@aigrc/core 0.1.0 → 0.2.0

package/dist/schemas/index.d.ts

@@ -1209,6 +1209,1827 @@ declare const ConstraintsSchema: z.ZodObject<{
     } | undefined;
 }>;
 type Constraints = z.infer<typeof ConstraintsSchema>;
+declare const RiskLevelSchema: z.ZodEnum<["minimal", "limited", "high", "unacceptable"]>;
+type RiskLevel = z.infer<typeof RiskLevelSchema>;
+declare const GoldenThreadSchema: z.ZodObject<{
+    /** Ticket ID from approval system (e.g., "FIN-1234") */
+    ticket_id: z.ZodString;
+    /** Email of approver (e.g., "ciso@corp.com") */
+    approved_by: z.ZodString;
+    /** ISO 8601 timestamp of approval (e.g., "2025-01-15T10:30:00Z") */
+    approved_at: z.ZodString;
+    /** SHA-256 hash of canonical string: sha256:{64 hex chars} */
+    hash: z.ZodOptional<z.ZodString>;
+    /** Optional cryptographic signature: {ALGORITHM}:{BASE64_SIGNATURE} */
+    signature: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    ticket_id: string;
+    approved_by: string;
+    approved_at: string;
+    hash?: string | undefined;
+    signature?: string | undefined;
+}, {
+    ticket_id: string;
+    approved_by: string;
+    approved_at: string;
+    hash?: string | undefined;
+    signature?: string | undefined;
+}>;
+type GoldenThread = z.infer<typeof GoldenThreadSchema>;
+declare const LineageSchema: z.ZodObject<{
+    /** Parent agent's instance_id, null for root agents */
+    parent_instance_id: z.ZodNullable<z.ZodString>;
+    /** Depth in spawn tree: 0 for root, 1 for first child, etc. */
+    generation_depth: z.ZodNumber;
+    /** Chain of ancestor instance_ids from root to parent */
+    ancestor_chain: z.ZodArray<z.ZodString, "many">;
+    /** When this agent was spawned */
+    spawned_at: z.ZodString;
+    /** Root agent's instance_id for tracing entire tree */
+    root_instance_id: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    parent_instance_id: string | null;
+    generation_depth: number;
+    ancestor_chain: string[];
+    spawned_at: string;
+    root_instance_id: string;
+}, {
+    parent_instance_id: string | null;
+    generation_depth: number;
+    ancestor_chain: string[];
+    spawned_at: string;
+    root_instance_id: string;
+}>;
+type Lineage = z.infer<typeof LineageSchema>;
+declare const CapabilitiesManifestSchema: z.ZodObject<{
+    /** List of allowed tool/action identifiers (supports wildcards: *, prefix_*) */
+    allowed_tools: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** List of explicitly denied tools (takes precedence over allowed) */
+    denied_tools: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Allowed domain patterns (regex) for external resources */
+    allowed_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Denied domain patterns (takes precedence over allowed) */
+    denied_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Maximum cost per session in USD */
+    max_cost_per_session: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    /** Maximum cost per day in USD */
+    max_cost_per_day: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    /** Maximum tokens per single API call */
+    max_tokens_per_call: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    /** Whether this agent can spawn child agents */
+    may_spawn_children: z.ZodDefault<z.ZodBoolean>;
+    /** Maximum depth of child agent spawning (0 = cannot spawn) */
+    max_child_depth: z.ZodDefault<z.ZodNumber>;
+    /** Capability decay mode for children: decay, explicit, inherit */
+    capability_mode: z.ZodDefault<z.ZodEnum<["decay", "explicit", "inherit"]>>;
+    /** Custom extension fields */
+    custom: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    allowed_tools: string[];
+    denied_tools: string[];
+    allowed_domains: string[];
+    denied_domains: string[];
+    may_spawn_children: boolean;
+    max_child_depth: number;
+    capability_mode: "decay" | "explicit" | "inherit";
+    custom?: Record<string, unknown> | undefined;
+    max_cost_per_session?: number | null | undefined;
+    max_cost_per_day?: number | null | undefined;
+    max_tokens_per_call?: number | null | undefined;
+}, {
+    custom?: Record<string, unknown> | undefined;
+    allowed_tools?: string[] | undefined;
+    denied_tools?: string[] | undefined;
+    allowed_domains?: string[] | undefined;
+    denied_domains?: string[] | undefined;
+    max_cost_per_session?: number | null | undefined;
+    max_cost_per_day?: number | null | undefined;
+    max_tokens_per_call?: number | null | undefined;
+    may_spawn_children?: boolean | undefined;
+    max_child_depth?: number | undefined;
+    capability_mode?: "decay" | "explicit" | "inherit" | undefined;
+}>;
+type CapabilitiesManifest = z.infer<typeof CapabilitiesManifestSchema>;
+declare const OperatingModeSchema: z.ZodEnum<["NORMAL", "SANDBOX", "RESTRICTED"]>;
+type OperatingMode = z.infer<typeof OperatingModeSchema>;
+declare const RuntimeIdentitySchema: z.ZodObject<{
+    /** Unique UUIDv4 for this runtime instance */
+    instance_id: z.ZodString;
+    /** Asset ID from the Asset Card (e.g., "aigrc-2024-a1b2c3d4") */
+    asset_id: z.ZodString;
+    /** Human-readable name from Asset Card */
+    asset_name: z.ZodString;
+    /** Semantic version from Asset Card */
+    asset_version: z.ZodString;
+    /** SHA-256 hash of Golden Thread data */
+    golden_thread_hash: z.ZodString;
+    /** Full Golden Thread authorization data */
+    golden_thread: z.ZodObject<{
+        /** Ticket ID from approval system (e.g., "FIN-1234") */
+        ticket_id: z.ZodString;
+        /** Email of approver (e.g., "ciso@corp.com") */
+        approved_by: z.ZodString;
+        /** ISO 8601 timestamp of approval (e.g., "2025-01-15T10:30:00Z") */
+        approved_at: z.ZodString;
+        /** SHA-256 hash of canonical string: sha256:{64 hex chars} */
+        hash: z.ZodOptional<z.ZodString>;
+        /** Optional cryptographic signature: {ALGORITHM}:{BASE64_SIGNATURE} */
+        signature: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        ticket_id: string;
+        approved_by: string;
+        approved_at: string;
+        hash?: string | undefined;
+        signature?: string | undefined;
+    }, {
+        ticket_id: string;
+        approved_by: string;
+        approved_at: string;
+        hash?: string | undefined;
+        signature?: string | undefined;
+    }>;
+    /** Risk level from classification */
+    risk_level: z.ZodEnum<["minimal", "limited", "high", "unacceptable"]>;
+    /** Agent lineage for spawned agents */
+    lineage: z.ZodObject<{
+        /** Parent agent's instance_id, null for root agents */
+        parent_instance_id: z.ZodNullable<z.ZodString>;
+        /** Depth in spawn tree: 0 for root, 1 for first child, etc. */
+        generation_depth: z.ZodNumber;
+        /** Chain of ancestor instance_ids from root to parent */
+        ancestor_chain: z.ZodArray<z.ZodString, "many">;
+        /** When this agent was spawned */
+        spawned_at: z.ZodString;
+        /** Root agent's instance_id for tracing entire tree */
+        root_instance_id: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        parent_instance_id: string | null;
+        generation_depth: number;
+        ancestor_chain: string[];
+        spawned_at: string;
+        root_instance_id: string;
+    }, {
+        parent_instance_id: string | null;
+        generation_depth: number;
+        ancestor_chain: string[];
+        spawned_at: string;
+        root_instance_id: string;
+    }>;
+    /** Capabilities manifest defining permissions */
+    capabilities_manifest: z.ZodObject<{
+        /** List of allowed tool/action identifiers (supports wildcards: *, prefix_*) */
+        allowed_tools: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        /** List of explicitly denied tools (takes precedence over allowed) */
+        denied_tools: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        /** Allowed domain patterns (regex) for external resources */
+        allowed_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        /** Denied domain patterns (takes precedence over allowed) */
+        denied_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        /** Maximum cost per session in USD */
+        max_cost_per_session: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        /** Maximum cost per day in USD */
+        max_cost_per_day: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        /** Maximum tokens per single API call */
+        max_tokens_per_call: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        /** Whether this agent can spawn child agents */
+        may_spawn_children: z.ZodDefault<z.ZodBoolean>;
+        /** Maximum depth of child agent spawning (0 = cannot spawn) */
+        max_child_depth: z.ZodDefault<z.ZodNumber>;
+        /** Capability decay mode for children: decay, explicit, inherit */
+        capability_mode: z.ZodDefault<z.ZodEnum<["decay", "explicit", "inherit"]>>;
+        /** Custom extension fields */
+        custom: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, "strip", z.ZodTypeAny, {
+        allowed_tools: string[];
+        denied_tools: string[];
+        allowed_domains: string[];
+        denied_domains: string[];
+        may_spawn_children: boolean;
+        max_child_depth: number;
+        capability_mode: "decay" | "explicit" | "inherit";
+        custom?: Record<string, unknown> | undefined;
+        max_cost_per_session?: number | null | undefined;
+        max_cost_per_day?: number | null | undefined;
+        max_tokens_per_call?: number | null | undefined;
+    }, {
+        custom?: Record<string, unknown> | undefined;
+        allowed_tools?: string[] | undefined;
+        denied_tools?: string[] | undefined;
+        allowed_domains?: string[] | undefined;
+        denied_domains?: string[] | undefined;
+        max_cost_per_session?: number | null | undefined;
+        max_cost_per_day?: number | null | undefined;
+        max_tokens_per_call?: number | null | undefined;
+        may_spawn_children?: boolean | undefined;
+        max_child_depth?: number | undefined;
+        capability_mode?: "decay" | "explicit" | "inherit" | undefined;
+    }>;
+    /** When this identity was created */
+    created_at: z.ZodString;
+    /** Whether Golden Thread hash has been verified */
+    verified: z.ZodDefault<z.ZodBoolean>;
+    /** Current operating mode */
+    mode: z.ZodDefault<z.ZodEnum<["NORMAL", "SANDBOX", "RESTRICTED"]>>;
+}, "strip", z.ZodTypeAny, {
+    instance_id: string;
+    asset_id: string;
+    asset_name: string;
+    asset_version: string;
+    golden_thread_hash: string;
+    golden_thread: {
+        ticket_id: string;
+        approved_by: string;
+        approved_at: string;
+        hash?: string | undefined;
+        signature?: string | undefined;
+    };
+    risk_level: "minimal" | "limited" | "high" | "unacceptable";
+    lineage: {
+        parent_instance_id: string | null;
+        generation_depth: number;
+        ancestor_chain: string[];
+        spawned_at: string;
+        root_instance_id: string;
+    };
+    capabilities_manifest: {
+        allowed_tools: string[];
+        denied_tools: string[];
+        allowed_domains: string[];
+        denied_domains: string[];
+        may_spawn_children: boolean;
+        max_child_depth: number;
+        capability_mode: "decay" | "explicit" | "inherit";
+        custom?: Record<string, unknown> | undefined;
+        max_cost_per_session?: number | null | undefined;
+        max_cost_per_day?: number | null | undefined;
+        max_tokens_per_call?: number | null | undefined;
+    };
+    created_at: string;
+    verified: boolean;
+    mode: "NORMAL" | "SANDBOX" | "RESTRICTED";
+}, {
+    instance_id: string;
+    asset_id: string;
+    asset_name: string;
+    asset_version: string;
+    golden_thread_hash: string;
+    golden_thread: {
+        ticket_id: string;
+        approved_by: string;
+        approved_at: string;
+        hash?: string | undefined;
+        signature?: string | undefined;
+    };
+    risk_level: "minimal" | "limited" | "high" | "unacceptable";
+    lineage: {
+        parent_instance_id: string | null;
+        generation_depth: number;
+        ancestor_chain: string[];
+        spawned_at: string;
+        root_instance_id: string;
+    };
+    capabilities_manifest: {
+        custom?: Record<string, unknown> | undefined;
+        allowed_tools?: string[] | undefined;
+        denied_tools?: string[] | undefined;
+        allowed_domains?: string[] | undefined;
+        denied_domains?: string[] | undefined;
+        max_cost_per_session?: number | null | undefined;
+        max_cost_per_day?: number | null | undefined;
+        max_tokens_per_call?: number | null | undefined;
+        may_spawn_children?: boolean | undefined;
+        max_child_depth?: number | undefined;
+        capability_mode?: "decay" | "explicit" | "inherit" | undefined;
+    };
+    created_at: string;
+    verified?: boolean | undefined;
+    mode?: "NORMAL" | "SANDBOX" | "RESTRICTED" | undefined;
+}>;
+type RuntimeIdentity = z.infer<typeof RuntimeIdentitySchema>;
+declare const KillSwitchCommandTypeSchema: z.ZodEnum<["TERMINATE", "PAUSE", "RESUME"]>;
+type KillSwitchCommandType = z.infer<typeof KillSwitchCommandTypeSchema>;
+declare const KillSwitchCommandSchema: z.ZodObject<{
+    /** Unique command ID for idempotency and replay prevention */
+    command_id: z.ZodString;
+    /** Type of command */
+    type: z.ZodEnum<["TERMINATE", "PAUSE", "RESUME"]>;
+    /** Target instance_id (optional, for specific instance) */
+    instance_id: z.ZodOptional<z.ZodString>;
+    /** Target asset_id (optional, for all instances of an asset) */
+    asset_id: z.ZodOptional<z.ZodString>;
+    /** Target organization (optional, for org-wide kill) */
+    organization: z.ZodOptional<z.ZodString>;
+    /** Cryptographic signature for verification */
+    signature: z.ZodString;
+    /** ISO 8601 timestamp for replay prevention */
+    timestamp: z.ZodString;
+    /** Human-readable reason for audit trail */
+    reason: z.ZodString;
+    /** Issuer of the command (email or system ID) */
+    issued_by: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    type: "TERMINATE" | "PAUSE" | "RESUME";
+    signature: string;
+    command_id: string;
+    timestamp: string;
+    reason: string;
+    issued_by: string;
+    instance_id?: string | undefined;
+    asset_id?: string | undefined;
+    organization?: string | undefined;
+}, {
+    type: "TERMINATE" | "PAUSE" | "RESUME";
+    signature: string;
+    command_id: string;
+    timestamp: string;
+    reason: string;
+    issued_by: string;
+    instance_id?: string | undefined;
+    asset_id?: string | undefined;
+    organization?: string | undefined;
+}>;
+type KillSwitchCommand = z.infer<typeof KillSwitchCommandSchema>;
+declare const GovernanceTokenIdentityClaimsSchema: z.ZodObject<{
+    instance_id: z.ZodString;
+    asset_id: z.ZodString;
+    asset_name: z.ZodString;
+    asset_version: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    instance_id: string;
+    asset_id: string;
+    asset_name: string;
+    asset_version: string;
+}, {
+    instance_id: string;
+    asset_id: string;
+    asset_name: string;
+    asset_version: string;
+}>;
+declare const GovernanceTokenGovernanceClaimsSchema: z.ZodObject<{
+    risk_level: z.ZodEnum<["minimal", "limited", "high", "unacceptable"]>;
+    golden_thread: z.ZodObject<{
+        hash: z.ZodString;
+        verified: z.ZodBoolean;
+        ticket_id: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        ticket_id: string;
+        hash: string;
+        verified: boolean;
+    }, {
+        ticket_id: string;
+        hash: string;
+        verified: boolean;
+    }>;
+    mode: z.ZodEnum<["NORMAL", "SANDBOX", "RESTRICTED"]>;
+}, "strip", z.ZodTypeAny, {
+    golden_thread: {
+        ticket_id: string;
+        hash: string;
+        verified: boolean;
+    };
+    risk_level: "minimal" | "limited" | "high" | "unacceptable";
+    mode: "NORMAL" | "SANDBOX" | "RESTRICTED";
+}, {
+    golden_thread: {
+        ticket_id: string;
+        hash: string;
+        verified: boolean;
+    };
+    risk_level: "minimal" | "limited" | "high" | "unacceptable";
+    mode: "NORMAL" | "SANDBOX" | "RESTRICTED";
+}>;
+declare const GovernanceTokenControlClaimsSchema: z.ZodObject<{
+    kill_switch: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        channel: z.ZodEnum<["sse", "polling", "file"]>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        channel: "sse" | "polling" | "file";
+    }, {
+        enabled: boolean;
+        channel: "sse" | "polling" | "file";
+    }>;
+    paused: z.ZodBoolean;
+    termination_pending: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    kill_switch: {
+        enabled: boolean;
+        channel: "sse" | "polling" | "file";
+    };
+    paused: boolean;
+    termination_pending: boolean;
+}, {
+    kill_switch: {
+        enabled: boolean;
+        channel: "sse" | "polling" | "file";
+    };
+    paused: boolean;
+    termination_pending: boolean;
+}>;
+declare const GovernanceTokenCapabilityClaimsSchema: z.ZodObject<{
+    hash: z.ZodString;
+    tools: z.ZodArray<z.ZodString, "many">;
+    max_budget_usd: z.ZodNullable<z.ZodNumber>;
+    can_spawn: z.ZodBoolean;
+    max_child_depth: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    hash: string;
+    max_child_depth: number;
+    tools: string[];
+    max_budget_usd: number | null;
+    can_spawn: boolean;
+}, {
+    hash: string;
+    max_child_depth: number;
+    tools: string[];
+    max_budget_usd: number | null;
+    can_spawn: boolean;
+}>;
+declare const GovernanceTokenLineageClaimsSchema: z.ZodObject<{
+    generation_depth: z.ZodNumber;
+    parent_instance_id: z.ZodNullable<z.ZodString>;
+    root_instance_id: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    parent_instance_id: string | null;
+    generation_depth: number;
+    root_instance_id: string;
+}, {
+    parent_instance_id: string | null;
+    generation_depth: number;
+    root_instance_id: string;
+}>;
+declare const GovernanceTokenPayloadSchema: z.ZodObject<{
+    /** Issuer: "aigos-runtime" */
+    iss: z.ZodLiteral<"aigos-runtime">;
+    /** Subject: instance_id of the agent */
+    sub: z.ZodString;
+    /** Audience: "aigos-agents" or specific agent */
+    aud: z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>;
+    /** Expiration timestamp (Unix epoch) */
+    exp: z.ZodNumber;
+    /** Issued at timestamp (Unix epoch) */
+    iat: z.ZodNumber;
+    /** Not before timestamp (Unix epoch) */
+    nbf: z.ZodNumber;
+    /** Unique JWT ID */
+    jti: z.ZodString;
+    aigos: z.ZodObject<{
+        identity: z.ZodObject<{
+            instance_id: z.ZodString;
+            asset_id: z.ZodString;
+            asset_name: z.ZodString;
+            asset_version: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            instance_id: string;
+            asset_id: string;
+            asset_name: string;
+            asset_version: string;
+        }, {
+            instance_id: string;
+            asset_id: string;
+            asset_name: string;
+            asset_version: string;
+        }>;
+        governance: z.ZodObject<{
+            risk_level: z.ZodEnum<["minimal", "limited", "high", "unacceptable"]>;
+            golden_thread: z.ZodObject<{
+                hash: z.ZodString;
+                verified: z.ZodBoolean;
+                ticket_id: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                ticket_id: string;
+                hash: string;
+                verified: boolean;
+            }, {
+                ticket_id: string;
+                hash: string;
+                verified: boolean;
+            }>;
+            mode: z.ZodEnum<["NORMAL", "SANDBOX", "RESTRICTED"]>;
+        }, "strip", z.ZodTypeAny, {
+            golden_thread: {
+                ticket_id: string;
+                hash: string;
+                verified: boolean;
+            };
+            risk_level: "minimal" | "limited" | "high" | "unacceptable";
+            mode: "NORMAL" | "SANDBOX" | "RESTRICTED";
+        }, {
+            golden_thread: {
+                ticket_id: string;
+                hash: string;
+                verified: boolean;
+            };
+            risk_level: "minimal" | "limited" | "high" | "unacceptable";
+            mode: "NORMAL" | "SANDBOX" | "RESTRICTED";
+        }>;
+        control: z.ZodObject<{
+            kill_switch: z.ZodObject<{
+                enabled: z.ZodBoolean;
+                channel: z.ZodEnum<["sse", "polling", "file"]>;
+            }, "strip", z.ZodTypeAny, {
+                enabled: boolean;
+                channel: "sse" | "polling" | "file";
+            }, {
+                enabled: boolean;
+                channel: "sse" | "polling" | "file";
+            }>;
+            paused: z.ZodBoolean;
+            termination_pending: z.ZodBoolean;
+        }, "strip", z.ZodTypeAny, {
+            kill_switch: {
+                enabled: boolean;
+                channel: "sse" | "polling" | "file";
+            };
+            paused: boolean;
+            termination_pending: boolean;
+        }, {
+            kill_switch: {
+                enabled: boolean;
+                channel: "sse" | "polling" | "file";
+            };
+            paused: boolean;
+            termination_pending: boolean;
+        }>;
+        capabilities: z.ZodObject<{
+            hash: z.ZodString;
+            tools: z.ZodArray<z.ZodString, "many">;
+            max_budget_usd: z.ZodNullable<z.ZodNumber>;
+            can_spawn: z.ZodBoolean;
+            max_child_depth: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            hash: string;
+            max_child_depth: number;
+            tools: string[];
+            max_budget_usd: number | null;
+            can_spawn: boolean;
+        }, {
+            hash: string;
+            max_child_depth: number;
+            tools: string[];
+            max_budget_usd: number | null;
+            can_spawn: boolean;
+        }>;
+        lineage: z.ZodObject<{
+            generation_depth: z.ZodNumber;
+            parent_instance_id: z.ZodNullable<z.ZodString>;
+            root_instance_id: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            parent_instance_id: string | null;
+            generation_depth: number;
+            root_instance_id: string;
+        }, {
+            parent_instance_id: string | null;
+            generation_depth: number;
+            root_instance_id: string;
+        }>;
+    }, "strip", z.ZodTypeAny, {
+        lineage: {
+            parent_instance_id: string | null;
+            generation_depth: number;
+            root_instance_id: string;
+        };
+        identity: {
+            instance_id: string;
+            asset_id: string;
+            asset_name: string;
+            asset_version: string;
+        };
+        governance: {
+            golden_thread: {
+                ticket_id: string;
+                hash: string;
+                verified: boolean;
+            };
+            risk_level: "minimal" | "limited" | "high" | "unacceptable";
+            mode: "NORMAL" | "SANDBOX" | "RESTRICTED";
+        };
+        control: {
+            kill_switch: {
+                enabled: boolean;
+                channel: "sse" | "polling" | "file";
+            };
+            paused: boolean;
+            termination_pending: boolean;
+        };
+        capabilities: {
+            hash: string;
+            max_child_depth: number;
+            tools: string[];
+            max_budget_usd: number | null;
+            can_spawn: boolean;
+        };
+    }, {
+        lineage: {
+            parent_instance_id: string | null;
+            generation_depth: number;
+            root_instance_id: string;
+        };
+        identity: {
+            instance_id: string;
+            asset_id: string;
+            asset_name: string;
+            asset_version: string;
+        };
+        governance: {
+            golden_thread: {
+                ticket_id: string;
+                hash: string;
+                verified: boolean;
+            };
+            risk_level: "minimal" | "limited" | "high" | "unacceptable";
+            mode: "NORMAL" | "SANDBOX" | "RESTRICTED";
+        };
+        control: {
+            kill_switch: {
+                enabled: boolean;
+                channel: "sse" | "polling" | "file";
+            };
+            paused: boolean;
+            termination_pending: boolean;
+        };
+        capabilities: {
+            hash: string;
+            max_child_depth: number;
+            tools: string[];
+            max_budget_usd: number | null;
+            can_spawn: boolean;
+        };
+    }>;
+}, "strip", z.ZodTypeAny, {
+    iss: "aigos-runtime";
+    sub: string;
+    aud: string | string[];
+    exp: number;
+    iat: number;
+    nbf: number;
+    jti: string;
+    aigos: {
+        lineage: {
+            parent_instance_id: string | null;
+            generation_depth: number;
+            root_instance_id: string;
+        };
+        identity: {
+            instance_id: string;
+            asset_id: string;
+            asset_name: string;
+            asset_version: string;
+        };
+        governance: {
+            golden_thread: {
+                ticket_id: string;
+                hash: string;
+                verified: boolean;
+            };
+            risk_level: "minimal" | "limited" | "high" | "unacceptable";
+            mode: "NORMAL" | "SANDBOX" | "RESTRICTED";
+        };
+        control: {
+            kill_switch: {
+                enabled: boolean;
+                channel: "sse" | "polling" | "file";
+            };
+            paused: boolean;
+            termination_pending: boolean;
+        };
+        capabilities: {
+            hash: string;
+            max_child_depth: number;
+            tools: string[];
+            max_budget_usd: number | null;
+            can_spawn: boolean;
+        };
+    };
+}, {
+    iss: "aigos-runtime";
+    sub: string;
+    aud: string | string[];
+    exp: number;
+    iat: number;
+    nbf: number;
+    jti: string;
+    aigos: {
+        lineage: {
+            parent_instance_id: string | null;
+            generation_depth: number;
+            root_instance_id: string;
+        };
+        identity: {
+            instance_id: string;
+            asset_id: string;
+            asset_name: string;
+            asset_version: string;
+        };
+        governance: {
+            golden_thread: {
+                ticket_id: string;
+                hash: string;
+                verified: boolean;
+            };
+            risk_level: "minimal" | "limited" | "high" | "unacceptable";
+            mode: "NORMAL" | "SANDBOX" | "RESTRICTED";
+        };
+        control: {
+            kill_switch: {
+                enabled: boolean;
+                channel: "sse" | "polling" | "file";
+            };
+            paused: boolean;
+            termination_pending: boolean;
+        };
+        capabilities: {
+            hash: string;
+            max_child_depth: number;
+            tools: string[];
+            max_budget_usd: number | null;
+            can_spawn: boolean;
+        };
+    };
+}>;
+type GovernanceTokenPayload = z.infer<typeof GovernanceTokenPayloadSchema>;
+type GovernanceTokenIdentityClaims = z.infer<typeof GovernanceTokenIdentityClaimsSchema>;
+type GovernanceTokenGovernanceClaims = z.infer<typeof GovernanceTokenGovernanceClaimsSchema>;
+type GovernanceTokenControlClaims = z.infer<typeof GovernanceTokenControlClaimsSchema>;
+type GovernanceTokenCapabilityClaims = z.infer<typeof GovernanceTokenCapabilityClaimsSchema>;
+type GovernanceTokenLineageClaims = z.infer<typeof GovernanceTokenLineageClaimsSchema>;
+declare const AssetCardRuntimeSchema: z.ZodObject<{
+    /** Path to policy file for this asset */
+    policy_path: z.ZodOptional<z.ZodString>;
+    /** Behavior when Golden Thread verification fails */
+    verification_failure_mode: z.ZodDefault<z.ZodEnum<["SANDBOX", "FAIL"]>>;
+    /** Whether telemetry is enabled for this asset */
+    telemetry_enabled: z.ZodDefault<z.ZodBoolean>;
+    /** Kill switch configuration */
+    kill_switch: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        channel: z.ZodDefault<z.ZodEnum<["sse", "polling", "file"]>>;
+        endpoint: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        channel: "sse" | "polling" | "file";
+        endpoint?: string | undefined;
+    }, {
+        enabled?: boolean | undefined;
+        channel?: "sse" | "polling" | "file" | undefined;
+        endpoint?: string | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    verification_failure_mode: "SANDBOX" | "FAIL";
+    telemetry_enabled: boolean;
+    kill_switch?: {
+        enabled: boolean;
+        channel: "sse" | "polling" | "file";
+        endpoint?: string | undefined;
+    } | undefined;
+    policy_path?: string | undefined;
+}, {
+    kill_switch?: {
+        enabled?: boolean | undefined;
+        channel?: "sse" | "polling" | "file" | undefined;
+        endpoint?: string | undefined;
+    } | undefined;
+    policy_path?: string | undefined;
+    verification_failure_mode?: "SANDBOX" | "FAIL" | undefined;
+    telemetry_enabled?: boolean | undefined;
+}>;
+type AssetCardRuntime = z.infer<typeof AssetCardRuntimeSchema>;
+declare const PolicyRuleEffectSchema: z.ZodEnum<["allow", "deny", "audit"]>;
+type PolicyRuleEffect = z.infer<typeof PolicyRuleEffectSchema>;
+declare const PolicyRuleSchema: z.ZodObject<{
+    /** Unique identifier for this rule */
+    id: z.ZodString;
+    /** Human-readable description */
+    description: z.ZodOptional<z.ZodString>;
+    /** Effect when rule matches: allow, deny, or audit */
+    effect: z.ZodEnum<["allow", "deny", "audit"]>;
+    /** Actions/tools this rule applies to (supports wildcards) */
+    actions: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Resources/domains this rule applies to (supports patterns) */
+    resources: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Conditions that must be true for rule to apply */
+    conditions: z.ZodOptional<z.ZodObject<{
+        /** Required risk levels for this rule to apply */
+        risk_levels: z.ZodOptional<z.ZodArray<z.ZodEnum<["minimal", "limited", "high", "unacceptable"]>, "many">>;
+        /** Required operating modes */
+        modes: z.ZodOptional<z.ZodArray<z.ZodEnum<["NORMAL", "SANDBOX", "RESTRICTED"]>, "many">>;
+        /** Time-based conditions (ISO 8601 time ranges) */
+        time_ranges: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            start: z.ZodString;
+            end: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            start: string;
+            end: string;
+        }, {
+            start: string;
+            end: string;
+        }>, "many">>;
+        /** Custom condition expressions */
+        custom: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, "strip", z.ZodTypeAny, {
+        custom?: Record<string, unknown> | undefined;
+        risk_levels?: ("minimal" | "limited" | "high" | "unacceptable")[] | undefined;
+        modes?: ("NORMAL" | "SANDBOX" | "RESTRICTED")[] | undefined;
+        time_ranges?: {
+            start: string;
+            end: string;
+        }[] | undefined;
+    }, {
+        custom?: Record<string, unknown> | undefined;
+        risk_levels?: ("minimal" | "limited" | "high" | "unacceptable")[] | undefined;
+        modes?: ("NORMAL" | "SANDBOX" | "RESTRICTED")[] | undefined;
+        time_ranges?: {
+            start: string;
+            end: string;
+        }[] | undefined;
+    }>>;
+    /** Priority for rule ordering (higher = evaluated first) */
+    priority: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    id: string;
+    effect: "allow" | "deny" | "audit";
+    actions: string[];
+    resources: string[];
+    priority: number;
+    description?: string | undefined;
+    conditions?: {
+        custom?: Record<string, unknown> | undefined;
+        risk_levels?: ("minimal" | "limited" | "high" | "unacceptable")[] | undefined;
+        modes?: ("NORMAL" | "SANDBOX" | "RESTRICTED")[] | undefined;
+        time_ranges?: {
+            start: string;
+            end: string;
+        }[] | undefined;
+    } | undefined;
+}, {
+    id: string;
+    effect: "allow" | "deny" | "audit";
+    description?: string | undefined;
+    actions?: string[] | undefined;
+    resources?: string[] | undefined;
+    conditions?: {
+        custom?: Record<string, unknown> | undefined;
+        risk_levels?: ("minimal" | "limited" | "high" | "unacceptable")[] | undefined;
+        modes?: ("NORMAL" | "SANDBOX" | "RESTRICTED")[] | undefined;
+        time_ranges?: {
+            start: string;
+            end: string;
+        }[] | undefined;
+    } | undefined;
+    priority?: number | undefined;
+}>;
+type PolicyRule = z.infer<typeof PolicyRuleSchema>;
+declare const PolicyCapabilitiesSchema: z.ZodObject<{
+    /** Default effect when no rule matches */
+    default_effect: z.ZodDefault<z.ZodEnum<["allow", "deny", "audit"]>>;
+    /** Allowed tools (supports wildcards: *, prefix_*) */
+    allowed_tools: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Denied tools (takes precedence) */
+    denied_tools: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Allowed domain patterns */
+    allowed_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Denied domain patterns */
+    denied_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Maximum budget per session in USD */
+    max_budget_per_session: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    /** Maximum budget per day in USD */
+    max_budget_per_day: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    /** Whether agent can spawn children */
+    may_spawn: z.ZodDefault<z.ZodBoolean>;
+    /** Maximum spawn depth */
+    max_spawn_depth: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    allowed_tools: string[];
+    denied_tools: string[];
+    allowed_domains: string[];
+    denied_domains: string[];
+    default_effect: "allow" | "deny" | "audit";
+    may_spawn: boolean;
+    max_spawn_depth: number;
+    max_budget_per_session?: number | null | undefined;
+    max_budget_per_day?: number | null | undefined;
+}, {
+    allowed_tools?: string[] | undefined;
+    denied_tools?: string[] | undefined;
+    allowed_domains?: string[] | undefined;
+    denied_domains?: string[] | undefined;
+    default_effect?: "allow" | "deny" | "audit" | undefined;
+    max_budget_per_session?: number | null | undefined;
+    max_budget_per_day?: number | null | undefined;
+    may_spawn?: boolean | undefined;
+    max_spawn_depth?: number | undefined;
+}>;
+type PolicyCapabilities = z.infer<typeof PolicyCapabilitiesSchema>;
+declare const PolicyFileSchema: z.ZodObject<{
+    /** Schema version for forward compatibility */
+    version: z.ZodLiteral<"1.0">;
+    /** Unique policy identifier */
+    id: z.ZodString;
+    /** Human-readable name */
+    name: z.ZodString;
+    /** Description of this policy */
+    description: z.ZodOptional<z.ZodString>;
+    /** Parent policy to inherit from */
+    extends: z.ZodOptional<z.ZodString>;
+    /** Target asset IDs or patterns this policy applies to */
+    applies_to: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Default capabilities when no rules match */
+    capabilities: z.ZodOptional<z.ZodObject<{
+        /** Default effect when no rule matches */
+        default_effect: z.ZodDefault<z.ZodEnum<["allow", "deny", "audit"]>>;
+        /** Allowed tools (supports wildcards: *, prefix_*) */
+        allowed_tools: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        /** Denied tools (takes precedence) */
+        denied_tools: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        /** Allowed domain patterns */
+        allowed_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        /** Denied domain patterns */
+        denied_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        /** Maximum budget per session in USD */
+        max_budget_per_session: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        /** Maximum budget per day in USD */
+        max_budget_per_day: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        /** Whether agent can spawn children */
+        may_spawn: z.ZodDefault<z.ZodBoolean>;
+        /** Maximum spawn depth */
+        max_spawn_depth: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        allowed_tools: string[];
+        denied_tools: string[];
+        allowed_domains: string[];
+        denied_domains: string[];
+        default_effect: "allow" | "deny" | "audit";
+        may_spawn: boolean;
+        max_spawn_depth: number;
+        max_budget_per_session?: number | null | undefined;
+        max_budget_per_day?: number | null | undefined;
+    }, {
+        allowed_tools?: string[] | undefined;
+        denied_tools?: string[] | undefined;
+        allowed_domains?: string[] | undefined;
+        denied_domains?: string[] | undefined;
+        default_effect?: "allow" | "deny" | "audit" | undefined;
+        max_budget_per_session?: number | null | undefined;
+        max_budget_per_day?: number | null | undefined;
+        may_spawn?: boolean | undefined;
+        max_spawn_depth?: number | undefined;
+    }>>;
+    /** Ordered list of policy rules */
+    rules: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        /** Unique identifier for this rule */
+        id: z.ZodString;
+        /** Human-readable description */
+        description: z.ZodOptional<z.ZodString>;
+        /** Effect when rule matches: allow, deny, or audit */
+        effect: z.ZodEnum<["allow", "deny", "audit"]>;
+        /** Actions/tools this rule applies to (supports wildcards) */
+        actions: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        /** Resources/domains this rule applies to (supports patterns) */
+        resources: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        /** Conditions that must be true for rule to apply */
+        conditions: z.ZodOptional<z.ZodObject<{
+            /** Required risk levels for this rule to apply */
+            risk_levels: z.ZodOptional<z.ZodArray<z.ZodEnum<["minimal", "limited", "high", "unacceptable"]>, "many">>;
+            /** Required operating modes */
+            modes: z.ZodOptional<z.ZodArray<z.ZodEnum<["NORMAL", "SANDBOX", "RESTRICTED"]>, "many">>;
+            /** Time-based conditions (ISO 8601 time ranges) */
+            time_ranges: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                start: z.ZodString;
+                end: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                start: string;
+                end: string;
+            }, {
+                start: string;
+                end: string;
+            }>, "many">>;
+            /** Custom condition expressions */
+            custom: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, "strip", z.ZodTypeAny, {
+            custom?: Record<string, unknown> | undefined;
+            risk_levels?: ("minimal" | "limited" | "high" | "unacceptable")[] | undefined;
+            modes?: ("NORMAL" | "SANDBOX" | "RESTRICTED")[] | undefined;
+            time_ranges?: {
+                start: string;
+                end: string;
+            }[] | undefined;
+        }, {
+            custom?: Record<string, unknown> | undefined;
+            risk_levels?: ("minimal" | "limited" | "high" | "unacceptable")[] | undefined;
+            modes?: ("NORMAL" | "SANDBOX" | "RESTRICTED")[] | undefined;
+            time_ranges?: {
+                start: string;
+                end: string;
+            }[] | undefined;
+        }>>;
+        /** Priority for rule ordering (higher = evaluated first) */
+        priority: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
+        effect: "allow" | "deny" | "audit";
+        actions: string[];
+        resources: string[];
+        priority: number;
+        description?: string | undefined;
+        conditions?: {
+            custom?: Record<string, unknown> | undefined;
+            risk_levels?: ("minimal" | "limited" | "high" | "unacceptable")[] | undefined;
+            modes?: ("NORMAL" | "SANDBOX" | "RESTRICTED")[] | undefined;
+            time_ranges?: {
+                start: string;
+                end: string;
+            }[] | undefined;
+        } | undefined;
+    }, {
+        id: string;
+        effect: "allow" | "deny" | "audit";
+        description?: string | undefined;
+        actions?: string[] | undefined;
+        resources?: string[] | undefined;
+        conditions?: {
+            custom?: Record<string, unknown> | undefined;
+            risk_levels?: ("minimal" | "limited" | "high" | "unacceptable")[] | undefined;
+            modes?: ("NORMAL" | "SANDBOX" | "RESTRICTED")[] | undefined;
+            time_ranges?: {
+                start: string;
+                end: string;
+            }[] | undefined;
+        } | undefined;
+        priority?: number | undefined;
+    }>, "many">>;
+    /** Metadata */
+    metadata: z.ZodOptional<z.ZodObject<{
+        created_at: z.ZodOptional<z.ZodString>;
+        updated_at: z.ZodOptional<z.ZodString>;
+        created_by: z.ZodOptional<z.ZodString>;
+        tags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        created_at?: string | undefined;
+        updated_at?: string | undefined;
+        created_by?: string | undefined;
+        tags?: string[] | undefined;
+    }, {
+        created_at?: string | undefined;
+        updated_at?: string | undefined;
+        created_by?: string | undefined;
+        tags?: string[] | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    id: string;
+    version: "1.0";
+    applies_to: string[];
+    rules: {
+        id: string;
+        effect: "allow" | "deny" | "audit";
+        actions: string[];
+        resources: string[];
+        priority: number;
+        description?: string | undefined;
+        conditions?: {
+            custom?: Record<string, unknown> | undefined;
+            risk_levels?: ("minimal" | "limited" | "high" | "unacceptable")[] | undefined;
+            modes?: ("NORMAL" | "SANDBOX" | "RESTRICTED")[] | undefined;
+            time_ranges?: {
+                start: string;
+                end: string;
+            }[] | undefined;
+        } | undefined;
+    }[];
+    capabilities?: {
+        allowed_tools: string[];
+        denied_tools: string[];
+        allowed_domains: string[];
+        denied_domains: string[];
+        default_effect: "allow" | "deny" | "audit";
+        may_spawn: boolean;
+        max_spawn_depth: number;
+        max_budget_per_session?: number | null | undefined;
+        max_budget_per_day?: number | null | undefined;
+    } | undefined;
+    description?: string | undefined;
+    extends?: string | undefined;
+    metadata?: {
+        created_at?: string | undefined;
+        updated_at?: string | undefined;
+        created_by?: string | undefined;
+        tags?: string[] | undefined;
+    } | undefined;
+}, {
+    name: string;
+    id: string;
+    version: "1.0";
+    capabilities?: {
+        allowed_tools?: string[] | undefined;
+        denied_tools?: string[] | undefined;
+        allowed_domains?: string[] | undefined;
+        denied_domains?: string[] | undefined;
+        default_effect?: "allow" | "deny" | "audit" | undefined;
+        max_budget_per_session?: number | null | undefined;
+        max_budget_per_day?: number | null | undefined;
+        may_spawn?: boolean | undefined;
+        max_spawn_depth?: number | undefined;
+    } | undefined;
+    description?: string | undefined;
+    extends?: string | undefined;
+    applies_to?: string[] | undefined;
+    rules?: {
+        id: string;
+        effect: "allow" | "deny" | "audit";
+        description?: string | undefined;
+        actions?: string[] | undefined;
+        resources?: string[] | undefined;
+        conditions?: {
+            custom?: Record<string, unknown> | undefined;
+            risk_levels?: ("minimal" | "limited" | "high" | "unacceptable")[] | undefined;
+            modes?: ("NORMAL" | "SANDBOX" | "RESTRICTED")[] | undefined;
+            time_ranges?: {
+                start: string;
+                end: string;
+            }[] | undefined;
+        } | undefined;
+        priority?: number | undefined;
+    }[] | undefined;
+    metadata?: {
+        created_at?: string | undefined;
+        updated_at?: string | undefined;
+        created_by?: string | undefined;
+        tags?: string[] | undefined;
+    } | undefined;
+}>;
+type PolicyFile = z.infer<typeof PolicyFileSchema>;
+declare const AigrcRuntimeConfigSchema: z.ZodObject<{
+    /** Default policy file path */
+    default_policy: z.ZodOptional<z.ZodString>;
+    /** Policy search paths */
+    policy_paths: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Asset card search paths */
+    asset_paths: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Default verification failure mode */
+    verification_failure_mode: z.ZodDefault<z.ZodEnum<["SANDBOX", "FAIL"]>>;
+    /** Telemetry configuration */
+    telemetry: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        endpoint: z.ZodOptional<z.ZodString>;
+        sample_rate: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        sample_rate: number;
+        endpoint?: string | undefined;
+    }, {
+        enabled?: boolean | undefined;
+        endpoint?: string | undefined;
+        sample_rate?: number | undefined;
+    }>>;
+    /** Kill switch configuration */
+    kill_switch: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        channel: z.ZodDefault<z.ZodEnum<["sse", "polling", "file"]>>;
+        endpoint: z.ZodOptional<z.ZodString>;
+        poll_interval_ms: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        channel: "sse" | "polling" | "file";
+        poll_interval_ms: number;
+        endpoint?: string | undefined;
+    }, {
+        enabled?: boolean | undefined;
+        channel?: "sse" | "polling" | "file" | undefined;
+        endpoint?: string | undefined;
+        poll_interval_ms?: number | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    verification_failure_mode: "SANDBOX" | "FAIL";
+    policy_paths: string[];
+    asset_paths: string[];
+    kill_switch?: {
+        enabled: boolean;
+        channel: "sse" | "polling" | "file";
+        poll_interval_ms: number;
+        endpoint?: string | undefined;
+    } | undefined;
+    default_policy?: string | undefined;
+    telemetry?: {
+        enabled: boolean;
+        sample_rate: number;
+        endpoint?: string | undefined;
+    } | undefined;
+}, {
+    kill_switch?: {
+        enabled?: boolean | undefined;
+        channel?: "sse" | "polling" | "file" | undefined;
+        endpoint?: string | undefined;
+        poll_interval_ms?: number | undefined;
+    } | undefined;
+    verification_failure_mode?: "SANDBOX" | "FAIL" | undefined;
+    default_policy?: string | undefined;
+    policy_paths?: string[] | undefined;
+    asset_paths?: string[] | undefined;
+    telemetry?: {
+        enabled?: boolean | undefined;
+        endpoint?: string | undefined;
+        sample_rate?: number | undefined;
+    } | undefined;
+}>;
+type AigrcRuntimeConfig = z.infer<typeof AigrcRuntimeConfigSchema>;
+declare const AigrcIntegrationsConfigSchema: z.ZodObject<{
+    /** JIRA integration */
+    jira: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        url: z.ZodOptional<z.ZodString>;
+        project_key: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        url?: string | undefined;
+        project_key?: string | undefined;
+    }, {
+        enabled?: boolean | undefined;
+        url?: string | undefined;
+        project_key?: string | undefined;
+    }>>;
+    /** Azure DevOps integration */
+    azure_devops: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        organization: z.ZodOptional<z.ZodString>;
+        project: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        organization?: string | undefined;
+        project?: string | undefined;
+    }, {
+        organization?: string | undefined;
+        enabled?: boolean | undefined;
+        project?: string | undefined;
+    }>>;
+    /** GitHub integration */
+    github: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        owner: z.ZodOptional<z.ZodString>;
+        repo: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        owner?: string | undefined;
+        repo?: string | undefined;
+    }, {
+        enabled?: boolean | undefined;
+        owner?: string | undefined;
+        repo?: string | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    jira?: {
+        enabled: boolean;
+        url?: string | undefined;
+        project_key?: string | undefined;
+    } | undefined;
+    github?: {
+        enabled: boolean;
+        owner?: string | undefined;
+        repo?: string | undefined;
+    } | undefined;
+    azure_devops?: {
+        enabled: boolean;
+        organization?: string | undefined;
+        project?: string | undefined;
+    } | undefined;
+}, {
+    jira?: {
+        enabled?: boolean | undefined;
+        url?: string | undefined;
+        project_key?: string | undefined;
+    } | undefined;
+    github?: {
+        enabled?: boolean | undefined;
+        owner?: string | undefined;
+        repo?: string | undefined;
+    } | undefined;
+    azure_devops?: {
+        organization?: string | undefined;
+        enabled?: boolean | undefined;
+        project?: string | undefined;
+    } | undefined;
+}>;
+type AigrcIntegrationsConfig = z.infer<typeof AigrcIntegrationsConfigSchema>;
+declare const AigrcConfigSchema: z.ZodObject<{
+    /** Schema version */
+    version: z.ZodLiteral<"1.0">;
+    /** Project name */
+    name: z.ZodOptional<z.ZodString>;
+    /** Project description */
+    description: z.ZodOptional<z.ZodString>;
+    /** Runtime governance configuration */
+    runtime: z.ZodOptional<z.ZodObject<{
+        /** Default policy file path */
+        default_policy: z.ZodOptional<z.ZodString>;
+        /** Policy search paths */
+        policy_paths: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        /** Asset card search paths */
+        asset_paths: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        /** Default verification failure mode */
+        verification_failure_mode: z.ZodDefault<z.ZodEnum<["SANDBOX", "FAIL"]>>;
+        /** Telemetry configuration */
+        telemetry: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            endpoint: z.ZodOptional<z.ZodString>;
+            sample_rate: z.ZodDefault<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            enabled: boolean;
+            sample_rate: number;
+            endpoint?: string | undefined;
+        }, {
+            enabled?: boolean | undefined;
+            endpoint?: string | undefined;
+            sample_rate?: number | undefined;
+        }>>;
+        /** Kill switch configuration */
+        kill_switch: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            channel: z.ZodDefault<z.ZodEnum<["sse", "polling", "file"]>>;
+            endpoint: z.ZodOptional<z.ZodString>;
+            poll_interval_ms: z.ZodDefault<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            enabled: boolean;
+            channel: "sse" | "polling" | "file";
+            poll_interval_ms: number;
+            endpoint?: string | undefined;
+        }, {
+            enabled?: boolean | undefined;
+            channel?: "sse" | "polling" | "file" | undefined;
+            endpoint?: string | undefined;
+            poll_interval_ms?: number | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        verification_failure_mode: "SANDBOX" | "FAIL";
+        policy_paths: string[];
+        asset_paths: string[];
+        kill_switch?: {
+            enabled: boolean;
+            channel: "sse" | "polling" | "file";
+            poll_interval_ms: number;
+            endpoint?: string | undefined;
+        } | undefined;
+        default_policy?: string | undefined;
+        telemetry?: {
+            enabled: boolean;
+            sample_rate: number;
+            endpoint?: string | undefined;
+        } | undefined;
+    }, {
+        kill_switch?: {
+            enabled?: boolean | undefined;
+            channel?: "sse" | "polling" | "file" | undefined;
+            endpoint?: string | undefined;
+            poll_interval_ms?: number | undefined;
+        } | undefined;
+        verification_failure_mode?: "SANDBOX" | "FAIL" | undefined;
+        default_policy?: string | undefined;
+        policy_paths?: string[] | undefined;
+        asset_paths?: string[] | undefined;
+        telemetry?: {
+            enabled?: boolean | undefined;
+            endpoint?: string | undefined;
+            sample_rate?: number | undefined;
+        } | undefined;
+    }>>;
+    /** External integrations */
+    integrations: z.ZodOptional<z.ZodObject<{
+        /** JIRA integration */
+        jira: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            url: z.ZodOptional<z.ZodString>;
+            project_key: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            enabled: boolean;
+            url?: string | undefined;
+            project_key?: string | undefined;
+        }, {
+            enabled?: boolean | undefined;
+            url?: string | undefined;
+            project_key?: string | undefined;
+        }>>;
+        /** Azure DevOps integration */
+        azure_devops: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            organization: z.ZodOptional<z.ZodString>;
+            project: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            enabled: boolean;
+            organization?: string | undefined;
+            project?: string | undefined;
+        }, {
+            organization?: string | undefined;
+            enabled?: boolean | undefined;
+            project?: string | undefined;
+        }>>;
+        /** GitHub integration */
+        github: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            owner: z.ZodOptional<z.ZodString>;
+            repo: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            enabled: boolean;
+            owner?: string | undefined;
+            repo?: string | undefined;
+        }, {
+            enabled?: boolean | undefined;
+            owner?: string | undefined;
+            repo?: string | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        jira?: {
+            enabled: boolean;
+            url?: string | undefined;
+            project_key?: string | undefined;
+        } | undefined;
+        github?: {
+            enabled: boolean;
+            owner?: string | undefined;
+            repo?: string | undefined;
+        } | undefined;
+        azure_devops?: {
+            enabled: boolean;
+            organization?: string | undefined;
+            project?: string | undefined;
+        } | undefined;
+    }, {
+        jira?: {
+            enabled?: boolean | undefined;
+            url?: string | undefined;
+            project_key?: string | undefined;
+        } | undefined;
+        github?: {
+            enabled?: boolean | undefined;
+            owner?: string | undefined;
+            repo?: string | undefined;
+        } | undefined;
+        azure_devops?: {
+            organization?: string | undefined;
+            enabled?: boolean | undefined;
+            project?: string | undefined;
+        } | undefined;
+    }>>;
+    /** Environment-specific overrides */
+    environments: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        runtime: z.ZodOptional<z.ZodObject<{
+            default_policy: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+            policy_paths: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString, "many">>>;
+            asset_paths: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString, "many">>>;
+            verification_failure_mode: z.ZodOptional<z.ZodDefault<z.ZodEnum<["SANDBOX", "FAIL"]>>>;
+            telemetry: z.ZodOptional<z.ZodOptional<z.ZodObject<{
+                enabled: z.ZodDefault<z.ZodBoolean>;
+                endpoint: z.ZodOptional<z.ZodString>;
+                sample_rate: z.ZodDefault<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                enabled: boolean;
+                sample_rate: number;
+                endpoint?: string | undefined;
+            }, {
+                enabled?: boolean | undefined;
+                endpoint?: string | undefined;
+                sample_rate?: number | undefined;
+            }>>>;
+            kill_switch: z.ZodOptional<z.ZodOptional<z.ZodObject<{
+                enabled: z.ZodDefault<z.ZodBoolean>;
+                channel: z.ZodDefault<z.ZodEnum<["sse", "polling", "file"]>>;
+                endpoint: z.ZodOptional<z.ZodString>;
+                poll_interval_ms: z.ZodDefault<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                enabled: boolean;
+                channel: "sse" | "polling" | "file";
+                poll_interval_ms: number;
+                endpoint?: string | undefined;
+            }, {
+                enabled?: boolean | undefined;
+                channel?: "sse" | "polling" | "file" | undefined;
+                endpoint?: string | undefined;
+                poll_interval_ms?: number | undefined;
+            }>>>;
+        }, "strip", z.ZodTypeAny, {
+            kill_switch?: {
+                enabled: boolean;
+                channel: "sse" | "polling" | "file";
+                poll_interval_ms: number;
+                endpoint?: string | undefined;
+            } | undefined;
+            verification_failure_mode?: "SANDBOX" | "FAIL" | undefined;
+            default_policy?: string | undefined;
+            policy_paths?: string[] | undefined;
+            asset_paths?: string[] | undefined;
+            telemetry?: {
+                enabled: boolean;
+                sample_rate: number;
+                endpoint?: string | undefined;
+            } | undefined;
+        }, {
+            kill_switch?: {
+                enabled?: boolean | undefined;
+                channel?: "sse" | "polling" | "file" | undefined;
+                endpoint?: string | undefined;
+                poll_interval_ms?: number | undefined;
+            } | undefined;
+            verification_failure_mode?: "SANDBOX" | "FAIL" | undefined;
+            default_policy?: string | undefined;
+            policy_paths?: string[] | undefined;
+            asset_paths?: string[] | undefined;
+            telemetry?: {
+                enabled?: boolean | undefined;
+                endpoint?: string | undefined;
+                sample_rate?: number | undefined;
+            } | undefined;
+        }>>;
+        integrations: z.ZodOptional<z.ZodObject<{
+            jira: z.ZodOptional<z.ZodOptional<z.ZodObject<{
+                enabled: z.ZodDefault<z.ZodBoolean>;
+                url: z.ZodOptional<z.ZodString>;
+                project_key: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                enabled: boolean;
+                url?: string | undefined;
+                project_key?: string | undefined;
+            }, {
+                enabled?: boolean | undefined;
+                url?: string | undefined;
+                project_key?: string | undefined;
+            }>>>;
+            azure_devops: z.ZodOptional<z.ZodOptional<z.ZodObject<{
+                enabled: z.ZodDefault<z.ZodBoolean>;
+                organization: z.ZodOptional<z.ZodString>;
+                project: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                enabled: boolean;
+                organization?: string | undefined;
+                project?: string | undefined;
+            }, {
+                organization?: string | undefined;
+                enabled?: boolean | undefined;
+                project?: string | undefined;
+            }>>>;
+            github: z.ZodOptional<z.ZodOptional<z.ZodObject<{
+                enabled: z.ZodDefault<z.ZodBoolean>;
+                owner: z.ZodOptional<z.ZodString>;
+                repo: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                enabled: boolean;
+                owner?: string | undefined;
+                repo?: string | undefined;
+            }, {
+                enabled?: boolean | undefined;
+                owner?: string | undefined;
+                repo?: string | undefined;
+            }>>>;
+        }, "strip", z.ZodTypeAny, {
+            jira?: {
+                enabled: boolean;
+                url?: string | undefined;
+                project_key?: string | undefined;
+            } | undefined;
+            github?: {
+                enabled: boolean;
+                owner?: string | undefined;
+                repo?: string | undefined;
+            } | undefined;
+            azure_devops?: {
+                enabled: boolean;
+                organization?: string | undefined;
+                project?: string | undefined;
+            } | undefined;
+        }, {
+            jira?: {
+                enabled?: boolean | undefined;
+                url?: string | undefined;
+                project_key?: string | undefined;
+            } | undefined;
+            github?: {
+                enabled?: boolean | undefined;
+                owner?: string | undefined;
+                repo?: string | undefined;
+            } | undefined;
+            azure_devops?: {
+                organization?: string | undefined;
+                enabled?: boolean | undefined;
+                project?: string | undefined;
+            } | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        runtime?: {
+            kill_switch?: {
+                enabled: boolean;
+                channel: "sse" | "polling" | "file";
+                poll_interval_ms: number;
+                endpoint?: string | undefined;
+            } | undefined;
+            verification_failure_mode?: "SANDBOX" | "FAIL" | undefined;
+            default_policy?: string | undefined;
+            policy_paths?: string[] | undefined;
+            asset_paths?: string[] | undefined;
+            telemetry?: {
+                enabled: boolean;
+                sample_rate: number;
+                endpoint?: string | undefined;
+            } | undefined;
+        } | undefined;
+        integrations?: {
+            jira?: {
+                enabled: boolean;
+                url?: string | undefined;
+                project_key?: string | undefined;
+            } | undefined;
+            github?: {
+                enabled: boolean;
+                owner?: string | undefined;
+                repo?: string | undefined;
+            } | undefined;
+            azure_devops?: {
+                enabled: boolean;
+                organization?: string | undefined;
+                project?: string | undefined;
+            } | undefined;
+        } | undefined;
+    }, {
+        runtime?: {
+            kill_switch?: {
+                enabled?: boolean | undefined;
+                channel?: "sse" | "polling" | "file" | undefined;
+                endpoint?: string | undefined;
+                poll_interval_ms?: number | undefined;
+            } | undefined;
+            verification_failure_mode?: "SANDBOX" | "FAIL" | undefined;
+            default_policy?: string | undefined;
+            policy_paths?: string[] | undefined;
+            asset_paths?: string[] | undefined;
+            telemetry?: {
+                enabled?: boolean | undefined;
+                endpoint?: string | undefined;
+                sample_rate?: number | undefined;
+            } | undefined;
+        } | undefined;
+        integrations?: {
+            jira?: {
+                enabled?: boolean | undefined;
+                url?: string | undefined;
+                project_key?: string | undefined;
+            } | undefined;
+            github?: {
+                enabled?: boolean | undefined;
+                owner?: string | undefined;
+                repo?: string | undefined;
+            } | undefined;
+            azure_devops?: {
+                organization?: string | undefined;
+                enabled?: boolean | undefined;
+                project?: string | undefined;
+            } | undefined;
+        } | undefined;
+    }>>>;
+}, "strip", z.ZodTypeAny, {
+    version: "1.0";
+    name?: string | undefined;
+    environments?: Record<string, {
+        runtime?: {
+            kill_switch?: {
+                enabled: boolean;
+                channel: "sse" | "polling" | "file";
+                poll_interval_ms: number;
+                endpoint?: string | undefined;
+            } | undefined;
+            verification_failure_mode?: "SANDBOX" | "FAIL" | undefined;
+            default_policy?: string | undefined;
+            policy_paths?: string[] | undefined;
+            asset_paths?: string[] | undefined;
+            telemetry?: {
+                enabled: boolean;
+                sample_rate: number;
+                endpoint?: string | undefined;
+            } | undefined;
+        } | undefined;
+        integrations?: {
+            jira?: {
+                enabled: boolean;
+                url?: string | undefined;
+                project_key?: string | undefined;
+            } | undefined;
+            github?: {
+                enabled: boolean;
+                owner?: string | undefined;
+                repo?: string | undefined;
+            } | undefined;
+            azure_devops?: {
+                enabled: boolean;
+                organization?: string | undefined;
+                project?: string | undefined;
+            } | undefined;
+        } | undefined;
+    }> | undefined;
+    runtime?: {
+        verification_failure_mode: "SANDBOX" | "FAIL";
+        policy_paths: string[];
+        asset_paths: string[];
+        kill_switch?: {
+            enabled: boolean;
+            channel: "sse" | "polling" | "file";
+            poll_interval_ms: number;
+            endpoint?: string | undefined;
+        } | undefined;
+        default_policy?: string | undefined;
+        telemetry?: {
+            enabled: boolean;
+            sample_rate: number;
+            endpoint?: string | undefined;
+        } | undefined;
+    } | undefined;
+    description?: string | undefined;
+    integrations?: {
+        jira?: {
+            enabled: boolean;
+            url?: string | undefined;
+            project_key?: string | undefined;
+        } | undefined;
+        github?: {
+            enabled: boolean;
+            owner?: string | undefined;
+            repo?: string | undefined;
+        } | undefined;
+        azure_devops?: {
+            enabled: boolean;
+            organization?: string | undefined;
+            project?: string | undefined;
+        } | undefined;
+    } | undefined;
+}, {
+    version: "1.0";
+    name?: string | undefined;
+    environments?: Record<string, {
+        runtime?: {
+            kill_switch?: {
+                enabled?: boolean | undefined;
+                channel?: "sse" | "polling" | "file" | undefined;
+                endpoint?: string | undefined;
+                poll_interval_ms?: number | undefined;
+            } | undefined;
+            verification_failure_mode?: "SANDBOX" | "FAIL" | undefined;
+            default_policy?: string | undefined;
+            policy_paths?: string[] | undefined;
+            asset_paths?: string[] | undefined;
+            telemetry?: {
+                enabled?: boolean | undefined;
+                endpoint?: string | undefined;
+                sample_rate?: number | undefined;
+            } | undefined;
+        } | undefined;
+        integrations?: {
+            jira?: {
+                enabled?: boolean | undefined;
+                url?: string | undefined;
+                project_key?: string | undefined;
+            } | undefined;
+            github?: {
+                enabled?: boolean | undefined;
+                owner?: string | undefined;
+                repo?: string | undefined;
+            } | undefined;
+            azure_devops?: {
+                organization?: string | undefined;
+                enabled?: boolean | undefined;
+                project?: string | undefined;
+            } | undefined;
+        } | undefined;
+    }> | undefined;
+    runtime?: {
+        kill_switch?: {
+            enabled?: boolean | undefined;
+            channel?: "sse" | "polling" | "file" | undefined;
+            endpoint?: string | undefined;
+            poll_interval_ms?: number | undefined;
+        } | undefined;
+        verification_failure_mode?: "SANDBOX" | "FAIL" | undefined;
+        default_policy?: string | undefined;
+        policy_paths?: string[] | undefined;
+        asset_paths?: string[] | undefined;
+        telemetry?: {
+            enabled?: boolean | undefined;
+            endpoint?: string | undefined;
+            sample_rate?: number | undefined;
+        } | undefined;
+    } | undefined;
+    description?: string | undefined;
+    integrations?: {
+        jira?: {
+            enabled?: boolean | undefined;
+            url?: string | undefined;
+            project_key?: string | undefined;
+        } | undefined;
+        github?: {
+            enabled?: boolean | undefined;
+            owner?: string | undefined;
+            repo?: string | undefined;
+        } | undefined;
+        azure_devops?: {
+            organization?: string | undefined;
+            enabled?: boolean | undefined;
+            project?: string | undefined;
+        } | undefined;
+    } | undefined;
+}>;
+type AigrcConfig = z.infer<typeof AigrcConfigSchema>;
 declare const AssetCardSchema: z.ZodObject<{
     $schema: z.ZodOptional<z.ZodString>;
     id: z.ZodString;
@@ -2010,8 +3831,88 @@ declare const AssetCardSchema: z.ZodObject<{
             logToolInvocations?: boolean | undefined;
         } | undefined;
     }>>;
+    /** Golden Thread authorization data (SPEC-PRT-001) */
+    golden_thread: z.ZodOptional<z.ZodObject<{
+        /** Ticket ID from approval system (e.g., "FIN-1234") */
+        ticket_id: z.ZodString;
+        /** Email of approver (e.g., "ciso@corp.com") */
+        approved_by: z.ZodString;
+        /** ISO 8601 timestamp of approval (e.g., "2025-01-15T10:30:00Z") */
+        approved_at: z.ZodString;
+        /** SHA-256 hash of canonical string: sha256:{64 hex chars} */
+        hash: z.ZodOptional<z.ZodString>;
+        /** Optional cryptographic signature: {ALGORITHM}:{BASE64_SIGNATURE} */
+        signature: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        ticket_id: string;
+        approved_by: string;
+        approved_at: string;
+        hash?: string | undefined;
+        signature?: string | undefined;
+    }, {
+        ticket_id: string;
+        approved_by: string;
+        approved_at: string;
+        hash?: string | undefined;
+        signature?: string | undefined;
+    }>>;
+    /** Runtime governance configuration (SPEC-RT) */
+    runtime: z.ZodOptional<z.ZodObject<{
+        /** Path to policy file for this asset */
+        policy_path: z.ZodOptional<z.ZodString>;
+        /** Behavior when Golden Thread verification fails */
+        verification_failure_mode: z.ZodDefault<z.ZodEnum<["SANDBOX", "FAIL"]>>;
+        /** Whether telemetry is enabled for this asset */
+        telemetry_enabled: z.ZodDefault<z.ZodBoolean>;
+        /** Kill switch configuration */
+        kill_switch: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            channel: z.ZodDefault<z.ZodEnum<["sse", "polling", "file"]>>;
+            endpoint: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            enabled: boolean;
+            channel: "sse" | "polling" | "file";
+            endpoint?: string | undefined;
+        }, {
+            enabled?: boolean | undefined;
+            channel?: "sse" | "polling" | "file" | undefined;
+            endpoint?: string | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        verification_failure_mode: "SANDBOX" | "FAIL";
+        telemetry_enabled: boolean;
+        kill_switch?: {
+            enabled: boolean;
+            channel: "sse" | "polling" | "file";
+            endpoint?: string | undefined;
+        } | undefined;
+        policy_path?: string | undefined;
+    }, {
+        kill_switch?: {
+            enabled?: boolean | undefined;
+            channel?: "sse" | "polling" | "file" | undefined;
+            endpoint?: string | undefined;
+        } | undefined;
+        policy_path?: string | undefined;
+        verification_failure_mode?: "SANDBOX" | "FAIL" | undefined;
+        telemetry_enabled?: boolean | undefined;
+    }>>;
 }, "strip", z.ZodTypeAny, {
     name: string;
+    governance: {
+        status: "linked" | "draft" | "approved" | "production" | "deprecated" | "revoked";
+        approvals: {
+            name: string;
+            date: string;
+            role: string;
+            email?: string | undefined;
+            source?: string | undefined;
+        }[];
+        deployment?: {
+            environments: string[];
+            lastDeployed?: string | null | undefined;
+        } | undefined;
+    };
     id: string;
     version: string;
     created: string;
@@ -2139,22 +4040,25 @@ declare const AssetCardSchema: z.ZodObject<{
         riskTolerance?: "high" | "low" | "medium" | null | undefined;
         importedAt?: string | null | undefined;
     };
-    governance: {
-        status: "linked" | "draft" | "approved" | "production" | "deprecated" | "revoked";
-        approvals: {
-            name: string;
-            date: string;
-            role: string;
-            email?: string | undefined;
-            source?: string | undefined;
-        }[];
-        deployment?: {
-            environments: string[];
-            lastDeployed?: string | null | undefined;
+    runtime?: {
+        verification_failure_mode: "SANDBOX" | "FAIL";
+        telemetry_enabled: boolean;
+        kill_switch?: {
+            enabled: boolean;
+            channel: "sse" | "polling" | "file";
+            endpoint?: string | undefined;
         } | undefined;
-    };
-    $schema?: string | undefined;
+        policy_path?: string | undefined;
+    } | undefined;
+    golden_thread?: {
+        ticket_id: string;
+        approved_by: string;
+        approved_at: string;
+        hash?: string | undefined;
+        signature?: string | undefined;
+    } | undefined;
     description?: string | undefined;
+    $schema?: string | undefined;
     constraints?: {
         runtime?: {
             maxIterations?: number | undefined;
@@ -2170,6 +4074,20 @@ declare const AssetCardSchema: z.ZodObject<{
     } | undefined;
 }, {
     name: string;
+    governance: {
+        status: "linked" | "draft" | "approved" | "production" | "deprecated" | "revoked";
+        approvals?: {
+            name: string;
+            date: string;
+            role: string;
+            email?: string | undefined;
+            source?: string | undefined;
+        }[] | undefined;
+        deployment?: {
+            environments?: string[] | undefined;
+            lastDeployed?: string | null | undefined;
+        } | undefined;
+    };
     id: string;
     created: string;
     updated: string;
@@ -2296,23 +4214,26 @@ declare const AssetCardSchema: z.ZodObject<{
         riskTolerance?: "high" | "low" | "medium" | null | undefined;
         importedAt?: string | null | undefined;
     };
-    governance: {
-        status: "linked" | "draft" | "approved" | "production" | "deprecated" | "revoked";
-        approvals?: {
-            name: string;
-            date: string;
-            role: string;
-            email?: string | undefined;
-            source?: string | undefined;
-        }[] | undefined;
-        deployment?: {
-            environments?: string[] | undefined;
-            lastDeployed?: string | null | undefined;
+    runtime?: {
+        kill_switch?: {
+            enabled?: boolean | undefined;
+            channel?: "sse" | "polling" | "file" | undefined;
+            endpoint?: string | undefined;
         } | undefined;
-    };
-    $schema?: string | undefined;
+        policy_path?: string | undefined;
+        verification_failure_mode?: "SANDBOX" | "FAIL" | undefined;
+        telemetry_enabled?: boolean | undefined;
+    } | undefined;
+    golden_thread?: {
+        ticket_id: string;
+        approved_by: string;
+        approved_at: string;
+        hash?: string | undefined;
+        signature?: string | undefined;
+    } | undefined;
     description?: string | undefined;
     version?: string | undefined;
+    $schema?: string | undefined;
     constraints?: {
         runtime?: {
             maxIterations?: number | undefined;
@@ -2329,4 +4250,4 @@ declare const AssetCardSchema: z.ZodObject<{
 }>;
 type AssetCard = z.infer<typeof AssetCardSchema>;
 
-export { ApprovalSchema, type AssetCard, AssetCardSchema, type Classification, ClassificationSchema, type Constraints, ConstraintsSchema, type ControlStatus, ControlStatusSchema, type Governance, GovernanceSchema, type Intent, IntentSchema, type JurisdictionClassification, JurisdictionClassificationSchema, type Owner, OwnerSchema, type RiskFactors, RiskFactorsSchema, type Technical, TechnicalSchema, type Trustworthiness, type TrustworthinessCharacteristic, TrustworthinessCharacteristicSchema, TrustworthinessSchema };
+export { type AigrcConfig, AigrcConfigSchema, type AigrcIntegrationsConfig, AigrcIntegrationsConfigSchema, type AigrcRuntimeConfig, AigrcRuntimeConfigSchema, ApprovalSchema, type AssetCard, type AssetCardRuntime, AssetCardRuntimeSchema, AssetCardSchema, type CapabilitiesManifest, CapabilitiesManifestSchema, type Classification, ClassificationSchema, type Constraints, ConstraintsSchema, type ControlStatus, ControlStatusSchema, type GoldenThread, GoldenThreadSchema, type Governance, GovernanceSchema, type GovernanceTokenCapabilityClaims, GovernanceTokenCapabilityClaimsSchema, type GovernanceTokenControlClaims, GovernanceTokenControlClaimsSchema, type GovernanceTokenGovernanceClaims, GovernanceTokenGovernanceClaimsSchema, type GovernanceTokenIdentityClaims, GovernanceTokenIdentityClaimsSchema, type GovernanceTokenLineageClaims, GovernanceTokenLineageClaimsSchema, type GovernanceTokenPayload, GovernanceTokenPayloadSchema, type Intent, IntentSchema, type JurisdictionClassification, JurisdictionClassificationSchema, type KillSwitchCommand, KillSwitchCommandSchema, type KillSwitchCommandType, KillSwitchCommandTypeSchema, type Lineage, LineageSchema, type OperatingMode, OperatingModeSchema, type Owner, OwnerSchema, type PolicyCapabilities, PolicyCapabilitiesSchema, type PolicyFile, PolicyFileSchema, type PolicyRule, type PolicyRuleEffect, PolicyRuleEffectSchema, PolicyRuleSchema, type RiskFactors, RiskFactorsSchema, type RiskLevel, RiskLevelSchema, type RuntimeIdentity, RuntimeIdentitySchema, type Technical, TechnicalSchema, type Trustworthiness, type TrustworthinessCharacteristic, TrustworthinessCharacteristicSchema, TrustworthinessSchema };