@deftai/directive-core 0.108.0 → 0.109.1

package/dist/validate-content/validate-links.js

@@ -1,5 +1,6 @@
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join, relative, resolve, sep } from "node:path";
+import { evaluateLiveProcedureTargets, formatLiveProcedureFailure, } from "../deposit/live-procedure-targets.js";
 import { NON_PRODUCT_DIRS } from "../fs/non-product-dirs.js";
 import { extractLinkTargets, shouldSkipLinkTarget } from "./link-parser.js";
 /**
@@ -43,7 +44,8 @@ function collectMarkdownFiles(root) {
     walk(root, []);
     return out.sort();
 }
-function findBrokenLinks(cwd) {
+/** Collect broken internal markdown links under cwd. Used by packed-fixture tests (#3937). */
+export function collectBrokenLinks(cwd) {
     const broken = [];
     const root = resolve(cwd);
     for (const md of collectMarkdownFiles(root)) {
@@ -82,13 +84,38 @@ function findBrokenLinks(cwd) {
 /**
  * Validate internal markdown links. Faithful to `scripts/validate-links.py`.
  */
+function contentRootForC3(cwd) {
+    const underContent = join(cwd, "content");
+    return existsSync(underContent) ? underContent : cwd;
+}
+function extraMarkdownForC3(cwd) {
+    const extras = [];
+    for (const name of ["main.md", "SKILL.md"]) {
+        const absolutePath = join(cwd, name);
+        if (existsSync(absolutePath)) {
+            extras.push({ relativePath: name, absolutePath });
+        }
+    }
+    return extras;
+}
 export function evaluate(options = {}) {
     const cwd = resolve(options.cwd ?? ".");
     const strict = options.strict === true ||
         options.linkCheckStrict === true ||
         (options.argv ?? []).includes("--strict") ||
         process.env.LINK_CHECK_STRICT === "1";
-    const broken = findBrokenLinks(cwd);
+    const c3 = evaluateLiveProcedureTargets({
+        stagedRoot: contentRootForC3(cwd),
+        extraFiles: extraMarkdownForC3(cwd),
+    });
+    if (c3.uniqueTargets.length > 0) {
+        return {
+            code: 1,
+            message: formatLiveProcedureFailure(c3),
+            stream: "stdout",
+        };
+    }
+    const broken = collectBrokenLinks(cwd);
     if (broken.length === 0) {
         return {
             code: 0,

package/dist/vbrief-activate/activate.d.ts

@@ -6,8 +6,13 @@ export interface ActivateOptions {
     readonly now?: Date;
 }
 /**
- * Pure activator — returns ``{ exitCode, message }``. Faithful to
- * ``scripts/vbrief_activate.py::activate``.
+ * Pure activator -- returns ``{ exitCode, message }``. Ported from
+ * ``scripts/vbrief_activate.py::activate`` under the #1782 byte-identical
+ * parity contract, with one deliberate divergence: the Python oracle created a
+ * ``vBRIEFInfo`` when the artifact carried no envelope, and that behaviour is
+ * NOT preserved (#3933). Envelope handling now follows the shared lifecycle
+ * policy -- stamp whichever envelope exists, refuse an envelope-less artifact
+ * by name.
  */
 export declare function activate(vbriefPath: string, options?: ActivateOptions): ActivateResult;
 //# sourceMappingURL=activate.d.ts.map

package/dist/vbrief-activate/activate.js

@@ -2,6 +2,7 @@ import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, unli
 import { basename, dirname, resolve } from "node:path";
 import { containedWrite } from "../fs/contained-write.js";
 import { assertProjectionContained, ProjectionContainmentError, } from "../fs/projection-containment.js";
+import { BRIEF_ENVELOPE_KEYS, missingEnvelopeMessage, stampExistingEnvelopes, } from "../lifecycle/brief-envelope.js";
 import { evaluateEffortActivateGate } from "../scope/effort-activate-gate.js";
 import { utcNowIso } from "../scope/vbrief-json.js";
 import { pythonJsonPretty } from "../vbrief-build/json.js";
@@ -57,8 +58,13 @@ function loadVbrief(vbriefPath) {
     return { payload: payload, error: null };
 }
 /**
- * Pure activator — returns ``{ exitCode, message }``. Faithful to
- * ``scripts/vbrief_activate.py::activate``.
+ * Pure activator -- returns ``{ exitCode, message }``. Ported from
+ * ``scripts/vbrief_activate.py::activate`` under the #1782 byte-identical
+ * parity contract, with one deliberate divergence: the Python oracle created a
+ * ``vBRIEFInfo`` when the artifact carried no envelope, and that behaviour is
+ * NOT preserved (#3933). Envelope handling now follows the shared lifecycle
+ * policy -- stamp whichever envelope exists, refuse an envelope-less artifact
+ * by name.
  */
 export function activate(vbriefPath, options = {}) {
     const now = options.now ?? new Date();
@@ -143,19 +149,26 @@ export function activate(vbriefPath, options = {}) {
         }
         throw err;
     }
-    planObj.status = TARGET_STATUS;
-    let info = payload.vBRIEFInfo;
-    if (info === undefined) {
-        info = {};
-        payload.vBRIEFInfo = info;
+    for (const key of BRIEF_ENVELOPE_KEYS) {
+        if (!(key in payload)) {
+            continue;
+        }
+        const env = payload[key];
+        if (env === null || typeof env !== "object" || Array.isArray(env)) {
+            return {
+                exitCode: 1,
+                message: `vBRIEF at ${vbriefPath} has a non-object \`${key}\` -- malformed.`,
+            };
+        }
     }
-    if (info === null || typeof info !== "object" || Array.isArray(info)) {
-        return {
-            exitCode: 1,
-            message: `vBRIEF at ${vbriefPath} has a non-object \`vBRIEFInfo\` -- malformed.`,
-        };
+    // #3933: stamp the envelope the brief already carries; never create one. A
+    // manufactured version-less `vBRIEFInfo` wins schema resolution over a valid
+    // `xBRIEFInfo`, so the brief this verb just moved would fail validation.
+    const stampedEnvelopes = stampExistingEnvelopes(payload, utcNowIso(now));
+    if (stampedEnvelopes.length === 0) {
+        return { exitCode: 1, message: missingEnvelopeMessage(`vBRIEF at ${vbriefPath}`) };
     }
-    info.updated = utcNowIso(now);
+    planObj.status = TARGET_STATUS;
     try {
         mkdirSync(activeDir, { recursive: true });
     }

package/dist/verify-ac/evaluate.d.ts

@@ -44,6 +44,15 @@ export declare const VERIFY_AC_CHECK_ID_PREFIX = "verify:ac";
 export declare function verifyAcCheckId(scopeKey?: string | null): string;
 /** Test seam: isolate stdout-dest buffer across cases. */
 export declare function resetInProcessVerificationBuffer(): void;
+/**
+ * Product-oracle outcome for one acceptance walk (#3615).
+ *
+ * A safety refusal is not a measurement. All-refused walks emit nothing.
+ * Mixed refused + executed-pass walks emit nothing (filtering refusals then
+ * classifying the remainder would be a false green). Any executed fail still
+ * emits fail. flag.ts is unchanged.
+ */
+export declare function productOracleOutcomeForWalk(runs: readonly LiteralAcceptanceRunResult[]): "pass" | "fail" | null;
 /**
  * Record one walk-level verification event for the executed command set (#3322 / #3397).
  * Fail and pass use the same method_fingerprint shape (command list + cwd hash).

package/dist/verify-ac/evaluate.js

@@ -10,6 +10,7 @@
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
+import { isSafetyRefusalRun } from "../literal-acceptance/run.js";
 import { parseRunSummaryJsonl, RunSummaryEmitter, resolveRunSummaryDestination, } from "../run-summary/index.js";
 import { flagPassAfterFailWithMethodChange, readVerificationAttempts, unresolvedMethodChangePasses, } from "./flag.js";
 function formatUnresolved(flag) {
@@ -57,6 +58,25 @@ function inProcessVerificationText() {
     }
     return inProcessVerificationLines.join("\n");
 }
+/**
+ * Product-oracle outcome for one acceptance walk (#3615).
+ *
+ * A safety refusal is not a measurement. All-refused walks emit nothing.
+ * Mixed refused + executed-pass walks emit nothing (filtering refusals then
+ * classifying the remainder would be a false green). Any executed fail still
+ * emits fail. flag.ts is unchanged.
+ */
+export function productOracleOutcomeForWalk(runs) {
+    const refused = runs.filter(isSafetyRefusalRun);
+    const executed = runs.filter((run) => !isSafetyRefusalRun(run));
+    if (executed.length === 0) {
+        return null;
+    }
+    if (refused.length > 0 && executed.every((run) => run.ok)) {
+        return null;
+    }
+    return executed.every((run) => run.ok) ? "pass" : "fail";
+}
 /**
  * Record one walk-level verification event for the executed command set (#3322 / #3397).
  * Fail and pass use the same method_fingerprint shape (command list + cwd hash).
@@ -69,6 +89,10 @@ export function emitVerifyAcAttempts(options) {
     if (options.runs.length === 0) {
         return;
     }
+    const outcome = productOracleOutcomeForWalk(options.runs);
+    if (outcome === null) {
+        return;
+    }
     try {
         const env = options.env ?? process.env;
         const projectRoot = resolve(options.projectRoot);
@@ -85,16 +109,15 @@ export function emitVerifyAcAttempts(options) {
             component: "verify-ac",
             writeStdout: options.writeStdout,
         });
-        // One walk-level event: the method is the command set, not each command.
-        // Per-command emit was blind to a shrinking list that kept the first command (#3397).
-        const commands = options.runs.map((run) => run.command);
-        const firstCwd = options.runs[0]?.cwd ?? "";
-        // Hash the cwd key (joined only when cwds differ) so cwd paths never enter
-        // the fingerprint; commandCountFromFingerprint can still count commands.
-        const cwdKey = options.runs.every((run) => run.cwd === firstCwd)
+        // Method identity is the executed command set. Refused rows are not
+        // measurements; including them would make a later same-command product
+        // fix look like a method change (#3615 Greptile P1).
+        const executed = options.runs.filter((run) => !isSafetyRefusalRun(run));
+        const commands = executed.map((run) => run.command);
+        const firstCwd = executed[0]?.cwd ?? "";
+        const cwdKey = executed.every((run) => run.cwd === firstCwd)
             ? firstCwd
-            : options.runs.map((run) => run.cwd).join("\0");
-        const outcome = options.runs.every((run) => run.ok) ? "pass" : "fail";
+            : executed.map((run) => run.cwd).join("\0");
         const emitted = emitter.emitVerification({
             check_id: checkId,
             method_fingerprint: methodFingerprintForWalk(commands, cwdKey),

package/dist/verify-env/agent-hooks.d.ts

@@ -1,4 +1,5 @@
 import { type AgentHookInspection } from "../init-deposit/agent-hooks.js";
+import { type HostToolCoverageFinding, inspectHostToolCoverage } from "../init-deposit/host-tool-coverage.js";
 import type { HostHooksPolicy } from "../policy/host-hooks.js";
 import type { OutputStream } from "./verify-hooks-installed.js";
 export interface AgentHookHealthResult {
@@ -6,7 +7,11 @@ export interface AgentHookHealthResult {
     readonly message: string;
     readonly stream: OutputStream;
     readonly registrations: readonly AgentHookInspection[];
+    /** Host tool-surface coverage gaps found alongside registration health (#3987). */
+    readonly coverage: readonly HostToolCoverageFinding[];
 }
 /** Read-only P0 agent-host registration health, independent of git hooks. */
-export declare function evaluateAgentHooks(projectRoot: string, hostHooksPolicy?: HostHooksPolicy): AgentHookHealthResult;
+export declare function evaluateAgentHooks(projectRoot: string, hostHooksPolicy?: HostHooksPolicy, 
+/** Test seam for the #3987 tool-surface coverage probe. */
+inspectCoverage?: typeof inspectHostToolCoverage): AgentHookHealthResult;
 //# sourceMappingURL=agent-hooks.d.ts.map

package/dist/verify-env/agent-hooks.js

@@ -1,6 +1,7 @@
 import { statSync } from "node:fs";
 import { resolve } from "node:path";
 import { inspectAgentHookDeposit } from "../init-deposit/agent-hooks.js";
+import { HOST_TOOL_COVERAGE_RECOVERY, inspectHostToolCoverage, } from "../init-deposit/host-tool-coverage.js";
 import { loadHostHooksPolicyFromProject, UNUSED_HOST_HOOKS_RECOVERY, } from "../policy/host-hooks.js";
 function isDirectory(path) {
     try {
@@ -11,7 +12,9 @@ function isDirectory(path) {
     }
 }
 /** Read-only P0 agent-host registration health, independent of git hooks. */
-export function evaluateAgentHooks(projectRoot, hostHooksPolicy = loadHostHooksPolicyFromProject(projectRoot)) {
+export function evaluateAgentHooks(projectRoot, hostHooksPolicy = loadHostHooksPolicyFromProject(projectRoot), 
+/** Test seam for the #3987 tool-surface coverage probe. */
+inspectCoverage = inspectHostToolCoverage) {
     const root = resolve(projectRoot);
     if (!isDirectory(root)) {
         return {
@@ -19,9 +22,11 @@ export function evaluateAgentHooks(projectRoot, hostHooksPolicy = loadHostHooksP
             message: `❌ deft agent hooks: project root ${root} does not exist (config error).`,
             stream: "stderr",
             registrations: [],
+            coverage: [],
         };
     }
     const registrations = inspectAgentHookDeposit(root, hostHooksPolicy);
+    const coverage = inspectCoverage(root, hostHooksPolicy);
     const unhealthy = registrations.filter((entry) => entry.status === "missing" || entry.status === "drifted");
     if (unhealthy.length > 0) {
         return {
@@ -34,6 +39,25 @@ export function evaluateAgentHooks(projectRoot, hostHooksPolicy = loadHostHooksP
                 UNUSED_HOST_HOOKS_RECOVERY,
             stream: "stderr",
             registrations,
+            coverage,
+        };
+    }
+    // #3987: a structurally current registration can still leave a host tool
+    // uncovered, which is the failure this issue is about — a deposit the host
+    // never matches is enforcement that never runs.
+    if (coverage.length > 0) {
+        return {
+            code: 1,
+            message: "❌ deft agent hook tool-surface coverage INCOMPLETE:\n" +
+                coverage
+                    .map((finding) => `  - ${finding.host}: ${finding.kind}` +
+                    `${finding.toolName === null ? "" : ` \`${finding.toolName}\``} ` +
+                    `at ${finding.path} — ${finding.detail}`)
+                    .join("\n") +
+                `\n  ${HOST_TOOL_COVERAGE_RECOVERY}`,
+            stream: "stderr",
+            registrations,
+            coverage,
         };
     }
     const disabledHosts = registrations
@@ -48,9 +72,11 @@ export function evaluateAgentHooks(projectRoot, hostHooksPolicy = loadHostHooksP
             "DEFT_HOOK_READ_ONLY=1 and explore subagent_type. Codex runtime trust is user-controlled and must be reviewed with `/hooks`; shell/MCP policy is deferred." +
             (disabledHosts.length > 0
                 ? ` Intentional hostHooks disabled: ${disabledHosts.join(", ")}.`
-                : ""),
+                : "") +
+            " Per-host mutation tool names verified against the deposited matchers (#3987).",
         stream: "stdout",
         registrations,
+        coverage,
     };
 }
 //# sourceMappingURL=agent-hooks.js.map

package/dist/verify-source/deposit-closure.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Check 1 -- staged-pack deposit closure (#3900 / #3601 C1).
+ *
+ * Resolves the C1 declaration against a staged pack root. Does not infer
+ * required paths from AGENTS.md prose. Reuses evaluateDepositClosure.
+ *
+ * Three-state: 0 clean / 1 missing declared paths / 2 config.
+ */
+import { type DepositClosureResult, type DepositRequiredDeclaration } from "../validate-content/deposit-required.js";
+export interface StagedDepositClosureResult {
+    readonly code: 0 | 1 | 2;
+    readonly message: string;
+    readonly stream: "stdout" | "stderr";
+    readonly missing: readonly string[];
+    readonly checked: number;
+}
+/** Copy declared C1 paths into dest using the content-package mapping. */
+export declare function stageDeclaredPack(repoRoot: string, destPackRoot: string): DepositRequiredDeclaration;
+export declare function formatStagedDepositClosureLine(result: DepositClosureResult): string;
+export declare function evaluateStagedDepositClosure(packRoot: string, paths: readonly string[]): StagedDepositClosureResult;
+export declare function evaluateDepositClosureFromRepo(repoRoot: string): StagedDepositClosureResult;
+export declare function evaluateDepositClosureAtRoot(root: string, packRootExplicit: boolean): StagedDepositClosureResult;
+//# sourceMappingURL=deposit-closure.d.ts.map

package/dist/verify-source/deposit-closure.js

@@ -0,0 +1,162 @@
+/**
+ * Check 1 -- staged-pack deposit closure (#3900 / #3601 C1).
+ *
+ * Resolves the C1 declaration against a staged pack root. Does not infer
+ * required paths from AGENTS.md prose. Reuses evaluateDepositClosure.
+ *
+ * Three-state: 0 clean / 1 missing declared paths / 2 config.
+ */
+import { cpSync, existsSync, mkdirSync, mkdtempSync, rmSync, statSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { evaluateDepositClosure, loadDepositRequiredDeclaration, packRelativeFromDepositPath, resolveDeclarationFile, sourcePathForPackRelative, } from "../validate-content/deposit-required.js";
+const EXIT_OK = 0;
+const EXIT_MISSING = 1;
+const EXIT_CONFIG = 2;
+const REMEDIATION = "Recovery: restore the declared files in content/ (or root harness files) so they survive content-package prepack. Do not infer paths from AGENTS.md prose (#3601 C1 / #3900).";
+function keepPackFile(src) {
+    const posix = src.replace(/\\/g, "/");
+    if (posix.includes("__pycache__"))
+        return false;
+    if (posix.endsWith(".pyc") || posix.endsWith(".py"))
+        return false;
+    return true;
+}
+/** Copy declared C1 paths into dest using the content-package mapping. */
+export function stageDeclaredPack(repoRoot, destPackRoot) {
+    const declarationPath = resolveDeclarationFile(repoRoot);
+    if (declarationPath === null) {
+        throw new Error("deposit-closure: C1 declaration missing (contracts/deposit-required-paths.json).");
+    }
+    const declaration = loadDepositRequiredDeclaration(declarationPath);
+    mkdirSync(destPackRoot, { recursive: true });
+    for (const declared of declaration.paths) {
+        const rel = packRelativeFromDepositPath(declared);
+        const from = sourcePathForPackRelative(repoRoot, rel);
+        if (!existsSync(from)) {
+            continue;
+        }
+        if (!keepPackFile(from)) {
+            continue;
+        }
+        const to = join(destPackRoot, ...rel.split("/"));
+        mkdirSync(dirname(to), { recursive: true });
+        cpSync(from, to);
+    }
+    return declaration;
+}
+export function formatStagedDepositClosureLine(result) {
+    if (result.ok) {
+        return ("Deposit required-paths: ok -- " +
+            String(result.checked) +
+            " declared C1 path(s) exist in the staged pack.");
+    }
+    const sample = result.missing.slice(0, 5).join(", ");
+    const extra = result.missing.length > 5 ? " (+" + String(result.missing.length - 5) + " more)" : "";
+    return ("Deposit required-paths: fail -- " +
+        String(result.missing.length) +
+        " declared path(s) missing from staged pack. Examples: " +
+        sample +
+        extra +
+        ". " +
+        REMEDIATION);
+}
+export function evaluateStagedDepositClosure(packRoot, paths) {
+    const root = resolve(packRoot);
+    let isDir = false;
+    try {
+        isDir = statSync(root).isDirectory();
+    }
+    catch {
+        isDir = false;
+    }
+    if (!isDir) {
+        return {
+            code: EXIT_CONFIG,
+            message: "verify_deposit_closure: --pack-root is not a directory: " +
+                root +
+                "\n  Recovery: pass a staged pack root or framework checkout.",
+            stream: "stderr",
+            missing: [],
+            checked: 0,
+        };
+    }
+    const result = evaluateDepositClosure({ packRoot: root, paths });
+    if (result.ok) {
+        return {
+            code: EXIT_OK,
+            message: formatStagedDepositClosureLine(result),
+            stream: "stdout",
+            missing: result.missing,
+            checked: result.checked,
+        };
+    }
+    return {
+        code: EXIT_MISSING,
+        message: formatStagedDepositClosureLine(result),
+        stream: "stderr",
+        missing: result.missing,
+        checked: result.checked,
+    };
+}
+export function evaluateDepositClosureFromRepo(repoRoot) {
+    const root = resolve(repoRoot);
+    const declarationPath = resolveDeclarationFile(root);
+    if (declarationPath === null) {
+        return {
+            code: EXIT_CONFIG,
+            message: "verify_deposit_closure: C1 declaration missing.\n  Recovery: add content/contracts/deposit-required-paths.json (#3601 C1).",
+            stream: "stderr",
+            missing: [],
+            checked: 0,
+        };
+    }
+    const tmp = mkdtempSync(join(tmpdir(), "deft-3900-pack-"));
+    try {
+        const declaration = stageDeclaredPack(root, tmp);
+        return evaluateStagedDepositClosure(tmp, declaration.paths);
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        return {
+            code: EXIT_CONFIG,
+            message: "verify_deposit_closure: " + reason + "\n  " + REMEDIATION,
+            stream: "stderr",
+            missing: [],
+            checked: 0,
+        };
+    }
+    finally {
+        rmSync(tmp, { recursive: true, force: true });
+    }
+}
+export function evaluateDepositClosureAtRoot(root, packRootExplicit) {
+    if (packRootExplicit) {
+        const declarationPath = resolveDeclarationFile(root);
+        if (declarationPath === null) {
+            return {
+                code: EXIT_CONFIG,
+                message: "verify_deposit_closure: C1 declaration missing under the given pack root.\n  Recovery: stage contracts/deposit-required-paths.json with the pack (#3601 C1).",
+                stream: "stderr",
+                missing: [],
+                checked: 0,
+            };
+        }
+        try {
+            const declaration = loadDepositRequiredDeclaration(declarationPath);
+            return evaluateStagedDepositClosure(root, declaration.paths);
+        }
+        catch (err) {
+            const reason = err instanceof Error ? err.message : String(err);
+            return {
+                code: EXIT_CONFIG,
+                message: "verify_deposit_closure: " + reason + "\n  " + REMEDIATION,
+                stream: "stderr",
+                missing: [],
+                checked: 0,
+            };
+        }
+    }
+    return evaluateDepositClosureFromRepo(root);
+}
+//# sourceMappingURL=deposit-closure.js.map

package/dist/verify-source/index.d.ts

@@ -5,10 +5,12 @@ export * from "./contained-writes.js";
 export * from "./content-manifest.js";
 export { CANONICAL_SCHEMA_REL, type ContractDriftOptions, type ContractDriftResult, evaluateContractDrift, PUBLISHED_SCHEMA_REL, } from "./contract-drift.js";
 export * from "./cursor-tier1.js";
+export * from "./deposit-closure.js";
 export * from "./openclaw-tier1.js";
 export * from "./python-call-scan.js";
 export * from "./rule-ownership-lint.js";
 export * from "./scm-boundary.js";
+export * from "./semantic-single-source.js";
 export * from "./skill-external-fetch-gate.js";
 export * from "./verify-stubs.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/verify-source/index.js

@@ -5,10 +5,12 @@ export * from "./contained-writes.js";
 export * from "./content-manifest.js";
 export { CANONICAL_SCHEMA_REL, evaluateContractDrift, PUBLISHED_SCHEMA_REL, } from "./contract-drift.js";
 export * from "./cursor-tier1.js";
+export * from "./deposit-closure.js";
 export * from "./openclaw-tier1.js";
 export * from "./python-call-scan.js";
 export * from "./rule-ownership-lint.js";
 export * from "./scm-boundary.js";
+export * from "./semantic-single-source.js";
 export * from "./skill-external-fetch-gate.js";
 export * from "./verify-stubs.js";
 //# sourceMappingURL=index.js.map

package/dist/verify-source/semantic-single-source.d.ts

@@ -0,0 +1,36 @@
+/**
+ * C2 — semantic single-source conformance (#3600 / #3899).
+ *
+ * Shipped guidance must name one value where the framework has one value.
+ * The 0.6-versus-0.8 defect lives inside a file that resolves perfectly, so
+ * pointer existence (C1) cannot see it. This oracle is not a link checker.
+ *
+ * Evaluates a staged pack root (flattened consumer deposit) or a source
+ * checkout (content/ prefix + root main.md). Three-state: 0 clean / 1 drift / 2 config.
+ */
+/** Closed, typed current-authoring surfaces (#3600 AC / #3899 C2). */
+export declare const C2_AUTHORING_SURFACES: readonly ["main.md", "skills/deft-directive-setup/SKILL.md", "skills/deft-directive-build/SKILL.md", "skills/deft-directive-interview/SKILL.md", "skills/deft-directive-refinement/SKILL.md", "skills/deft-directive-sync/SKILL.md", "templates/project.md.template", "templates/make-spec.md", "conventions/references.md", "commands.md"];
+export type C2AuthoringSurface = (typeof C2_AUTHORING_SURFACES)[number];
+export interface SemanticSingleSourceViolation {
+    readonly path: string;
+    readonly line: number;
+    readonly version: string;
+    readonly excerpt: string;
+}
+export interface SemanticSingleSourceResult {
+    readonly code: 0 | 1 | 2;
+    readonly message: string;
+    readonly stream: "stdout" | "stderr";
+    readonly setupWriteVersion: string | null;
+    readonly violations: readonly SemanticSingleSourceViolation[];
+    readonly currentWriteVersions: readonly string[];
+}
+/**
+ * Resolve a closed-list surface against a flattened pack root or a source
+ * checkout (content/ prefix for everything except root harness main.md).
+ */
+export declare function resolveAuthoringSurface(packRoot: string, rel: string): string | null;
+export declare function extractQuotedVersions(line: string): string[];
+export declare function extractSetupWriteVersion(setupText: string): string | null;
+export declare function evaluateSemanticSingleSource(packRoot: string): SemanticSingleSourceResult;
+//# sourceMappingURL=semantic-single-source.d.ts.map