, name: string, emit: ManifestEventSink): SnapshotResult;
+interface TreeDiff {
+    added: Array<{
+        path: string;
+        sha256: string;
+    }>;
+    changed: Array<{
+        path: string;
+        from: string;
+        to: string;
+    }>;
+    removed: Array<{
+        path: string;
+        sha256: string;
+    }>;
+}
+declare function diffTrees(prev: readonly TreeFile[], next: readonly TreeFile[]): TreeDiff;
+
+/**
+ * @symbol #manifest-loader
+ *
+ * S0b (mod ids): who owns a `modns.*` event kind. Dependency-free on purpose (the log's redaction, the socket's
+ * log.append gate and the mod host all import it; none may pull the grant reader in).
+ */
+/**
+ * The FROZEN format-1 alias table (S0b §4): the bare names of the bundled first-party mods before S0b. A test fails if
+ * format-1 support is removed while this table remains (the two expire together).
+ */
+declare const LEGACY_ALIASES: readonly string[];
+/**
+ * Does a mod own an event kind (S0b §2)? Its own `modns.<publisher>.<name>.` by WHOLE segments (the trailing dot), or,
+ * for an alias-table entry gnomon.<N> only, its legacy `modns.<N>.` (publisher N is reserved, so nobody else can own it).
+ */
+declare function ownsModKind(id: string, kind: string): boolean;
+
+declare const GRANTS_FILE = "grants.jsonl";
+declare const GRANT_ROW_SCHEMA: "grantRow:v1";
+/** S0b: the row schema of grant.install / grant.uninstall / grant.publisher (full mod ids). */
+declare const GRANT_ROW_SCHEMA_V2: "grantRow:v2";
+
+/** packageHashes of the historical (format-1) first-party pins: an alias resolves to gnomon.<N> only from one of these. */
+declare const HISTORICAL_FIRST_PARTY_PINS: ReadonlySet<string>;
+/** Is format 1 still loadable (MANIFEST_FORMAT.accepted)? The alias table is only meaningful while it is. */
+declare const FORMAT_1_SUPPORTED: boolean;
+/** The alias of a legacy bare name (S0b §4): the full mod id it resolves to. */
+declare function aliasOf(legacyName: string, tier: TrustTier | undefined, packageHash: string): string;
+/** The snapshot directory key of a pin row: the legacy bare name for a resolved v1 row, else the mod id. */
+declare function pinDirKey(row: {
+    name: string;
+    legacyName?: string;
+}): string;
+interface GrantInstallRow {
+    schemaVersion: typeof GRANT_ROW_SCHEMA | typeof GRANT_ROW_SCHEMA_V2;
+    kind: 'grant.install';
+    createdAt: string;
+    /** the full mod id (v2 rows; a resolved v1 row carries its alias here) */
+    name: string;
+    /** a resolved v1 row only: the bare legacy name (never written) */
+    legacyName?: string;
+    manifestHash: string;
+    packageHash: string;
+    cardId: string;
+    source: 'package' | `linked:${string}` | `git:${string}`;
+    /** a format-1 manifest: canonicalManifestHash of its upgraded V2 object (a mismatch at load re-cards) */
+    upgradedHash?: string;
+    dev?: {
+        until: string;
+    };
+}
+/** S0b: the TOFU binding of a non-GitHub publisher to (host, namespace). */
+interface GrantPublisherRow {
+    schemaVersion: typeof GRANT_ROW_SCHEMA_V2;
+    kind: 'grant.publisher';
+    createdAt: string;
+    /** TD-2026-10-20-514 (Aegis Q1): the card whose decision wrote it; REQUIRED on rows written through decision.sign */
+    cardId?: string;
+    publisher: string;
+    host: string;
+    namespace: string;
+}
+interface GrantCapabilityRow {
+    schemaVersion: typeof GRANT_ROW_SCHEMA;
+    kind: 'grant.capability';
+    createdAt: string;
+    /** TD-2026-10-20-514 (Aegis Q1): the card whose decision wrote it; REQUIRED on rows written through decision.sign */
+    cardId?: string;
+    manifestHash?: string;
+    deviceId?: string;
+    capabilities: string[];
+    read?: string[];
+}
+interface GrantTrustRow {
+    schemaVersion: typeof GRANT_ROW_SCHEMA;
+    kind: 'grant.trust';
+    createdAt: string;
+    /** TD-2026-10-20-514 (Aegis Q1): the card whose decision wrote it; REQUIRED on rows written through decision.sign */
+    cardId?: string;
+    manifestHash: string;
+    tier: TrustTier;
+    maxKnowledgeTier?: string;
+}
+interface GrantEgressRow {
+    schemaVersion: typeof GRANT_ROW_SCHEMA;
+    kind: 'grant.egress';
+    createdAt: string;
+    /** TD-2026-10-20-514 (Aegis Q1): the card whose decision wrote it; REQUIRED on rows written through decision.sign */
+    cardId?: string;
+    manifestHash: string;
+    hosts: string[];
+}
+interface GrantBindRow {
+    schemaVersion: typeof GRANT_ROW_SCHEMA;
+    kind: 'grant.bind';
+    createdAt: string;
+    /** TD-2026-10-20-514 (Aegis Q1): the card whose decision wrote it; REQUIRED on rows written through decision.sign */
+    cardId?: string;
+    principal: string;
+    manifestHash: string;
+    kinds: string[];
+}
+/** M1.11 slice 3: a root-signed uninstall (decided on a root-class card); the effective pin is the LAST install/uninstall row naming the mod. */
+interface GrantUninstallRow {
+    schemaVersion: typeof GRANT_ROW_SCHEMA | typeof GRANT_ROW_SCHEMA_V2;
+    kind: 'grant.uninstall';
+    createdAt: string;
+    name: string;
+    legacyName?: string;
+    /** the pin it removes */
+    packageHash: string;
+    cardId: string;
+}
+type GrantRow = GrantInstallRow | GrantCapabilityRow | GrantTrustRow | GrantEgressRow | GrantBindRow | GrantUninstallRow | GrantPublisherRow;
+/** What a writer passes: a grant row without schemaVersion (createdAt optional). */
+type GrantRowInput = GrantRow extends infer R ? (R extends GrantRow ? Omit<R, 'schemaVersion' | 'createdAt'> & {
+    createdAt?: string;
+} : never) : never;
+interface ResolvedGrants {
+    capabilities: Map<string, {
+        capabilities: Set<string>;
+        read: string[];
+    }>;
+    trust: Map<string, TrustTier>;
+    egress: Map<string, Set<string>>;
+    binds: GrantBindRow[];
+    installs: GrantInstallRow[];
+    /** grant.install and grant.uninstall rows in file order (effectiveInstall reads this) */
+    pins: Array<GrantInstallRow | GrantUninstallRow>;
+    /** S0b: publisher → its TOFU (host, namespace) binding (last row wins) */
+    /** publisher → its newest accepted binding (Aegis S0b M6: per-publisher strictly increasing createdAt) */
+    publishers: Map<string, {
+        host: string;
+        namespace: string;
+        createdAt?: string;
+    }>;
+    other: Array<{
+        line: number;
+        kind: GrantRowKind;
+    }>;
+    rejected: Array<{
+        line: number;
+        reason: string;
+    }>;
+}
+declare function grantsPath(home: string): string;
+/** Row-shape check; null = valid. Never consults other rows. */
+declare function checkGrantRow(row: unknown): string | null;
+/** Read and resolve the grant table against the trust set. Never throws on content. */
+declare function readGrants(home: string, trust: RowVerifier): ResolvedGrants;
+/**
+ * Append one root-signed grant row. The row is validated first (an Anthropic
+ * egress host or a knowledge+egress pairing is refused before signing), then
+ * signed by the authority — which refuses UNSUPPORTED until M1.3 in production.
+ */
+/** The newest accepted pin row's createdAt (ms) for a mod, by the reader's own rule (accepted pins are strictly increasing). */
+declare function newestPinMs(grants: ResolvedGrants, name: string): number | undefined;
+/**
+ * TD-2026-10-20-514: build ONE grant row (schemaVersion, createdAt, the replay-safe createdAt bumps and the
+ * knowledge+egress clash) against the table AND the rows already pending in the same batch. Pure: no signing, no
+ * write. A row built here, signed, then rebuilt under the lock must come out identical, or the table moved.
+ */
+declare function buildGrantRow(home: string, authority: RowVerifier, input: GrantRowInput, now?: Date, pending?: readonly GrantRow[], table?: ResolvedGrants): GrantRow;
+/** Build every row of one batch in order (each sees the ones before it). */
+declare function buildGrantRows(home: string, authority: RowVerifier, inputs: readonly GrantRowInput[], now?: Date): GrantRow[];
+/**
+ * TD-2026-10-20-514 / Aegis C5: append rows that are ALREADY root-signed. Every signature is verified; then, under the
+ * cross-process file lock, every row is rebuilt against the table as it is NOW and must come out byte-identical (a
+ * row whose createdAt went stale, a concurrent pin or binding, a new knowledge/egress clash: refused, nothing is
+ * written and nothing is silently re-signed). ONE write + fsync, grant.install LAST, then the pin read-back.
+ */
+declare function appendSignedGrantRows(home: string, authority: RowVerifier, rows: readonly GrantRow[], sigs: ReadonlyArray<{
+    signer: string;
+    sig: string;
+}>): void;
+/**
+ * Append one root-signed grant row (the CLI path; the daemon's card decisions go through buildGrantRows +
+ * decision.sign + appendSignedGrantRows). Built, signed by the authority (RootUnavailableError without a root),
+ * then re-checked and written under the same lock as the batch path.
+ */
+declare function appendGrantRow(home: string, authority: RootAuthority, input: GrantRowInput, now?: Date): GrantRow;
+/**
+ * Aegis F4 (TD-2026-10-20-514): the verified rows ONE decision wrote (its cardId), in file order, when that decision's
+ * anchor (grant.install / grant.uninstall naming the cardId) is among them; else []. A commit whose append landed but
+ * whose decision was not recorded (the pin read-back or the staged write threw) is finished from these rows.
+ */
+declare function rowsOfDecision(home: string, trust: RowVerifier, cardId: string): GrantRow[];
+interface GrantCheck {
+    ok: boolean;
+    missingCapabilities: string[];
+    missingEgress: string[];
+    tier: TrustTier | undefined;
+    read: string[];
+}
+/** Does the grant table hold every capability and egress host the manifest requires? */
+declare function checkAgainstGrants(manifest: {
+    requires?: {
+        capabilities?: string[];
+        egress?: 'none' | Array<{
+            host: string;
+        }>;
+    };
+}, mh: string, grants: ResolvedGrants): GrantCheck;
+/** The effective install of a mod: the LAST grant.install row naming it (re-pins and rollbacks append), unless a later grant.uninstall names it. */
+declare function effectiveInstall(grants: ResolvedGrants, name: string): GrantInstallRow | undefined;
+
+declare const GNOMON_REPO_DIR = ".gnomon";
+declare const RECORD_SCHEMA: "gnomon-generated-record:v1";
+declare const TEXT_MARKER = "# gnomon:generated";
+/** The only directories generateRepo may create or remove. */
+declare const GENERATED_DIRS: readonly string[];
+declare const GENERATED_FILES: readonly string[];
+interface GeneratedRecord {
+    schemaVersion: typeof RECORD_SCHEMA;
+    repo: string;
+    manifestHash: string;
+    files: Array<{
+        path: string;
+        sha256: string;
+    }>;
+    createdDirs: string[];
+}
+/** Canonical pretty JSON: sorted keys at every level, 2-space indent, final newline. */
+declare function stableJson(v: unknown): string;
+/** The generated file set (posix path under the repo → content), a pure function of the manifest. */
+declare function renderGenerated(m: ManifestV2): Map<string, string>;
+/** Kernel-held record path for a repo. */
+declare function recordPath(home: string, repo: string): string;
+declare function readRecord(home: string, repo: string): GeneratedRecord | null;
+/**
+ * T-2026-10-18-008 (M1.7): the generated plugin bytes a session may use, verified at SPAWN against the
+ * kernel-held record — never the repo's bytes on trust. No record ⇒ null (the repo has no generated plugin).
+ * Every recorded generated file under `.gnomon/generated/` is read (confined, O_NOFOLLOW) and must hash to
+ * the record AND carry the marker, else refused GENERATED. The returned bytes are what the session gets
+ * (the supervisor copies them into the kernel's own session dir); the repo files are never passed by path.
+ */
+declare function verifiedGenerated(repo: string, opts: {
+    home: string;
+    emit?: ManifestEventSink;
+}): Map<string, Buffer> | null;
+interface GenerateReport {
+    written: string[];
+    unchanged: string[];
+    manifestHash: string;
+    /** record entries outside the fixed generated set (ignored, never touched) */
+    ignored: string[];
+}
+/** Generate (or regenerate) the repo's files. Idempotent; refuses to overwrite a file that is not ours. */
+declare function generateRepo(repo: string, m: ManifestV2, opts: {
+    home: string;
+    writeProjectYaml?: boolean;
+    emit?: ManifestEventSink;
+}): GenerateReport;
+interface UninstallReport {
+    removed: string[];
+    /** generated files whose bytes were edited since generation: kept, never deleted */
+    keptEdited: string[];
+    removedDirs: string[];
+    /** record entries outside the fixed generated set: ignored, never touched */
+    ignored: string[];
+}
+declare function uninstallRepo(repo: string, opts: {
+    home: string;
+    emit?: ManifestEventSink;
+}): UninstallReport;
+declare function uninstallHome(home: string, opts: {
+    mode: 'remove' | 'keep';
+    emit?: ManifestEventSink;
+}): {
+    removed: boolean;
+    exportPath: string | null;
+};
+
+/** The user's MCP server names (sorted, unique) from user, local and (optionally) project scope. */
+declare function userMcpServerNames(opts: {
+    userHome?: string;
+    repo?: string;
+}): string[];
+
+declare const STAGED_RECORD_SCHEMA: "gnomon-staged-install:v1";
+type InstallSource = 'package' | `linked:${string}` | `git:${string}`;
+/** S0b §3: how the bytes compare with the approved history of this mod id (the card's index-3 line). */
+/** What a publisher binding replaces (Aegis S0b M2). */
+type PublisherFrom = {
+    host: string;
+    namespace: string;
+} | 'github.com' | null;
+type VersionClass = 'first' | 'update' | 'downgrade' | 'revert' | 'same-version-new-bytes' | 'format-only';
+/** What the install card shows (§12.5), and what its contentHash covers. */
+interface InstallCardDetail {
+    /** the mod id <publisher>.<name> */
+    name: string;
+    publisher: string;
+    /** how the publisher is shown: `acme`, `acme (unverified, local folder)`, `acme @ gitlab.com` */
+    publisherDisplay: string;
+    /** manifest format of the staged bytes (1 only for a historical first-party pin) */
+    format: 1 | 2;
+    upgradedHash?: string;
+    versionClass: VersionClass;
+    /** the version of the pin this replaces (absent on a first install) */
+    prevVersion?: string;
+    /** the source this replaces when it differs in kind, owner, host or namespace (a source change: always the full card) */
+    sourceChangedFrom?: string;
+    /** another installed third-party publisher this one is a skeleton match of */
+    looksLike?: string;
+    /** the derived MCP server name (absent when the mod has no provides.mcp) */
+    serverName?: string;
+    /** a non-GitHub publisher re-bound to a new (host, namespace) by this card */
+    /**
+     * the publisher binding this install writes (Aegis S0b M2): `from` is the binding it replaces as seen at stage
+     * ({host, namespace}, 'github.com' for the implicit owner claim, or null for a first binding); decide refuses
+     * PUBLISHER unless the binding is still `from`
+     */
+    rebind?: {
+        host: string;
+        namespace: string;
+        from?: PublisherFrom;
+    };
+    kind: ManifestV2['kind'];
+    version: string;
+    source: InstallSource;
+    tier: TrustTier;
+    manifestHash: string;
+    packageHash: string;
+    effects: string[];
+    egress: string[];
+    capabilities: string[];
+    events: string[];
+    tools: string[];
+    views: string[];
+    readPaths: string[];
+    packages: string[];
+    commands: string[];
+    keybindings: string[];
+    knowledge: string[];
+    mcp: string[];
+    hooks: string[];
+    /** the Desk (TD-2026-10-20-812): one line per declared offer; absent when the manifest declares none */
+    offers?: string[];
+    /** counts of the opaque provides arrays (skills, agents, bands, steps, resolvers, blocks, oracles) */
+    opaque: Record<string, number>;
+    /** the effective pin this card would replace, or null for a first install */
+    replaces: {
+        packageHash: string;
+        manifestHash: string;
+    } | null;
+    widened: WideningEntry[];
+    files: TreeDiff;
+    stagedBy: string;
+    hsid?: string;
+}
+interface StagedRecord {
+    schemaVersion: typeof STAGED_RECORD_SCHEMA;
+    card: CardV1;
+    detail: InstallCardDetail;
+    manifest: ManifestV2;
+    decision?: {
+        decision: 'install' | 'deny';
+        at: string;
+    };
+}
+interface StageOptions {
+    home: string;
+    /** the package path or the linked folder */
+    source: string;
+    via: 'package' | 'linked' | 'git';
+    /**
+     * via 'git': the claimed URL and commit of the fetched checkout in `source` (the fetch itself is S4).
+     * TODO(S4, Aegis S0b L4): the fetch seam MUST run git with `-c http.followRedirects=false` (spec
+     * gnomon-mod-naming-versioning.md §3 Git source: repo-jacking) plus the other D4 clone flags; integrity stays the
+     * packageHash verified here and at load, never the sha40 locator.
+     */
+    git?: {
+        url: string;
+        commit: string;
+    };
+    /** the human asked to re-bind a non-GitHub publisher to this source's (host, namespace) (full card) */
+    rebindPublisher?: boolean;
+    /** MCP server names in the user's .mcp.json (COLLISION) */
+    userMcpServers?: readonly string[];
+    /**
+     * kernel-internal (loadMod's upgradedHash re-card, Aegis S0b L2): the alias publisher of the pinned format-1 row,
+     * and a re-card even when the bytes, manifestHash and source equal the current pin. Never set from a client.
+     */
+    recard?: {
+        legacyPublisher?: 'gnomon' | 'local';
+    };
+    /** a signature over the manifestHash claiming the `signed:<gkey>` tier (refused until trusted keys exist) */
+    signature?: {
+        keyId: string;
+        sig: string;
+    };
+    /** the principal that staged it (an agent session principal for agent-written mods) */
+    requestedBy: string;
+    hsid?: string;
+    attended?: boolean;
+    /** extra read paths a knowledge:provide grant asks for (listed on the card) */
+    readPaths?: string[];
+    trust: RowVerifier;
+    emit?: ManifestEventSink;
+    now?: Date;
+}
+type StageResult = {
+    state: 'staged';
+    cardId: string;
+    record: StagedRecord;
+} | {
+    state: 'unchanged';
+    packageHash: string;
+};
+declare function readStaged(home: string, name: string, cardId: string): StagedRecord | null;
+/** Stage an install (package), a link (folder) or a fetched git checkout. Raises a pending card; takes no effect. */
+declare function stageInstall(opts: StageOptions): StageResult;
+interface DecideOptions {
+    presenceToken: unknown;
+    /** MCP server names in the user's .mcp.json (COLLISION, re-checked at decide) */
+    userMcpServers?: readonly string[];
+    authority: RootAuthority;
+    emit?: ManifestEventSink;
+    now?: Date;
+}
+type LoadResult = {
+    state: 'ready';
+    name: string;
+    snapshotDir: string;
+    manifest: ManifestV2;
+    packageHash: string;
+    manifestHash: string;
+    tier: TrustTier | undefined;
+    readPaths: string[];
+    source: InstallSource;
+} | {
+    state: 'paused';
+    name: string;
+    reason: 'changed';
+    cardId: string | null;
+    files: TreeDiff;
+    snapshotDir: string;
+};
+interface LoadOptions {
+    home: string;
+    name: string;
+    trust: RowVerifier;
+    emit?: ManifestEventSink;
+    /** principal recorded on a re-approve card raised by a linked-folder change (the kernel) */
+    kernelPrincipal?: string;
+    /** MCP server names in the user's .mcp.json (COLLISION, re-checked at load) */
+    userMcpServers?: readonly string[];
+}
+/** Resolve what may load for a mod: from the pinned snapshot only, under its grants. */
+declare function loadMod(opts: LoadOptions): LoadResult;
+/** Linked folders of every effective install (the session profile's write denies, regenerated per spawn). */
+declare function linkedFolders(home: string, trust: RowVerifier): string[];
+
+/**
+ * @symbol #manifest-loader
+ *
+ * #manifest-loader public surface (spec §3.6). The install-card DECISION and
+ * the rollback are deliberately NOT exported: they live behind the internal
+ * seam channel until the M1.6 approval broker (install.ts header).
+ */
+
+declare const index_ALWAYS_ASK_TOOLS: typeof ALWAYS_ASK_TOOLS;
+declare const index_ANTHROPIC_DOMAINS: typeof ANTHROPIC_DOMAINS;
+declare const index_CLAUDE_SESSION_ENV: typeof CLAUDE_SESSION_ENV;
+declare const index_CLAUDE_SESSION_ENV_REL: typeof CLAUDE_SESSION_ENV_REL;
+declare const index_CLAUDE_TRANSCRIPTS_REL: typeof CLAUDE_TRANSCRIPTS_REL;
+declare const index_COMMAND_UNSAFE: typeof COMMAND_UNSAFE;
+declare const index_CREDENTIAL_READ_DENY: typeof CREDENTIAL_READ_DENY;
+type index_DecideOptions = DecideOptions;
+declare const index_ENGINES_MAX: typeof ENGINES_MAX;
+type index_EgressRefusalWhy = EgressRefusalWhy;
+type index_EgressVerdict = EgressVerdict;
+declare const index_FIRST_PARTY_MOD_NAMES: typeof FIRST_PARTY_MOD_NAMES;
+declare const index_FIRST_PARTY_ONLY_KINDS: typeof FIRST_PARTY_ONLY_KINDS;
+declare const index_FORMAT_1_SUPPORTED: typeof FORMAT_1_SUPPORTED;
+declare const index_FORMAT_INVARIANT_KEYS: typeof FORMAT_INVARIANT_KEYS;
+declare const index_GENERATED_DIRS: typeof GENERATED_DIRS;
+declare const index_GENERATED_FILES: typeof GENERATED_FILES;
+declare const index_GIT_HASH_SCHEMA: typeof GIT_HASH_SCHEMA;
+declare const index_GNOMON_REPO_DIR: typeof GNOMON_REPO_DIR;
+declare const index_GRANTS_FILE: typeof GRANTS_FILE;
+declare const index_GRANT_ROW_SCHEMA: typeof GRANT_ROW_SCHEMA;
+declare const index_GRANT_ROW_SCHEMA_V2: typeof GRANT_ROW_SCHEMA_V2;
+type index_GenerateReport = GenerateReport;
+type index_GeneratedRecord = GeneratedRecord;
+type index_GrantBindRow = GrantBindRow;
+type index_GrantCapabilityRow = GrantCapabilityRow;
+type index_GrantCheck = GrantCheck;
+type index_GrantEgressRow = GrantEgressRow;
+type index_GrantInstallRow = GrantInstallRow;
+type index_GrantPublisherRow = GrantPublisherRow;
+type index_GrantRow = GrantRow;
+type index_GrantRowInput = GrantRowInput;
+type index_GrantTrustRow = GrantTrustRow;
+type index_GrantUninstallRow = GrantUninstallRow;
+declare const index_HISTORICAL_FIRST_PARTY_PINS: typeof HISTORICAL_FIRST_PARTY_PINS;
+declare const index_HOME_READABLE_ROOTS: typeof HOME_READABLE_ROOTS;
+type index_HashInput = HashInput;
+type index_InstallCardDetail = InstallCardDetail;
+type index_InstallSource = InstallSource;
+declare const index_KERNEL_LOG_PATHS: typeof KERNEL_LOG_PATHS;
+declare const index_KERNEL_NAMESPACE_TOKENS: typeof KERNEL_NAMESPACE_TOKENS;
+declare const index_KERNEL_WORKTREES_REL: typeof KERNEL_WORKTREES_REL;
+declare const index_KNOWN_ABIS: typeof KNOWN_ABIS;
+declare const index_LAYERS_HASH_SCHEMA: typeof LAYERS_HASH_SCHEMA;
+declare const index_LEGACY_ALIASES: typeof LEGACY_ALIASES;
+declare const index_LIFECYCLE_INSTALL_SCRIPTS: typeof LIFECYCLE_INSTALL_SCRIPTS;
+type index_LayersInput = LayersInput;
+type index_LoadOptions = LoadOptions;
+type index_LoadResult = LoadResult;
+declare const index_MANIFEST_FILE: typeof MANIFEST_FILE;
+declare const index_MANIFEST_FORMATS_ACCEPTED: typeof MANIFEST_FORMATS_ACCEPTED;
+declare const index_MANIFEST_FORMAT_CURRENT: typeof MANIFEST_FORMAT_CURRENT;
+declare const index_MANIFEST_KINDS: typeof MANIFEST_KINDS;
+declare const index_MANIFEST_REFUSAL_CODES: typeof MANIFEST_REFUSAL_CODES;
+declare const index_MCP_CONFIG_LIMITS: typeof MCP_CONFIG_LIMITS;
+declare const index_MCP_ENV_DENY: typeof MCP_ENV_DENY;
+declare const index_MCP_ENV_DENY_PREFIXES: typeof MCP_ENV_DENY_PREFIXES;
+declare const index_MCP_ENV_NAME: typeof MCP_ENV_NAME;
+declare const index_MOD_ABI_V1: typeof MOD_ABI_V1;
+type index_ManifestCommand = ManifestCommand;
+type index_ManifestEgress = ManifestEgress;
+type index_ManifestEventSink = ManifestEventSink;
+type index_ManifestHook = ManifestHook;
+type index_ManifestKeybinding = ManifestKeybinding;
+type index_ManifestKind = ManifestKind;
+type index_ManifestKnowledge = ManifestKnowledge;
+type index_ManifestMcp = ManifestMcp;
+type index_ManifestMcpConfig = ManifestMcpConfig;
+type index_ManifestRefusal = ManifestRefusal;
+declare const index_ManifestRefusal: typeof ManifestRefusal;
+type index_ManifestRefusalCode = ManifestRefusalCode;
+type index_ManifestTool = ManifestTool;
+type index_ManifestV2 = ManifestV2;
+type index_ManifestView = ManifestView;
+type index_McpUserConfig = McpUserConfig;
+declare const index_NEVER_REQUESTABLE: typeof NEVER_REQUESTABLE;
+declare const index_NPM_LOCKFILES: typeof NPM_LOCKFILES;
+declare const index_OTHER_LOCKFILES: typeof OTHER_LOCKFILES;
+declare const index_PACKAGE_TREE_SCHEMA: typeof PACKAGE_TREE_SCHEMA;
+declare const index_PERSISTENCE_PATHS: typeof PERSISTENCE_PATHS;
+declare const index_PRIVATE_NAME_SUFFIXES: typeof PRIVATE_NAME_SUFFIXES;
+type index_PackageTree = PackageTree;
+type index_PathMatch = PathMatch;
+type index_PolicyPath = PolicyPath;
+declare const index_RECORD_SCHEMA: typeof RECORD_SCHEMA;
+declare const index_RESERVED_DECISION_KEYS: typeof RESERVED_DECISION_KEYS;
+declare const index_RESERVED_MOD_NAMES: typeof RESERVED_MOD_NAMES;
+type index_ReadManifestOptions = ReadManifestOptions;
+type index_ReadManifestResult = ReadManifestResult;
+type index_ResolvedGrants = ResolvedGrants;
+declare const index_SESSION_CACHE_ENV: typeof SESSION_CACHE_ENV;
+declare const index_SESSION_DENY_CLASSES: typeof SESSION_DENY_CLASSES;
+declare const index_SESSION_POLICY_SCHEMA: typeof SESSION_POLICY_SCHEMA;
+declare const index_SESSION_UUID_RE: typeof SESSION_UUID_RE;
+declare const index_STAGED_RECORD_SCHEMA: typeof STAGED_RECORD_SCHEMA;
+type index_SessionDenyClass = SessionDenyClass;
+type index_SessionPolicy = SessionPolicy;
+type index_SessionPolicyInput = SessionPolicyInput;
+type index_SnapshotRefusalReason = SnapshotRefusalReason;
+type index_SnapshotResult = SnapshotResult;
+type index_StageOptions = StageOptions;
+type index_StageResult = StageResult;
+type index_StagedRecord = StagedRecord;
+declare const index_TEXT_MARKER: typeof TEXT_MARKER;
+declare const index_TOOL_EFFECTS: typeof TOOL_EFFECTS;
+declare const index_TRUST_TIER_PATTERN: typeof TRUST_TIER_PATTERN;
+type index_ToolEffect = ToolEffect;
+type index_TreeDiff = TreeDiff;
+type index_TreeFile = TreeFile;
+type index_TrustTier = TrustTier;
+type index_UninstallReport = UninstallReport;
+type index_UnresolvablePath = UnresolvablePath;
+declare const index_UnresolvablePath: typeof UnresolvablePath;
+declare const index_VERSION_MAX: typeof VERSION_MAX;
+type index_ValidateManifestOptions = ValidateManifestOptions;
+declare const index_WIDENING_FIELDS: typeof WIDENING_FIELDS;
+declare const index_WRITE_CACHE_PATHS: typeof WRITE_CACHE_PATHS;
+declare const index_WRITE_TEMP_PATHS: typeof WRITE_TEMP_PATHS;
+type index_WalkEntry = WalkEntry;
+type index_WideningEntry = WideningEntry;
+type index_WideningField = WideningField;
+declare const index_aliasOf: typeof aliasOf;
+declare const index_appendGrantRow: typeof appendGrantRow;
+declare const index_appendSignedGrantRows: typeof appendSignedGrantRows;
+declare const index_buildGrantRow: typeof buildGrantRow;
+declare const index_buildGrantRows: typeof buildGrantRows;
+declare const index_buildSessionPolicy: typeof buildSessionPolicy;
+declare const index_canonicalManifestHash: typeof canonicalManifestHash;
+declare const index_capabilityForm: typeof capabilityForm;
+declare const index_checkAgainstGrants: typeof checkAgainstGrants;
+declare const index_checkEgressHost: typeof checkEgressHost;
+declare const index_checkGrantRow: typeof checkGrantRow;
+declare const index_claudePermissions: typeof claudePermissions;
+declare const index_collectGitInputs: typeof collectGitInputs;
+declare const index_collectLayerInputs: typeof collectLayerInputs;
+declare const index_compareVersions: typeof compareVersions;
+declare const index_computePackageHash: typeof computePackageHash;
+declare const index_defaultClaudeJson: typeof defaultClaudeJson;
+declare const index_detectWidening: typeof detectWidening;
+declare const index_diffTrees: typeof diffTrees;
+declare const index_digestInputs: typeof digestInputs;
+declare const index_effectiveInstall: typeof effectiveInstall;
+declare const index_enginesAdmit: typeof enginesAdmit;
+declare const index_gateClassPathRule: typeof gateClassPathRule;
+declare const index_generateRepo: typeof generateRepo;
+declare const index_gitHash: typeof gitHash;
+declare const index_grantsPath: typeof grantsPath;
+declare const index_hashHex: typeof hashHex;
+declare const index_hashPinnedTree: typeof hashPinnedTree;
+declare const index_hashSourceTree: typeof hashSourceTree;
+declare const index_isAnthropicHost: typeof isAnthropicHost;
+declare const index_isClosureName: typeof isClosureName;
+declare const index_isConfigNamedEnvFile: typeof isConfigNamedEnvFile;
+declare const index_isManifestRefusal: typeof isManifestRefusal;
+declare const index_layersHash: typeof layersHash;
+declare const index_linkedFolders: typeof linkedFolders;
+declare const index_loadMod: typeof loadMod;
+declare const index_localRunnerDenies: typeof localRunnerDenies;
+declare const index_manifestHash: typeof manifestHash;
+declare const index_mcpEnvOwnPrefix: typeof mcpEnvOwnPrefix;
+declare const index_modDir: typeof modDir;
+declare const index_newestPinMs: typeof newestPinMs;
+declare const index_noEvents: typeof noEvents;
+declare const index_normalizeContent: typeof normalizeContent;
+declare const index_normalizeHost: typeof normalizeHost;
+declare const index_normalizeLayerKey: typeof normalizeLayerKey;
+declare const index_ownsModKind: typeof ownsModKind;
+declare const index_parseEngines: typeof parseEngines;
+declare const index_pinDirKey: typeof pinDirKey;
+declare const index_pinnedDir: typeof pinnedDir;
+declare const index_policyHash: typeof policyHash;
+declare const index_readChecked: typeof readChecked;
+declare const index_readGrants: typeof readGrants;
+declare const index_readManifest: typeof readManifest;
+declare const index_readRecord: typeof readRecord;
+declare const index_readStaged: typeof readStaged;
+declare const index_realpathFollow: typeof realpathFollow;
+declare const index_realpathLoose: typeof realpathLoose;
+declare const index_recordPath: typeof recordPath;
+declare const index_removeTree: typeof removeTree;
+declare const index_renderGenerated: typeof renderGenerated;
+declare const index_resolveGitDirs: typeof resolveGitDirs;
+declare const index_resolveMcpLaunch: typeof resolveMcpLaunch;
+declare const index_rowsOfDecision: typeof rowsOfDecision;
+declare const index_snapshotFolder: typeof snapshotFolder;
+declare const index_stableJson: typeof stableJson;
+declare const index_stageInstall: typeof stageInstall;
+declare const index_uninstallHome: typeof uninstallHome;
+declare const index_uninstallRepo: typeof uninstallRepo;
+declare const index_upgradeManifestV1: typeof upgradeManifestV1;
+declare const index_userMcpServerNames: typeof userMcpServerNames;
+declare const index_userTempRoot: typeof userTempRoot;
+declare const index_validateManifest: typeof validateManifest;
+declare const index_validateMcpUserConfig: typeof validateMcpUserConfig;
+declare const index_verifiedGenerated: typeof verifiedGenerated;
+declare const index_walkSource: typeof walkSource;
+declare namespace index {
+  export { index_ALWAYS_ASK_TOOLS as ALWAYS_ASK_TOOLS, index_ANTHROPIC_DOMAINS as ANTHROPIC_DOMAINS, index_CLAUDE_SESSION_ENV as CLAUDE_SESSION_ENV, index_CLAUDE_SESSION_ENV_REL as CLAUDE_SESSION_ENV_REL, index_CLAUDE_TRANSCRIPTS_REL as CLAUDE_TRANSCRIPTS_REL, index_COMMAND_UNSAFE as COMMAND_UNSAFE, index_CREDENTIAL_READ_DENY as CREDENTIAL_READ_DENY, index_ENGINES_MAX as ENGINES_MAX, index_FIRST_PARTY_MOD_NAMES as FIRST_PARTY_MOD_NAMES, index_FIRST_PARTY_ONLY_KINDS as FIRST_PARTY_ONLY_KINDS, index_FORMAT_1_SUPPORTED as FORMAT_1_SUPPORTED, index_FORMAT_INVARIANT_KEYS as FORMAT_INVARIANT_KEYS, index_GENERATED_DIRS as GENERATED_DIRS, index_GENERATED_FILES as GENERATED_FILES, index_GIT_HASH_SCHEMA as GIT_HASH_SCHEMA, index_GNOMON_REPO_DIR as GNOMON_REPO_DIR, index_GRANTS_FILE as GRANTS_FILE, index_GRANT_ROW_SCHEMA as GRANT_ROW_SCHEMA, index_GRANT_ROW_SCHEMA_V2 as GRANT_ROW_SCHEMA_V2, index_HISTORICAL_FIRST_PARTY_PINS as HISTORICAL_FIRST_PARTY_PINS, index_HOME_READABLE_ROOTS as HOME_READABLE_ROOTS, index_KERNEL_LOG_PATHS as KERNEL_LOG_PATHS, index_KERNEL_NAMESPACE_TOKENS as KERNEL_NAMESPACE_TOKENS, index_KERNEL_WORKTREES_REL as KERNEL_WORKTREES_REL, index_KNOWN_ABIS as KNOWN_ABIS, index_LAYERS_HASH_SCHEMA as LAYERS_HASH_SCHEMA, index_LEGACY_ALIASES as LEGACY_ALIASES, index_LIFECYCLE_INSTALL_SCRIPTS as LIFECYCLE_INSTALL_SCRIPTS, index_MANIFEST_FILE as MANIFEST_FILE, index_MANIFEST_FORMATS_ACCEPTED as MANIFEST_FORMATS_ACCEPTED, index_MANIFEST_FORMAT_CURRENT as MANIFEST_FORMAT_CURRENT, index_MANIFEST_KINDS as MANIFEST_KINDS, index_MANIFEST_REFUSAL_CODES as MANIFEST_REFUSAL_CODES, index_MCP_CONFIG_LIMITS as MCP_CONFIG_LIMITS, index_MCP_ENV_DENY as MCP_ENV_DENY, index_MCP_ENV_DENY_PREFIXES as MCP_ENV_DENY_PREFIXES, index_MCP_ENV_NAME as MCP_ENV_NAME, index_MOD_ABI_V1 as MOD_ABI_V1, index_ManifestRefusal as ManifestRefusal, index_NEVER_REQUESTABLE as NEVER_REQUESTABLE, index_NPM_LOCKFILES as NPM_LOCKFILES, index_OTHER_LOCKFILES as OTHER_LOCKFILES, index_PACKAGE_TREE_SCHEMA as PACKAGE_TREE_SCHEMA, index_PERSISTENCE_PATHS as PERSISTENCE_PATHS, index_PRIVATE_NAME_SUFFIXES as PRIVATE_NAME_SUFFIXES, index_RECORD_SCHEMA as RECORD_SCHEMA, index_RESERVED_DECISION_KEYS as RESERVED_DECISION_KEYS, index_RESERVED_MOD_NAMES as RESERVED_MOD_NAMES, index_SESSION_CACHE_ENV as SESSION_CACHE_ENV, index_SESSION_DENY_CLASSES as SESSION_DENY_CLASSES, index_SESSION_POLICY_SCHEMA as SESSION_POLICY_SCHEMA, index_SESSION_UUID_RE as SESSION_UUID_RE, index_STAGED_RECORD_SCHEMA as STAGED_RECORD_SCHEMA, index_TEXT_MARKER as TEXT_MARKER, index_TOOL_EFFECTS as TOOL_EFFECTS, index_TRUST_TIER_PATTERN as TRUST_TIER_PATTERN, index_UnresolvablePath as UnresolvablePath, index_VERSION_MAX as VERSION_MAX, index_WIDENING_FIELDS as WIDENING_FIELDS, index_WRITE_CACHE_PATHS as WRITE_CACHE_PATHS, index_WRITE_TEMP_PATHS as WRITE_TEMP_PATHS, index_aliasOf as aliasOf, index_appendGrantRow as appendGrantRow, index_appendSignedGrantRows as appendSignedGrantRows, index_buildGrantRow as buildGrantRow, index_buildGrantRows as buildGrantRows, index_buildSessionPolicy as buildSessionPolicy, index_canonicalManifestHash as canonicalManifestHash, index_capabilityForm as capabilityForm, index_checkAgainstGrants as checkAgainstGrants, index_checkEgressHost as checkEgressHost, index_checkGrantRow as checkGrantRow, index_claudePermissions as claudePermissions, index_collectGitInputs as collectGitInputs, index_collectLayerInputs as collectLayerInputs, index_compareVersions as compareVersions, index_computePackageHash as computePackageHash, index_defaultClaudeJson as defaultClaudeJson, index_detectWidening as detectWidening, index_diffTrees as diffTrees, index_digestInputs as digestInputs, index_effectiveInstall as effectiveInstall, index_enginesAdmit as enginesAdmit, index_gateClassPathRule as gateClassPathRule, index_generateRepo as generateRepo, index_gitHash as gitHash, index_grantsPath as grantsPath, index_hashHex as hashHex, index_hashPinnedTree as hashPinnedTree, index_hashSourceTree as hashSourceTree, index_isAnthropicHost as isAnthropicHost, index_isClosureName as isClosureName, index_isConfigNamedEnvFile as isConfigNamedEnvFile, index_isManifestRefusal as isManifestRefusal, index_layersHash as layersHash, index_linkedFolders as linkedFolders, index_loadMod as loadMod, index_localRunnerDenies as localRunnerDenies, index_manifestHash as manifestHash, index_mcpEnvOwnPrefix as mcpEnvOwnPrefix, index_modDir as modDir, index_newestPinMs as newestPinMs, index_noEvents as noEvents, index_normalizeContent as normalizeContent, index_normalizeHost as normalizeHost, index_normalizeLayerKey as normalizeLayerKey, index_ownsModKind as ownsModKind, index_parseEngines as parseEngines, index_pinDirKey as pinDirKey, index_pinnedDir as pinnedDir, index_policyHash as policyHash, index_readChecked as readChecked, index_readGrants as readGrants, index_readManifest as readManifest, index_readRecord as readRecord, index_readStaged as readStaged, index_realpathFollow as realpathFollow, index_realpathLoose as realpathLoose, index_recordPath as recordPath, index_removeTree as removeTree, index_renderGenerated as renderGenerated, index_resolveGitDirs as resolveGitDirs, index_resolveMcpLaunch as resolveMcpLaunch, index_rowsOfDecision as rowsOfDecision, index_snapshotFolder as snapshotFolder, index_stableJson as stableJson, index_stageInstall as stageInstall, index_uninstallHome as uninstallHome, index_uninstallRepo as uninstallRepo, index_upgradeManifestV1 as upgradeManifestV1, index_userMcpServerNames as userMcpServerNames, index_userTempRoot as userTempRoot, index_validateManifest as validateManifest, index_validateMcpUserConfig as validateMcpUserConfig, index_verifiedGenerated as verifiedGenerated, index_walkSource as walkSource };
+  export type { index_DecideOptions as DecideOptions, index_EgressRefusalWhy as EgressRefusalWhy, index_EgressVerdict as EgressVerdict, index_GenerateReport as GenerateReport, index_GeneratedRecord as GeneratedRecord, index_GrantBindRow as GrantBindRow, index_GrantCapabilityRow as GrantCapabilityRow, index_GrantCheck as GrantCheck, index_GrantEgressRow as GrantEgressRow, index_GrantInstallRow as GrantInstallRow, index_GrantPublisherRow as GrantPublisherRow, index_GrantRow as GrantRow, index_GrantRowInput as GrantRowInput, index_GrantTrustRow as GrantTrustRow, index_GrantUninstallRow as GrantUninstallRow, index_HashInput as HashInput, index_InstallCardDetail as InstallCardDetail, index_InstallSource as InstallSource, index_LayersInput as LayersInput, index_LoadOptions as LoadOptions, index_LoadResult as LoadResult, index_ManifestCommand as ManifestCommand, index_ManifestEgress as ManifestEgress, index_ManifestEventSink as ManifestEventSink, index_ManifestHook as ManifestHook, index_ManifestKeybinding as ManifestKeybinding, index_ManifestKind as ManifestKind, index_ManifestKnowledge as ManifestKnowledge, index_ManifestMcp as ManifestMcp, index_ManifestMcpConfig as ManifestMcpConfig, index_ManifestRefusalCode as ManifestRefusalCode, index_ManifestTool as ManifestTool, index_ManifestV2 as ManifestV2, index_ManifestView as ManifestView, index_McpUserConfig as McpUserConfig, index_PackageTree as PackageTree, index_PathMatch as PathMatch, index_PolicyPath as PolicyPath, index_ReadManifestOptions as ReadManifestOptions, index_ReadManifestResult as ReadManifestResult, index_ResolvedGrants as ResolvedGrants, index_SessionDenyClass as SessionDenyClass, index_SessionPolicy as SessionPolicy, index_SessionPolicyInput as SessionPolicyInput, index_SnapshotRefusalReason as SnapshotRefusalReason, index_SnapshotResult as SnapshotResult, index_StageOptions as StageOptions, index_StageResult as StageResult, index_StagedRecord as StagedRecord, index_ToolEffect as ToolEffect, index_TreeDiff as TreeDiff, index_TreeFile as TreeFile, index_TrustTier as TrustTier, index_UninstallReport as UninstallReport, index_ValidateManifestOptions as ValidateManifestOptions, index_WalkEntry as WalkEntry, index_WideningEntry as WideningEntry, index_WideningField as WideningField };
+}
+
+/** The generated plugin's name: its items appear as `project:<name>`. */
+declare const REPO_CONTEXT_PLUGIN = "project";
+/** The child env that makes Claude load `--add-dir` memory (CLAUDE.md, .claude/CLAUDE.md, .claude/rules). */
+declare const REPO_CONTEXT_ENV: Readonly<Record<string, string>>;
+declare const SKILL_KEYS: readonly string[];
+declare const AGENT_KEYS: readonly string[];
+declare const COMMAND_KEYS: readonly string[];
+declare const MAX_CONTEXT_FILES = 1024;
+declare const MAX_CONTEXT_BYTES: number;
+declare const MAX_CONTEXT_FILE_BYTES: number;
+declare const MAX_TREE_DEPTH = 6;
+/**
+ * H2 (Aegis): Claude Code runs `!`cmd`` and ```! fenced blocks in skills and commands BEFORE the model sees them.
+ * Fail closed: a skill or command that contains either is not loaded, and the session's policy.json also sets
+ * REPO_CONTEXT_SETTINGS.disableSkillShellExecution (2.1.303: "Commands are replaced with a placeholder").
+ */
+declare function hasShellPreprocessing(text: string): boolean;
+/** Kernel settings merged into an audited session's policy.json (P8-D97, H2). */
+declare const REPO_CONTEXT_SETTINGS: Readonly<{
+    disableSkillShellExecution: true;
+}>;
+type SanitizeResult = {
+    ok: true;
+    text: string;
+    dropped: string[];
+    hooks: boolean;
+} | {
+    ok: false;
+    why: string;
+};
+/**
+ * Keep only the allowed top-level frontmatter keys (and their indented or `- ` continuation lines). Fail closed:
+ * anything that is not a plain `key:` line, a continuation, a blank or a comment refuses the whole file.
+ */
+declare function sanitizeFrontmatter(raw: string, allowed: readonly string[]): SanitizeResult;
+interface RepoContext {
+    /** the generated plugin dir, or null when the repo has no skill, agent or command to load */
+    pluginDir: string | null;
+    /** `--add-dir` targets for memory (outermost first), each passed by auditMemoryDir */
+    memoryDirs: string[];
+    /** F3: every in-repo `@` import target of the added memory dirs (existing or not): write-denied as literals */
+    importTargets: string[];
+    /** H1: memory dirs NOT added (relative to the git top-level), with why: a symlink, or an @ import leaving the repo */
+    memoryRefused: Array<{
+        dir: string;
+        why: string;
+    }>;
+    skills: string[];
+    agents: string[];
+    commands: string[];
+    /** repo-relative paths not loaded, with why */
+    refused: Array<{
+        path: string;
+        why: string;
+    }>;
+    /** repo-relative paths whose frontmatter lost keys (hooks, allowed-tools, permissionMode, unknown) */
+    dropped: Array<{
+        path: string;
+        keys: string[];
+    }>;
+    /** repo-relative paths whose frontmatter declared `hooks` (stripped: never run) */
+    frontmatterHooks: string[];
+}
+/**
+ * The memory chain: the cwd and its ancestors up to the git top-level (innermost first), never the user home or
+ * above; without a git top-level, the cwd alone. `top` bounds every `@` import (the git top-level, else the cwd).
+ */
+declare function memoryChainOf(cwd: string, userHome: string): {
+    chain: string[];
+    top: string;
+};
+/** The memory dirs that hold memory, outermost first (unaudited: buildRepoContext audits them). */
+declare function memoryDirsOf(cwd: string, userHome: string): string[];
+declare const MAX_IMPORT_DEPTH = 5;
+/**
+ * The `@` imports of a memory file, resolved the way Claude resolves them (`~/` = the user home). Code spans are NOT
+ * skipped (stricter than Claude). `refuse` is set when the file carries an entity-encoded `@` or an import token
+ * containing `%` (R2: no percent-encoded path tricks).
+ */
+declare function importAudit(text: string, file: string, userHome: string): {
+    targets: string[];
+    refuse: string | null;
+};
+/** The resolved import targets only (see importAudit). */
+declare function importTargets(text: string, file: string, userHome: string): string[];
+/** R1: the most directories one memory dir's subtree walk visits; past it the dir is refused (fail closed). */
+declare const MAX_SUBTREE_DIRS = 200000;
+/**
+ * R1 (Aegis): EVERY memory file in a memory dir's SUBTREE — Claude Code loads a subdirectory's CLAUDE.md lazily, when
+ * it reads files there. Collected in any letter case (APFS, NTFS): every `claude.md` at any depth (so
+ * `.claude/CLAUDE.md` too), and every `.md` under a `.claude/rules` dir. A symlink named `claude.md` or `.claude`, or
+ * anything symlinked inside `.claude/rules`, refuses; other symlinks are not followed. The VCS dir and `node_modules`
+ * dirs are skipped (dependency trees: 80% of a real repo's dirs; their CLAUDE.md is a residual, writes there stay
+ * denied by the `steering` match). An
+ * unreadable dir, or more than `maxDirs` dirs, refuses (fail closed).
+ */
+declare function memoryFilesUnder(dir: string, maxDirs?: number, top?: string): {
+    ok: true;
+    files: string[];
+    dirs: number;
+} | {
+    ok: false;
+    why: string;
+};
+/**
+ * H1 (Aegis): audit one memory dir in the KERNEL. Refused (the whole dir is not added) when any memory file is a
+ * symlink, unreadable or oversized, or when any `@` import followed recursively (depth MAX_IMPORT_DEPTH, `~`,
+ * absolute and relative forms) names an existing path outside `top`, or a symlink. A target that does not exist is
+ * nothing Claude can load and is ignored.
+ */
+/** F3: the most distinct in-repo import targets one memory dir may name (each becomes a write-deny literal). */
+declare const MAX_IMPORT_TARGETS = 4096;
+declare function auditMemoryDir(dir: string, top: string, userHome: string, maxDirs?: number, walked?: {
+    ok: true;
+    files: string[];
+}): {
+    ok: true;
+    imports: string[];
+} | {
+    ok: false;
+    why: string;
+};
+/**
+ * Build the session's repo context: the memory dirs and the generated plugin under `outDir` (wiped first).
+ * Reads only `<cwd>/.claude/{skills,agents,commands}` and the memory files' presence; writes only under outDir.
+ */
+declare function buildRepoContext(i: {
+    cwd: string;
+    userHome: string;
+    outDir: string;
+    maxSubtreeDirs?: number;
+}): RepoContext;
+/** What the repo's settings layers carry besides hooks: NOT loaded (P8-D97), reported only. Never a value. */
+interface RepoSettingsInfo {
+    files: string[];
+    permissions: {
+        allow: number;
+        ask: number;
+        deny: number;
+        other: string[];
+    };
+    envKeys: string[];
+    otherKeys: string[];
+    unreadable: string[];
+}
+declare function repoSettingsInfo(roots: readonly string[]): RepoSettingsInfo;
+/** The informational card lines (kernel-composed, bounded): empty when the repo sets nothing besides hooks. */
+declare function repoSettingsLines(info: RepoSettingsInfo): string[];
+/** The `gate-class.detected{what:'repo-context'}` payload (names and counts only, bounded). */
+declare function repoContextRow(hsid: string, ctx: RepoContext, info: RepoSettingsInfo): Record<string, unknown>;
+/** The repo-card lines about the context (kernel-composed): what memory and which items were refused. */
+declare function repoContextLines(ctx: RepoContext): string[];
+
+declare const repoContext_AGENT_KEYS: typeof AGENT_KEYS;
+declare const repoContext_COMMAND_KEYS: typeof COMMAND_KEYS;
+declare const repoContext_MAX_CONTEXT_BYTES: typeof MAX_CONTEXT_BYTES;
+declare const repoContext_MAX_CONTEXT_FILES: typeof MAX_CONTEXT_FILES;
+declare const repoContext_MAX_CONTEXT_FILE_BYTES: typeof MAX_CONTEXT_FILE_BYTES;
+declare const repoContext_MAX_IMPORT_DEPTH: typeof MAX_IMPORT_DEPTH;
+declare const repoContext_MAX_IMPORT_TARGETS: typeof MAX_IMPORT_TARGETS;
+declare const repoContext_MAX_SUBTREE_DIRS: typeof MAX_SUBTREE_DIRS;
+declare const repoContext_MAX_TREE_DEPTH: typeof MAX_TREE_DEPTH;
+declare const repoContext_REPO_CONTEXT_ENV: typeof REPO_CONTEXT_ENV;
+declare const repoContext_REPO_CONTEXT_PLUGIN: typeof REPO_CONTEXT_PLUGIN;
+declare const repoContext_REPO_CONTEXT_SETTINGS: typeof REPO_CONTEXT_SETTINGS;
+type repoContext_RepoContext = RepoContext;
+type repoContext_RepoSettingsInfo = RepoSettingsInfo;
+declare const repoContext_SKILL_KEYS: typeof SKILL_KEYS;
+type repoContext_SanitizeResult = SanitizeResult;
+declare const repoContext_auditMemoryDir: typeof auditMemoryDir;
+declare const repoContext_buildRepoContext: typeof buildRepoContext;
+declare const repoContext_hasShellPreprocessing: typeof hasShellPreprocessing;
+declare const repoContext_importAudit: typeof importAudit;
+declare const repoContext_importTargets: typeof importTargets;
+declare const repoContext_memoryChainOf: typeof memoryChainOf;
+declare const repoContext_memoryDirsOf: typeof memoryDirsOf;
+declare const repoContext_memoryFilesUnder: typeof memoryFilesUnder;
+declare const repoContext_repoContextLines: typeof repoContextLines;
+declare const repoContext_repoContextRow: typeof repoContextRow;
+declare const repoContext_repoSettingsInfo: typeof repoSettingsInfo;
+declare const repoContext_repoSettingsLines: typeof repoSettingsLines;
+declare const repoContext_sanitizeFrontmatter: typeof sanitizeFrontmatter;
+declare namespace repoContext {
+  export { repoContext_AGENT_KEYS as AGENT_KEYS, repoContext_COMMAND_KEYS as COMMAND_KEYS, repoContext_MAX_CONTEXT_BYTES as MAX_CONTEXT_BYTES, repoContext_MAX_CONTEXT_FILES as MAX_CONTEXT_FILES, repoContext_MAX_CONTEXT_FILE_BYTES as MAX_CONTEXT_FILE_BYTES, repoContext_MAX_IMPORT_DEPTH as MAX_IMPORT_DEPTH, repoContext_MAX_IMPORT_TARGETS as MAX_IMPORT_TARGETS, repoContext_MAX_SUBTREE_DIRS as MAX_SUBTREE_DIRS, repoContext_MAX_TREE_DEPTH as MAX_TREE_DEPTH, repoContext_REPO_CONTEXT_ENV as REPO_CONTEXT_ENV, repoContext_REPO_CONTEXT_PLUGIN as REPO_CONTEXT_PLUGIN, repoContext_REPO_CONTEXT_SETTINGS as REPO_CONTEXT_SETTINGS, repoContext_SKILL_KEYS as SKILL_KEYS, repoContext_auditMemoryDir as auditMemoryDir, repoContext_buildRepoContext as buildRepoContext, repoContext_hasShellPreprocessing as hasShellPreprocessing, repoContext_importAudit as importAudit, repoContext_importTargets as importTargets, repoContext_memoryChainOf as memoryChainOf, repoContext_memoryDirsOf as memoryDirsOf, repoContext_memoryFilesUnder as memoryFilesUnder, repoContext_repoContextLines as repoContextLines, repoContext_repoContextRow as repoContextRow, repoContext_repoSettingsInfo as repoSettingsInfo, repoContext_repoSettingsLines as repoSettingsLines, repoContext_sanitizeFrontmatter as sanitizeFrontmatter };
+  export type { repoContext_RepoContext as RepoContext, repoContext_RepoSettingsInfo as RepoSettingsInfo, repoContext_SanitizeResult as SanitizeResult };
+}
+
+declare const REPO_HOOK_FILES: readonly [{
+    readonly source: "project";
+    readonly rel: readonly [".claude", "settings.json"];
+}, {
+    readonly source: "local";
+    readonly rel: readonly [".claude", "settings.local.json"];
+}];
+declare const MAX_SETTINGS_BYTES: number;
+declare const MAX_REPO_HOOKS = 64;
+/** pending (raised, undecided) cards remembered per process; the oldest is forgotten past this (re-raised on the next open) */
+declare const MAX_PENDING_HOOK_CARDS = 256;
+interface RepoHook {
+    hookId: string;
+    source: 'project' | 'local';
+    event: string;
+    matcher: string | null;
+    command: string;
+    timeout: number | null;
+}
+type RepoHookSet = {
+    status: 'none';
+    repoKey: string;
+    setHash: null;
+    hooks: [];
+    refused: [];
+} | {
+    status: 'ok';
+    repoKey: string;
+    setHash: string;
+    hooks: RepoHook[];
+    refused: string[];
+} | {
+    status: 'unreadable' | 'too-many';
+    repoKey: string;
+    setHash: null;
+    hooks: [];
+    refused: [];
+    why: string;
+};
+/** The session roots realpath'd and deduped (a worktree equal to cwd counts once). */
+declare function uniqueRoots(roots: readonly string[]): string[];
+/** One key per repo root (realpath'd, deduped cwd + worktree). */
+declare function repoKeyOf(roots: readonly string[]): string;
+/**
+ * The hook events Claude Code supports (Aegis C1): anything else is refused,
+ * so no repo-controlled name ever becomes a key the kernel did not expect.
+ */
+declare const CLAUDE_HOOK_EVENTS: readonly string[];
+/** refused hook ids carried on a gate-class.detected row (the set is bounded by MAX_REPO_HOOKS too) */
+declare const MAX_REFUSED_LOGGED = 64;
+/** Read one settings layer: O_NOFOLLOW + fstat (no symlink, a regular file, bounded). null = absent. */
+declare function readLayer(file: string): {
+    ok: true;
+    text: string;
+} | {
+    ok: false;
+    why: string;
+} | null;
+/** Extract the repo hooks of the session roots (strict, fail closed). Pure but for reading the two settings files per root. */
+declare function extractRepoHooks(roots: readonly string[]): RepoHookSet;
+/** The approved hooks as a Claude settings `hooks` block (merged into the session's policy.json). */
+declare function hooksBlock(approved: readonly RepoHook[]): Record<string, Array<{
+    matcher?: string;
+    hooks: Array<{
+        type: 'command';
+        command: string;
+        timeout?: number;
+    }>;
+}>>;
+/** Merge two settings `hooks` blocks (generated first, then approved repo hooks). */
+declare function mergeHooks(a: unknown, b: Record<string, unknown[]>): Record<string, unknown[]>;
+/** Aegis C2: the kernel's warning line on every repo-hook card. */
+declare const REPO_HOOK_WARNING = "approving trusts the command and every file it runs; a repo change, a pull, or a session edit can change what runs";
+/** The card for one hook: the install-card rendering (count line first, one line for the hook, never cut). */
+/** Hook events whose hook can answer a tool permission itself (p01b (i)), so the card warns about it. */
+declare const TOOL_APPROVING_EVENTS: readonly string[];
+declare const TOOL_APPROVAL_WARNING = "This hook can approve tool uses with no card: a PreToolUse or PermissionRequest hook that answers allow runs the tool without asking you (P8-D96).";
+declare function repoHookCard(set: Extract<RepoHookSet, {
+    status: 'ok';
+}>, h: RepoHook, root: string, info?: readonly string[]): {
+    detail: Record<string, unknown>;
+    lines: string[];
+    block: Record<string, unknown>;
+};
+/** A chain row as the decision reader sees it (a full-view event). */
+interface DecisionRow {
+    principal: string;
+    keyId?: unknown;
+    payload?: unknown;
+}
+/**
+ * P8-D94: the human's per-hook decisions for (repoKey, setHash), read back from the chain. Only KERNEL-signed
+ * rows count (principal === the kernel principal AND keyId a kernel key): a forged `gate-class.decided` from
+ * any other principal or key is ignored. The last decision per hook wins.
+ */
+declare function repoHookDecisionsFrom(rows: Iterable<DecisionRow>, kernel: {
+    principal: string;
+    isKernelKey: (keyId: string) => boolean;
+}, repoKey: string, setHash: string): Map<string, 'allow' | 'deny'>;
+
+declare const repoHooks_CLAUDE_HOOK_EVENTS: typeof CLAUDE_HOOK_EVENTS;
+type repoHooks_DecisionRow = DecisionRow;
+declare const repoHooks_MAX_PENDING_HOOK_CARDS: typeof MAX_PENDING_HOOK_CARDS;
+declare const repoHooks_MAX_REFUSED_LOGGED: typeof MAX_REFUSED_LOGGED;
+declare const repoHooks_MAX_REPO_HOOKS: typeof MAX_REPO_HOOKS;
+declare const repoHooks_MAX_SETTINGS_BYTES: typeof MAX_SETTINGS_BYTES;
+declare const repoHooks_REPO_HOOK_FILES: typeof REPO_HOOK_FILES;
+declare const repoHooks_REPO_HOOK_WARNING: typeof REPO_HOOK_WARNING;
+type repoHooks_RepoHook = RepoHook;
+type repoHooks_RepoHookSet = RepoHookSet;
+declare const repoHooks_TOOL_APPROVAL_WARNING: typeof TOOL_APPROVAL_WARNING;
+declare const repoHooks_TOOL_APPROVING_EVENTS: typeof TOOL_APPROVING_EVENTS;
+declare const repoHooks_extractRepoHooks: typeof extractRepoHooks;
+declare const repoHooks_hooksBlock: typeof hooksBlock;
+declare const repoHooks_mergeHooks: typeof mergeHooks;
+declare const repoHooks_readLayer: typeof readLayer;
+declare const repoHooks_repoHookCard: typeof repoHookCard;
+declare const repoHooks_repoHookDecisionsFrom: typeof repoHookDecisionsFrom;
+declare const repoHooks_repoKeyOf: typeof repoKeyOf;
+declare const repoHooks_uniqueRoots: typeof uniqueRoots;
+declare namespace repoHooks {
+  export { repoHooks_CLAUDE_HOOK_EVENTS as CLAUDE_HOOK_EVENTS, repoHooks_MAX_PENDING_HOOK_CARDS as MAX_PENDING_HOOK_CARDS, repoHooks_MAX_REFUSED_LOGGED as MAX_REFUSED_LOGGED, repoHooks_MAX_REPO_HOOKS as MAX_REPO_HOOKS, repoHooks_MAX_SETTINGS_BYTES as MAX_SETTINGS_BYTES, repoHooks_REPO_HOOK_FILES as REPO_HOOK_FILES, repoHooks_REPO_HOOK_WARNING as REPO_HOOK_WARNING, repoHooks_TOOL_APPROVAL_WARNING as TOOL_APPROVAL_WARNING, repoHooks_TOOL_APPROVING_EVENTS as TOOL_APPROVING_EVENTS, repoHooks_extractRepoHooks as extractRepoHooks, repoHooks_hooksBlock as hooksBlock, repoHooks_mergeHooks as mergeHooks, repoHooks_readLayer as readLayer, repoHooks_repoHookCard as repoHookCard, repoHooks_repoHookDecisionsFrom as repoHookDecisionsFrom, repoHooks_repoKeyOf as repoKeyOf, repoHooks_uniqueRoots as uniqueRoots };
+  export type { repoHooks_DecisionRow as DecisionRow, repoHooks_RepoHook as RepoHook, repoHooks_RepoHookSet as RepoHookSet };
+}
+
+/**
+ * The voice-io floor (T-2026-10-21-028): the copy must answer `--version` with at least this. Every security-relevant
+ * voice-io fix bumps voiceIOVersion (packages/gnomon-voice/io-darwin/Sources/VoiceIOCore/Frame.swift) and raises this
+ * floor with it, like MIN_HELPER_VERSION (identity/helper.ts): the floor is what refuses an older, validly signed copy.
+ */
+declare const MIN_VOICE_IO_VERSION = "0.1.0";
+/**
+ * The sha256 a release build pins for voice-io on this arch; undefined in a dev build (signature + version floor
+ * only). Refuses (`checksum` / `version`) when the release cannot pin it: no entry for this arch, a broken stamp, a
+ * different signing requirement than VOICE_IO_REQUIREMENT, or a pinned version below the floor.
+ */
+declare function releaseVoiceIoSha256(pins: ReleasePins, arch?: string): string | undefined;
+
+declare const LOOPS_DISABLED_REASON = "loops-disabled";
+declare const LOOPS_DISABLED_MESSAGE = "Loops are off in this build. They arrive in Gnomon 8.1.";
+declare const LOOPS_DISABLED_STATUS_REASON = "not-in-this-build";
+interface LoopsGateInput {
+    /** the compiled release define is present (default: this bundle's own) */
+    release?: boolean;
+    env?: Readonly<Record<string, string | undefined>>;
+}
+/** Are loops enabled in this process? Pure given its inputs; the daemon calls it once at boot. */
+declare function resolveLoopsEnabled(i?: LoopsGateInput): boolean;
+
+declare const gate_LOOPS_DISABLED_MESSAGE: typeof LOOPS_DISABLED_MESSAGE;
+declare const gate_LOOPS_DISABLED_REASON: typeof LOOPS_DISABLED_REASON;
+declare const gate_LOOPS_DISABLED_STATUS_REASON: typeof LOOPS_DISABLED_STATUS_REASON;
+type gate_LoopsGateInput = LoopsGateInput;
+declare const gate_resolveLoopsEnabled: typeof resolveLoopsEnabled;
+declare namespace gate {
+  export { gate_LOOPS_DISABLED_MESSAGE as LOOPS_DISABLED_MESSAGE, gate_LOOPS_DISABLED_REASON as LOOPS_DISABLED_REASON, gate_LOOPS_DISABLED_STATUS_REASON as LOOPS_DISABLED_STATUS_REASON, gate_resolveLoopsEnabled as resolveLoopsEnabled };
+  export type { gate_LoopsGateInput as LoopsGateInput };
+}
+
+type AppZipRefusal = 'dev' | 'broken' | 'unpinned' | 'missing' | 'checksum';
+declare class AppZipRefused extends Error {
+    readonly reason: AppZipRefusal;
+    constructor(reason: AppZipRefusal, message: string);
+}
+/** The sha256 this build accepts for `arch`'s published zip, or the refusal. */
+declare function appZipPin(pins: ReleasePins, arch: string): {
+    kind: 'pinned';
+    sha256: string;
+} | {
+    kind: 'refuse';
+    reason: AppZipRefusal;
+    why: string;
+};
+/** Streamed sha256 of a file (the zip is tens of MB). */
+declare function sha256OfFile(file: string): string;
+/**
+ * The installed @a-company/gnomon-darwin-<arch> zip, resolved from `from` (this module by default). Refused `missing`
+ * when npm skipped the package or the resolved package.json is not that package.
+ */
+declare function platformPackageZip(arch: string, from?: string): string;
+/** Refuse unless `zipPath` hashes to the sha256 compiled into this build for `arch`. Returns the digest. */
+declare function verifyAppZip(zipPath: string, { arch, pins }?: {
+    arch?: string;
+    pins?: ReleasePins;
+}): string;
+
+type appZip_AppZipRefusal = AppZipRefusal;
+type appZip_AppZipRefused = AppZipRefused;
+declare const appZip_AppZipRefused: typeof AppZipRefused;
+declare const appZip_appZipPin: typeof appZipPin;
+declare const appZip_platformPackageZip: typeof platformPackageZip;
+declare const appZip_sha256OfFile: typeof sha256OfFile;
+declare const appZip_verifyAppZip: typeof verifyAppZip;
+declare namespace appZip {
+  export { appZip_AppZipRefused as AppZipRefused, appZip_appZipPin as appZipPin, appZip_platformPackageZip as platformPackageZip, appZip_sha256OfFile as sha256OfFile, appZip_verifyAppZip as verifyAppZip };
+  export type { appZip_AppZipRefusal as AppZipRefusal };
+}
+
+export { CLAUDE_CODE_PLATFORMS, GNOMON_VERSION, HELPER_REQUIREMENT, KERNEL_ALLOWED_PACKAGE, KERNEL_MODULES, MIN_HELPER_VERSION, MIN_VOICE_IO_VERSION, appZip, binaryDenies, bundledRunner, adapter as claudeAdapter, index$1 as kernelLog, gate as loopsGate, index as manifestLoader, pinHelper, releaseHelperSha256, releasePins, releaseVoiceIoSha256, repoContext, repoHooks, session as sessionSandbox };
+export type { KernelModule };