@b00dea/cockpit 0.0.0-bootstrap.0 → 0.1.0

package/dist/schema.d.ts

@@ -0,0 +1,1322 @@
+import { z } from 'zod';
+export declare const STRUCTURED_INPUT_ENTRY_LIMIT = 4096;
+export type Mount = 'always' | 'host' | 'none' | `profile:${string}`;
+export declare const Mount: z.ZodType<Mount>;
+export declare const Acquire: z.ZodEnum<{
+    auto: "auto";
+    manual: "manual";
+    none: "none";
+}>;
+export declare const AddressingPosture: z.ZodEnum<{
+    hostname: "hostname";
+    port: "port";
+}>;
+export declare const AuthPosture: z.ZodEnum<{
+    bypassed: "bypassed";
+    none: "none";
+    real: "real";
+}>;
+declare const Toolchain: z.ZodEnum<{
+    dotnet: "dotnet";
+    go: "go";
+    node: "node";
+    none: "none";
+    python: "python";
+    ruby: "ruby";
+    rust: "rust";
+}>;
+export declare const EnvironmentFile: z.ZodObject<{
+    template: z.ZodString;
+    instance: z.ZodString;
+}, z.core.$strict>;
+export declare const MAX_COLD_START_SECONDS = 3600;
+export declare const MachineFloor: z.ZodObject<{
+    runtime_memory_mb: z.ZodNumber;
+    runtime_cpus: z.ZodNumber;
+    free_disk_mb: z.ZodNumber;
+    cold_start_seconds: z.ZodNumber;
+}, z.core.$strict>;
+export declare const ResettableVolumeId: z.ZodString;
+export declare const GeneratedHostPath: z.ZodString;
+export declare function parseBrowserNetworkExposure(value: string | undefined, reason: string | undefined): Readonly<{
+    value: string;
+    reason?: string;
+}>;
+export declare const EntrypointDerivative: z.ZodObject<{
+    name: z.ZodString;
+    kind: z.ZodEnum<{
+        advertised_listener: "advertised_listener";
+        callback_url: "callback_url";
+        cors_origin: "cors_origin";
+        entrypoint: "entrypoint";
+        origin: "origin";
+        public_base_url: "public_base_url";
+    }>;
+    port: z.ZodString;
+    path: z.ZodString;
+    hostname: z.ZodOptional<z.ZodString>;
+    scheme: z.ZodOptional<z.ZodEnum<{
+        http: "http";
+        https: "https";
+    }>>;
+}, z.core.$strict>;
+export declare const GuardCommandArgv: z.ZodArray<z.ZodString>;
+export declare const InstallPolicy: z.ZodObject<{
+    toolchain: z.ZodEnum<{
+        dotnet: "dotnet";
+        go: "go";
+        node: "node";
+        python: "python";
+        ruby: "ruby";
+        rust: "rust";
+    }>;
+    lockfile: z.ZodString;
+    build: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    test: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+export declare const Provenance: z.ZodObject<{
+    source: z.ZodString;
+    observed_on: z.ZodOptional<z.ZodString>;
+    kind: z.ZodEnum<{
+        declared: "declared";
+        inferred: "inferred";
+        measured: "measured";
+    }>;
+    reason: z.ZodString;
+    confirmed: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export declare const Environment: z.ZodObject<{
+    addressing: z.ZodOptional<z.ZodEnum<{
+        hostname: "hostname";
+        port: "port";
+    }>>;
+    authentication: z.ZodOptional<z.ZodEnum<{
+        bypassed: "bypassed";
+        none: "none";
+        real: "real";
+    }>>;
+    posture_requirements: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        requirement: z.ZodString;
+        addressing: z.ZodOptional<z.ZodEnum<{
+            hostname: "hostname";
+            port: "port";
+        }>>;
+        authentication: z.ZodOptional<z.ZodEnum<{
+            bypassed: "bypassed";
+            none: "none";
+            real: "real";
+        }>>;
+    }, z.core.$strict>>>;
+    machine: z.ZodOptional<z.ZodObject<{
+        runtime_memory_mb: z.ZodNumber;
+        runtime_cpus: z.ZodNumber;
+        free_disk_mb: z.ZodNumber;
+        cold_start_seconds: z.ZodNumber;
+    }, z.core.$strict>>;
+    resettable_volumes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    generated_host_paths: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    compose_files: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    entrypoint_derivatives: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        kind: z.ZodEnum<{
+            advertised_listener: "advertised_listener";
+            callback_url: "callback_url";
+            cors_origin: "cors_origin";
+            entrypoint: "entrypoint";
+            origin: "origin";
+            public_base_url: "public_base_url";
+        }>;
+        port: z.ZodString;
+        path: z.ZodString;
+        hostname: z.ZodOptional<z.ZodString>;
+        scheme: z.ZodOptional<z.ZodEnum<{
+            http: "http";
+            https: "https";
+        }>>;
+    }, z.core.$strict>>>;
+    install_policies: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        toolchain: z.ZodEnum<{
+            dotnet: "dotnet";
+            go: "go";
+            node: "node";
+            python: "python";
+            ruby: "ruby";
+            rust: "rust";
+        }>;
+        lockfile: z.ZodString;
+        build: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        test: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>>;
+    seed: z.ZodOptional<z.ZodObject<{
+        argv: z.ZodArray<z.ZodString>;
+        timeout_seconds: z.ZodNumber;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const OPERATOR_GATE_RISK_PATTERN: string;
+export declare function requiresOperatorGate(sibling: {
+    mount: Mount;
+    purpose: string;
+}): boolean;
+export declare function deriveSiblingVariable(slug: string): string;
+export declare const SIBLING_DEFAULT_GUIDES: readonly string[];
+export declare const Sibling: z.ZodObject<{
+    slug: z.ZodString;
+    dir: z.ZodUnion<readonly [z.ZodLiteral<".">, z.ZodString]>;
+    remote: z.ZodOptional<z.ZodString>;
+    branch: z.ZodOptional<z.ZodString>;
+    mount: z.ZodType<Mount, unknown, z.core.$ZodTypeInternals<Mount, unknown>>;
+    acquire: z.ZodEnum<{
+        auto: "auto";
+        manual: "manual";
+        none: "none";
+    }>;
+    var: z.ZodString;
+    toolchain: z.ZodDefault<z.ZodEnum<{
+        dotnet: "dotnet";
+        go: "go";
+        node: "node";
+        none: "none";
+        python: "python";
+        ruby: "ruby";
+        rust: "rust";
+    }>>;
+    gate: z.ZodOptional<z.ZodEnum<{
+        operator: "operator";
+    }>>;
+    host_reason: z.ZodOptional<z.ZodString>;
+    guides: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    instruction_pointer: z.ZodDefault<z.ZodBoolean>;
+    purpose: z.ZodString;
+    environment_files: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        template: z.ZodString;
+        instance: z.ZodString;
+    }, z.core.$strict>>>;
+    derives: z.ZodOptional<z.ZodObject<{
+        mcp_sources: z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            provenance: z.ZodObject<{
+                source: z.ZodString;
+                observed_on: z.ZodOptional<z.ZodString>;
+                kind: z.ZodEnum<{
+                    declared: "declared";
+                    inferred: "inferred";
+                    measured: "measured";
+                }>;
+                reason: z.ZodString;
+                confirmed: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const Guards: z.ZodObject<{
+    hosted_db_hosts: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    vendor_endpoint_hosts: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    protected_branches: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    allow: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        argv: z.ZodArray<z.ZodString>;
+        reason: z.ZodString;
+        cwd: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<".">, z.ZodString]>>;
+    }, z.core.$strict>>>;
+    deny: z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        prefix: z.ZodArray<z.ZodString>;
+        reason: z.ZodString;
+        fix: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        contains: z.ZodArray<z.ZodString>;
+        reason: z.ZodString;
+        fix: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>]>>>;
+}, z.core.$strict>;
+export declare const TESTING_STAGE_TIMEOUT_MAX_SECONDS = 7200;
+export declare const EVALUATOR_COMMANDS: Readonly<{
+    readonly codexcli: 'codex';
+    readonly claudecode: 'claude';
+    readonly opencode: 'opencode';
+}>;
+export type EvaluatorTool = keyof typeof EVALUATOR_COMMANDS;
+export declare function runningEvaluatorTool(env: Readonly<Record<string, string | undefined>>): EvaluatorTool | undefined;
+export declare const DECIDERS: readonly ['agent', 'person', 'ci'];
+export type Decider = typeof DECIDERS[number];
+export declare const WORK_GRADING: readonly ['independent', 'checks', 'self'];
+export type WorkGrading = typeof WORK_GRADING[number];
+export declare const Work: z.ZodObject<{
+    grading: z.ZodDefault<z.ZodEnum<{
+        checks: "checks";
+        independent: "independent";
+        self: "self";
+    }>>;
+    evaluators: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        claudecode: "claudecode";
+        codexcli: "codexcli";
+        opencode: "opencode";
+    }>>>;
+    attempt_cap: z.ZodDefault<z.ZodNumber>;
+    wip_cap: z.ZodDefault<z.ZodNumber>;
+    verification_timeout_seconds: z.ZodDefault<z.ZodNumber>;
+    evaluator_timeout_seconds: z.ZodDefault<z.ZodNumber>;
+    gates: z.ZodPrefault<z.ZodObject<{
+        accept: z.ZodOptional<z.ZodEnum<{
+            agent: "agent";
+            ci: "ci";
+            person: "person";
+        }>>;
+        amend: z.ZodOptional<z.ZodEnum<{
+            agent: "agent";
+            ci: "ci";
+            person: "person";
+        }>>;
+        answer: z.ZodOptional<z.ZodEnum<{
+            agent: "agent";
+            ci: "ci";
+            person: "person";
+        }>>;
+        signoff: z.ZodOptional<z.ZodEnum<{
+            agent: "agent";
+            ci: "ci";
+            person: "person";
+        }>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const Autonomy: z.ZodObject<{
+    sync: z.ZodOptional<z.ZodEnum<{
+        agent: "agent";
+        ci: "ci";
+        person: "person";
+    }>>;
+    stale_delete: z.ZodOptional<z.ZodEnum<{
+        agent: "agent";
+        ci: "ci";
+        person: "person";
+    }>>;
+    reset: z.ZodOptional<z.ZodEnum<{
+        agent: "agent";
+        ci: "ci";
+        person: "person";
+    }>>;
+    mcp_approve: z.ZodOptional<z.ZodEnum<{
+        agent: "agent";
+        person: "person";
+    }>>;
+}, z.core.$strict>;
+export declare const BROWSER_DRIVER_VERSION: RegExp;
+/** Playwright refuses a client and server whose major.minor differ, so only that much must agree. */
+export declare function browserDriversCompatible(left: string, right: string): boolean;
+export declare const Browser: z.ZodObject<{
+    engine: z.ZodDefault<z.ZodEnum<{
+        chromium: "chromium";
+        firefox: "firefox";
+        webkit: "webkit";
+    }>>;
+    network_exposure: z.ZodDefault<z.ZodString>;
+    network_exposure_reason: z.ZodOptional<z.ZodString>;
+    harnesses: z.ZodArray<z.ZodObject<{
+        target: z.ZodEnum<{
+            claudecode: "claudecode";
+            codexcli: "codexcli";
+            opencode: "opencode";
+        }>;
+        version: z.ZodString;
+    }, z.core.$strict>>;
+    images: z.ZodObject<{
+        mcp: z.ZodObject<{
+            reference: z.ZodString;
+            driver_version: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    project: z.ZodObject<{
+        manifest: z.ZodOptional<z.ZodString>;
+        manifest_sha256: z.ZodOptional<z.ZodString>;
+        lockfile: z.ZodString;
+        sha256: z.ZodString;
+        driver_version: z.ZodString;
+    }, z.core.$strict>;
+    endpoint: z.ZodOptional<z.ZodString>;
+    max_clients: z.ZodNumber;
+    proxy: z.ZodObject<{
+        host_variable: z.ZodOptional<z.ZodString>;
+        server_port: z.ZodNumber;
+        proxy_port: z.ZodNumber;
+        allowed_hosts: z.ZodArray<z.ZodString>;
+        bind: z.ZodDefault<z.ZodEnum<{
+            "127.0.0.1": "127.0.0.1";
+            "::1": "::1";
+        }>>;
+    }, z.core.$strict>;
+    resolver: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        hostname: z.ZodString;
+        address: z.ZodUnion<readonly [z.ZodIPv4, z.ZodIPv6]>;
+    }, z.core.$strict>>>;
+    authentication: z.ZodObject<{
+        policy: z.ZodEnum<{
+            none: "none";
+            "per-worker": "per-worker";
+            serialized: "serialized";
+        }>;
+        states: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            worker: z.ZodString;
+            path: z.ZodString;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>;
+    data: z.ZodObject<{
+        mode: z.ZodEnum<{
+            empty: "empty";
+            restored: "restored";
+            seeded: "seeded";
+        }>;
+        isolated: z.ZodBoolean;
+        reaches_production: z.ZodBoolean;
+    }, z.core.$strict>;
+    request_preapproval: z.ZodDefault<z.ZodBoolean>;
+    artifacts: z.ZodObject<{
+        mcp: z.ZodString;
+        cli: z.ZodString;
+        auth: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const TestingName: z.ZodString;
+export declare const Testing: z.ZodObject<{
+    stages: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        command: z.ZodArray<z.ZodString>;
+        requires_stack: z.ZodBoolean;
+        timeout_seconds: z.ZodDefault<z.ZodNumber>;
+        select: z.ZodOptional<z.ZodObject<{
+            spec: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            file: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            test: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            route: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    gates: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        tier: z.ZodEnum<{
+            full: "full";
+            targeted: "targeted";
+        }>;
+        stages: z.ZodArray<z.ZodString>;
+        changes: z.ZodString;
+    }, z.core.$strict>>;
+    native_hooks: z.ZodDefault<z.ZodObject<{
+        install: z.ZodDefault<z.ZodEnum<{
+            "explicit-native": "explicit-native";
+            inspect: "inspect";
+        }>>;
+    }, z.core.$strict>>;
+    native_hook_policy: z.ZodOptional<z.ZodObject<{
+        path: z.ZodString;
+        sha256: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+declare const SurfaceSource: z.ZodObject<{
+    path: z.ZodIntersection<z.ZodString, z.ZodString>;
+    bytes: z.ZodString;
+}, z.core.$strict>;
+declare const SurfaceOverrideReference: z.ZodObject<{
+    name: z.ZodString;
+    sha256: z.ZodString;
+}, z.core.$strict>;
+export declare const SurfaceDeclaration: z.ZodObject<{
+    name: z.ZodString;
+    feature: z.ZodEnum<{
+        hooks: "hooks";
+        mcp: "mcp";
+        permissions: "permissions";
+        rules: "rules";
+        skills: "skills";
+        subagents: "subagents";
+    }>;
+    sources: z.ZodArray<z.ZodObject<{
+        path: z.ZodIntersection<z.ZodString, z.ZodString>;
+        bytes: z.ZodString;
+    }, z.core.$strict>>;
+    source: z.ZodIntersection<z.ZodString, z.ZodString>;
+    replaces: z.ZodOptional<z.ZodObject<{
+        name: z.ZodString;
+        sha256: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const SurfaceOverlay: z.ZodObject<{
+    name: z.ZodString;
+    sources: z.ZodArray<z.ZodObject<{
+        path: z.ZodIntersection<z.ZodString, z.ZodString>;
+        bytes: z.ZodString;
+    }, z.core.$strict>>;
+    source: z.ZodIntersection<z.ZodString, z.ZodString>;
+    replaces: z.ZodOptional<z.ZodObject<{
+        name: z.ZodString;
+        sha256: z.ZodString;
+    }, z.core.$strict>>;
+    feature: z.ZodEnum<{
+        hooks: "hooks";
+        rules: "rules";
+        skills: "skills";
+        subagents: "subagents";
+    }>;
+}, z.core.$strict>;
+export declare const SurfaceAdoption: z.ZodObject<{
+    path: z.ZodEnum<{
+        ".claude/settings.json": ".claude/settings.json";
+        ".codex/config.toml": ".codex/config.toml";
+        ".codex/hooks.json": ".codex/hooks.json";
+    }>;
+    source: z.ZodIntersection<z.ZodString, z.ZodString>;
+    sha256: z.ZodString;
+    adopted_on: z.ZodString;
+    provenance: z.ZodObject<{
+        source: z.ZodString;
+        observed_on: z.ZodOptional<z.ZodString>;
+        kind: z.ZodEnum<{
+            declared: "declared";
+            inferred: "inferred";
+            measured: "measured";
+        }>;
+        reason: z.ZodString;
+        confirmed: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+declare const CustomHarnessCapability: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    feature: z.ZodEnum<{
+        hooks: "hooks";
+        mcp: "mcp";
+        permissions: "permissions";
+        rules: "rules";
+        skills: "skills";
+        subagents: "subagents";
+    }>;
+    measured_on: z.ZodString;
+    spelling: z.ZodIntersection<z.ZodString, z.ZodString>;
+    control: z.ZodIntersection<z.ZodString, z.ZodString>;
+    mechanism: z.ZodObject<{
+        module: z.ZodIntersection<z.ZodString, z.ZodString>;
+        export: z.ZodString;
+    }, z.core.$strict>;
+    state: z.ZodLiteral<"enforced">;
+    evidence: z.ZodObject<{
+        reference: z.ZodIntersection<z.ZodString, z.ZodString>;
+        sha256: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    feature: z.ZodEnum<{
+        hooks: "hooks";
+        mcp: "mcp";
+        permissions: "permissions";
+        rules: "rules";
+        skills: "skills";
+        subagents: "subagents";
+    }>;
+    measured_on: z.ZodString;
+    spelling: z.ZodIntersection<z.ZodString, z.ZodString>;
+    control: z.ZodIntersection<z.ZodString, z.ZodString>;
+    mechanism: z.ZodObject<{
+        module: z.ZodIntersection<z.ZodString, z.ZodString>;
+        export: z.ZodString;
+    }, z.core.$strict>;
+    state: z.ZodLiteral<"instructed">;
+}, z.core.$strict>, z.ZodObject<{
+    feature: z.ZodEnum<{
+        hooks: "hooks";
+        mcp: "mcp";
+        permissions: "permissions";
+        rules: "rules";
+        skills: "skills";
+        subagents: "subagents";
+    }>;
+    measured_on: z.ZodString;
+    state: z.ZodLiteral<"unavailable">;
+    reason: z.ZodString;
+}, z.core.$strict>], "state">;
+export declare const CustomHarness: z.ZodObject<{
+    name: z.ZodString;
+    capabilities: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        feature: z.ZodEnum<{
+            hooks: "hooks";
+            mcp: "mcp";
+            permissions: "permissions";
+            rules: "rules";
+            skills: "skills";
+            subagents: "subagents";
+        }>;
+        measured_on: z.ZodString;
+        spelling: z.ZodIntersection<z.ZodString, z.ZodString>;
+        control: z.ZodIntersection<z.ZodString, z.ZodString>;
+        mechanism: z.ZodObject<{
+            module: z.ZodIntersection<z.ZodString, z.ZodString>;
+            export: z.ZodString;
+        }, z.core.$strict>;
+        state: z.ZodLiteral<"enforced">;
+        evidence: z.ZodObject<{
+            reference: z.ZodIntersection<z.ZodString, z.ZodString>;
+            sha256: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        feature: z.ZodEnum<{
+            hooks: "hooks";
+            mcp: "mcp";
+            permissions: "permissions";
+            rules: "rules";
+            skills: "skills";
+            subagents: "subagents";
+        }>;
+        measured_on: z.ZodString;
+        spelling: z.ZodIntersection<z.ZodString, z.ZodString>;
+        control: z.ZodIntersection<z.ZodString, z.ZodString>;
+        mechanism: z.ZodObject<{
+            module: z.ZodIntersection<z.ZodString, z.ZodString>;
+            export: z.ZodString;
+        }, z.core.$strict>;
+        state: z.ZodLiteral<"instructed">;
+    }, z.core.$strict>, z.ZodObject<{
+        feature: z.ZodEnum<{
+            hooks: "hooks";
+            mcp: "mcp";
+            permissions: "permissions";
+            rules: "rules";
+            skills: "skills";
+            subagents: "subagents";
+        }>;
+        measured_on: z.ZodString;
+        state: z.ZodLiteral<"unavailable">;
+        reason: z.ZodString;
+    }, z.core.$strict>], "state">>;
+}, z.core.$strict>;
+declare const Surfaces: z.ZodObject<{
+    tools: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        claudecode: "claudecode";
+        codexcli: "codexcli";
+        cursor: "cursor";
+        grokcli: "grokcli";
+        opencode: "opencode";
+    }>>>;
+    overlays: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        sources: z.ZodArray<z.ZodObject<{
+            path: z.ZodIntersection<z.ZodString, z.ZodString>;
+            bytes: z.ZodString;
+        }, z.core.$strict>>;
+        source: z.ZodIntersection<z.ZodString, z.ZodString>;
+        replaces: z.ZodOptional<z.ZodObject<{
+            name: z.ZodString;
+            sha256: z.ZodString;
+        }, z.core.$strict>>;
+        feature: z.ZodEnum<{
+            hooks: "hooks";
+            rules: "rules";
+            skills: "skills";
+            subagents: "subagents";
+        }>;
+    }, z.core.$strict>>>;
+    harnesses: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        capabilities: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            feature: z.ZodEnum<{
+                hooks: "hooks";
+                mcp: "mcp";
+                permissions: "permissions";
+                rules: "rules";
+                skills: "skills";
+                subagents: "subagents";
+            }>;
+            measured_on: z.ZodString;
+            spelling: z.ZodIntersection<z.ZodString, z.ZodString>;
+            control: z.ZodIntersection<z.ZodString, z.ZodString>;
+            mechanism: z.ZodObject<{
+                module: z.ZodIntersection<z.ZodString, z.ZodString>;
+                export: z.ZodString;
+            }, z.core.$strict>;
+            state: z.ZodLiteral<"enforced">;
+            evidence: z.ZodObject<{
+                reference: z.ZodIntersection<z.ZodString, z.ZodString>;
+                sha256: z.ZodString;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            feature: z.ZodEnum<{
+                hooks: "hooks";
+                mcp: "mcp";
+                permissions: "permissions";
+                rules: "rules";
+                skills: "skills";
+                subagents: "subagents";
+            }>;
+            measured_on: z.ZodString;
+            spelling: z.ZodIntersection<z.ZodString, z.ZodString>;
+            control: z.ZodIntersection<z.ZodString, z.ZodString>;
+            mechanism: z.ZodObject<{
+                module: z.ZodIntersection<z.ZodString, z.ZodString>;
+                export: z.ZodString;
+            }, z.core.$strict>;
+            state: z.ZodLiteral<"instructed">;
+        }, z.core.$strict>, z.ZodObject<{
+            feature: z.ZodEnum<{
+                hooks: "hooks";
+                mcp: "mcp";
+                permissions: "permissions";
+                rules: "rules";
+                skills: "skills";
+                subagents: "subagents";
+            }>;
+            measured_on: z.ZodString;
+            state: z.ZodLiteral<"unavailable">;
+            reason: z.ZodString;
+        }, z.core.$strict>], "state">>;
+    }, z.core.$strict>>>;
+    bundles: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        "claudecode-plugin": "claudecode-plugin";
+    }>>>;
+    adopted: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        path: z.ZodEnum<{
+            ".claude/settings.json": ".claude/settings.json";
+            ".codex/config.toml": ".codex/config.toml";
+            ".codex/hooks.json": ".codex/hooks.json";
+        }>;
+        source: z.ZodIntersection<z.ZodString, z.ZodString>;
+        sha256: z.ZodString;
+        adopted_on: z.ZodString;
+        provenance: z.ZodObject<{
+            source: z.ZodString;
+            observed_on: z.ZodOptional<z.ZodString>;
+            kind: z.ZodEnum<{
+                declared: "declared";
+                inferred: "inferred";
+                measured: "measured";
+            }>;
+            reason: z.ZodString;
+            confirmed: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+export declare function configurationDefaults(): {
+    cockpit: {
+        siblings_root: string;
+        guide_cap: number;
+    };
+    sibling: {
+        toolchain: "dotnet" | "go" | "node" | "none" | "python" | "ruby" | "rust";
+        guides: string[];
+        instruction_pointer: boolean;
+    };
+    ports: {
+        step: number;
+        count: number;
+    };
+    guards: {
+        hosted_db_hosts: string[];
+        vendor_endpoint_hosts: string[];
+        protected_branches: string[];
+        allow: {
+            argv: string[];
+            reason: string;
+            cwd?: string | undefined;
+        }[];
+        deny: ({
+            prefix: string[];
+            reason: string;
+            fix?: string | undefined;
+        } | {
+            contains: string[];
+            reason: string;
+            fix?: string | undefined;
+        })[];
+    };
+    mcp: {
+        approved: Record<string, string>;
+    };
+    work: {
+        grading: "checks" | "independent" | "self";
+        evaluators?: ("claudecode" | "codexcli" | "opencode")[] | undefined;
+        attempt_cap: number;
+        wip_cap: number;
+        verification_timeout_seconds: number;
+        evaluator_timeout_seconds: number;
+        gates: {
+            accept?: "agent" | "ci" | "person" | undefined;
+            amend?: "agent" | "ci" | "person" | undefined;
+            answer?: "agent" | "ci" | "person" | undefined;
+            signoff?: "agent" | "ci" | "person" | undefined;
+        };
+    };
+    autonomy: {
+        sync?: "agent" | "ci" | "person" | undefined;
+        stale_delete?: "agent" | "ci" | "person" | undefined;
+        reset?: "agent" | "ci" | "person" | undefined;
+        mcp_approve?: "agent" | "person" | undefined;
+    };
+    environment: {
+        addressing?: "hostname" | "port" | undefined;
+        authentication?: "bypassed" | "none" | "real" | undefined;
+        posture_requirements?: {
+            requirement: string;
+            addressing?: "hostname" | "port" | undefined;
+            authentication?: "bypassed" | "none" | "real" | undefined;
+        }[] | undefined;
+        machine?: {
+            runtime_memory_mb: number;
+            runtime_cpus: number;
+            free_disk_mb: number;
+            cold_start_seconds: number;
+        } | undefined;
+        resettable_volumes: string[];
+        generated_host_paths: string[];
+        compose_files: string[];
+        entrypoint_derivatives: {
+            name: string;
+            kind: "advertised_listener" | "callback_url" | "cors_origin" | "entrypoint" | "origin" | "public_base_url";
+            port: string;
+            path: string;
+            hostname?: string | undefined;
+            scheme?: "http" | "https" | undefined;
+        }[];
+        install_policies: {
+            toolchain: "dotnet" | "go" | "node" | "python" | "ruby" | "rust";
+            lockfile: string;
+            build?: string[] | undefined;
+            test?: string[] | undefined;
+        }[];
+        seed?: {
+            argv: string[];
+            timeout_seconds: number;
+        } | undefined;
+    };
+    surfaces: {
+        tools: ("claudecode" | "codexcli" | "cursor" | "grokcli" | "opencode")[];
+        overlays: {
+            name: string;
+            sources: {
+                path: string;
+                bytes: string;
+            }[];
+            source: string;
+            replaces?: {
+                name: string;
+                sha256: string;
+            } | undefined;
+            feature: "hooks" | "rules" | "skills" | "subagents";
+        }[];
+        harnesses: {
+            name: string;
+            capabilities: ({
+                feature: "hooks" | "mcp" | "permissions" | "rules" | "skills" | "subagents";
+                measured_on: string;
+                spelling: string;
+                control: string;
+                mechanism: {
+                    module: string;
+                    export: string;
+                };
+                state: "enforced";
+                evidence: {
+                    reference: string;
+                    sha256: string;
+                };
+            } | {
+                feature: "hooks" | "mcp" | "permissions" | "rules" | "skills" | "subagents";
+                measured_on: string;
+                spelling: string;
+                control: string;
+                mechanism: {
+                    module: string;
+                    export: string;
+                };
+                state: "instructed";
+            } | {
+                feature: "hooks" | "mcp" | "permissions" | "rules" | "skills" | "subagents";
+                measured_on: string;
+                state: "unavailable";
+                reason: string;
+            })[];
+        }[];
+        bundles: "claudecode-plugin"[];
+        adopted: {
+            path: ".claude/settings.json" | ".codex/config.toml" | ".codex/hooks.json";
+            source: string;
+            sha256: string;
+            adopted_on: string;
+            provenance: {
+                source: string;
+                observed_on?: string | undefined;
+                kind: "declared" | "inferred" | "measured";
+                reason: string;
+                confirmed?: boolean | undefined;
+            };
+        }[];
+    };
+};
+/**
+ * The init interview answers a cockpit.toml records. `unconfirmed` lists those no person stated: the
+ * setup agent chose them as defaults, or the answers file did not say who chose them. doctor warns
+ * until a person confirms each one and deletes its entry, because a configuration whose values look
+ * stated but were guessed is the failure cockpit exists to prevent.
+ */
+export declare const UNCONFIRMABLE_ANSWERS: readonly ['cockpit.name', 'sibling', 'estate.runnable', 'ports.bases', 'environment.install_policies', 'environment.test_data', 'environment.compose_files', 'environment.machine', 'environment.posture', 'testing', 'guards'];
+export declare const CockpitConfig: z.ZodObject<{
+    unconfirmed: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        "cockpit.name": "cockpit.name";
+        "environment.compose_files": "environment.compose_files";
+        "environment.install_policies": "environment.install_policies";
+        "environment.machine": "environment.machine";
+        "environment.posture": "environment.posture";
+        "environment.test_data": "environment.test_data";
+        "estate.runnable": "estate.runnable";
+        guards: "guards";
+        "ports.bases": "ports.bases";
+        sibling: "sibling";
+        testing: "testing";
+    }>>>;
+    cockpit: z.ZodObject<{
+        name: z.ZodString;
+        siblings_root: z.ZodDefault<z.ZodString>;
+        guide_cap: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strict>;
+    sibling: z.ZodArray<z.ZodObject<{
+        slug: z.ZodString;
+        dir: z.ZodUnion<readonly [z.ZodLiteral<".">, z.ZodString]>;
+        remote: z.ZodOptional<z.ZodString>;
+        branch: z.ZodOptional<z.ZodString>;
+        mount: z.ZodType<Mount, unknown, z.core.$ZodTypeInternals<Mount, unknown>>;
+        acquire: z.ZodEnum<{
+            auto: "auto";
+            manual: "manual";
+            none: "none";
+        }>;
+        var: z.ZodString;
+        toolchain: z.ZodDefault<z.ZodEnum<{
+            dotnet: "dotnet";
+            go: "go";
+            node: "node";
+            none: "none";
+            python: "python";
+            ruby: "ruby";
+            rust: "rust";
+        }>>;
+        gate: z.ZodOptional<z.ZodEnum<{
+            operator: "operator";
+        }>>;
+        host_reason: z.ZodOptional<z.ZodString>;
+        guides: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        instruction_pointer: z.ZodDefault<z.ZodBoolean>;
+        purpose: z.ZodString;
+        environment_files: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            template: z.ZodString;
+            instance: z.ZodString;
+        }, z.core.$strict>>>;
+        derives: z.ZodOptional<z.ZodObject<{
+            mcp_sources: z.ZodArray<z.ZodObject<{
+                path: z.ZodString;
+                provenance: z.ZodObject<{
+                    source: z.ZodString;
+                    observed_on: z.ZodOptional<z.ZodString>;
+                    kind: z.ZodEnum<{
+                        declared: "declared";
+                        inferred: "inferred";
+                        measured: "measured";
+                    }>;
+                    reason: z.ZodString;
+                    confirmed: z.ZodOptional<z.ZodBoolean>;
+                }, z.core.$strict>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    ports: z.ZodObject<{
+        step: z.ZodDefault<z.ZodNumber>;
+        count: z.ZodDefault<z.ZodNumber>;
+        bases: z.ZodRecord<z.ZodString, z.ZodNumber>;
+    }, z.core.$strict>;
+    guards: z.ZodPrefault<z.ZodObject<{
+        hosted_db_hosts: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        vendor_endpoint_hosts: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        protected_branches: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        allow: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            argv: z.ZodArray<z.ZodString>;
+            reason: z.ZodString;
+            cwd: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<".">, z.ZodString]>>;
+        }, z.core.$strict>>>;
+        deny: z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+            prefix: z.ZodArray<z.ZodString>;
+            reason: z.ZodString;
+            fix: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>, z.ZodObject<{
+            contains: z.ZodArray<z.ZodString>;
+            reason: z.ZodString;
+            fix: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>]>>>;
+    }, z.core.$strict>>;
+    mcp: z.ZodPrefault<z.ZodObject<{
+        approved: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strict>>;
+    work: z.ZodPrefault<z.ZodObject<{
+        grading: z.ZodDefault<z.ZodEnum<{
+            checks: "checks";
+            independent: "independent";
+            self: "self";
+        }>>;
+        evaluators: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            claudecode: "claudecode";
+            codexcli: "codexcli";
+            opencode: "opencode";
+        }>>>;
+        attempt_cap: z.ZodDefault<z.ZodNumber>;
+        wip_cap: z.ZodDefault<z.ZodNumber>;
+        verification_timeout_seconds: z.ZodDefault<z.ZodNumber>;
+        evaluator_timeout_seconds: z.ZodDefault<z.ZodNumber>;
+        gates: z.ZodPrefault<z.ZodObject<{
+            accept: z.ZodOptional<z.ZodEnum<{
+                agent: "agent";
+                ci: "ci";
+                person: "person";
+            }>>;
+            amend: z.ZodOptional<z.ZodEnum<{
+                agent: "agent";
+                ci: "ci";
+                person: "person";
+            }>>;
+            answer: z.ZodOptional<z.ZodEnum<{
+                agent: "agent";
+                ci: "ci";
+                person: "person";
+            }>>;
+            signoff: z.ZodOptional<z.ZodEnum<{
+                agent: "agent";
+                ci: "ci";
+                person: "person";
+            }>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    autonomy: z.ZodPrefault<z.ZodObject<{
+        sync: z.ZodOptional<z.ZodEnum<{
+            agent: "agent";
+            ci: "ci";
+            person: "person";
+        }>>;
+        stale_delete: z.ZodOptional<z.ZodEnum<{
+            agent: "agent";
+            ci: "ci";
+            person: "person";
+        }>>;
+        reset: z.ZodOptional<z.ZodEnum<{
+            agent: "agent";
+            ci: "ci";
+            person: "person";
+        }>>;
+        mcp_approve: z.ZodOptional<z.ZodEnum<{
+            agent: "agent";
+            person: "person";
+        }>>;
+    }, z.core.$strict>>;
+    browser: z.ZodOptional<z.ZodObject<{
+        engine: z.ZodDefault<z.ZodEnum<{
+            chromium: "chromium";
+            firefox: "firefox";
+            webkit: "webkit";
+        }>>;
+        network_exposure: z.ZodDefault<z.ZodString>;
+        network_exposure_reason: z.ZodOptional<z.ZodString>;
+        harnesses: z.ZodArray<z.ZodObject<{
+            target: z.ZodEnum<{
+                claudecode: "claudecode";
+                codexcli: "codexcli";
+                opencode: "opencode";
+            }>;
+            version: z.ZodString;
+        }, z.core.$strict>>;
+        images: z.ZodObject<{
+            mcp: z.ZodObject<{
+                reference: z.ZodString;
+                driver_version: z.ZodString;
+            }, z.core.$strict>;
+        }, z.core.$strict>;
+        project: z.ZodObject<{
+            manifest: z.ZodOptional<z.ZodString>;
+            manifest_sha256: z.ZodOptional<z.ZodString>;
+            lockfile: z.ZodString;
+            sha256: z.ZodString;
+            driver_version: z.ZodString;
+        }, z.core.$strict>;
+        endpoint: z.ZodOptional<z.ZodString>;
+        max_clients: z.ZodNumber;
+        proxy: z.ZodObject<{
+            host_variable: z.ZodOptional<z.ZodString>;
+            server_port: z.ZodNumber;
+            proxy_port: z.ZodNumber;
+            allowed_hosts: z.ZodArray<z.ZodString>;
+            bind: z.ZodDefault<z.ZodEnum<{
+                "127.0.0.1": "127.0.0.1";
+                "::1": "::1";
+            }>>;
+        }, z.core.$strict>;
+        resolver: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            hostname: z.ZodString;
+            address: z.ZodUnion<readonly [z.ZodIPv4, z.ZodIPv6]>;
+        }, z.core.$strict>>>;
+        authentication: z.ZodObject<{
+            policy: z.ZodEnum<{
+                none: "none";
+                "per-worker": "per-worker";
+                serialized: "serialized";
+            }>;
+            states: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                worker: z.ZodString;
+                path: z.ZodString;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>;
+        data: z.ZodObject<{
+            mode: z.ZodEnum<{
+                empty: "empty";
+                restored: "restored";
+                seeded: "seeded";
+            }>;
+            isolated: z.ZodBoolean;
+            reaches_production: z.ZodBoolean;
+        }, z.core.$strict>;
+        request_preapproval: z.ZodDefault<z.ZodBoolean>;
+        artifacts: z.ZodObject<{
+            mcp: z.ZodString;
+            cli: z.ZodString;
+            auth: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
+    testing: z.ZodOptional<z.ZodObject<{
+        stages: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            command: z.ZodArray<z.ZodString>;
+            requires_stack: z.ZodBoolean;
+            timeout_seconds: z.ZodDefault<z.ZodNumber>;
+            select: z.ZodOptional<z.ZodObject<{
+                spec: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                file: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                test: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                route: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+        gates: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            tier: z.ZodEnum<{
+                full: "full";
+                targeted: "targeted";
+            }>;
+            stages: z.ZodArray<z.ZodString>;
+            changes: z.ZodString;
+        }, z.core.$strict>>;
+        native_hooks: z.ZodDefault<z.ZodObject<{
+            install: z.ZodDefault<z.ZodEnum<{
+                "explicit-native": "explicit-native";
+                inspect: "inspect";
+            }>>;
+        }, z.core.$strict>>;
+        native_hook_policy: z.ZodOptional<z.ZodObject<{
+            path: z.ZodString;
+            sha256: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    environment: z.ZodPrefault<z.ZodObject<{
+        addressing: z.ZodOptional<z.ZodEnum<{
+            hostname: "hostname";
+            port: "port";
+        }>>;
+        authentication: z.ZodOptional<z.ZodEnum<{
+            bypassed: "bypassed";
+            none: "none";
+            real: "real";
+        }>>;
+        posture_requirements: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            requirement: z.ZodString;
+            addressing: z.ZodOptional<z.ZodEnum<{
+                hostname: "hostname";
+                port: "port";
+            }>>;
+            authentication: z.ZodOptional<z.ZodEnum<{
+                bypassed: "bypassed";
+                none: "none";
+                real: "real";
+            }>>;
+        }, z.core.$strict>>>;
+        machine: z.ZodOptional<z.ZodObject<{
+            runtime_memory_mb: z.ZodNumber;
+            runtime_cpus: z.ZodNumber;
+            free_disk_mb: z.ZodNumber;
+            cold_start_seconds: z.ZodNumber;
+        }, z.core.$strict>>;
+        resettable_volumes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        generated_host_paths: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        compose_files: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        entrypoint_derivatives: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            kind: z.ZodEnum<{
+                advertised_listener: "advertised_listener";
+                callback_url: "callback_url";
+                cors_origin: "cors_origin";
+                entrypoint: "entrypoint";
+                origin: "origin";
+                public_base_url: "public_base_url";
+            }>;
+            port: z.ZodString;
+            path: z.ZodString;
+            hostname: z.ZodOptional<z.ZodString>;
+            scheme: z.ZodOptional<z.ZodEnum<{
+                http: "http";
+                https: "https";
+            }>>;
+        }, z.core.$strict>>>;
+        install_policies: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            toolchain: z.ZodEnum<{
+                dotnet: "dotnet";
+                go: "go";
+                node: "node";
+                python: "python";
+                ruby: "ruby";
+                rust: "rust";
+            }>;
+            lockfile: z.ZodString;
+            build: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            test: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>>;
+        seed: z.ZodOptional<z.ZodObject<{
+            argv: z.ZodArray<z.ZodString>;
+            timeout_seconds: z.ZodNumber;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    surfaces: z.ZodPrefault<z.ZodObject<{
+        tools: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+            claudecode: "claudecode";
+            codexcli: "codexcli";
+            cursor: "cursor";
+            grokcli: "grokcli";
+            opencode: "opencode";
+        }>>>;
+        overlays: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            sources: z.ZodArray<z.ZodObject<{
+                path: z.ZodIntersection<z.ZodString, z.ZodString>;
+                bytes: z.ZodString;
+            }, z.core.$strict>>;
+            source: z.ZodIntersection<z.ZodString, z.ZodString>;
+            replaces: z.ZodOptional<z.ZodObject<{
+                name: z.ZodString;
+                sha256: z.ZodString;
+            }, z.core.$strict>>;
+            feature: z.ZodEnum<{
+                hooks: "hooks";
+                rules: "rules";
+                skills: "skills";
+                subagents: "subagents";
+            }>;
+        }, z.core.$strict>>>;
+        harnesses: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            capabilities: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                feature: z.ZodEnum<{
+                    hooks: "hooks";
+                    mcp: "mcp";
+                    permissions: "permissions";
+                    rules: "rules";
+                    skills: "skills";
+                    subagents: "subagents";
+                }>;
+                measured_on: z.ZodString;
+                spelling: z.ZodIntersection<z.ZodString, z.ZodString>;
+                control: z.ZodIntersection<z.ZodString, z.ZodString>;
+                mechanism: z.ZodObject<{
+                    module: z.ZodIntersection<z.ZodString, z.ZodString>;
+                    export: z.ZodString;
+                }, z.core.$strict>;
+                state: z.ZodLiteral<"enforced">;
+                evidence: z.ZodObject<{
+                    reference: z.ZodIntersection<z.ZodString, z.ZodString>;
+                    sha256: z.ZodString;
+                }, z.core.$strict>;
+            }, z.core.$strict>, z.ZodObject<{
+                feature: z.ZodEnum<{
+                    hooks: "hooks";
+                    mcp: "mcp";
+                    permissions: "permissions";
+                    rules: "rules";
+                    skills: "skills";
+                    subagents: "subagents";
+                }>;
+                measured_on: z.ZodString;
+                spelling: z.ZodIntersection<z.ZodString, z.ZodString>;
+                control: z.ZodIntersection<z.ZodString, z.ZodString>;
+                mechanism: z.ZodObject<{
+                    module: z.ZodIntersection<z.ZodString, z.ZodString>;
+                    export: z.ZodString;
+                }, z.core.$strict>;
+                state: z.ZodLiteral<"instructed">;
+            }, z.core.$strict>, z.ZodObject<{
+                feature: z.ZodEnum<{
+                    hooks: "hooks";
+                    mcp: "mcp";
+                    permissions: "permissions";
+                    rules: "rules";
+                    skills: "skills";
+                    subagents: "subagents";
+                }>;
+                measured_on: z.ZodString;
+                state: z.ZodLiteral<"unavailable">;
+                reason: z.ZodString;
+            }, z.core.$strict>], "state">>;
+        }, z.core.$strict>>>;
+        bundles: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+            "claudecode-plugin": "claudecode-plugin";
+        }>>>;
+        adopted: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            path: z.ZodEnum<{
+                ".claude/settings.json": ".claude/settings.json";
+                ".codex/config.toml": ".codex/config.toml";
+                ".codex/hooks.json": ".codex/hooks.json";
+            }>;
+            source: z.ZodIntersection<z.ZodString, z.ZodString>;
+            sha256: z.ZodString;
+            adopted_on: z.ZodString;
+            provenance: z.ZodObject<{
+                source: z.ZodString;
+                observed_on: z.ZodOptional<z.ZodString>;
+                kind: z.ZodEnum<{
+                    declared: "declared";
+                    inferred: "inferred";
+                    measured: "measured";
+                }>;
+                reason: z.ZodString;
+                confirmed: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type CockpitConfig = z.infer<typeof CockpitConfig>;
+export type Sibling = z.infer<typeof Sibling>;
+export type Acquire = z.infer<typeof Acquire>;
+export type Toolchain = z.infer<typeof Toolchain>;
+export type AddressingPosture = z.infer<typeof AddressingPosture>;
+export type AuthPosture = z.infer<typeof AuthPosture>;
+export type EnvironmentFile = z.infer<typeof EnvironmentFile>;
+export type MachineFloor = z.infer<typeof MachineFloor>;
+export type ResettableVolumeId = z.infer<typeof ResettableVolumeId>;
+export type GeneratedHostPath = z.infer<typeof GeneratedHostPath>;
+export type EntrypointDerivative = z.infer<typeof EntrypointDerivative>;
+export type InstallPolicy = z.infer<typeof InstallPolicy>;
+export type Browser = z.infer<typeof Browser>;
+export type Testing = z.infer<typeof Testing>;
+export type Provenance = z.infer<typeof Provenance>;
+export type SurfaceSource = z.infer<typeof SurfaceSource>;
+export type SurfaceOverrideReference = z.infer<typeof SurfaceOverrideReference>;
+export type SurfaceDeclaration = z.infer<typeof SurfaceDeclaration>;
+export type SurfaceOverlay = z.infer<typeof SurfaceOverlay>;
+export type SurfaceAdoption = z.infer<typeof SurfaceAdoption>;
+export type CustomHarnessCapability = z.infer<typeof CustomHarnessCapability>;
+export type CustomHarness = z.infer<typeof CustomHarness>;
+export type Surfaces = z.infer<typeof Surfaces>;
+/** Rows the stack bind-mounts under the given profile set — the projection's import list. */
+export declare function mounted(cfg: CockpitConfig, profiles: readonly string[]): Sibling[];
+/**
+ * The SHA-256 that identifies a running stack: ownership labels, the generation, saved progress and
+ * data history are keyed by it rather than by the bytes of cockpit.toml. Keying them by the file
+ * meant rewording a sibling's purpose stranded the running stack, so `up` and `sibling add` refused
+ * until it was torn down.
+ *
+ * It covers everything except what is known not to reach a container: comments and formatting,
+ * guards, MCP, work orders, surfaces, testing, the guide settings, the descriptive sibling fields,
+ * the host-only environment fields, siblings with mount "none", and descriptive prose and provenance
+ * anywhere. A new field is therefore counted
+ * as runtime until someone decides otherwise: the failure is a needless down, never a stack running
+ * an older declaration than the one on disk. The contents of `environment.compose_files` are
+ * outside it: only their paths are declared here, and `up` hands the files to Compose as they are.
+ */
+export declare function runtimeDeclarationSha256(cfg: CockpitConfig): string;
+export {};