@b00dea/cockpit 0.1.0 → 0.1.1

package/dist/guards/policy-change.d.ts

@@ -0,0 +1,43 @@
+import type { EnvironmentDiagnostic } from '../environment/contract.js';
+import type { CockpitConfig } from '../schema.js';
+type PolicyChange = Readonly<{
+    kind: 'non-widening';
+}> | Readonly<{
+    kind: 'widening';
+    fields: readonly string[];
+}>;
+/**
+ * Every schema path a rule names, so a test can hold each to a field the schema still has: a rule
+ * whose path was renamed away never matches, and its field silently falls back to the default.
+ * Paths under `sibling[].` name a field of a sibling row.
+ */
+export declare const POLICY_CHANGE_RULE_PATHS: readonly string[];
+/**
+ * Whether `after` lets agents do anything `before` did not, over the loaded configurations. Only a
+ * difference a rule above proves safe is non-widening; every other difference widens. `confirmed`
+ * names the answers whose recorded observation matches `after`; only those may leave `unconfirmed`.
+ */
+export declare function policyChange(before: CockpitConfig, after: CockpitConfig, confirmed?: ReadonlySet<string>): PolicyChange;
+type GuardConfigChange = Readonly<{
+    kind: 'unchanged' | 'unrecorded';
+}> | PolicyChange;
+/**
+ * How the current configuration differs from the one the guards were generated from. `recorded` is
+ * the copy sync kept of that configuration; one missing, or not the configuration `generatedSha256`
+ * names, cannot show the edit is safe. `confirmations` is the machine-local record `cockpit confirm`
+ * keeps of the observations that confirmed answers.
+ */
+export declare function guardConfigChange(generatedSha256: string, recorded: Uint8Array | undefined, current: Readonly<{
+    sha256: string;
+    config: CockpitConfig;
+}>, confirmations?: Uint8Array): GuardConfigChange;
+/** Why a changed configuration needs a person before the guard applies it, for a hold or a check. */
+export declare function guardConfigHeldReason(change: Exclude<GuardConfigChange, Readonly<{
+    kind: 'unchanged' | 'non-widening';
+}>>): string;
+/** What `check` reports about an edit the guards were not regenerated for, or nothing. */
+export declare function inspectGuardConfigChange(root: string, configPath: string, current: Readonly<{
+    sha256: string;
+    config: CockpitConfig;
+}>): Promise<readonly EnvironmentDiagnostic[]>;
+export {};

package/dist/guards/policy-change.js

@@ -0,0 +1,159 @@
+// Owns whether an edit of cockpit.toml widens what agents may do. The guard holds every agent call
+// once the configuration differs from the one it was generated from; this classification decides
+// whether that hold needs a person (the edit widens) or only a sync an agent may run (it does not).
+// It fails closed: a field with no rule here widens whenever it changes, so a field added to the
+// schema later is a person's decision until someone writes down why it is not. A rule exists only
+// for a field that cannot widen the guard's trust inputs (the commands agents run unprompted, the
+// roots they write, the secrets they are kept from, who passes a gate) in the direction it admits.
+// [guards], [work], [autonomy], [mcp], [testing], [browser] and every command field have none, so
+// any change to them is a person's.
+// The rules read the configuration rather than compare the guard policy each side would build: most
+// of what they judge (Compose files and profiles, resettable volumes, the tools guarded, a sibling's
+// operator gate) never reaches that policy, and building it observes the checkouts on disk.
+import { join } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { UNSYNCED_ADMITTED_PROSE } from '../command-table.js';
+import { parseCockpitConfigBytes, readBoundedInput } from '../config/load.js';
+import { hasErrorCode } from '../environment/contract.js';
+import { cockpitCommand } from '../fix-catalogue.js';
+import { sha256Hex } from '../sha256.js';
+import { ANSWER_CONFIRMATION_PATH, confirmedAnswers } from './answer-confirmation.js';
+import { GUARD_LOCAL_PATHS, parseGuardLocalIdentity } from './local-identity.js';
+const safe = () => [];
+const gains = (from, to) => to.some(row => !from.some(was => isDeepStrictEqual(was, row)));
+/** A list that may lose rows but not gain one. */
+const onlyRemoves = (before = [], after = [], at) => gains(before, after) ? [at] : [];
+/** A list that may gain rows but not lose one. */
+const onlyAdds = (before = [], after = [], at) => gains(after, before) ? [at] : [];
+function plainObject(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+/** The paths under `at` that differ in a way no rule admits; a rule is looked up by its path from the walk's root. */
+function walk(before, after, rules, at, key = '') {
+    const rule = rules[key];
+    if (rule)
+        return [...rule(before, after, at)];
+    if (plainObject(before) && plainObject(after)) {
+        return [...new Set([...Object.keys(before), ...Object.keys(after)])].flatMap(name => walk(before[name], after[name], rules, at ? `${at}.${name}` : name, key ? `${key}.${name}` : name));
+    }
+    return isDeepStrictEqual(before, after) ? [] : [at];
+}
+// The fields of an existing sibling that say what it is for. Everything else about a sibling decides
+// what the agent may write or read: its directory is a writable root, its environment files are the
+// instances the guard protects, its guides are copied into every agent's instructions, and its derived
+// MCP sources start processes outside the guard.
+const SIBLING_RULES = {
+    purpose: safe,
+    host_reason: safe,
+    // Only the stale-stack warning reads these.
+    rebuild_inputs: safe,
+    // An operator gate keeps a sibling out of default runs; adding one narrows, removing one widens.
+    gate: (before, after, at) => before !== undefined && after === undefined ? [at] : [],
+};
+// A new sibling is a new root the agent may write, wherever its directory is, so only a removed or
+// described one is compared field by field.
+const siblings = (before, after, at) => [
+    ...before.flatMap(row => {
+        const now = after.find(candidate => candidate.slug === row.slug);
+        // A removed sibling takes its instance protection with it, and its directory leaves the guard's view.
+        return now ? walk(row, now, SIBLING_RULES, `${at}.${row.slug}`) : [`${at}.${row.slug}`];
+    }),
+    ...after.filter(row => !before.some(candidate => candidate.slug === row.slug)).map(row => `${at}.${row.slug}`),
+];
+// A policy row admits its build and test commands in every sibling of its toolchain.
+const installPolicies = (before, after, at) => after.flatMap(row => {
+    const was = before.find(candidate => candidate.toolchain === row.toolchain && candidate.lockfile === row.lockfile);
+    return ['build', 'test'].filter(kind => row[kind] !== undefined && !isDeepStrictEqual(row[kind], was?.[kind]))
+        .map(kind => `${at}.${row.toolchain}:${row.lockfile}.${kind}`);
+});
+// Keyed by schema path from the configuration's root.
+const CHANGE_RULES = {
+    // Removing an entry would claim a person stated an answer nobody stated; policyChange admits the
+    // removal of one an observation recorded as confirmed for exactly the new configuration.
+    unconfirmed: onlyAdds,
+    'cockpit.guide_cap': safe,
+    sibling: siblings,
+    ports: safe,
+    'environment.compose_files': onlyRemoves,
+    // A profile starts more of the Compose files' services, as a new Compose file does.
+    'environment.profiles': onlyRemoves,
+    'environment.install_policies': installPolicies,
+    // Reset deletes exactly these volumes.
+    'environment.resettable_volumes': onlyRemoves,
+    // Addresses derived from leased ports, and the floor the host is held to: neither reaches the guard.
+    'environment.entrypoint_derivatives': safe,
+    'environment.machine': safe,
+    // Removing a tool deletes its guard registration.
+    'surfaces.tools': onlyAdds,
+    // Only docs check reads living documents. The decision paths stay a person's: work orders
+    // never count changes under them as out of scope.
+    'docs.living': safe,
+};
+/**
+ * Every schema path a rule names, so a test can hold each to a field the schema still has: a rule
+ * whose path was renamed away never matches, and its field silently falls back to the default.
+ * Paths under `sibling[].` name a field of a sibling row.
+ */
+export const POLICY_CHANGE_RULE_PATHS = Object.freeze([...Object.keys(CHANGE_RULES),
+    ...Object.keys(SIBLING_RULES).map(field => `sibling[].${field}`)]);
+/**
+ * Whether `after` lets agents do anything `before` did not, over the loaded configurations. Only a
+ * difference a rule above proves safe is non-widening; every other difference widens. `confirmed`
+ * names the answers whose recorded observation matches `after`; only those may leave `unconfirmed`.
+ */
+export function policyChange(before, after, confirmed = new Set()) {
+    const unconfirmed = (from = [], to = [], at) => gains(to, from.filter(answer => !confirmed.has(answer))) ? [at] : [];
+    const fields = walk(before, after, { ...CHANGE_RULES, unconfirmed }, '');
+    return fields.length ? { kind: 'widening', fields: [...new Set(fields)] } : { kind: 'non-widening' };
+}
+/**
+ * How the current configuration differs from the one the guards were generated from. `recorded` is
+ * the copy sync kept of that configuration; one missing, or not the configuration `generatedSha256`
+ * names, cannot show the edit is safe. `confirmations` is the machine-local record `cockpit confirm`
+ * keeps of the observations that confirmed answers.
+ */
+export function guardConfigChange(generatedSha256, recorded, current, confirmations) {
+    if (current.sha256 === generatedSha256)
+        return { kind: 'unchanged' };
+    const before = recorded && sha256Hex(recorded) === generatedSha256 ? parseCockpitConfigBytes(recorded) : undefined;
+    return before ? policyChange(before, current.config, confirmedAnswers(confirmations, current.config)) : { kind: 'unrecorded' };
+}
+/** Why a changed configuration needs a person before the guard applies it, for a hold or a check. */
+export function guardConfigHeldReason(change) {
+    return change.kind === 'widening'
+        ? `it widens what agents may do (${change.fields.join(', ')})`
+        : `the configuration they were generated from is not recorded in ${GUARD_LOCAL_PATHS.generatedConfig}, so the edit cannot be shown not to widen what agents may do`;
+}
+/** What `check` reports about an edit the guards were not regenerated for, or nothing. */
+export async function inspectGuardConfigChange(root, configPath, current) {
+    const local = async (path) => {
+        try {
+            const read = await readBoundedInput(join(root, path));
+            return read.kind === 'complete' ? read.bytes : undefined;
+        }
+        catch (error) {
+            if (hasErrorCode(error, 'ENOENT'))
+                return undefined;
+            throw error;
+        }
+    };
+    const identityBytes = await local(GUARD_LOCAL_PATHS.identity);
+    // No guard was generated on this machine, so nothing holds the agent.
+    if (!identityBytes)
+        return [];
+    const identity = parseGuardLocalIdentity(identityBytes.toString('utf8'));
+    if (!identity)
+        return [];
+    const change = guardConfigChange(identity.configSha256, await local(GUARD_LOCAL_PATHS.generatedConfig), current, await local(ANSWER_CONFIRMATION_PATH));
+    if (change.kind === 'unchanged')
+        return [];
+    if (change.kind === 'non-widening')
+        return [{ severity: 'warning', target: 'guard',
+                code: 'GUARD_CONFIG_UNSYNCED',
+                message: `cockpit.toml changed since the guards were generated without widening what agents may do; the guard holds every agent tool call except ${UNSYNCED_ADMITTED_PROSE} until it is synced`,
+                fix: `run ${cockpitCommand('sync', { config: configPath })}; an agent may run it where [autonomy] sync = "agent"` }];
+    return [{ severity: 'error', target: 'guard',
+            code: 'GUARD_CONFIG_WIDENED',
+            message: `cockpit.toml changed since the guards were generated and ${guardConfigHeldReason(change)}; the guard holds every agent tool call until a person syncs`,
+            fix: `a person reads the change and runs ${cockpitCommand('sync', { config: configPath })} in a terminal outside the agent, or the change is reverted` }];
+}

package/dist/guards/policy-pin.d.ts

@@ -1,4 +1,4 @@
-import type { GuardDecision } from './evaluator.js';
+import { type GuardDecision } from './evaluator.js';
 import type { GuardFileContent, ParsedInvocation } from './invocation-parser.js';
 /**
  * The denial for a tool call that would change the pinned policy tables, or undefined. `isConfig`

package/dist/guards/policy-pin.js

@@ -8,6 +8,7 @@
 import { posix } from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
 import { pinnedPolicyTables } from '../autonomy.js';
+import { innerCommand } from './evaluator.js';
 import { classifyReadOnlyInvocation, cockpitLauncherPrefix } from './read-only.js';
 const denial = (reason) => ({ decision: 'deny', reason });
 const PINNED = '[work], [work.gates] and [autonomy] (and [mcp] while [autonomy] mcp_approve is not agent)';
@@ -104,24 +105,25 @@ function recordsWithoutWriting(invocation) {
     return false;
 }
 /**
- * The invocations the pin judges. A cockpit session runs the words after its `--` as a command of
- * its own, so that command is judged as one more invocation and the session by the words before it.
+ * The invocations the pin judges. A cockpit session or exec runs the words after its `--` as a
+ * command of its own, so that command is judged as one more invocation and the wrapper by the words
+ * before it. Exec's command runs in a product container, where neither a read-only spelling nor a
+ * cockpit launcher proves what the program is, so naming the configuration there is never excused.
  */
 function judgedInvocations(invocations) {
     const judged = [];
-    const pending = [...invocations];
+    const pending = invocations.map(invocation => ({ ...invocation, contained: false }));
     for (let invocation = pending.shift(); invocation; invocation = pending.shift()) {
         const prefix = invocation.executable === null ? undefined : cockpitLauncherPrefix(invocation.executable, invocation.argv);
-        const separator = prefix !== undefined && invocation.argv[prefix] === 'session' ? invocation.argv.indexOf('--', prefix) : -1;
-        if (separator < 0) {
+        const inner = prefix === undefined ? undefined : innerCommand(invocation.argv.slice(prefix));
+        if (!inner) {
             judged.push(invocation);
             continue;
         }
-        judged.push({ ...invocation, argv: invocation.argv.slice(0, separator) });
-        const command = invocation.argv.slice(separator + 1);
-        if (command.length)
-            pending.push({ executable: command[0], argv: command.slice(1), cwd: invocation.cwd, wrapped: false, redirects: [],
-                words: command.map((value, index) => ({ role: index ? 'argument' : 'executable', value })) });
+        judged.push({ ...invocation, argv: invocation.argv.slice(0, invocation.argv.length - inner.words.length - 1) });
+        pending.push({ executable: inner.words[0], argv: inner.words.slice(1), cwd: invocation.cwd, wrapped: false, redirects: [],
+            words: inner.words.map((value, index) => ({ role: index ? 'argument' : 'executable', value })),
+            contained: invocation.contained || inner.runs === 'container' });
     }
     return judged;
 }
@@ -141,13 +143,13 @@ export function pinnedPolicyDenial(input, current, isConfig) {
                 continue;
             // A proven read leaves the file as it is, and staging or committing it records the text the
             // guard already checked.
-            if (!writes && (classifyReadOnlyInvocation(invocation) || recordsWithoutWriting(invocation)))
+            if (!writes && !invocation.contained && (classifyReadOnlyInvocation(invocation) || recordsWithoutWriting(invocation)))
                 continue;
             // Installed cockpit reads the file it is given with --config, but a path or `node <script>`
             // spells any program as well as cockpit. Whether it starts cockpit is the evaluator's
             // launcher proof, so only the --config operand is left to it; naming the file anywhere
             // else is denied whatever the spelling starts.
-            const prefix = invocation.executable === null ? undefined : cockpitLauncherPrefix(invocation.executable, invocation.argv);
+            const prefix = invocation.executable === null || invocation.contained ? undefined : cockpitLauncherPrefix(invocation.executable, invocation.argv);
             const configOperand = (index) => prefix !== undefined && index >= prefix
                 && (invocation.argv[index].startsWith('--config=') || index > prefix && invocation.argv[index - 1] === '--config');
             if (!writes && naming.every(configOperand))

package/dist/init/command.d.ts

@@ -1,6 +1,6 @@
 import type { SurfaceTarget } from '../surfaces/contract.js';
 import { type CockpitRootQuestion, type InitApplicationInput, type InitApplicationOutcome } from '../environment/init-application.js';
-export interface InitCommandInput {
+interface InitCommandInput {
     readonly root: string;
     readonly target: SurfaceTarget;
     /** Every chosen tool, target first; just the target when only one was given. */
@@ -22,7 +22,7 @@ export interface UnattendedInit {
     readonly answers: Readonly<Record<string, unknown>>;
     readonly defaultsSha256?: string;
 }
-export interface InitCommandOptions {
+interface InitCommandOptions {
     readonly interactive: boolean;
     readonly json: boolean;
     readonly unattended?: UnattendedInit;
@@ -36,5 +36,6 @@ export interface InitCommandIo {
     /** Creates and initialises one repository beside the product, or initialises its existing plain directory; it never creates parents. */
     readonly createCockpitRoot?: (path: string) => Promise<void>;
 }
-export type InitApplicationHandler = (input: InitApplicationInput) => Promise<InitApplicationOutcome>;
+type InitApplicationHandler = (input: InitApplicationInput) => Promise<InitApplicationOutcome>;
 export declare function runInitOperatorCommand(input: InitCommandInput, options: InitCommandOptions, io: InitCommandIo, application: InitApplicationHandler): Promise<InitApplicationOutcome>;
+export {};

package/dist/init/command.js

@@ -1,5 +1,6 @@
 import { randomUUID } from 'node:crypto';
 import { initCommand } from '../fix-catalogue.js';
+import { canonicalJson } from '../canonical-json.js';
 import { runInitApplication, unsupportedInitPlatformOutcome, } from '../environment/init-application.js';
 import { refusalOutcome as refusal } from '../refusal.js';
 // Real interviews ask up to eleven questions; the bound only stops an application that never converges from looping forever.
@@ -8,14 +9,16 @@ const ANSWER_FIELDS = ['cockpit.root', 'cockpit.name', 'sibling', 'estate.runnab
     'environment.install_policies', 'environment.test_data', 'environment.compose_files',
     'environment.machine', 'environment.posture', 'testing', 'guards'];
 /**
- * The answers file's optional [provenance] table says who chose an answer: "human" (the default) or
- * "agent-default" when the setup agent picked it because the person let it choose. Without it, every
- * value an agent invented was written into cockpit.toml as something the operator stated.
+ * The answers file's optional [provenance] table says who chose an answer: "human" (the default),
+ * "agent-default" when the setup agent picked it because the person let it choose, or "derived" when
+ * the setup agent accepts the value init read from exact sources. Without it, every value an agent
+ * invented was written into cockpit.toml as something the operator stated. A derived field needs no
+ * value in the file: init answers it with what it read, and the document owner checks it either way.
  */
 const PROVENANCE_TABLE = 'provenance';
-const PROVENANCE_VALUES = { human: 'operator-confirmed', 'agent-default': 'agent-default' };
-// cockpit never proposes these, and the docs say they come from a person; an answers file that does
-// not attribute one is recorded as unattributed rather than as the person's.
+const PROVENANCE_VALUES = { human: 'operator-confirmed', 'agent-default': 'agent-default', derived: 'derived' };
+// cockpit proposes at most part of the machine floor, since free disk and the cold start time have no
+// source; an answers file that does not attribute one is recorded as unattributed rather than as the person's.
 const UNATTRIBUTED_UNLESS_MARKED = ['environment.machine'];
 const isTable = (value) => value !== null && typeof value === 'object' && !Array.isArray(value) && !(value instanceof Date);
 /** Flattens the answers file to field -> value, naming any key that matches no interview field. */
@@ -45,7 +48,7 @@ function answerProvenance(answers, answered) {
     if (table === undefined)
         return { marks };
     if (!isTable(table))
-        return { refusal: refusal('INIT_ANSWER_INVALID', `${PROVENANCE_TABLE} must be a table of answer field = "human" or "agent-default"`) };
+        return { refusal: refusal('INIT_ANSWER_INVALID', `${PROVENANCE_TABLE} must be a table of answer field = "human", "agent-default" or "derived"`) };
     const problems = [];
     const walk = (current, prefix) => {
         for (const [key, value] of Object.entries(current)) {
@@ -58,9 +61,9 @@ function answerProvenance(answers, answered) {
                 problems.push(`provenance names no recorded interview answer: ${path}`);
             }
             else if (typeof value !== 'string' || PROVENANCE_VALUES[value] === undefined) {
-                problems.push(`provenance.${path} must be "human" or "agent-default"`);
+                problems.push(`provenance.${path} must be "human", "agent-default" or "derived"`);
             }
-            else if (!answered.has(path)) {
+            else if (!answered.has(path) && value !== 'derived') {
                 problems.push(`provenance names ${path}, which the answers file does not answer`);
             }
             else
@@ -87,7 +90,19 @@ function noteInterview(asked, outcome) {
     for (const field of [...interview.answered, ...interview.outstanding.map(row => row.field)])
         asked.add(field);
 }
-function unattendedAnswer(field, expectedSha256, supplied, unattended) {
+/**
+ * The value init read for a field from exact sources, as the pending run proposed it; "answered"
+ * when an earlier run already recorded the field, whose recorded answer stays in force.
+ */
+function derivedProposal(field, pending) {
+    const interview = pending.result?.interview;
+    if (interview?.answered.includes(field))
+        return 'answered';
+    const proposal = interview?.outstanding.find(row => row.field === field)?.proposals
+        .find(row => row.target === field && row.provenance.kind === 'derived');
+    return proposal && { value: proposal.value };
+}
+function unattendedAnswer(field, expectedSha256, supplied, unattended, marks, pending) {
     if (field === 'configuration.defaults') {
         if (unattended.defaultsSha256 === undefined)
             return { kind: 'missing' };
@@ -95,7 +110,15 @@ function unattendedAnswer(field, expectedSha256, supplied, unattended) {
             return { kind: 'refusal', outcome: refusal('INIT_DEFAULTS_NOT_ACCEPTED', '--accept-defaults does not equal the digest of the surfaced defaults; rerun without it to read the current digest') };
         return { kind: 'answer', bytes: JSON.stringify({ confirmed: true, sha256: unattended.defaultsSha256 }) };
     }
-    const value = supplied.get(field);
+    let value = supplied.get(field);
+    if (value === undefined && marks.get(field) === 'derived') {
+        const derived = derivedProposal(field, pending);
+        if (derived === 'answered')
+            return { kind: 'missing' };
+        if (derived === undefined)
+            return { kind: 'refusal', outcome: refusal('INIT_ANSWER_INVALID', `provenance.${field} is "derived", but init read no complete value for ${field} from an exact source; answer it in the answers file and mark it "human" once a person states it, or "agent-default" when you chose it`) };
+        value = derived.value;
+    }
     if (value === undefined)
         return { kind: 'missing' };
     try {
@@ -105,9 +128,6 @@ function unattendedAnswer(field, expectedSha256, supplied, unattended) {
         return { kind: 'refusal', outcome: refusal('INIT_ANSWER_INVALID', `the answer for ${field} cannot be written as JSON (${error instanceof Error ? error.message : 'unknown error'})`) };
     }
 }
-const canonicalJson = (value) => Array.isArray(value) ? `[${value.map(canonicalJson).join(',')}]`
-    : isTable(value) ? `{${Object.keys(value).sort().map(key => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(',')}}`
-        : JSON.stringify(value);
 /**
  * An answer an earlier run recorded stays in force, so a different value in the file must not be
  * accepted quietly: the person approved the file's bytes, not the recorded ones.
@@ -123,7 +143,7 @@ function recordedAnswerConflict(input, preview, supplied, marks, unattended) {
         // The defaults are accepted by digest, not by the answers file, and are bound to the draft they confirmed.
         if (field === 'configuration.defaults')
             continue;
-        const now = unattendedAnswer(field, undefined, supplied, unattended);
+        const now = unattendedAnswer(field, undefined, supplied, unattended, marks, preview);
         if (now.kind === 'refusal')
             return now.outcome;
         if (now.kind !== 'answer' || recorded[index] === undefined)
@@ -274,7 +294,7 @@ async function drive(input, options, io, application, asked) {
         // A person typing at the terminal states their own answer.
         let answerProvenanceValue = 'operator-confirmed';
         if (unattended && supplied) {
-            const resolved = unattendedAnswer(question.field, question.expectedSha256, supplied.fields, unattended);
+            const resolved = unattendedAnswer(question.field, question.expectedSha256, supplied.fields, unattended, marks, outcome);
             if (resolved.kind === 'refusal')
                 return resolved.outcome;
             // An unanswered field is not a failure: the pending result lists what is still outstanding.

package/dist/init/derive.d.ts

@@ -1,17 +1,18 @@
 import { type Diagnostic } from '../environment/contract.js';
-export interface InferredProvenance {
-    readonly kind: 'inferred';
+interface InferredProvenance {
+    readonly kind: 'derived' | 'inferred';
+    /** The file the value was read from, as file:line where one line holds it. */
     readonly source: string;
     readonly reason: string;
 }
-export interface InferredFact {
+interface InferredFact {
     /** Interview fields this fact helps answer. */
     readonly fields: readonly string[];
     readonly target: string;
     readonly value: unknown;
     readonly provenance: InferredProvenance;
 }
-export interface SkippedInference {
+interface SkippedInference {
     readonly source: string;
     readonly reason: string;
 }
@@ -19,7 +20,7 @@ export interface InferenceResult {
     readonly facts: readonly InferredFact[];
     readonly skipped: readonly SkippedInference[];
 }
-export interface InferenceInput {
+interface InferenceInput {
     /** Files must stay under this observed authority root. */
     readonly root: string;
     /** Paths surfaced for confirmation are relative to the cockpit that will store them. */
@@ -30,7 +31,7 @@ export interface InferenceInput {
     }>[];
 }
 export declare const COMPOSE_NAMES: readonly ['compose.yaml', 'compose.yml', 'docker-compose.yaml', 'docker-compose.yml'];
-export interface DockerfileFacts {
+interface DockerfileFacts {
     readonly command?: string[];
     readonly ports: number[];
 }
@@ -49,3 +50,4 @@ export declare function composeFindings(input: Readonly<{
     root: string;
     draft: string;
 }>): Promise<readonly Diagnostic[]>;
+export {};