@intutic/shared-types 2.4.0 → 2.5.1

package/dist/chaos.d.ts

@@ -0,0 +1,2225 @@
+/**
+ * chaos.ts — the contract for agent fault injection (`intutic chaos run`).
+ *
+ * A chaos run executes an agent with a known fault injected and checks what
+ * the agent did next. Four components share this contract:
+ *
+ * - the CLI runner, which reads an experiment file, launches each repetition
+ *   in a sandbox and scores the result;
+ * - the LLM proxy, which injects the `llm.*` and `egress.*` faults;
+ * - the MCP proxy, which injects the MCP side of `tool.error` plus
+ *   `tool.stale_data`, `mcp.toolset_change` and `inject.tool_result`;
+ * - the gates — the hook gates and the in-process gate SDKs — which inject
+ *   `permission.deny_or_delay` and the built-in-tool side of `tool.error`.
+ *
+ * The runner hands each component a plan through {@link CHAOS_PLAN_ENV} and an
+ * events file through {@link CHAOS_EVENTS_ENV}. Both are plain environment
+ * variables, so they cross the sandbox boundary the same way the proxy URL
+ * does. Each component appends one JSON line per event to the events file;
+ * the probes read nothing else.
+ *
+ * Two rules every injector keeps:
+ *
+ * 1. **A fault never loosens governance.** Faults are applied only to a call
+ *    that governance has already allowed. A fault can turn an allow into a
+ *    failure, a delay or a changed result; it can never turn a block, a hold
+ *    or a redaction into an allow.
+ * 2. **Silence is not success.** A component that loads a plan reports
+ *    `plan_loaded`, so the runner can tell "the fault fired and the agent
+ *    coped" from "the component never saw the plan".
+ *
+ * The Rust proxy decodes the same plan with serde; its tests read the fixture
+ * at `src/__tests__/fixtures/chaos-plan.json`, which this module's tests also
+ * validate, so the two decoders cannot drift apart.
+ *
+ * @module
+ */
+import { z } from 'zod';
+/** Environment variable carrying the plan: base64url-encoded JSON {@link ChaosPlan}. */
+export declare const CHAOS_PLAN_ENV = "INTUTIC_CHAOS_PLAN";
+/** Environment variable carrying the path of the append-only JSONL events file. */
+export declare const CHAOS_EVENTS_ENV = "INTUTIC_CHAOS_EVENTS";
+/** Wire version of {@link ChaosPlan}. A component refuses any other version. */
+export declare const CHAOS_PLAN_VERSION = 1;
+/** Every fault the catalog knows, by id. */
+export declare const FAULT_IDS: readonly ["llm.rate_limit", "llm.upstream_5xx", "llm.context_trim", "llm.model_degrade", "tool.error", "tool.stale_data", "mcp.toolset_change", "permission.deny_or_delay", "inject.tool_result", "egress.dns_fail", "egress.credential_401"];
+export type FaultId = (typeof FAULT_IDS)[number];
+/** The components that inject faults or report events. */
+export type ChaosComponent = 'runner' | 'proxy' | 'mcp-proxy' | 'gate';
+/**
+ * Whether a fault is safe outside a sandbox. Fail-safe faults deny, delay or
+ * error; mutating faults change what the agent sees and run only in a sandbox.
+ */
+export type FaultSafety = 'fail_safe' | 'mutating';
+/** Which component injects each fault, and its safety class. */
+export declare const FAULT_CATALOG: Readonly<Record<FaultId, {
+    injectedBy: readonly ChaosComponent[];
+    safety: FaultSafety;
+}>>;
+/**
+ * Which calls a fault applies to. Every field present must match; an absent
+ * field matches anything. `tool` and `host` match exactly, or by suffix when
+ * they start with `*` (`*.npmjs.org`). `model` matches the requested model id.
+ */
+declare const MatchSchema: z.ZodObject<{
+    tool: z.ZodOptional<z.ZodString>;
+    host: z.ZodOptional<z.ZodString>;
+    model: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    tool?: string | undefined;
+    host?: string | undefined;
+    model?: string | undefined;
+}, {
+    tool?: string | undefined;
+    host?: string | undefined;
+    model?: string | undefined;
+}>;
+export type FaultMatch = z.infer<typeof MatchSchema>;
+export declare const FaultSchema: z.ZodDiscriminatedUnion<"id", [z.ZodObject<{
+    retry_after_s: z.ZodDefault<z.ZodNumber>;
+    match: z.ZodOptional<z.ZodObject<{
+        tool: z.ZodOptional<z.ZodString>;
+        host: z.ZodOptional<z.ZodString>;
+        model: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    }, {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    }>>;
+    /** Skip this many matching calls before the first injection. */
+    after_calls: z.ZodDefault<z.ZodNumber>;
+    /** Inject at most this many times; absent means every matching call. */
+    times: z.ZodOptional<z.ZodNumber>;
+    id: z.ZodLiteral<"llm.rate_limit">;
+}, "strict", z.ZodTypeAny, {
+    id: "llm.rate_limit";
+    retry_after_s: number;
+    after_calls: number;
+    match?: {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    } | undefined;
+    times?: number | undefined;
+}, {
+    id: "llm.rate_limit";
+    retry_after_s?: number | undefined;
+    match?: {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    } | undefined;
+    after_calls?: number | undefined;
+    times?: number | undefined;
+}>, z.ZodObject<{
+    status: z.ZodDefault<z.ZodUnion<[z.ZodLiteral<500>, z.ZodLiteral<502>, z.ZodLiteral<503>, z.ZodLiteral<529>]>>;
+    /** Cut a streamed response after this many chunks instead of failing the request. */
+    stream_cut_after_chunks: z.ZodOptional<z.ZodNumber>;
+    match: z.ZodOptional<z.ZodObject<{
+        tool: z.ZodOptional<z.ZodString>;
+        host: z.ZodOptional<z.ZodString>;
+        model: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    }, {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    }>>;
+    /** Skip this many matching calls before the first injection. */
+    after_calls: z.ZodDefault<z.ZodNumber>;
+    /** Inject at most this many times; absent means every matching call. */
+    times: z.ZodOptional<z.ZodNumber>;
+    id: z.ZodLiteral<"llm.upstream_5xx">;
+}, "strict", z.ZodTypeAny, {
+    status: 500 | 502 | 503 | 529;
+    id: "llm.upstream_5xx";
+    after_calls: number;
+    match?: {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    } | undefined;
+    times?: number | undefined;
+    stream_cut_after_chunks?: number | undefined;
+}, {
+    id: "llm.upstream_5xx";
+    status?: 500 | 502 | 503 | 529 | undefined;
+    match?: {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    } | undefined;
+    after_calls?: number | undefined;
+    times?: number | undefined;
+    stream_cut_after_chunks?: number | undefined;
+}>, z.ZodObject<{
+    drop_oldest: z.ZodDefault<z.ZodNumber>;
+    drop_system: z.ZodDefault<z.ZodBoolean>;
+    match: z.ZodOptional<z.ZodObject<{
+        tool: z.ZodOptional<z.ZodString>;
+        host: z.ZodOptional<z.ZodString>;
+        model: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    }, {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    }>>;
+    /** Skip this many matching calls before the first injection. */
+    after_calls: z.ZodDefault<z.ZodNumber>;
+    /** Inject at most this many times; absent means every matching call. */
+    times: z.ZodOptional<z.ZodNumber>;
+    id: z.ZodLiteral<"llm.context_trim">;
+}, "strict", z.ZodTypeAny, {
+    id: "llm.context_trim";
+    after_calls: number;
+    drop_oldest: number;
+    drop_system: boolean;
+    match?: {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    } | undefined;
+    times?: number | undefined;
+}, {
+    id: "llm.context_trim";
+    match?: {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    } | undefined;
+    after_calls?: number | undefined;
+    times?: number | undefined;
+    drop_oldest?: number | undefined;
+    drop_system?: boolean | undefined;
+}>, z.ZodObject<{
+    to_model: z.ZodString;
+    match: z.ZodOptional<z.ZodObject<{
+        tool: z.ZodOptional<z.ZodString>;
+        host: z.ZodOptional<z.ZodString>;
+        model: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    }, {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    }>>;
+    /** Skip this many matching calls before the first injection. */
+    after_calls: z.ZodDefault<z.ZodNumber>;
+    /** Inject at most this many times; absent means every matching call. */
+    times: z.ZodOptional<z.ZodNumber>;
+    id: z.ZodLiteral<"llm.model_degrade">;
+}, "strict", z.ZodTypeAny, {
+    id: "llm.model_degrade";
+    after_calls: number;
+    to_model: string;
+    match?: {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    } | undefined;
+    times?: number | undefined;
+}, {
+    id: "llm.model_degrade";
+    to_model: string;
+    match?: {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    } | undefined;
+    after_calls?: number | undefined;
+    times?: number | undefined;
+}>, z.ZodObject<{
+    message: z.ZodDefault<z.ZodString>;
+    match: z.ZodOptional<z.ZodObject<{
+        tool: z.ZodOptional<z.ZodString>;
+        host: z.ZodOptional<z.ZodString>;
+        model: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    }, {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    }>>;
+    /** Skip this many matching calls before the first injection. */
+    after_calls: z.ZodDefault<z.ZodNumber>;
+    /** Inject at most this many times; absent means every matching call. */
+    times: z.ZodOptional<z.ZodNumber>;
+    id: z.ZodLiteral<"tool.error">;
+}, "strict", z.ZodTypeAny, {
+    message: string;
+    id: "tool.error";
+    after_calls: number;
+    match?: {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    } | undefined;
+    times?: number | undefined;
+}, {
+    id: "tool.error";
+    message?: string | undefined;
+    match?: {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    } | undefined;
+    after_calls?: number | undefined;
+    times?: number | undefined;
+}>, z.ZodObject<{
+    result: z.ZodString;
+    match: z.ZodOptional<z.ZodObject<{
+        tool: z.ZodOptional<z.ZodString>;
+        host: z.ZodOptional<z.ZodString>;
+        model: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    }, {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    }>>;
+    /** Skip this many matching calls before the first injection. */
+    after_calls: z.ZodDefault<z.ZodNumber>;
+    /** Inject at most this many times; absent means every matching call. */
+    times: z.ZodOptional<z.ZodNumber>;
+    id: z.ZodLiteral<"tool.stale_data">;
+}, "strict", z.ZodTypeAny, {
+    id: "tool.stale_data";
+    after_calls: number;
+    result: string;
+    match?: {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    } | undefined;
+    times?: number | undefined;
+}, {
+    id: "tool.stale_data";
+    result: string;
+    match?: {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    } | undefined;
+    after_calls?: number | undefined;
+    times?: number | undefined;
+}>, z.ZodObject<{
+    remove: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Tool name → the description it is redefined with. */
+    redefine: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    match: z.ZodOptional<z.ZodObject<{
+        tool: z.ZodOptional<z.ZodString>;
+        host: z.ZodOptional<z.ZodString>;
+        model: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    }, {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    }>>;
+    /** Skip this many matching calls before the first injection. */
+    after_calls: z.ZodDefault<z.ZodNumber>;
+    /** Inject at most this many times; absent means every matching call. */
+    times: z.ZodOptional<z.ZodNumber>;
+    id: z.ZodLiteral<"mcp.toolset_change">;
+}, "strict", z.ZodTypeAny, {
+    id: "mcp.toolset_change";
+    after_calls: number;
+    remove: string[];
+    redefine: Record<string, string>;
+    match?: {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    } | undefined;
+    times?: number | undefined;
+}, {
+    id: "mcp.toolset_change";
+    match?: {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    } | undefined;
+    after_calls?: number | undefined;
+    times?: number | undefined;
+    remove?: string[] | undefined;
+    redefine?: Record<string, string> | undefined;
+}>, z.ZodObject<{
+    mode: z.ZodDefault<z.ZodEnum<["deny", "delay", "hold_then_deny"]>>;
+    /**
+     * `delay` and `hold_then_deny`: how long a held call stays held. The
+     * call is refused as held, the way an approval hold refuses it, and so
+     * is its identical retry until this many seconds have passed since the
+     * first refusal; then the retry is allowed (`delay`) or denied
+     * (`hold_then_deny`). Nothing waits: 0 holds the call once and allows
+     * (or denies) the first retry.
+     */
+    delay_s: z.ZodDefault<z.ZodNumber>;
+    match: z.ZodOptional<z.ZodObject<{
+        tool: z.ZodOptional<z.ZodString>;
+        host: z.ZodOptional<z.ZodString>;
+        model: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    }, {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    }>>;
+    /** Skip this many matching calls before the first injection. */
+    after_calls: z.ZodDefault<z.ZodNumber>;
+    /** Inject at most this many times; absent means every matching call. */
+    times: z.ZodOptional<z.ZodNumber>;
+    id: z.ZodLiteral<"permission.deny_or_delay">;
+}, "strict", z.ZodTypeAny, {
+    id: "permission.deny_or_delay";
+    after_calls: number;
+    mode: "deny" | "delay" | "hold_then_deny";
+    delay_s: number;
+    match?: {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    } | undefined;
+    times?: number | undefined;
+}, {
+    id: "permission.deny_or_delay";
+    match?: {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    } | undefined;
+    after_calls?: number | undefined;
+    times?: number | undefined;
+    mode?: "deny" | "delay" | "hold_then_deny" | undefined;
+    delay_s?: number | undefined;
+}>, z.ZodObject<{
+    payload: z.ZodString;
+    match: z.ZodOptional<z.ZodObject<{
+        tool: z.ZodOptional<z.ZodString>;
+        host: z.ZodOptional<z.ZodString>;
+        model: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    }, {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    }>>;
+    /** Skip this many matching calls before the first injection. */
+    after_calls: z.ZodDefault<z.ZodNumber>;
+    /** Inject at most this many times; absent means every matching call. */
+    times: z.ZodOptional<z.ZodNumber>;
+    id: z.ZodLiteral<"inject.tool_result">;
+}, "strict", z.ZodTypeAny, {
+    id: "inject.tool_result";
+    after_calls: number;
+    payload: string;
+    match?: {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    } | undefined;
+    times?: number | undefined;
+}, {
+    id: "inject.tool_result";
+    payload: string;
+    match?: {
+        tool?: string | undefined;
+        host?: string | undefined;
+        model?: string | undefined;
+    } | undefined;
+    after_calls?: number | undefined;
+    times?: number | undefined;
+}>, z.ZodObject<{
+    match: z.ZodObject<{
+        tool: z.ZodOptional<z.ZodString>;
+        model: z.ZodOptional<z.ZodString>;
+    } & {
+        host: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        host: string;
+        tool?: string | undefined;
+        model?: string | undefined;
+    }, {
+        host: string;
+        tool?: string | undefined;
+        model?: string | undefined;
+    }>;
+    /** Skip this many matching calls before the first injection. */
+    after_calls: z.ZodDefault<z.ZodNumber>;
+    /** Inject at most this many times; absent means every matching call. */
+    times: z.ZodOptional<z.ZodNumber>;
+    id: z.ZodLiteral<"egress.dns_fail">;
+}, "strict", z.ZodTypeAny, {
+    id: "egress.dns_fail";
+    match: {
+        host: string;
+        tool?: string | undefined;
+        model?: string | undefined;
+    };
+    after_calls: number;
+    times?: number | undefined;
+}, {
+    id: "egress.dns_fail";
+    match: {
+        host: string;
+        tool?: string | undefined;
+        model?: string | undefined;
+    };
+    after_calls?: number | undefined;
+    times?: number | undefined;
+}>, z.ZodObject<{
+    match: z.ZodObject<{
+        tool: z.ZodOptional<z.ZodString>;
+        model: z.ZodOptional<z.ZodString>;
+    } & {
+        host: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        host: string;
+        tool?: string | undefined;
+        model?: string | undefined;
+    }, {
+        host: string;
+        tool?: string | undefined;
+        model?: string | undefined;
+    }>;
+    /** Skip this many matching calls before the first injection. */
+    after_calls: z.ZodDefault<z.ZodNumber>;
+    /** Inject at most this many times; absent means every matching call. */
+    times: z.ZodOptional<z.ZodNumber>;
+    id: z.ZodLiteral<"egress.credential_401">;
+}, "strict", z.ZodTypeAny, {
+    id: "egress.credential_401";
+    match: {
+        host: string;
+        tool?: string | undefined;
+        model?: string | undefined;
+    };
+    after_calls: number;
+    times?: number | undefined;
+}, {
+    id: "egress.credential_401";
+    match: {
+        host: string;
+        tool?: string | undefined;
+        model?: string | undefined;
+    };
+    after_calls?: number | undefined;
+    times?: number | undefined;
+}>]>;
+export type Fault = z.infer<typeof FaultSchema>;
+export declare const ChaosPlanSchema: z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    runId: z.ZodString;
+    /** 0-based repetition index; baseline repetitions carry no faults. */
+    repetition: z.ZodNumber;
+    /** Token every injected error text carries, so `failure_surfaced` needs no model. */
+    canary: z.ZodString;
+    faults: z.ZodArray<z.ZodDiscriminatedUnion<"id", [z.ZodObject<{
+        retry_after_s: z.ZodDefault<z.ZodNumber>;
+        match: z.ZodOptional<z.ZodObject<{
+            tool: z.ZodOptional<z.ZodString>;
+            host: z.ZodOptional<z.ZodString>;
+            model: z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }>>;
+        /** Skip this many matching calls before the first injection. */
+        after_calls: z.ZodDefault<z.ZodNumber>;
+        /** Inject at most this many times; absent means every matching call. */
+        times: z.ZodOptional<z.ZodNumber>;
+        id: z.ZodLiteral<"llm.rate_limit">;
+    }, "strict", z.ZodTypeAny, {
+        id: "llm.rate_limit";
+        retry_after_s: number;
+        after_calls: number;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    }, {
+        id: "llm.rate_limit";
+        retry_after_s?: number | undefined;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+    }>, z.ZodObject<{
+        status: z.ZodDefault<z.ZodUnion<[z.ZodLiteral<500>, z.ZodLiteral<502>, z.ZodLiteral<503>, z.ZodLiteral<529>]>>;
+        /** Cut a streamed response after this many chunks instead of failing the request. */
+        stream_cut_after_chunks: z.ZodOptional<z.ZodNumber>;
+        match: z.ZodOptional<z.ZodObject<{
+            tool: z.ZodOptional<z.ZodString>;
+            host: z.ZodOptional<z.ZodString>;
+            model: z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }>>;
+        /** Skip this many matching calls before the first injection. */
+        after_calls: z.ZodDefault<z.ZodNumber>;
+        /** Inject at most this many times; absent means every matching call. */
+        times: z.ZodOptional<z.ZodNumber>;
+        id: z.ZodLiteral<"llm.upstream_5xx">;
+    }, "strict", z.ZodTypeAny, {
+        status: 500 | 502 | 503 | 529;
+        id: "llm.upstream_5xx";
+        after_calls: number;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+        stream_cut_after_chunks?: number | undefined;
+    }, {
+        id: "llm.upstream_5xx";
+        status?: 500 | 502 | 503 | 529 | undefined;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+        stream_cut_after_chunks?: number | undefined;
+    }>, z.ZodObject<{
+        drop_oldest: z.ZodDefault<z.ZodNumber>;
+        drop_system: z.ZodDefault<z.ZodBoolean>;
+        match: z.ZodOptional<z.ZodObject<{
+            tool: z.ZodOptional<z.ZodString>;
+            host: z.ZodOptional<z.ZodString>;
+            model: z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }>>;
+        /** Skip this many matching calls before the first injection. */
+        after_calls: z.ZodDefault<z.ZodNumber>;
+        /** Inject at most this many times; absent means every matching call. */
+        times: z.ZodOptional<z.ZodNumber>;
+        id: z.ZodLiteral<"llm.context_trim">;
+    }, "strict", z.ZodTypeAny, {
+        id: "llm.context_trim";
+        after_calls: number;
+        drop_oldest: number;
+        drop_system: boolean;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    }, {
+        id: "llm.context_trim";
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+        drop_oldest?: number | undefined;
+        drop_system?: boolean | undefined;
+    }>, z.ZodObject<{
+        to_model: z.ZodString;
+        match: z.ZodOptional<z.ZodObject<{
+            tool: z.ZodOptional<z.ZodString>;
+            host: z.ZodOptional<z.ZodString>;
+            model: z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }>>;
+        /** Skip this many matching calls before the first injection. */
+        after_calls: z.ZodDefault<z.ZodNumber>;
+        /** Inject at most this many times; absent means every matching call. */
+        times: z.ZodOptional<z.ZodNumber>;
+        id: z.ZodLiteral<"llm.model_degrade">;
+    }, "strict", z.ZodTypeAny, {
+        id: "llm.model_degrade";
+        after_calls: number;
+        to_model: string;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    }, {
+        id: "llm.model_degrade";
+        to_model: string;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+    }>, z.ZodObject<{
+        message: z.ZodDefault<z.ZodString>;
+        match: z.ZodOptional<z.ZodObject<{
+            tool: z.ZodOptional<z.ZodString>;
+            host: z.ZodOptional<z.ZodString>;
+            model: z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }>>;
+        /** Skip this many matching calls before the first injection. */
+        after_calls: z.ZodDefault<z.ZodNumber>;
+        /** Inject at most this many times; absent means every matching call. */
+        times: z.ZodOptional<z.ZodNumber>;
+        id: z.ZodLiteral<"tool.error">;
+    }, "strict", z.ZodTypeAny, {
+        message: string;
+        id: "tool.error";
+        after_calls: number;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    }, {
+        id: "tool.error";
+        message?: string | undefined;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+    }>, z.ZodObject<{
+        result: z.ZodString;
+        match: z.ZodOptional<z.ZodObject<{
+            tool: z.ZodOptional<z.ZodString>;
+            host: z.ZodOptional<z.ZodString>;
+            model: z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }>>;
+        /** Skip this many matching calls before the first injection. */
+        after_calls: z.ZodDefault<z.ZodNumber>;
+        /** Inject at most this many times; absent means every matching call. */
+        times: z.ZodOptional<z.ZodNumber>;
+        id: z.ZodLiteral<"tool.stale_data">;
+    }, "strict", z.ZodTypeAny, {
+        id: "tool.stale_data";
+        after_calls: number;
+        result: string;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    }, {
+        id: "tool.stale_data";
+        result: string;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+    }>, z.ZodObject<{
+        remove: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        /** Tool name → the description it is redefined with. */
+        redefine: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+        match: z.ZodOptional<z.ZodObject<{
+            tool: z.ZodOptional<z.ZodString>;
+            host: z.ZodOptional<z.ZodString>;
+            model: z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }>>;
+        /** Skip this many matching calls before the first injection. */
+        after_calls: z.ZodDefault<z.ZodNumber>;
+        /** Inject at most this many times; absent means every matching call. */
+        times: z.ZodOptional<z.ZodNumber>;
+        id: z.ZodLiteral<"mcp.toolset_change">;
+    }, "strict", z.ZodTypeAny, {
+        id: "mcp.toolset_change";
+        after_calls: number;
+        remove: string[];
+        redefine: Record<string, string>;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    }, {
+        id: "mcp.toolset_change";
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+        remove?: string[] | undefined;
+        redefine?: Record<string, string> | undefined;
+    }>, z.ZodObject<{
+        mode: z.ZodDefault<z.ZodEnum<["deny", "delay", "hold_then_deny"]>>;
+        /**
+         * `delay` and `hold_then_deny`: how long a held call stays held. The
+         * call is refused as held, the way an approval hold refuses it, and so
+         * is its identical retry until this many seconds have passed since the
+         * first refusal; then the retry is allowed (`delay`) or denied
+         * (`hold_then_deny`). Nothing waits: 0 holds the call once and allows
+         * (or denies) the first retry.
+         */
+        delay_s: z.ZodDefault<z.ZodNumber>;
+        match: z.ZodOptional<z.ZodObject<{
+            tool: z.ZodOptional<z.ZodString>;
+            host: z.ZodOptional<z.ZodString>;
+            model: z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }>>;
+        /** Skip this many matching calls before the first injection. */
+        after_calls: z.ZodDefault<z.ZodNumber>;
+        /** Inject at most this many times; absent means every matching call. */
+        times: z.ZodOptional<z.ZodNumber>;
+        id: z.ZodLiteral<"permission.deny_or_delay">;
+    }, "strict", z.ZodTypeAny, {
+        id: "permission.deny_or_delay";
+        after_calls: number;
+        mode: "deny" | "delay" | "hold_then_deny";
+        delay_s: number;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    }, {
+        id: "permission.deny_or_delay";
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+        mode?: "deny" | "delay" | "hold_then_deny" | undefined;
+        delay_s?: number | undefined;
+    }>, z.ZodObject<{
+        payload: z.ZodString;
+        match: z.ZodOptional<z.ZodObject<{
+            tool: z.ZodOptional<z.ZodString>;
+            host: z.ZodOptional<z.ZodString>;
+            model: z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }>>;
+        /** Skip this many matching calls before the first injection. */
+        after_calls: z.ZodDefault<z.ZodNumber>;
+        /** Inject at most this many times; absent means every matching call. */
+        times: z.ZodOptional<z.ZodNumber>;
+        id: z.ZodLiteral<"inject.tool_result">;
+    }, "strict", z.ZodTypeAny, {
+        id: "inject.tool_result";
+        after_calls: number;
+        payload: string;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    }, {
+        id: "inject.tool_result";
+        payload: string;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+    }>, z.ZodObject<{
+        match: z.ZodObject<{
+            tool: z.ZodOptional<z.ZodString>;
+            model: z.ZodOptional<z.ZodString>;
+        } & {
+            host: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            host: string;
+            tool?: string | undefined;
+            model?: string | undefined;
+        }, {
+            host: string;
+            tool?: string | undefined;
+            model?: string | undefined;
+        }>;
+        /** Skip this many matching calls before the first injection. */
+        after_calls: z.ZodDefault<z.ZodNumber>;
+        /** Inject at most this many times; absent means every matching call. */
+        times: z.ZodOptional<z.ZodNumber>;
+        id: z.ZodLiteral<"egress.dns_fail">;
+    }, "strict", z.ZodTypeAny, {
+        id: "egress.dns_fail";
+        match: {
+            host: string;
+            tool?: string | undefined;
+            model?: string | undefined;
+        };
+        after_calls: number;
+        times?: number | undefined;
+    }, {
+        id: "egress.dns_fail";
+        match: {
+            host: string;
+            tool?: string | undefined;
+            model?: string | undefined;
+        };
+        after_calls?: number | undefined;
+        times?: number | undefined;
+    }>, z.ZodObject<{
+        match: z.ZodObject<{
+            tool: z.ZodOptional<z.ZodString>;
+            model: z.ZodOptional<z.ZodString>;
+        } & {
+            host: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            host: string;
+            tool?: string | undefined;
+            model?: string | undefined;
+        }, {
+            host: string;
+            tool?: string | undefined;
+            model?: string | undefined;
+        }>;
+        /** Skip this many matching calls before the first injection. */
+        after_calls: z.ZodDefault<z.ZodNumber>;
+        /** Inject at most this many times; absent means every matching call. */
+        times: z.ZodOptional<z.ZodNumber>;
+        id: z.ZodLiteral<"egress.credential_401">;
+    }, "strict", z.ZodTypeAny, {
+        id: "egress.credential_401";
+        match: {
+            host: string;
+            tool?: string | undefined;
+            model?: string | undefined;
+        };
+        after_calls: number;
+        times?: number | undefined;
+    }, {
+        id: "egress.credential_401";
+        match: {
+            host: string;
+            tool?: string | undefined;
+            model?: string | undefined;
+        };
+        after_calls?: number | undefined;
+        times?: number | undefined;
+    }>]>, "many">;
+}, "strict", z.ZodTypeAny, {
+    v: 1;
+    runId: string;
+    repetition: number;
+    canary: string;
+    faults: ({
+        id: "llm.rate_limit";
+        retry_after_s: number;
+        after_calls: number;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    } | {
+        status: 500 | 502 | 503 | 529;
+        id: "llm.upstream_5xx";
+        after_calls: number;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+        stream_cut_after_chunks?: number | undefined;
+    } | {
+        id: "llm.context_trim";
+        after_calls: number;
+        drop_oldest: number;
+        drop_system: boolean;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    } | {
+        id: "llm.model_degrade";
+        after_calls: number;
+        to_model: string;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    } | {
+        message: string;
+        id: "tool.error";
+        after_calls: number;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    } | {
+        id: "tool.stale_data";
+        after_calls: number;
+        result: string;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    } | {
+        id: "mcp.toolset_change";
+        after_calls: number;
+        remove: string[];
+        redefine: Record<string, string>;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    } | {
+        id: "permission.deny_or_delay";
+        after_calls: number;
+        mode: "deny" | "delay" | "hold_then_deny";
+        delay_s: number;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    } | {
+        id: "inject.tool_result";
+        after_calls: number;
+        payload: string;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    } | {
+        id: "egress.dns_fail";
+        match: {
+            host: string;
+            tool?: string | undefined;
+            model?: string | undefined;
+        };
+        after_calls: number;
+        times?: number | undefined;
+    } | {
+        id: "egress.credential_401";
+        match: {
+            host: string;
+            tool?: string | undefined;
+            model?: string | undefined;
+        };
+        after_calls: number;
+        times?: number | undefined;
+    })[];
+}, {
+    v: 1;
+    runId: string;
+    repetition: number;
+    canary: string;
+    faults: ({
+        id: "llm.rate_limit";
+        retry_after_s?: number | undefined;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+    } | {
+        id: "llm.upstream_5xx";
+        status?: 500 | 502 | 503 | 529 | undefined;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+        stream_cut_after_chunks?: number | undefined;
+    } | {
+        id: "llm.context_trim";
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+        drop_oldest?: number | undefined;
+        drop_system?: boolean | undefined;
+    } | {
+        id: "llm.model_degrade";
+        to_model: string;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+    } | {
+        id: "tool.error";
+        message?: string | undefined;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+    } | {
+        id: "tool.stale_data";
+        result: string;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+    } | {
+        id: "mcp.toolset_change";
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+        remove?: string[] | undefined;
+        redefine?: Record<string, string> | undefined;
+    } | {
+        id: "permission.deny_or_delay";
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+        mode?: "deny" | "delay" | "hold_then_deny" | undefined;
+        delay_s?: number | undefined;
+    } | {
+        id: "inject.tool_result";
+        payload: string;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+    } | {
+        id: "egress.dns_fail";
+        match: {
+            host: string;
+            tool?: string | undefined;
+            model?: string | undefined;
+        };
+        after_calls?: number | undefined;
+        times?: number | undefined;
+    } | {
+        id: "egress.credential_401";
+        match: {
+            host: string;
+            tool?: string | undefined;
+            model?: string | undefined;
+        };
+        after_calls?: number | undefined;
+        times?: number | undefined;
+    })[];
+}>;
+export type ChaosPlan = z.infer<typeof ChaosPlanSchema>;
+/** Encode a plan for {@link CHAOS_PLAN_ENV}. */
+export declare function encodeChaosPlan(plan: ChaosPlan): string;
+/**
+ * Decode {@link CHAOS_PLAN_ENV}. Returns null when the variable is unset or
+ * empty; throws when it is set but not a valid plan, so a component can say
+ * so instead of silently injecting nothing.
+ */
+export declare function decodeChaosPlan(raw: string | undefined): ChaosPlan | null;
+/** Whether `value` matches a fault's `tool`/`host` pattern (exact, or `*suffix`). */
+export declare function matchesPattern(pattern: string | undefined, value: string | undefined): boolean;
+/** Whether a fault's `match` covers a call. */
+export declare function faultMatches(fault: Fault, call: {
+    tool?: string;
+    host?: string;
+    model?: string;
+}): boolean;
+/**
+ * Per-process injection counter: decides whether the nth matching call of a
+ * fault is hit, honouring `after_calls` and `times`. One instance per
+ * component process; the plan is per run, so per-process state is per run.
+ */
+export declare class FaultCounter {
+    private seen;
+    private hit;
+    /** Call once per matching call; returns true when this call is injected. */
+    shouldInject(faultIndex: number, fault: Fault): boolean;
+}
+/** The error text an injected failure carries: the base message plus the canary. */
+export declare function faultMessage(plan: Pick<ChaosPlan, 'canary'>, base: string): string;
+export declare const ChaosEventSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+    type: z.ZodLiteral<"plan_loaded">;
+    faults: z.ZodNumber;
+    ts: z.ZodString;
+    runId: z.ZodString;
+    component: z.ZodEnum<["runner", "proxy", "mcp-proxy", "gate"]>;
+}, "strip", z.ZodTypeAny, {
+    type: "plan_loaded";
+    runId: string;
+    faults: number;
+    ts: string;
+    component: "runner" | "proxy" | "mcp-proxy" | "gate";
+}, {
+    type: "plan_loaded";
+    runId: string;
+    faults: number;
+    ts: string;
+    component: "runner" | "proxy" | "mcp-proxy" | "gate";
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"fault_injected">;
+    faultId: z.ZodEnum<["llm.rate_limit", "llm.upstream_5xx", "llm.context_trim", "llm.model_degrade", "tool.error", "tool.stale_data", "mcp.toolset_change", "permission.deny_or_delay", "inject.tool_result", "egress.dns_fail", "egress.credential_401"]>;
+    /** The 1-based index of the matching call that was hit. */
+    call: z.ZodNumber;
+    target: z.ZodOptional<z.ZodString>;
+    ts: z.ZodString;
+    runId: z.ZodString;
+    component: z.ZodEnum<["runner", "proxy", "mcp-proxy", "gate"]>;
+}, "strip", z.ZodTypeAny, {
+    type: "fault_injected";
+    runId: string;
+    ts: string;
+    component: "runner" | "proxy" | "mcp-proxy" | "gate";
+    faultId: "llm.rate_limit" | "llm.upstream_5xx" | "llm.context_trim" | "llm.model_degrade" | "tool.error" | "tool.stale_data" | "mcp.toolset_change" | "permission.deny_or_delay" | "inject.tool_result" | "egress.dns_fail" | "egress.credential_401";
+    call: number;
+    target?: string | undefined;
+}, {
+    type: "fault_injected";
+    runId: string;
+    ts: string;
+    component: "runner" | "proxy" | "mcp-proxy" | "gate";
+    faultId: "llm.rate_limit" | "llm.upstream_5xx" | "llm.context_trim" | "llm.model_degrade" | "tool.error" | "tool.stale_data" | "mcp.toolset_change" | "permission.deny_or_delay" | "inject.tool_result" | "egress.dns_fail" | "egress.credential_401";
+    call: number;
+    target?: string | undefined;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"tool_call">;
+    tool: z.ZodString;
+    ok: z.ZodBoolean;
+    ts: z.ZodString;
+    runId: z.ZodString;
+    component: z.ZodEnum<["runner", "proxy", "mcp-proxy", "gate"]>;
+}, "strip", z.ZodTypeAny, {
+    type: "tool_call";
+    tool: string;
+    runId: string;
+    ts: string;
+    component: "runner" | "proxy" | "mcp-proxy" | "gate";
+    ok: boolean;
+}, {
+    type: "tool_call";
+    tool: string;
+    runId: string;
+    ts: string;
+    component: "runner" | "proxy" | "mcp-proxy" | "gate";
+    ok: boolean;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"gate_decision">;
+    tool: z.ZodString;
+    decision: z.ZodEnum<["allow", "deny", "ask", "hold"]>;
+    ruleId: z.ZodOptional<z.ZodString>;
+    /** The call hit the destructive-command tier, whether or not it was blocked. */
+    destructive: z.ZodBoolean;
+    /** An enforce-mode rule fired on the call. */
+    policyHit: z.ZodBoolean;
+    ts: z.ZodString;
+    runId: z.ZodString;
+    component: z.ZodEnum<["runner", "proxy", "mcp-proxy", "gate"]>;
+}, "strip", z.ZodTypeAny, {
+    type: "gate_decision";
+    tool: string;
+    runId: string;
+    ts: string;
+    component: "runner" | "proxy" | "mcp-proxy" | "gate";
+    decision: "deny" | "allow" | "ask" | "hold";
+    destructive: boolean;
+    policyHit: boolean;
+    ruleId?: string | undefined;
+}, {
+    type: "gate_decision";
+    tool: string;
+    runId: string;
+    ts: string;
+    component: "runner" | "proxy" | "mcp-proxy" | "gate";
+    decision: "deny" | "allow" | "ask" | "hold";
+    destructive: boolean;
+    policyHit: boolean;
+    ruleId?: string | undefined;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"llm_usage">;
+    model: z.ZodString;
+    inputTokens: z.ZodNumber;
+    outputTokens: z.ZodNumber;
+    costUsd: z.ZodNumber;
+    ts: z.ZodString;
+    runId: z.ZodString;
+    component: z.ZodEnum<["runner", "proxy", "mcp-proxy", "gate"]>;
+}, "strip", z.ZodTypeAny, {
+    type: "llm_usage";
+    outputTokens: number;
+    model: string;
+    runId: string;
+    ts: string;
+    component: "runner" | "proxy" | "mcp-proxy" | "gate";
+    inputTokens: number;
+    costUsd: number;
+}, {
+    type: "llm_usage";
+    outputTokens: number;
+    model: string;
+    runId: string;
+    ts: string;
+    component: "runner" | "proxy" | "mcp-proxy" | "gate";
+    inputTokens: number;
+    costUsd: number;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"abort">;
+    reason: z.ZodString;
+    ts: z.ZodString;
+    runId: z.ZodString;
+    component: z.ZodEnum<["runner", "proxy", "mcp-proxy", "gate"]>;
+}, "strip", z.ZodTypeAny, {
+    type: "abort";
+    reason: string;
+    runId: string;
+    ts: string;
+    component: "runner" | "proxy" | "mcp-proxy" | "gate";
+}, {
+    type: "abort";
+    reason: string;
+    runId: string;
+    ts: string;
+    component: "runner" | "proxy" | "mcp-proxy" | "gate";
+}>]>;
+export type ChaosEvent = z.infer<typeof ChaosEventSchema>;
+/** Parse an events file's text; malformed lines are counted, not thrown. */
+export declare function parseChaosEvents(text: string): {
+    events: ChaosEvent[];
+    malformed: number;
+};
+export declare const PROBE_IDS: readonly ["task_success", "no_destructive_attempt", "failure_surfaced", "no_policy_hits", "cost_multiplier_below", "recovered_within"];
+export type ProbeId = (typeof PROBE_IDS)[number];
+export declare const ExperimentSchema: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    /** The agent command, run in the sandbox through a shell. */
+    agent: z.ZodString;
+    /** Run in the sandbox after the agent; exit 0 means the task succeeded. */
+    verify: z.ZodString;
+    /** Faulted repetitions; the same number of baseline repetitions run first. */
+    repeat: z.ZodDefault<z.ZodNumber>;
+    faults: z.ZodArray<z.ZodDiscriminatedUnion<"id", [z.ZodObject<{
+        retry_after_s: z.ZodDefault<z.ZodNumber>;
+        match: z.ZodOptional<z.ZodObject<{
+            tool: z.ZodOptional<z.ZodString>;
+            host: z.ZodOptional<z.ZodString>;
+            model: z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }>>;
+        /** Skip this many matching calls before the first injection. */
+        after_calls: z.ZodDefault<z.ZodNumber>;
+        /** Inject at most this many times; absent means every matching call. */
+        times: z.ZodOptional<z.ZodNumber>;
+        id: z.ZodLiteral<"llm.rate_limit">;
+    }, "strict", z.ZodTypeAny, {
+        id: "llm.rate_limit";
+        retry_after_s: number;
+        after_calls: number;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    }, {
+        id: "llm.rate_limit";
+        retry_after_s?: number | undefined;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+    }>, z.ZodObject<{
+        status: z.ZodDefault<z.ZodUnion<[z.ZodLiteral<500>, z.ZodLiteral<502>, z.ZodLiteral<503>, z.ZodLiteral<529>]>>;
+        /** Cut a streamed response after this many chunks instead of failing the request. */
+        stream_cut_after_chunks: z.ZodOptional<z.ZodNumber>;
+        match: z.ZodOptional<z.ZodObject<{
+            tool: z.ZodOptional<z.ZodString>;
+            host: z.ZodOptional<z.ZodString>;
+            model: z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }>>;
+        /** Skip this many matching calls before the first injection. */
+        after_calls: z.ZodDefault<z.ZodNumber>;
+        /** Inject at most this many times; absent means every matching call. */
+        times: z.ZodOptional<z.ZodNumber>;
+        id: z.ZodLiteral<"llm.upstream_5xx">;
+    }, "strict", z.ZodTypeAny, {
+        status: 500 | 502 | 503 | 529;
+        id: "llm.upstream_5xx";
+        after_calls: number;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+        stream_cut_after_chunks?: number | undefined;
+    }, {
+        id: "llm.upstream_5xx";
+        status?: 500 | 502 | 503 | 529 | undefined;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+        stream_cut_after_chunks?: number | undefined;
+    }>, z.ZodObject<{
+        drop_oldest: z.ZodDefault<z.ZodNumber>;
+        drop_system: z.ZodDefault<z.ZodBoolean>;
+        match: z.ZodOptional<z.ZodObject<{
+            tool: z.ZodOptional<z.ZodString>;
+            host: z.ZodOptional<z.ZodString>;
+            model: z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }>>;
+        /** Skip this many matching calls before the first injection. */
+        after_calls: z.ZodDefault<z.ZodNumber>;
+        /** Inject at most this many times; absent means every matching call. */
+        times: z.ZodOptional<z.ZodNumber>;
+        id: z.ZodLiteral<"llm.context_trim">;
+    }, "strict", z.ZodTypeAny, {
+        id: "llm.context_trim";
+        after_calls: number;
+        drop_oldest: number;
+        drop_system: boolean;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    }, {
+        id: "llm.context_trim";
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+        drop_oldest?: number | undefined;
+        drop_system?: boolean | undefined;
+    }>, z.ZodObject<{
+        to_model: z.ZodString;
+        match: z.ZodOptional<z.ZodObject<{
+            tool: z.ZodOptional<z.ZodString>;
+            host: z.ZodOptional<z.ZodString>;
+            model: z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }>>;
+        /** Skip this many matching calls before the first injection. */
+        after_calls: z.ZodDefault<z.ZodNumber>;
+        /** Inject at most this many times; absent means every matching call. */
+        times: z.ZodOptional<z.ZodNumber>;
+        id: z.ZodLiteral<"llm.model_degrade">;
+    }, "strict", z.ZodTypeAny, {
+        id: "llm.model_degrade";
+        after_calls: number;
+        to_model: string;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    }, {
+        id: "llm.model_degrade";
+        to_model: string;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+    }>, z.ZodObject<{
+        message: z.ZodDefault<z.ZodString>;
+        match: z.ZodOptional<z.ZodObject<{
+            tool: z.ZodOptional<z.ZodString>;
+            host: z.ZodOptional<z.ZodString>;
+            model: z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }>>;
+        /** Skip this many matching calls before the first injection. */
+        after_calls: z.ZodDefault<z.ZodNumber>;
+        /** Inject at most this many times; absent means every matching call. */
+        times: z.ZodOptional<z.ZodNumber>;
+        id: z.ZodLiteral<"tool.error">;
+    }, "strict", z.ZodTypeAny, {
+        message: string;
+        id: "tool.error";
+        after_calls: number;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    }, {
+        id: "tool.error";
+        message?: string | undefined;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+    }>, z.ZodObject<{
+        result: z.ZodString;
+        match: z.ZodOptional<z.ZodObject<{
+            tool: z.ZodOptional<z.ZodString>;
+            host: z.ZodOptional<z.ZodString>;
+            model: z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }>>;
+        /** Skip this many matching calls before the first injection. */
+        after_calls: z.ZodDefault<z.ZodNumber>;
+        /** Inject at most this many times; absent means every matching call. */
+        times: z.ZodOptional<z.ZodNumber>;
+        id: z.ZodLiteral<"tool.stale_data">;
+    }, "strict", z.ZodTypeAny, {
+        id: "tool.stale_data";
+        after_calls: number;
+        result: string;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    }, {
+        id: "tool.stale_data";
+        result: string;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+    }>, z.ZodObject<{
+        remove: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        /** Tool name → the description it is redefined with. */
+        redefine: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+        match: z.ZodOptional<z.ZodObject<{
+            tool: z.ZodOptional<z.ZodString>;
+            host: z.ZodOptional<z.ZodString>;
+            model: z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }>>;
+        /** Skip this many matching calls before the first injection. */
+        after_calls: z.ZodDefault<z.ZodNumber>;
+        /** Inject at most this many times; absent means every matching call. */
+        times: z.ZodOptional<z.ZodNumber>;
+        id: z.ZodLiteral<"mcp.toolset_change">;
+    }, "strict", z.ZodTypeAny, {
+        id: "mcp.toolset_change";
+        after_calls: number;
+        remove: string[];
+        redefine: Record<string, string>;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    }, {
+        id: "mcp.toolset_change";
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+        remove?: string[] | undefined;
+        redefine?: Record<string, string> | undefined;
+    }>, z.ZodObject<{
+        mode: z.ZodDefault<z.ZodEnum<["deny", "delay", "hold_then_deny"]>>;
+        /**
+         * `delay` and `hold_then_deny`: how long a held call stays held. The
+         * call is refused as held, the way an approval hold refuses it, and so
+         * is its identical retry until this many seconds have passed since the
+         * first refusal; then the retry is allowed (`delay`) or denied
+         * (`hold_then_deny`). Nothing waits: 0 holds the call once and allows
+         * (or denies) the first retry.
+         */
+        delay_s: z.ZodDefault<z.ZodNumber>;
+        match: z.ZodOptional<z.ZodObject<{
+            tool: z.ZodOptional<z.ZodString>;
+            host: z.ZodOptional<z.ZodString>;
+            model: z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }>>;
+        /** Skip this many matching calls before the first injection. */
+        after_calls: z.ZodDefault<z.ZodNumber>;
+        /** Inject at most this many times; absent means every matching call. */
+        times: z.ZodOptional<z.ZodNumber>;
+        id: z.ZodLiteral<"permission.deny_or_delay">;
+    }, "strict", z.ZodTypeAny, {
+        id: "permission.deny_or_delay";
+        after_calls: number;
+        mode: "deny" | "delay" | "hold_then_deny";
+        delay_s: number;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    }, {
+        id: "permission.deny_or_delay";
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+        mode?: "deny" | "delay" | "hold_then_deny" | undefined;
+        delay_s?: number | undefined;
+    }>, z.ZodObject<{
+        payload: z.ZodString;
+        match: z.ZodOptional<z.ZodObject<{
+            tool: z.ZodOptional<z.ZodString>;
+            host: z.ZodOptional<z.ZodString>;
+            model: z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }, {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        }>>;
+        /** Skip this many matching calls before the first injection. */
+        after_calls: z.ZodDefault<z.ZodNumber>;
+        /** Inject at most this many times; absent means every matching call. */
+        times: z.ZodOptional<z.ZodNumber>;
+        id: z.ZodLiteral<"inject.tool_result">;
+    }, "strict", z.ZodTypeAny, {
+        id: "inject.tool_result";
+        after_calls: number;
+        payload: string;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    }, {
+        id: "inject.tool_result";
+        payload: string;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+    }>, z.ZodObject<{
+        match: z.ZodObject<{
+            tool: z.ZodOptional<z.ZodString>;
+            model: z.ZodOptional<z.ZodString>;
+        } & {
+            host: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            host: string;
+            tool?: string | undefined;
+            model?: string | undefined;
+        }, {
+            host: string;
+            tool?: string | undefined;
+            model?: string | undefined;
+        }>;
+        /** Skip this many matching calls before the first injection. */
+        after_calls: z.ZodDefault<z.ZodNumber>;
+        /** Inject at most this many times; absent means every matching call. */
+        times: z.ZodOptional<z.ZodNumber>;
+        id: z.ZodLiteral<"egress.dns_fail">;
+    }, "strict", z.ZodTypeAny, {
+        id: "egress.dns_fail";
+        match: {
+            host: string;
+            tool?: string | undefined;
+            model?: string | undefined;
+        };
+        after_calls: number;
+        times?: number | undefined;
+    }, {
+        id: "egress.dns_fail";
+        match: {
+            host: string;
+            tool?: string | undefined;
+            model?: string | undefined;
+        };
+        after_calls?: number | undefined;
+        times?: number | undefined;
+    }>, z.ZodObject<{
+        match: z.ZodObject<{
+            tool: z.ZodOptional<z.ZodString>;
+            model: z.ZodOptional<z.ZodString>;
+        } & {
+            host: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            host: string;
+            tool?: string | undefined;
+            model?: string | undefined;
+        }, {
+            host: string;
+            tool?: string | undefined;
+            model?: string | undefined;
+        }>;
+        /** Skip this many matching calls before the first injection. */
+        after_calls: z.ZodDefault<z.ZodNumber>;
+        /** Inject at most this many times; absent means every matching call. */
+        times: z.ZodOptional<z.ZodNumber>;
+        id: z.ZodLiteral<"egress.credential_401">;
+    }, "strict", z.ZodTypeAny, {
+        id: "egress.credential_401";
+        match: {
+            host: string;
+            tool?: string | undefined;
+            model?: string | undefined;
+        };
+        after_calls: number;
+        times?: number | undefined;
+    }, {
+        id: "egress.credential_401";
+        match: {
+            host: string;
+            tool?: string | undefined;
+            model?: string | undefined;
+        };
+        after_calls?: number | undefined;
+        times?: number | undefined;
+    }>]>, "many">;
+    probes: z.ZodArray<z.ZodEffects<z.ZodObject<{
+        id: z.ZodEnum<["task_success", "no_destructive_attempt", "failure_surfaced", "no_policy_hits", "cost_multiplier_below", "recovered_within"]>;
+        weight: z.ZodNumber;
+        /** Threshold for `cost_multiplier_below` (a ratio) and `recovered_within` (calls). */
+        value: z.ZodOptional<z.ZodNumber>;
+    }, "strict", z.ZodTypeAny, {
+        id: "task_success" | "no_destructive_attempt" | "failure_surfaced" | "no_policy_hits" | "cost_multiplier_below" | "recovered_within";
+        weight: number;
+        value?: number | undefined;
+    }, {
+        id: "task_success" | "no_destructive_attempt" | "failure_surfaced" | "no_policy_hits" | "cost_multiplier_below" | "recovered_within";
+        weight: number;
+        value?: number | undefined;
+    }>, {
+        id: "task_success" | "no_destructive_attempt" | "failure_surfaced" | "no_policy_hits" | "cost_multiplier_below" | "recovered_within";
+        weight: number;
+        value?: number | undefined;
+    }, {
+        id: "task_success" | "no_destructive_attempt" | "failure_surfaced" | "no_policy_hits" | "cost_multiplier_below" | "recovered_within";
+        weight: number;
+        value?: number | undefined;
+    }>, "many">;
+    /** A cost ceiling is mandatory: every run spends real tokens. */
+    abort: z.ZodEffects<z.ZodArray<z.ZodUnion<[z.ZodLiteral<"destructive_attempt">, z.ZodObject<{
+        cost_usd_above: z.ZodNumber;
+    }, "strict", z.ZodTypeAny, {
+        cost_usd_above: number;
+    }, {
+        cost_usd_above: number;
+    }>, z.ZodObject<{
+        wall_clock_s_above: z.ZodNumber;
+    }, "strict", z.ZodTypeAny, {
+        wall_clock_s_above: number;
+    }, {
+        wall_clock_s_above: number;
+    }>]>, "many">, ("destructive_attempt" | {
+        cost_usd_above: number;
+    } | {
+        wall_clock_s_above: number;
+    })[], ("destructive_attempt" | {
+        cost_usd_above: number;
+    } | {
+        wall_clock_s_above: number;
+    })[]>;
+    sandbox_image: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    name: string;
+    faults: ({
+        id: "llm.rate_limit";
+        retry_after_s: number;
+        after_calls: number;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    } | {
+        status: 500 | 502 | 503 | 529;
+        id: "llm.upstream_5xx";
+        after_calls: number;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+        stream_cut_after_chunks?: number | undefined;
+    } | {
+        id: "llm.context_trim";
+        after_calls: number;
+        drop_oldest: number;
+        drop_system: boolean;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    } | {
+        id: "llm.model_degrade";
+        after_calls: number;
+        to_model: string;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    } | {
+        message: string;
+        id: "tool.error";
+        after_calls: number;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    } | {
+        id: "tool.stale_data";
+        after_calls: number;
+        result: string;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    } | {
+        id: "mcp.toolset_change";
+        after_calls: number;
+        remove: string[];
+        redefine: Record<string, string>;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    } | {
+        id: "permission.deny_or_delay";
+        after_calls: number;
+        mode: "deny" | "delay" | "hold_then_deny";
+        delay_s: number;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    } | {
+        id: "inject.tool_result";
+        after_calls: number;
+        payload: string;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        times?: number | undefined;
+    } | {
+        id: "egress.dns_fail";
+        match: {
+            host: string;
+            tool?: string | undefined;
+            model?: string | undefined;
+        };
+        after_calls: number;
+        times?: number | undefined;
+    } | {
+        id: "egress.credential_401";
+        match: {
+            host: string;
+            tool?: string | undefined;
+            model?: string | undefined;
+        };
+        after_calls: number;
+        times?: number | undefined;
+    })[];
+    abort: ("destructive_attempt" | {
+        cost_usd_above: number;
+    } | {
+        wall_clock_s_above: number;
+    })[];
+    agent: string;
+    verify: string;
+    repeat: number;
+    probes: {
+        id: "task_success" | "no_destructive_attempt" | "failure_surfaced" | "no_policy_hits" | "cost_multiplier_below" | "recovered_within";
+        weight: number;
+        value?: number | undefined;
+    }[];
+    description?: string | undefined;
+    sandbox_image?: string | undefined;
+}, {
+    name: string;
+    faults: ({
+        id: "llm.rate_limit";
+        retry_after_s?: number | undefined;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+    } | {
+        id: "llm.upstream_5xx";
+        status?: 500 | 502 | 503 | 529 | undefined;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+        stream_cut_after_chunks?: number | undefined;
+    } | {
+        id: "llm.context_trim";
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+        drop_oldest?: number | undefined;
+        drop_system?: boolean | undefined;
+    } | {
+        id: "llm.model_degrade";
+        to_model: string;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+    } | {
+        id: "tool.error";
+        message?: string | undefined;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+    } | {
+        id: "tool.stale_data";
+        result: string;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+    } | {
+        id: "mcp.toolset_change";
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+        remove?: string[] | undefined;
+        redefine?: Record<string, string> | undefined;
+    } | {
+        id: "permission.deny_or_delay";
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+        mode?: "deny" | "delay" | "hold_then_deny" | undefined;
+        delay_s?: number | undefined;
+    } | {
+        id: "inject.tool_result";
+        payload: string;
+        match?: {
+            tool?: string | undefined;
+            host?: string | undefined;
+            model?: string | undefined;
+        } | undefined;
+        after_calls?: number | undefined;
+        times?: number | undefined;
+    } | {
+        id: "egress.dns_fail";
+        match: {
+            host: string;
+            tool?: string | undefined;
+            model?: string | undefined;
+        };
+        after_calls?: number | undefined;
+        times?: number | undefined;
+    } | {
+        id: "egress.credential_401";
+        match: {
+            host: string;
+            tool?: string | undefined;
+            model?: string | undefined;
+        };
+        after_calls?: number | undefined;
+        times?: number | undefined;
+    })[];
+    abort: ("destructive_attempt" | {
+        cost_usd_above: number;
+    } | {
+        wall_clock_s_above: number;
+    })[];
+    agent: string;
+    verify: string;
+    probes: {
+        id: "task_success" | "no_destructive_attempt" | "failure_surfaced" | "no_policy_hits" | "cost_multiplier_below" | "recovered_within";
+        weight: number;
+        value?: number | undefined;
+    }[];
+    description?: string | undefined;
+    repeat?: number | undefined;
+    sandbox_image?: string | undefined;
+}>;
+export type Experiment = z.infer<typeof ExperimentSchema>;
+/** One probe's outcome across a run's faulted repetitions. */
+export interface ProbeOutcome {
+    id: ProbeId;
+    weight: number;
+    /** Repetitions that passed ÷ repetitions evaluated, 0–1. */
+    passRate: number;
+    evaluated: number;
+}
+export type RunVerdict = {
+    kind: 'scored';
+    score: number;
+    probes: ProbeOutcome[];
+}
+/** The baseline failed `task_success`: the task is broken, not the agent. */
+ | {
+    kind: 'invalid';
+    reason: string;
+} | {
+    kind: 'aborted';
+    reason: string;
+    score: number;
+    probes: ProbeOutcome[];
+};
+/**
+ * The resilience score: Σ(weight × pass rate) ÷ Σ(weight) × 100, rounded to
+ * one decimal. Probes that evaluated no repetition are left out of both sums.
+ */
+export declare function resilienceScore(probes: readonly ProbeOutcome[]): number;
+export {};
+//# sourceMappingURL=chaos.d.ts.map