@tangle-network/agent-runtime 0.94.12 → 0.95.0

package/dist/prepare-DIeVgQG3.d.ts

@@ -1,718 +0,0 @@
-import { AgentCandidateBundle, AgentCandidateArtifactRef, AgentCandidateTermination, AgentCandidateTaskOutcomeEvidence, Sha256Digest, AgentCandidateContainer, AgentCandidateOciPlatform, AgentCandidateGitHubRepository, AgentCandidateWorkspaceSnapshotEvidence, AgentCandidateResolvedModel, AgentCandidateAttemptPolicy, AgentCandidateExecutionLimits, AgentCandidateModelAccessNetwork, AgentCandidateCapturedArtifact, AgentCandidateWorkspaceManifestMaterialV1, AgentCandidateProfilePlanEvidence, AgentCandidateExecutionPlanEvidence, AgentCandidateMaterializationReceipt, AgentCandidateInstructionDelivery, AgentCandidateEffectiveMemory, AgentCandidateRunReceiptV2, AgentCandidateSpend, ReasoningEffort } from '@tangle-network/agent-interface';
-import { BenchmarkEvaluation, TraceStore } from '@tangle-network/agent-eval';
-
-/** Exact candidate wire shape before the runtime computes its canonical digest. */
-type AgentCandidateBundleInput = Omit<AgentCandidateBundle, 'digest'>;
-/** Validate and content-address a candidate bundle before it crosses an approval boundary. */
-declare function sealAgentCandidateBundle(input: AgentCandidateBundleInput): AgentCandidateBundle;
-
-declare const verifiedCandidateBrand: unique symbol;
-declare const preparedCandidateBrand: unique symbol;
-declare const verifiedTaskOutcomeBrand: unique symbol;
-/** Reads one content-addressed object from the closed S3/IPFS locator set. */
-interface AgentCandidateArtifactPort {
-    read(ref: AgentCandidateArtifactRef): Promise<Uint8Array>;
-}
-type AgentCandidateOutputPurpose = 'candidate-workspace-manifest' | 'candidate-workspace-archive' | 'task-manifest' | 'task-archive' | 'task-patch' | 'task-outcome' | 'memory-after-manifest' | 'memory-after-archive' | 'grader-evidence' | 'benchmark-result' | 'model-settlement' | 'trace' | 'run-receipt' | 'failure-evidence';
-/** Durable content-addressed evidence store controlled only by the evaluator. */
-interface AgentCandidateOutputArtifactPort extends AgentCandidateArtifactPort {
-    /** Must be idempotent for identical bytes and return only a durable S3/IPFS locator. */
-    put(input: {
-        executionId: string;
-        purpose: AgentCandidateOutputPurpose;
-        bytes: Uint8Array;
-        /** Abort must prevent durable publication when it happens before resolution. */
-        signal?: AbortSignal;
-    }): Promise<AgentCandidateArtifactRef>;
-}
-/** Resolves a declared GitHub repository to an already-present local Git object store. */
-interface AgentCandidateRepositoryPort {
-    resolve(repository: AgentCandidateGitHubRepository): Promise<string>;
-}
-interface AgentCandidateVerificationPorts {
-    artifacts: AgentCandidateArtifactPort;
-    repositories: AgentCandidateRepositoryPort;
-}
-/**
- * Materializes an already-verified workspace archive.
- *
- * The runtime independently scans every resulting byte, mode, and path against
- * the signed manifest after this returns. Implementations may therefore unpack
- * any archive encoding, or no-op when the exact workspace is already present.
- */
-interface AgentCandidateWorkspacePort {
-    materialize(input: {
-        role: 'task' | 'candidate' | 'memory';
-        snapshot: AgentCandidateWorkspaceSnapshotEvidence;
-        archive: Uint8Array;
-        destination: string;
-    }): Promise<void>;
-}
-interface ResolvedAgentCandidateContainer {
-    source: 'pinned-container' | 'evaluator-task-container';
-    image: string;
-    indexDigest: Sha256Digest;
-    manifestDigest: Sha256Digest;
-    platform: AgentCandidateOciPlatform;
-}
-interface AgentCandidateContainerPort {
-    resolve(input: {
-        candidate: AgentCandidateContainer | undefined;
-        evaluatorTaskContainer: ResolvedAgentCandidateContainer | undefined;
-    }): Promise<ResolvedAgentCandidateContainer>;
-}
-interface AgentCandidateModelPort {
-    resolve(input: {
-        requested: string;
-        harness: AgentCandidateBundle['execution']['harness'];
-        reasoningEffort: NonNullable<AgentCandidateBundle['profile']['model']>['reasoningEffort'];
-    }): Promise<AgentCandidateResolvedModel>;
-    /**
-     * Reserve a stable access identity without creating a live credential.
-     * The reservation is scoped to `preparationId` and must automatically expire
-     * at `expiresAtMs`, even if this call returns ambiguously to the runtime.
-     */
-    reserveGrant(input: {
-        executionId: string;
-        preparationId: string;
-        expiresAtMs: number;
-        attempt: AgentCandidateAttemptPolicy;
-        bundleDigest: Sha256Digest;
-        resolved: AgentCandidateResolvedModel;
-        limits: AgentCandidateModelLimits;
-    }): Promise<AgentCandidateProtectedModelReservation>;
-    /** Create the live scoped credential only after the execution attempt is durably claimed. */
-    activateGrant(input: {
-        executionId: string;
-        preparationId: string;
-        grantDigest: Sha256Digest;
-        resolved: AgentCandidateResolvedModel;
-        deadlineAtMs: number;
-    }): Promise<AgentCandidateProtectedModelActivation>;
-    /**
-     * Atomically revoke the grant, drain in-flight calls, and return its immutable final ledger.
-     * This operation must be idempotent for the exact preparation and must also
-     * settle a reservation that was never activated. It must never affect a
-     * different preparation, even when both reservations report the same digest.
-     */
-    settleGrant(input: {
-        executionId: string;
-        preparationId: string;
-        grantDigest: Sha256Digest;
-        resolved: AgentCandidateResolvedModel;
-        reason: 'completed' | 'failed' | 'timeout' | 'replayed' | 'preparation-failed' | 'abandoned';
-    }): Promise<AgentCandidateProtectedModelSettlement>;
-}
-/** Limits mechanically enforced by the evaluator-owned model gateway. */
-type AgentCandidateModelLimits = Pick<AgentCandidateExecutionLimits, 'maxModelCalls' | 'maxInputTokens' | 'maxOutputTokens' | 'maxCostUsd'>;
-interface AgentCandidateBenchmarkGraderIdentity {
-    name: string;
-    version: string;
-    artifact: AgentCandidateArtifactRef;
-}
-interface AgentCandidateProtectedModelReservation {
-    preparationId: string;
-    digest: Sha256Digest;
-    /** Evaluator service must expire and revoke this reservation at this epoch millisecond. */
-    expiresAtMs: number;
-    /** The gateway must stop calls before any one of these limits is exceeded. */
-    enforcedLimits: AgentCandidateModelLimits;
-    /** Exact public endpoint exception; every other candidate destination stays blocked. */
-    network: AgentCandidateModelAccessNetwork;
-}
-interface AgentCandidateProtectedModelActivation {
-    /** Injected only into the trusted executor after all pre-launch checks pass. */
-    env: Readonly<Record<string, string>>;
-}
-/** One evaluator-gateway call in the final, revoked model-access ledger. */
-interface AgentCandidateProtectedModelCall {
-    callId: string;
-    /** Router-generated public response identity. */
-    generationId: string;
-    /** Exact protected agent-eval LLM span produced from the router ledger. */
-    traceSpanId: string;
-    status: 'succeeded' | 'failed';
-    model: string;
-    startedAtMs: number;
-    endedAtMs: number;
-    inputTokens: number;
-    outputTokens: number;
-    cachedInputTokens: number;
-    reasoningTokens: number;
-    /** Integer billionths of one US dollar; avoids floating-point ledger drift. */
-    costUsdNanos: number;
-}
-interface AgentCandidateProtectedModelSettlement {
-    preparationId: string;
-    grantDigest: Sha256Digest;
-    closed: true;
-    calls: readonly AgentCandidateProtectedModelCall[];
-}
-interface AgentCandidateMemoryResetResult {
-    preparationId: string;
-    accessDigest: Sha256Digest;
-    expiresAtMs: number;
-    evidence: AgentCandidateCapturedArtifact;
-    emptyStateDigest: Sha256Digest;
-    beforeState: AgentCandidateWorkspaceSnapshotEvidence;
-}
-interface AgentCandidateMemoryPort {
-    /**
-     * Reset and reserve exact task memory without returning live access.
-     * The service must scope the reservation to `preparationId`, automatically
-     * revoke it at `expiresAtMs`, and never reuse it for another preparation.
-     */
-    reset(input: {
-        executionId: string;
-        preparationId: string;
-        expiresAtMs: number;
-        effectiveNamespace: string;
-        seed?: Uint8Array;
-        seedDigest?: Sha256Digest;
-    }): Promise<AgentCandidateMemoryResetResult>;
-    /**
-     * Create live scoped access only after the execution attempt is durably claimed.
-     * Activation must match the exact preparation/access pair and may not extend expiry.
-     */
-    activate(input: {
-        executionId: string;
-        preparationId: string;
-        accessDigest: Sha256Digest;
-        effectiveNamespace: string;
-        deadlineAtMs: number;
-    }): Promise<{
-        env: Readonly<Record<string, string>>;
-    }>;
-    /**
-     * Revoke evaluator-owned access after process death or a failed preparation.
-     * Must be idempotent and concurrency-safe for the exact preparation/access
-     * pair and must never close a different preparation.
-     */
-    close(input: {
-        executionId: string;
-        preparationId: string;
-        accessDigest: Sha256Digest;
-        effectiveNamespace: string;
-        reason: 'completed' | 'failed' | 'timeout' | 'replayed' | 'preparation-failed' | 'abandoned';
-    }): Promise<{
-        closed: true;
-    }>;
-}
-interface AgentCandidateExecutionPorts extends AgentCandidateVerificationPorts {
-    workspaces: AgentCandidateWorkspacePort;
-    containers: AgentCandidateContainerPort;
-    models: AgentCandidateModelPort;
-    memory: AgentCandidateMemoryPort;
-}
-interface AgentCandidateTaskExecution {
-    executionId: string;
-    benchmark: string;
-    benchmarkVersion: string;
-    taskId: string;
-    splitDigest: Sha256Digest;
-    /** Exact agent-visible task instruction. The runtime rejects malformed Unicode. */
-    instruction: string;
-    repository: {
-        identity: string;
-        rootIdentity: string;
-        baseCommit: string;
-        baseTree: string;
-    };
-    attempt: AgentCandidateAttemptPolicy;
-    model: {
-        requested: string;
-        reasoningEffort: ReasoningEffort;
-    };
-    grader: AgentCandidateBenchmarkGraderIdentity;
-    /** Absolute paths inside the evaluator-owned execution environment. */
-    executionRoots: {
-        taskRoot: string;
-        candidateRoot?: string;
-    };
-    /** Host-side staging roots. These are verified but never signed as container paths. */
-    stagingRoots: {
-        taskRoot: string;
-        candidateRoot?: string;
-        profileRoot: string;
-    };
-    workspace: AgentCandidateWorkspaceSnapshotEvidence;
-    evaluatorTaskContainer?: ResolvedAgentCandidateContainer;
-    limits: AgentCandidateExecutionLimits;
-}
-interface VerifiedAgentCandidate {
-    readonly bundle: AgentCandidateBundle;
-    readonly materializedTree?: string;
-    readonly [verifiedCandidateBrand]: true;
-}
-interface CanonicalCandidateDocument<T> {
-    readonly value: T;
-    /** Canonical UTF-8 bytes of `value` with its top-level digest omitted. */
-    readonly bytes: Uint8Array;
-    readonly digest: Sha256Digest;
-}
-interface PreparedAgentCandidateLaunch {
-    executable: string;
-    /** Complete fixed argv, including profile materializer flags but excluding task delivery. */
-    args: readonly string[];
-    env: Readonly<Record<string, string>>;
-    /** Informational subset already present at the tail of `args`; executors must not append twice. */
-    flags: readonly string[];
-    cwd: string;
-}
-interface PreparedAgentCandidateInstruction {
-    bytes: Uint8Array;
-    delivery: AgentCandidateInstructionDelivery;
-}
-interface PreparedAgentCandidateTrace {
-    runId: string;
-    tags: Readonly<Record<string, string>>;
-    env: Readonly<Record<string, string>>;
-}
-interface PreparedAgentCandidateExecution {
-    readonly bundle: AgentCandidateBundle;
-    readonly executionId: string;
-    readonly roots: {
-        execution: {
-            taskRoot: string;
-            candidateRoot?: string;
-        };
-        staging: {
-            taskRoot: string;
-            candidateRoot?: string;
-            profileRoot: string;
-        };
-    };
-    readonly profilePlan: {
-        value: AgentCandidateProfilePlanEvidence;
-        bytes: Uint8Array;
-        written: readonly string[];
-    };
-    readonly executionPlan: {
-        value: AgentCandidateExecutionPlanEvidence;
-        bytes: Uint8Array;
-    };
-    readonly materializationReceipt: CanonicalCandidateDocument<AgentCandidateMaterializationReceipt>;
-    readonly launch: PreparedAgentCandidateLaunch;
-    readonly instruction: PreparedAgentCandidateInstruction;
-    readonly resolvedModel: AgentCandidateResolvedModel;
-    readonly knowledge?: {
-        snapshotId: string;
-        manifestDigest: Sha256Digest;
-        manifest: Uint8Array;
-    };
-    readonly trace: PreparedAgentCandidateTrace;
-    readonly memory: AgentCandidateEffectiveMemory;
-    readonly [preparedCandidateBrand]: true;
-}
-interface AgentCandidateProtectedRunCapture {
-    executionId: string;
-    termination: AgentCandidateTermination;
-}
-/** Raw evaluator capture made only after the candidate process is dead. */
-interface AgentCandidateExecutorTaskOutcomeCapture {
-    /** Claimed final tree. The runtime recomputes it independently from `gitDiff`. */
-    resultTree: string;
-    /** Complete evaluator-captured workspace description after candidate execution. */
-    afterState: AgentCandidateWorkspaceManifestMaterialV1;
-    /** Reproducible workspace archive corresponding to `afterState`. */
-    archive: Uint8Array;
-    /** Exact binary patch from the signed task base to `afterState`. */
-    gitDiff: Uint8Array;
-}
-/** Raw isolated-memory capture made only after access has been revoked. */
-interface AgentCandidateExecutorMemoryCapture {
-    readonly afterState: AgentCandidateWorkspaceManifestMaterialV1;
-    readonly archive: Uint8Array;
-}
-/** Idempotent executor result after process death and trace drain. */
-interface AgentCandidateExecutorFinalCapture {
-    readonly stopped: true;
-    readonly taskOutcome?: AgentCandidateExecutorTaskOutcomeCapture;
-    /** Required only when the prepared candidate uses isolated task memory. */
-    readonly memoryAfter?: AgentCandidateExecutorMemoryCapture;
-}
-/** Branded task outcome that has survived independent patch and tree verification. */
-interface VerifiedAgentCandidateTaskOutcome {
-    readonly evidence: AgentCandidateTaskOutcomeEvidence & {
-        readonly artifact: AgentCandidateArtifactRef;
-    };
-    readonly patch: Uint8Array;
-    readonly [verifiedTaskOutcomeBrand]: true;
-}
-/**
- * Evaluator-owned executable grader, pinned by immutable implementation bytes.
- *
- * `run` is an isolation boundary, not an arbitrary scoring callback. The
- * implementation admitted to that boundary is supplied by the runtime after
- * artifact verification. Implementations must derive every returned binding
- * digest from the bytes and task outcome they actually admitted, rather than
- * copying an expected digest from ambient configuration.
- */
-interface AgentCandidateBenchmarkGraderPort {
-    readonly name: string;
-    readonly version: string;
-    readonly artifact: AgentCandidateArtifactRef;
-    run(input: {
-        readonly executionId: string;
-        readonly termination: AgentCandidateTermination;
-        readonly outcome: VerifiedAgentCandidateTaskOutcome;
-        /** Exact verified artifact bytes. Each read returns a detached copy. */
-        readonly implementation: {
-            readonly byteLength: number;
-            readonly bytes: Uint8Array;
-        };
-        /** Frozen result deadline; runners must stop work and side effects when aborted. */
-        readonly signal: AbortSignal;
-    }): Promise<{
-        readonly evaluation: BenchmarkEvaluation;
-        /** Raw grader output needed to audit or reproduce the normalized result. */
-        readonly evidence: Uint8Array;
-        /** Runtime-checked binding between admitted code, task input, and raw output. */
-        readonly binding: {
-            /** Digest computed from the implementation bytes admitted to execution. */
-            readonly implementationDigest: Sha256Digest;
-            /** Digest of the exact runtime-verified task outcome graded by this run. */
-            readonly taskOutcomeDigest: Sha256Digest;
-            /** Digest computed from `evidence` before it leaves the execution boundary. */
-            readonly outputDigest: Sha256Digest;
-        };
-    }>;
-}
-/** One detached request passed to the trusted environment-specific executor. */
-interface AgentCandidateExecutorRequest {
-    readonly executionId: string;
-    /** Immutable bytes from which the executor creates fresh isolated workspaces. */
-    readonly inputs: {
-        readonly task: AgentCandidateExecutorWorkspaceInput;
-        readonly candidate?: AgentCandidateExecutorWorkspaceInput;
-        readonly profile: {
-            readonly files: readonly AgentCandidateExecutorProfileFile[];
-        };
-    };
-    readonly roots: PreparedAgentCandidateExecution['roots']['execution'];
-    readonly profilePlan: PreparedAgentCandidateExecution['profilePlan'];
-    readonly executionPlan: PreparedAgentCandidateExecution['executionPlan'];
-    readonly materializationReceipt: CanonicalCandidateDocument<AgentCandidateMaterializationReceipt>;
-    readonly launch: PreparedAgentCandidateLaunch;
-    readonly instruction: PreparedAgentCandidateInstruction;
-    readonly resolvedModel: AgentCandidateResolvedModel;
-    /** Mechanically enforced by the runtime plus executor process-death acknowledgement. */
-    readonly hardLimits: Pick<AgentCandidateExecutionLimits, 'timeoutMs'>;
-    /** Validity bound checked against protected traces; generic black-box executors cannot preempt it. */
-    readonly observedLimits: Pick<AgentCandidateExecutionLimits, 'maxSteps'>;
-    readonly knowledge?: PreparedAgentCandidateExecution['knowledge'];
-    readonly trace: PreparedAgentCandidateTrace;
-    readonly memory: AgentCandidateEffectiveMemory;
-}
-/**
- * Executes one prepared request inside an evaluator-owned isolation boundary.
- *
- * `request.launch.env` is the complete allowlisted environment, including
- * protected model, memory, and trace bindings. Implementations must not merge
- * ambient host variables into it. The returned capture deliberately contains
- * no candidate-authored usage or score fields.
- */
-interface AgentCandidateExecutorPort {
-    execute(request: AgentCandidateExecutorRequest, context: {
-        traceStore: TraceStore;
-        /** Aborted by the runtime at the exact frozen wall-time deadline. */
-        signal: AbortSignal;
-        /** Absolute epoch-millisecond deadline owned by the runtime. */
-        deadlineAtMs: number;
-    }): Promise<AgentCandidateProtectedRunCapture>;
-    /**
-     * Kill any process/container still associated with the request, drain trace
-     * writes, and capture the final task workspace before teardown.
-     * The runtime calls this on success, failure, and timeout before model settlement.
-     * Implementations must be idempotent and concurrency-safe for this exact
-     * execution/plan pair because a fresh worker may repeat crash recovery.
-     */
-    stopAndCapture(request: AgentCandidateExecutorStopRequest, context: {
-        traceStore: TraceStore;
-        reason: 'completed' | 'failed' | 'timeout';
-        /** Aborted at the frozen execution deadline or evaluator cleanup deadline. */
-        signal: AbortSignal;
-        /** Absolute execution deadline; a later stop acknowledgement cannot produce success. */
-        deadlineAtMs: number;
-    }): Promise<AgentCandidateExecutorFinalCapture>;
-}
-/** Opaque process identity used for termination without re-exposing launch credentials. */
-interface AgentCandidateExecutorStopRequest {
-    readonly executionId: string;
-    readonly executionPlanDigest: Sha256Digest;
-}
-interface AgentCandidateExecutorWorkspaceInput {
-    readonly snapshot: AgentCandidateWorkspaceSnapshotEvidence;
-    readonly files: readonly AgentCandidateExecutorWorkspaceFile[];
-}
-interface AgentCandidateExecutorWorkspaceFile {
-    readonly path: string;
-    readonly mode: 0o644 | 0o755;
-    readonly bytes: Uint8Array;
-}
-interface AgentCandidateExecutorProfileFile {
-    readonly path: string;
-    readonly mode: 0o644 | 0o755;
-    readonly bytes: Uint8Array;
-}
-type AgentCandidateRunFinalization = {
-    succeeded: true;
-    receipt: CanonicalCandidateDocument<AgentCandidateRunReceiptV2>;
-    artifacts: {
-        modelSettlement: AgentCandidateArtifactRef;
-        taskOutcome: AgentCandidateArtifactRef;
-        benchmarkResult: AgentCandidateArtifactRef;
-        runReceipt: AgentCandidateArtifactRef;
-    };
-} | {
-    succeeded: false;
-    reason: string;
-    partial: {
-        executionId: string;
-        bundleDigest: Sha256Digest;
-        executionPlanDigest: Sha256Digest;
-        materializationReceiptDigest: Sha256Digest;
-        termination?: AgentCandidateTermination;
-    };
-    /** Independent evaluator-gateway usage, even when execution or trace capture failed. */
-    usage: AgentCandidateSpend | null;
-};
-/** Protected trace tags that bind a run to one prepared candidate execution. */
-declare const CANDIDATE_TRACE_TAGS: {
-    readonly executionId: "tangle.candidate.execution_id";
-    readonly bundleDigest: "tangle.candidate.bundle_digest";
-    readonly executionPlanDigest: "tangle.candidate.execution_plan_digest";
-    readonly materializationReceiptDigest: "tangle.candidate.materialization_receipt_digest";
-};
-/** Environment keys used to propagate immutable candidate trace identity. */
-declare const CANDIDATE_TRACE_ENV: {
-    readonly executionId: "TANGLE_CANDIDATE_EXECUTION_ID";
-    readonly bundleDigest: "TANGLE_CANDIDATE_BUNDLE_DIGEST";
-    readonly executionPlanDigest: "TANGLE_CANDIDATE_EXECUTION_PLAN_DIGEST";
-    readonly materializationReceiptDigest: "TANGLE_CANDIDATE_MATERIALIZATION_RECEIPT_DIGEST";
-    readonly traceRunId: "TANGLE_TRACE_RUN_ID";
-};
-
-/** Durable one-shot lifecycle for candidate execution attempts. */
-
-/** Non-secret identities a trusted recovery worker needs to close an abandoned attempt. */
-interface AgentCandidateExecutionCleanupHandles {
-    readonly preparationId: string;
-    readonly modelGrantDigest: Sha256Digest;
-    readonly resolvedModel: AgentCandidateResolvedModel;
-    readonly traceRunId: string;
-    readonly cleanupTimeoutMs: number;
-    readonly memory?: {
-        readonly accessDigest: Sha256Digest;
-        readonly effectiveNamespace: string;
-    };
-}
-/** Immutable signed identity stored for one execution attempt. */
-interface AgentCandidateExecutionClaim {
-    readonly executionId: string;
-    readonly attempt: number;
-    readonly maxAttempts: number;
-    readonly retryPolicy: AgentCandidateAttemptPolicy['retryPolicy'];
-    readonly bundleDigest: Sha256Digest;
-    readonly executionPlanDigest: Sha256Digest;
-    /** Frozen plan identity with only attempt number and per-attempt grant identity normalized. */
-    readonly retryLineageDigest: Sha256Digest;
-    /** The winning lease stops authorizing a new terminal write at this instant. */
-    readonly leaseExpiresAtMs: number;
-    /** Frozen budget for task verification, executable grading, and receipt construction. */
-    readonly resultTimeoutMs: number;
-    /** Non-secret handles retained so an expired attempt can be closed and reconciled. */
-    readonly cleanup: AgentCandidateExecutionCleanupHandles;
-}
-/** Secret capability required to finish the acquired attempt. */
-interface AgentCandidateExecutionLease {
-    readonly executionId: string;
-    readonly attempt: number;
-    readonly token: string;
-    readonly expiresAtMs: number;
-}
-/** Only the first class is retryable, and only when the closed model ledger has zero calls. */
-type AgentCandidateExecutionFailureClass = 'pre-model-infrastructure' | 'execution' | 'post-model-infrastructure' | 'unknown';
-/** Exact fixed-point usage proven by the closed evaluator model ledger. */
-interface AgentCandidateExecutionUsage {
-    readonly costUsdNanos: number;
-    readonly inputTokens: number;
-    readonly outputTokens: number;
-    readonly cachedInputTokens: number;
-    readonly reasoningTokens: number;
-    readonly modelCalls: number;
-}
-/** Evaluator-owned terminal facts staged durably before the terminal CAS. */
-type AgentCandidateExecutionTerminalResult = {
-    readonly schemaVersion: 1;
-    readonly status: 'succeeded';
-    readonly usage: AgentCandidateExecutionUsage;
-    readonly modelSettlement: AgentCandidateArtifactRef;
-    readonly taskOutcome: AgentCandidateArtifactRef;
-    readonly benchmarkResult: AgentCandidateArtifactRef;
-    readonly runReceipt: AgentCandidateArtifactRef;
-} | {
-    readonly schemaVersion: 1;
-    readonly status: 'failed';
-    readonly failureClass: AgentCandidateExecutionFailureClass;
-    readonly usage: AgentCandidateExecutionUsage;
-    readonly modelSettlement: AgentCandidateArtifactRef;
-    readonly failureEvidence?: AgentCandidateArtifactRef;
-};
-/** Durable terminal record for one acquired execution attempt. */
-type AgentCandidateExecutionTerminalRecord = AgentCandidateExecutionTerminalResult & {
-    readonly executionId: string;
-    readonly attempt: number;
-    readonly bundleDigest: Sha256Digest;
-    readonly executionPlanDigest: Sha256Digest;
-    /** RFC 8785 SHA-256 of this record with `terminalDigest` omitted. */
-    readonly terminalDigest: Sha256Digest;
-};
-/** Monotonic durable phase: the second value means candidate code could have started. */
-type AgentCandidateExecutionPhase = 'claimed' | 'candidate-may-run';
-/** Trusted, independently observed closure facts for one expired winning lease. */
-interface AgentCandidateExecutionRecoveryEvidence {
-    readonly failureClass: AgentCandidateExecutionFailureClass;
-    readonly usage: AgentCandidateExecutionUsage;
-    readonly modelSettlement: AgentCandidateArtifactRef;
-    readonly failureEvidence?: AgentCandidateArtifactRef;
-    readonly process: {
-        readonly stopped: true;
-        readonly executionPlanDigest: Sha256Digest;
-    };
-    readonly model: {
-        readonly closed: true;
-        readonly preparationId: string;
-        readonly grantDigest: Sha256Digest;
-    };
-    readonly memory?: {
-        readonly closed: true;
-        readonly preparationId: string;
-        readonly accessDigest: Sha256Digest;
-        readonly effectiveNamespace: string;
-    };
-}
-interface AgentCandidateExecutionAttemptRef {
-    readonly executionId: string;
-    readonly attempt: number;
-}
-/** Persisted state available to a fresh trusted recovery worker after a crash. */
-interface AgentCandidateExecutionAttemptRecord {
-    readonly claim: AgentCandidateExecutionClaim;
-    readonly phase: AgentCandidateExecutionPhase;
-    /** Durable outbox content written before the terminal compare-and-set. */
-    readonly staged?: AgentCandidateExecutionTerminalRecord;
-    readonly terminal?: AgentCandidateExecutionTerminalRecord;
-}
-/** Result of atomically claiming one execution attempt. */
-type AgentCandidateExecutionClaimResult = {
-    readonly acquired: true;
-    readonly claim: AgentCandidateExecutionClaim;
-    readonly lease: AgentCandidateExecutionLease;
-} | {
-    readonly acquired: false;
-    readonly reason: 'already-claimed';
-    /** The durable winner already occupying this execution-attempt slot. */
-    readonly claim: AgentCandidateExecutionClaim;
-    /** True only when every signed claim field matches the durable winner. */
-    readonly exactReplay: boolean;
-} | {
-    readonly acquired: false;
-    readonly reason: 'retry-not-eligible';
-    readonly claim: AgentCandidateExecutionClaim;
-    readonly detail: AgentCandidateRetryRejection;
-};
-/** Result of atomically recording an attempt's terminal facts. */
-type AgentCandidateExecutionFinishResult = {
-    readonly finished: true;
-    readonly terminal: AgentCandidateExecutionTerminalRecord;
-} | {
-    readonly finished: false;
-    readonly terminal: AgentCandidateExecutionTerminalRecord;
-    /** True when a repeated finish supplied the same terminal digest. */
-    readonly exactReplay: boolean;
-};
-/** Result of durably staging the one immutable terminal outbox entry. */
-type AgentCandidateExecutionStageResult = {
-    readonly staged: true;
-    readonly terminal: AgentCandidateExecutionTerminalRecord;
-} | {
-    readonly staged: false;
-    readonly terminal: AgentCandidateExecutionTerminalRecord;
-    readonly exactReplay: boolean;
-};
-/** Result of crossing the irreversible candidate-may-run boundary. */
-type AgentCandidateExecutionPhaseResult = {
-    readonly marked: true;
-    readonly phase: 'candidate-may-run';
-} | {
-    readonly marked: false;
-    readonly phase: 'candidate-may-run';
-};
-type AgentCandidateRetryRejection = 'prior-attempt-missing' | 'prior-attempt-running' | 'prior-attempt-succeeded' | 'prior-attempt-spent-model-calls' | 'prior-attempt-not-pre-model-infrastructure' | 'retry-lineage-mismatch';
-/**
- * Atomic one-shot store for candidate execution attempts.
- *
- * Implementations must linearize both methods across every process sharing the
- * store. Terminal publication is deliberately two-step: `stageTerminal`
- * fsyncs the complete immutable outbox record, then `finish` publishes exactly
- * those staged bytes by digest. A crash between the two leaves recoverable
- * evidence rather than an ambiguous completed run.
- */
-interface AgentCandidateExecutionClaimStore {
-    tryClaim(claim: AgentCandidateExecutionClaim): Promise<AgentCandidateExecutionClaimResult>;
-    getAttempt(attempt: AgentCandidateExecutionAttemptRef): Promise<AgentCandidateExecutionAttemptRecord | undefined>;
-    /** Persist the point after which candidate code may have run. */
-    markCandidateMayRun(lease: AgentCandidateExecutionLease): Promise<AgentCandidateExecutionPhaseResult>;
-    /** Fsync the complete terminal record into the durable outbox. */
-    stageTerminal(lease: AgentCandidateExecutionLease, result: AgentCandidateExecutionTerminalResult): Promise<AgentCandidateExecutionStageResult>;
-    /** Publish exactly the staged terminal identified by `terminalDigest`. */
-    finish(lease: AgentCandidateExecutionLease, terminalDigest: Sha256Digest): Promise<AgentCandidateExecutionFinishResult>;
-    /**
-     * Write a failed terminal only after the lease expired and a trusted worker
-     * independently proved process death plus model and memory closure.
-     */
-    recoverExpired(attempt: AgentCandidateExecutionAttemptRef, evidence: AgentCandidateExecutionRecoveryEvidence): Promise<AgentCandidateExecutionFinishResult>;
-}
-interface InMemoryAgentCandidateExecutionClaimStoreOptions {
-    /** Testable evaluator clock; defaults to `Date.now`. */
-    now?: () => number;
-}
-/** Single-process lifecycle implementation. */
-declare class InMemoryAgentCandidateExecutionClaimStore implements AgentCandidateExecutionClaimStore {
-    private readonly claims;
-    private readonly now;
-    constructor(options?: InMemoryAgentCandidateExecutionClaimStoreOptions);
-    tryClaim(requested: AgentCandidateExecutionClaim): Promise<AgentCandidateExecutionClaimResult>;
-    getAttempt(requestedAttempt: AgentCandidateExecutionAttemptRef): Promise<AgentCandidateExecutionAttemptRecord | undefined>;
-    markCandidateMayRun(requestedLease: AgentCandidateExecutionLease): Promise<AgentCandidateExecutionPhaseResult>;
-    stageTerminal(requestedLease: AgentCandidateExecutionLease, result: AgentCandidateExecutionTerminalResult): Promise<AgentCandidateExecutionStageResult>;
-    finish(requestedLease: AgentCandidateExecutionLease, requestedTerminalDigest: Sha256Digest): Promise<AgentCandidateExecutionFinishResult>;
-    recoverExpired(requestedAttempt: AgentCandidateExecutionAttemptRef, evidence: AgentCandidateExecutionRecoveryEvidence): Promise<AgentCandidateExecutionFinishResult>;
-    private requireClaim;
-}
-
-interface ExecutePreparedAgentCandidateOptions {
-    executor: AgentCandidateExecutorPort;
-    grader: AgentCandidateBenchmarkGraderPort;
-    outputArtifacts: AgentCandidateOutputArtifactPort;
-    traceStore: TraceStore;
-    /** Long-lived evaluator-owned store shared by every process that can run this benchmark. */
-    claimStore: AgentCandidateExecutionClaimStore;
-    /** Maximum time to prove process death and revoke protected access after a run ends. */
-    cleanupTimeoutMs?: number;
-    /** Maximum time for task verification, executable grading, and receipt construction. */
-    resultTimeoutMs?: number;
-}
-/** Executes and finalizes one durably claimed candidate without exposing an unproven result. */
-declare function executePreparedAgentCandidate(prepared: PreparedAgentCandidateExecution, options: ExecutePreparedAgentCandidateOptions): Promise<AgentCandidateRunFinalization>;
-
-interface PrepareAgentCandidateExecutionOptions {
-    cleanupTimeoutMs?: number;
-    /** Maximum time for task verification, executable grading, and receipt construction. */
-    resultTimeoutMs?: number;
-}
-/** Materializes a verified candidate into one immutable evaluator-owned execution plan. */
-declare function prepareAgentCandidateExecution(candidate: VerifiedAgentCandidate, task: AgentCandidateTaskExecution, ports: AgentCandidateExecutionPorts, options?: PrepareAgentCandidateExecutionOptions): Promise<PreparedAgentCandidateExecution>;
-
-export { InMemoryAgentCandidateExecutionClaimStore as $, type AgentCandidateBundleInput as A, type AgentCandidateExecutorProfileFile as B, type AgentCandidateExecutorRequest as C, type AgentCandidateExecutorStopRequest as D, type ExecutePreparedAgentCandidateOptions as E, type AgentCandidateExecutorTaskOutcomeCapture as F, type AgentCandidateExecutorWorkspaceFile as G, type AgentCandidateExecutorWorkspaceInput as H, type AgentCandidateMemoryPort as I, type AgentCandidateMemoryResetResult as J, type AgentCandidateModelLimits as K, type AgentCandidateModelPort as L, type AgentCandidateOutputArtifactPort as M, type AgentCandidateOutputPurpose as N, type AgentCandidateProtectedModelActivation as O, type PrepareAgentCandidateExecutionOptions as P, type AgentCandidateProtectedModelCall as Q, type AgentCandidateProtectedModelReservation as R, type AgentCandidateProtectedModelSettlement as S, type AgentCandidateProtectedRunCapture as T, type AgentCandidateRepositoryPort as U, type AgentCandidateRetryRejection as V, type AgentCandidateVerificationPorts as W, type AgentCandidateWorkspacePort as X, CANDIDATE_TRACE_ENV as Y, CANDIDATE_TRACE_TAGS as Z, type CanonicalCandidateDocument as _, type AgentCandidateTaskExecution as a, type PreparedAgentCandidateExecution as a0, type PreparedAgentCandidateInstruction as a1, type PreparedAgentCandidateLaunch as a2, type PreparedAgentCandidateTrace as a3, type ResolvedAgentCandidateContainer as a4, type VerifiedAgentCandidate as a5, type VerifiedAgentCandidateTaskOutcome as a6, executePreparedAgentCandidate as a7, prepareAgentCandidateExecution as a8, sealAgentCandidateBundle as a9, type AgentCandidateExecutionPorts as b, type AgentCandidateRunFinalization as c, type AgentCandidateArtifactPort as d, type AgentCandidateBenchmarkGraderIdentity as e, type AgentCandidateBenchmarkGraderPort as f, type AgentCandidateContainerPort as g, type AgentCandidateExecutionAttemptRecord as h, type AgentCandidateExecutionAttemptRef as i, type AgentCandidateExecutionClaim as j, type AgentCandidateExecutionClaimResult as k, type AgentCandidateExecutionClaimStore as l, type AgentCandidateExecutionCleanupHandles as m, type AgentCandidateExecutionFailureClass as n, type AgentCandidateExecutionFinishResult as o, type AgentCandidateExecutionLease as p, type AgentCandidateExecutionPhase as q, type AgentCandidateExecutionPhaseResult as r, type AgentCandidateExecutionRecoveryEvidence as s, type AgentCandidateExecutionStageResult as t, type AgentCandidateExecutionTerminalRecord as u, type AgentCandidateExecutionTerminalResult as v, type AgentCandidateExecutionUsage as w, type AgentCandidateExecutorFinalCapture as x, type AgentCandidateExecutorMemoryCapture as y, type AgentCandidateExecutorPort as z };