@interlok/cli 0.0.0-stage → 1.3.0

package/LICENSE

@@ -0,0 +1,5 @@
+Apache License 2.0
+
+Copyright 2026 Interlok
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy at https://www.apache.org/licenses/LICENSE-2.0

package/README.md

@@ -1,3 +1,159 @@
-# Temporary Holding Version
+# Interlok CLI
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Seven commands: `scan`, `shadow`, `proxy`, `gate`, `verify`, `approvals-mcp`, `hook`. Apache-2.0. Telemetry is off; nothing leaves your machine unless you pass `--publish`, run `shadow`, or an agent asks a person through `hook` or `approvals-mcp`.
+
+## scan: coverage, locally
+
+```bash
+npx @interlok/cli scan                       # reads .mcp.json, .vscode/mcp.json, .cursor/mcp.json
+npx @interlok/cli scan .mcp.json --enumerate # starts each server and lists its tools
+npx @interlok/cli scan --ci --min-coverage 80 # exit 5 below 80% of high-risk write paths guarded
+npx @interlok/cli scan --publish             # signed public report + README badge (needs a key)
+```
+
+Coverage counts only high-consequence write paths (money, access, deletion, code execution, deploys, messages to people) and how many have a guard. Tools whose names can't be classified count as high-risk until someone classifies them. `src/classify.ts` is the same file the hosted app uses; a test fails the build if they differ.
+
+## shadow: what your agent would have done, on every pull request
+
+```bash
+npx @interlok/cli shadow --agent my-agent --markdown interlok.md \
+  --fail-on new_high_reach,coverage_drop -- npm run agent:e2e
+```
+
+In GitHub Actions the commit, branch, and base branch are read from the environment, so a pull request is compared with the latest run on the branch it merges into. `--fail-on` takes `would_hold`, `new_high_reach`, `coverage_drop` (exit 4). The Markdown also goes to the Actions run summary. A complete workflow is in `docs/ci/interlok-shadow.yml`.
+
+## proxy: put any MCP server behind Interlok, no code
+
+In your MCP client config (Claude Desktop, Cursor, VS Code, your own agent), wrap the server's command:
+
+```json
+{
+  "mcpServers": {
+    "github": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@interlok/cli",
+        "proxy",
+        "--name",
+        "github",
+        "--agent",
+        "support-bot",
+        "--",
+        "npx",
+        "-y",
+        "@modelcontextprotocol/server-github"
+      ],
+      "env": { "INTERLOK_API_KEY": "ilk_live_…", "GITHUB_PERSONAL_ACCESS_TOKEN": "…" }
+    }
+  }
+}
+```
+
+For a remote server, run `npx @interlok/cli proxy --name crm --upstream https://mcp.example.com/mcp --port 8787` and point the client at `http://127.0.0.1:8787/mcp`. Cloud agent builders (Copilot Studio, Agentforce, AgentCore Gateway) cannot reach loopback: run the proxy behind your HTTPS ingress, add `--host 0.0.0.0` inside a container, and register the ingress URL as the MCP server. The client's own credentials still go to your server; the proxy adds none and forwards none of Interlok's.
+
+- **Gate (default):** every `tools/call` is asked of the gate first. Allowed calls run; a held call waits for a person (up to `--wait`, default 300 s) and runs only if released; a denied call never reaches the server and the model gets the reason. If Interlok can't be reached the call is refused unless you pass `--fail-open`.
+- **Shadow:** under `interlok shadow -- <your test command>` (or with `--shadow <run>`), every call is recorded into the run and forwarded; nothing is blocked.
+- Everything else (initialize, tools/list, resources, pings) passes through untouched. The server's tool list is registered once so description changes show up as drift.
+- Your Interlok key is never passed to the MCP server, and the proxy writes only protocol messages to stdout.
+
+## hook: hold a coding agent's risky commands for a person
+
+For Claude Code, Codex, Cursor, Gemini CLI and GitHub Copilot (the Copilot CLI, the Copilot cloud
+agent and VS Code), including inside Paradev and Conductor workspaces. Each shell
+command and MCP call is checked locally against `.interlok/policy.json`; only a match leaves the
+machine, as an approval a named person answers.
+
+```bash
+npm i -g @interlok/cli
+interlok hook init [--agent claude,codex,cursor,gemini,copilot] [--npx]
+export INTERLOK_API_KEY=ilk_...              # approvals:write scope
+interlok hook test "vercel deploy --prod"    # which rule would hold it, without running anything
+```
+
+`init` writes the policy file (built-in rules: protected-branch and force pushes, PR merges,
+production deploys, infrastructure applies, migrations and destructive SQL, publishes, secret
+changes, deletes outside the project, MCP tools that change something) and merges the hook into
+`.claude/settings.json`, `.codex/hooks.json`, `.cursor/hooks.json`, `.gemini/settings.json` and
+`.github/hooks/interlok.json` without touching what is there. Add rules with `id`, `match` (regex on the command line), optional `tool`, `unless` and
+`approvers`; set `"defaults": false` to use only your own.
+
+- Approvals are single-use: the same command later asks again.
+- Still held after `wait` seconds: the agent is told to continue other work and retry the exact
+  command; the retry resolves the same request instead of opening a new one.
+- Fails closed with no key, no connection or an unreadable policy; `--fail-open` relaxes only an
+  unreachable Interlok.
+- Credentials in a command line are masked before anyone sees it; `"summary": "hash-only"` sends
+  only the rule and a hash.
+- Gemini CLI and Copilot let a call run when a hook times out, so every config gives the hook 120
+  seconds and the wait for a person is capped at 100.
+- Copilot: commit `.github/hooks/interlok.json` (the cloud agent reads only that folder) and put
+  `INTERLOK_API_KEY` in the repository's `copilot` environment secrets. Copilot also runs the hooks
+  in `.claude/settings.json`; with both files present, the Claude entry steps aside for Copilot so
+  one command opens one request.
+
+## approvals-mcp: let any MCP agent ask a person first
+
+One tool, `request_human_approval`, for agents that should check with a person before they act. No gateway and no policy: the request always waits, a named person approves or denies it in the Interlok console, and the agent gets the answer with a signed receipt. Only `approved` means go ahead; anything else, including Interlok being unreachable, tells the agent not to act.
+
+```json
+{
+  "mcpServers": {
+    "interlok-approvals": {
+      "command": "npx",
+      "args": ["-y", "@interlok/cli", "approvals-mcp", "--agent", "support-bot"],
+      "env": { "INTERLOK_API_KEY": "ilk_live_…" }
+    }
+  }
+}
+```
+
+- The `payload` argument is hashed on your machine; only its SHA-256 reaches Interlok.
+- `--wait <seconds>` (default 120) is how long the tool waits for a person before answering "still waiting".
+- The key needs the `approvals:write` and `approvals:read` scopes. A key can ask; it can never answer.
+
+## gate: hold a risky deploy for a person
+
+```yaml
+jobs:
+  gate:
+    permissions: { id-token: write, contents: read }
+    steps:
+      - uses: actions/checkout@v4
+        with: { fetch-depth: 0 }
+      - run: terraform show -json tfplan > plan.json # optional
+      - run: npx @interlok/cli gate --action deploy --env production --plan plan.json --wait 60m
+        env: { INTERLOK_CONNECTOR: <connector id from Console → Settings → Connectors> }
+  deploy:
+    needs: gate
+    steps:
+      # ... deploy ...
+      - if: always()
+        run: npx @interlok/cli gate report --status ${{ job.status }}
+```
+
+CI authenticates with its OIDC token; nothing is stored. The plan is summarized locally and only the summary and its hash are sent. Low-risk changes pass in seconds; a held change waits for a person in Slack or the console. `--emergency --reason "..."` is break-glass, allowed only for people on the connector's emergency list and never for agent- or bot-authored changes; a second person reviews within 24 h. Protect the workflow file itself (CODEOWNERS and branch protection): a CI gate is only as strong as the workflow that calls it. Exit codes: 0 allowed or released · 10 denied · 11 hold expired · 12 Interlok unreachable (fails closed unless `--fail-open`) · 13 config or auth error.
+
+### Model promotions
+
+The same step holds a production model change for a person: a provider swap, new weights, a floating alias (`latest`, `preview`), a failed or missing eval, or a model that serves governed data.
+
+```bash
+npx @interlok/cli gate --action model.promote --env production \
+  --provider-from openai --provider-to aws.bedrock \
+  --model-from gpt-4.1-2025-04-14 --model-to anthropic.claude-sonnet-4-5-20250929-v1:0 \
+  --model-change provider,model --eval-suite regression-v3 --eval-passed true \
+  --classification cui
+```
+
+`--model-change` takes any of `model, provider, weights, fine_tune, quantization, prompt_template, decoding, alias`. `--digest-from/--digest-to` take the sha256 of weights or an image when your platform can state one.
+
+## verify: offline, no account
+
+```bash
+npx @interlok/cli verify interlok-shadow-<run>.json
+```
+
+Checks every signature and that the events, coverage, and run diff are exactly what was signed. Public reports (`/r/<slug>`) verify the same way.
+
+Exit codes: 1 error · 2 critical finding · 3 verification failed · 4 `--fail-on` tripped · 5 below `--min-coverage`.

package/dist/approvals-mcp.d.ts

@@ -0,0 +1,83 @@
+/**
+ * `interlok approvals-mcp`: an MCP server with one tool, `request_human_approval`. Any MCP agent
+ * (Claude, Cursor, Copilot, your own) can ask a named person before it does something it should
+ * not do alone. The request waits in the Interlok console approvals queue (or a connected channel); only a
+ * person can answer it, and the answer comes back with a signed receipt.
+ *
+ *   { "mcpServers": { "interlok-approvals": { "command": "npx",
+ *       "args": ["-y", "@interlok/cli", "approvals-mcp"],
+ *       "env": { "INTERLOK_API_KEY": "ilk_..." } } } }
+ *
+ * The payload is hashed here and never sent. Protocol messages go to stdout; everything else to
+ * stderr. Nothing in this file can approve: the API refuses determinations from a key.
+ */
+export declare const TOOL: {
+    readonly name: "request_human_approval";
+    readonly description: "Ask a named person to approve an action before you take it. Use this before anything irreversible or consequential: paying, refunding, deleting, deploying, emailing customers, changing permissions. Wait for the answer and act only if it is approved.";
+    readonly inputSchema: {
+        readonly type: "object";
+        readonly properties: {
+            readonly action: {
+                readonly type: "string";
+                readonly description: "Short machine name of what you want to do, e.g. refund.issue or db.drop_table.";
+            };
+            readonly summary: {
+                readonly type: "string";
+                readonly description: "One or two sentences the approver reads: what, to whom, how much, and why.";
+            };
+            readonly payload: {
+                readonly description: "The exact request you will send if approved. Only its SHA-256 leaves this machine.";
+            };
+            readonly context: {
+                readonly type: "object";
+                readonly description: "Up to 20 short fields shown to the approver (strings, numbers, booleans).";
+                readonly additionalProperties: {
+                    readonly type: readonly ["string", "number", "boolean"];
+                };
+            };
+        };
+        readonly required: readonly ["action", "summary"];
+    };
+};
+export interface McpConfig {
+    api: string;
+    key: string;
+    agent: string;
+    /** How long to wait for a person before answering "still waiting". */
+    waitSeconds: number;
+    fetch?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    log?: (line: string) => void;
+}
+type Msg = {
+    jsonrpc: "2.0";
+    id?: string | number | null;
+    method?: string;
+    params?: any;
+};
+export declare const payloadHash: (payload: unknown) => string;
+/** What the model reads for each outcome. Only "approved" means go ahead. */
+export declare function describe(a: {
+    status: string;
+    hold?: {
+        tag_number?: string | null;
+    };
+    determinations?: {
+        by: string;
+        note: string | null;
+    }[];
+    receipt?: {
+        entries?: {
+            seq: number;
+            entry_hash: string;
+        }[];
+    };
+    console_url?: string;
+}): {
+    text: string;
+    isError: boolean;
+};
+/** Handle one JSON-RPC message. Returns the reply, or null for notifications. */
+export declare function handle(m: Msg, cfg: McpConfig): Promise<object | null>;
+export declare function approvalsMcpCommand(value: (flag: string) => string | undefined): Promise<void>;
+export {};

package/dist/approvals-mcp.js

@@ -0,0 +1,185 @@
+import { createHash } from "node:crypto";
+import { createInterface } from "node:readline";
+import { canonical } from "./canonical.js";
+/**
+ * `interlok approvals-mcp`: an MCP server with one tool, `request_human_approval`. Any MCP agent
+ * (Claude, Cursor, Copilot, your own) can ask a named person before it does something it should
+ * not do alone. The request waits in the Interlok console approvals queue (or a connected channel); only a
+ * person can answer it, and the answer comes back with a signed receipt.
+ *
+ *   { "mcpServers": { "interlok-approvals": { "command": "npx",
+ *       "args": ["-y", "@interlok/cli", "approvals-mcp"],
+ *       "env": { "INTERLOK_API_KEY": "ilk_..." } } } }
+ *
+ * The payload is hashed here and never sent. Protocol messages go to stdout; everything else to
+ * stderr. Nothing in this file can approve: the API refuses determinations from a key.
+ */
+export const TOOL = {
+    name: "request_human_approval",
+    description: "Ask a named person to approve an action before you take it. Use this before anything irreversible or consequential: paying, refunding, deleting, deploying, emailing customers, changing permissions. Wait for the answer and act only if it is approved.",
+    inputSchema: {
+        type: "object",
+        properties: {
+            action: {
+                type: "string",
+                description: "Short machine name of what you want to do, e.g. refund.issue or db.drop_table.",
+            },
+            summary: {
+                type: "string",
+                description: "One or two sentences the approver reads: what, to whom, how much, and why.",
+            },
+            payload: {
+                description: "The exact request you will send if approved. Only its SHA-256 leaves this machine.",
+            },
+            context: {
+                type: "object",
+                description: "Up to 20 short fields shown to the approver (strings, numbers, booleans).",
+                additionalProperties: { type: ["string", "number", "boolean"] },
+            },
+        },
+        required: ["action", "summary"],
+    },
+};
+export const payloadHash = (payload) => createHash("sha256").update(canonical(payload)).digest("hex");
+const text = (id, t, isError = false) => ({
+    jsonrpc: "2.0",
+    id,
+    result: { ...(isError ? { isError: true } : {}), content: [{ type: "text", text: t }] },
+});
+/** What the model reads for each outcome. Only "approved" means go ahead. */
+export function describe(a) {
+    const tag = a.hold?.tag_number ? ` (tag ${a.hold.tag_number})` : "";
+    const who = (a.determinations ?? []).map((d) => d.by).join(", ");
+    const note = (a.determinations ?? []).find((d) => d.note)?.note;
+    const last = a.receipt?.entries?.at(-1);
+    const receipt = last ? ` Signed receipt: ledger entry #${last.seq} (${last.entry_hash}).` : "";
+    switch (a.status) {
+        case "approved":
+            return {
+                text: `APPROVED by ${who || "a person"}${tag}. You may proceed with exactly this request.${note ? ` Note: ${note}` : ""}${receipt}`,
+                isError: false,
+            };
+        case "denied":
+            return {
+                text: `DENIED by ${who || "a person"}${tag}. Do not take this action.${note ? ` Reason: ${note}` : ""}${receipt}`,
+                isError: true,
+            };
+        case "expired":
+        case "cancelled":
+            return {
+                text: `No approval${tag}: the request ${a.status}. Do not take this action.`,
+                isError: true,
+            };
+        default:
+            return {
+                text: `Still waiting for a person${tag}. Do not take this action yet.${a.console_url ? ` Approvers decide at ${a.console_url}.` : ""}`,
+                isError: true,
+            };
+    }
+}
+async function call(cfg, path, init = {}) {
+    const r = await (cfg.fetch ?? fetch)(`${cfg.api}${path}`, {
+        ...init,
+        headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${cfg.key}`,
+            ...(init.headers ?? {}),
+        },
+        signal: AbortSignal.timeout(30_000),
+    });
+    const body = await r.json().catch(() => ({}));
+    if (!r.ok)
+        throw new Error(`Interlok ${r.status}: ${body?.error ?? "request failed"}`);
+    return body;
+}
+/** Handle one JSON-RPC message. Returns the reply, or null for notifications. */
+export async function handle(m, cfg) {
+    if (m.id === undefined || m.id === null)
+        return null; // notifications need no answer
+    switch (m.method) {
+        case "initialize":
+            return {
+                jsonrpc: "2.0",
+                id: m.id,
+                result: {
+                    protocolVersion: m.params?.protocolVersion ?? "2025-06-18",
+                    capabilities: { tools: {} },
+                    serverInfo: { name: "interlok-approvals", version: "1.0.0" },
+                },
+            };
+        case "ping":
+            return { jsonrpc: "2.0", id: m.id, result: {} };
+        case "tools/list":
+            return { jsonrpc: "2.0", id: m.id, result: { tools: [TOOL] } };
+        case "tools/call": {
+            if (m.params?.name !== TOOL.name)
+                return text(m.id, `Unknown tool ${m.params?.name}`, true);
+            const a = m.params?.arguments ?? {};
+            if (typeof a.action !== "string" || typeof a.summary !== "string")
+                return text(m.id, "request_human_approval needs an action and a summary.", true);
+            try {
+                const created = await call(cfg, "/api/v1/approvals", {
+                    method: "POST",
+                    body: JSON.stringify({
+                        action: a.action,
+                        summary: a.summary,
+                        payload_hash: a.payload !== undefined ? payloadHash(a.payload) : undefined,
+                        context: a.context,
+                        agent: { name: cfg.agent },
+                    }),
+                });
+                let current = created;
+                const sleep = cfg.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+                const deadline = Date.now() + cfg.waitSeconds * 1000;
+                while (current.status === "held" && Date.now() < deadline) {
+                    await sleep(2000);
+                    current = await call(cfg, `/api/v1/approvals/${encodeURIComponent(created.id)}`);
+                }
+                const d = describe(current);
+                return text(m.id, d.text, d.isError);
+            }
+            catch (e) {
+                cfg.log?.(`approval request failed: ${e.message}`);
+                // Fail closed: without an answer from a person, the action does not happen.
+                return text(m.id, `Could not reach Interlok (${e.message}). No approval: do not take this action.`, true);
+            }
+        }
+        default:
+            return {
+                jsonrpc: "2.0",
+                id: m.id,
+                error: { code: -32601, message: `Unknown method ${m.method}` },
+            };
+    }
+}
+export async function approvalsMcpCommand(value) {
+    const cfg = {
+        api: (value("--api") ?? process.env.INTERLOK_URL ?? "https://interlok.io").replace(/\/$/, ""),
+        key: process.env.INTERLOK_API_KEY ?? "",
+        agent: value("--agent") ?? process.env.INTERLOK_AGENT ?? "mcp-agent",
+        waitSeconds: Number(value("--wait") ?? 120),
+        log: (l) => process.stderr.write(`[interlok] ${l}\n`),
+    };
+    if (!cfg.key) {
+        process.stderr.write("interlok approvals-mcp needs INTERLOK_API_KEY (approvals:write scope)\n");
+        process.exitCode = 1;
+        return;
+    }
+    const rl = createInterface({ input: process.stdin });
+    for await (const line of rl) {
+        if (!line.trim())
+            continue;
+        let m;
+        try {
+            m = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        // Each message on its own: a request waiting on a person never blocks pings or other calls.
+        void handle(m, cfg).then((reply) => {
+            if (reply)
+                process.stdout.write(JSON.stringify(reply) + "\n");
+        });
+    }
+}

package/dist/canonical.d.ts

@@ -0,0 +1 @@
+export declare function canonical(value: unknown): string;

package/dist/canonical.js

@@ -0,0 +1,20 @@
+export function canonical(value) {
+    if (value === null || typeof value === "boolean" || typeof value === "string")
+        return JSON.stringify(value);
+    if (typeof value === "number") {
+        if (!Number.isFinite(value))
+            throw new Error("non-finite number");
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(",")}]`;
+    if (typeof value === "object") {
+        const o = value;
+        return `{${Object.keys(o)
+            .filter((k) => o[k] !== undefined)
+            .sort()
+            .map((k) => `${JSON.stringify(k)}:${canonical(o[k])}`)
+            .join(",")}}`;
+    }
+    throw new Error(`unsupported type ${typeof value}`);
+}

package/dist/classify.d.ts

@@ -0,0 +1,107 @@
+/**
+ * Tool risk classifier and coverage math.
+ *
+ * Deterministic on purpose, like the posture score: the same tool must classify the same way on
+ * every machine, in the console, in CI, and in the gate. No model, no network, no clock.
+ *
+ * This file imports nothing. The public CLI vendors it byte-for-byte (cli/src/classify.ts) and a
+ * test fails the build if the two copies drift, so a CI coverage number and a console coverage
+ * number can never disagree about the same inventory.
+ *
+ * Precedence, highest first:
+ *   1. A human declaration (recorded in the ledger) wins outright.
+ *   2. The registry's write_path, when the tool is registered.
+ *   3. The higher of annotation risk and name/schema heuristics. MCP annotations come from the
+ *      server and are untrusted, so they can raise risk but never lower it.
+ *   4. A tool whose name matches neither a read nor a write verb fails closed: it is treated as a
+ *      high-risk write path and counted as unclassified until someone declares it.
+ */
+export declare const CLASSIFIER_VERSION = "1.0.0";
+export type RiskTier = "low" | "medium" | "high" | "critical";
+export type Reversibility = "reversible" | "compensable" | "irreversible" | "unknown";
+export type SideEffect = "payment" | "access_grant" | "destructive" | "code_exec" | "deploy" | "outbound_msg" | "external_write" | "data_write";
+export type DataClass = "financial" | "pii" | "secrets" | "prod_data" | "comms";
+export type ProfileSource = "declared" | "registry" | "annotation" | "heuristic" | "unknown";
+/** The MCP tool annotations (spec 2025-03-26+). Hints from the server, never trusted to lower risk. */
+export interface ToolAnnotations {
+    title?: string;
+    readOnlyHint?: boolean;
+    destructiveHint?: boolean;
+    idempotentHint?: boolean;
+    openWorldHint?: boolean;
+}
+export interface ToolDescriptor {
+    name: string;
+    description?: string | null;
+    input_schema?: unknown;
+    annotations?: ToolAnnotations | null;
+    /** Registry value. Present when the tool was registered against a connection. */
+    write_path?: boolean | null;
+}
+/** What a person can pin for a tool. Every field optional; anything set beats the heuristics. */
+export interface DeclaredProfile {
+    write_path?: boolean;
+    risk_tier?: RiskTier;
+    reversibility?: Reversibility;
+    data_classes?: DataClass[];
+    side_effects?: SideEffect[];
+}
+export interface ToolProfile {
+    tool: string;
+    write_path: boolean;
+    risk_tier: RiskTier;
+    reversibility: Reversibility;
+    data_classes: DataClass[];
+    side_effects: SideEffect[];
+    source: ProfileSource;
+    /** True when no verb matched and the profile is a fail-closed default. */
+    unclassified: boolean;
+    /** Human-readable reasons, in the order they were applied. */
+    basis: string[];
+    classifier_version: string;
+}
+export declare const tierRank: (t: RiskTier) => number;
+export declare const maxTier: (a: RiskTier, b: RiskTier) => RiskTier;
+export declare const atLeast: (t: RiskTier, floor: RiskTier) => boolean;
+/** The verb part of a namespaced or dotted tool name: `github/create_release` → `create_release`. */
+export declare function bareToolName(tool: string): string;
+export declare function classifyTool(t: ToolDescriptor, declared?: DeclaredProfile | null): ToolProfile;
+export type CoverageRung = "guarded" | "exercised" | "governed" | "enforced";
+export interface CoverageItem {
+    /** `server/tool` or `connection/tool`. */
+    key: string;
+    profile: ToolProfile;
+    guarded?: boolean;
+    exercised?: boolean;
+    governed?: boolean;
+    enforced?: boolean;
+}
+export interface CoverageRungResult {
+    covered: number;
+    total: number;
+    /** null when there is nothing to cover: no high-risk write paths at all. */
+    pct: number | null;
+}
+export interface CoveragePath {
+    key: string;
+    risk_tier: RiskTier;
+    unclassified: boolean;
+    guarded?: boolean;
+    exercised?: boolean;
+    governed?: boolean;
+    enforced?: boolean;
+}
+export interface Coverage {
+    classifier_version: string;
+    threshold: RiskTier;
+    /** High-consequence write paths: the denominator for every rung. */
+    high_risk_write_paths: number;
+    /** How many of those are fail-closed defaults nobody has classified yet. */
+    unclassified: number;
+    rungs: Partial<Record<CoverageRung, CoverageRungResult>>;
+    /** The paths themselves, sorted by key so the list is stable. */
+    paths: CoveragePath[];
+}
+export declare function computeCoverage(items: CoverageItem[], threshold?: RiskTier): Coverage;
+/** One line a person can read: "guarded 3/8 (38%) · 2 unclassified". */
+export declare function coverageLine(c: Coverage, rung?: CoverageRung): string;