@martinloop/mcp 0.3.9 → 0.5.0

package/dist/vendor/core/context-chain-gate.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Context Chain Gate — C1
+ *
+ * Converts chain verification evidence into a merge-gate decision and
+ * a PR comment (Infracost-style). Two things hard-fail. Everything else
+ * is configurable or comment-only.
+ *
+ * Hard failures (always block merge):
+ *   1. no_governance_receipt — no receipt at all
+ *   2. tamper_detected       — receipt hash does not match producer run
+ *
+ * Configurable gate (team decides; default: warn only):
+ *   3. verifier_failed — unverified claims, incomplete integrity,
+ *                        missing artifacts, unresolved assumptions
+ *
+ * Comment-only (never block, always visible):
+ *   - Cost: actual vs budget — money is already spent, blocking adds friction
+ *   - Chain lineage: chainId, producerRunId, consumerRunId
+ *   - Integrity state
+ *
+ * Standing rules:
+ *   - Pure functions, no side effects.
+ *   - evaluateChainGate never reads environment variables or config files.
+ *   - renderGatePrComment produces valid GitHub-flavored markdown.
+ *   - No fake data, no placeholder behaviour.
+ */
+import type { ContextHandoffReceipt } from "../contracts/index.js";
+import type { ChainIntegrityState, ContextHandoffVerification } from "../contracts/index.js";
+export interface ChainGateConfig {
+    /**
+     * When true, a failed verifier (unverified claims, incomplete integrity,
+     * missing artifacts, unresolved assumptions) blocks the merge.
+     * Default: false — warn in PR comment, do not block.
+     */
+    blockOnVerifierFailure: boolean;
+}
+export interface ChainGateCost {
+    actualUsd: number;
+    budgetUsd: number;
+}
+export interface ChainGateInput {
+    /** null means no receipt was provided — triggers the hard no_governance_receipt failure. */
+    receipt: ContextHandoffReceipt | null;
+    /** null when receipt is null. Must be provided when receipt is non-null. */
+    verification: ContextHandoffVerification | null;
+    cost?: ChainGateCost;
+    config?: Partial<ChainGateConfig>;
+}
+export type ChainGateConclusion = "failure" | "neutral" | "success";
+export interface ChainGateResult {
+    noGovernance: boolean;
+    tamperDetected: boolean;
+    verifierFailed: boolean;
+    shouldBlock: boolean;
+    conclusion: ChainGateConclusion;
+    failureReasonCode?: string;
+    failureMessage?: string;
+    cost?: ChainGateCost & {
+        exceeded: boolean;
+    };
+    integrity: ChainIntegrityState | "absent";
+}
+/**
+ * Evaluates whether the chain gate should block merge, and assembles
+ * the data needed for the PR comment.
+ *
+ * Call order:
+ *   1. Check for missing receipt (hard fail).
+ *   2. Check for tamper_detected integrity (hard fail).
+ *   3. Check verifier result against config (configurable gate).
+ *   4. Return success / neutral with full comment data.
+ */
+export declare function evaluateChainGate(input: ChainGateInput): ChainGateResult;
+export interface GatePrCommentOptions {
+    runId?: string;
+    chainId?: string;
+    handoffId?: string;
+    producerRunId?: string;
+    prNumber?: number;
+    headSha?: string;
+}
+/**
+ * Renders an Infracost-style GitHub PR comment summarising the gate result.
+ *
+ * Hard failures and cost overruns are shown prominently.
+ * Cost is always present when provided — never omitted, never a blocking signal.
+ * Lineage fields (chainId, producerRunId, runId) provide audit trail links.
+ */
+export declare function renderGatePrComment(result: ChainGateResult, options?: GatePrCommentOptions): string;

package/dist/vendor/core/context-chain-gate.js

@@ -0,0 +1,173 @@
+/**
+ * Context Chain Gate — C1
+ *
+ * Converts chain verification evidence into a merge-gate decision and
+ * a PR comment (Infracost-style). Two things hard-fail. Everything else
+ * is configurable or comment-only.
+ *
+ * Hard failures (always block merge):
+ *   1. no_governance_receipt — no receipt at all
+ *   2. tamper_detected       — receipt hash does not match producer run
+ *
+ * Configurable gate (team decides; default: warn only):
+ *   3. verifier_failed — unverified claims, incomplete integrity,
+ *                        missing artifacts, unresolved assumptions
+ *
+ * Comment-only (never block, always visible):
+ *   - Cost: actual vs budget — money is already spent, blocking adds friction
+ *   - Chain lineage: chainId, producerRunId, consumerRunId
+ *   - Integrity state
+ *
+ * Standing rules:
+ *   - Pure functions, no side effects.
+ *   - evaluateChainGate never reads environment variables or config files.
+ *   - renderGatePrComment produces valid GitHub-flavored markdown.
+ *   - No fake data, no placeholder behaviour.
+ */
+const DEFAULT_CONFIG = {
+    blockOnVerifierFailure: false
+};
+// ─── Gate evaluation ─────────────────────────────────────────────────────────
+/**
+ * Evaluates whether the chain gate should block merge, and assembles
+ * the data needed for the PR comment.
+ *
+ * Call order:
+ *   1. Check for missing receipt (hard fail).
+ *   2. Check for tamper_detected integrity (hard fail).
+ *   3. Check verifier result against config (configurable gate).
+ *   4. Return success / neutral with full comment data.
+ */
+export function evaluateChainGate(input) {
+    const config = { ...DEFAULT_CONFIG, ...input.config };
+    const costResult = input.cost !== undefined
+        ? { ...input.cost, exceeded: input.cost.actualUsd > input.cost.budgetUsd }
+        : undefined;
+    // ── Hard fail 1: no governance receipt ───────────────────────────────────
+    if (input.receipt === null || input.verification === null) {
+        return {
+            noGovernance: true,
+            tamperDetected: false,
+            verifierFailed: false,
+            shouldBlock: true,
+            conclusion: "failure",
+            failureReasonCode: "no_governance_receipt",
+            failureMessage: "No MartinLoop governance receipt was found for this run. " +
+                "Every AI-authored PR must carry a verified governance receipt.",
+            integrity: "absent",
+            ...(costResult !== undefined ? { cost: costResult } : {})
+        };
+    }
+    const integrity = input.verification.integrity;
+    // ── Hard fail 2: tampered receipt ─────────────────────────────────────────
+    if (integrity === "tamper_detected") {
+        return {
+            noGovernance: false,
+            tamperDetected: true,
+            verifierFailed: false,
+            shouldBlock: true,
+            conclusion: "failure",
+            failureReasonCode: "tamper_detected",
+            failureMessage: "Governance receipt integrity check failed: tamper detected. " +
+                "The receipt hash does not match the producer run record.",
+            integrity,
+            ...(costResult !== undefined ? { cost: costResult } : {})
+        };
+    }
+    // ── Configurable gate: verifier failed ───────────────────────────────────
+    const verifierFailed = !input.verification.ok;
+    const blockOnVerifier = verifierFailed && config.blockOnVerifierFailure;
+    if (blockOnVerifier) {
+        const first = input.verification.reasons[0];
+        return {
+            noGovernance: false,
+            tamperDetected: false,
+            verifierFailed: true,
+            shouldBlock: true,
+            conclusion: "failure",
+            failureReasonCode: first?.code ?? "verifier_failed",
+            failureMessage: first?.message ?? "Context chain verification failed.",
+            integrity,
+            ...(costResult !== undefined ? { cost: costResult } : {})
+        };
+    }
+    // ── Pass (or warn-only verifier failure) ──────────────────────────────────
+    return {
+        noGovernance: false,
+        tamperDetected: false,
+        verifierFailed,
+        shouldBlock: false,
+        conclusion: verifierFailed ? "neutral" : "success",
+        integrity,
+        ...(costResult !== undefined ? { cost: costResult } : {})
+    };
+}
+/**
+ * Renders an Infracost-style GitHub PR comment summarising the gate result.
+ *
+ * Hard failures and cost overruns are shown prominently.
+ * Cost is always present when provided — never omitted, never a blocking signal.
+ * Lineage fields (chainId, producerRunId, runId) provide audit trail links.
+ */
+export function renderGatePrComment(result, options = {}) {
+    const lines = [];
+    lines.push("## MartinLoop Governance");
+    lines.push("");
+    // Status headline
+    if (result.noGovernance) {
+        lines.push("🚫 **No governance receipt** — merge is blocked.");
+    }
+    else if (result.tamperDetected) {
+        lines.push("🚫 **Tampered receipt** — merge is blocked.");
+    }
+    else if (result.verifierFailed && result.shouldBlock) {
+        lines.push("⚠️ **Verifier failed** — merge is blocked (configured as required).");
+    }
+    else if (result.verifierFailed) {
+        lines.push("⚠️ **Verifier warnings** — merge is permitted, review recommended.");
+    }
+    else {
+        lines.push("✅ **Governance verified** — chain integrity confirmed.");
+    }
+    lines.push("");
+    lines.push("| Signal | Value | Status |");
+    lines.push("|--------|-------|--------|");
+    // Chain integrity
+    const integrityIcon = result.integrity === "verified"
+        ? "✅"
+        : result.integrity === "absent" || result.integrity === "tamper_detected"
+            ? "🚫"
+            : "⚠️";
+    lines.push(`| Chain integrity | \`${result.integrity}\` | ${integrityIcon} |`);
+    // Cost — always comment-only, never a block signal
+    if (result.cost !== undefined) {
+        const { actualUsd, budgetUsd, exceeded } = result.cost;
+        const costIcon = exceeded ? "⚠️" : "✅";
+        const delta = actualUsd - budgetUsd;
+        const costNote = exceeded
+            ? `over budget (+$${delta.toFixed(4)})`
+            : "within budget";
+        lines.push(`| Cost | \`$${actualUsd.toFixed(4)}\` / \`$${budgetUsd.toFixed(4)}\` | ${costIcon} ${costNote} |`);
+    }
+    // Lineage (audit trail, never a block signal)
+    if (options.chainId) {
+        lines.push(`| Chain ID | \`${options.chainId}\` | ℹ️ |`);
+    }
+    if (options.handoffId) {
+        lines.push(`| Handoff ID | \`${options.handoffId}\` | ℹ️ |`);
+    }
+    if (options.producerRunId) {
+        lines.push(`| Producer run | \`${options.producerRunId}\` | ℹ️ |`);
+    }
+    if (options.runId) {
+        lines.push(`| Consumer run | \`${options.runId}\` | ℹ️ |`);
+    }
+    // Failure detail
+    if (result.failureMessage) {
+        lines.push("");
+        lines.push(`> **Failure:** ${result.failureMessage}`);
+    }
+    lines.push("");
+    lines.push("_Powered by [MartinLoop](https://github.com/Keesan12/martin-loop) governance gate_");
+    return lines.join("\n");
+}

package/dist/vendor/core/context-compiler.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Context Compiler — A-CTX-1
+ *
+ * Deterministic working-set selector. Given a set of ContextObject candidates,
+ * a budget, a policy, and an explicit nowMs, produces a ContextManifest whose
+ * hash is identical for identical inputs on any platform.
+ *
+ * Shadow mode: the manifest is computed and emitted but the original provider
+ * packet is returned byte-for-byte unchanged.
+ *
+ * Standing invariants:
+ *   - nowMs is ALWAYS a captured input — never Date.now() internally
+ *   - No raw source text in manifest or ledger receipt — hashes and counts only
+ *   - No confidence float, no outcome_delta — both permanently banned
+ *   - Fault budget accumulates by taskId, not runId
+ *   - required-over-budget is an explicit failure, never a silent drop
+ *   - MAX_RENDER_PASSES = 5 — hard constant
+ */
+import type { ContextBudget, ContextLedgerEntry, ContextManifest, ContextObject, ContextPolicy } from "../contracts/index.js";
+export declare const MAX_RENDER_PASSES = 5;
+/**
+ * Minimal adapter interface for token recounting.
+ * Implementations may call the provider SDK's token counter.
+ * Must not make network calls to the provider inference endpoint.
+ */
+export interface ContextAdapter {
+    readonly version: string;
+    /** Recount the actual rendered tokens for a serialized text segment. */
+    recountTokens(text: string): number;
+}
+/** Fallback adapter: char÷4 heuristic, no external calls. */
+export declare const HEURISTIC_ADAPTER: ContextAdapter;
+export interface CompileContextInput {
+    taskId: string;
+    runId: string;
+    /** Must be a captured value — never call Date.now() inside the compiler. */
+    nowMs: number;
+    candidates: readonly ContextObject[];
+    budget: ContextBudget;
+    policy: ContextPolicy;
+    adapter: ContextAdapter;
+}
+export type CompileContextOutput = {
+    ok: true;
+    manifest: ContextManifest;
+    ledgerEntry: ContextLedgerEntry;
+} | {
+    ok: false;
+    reason: "required_over_budget" | "recount_exceeded_passes";
+    manifest: null;
+    ledgerEntry: null;
+};
+export declare function compileContext(input: CompileContextInput): CompileContextOutput;

package/dist/vendor/core/context-compiler.js

@@ -0,0 +1,261 @@
+/**
+ * Context Compiler — A-CTX-1
+ *
+ * Deterministic working-set selector. Given a set of ContextObject candidates,
+ * a budget, a policy, and an explicit nowMs, produces a ContextManifest whose
+ * hash is identical for identical inputs on any platform.
+ *
+ * Shadow mode: the manifest is computed and emitted but the original provider
+ * packet is returned byte-for-byte unchanged.
+ *
+ * Standing invariants:
+ *   - nowMs is ALWAYS a captured input — never Date.now() internally
+ *   - No raw source text in manifest or ledger receipt — hashes and counts only
+ *   - No confidence float, no outcome_delta — both permanently banned
+ *   - Fault budget accumulates by taskId, not runId
+ *   - required-over-budget is an explicit failure, never a silent drop
+ *   - MAX_RENDER_PASSES = 5 — hard constant
+ */
+import { createHash } from "node:crypto";
+import { CONTEXT_LEDGER_VERSION, CONTEXT_MANIFEST_VERSION } from "../contracts/index.js";
+// ─── Constants ────────────────────────────────────────────────────────────────
+export const MAX_RENDER_PASSES = 5;
+/** Fallback adapter: char÷4 heuristic, no external calls. */
+export const HEURISTIC_ADAPTER = {
+    version: "heuristic@1",
+    recountTokens: (text) => text.length === 0 ? 0 : Math.max(1, Math.ceil(Buffer.byteLength(text, "utf8") / 4))
+};
+// ─── Helpers ──────────────────────────────────────────────────────────────────
+function sha256(value) {
+    return createHash("sha256").update(value, "utf8").digest("hex");
+}
+function canonicalize(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalize);
+    if (value !== null && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value)
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([k, v]) => [k, canonicalize(v)]));
+    }
+    return value;
+}
+function canonicalJson(value) {
+    return JSON.stringify(canonicalize(value));
+}
+/** Priority order for selection: required → pinned → high → normal → low */
+const PRIORITY_RANK = {
+    required: 0,
+    high: 2,
+    normal: 3,
+    low: 4
+};
+/** Pinned objects slot between required and high. */
+function selectionRank(obj) {
+    if (obj.priority === "required")
+        return 0;
+    if (obj.pinnedBy !== undefined)
+        return 1;
+    return PRIORITY_RANK[obj.priority];
+}
+// ─── Compiler ────────────────────────────────────────────────────────────────
+export function compileContext(input) {
+    const { taskId, runId, nowMs, candidates, budget, policy, adapter } = input;
+    // ── Eligibility filter — policy-denied objects become governed exclusion records ──
+    //
+    // A-CTX-2 fix: denied objects must NOT silently disappear. They enter decisions[]
+    // as "excluded" with a reason code so the exclusion is visible as governed evidence.
+    // executableContext = admittedObjects only; ledgerDecisions = admitted + excluded.
+    const policyExcluded = [];
+    const eligibleList = [];
+    for (const obj of candidates) {
+        if (policy.deniedSensitivities.includes(obj.sensitivity)) {
+            policyExcluded.push({
+                objectId: obj.id,
+                decision: "excluded",
+                reason: `sensitivity_denied:${obj.sensitivity}`
+            });
+        }
+        else if (policy.deniedTrustLevels.includes(obj.trust)) {
+            policyExcluded.push({
+                objectId: obj.id,
+                decision: "excluded",
+                reason: `trust_denied:${obj.trust}`
+            });
+        }
+        else {
+            eligibleList.push(obj);
+        }
+    }
+    const eligible = eligibleList;
+    // ── Compute compilerInputHash ────────────────────────────────────────────
+    const inputFingerprint = {
+        taskId,
+        runId,
+        nowMs,
+        adapterVersion: adapter.version,
+        policyHash: policy.policyHash,
+        budget: {
+            modelWindowTokens: budget.modelWindowTokens,
+            maxWorkingSetTokens: budget.maxWorkingSetTokens,
+            pinnedTokensMax: budget.pinnedTokensMax
+        },
+        candidateIds: eligible.map((o) => o.id).sort()
+    };
+    // ── Pinned token cap ─────────────────────────────────────────────────────
+    const pinnedTokensTotal = eligible
+        .filter((o) => o.pinnedBy !== undefined)
+        .reduce((s, o) => s + o.estimatedTokens, 0);
+    if (pinnedTokensTotal > budget.pinnedTokensMax) {
+        // Fail-closed: reject the entire batch, not individual pins
+        return { ok: false, reason: "required_over_budget", manifest: null, ledgerEntry: null };
+    }
+    // ── Sort by selection rank, then objectId as stable tie-breaker ──────────
+    const sorted = [...eligible].sort((a, b) => {
+        const rankDiff = selectionRank(a) - selectionRank(b);
+        if (rankDiff !== 0)
+            return rankDiff;
+        // Stable tie-breaker: objectId lexicographic
+        return a.id < b.id ? -1 : a.id > b.id ? 1 : 0;
+    });
+    // ── Selection pass ───────────────────────────────────────────────────────
+    let remaining = budget.maxWorkingSetTokens;
+    const decisions = [];
+    let requiredOverBudget = false;
+    // Required objects total token check first
+    const requiredTokens = sorted
+        .filter((o) => o.priority === "required")
+        .reduce((s, o) => s + o.estimatedTokens, 0);
+    if (requiredTokens > remaining) {
+        requiredOverBudget = true;
+        if (policy.requiredOverBudgetAction === "fail_closed") {
+            return { ok: false, reason: "required_over_budget", manifest: null, ledgerEntry: null };
+        }
+        // explicit_escalation: record and continue — all required marked excluded
+    }
+    for (const obj of sorted) {
+        const isRequired = obj.priority === "required";
+        if (requiredOverBudget && isRequired) {
+            decisions.push({
+                objectId: obj.id,
+                decision: "excluded",
+                reason: "required_over_budget"
+            });
+            continue;
+        }
+        if (obj.estimatedTokens <= remaining) {
+            decisions.push({
+                objectId: obj.id,
+                decision: "included",
+                reason: isRequired ? "required" : obj.pinnedBy !== undefined ? "pinned" : "within_budget"
+            });
+            remaining -= obj.estimatedTokens;
+        }
+        else {
+            // Attempt truncation for required/pinned, exclude otherwise
+            if (isRequired || obj.pinnedBy !== undefined) {
+                decisions.push({
+                    objectId: obj.id,
+                    decision: "included_truncated",
+                    truncatedFromTokens: obj.estimatedTokens,
+                    reason: isRequired ? "required_truncated" : "pinned_truncated"
+                });
+                // Truncated objects consume whatever is left
+                remaining = 0;
+            }
+            else {
+                decisions.push({
+                    objectId: obj.id,
+                    decision: "excluded",
+                    reason: "budget_exhausted"
+                });
+            }
+        }
+    }
+    // ── Adapter recount (up to MAX_RENDER_PASSES) ────────────────────────────
+    const includedDecisions = decisions.filter((d) => d.decision === "included" || d.decision === "included_truncated");
+    let totalRenderedTokens = 0;
+    let renderPasses = 0;
+    let recountConverged = false;
+    const includedObjects = new Map(eligible.map((o) => [o.id, o]));
+    for (let pass = 0; pass < MAX_RENDER_PASSES; pass++) {
+        renderPasses = pass + 1;
+        let passTotal = 0;
+        for (const d of includedDecisions) {
+            const obj = includedObjects.get(d.objectId);
+            if (!obj)
+                continue;
+            // In shadow mode we use the contentHash as a proxy text for recounting
+            const recounted = adapter.recountTokens(obj.contentHash);
+            d.renderedTokens = recounted;
+            passTotal += recounted;
+        }
+        if (passTotal === totalRenderedTokens && pass > 0) {
+            recountConverged = true;
+            break;
+        }
+        totalRenderedTokens = passTotal;
+        if (pass === 0)
+            recountConverged = false;
+    }
+    if (!recountConverged && renderPasses >= MAX_RENDER_PASSES) {
+        return { ok: false, reason: "recount_exceeded_passes", manifest: null, ledgerEntry: null };
+    }
+    // ── Merge policy exclusions — excluded objects precede selection decisions ──
+    //
+    // A-CTX-2: executableContext = admittedObjects (decisions[]);
+    //          ledgerDecisions   = [...policyExcluded, ...decisions]
+    // Policy-excluded objects never enter the admitted working set, but their
+    // exclusion is visible as governed evidence in the manifest and ledger.
+    const allDecisions = [...policyExcluded, ...decisions];
+    // ── Manifest hash ────────────────────────────────────────────────────────
+    const manifestHashInput = canonicalJson({
+        adapterVersion: adapter.version,
+        budget: inputFingerprint.budget,
+        decisions: allDecisions.map((d) => ({
+            decision: d.decision,
+            objectId: d.objectId,
+            reason: d.reason,
+            ...(d.truncatedFromTokens !== undefined
+                ? { truncatedFromTokens: d.truncatedFromTokens }
+                : {})
+        })),
+        nowMs,
+        policyHash: policy.policyHash,
+        runId,
+        taskId,
+        totalRenderedTokens
+    });
+    const manifestHash = sha256(manifestHashInput);
+    const compilationDurationMs = 0; // In shadow mode: nowMs is frozen; duration is metadata-only
+    const manifest = {
+        schemaVersion: CONTEXT_MANIFEST_VERSION,
+        manifestHash,
+        taskId,
+        runId,
+        nowMs,
+        adapterVersion: adapter.version,
+        policyHash: policy.policyHash,
+        budget,
+        decisions: allDecisions,
+        totalRenderedTokens,
+        renderPasses,
+        compilationDurationMs
+    };
+    const totalIncluded = allDecisions.filter((d) => d.decision === "included" || d.decision === "included_truncated").length;
+    const totalExcluded = allDecisions.filter((d) => d.decision === "excluded").length;
+    const totalFaultLoaded = allDecisions.filter((d) => d.decision === "fault_loaded").length;
+    const ledgerEntry = {
+        schemaVersion: CONTEXT_LEDGER_VERSION,
+        entryType: "context",
+        taskId,
+        runId,
+        manifestHash,
+        totalIncluded,
+        totalExcluded,
+        totalFaultLoaded,
+        overflowCount: requiredOverBudget ? 1 : 0,
+        faultBudgetUsed: 0,
+        adapterVersion: adapter.version
+    };
+    return { ok: true, manifest, ledgerEntry };
+}

package/dist/vendor/core/context-handoff.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Context Handoff Verifier — A-CTX-2
+ *
+ * Pure functions for verifying upstream-to-downstream context handoffs and
+ * deciding whether to circuit-break before the downstream agent executes.
+ *
+ * Standing rules:
+ *   - These functions are pure and side-effect-free.
+ *   - verifyContextHandoff fails closed — any ambiguity → not ok.
+ *   - decideContextCircuitBreak is the sole gate before adapter execution.
+ *   - The downstream adapter MUST NOT be called when shouldStop is true.
+ */
+import type { ContextCircuitBreakResult, ContextHandoffReceipt, ContextHandoffVerification } from "../contracts/index.js";
+export interface VerifyContextHandoffInput {
+    handoff: ContextHandoffReceipt;
+    /** true when the producer receipt file hash has been independently confirmed */
+    producerReceiptVerified: boolean;
+    /** Map of sha256 → true for every artifact hash available to the verifier */
+    availableArtifacts: ReadonlyMap<string, true>;
+}
+/**
+ * Deterministically verifies a context handoff.
+ *
+ * Returns ok=false when ANY of the following is true:
+ *   - schemaVersion is not in SUPPORTED_SCHEMAS
+ *   - producerReceiptVerified is false
+ *   - upstreamIntegrity is not "verified"
+ *   - a required artifact is absent from availableArtifacts
+ *   - an artifact sha256 does not appear in availableArtifacts (hash changed)
+ *   - any required claim has state "unverified" or "rejected"
+ *   - any claim has state "unknown"
+ *   - unresolvedAssumptions is non-empty
+ *   - handoffId, chainId, producerRunId, or producerReceiptHash is blank
+ */
+export declare function verifyContextHandoff(input: VerifyContextHandoffInput): ContextHandoffVerification;
+/**
+ * Converts a ContextHandoffVerification into a gate decision.
+ *
+ * Healthy:  { shouldStop: false, silent: true }
+ * Broken:   { shouldStop: true, silent: false, reasonCode, message, nextAction }
+ */
+export declare function decideContextCircuitBreak(verification: ContextHandoffVerification): ContextCircuitBreakResult;