@tangle-network/agent-runtime 0.90.1 → 0.91.0

package/dist/index.d.ts

@@ -1,12 +1,12 @@
-import { AgentProfile, AgentEvalError, AnalystFinding, KnowledgeReadinessReport, RunRecord, ControlEvalResult, KnowledgeRequirement } from '@tangle-network/agent-eval';
+import { BenchmarkEvaluation, TraceStore, AgentProfile, AgentEvalError, AnalystFinding, KnowledgeReadinessReport, RunRecord, ControlEvalResult, KnowledgeRequirement } from '@tangle-network/agent-eval';
 export { AgentEvalError, AgentEvalErrorCode, ConfigError, ControlBudget, ControlDecision, ControlEvalResult, ControlRunResult, ControlStep, DataAcquisitionPlan, JudgeError, KnowledgeReadinessReport, KnowledgeRequirement, NotFoundError, RunRecord, ValidationError } from '@tangle-network/agent-eval';
 import { g as AgentBackendInput, O as OpenAIChatTool, h as OpenAIChatToolChoice, i as OpenAIChatResponseFormat, j as AgentExecutionBackend, k as AgentBackendContext, b as RuntimeStreamEvent, K as KnowledgeReadinessDecision, l as RunAgentTaskOptions, m as AgentTaskRunResult, n as RunAgentTaskStreamOptions, o as AgentRuntimeEvent, p as AgentTaskStatus, q as RuntimeSessionStore, r as RuntimeSession, R as RuntimeHooks } from './types-SyuwunY_.js';
 export { s as AgentAdapter, t as AgentKnowledgeProvider, u as AgentRuntimeEventSink, v as AgentTaskContext, w as AgentTaskSpec, B as BackendErrorDetail, x as RuntimeDecisionEvidenceRef, y as RuntimeDecisionKind, z as RuntimeDecisionPoint, C as RuntimeHookContext, F as RuntimeHookErrorContext, G as RuntimeHookEvent, H as RuntimeHookPhase, J as RuntimeHookTarget, M as RuntimeRunHandle, N as RuntimeRunPersistenceAdapter, P as RuntimeRunRow, Q as composeRuntimeHooks, T as defineRuntimeHooks, U as notifyRuntimeDecisionPoint, W as notifyRuntimeHookEvent, X as startRuntimeRun } from './types-SyuwunY_.js';
+import { AgentCandidateArtifactRef, AgentCandidateTermination, AgentCandidateTaskOutcomeEvidence, Sha256Digest, AgentCandidateContainer, AgentCandidateOciPlatform, AgentCandidateGitHubRepository, AgentCandidateWorkspaceSnapshotEvidence, AgentCandidateBundle, AgentCandidateResolvedModel, AgentCandidateAttemptPolicy, AgentCandidateExecutionLimits, AgentCandidateModelAccessNetwork, AgentCandidateCapturedArtifact, AgentCandidateWorkspaceManifestMaterialV1, AgentCandidateProfilePlanEvidence, AgentCandidateExecutionPlanEvidence, AgentCandidateMaterializationReceipt, AgentCandidateInstructionDelivery, AgentCandidateEffectiveMemory, AgentCandidateRunReceiptV2, AgentCandidateSpend, ReasoningEffort, AgentProfile as AgentProfile$1 } from '@tangle-network/agent-interface';
 import { Scenario, ProfileDispatchFn, MutableSurface as MutableSurface$1, SurfaceProposer as SurfaceProposer$1 } from '@tangle-network/agent-eval/campaign';
 import { V as Verifier, C as CandidateGenerator } from './mcp-serve-verifier-XsX8rkB9.js';
 export { A as AgenticGeneratorOptions, I as ImprovementDriverOptions, M as McpServeSpec, a as VerifyResult, b as agenticGenerator, c as commandVerifier, i as improvementDriver, m as mcpServeVerifier } from './mcp-serve-verifier-XsX8rkB9.js';
 import { Scenario as Scenario$1, SurfaceProposer, JudgeConfig, MutableSurface, DispatchContext, SelfImproveBudget, SelfImproveLlm, SelfImproveOptions, SelfImproveResult } from '@tangle-network/agent-eval/contract';
-import { AgentProfile as AgentProfile$1 } from '@tangle-network/agent-interface';
 import { L as LocalHarness } from './local-harness-dcD5WTTr.js';
 import { S as SurfaceImprovementEdit } from './improvement-adapter-CDR8QNVM.js';
 import { I as ImprovementAdapter } from './types-BC3bZpH0.js';
@@ -159,6 +159,807 @@ declare function createOpenAICompatibleBackend<TInput extends AgentBackendInput
     retry?: BackendRetryPolicy;
 }): AgentExecutionBackend<TInput>;
 
+declare const verifiedCandidateBrand: unique symbol;
+declare const preparedCandidateBrand: unique symbol;
+declare const verifiedTaskOutcomeBrand: unique symbol;
+/** Reads one content-addressed object from the closed S3/IPFS locator set. */
+interface AgentCandidateArtifactPort {
+    read(ref: AgentCandidateArtifactRef): Promise<Uint8Array>;
+}
+type AgentCandidateOutputPurpose = 'task-manifest' | 'task-archive' | 'task-patch' | 'task-outcome' | 'memory-after-manifest' | 'memory-after-archive' | 'grader-evidence' | 'benchmark-result' | 'model-settlement' | 'trace' | 'run-receipt' | 'failure-evidence';
+/** Durable content-addressed evidence store controlled only by the evaluator. */
+interface AgentCandidateOutputArtifactPort extends AgentCandidateArtifactPort {
+    /** Must be idempotent for identical bytes and return only a durable S3/IPFS locator. */
+    put(input: {
+        executionId: string;
+        purpose: AgentCandidateOutputPurpose;
+        bytes: Uint8Array;
+        /** Abort must prevent durable publication when it happens before resolution. */
+        signal?: AbortSignal;
+    }): Promise<AgentCandidateArtifactRef>;
+}
+/** Resolves a declared GitHub repository to an already-present local Git object store. */
+interface AgentCandidateRepositoryPort {
+    resolve(repository: AgentCandidateGitHubRepository): Promise<string>;
+}
+interface AgentCandidateVerificationPorts {
+    artifacts: AgentCandidateArtifactPort;
+    repositories: AgentCandidateRepositoryPort;
+}
+/**
+ * Materializes an already-verified workspace archive.
+ *
+ * The runtime independently scans every resulting byte, mode, and path against
+ * the signed manifest after this returns. Implementations may therefore unpack
+ * any archive encoding, or no-op when the exact workspace is already present.
+ */
+interface AgentCandidateWorkspacePort {
+    materialize(input: {
+        role: 'task' | 'candidate' | 'memory';
+        snapshot: AgentCandidateWorkspaceSnapshotEvidence;
+        archive: Uint8Array;
+        destination: string;
+    }): Promise<void>;
+}
+interface ResolvedAgentCandidateContainer {
+    source: 'pinned-container' | 'evaluator-task-container';
+    image: string;
+    indexDigest: Sha256Digest;
+    manifestDigest: Sha256Digest;
+    platform: AgentCandidateOciPlatform;
+}
+interface AgentCandidateContainerPort {
+    resolve(input: {
+        candidate: AgentCandidateContainer | undefined;
+        evaluatorTaskContainer: ResolvedAgentCandidateContainer | undefined;
+    }): Promise<ResolvedAgentCandidateContainer>;
+}
+interface AgentCandidateModelPort {
+    resolve(input: {
+        requested: string;
+        harness: AgentCandidateBundle['execution']['harness'];
+        reasoningEffort: NonNullable<AgentCandidateBundle['profile']['model']>['reasoningEffort'];
+    }): Promise<AgentCandidateResolvedModel>;
+    /**
+     * Reserve a stable access identity without creating a live credential.
+     * The reservation is scoped to `preparationId` and must automatically expire
+     * at `expiresAtMs`, even if this call returns ambiguously to the runtime.
+     */
+    reserveGrant(input: {
+        executionId: string;
+        preparationId: string;
+        expiresAtMs: number;
+        attempt: AgentCandidateAttemptPolicy;
+        bundleDigest: Sha256Digest;
+        resolved: AgentCandidateResolvedModel;
+        limits: AgentCandidateModelLimits;
+    }): Promise<AgentCandidateProtectedModelReservation>;
+    /** Create the live scoped credential only after the execution attempt is durably claimed. */
+    activateGrant(input: {
+        executionId: string;
+        preparationId: string;
+        grantDigest: Sha256Digest;
+        resolved: AgentCandidateResolvedModel;
+        deadlineAtMs: number;
+    }): Promise<AgentCandidateProtectedModelActivation>;
+    /**
+     * Atomically revoke the grant, drain in-flight calls, and return its immutable final ledger.
+     * This operation must be idempotent for the exact preparation and must also
+     * settle a reservation that was never activated. It must never affect a
+     * different preparation, even when both reservations report the same digest.
+     */
+    settleGrant(input: {
+        executionId: string;
+        preparationId: string;
+        grantDigest: Sha256Digest;
+        resolved: AgentCandidateResolvedModel;
+        reason: 'completed' | 'failed' | 'timeout' | 'replayed' | 'preparation-failed' | 'abandoned';
+    }): Promise<AgentCandidateProtectedModelSettlement>;
+}
+/** Limits mechanically enforced by the evaluator-owned model gateway. */
+type AgentCandidateModelLimits = Pick<AgentCandidateExecutionLimits, 'maxModelCalls' | 'maxInputTokens' | 'maxOutputTokens' | 'maxCostUsd'>;
+interface AgentCandidateProtectedModelReservation {
+    preparationId: string;
+    digest: Sha256Digest;
+    /** Evaluator service must expire and revoke this reservation at this epoch millisecond. */
+    expiresAtMs: number;
+    /** The gateway must stop calls before any one of these limits is exceeded. */
+    enforcedLimits: AgentCandidateModelLimits;
+    /** Exact public endpoint exception; every other candidate destination stays blocked. */
+    network: AgentCandidateModelAccessNetwork;
+}
+interface AgentCandidateProtectedModelActivation {
+    /** Injected only into the trusted executor after all pre-launch checks pass. */
+    env: Readonly<Record<string, string>>;
+}
+/** One evaluator-gateway call in the final, revoked model-access ledger. */
+interface AgentCandidateProtectedModelCall {
+    callId: string;
+    /** Router-generated public response identity. */
+    generationId: string;
+    /** Exact protected agent-eval LLM span produced from the router ledger. */
+    traceSpanId: string;
+    status: 'succeeded' | 'failed';
+    model: string;
+    startedAtMs: number;
+    endedAtMs: number;
+    inputTokens: number;
+    outputTokens: number;
+    cachedInputTokens: number;
+    reasoningTokens: number;
+    /** Integer billionths of one US dollar; avoids floating-point ledger drift. */
+    costUsdNanos: number;
+}
+interface AgentCandidateProtectedModelSettlement {
+    preparationId: string;
+    grantDigest: Sha256Digest;
+    closed: true;
+    calls: readonly AgentCandidateProtectedModelCall[];
+}
+interface AgentCandidateMemoryResetResult {
+    preparationId: string;
+    accessDigest: Sha256Digest;
+    expiresAtMs: number;
+    evidence: AgentCandidateCapturedArtifact;
+    emptyStateDigest: Sha256Digest;
+    beforeState: AgentCandidateWorkspaceSnapshotEvidence;
+}
+interface AgentCandidateMemoryPort {
+    /**
+     * Reset and reserve exact task memory without returning live access.
+     * The service must scope the reservation to `preparationId`, automatically
+     * revoke it at `expiresAtMs`, and never reuse it for another preparation.
+     */
+    reset(input: {
+        executionId: string;
+        preparationId: string;
+        expiresAtMs: number;
+        effectiveNamespace: string;
+        seed?: Uint8Array;
+        seedDigest?: Sha256Digest;
+    }): Promise<AgentCandidateMemoryResetResult>;
+    /**
+     * Create live scoped access only after the execution attempt is durably claimed.
+     * Activation must match the exact preparation/access pair and may not extend expiry.
+     */
+    activate(input: {
+        executionId: string;
+        preparationId: string;
+        accessDigest: Sha256Digest;
+        effectiveNamespace: string;
+        deadlineAtMs: number;
+    }): Promise<{
+        env: Readonly<Record<string, string>>;
+    }>;
+    /**
+     * Revoke evaluator-owned access after process death or a failed preparation.
+     * Must be idempotent and concurrency-safe for the exact preparation/access
+     * pair and must never close a different preparation.
+     */
+    close(input: {
+        executionId: string;
+        preparationId: string;
+        accessDigest: Sha256Digest;
+        effectiveNamespace: string;
+        reason: 'completed' | 'failed' | 'timeout' | 'replayed' | 'preparation-failed' | 'abandoned';
+    }): Promise<{
+        closed: true;
+    }>;
+}
+interface AgentCandidateExecutionPorts extends AgentCandidateVerificationPorts {
+    workspaces: AgentCandidateWorkspacePort;
+    containers: AgentCandidateContainerPort;
+    models: AgentCandidateModelPort;
+    memory: AgentCandidateMemoryPort;
+}
+interface AgentCandidateTaskExecution {
+    executionId: string;
+    benchmark: string;
+    benchmarkVersion: string;
+    taskId: string;
+    splitDigest: Sha256Digest;
+    /** Exact agent-visible task instruction. The runtime rejects malformed Unicode. */
+    instruction: string;
+    repository: {
+        identity: string;
+        rootIdentity: string;
+        baseCommit: string;
+        baseTree: string;
+    };
+    attempt: AgentCandidateAttemptPolicy;
+    model: {
+        requested: string;
+        reasoningEffort: ReasoningEffort;
+    };
+    /** Absolute paths inside the evaluator-owned execution environment. */
+    executionRoots: {
+        taskRoot: string;
+        candidateRoot?: string;
+    };
+    /** Host-side staging roots. These are verified but never signed as container paths. */
+    stagingRoots: {
+        taskRoot: string;
+        candidateRoot?: string;
+        profileRoot: string;
+    };
+    workspace: AgentCandidateWorkspaceSnapshotEvidence;
+    evaluatorTaskContainer?: ResolvedAgentCandidateContainer;
+    limits: AgentCandidateExecutionLimits;
+}
+interface VerifiedAgentCandidate {
+    readonly bundle: AgentCandidateBundle;
+    readonly materializedTree?: string;
+    readonly [verifiedCandidateBrand]: true;
+}
+interface CanonicalCandidateDocument<T> {
+    readonly value: T;
+    /** Canonical UTF-8 bytes of `value` with its top-level digest omitted. */
+    readonly bytes: Uint8Array;
+    readonly digest: Sha256Digest;
+}
+interface PreparedAgentCandidateLaunch {
+    executable: string;
+    /** Complete fixed argv, including profile materializer flags but excluding task delivery. */
+    args: readonly string[];
+    env: Readonly<Record<string, string>>;
+    /** Informational subset already present at the tail of `args`; executors must not append twice. */
+    flags: readonly string[];
+    cwd: string;
+}
+interface PreparedAgentCandidateInstruction {
+    bytes: Uint8Array;
+    delivery: AgentCandidateInstructionDelivery;
+}
+interface PreparedAgentCandidateTrace {
+    runId: string;
+    tags: Readonly<Record<string, string>>;
+    env: Readonly<Record<string, string>>;
+}
+interface PreparedAgentCandidateExecution {
+    readonly bundle: AgentCandidateBundle;
+    readonly executionId: string;
+    readonly roots: {
+        execution: {
+            taskRoot: string;
+            candidateRoot?: string;
+        };
+        staging: {
+            taskRoot: string;
+            candidateRoot?: string;
+            profileRoot: string;
+        };
+    };
+    readonly profilePlan: {
+        value: AgentCandidateProfilePlanEvidence;
+        bytes: Uint8Array;
+        written: readonly string[];
+    };
+    readonly executionPlan: {
+        value: AgentCandidateExecutionPlanEvidence;
+        bytes: Uint8Array;
+    };
+    readonly materializationReceipt: CanonicalCandidateDocument<AgentCandidateMaterializationReceipt>;
+    readonly launch: PreparedAgentCandidateLaunch;
+    readonly instruction: PreparedAgentCandidateInstruction;
+    readonly resolvedModel: AgentCandidateResolvedModel;
+    readonly knowledge?: {
+        snapshotId: string;
+        manifestDigest: Sha256Digest;
+        manifest: Uint8Array;
+    };
+    readonly trace: PreparedAgentCandidateTrace;
+    readonly memory: AgentCandidateEffectiveMemory;
+    readonly [preparedCandidateBrand]: true;
+}
+interface AgentCandidateProtectedRunCapture {
+    executionId: string;
+    termination: AgentCandidateTermination;
+}
+/** Raw evaluator capture made only after the candidate process is dead. */
+interface AgentCandidateExecutorTaskOutcomeCapture {
+    /** Claimed final tree. The runtime recomputes it independently from `gitDiff`. */
+    resultTree: string;
+    /** Complete evaluator-captured workspace description after candidate execution. */
+    afterState: AgentCandidateWorkspaceManifestMaterialV1;
+    /** Reproducible workspace archive corresponding to `afterState`. */
+    archive: Uint8Array;
+    /** Exact binary patch from the signed task base to `afterState`. */
+    gitDiff: Uint8Array;
+}
+/** Raw isolated-memory capture made only after access has been revoked. */
+interface AgentCandidateExecutorMemoryCapture {
+    readonly afterState: AgentCandidateWorkspaceManifestMaterialV1;
+    readonly archive: Uint8Array;
+}
+/** Idempotent executor result after process death and trace drain. */
+interface AgentCandidateExecutorFinalCapture {
+    readonly stopped: true;
+    readonly taskOutcome?: AgentCandidateExecutorTaskOutcomeCapture;
+    /** Required only when the prepared candidate uses isolated task memory. */
+    readonly memoryAfter?: AgentCandidateExecutorMemoryCapture;
+}
+/** Branded task outcome that has survived independent patch and tree verification. */
+interface VerifiedAgentCandidateTaskOutcome {
+    readonly evidence: AgentCandidateTaskOutcomeEvidence & {
+        readonly artifact: AgentCandidateArtifactRef;
+    };
+    readonly patch: Uint8Array;
+    readonly [verifiedTaskOutcomeBrand]: true;
+}
+/**
+ * Evaluator-owned executable grader, pinned by immutable implementation bytes.
+ *
+ * `run` is an isolation boundary, not an arbitrary scoring callback. The
+ * implementation admitted to that boundary is supplied by the runtime after
+ * artifact verification. Implementations must derive every returned binding
+ * digest from the bytes and task outcome they actually admitted, rather than
+ * copying an expected digest from ambient configuration.
+ */
+interface AgentCandidateBenchmarkGraderPort {
+    readonly name: string;
+    readonly version: string;
+    readonly artifact: AgentCandidateArtifactRef;
+    run(input: {
+        readonly executionId: string;
+        readonly termination: AgentCandidateTermination;
+        readonly outcome: VerifiedAgentCandidateTaskOutcome;
+        /** Exact verified artifact bytes. Each read returns a detached copy. */
+        readonly implementation: {
+            readonly byteLength: number;
+            readonly bytes: Uint8Array;
+        };
+        /** Frozen result deadline; runners must stop work and side effects when aborted. */
+        readonly signal: AbortSignal;
+    }): Promise<{
+        readonly evaluation: BenchmarkEvaluation;
+        /** Raw grader output needed to audit or reproduce the normalized result. */
+        readonly evidence: Uint8Array;
+        /** Runtime-checked binding between admitted code, task input, and raw output. */
+        readonly binding: {
+            /** Digest computed from the implementation bytes admitted to execution. */
+            readonly implementationDigest: Sha256Digest;
+            /** Digest of the exact runtime-verified task outcome graded by this run. */
+            readonly taskOutcomeDigest: Sha256Digest;
+            /** Digest computed from `evidence` before it leaves the execution boundary. */
+            readonly outputDigest: Sha256Digest;
+        };
+    }>;
+}
+/** One detached request passed to the trusted environment-specific executor. */
+interface AgentCandidateExecutorRequest {
+    readonly executionId: string;
+    /** Immutable bytes from which the executor creates fresh isolated workspaces. */
+    readonly inputs: {
+        readonly task: AgentCandidateExecutorWorkspaceInput;
+        readonly candidate?: AgentCandidateExecutorWorkspaceInput;
+        readonly profile: {
+            readonly files: readonly AgentCandidateExecutorProfileFile[];
+        };
+    };
+    readonly roots: PreparedAgentCandidateExecution['roots']['execution'];
+    readonly profilePlan: PreparedAgentCandidateExecution['profilePlan'];
+    readonly executionPlan: PreparedAgentCandidateExecution['executionPlan'];
+    readonly materializationReceipt: CanonicalCandidateDocument<AgentCandidateMaterializationReceipt>;
+    readonly launch: PreparedAgentCandidateLaunch;
+    readonly instruction: PreparedAgentCandidateInstruction;
+    readonly resolvedModel: AgentCandidateResolvedModel;
+    /** Mechanically enforced by the runtime plus executor process-death acknowledgement. */
+    readonly hardLimits: Pick<AgentCandidateExecutionLimits, 'timeoutMs'>;
+    /** Validity bound checked against protected traces; generic black-box executors cannot preempt it. */
+    readonly observedLimits: Pick<AgentCandidateExecutionLimits, 'maxSteps'>;
+    readonly knowledge?: PreparedAgentCandidateExecution['knowledge'];
+    readonly trace: PreparedAgentCandidateTrace;
+    readonly memory: AgentCandidateEffectiveMemory;
+}
+/**
+ * Executes one prepared request inside an evaluator-owned isolation boundary.
+ *
+ * `request.launch.env` is the complete allowlisted environment, including
+ * protected model, memory, and trace bindings. Implementations must not merge
+ * ambient host variables into it. The returned capture deliberately contains
+ * no candidate-authored usage or score fields.
+ */
+interface AgentCandidateExecutorPort {
+    execute(request: AgentCandidateExecutorRequest, context: {
+        traceStore: TraceStore;
+        /** Aborted by the runtime at the exact frozen wall-time deadline. */
+        signal: AbortSignal;
+        /** Absolute epoch-millisecond deadline owned by the runtime. */
+        deadlineAtMs: number;
+    }): Promise<AgentCandidateProtectedRunCapture>;
+    /**
+     * Kill any process/container still associated with the request, drain trace
+     * writes, and capture the final task workspace before teardown.
+     * The runtime calls this on success, failure, and timeout before model settlement.
+     * Implementations must be idempotent and concurrency-safe for this exact
+     * execution/plan pair because a fresh worker may repeat crash recovery.
+     */
+    stopAndCapture(request: AgentCandidateExecutorStopRequest, context: {
+        traceStore: TraceStore;
+        reason: 'completed' | 'failed' | 'timeout';
+        /** Aborted at the frozen execution deadline or evaluator cleanup deadline. */
+        signal: AbortSignal;
+        /** Absolute execution deadline; a later stop acknowledgement cannot produce success. */
+        deadlineAtMs: number;
+    }): Promise<AgentCandidateExecutorFinalCapture>;
+}
+/** Opaque process identity used for termination without re-exposing launch credentials. */
+interface AgentCandidateExecutorStopRequest {
+    readonly executionId: string;
+    readonly executionPlanDigest: Sha256Digest;
+}
+interface AgentCandidateExecutorWorkspaceInput {
+    readonly snapshot: AgentCandidateWorkspaceSnapshotEvidence;
+    readonly files: readonly AgentCandidateExecutorWorkspaceFile[];
+}
+interface AgentCandidateExecutorWorkspaceFile {
+    readonly path: string;
+    readonly mode: 0o644 | 0o755;
+    readonly bytes: Uint8Array;
+}
+interface AgentCandidateExecutorProfileFile {
+    readonly path: string;
+    readonly mode: 0o644 | 0o755;
+    readonly bytes: Uint8Array;
+}
+type AgentCandidateRunFinalization = {
+    succeeded: true;
+    receipt: CanonicalCandidateDocument<AgentCandidateRunReceiptV2>;
+    artifacts: {
+        modelSettlement: AgentCandidateArtifactRef;
+        taskOutcome: AgentCandidateArtifactRef;
+        benchmarkResult: AgentCandidateArtifactRef;
+        runReceipt: AgentCandidateArtifactRef;
+    };
+} | {
+    succeeded: false;
+    reason: string;
+    partial: {
+        executionId: string;
+        bundleDigest: Sha256Digest;
+        executionPlanDigest: Sha256Digest;
+        materializationReceiptDigest: Sha256Digest;
+        termination?: AgentCandidateTermination;
+    };
+    /** Independent evaluator-gateway usage, even when execution or trace capture failed. */
+    usage: AgentCandidateSpend | null;
+};
+/** Protected trace tags that bind a run to one prepared candidate execution. */
+declare const CANDIDATE_TRACE_TAGS: {
+    readonly executionId: "tangle.candidate.execution_id";
+    readonly bundleDigest: "tangle.candidate.bundle_digest";
+    readonly executionPlanDigest: "tangle.candidate.execution_plan_digest";
+    readonly materializationReceiptDigest: "tangle.candidate.materialization_receipt_digest";
+};
+/** Environment keys used to propagate immutable candidate trace identity. */
+declare const CANDIDATE_TRACE_ENV: {
+    readonly executionId: "TANGLE_CANDIDATE_EXECUTION_ID";
+    readonly bundleDigest: "TANGLE_CANDIDATE_BUNDLE_DIGEST";
+    readonly executionPlanDigest: "TANGLE_CANDIDATE_EXECUTION_PLAN_DIGEST";
+    readonly materializationReceiptDigest: "TANGLE_CANDIDATE_MATERIALIZATION_RECEIPT_DIGEST";
+    readonly traceRunId: "TANGLE_TRACE_RUN_ID";
+};
+
+/** Extract the complete durable claim from a prepared execution. */
+declare function candidateExecutionClaim(prepared: PreparedAgentCandidateExecution): AgentCandidateExecutionClaim;
+
+/** Durable one-shot lifecycle for candidate execution attempts. */
+
+/** Non-secret identities a trusted recovery worker needs to close an abandoned attempt. */
+interface AgentCandidateExecutionCleanupHandles {
+    readonly preparationId: string;
+    readonly modelGrantDigest: Sha256Digest;
+    readonly resolvedModel: AgentCandidateResolvedModel;
+    readonly traceRunId: string;
+    readonly cleanupTimeoutMs: number;
+    readonly memory?: {
+        readonly accessDigest: Sha256Digest;
+        readonly effectiveNamespace: string;
+    };
+}
+/** Immutable signed identity stored for one execution attempt. */
+interface AgentCandidateExecutionClaim {
+    readonly executionId: string;
+    readonly attempt: number;
+    readonly maxAttempts: number;
+    readonly retryPolicy: AgentCandidateAttemptPolicy['retryPolicy'];
+    readonly bundleDigest: Sha256Digest;
+    readonly executionPlanDigest: Sha256Digest;
+    /** Frozen plan identity with only attempt number and per-attempt grant identity normalized. */
+    readonly retryLineageDigest: Sha256Digest;
+    /** The winning lease stops authorizing a new terminal write at this instant. */
+    readonly leaseExpiresAtMs: number;
+    /** Frozen budget for task verification, executable grading, and receipt construction. */
+    readonly resultTimeoutMs: number;
+    /** Non-secret handles retained so an expired attempt can be closed and reconciled. */
+    readonly cleanup: AgentCandidateExecutionCleanupHandles;
+}
+/** Secret capability required to finish the acquired attempt. */
+interface AgentCandidateExecutionLease {
+    readonly executionId: string;
+    readonly attempt: number;
+    readonly token: string;
+    readonly expiresAtMs: number;
+}
+/** Only the first class is retryable, and only when the closed model ledger has zero calls. */
+type AgentCandidateExecutionFailureClass = 'pre-model-infrastructure' | 'execution' | 'post-model-infrastructure' | 'unknown';
+/** Exact fixed-point usage proven by the closed evaluator model ledger. */
+interface AgentCandidateExecutionUsage {
+    readonly costUsdNanos: number;
+    readonly inputTokens: number;
+    readonly outputTokens: number;
+    readonly cachedInputTokens: number;
+    readonly reasoningTokens: number;
+    readonly modelCalls: number;
+}
+/** Evaluator-owned terminal facts staged durably before the terminal CAS. */
+type AgentCandidateExecutionTerminalResult = {
+    readonly schemaVersion: 1;
+    readonly status: 'succeeded';
+    readonly usage: AgentCandidateExecutionUsage;
+    readonly modelSettlement: AgentCandidateArtifactRef;
+    readonly taskOutcome: AgentCandidateArtifactRef;
+    readonly benchmarkResult: AgentCandidateArtifactRef;
+    readonly runReceipt: AgentCandidateArtifactRef;
+} | {
+    readonly schemaVersion: 1;
+    readonly status: 'failed';
+    readonly failureClass: AgentCandidateExecutionFailureClass;
+    readonly usage: AgentCandidateExecutionUsage;
+    readonly modelSettlement: AgentCandidateArtifactRef;
+    readonly failureEvidence?: AgentCandidateArtifactRef;
+};
+/** Durable terminal record for one acquired execution attempt. */
+type AgentCandidateExecutionTerminalRecord = AgentCandidateExecutionTerminalResult & {
+    readonly executionId: string;
+    readonly attempt: number;
+    readonly bundleDigest: Sha256Digest;
+    readonly executionPlanDigest: Sha256Digest;
+    /** RFC 8785 SHA-256 of this record with `terminalDigest` omitted. */
+    readonly terminalDigest: Sha256Digest;
+};
+/** Monotonic durable phase: the second value means candidate code could have started. */
+type AgentCandidateExecutionPhase = 'claimed' | 'candidate-may-run';
+/** Trusted, independently observed closure facts for one expired winning lease. */
+interface AgentCandidateExecutionRecoveryEvidence {
+    readonly failureClass: AgentCandidateExecutionFailureClass;
+    readonly usage: AgentCandidateExecutionUsage;
+    readonly modelSettlement: AgentCandidateArtifactRef;
+    readonly failureEvidence?: AgentCandidateArtifactRef;
+    readonly process: {
+        readonly stopped: true;
+        readonly executionPlanDigest: Sha256Digest;
+    };
+    readonly model: {
+        readonly closed: true;
+        readonly preparationId: string;
+        readonly grantDigest: Sha256Digest;
+    };
+    readonly memory?: {
+        readonly closed: true;
+        readonly preparationId: string;
+        readonly accessDigest: Sha256Digest;
+        readonly effectiveNamespace: string;
+    };
+}
+interface AgentCandidateExecutionAttemptRef {
+    readonly executionId: string;
+    readonly attempt: number;
+}
+/** Persisted state available to a fresh trusted recovery worker after a crash. */
+interface AgentCandidateExecutionAttemptRecord {
+    readonly claim: AgentCandidateExecutionClaim;
+    readonly phase: AgentCandidateExecutionPhase;
+    /** Durable outbox content written before the terminal compare-and-set. */
+    readonly staged?: AgentCandidateExecutionTerminalRecord;
+    readonly terminal?: AgentCandidateExecutionTerminalRecord;
+}
+/** Result of atomically claiming one execution attempt. */
+type AgentCandidateExecutionClaimResult = {
+    readonly acquired: true;
+    readonly claim: AgentCandidateExecutionClaim;
+    readonly lease: AgentCandidateExecutionLease;
+} | {
+    readonly acquired: false;
+    readonly reason: 'already-claimed';
+    /** The durable winner already occupying this execution-attempt slot. */
+    readonly claim: AgentCandidateExecutionClaim;
+    /** True only when every signed claim field matches the durable winner. */
+    readonly exactReplay: boolean;
+} | {
+    readonly acquired: false;
+    readonly reason: 'retry-not-eligible';
+    readonly claim: AgentCandidateExecutionClaim;
+    readonly detail: AgentCandidateRetryRejection;
+};
+/** Result of atomically recording an attempt's terminal facts. */
+type AgentCandidateExecutionFinishResult = {
+    readonly finished: true;
+    readonly terminal: AgentCandidateExecutionTerminalRecord;
+} | {
+    readonly finished: false;
+    readonly terminal: AgentCandidateExecutionTerminalRecord;
+    /** True when a repeated finish supplied the same terminal digest. */
+    readonly exactReplay: boolean;
+};
+/** Result of durably staging the one immutable terminal outbox entry. */
+type AgentCandidateExecutionStageResult = {
+    readonly staged: true;
+    readonly terminal: AgentCandidateExecutionTerminalRecord;
+} | {
+    readonly staged: false;
+    readonly terminal: AgentCandidateExecutionTerminalRecord;
+    readonly exactReplay: boolean;
+};
+/** Result of crossing the irreversible candidate-may-run boundary. */
+type AgentCandidateExecutionPhaseResult = {
+    readonly marked: true;
+    readonly phase: 'candidate-may-run';
+} | {
+    readonly marked: false;
+    readonly phase: 'candidate-may-run';
+};
+type AgentCandidateRetryRejection = 'prior-attempt-missing' | 'prior-attempt-running' | 'prior-attempt-succeeded' | 'prior-attempt-spent-model-calls' | 'prior-attempt-not-pre-model-infrastructure' | 'retry-lineage-mismatch';
+/**
+ * Atomic one-shot store for candidate execution attempts.
+ *
+ * Implementations must linearize both methods across every process sharing the
+ * store. Terminal publication is deliberately two-step: `stageTerminal`
+ * fsyncs the complete immutable outbox record, then `finish` publishes exactly
+ * those staged bytes by digest. A crash between the two leaves recoverable
+ * evidence rather than an ambiguous completed run.
+ */
+interface AgentCandidateExecutionClaimStore {
+    tryClaim(claim: AgentCandidateExecutionClaim): Promise<AgentCandidateExecutionClaimResult>;
+    getAttempt(attempt: AgentCandidateExecutionAttemptRef): Promise<AgentCandidateExecutionAttemptRecord | undefined>;
+    /** Persist the point after which candidate code may have run. */
+    markCandidateMayRun(lease: AgentCandidateExecutionLease): Promise<AgentCandidateExecutionPhaseResult>;
+    /** Fsync the complete terminal record into the durable outbox. */
+    stageTerminal(lease: AgentCandidateExecutionLease, result: AgentCandidateExecutionTerminalResult): Promise<AgentCandidateExecutionStageResult>;
+    /** Publish exactly the staged terminal identified by `terminalDigest`. */
+    finish(lease: AgentCandidateExecutionLease, terminalDigest: Sha256Digest): Promise<AgentCandidateExecutionFinishResult>;
+    /**
+     * Write a failed terminal only after the lease expired and a trusted worker
+     * independently proved process death plus model and memory closure.
+     */
+    recoverExpired(attempt: AgentCandidateExecutionAttemptRef, evidence: AgentCandidateExecutionRecoveryEvidence): Promise<AgentCandidateExecutionFinishResult>;
+}
+interface InMemoryAgentCandidateExecutionClaimStoreOptions {
+    /** Testable evaluator clock; defaults to `Date.now`. */
+    now?: () => number;
+}
+/** Single-process lifecycle implementation. */
+declare class InMemoryAgentCandidateExecutionClaimStore implements AgentCandidateExecutionClaimStore {
+    private readonly claims;
+    private readonly now;
+    constructor(options?: InMemoryAgentCandidateExecutionClaimStoreOptions);
+    tryClaim(requested: AgentCandidateExecutionClaim): Promise<AgentCandidateExecutionClaimResult>;
+    getAttempt(requestedAttempt: AgentCandidateExecutionAttemptRef): Promise<AgentCandidateExecutionAttemptRecord | undefined>;
+    markCandidateMayRun(requestedLease: AgentCandidateExecutionLease): Promise<AgentCandidateExecutionPhaseResult>;
+    stageTerminal(requestedLease: AgentCandidateExecutionLease, result: AgentCandidateExecutionTerminalResult): Promise<AgentCandidateExecutionStageResult>;
+    finish(requestedLease: AgentCandidateExecutionLease, requestedTerminalDigest: Sha256Digest): Promise<AgentCandidateExecutionFinishResult>;
+    recoverExpired(requestedAttempt: AgentCandidateExecutionAttemptRef, evidence: AgentCandidateExecutionRecoveryEvidence): Promise<AgentCandidateExecutionFinishResult>;
+    private requireClaim;
+}
+
+interface FileAgentCandidateExecutionClaimStoreOptions {
+    /** Evaluator-owned directory shared by every process allowed to execute candidates. */
+    directory: string;
+    /** Testable evaluator clock; defaults to `Date.now`. */
+    now?: () => number;
+}
+/** Cross-process lifecycle implemented as fsynced, create-if-absent records. */
+declare class FileAgentCandidateExecutionClaimStore implements AgentCandidateExecutionClaimStore {
+    private readonly directory;
+    private readonly now;
+    constructor(options: FileAgentCandidateExecutionClaimStoreOptions);
+    tryClaim(requested: AgentCandidateExecutionClaim): Promise<AgentCandidateExecutionClaimResult>;
+    getAttempt(requestedAttempt: AgentCandidateExecutionAttemptRef): Promise<AgentCandidateExecutionAttemptRecord | undefined>;
+    markCandidateMayRun(requestedLease: AgentCandidateExecutionLease): Promise<AgentCandidateExecutionPhaseResult>;
+    stageTerminal(requestedLease: AgentCandidateExecutionLease, result: AgentCandidateExecutionTerminalResult): Promise<AgentCandidateExecutionStageResult>;
+    finish(requestedLease: AgentCandidateExecutionLease, requestedTerminalDigest: Sha256Digest): Promise<AgentCandidateExecutionFinishResult>;
+    recoverExpired(requestedAttempt: AgentCandidateExecutionAttemptRef, evidence: AgentCandidateExecutionRecoveryEvidence): Promise<AgentCandidateExecutionFinishResult>;
+    private storedAttempt;
+    private transitionState;
+    private retryFailure;
+    private ownerPublication;
+    private claimPath;
+    private terminalPath;
+    private transitionPath;
+}
+
+interface DisposePreparedAgentCandidateOptions {
+    cleanupTimeoutMs?: number;
+}
+/** Revoke reservations held by a prepared candidate that will not be executed. */
+declare function disposePreparedAgentCandidateExecution(prepared: PreparedAgentCandidateExecution, options?: DisposePreparedAgentCandidateOptions): Promise<{
+    disposed: true;
+}>;
+
+interface ExecutePreparedAgentCandidateOptions {
+    executor: AgentCandidateExecutorPort;
+    grader: AgentCandidateBenchmarkGraderPort;
+    outputArtifacts: AgentCandidateOutputArtifactPort;
+    traceStore: TraceStore;
+    /** Long-lived evaluator-owned store shared by every process that can run this benchmark. */
+    claimStore: AgentCandidateExecutionClaimStore;
+    /** Maximum time to prove process death and revoke protected access after a run ends. */
+    cleanupTimeoutMs?: number;
+    /** Maximum time for task verification, executable grading, and receipt construction. */
+    resultTimeoutMs?: number;
+}
+/** Executes and finalizes one durably claimed candidate without exposing an unproven result. */
+declare function executePreparedAgentCandidate(prepared: PreparedAgentCandidateExecution, options: ExecutePreparedAgentCandidateOptions): Promise<AgentCandidateRunFinalization>;
+
+/** Persist evaluator evidence, read it back, and bind the returned locator to the exact bytes. */
+declare function persistCandidateOutputArtifact(port: AgentCandidateOutputArtifactPort, input: {
+    executionId: string;
+    purpose: AgentCandidateOutputPurpose;
+    bytes: Uint8Array;
+    signal?: AbortSignal;
+}): Promise<AgentCandidateArtifactRef>;
+
+interface PrepareAgentCandidateExecutionOptions {
+    cleanupTimeoutMs?: number;
+    /** Maximum time for task verification, executable grading, and receipt construction. */
+    resultTimeoutMs?: number;
+}
+/** Materializes a verified candidate into one immutable evaluator-owned execution plan. */
+declare function prepareAgentCandidateExecution(candidate: VerifiedAgentCandidate, task: AgentCandidateTaskExecution, ports: AgentCandidateExecutionPorts, options?: PrepareAgentCandidateExecutionOptions): Promise<PreparedAgentCandidateExecution>;
+
+type AgentCandidateModelGrantReserveInput = Parameters<AgentCandidateModelPort['reserveGrant']>[0];
+type AgentCandidateModelGrantActivateInput = Parameters<AgentCandidateModelPort['activateGrant']>[0];
+type AgentCandidateModelGrantSettleInput = Parameters<AgentCandidateModelPort['settleGrant']>[0];
+/** Secret-free response from the service's reservation endpoint. */
+type AgentCandidateModelGrantReservation = AgentCandidateProtectedModelReservation;
+/**
+ * Narrow transport contract for a service that owns scoped model credentials
+ * and the authoritative per-call usage ledger.
+ *
+ * An HTTP client can bind these methods to control-plane endpoints. Keeping
+ * transport out of the runtime prevents parent credentials, endpoint paths,
+ * and retry policy from becoming part of the portable candidate contract.
+ */
+interface AgentCandidateModelGrantClient {
+    reserve(input: AgentCandidateModelGrantReserveInput): Promise<AgentCandidateModelGrantReservation>;
+    activate(input: AgentCandidateModelGrantActivateInput): Promise<AgentCandidateProtectedModelActivation>;
+    settle(input: AgentCandidateModelGrantSettleInput): Promise<AgentCandidateProtectedModelSettlement>;
+}
+interface CreateProtectedAgentCandidateModelPortOptions {
+    client: AgentCandidateModelGrantClient;
+    /** Catalog/snapshot resolution stays separate from credential issuance. */
+    resolveModel: AgentCandidateModelPort['resolve'];
+    /** The only public DNS name candidate processes may reach for inference. */
+    gatewayDomain: string;
+    /** Exact environment names the activation endpoint must return, no more or fewer. */
+    activationEnvNames: readonly string[];
+}
+/**
+ * Bind a protected model-grant service to the immutable candidate runtime.
+ *
+ * The service remains the authority for expiry, admission, revocation, and
+ * metering. This adapter independently checks every response before allowing
+ * it to cross into candidate execution or durable receipt finalization.
+ */
+declare function createProtectedAgentCandidateModelPort(options: CreateProtectedAgentCandidateModelPortOptions): AgentCandidateModelPort;
+
+interface RecoverExpiredAgentCandidateOptions {
+    attempt: AgentCandidateExecutionAttemptRef;
+    claimStore: AgentCandidateExecutionClaimStore;
+    executor: AgentCandidateExecutorPort;
+    traceStore: TraceStore;
+    ports: Pick<AgentCandidateExecutionPorts, 'models' | 'memory'>;
+    outputArtifacts: AgentCandidateOutputArtifactPort;
+    cleanupTimeoutMs?: number;
+    /** Evaluator clock; must be the same clock used by the claim store. */
+    now?: () => number;
+}
+/** Close an expired crashed attempt from persisted non-secret handles, then record failure. */
+declare function recoverExpiredAgentCandidateExecution(options: RecoverExpiredAgentCandidateOptions): Promise<AgentCandidateExecutionFinishResult>;
+
+/** Verifies every digest, resource, workspace, and Git object in a candidate bundle. */
+declare function verifyAgentCandidateBundle(input: unknown, ports: AgentCandidateVerificationPorts): Promise<VerifiedAgentCandidate>;
+
 /**
  *
  * Per-call resilience policy for participant backends: deadline, retry with
@@ -2041,4 +2842,4 @@ interface StreamToolLoopOptions<Raw> {
  *  `capped` if it stops for any non-completed reason with calls still pending. */
 declare function streamToolLoop<Raw>(opts: StreamToolLoopOptions<Raw>): AsyncGenerator<StreamToolLoopYield<Raw>, void, unknown>;
 
-export { AgentBackendContext, AgentBackendInput, type AgentBackendKind, AgentExecutionBackend, AgentRuntimeEvent, AgentTaskRunResult, AgentTaskStatus, type AuthSource, type BackendCallPolicy, BackendTransportError, CandidateGenerator, type ChatStreamEvent, type ChatTurnHooks, type ChatTurnIdentity, type ChatTurnProducer, type ChatTurnResult, type CircuitBreakerConfig, CircuitBreakerState, CircuitOpenError, type Conversation, type ConversationDriveState, type ConversationJournal, type ConversationJournalEntry, type ConversationParticipant, type ConversationPolicy, type ConversationResult, type ConversationStreamEvent, type ConversationTurn, type D1DatabaseLike, type D1StmtLike, DEFAULT_MAX_DEPTH, DEFAULT_ROUTER_BASE_URL, DeadlineExceededError, FORWARD_HEADERS, FileConversationJournal, type ForwardHeaderName, type HaltContext, type HaltPredicate, type HaltReason, type HaltSignal, type ImproveOptions, type ImproveResult, type ImproveSurface, InMemoryConversationJournal, InMemoryRuntimeSessionStore, type ModelInfo, OpenAIChatResponseFormat, OpenAIChatTool, OpenAIChatToolChoice, type PersonaConversationResult, type PersonaDriver, PlannerError, type PropagatedHeaders, ROLLOUT_POLICY_BOUNDS, ROLLOUT_POLICY_EXTENSION, type RawTraceDistillerOptions, type ReflectiveGeneratorOptions, type ResolveAgentBackendOptions, type ResolvedChatModel, type RetryBackoff, type RetryableErrorPredicate, type RouterEnv, type RunChatTurnInput, type RunConversationOptions, type RunPersonaConfig, type RunPersonaConversationOptions, type RunToolLoopOptions, type RuntimeEventCollector, RuntimeHooks, RuntimeRunStateError, RuntimeSessionStore, RuntimeStreamEvent, type RuntimeStreamEventCollector, type RuntimeTelemetryOptions, type SanitizedKnowledgeReadinessReport, type SqlAdapter, SqlConversationJournal, type StreamToolLoopOptions, type StreamToolLoopYield, type ToolCallOutcome, type ToolLoopAssistantToolCall, type ToolLoopCall, type ToolLoopEvent, type ToolLoopMessage, type ToolLoopResult, type ToolLoopStopReason, type TurnOrder, Verifier, applyRolloutPolicyToProfile, applyRunRecordDefaults, buildForwardHeaders, cleanModelId, computeBackoff, createConversationBackend, createIterableBackend, createOpenAICompatibleBackend, createRuntimeEventCollector, createRuntimeStreamEventCollector, createSandboxPromptBackend, d1ToSqlAdapter, decideKnowledgeReadiness, defaultIsRetryable, defineConversation, deriveExecutionId, enumerateNeighborPolicies, getModels, handleChatTurn, improve, isDepthExceeded, makePerAttemptSignal, mcpBuildPrompt, normalizeRolloutPolicy, parseRolloutPolicy, rawTraceDistiller, readDepth, readinessServerSentEvent, reflectiveGenerator, resolveAgentBackend, resolveChatModel, resolveRouterBaseUrl, rolloutPolicyProposer, runAgentTask, runAgentTaskStream, runConversation, runConversationStream, runPersonaConversation, runPersonaDispatch, runToolLoop, runtimeStreamServerSentEvent, sanitizeAgentRuntimeEvent, sanitizeKnowledgeReadinessReport, sanitizeRuntimeStreamEvent, serializeRolloutPolicy, sleep, slugifySpeaker, streamToolLoop, structuralRolloutPolicyFromProfile, toolBuildPrompt, turnId, validateChatModelId };
+export { AgentBackendContext, AgentBackendInput, type AgentBackendKind, type AgentCandidateArtifactPort, type AgentCandidateBenchmarkGraderPort, type AgentCandidateContainerPort, type AgentCandidateExecutionAttemptRecord, type AgentCandidateExecutionAttemptRef, type AgentCandidateExecutionClaim, type AgentCandidateExecutionClaimResult, type AgentCandidateExecutionClaimStore, type AgentCandidateExecutionCleanupHandles, type AgentCandidateExecutionFailureClass, type AgentCandidateExecutionFinishResult, type AgentCandidateExecutionLease, type AgentCandidateExecutionPhase, type AgentCandidateExecutionPhaseResult, type AgentCandidateExecutionPorts, type AgentCandidateExecutionRecoveryEvidence, type AgentCandidateExecutionStageResult, type AgentCandidateExecutionTerminalRecord, type AgentCandidateExecutionTerminalResult, type AgentCandidateExecutionUsage, type AgentCandidateExecutorFinalCapture, type AgentCandidateExecutorMemoryCapture, type AgentCandidateExecutorPort, type AgentCandidateExecutorProfileFile, type AgentCandidateExecutorRequest, type AgentCandidateExecutorStopRequest, type AgentCandidateExecutorTaskOutcomeCapture, type AgentCandidateExecutorWorkspaceFile, type AgentCandidateExecutorWorkspaceInput, type AgentCandidateMemoryPort, type AgentCandidateMemoryResetResult, type AgentCandidateModelGrantActivateInput, type AgentCandidateModelGrantClient, type AgentCandidateModelGrantReservation, type AgentCandidateModelGrantReserveInput, type AgentCandidateModelGrantSettleInput, type AgentCandidateModelLimits, type AgentCandidateModelPort, type AgentCandidateOutputArtifactPort, type AgentCandidateOutputPurpose, type AgentCandidateProtectedModelActivation, type AgentCandidateProtectedModelCall, type AgentCandidateProtectedModelReservation, type AgentCandidateProtectedModelSettlement, type AgentCandidateProtectedRunCapture, type AgentCandidateRepositoryPort, type AgentCandidateRetryRejection, type AgentCandidateRunFinalization, type AgentCandidateTaskExecution, type AgentCandidateVerificationPorts, type AgentCandidateWorkspacePort, AgentExecutionBackend, AgentRuntimeEvent, AgentTaskRunResult, AgentTaskStatus, type AuthSource, type BackendCallPolicy, BackendTransportError, CANDIDATE_TRACE_ENV, CANDIDATE_TRACE_TAGS, CandidateGenerator, type CanonicalCandidateDocument, type ChatStreamEvent, type ChatTurnHooks, type ChatTurnIdentity, type ChatTurnProducer, type ChatTurnResult, type CircuitBreakerConfig, CircuitBreakerState, CircuitOpenError, type Conversation, type ConversationDriveState, type ConversationJournal, type ConversationJournalEntry, type ConversationParticipant, type ConversationPolicy, type ConversationResult, type ConversationStreamEvent, type ConversationTurn, type CreateProtectedAgentCandidateModelPortOptions, type D1DatabaseLike, type D1StmtLike, DEFAULT_MAX_DEPTH, DEFAULT_ROUTER_BASE_URL, DeadlineExceededError, type DisposePreparedAgentCandidateOptions, type ExecutePreparedAgentCandidateOptions, FORWARD_HEADERS, FileAgentCandidateExecutionClaimStore, type FileAgentCandidateExecutionClaimStoreOptions, FileConversationJournal, type ForwardHeaderName, type HaltContext, type HaltPredicate, type HaltReason, type HaltSignal, type ImproveOptions, type ImproveResult, type ImproveSurface, InMemoryAgentCandidateExecutionClaimStore, InMemoryConversationJournal, InMemoryRuntimeSessionStore, type ModelInfo, OpenAIChatResponseFormat, OpenAIChatTool, OpenAIChatToolChoice, type PersonaConversationResult, type PersonaDriver, PlannerError, type PrepareAgentCandidateExecutionOptions, type PreparedAgentCandidateExecution, type PreparedAgentCandidateInstruction, type PreparedAgentCandidateLaunch, type PreparedAgentCandidateTrace, type PropagatedHeaders, ROLLOUT_POLICY_BOUNDS, ROLLOUT_POLICY_EXTENSION, type RawTraceDistillerOptions, type RecoverExpiredAgentCandidateOptions, type ReflectiveGeneratorOptions, type ResolveAgentBackendOptions, type ResolvedAgentCandidateContainer, type ResolvedChatModel, type RetryBackoff, type RetryableErrorPredicate, type RouterEnv, type RunChatTurnInput, type RunConversationOptions, type RunPersonaConfig, type RunPersonaConversationOptions, type RunToolLoopOptions, type RuntimeEventCollector, RuntimeHooks, RuntimeRunStateError, RuntimeSessionStore, RuntimeStreamEvent, type RuntimeStreamEventCollector, type RuntimeTelemetryOptions, type SanitizedKnowledgeReadinessReport, type SqlAdapter, SqlConversationJournal, type StreamToolLoopOptions, type StreamToolLoopYield, type ToolCallOutcome, type ToolLoopAssistantToolCall, type ToolLoopCall, type ToolLoopEvent, type ToolLoopMessage, type ToolLoopResult, type ToolLoopStopReason, type TurnOrder, type VerifiedAgentCandidate, type VerifiedAgentCandidateTaskOutcome, Verifier, applyRolloutPolicyToProfile, applyRunRecordDefaults, buildForwardHeaders, candidateExecutionClaim, cleanModelId, computeBackoff, createConversationBackend, createIterableBackend, createOpenAICompatibleBackend, createProtectedAgentCandidateModelPort, createRuntimeEventCollector, createRuntimeStreamEventCollector, createSandboxPromptBackend, d1ToSqlAdapter, decideKnowledgeReadiness, defaultIsRetryable, defineConversation, deriveExecutionId, disposePreparedAgentCandidateExecution, enumerateNeighborPolicies, executePreparedAgentCandidate, getModels, handleChatTurn, improve, isDepthExceeded, makePerAttemptSignal, mcpBuildPrompt, normalizeRolloutPolicy, parseRolloutPolicy, persistCandidateOutputArtifact, prepareAgentCandidateExecution, rawTraceDistiller, readDepth, readinessServerSentEvent, recoverExpiredAgentCandidateExecution, reflectiveGenerator, resolveAgentBackend, resolveChatModel, resolveRouterBaseUrl, rolloutPolicyProposer, runAgentTask, runAgentTaskStream, runConversation, runConversationStream, runPersonaConversation, runPersonaDispatch, runToolLoop, runtimeStreamServerSentEvent, sanitizeAgentRuntimeEvent, sanitizeKnowledgeReadinessReport, sanitizeRuntimeStreamEvent, serializeRolloutPolicy, sleep, slugifySpeaker, streamToolLoop, structuralRolloutPolicyFromProfile, toolBuildPrompt, turnId, validateChatModelId, verifyAgentCandidateBundle };