@haystackeditor/cli 0.15.25 → 0.15.27

package/dist/commands/verify-hosted-reproducibility.d.ts

@@ -4,11 +4,13 @@ export interface HostedReproducibilityOptions {
     head: string;
     runs?: string;
     seriesKey?: string;
+    freshPlans?: boolean;
     account?: string;
     interval?: string;
     timeout?: string;
     json?: boolean;
 }
+type HostedReproducibilityMode = 'exact_plan_replay' | 'fresh_plans';
 interface HostedReproducibilityRun {
     state: HostedRunState;
     timedOut: boolean;
@@ -19,6 +21,7 @@ interface HostedReproducibilityIdentity {
     baseCommit: string;
     headCommit: string;
     requestedRuns?: number;
+    mode?: HostedReproducibilityMode;
 }
 interface ParsedAssessment {
     schemaVersion: 8 | 9;
@@ -60,6 +63,7 @@ export interface HostedReproducibilityReport {
     repository: string;
     base_commit: string;
     head_commit: string;
+    reproducibility_mode: HostedReproducibilityMode;
     requested_runs: number;
     launched_runs: number;
     unstarted_runs: number;
@@ -67,7 +71,7 @@ export interface HostedReproducibilityReport {
     run_ids: string[];
     replay_source_run_id: string | null;
     plan_replay_verified: boolean;
-    planner_reproducibility_tested: false;
+    planner_reproducibility_tested: boolean;
     planner_reproducible: boolean;
     assessment_reproducible: boolean;
     reproducible: boolean;
@@ -78,7 +82,7 @@ export interface HostedReproducibilityReport {
     inconclusive_cell_ids: string[];
     unrunnable_runs: RunFailure[];
 }
-export declare function hostedReproducibilityRunKey(seriesKey: string, repository: string, baseCommit: string, headCommit: string, ordinal: number): string;
+export declare function hostedReproducibilityRunKey(seriesKey: string, repository: string, baseCommit: string, headCommit: string, ordinal: number, mode?: HostedReproducibilityMode): string;
 export declare function analyzeHostedReproducibility(runs: HostedReproducibilityRun[], identity: HostedReproducibilityIdentity): HostedReproducibilityReport;
 export declare function isHostedReproducibilityReplaySource(run: HostedReproducibilityRun, identity: HostedReproducibilityIdentity): boolean;
 export declare function verifyHostedReproducibilityCommand(repositoryArg: string, options: HostedReproducibilityOptions): Promise<void>;

package/dist/commands/verify-hosted-reproducibility.js

@@ -69,15 +69,24 @@ function requireSeriesKey(value) {
     }
     return key;
 }
-export function hostedReproducibilityRunKey(seriesKey, repository, baseCommit, headCommit, ordinal) {
+export function hostedReproducibilityRunKey(seriesKey, repository, baseCommit, headCommit, ordinal, mode = 'exact_plan_replay') {
     const digest = createHash('sha256')
-        .update(JSON.stringify([
-        seriesKey,
-        repository,
-        baseCommit,
-        headCommit,
-        ordinal,
-    ]))
+        .update(JSON.stringify(mode === 'exact_plan_replay'
+        ? [
+            seriesKey,
+            repository,
+            baseCommit,
+            headCommit,
+            ordinal,
+        ]
+        : [
+            mode,
+            seriesKey,
+            repository,
+            baseCommit,
+            headCommit,
+            ordinal,
+        ]))
         .digest('hex');
     return `repro:${digest}`;
 }
@@ -371,10 +380,17 @@ export function analyzeHostedReproducibility(runs, identity) {
             });
         }
     }
+    const requestedRuns = identity.requestedRuns ?? runs.length;
+    const allRequestedRunsLaunched = runs.length === requestedRuns;
     const planVariants = groupedPlanVariants(parsed);
     const assessmentVariants = groupedOutcomeVariants(parsed);
-    const replaySourceRunId = parsed[0]?.runId ?? null;
-    const planReplayVerified = parsed.length === runs.length
+    const mode = identity.mode ?? 'exact_plan_replay';
+    const replaySourceRunId = mode === 'exact_plan_replay'
+        ? parsed[0]?.runId ?? null
+        : null;
+    const planReplayVerified = mode === 'exact_plan_replay'
+        && allRequestedRunsLaunched
+        && parsed.length === runs.length
         && parsed.length > 1
         && parsed[0]?.assessment.schemaVersion === 8
         && parsed[0]?.assessment.replaySourceRunId === null
@@ -384,7 +400,17 @@ export function analyzeHostedReproducibility(runs, identity) {
                 === parsed[0].assessment.schemaVersion
             && item.assessment.riskPlanSha256
                 === parsed[0].assessment.riskPlanSha256);
-    const assessmentReproducible = planReplayVerified && assessmentVariants.length === 1;
+    const plannerReproducibilityTested = mode === 'fresh_plans' && parsed.length > 1;
+    const plannerReproducible = plannerReproducibilityTested
+        && allRequestedRunsLaunched
+        && parsed.length === runs.length
+        && parsed.every(item => item.assessment.schemaVersion === 8
+            && item.assessment.replaySourceRunId === null)
+        && planVariants.length === 1;
+    const assessmentReproducible = (mode === 'exact_plan_replay'
+        ? planReplayVerified
+        : plannerReproducible)
+        && assessmentVariants.length === 1;
     const planDriftCellIds = driftIds(parsed, assessment => new Map(assessment.planIdentities.map(plan => [
         plan.cellId,
         { capabilityId: plan.capabilityId },
@@ -401,12 +427,12 @@ export function analyzeHostedReproducibility(runs, identity) {
     const inconclusiveCellIds = [...new Set(parsed.flatMap(item => item.assessment.outcomes
             .filter(outcome => outcome.status === 'inconclusive')
             .map(outcome => outcome.cellId)))].sort();
-    const requestedRuns = identity.requestedRuns ?? runs.length;
     return {
         series_key: identity.seriesKey,
         repository: identity.repository,
         base_commit: identity.baseCommit,
         head_commit: identity.headCommit,
+        reproducibility_mode: mode,
         requested_runs: requestedRuns,
         launched_runs: runs.length,
         unstarted_runs: Math.max(0, requestedRuns - runs.length),
@@ -414,10 +440,12 @@ export function analyzeHostedReproducibility(runs, identity) {
         run_ids: runs.map(run => run.state.runId),
         replay_source_run_id: replaySourceRunId,
         plan_replay_verified: planReplayVerified,
-        planner_reproducibility_tested: false,
-        planner_reproducible: false,
+        planner_reproducibility_tested: plannerReproducibilityTested,
+        planner_reproducible: plannerReproducible,
         assessment_reproducible: assessmentReproducible,
-        reproducible: planReplayVerified
+        reproducible: (mode === 'exact_plan_replay'
+            ? planReplayVerified
+            : plannerReproducible)
             && assessmentReproducible
             && inconclusiveCellIds.length === 0,
         plan_variants: planVariants,
@@ -444,9 +472,20 @@ function renderHostedReproducibility(report) {
     const icon = report.reproducible ? chalk.green('✓') : chalk.yellow('!');
     console.log(`${icon} Hosted reproducibility: ${report.reproducible ? 'reproducible' : 'not established'}`);
     console.log(`  ${chalk.dim('Runs:')} ${report.analyzable_runs}/${report.requested_runs} analyzable; ${report.launched_runs} launched`);
+    console.log(`  ${chalk.dim('Mode:')} ${report.reproducibility_mode === 'fresh_plans'
+        ? 'independent fresh plans'
+        : 'exact plan replay'}`);
     console.log(`  ${chalk.dim('Plan variants:')} ${report.plan_variants.length}`);
-    console.log(`  ${chalk.dim('Exact plan replay:')} ${report.plan_replay_verified ? 'verified' : 'not verified'}`);
-    console.log(`  ${chalk.dim('Independent planner reproducibility:')} not tested`);
+    console.log(`  ${chalk.dim('Exact plan replay:')} ${report.reproducibility_mode === 'fresh_plans'
+        ? 'not requested'
+        : report.plan_replay_verified
+            ? 'verified'
+            : 'not verified'}`);
+    console.log(`  ${chalk.dim('Independent planner reproducibility:')} ${report.planner_reproducibility_tested
+        ? report.planner_reproducible
+            ? 'verified'
+            : 'not reproducible'
+        : 'not tested'}`);
     console.log(`  ${chalk.dim('Assessment variants:')} ${report.assessment_variants.length}`);
     if (report.plan_drift_cell_ids.length > 0) {
         console.log(`  ${chalk.dim('Plan drift:')} ${report.plan_drift_cell_ids.length} stable cell id(s)`);
@@ -465,6 +504,9 @@ export async function verifyHostedReproducibilityCommand(repositoryArg, options)
     const repository = parseHostedRepository(repositoryArg);
     const requestedRuns = boundedInteger(options.runs, DEFAULT_RUNS, '--runs', 2, MAX_RUNS);
     const seriesKey = requireSeriesKey(options.seriesKey);
+    const mode = options.freshPlans
+        ? 'fresh_plans'
+        : 'exact_plan_replay';
     const auth = await resolveAuthContext({
         preferredLogin: options.account,
         owner: repository.owner,
@@ -479,8 +521,8 @@ export async function verifyHostedReproducibilityCommand(repositoryArg, options)
         const started = await startHostedVerification(repositoryArg, {
             base: options.base,
             head: options.head,
-            idempotencyKey: hostedReproducibilityRunKey(seriesKey, repository.fullName, options.base, options.head, index + 1),
-            replayPlanFrom: index === 0
+            idempotencyKey: hostedReproducibilityRunKey(seriesKey, repository.fullName, options.base, options.head, index + 1, mode),
+            replayPlanFrom: options.freshPlans || index === 0
                 ? undefined
                 : runs[0]?.state.runId,
             wait: false,
@@ -497,7 +539,9 @@ export async function verifyHostedReproducibilityCommand(repositoryArg, options)
             timedOut = waited.timedOut;
         }
         runs.push({ state, timedOut });
-        if (index === 0
+        if (!options.freshPlans
+            &&
+                index === 0
             && !isHostedReproducibilityReplaySource(runs[0], {
                 seriesKey,
                 repository: repository.fullName,
@@ -516,6 +560,7 @@ export async function verifyHostedReproducibilityCommand(repositoryArg, options)
         baseCommit: options.base,
         headCommit: options.head,
         requestedRuns,
+        mode,
     });
     if (options.json) {
         process.stdout.write(`${JSON.stringify(withSchema('cloud-verifier', {

package/dist/index.js

@@ -30,11 +30,18 @@ import { initCommand } from './commands/init.js';
 import { authListCommand, authUseCommand, loginCommand, logoutCommand, whoamiCommand, } from './commands/login.js';
 import { handleAgenticTool, handleAutoMerge, handleAutoFix, handleWaitForReviewers, isAutoMergeEnabled, isAutoFixEnabled } from './commands/config.js';
 import { installSkills, listSkills } from './commands/skills.js';
+import { cloudVerifierUniverseValidateCommand } from './commands/cloud-verifier-universe.js';
+import { cloudVerifierIdentityCensusCommand } from './commands/cloud-verifier-identity-census.js';
+import { cloudVerifierDataStoreDriftCommand } from './commands/cloud-verifier-data-store-drift.js';
+import { cloudVerifierBehaviorsValidateCommand } from './commands/cloud-verifier-behaviors.js';
+import { prepareUniverseReviewCommand } from './commands/prepare-universe-review.js';
+import { scaffoldProvisionalUniverseCommand } from './commands/scaffold-provisional-universe.js';
 import { hooksInstall, hooksStatus, hooksUpdate } from './commands/hooks.js';
 import { submitCommand } from './commands/submit.js';
 import { installSessionHooks, sessionHooksStatus } from './commands/install-session-hooks.js';
 import { listPolicies, addPolicy, removePolicy, initPolicies, addInstruction } from './commands/policy.js';
 import { triageCommand } from './commands/triage.js';
+import { designVerifyCommand } from './commands/design-verify.js';
 import { dismissCommand, markReviewedCommand, undismissCommand } from './commands/dismiss.js';
 import { requestReviewCommand } from './commands/request-review.js';
 import { reviewCommand } from './commands/review.js';
@@ -43,6 +50,7 @@ import { prReadCommand } from './commands/pr.js';
 import { inboxListCommand } from './commands/inbox.js';
 import { askHaystackCommand } from './commands/ask.js';
 import { tracesGetCommand, tracesListCommand } from './commands/traces.js';
+import { telemetryInstrumentCommand } from './commands/telemetry.js';
 import { setupCommand } from './commands/setup.js';
 import { schemaCommand, listSchemas } from './commands/schema-cmd.js';
 import { registerWebhook, listWebhooks, rotateWebhookSecret, setWebhookEnabled, listDeliveries, replayDelivery, } from './commands/webhooks.js';
@@ -262,12 +270,13 @@ Example:
 });
 hostedVerify
     .command('reproducibility')
-    .description('Replay one exact hosted risk plan and report executor or assessment drift')
+    .description('Replay one exact hosted risk plan or run fresh plans to report drift')
     .argument('<repository>', 'Exact GitHub owner/repository name')
     .option('--base <sha>', 'Required: exact 40-character lowercase base commit SHA')
     .option('--head <sha>', 'Required: exact 40-character lowercase head commit SHA')
     .option('--runs <n>', 'Number of sequential production runs (default 3; min 2, max 10)')
     .option('--series-key <key>', 'Stable series key for resumable idempotent retries')
+    .option('--fresh-plans', 'Run the planner independently for every run instead of replaying the first plan')
     .option('--account <login>', 'Use a specific saved Haystack account')
     .option('--interval <seconds>', 'Polling interval for each run (default 5)')
     .option('--timeout <minutes>', 'Maximum wait per run (default 35)')
@@ -278,8 +287,14 @@ validated plan against the same repository and commit pair with a distinct,
 series-derived idempotency key. A reproducible verdict requires schema-9 replay
 provenance, stable assessment outcomes, and no inconclusive cells.
 
+With --fresh-plans, every run plans independently. A reproducible verdict then
+requires one stable-id plan variant, one assessment variant, no replay
+provenance, and no inconclusive cells. Use this mode to detect planner drift;
+use the default mode to isolate executor or assessment drift.
+
 Example:
   haystack verify hosted reproducibility owner/repo --base <sha> --head <sha> --runs 3
+  haystack verify hosted reproducibility owner/repo --base <sha> --head <sha> --runs 3 --fresh-plans
 `)
     .action(async (repository, _options, cmd) => {
     const options = { ...cmd.optsWithGlobals(), ...cmd.opts() };
@@ -797,6 +812,32 @@ traces
     .option('--limit <count>', 'Chunks per page', '20')
     .option('--json', 'Output as JSON')
     .action((ref, checkpoint, options) => runPublicCommand(() => tracesGetCommand(ref, checkpoint, options), options.json));
+const telemetry = program.command('telemetry').description('Add privacy-safe production telemetry without an application SDK');
+telemetry
+    .command('instrument <dist>')
+    .description('Instrument compiled Node.js output without changing application source')
+    .requiredOption('--entry <file>', 'Entry file relative to the compiled output directory')
+    .option('--source-root <dir>', 'Source directory whose files correspond exactly to compiled output (default: sibling src/)')
+    .option('--include-symbols <file>', 'Experimental JSON allow-list of exact sourcePath + qualifiedName symbols')
+    .option('--json', 'Machine-readable instrumentation manifest')
+    .addHelpText('after', `
+Run this once after the normal application build. It rewrites only compiled
+JavaScript and copies a dependency-free runtime beside it; application source
+does not import Haystack.
+
+At runtime, telemetry stays off unless all three variables are set:
+  HAYSTACK_TELEMETRY=1
+  HAYSTACK_TELEMETRY_ENDPOINT=https://.../v3/telemetry
+  HAYSTACK_TELEMETRY_TOKEN=...
+
+Example:
+  npm run build && haystack telemetry instrument dist --entry index.js
+`)
+    .action((dist, options) => runPublicCommand(() => telemetryInstrumentCommand(dist, {
+    ...options,
+    includeSymbolsFile: options.includeSymbols,
+    includeSymbols: undefined,
+}), options.json));
 program
     .command('dismiss <pr>')
     .description('Dismiss analysis findings for a PR')
@@ -819,6 +860,31 @@ Examples:
   haystack dismiss acme/widgets#99     # Dismiss for specific repo
 `)
     .action(dismissCommand);
+program
+    .command('design-verify <pr>')
+    // "verification" is a banned word in top-level help (public-contract test
+    // keeps retired auto-fix/verification wording out of the CLI surface).
+    .description('Run a blind design-by-execution review of a PR')
+    .option('--json', 'Machine-readable output')
+    .option('--no-wait', 'Return after the run is admitted instead of waiting for its verdict')
+    .option('--run <run-id>', 'Resume and wait for an existing exact run id')
+    .option('--poll-interval <seconds>', 'Status polling interval', '3')
+    .option('--timeout <seconds>', 'Maximum time to wait; the server run continues after timeout', '7200')
+    .addHelpText('after', `
+Executes the change instead of reading it: infers intent from the diff
+alone, designs pre-registered behavioral test cases, runs them against
+both sides of the PR in isolated sandboxes, and reports a mechanical
+verdict of unexpected behavior changes.
+
+The command waits for a behavioral verdict by default. Use --no-wait to
+return the run id immediately, or --run <run-id> to resume waiting.
+
+PR identifier formats:
+  123                                     PR number (uses current repo)
+  owner/repo#123                          Fully qualified
+  https://github.com/owner/repo/pull/123  GitHub URL
+`)
+    .action(designVerifyCommand);
 program
     .command('mark-reviewed <pr>')
     .description('Mark human review as not needed for a PR')
@@ -1028,32 +1094,95 @@ Examples:
 // Skills subcommands
 const skills = program
     .command('skills')
-    .description('Manage AI skills for Claude Code');
+    .description('Manage AI skills for coding agents');
 skills
     .command('install')
-    .description('Install Haystack skills into your coding CLI')
+    .description('Install portable Haystack skills and optional coding-CLI shims')
     .option('--cli <name>', 'Target CLI: claude, codex, cursor, or manual')
     .addHelpText('after', `
-This registers the Haystack MCP server with your coding CLI, enabling:
-  /setup-haystack         - AI-assisted project setup
+This installs portable skills in the Git repository's .agents/skills directory:
   /submit                 - Submit a PR via Haystack
+  /map-your-system        - Map how Haystack QA can run this system
+  /map-cloud-verifier-universe - Map a production-derived hermetic universe
 Supported CLIs:
-  claude    Claude Code (auto-detected)
-  codex     Codex CLI (auto-detected)
-  cursor    Cursor IDE (auto-detected)
-  manual    Show manual setup instructions
+  claude    Also install Claude Code command shims
+  codex     Use portable .agents/skills discovery only
+  cursor    Use portable .agents/skills discovery only
+  manual    Install portable skills and show their location
 
 Examples:
-  haystack skills install              # Auto-detect and install
+  haystack skills install              # Install portable skills only
   haystack skills install --cli codex  # Install for Codex only
-  haystack skills install --cli manual # Show manual instructions
+  haystack skills install --cli claude # Also install Claude command shims
 `)
-    .action(installSkills);
+    .action(async (opts) => {
+    try {
+        await installSkills(opts);
+    }
+    catch (err) {
+        console.error(chalk.red('skills install failed:'), err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
 skills
     .command('list')
     .description('List available Haystack skills')
     .action(listSkills);
-// Hooks subcommands
+skills
+    .command('census-universe')
+    .description('Deterministically census Cloud Verifier source identities before mapping')
+    .option('--json', 'Machine-readable result')
+    .option('--root <path>', 'Repository root (default: current Git worktree)')
+    .action((opts) => runPublicCommand(async () => cloudVerifierIdentityCensusCommand(opts), opts.json));
+skills
+    .command('data-store-drift')
+    .description('Check whether the detected data stores still match the checked-in map (per-PR drift gate)')
+    .option('--json', 'Machine-readable result')
+    .option('--root <path>', 'Repository root (default: current Git worktree)')
+    .option('--baseline <path>', 'Baseline map path (default: .haystack/cloud-verifier/data-stores.json)')
+    .option('--base-ref <ref>', 'Only run when the diff against this ref touches a store-relevant file')
+    .option('--update', 'Write the current detected stores as the new baseline')
+    .action((opts) => runPublicCommand(async () => cloudVerifierDataStoreDriftCommand(opts), opts.json));
+skills
+    .command('validate-universe')
+    .description('Validate Cloud Verifier universe artifacts and stable-ID references')
+    .option('--json', 'Machine-readable result')
+    .action(async (opts) => {
+    try {
+        await cloudVerifierUniverseValidateCommand(opts);
+    }
+    catch (err) {
+        console.error(chalk.red('validate-universe failed:'), err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
+skills
+    .command('validate-behaviors')
+    .description('Validate customer actions and their exact runtime identities')
+    .option('--json', 'Machine-readable result')
+    .action(async (opts) => {
+    try {
+        await cloudVerifierBehaviorsValidateCommand(opts);
+    }
+    catch (err) {
+        console.error(chalk.red('validate-behaviors failed:'), err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
+skills
+    .command('scaffold-provisional-universe')
+    .description('Create a compact missing-authority receipt from strict JSON facts')
+    .requiredOption('--input <path>', 'Strict provisional-universe JSON input file')
+    .action((opts) => runPublicCommand(async () => scaffoldProvisionalUniverseCommand(opts), true));
+skills
+    .command('prepare-universe-review')
+    .description('Create a tracked-source snapshot with conventional test paths removed')
+    .option('--json', 'Machine-readable isolation result and snapshot manifest')
+    .option('--exclude-inactive-submodule <path...>', 'Omit exact tracked gitlink paths explicitly known to be inactive')
+    .option('--omit-unscannable-files', 'Omit files whose test content cannot be ruled out, instead of blocking the review. '
+    + 'The reviewer still never sees a test; the omissions are recorded as uncovered scope')
+    .option('--full-receipt', 'Include complete non-blocking path receipts in JSON output')
+    .action((opts) => runPublicCommand(() => prepareUniverseReviewCommand(opts), opts.json));
 const hooks = program
     .command('hooks')
     .description('Manage git hooks for AI agent quality checks');

package/dist/triage/runner.js

@@ -101,7 +101,13 @@ export function buildCommand(cli, prompt, maxTurns) {
         case 'codex':
             return {
                 command: 'codex',
-                args: ['exec', prompt, '--full-auto'],
+                args: [
+                    '--sandbox', 'workspace-write',
+                    '--ask-for-approval', 'never',
+                    'exec',
+                    '--ephemeral',
+                    prompt,
+                ],
             };
         case 'gemini':
             return {
@@ -119,17 +125,12 @@ function spawnChecker(cli, config, cwd, timeoutMs) {
         const { command, args } = buildCommand(cli, config.prompt, config.maxTurns);
         let stdout = '';
         let stderr = '';
-        const codexHome = join(cwd, '.haystack', 'triage', 'codex-home');
-        if (cli === 'codex') {
-            mkdirSync(codexHome, { recursive: true });
-        }
         const proc = spawn(command, args, {
             cwd,
             stdio: ['ignore', 'pipe', 'pipe'],
             env: {
                 ...process.env,
                 CLAUDECODE: undefined,
-                CODEX_HOME: cli === 'codex' ? codexHome : process.env.CODEX_HOME,
             },
         });
         proc.stdout?.on('data', (data) => {

package/dist/utils/design-verifier-api.d.ts

@@ -0,0 +1,129 @@
+/**
+ * Client for the design-verifier trigger route on the auth worker.
+ *
+ * The worker owns everything sensitive: it authenticates the CLI token,
+ * enforces hsk_live repo scope, resolves the PR's base/head SHAs via the
+ * GitHub App install token, and forwards to the AWS design-verifier API with
+ * the server-side shared secret. This client just POSTs and interprets the
+ * response.
+ */
+export type DesignVerifierTriggerResult = {
+    status: 'started' | 'queued' | 'duplicate';
+    runId: string;
+} | {
+    status: 'denied';
+    message: string;
+} | {
+    status: 'rate_limited';
+    message: string;
+} | {
+    status: 'unavailable';
+    message: string;
+} | {
+    status: 'error';
+    message: string;
+};
+export interface DesignVerifierCommandSpec {
+    cwd: string;
+    argv: string[];
+    env: Record<string, string>;
+    timeoutMs?: number;
+}
+export interface DesignVerifierExecutionDiagnostic {
+    diagnosticId: string;
+    kind: string;
+    message: string;
+    type?: string;
+    code?: string;
+}
+export interface DesignVerifierExecutionSummary {
+    side: 'base1' | 'base2' | 'head';
+    status: 'completed' | 'failed' | 'missing';
+    commandExitCode: number | null;
+    durationMs: number | null;
+    scenarioError: string | null;
+    diagnostics: DesignVerifierExecutionDiagnostic[];
+    diagnosticsOmitted: number;
+    outputExcerpt: Array<{
+        stream: 'stdout' | 'stderr' | 'system' | 'output';
+        text: string;
+    }>;
+    outputLinesOmitted: number;
+    traceArtifact: string;
+    outputArtifact: string;
+}
+export interface DesignVerifierStageTiming {
+    stage: 'prepare' | 'bake' | 'blast-radius' | 'prefetch' | 'case-design' | 'verdict';
+    status: string;
+    durationMs: number | null;
+    completedAt: string | null;
+    source: 'phase-artifact' | 'phase-artifact-clock' | 'cache-hit' | 'missing';
+    breakdownMs: Record<string, number>;
+    pollCount?: number;
+}
+export interface DesignVerifierTimingSummary {
+    admissionMs: number | null;
+    pipelineDurationMs: number | null;
+    recordedStageMs: number;
+    unattributedMs: number | null;
+    stages: DesignVerifierStageTiming[];
+}
+export interface DesignVerifierStatusResult {
+    version: 'dv-cli-status-v1';
+    runId: string;
+    owner: string;
+    repo: string;
+    pr: number;
+    baseSha: string | null;
+    headSha: string | null;
+    status: string;
+    stage: string | null;
+    createdAt: string | null;
+    startedAt: string | null;
+    finishedAt: string | null;
+    durationMs: number | null;
+    error: string | null;
+    result?: {
+        verdict: Record<string, any>;
+        cases: Array<Record<string, any>>;
+        scenarios: Array<Record<string, any> & {
+            executions?: DesignVerifierExecutionSummary[];
+        }>;
+        changedFiles: string[];
+        timings?: DesignVerifierTimingSummary;
+        probes: Array<{
+            caseId: string;
+            title: string;
+            files: string[];
+            validate: DesignVerifierCommandSpec | null;
+            run: DesignVerifierCommandSpec | null;
+        }>;
+        replay: {
+            artifactPrefix: string;
+            keys: Record<string, string>;
+        };
+    };
+}
+export type DesignVerifierStatusFetchResult = {
+    status: 'ok';
+    run: DesignVerifierStatusResult;
+} | {
+    status: 'not_found' | 'denied' | 'unavailable' | 'error';
+    message: string;
+};
+export declare function triggerDesignVerifier(owner: string, repo: string, prNumber: number, token: string): Promise<DesignVerifierTriggerResult>;
+export declare function getDesignVerifierStatus(owner: string, repo: string, prNumber: number, runId: string, token: string): Promise<DesignVerifierStatusFetchResult>;
+export declare function waitForDesignVerifier(owner: string, repo: string, prNumber: number, runId: string, token: string, options?: {
+    intervalMs?: number;
+    timeoutMs?: number;
+    onProgress?: (run: DesignVerifierStatusResult) => void;
+    sleep?: (ms: number) => Promise<void>;
+}): Promise<{
+    status: 'terminal';
+    run: DesignVerifierStatusResult;
+} | {
+    status: 'timeout';
+} | {
+    status: 'error';
+    message: string;
+}>;