@odla-ai/harness 0.1.0

package/dist/node.d.cts

@@ -0,0 +1,544 @@
+import { r as HarnessTaskSpec, g as HarnessAgentOutput, f as HarnessAgentInput, H as HarnessControlPlane, u as HarnessToolBroker, a as HarnessLease, d as HarnessInferenceRequest, e as HarnessInferenceResponse, i as CodeSessionEventData, w as HarnessToolRequest, v as HarnessToolName } from './types-D12vK3K9.cjs';
+import { CodePortableCheckpoint, CodeSourceFile, CodeVerificationReceipt, CodeCheckpointState } from '@odla-ai/camel/code';
+import { PolicyOutcome } from '@odla-ai/camel/policy';
+import '@odla-ai/ai';
+
+/** Supported command-line container engines for isolated harness attempts. */
+type ContainerEngine = "container" | "podman" | "docker";
+/** Host facts and executable probe used while selecting a safe container engine. */
+interface ContainerEngineSelectionOptions {
+    platform?: NodeJS.Platform;
+    arch?: string;
+    uid?: number;
+    available?: (engine: ContainerEngine) => Promise<boolean>;
+}
+/** Host facts and rootless probe used to verify the selected engine boundary. */
+interface ContainerEngineVerificationOptions {
+    platform?: NodeJS.Platform;
+    arch?: string;
+    uid?: number;
+    podmanRootless?: () => Promise<boolean>;
+}
+/** Optional CPU, memory, process, and temporary-filesystem limits for an attempt. */
+interface ContainerLimits {
+    cpus?: number;
+    memory?: string;
+    pids?: number;
+    tmpfsBytes?: number;
+}
+/** Container, task, callback, and cancellation settings for one agent attempt. */
+interface ContainerRunOptions {
+    engine: ContainerEngine;
+    image: string;
+    workspaceDir: string;
+    workspaceAccess?: "read-write" | "read-only" | "none";
+    task: HarnessTaskSpec;
+    limits?: ContainerLimits;
+    allowUnpinnedImage?: boolean;
+    signal?: AbortSignal;
+    onMessage(message: HarnessAgentOutput): Promise<HarnessAgentInput | void>;
+    onStderr?(text: string): Promise<void> | void;
+}
+/** Terminal container outcome and bounded diagnostic output returned to the runner. */
+interface ContainerRunResult {
+    exitCode: number;
+    status: "completed" | "failed" | "cancelled";
+    result?: unknown;
+    stderr: string;
+}
+/** Require an immutable OCI image reference pinned to a SHA-256 digest. */
+declare function assertPinnedImage(image: string): void;
+/** Choose the strongest installed local default without silently selecting a
+ * rootful Linux daemon. Apple container is a per-container VM boundary;
+ * rootless Podman is the Linux default; Docker remains explicit. */
+declare function selectContainerEngine(requested?: ContainerEngine | "auto", options?: ContainerEngineSelectionOptions): Promise<ContainerEngine>;
+/** Fail closed if the selected engine cannot provide the promised host
+ * boundary. This is checked for every attempt so a changed Podman connection
+ * cannot silently turn a rootless Linux runner into a rootful one. */
+declare function verifyContainerEngineBoundary(engine: ContainerEngine, options?: ContainerEngineVerificationOptions): Promise<void>;
+/** Build hardened, networkless engine arguments without starting the container. */
+declare function buildContainerRunArgs(options: Omit<ContainerRunOptions, "onMessage" | "onStderr" | "signal">): string[];
+/** Execute one JSONL agent inside a hardened Apple container, Podman, or Docker
+ * boundary. The
+ * container has no network and receives no credentials; inference requests are
+ * bridged over stdin/stdout to the trusted runner process. */
+declare function runContainerAttempt(options: ContainerRunOptions): Promise<ContainerRunResult>;
+
+/** Disposable, filtered materialization of one committed Git tree. */
+interface MaterializedGitTree {
+    root: string;
+    sourceDir: string;
+    fileCount: number;
+    byteCount: number;
+    cleanup(): Promise<void>;
+}
+/** Materialize ordinary files from an exact commit without copying secrets,
+ * symlinks, ignored local files, or Git metadata. */
+declare function materializeGitTree(source: string, commitSha: string, options?: Pick<StageWorkspaceOptions, "maxFiles" | "maxBytes" | "tempRoot">): Promise<MaterializedGitTree>;
+
+/** File, byte, and temporary-directory limits applied while staging a workspace. */
+interface StageWorkspaceOptions {
+    maxFiles?: number;
+    maxBytes?: number;
+    tempRoot?: string;
+    /** Stage tracked files plus non-ignored untracked files from a Git checkout. */
+    gitTrackedAndUnignored?: boolean;
+}
+/** Disposable baseline and mutable workspace copy used to generate a bounded patch. */
+interface StagedWorkspace {
+    root: string;
+    baselineDir: string;
+    workspaceDir: string;
+    fileCount: number;
+    byteCount: number;
+    patch(maxBytes: number): Promise<string>;
+    cleanup(): Promise<void>;
+}
+/** Copy a bounded, secret-filtered workspace twice: one immutable baseline and
+ * one disposable directory mounted into the container. The developer checkout
+ * itself is never mounted. */
+declare function stageWorkspace(source: string, options?: StageWorkspaceOptions): Promise<StagedWorkspace>;
+/** Create a disposable workspace whose diff base and initial editable tree
+ * intentionally come from different already-filtered sources. */
+declare function stageWorkspacePair(baselineSource: string, workspaceSource: string, options?: StageWorkspaceOptions): Promise<StagedWorkspace>;
+/** Convert a path-like value into a bounded lowercase label safe for runner metadata. */
+declare function safeWorkspaceLabel(value: string): string;
+
+/** Digest every regular path and byte in a staged workspace under fixed bounds. */
+declare function digestStagedWorkspace(root: string, limits: {
+    maxFiles: number;
+    maxBytes: number;
+}): Promise<`sha256:${string}`>;
+
+/** Control-plane, workspace, isolation, polling, and lifecycle settings for a runner. */
+interface HarnessRunnerOptions {
+    control: HarnessControlPlane;
+    workspaces: Readonly<Record<string, string>>;
+    engine: ContainerEngine;
+    image: string;
+    limits?: ContainerLimits;
+    heartbeatMs?: number;
+    pollMs?: number;
+    once?: boolean;
+    preserveWorkspace?: boolean;
+    allowUnpinnedImage?: boolean;
+    workspaceAccess?: "read-write" | "read-only" | "none";
+    signal?: AbortSignal;
+    log?: (message: string) => void;
+    toolBroker?: HarnessToolBroker;
+}
+/** Execute one leased task. The registered workspace is copied before the
+ * container starts; neither the checkout nor the runner credential is mounted. */
+declare function runLeasedAttempt(lease: HarnessLease, options: HarnessRunnerOptions): Promise<void>;
+/** One runner executes one attempt at a time. Concurrency comes from multiple
+ * independently credentialed runner processes. */
+declare function runHarnessRunner(options: HarnessRunnerOptions): Promise<void>;
+
+/** Stable HTTP and transport error returned by the remote Code control plane. */
+declare class CodeRuntimeControlError extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly name = "CodeRuntimeControlError";
+    constructor(message: string, status: number, code?: string);
+}
+/** Endpoint, host credential, timeout, and cancellation settings for a Code runtime client. */
+interface CodeRuntimeClientOptions {
+    endpoint: string;
+    token: string;
+    fetch?: typeof fetch;
+    /** Timeout for short control-plane operations such as heartbeats and events. */
+    requestTimeoutMs?: number;
+    /** Timeout for provider-backed inference and review calls. */
+    modelRequestTimeoutMs?: number;
+    signal?: AbortSignal;
+}
+/** Create the credentialed, outbound-only Code host control client. */
+declare function createCodeRuntimeControlClient(options: CodeRuntimeClientOptions): CodeRuntimeAgentControlPlane;
+
+/** Version of the outbound Code host heartbeat contract. */
+declare const CODE_RUNTIME_PROTOCOL_VERSION: 1;
+/** Frozen, secret-filtered view of the checkout from which a terminal connected. */
+interface CodeLocalSourceDescriptor {
+    kind: "local_checkout";
+    repository: string;
+    headCommitSha: string;
+    trustedBaseDigest: `sha256:${string}`;
+    developerPatchDigest: `sha256:${string}`;
+    snapshotDigest: `sha256:${string}`;
+    modified: boolean;
+    fileCount: number;
+    byteCount: number;
+    capturedAt: number;
+}
+/** Host resources and supported isolation engines advertised on heartbeat. */
+interface CodeRuntimeCapabilities {
+    protocolVersion: typeof CODE_RUNTIME_PROTOCOL_VERSION;
+    platform: "macos" | "linux";
+    arch: string;
+    engines: Array<"container" | "podman" | "docker">;
+    cpuCount: number;
+    memoryBytes: number;
+    source?: CodeLocalSourceDescriptor;
+    images?: {
+        ready: boolean;
+        pi: string;
+        recipes: Array<{
+            id: string;
+            image: string;
+        }>;
+    };
+}
+/** A generation-fenced assignment of one app environment to one Code host. */
+interface CodeRuntimeBinding {
+    bindingId: string;
+    appId: string;
+    env: "dev" | "prod";
+    offerId: string;
+    hostId: string;
+    generation: number;
+    revokedAt: number | null;
+}
+/** Authoritative heartbeat response for a live host and its pending work. */
+interface CodeRuntimeSnapshot {
+    host: {
+        hostId: string;
+        runtimeVersion: string;
+        lastSeenAt: number;
+        revokedAt: null;
+    };
+    bindings: CodeRuntimeBinding[];
+    commands: CodeRuntimeCommand[];
+}
+/** Commands accepted by the outbound Code runtime. */
+type CodeRuntimeCommandKind = "start" | "prompt" | "checkpoint_stop" | "resume";
+/** One sequenced command fenced to an exact host-binding generation. */
+interface CodeRuntimeCommand {
+    commandId: string;
+    instanceId: string;
+    sessionId: string;
+    appId: string;
+    env: "dev" | "prod";
+    bindingId: string;
+    hostId: string;
+    bindingGeneration: number;
+    sequence: number;
+    kind: CodeRuntimeCommandKind;
+    payload: Record<string, unknown>;
+    createdAt: number;
+}
+/** Terminal or continuing state acknowledged for a runtime command. */
+interface CodeRuntimeCommandResult {
+    status: "running" | "checkpointed" | "failed";
+    checkpoint?: CodePortableCheckpoint;
+    message?: string;
+}
+/** Minimal control-plane operations used by an outbound Code host. */
+interface CodeRuntimeControlPlane {
+    heartbeat(runtimeVersion: string, capabilities: CodeRuntimeCapabilities): Promise<CodeRuntimeSnapshot>;
+    acknowledge(commandId: string, result: CodeRuntimeCommandResult): Promise<void>;
+}
+/** Credentialless agent operations brokered over the same outbound host identity. */
+interface CodeRuntimeAgentControlPlane extends CodeRuntimeControlPlane {
+    source(sessionId: string): Promise<CodeRuntimeSourceSnapshot>;
+    infer(sessionId: string, request: HarnessInferenceRequest): Promise<HarnessInferenceResponse>;
+    review(sessionId: string, request: CodeRuntimeReviewRequest): Promise<CodeRuntimeReviewResponse>;
+    submitCandidate(sessionId: string, checkpointId: string, verification: CodeVerificationReceipt): Promise<CodeRuntimeCandidateResponse>;
+    appendSessionEvent(sessionId: string, eventId: string, event: CodeSessionEventData): Promise<void>;
+    reportSessionFailure(sessionId: string, message: string): Promise<void>;
+}
+/** Untrusted candidate material available only to the independent review route. */
+interface CodeRuntimeReviewRequest {
+    patch: string;
+    verification: CodeVerificationReceipt;
+}
+/** Closed review result. Only an exact approved verdict can enter a reviewed checkpoint. */
+interface CodeRuntimeReviewResponse {
+    verdict: "approved" | "rejected";
+    reviewDigest: `sha256:${string}`;
+    provider: string;
+    model: string;
+    policyVersion: number;
+}
+/** Owner-private candidate admitted after checkpoint, verifier, and review evidence agree. */
+interface CodeRuntimeCandidateResponse {
+    candidateId: string;
+    status: "submitted" | "approved" | "published" | "failed";
+}
+/** Exact, attestation-matched GitHub source returned to one assigned runtime. */
+interface CodeRuntimeSourceSnapshot {
+    repository: string;
+    commitSha: string;
+    treeDigest: `sha256:${string}`;
+    files: CodeSourceFile[];
+    references?: Array<{
+        alias: string;
+        repository: string;
+        commitSha: string;
+        treeDigest: `sha256:${string}`;
+        files: CodeSourceFile[];
+    }>;
+}
+
+/** Presence-loop settings and an optional callback for each heartbeat snapshot. */
+interface CodeRuntimeLoopOptions {
+    control: CodeRuntimeControlPlane;
+    runtimeVersion: string;
+    capabilities: CodeRuntimeCapabilities;
+    heartbeatMs?: number;
+    once?: boolean;
+    signal?: AbortSignal;
+    onSnapshot?(snapshot: CodeRuntimeSnapshot): Promise<void> | void;
+    onRetry?(error: unknown, delayMs: number): Promise<void> | void;
+}
+/** Maintain presence without opening a listener or accepting inbound traffic. */
+declare function runCodeRuntimeHeartbeatLoop(options: CodeRuntimeLoopOptions): Promise<void>;
+/** Executes one fenced runtime command and returns its acknowledgement payload. */
+interface CodeRuntimeCommandEngine {
+    execute(command: CodeRuntimeCommand): Promise<CodeRuntimeCommandResult>;
+    acknowledged?(command: CodeRuntimeCommand, result: CodeRuntimeCommandResult): Promise<void> | void;
+}
+/** Executes each command id at most once in-process and safely retries only its
+ * acknowledgement after a transient control-plane failure. */
+declare class CodeRuntimeReconciler {
+    private readonly control;
+    private readonly engine;
+    private readonly results;
+    constructor(control: CodeRuntimeControlPlane, engine: CodeRuntimeCommandEngine);
+    reconcile(snapshot: CodeRuntimeSnapshot): Promise<void>;
+}
+
+interface FrozenCodeLocalSource {
+    descriptor: CodeLocalSourceDescriptor;
+    trustedBaseDir: string;
+    sourceDir: string;
+}
+
+/** One control-owned regular file expected from a clean build recipe. */
+interface CodeExpectedArtifact {
+    id: string;
+    path: string;
+    maximumBytes: number;
+}
+/** Fixed, app-registered command executed in a separate digest-pinned build container. */
+interface CodeBuildRecipe {
+    id: string;
+    image: string;
+    command: readonly string[];
+    timeoutMs: number;
+    maxOutputBytes: number;
+    cpus?: number;
+    memory?: string;
+    pids?: number;
+    tmpfsBytes?: number;
+    expectedArtifacts?: readonly CodeExpectedArtifact[];
+}
+/** Bounded terminal result from an isolated recipe container. */
+interface CodeRecipeResult {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+    durationMs: number;
+    outputLimitExceeded: boolean;
+    timedOut: boolean;
+}
+/** Injectable recipe boundary used by the policy broker and its tests. */
+interface CodeRecipeExecutor {
+    run(input: {
+        workspaceDir: string;
+        recipe: CodeBuildRecipe;
+        signal?: AbortSignal;
+    }): Promise<CodeRecipeResult>;
+}
+/** Auditable CaMeL decision emitted before any requested tool effect. */
+interface CodeToolDecision {
+    lease: HarnessLease;
+    request: HarnessToolRequest;
+    tool: HarnessToolName;
+    policy: PolicyOutcome;
+    approvalConsumed: boolean;
+}
+/** Bounds, recipes, authorization mode, and decision hooks for one trusted broker. */
+interface CodeToolBrokerOptions {
+    recipes: readonly CodeBuildRecipe[];
+    recipeExecutor: CodeRecipeExecutor;
+    recipeAuthorization: "registered_recipe" | "exact_approval";
+    readerId: string;
+    maxReadBytes?: number;
+    maxReadLines?: number;
+    maxPatchBytes?: number;
+    maxRecipeWorkspaceFiles?: number;
+    maxRecipeWorkspaceBytes?: number;
+    /** Paths Pi may read but may never modify. Prefixes are relative directory names. */
+    readOnlyPrefixes?: readonly string[];
+    consumeApproval?(input: CodeToolDecision & {
+        actionDigest: string;
+    }): Promise<boolean>;
+    onDecision?(decision: CodeToolDecision): Promise<void> | void;
+}
+
+/** Trusted control plane, isolation engine, Pi image, recipes, and resource policy for a Code runtime. */
+interface CodePiRuntimeEngineOptions {
+    control: CodeRuntimeAgentControlPlane;
+    engine: ContainerEngine;
+    image: string;
+    /** The Code CLI may build its bundled, content-addressed Pi adapter locally. */
+    imageAuthorization?: "digest" | "cli_embedded";
+    recipes: readonly CodeBuildRecipe[];
+    recipeAuthorization?: "registered_recipe" | "exact_approval";
+    limits?: ContainerLimits;
+    runAttempt?: (options: ContainerRunOptions) => Promise<ContainerRunResult>;
+    recipeExecutor?: CodeRecipeExecutor;
+    /** Owner-visible and terminal-visible bounded runtime failures. */
+    onDiagnostic?: (message: string) => void;
+    /** Frozen checkout snapshot owned by the foreground terminal process. */
+    localSource?: FrozenCodeLocalSource;
+}
+
+/** Execute fenced Code commands with real Pi in a credentialless, networkless container. */
+declare class CodePiRuntimeEngine implements CodeRuntimeCommandEngine {
+    #private;
+    private readonly options;
+    constructor(options: CodePiRuntimeEngineOptions);
+    execute(command: CodeRuntimeCommand): Promise<CodeRuntimeCommandResult>;
+    acknowledged(command: CodeRuntimeCommand, result: CodeRuntimeCommandResult): Promise<void>;
+    close(): Promise<void>;
+}
+
+/** Inputs for capturing one running staged workspace as a portable checkpoint. */
+interface CreateCodeWorkspaceCheckpointInput {
+    workspace: StagedWorkspace;
+    baseCommitSha: string;
+    state: CodeCheckpointState;
+    maximumPatchBytes?: number;
+}
+/** Inputs for reconstructing a checkpoint on any compatible bound host. */
+interface RestoreCodeWorkspaceCheckpointInput {
+    trustedBaseDir: string;
+    trustedBaseCommitSha: string;
+    checkpoint: unknown;
+    stage?: StageWorkspaceOptions;
+}
+/** Fresh staged workspace plus its verified portable checkpoint state. */
+interface RestoredCodeWorkspaceCheckpoint {
+    workspace: StagedWorkspace;
+    checkpoint: CodePortableCheckpoint;
+}
+/** Capture a bounded, text-only candidate patch and closed resume state. */
+declare function createCodeWorkspaceCheckpoint(input: CreateCodeWorkspaceCheckpointInput): Promise<CodePortableCheckpoint>;
+/** Reconstruct a verified candidate from a fresh copy of its exact trusted base. */
+declare function restoreCodeWorkspaceCheckpoint(input: RestoreCodeWorkspaceCheckpointInput): Promise<RestoredCodeWorkspaceCheckpoint>;
+/** Return whether the exact effect already completed; reject an ID rebound to another action. */
+declare function isCheckpointEffectCompleted(checkpoint: CodePortableCheckpoint, effectId: string, actionDigest: `sha256:${string}`): boolean;
+
+/** Trusted session state, verification policy, and review callback used to stop at a portable checkpoint. */
+interface PrepareRuntimeCheckpointInput {
+    sessionId: string;
+    role: "coding" | "review";
+    workspace: StagedWorkspace;
+    baseCommitSha: string;
+    trustedBaseDigest: `sha256:${string}`;
+    planningInputDigest: `sha256:${string}`;
+    conversationRefs: readonly string[];
+    fallbackPolicyDigest: `sha256:${string}`;
+    recipes: readonly CodeBuildRecipe[];
+    recipeExecutor: CodeRecipeExecutor;
+    review(patch: string, verification: CodeVerificationReceipt): Promise<CodeRuntimeReviewResponse>;
+}
+/** Portable checkpoint plus the optional clean-build and independent-review evidence that produced it. */
+interface PreparedRuntimeCheckpoint {
+    checkpoint: Awaited<ReturnType<typeof createCodeWorkspaceCheckpoint>>;
+    verification: CodeVerificationReceipt | null;
+    review: CodeRuntimeReviewResponse | null;
+    note: string;
+}
+/** Verify and independently review a stopped workspace without exposing raw build output to planning. */
+declare function prepareRuntimeCheckpoint(input: PrepareRuntimeCheckpointInput): Promise<PreparedRuntimeCheckpoint>;
+
+/** Active isolated workspace state required to prepare and publish a Code checkpoint candidate. */
+interface RuntimeCheckpointSession {
+    workspace: StagedWorkspace;
+    done: Promise<ContainerRunResult | null>;
+    abort: AbortController;
+    baseCommitSha: string;
+    trustedBaseDigest: `sha256:${string}`;
+    planningInputDigest: `sha256:${string}`;
+    conversationRefs: string[];
+    role: "coding" | "review";
+}
+interface Options {
+    control: CodeRuntimeAgentControlPlane;
+    recipes: readonly CodeBuildRecipe[];
+    recipeExecutor: CodeRecipeExecutor;
+    fallbackPolicyDigest: `sha256:${string}`;
+    event(command: CodeRuntimeCommand, event: CodeSessionEventData, refs: string[]): Promise<void>;
+}
+/** Own checkpoint evidence and candidate admission retries outside the Pi process lifecycle. */
+declare class CodeRuntimeCheckpointManager {
+    #private;
+    private readonly options;
+    constructor(options: Options);
+    prepare(command: CodeRuntimeCommand, active: RuntimeCheckpointSession): Promise<CodeRuntimeCommandResult>;
+    acknowledged(command: CodeRuntimeCommand, result: CodeRuntimeCommandResult): Promise<boolean>;
+}
+
+/** Disposable local source tree materialized from an exact, validated Code snapshot. */
+interface MaterializedCodeSource {
+    sourceDir: string;
+    cleanup(): Promise<void>;
+}
+/** Materialize only ordinary, relative snapshot files into a disposable source tree. */
+declare function materializeCodeRuntimeSource(snapshot: CodeRuntimeSourceSnapshot, tempRoot?: string): Promise<MaterializedCodeSource>;
+/** Add server-resolved reference trees to both sides of a staged local
+ * checkout. They remain outside the candidate diff and the tool broker denies
+ * every write beneath the reference root. */
+declare function attachCodeRuntimeReferences(workspace: StagedWorkspace, references: NonNullable<CodeRuntimeSourceSnapshot["references"]>): Promise<void>;
+
+/** Create the trusted CaMeL boundary for all Pi filesystem and build effects. */
+declare function createCodeToolBroker(options: CodeToolBrokerOptions): HarnessToolBroker;
+
+/** Build a trusted, fixed command for an isolated and networkless recipe container. */
+declare function buildRecipeContainerArgs(engine: ContainerEngine, workspaceDir: string, recipe: CodeBuildRecipe, name?: string): string[];
+/** Create a recipe executor that never invokes a shell and never mounts credentials. */
+declare function createContainerRecipeExecutor(engine: ContainerEngine): CodeRecipeExecutor;
+/** Validate immutable recipe identity, digest image, command, and resource bounds. */
+declare function assertCodeBuildRecipe(recipe: CodeBuildRecipe): void;
+
+/** Control-owned clean-verification policy for one app environment. */
+interface CodeVerificationPolicy {
+    policyId: string;
+    recipes: readonly CodeBuildRecipe[];
+    testPathPrefixes?: readonly string[];
+    testPathSuffixes?: readonly string[];
+    maximumChangedTests?: number;
+    maximumPatchBytes?: number;
+    maximumFiles?: number;
+    maximumBytes?: number;
+}
+/** Trusted base, candidate patch, policy, and isolated executor for one clean run. */
+interface VerifyCodeCandidateInput {
+    verificationId?: string;
+    trustedBaseDir: string;
+    trustedBaseCommitSha: string;
+    trustedBaseDigest: `sha256:${string}`;
+    candidatePatch: string;
+    policy: CodeVerificationPolicy;
+    recipeExecutor: CodeRecipeExecutor;
+    signal?: AbortSignal;
+}
+/** Bounded raw recipe output retained for coding, review, and owner display only. */
+interface CodeVerificationLog {
+    recipeId: string;
+    stdout: string;
+    stderr: string;
+}
+/** Closed receipt plus quarantined evidence that must never be passed to planning. */
+interface CodeVerificationEvidence {
+    receipt: CodeVerificationReceipt;
+    changedTests: readonly string[];
+    logs: readonly CodeVerificationLog[];
+}
+
+/** Rebuild a candidate from an exact trusted base and emit a prose-free clean-verifier receipt. */
+declare function verifyCodeCandidate(input: VerifyCodeCandidateInput): Promise<CodeVerificationEvidence>;
+
+export { CODE_RUNTIME_PROTOCOL_VERSION, type CodeBuildRecipe, type CodeExpectedArtifact, type CodeLocalSourceDescriptor, CodePiRuntimeEngine, type CodePiRuntimeEngineOptions, type CodeRecipeExecutor, type CodeRecipeResult, type CodeRuntimeAgentControlPlane, type CodeRuntimeBinding, type CodeRuntimeCandidateResponse, type CodeRuntimeCapabilities, CodeRuntimeCheckpointManager, type CodeRuntimeClientOptions, type CodeRuntimeCommand, type CodeRuntimeCommandEngine, type CodeRuntimeCommandKind, type CodeRuntimeCommandResult, CodeRuntimeControlError, type CodeRuntimeControlPlane, type CodeRuntimeLoopOptions, CodeRuntimeReconciler, type CodeRuntimeReviewRequest, type CodeRuntimeReviewResponse, type CodeRuntimeSnapshot, type CodeRuntimeSourceSnapshot, type CodeToolBrokerOptions, type CodeToolDecision, type CodeVerificationEvidence, type CodeVerificationLog, type CodeVerificationPolicy, type ContainerEngine, type ContainerEngineSelectionOptions, type ContainerEngineVerificationOptions, type ContainerLimits, type ContainerRunOptions, type ContainerRunResult, type CreateCodeWorkspaceCheckpointInput, type HarnessRunnerOptions, type MaterializedCodeSource, type MaterializedGitTree, type PrepareRuntimeCheckpointInput, type PreparedRuntimeCheckpoint, type RestoreCodeWorkspaceCheckpointInput, type RestoredCodeWorkspaceCheckpoint, type RuntimeCheckpointSession, type StageWorkspaceOptions, type StagedWorkspace, type VerifyCodeCandidateInput, assertCodeBuildRecipe, assertPinnedImage, attachCodeRuntimeReferences, buildContainerRunArgs, buildRecipeContainerArgs, createCodeRuntimeControlClient, createCodeToolBroker, createCodeWorkspaceCheckpoint, createContainerRecipeExecutor, digestStagedWorkspace, isCheckpointEffectCompleted, materializeCodeRuntimeSource, materializeGitTree, prepareRuntimeCheckpoint, restoreCodeWorkspaceCheckpoint, runCodeRuntimeHeartbeatLoop, runContainerAttempt, runHarnessRunner, runLeasedAttempt, safeWorkspaceLabel, selectContainerEngine, stageWorkspace, stageWorkspacePair, verifyCodeCandidate, verifyContainerEngineBoundary };