@tiphys/kernel 0.0.0 → 0.2.0

package/dist/src/gates/manifest.d.ts

@@ -0,0 +1,99 @@
+import type { SchemaDocument } from "./validate.ts";
+/**
+ * THE GATE MANIFEST (kernel plan M2, M2-P1 step 6).
+ *
+ * One manifest per repository. It declares which gates exist, how each is
+ * invoked, what one unit of its work is, whether an unmet precondition
+ * fails the run, and which commands can destroy work.
+ *
+ * SCHEMA RESOLUTION FROM SOURCE AND FROM dist/ (step 5). The schema
+ * documents sit beside this module at `./schemas/*.json` and are resolved
+ * through `import.meta.url`, so the same code finds
+ * `src/gates/schemas/...` when run from source and
+ * `dist/src/gates/schemas/...` when run from the compiled entry. `tsc` does
+ * not copy JSON, which was MEASURED rather than assumed (the measurement is
+ * in the work history), so the build script copies the directory into
+ * `dist/` and criterion 10 witnesses both documents in `npm pack` output.
+ * They are deliberately NOT imported as modules: `resolveJsonModule` is off
+ * in both tsconfigs, and turning it on would inline the schema into the
+ * bundle and make the shipped document and the enforced document two
+ * different things.
+ *
+ * M2-C-6: the manifest path comes from the caller, so it is read through the
+ * DELIVERED `readRegularFileIfPresent`. A named pipe at the manifest path
+ * reports `error` naming the path and the type, and never blocks.
+ */
+export type PreconditionKind = "file-exists" | "file-absent" | "branch-matches" | "diff-touches" | "command-exit-zero";
+export declare const PRECONDITION_KINDS: readonly PreconditionKind[];
+export type RunParameter = "base" | "head" | "phase";
+export interface PreconditionSpec {
+    id: string;
+    kind: PreconditionKind;
+    path?: string;
+    pattern?: string;
+    paths?: string[];
+    command?: string[];
+}
+export interface GateEntry {
+    id: string;
+    command: string[];
+    unitLabel: string;
+    applicability: "required" | "conditional";
+    parameters?: RunParameter[];
+    precondition?: PreconditionSpec;
+    modes?: string[];
+}
+export interface GateManifest {
+    version: number;
+    gates: GateEntry[];
+    destructiveCommands: string[];
+}
+export type ManifestLoad = {
+    ok: true;
+    manifest: GateManifest;
+    sha256: string;
+    body: string;
+} | {
+    ok: false;
+    reason: string;
+    diagnostics: string[];
+};
+export declare function manifestSchema(): SchemaDocument;
+export declare function resultSchema(): SchemaDocument;
+/**
+ * Absolute paths of every schema document `manifest-self-check` validates.
+ *
+ * ENUMERATED, NOT ENUMERABLE-BY-HAND (fix round, M2-P1). This milestone's
+ * plan (kernel-plan-v1.md) adds four more schema documents to this same
+ * directory across M2-P2, M2-P4, M2-P5, M2-P6 and M2-P7. A fixed two-entry
+ * list here was the mechanism, not a fluke: it named the two documents that
+ * existed at the time this function was written and would keep returning
+ * exactly those two forever, so manifest-self-check would silently stop
+ * validating every document a later phase ships, while test/gates.test.ts's
+ * independent readdir-based parity check reddens correctly the moment a
+ * phase adds one (CR-812's test, `test/gates.test.ts` near line 2378). The
+ * fix is to make the SAME enumeration the source of truth here: read the
+ * directory beside this module, keep entries matching `*.schema.json`, and
+ * sort them by filename so the order is deterministic across platforms and
+ * across runs (readdir order is not guaranteed by POSIX). Every document a
+ * phase drops into `src/gates/schemas/` is then validated automatically,
+ * and the parity property the test checks becomes structural rather than
+ * a thing two call sites have to be kept in sync by hand.
+ */
+export declare function schemaDocumentPaths(): string[];
+/**
+ * Validate an already-parsed manifest document. Returns the diagnostics in
+ * the contract's deterministic order (by pointer, then message).
+ */
+export declare function validateManifestDocument(document: unknown): string[];
+/** Validate an already-parsed gate result record. */
+export declare function validateResultDocument(document: unknown): string[];
+/**
+ * Load and validate a manifest from a path the caller supplied.
+ *
+ * Fail closed at every step: not a regular file, absent, unparseable, or
+ * schema-invalid all produce `ok: false` with a reason. None of them
+ * produces a manifest with fewer gates in it, which is the failure this
+ * whole milestone exists to make impossible.
+ */
+export declare function loadManifest(path: string): ManifestLoad;

package/dist/src/gates/manifest.js

@@ -0,0 +1,208 @@
+import { createHash } from "node:crypto";
+import { readdirSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { readRegularFileIfPresent } from "../task.js";
+import { DIAGNOSTIC_MESSAGES, formatDiagnostics, loadSchema, validate, } from "./validate.js";
+export const PRECONDITION_KINDS = [
+    "file-exists",
+    "file-absent",
+    "branch-matches",
+    "diff-touches",
+    "command-exit-zero",
+];
+const schemaDirectory = new URL("./schemas/", import.meta.url);
+function readSchemaDocument(name) {
+    const path = fileURLToPath(new URL(name, schemaDirectory));
+    const read = readRegularFileIfPresent(path);
+    if (read.kind !== "read") {
+        throw new Error(read.kind === "absent"
+            ? `schema document ${path} is missing from this installation`
+            : read.reason);
+    }
+    const parsed = JSON.parse(read.body);
+    const loaded = loadSchema(parsed, name);
+    if (!loaded.ok) {
+        throw new Error(loaded.reason);
+    }
+    return loaded.schema;
+}
+/** The two schema documents this milestone ships, loaded once. */
+let cachedManifestSchema;
+let cachedResultSchema;
+export function manifestSchema() {
+    if (cachedManifestSchema === undefined) {
+        cachedManifestSchema = readSchemaDocument("gate-manifest.schema.json");
+    }
+    return cachedManifestSchema;
+}
+export function resultSchema() {
+    if (cachedResultSchema === undefined) {
+        cachedResultSchema = readSchemaDocument("gate-result.schema.json");
+    }
+    return cachedResultSchema;
+}
+/**
+ * Absolute paths of every schema document `manifest-self-check` validates.
+ *
+ * ENUMERATED, NOT ENUMERABLE-BY-HAND (fix round, M2-P1). This milestone's
+ * plan (kernel-plan-v1.md) adds four more schema documents to this same
+ * directory across M2-P2, M2-P4, M2-P5, M2-P6 and M2-P7. A fixed two-entry
+ * list here was the mechanism, not a fluke: it named the two documents that
+ * existed at the time this function was written and would keep returning
+ * exactly those two forever, so manifest-self-check would silently stop
+ * validating every document a later phase ships, while test/gates.test.ts's
+ * independent readdir-based parity check reddens correctly the moment a
+ * phase adds one (CR-812's test, `test/gates.test.ts` near line 2378). The
+ * fix is to make the SAME enumeration the source of truth here: read the
+ * directory beside this module, keep entries matching `*.schema.json`, and
+ * sort them by filename so the order is deterministic across platforms and
+ * across runs (readdir order is not guaranteed by POSIX). Every document a
+ * phase drops into `src/gates/schemas/` is then validated automatically,
+ * and the parity property the test checks becomes structural rather than
+ * a thing two call sites have to be kept in sync by hand.
+ */
+export function schemaDocumentPaths() {
+    const directory = fileURLToPath(schemaDirectory);
+    return readdirSync(directory)
+        .filter((name) => name.endsWith(".schema.json"))
+        .sort()
+        .map((name) => fileURLToPath(new URL(name, schemaDirectory)));
+}
+/**
+ * The kind-specific required fields, checked here rather than in the schema.
+ *
+ * WHY NOT IN THE SCHEMA. Expressing "kind file-exists requires path" needs
+ * conditional composition (`if`/`then`, or `oneOf`), and both are outside
+ * M2-D-04's closed keyword set, which DR-0013 decided against growing. So
+ * the check lives in code and emits the SAME `INVALID <pointer> <message>`
+ * diagnostics, which keeps one diagnostic contract rather than two. When
+ * M3-P1 swaps in Ajv the constraint can move into the schema without any
+ * consumer noticing, because the output line is unchanged.
+ */
+const REQUIRED_FIELD_FOR_KIND = {
+    "file-exists": "path",
+    "file-absent": "path",
+    "branch-matches": "pattern",
+    "diff-touches": "paths",
+    "command-exit-zero": "command",
+};
+function preconditionFieldDiagnostics(manifest) {
+    const found = [];
+    const gates = manifest.gates;
+    if (!Array.isArray(gates)) {
+        return found;
+    }
+    for (let index = 0; index < gates.length; index += 1) {
+        const gate = gates[index];
+        const precondition = gate?.precondition;
+        if (precondition === undefined || precondition === null) {
+            continue;
+        }
+        const kind = precondition["kind"];
+        if (typeof kind !== "string" || !PRECONDITION_KINDS.includes(kind)) {
+            continue;
+        }
+        const field = REQUIRED_FIELD_FOR_KIND[kind];
+        if (precondition[field] === undefined) {
+            found.push({
+                pointer: `#/gates/${index}/precondition/${field}`,
+                message: DIAGNOSTIC_MESSAGES.required(field),
+            });
+        }
+    }
+    return found;
+}
+/** Every duplicate gate id, as diagnostics. A registry keyed by name cannot hold two. */
+function duplicateIdDiagnostics(manifest) {
+    const found = [];
+    const gates = manifest.gates;
+    if (!Array.isArray(gates)) {
+        return found;
+    }
+    const seen = new Set();
+    for (let index = 0; index < gates.length; index += 1) {
+        const id = gates[index]?.id;
+        if (typeof id !== "string") {
+            continue;
+        }
+        if (seen.has(id)) {
+            found.push({
+                pointer: `#/gates/${index}/id`,
+                message: DIAGNOSTIC_MESSAGES.duplicateId(JSON.stringify(id)),
+            });
+        }
+        seen.add(id);
+    }
+    return found;
+}
+/**
+ * Validate an already-parsed manifest document. Returns the diagnostics in
+ * the contract's deterministic order (by pointer, then message).
+ */
+export function validateManifestDocument(document) {
+    const diagnostics = [
+        ...validate(manifestSchema(), document),
+        ...preconditionFieldDiagnostics(document),
+        ...duplicateIdDiagnostics(document),
+    ];
+    diagnostics.sort((a, b) => {
+        if (a.pointer !== b.pointer) {
+            return a.pointer < b.pointer ? -1 : 1;
+        }
+        if (a.message === b.message) {
+            return 0;
+        }
+        return a.message < b.message ? -1 : 1;
+    });
+    return formatDiagnostics(diagnostics);
+}
+/** Validate an already-parsed gate result record. */
+export function validateResultDocument(document) {
+    return formatDiagnostics(validate(resultSchema(), document));
+}
+/**
+ * Load and validate a manifest from a path the caller supplied.
+ *
+ * Fail closed at every step: not a regular file, absent, unparseable, or
+ * schema-invalid all produce `ok: false` with a reason. None of them
+ * produces a manifest with fewer gates in it, which is the failure this
+ * whole milestone exists to make impossible.
+ */
+export function loadManifest(path) {
+    const read = readRegularFileIfPresent(path);
+    if (read.kind === "absent") {
+        return {
+            ok: false,
+            reason: `manifest ${path} does not exist`,
+            diagnostics: [],
+        };
+    }
+    if (read.kind === "refused") {
+        return { ok: false, reason: read.reason, diagnostics: [] };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(read.body);
+    }
+    catch (error) {
+        return {
+            ok: false,
+            reason: `manifest ${path} does not parse as JSON: ${error.message}`,
+            diagnostics: [],
+        };
+    }
+    const diagnostics = validateManifestDocument(parsed);
+    if (diagnostics.length > 0) {
+        return {
+            ok: false,
+            reason: `manifest ${path} is not a valid gate manifest`,
+            diagnostics,
+        };
+    }
+    return {
+        ok: true,
+        manifest: parsed,
+        sha256: createHash("sha256").update(read.body).digest("hex"),
+        body: read.body,
+    };
+}

package/dist/src/gates/merge-preconditions.d.ts

@@ -0,0 +1,319 @@
+import type { GateStatus } from "./result.ts";
+/**
+ * THE MERGE PRECONDITION READER (kernel plan M4, M4-P12; DR-0012, DR-0036,
+ * T-009, R-064, R-065a).
+ *
+ * WHAT THIS IS NOT. It is not a merge command. M4-D-09 puts the merge
+ * capability in the plugin at cutover and DR-0036 keeps merge authority with
+ * the current process for the whole of M4. What is missing today is not the
+ * ability to merge; it is any ARTIFACT saying the six conditions of
+ * delivery/decisions/DR-0012-delegated-merge-authority.md:22 to :27 held at the
+ * head that was merged. So this gate produces one ROW PER CONDITION, each
+ * carrying the head sha it was evaluated against, and the orchestrator reads it
+ * before merging, by hand.
+ *
+ * THE HAZARD CLASS, in the plan's words: A MERGE PRECONDITION CHECK THAT IS
+ * GREEN BECAUSE IT COULD NOT LOOK. Every arm below is written against one of
+ * its members, and each member is named where it is refused rather than in a
+ * list nobody rereads:
+ *
+ *   a 401 piped into a `|| true`      -> `probeApi` runs FIRST and an
+ *                                        unreachable or refusing API is
+ *                                        `error` with units 0. CLAUDE.md
+ *                                        standing warning 6 records this shape
+ *                                        costing a whole watcher.
+ *   an API failure called N/A          -> `not-applicable` is reachable from
+ *                                        exactly one place here, the
+ *                                        NO-VERDICT-AT-THIS-HEAD arm, and it
+ *                                        carries an evaluated precondition
+ *                                        record (SC-011).
+ *   CI-green read off the BRANCH       -> condition 4 compares
+ *                                        `check_run.head_sha` against the head
+ *                                        under evaluation and reddens when they
+ *                                        differ, which is T-009 one scope down.
+ *   scope satisfied by a record EXISTING -> condition 5 reads the record's
+ *                                        STATUS word.
+ *   arbitration satisfied by a file EXISTING -> condition 6 requires the
+ *                                        document to name BOTH verdicts and the
+ *                                        SAME head.
+ *   a ruleset read as a default        -> an empty body from the ruleset API is
+ *                                        `error`, never an assumed shape.
+ *
+ * WHY CONDITIONS 1 AND 2 ARE COMPOSED AND NOT REIMPLEMENTED (plan step 6).
+ * M4-P10 shipped `dual-review-decorrelation` (DR-0012 condition 1) and
+ * `verdict-pair-approves` (condition 2) as derived checks in `src/checks.ts`,
+ * and `scripts/check-dual-review.mjs` is the runner around them. This gate is a
+ * SECOND CALLER of the same exported primitives rather than a second copy of
+ * the rules: it resolves the corpus with `resolveCorpusSource`, refuses a
+ * context whose delivery regime is undeterminable with `missingRegimeDocument`,
+ * reads the DR-0038 declaration with `readReviewFamilies`, and then runs the
+ * two checks BY ID out of `registeredChecks()`.
+ *
+ * BY ID, AND A MISSING REGISTRATION IS `error`. `scripts/check-dual-review.mjs`
+ * prints `0 registered check(s) named X` beside its own verdict, which is the
+ * Kind B witness that deregistering the check is visible. On the MERGE path a
+ * condition with no check behind it is a condition nobody evaluated, so here it
+ * is `error` and never a green with the comparison quietly skipped.
+ *
+ * WHY THE ROW STATUS AND THE GATE STATUS ARE NOT THE SAME WORD, and this is the
+ * one place the plan and the criteria say different things, so the reconciliation
+ * is written down rather than left to a reader. Plan step 4
+ * (delivery/plan/kernel-plan-m4.md:1911) says an ABSENT scope record is `error`;
+ * criterion 4 (delivery/plan/kernel-plan-m4.md:1938) says condition 5 is RED when
+ * no record exists. Both hold at once because they speak about different objects:
+ * the CONDITION is unsatisfied either way and its row reads `red` with a reason
+ * naming which arm it was, while the GATE could not reach a verdict about an
+ * instrument that is not there, so the gate's own status is `error`. Everything a
+ * reader needs is printed: the row, its reason, and the gate word.
+ */
+declare const GATE_ID = "merge-preconditions";
+declare const UNIT_LABEL = "merge preconditions evaluated";
+/**
+ * The id of the one precondition this gate can report unmet.
+ *
+ * SC-011: `not-applicable` ASSERTS that a precondition was evaluated. The
+ * precondition here is "a merge is being proposed at this head", evidenced by
+ * at least one committed verdict document naming it. A head with no such
+ * document is not a merge waiting on six conditions; it is a branch nobody has
+ * reviewed yet, and reporting red for that would make the gate unusable on
+ * every push while making it say something false.
+ */
+declare const PRECONDITION_ID = "merge-preconditions-verdict-names-this-head";
+interface Flags {
+    result?: string;
+    evidence?: string;
+    head?: string;
+    phase?: string;
+    context?: string;
+    repo?: string;
+    "api-base"?: string;
+    "scope-record"?: string;
+    arbitrations?: string;
+}
+/**
+ * ROW STATUS IS THE SAME FOUR-WORD VOCABULARY MINUS `not-applicable`.
+ * A row cannot be not-applicable: the gate as a whole is, or every condition
+ * was evaluated. Keeping the words identical to `GateStatus` is deliberate, so
+ * a reader does not have to learn a second vocabulary for the thing the gate
+ * exists to print.
+ */
+export type RowStatus = "green" | "red" | "error";
+export interface ConditionRow {
+    /** `condition-1` .. `condition-6`, or `branch-protection`. */
+    id: string;
+    /** The DR-0012 clause, or the requirement id, this row is about. */
+    clause: string;
+    status: RowStatus;
+    /** The head sha this row was evaluated against. Criterion 8 wants it here. */
+    head: string;
+    /** One sentence, printed on EVERY arm including green. */
+    sentence: string;
+}
+export declare function renderRow(row: ConditionRow): string;
+/**
+ * The gate word for a set of rows.
+ *
+ * `error` DOMINATES `red`, which is M2-C-3's direction: a run that could not
+ * look at one condition has not reached a verdict about the merge, and a red
+ * would be a verdict. A red that is also accompanied by an error still reports
+ * error, and both rows print either way, so nothing is hidden by the ordering.
+ */
+export declare function gateStatusForRows(rows: readonly ConditionRow[]): GateStatus;
+export type ApiResponse = {
+    ok: true;
+    status: number;
+    body: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * ONE REQUEST, AND THE FAILURE ARM IS WRITTEN FIRST.
+ *
+ * CLAUDE.md standing warning 6 records the exact defect this shape exists
+ * against: a watcher whose failure arm was a `.catch(() => {})` emitted nothing
+ * and was indistinguishable from a run still in progress. There is no catch
+ * here that returns a value the caller can mistake for data: a transport
+ * failure becomes `{ok: false, reason}` and every caller turns that into
+ * `error`.
+ *
+ * NO CREDENTIAL IS READ, AND THAT IS A RULE RATHER THAN AN OVERSIGHT.
+ * test/m2-exit-test.test.ts:425 asserts, by grepping every file under
+ * `src/gates/`, that no production gate reads a LITERAL-NAMED environment
+ * variable, because such a read is an ambient switch that changes a gate's
+ * reported status with nothing in the record to say so. An earlier draft of
+ * this module read `GH_TOKEN` and that test caught it, which is the guard
+ * working. Measured 2026-09-17 from this container, with NO Authorization
+ * header at all: `GET /repos/{slug}`, `GET /repos/{slug}/rulesets` and
+ * `GET /repos/{slug}/commits/{sha}/check-runs` each answered HTTP 200, because
+ * the agent proxy substitutes credentials on the way out and the value in
+ * `GH_TOKEN` is irrelevant (CLAUDE.md standing warning 6's invalid-token
+ * control measures the same thing). WHAT THIS COSTS, recorded rather than left
+ * to be found: in a deployment where the API genuinely requires a credential,
+ * every request here answers 401 or 404 and the gate reports `error`. That is
+ * the fail-closed direction and never a silent pass, and supplying a token
+ * would have to be a DECLARED FLAG in the registry command rather than an
+ * ambient environment read.
+ */
+export declare function requestJson(url: string): Promise<ApiResponse>;
+export type JsonReading = {
+    ok: true;
+    value: unknown;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * PARSE A RESPONSE BODY, AND AN EMPTY ONE IS A FAILURE RATHER THAN A DEFAULT.
+ *
+ * Criterion 6 is the whole reason this is a named function: the ruleset API
+ * answering with a zero-length body must produce `error`, because a default
+ * here is the silent pass this phase exists against. `JSON.parse("")` throws,
+ * so the empty case would reach the same place anyway; it is separated out so
+ * the REASON a reader is given names the emptiness rather than a parser
+ * message that says nothing about what happened.
+ */
+export declare function readJsonBody(url: string, response: ApiResponse): JsonReading;
+/**
+ * `owner/name` out of a git remote URL, or undefined when the URL is not one.
+ *
+ * DERIVED RATHER THAN WRITTEN INTO THE REGISTRY, and the reason is DR-0029: the
+ * kernel is just another project under the scheme, so a registry entry naming
+ * ONE repository would be the kernel's registry claiming to be everybody's. The
+ * remote is the fact this gate is actually about.
+ */
+export declare function slugFromRemote(url: string): string | undefined;
+interface CheckRun {
+    name?: unknown;
+    status?: unknown;
+    conclusion?: unknown;
+    head_sha?: unknown;
+}
+/**
+ * Condition 4, and the comparison that makes it worth having.
+ *
+ * T-009 ONE SCOPE DOWN. "CI is green" is never a complete sentence: the
+ * complete one names the event and the HEAD SHA. A check that asked the API for
+ * the newest run on the BRANCH would report green off a run for an earlier
+ * head, which is exactly the state this repository spent four hours and
+ * twenty-one minutes in. So every check run the API returns is compared on
+ * `head_sha` and one that names a different commit is reported as the different
+ * commit it is, never counted.
+ */
+export declare function judgeCheckRuns(head: string, runs: readonly CheckRun[], context: string): {
+    ok: boolean;
+    sentence: string;
+};
+/**
+ * Condition 5, and the distinction the plan's hazard list names: the condition
+ * is satisfied by the record's STATUS, never by the record's EXISTENCE.
+ *
+ * The absent arm and the red arm are DIFFERENT REASONS on purpose (criterion
+ * 4). `instrument` is what the caller turns into the gate's own word: an absent
+ * record means the gate could not look, which is `error` at gate level while
+ * the condition itself is unsatisfied.
+ */
+export declare function judgeScopeRecord(path: string, read: {
+    kind: "read";
+    body: string;
+} | {
+    kind: "absent";
+} | {
+    kind: "refused";
+    reason: string;
+}): {
+    ok: boolean;
+    sentence: string;
+    instrument: "present" | "missing";
+};
+/**
+ * Condition 6, and EXISTENCE IS NOT THE TEST.
+ *
+ * Criterion 5 asks for two structurally different members of that class, and
+ * they are structurally different because they fail on different halves of the
+ * same document: one that names only ONE of the two verdicts has read half the
+ * evidence, and one that names a DIFFERENT HEAD has read the right number of
+ * documents about the wrong commit. A check that tested for the file's presence
+ * passes both.
+ *
+ * VERDICTS ARE IDENTIFIED BY FILE NAME because `schemas/verdict.schema.json`
+ * gives a verdict no id of its own; its required keys are kind, phase, head,
+ * verdict, produced-by, framing, review-contract, findings, criteria and
+ * deviations-judged. The existing arbitration documents in `delivery/review/`
+ * already cite their reviews by path, so the convention that exists is read
+ * rather than a field invented.
+ *
+ * THE FILE NAME AND NOT THE FULL PATH, and that is a measured correction rather
+ * than a preference. `loadCommittedVerdicts` returns ABSOLUTE paths when it
+ * falls back to the worktree and repository-relative ones when it reads a
+ * commit, so comparing whole paths made the same document resolve or not
+ * resolve depending on which corpus source happened to be chosen. The file name
+ * is the part that is stable across both, and it is the part an arbitration
+ * document's `- reviews:` line contains either way.
+ */
+export declare function judgeArbitration(path: string, head: string, verdictPaths: readonly string[], read: {
+    kind: "read";
+    body: string;
+} | {
+    kind: "absent";
+} | {
+    kind: "refused";
+    reason: string;
+}): {
+    ok: boolean;
+    sentence: string;
+};
+interface RulesetRule {
+    type?: unknown;
+    parameters?: Record<string, unknown>;
+}
+export interface RulesetReading {
+    id: string;
+    name: string;
+    enforcement: string;
+    rules: RulesetRule[];
+}
+/**
+ * The ruleset encoding, and the TWO members of criterion 7.
+ *
+ * `enforcement: disabled` is PRESENT-BUT-TOOTHLESS and a
+ * `required_status_checks` rule that does not name `gates` is
+ * PRESENT-BUT-WRONG. They are different failures and they are reported with
+ * different sentences, because a reader told only "the ruleset is wrong" has to
+ * go and find out which.
+ *
+ * R-065a IS DATA, NOT A VERDICT. Squash-only is an OWNER action the owner has
+ * deferred; the plan (step 7) says report its state and do not judge it, so
+ * `allowed_merge_methods` is printed and never turns this row red.
+ */
+export declare function judgeRulesets(rulesets: readonly RulesetReading[]): {
+    ok: boolean;
+    sentence: string;
+};
+export interface VerdictForHead {
+    path: string;
+    record: Record<string, unknown>;
+}
+/**
+ * Condition 3, and what it DOES and DOES NOT establish.
+ *
+ * DR-0012 condition 3 (delivery/decisions/DR-0012-delegated-merge-authority.md:24)
+ * says both reviewers were given the phase's acceptance criteria as their
+ * contract and both WALKED OR EXECUTED them. What is reachable from the verdict
+ * documents alone is that each one declares a `review-contract` and carries a
+ * non-empty `criteria[]` whose entries each record `met`. Whether that walk
+ * COVERS every acceptance criterion the plan declares is a comparison against a
+ * different document and it is the shipped Kind B check
+ * `verdict-criteria-complete`, which resolves a `plan.yaml` out of its context.
+ * This repository has no such document, so running it here would make this row
+ * permanently error about the instrument rather than about the merge. The row's
+ * sentence therefore says which half it established, and the other half is
+ * recorded as residue in delivery/work-history/m4-p12.md rather than implied.
+ */
+export declare function judgeCriteriaWalked(verdicts: readonly VerdictForHead[]): {
+    ok: boolean;
+    sentence: string;
+};
+export declare function runGate(flags: Flags): Promise<number>;
+export declare function main(argv: string[]): Promise<number>;
+export { GATE_ID, PRECONDITION_ID, UNIT_LABEL };