@claude-flow/cli 3.64.0 → 3.65.1

package/dist/src/mcp-tools/http-fetch-tools.js

@@ -11,7 +11,10 @@
  * AbortController, response truncation, default User-Agent.
  *
  * Architectural constraints (load-bearing):
- *   - DEFAULT-REFUSES private addresses + loopback (CLAUDE_FLOW_HTTP_FETCH_ALLOW_PRIVATE=1 opt-in)
+ *   - DEFAULT-REFUSES private addresses + loopback (CLAUDE_FLOW_HTTP_FETCH_ALLOW_PRIVATE=1 opt-in):
+ *     IP literals by text here, and every resolved address of a hostname at connect time, on the
+ *     connection itself (http-fetch-pinned.ts), so DNS that points at, or rebinds to, a private
+ *     address is refused too
  *   - DEFAULT-REFUSES Authorization / Cookie / X-Auth-* (CLAUDE_FLOW_HTTP_FETCH_ALLOW_AUTH=1 opt-in)
  *   - hard timeout 30s default, 60s ceiling
  *   - response truncated to 256KB default, 1MB ceiling
@@ -19,6 +22,8 @@
  *
  * @module @claude-flow/cli/mcp-tools/http-fetch
  */
+import { allowPrivateAddresses, isPrivateOrLoopback, pinnedRequest, PrivateAddressError } from './http-fetch-pinned.js';
+export { isPrivateOrLoopback } from './http-fetch-pinned.js';
 const DEFAULT_TIMEOUT_MS = 30_000;
 const MAX_TIMEOUT_MS = 60_000;
 const DEFAULT_MAX_RESPONSE_BYTES = 256 * 1024; // 256 KB
@@ -54,75 +59,11 @@ export function validateUrl(rawUrl) {
         throw new HttpFetchValidationError(`protocol ${parsed.protocol} not allowed (only http: and https:)`, 'FORBIDDEN_PROTOCOL');
     }
     const host = parsed.hostname.toLowerCase();
-    const allowPrivate = process.env.CLAUDE_FLOW_HTTP_FETCH_ALLOW_PRIVATE === '1';
-    if (!allowPrivate && isPrivateOrLoopback(host)) {
+    if (!allowPrivateAddresses() && isPrivateOrLoopback(host)) {
         throw new HttpFetchValidationError(`host ${host} is loopback/private/link-local; set CLAUDE_FLOW_HTTP_FETCH_ALLOW_PRIVATE=1 to override`, 'PRIVATE_ADDRESS');
     }
     return parsed;
 }
-function isPrivateOrLoopback(host) {
-    if (host === 'localhost' || host === 'localhost.localdomain')
-        return true;
-    // Node's URL parser keeps brackets in `.hostname` for every IPv6 literal
-    // (e.g. "[::1]", "[fc00::1]", "[::ffff:7f00:1]"). Strip them once so every
-    // check below operates on the bare address — without this, the fc00::/7
-    // and fe80::/10 checks further down never match anything (they test
-    // `startsWith('fc'/'fe80:')` against a string starting with "["), and an
-    // IPv4-mapped-IPv6 literal (`::ffff:a.b.c.d`, which Node normalizes to a
-    // canonical `::ffff:xxxx:yyyy` hex form) sails through both the IPv4 and
-    // IPv6 branches untested — a live SSRF bypass (e.g. `::ffff:127.0.0.1` or
-    // `::ffff:169.254.169.254` reaching loopback / cloud-metadata targets).
-    const bare = host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : host;
-    if (bare === '::1')
-        return true; // IPv6 loopback
-    // IPv4-mapped IPv6 — decode back to dotted-decimal and recurse into the
-    // IPv4 check below so it inherits every existing private/loopback/
-    // link-local/CGNAT rule instead of needing its own copy.
-    const mappedHex = bare.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
-    if (mappedHex) {
-        const hi = parseInt(mappedHex[1], 16);
-        const lo = parseInt(mappedHex[2], 16);
-        const decoded = `${(hi >> 8) & 0xff}.${hi & 0xff}.${(lo >> 8) & 0xff}.${lo & 0xff}`;
-        return isPrivateOrLoopback(decoded);
-    }
-    const mappedDecimal = bare.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
-    if (mappedDecimal)
-        return isPrivateOrLoopback(mappedDecimal[1]);
-    // IPv4 numeric checks
-    const m = bare.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-    if (m) {
-        const a = Number(m[1]);
-        const b = Number(m[2]);
-        if (a === 0)
-            return true; // 0.0.0.0/8
-        if (a === 127)
-            return true; // loopback
-        if (a === 10)
-            return true; // RFC1918
-        if (a === 172 && b >= 16 && b <= 31)
-            return true; // RFC1918
-        if (a === 192 && b === 168)
-            return true; // RFC1918
-        if (a === 169 && b === 254)
-            return true; // link-local
-        if (a === 100 && b >= 64 && b <= 127)
-            return true; // CGNAT
-        return false;
-    }
-    // IPv6 special forms — be conservative and accept only public-looking
-    // literals. Reject obvious private/local forms.
-    if (bare.startsWith('fc') || bare.startsWith('fd'))
-        return true; // fc00::/7 ULA
-    if (bare.startsWith('fe80:'))
-        return true; // link-local
-    // KNOWN LIMITATION (pre-existing, not introduced by the bracket-stripping /
-    // IPv4-mapped-IPv6 fix above; flagged by an independent adversarial review):
-    // `::` (IPv6 unspecified/"any", the analog of 0.0.0.0, which the IPv4 branch
-    // above does block), IPv6 multicast (ff00::/8), and NAT64 (64:ff9b::/96) are
-    // not covered. Left as a follow-up hardening item rather than scope-creeping
-    // this patch.
-    return false;
-}
 export function validateHeaders(headers) {
     const allowAuth = process.env.CLAUDE_FLOW_HTTP_FETCH_ALLOW_AUTH === '1';
     const out = {};
@@ -156,7 +97,8 @@ function clampNumber(raw, defaultValue, max) {
  * dispatcher. Returns a result object (does not throw on validation failure
  * — it returns success: false with an errorCode).
  */
-export async function httpFetchExecute(input) {
+export async function httpFetchExecute(input, deps = {}) {
+    const send = deps.request ?? pinnedRequest;
     const startedAt = Date.now();
     const url = String(input.url ?? '');
     const method = String(input.method ?? 'GET').toUpperCase();
@@ -242,12 +184,13 @@ export async function httpFetchExecute(input) {
         // protocols after passing the allowlist. Every hop is validated with the
         // same rules; sensitive headers are dropped when the origin changes.
         while (true) {
-            response = await fetch(currentUrl.toString(), {
+            // Never fetch(): it resolves the hostname again on its own, so what it connects to is
+            // not what was checked. `send` connects only to addresses its DNS lookup checked.
+            response = await send(currentUrl.toString(), {
                 method: currentMethod,
                 headers,
                 body: currentMethod === 'GET' || currentMethod === 'HEAD' ? undefined : currentBody,
                 signal: controller.signal,
-                redirect: 'manual',
             });
             if (!REDIRECT_STATUSES.has(response.status))
                 break;
@@ -378,6 +321,12 @@ export async function httpFetchExecute(input) {
     }
     catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
+        if (e instanceof PrivateAddressError) {
+            return {
+                success: false, status: 0, statusText: '', headers: {}, body: '', bodyTruncated: false, bytesRead: 0,
+                durationMs: Date.now() - startedAt, url: parsed.toString(), method, error: msg, errorCode: 'PRIVATE_ADDRESS',
+            };
+        }
         const aborted = msg.includes('aborted') || e?.name === 'AbortError';
         return {
             success: false,
@@ -401,7 +350,7 @@ export async function httpFetchExecute(input) {
 export const httpFetchTools = [
     {
         name: 'http_fetch',
-        description: 'ADR-164 §5.1.8 — HTTP probe primitive for business-pod ops benches (synthetic 200/500 endpoint checks, third-party status pages). Default-secure: blocks file://, ftp://, RFC-1918 / loopback / link-local hosts unless CLAUDE_FLOW_HTTP_FETCH_ALLOW_PRIVATE=1, and rejects Authorization / Cookie / X-Auth-* headers unless CLAUDE_FLOW_HTTP_FETCH_ALLOW_AUTH=1. Hard 30s timeout (60s ceiling), response truncated to 256 KB (1 MB ceiling), default User-Agent ruflo-http-fetch/1.0. Use when a pod or smoke contract needs a guarded HTTP probe — calling Node fetch() directly is wrong because it skips the URL allowlist and header sanitization that ADR-164 mandates for autopilot mode. Pair with the ops-pod bench in plugins/ruflo-business-pods/templates/ops.json (the §4.4 synthetic-endpoint test).',
+        description: 'ADR-164 §5.1.8 — HTTP probe primitive for business-pod ops benches (synthetic 200/500 endpoint checks, third-party status pages). Default-secure: blocks file://, ftp://, and RFC-1918 / loopback / link-local hosts, whether given as an address or as a name that resolves to one (checked on the connection itself, every redirect hop included), unless CLAUDE_FLOW_HTTP_FETCH_ALLOW_PRIVATE=1, and rejects Authorization / Cookie / X-Auth-* headers unless CLAUDE_FLOW_HTTP_FETCH_ALLOW_AUTH=1. Hard 30s timeout (60s ceiling), response truncated to 256 KB (1 MB ceiling), default User-Agent ruflo-http-fetch/1.0. Use when a pod or smoke contract needs a guarded HTTP probe — calling Node fetch() directly is wrong because it skips the URL allowlist and header sanitization that ADR-164 mandates for autopilot mode. Pair with the ops-pod bench in plugins/ruflo-business-pods/templates/ops.json (the §4.4 synthetic-endpoint test).',
         category: 'business-pods',
         tags: ['business-pods', 'http', 'fetch', 'adr-164', 'security', 'ops-pod'],
         inputSchema: {

package/dist/src/memory/verified-guards.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Gaming defences for the verified-outcome learning loop (ADR-503).
+ *
+ * Every rule here can only downgrade: a tainted record does not train, a
+ * pattern that looks gamed is held back from the prompt. Nothing here can
+ * turn an `unknown` into a verified outcome.
+ *
+ *  - §2.1/§2.2 taints: the mod marks a `verified-success` whose turn edited a
+ *    test file or a verifier config, or narrowed its check. Ingest never
+ *    trains a tainted record unless `.claude-flow/config.json`
+ *    `learningLoop.allowTaint` lists every one of its classes.
+ *  - §2.3 re-verify settings (the runner lives in verified-reverify.ts).
+ *  - §2.4 the anomaly gate on lessons.
+ */
+export type Taint = 'edited-tests' | 'edited-verifier-config' | 'narrowed-verifier';
+export declare const TAINTS: readonly Taint[];
+/** A record's `taint` field, validated: known classes only, each once. Anything else is dropped. */
+export declare function parseTaint(raw: unknown): Taint[];
+export interface LoopConfig {
+    /** Taint classes a project lets train (default none). */
+    readonly allowTaint: readonly Taint[];
+    /** Re-run a verifier at HEAD before a success trains (default off: it runs project code). */
+    readonly reverify: boolean;
+    readonly reverifyTimeoutMs: number;
+}
+export declare const DEFAULT_REVERIFY_TIMEOUT_MS = 300000;
+export declare const DEFAULT_LOOP_CONFIG: LoopConfig;
+/**
+ * `learningLoop` from `.claude-flow/config.json`. A missing, unreadable or
+ * malformed file means the defaults: no taint allowed, re-verify off. Only
+ * `reverify: true` (the boolean) turns re-verification on.
+ */
+export declare function readLoopConfig(root: string): LoopConfig;
+export declare function parseLoopConfig(raw: unknown): LoopConfig;
+/** The taint classes of a record that its project did not allow; non-empty means it never trains. */
+export declare const blockedTaints: (taint: readonly Taint[], config: LoopConfig) => Taint[];
+/**
+ * What ingest knows about a verified pattern, from verified records only
+ * (SONA's own counts include other feeders). Sessions are capped: the gate
+ * only asks whether there were two.
+ */
+export interface PatternStats {
+    successes: number;
+    failures: number;
+    /** Successes that carried an allowed taint. */
+    tainted: number;
+    /** Successes decided by a narrowed command. */
+    narrowed: number;
+    sessions: string[];
+}
+export declare const MAX_PATTERN_SESSIONS = 4;
+export declare const emptyStats: () => PatternStats;
+export declare function parseStats(raw: unknown): PatternStats;
+/** Folds one trained record into its pattern's stats. */
+export declare function addOutcome(stats: PatternStats, success: boolean, taint: readonly Taint[], session: string | null): void;
+export type HoldReason = 'perfect-and-tainted' | 'only-narrowed' | 'one-session';
+/** §2.4 case 1: records at or above which a perfect record with half its successes tainted is held. */
+export declare const PERFECT_MIN_RECORDS = 8;
+/**
+ * Why a would-be lesson is held back from the prompt (ADR-503 §2.4), or null.
+ * A held pattern stays in SONA; it only never becomes a prompt lesson.
+ *
+ * 1. 100% success over 8 or more records, half or more of them tainted (allowed).
+ * 2. Every success came from a narrowed command.
+ * 3. Every success came from one session: no independent repetition. A pattern
+ *    with no recorded sessions (a record from before ADR-503, or one without a
+ *    session) counts as one session.
+ */
+export declare function holdReason(stats: PatternStats, sonaSuccesses: number): HoldReason | null;
+//# sourceMappingURL=verified-guards.d.ts.map

package/dist/src/memory/verified-guards.js

@@ -0,0 +1,101 @@
+/**
+ * Gaming defences for the verified-outcome learning loop (ADR-503).
+ *
+ * Every rule here can only downgrade: a tainted record does not train, a
+ * pattern that looks gamed is held back from the prompt. Nothing here can
+ * turn an `unknown` into a verified outcome.
+ *
+ *  - §2.1/§2.2 taints: the mod marks a `verified-success` whose turn edited a
+ *    test file or a verifier config, or narrowed its check. Ingest never
+ *    trains a tainted record unless `.claude-flow/config.json`
+ *    `learningLoop.allowTaint` lists every one of its classes.
+ *  - §2.3 re-verify settings (the runner lives in verified-reverify.ts).
+ *  - §2.4 the anomaly gate on lessons.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+export const TAINTS = ['edited-tests', 'edited-verifier-config', 'narrowed-verifier'];
+/** A record's `taint` field, validated: known classes only, each once. Anything else is dropped. */
+export function parseTaint(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    const out = [];
+    for (const t of raw.slice(0, 8))
+        if (TAINTS.includes(t) && !out.includes(t))
+            out.push(t);
+    return out;
+}
+export const DEFAULT_REVERIFY_TIMEOUT_MS = 300_000;
+export const DEFAULT_LOOP_CONFIG = { allowTaint: [], reverify: false, reverifyTimeoutMs: DEFAULT_REVERIFY_TIMEOUT_MS };
+/**
+ * `learningLoop` from `.claude-flow/config.json`. A missing, unreadable or
+ * malformed file means the defaults: no taint allowed, re-verify off. Only
+ * `reverify: true` (the boolean) turns re-verification on.
+ */
+export function readLoopConfig(root) {
+    const path = join(root, '.claude-flow', 'config.json');
+    try {
+        if (!existsSync(path))
+            return DEFAULT_LOOP_CONFIG;
+        const raw = JSON.parse(readFileSync(path, 'utf8'));
+        return parseLoopConfig(raw?.learningLoop);
+    }
+    catch {
+        return DEFAULT_LOOP_CONFIG;
+    }
+}
+export function parseLoopConfig(raw) {
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        return DEFAULT_LOOP_CONFIG;
+    const r = raw;
+    const sec = typeof r.reverifyTimeoutSec === 'number' && Number.isFinite(r.reverifyTimeoutSec) ? Math.min(Math.max(Math.floor(r.reverifyTimeoutSec), 10), 3600) : DEFAULT_REVERIFY_TIMEOUT_MS / 1000;
+    return { allowTaint: parseTaint(r.allowTaint), reverify: r.reverify === true, reverifyTimeoutMs: sec * 1000 };
+}
+/** The taint classes of a record that its project did not allow; non-empty means it never trains. */
+export const blockedTaints = (taint, config) => taint.filter(t => !config.allowTaint.includes(t));
+export const MAX_PATTERN_SESSIONS = 4;
+const SESSION = /^[A-Za-z0-9_-]{1,40}$/;
+const count = (v) => (typeof v === 'number' && Number.isFinite(v) && v >= 0 ? Math.min(Math.floor(v), 1_000_000) : 0);
+export const emptyStats = () => ({ successes: 0, failures: 0, tainted: 0, narrowed: 0, sessions: [] });
+export function parseStats(raw) {
+    const r = (raw && typeof raw === 'object' ? raw : {});
+    const sessions = Array.isArray(r.sessions) ? [...new Set(r.sessions.filter((s) => typeof s === 'string' && SESSION.test(s)))].slice(0, MAX_PATTERN_SESSIONS) : [];
+    return { successes: count(r.successes), failures: count(r.failures), tainted: count(r.tainted), narrowed: count(r.narrowed), sessions };
+}
+/** Folds one trained record into its pattern's stats. */
+export function addOutcome(stats, success, taint, session) {
+    if (!success) {
+        stats.failures++;
+        return;
+    }
+    stats.successes++;
+    if (taint.length > 0)
+        stats.tainted++;
+    if (taint.includes('narrowed-verifier'))
+        stats.narrowed++;
+    if (session && SESSION.test(session) && !stats.sessions.includes(session) && stats.sessions.length < MAX_PATTERN_SESSIONS)
+        stats.sessions.push(session);
+}
+/** §2.4 case 1: records at or above which a perfect record with half its successes tainted is held. */
+export const PERFECT_MIN_RECORDS = 8;
+/**
+ * Why a would-be lesson is held back from the prompt (ADR-503 §2.4), or null.
+ * A held pattern stays in SONA; it only never becomes a prompt lesson.
+ *
+ * 1. 100% success over 8 or more records, half or more of them tainted (allowed).
+ * 2. Every success came from a narrowed command.
+ * 3. Every success came from one session: no independent repetition. A pattern
+ *    with no recorded sessions (a record from before ADR-503, or one without a
+ *    session) counts as one session.
+ */
+export function holdReason(stats, sonaSuccesses) {
+    const s = stats.successes;
+    if (s >= PERFECT_MIN_RECORDS && stats.failures === 0 && stats.tainted * 2 >= s)
+        return 'perfect-and-tainted';
+    if (s > 0 && stats.narrowed === s)
+        return 'only-narrowed';
+    if ((s > 0 || sonaSuccesses > 0) && stats.sessions.length < 2)
+        return 'one-session';
+    return null;
+}
+//# sourceMappingURL=verified-guards.js.map

package/dist/src/memory/verified-outcomes.d.ts

@@ -19,7 +19,15 @@
  * verified outcomes produced, those at or above the SONA routing gate as
  * lessons, and repeated verified failures as cautions. The mod reads that
  * file and adds at most three cited lessons to a prompt.
+ *
+ * ADR-503 hardens it against gamed signals (verified-guards.ts,
+ * verified-reverify.ts): a tainted success does not train unless the project
+ * allows its taint class, an opt-in re-verify can downgrade a success before
+ * it trains, and an anomaly gate holds suspicious patterns back from the
+ * prompt. Every one of these can only downgrade.
  */
+import { type HoldReason, type LoopConfig, type PatternStats, type Taint } from './verified-guards.js';
+import { type ReverifyRunner } from './verified-reverify.js';
 export declare const VERIFIED_PATH: string;
 export declare const LEDGER_PATH: string;
 export declare const LESSONS_PATH: string;
@@ -49,6 +57,10 @@ export interface VerifiedRecord {
         readonly ok: boolean;
     }>;
     readonly edits: number;
+    /** ADR-503 §2.1: what the turn did to its own check; only a `verified-success` carries any. */
+    readonly taint: readonly Taint[];
+    /** The mod process that recorded it, when the mod wrote one (ADR-503 §2.4). */
+    readonly session: string | null;
     readonly startedAt: number;
     readonly endedAt: number;
 }
@@ -62,13 +74,31 @@ export interface IngestLedger {
         verifiedFailure: number;
         unknown: number;
         rejected: number;
+        tainted: number;
     };
-    /** Pattern keys verified outcomes trained, with the last verifier command that decided them (the lesson's evidence). */
+    /**
+     * Pattern keys verified outcomes trained, with the last verifier command that decided them (the lesson's evidence)
+     * and what the anomaly gate needs (ADR-503 §2.4).
+     */
     patterns: Record<string, {
         evidence: string;
         at: number;
+        stats: PatternStats;
     }>;
+    /** ADR-503 §2.3: the rotation cursor and the latest re-verifications (which commit, which check, what happened). */
+    reverify: {
+        cursor: number;
+        log: ReverifyLogEntry[];
+    };
+}
+export interface ReverifyLogEntry {
+    readonly id: string;
+    readonly check: string | null;
+    readonly commit: string | null;
+    readonly status: 'pass' | 'fail' | 'timeout' | 'error';
+    readonly at: number;
 }
+export declare const MAX_REVERIFY_LOG = 50;
 export interface Lesson {
     readonly id: string;
     readonly kind: 'lesson' | 'caution';
@@ -86,19 +116,38 @@ export interface LessonsFile {
     lessons: Lesson[];
     /** Verified patterns still below the gate, for the cold-start progress line. */
     belowGate: number;
+    /** Patterns at or above the gate that the anomaly gate kept out of the prompt (ADR-503 §2.4). */
+    held: Array<{
+        id: string;
+        reason: HoldReason;
+    }>;
 }
 export interface IngestResult {
+    /** `tainted`: successes whose taint the project did not allow, counted and never trained (ADR-503 §2.2). */
     ingested: {
         verifiedSuccess: number;
         verifiedFailure: number;
         unknown: number;
         rejected: number;
+        tainted: number;
     };
     trained: number;
     skipped: 'no-file' | 'unchanged' | 'too-large' | null;
     lessons: number;
     cautions: number;
     belowGate: number;
+    held: LessonsFile['held'];
+    /**
+     * ADR-503 §2.3: checks run, successes that passed or were downgraded to unknown, and successes left for an explicit
+     * ingest because this caller may not run project code.
+     */
+    reverify: {
+        enabled: boolean;
+        ran: number;
+        passed: number;
+        downgraded: number;
+        deferred: number;
+    };
     totals: IngestLedger['totals'];
     sonaAvailable: boolean;
 }
@@ -137,8 +186,15 @@ export declare function emptyLedger(): IngestLedger;
 export declare function readLedger(raw: string | null): IngestLedger;
 /** A lesson's citation: a short hash of the SONA pattern key, so the key's own text never reaches a prompt. */
 export declare const lessonId: (patternKey: string) => string;
-/** Builds the lessons file from SONA's patterns, keeping only the ones verified outcomes trained. */
-export declare function buildLessons(patterns: ReturnType<SonaLike['exportPatterns']>, verified: IngestLedger['patterns'], now: number): LessonsFile;
+/**
+ * Builds the lessons file from SONA's patterns, keeping only the ones verified outcomes trained. A would-be lesson the
+ * anomaly gate holds (ADR-503 §2.4) is listed under `held` instead: it stays in SONA, never in a prompt.
+ */
+export declare function buildLessons(patterns: ReturnType<SonaLike['exportPatterns']>, verified: Record<string, {
+    evidence: string;
+    at: number;
+    stats?: PatternStats;
+}>, now: number): LessonsFile;
 export interface IngestOptions {
     /** Project root; defaults to process.cwd(), where SONA keeps `.swarm/`. */
     root?: string;
@@ -149,6 +205,15 @@ export interface IngestOptions {
     /** SONA to train; defaults to the process's optimizer. Null means unavailable. */
     sona?: SonaLike | null;
     now?: number;
+    /** `learningLoop` settings; defaults to `.claude-flow/config.json` under `root` (ADR-503). */
+    config?: LoopConfig;
+    /**
+     * Whether this caller may run project code to re-verify (ADR-503 §2.3). Only an explicit ingest passes true; a hot
+     * caller (hooks_route) leaves successes un-ingested when re-verify is on, instead of blocking for the timeout.
+     */
+    allowReverify?: boolean;
+    /** Re-verify runner; defaults to the detached-git-worktree runner. Tests inject one. */
+    reverifier?: ReverifyRunner;
 }
 export declare function ingestVerifiedOutcomes(options?: IngestOptions): Promise<IngestResult>;
 /**