@cleocode/contracts 2026.9.22 → 2026.9.24

package/src/__tests__/evidence-atom-schema.test.ts

@@ -684,7 +684,8 @@ describe('formatGateRequirement (T10337)', () => {
     expect(s).toContain('[decision AND note]');
     expect(s).toContain('[pr AND files]');
     // Joiner between combinations is ' OR '.
-    expect(s.split(' OR ').length).toBe(5);
+    // T12689: + [pr AND note] for a deletion-only PR.
+    expect(s.split(' OR ').length).toBe(6);
   });
 
   it('formats single-element combination without AND', () => {
@@ -759,7 +760,7 @@ describe('validateEvidenceForGate failure surface (T9949)', () => {
     if (!r.ok) {
       // Error includes the same artifact requirement as the validator.
       expect(r.message).toBe(
-        "Gate 'implemented' requires evidence: [commit AND files] OR [commit AND note] OR [decision AND files] OR [decision AND note] OR [pr AND files]",
+        "Gate 'implemented' requires evidence: [commit AND files] OR [commit AND note] OR [decision AND files] OR [decision AND note] OR [pr AND files] OR [pr AND note]",
       );
       // New rich hint includes the same content as formatGateRequirementHint.
       expect(r.hint).toBe(formatGateRequirementHint('implemented'));

package/src/acceptance-gate-schema.ts

@@ -536,7 +536,10 @@ export const acceptanceGateResultSchema = z
           message: 'Result cannot precede input capture',
         });
       const executable = ['test', 'command', 'lint'].includes(result.kind);
-      if (executable && !binding.invocation)
+      // T12718: a command the runner refused to split (shell syntax, open
+      // quote) never had an invocation. It is bound as an unmet `error` so the
+      // rest of its batch still records; any verdict needs the invocation.
+      if (executable && !binding.invocation && result.result !== 'error')
         context.addIssue({
           code: 'custom',
           path: ['binding', 'invocation'],

package/src/branch-lock.ts

@@ -366,6 +366,19 @@ export const ISOLATION_ENV_KEYS = [
 /** Union of all isolation env key strings. */
 export type IsolationEnvKey = (typeof ISOLATION_ENV_KEYS)[number];
 
+/**
+ * The identity keys re-exported on every shell call of a spawned agent
+ * (T12502) — see {@link IsolationResult.perCallLine}. `CLEO_AGENT_ROLE` is
+ * among them because the git shim reads it on every `git` call to enforce
+ * the worker's restricted-role policy; a shell that lost it would run git
+ * unrestricted.
+ */
+const IDENTITY_ENV_KEYS = [
+  'CLEO_SESSION_ID',
+  'CLEO_AGENT_ID',
+  'CLEO_AGENT_ROLE',
+] as const satisfies readonly IsolationEnvKey[];
+
 /**
  * Absolute-path validation rules enforced for Edit/Write SDK tool operations.
  *
@@ -515,6 +528,15 @@ export interface IsolationResult {
    * The trailing newline is included so callers can concatenate directly.
    */
   preamble: string;
+  /**
+   * The one line an agent must run at the start of EVERY shell call (T12502):
+   * `cd <worktree> && export CLEO_SESSION_ID=… CLEO_AGENT_ID=… CLEO_AGENT_ROLE=… || exit 1`
+   * (identity keys only when set; every value shell-quoted). Harness shells
+   * keep neither cwd nor env between calls, so this line re-enters the
+   * worktree AND re-binds the agent's own session and the role the git shim
+   * enforces. It is also Step 1 of {@link IsolationResult.preamble}.
+   */
+  perCallLine: string;
   /**
    * Boundary contract for downstream enforcement layers (git-shim, tests).
    *
@@ -596,11 +618,24 @@ export function provisionIsolatedShell(options: IsolationOptions): IsolationResu
   // T12520 — every path is emitted through `shellQuote`, never interpolated
   // bare or inside double quotes, so the snippet parses for any worktree path.
   const quotedPath = shellQuote(worktreePath);
+  // T12502 — env does not persist between an agent harness's Bash calls, so
+  // the per-call line re-binds the agent's own identity (and the role the git
+  // shim enforces) along with the cwd.
+  // Without it a worker's `cleo start` resolves to the ORCHESTRATOR's session
+  // and is refused on its own (spawn-claimed) task with E_TASK_CLAIMED.
+  const identityExports = IDENTITY_ENV_KEYS.filter((k) => env[k] !== '').map(
+    (k) => `${k}=${shellQuote(env[k])}`,
+  );
+  const perCallLine =
+    identityExports.length > 0
+      ? `cd ${quotedPath} && export ${identityExports.join(' ')} || exit 1`
+      : `cd ${quotedPath} || exit 1`;
   const preamble = [
     '## Worktree Isolation (REQUIRED — do not skip)',
     '',
-    '# Step 1: Enter the worktree (exits immediately if path is missing)',
-    `cd ${quotedPath} || exit 1`,
+    '# Step 1: Enter the worktree and bind your session (exits if the path is missing).',
+    '# Repeat this line at the start of EVERY Bash call: cwd and env do not persist.',
+    perCallLine,
     '',
     '# Step 2: Verify working directory (guards against shell/symlink quirks)',
     'case "$PWD" in',
@@ -630,7 +665,7 @@ export function provisionIsolatedShell(options: IsolationOptions): IsolationResu
     absolutePathRules,
   };
 
-  return { cwd, env, preamble, boundaryContract };
+  return { cwd, env, preamble, perCallLine, boundaryContract };
 }
 
 // ---------------------------------------------------------------------------

package/src/data-accessor.ts

@@ -17,6 +17,7 @@ import type { ArchivedTask } from './archive.js';
 import type { Session } from './session.js';
 import type {
   Task,
+  TaskClaim,
   TaskKind,
   TaskPriority,
   TaskSeverity,
@@ -150,6 +151,18 @@ export interface TaskFieldUpdates {
   updatedAt?: string | null;
   assignee?: string | null;
   pipelineStage?: string | null;
+  /**
+   * Agent claim lease columns (T12502). Change them through
+   * `DataAccessor.claimTask` / `unclaimTask`, which pair them with a
+   * {@link TaskClaimGuard} so the write is a compare-and-set on the holder.
+   */
+  claimedBySession?: string | null;
+  /** Agent identity of the lease holder (T12502). */
+  claimedByAgent?: string | null;
+  /** ISO-8601 UTC instant the lease was taken (T12502). */
+  claimedAt?: string | null;
+  /** ISO-8601 UTC instant the lease lapses unless renewed (T12502). */
+  leaseExpiresAt?: string | null;
 }
 
 /**
@@ -255,6 +268,8 @@ export interface AcBindingRow {
 
 /** Query options for bounded reads from the append-only task audit log. @task T10594 */
 export interface TaskAuditLogQuery {
+  /** Exact audit row ids (T12693: revert one ranking change). */
+  ids?: readonly string[];
   taskIds?: readonly string[];
   actions?: readonly string[];
   since?: string;
@@ -271,22 +286,173 @@ export interface TaskAuditLogRow {
   detailsJson: string | null;
   beforeJson: string | null;
   afterJson: string | null;
+  /** Session the mutation ran in, when recorded (T12693). */
+  sessionId?: string | null;
 }
 
 /**
  * Optimistic-concurrency guard for a single-task write (T12503).
  *
  * A task's version is its `updatedAt` timestamp (falling back to `createdAt`
- * for a row that was never updated). Writers keep it strictly increasing, so a
- * caller that read version `v` and passes `expectedUpdatedAt: v` either writes
- * against exactly the row it read or fails with `E_CONFLICT`
- * (`ExitCode.VERSION_CONFLICT`) carrying the current version. The comparison
+ * for a row that was never updated). The update, complete and field-update
+ * paths advance it strictly, so a caller that read version `v` and passes
+ * `expectedUpdatedAt: v` either writes against exactly the row it read or
+ * fails with `E_CONFLICT` (`ExitCode.VERSION_CONFLICT`) carrying the current
+ * version. Some other writers still stamp it from the clock, leaving a narrow
+ * same-millisecond window (T12720). The comparison
  * runs inside the write transaction, after `BEGIN IMMEDIATE` holds the lock.
  * Omitting the guard keeps last-writer-wins semantics.
  */
 export interface TaskWriteGuard {
   /** Version the caller read; the write fails with `E_CONFLICT` if the row moved on. */
   expectedUpdatedAt?: string;
+  /**
+   * The task as the caller read it. Used only to build the conflict summary:
+   * on `E_CONFLICT`, the fields whose stored value differs from this snapshot
+   * are reported in {@link TaskConflictDetails.changedFields}. @task T12503
+   */
+  baseline?: Task;
+  /**
+   * Compare-and-set on the claim lease columns (T12502). The write matches
+   * only while the stored holder satisfies {@link TaskClaimGuard.mode}; when
+   * it does not, the write fails with `E_TASK_CLAIMED`
+   * ({@link TaskClaimedDetails}) instead of `E_CONFLICT`.
+   */
+  claim?: TaskClaimGuard;
+  /**
+   * Leave the task version (`updatedAt`) unchanged. For lease bookkeeping
+   * (renew, release) that must not invalidate another writer's `--if-match`.
+   * @task T12502
+   */
+  keepVersion?: boolean;
+}
+
+/**
+ * How a claim write treats the lease already stored on the task (T12502).
+ *
+ * - `acquire`: succeeds when the task is unclaimed, already held by the
+ *   caller's session, or held by `handoffFrom` (an orchestrator handing the
+ *   task to the agent it spawns). An expired lease still blocks: taking it is
+ *   explicit.
+ * - `take-over`: `acquire`, or the stored lease has expired. Audited.
+ * - `force`: unconditional, even over a live lease. Audited.
+ * - `renew`: only the holder session may extend its lease.
+ * - `release`: only the holder session may clear its lease.
+ */
+export type TaskClaimMode = 'acquire' | 'take-over' | 'force' | 'renew' | 'release';
+
+/**
+ * Claim predicate for a guarded task write (T12502). Evaluated in the
+ * UPDATE's WHERE clause, inside the write transaction.
+ */
+export interface TaskClaimGuard {
+  /** The caller's session, or `null` for an unbound caller (holds no lease). */
+  sessionId: string | null;
+  /** Which stored holders the write may replace. */
+  mode: TaskClaimMode;
+  /** ISO-8601 UTC "now" used for the lease-expiry comparison. */
+  now: string;
+  /** A session whose live lease `acquire` may take over (spawn hand-off). */
+  handoffFrom?: string | null;
+}
+
+/**
+ * A request to take, renew or override the claim lease on a task (T12502).
+ */
+export interface TaskClaimRequest {
+  /** The claiming session; `null` checks the claim without taking a lease. */
+  sessionId: string | null;
+  /** Agent identity recorded with the lease, or `null`. */
+  agentId: string | null;
+  /** How to treat a stored lease (see {@link TaskClaimMode}); never `release`. */
+  mode: Exclude<TaskClaimMode, 'release'>;
+  /** Lease length in milliseconds; defaults to the core lease TTL. */
+  leaseMs?: number;
+  /** Clock override (ISO-8601 UTC) for tests. */
+  now?: string;
+  /** A session whose live lease `acquire` may take over (spawn hand-off). */
+  handoffFrom?: string | null;
+}
+
+/**
+ * `details` of an `E_TASK_CLAIMED` (`ExitCode.TASK_CLAIMED`) error: who holds
+ * the task, until when, and which explicit, audited override applies.
+ *
+ * @task T12502
+ */
+export interface TaskClaimedDetails {
+  /** Always `'claimedBySession'`: the lease-holder column the claim compared. */
+  field: 'claimedBySession';
+  /** The claimed task. */
+  taskId: string;
+  /** The lease currently stored on the task. */
+  holder: TaskClaim;
+  /** `true` when the holder's lease has lapsed (take it with `--take-over`). */
+  expired: boolean;
+  /** The refused caller. */
+  requester: { sessionId: string | null; agentId: string | null };
+  /** The flag that would override: `--take-over` (expired) or `--force-claim` (live). */
+  override: '--take-over' | '--force-claim';
+}
+
+/**
+ * One field that differs between the caller's read and the stored row, as
+ * reported on an `E_CONFLICT` error. Values are JSON-serialised and truncated
+ * so the envelope stays small; `null` means the field was absent.
+ *
+ * @task T12503
+ */
+export interface TaskConflictChange {
+  /** Task field name (camelCase, as on {@link Task}). */
+  field: string;
+  /** JSON of the value in the caller's read, or `null` when absent. */
+  was: string | null;
+  /** JSON of the value currently stored, or `null` when absent. */
+  now: string | null;
+}
+
+/**
+ * `details` of an `E_CONFLICT` (`ExitCode.VERSION_CONFLICT`) task error: the
+ * version the caller expected, the version now stored, and which fields moved
+ * so an agent can re-read, merge and retry with `--if-match <currentVersion>`.
+ *
+ * `changedFields` is diffed against the caller's read when the write path
+ * holds it (`cleo update`, `cleo complete`, or a guard with `baseline`). When
+ * the caller's read was already older than the one this command made, the
+ * summary covers only changes after that read; `current` always carries the
+ * stored values to merge against.
+ *
+ * @task T12503
+ */
+export interface TaskConflictDetails {
+  /** Always `'updatedAt'`: the version field. */
+  field: 'updatedAt';
+  /** The version the caller expected. */
+  expected: string;
+  /** The version currently stored (same as {@link currentVersion}). */
+  actual: string;
+  /** The version to pass as `--if-match` after merging. */
+  currentVersion: string;
+  /** Names of the fields that differ between the caller's read and the stored row. */
+  changedFields: string[];
+  /** Per-field before/after summary for {@link changedFields}. */
+  changes: TaskConflictChange[];
+  /**
+   * Merge-relevant stored values of the task right now, bounded so the
+   * envelope stays small: `title` is cut at 200 characters and `labels` /
+   * `depends` hold at most the first 50 entries, with the full counts in
+   * `labelsTotal` / `dependsTotal`.
+   */
+  current: {
+    title: string;
+    status: TaskStatus;
+    priority: TaskPriority;
+    labels: string[];
+    labelsTotal: number;
+    depends: string[];
+    dependsTotal: number;
+    parentId: string | null;
+  } | null;
 }
 
 /**
@@ -295,6 +461,11 @@ export interface TaskWriteGuard {
  */
 export interface TransactionAccessor {
   upsertSingleTask(task: Task): Promise<void>;
+  /**
+   * Insert a NEW task; never overwrites. Throws `ID_COLLISION` when the id is
+   * already stored (T12724).
+   */
+  insertNewTask(task: Task): Promise<void>;
   archiveSingleTask(taskId: string, fields: ArchiveFields): Promise<void>;
   removeSingleTask(taskId: string): Promise<void>;
   setMetaValue(key: string, value: unknown): Promise<void>;
@@ -432,6 +603,13 @@ export interface DataAccessor {
   /** Upsert a single task (targeted write, no full-file reload). */
   upsertSingleTask(task: Task): Promise<void>;
 
+  /**
+   * Insert a NEW task under a freshly allocated or computed id. Never
+   * overwrites: throws `ID_COLLISION` when the id is already stored, and
+   * writes nothing (T12724).
+   */
+  insertNewTask(task: Task): Promise<void>;
+
   /** Archive a single task by ID (sets status='archived' + archive metadata). */
   archiveSingleTask(taskId: string, fields: ArchiveFields): Promise<void>;
 
@@ -575,29 +753,50 @@ export interface DataAccessor {
   /** Get a single agent instance by ID. Returns null if not found. */
   getAgentInstance(agentId: string): Promise<DataAccessorAgentInstance | null>;
 
-  // ---- Agent task claiming ----
+  // ---- Agent task claiming (leased, T12502) ----
 
   /**
-   * Atomically claim a task for an agent.
+   * Take, renew or override the claim lease on a task in one compare-and-set
+   * write (`updateTaskFields` with a {@link TaskClaimGuard}). The human
+   * `assignee` is never touched.
    *
-   * Uses `UPDATE ... WHERE assignee IS NULL OR assignee = agentId` to prevent
-   * race conditions. Throws if the task is already claimed by a different agent.
+   * With `sessionId: null` no lease is written; the call only verifies, in
+   * the same way, that no other session holds the task.
    *
    * @param taskId - ID of the task to claim.
-   * @param agentId - Agent identifier claiming the task.
-   * @throws {Error} When the task is not found or is already claimed by another agent.
+   * @param request - Claimant, mode and lease length.
+   * @returns The lease now held, or `null` when `sessionId` is `null`.
+   * @throws {Error} When the task is not found.
+   * @throws CleoError `E_TASK_CLAIMED` with {@link TaskClaimedDetails} when
+   *   another session holds the task and `mode` does not allow replacing it.
    */
-  claimTask(taskId: string, agentId: string): Promise<void>;
+  claimTask(taskId: string, request: TaskClaimRequest): Promise<TaskClaim | null>;
 
   /**
-   * Release a claimed task, clearing its assignee.
+   * Release the claim lease on a task. Without `force`, only the holder
+   * session's lease is cleared; with `force` any lease is cleared.
    *
-   * No-op if the task is not currently claimed.
-   *
-   * @param taskId - ID of the task to unclaim.
+   * @param taskId - ID of the task to release.
+   * @param release - The releasing session and whether to force.
+   * @returns `true` when a lease was cleared, `false` when there was none to clear.
    * @throws {Error} When the task is not found.
+   * @throws CleoError `E_TASK_CLAIMED` when another session holds the lease and `force` is not set.
+   */
+  unclaimTask(
+    taskId: string,
+    release: { sessionId: string | null; force?: boolean },
+  ): Promise<boolean>;
+
+  /**
+   * Heartbeat: extend every lease held by `sessionId` to `leaseExpiresAt`,
+   * without changing any task version (T12502). A session holding no lease
+   * costs one indexed read and takes no write lock.
+   *
+   * @param sessionId - The holder session.
+   * @param leaseExpiresAt - New lease expiry (ISO-8601 UTC).
+   * @returns Number of leases renewed.
    */
-  unclaimTask(taskId: string): Promise<void>;
+  renewSessionClaims(sessionId: string, leaseExpiresAt: string): Promise<number>;
 }
 
 // Factory functions (createDataAccessor, getTaskAccessor) live in @cleocode/core,

package/src/decide-sites.ts

@@ -0,0 +1,179 @@
+/**
+ * Decision-site registry contracts — the "decision ladder as code" (spec
+ * `system-one-integration` §3, owner decisions D11158 and D11159).
+ *
+ * Every place CLEO makes a judgement is a decision site: it has one primary
+ * rung, an ordered ladder of rungs it may escalate to, a fallback, an
+ * owner-escalation rule, a mode and (to act on a System One answer) go-live
+ * evidence. The registry rows live in `packages/core/src/decide/sites/`;
+ * these are their types.
+ *
+ * Types and const data only (arch gate 10).
+ *
+ * @task T12662
+ * @epic T12486
+ */
+
+/**
+ * The decision rungs, cheapest first. Escalation only moves up this list.
+ *
+ * - `rule` — the answer follows from data (ids, statuses, thresholds).
+ * - `system-one` — a typed judgement over text with a small fixed answer set.
+ * - `generative` — the output must be free text or code.
+ * - `agent` — multi-step work.
+ * - `owner` — authority only the owner can take (the ask tool).
+ */
+export const DECISION_RUNGS = ['rule', 'system-one', 'generative', 'agent', 'owner'] as const;
+
+/** One rung of the decision ladder. */
+export type DecisionRung = (typeof DECISION_RUNGS)[number];
+
+/** Site modes: `off` never asks, `shadow` asks and audits, `on` acts. */
+export const DECISION_SITE_MODES = ['off', 'shadow', 'on'] as const;
+
+/** How a site uses its System One rung. */
+export type DecisionSiteModeValue = (typeof DECISION_SITE_MODES)[number];
+
+/** The shape of the question a site answers. */
+export type DecisionSiteQuestionType =
+  | 'noul'
+  | 'choice'
+  | 'score'
+  | 'text'
+  | 'multi-step'
+  | 'owner-choice';
+
+/**
+ * When a site may put a question to the owner.
+ *
+ * - `never` — the site never asks the owner.
+ * - `escalate-only` — it may add an owner question, never clear one.
+ * - `below-floor` — it asks the owner when every lower rung is below its floor.
+ * - `always` — the owner always decides.
+ */
+export type DecisionSiteOwnerEscalation = 'never' | 'escalate-only' | 'below-floor' | 'always';
+
+/** Classes of text a site may send off the machine (spec §8). */
+export type DecisionSiteTextClass =
+  | 'task-text'
+  | 'memory-text'
+  | 'diff'
+  | 'skill-text'
+  | 'external-text';
+
+/** Measured evidence that lets a site act on its System One answer (`mode: on`). */
+export interface DecisionSiteGoLive {
+  /** Canonical doc slug holding the measurement. */
+  readonly evidenceDoc: string;
+  /** ISO date of the measurement. */
+  readonly measuredAt: string;
+  /** Number of labelled decisions measured. */
+  readonly n: number;
+  /** Metric name, e.g. `precision@acting-class`. */
+  readonly metric: string;
+  /** Measured value. */
+  readonly value: number;
+  /** Floor the value had to clear. */
+  readonly floor: number;
+}
+
+/** One registry row: everything CLEO knows about a decision site. */
+export interface DecisionSiteDefinition {
+  /** Site id; the string `decide()` and the audit log use, e.g. `tasks.duplicate-detection`. */
+  readonly id: string;
+  /** Human title. */
+  readonly title: string;
+  /** Repo-relative files where the site lives. */
+  readonly files: readonly string[];
+  /** The shape of the question. */
+  readonly questionType: DecisionSiteQuestionType;
+  /** The rung that answers first. */
+  readonly primaryRung: DecisionRung;
+  /** Rungs it may escalate to, in order, all above the primary. */
+  readonly ladder: readonly DecisionRung[];
+  /** What acts when the primary is unavailable. */
+  readonly fallback: DecisionRung | 'none';
+  /**
+   * Minimum confidence per question before `on` may act on a System One
+   * answer. The key `*` applies to every question of the site.
+   */
+  readonly floors?: Readonly<Record<string, number>>;
+  /** When the site may ask the owner. */
+  readonly ownerEscalation: DecisionSiteOwnerEscalation;
+  /** Config key holding the mode (the existing `decide.sites.*` keys, D11159). */
+  readonly modeKey?: string;
+  /** Config key opting the site into its generative rung (`decide.generativeFallback.*`). */
+  readonly generativeKey?: string;
+  /** Mode when the config key is unset. */
+  readonly defaultMode: DecisionSiteModeValue;
+  /** Generative rung: the role or system key it resolves its model with. */
+  readonly llmSystemKey?: string;
+  /** True for a site on a write path: 300 ms budget, never blocks the write. */
+  readonly writePath: boolean;
+  /** Text classes it sends to a provider. */
+  readonly sends: readonly DecisionSiteTextClass[];
+  /** Go-live evidence, required before a System One site runs `on`. */
+  readonly goLive?: DecisionSiteGoLive;
+  /** Owning task. */
+  readonly task: string;
+  /** Free-form note (constraints such as "interactive only"). */
+  readonly note?: string;
+}
+
+/** Audit counts for one site over the last seven days. */
+export interface DecisionSiteActivity {
+  /** Audit lines written for the site. */
+  readonly asked: number;
+  /** Answered by the provider. */
+  readonly provider: number;
+  /** Answered from the decision cache. */
+  readonly cache: number;
+  /** Answered by the fallback. */
+  readonly fallback: number;
+  /** Escalated to a higher rung (0 until the ladder executor lands, T12665). */
+  readonly escalated: number;
+  /** Share of compared shadow lines where decision and heuristic agreed, when any were compared. */
+  readonly agreement?: number;
+}
+
+/** One site as `cleo decide sites` reports it. */
+export interface DecisionSiteSummary {
+  /** Site id. */
+  readonly id: string;
+  /** Human title. */
+  readonly title: string;
+  /** Question shape. */
+  readonly questionType: DecisionSiteQuestionType;
+  /** Primary rung. */
+  readonly primaryRung: DecisionRung;
+  /** Escalation ladder. */
+  readonly ladder: readonly DecisionRung[];
+  /** Fallback. */
+  readonly fallback: DecisionRung | 'none';
+  /** Owner-escalation rule. */
+  readonly ownerEscalation: DecisionSiteOwnerEscalation;
+  /** Registry default mode. */
+  readonly mode: DecisionSiteModeValue;
+  /** Mode set in config, when the site has a mode key and it is set. */
+  readonly configuredMode?: DecisionSiteModeValue;
+  /** Mode in force: `off` for a System One site while no provider is configured. */
+  readonly effectiveMode: DecisionSiteModeValue;
+  /** Config key holding the mode, when the site has one. */
+  readonly modeKey?: string;
+  /** Go-live evidence, when recorded. */
+  readonly goLive?: DecisionSiteGoLive;
+  /** Owning task. */
+  readonly task: string;
+  /** Audit activity over the last seven days. */
+  readonly last7d: DecisionSiteActivity;
+}
+
+/** Result of `cleo decide sites`. */
+export interface DecisionSitesListResult {
+  /** Whether a System One provider is configured (else System One sites are `off`). */
+  readonly providerConfigured: boolean;
+  /** Registered sites total, before filters. */
+  readonly total: number;
+  /** Matching sites. */
+  readonly sites: readonly DecisionSiteSummary[];
+}