@linxin666/dsh-client-ui-task-board 0.4.4 → 0.4.5

package/lib/types/core/handover.d.ts

@@ -35,7 +35,11 @@ export declare const HANDOVER_MAX_REFERENCE_BYTES = 512;
 export declare const HANDOVER_MAX_TOTAL_BYTES: number;
 /** Per target-id (workspace/preset) byte cap. */
 export declare const HANDOVER_MAX_TARGET_BYTES = 256;
-/** The board's notion of the deployment session-default permission (fail-safe default). */
+/**
+ * Fail-safe baseline for the confirmation gate: what it falls back to when the
+ * deployment pins no baseline of its own and the Host's default permission
+ * preset cannot be read. Every elevation above it stays gated.
+ */
 export declare const DEFAULT_SESSION_PERMISSION: TaskPermission;
 /** Permission elevation rank (higher = more authority). */
 export declare const PERMISSION_RANK: ReadonlyMap<TaskPermission, number>;
@@ -51,6 +55,14 @@ export declare function handoverOf(input: TaskHandoverInput, now: number): TaskH
 export declare function effectivePermission(task: Pick<TaskRecord, 'permission' | 'handover'>): TaskPermission | undefined;
 /** Whether a binding's permission is elevated above the session default. */
 export declare function exceedsSessionDefault(permission: TaskPermission | undefined, sessionDefault: TaskPermission): boolean;
+/**
+ * Whether a session running at `holder` already carries `permission`: the
+ * permission is absent, or its rank does not exceed the holder's. A teammate
+ * inherits the Lead session's permission and cannot be narrowed below it, so a
+ * subtask's own pin is carried by a team run exactly when this holds, and a pin
+ * it does not carry would be silently dropped instead.
+ */
+export declare function permissionCarriedBy(holder: TaskPermission, permission: TaskPermission | undefined): boolean;
 /**
  * The confirmation-gate predicate: an elevated permission without a human
  * confirmation stamp. Manual run/rerun and cron must refuse such a card.

package/lib/types/core/issue-form.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Issue-form vocabulary the card excerpt recognizes.
+ *
+ * Issue forms from an issue tracker (and the zh templates this family's repositories use)
+ * write the same section headings and empty-field placeholders on every issue.
+ * The patterns are data about those forms, not UI copy, so they live in the
+ * shared core rather than in a locale dictionary; the browser half imports them.
+ *
+ * @module @linxin666/dsh-client-ui-task-board/core/issue-form
+ */
+/** Section headings whose body is the issue's own summary (zh and en forms). */
+export declare const SUMMARY_HEADING: RegExp;
+/** Values an issue form writes for an empty field. */
+export declare const EMPTY_FIELD: RegExp;
+/** A trailing colon (ASCII or full-width) after a heading. */
+export declare const HEADING_COLON: RegExp;

package/lib/types/core/tasks.d.ts

@@ -5,7 +5,9 @@
  * unit-testable in isolation.
  */
 import type { FreezeSnapshot } from './freeze-snapshot.ts';
+import type { ExecutionVerification } from './verification.ts';
 import type { TaskHandover, TaskHandoverInput } from './handover.ts';
+import { type TaskBoardExtensionPayload } from './extension.ts';
 /** Task lifecycle status, one per kanban column. */
 export type TaskStatus = 'backlog' | 'todo' | 'running' | 'done' | 'failed';
 /** Settled outcome of one execution attempt. */
@@ -52,6 +54,14 @@ export interface ExecutionRecord {
     ownResult?: ExecutionOutcome;
     /** Human failure text that arrived with {@link ownResult}. */
     ownError?: string;
+    /**
+     * Goal acceptance state of this execution (task-board goal verification).
+     * Fixed when the execution starts and never rewritten from later settings:
+     * the contract is frozen here, the attempts accrue here, and the settlement
+     * rule reads the pass record here. Absent on an execution that started
+     * before the feature existed, which keeps it on the historical verdict.
+     */
+    verification?: ExecutionVerification;
 }
 /**
  * Maximum number of execution records retained per task. Older settled runs
@@ -231,6 +241,20 @@ export interface TaskRecord {
      * turn. A session whose `/goal` command is refused still runs the prompt.
      */
     goalRun?: boolean;
+    /**
+     * Run this task's goal executions WITHOUT the board's acceptance gate.
+     *
+     * Absent means INHERIT: the execution's applicability is decided by the
+     * board-wide `goalVerification` switch frozen at start, exactly as a card
+     * that never touched this option behaves. Only an explicit `true` opts the
+     * card out, and the execution records `applicability: 'disabled'` so the
+     * report says plainly that nothing certified this run.
+     *
+     * The opt-out is per execution, not per run: flipping it never rewrites the
+     * verdict rule of an execution already open, and a rerun or a scheduled
+     * occurrence reads the card's current value when it freezes its contract.
+     */
+    skipVerification?: boolean;
     /**
      * Frozen context snapshot for a continuation card; absent on plain tasks.
      * Sanitized before it enters the ledger (redaction, slash-command taint,
@@ -262,6 +286,20 @@ export interface TaskRecord {
      * absent means on-board.
      */
     archivedAt?: number;
+    /**
+     * Opaque external-provider metadata, keyed by extension id; optional and
+     * additive so existing tasks require no ledger migration. The board stores
+     * and forwards it without interpreting the keys — each provider owns the
+     * shape and validation of its own entry.
+     */
+    integrations?: Record<string, TaskBoardExtensionPayload>;
+    /**
+     * Whether the card is held off the board: it exists in the ledger (and its
+     * execution history is intact) but no column ever renders it. Providers
+     * create hidden cards for work they materialize but do not want displayed;
+     * absent means on-board.
+     */
+    hidden?: boolean;
 }
 /**
  * Statuses a task may be archived from: every status but `running`, whose
@@ -287,7 +325,7 @@ export interface NewTaskInput {
      * inherits the parent's unset execution targets.
      */
     parentId?: string;
-    /** Workspace the execution must run in; empty/absent = the recent workspace. */
+    /** Workspace the execution must run in; empty/absent = the creating session's workspace for a root task, else the recent workspace at execution time. */
     workspaceId?: string;
     /** Agent preset the execution session must be composed from; empty/absent = deployment default. */
     mode?: string;
@@ -304,6 +342,11 @@ export interface NewTaskInput {
      * default (goal run); an explicit false requests a single plain turn.
      */
     goalRun?: boolean;
+    /**
+     * Run this task's goal executions without the acceptance gate; absent
+     * inherits the board-wide `goalVerification` switch.
+     */
+    skipVerification?: boolean;
     /**
      * Optional scheduled-run rule requested at creation time (the new-task
      * dialog): an enable flag, a 5-field cron expression, and the IANA zone its
@@ -333,13 +376,31 @@ export interface NewTaskInput {
      * ahead of the execution prompt; a bare name changes nothing at run time.
      */
     tags?: TaskTag[];
+    /** Opaque external-provider metadata keyed by extension id. */
+    integrations?: Record<string, TaskBoardExtensionPayload>;
+    /** Column the created card opens in; absent means the board default (todo). */
+    status?: TaskStatus;
+    /** Create the card off-board (held in the ledger, never rendered). */
+    hidden?: boolean;
 }
 /** The five kanban columns, in display order. */
 export declare const COLUMNS: readonly {
     status: TaskStatus;
     label: string;
 }[];
-/** Statuses a user may move a card to manually (execution states are owned by the runner). */
+/**
+ * Statuses a card may be moved to by hand: every column. The board UI and the
+ * agent tool surface share this one list, so no column can be manual on one
+ * surface and locked on the other.
+ *
+ * The column is a board statement, not a claim about a run. A hand-written
+ * `done`/`failed` declares that the work finished (or failed) outside a
+ * Host-run execution — human hands, an external system — and a hand-written
+ * `running` says the work is under way without a tracked session. None of them
+ * creates an {@link ExecutionRecord}, which is what keeps a declaration
+ * distinguishable from a recorded outcome in the card's execution history; the
+ * next settled run overwrites the column with the real one.
+ */
 export declare const MANUAL_STATUSES: readonly TaskStatus[];
 /** Statuses the runner may move a card to from 'running'. */
 export declare const RUNNER_SETTLE_STATUSES: readonly TaskStatus[];
@@ -347,8 +408,28 @@ export declare const RUNNER_SETTLE_STATUSES: readonly TaskStatus[];
 export declare const ALL_STATUSES: readonly TaskStatus[];
 /** Brand an unknown string as a status; undefined when it is not one. */
 export declare function isTaskStatus(value: unknown): value is TaskStatus;
-/** Whether a manual move target is allowed from the given status. */
+/**
+ * Whether the manual move `from` -> `to` is a legal *column* change: any
+ * column, and never the one the card already shows.
+ *
+ * Whether the card may be moved at all is a separate question. The lock an
+ * executing card carries belongs to its open execution, never to the column
+ * text, so it is {@link canMoveTask} — not this predicate — that expresses it.
+ */
 export declare function canMoveManually(from: TaskStatus, to: TaskStatus): boolean;
+/**
+ * Whether the board may move `task` to `to` by hand: the card is on-board,
+ * holds no open execution, and the target is a legal column change. The ledger,
+ * the detail view's status buttons and the board's drop handler all decide
+ * through this one predicate, so no two surfaces can disagree about a card.
+ */
+export declare function canMoveTask(task: TaskRecord, to: TaskStatus): boolean;
+/**
+ * Whether the task still has an execution the runner has not settled. This —
+ * not the `running` column — is what "the runner owns this card" means: a card
+ * parked in `running` by hand has no session and stays fully movable.
+ */
+export declare function hasOpenExecution(task: TaskRecord): boolean;
 /** Normalize one optional execution-target string: trim; blank collapses to undefined. */
 export declare function normalizeTargetId(value: string | undefined): string | undefined;
 /**

package/lib/types/core/use-cases/task-tag.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Label-management use cases (issue: labels could not be cleaned up).
+ *
+ * A label lives on every task that carries it, so renaming or removing one is a
+ * ledger-wide edit, not a task edit: the board's label row is the union of the
+ * labels in use, and without these two transitions a label created by an
+ * afternoon experiment stayed on the board forever.
+ *
+ * Both transitions are pure ledger rewrites (no persistence, no notify — the
+ * controller and the Host ledger orchestrate those), and both are idempotent:
+ * a label that no task carries changes nothing and reports no error for the
+ * delete path (the desired end state already holds), while a rename from an
+ * unknown label is refused so a stale tab cannot silently do nothing.
+ *
+ * Renaming onto a name that is already in use MERGES the two: a task carrying
+ * both keeps the row it already had (with its execution hint) and loses the
+ * duplicate, which is the only reading that cannot lose a hint the user typed.
+ */
+import { type TaskRecord } from '../tasks.ts';
+/** Outcome of one ledger-wide label edit. */
+export interface TagEditResult {
+    /** The ledger after the edit, or the input unchanged when nothing applied. */
+    tasks: readonly TaskRecord[];
+    /** Whether any task actually changed (drives whether the caller persists). */
+    changed: boolean;
+    /** Refusal reason; the ledger is unchanged when set. */
+    error?: string;
+}
+/**
+ * Rename one label everywhere, merging into an existing label of the target
+ * name. Every touched task gets a fresh updatedAt; untouched tasks keep theirs.
+ * @param tasks - current ledger.
+ * @param from - the label to rename.
+ * @param to - the new name (an existing name merges the two labels).
+ * @param now - clock instant (ms epoch).
+ * @returns the rewritten ledger, or a refusal.
+ */
+export declare function applyRenameTag(tasks: readonly TaskRecord[], from: string, to: string, now: number): TagEditResult;
+/**
+ * Remove one label from every task that carries it. Archived cards are included:
+ * the board's label row draws from the whole ledger, so a label left on an
+ * archived card would come straight back into the filter.
+ * @param tasks - current ledger.
+ * @param name - the label to remove.
+ * @param now - clock instant (ms epoch).
+ * @returns the rewritten ledger.
+ */
+export declare function applyDeleteTag(tasks: readonly TaskRecord[], name: string, now: number): TagEditResult;

package/lib/types/core/use-cases/task-update.d.ts

@@ -15,7 +15,7 @@ import type { TaskHandoverInput } from '../handover.ts';
  * Editable fields on a task (the update patch surface). `freeze` replaces the
  * continuation-card snapshot (restamping frozenAt); an explicit null clears it.
  */
-export type TaskUpdatePatch = Partial<Pick<TaskRecord, 'title' | 'description' | 'prompt' | 'workspaceId' | 'mode' | 'permission' | 'model' | 'reuseSession' | 'teamRun' | 'goalRun'>> & {
+export type TaskUpdatePatch = Partial<Pick<TaskRecord, 'title' | 'description' | 'prompt' | 'workspaceId' | 'mode' | 'permission' | 'model' | 'reuseSession' | 'teamRun' | 'goalRun' | 'skipVerification'>> & {
     freeze?: FreezeSnapshot & {
         redacted?: boolean;
     } | null;
@@ -39,8 +39,10 @@ export declare const TASK_CONTENT_FIELDS: readonly ["title", "description", "pro
 export declare function hasContentPatch(patch: TaskUpdatePatch): boolean;
 /**
  * Whether a task's content may still be edited: the task must be on-board
- * (not archived) and must never have started executing. Fail-closed: a
- * running, settled, or cancelled-before-launch task keeps its content fixed.
+ * (not archived) and must never have started executing. Fail-closed: a task
+ * with any execution record — running, settled, or cancelled before launch —
+ * keeps its content fixed. The run, not the column, is the trigger: a card
+ * parked in 'running' by hand has nothing recorded yet and stays editable.
  */
 export declare function canEditTaskContent(task: TaskRecord): boolean;
 /**

package/lib/types/core/verification.d.ts

@@ -0,0 +1,386 @@
+/**
+ * Goal acceptance domain: the board's evaluator-backed certification layer for
+ * task executions that run in goal form.
+ *
+ * The board owns WHEN acceptance runs (the goal's completion gate), the
+ * per-cycle budget, the feedback it returns, the settlement rule and the
+ * report. The algorithm it runs is the DEFAULT final acceptance of the
+ * installed `dsh-llm-verifier` 0.8.4 (MIT), mirrored here rather than imported:
+ * that plugin is a third-party plugin, not a dependency of this repository, and
+ * a host half may only depend on the official `@deepseek-ai/*` SDK.
+ *
+ * Mirrored contract, byte-identical where the judge prompt depends on it:
+ * the three coding criteria of `DEFAULT_CRITERIA` (`CRITERIA_PRESETS.coding`),
+ * the 20-letter A-T scale, the required `<score_A>`/`<score_B>` verdict tags,
+ * the untrusted-evidence framing, `EMPTY_WORK_BASELINE` as candidate B, two
+ * rounds per criterion with the A/B slots swapped on the odd round, per-round
+ * scores mapped back to the caller's slots and averaged per criterion, and the
+ * pass rule `winner === 'A' && total >= threshold && every criterion >= threshold`.
+ *
+ * This module is framework-free (no cordis, no SDK imports) so the whole rule
+ * set is unit-testable in isolation; the model call itself lives in the host
+ * half (`src/host/verification-runner.ts`).
+ */
+/** Schema version of the persisted verification block (per execution record). */
+export declare const VERIFICATION_SCHEMA_VERSION: 1;
+/** Acceptance threshold mirrored from the verifier's `autoVerifyThreshold` default. */
+export declare const VERIFICATION_THRESHOLD = 0.65;
+/** Rounds per criterion: the verifier's `autoVerifyFinalRepeats` default. */
+export declare const VERIFICATION_ROUNDS = 2;
+/**
+ * Quality acceptances one goal completion cycle may spend: the first verdict,
+ * then one re-verification after the agent repaired the work. A second failure
+ * ends the cycle (see {@link MAX_EXCEPTION_ATTEMPTS} for the separate anomaly
+ * budget).
+ */
+export declare const MAX_QUALITY_ATTEMPTS = 2;
+/**
+ * Anomaly budget of one cycle. A timeout, an authentication failure or an
+ * unparseable judge answer is not a quality verdict, so it never consumes a
+ * quality attempt; it is still bounded, so an unusable judge route can never
+ * turn the completion gate into an unbounded retry loop.
+ */
+export declare const MAX_EXCEPTION_ATTEMPTS = 2;
+/** The fixed baseline a session acceptance measures itself against. */
+export declare const EMPTY_WORK_BASELINE = "(No useful work or verification was performed.)";
+/** Ground-truth note prepended to every judge prompt. */
+export declare const DEFAULT_GROUND_TRUTH_NOTE = "**IMPORTANT:** Focus on observed tool and terminal output as ground truth. Do NOT trust the agent's self-assessment or claims of success.";
+/** Injected-content guardrail shared by every judge prompt. */
+export declare const UNTRUSTED_EVIDENCE_NOTE: string;
+/** Role sentence for a completed-artifact review of a coding task. */
+export declare const EVALUATOR_ROLE = "You are an expert evaluator of AI coding agents. You will see a task description and two agent trajectories, then evaluate them on ONE specific criterion, stated at the end.";
+/** The 20-point A-T scale, mirrored from the verifier. */
+export declare const GRANULARITY = 20;
+/** One criterion of the coding rubric. */
+export interface VerificationCriterion {
+    id: string;
+    name: string;
+    description: string;
+}
+/** The coding rubric, identical to the verifier's `DEFAULT_CRITERIA`. */
+export declare const CODING_CRITERIA: readonly VerificationCriterion[];
+/** Rating scale text rendered into every judge prompt. */
+export declare const SCALE_DESCRIPTION: string;
+/** A-T letters in scale order (A = best). */
+export declare const LETTERS: readonly string[];
+/**
+ * Normalize one score token to an A-T letter.
+ * @param token - the raw captured token.
+ * @returns the uppercase letter, or undefined when it is not one of A-T.
+ */
+export declare function normalizeScoreLetter(token: string): string | undefined;
+/** Numeric value of one A-T letter (A = 20 ... T = 1). */
+export declare function letterValue(letter: string): number;
+/**
+ * Read the LAST `<tag> LETTER </tag>` verdict out of one judge answer.
+ *
+ * The tag contract is the verifier's explicit-tag channel: this deployment's
+ * only scoring channel, because the official DSH adapters expose no token
+ * logprobs (the verifier's direct top-logprob transport needs a capability the
+ * public SDK does not carry). A missing or unusable tag is an exception, never
+ * a score: the verdict stays fail-closed.
+ * @param text - the raw judge answer.
+ * @param tag - the tag name, e.g. `score_A`.
+ * @returns the score in 0..1 (A = 1.0, T = 0.0).
+ * @throws Error when the answer carries no valid A-T verdict for this tag.
+ */
+export declare function extractScore(text: string, tag: string): number;
+/**
+ * Render one untrusted content block with deterministic nonce-tagged delimiters.
+ * @param tag - block tag.
+ * @param token - content-derived delimiter token.
+ * @param content - the untrusted content.
+ * @returns the wrapped block.
+ */
+export declare function renderDelimitedBlock(tag: string, token: string, content: string): string;
+/**
+ * Deterministic per-prompt delimiter token (FNV-1a, same construction as the
+ * verifier's). Not random: the token must depend on the whole content so that
+ * identical inputs render an identical prompt while injected text cannot
+ * predict the terminator.
+ * @param parts - the content parts.
+ * @returns a short base-36 token.
+ */
+export declare function evidenceNonce(...parts: readonly string[]): string;
+/**
+ * One pairwise judge prompt focused on a single criterion.
+ *
+ * Everything that does not depend on the criterion comes first and only the
+ * criterion varies at the tail, so a prefix-caching backend serves the
+ * evidence-heavy body from cache across the criteria of one acceptance.
+ * @param problem - the task statement.
+ * @param traceA - candidate A's trajectory.
+ * @param traceB - candidate B's trajectory.
+ * @param criterion - the criterion this call scores.
+ * @param groundTruthNote - note prepended to every judge prompt.
+ * @param context - optional reference context (the host's own record of what
+ *   changed on disk), rendered as its own data-only block between the task and
+ *   the two candidates. Omitted renders nothing, which keeps the prompt
+ *   byte-identical for a deployment that serves no change service.
+ * @returns the rendered prompt.
+ */
+export declare function buildAcceptancePrompt(problem: string, traceA: string, traceB: string, criterion: VerificationCriterion, groundTruthNote?: string, context?: string): string;
+/** Where the judge route of one execution came from. */
+export type VerificationRouteSource = 'inherit' | 'explicit';
+/** The resolved judge route of one execution's acceptance. */
+export interface VerificationRoute {
+    provider: string;
+    model: string;
+    reasoningEffort?: string;
+}
+/** One reasoning-effort option an adapter exposes for an exact model route. */
+export interface CatalogReasoningEffort {
+    id: string;
+    name?: string;
+}
+/** One adapter-discovered model of the host catalog. */
+export interface CatalogModel {
+    id: string;
+    name?: string;
+    reasoning?: {
+        efforts: CatalogReasoningEffort[];
+        defaultEffort?: string;
+    };
+}
+/** One provider route and its models. */
+export interface CatalogGroup {
+    id: string;
+    name?: string;
+    models: CatalogModel[];
+}
+/** The host model catalog the acceptance settings resolve against. */
+export interface ModelCatalogView {
+    /** The route an unconfigured session starts at: the host's own configuration. */
+    default?: VerificationRoute;
+    groups: CatalogGroup[];
+}
+/** The acceptance settings as the configuration holds them. */
+export interface VerificationSettings {
+    enabled: boolean;
+    /** Qualified provider/model route, or '' to inherit the host default. */
+    model: string;
+    /** Reasoning effort id, or '' to inherit. */
+    reasoningEffort: string;
+}
+/** The acceptance configuration frozen when one execution started. */
+export interface VerificationContract {
+    /** Whether acceptance is required for this execution (the switch at start time). */
+    enabled: boolean;
+    /** Whether the judge model came from the host default or from configuration. */
+    modelSource: VerificationRouteSource;
+    /** Resolved judge route; absent when the deployment serves no model catalog. */
+    route?: VerificationRoute;
+    /** The reasoning effort configuration asked for, when it named one. */
+    requestedEffort?: string;
+    /**
+     * Set when an explicitly configured reasoning effort is not supported by the
+     * resolved model: the incompatible value is NOT sent, and the acceptance runs
+     * on `resolved` (the model's own default when that is defined).
+     */
+    effortFallback?: {
+        requested: string;
+        resolved?: string;
+    };
+    /** Rubric preset. The first version always judges with the coding criteria. */
+    preset: 'coding';
+    /** Acceptance threshold frozen with the contract. */
+    threshold: number;
+}
+/** One criterion's verdict inside an acceptance attempt. */
+export interface VerificationCriterionScore {
+    id: string;
+    name: string;
+    /** Score of the task's own work (0..1). */
+    score: number;
+    /** Score of the empty-work baseline in the same comparison. */
+    baseline: number;
+    threshold: number;
+    passed: boolean;
+}
+/** Token accounting of one acceptance attempt. */
+export interface VerificationUsage {
+    calls: number;
+    inputTokens: number;
+    outputTokens: number;
+    reasoningTokens: number;
+    /** At least one call's usage was unknown; the counts are a floor. */
+    usageIncomplete?: boolean;
+}
+/** Scope of the evidence one attempt judged. */
+export interface VerificationEvidenceSummary {
+    /** Characters handed to the judge after redaction. */
+    chars: number;
+    /** Characters dropped by the total cap (the newest text is kept). */
+    omittedCharacters: number;
+    /** Trace entries rendered. */
+    entries: number;
+    /** Sequence window the evidence was read from. */
+    fromSeq?: number;
+    toSeq?: number;
+    /** Digest of the judged evidence; the pass record is bound to it. */
+    hash: string;
+    /** Files of host-observed workspace changes rendered into the prompt (0 = none). */
+    workspaceFiles?: number;
+}
+/** One recorded acceptance attempt: a quality verdict or an anomaly. */
+export interface VerificationAttempt {
+    /** 1-based ordinal within its own stage. */
+    index: number;
+    /** When the attempt ran (ms epoch). */
+    at: number;
+    stage: 'quality' | 'exception';
+    /** Quality: whether the work passed. A recorded anomaly is never a pass. */
+    passed: boolean;
+    /** Total score of the task's own work (0 for an anomaly). */
+    score: number;
+    /** Score of the empty-work baseline. */
+    baseline: number;
+    criteria: VerificationCriterionScore[];
+    /** Bounded, locatable feedback for the agent. */
+    findings: string[];
+    usage: VerificationUsage;
+    evidence: VerificationEvidenceSummary;
+    route: VerificationRoute;
+    /** Scoring channel that answered. This deployment serves explicit tags only. */
+    channel: 'explicit-tag';
+    rounds: number;
+    /** Anomaly reason; absent on a quality verdict. */
+    error?: string;
+}
+/** Persisted acceptance state of one execution. */
+export interface ExecutionVerification {
+    contract: VerificationContract;
+    attempts: VerificationAttempt[];
+    /** True while an acceptance is running, so the board can show 验收中. */
+    inFlight?: boolean;
+    /**
+     * Why this execution may not settle as succeeded without a pass record:
+     * `disabled` when the switch was off at start, `skipped` when the CARD opted
+     * out of the gate (`TaskRecord.skipVerification`), `goal-unavailable` when
+     * the run never became a goal run (so no completion gate could ever fire),
+     * and `team-member` for a teammate execution (the Lead's acceptance covers
+     * the team's aggregated evidence).
+     */
+    applicability: 'enforced' | 'disabled' | 'skipped' | 'goal-unavailable' | 'team-member';
+    /** Set when the cycle is spent and the execution must fail. */
+    failedReason?: string;
+    failedAt?: number;
+}
+/** UI/board phase of one execution's acceptance. */
+export type VerificationPhase = 'off' | 'executing' | 'verifying' | 'repairing' | 'passed' | 'failed';
+/** Quality attempts spent by this cycle. */
+export declare function qualityAttempts(verification: ExecutionVerification | undefined): VerificationAttempt[];
+/** Anomaly attempts spent by this cycle. */
+export declare function exceptionAttempts(verification: ExecutionVerification | undefined): VerificationAttempt[];
+/** The quality attempt that passed, when one did. */
+export declare function passedAttempt(verification: ExecutionVerification | undefined): VerificationAttempt | undefined;
+/**
+ * Whether the board requires a matching pass record before this execution may
+ * settle as succeeded. False when acceptance was off at start, and false for a
+ * run that never became a goal run or for a teammate execution — those settle
+ * on their own verdict, which is why {@link ExecutionVerification.applicability}
+ * is persisted rather than re-derived.
+ * @param verification - the execution's persisted acceptance state.
+ * @returns true when a pass record is required.
+ */
+export declare function verificationRequired(verification: ExecutionVerification | undefined): boolean;
+/** Whether this cycle still has quality budget left. */
+export declare function hasQualityBudget(verification: ExecutionVerification | undefined): boolean;
+/** Whether this cycle still has anomaly budget left. */
+export declare function hasExceptionBudget(verification: ExecutionVerification | undefined): boolean;
+/** Derived board phase of one execution's acceptance. */
+export declare function verificationPhase(verification: ExecutionVerification | undefined): VerificationPhase;
+/**
+ * The acceptance rule, mirrored from the verifier's `sessionAccepted`:
+ * the work must BEAT the empty-work baseline, reach the total threshold, and
+ * reach the threshold on every criterion. A tie or a loss against the baseline
+ * fails, so a session indistinguishable from the baseline can never pass.
+ * @param score - total score of the task's own work.
+ * @param baseline - total score of the empty-work baseline.
+ * @param criteria - per-criterion scores of the task's own work.
+ * @param threshold - acceptance threshold.
+ * @returns true when the work passes.
+ */
+export declare function acceptancePassed(score: number, baseline: number, criteria: readonly {
+    score: number;
+}[], threshold: number): boolean;
+/**
+ * Repair a persisted acceptance block, or drop it.
+ *
+ * Deliberately fail-soft on the FIELD and fail-closed on the VERDICT: a block
+ * that does not parse is dropped (the execution keeps its own record, and the
+ * board then treats the execution as unverified), while a block that does parse
+ * keeps every recorded attempt verbatim. Dropping a malformed block can only
+ * make the board MORE strict, never less.
+ * @param value - the persisted value.
+ * @returns the repaired block, or undefined when it is unusable.
+ */
+export declare function normalizeVerification(value: unknown): ExecutionVerification | undefined;
+/** Totals spanning every attempt of one execution (for the report and the card). */
+export interface VerificationTotals {
+    quality: number;
+    exceptions: number;
+    calls: number;
+    inputTokens: number;
+    outputTokens: number;
+    reasoningTokens: number;
+    usageIncomplete: boolean;
+}
+/** Sum the attempts of one execution. */
+export declare function verificationTotals(verification: ExecutionVerification | undefined): VerificationTotals;
+/**
+ * The failure feedback one acceptance returns to the fixing agent. It names
+ * what failed, with the numbers, the locator lines the judge reported and the
+ * remaining budget, so the next round can act on it instead of restating the
+ * work.
+ * @param attempt - the failed quality attempt.
+ * @param remaining - quality attempts still available after this one.
+ * @returns the model-facing feedback text.
+ */
+export declare function qualityFeedback(attempt: VerificationAttempt, remaining: number): string;
+/**
+ * The reason one exhausted acceptance cycle records as the execution's final
+ * failure. Unlike {@link qualityFeedback} — which the fixing agent reads while
+ * budget remains — this reason is also persisted on the ledger, echoed on every
+ * later completion attempt and shown on the card, so it carries the full
+ * picture: the scores, the baseline comparison, every failing criterion and the
+ * judge's locatable findings, so a later agent (or the user) can act on WHAT to
+ * improve, not only on how badly the attempt scored.
+ * @param attempt - the failed quality attempt that spent the last budget.
+ * @param used - quality attempts spent by the cycle.
+ * @param threshold - the contract threshold the work was judged against.
+ * @returns the model- and user-facing failure reason.
+ */
+export declare function finalFailureReason(attempt: VerificationAttempt, used: number, threshold: number): string;
+/** `0.42` style percentage. */
+export declare function percent(value: number): string;
+/** Split a qualified `provider/model` route; undefined when it is not one. */
+export declare function parseModelRoute(qualified: string | undefined): {
+    provider: string;
+    model: string;
+} | undefined;
+/**
+ * Normalize the raw `session/modelCatalog` reply into the shape the acceptance
+ * settings read. Everything is optional in the wire value, so every level is
+ * checked: an unreadable catalog degrades to "unknown", never to a crash.
+ * @param value - the raw gateway reply.
+ * @returns the normalized catalog, or undefined when nothing usable arrived.
+ */
+export declare function normalizeCatalog(value: unknown): ModelCatalogView | undefined;
+/** Whether the catalog declares the route at all. */
+export declare function catalogHasRoute(catalog: ModelCatalogView | undefined, provider: string, model: string): boolean;
+/**
+ * Resolve the acceptance configuration into the contract one execution freezes.
+ *
+ * "Inherit host" means the host's own model catalog default, never the card's
+ * pinned execution model. An explicitly configured reasoning effort is sent
+ * ONLY when the target model's adapter declares it: an unsupported value is
+ * dropped instead of being passed through, and the fallback to the target
+ * model's own default is recorded so the settings card and the report can show
+ * exactly what will be sent.
+ * @param settings - the live configuration.
+ * @param catalog - the host model catalog, when this cohort serves one.
+ * @param threshold - acceptance threshold to freeze.
+ * @returns the contract.
+ */
+export declare function resolveContract(settings: VerificationSettings, catalog: ModelCatalogView | undefined, threshold?: number): VerificationContract;