@sema-agent/core 5.21.0 → 5.22.0

package/dist/core/permission-rule-org.js

@@ -0,0 +1,211 @@
+import { parseAllowRuleText, ruleAdmitsCommand } from "./permission-rule-model.js";
+import { sameScope, writerOf } from "./permission-rule-store.js";
+export function orgRuleStatePersistenceOf(store) {
+    const s = store;
+    return typeof s.readOrgState === "function" && typeof s.installOrgState === "function"
+        ? { readOrgState: s.readOrgState.bind(store), installOrgState: s.installOrgState.bind(store) }
+        : undefined;
+}
+export const ORG_UNAVAILABLE_DECISION_REASON = "org_unavailable";
+export const ORG_FETCHED_AT_SKEW_ALLOWANCE_MS = 5 * 60_000;
+export function createOrgRuleOverlay(cfg) {
+    if (cfg.governed !== true) {
+        throw new Error("createOrgRuleOverlay is only for org-governed deployments — pass `governed: true` or do not construct one");
+    }
+    if (cfg.provider === undefined) {
+        throw new Error("org-governed is declared but no OrgRuleSnapshotProvider is wired — a governed deployment without an org source is a configuration contradiction; refusing to boot rather than running silently ungoverned");
+    }
+    if (typeof cfg.stalenessBoundMs !== "number" || !Number.isFinite(cfg.stalenessBoundMs) || cfg.stalenessBoundMs <= 0) {
+        throw new Error(`org stalenessBoundMs must be a finite positive number of milliseconds (got ${String(cfg.stalenessBoundMs)})`);
+    }
+    const provider = cfg.provider;
+    const now = cfg.now ?? Date.now;
+    let memoryState;
+    const readState = async () => {
+        const state = cfg.persistence !== undefined ? await cfg.persistence.readOrgState() : memoryState;
+        return state === undefined ? undefined : structuredClone(state);
+    };
+    const writeState = async (state) => {
+        if (cfg.persistence !== undefined)
+            await cfg.persistence.installOrgState(structuredClone(state));
+        else
+            memoryState = structuredClone(state);
+    };
+    let chain = Promise.resolve();
+    const serialize = (fn) => {
+        const run = chain.then(fn, fn);
+        chain = run.then(() => undefined, () => undefined);
+        return run;
+    };
+    const resolve = async () => {
+        const disclosures = [];
+        if (cfg.persistence === undefined) {
+            disclosures.push("org rule state has no durable persistence wired — the last-known-good snapshot and the anti-rollback mark do not survive a restart");
+        }
+        let fetched;
+        let fetchFailed = false;
+        try {
+            fetched = await provider.current();
+        }
+        catch (err) {
+            fetchFailed = true;
+            disclosures.push(`org snapshot provider failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        return await serialize(async () => {
+            const nowMs = now();
+            const guardedRead = async (context) => {
+                try {
+                    return await readState();
+                }
+                catch (err) {
+                    disclosures.push(`org state ${context} read failed: ${err instanceof Error ? err.message : String(err)}`);
+                    return undefined;
+                }
+            };
+            const installed = await (async () => {
+                const persisted = await guardedRead("persistence");
+                if (fetched === undefined)
+                    return persisted;
+                const invalid = validateOrgSnapshot(fetched, nowMs);
+                if (invalid !== undefined) {
+                    disclosures.push(`org snapshot refused: ${invalid}; the previously installed snapshot (if any) remains in force`);
+                    return persisted;
+                }
+                if (persisted !== undefined && fetched.revision < persisted.revisionHighWater) {
+                    disclosures.push(`org snapshot revision ${fetched.revision} is below the installed high-water mark ${persisted.revisionHighWater} — refusing the rollback; the current deny set is unchanged`);
+                    return persisted;
+                }
+                if (persisted !== undefined && fetched.revision === persisted.snapshot.revision && !sameOrgPolicyContent(fetched, persisted.snapshot)) {
+                    disclosures.push(`org snapshot revision ${fetched.revision} equals the installed revision but carries DIFFERENT policy content — refusing the swap; the current deny set is unchanged`);
+                    return persisted;
+                }
+                const state = {
+                    revisionHighWater: Math.max(persisted?.revisionHighWater ?? 0, fetched.revision),
+                    snapshot: fetched,
+                    installedAtMs: nowMs,
+                };
+                try {
+                    await writeState(state);
+                }
+                catch (err) {
+                    const reread = await guardedRead("reconciliation");
+                    if (reread !== undefined && reread.revisionHighWater >= state.revisionHighWater) {
+                        disclosures.push(`org snapshot install was superseded by a concurrent install at revision ${reread.snapshot.revision} — continuing on the newer installed state`);
+                        return reread;
+                    }
+                    disclosures.push(`org snapshot install failed (${err instanceof Error ? err.message : String(err)}) and no superseding installed state exists — org adjudication is UNAVAILABLE`);
+                    return undefined;
+                }
+                return state;
+            })();
+            const decisionMs = now();
+            const withinBound = (snap) => decisionMs - snap.fetchedAtMs <= cfg.stalenessBoundMs && snap.fetchedAtMs <= decisionMs + ORG_FETCHED_AT_SKEW_ALLOWANCE_MS;
+            if (installed !== undefined) {
+                if (installed.snapshot.fetchedAtMs > decisionMs + ORG_FETCHED_AT_SKEW_ALLOWANCE_MS) {
+                    disclosures.push(`the installed org snapshot claims a FUTURE observation time (${installed.snapshot.fetchedAtMs} vs now ${decisionMs}) — org adjudication is UNAVAILABLE; the consuming gate must tighten every terminal allow to a real-approval ask`);
+                    return { status: "unavailable", rules: [], disclosures };
+                }
+                if (withinBound(installed.snapshot)) {
+                    const freshlyInstalled = fetched !== undefined && installed.snapshot === fetched;
+                    if (!freshlyInstalled && !fetchFailed && fetched === undefined) {
+                        disclosures.push("org snapshot provider returned no snapshot — continuing on the last-known-good");
+                    }
+                    return {
+                        status: freshlyInstalled ? "fresh" : "last-known-good",
+                        rules: structuredClone(installed.snapshot.rules),
+                        revision: installed.snapshot.revision,
+                        disclosures,
+                    };
+                }
+                disclosures.push(`the newest org snapshot was observed ${decisionMs - installed.snapshot.fetchedAtMs}ms ago (bound ${cfg.stalenessBoundMs}ms) — org adjudication is UNAVAILABLE; the consuming gate must tighten every terminal allow to a real-approval ask`);
+                return { status: "unavailable", rules: [], disclosures };
+            }
+            disclosures.push("no org snapshot has ever been installed — org adjudication is UNAVAILABLE; the consuming gate must tighten every terminal allow to a real-approval ask");
+            return { status: "unavailable", rules: [], disclosures };
+        });
+    };
+    return { resolve };
+}
+function sameOrgPolicyContent(a, b) {
+    if (a.rules.length !== b.rules.length)
+        return false;
+    return a.rules.every((r, i) => b.rules[i]?.rule === r.rule && b.rules[i]?.behavior === r.behavior);
+}
+function validateOrgSnapshot(s, nowMs) {
+    if (typeof s.revision !== "number" || !Number.isFinite(s.revision))
+        return `revision is not a finite number (${String(s.revision)})`;
+    if (typeof s.fetchedAtMs !== "number" || !Number.isFinite(s.fetchedAtMs))
+        return `fetchedAtMs is not a finite number (${String(s.fetchedAtMs)})`;
+    if (s.fetchedAtMs > nowMs + ORG_FETCHED_AT_SKEW_ALLOWANCE_MS) {
+        return `fetchedAtMs is ${s.fetchedAtMs - nowMs}ms in the future (allowance ${ORG_FETCHED_AT_SKEW_ALLOWANCE_MS}ms) — a future-dated observation would satisfy the staleness bound indefinitely`;
+    }
+    if (!Array.isArray(s.rules))
+        return "rules is not an array";
+    for (const r of s.rules) {
+        if (typeof r?.rule !== "string" || r.rule === "")
+            return "a rule entry carries no rule text";
+        if (r.behavior !== "deny" && r.behavior !== "ask")
+            return `rule "${r.rule}" carries behavior "${String(r.behavior)}" — the org layer has no allow bucket`;
+        const parsed = parseAllowRuleText(r.rule, { direction: "tighten" });
+        if ("reject" in parsed)
+            return `rule "${r.rule}" does not parse (${parsed.reject.code}) — an unenforceable ${r.behavior} must not install as policy`;
+    }
+    return undefined;
+}
+export function orgRuleVerdictFor(rules, call) {
+    let ask;
+    for (const r of rules) {
+        const parsed = parseAllowRuleText(r.rule, { direction: "tighten" });
+        if ("reject" in parsed)
+            continue;
+        if (parsed.rule.tool !== call.tool)
+            continue;
+        if (!ruleAdmitsCommand(parsed.rule, call.command))
+            continue;
+        if (r.behavior === "deny")
+            return { behavior: "deny", rule: r.rule };
+        ask ??= { behavior: "ask", rule: r.rule };
+    }
+    return ask;
+}
+export async function effectivePermissionRules(opts) {
+    const store = resolveIntrospectionStore(opts);
+    const listed = await store.list();
+    const orgDenies = (opts.orgSnapshot?.rules ?? []).filter((r) => r.behavior === "deny");
+    const out = [];
+    for (const r of listed.rules) {
+        const shadowed = orgDenies.some((d) => {
+            const parsed = parseAllowRuleText(d.rule, { direction: "tighten" });
+            return !("reject" in parsed) && parsed.rule.tool === r.tool && ruleAdmitsCommand(parsed.rule, r.command);
+        });
+        out.push({ rule: r.rule, scope: r.scope, status: shadowed ? "shadowed-by-org" : "live" });
+    }
+    for (const t of listed.tombstones) {
+        if (listed.rules.some((r) => r.rule === t.rule && sameScope(r.scope, t.scope)))
+            continue;
+        if (out.some((e) => e.rule === t.rule && sameScope(e.scope, t.scope)))
+            continue;
+        out.push({ rule: t.rule, scope: t.scope, status: "removed" });
+    }
+    return out;
+}
+function resolveIntrospectionStore(opts) {
+    if (opts.owner !== undefined && opts.owner.kind === "local-owner") {
+        if (opts.principal !== undefined) {
+            throw new Error("pass either a principal or a local-owner, not both — a bucket has one owner");
+        }
+        const store = opts.provider.forLocalOwner?.();
+        if (store === undefined) {
+            throw new Error("this provider has no local-owner bucket (forLocalOwner is not implemented)");
+        }
+        return store;
+    }
+    if (opts.owner !== undefined && opts.owner.kind === "principal" && opts.principal !== undefined && opts.owner.principal !== opts.principal) {
+        throw new Error(`contradictory identity: principal "${opts.principal}" and owner principal "${opts.owner.principal}" disagree`);
+    }
+    const principal = opts.owner?.kind === "principal" ? opts.owner.principal : opts.principal;
+    return opts.provider.forPrincipal(principal);
+}
+export function isWritablePermissionRuleStore(store) {
+    return writerOf(store) !== undefined;
+}

package/dist/core/permission-rule-store.d.ts

@@ -31,6 +31,7 @@
  * person pressing delete a second time.
  */
 import type { PersistedAllowRule, RuleAdd, RuleDot, RuleScope, RuleTombstone } from "./permission-rule-model.js";
+import type { RuleSyncDropReason, RuleQuarantineReason } from "./governance-codes.js";
 import type { StoreDurability, StoreFidelity } from "./checkpoint-store.js";
 /** One store read: the rules as persisted, their tombstones, and the revision they were read at. */
 export interface StoredAllowRules {
@@ -51,24 +52,59 @@ export interface StoredAllowRules {
  */
 export interface PermissionRuleStore {
     list(): Promise<StoredAllowRules>;
+    /**
+     * design/182 §5.2/§8.3 — the quarantine area, for introspection. Rows a sync round moved out of the
+     * live view (fence arm, server rejection, validator rejection): bytes kept, never silently deleted,
+     * re-enterable only through a new consent. Optional and additive — a backend without sync has none.
+     */
+    quarantined?(): Promise<QuarantinedRuleAdd[]>;
     /** Declared durability; an undeclared backend reads fail-closed as `"process-local"`. */
     readonly durability?: StoreDurability;
     /** Declared serialization fidelity, same doctrine as the other store families. */
     readonly fidelity?: StoreFidelity;
 }
+/**
+ * design/182 §3.3/§4.5 — who a rule bucket belongs to, as a STRUCTURAL position.
+ *
+ * Identity absence is spelled as a distinct union member, never as a sentinel string flowing through
+ * `forPrincipal` — every consumer of a principal string is an identity surface, and a made-up name on an
+ * identity surface is indistinguishable from a real one downstream. Cloud sync and cloud tickets accept
+ * ONLY the `principal` kind: syncing is an authenticated act, and a local-owner bucket has no cloud home
+ * until it is adopted (`adoptFilePermissionRuleStore`).
+ */
+export type RuleOwner = {
+    kind: "principal";
+    principal: string;
+} | {
+    kind: "local-owner";
+};
+/** Do two owners name the same bucket? */
+export declare function sameRuleOwner(a: RuleOwner, b: RuleOwner): boolean;
 /** Resolves a store for one verified principal. `undefined` ⇒ a store that reports zero rules. */
 export interface PermissionRuleStoreProvider {
     forPrincipal(principal: string | undefined): PermissionRuleStore;
+    /**
+     * design/182 §4.5 (F-011) — the identity-less LOCAL bucket, for a deployment that explicitly declared
+     * local-owner rules. Optional and additive: a provider without it simply has no local-owner form.
+     * A file backend resolves a FIXED file name (never a principal-hash path), and after an adoption
+     * completed it resolves the ADOPTED principal's bucket forever — the retired bucket never revives.
+     */
+    forLocalOwner?(): PermissionRuleStore;
 }
-/** The outcome of one accepted write. */
+/** The outcome of one accepted write. `sync` is present only on a `sync-join` delta — the landing
+ *  report the disclosure layer reads (design/182 §8.1: quarantine/fence details ride the PutResult). */
 export interface PutResult {
     rev: number;
+    sync?: RuleSyncLandingReport;
 }
 /** Authorization accompanying an add: the redemption that produced it. Carrying the record id makes the
- *  add's logical operation identity checkable at the backend, not just at the caller. */
+ *  add's logical operation identity checkable at the backend, not just at the caller. A v1 caller
+ *  carries `principal`; the local-owner path (design/182 §4.5) carries `owner` instead — never both
+ *  disagreeing, never a sentinel string. */
 export interface RedemptionAuthorization {
     recordId: string;
-    principal: string;
+    principal?: string;
+    owner?: RuleOwner;
 }
 /** The add half of the write union: one redeemed approval becoming one dot on one (rule, scope). */
 export interface RuleAddDelta {
@@ -86,13 +122,46 @@ export interface RuleDeleteDelta {
     kind: "tighten-delete";
     tombstone: RuleTombstone;
 }
+/**
+ * design/182 §8.1 — one whole sync round landing as ONE delta.
+ *
+ * "Partial landing" is unspellable at the write layer: either the whole join lands or none of it does,
+ * and replaying the same join is idempotent. The delta cannot express "remove a local row" through the
+ * join (a join only ever unions) — that is what the explicit `quarantine` member is for, so a
+ * server-rejected or validator-rejected LOCAL row moves out of the live view in the SAME optimistic
+ * write as the join, never silently and never in a second racing write.
+ */
+export interface RuleSyncJoinDelta {
+    kind: "sync-join";
+    /** The validated inbound state (the client's §4.3 partitioning already applied). */
+    inbound: RuleSyncState;
+    /** The server's collected (already-recycled) frontier. Absent in v2.0 — the fence arms stay dormant. */
+    gcFrontier?: RuleSyncFrontier;
+    /** The observation vector to persist on a CLEAN landing (absent ⇒ the vector does not advance). */
+    observedVector?: RuleSyncFrontier;
+    /**
+     * Explicit local-row quarantine instructions. Each dot must name an add present in the current raw
+     * state (an already-quarantined or unknown dot is an idempotent no-op); an instruction may never touch
+     * a tombstone. Quarantined rows keep their bytes, leave the live view and the sync state, and are
+     * disclosed — they can re-enter only through a NEW consent (a new ask, a new record, a new dot).
+     */
+    quarantine?: Array<{
+        rule: string;
+        scope: RuleScope;
+        dots: RuleDot[];
+        reason: RuleQuarantineReason;
+    }>;
+}
 /**
  * What a write may say. Authorization discriminates on the DELTA SHAPE, not on a full snapshot: only the
  * add arm can introduce a dot, and the delete arm carries a tombstone and no adds. A backend additionally
  * REFUSES at runtime any delete that would introduce a new add dot — structure and runtime check together,
- * so "pick the delete arm and smuggle an add" is neither expressible nor accepted.
+ * so "pick the delete arm and smuggle an add" is neither expressible nor accepted. The `sync-join` arm is
+ * constructible only by core (the writer is never exported), and every inbound record inside it passes the
+ * single validator again AT THE BACKEND — the fifth door of design/179 §4's validator list closes here,
+ * not at the calling layer.
  */
-export type RuleWriteDelta = RuleAddDelta | RuleDeleteDelta;
+export type RuleWriteDelta = RuleAddDelta | RuleDeleteDelta | RuleSyncJoinDelta;
 /**
  * The core-private write face. Deliberately absent from the package's public exports: a host cannot hold
  * one, so no API-level path to the store bypasses the consent protocol.
@@ -107,6 +176,26 @@ export interface PermissionRuleWriter {
         conflict: true;
         rev: number;
     }>;
+    /**
+     * design/182 §4.2 — the RAW state a sync round exchanges: adds with tombstoned dots NOT pre-filtered
+     * (list() filters; a join must not), plus the replica identity, the minted-counter high water and the
+     * persisted observation vector. Core-private like the rest of the writer: the raw view rides the sync
+     * client, never a host API.
+     */
+    readRaw(): Promise<RawRuleSyncState>;
+}
+/** The writer's raw view of one store — everything one sync round needs to know about this replica. */
+export interface RawRuleSyncState {
+    /** This replica's actor id — the wire `replica` field. A replica identity, NEVER a person identity. */
+    actor: string;
+    /** The highest counter this replica has minted — the own-actor forgery fence's local truth. */
+    counter: number;
+    rev: number;
+    rules: PersistedAllowRule[];
+    tombstones: RuleTombstone[];
+    /** The persisted observation vector (absent = never completed a clean round). */
+    observedVector?: RuleSyncFrontier;
+    quarantined?: QuarantinedRuleAdd[];
 }
 /**
  * The internal handle a writable backend hangs its write face on. Not exported from the package index —
@@ -142,6 +231,156 @@ export declare function addDotsOf(rules: readonly PersistedAllowRule[]): RuleDot
  * Every backend calls this before appending a tombstone.
  */
 export declare function assertDeleteDeltaCarriesNoAdd(delta: RuleDeleteDelta): void;
+/**
+ * The state one sync round exchanges: raw adds (tombstoned dots NOT pre-filtered) plus tombstones.
+ * The live view is always DERIVED (`applyTombstones`); the join below never deletes anything.
+ * The server-side twin MUST use the same join (consume the export, or pass
+ * `permissionRuleSyncContract` against its own reimplementation).
+ */
+export interface RuleSyncState {
+    rules: PersistedAllowRule[];
+    tombstones: RuleTombstone[];
+}
+/**
+ * An actor → counter vector. A dot is at-or-below a frontier ⟺ `dot.counter <= frontier[dot.actor]`.
+ * Used both as the client's observation vector and as the server's collected-frontier watermark —
+ * two quantities with strictly separated jobs (§5.1): only the COLLECTED watermark (monotone,
+ * never lowered by a registering or returning replica) may drive the fence arm.
+ *
+ * SQL twin note (server half): persist this as a JSON blob column — the vector is read and written
+ * whole, never queried per-actor; a row-per-actor table would invite partial updates the semantics
+ * cannot express. Epoch-millisecond columns around it follow the `_ms` suffix convention; the OCC
+ * counter column is named `rev` (never `version` — that word is reserved for format/schema versions).
+ */
+export type RuleSyncFrontier = Record<string, number>;
+/** One quarantined row: bytes preserved, out of the live view and out of sync, disclosed.
+ *  SQL twin note: `add` (dot + provenance) is one immutable value minted at approval time — persist it
+ *  as a JSON blob; `rule`/`scope`/`reason`/`atMs` are query axes and belong in structured columns
+ *  (`at_ms` on the SQL side). */
+export interface QuarantinedRuleAdd {
+    rule: string;
+    scope: RuleScope;
+    add: RuleAdd;
+    reason: RuleQuarantineReason;
+    atMs: number;
+}
+/** One dropped/quarantined disclosure line. `reason` is a closed, typed code (RULE_SYNC_DROP_CODES in
+ *  governance-codes.ts) — "silently dropped" must be machine-checkable, so free text is not a member. */
+export interface RuleSyncDrop {
+    rule: string;
+    scope: RuleScope;
+    dot: RuleDot;
+    reason: RuleSyncDropReason;
+}
+/** What one landed sync-join reports back for disclosure (rides {@link PutResult}). */
+export interface RuleSyncLandingReport {
+    /** Inbound records the backend refused (the peer still holds them — no data loss on this side). */
+    droppedInbound: RuleSyncDrop[];
+    /** Local rows moved into the quarantine area by this landing (instruction, fence, or validator). */
+    quarantined: RuleSyncDrop[];
+    /** Tombstones (with their covered adds) recycled below the frontier. Hygiene, not semantics. */
+    collectedTombstones: number;
+    /** Inbound adds withheld this round because an inbound tombstone was rejected (§4.3 tighten-only:
+     *  a dropped tombstone may have covered them — they re-arrive once the peer's state is clean). */
+    withheldAdds: number;
+}
+/** Is `dot` at or below the frontier? Absent actor ⇒ not below (a frontier never covers what it never saw). */
+export declare function dotAtOrBelowFrontier(dot: RuleDot, frontier: RuleSyncFrontier): boolean;
+/**
+ * design/182 §5.1 — the state vector: per actor, the max counter over every add dot, every tombstone's
+ * `deletedBy` and every tombstone's `removedDots`. "How far has this state seen that actor mint."
+ */
+export declare function ruleSyncVector(state: RuleSyncState): RuleSyncFrontier;
+/** Pointwise max of two frontiers — how an observation vector advances (monotone, never down). */
+export declare function joinFrontiers(a: RuleSyncFrontier, b: RuleSyncFrontier): RuleSyncFrontier;
+/**
+ * design/182 §3.1 pre-normalization — re-project the denormalized `tool`/`match`/`command` fields of one
+ * persisted rule from its `rule` TEXT (the single source of truth) through the one shared validator.
+ *
+ * A record whose text the validator refuses, or whose stored fields disagree with the re-projection, is
+ * damage or forgery — it is REFUSED (fail-closed), never repaired toward either side: picking a side
+ * would break the join's commutativity, and "take the wider" would widen a matching surface nobody
+ * approved. Returns the normalized record or the refusal reason.
+ */
+export declare function normalizePersistedRule(r: PersistedAllowRule): {
+    rule: PersistedAllowRule;
+} | {
+    reject: Extract<RuleSyncDropReason, "invalid_rule_text" | "metadata_mismatch">;
+};
+/** The normalization half exposed for the DISCLOSURE layer: which records a join would refuse, and why. */
+export declare function screenRuleSyncState(state: RuleSyncState): {
+    state: RuleSyncState;
+    rejected: RuleSyncDrop[];
+};
+/**
+ * design/182 §3.1 — the pure state join. Idempotent, commutative, associative; both sides monotone
+ * (a join only ever unions, it never deletes). The output is CANONICALLY ORDERED so equal states are
+ * deep-equal, which is what lets the contract suite assert the three laws structurally.
+ *
+ * - rules: grouped by (rule, scope); a group's adds are the dot-identity union (provenance rides each
+ *   add; two payloads under ONE dot — unreachable in a healthy protocol — resolve by canonical-json
+ *   byte order, determinism only, detection belongs to the screening layer);
+ * - tombstones: grouped by (rule, scope, deletedBy); same identity with differing `removedDots` takes
+ *   the UNION (any one-sided pick breaks commutativity and can drop an observed removal — the union is
+ *   the only convergent answer, and it only ever tightens);
+ * - both inputs pass {@link screenRuleSyncState} first (refused records are dropped deterministically;
+ *   callers wanting the refusal DETAILS run the screen themselves — this function stays a pure join).
+ */
+export declare function joinRuleStates(a: RuleSyncState, b: RuleSyncState): RuleSyncState;
+/**
+ * design/182 §5.1/§5.2 — the paired-collection arm: a tombstone is collectable ⟺ its `removedDots` are
+ * ALL at-or-below the frontier AND its `deletedBy` is too; collection removes the tombstone together
+ * with the adds it covers, atomically (collect only the tombstone and the next join resurrects the add;
+ * collect only the add and the leftover tombstone is idle but harmless — so it is always the pair).
+ */
+export declare function collectBelowFrontier(state: RuleSyncState, frontier: RuleSyncFrontier): {
+    state: RuleSyncState;
+    collectedTombstones: number;
+};
+/** The current raw facts a sync-join folds into — what {@link applySyncJoin} takes and returns. */
+export interface RuleSyncJoinBase {
+    actor: string;
+    counter: number;
+    rules: PersistedAllowRule[];
+    tombstones: RuleTombstone[];
+    quarantined: QuarantinedRuleAdd[];
+    observedVector?: RuleSyncFrontier;
+}
+/**
+ * design/182 §8.1 — the ONE landing pipeline every backend shares (the `foldDelta` doctrine: the file
+ * and in-memory forms must not drift on what a sync-join MEANS). Pure; the backend persists the result
+ * in a single optimistic write. Steps:
+ *
+ *   ① screen the inbound state at the backend (the single validator's fifth door closes HERE — the
+ *     backend does not trust the calling layer): text/metadata refusals drop the inbound record;
+ *     the own-actor forgery fence (M14) drops any inbound add or tombstone claiming THIS replica's
+ *     actor with a counter above what this replica has minted; an inbound tombstone with an empty
+ *     `removedDots` is a protocol violation and THROWS (the client's tighten-only partitioning must
+ *     have withheld the round's adds — a backend landing them anyway would loosen);
+ *   ② join (unions only, never deletes);
+ *   ③ with a `gcFrontier`: paired collection, then the fence arm — a live LOCAL add at-or-below the
+ *     collected frontier and ABSENT from the inbound state is the residue of an already-recycled
+ *     tombstone: moved to quarantine (never silently dropped), disclosed;
+ *   ④ execute the explicit quarantine instructions (idempotent per dot; touching a tombstone throws);
+ *   ⑤ screen LOCAL rows too — a locally damaged row (file edit) moves to quarantine rather than
+ *     riding every future round;
+ *   ⑥ persist the observation vector the delta carries (the client only sends one on a clean round).
+ */
+export declare function applySyncJoin(cur: RuleSyncJoinBase, delta: RuleSyncJoinDelta, nowMs: number): {
+    next: RuleSyncJoinBase;
+    report: RuleSyncLandingReport;
+};
+/**
+ * The redemption-side quarantine fence, shared by every backend (design/182 §5.2 review round 2):
+ * a quarantined row's contract is "re-entry only through a NEW consent — a new ask, a new record, a
+ * NEW dot". Replaying an already-redeemed approval record re-submits its RECORDED dot; once that
+ * add has been quarantined, folding the replay back into `rules` would resurrect it without anyone
+ * consenting again (and for `below_gc_frontier`, resurrect an approval whose deletion tombstone was
+ * already recycled). Any quarantined row sharing the delta's dot — under ANY (rule, scope) — refuses
+ * the write loudly: dots are minted once, so a replayed dot that quarantine pinned anywhere is the
+ * resurrection shape regardless of which tuple it claims now.
+ */
+export declare function assertRedemptionNotQuarantined(quarantined: readonly QuarantinedRuleAdd[], delta: RuleAddDelta): void;
 /** Integrity fingerprint over a store's own facts. Corruption detection, not tamper-proofing. */
 export declare function ruleStoreChecksum(payload: unknown): Promise<string>;
 /**
@@ -193,13 +432,17 @@ export declare const EMPTY_RULE_STORE: PermissionRuleStore;
  */
 export declare class InMemoryPermissionRuleStore implements WritablePermissionRuleStore {
     private readonly actor;
+    private readonly now;
     readonly durability: StoreDurability;
     readonly fidelity: StoreFidelity;
     private rules;
     private tombstones;
+    private quarantinedRows;
+    private observedVector;
     private rev;
     private counter;
-    constructor(actor?: string);
+    constructor(actor?: string, now?: () => number);
     list(): Promise<StoredAllowRules>;
+    quarantined(): Promise<QuarantinedRuleAdd[]>;
     readonly [PERMISSION_RULE_WRITER]: PermissionRuleWriter;
 }