@rigour-labs/core 5.5.3 → 6.0.0

package/dist/firewall/capability-broker.js

@@ -0,0 +1,209 @@
+/**
+ * Capability broker — issues one-use, short-lived capabilities.
+ */
+import { randomUUID } from 'crypto';
+import fs from 'fs-extra';
+import path from 'path';
+import { hashPolicy } from './policy-hash.js';
+import { evaluateTypedCommand } from './typed-command.js';
+import { isPathInScope } from './scope-enforcement.js';
+const DEFAULT_TTL_MS = 30_000;
+export class CapabilityBroker {
+    config;
+    grants = new Map();
+    decisions = [];
+    policyHash;
+    constructor(config) {
+        this.config = config;
+        this.policyHash = hashPolicy({
+            toolAllowlist: [...config.toolAllowlist].sort(),
+            scopes: config.agentScopes,
+            ttl: config.defaultTtlMs ?? DEFAULT_TTL_MS,
+        });
+    }
+    getPolicyHash() {
+        return this.policyHash;
+    }
+    getDecisions() {
+        return [...this.decisions];
+    }
+    listGrants() {
+        return [...this.grants.values()];
+    }
+    issue(action, resource, constraints) {
+        const grant = {
+            id: randomUUID(),
+            action,
+            resource,
+            constraints,
+            expiresAt: Date.now() + (this.config.defaultTtlMs ?? DEFAULT_TTL_MS),
+            agentId: this.config.agentId,
+            taskId: this.config.taskId,
+            policyHash: this.policyHash,
+            used: false,
+        };
+        this.grants.set(grant.id, grant);
+        return grant;
+    }
+    evaluateProposal(input) {
+        const timestamp = new Date().toISOString();
+        const early = this.prechecks(input, timestamp);
+        if (early)
+            return early;
+        if (input.capabilityId) {
+            return this.evaluateWithCapability(input.capabilityId, input.action, input.resource, timestamp);
+        }
+        const grant = this.issue(input.action, input.resource, input.args);
+        return this.record({
+            decision: 'allow',
+            reason: `Capability issued for ${input.action}:${input.resource}`,
+            ruleId: 'capability.issue',
+            capabilityId: grant.id,
+            policyHash: this.policyHash,
+            timestamp,
+        });
+    }
+    prechecks(input, timestamp) {
+        if (input.action === 'mcp.call') {
+            const deny = this.denyUndeclaredMcp(input.resource, timestamp);
+            if (deny)
+                return deny;
+        }
+        if (input.action === 'filesystem.write') {
+            const deny = this.denyOutOfScopeWrite(input.resource, timestamp);
+            if (deny)
+                return deny;
+        }
+        if (input.action === 'shell.exec' && input.command) {
+            const cmdEv = evaluateTypedCommand(input.command);
+            if (cmdEv.decision !== 'allow') {
+                return this.record({ ...cmdEv, policyHash: this.policyHash, timestamp });
+            }
+        }
+        if (input.action === 'secret.lease') {
+            const grant = this.issue('secret.lease', input.resource, { purpose: input.args?.purpose });
+            return this.record({
+                decision: 'allow',
+                reason: `Secret lease capability issued for ${input.resource} (secret not exposed to agent)`,
+                ruleId: 'secret.lease',
+                capabilityId: grant.id,
+                policyHash: this.policyHash,
+                timestamp,
+            });
+        }
+        return null;
+    }
+    denyUndeclaredMcp(tool, timestamp) {
+        const allow = this.config.toolAllowlist;
+        if (allow.includes('*') || allow.includes(tool))
+            return null;
+        return this.record({
+            decision: 'deny',
+            reason: `MCP tool "${tool}" is not on the agent allowlist`,
+            ruleId: 'mcp.undeclared',
+            policyHash: this.policyHash,
+            timestamp,
+        });
+    }
+    denyOutOfScopeWrite(resource, timestamp) {
+        if (this.config.agentScopes.length === 0)
+            return null;
+        if (!this.config.agentId) {
+            return this.record({
+                decision: 'scope-violation',
+                reason: 'Writer agentId is required when agent scopes are registered (fail-closed; no union-allow)',
+                ruleId: 'scope.unbound',
+                policyHash: this.policyHash,
+                timestamp,
+            });
+        }
+        const agents = this.config.agentScopes.filter(a => a.agentId === this.config.agentId);
+        const rel = resource.replace(/\\/g, '/');
+        const ok = agents.some(a => isPathInScope(rel, a.taskScope));
+        if (ok)
+            return null;
+        return this.record({
+            decision: 'scope-violation',
+            reason: `Write to "${resource}" outside assigned scope`,
+            ruleId: 'scope.out-of-bounds',
+            policyHash: this.policyHash,
+            timestamp,
+        });
+    }
+    evaluateWithCapability(capabilityId, action, resource, timestamp) {
+        const consumed = this.consumeCapability(capabilityId, action, resource, timestamp);
+        if (consumed.kind === 'deny')
+            return consumed.evaluation;
+        return this.record({
+            decision: 'allow',
+            reason: `Capability ${capabilityId} consumed for ${action}:${resource}`,
+            ruleId: 'capability.consume',
+            capabilityId,
+            policyHash: this.policyHash,
+            timestamp,
+        });
+    }
+    consumeCapability(capabilityId, action, resource, timestamp) {
+        const grant = this.grants.get(capabilityId);
+        if (!grant) {
+            return { kind: 'deny', evaluation: this.denyCap('Unknown capability id', 'capability.unknown', timestamp) };
+        }
+        if (grant.used) {
+            return {
+                kind: 'deny',
+                evaluation: this.denyCap('Capability already consumed (one-use)', 'capability.reuse', timestamp, grant.id),
+            };
+        }
+        if (Date.now() > grant.expiresAt) {
+            return {
+                kind: 'deny',
+                evaluation: this.denyCap('Capability expired', 'capability.expired', timestamp, grant.id),
+            };
+        }
+        if (grant.action !== action || grant.resource !== resource) {
+            return {
+                kind: 'deny',
+                evaluation: this.denyCap('Capability does not match proposed action/resource', 'capability.mismatch', timestamp, grant.id),
+            };
+        }
+        grant.used = true;
+        return { kind: 'ok' };
+    }
+    denyCap(reason, ruleId, timestamp, capabilityId) {
+        return this.record({
+            decision: 'deny',
+            reason,
+            ruleId,
+            capabilityId,
+            policyHash: this.policyHash,
+            timestamp,
+        });
+    }
+    record(ev) {
+        this.decisions.push(ev);
+        return ev;
+    }
+    async persistDecisions(cwd) {
+        const dir = path.join(cwd, '.rigour');
+        await fs.ensureDir(dir);
+        const file = path.join(dir, 'firewall-decisions.jsonl');
+        const lines = this.decisions.map(d => JSON.stringify(d)).join('\n');
+        if (lines) {
+            await fs.appendFile(file, lines + '\n');
+        }
+    }
+}
+/** Pure evaluate for adversarial replay (fresh broker per call). */
+export function evaluateActionDeterministic(input) {
+    const broker = new CapabilityBroker({
+        defaultTtlMs: DEFAULT_TTL_MS,
+        toolAllowlist: input.toolAllowlist,
+        agentScopes: input.agentScopes,
+        agentId: input.agentId,
+    });
+    return broker.evaluateProposal({
+        action: input.action,
+        resource: input.resource,
+        command: input.command,
+    });
+}

package/dist/firewall/firewall.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/firewall/firewall.test.js

@@ -0,0 +1,102 @@
+import { describe, it, expect } from 'vitest';
+import { evaluateTypedCommand, parseCommandLine, evaluateWriteScope, evaluateActionDeterministic, runAdversarialCorpus, CapabilityBroker, validateAgentClaimedScope, } from './index.js';
+describe('typed command firewall', () => {
+    it('denies shell metacharacters', () => {
+        const ev = evaluateTypedCommand('ls; rm -rf /');
+        expect(ev.decision).toBe('deny');
+        expect(ev.ruleId).toBe('shell.no-meta');
+    });
+    it('denies unknown binaries including node/npx', () => {
+        expect(evaluateTypedCommand('curl https://evil.example').decision).toBe('deny');
+        expect(evaluateTypedCommand('node -e "1"').decision).toBe('deny');
+        expect(evaluateTypedCommand('npx cowsay hi').decision).toBe('deny');
+    });
+    it('denies git push', () => {
+        const ev = evaluateTypedCommand('git push origin main');
+        expect(ev.decision).toBe('deny');
+        expect(ev.ruleId).toBe('git.destructive');
+    });
+    it('allows vitest', () => {
+        const ev = evaluateTypedCommand('vitest run packages/rigour-core');
+        expect(ev.decision).toBe('allow');
+        expect(parseCommandLine('vitest run x')?.bin).toBe('vitest');
+    });
+});
+describe('scope enforcement', () => {
+    it('denies unbound writer when scopes exist', () => {
+        const ev = evaluateWriteScope('/repo', 'packages/rigour-core/src/x.ts', [
+            { agentId: 'a1', taskScope: ['packages/rigour-core/**'] },
+        ]);
+        expect(ev.decision).toBe('scope-violation');
+        expect(ev.ruleId).toBe('scope.unbound');
+    });
+    it('flags out-of-scope writes for bound agent', () => {
+        const ev = evaluateWriteScope('/repo', '.github/workflows/x.yml', [
+            { agentId: 'a1', taskScope: ['packages/rigour-core/**'] },
+        ], 'a1');
+        expect(ev.decision).toBe('scope-violation');
+    });
+    it('allows in-scope writes for bound agent', () => {
+        const ev = evaluateWriteScope('/repo', 'packages/rigour-core/src/firewall/types.ts', [
+            { agentId: 'a1', taskScope: ['packages/rigour-core/**'] },
+        ], 'a1');
+        expect(ev.decision).toBe('allow');
+    });
+    it('rejects broad self-registration scopes', () => {
+        expect(validateAgentClaimedScope(['**/*']).ok).toBe(false);
+        expect(validateAgentClaimedScope(['.github/**']).ok).toBe(false);
+        expect(validateAgentClaimedScope(['packages/rigour-core/**']).ok).toBe(true);
+    });
+});
+describe('capability broker', () => {
+    it('denies undeclared MCP tools', () => {
+        const broker = new CapabilityBroker({
+            defaultTtlMs: 1000,
+            toolAllowlist: ['rigour_check'],
+            agentScopes: [],
+        });
+        const ev = broker.evaluateProposal({
+            action: 'mcp.call',
+            resource: 'slack.post_message',
+        });
+        expect(ev.decision).toBe('deny');
+        expect(ev.ruleId).toBe('mcp.undeclared');
+    });
+    it('issues one-use capabilities', () => {
+        const broker = new CapabilityBroker({
+            defaultTtlMs: 60_000,
+            toolAllowlist: ['*'],
+            agentScopes: [],
+        });
+        const grant = broker.issue('mcp.call', 'rigour_check');
+        const ok = broker.evaluateProposal({
+            action: 'mcp.call',
+            resource: 'rigour_check',
+            capabilityId: grant.id,
+        });
+        expect(ok.decision).toBe('allow');
+        const again = broker.evaluateProposal({
+            action: 'mcp.call',
+            resource: 'rigour_check',
+            capabilityId: grant.id,
+        });
+        expect(again.decision).toBe('deny');
+        expect(again.ruleId).toBe('capability.reuse');
+    });
+});
+describe('adversarial corpus', () => {
+    it('passes default regression corpus', () => {
+        const report = runAdversarialCorpus();
+        expect(report.failed).toBe(0);
+        expect(report.passed).toBeGreaterThan(0);
+    });
+    it('evaluateActionDeterministic matches expected deny', () => {
+        const ev = evaluateActionDeterministic({
+            action: 'mcp.call',
+            resource: 'github.merge',
+            toolAllowlist: [],
+            agentScopes: [],
+        });
+        expect(ev.decision).toBe('deny');
+    });
+});

package/dist/firewall/index.d.ts

@@ -0,0 +1,10 @@
+export * from './types.js';
+export * from './policy-hash.js';
+export * from './typed-command.js';
+export * from './scope-enforcement.js';
+export * from './capability-broker.js';
+export * from './transaction.js';
+export * from './attestation.js';
+export * from './adversarial.js';
+export * from './mcp-gateway.js';
+export * from './arbitration-token.js';

package/dist/firewall/index.js

@@ -0,0 +1,10 @@
+export * from './types.js';
+export * from './policy-hash.js';
+export * from './typed-command.js';
+export * from './scope-enforcement.js';
+export * from './capability-broker.js';
+export * from './transaction.js';
+export * from './attestation.js';
+export * from './adversarial.js';
+export * from './mcp-gateway.js';
+export * from './arbitration-token.js';

package/dist/firewall/mcp-gateway.d.ts

@@ -0,0 +1,40 @@
+/**
+ * MCP Gateway interface sketch (ADR 001).
+ * Full proxy packaging may move to packages/rigour-gateway later.
+ */
+import type { PolicyEvaluation } from './types.js';
+import { CapabilityBroker, type BrokerConfig } from './capability-broker.js';
+export interface ToolDescriptor {
+    name: string;
+    description?: string;
+}
+export interface McpGatewayInvokeRequest {
+    agentId: string;
+    taskId: string;
+    tool: string;
+    args: Record<string, unknown>;
+    capabilityId?: string;
+}
+export interface McpGatewayInvokeResult {
+    decision: PolicyEvaluation['decision'];
+    reason: string;
+    ruleId?: string;
+    capabilityId?: string;
+    /** Present only when decision is allow and a downstream handler is wired. */
+    result?: unknown;
+}
+/**
+ * In-process gateway that filters discovery and authorizes calls via CapabilityBroker.
+ * Does not forward to external MCP servers yet — that is the next packaging step.
+ */
+export declare class McpGateway {
+    private readonly config;
+    private broker;
+    constructor(config: BrokerConfig & {
+        downstream?: (tool: string, args: Record<string, unknown>) => Promise<unknown>;
+    });
+    listTools(): ToolDescriptor[];
+    invoke(req: McpGatewayInvokeRequest): Promise<McpGatewayInvokeResult>;
+    leaseSecret(name: string, purpose: string): McpGatewayInvokeResult;
+    getBroker(): CapabilityBroker;
+}

package/dist/firewall/mcp-gateway.js

@@ -0,0 +1,64 @@
+/**
+ * MCP Gateway interface sketch (ADR 001).
+ * Full proxy packaging may move to packages/rigour-gateway later.
+ */
+import { CapabilityBroker } from './capability-broker.js';
+/**
+ * In-process gateway that filters discovery and authorizes calls via CapabilityBroker.
+ * Does not forward to external MCP servers yet — that is the next packaging step.
+ */
+export class McpGateway {
+    config;
+    broker;
+    constructor(config) {
+        this.config = config;
+        this.broker = new CapabilityBroker(config);
+    }
+    listTools() {
+        return this.config.toolAllowlist
+            .filter(t => t !== '*')
+            .map(name => ({ name, description: 'Allowlisted tool' }));
+    }
+    async invoke(req) {
+        const evaluation = this.broker.evaluateProposal({
+            action: 'mcp.call',
+            resource: req.tool,
+            args: req.args,
+            capabilityId: req.capabilityId,
+        });
+        if (evaluation.decision !== 'allow') {
+            return {
+                decision: evaluation.decision,
+                reason: evaluation.reason,
+                ruleId: evaluation.ruleId,
+            };
+        }
+        let result;
+        if (this.config.downstream) {
+            result = await this.config.downstream(req.tool, req.args);
+        }
+        return {
+            decision: 'allow',
+            reason: evaluation.reason,
+            ruleId: evaluation.ruleId,
+            capabilityId: evaluation.capabilityId,
+            result,
+        };
+    }
+    leaseSecret(name, purpose) {
+        const evaluation = this.broker.evaluateProposal({
+            action: 'secret.lease',
+            resource: name,
+            args: { purpose },
+        });
+        return {
+            decision: evaluation.decision,
+            reason: evaluation.reason,
+            ruleId: evaluation.ruleId,
+            capabilityId: evaluation.capabilityId,
+        };
+    }
+    getBroker() {
+        return this.broker;
+    }
+}

package/dist/firewall/policy-hash.d.ts

@@ -0,0 +1 @@
+export declare function hashPolicy(input: unknown): string;

package/dist/firewall/policy-hash.js

@@ -0,0 +1,5 @@
+import { createHash } from 'crypto';
+export function hashPolicy(input) {
+    const payload = typeof input === 'string' ? input : JSON.stringify(input);
+    return createHash('sha256').update(payload).digest('hex').slice(0, 16);
+}

package/dist/firewall/scope-enforcement.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Enforce agent file ownership against claimed globs.
+ * Fail-closed: when scopes exist, writer agentId is required (no union-allow).
+ */
+import type { PolicyEvaluation } from './types.js';
+export interface AgentScopeRecord {
+    agentId: string;
+    taskScope: string[];
+}
+export declare function normalizeRelPath(cwd: string, filePath: string): string;
+export declare function isPathInScope(relPath: string, globs: string[]): boolean;
+export declare function validateAgentClaimedScope(taskScope: string[]): {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Operator-controlled allowlist: `.rigour/operator-scopes.json`
+ * `{ "agents": { "agent-id": ["packages/foo/**"] } }`
+ */
+export declare function loadOperatorScopes(cwd: string): Promise<Record<string, string[]> | null>;
+export declare function isScopeSubset(claimed: string[], allowed: string[]): boolean;
+export declare function evaluateWriteScope(cwd: string, filePath: string, agentScopes: AgentScopeRecord[], agentId?: string): PolicyEvaluation;
+export declare function loadAgentScopesFromDisk(cwd: string): Promise<AgentScopeRecord[]>;
+export declare function assertWritesInScope(cwd: string, files: string[], agentId?: string): Promise<PolicyEvaluation>;

package/dist/firewall/scope-enforcement.js

@@ -0,0 +1,155 @@
+/**
+ * Enforce agent file ownership against claimed globs.
+ * Fail-closed: when scopes exist, writer agentId is required (no union-allow).
+ */
+import path from 'path';
+import micromatch from 'micromatch';
+import fs from 'fs-extra';
+import { hashPolicy } from './policy-hash.js';
+/** Globs agents may not self-claim without operator authority. */
+const FORBIDDEN_AGENT_SCOPES = new Set(['*', '**', '**/*', '**/**', '/*', '/']);
+const SENSITIVE_SCOPE_PATTERNS = [
+    /^\.github(\/|$|\*\*)/i,
+    /(^|\/)\.env/i,
+    /(^|\/)secrets?(\/|$|\*\*)/i,
+    /^\*\*\/\.github/,
+];
+export function normalizeRelPath(cwd, filePath) {
+    const abs = path.isAbsolute(filePath) ? filePath : path.join(cwd, filePath);
+    return path.relative(cwd, abs).replace(/\\/g, '/');
+}
+export function isPathInScope(relPath, globs) {
+    if (!globs || globs.length === 0)
+        return false;
+    const normalized = relPath.replace(/\\/g, '/');
+    return micromatch.isMatch(normalized, globs, { dot: true });
+}
+export function validateAgentClaimedScope(taskScope) {
+    if (!taskScope.length) {
+        return { ok: false, reason: 'taskScope must be a non-empty list of path globs' };
+    }
+    for (const raw of taskScope) {
+        const s = raw.replace(/\\/g, '/').trim();
+        if (!s) {
+            return { ok: false, reason: 'Empty scope glob is not allowed' };
+        }
+        if (FORBIDDEN_AGENT_SCOPES.has(s)) {
+            return {
+                ok: false,
+                reason: `Scope "${s}" is too broad for agent self-registration (operator authority required)`,
+            };
+        }
+        if (SENSITIVE_SCOPE_PATTERNS.some(re => re.test(s))) {
+            return {
+                ok: false,
+                reason: `Scope "${s}" covers sensitive paths; set operator scopes or RIGOUR_ALLOW_AGENT_SCOPE_AUTHORITY=1`,
+            };
+        }
+    }
+    return { ok: true };
+}
+/**
+ * Operator-controlled allowlist: `.rigour/operator-scopes.json`
+ * `{ "agents": { "agent-id": ["packages/foo/**"] } }`
+ */
+export async function loadOperatorScopes(cwd) {
+    const p = path.join(cwd, '.rigour', 'operator-scopes.json');
+    if (!(await fs.pathExists(p)))
+        return null;
+    try {
+        const raw = await fs.readJson(p);
+        if (raw?.agents && typeof raw.agents === 'object') {
+            return raw.agents;
+        }
+    }
+    catch {
+        return null;
+    }
+    return null;
+}
+export function isScopeSubset(claimed, allowed) {
+    // Each claimed glob must be matched/covered by an allowed glob (exact or nested under allowed prefix)
+    return claimed.every(c => allowed.some(a => c === a || c.startsWith(a.replace(/\*\*$/, '').replace(/\*$/, '')) || micromatch.isMatch(c, a, { dot: true })));
+}
+export function evaluateWriteScope(cwd, filePath, agentScopes, agentId) {
+    const policyHash = hashPolicy({ agentScopes, agentId });
+    const rel = normalizeRelPath(cwd, filePath);
+    const timestamp = new Date().toISOString();
+    if (!agentScopes.length) {
+        return {
+            decision: 'allow',
+            reason: 'No agent scopes registered; scope enforcement inactive',
+            ruleId: 'scope.inactive',
+            policyHash,
+            timestamp,
+        };
+    }
+    if (!agentId) {
+        return {
+            decision: 'scope-violation',
+            reason: 'Writer agentId is required when agent scopes are registered (fail-closed; no union-allow)',
+            ruleId: 'scope.unbound',
+            policyHash,
+            timestamp,
+        };
+    }
+    const agents = agentScopes.filter(a => a.agentId === agentId);
+    if (agents.length === 0) {
+        return {
+            decision: 'scope-violation',
+            reason: `Agent "${agentId}" is not registered`,
+            ruleId: 'scope.unregistered',
+            policyHash,
+            timestamp,
+        };
+    }
+    const allowed = agents.some(a => isPathInScope(rel, a.taskScope));
+    if (!allowed) {
+        const scopes = agents.map(a => `${a.agentId}:[${a.taskScope.join(', ')}]`).join('; ');
+        return {
+            decision: 'scope-violation',
+            reason: `Write to "${rel}" is outside assigned scope (${scopes})`,
+            ruleId: 'scope.out-of-bounds',
+            policyHash,
+            timestamp,
+        };
+    }
+    return {
+        decision: 'allow',
+        reason: `Path "${rel}" is within assigned agent scope`,
+        ruleId: 'scope.allow',
+        policyHash,
+        timestamp,
+    };
+}
+export async function loadAgentScopesFromDisk(cwd) {
+    const sessionPath = path.join(cwd, '.rigour', 'agent-session.json');
+    if (!(await fs.pathExists(sessionPath)))
+        return [];
+    try {
+        const raw = await fs.readJson(sessionPath);
+        const agents = Array.isArray(raw?.agents) ? raw.agents : [];
+        return agents.map((a) => ({
+            agentId: String(a.agentId),
+            taskScope: Array.isArray(a.taskScope) ? a.taskScope.map(String) : [],
+        }));
+    }
+    catch {
+        return [];
+    }
+}
+export async function assertWritesInScope(cwd, files, agentId) {
+    const scopes = await loadAgentScopesFromDisk(cwd);
+    for (const file of files) {
+        const ev = evaluateWriteScope(cwd, file, scopes, agentId);
+        if (ev.decision !== 'allow')
+            return ev;
+    }
+    return {
+        decision: 'allow',
+        reason: 'All files within scope',
+        ruleId: 'scope.batch-allow',
+        policyHash: hashPolicy({ files, agentId }),
+        timestamp: new Date().toISOString(),
+    };
+}

package/dist/firewall/transaction.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Transactional execution — worktree START → verify → COMMIT | DISCARD.
+ */
+import type { PolicyEvaluation, TransactionBudgets, TransactionRecord } from './types.js';
+export declare class TransactionRunner {
+    private readonly cwd;
+    private record;
+    constructor(cwd: string, opts: {
+        agentId?: string;
+        scope: string[];
+        budgets?: Partial<TransactionBudgets>;
+        policyHash?: string;
+    });
+    static fromRecord(cwd: string, record: TransactionRecord): TransactionRunner;
+    getRecord(): TransactionRecord;
+    private setStatus;
+    addDecision(ev: PolicyEvaluation): void;
+    /**
+     * Create an ephemeral git worktree for isolated writes.
+     */
+    start(): Promise<TransactionRecord>;
+    noteFileChange(relPath: string): Promise<PolicyEvaluation>;
+    syncWorktreeChanges(): Promise<string[]>;
+    getWorktreePath(): string | undefined;
+    verify(runGates: () => Promise<{
+        status: string;
+        failedGates: string[];
+        score?: number;
+    }>): Promise<{
+        ok: boolean;
+        gateResults: {
+            status: string;
+            failedGates: string[];
+            score?: number;
+        };
+    }>;
+    commit(): Promise<TransactionRecord>;
+    discard(): Promise<TransactionRecord>;
+    private persist;
+}
+export declare function listChangedFiles(dir: string): Promise<string[]>;
+export declare function loadCurrentTransaction(cwd: string): Promise<TransactionRecord | null>;
+export declare function listTransactions(cwd: string): Promise<TransactionRecord[]>;