@archmax-ai/harness 0.0.0

package/dist/index.js

@@ -0,0 +1,197 @@
+/**
+ * `@archmax-ai/harness` — a generic, backend-driven agent runtime built on LangChain Deep
+ * Agents. Assemble a governed agent with {@link createAgent}, point it at a
+ * workspace of authored workflows, and drive it like any Deep Agent.
+ *
+ * The runtime reads its entire agent definition (machine spec, system prompt,
+ * skills, scripts) and session state through a single Deep Agents
+ * backend, so the same code runs over a local filesystem, a store, a sandbox, or
+ * a remote backend without modification.
+ *
+ * **What is public.** This barrel is the supported surface, and every export
+ * carries a docstring saying what it is for. It is deliberately small: an export
+ * is here because a real consumer needs it, not because a module happened to
+ * expose it. Adjacent surfaces live on their own subpaths — `@archmax-ai/harness/testing`
+ * (the case engine), `@archmax-ai/harness/cli` (the state-flow renderer), and
+ * `@archmax-ai/harness/sandbox` (hook and script authoring) — so a production import never
+ * pulls in test machinery.
+ *
+ * Two **light** subpaths mirror part of this surface without the runtime behind
+ * it: `@archmax-ai/harness/spec` (the schema, the pure validator and the grammars —
+ * browser-safe) and `@archmax-ai/harness/messages` (transcript readers). A name on
+ * both is the same binding.
+ *
+ * Anything not exported here is internal and may change without a major version.
+ */
+// --- Assembly -----------------------------------------------------------------
+/**
+ * Assemble an agent: Deep Agents' own parameters plus `workflow`. Omit `workflow`
+ * for a plain Deep Agent; supply it and the same agent is governed by that
+ * machine. Returns a wrapper over the compiled graph — `invoke` / `stream` /
+ * `graph` — with governance under `.workflow`.
+ */
+export { createAgent } from "./assembly/index.js";
+/** The wrapper class {@link createAgent} returns. */
+export { ArchmaxAgent } from "./agent.js";
+/**
+ * Read a session that must be parked in `status` — the checkpointed status **and**
+ * a live suspension — or `null`. What every resume asks before touching the graph.
+ */
+export { readParkedSession } from "./sessions/resume.js";
+export { 
+/** The park record a session's checkpointed values hold, on either channel, or `null`. */
+pendingParkOf, 
+/** The state a park record names, across the current and the deprecated spelling. */
+parkedStateOf, } from "./workflow/state.js";
+// --- Errors -------------------------------------------------------------------
+//
+// Each is thrown by assembly or by a public operation, so a consumer that wants
+// to distinguish a cause from a message needs the class.
+export { 
+/** A named workflow has no loadable machine spec — assembly fails closed. */
+WorkflowLoadError, 
+/** A turn would start a session on a workflow that declares `disabled: true`. */
+WorkflowDisabledError, } from "./machine/load-spec.js";
+/** A trigger id the machine does not declare. */
+export { UnknownTriggerError } from "./machine/triggers.js";
+/** A host tool wearing a reserved `archmax_` name. */
+export { ReservedToolNameError } from "./machine/tool-names.js";
+/** A seeded variable name that is not a legal identifier. */
+export { InvalidVariableNameError } from "./machine/variables.js";
+/** A mount key shadows a session area. */
+export { MountCollisionError } from "./core/mounts.js";
+export { 
+/** A custom `backend` was supplied without a `sessionStore`. */
+SessionStoreRequiredError, 
+/** A session id that would escape its zone or shadow a reserved name. */
+SessionStoreIdError, 
+/** A session operation the configured store cannot perform (delete, list). */
+SessionStoreCapabilityError, } from "./core/session-store.js";
+export { 
+/** The authoring backend was also served by a writable mount. */
+AuthoringBackendExposedError, 
+/** @deprecated Older spelling of {@link AuthoringBackendExposedError}; kept for one release. */
+AuthoringPlaneExposedError, 
+/** A partly composed workspace needed a filesystem default and no `rootDir` was given. */
+WorkspaceRootRequiredError, } from "./core/workspace-context.js";
+/** A workspace declared a `runtime.version` this build does not implement. */
+export { UnsupportedRuntimeContractError } from "./runtime/contract.js";
+export { 
+/** A decision or reply for a session not parked at a human state. */
+SessionNotParkedError, 
+/** A decision naming a target the parked state does not declare. */
+InvalidDecisionTargetError, 
+/** A reply with nothing to answer. */
+EmptyMessageError, 
+/** A delivery to a session not parked with `archmax_wait`. */
+SessionNotAwaitingInputError, 
+/** A delivery naming no trigger id. */
+MissingDeliveryTriggerError, } from "./sessions/resume.js";
+/** A firing for a session whose turn is still in progress. */
+export { SessionNotResumableError } from "./sessions/resolve.js";
+// --- Workspace composition ----------------------------------------------------
+/** The conventional mount table for a filesystem workspace. */
+export { defaultMounts } from "./core/mounts.js";
+/** Rebase one backend so it can serve several mounts. */
+export { mountSubtree } from "./core/path-mapping.js";
+export { 
+/** Filesystem session store (the zero-config default). */
+createFilesystemSessionStore, 
+/** Session store over any Deep Agents backend (e.g. S3). */
+createBackendSessionStore, 
+/** Ephemeral session store, for tests and one-shot sessions. */
+createMemorySessionStore, } from "./core/session-store.js";
+/** Whether a name is reserved at the workspace root (a session area or a mount). */
+export { isReservedRootName } from "./core/zones.js";
+/** Why a session id cannot own a session folder, or `null` when it can — the rule every ingress applies. */
+export { sessionIdRejection } from "./core/session-id.js";
+/** Whether one session was dispatched by another (`<parent>~<state>:<workflow>:<n>`), at any depth. */
+export { isChildSessionOf } from "./sessions/scope.js";
+/** Which zone a workspace path belongs to — the kernel's own classifier (a host maps evidence paths with it). */
+export { classifyWorkspacePath } from "./core/zones.js";
+/**
+ * Build the workspace composite the assembly uses. Public because a consumer
+ * serving authored content from its own backend needs the same composition.
+ */
+export { createWorkspaceContext } from "./core/workspace-context.js";
+/** Where a workspace may override the bundled platform prompt (`.platform/system/GRAPH_STATE.md`). */
+export { PLATFORM_BACKEND_PROMPT_PATH } from "./workflow/paths.js";
+// --- Prompt and message plumbing ---------------------------------------------
+//
+// Blessed internals. A consumer that assembles its own agent needs exactly these
+// to compose a system prompt and read what a session said.
+/** Compose the system prompt from persona, platform, zones and workflow layers. */
+export { resolveSystemPrompt } from "./core/prompt.js";
+/** Bind a `name → tool` map in the shape the `tools` option takes. */
+export { toolsFromMap } from "./workflow/agent-tools.js";
+/** A message's text, whatever content-block shape it arrived in. */
+export { contentToString } from "./core/messages.js";
+/** Whether a message is the assistant's turn. */
+export { isAiMessage } from "./core/messages.js";
+/** The last thing the agent said to the person; tool results and runtime notes are skipped. */
+export { lastAgentText } from "./core/messages.js";
+/**
+ * Whether the runtime wrote a transcript message rather than a person — a
+ * decision, an arrival, an error route, a completion check, a child's result.
+ * A host slicing a turn out of a session's messages, or rendering a transcript,
+ * asks this instead of inferring authorship from role.
+ */
+export { isRuntimeNote } from "./core/messages.js";
+/** Which kind of runtime note a message is, or `null` if a person wrote it. */
+export { runtimeNoteKind } from "./core/messages.js";
+/** Parse a sandbox script's leading description block. */
+export { parseCodeDescription } from "./core/code-description.js";
+// --- The machine --------------------------------------------------------------
+/** Load and shape-check a `workflow.yaml` without assembling an agent. */
+export { loadMachineSpec } from "./machine/load-spec.js";
+/** A `before:`/`after:` declaration as a flat list of hooks. */
+export { normalizeHooks } from "./lifecycle/hook-shape.js";
+/** The compiled machine, as `agent.workflow.machine` exposes it. */
+export { WorkflowMachine } from "./machine/machine.js";
+/** Statically validate a workflow scaffold — no model calls. */
+export { validateWorkflow } from "./validate/validate.js";
+/**
+ * The dispatcher's default delegation bounds. Public because a host configuring
+ * `bounds` needs to know what it is overriding.
+ */
+export { DEFAULT_SUB_WORKFLOW_DEPTH, DEFAULT_SUB_WORKFLOW_CONCURRENCY, } from "./machine/delegation.js";
+// --- Names a host must not hard-code -----------------------------------------
+export { 
+/** The entry trigger id (`manual`). */
+MANUAL_TRIGGER, 
+/** The trigger applied when none is supplied (same value as `MANUAL_TRIGGER`). */
+DEFAULT_TRIGGER_ID, 
+/** The session id a firing of a trigger resolves to under a spec, or `undefined` when the runtime mints one. */
+sessionIdForTrigger, } from "./machine/triggers.js";
+/** Default workflow slug when none is named. */
+export { DEFAULT_WORKFLOW } from "./workflow/paths.js";
+export { 
+/** Prefix of every delegation tool name. */
+WORKFLOW_TOOL_PREFIX, 
+/** The delegation tool name for a workflow slug. */
+workflowToolName, 
+/** The workflow slug a delegation tool name refers to. */
+workflowSlugFromToolName, } from "./machine/tool-names.js";
+// --- Token accounting ---------------------------------------------------------
+/** Fold `model-usage` events into per-session totals and cost. */
+export { createUsageTracker } from "./core/usage.js";
+/** Render a usage summary for a footer or a log line. */
+export { formatUsage } from "./core/usage.js";
+// --- Environment --------------------------------------------------------------
+//
+// A backend that assembles its own runtime needs these and there is no `./env`
+// subpath. Dropping one is a silent break: destructuring a missing named export
+// off a dynamic `import()` yields `undefined`.
+/** Build the env-configured chat model to pass as `model`. */
+export { createChatModel } from "./env.js";
+export { 
+/**
+ * The bundled authoring skill's parent directory (holding `archmax-harness/`), so an
+ * authoring agent's reference always matches the installed SDK.
+ */
+BUNDLED_AUTHORING_SKILL_DIR, 
+/** @deprecated Use `BUNDLED_AUTHORING_SKILL_DIR`; same value. */
+BUNDLED_SKILLS_DIR, } from "./env.js";
+/** This package's version, as session metadata records it. */
+export { PACKAGE_VERSION } from "./env.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,iFAAiF;AAEjF;;;;;GAKG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,qDAAqD;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAiD1C;;;GAGG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO;AACL,0FAA0F;AAC1F,aAAa;AACb,qFAAqF;AACrF,aAAa,GACd,MAAM,qBAAqB,CAAC;AAqB7B,iFAAiF;AACjF,EAAE;AACF,gFAAgF;AAChF,yDAAyD;AAEzD,OAAO;AACL,6EAA6E;AAC7E,iBAAiB;AACjB,iFAAiF;AACjF,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,iDAAiD;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,sDAAsD;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,6DAA6D;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,0CAA0C;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO;AACL,gEAAgE;AAChE,yBAAyB;AACzB,yEAAyE;AACzE,mBAAmB;AACnB,8EAA8E;AAC9E,2BAA2B,GAC5B,MAAM,yBAAyB,CAAC;AACjC,OAAO;AACL,iEAAiE;AACjE,4BAA4B;AAC5B,gGAAgG;AAChG,0BAA0B;AAC1B,0FAA0F;AAC1F,0BAA0B,GAC3B,MAAM,6BAA6B,CAAC;AACrC,8EAA8E;AAC9E,OAAO,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO;AACL,qEAAqE;AACrE,qBAAqB;AACrB,oEAAoE;AACpE,0BAA0B;AAC1B,sCAAsC;AACtC,iBAAiB;AACjB,8DAA8D;AAC9D,4BAA4B;AAC5B,uCAAuC;AACvC,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,8DAA8D;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEjE,iFAAiF;AAEjF,+DAA+D;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,yDAAyD;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAItD,OAAO;AACL,0DAA0D;AAC1D,4BAA4B;AAC5B,4DAA4D;AAC5D,yBAAyB;AACzB,gEAAgE;AAChE,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AAIjC,oFAAoF;AACpF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,4GAA4G;AAC5G,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,uGAAuG;AACvG,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,iHAAiH;AACjH,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAKxD;;;GAGG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAGrE,sGAAsG;AACtG,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AAEnE,gFAAgF;AAChF,EAAE;AACF,iFAAiF;AACjF,2DAA2D;AAE3D,mFAAmF;AACnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,sEAAsE;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,oEAAoE;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,iDAAiD;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,+FAA+F;AAC/F,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD;;;;;GAKG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,+EAA+E;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAMrD,0DAA0D;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAElE,iFAAiF;AAEjF,0EAA0E;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,gEAAgE;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,oEAAoE;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,gEAAgE;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAM1D;;;GAGG;AACH,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,GACjC,MAAM,yBAAyB,CAAC;AAEjC,gFAAgF;AAEhF,OAAO;AACL,uCAAuC;AACvC,cAAc;AACd,kFAAkF;AAClF,kBAAkB;AAClB,gHAAgH;AAChH,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,gDAAgD;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO;AACL,4CAA4C;AAC5C,oBAAoB;AACpB,oDAAoD;AACpD,gBAAgB;AAChB,0DAA0D;AAC1D,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AAWjC,iFAAiF;AAEjF,kEAAkE;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,yDAAyD;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAG9C,iFAAiF;AACjF,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,+CAA+C;AAE/C,8DAA8D;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO;AACL;;;GAGG;AACH,2BAA2B;AAC3B,iEAAiE;AACjE,kBAAkB,GACnB,MAAM,UAAU,CAAC;AAClB,8DAA8D;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC"}

package/dist/kernel/kernel.d.ts

@@ -0,0 +1,192 @@
+import type { WorkflowMachine } from "../machine/machine.js";
+import type { ForbidEntry } from "../machine/types.js";
+import type { VariableStore } from "../machine/variables.js";
+import { type MountPrefixes } from "../core/mounts.js";
+import { type SkillPrefixes } from "../core/skills.js";
+import type { LifecycleDecision } from "../lifecycle/runner.js";
+/**
+ * The decision kernel: a single pure, synchronous function that produces every
+ * governance verdict from the machine spec, a snapshot of checkpointed workflow
+ * state, and a proposed action. Effectful work (running hooks/judges) happens in
+ * `LifecycleRunner`; its outputs are reduced here as {@link HookFact}s so the
+ * kernel stays pure and both runtime enforcement and static validation share one
+ * code path.
+ */
+export type VerdictDecision = "allow" | "block";
+export interface Verdict {
+    decision: VerdictDecision;
+    /**
+     * A block the agent cannot recover from by retrying: the harness could not
+     * evaluate the declared governance at all. The middleware ends the turn as a
+     * failure (routed by `on_error`) rather than returning a retryable error.
+     * Absent means an ordinary, recoverable block.
+     */
+    terminal?: boolean;
+    /** Stable identifier for the rule that produced this verdict (for diagnostics/tests). */
+    ruleId: string;
+    /** Human-readable explanation, present on `block`. */
+    reason?: string;
+    /** Tool-call blocks: whether the block should surface as a warn-level event. */
+    warn?: boolean;
+    /** Transition reductions: whether the deciding hook consumed one of its iterations. */
+    correctionConsumed?: boolean;
+    /**
+     * Transition reductions: whether the block is a `correct` refused because the
+     * hook's `max_iterations` are already spent. Retrying in place cannot clear
+     * it, so the runner reports it as a terminal rejection.
+     */
+    budgetExhausted?: boolean;
+}
+/**
+ * A reduced lifecycle-hook outcome. `LifecycleRunner` executes a hook, parses
+ * its return value into a {@link LifecycleDecision}, and hands it here (with an
+ * optional `error` when the hook could not execute) for reduction.
+ */
+export interface HookFact extends LifecycleDecision {
+    /** Present when the hook could not execute; reduces to a fail-closed veto. */
+    error?: string;
+    /** Bounded grade-and-retry budget for an `after` hook of any kind (0 = none). */
+    maxIterations?: number;
+    /** Iterations already consumed for this state. */
+    iterationsUsed?: number;
+}
+/**
+ * Who initiated a tool call. `agent` (the default) is a call the model made
+ * directly; `script` is a programmatic call from a sandbox script, governed
+ * identically to an agent call in the same state; `lifecycle` is a programmatic
+ * call from a lifecycle hook, which runs on harness authority and skips the
+ * per-state allow list and nothing else.
+ */
+export type ToolCallOrigin = "agent" | "script" | "lifecycle";
+export type ProposedAction = {
+    kind: "tool-call";
+    state: string;
+    tool: string;
+    args: Record<string, unknown>;
+    /** Defaults to `agent` when absent. */
+    origin?: ToolCallOrigin;
+    /**
+     * Whether the call was made during a **reply-only turn** — the run parked,
+     * the model handed no tools. Supplied by the caller that knows which turn
+     * it is in; absent means an ordinary turn.
+     */
+    replyOnly?: boolean;
+} | {
+    kind: "transition";
+    from: string;
+    to: string;
+    reason?: string;
+    hookFacts: HookFact[];
+} | {
+    kind: "enter-state";
+    state: string;
+    hookFacts: HookFact[];
+};
+/** Read-only context a governance rule may consult. */
+export interface RuleApi {
+    machine: WorkflowMachine;
+    /**
+     * The run's variables, so a guard's `${{name}}` references resolve. Absent,
+     * every reference is unresolvable and fails closed: the guard blocks.
+     */
+    variables?: VariableStore;
+    /**
+     * The workspace's resolved mount keys, supplied by the caller — the kernel
+     * holds no list of authored directory names. Absent, no path classifies as
+     * authored, which is safe because read-only mounts refuse writes themselves.
+     */
+    mountPrefixes?: MountPrefixes;
+    /**
+     * The workspace's resolved skill bundles (slug → bundle prefix), supplied by
+     * the caller. Absent or empty, no path lands inside a bundle and
+     * {@link skillRule} never fires.
+     */
+    skills?: SkillPrefixes;
+}
+/**
+ * A single governance rule: a pure function over a proposed action that either
+ * returns a {@link Verdict} (its opinion) or `null` (abstain). The kernel folds
+ * the ordered rule pipeline and the first non-null verdict wins; when every rule
+ * abstains the default is allow.
+ */
+export type GovernanceRule = (action: ProposedAction, api: RuleApi) => Verdict | null;
+/**
+ * Agent tools that scripts may never invoke through programmatic tool calling
+ * (PTC): every harness control tool (including both sandbox entry points, so
+ * sandboxed code cannot re-enter the sandbox) plus a bare `eval`. Owned by
+ * governance so the interpreter and the lifecycle runner cannot drift.
+ */
+export declare const PTC_EXCLUDED_TOOLS: ReadonlySet<string>;
+/**
+ * Whether a workspace-relative path targets the read-only authored zone (an
+ * authored mount or an authored root file), via the shared table in
+ * `core/zones.ts` so runtime, mount routing, and validation agree.
+ */
+export declare function isReadOnlyZonePath(path: string, mounts?: MountPrefixes): boolean;
+/**
+ * Reduce a single lifecycle-hook fact to a verdict. Fail-closed: an execution
+ * error is a veto. `before` hooks gate entry with `ok`/`veto` only — a `correct`
+ * at entry has nothing to retry, so it reduces to a veto and never consumes the
+ * correction budget. Within an `after` veto window any hook's `correct` (script
+ * or subagent judge alike) enters the same bounded correction flow, budgeted by
+ * the hook's `max_corrections`.
+ */
+export declare function reduceHookFact(fact: HookFact, opts: {
+    phase: "before" | "after" | "tool";
+    veto: boolean;
+    to?: string;
+}): Verdict;
+/**
+ * An **ancestor's** `mounts.forbid_always`, as rules the descendant inherits.
+ * The mount twin of {@link compileForbiddenSkillRules}: a child machine resolves
+ * its own enabled set and cannot see a caller's denial, so the denial travels as
+ * a rule — any path under one of those mounts is refused, whatever the child
+ * granted itself, and the refusal names the workflow that denied it.
+ *
+ * A workflow-wide denial binds a hook and a rubric grader too, so this rule —
+ * unlike {@link mountRule} — does not exempt the `lifecycle` origin.
+ */
+export declare function compileForbiddenMountRules(names: readonly string[], source: string): GovernanceRule[];
+/**
+ * An **ancestor's** `skills.forbid_always`, as rules the descendant inherits. A
+ * child machine resolves its own enabled set and cannot see a caller's denial,
+ * so the denial travels as a rule: any path inside one of those bundles is
+ * refused, whatever the child granted itself.
+ */
+export declare function compileForbiddenSkillRules(slugs: readonly string[], source: string): GovernanceRule[];
+/** Where a denial was declared, which decides its scope, ruleId and wording. */
+export type ForbidScope = "workflow" | "state";
+/**
+ * Compile a `forbid_always` (root) or `forbid` (state) list into governance
+ * rules. One implementation for both positions: the entries share the `allow`
+ * grammar, so `normalizeAllowEntry` and the argument-guard matcher are the same
+ * ones the grant side uses, and the two differ only in what they match and how
+ * the refusal reads.
+ *
+ * A denial is evaluated ahead of every grant and every consumer rule, so **deny
+ * beats allow and no narrower level widens a denial**: nothing reaches past a
+ * workflow's `forbid_always`, and nothing in a state reaches past its `forbid`.
+ * An entry naming the tool `*` denies every tool; an entry with argument guards
+ * denies only the calls those guards match.
+ *
+ * Returns an empty list for an empty declaration, so the pipeline is unchanged
+ * for a workflow that denies nothing. Pure — the same rules run at runtime and
+ * in the validator.
+ */
+export declare function compileForbidRules(entries: readonly ForbidEntry[] | undefined, options: {
+    scope: ForbidScope;
+    /** The state the entries belong to. Required for `scope: "state"`. */
+    state?: string;
+    /**
+     * The workflow that declared this denial, named in the block reason when it
+     * is an **ancestor** of the governed machine — a delegated machine inherits
+     * every ancestor's denials, so the refusal must say whose rule stopped it.
+     */
+    source?: string;
+}): GovernanceRule[];
+/**
+ * The single governance decision function. Given the machine, a proposed action,
+ * and any consumer-supplied governance rules, return a typed verdict. Pure and
+ * synchronous, so runtime enforcement and static validation share one path.
+ */
+export declare function decide(machine: WorkflowMachine, action: ProposedAction, customRules?: GovernanceRule[], mountPrefixes?: MountPrefixes, variables?: VariableStore, skills?: SkillPrefixes): Verdict;