@vostride/agent-qa-eval-local 0.0.0-stage → 0.2.1

package/dist/index.d.cts

@@ -0,0 +1,2930 @@
+import * as _vostride_agent_qa_eval from '@vostride/agent-qa-eval';
+import { AdversarialCapSource, AdversarialMutator, ProbeGeneratorKind, GeneratorKind, ProbeRefusal, ProbeInapplicability, ProbeAuthorPort, AuthoringModel, NoProbeModelGap, AdversarialSeedSkip, LeafCassette, StandaloneLabelRecord, AdversarialCorpusEntry, JudgePanelPort, JudgePort, JudgeCalibrationEvidence, JudgeCalibrationDiagnostics, JudgeTargetedCalibrationMember, BaselineProfileKeyInput, JudgeIdentityBlock, JudgeCalibrationMinimum, UsageAggregator, JudgeTargetedCalibrationDisclosure, LabelCalibrationReport, CommittedCorpusSnapshot, ExtractedBlob, SeedingPlan, ExtractedCassette, PairSkip, SilverExclusion, PartitionManifest, RunExclusionRecord, HandoffSource, ArtifactSource, Cassette, ReplayRefusal, CassetteScore, DecisionDiff, ScoringContext, ReplayCassetteOutcome, DeclaredBriefDelta, ReplayClock, ReplayEscalationPredicate, SeedPolicy, ScoringJudgeRequest, BASELINE_POINTER_SCHEMA_VERSION, CorpusEntry, EvalBatchReport, DecisionVectorsDocument, NoiseFloorArtefact, ReplaySample, ScoredBatchEntry, FloorRefusal, DecisionCorrectnessVector, ClassifierRepeatability, GateVerdict, BaselinePointer, BaselineComparatorRefusal, CorpusCensus, JudgeCapabilityInput, CanaryEvidenceSummary, GatePosture, LabelCalibrationInput, CalibrationObservation } from '@vostride/agent-qa-eval';
+export { ArtifactSource, HandoffSource } from '@vostride/agent-qa-eval';
+import * as _vostride_agent_qa_schema from '@vostride/agent-qa-schema';
+import { MaskFn, CompletedRunHandoff, MarkReceipt, MarkAddress, PerTestOutcome, CandidateInjection, CrossCheck, Gate1Receipt, Gate1KSource, Benefit, ScopeKey } from '@vostride/agent-qa-schema';
+import { z } from 'zod';
+import { ModelProfile, ResolvedModelAuth, ModelProviderOverrides, ModelCallObservation } from '@vostride/agent-qa-model';
+
+/**
+ * Durable refresh state lives BESIDE the staging tree, never inside it: a staged batch
+ * directory is reviewable data an operator may delete after admitting or rejecting it, and the
+ * record of what was already decided must outlive that.
+ */
+declare const ADVERSARIAL_STATE_SUBDIR = "eval/adversarial-state";
+declare const ADVERSARIAL_STATE_SCHEMA_VERSION = 2;
+/**
+ * What a completed `(seed, mutator)` tuple resolved to.
+ *
+ * Both are COMPLETED work. `derived` produced reviewable bytes; `inapplicable` is the
+ * generator's own typed statement that the family cannot act on this seed. A tuple that is
+ * merely DEFERRED (`cap-exceeded`) or that was already settled earlier (`already-derived`) is not
+ * an outcome and never lands here — recording either would settle work nobody did.
+ */
+type AdversarialTupleOutcome = 'derived' | 'inapplicable';
+interface AdversarialRefreshTuple {
+    seedCassetteId: string;
+    mutator: AdversarialMutator;
+    /** The derived id this tuple addresses — stable across outcomes, because it is a function of the generation, not of the result (D-08). */
+    cassetteId: string;
+    outcome: AdversarialTupleOutcome;
+    /** The inapplicability reason for `inapplicable`; absent for `derived`. */
+    detail?: string;
+}
+/**
+ * The resolved cap and where the operator set it — recorded so a refresh can explain itself.
+ *
+ * 2026-09-12, 422-22: `source` names the NEUTRAL vocabulary rather than re-spelling it. This
+ * record is persisted, and a storage-side copy of a persisted vocabulary is a second list to keep
+ * in step with the first — which is how one of them ends up admitting an origin the other refuses.
+ */
+interface AdversarialSeedCap {
+    value: number;
+    source: AdversarialCapSource;
+}
+interface AdversarialRefreshRecord {
+    schemaVersion: typeof ADVERSARIAL_STATE_SCHEMA_VERSION;
+    product: string;
+    /** The frozen table generation these outcomes were decided under. */
+    tableVersion: number;
+    /** The committed corpus digest this refresh read its seeds from. */
+    sourceDigest: string;
+    cap: AdversarialSeedCap;
+    /** Novel eligible seeds counted BEFORE the cap was applied. */
+    eligibleSeeds: number;
+    /** Novel eligible seeds the cap deferred to a later refresh. */
+    excessSeeds: number;
+    /** Immutable batch membership: the seed ids this refresh selected, ascending. */
+    seedIds: readonly string[];
+    tuples: readonly AdversarialRefreshTuple[];
+}
+/** The record's own content address — its file name, and the whole of its identity. */
+declare function adversarialRefreshRecordDigest(record: AdversarialRefreshRecord): string;
+/** The settled-tuple key. Public so a caller can build the same key it will be checked against. */
+declare function adversarialTupleKey(seedCassetteId: string, mutator: AdversarialMutator): string;
+/**
+ * Resolve the per-refresh seed cap (D-04).
+ *
+ * Every rejected boundary is rejected LOUDLY: zero, negative, fractional, nonfinite and
+ * beyond-safe-integer caps are a TypeError rather than a silent fallback to the default. A cap
+ * that quietly becomes 8 because the operator typed `0` is a cap the operator does not have.
+ */
+declare function resolveAdversarialSeedCap(input: {
+    value?: number;
+    source?: Exclude<AdversarialCapSource, 'default'>;
+}): AdversarialSeedCap;
+/**
+ * Every published refresh record for one product, in file-name order.
+ *
+ * An absent tree is an empty history, not a failure — the first refresh on a host has no state
+ * and must not be told the store is broken. A record that fails the strict schema (one written
+ * before Phase 441 carries a policy digest) is absent too: D-20 migrates nothing (441-64, CR-C02).
+ * Unparseable bytes, and a record that parses but whose digest name or product does not match,
+ * are still failures.
+ */
+declare function readAdversarialRefreshRecords(input: {
+    agentQaRoot: string;
+    product: string;
+}): AdversarialRefreshRecord[];
+/**
+ * Publish one refresh record write-once, under its own content address.
+ *
+ * `unchanged` means the identical record was already published — the concurrent-refresh case,
+ * and the re-run-over-an-unchanged-corpus case. Anything else under that name is a conflict.
+ */
+declare function publishAdversarialRefreshRecord(input: {
+    agentQaRoot: string;
+    record: AdversarialRefreshRecord;
+}): 'published' | 'unchanged';
+/**
+ * The `(seed, mutator)` tuples already decided under THIS generation.
+ *
+ * A refresh skips these, which is what lets its cap reach the seeds behind them. Scoping by the
+ * generation is the whole contract: a new generation does not inherit a decision that was not
+ * made about it.
+ */
+declare function settledAdversarialTuples(records: readonly AdversarialRefreshRecord[], scope: {
+    tableVersion: number;
+}): ReadonlySet<string>;
+/**
+ * Every id this product has EVER derived, across all generations.
+ *
+ * Unscoped on purpose (D-08): a generation bump creates new ids beside the old, and the old
+ * ones are committed history. Re-deriving one would address bytes that already exist, so this
+ * set only ever grows.
+ */
+declare function derivedAdversarialCassetteIds(records: readonly AdversarialRefreshRecord[]): ReadonlySet<string>;
+/**
+ * Probe reservations live beside the refresh-state tree, never inside a staged batch: a batch is
+ * reviewable data an operator may delete, and the record of what was already PAID FOR must
+ * outlive that even more emphatically than the record of what was already decided.
+ */
+declare const ADVERSARIAL_PROBE_SUBDIR = "eval/adversarial-probes";
+declare const ADVERSARIAL_PROBE_SCHEMA_VERSION = 2;
+/** D-11's idempotence key, as durable fields. */
+interface ProbeReservationKey {
+    product: string;
+    seedCassetteId: string;
+    kind: ProbeGeneratorKind;
+    promptVersion: number;
+}
+/** The row written BEFORE a provider is contacted. Its existence is the charge. */
+interface ProbeReservation extends ProbeReservationKey {
+    schemaVersion: typeof ADVERSARIAL_PROBE_SCHEMA_VERSION;
+    /** The frozen prompt hash the request was rendered from. */
+    promptHash: string;
+    /** sha256 of the configured model id — never the id, which can embed a credential. */
+    authorDigest: string;
+    /** The resolved provider family, which cannot. */
+    authorFamily: string;
+}
+/**
+ * What a provider call resolved to.
+ *
+ * All four are ANSWERS — the port returned control. `derived` carries the authored text so a
+ * later refresh can re-derive the same case for free; `refused` is a policy block recorded
+ * before 441-42 and only read back now, `invalid` an
+ * answer the pure contract rejected, and `error` a call that failed. None of the last three
+ * carries text: a refused surface is data, not a diagnostic.
+ */
+type ProbeCompletionOutcome = 'derived' | 'refused' | 'invalid' | 'error';
+interface ProbeCompletion {
+    schemaVersion: typeof ADVERSARIAL_PROBE_SCHEMA_VERSION;
+    outcome: ProbeCompletionOutcome;
+    /** Present only on `derived`: the authored text and the id it produced. */
+    text?: string;
+    cassetteId?: string;
+    /** Reported spend, present only when the provider reported it. ABSENT is not zero. */
+    promptTokens?: number;
+    completionTokens?: number;
+    /** The firing detector or the refusal reason; never the refused text. */
+    detail?: string;
+}
+/**
+ * The store's answer about one tuple.
+ *
+ * `usageKnown` is on every arm and is never inferred from a zero: an interrupted attempt and a
+ * failed one both have unknown tokens, and reporting them as `0` would make a real charge read
+ * as a free one.
+ */
+type ProbeAttemptState = {
+    kind: 'unattempted';
+    usageKnown: false;
+} | {
+    kind: 'interrupted';
+    reservation: ProbeReservation;
+    usageKnown: false;
+} | {
+    kind: 'completed';
+    reservation: ProbeReservation;
+    completion: ProbeCompletion;
+    usageKnown: boolean;
+};
+/** Build the durable reservation for one tuple. Pure; the author is reduced to a digest here. */
+declare function probeReservationOf(key: ProbeReservationKey, input: {
+    promptHash: string;
+    author: {
+        id: string;
+        family: string;
+    };
+}): ProbeReservation;
+/** What the durable store says about ONE tuple. An absent tree is an empty history, not a failure. */
+declare function readProbeAttempt(input: {
+    agentQaRoot: string;
+    key: ProbeReservationKey;
+}): ProbeAttemptState;
+/**
+ * Every attempt this product has on disk, in tuple-digest order.
+ *
+ * The disclosure surface: a report that wants to say "these calls were made and this one is
+ * still unanswered" reads it here. A PRESENT but malformed row is a failure, never silently
+ * dropped — this is the evidence a later refresh declines to spend on.
+ */
+declare function readProbeAttempts(input: {
+    agentQaRoot: string;
+    product: string;
+}): ProbeAttemptState[];
+/**
+ * Claim the allowance for ONE tuple, exclusively, BEFORE anything reaches a provider.
+ *
+ * `already-claimed` is not an error and is not a retry: it is the answer a concurrent owner —
+ * or a later run over the same disk — must get, together with the reservation that actually
+ * exists. Unlike the refresh record above this one is NOT content-addressed, so differing bytes
+ * under one name are not a conflict: two hosts with two authors asking the same question is
+ * exactly the race this arbitrates, and the first claim wins outright.
+ */
+declare function reserveProbeCall(input: {
+    agentQaRoot: string;
+    reservation: ProbeReservation;
+}): {
+    kind: 'claimed' | 'already-claimed';
+    state: ProbeAttemptState;
+};
+/**
+ * Record what ONE reserved call resolved to, write-once.
+ *
+ * Two refusals, both deliberate. A completion for a tuple nothing reserved is refused, because
+ * it would show an answer nobody was ever charged for. A SECOND, different completion for one
+ * tuple is refused, because the completion is the reason a tuple is closed and overwriting it
+ * would erase why — the same law the refresh record keeps, for the same reason. An identical
+ * re-write is `unchanged`: a retry that recomputes the same answer is a no-op, not a conflict.
+ */
+declare function completeProbeCall(input: {
+    agentQaRoot: string;
+    key: ProbeReservationKey;
+    completion: ProbeCompletion;
+}): 'published' | 'unchanged';
+
+/** Local staging root for reviewable adversarial batches (D-01, beside `eval/feedback`). */
+declare const ADVERSARIAL_STAGING_SUBDIR = "eval/adversarial";
+/** The reviewed manifest's file name inside a staged batch directory. */
+declare const ADVERSARIAL_MANIFEST_FILE = "manifest.json";
+/**
+ * The SEED's label identity as it stood when the batch was reviewed (D-06).
+ *
+ * This is the pin that a recomputed manifest cannot launder. Every other pin here describes
+ * STAGED bytes, so an operator who edits a staged document and regenerates the manifest gets
+ * a self-consistent manifest — with a different digest, which is already refused. This one is
+ * checked against the seed's COMMITTED label at admission, so a derived record whose
+ * provenance, channel or tier was rewritten to something the seed never had is refused even
+ * if every staged pin agrees with itself.
+ */
+interface AdversarialSeedProvenancePin {
+    runId: string;
+    capturedAtOrdinal: number;
+    sourceChannel: string;
+    tier: string;
+}
+/**
+ * One reviewed case, pinned by content address (D-02).
+ *
+ * TWO DERIVATION PATHS, TWO PROVENANCE SHAPES (D-05/D-11). A table-drawn variant names
+ * `mutator` + `tableEntryId`; an LLM-authored probe names `promptVersion` and neither of the
+ * other two, because no frozen table drew its text. The pair is mutually exclusive and
+ * `listStagedAdversarial` refuses a case that carries both or neither — a manifest case whose
+ * provenance cannot be true is exactly what a refusal is for.
+ *
+ * The author's model id is deliberately NOT pinned here. It is already on the corpus entry,
+ * whose bytes the manifest pins.
+ */
+interface AdversarialBatchManifestCase {
+    cassetteId: string;
+    seedCassetteId: string;
+    /** Table path only: the mutation family. Absent on a probe. */
+    mutator?: AdversarialMutator;
+    kind: GeneratorKind;
+    /** Table path only. Disclosure of the drawn table entry; not part of the derived identity (D-08). */
+    tableEntryId?: string;
+    /** Probe path only: the frozen prompt generation the text was authored under (D-11). */
+    promptVersion?: number;
+    cassetteTextHash: string;
+    labelTextHash: string;
+    entryTextHash: string;
+    /** The ORIGINAL label identity the clone must still carry (D-06). */
+    seedProvenance: AdversarialSeedProvenancePin;
+    /** The derived cassette's blob closure, validated against the seed's committed bytes. */
+    blobShas: readonly string[];
+}
+/** The reviewed batch: what an operator admits with `--batch <digest>` (D-01/D-02). */
+interface AdversarialBatchManifest {
+    schemaVersion: 2;
+    product: string;
+    /** sha256 over the pinned case list; equals the staging directory name. */
+    batchDigest: string;
+    tableVersion: number;
+    tableHash: string;
+    /** Disclosure only — deliberately OUTSIDE the digest so re-staging is idempotent. */
+    stagedAt: string;
+    cases: readonly AdversarialBatchManifestCase[];
+}
+/** A per-detector refusal row. Nothing produces one since 441-42 (D-15); the field stays empty. */
+interface AdversarialRefusal {
+    cassetteId: string;
+    seedCassetteId: string;
+    generator: GeneratorKind;
+    detector: string;
+    action: 'block' | 'redact';
+}
+/**
+ * A refusal a previous refresh recorded. Nothing produces one since 441-53 (D-15): the refresh
+ * record no longer holds a refused tuple, so the field stays empty.
+ */
+interface AdversarialSettledRefusal {
+    seedCassetteId: string;
+    mutator: AdversarialMutator;
+    detector?: string;
+}
+/** Everything that stopped a derived case short of publication for a non-policy reason. */
+interface AdversarialStagingSkip {
+    cassetteId: string;
+    seedCassetteId: string;
+    reason: 'blob-unresolvable' | 'blob-hash-mismatch' | 'text-hash-mismatch' | 'manifest-digest-mismatch' | 'path-identity-mismatch' | 'seed-label-unavailable' | 'seed-provenance-mismatch'
+    /** This id is already committed with DIFFERENT bytes. History wins; nothing is overwritten. */
+     | 'committed-conflict'
+    /** 441 GAP3-D1: a reviewed string still holds a declared value raw; the writer refused it. */
+     | 'unmasked-declared-value';
+}
+/**
+ * Recorded default cap on PROVIDER CALLS one refresh may make (D-04/D-10).
+ *
+ * The rationale, stated rather than tuned: a refresh authors at most one probe per
+ * `(seed, kind, promptVersion)` tuple, and the two frozen probe kinds over two seeds is four
+ * requested generations. It is deliberately INDEPENDENT of
+ * `ADVERSARIAL_DEFAULT_MAX_SEEDS_PER_REFRESH` — eight deterministic seeds cost nothing but CPU,
+ * while four authored probes cost four provider calls that no later run can recover. Two
+ * budgets, because the two halves are bounded for two different reasons.
+ *
+ * It counts CALLS and not tokens. A provider that reports no usage yields zero tokens
+ * (422-05), which UNDER-states spend; an unreported token must never be readable as "free", so
+ * the budget is denominated in the one quantity this layer always knows exactly.
+ */
+declare const ADVERSARIAL_DEFAULT_MAX_PROBE_CALLS = 4;
+/**
+ * The resolved probe-call cap and where the operator set it (the seed-cap idiom).
+ *
+ * 2026-09-12, 422-22: `source` names the NEUTRAL `AdversarialCapSource` for the same reason the
+ * seed cap does — this value is recorded beside every refresh, and a second storage-side spelling
+ * of a persisted vocabulary is a second list to keep in step with the first.
+ */
+interface AdversarialProbeCallCap {
+    value: number;
+    source: AdversarialCapSource;
+}
+/**
+ * What a refresh SPENT at a provider.
+ *
+ * `modelCalls` is the authoritative number and is counted at RESERVATION time, not at answer
+ * time: a call that was announced and never answered still cost whatever it cost, and counting
+ * only answers would let an interrupted refresh under-report its bill. Token counts are carried
+ * exactly as the provider reported them and are never inferred.
+ */
+interface AdversarialSpend {
+    modelCalls: number;
+    promptTokens: number;
+    completionTokens: number;
+    /**
+     * Whether every call counted above reported its token usage.
+     *
+     * `false` is a statement, not a warning: a call that was announced and never answered, or one
+     * that failed, has UNKNOWN tokens, and the alternative to saying so is reporting `0` — which
+     * makes a real charge indistinguishable from a free one. It is exactly the reason the budget
+     * is denominated in calls rather than in tokens.
+     */
+    usageKnown: boolean;
+}
+/**
+ * Why a `(seed, kind, promptVersion)` tuple yielded no authored probe.
+ *
+ * The first members are the pure contract's own seed law, re-reported verbatim so a staging
+ * report speaks ONE vocabulary about table families and probes alike. The last two are this
+ * layer's: a tuple already decided by a previous refresh, and a tuple this refresh's call
+ * budget deferred to the next one.
+ */
+type AdversarialProbeSkipReason = ProbeInapplicability | 'tuple-already-decided'
+/**
+ * A durable reservation exists with no completion: a previous run announced this call and
+ * never recorded an answer. It is CHARGED and it is NOT re-authored — re-asking would buy the
+ * same question twice — and it is its own reason precisely because "asked and lost" is a
+ * different fact from "asked and answered" and from "never asked".
+ */
+ | 'tuple-interrupted' | 'probe-cap-exceeded'
+/** Paid output belongs to a different author or prompt; never implicitly re-author it. */
+ | 'probe-reservation-mismatch'
+/** Re-derivation must recover the identity already recorded with the paid response. */
+ | 'probe-completion-identity-mismatch';
+/** An honest row for every probe tuple that produced no case. */
+interface AdversarialProbeSkip {
+    seedCassetteId: string;
+    kind: ProbeGeneratorKind;
+    promptVersion: number;
+    reason: AdversarialProbeSkipReason;
+}
+/**
+ * An authored RESPONSE the pure contract refused.
+ *
+ * It says the model's answer was not a usable probe — too long, not a name, folded back onto the
+ * recorded identity. It names no text either, for the same reason.
+ */
+interface AdversarialProbeRefusal {
+    seedCassetteId: string;
+    kind: ProbeGeneratorKind;
+    promptVersion: number;
+    reason: ProbeRefusal;
+}
+interface StageAdversarialProposalInput {
+    agentQaRoot: string;
+    committedRoot: string;
+    product: string;
+    mutators?: readonly AdversarialMutator[];
+    /** D-04: the per-refresh NOVEL-seed cap; absent resolves to the recorded default. */
+    maxSeeds?: number;
+    /** Where `maxSeeds` came from, recorded beside the refresh. Absent with a value means 'flag'. */
+    maxSeedsSource?: Exclude<AdversarialCapSource, 'default'>;
+    /**
+     * D-10: the bound author, or nothing.
+     *
+     * A PORT and never a model: this package constructs no provider client and sees no profile,
+     * credential or provider name. Absent means this refresh authors nothing at all — the frozen
+     * families still derive, because a host with no eligible author is not a host with no
+     * adversarial corpus.
+     */
+    probeAuthor?: ProbeAuthorPort;
+    /** D-11: the identity every authored entry stamps. Required with `probeAuthor`. */
+    authoringModel?: AuthoringModel;
+    /** D-09: the host's capability gap, reported on the batch when there is no author. */
+    noProbeModel?: NoProbeModelGap;
+    /** D-04/D-10: the per-refresh provider-CALL cap; absent resolves to the recorded default. */
+    maxProbeCalls?: number;
+    /** Where `maxProbeCalls` came from. Absent with a value means 'flag'. */
+    maxProbeCallsSource?: Exclude<AdversarialCapSource, 'default'>;
+    /** Derive, publish nothing — neither staged bytes nor a settle record. */
+    dryRun?: boolean;
+}
+interface StagedAdversarialCase {
+    cassetteId: string;
+    seedCassetteId: string;
+    /** Table path only. */
+    mutator?: AdversarialMutator;
+    kind: GeneratorKind;
+    /** Table path only. */
+    tableEntryId?: string;
+    /** Probe path only: the frozen prompt generation this text was authored under (D-11). */
+    promptVersion?: number;
+}
+interface StageAdversarialProposalResult {
+    kind: 'staged' | 'unchanged' | 'dry-run' | 'nothing-derived';
+    product: string;
+    batchDigest?: string;
+    dir?: string;
+    staged: readonly StagedAdversarialCase[];
+    refusals: readonly AdversarialRefusal[];
+    skips: readonly AdversarialSeedSkip[];
+    stagingSkips: readonly AdversarialStagingSkip[];
+    seedsConsidered: number;
+    seedsDeferred: number;
+    tableVersion: number;
+    tableHash: string;
+    /**
+     * D-04: the committed root's GATE posture, not the reader's length.
+     *
+     * `openCorpusReader` answers an absent, unmarked or unreadable root with an empty list —
+     * byte-identical to a healthy root that genuinely holds no visible entry. Only the gate's own
+     * digest read establishes the root, and a refresh that cannot establish it settles nothing:
+     * a settle record written against silence is evidence manufactured from an outage.
+     */
+    rootPosture: 'available' | 'unavailable';
+    /** The corpus digest this refresh read its seeds from; absent when the posture is unavailable. */
+    sourceDigest?: string;
+    /** The resolved cap and its source, recorded beside every refresh. */
+    cap: AdversarialSeedCap;
+    /** NOVEL eligible seeds, counted BEFORE the cap; `seedsDeferred` is the overflow. */
+    eligibleSeeds: number;
+    /** The durable refresh record this refresh published, if it published one. */
+    stateRecordDigest?: string;
+    /** Always empty since 441-53 (D-15). */
+    settledRefusals: readonly AdversarialSettledRefusal[];
+    /**
+     * D-09: why this host authored no probes.
+     *
+     * ABSENT means the capability was never consulted (an admission, or a caller that declined to
+     * resolve credentials) — which is a different fact from "consulted, and there is no author".
+     * Collapsing the two would let a host that never asked read as a host that has nothing.
+     */
+    noProbeModel?: NoProbeModelGap;
+    /** The identity that authored this refresh's probes; absent when none were authored. */
+    authoringModel?: AuthoringModel;
+    /** The resolved provider-call cap and its source, recorded beside every refresh. */
+    probeCap: AdversarialProbeCallCap;
+    /** What this refresh actually spent at a provider. */
+    spend: AdversarialSpend;
+    /** Every probe tuple that produced no case, and why. */
+    probeSkips: readonly AdversarialProbeSkip[];
+    /** Authored responses the pure contract refused. */
+    probeRefusals: readonly AdversarialProbeRefusal[];
+    /**
+     * Calls a PREVIOUS run announced and never recorded an answer for, still charged against
+     * their tuples. Reported separately from `spend.modelCalls`, which counts only what THIS
+     * refresh asked: folding them together would claim this run made a call it did not.
+     */
+    interruptedProbeCalls: number;
+}
+/** A staged batch loaded back from disk with its bytes verified against the manifest pins. */
+interface StagedAdversarialBatch {
+    dir: string;
+    manifest: AdversarialBatchManifest;
+    retirement?: AdversarialRetirementRecord;
+    cases: readonly {
+        manifest: AdversarialBatchManifestCase;
+        caseDir: string;
+        cassette: LeafCassette;
+        labelRecord: StandaloneLabelRecord;
+        corpusEntry: AdversarialCorpusEntry;
+        /** The EXACT reviewed bytes; admission never re-serializes from the parsed objects. */
+        texts: {
+            cassette: string;
+            label: string;
+            entry: string;
+        };
+    }[];
+}
+interface RefreshAdversarialSplitInput {
+    agentQaRoot: string;
+    committedRoot: string;
+    product: string;
+    /** The reviewed batch digest the operator named; exact, never "the latest". */
+    batchDigest: string;
+    dryRun?: boolean;
+    /** Snapshot host receipts only after validation, under lifecycle ownership, before writes. */
+    beforeWrites?: () => void;
+    /**
+     * Runs after ONE case's bytes have landed and been byte-verified.
+     *
+     * An observation and fault-injection seam. Admission is the only place in this composition
+     * where an interruption can leave the committed root part-way through a reviewed batch, and
+     * "a case that landed stays landed" is not a claim anything could check without a way to
+     * interrupt it between cases. A throw here is treated exactly like a real IO failure.
+     */
+    afterCaseCommitted?: (cassetteId: string) => void;
+    /** 441 GAP3-D1: the workspace's declared-secret mask, passed to the seeding writer. Required. */
+    mask: MaskFn;
+}
+/**
+ * The outcome of ONE operator admission (D-01..D-04).
+ *
+ * Four counts, deliberately not three. `admitted` are cases whose bytes this run committed;
+ * `unchanged` are reviewed cases already present BYTE-IDENTICALLY, which move no digest and
+ * must not be double-counted as admissions; `refusals` is always empty (441 D-15); `remaining` are
+ * reviewed members that have not landed — the number that makes a partial admission legible
+ * as one. Collapsing any pair of them is how an interrupted run comes to read as a complete one.
+ */
+interface AdversarialAdmissionResult {
+    kind: 'admitted' | 'partial' | 'dry-run' | 'refused';
+    reason?: 'batch-not-found' | 'staging-integrity' | 'corpus-unavailable' | 'admission-refused' | 'admission-interrupted';
+    product: string;
+    batchDigest: string;
+    /** Cases whose bytes THIS run committed. */
+    admitted: readonly StagedAdversarialCase[];
+    /** Reviewed cases already committed byte-identically; the digest does not move for these. */
+    unchanged: readonly StagedAdversarialCase[];
+    refusals: readonly AdversarialRefusal[];
+    /** Reviewed members that have not landed — zero on a complete admission. */
+    remaining: readonly StagedAdversarialCase[];
+    stagingSkips: readonly AdversarialStagingSkip[];
+    previousCorpusDigest?: string;
+    nextCorpusDigest?: string;
+    writesStarted: boolean;
+    retirement?: AdversarialRetirementResult;
+    lifecycleBusy?: {
+        lockPath: string;
+    };
+}
+declare const retirementSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<2>;
+    product: z.ZodString;
+    batchDigest: z.ZodString;
+    manifestSha256: z.ZodString;
+    reviewedCaseIds: z.ZodArray<z.ZodString>;
+    alreadyCommittedCaseIds: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+type AdversarialRetirementRecord = z.infer<typeof retirementSchema>;
+interface RetireStagedAdversarialBatchInput {
+    agentQaRoot: string;
+    committedRoot: string;
+    product: string;
+    batchDigest: string;
+}
+/** A decision over retained reviewed bytes, never an admission outcome. */
+interface AdversarialRetirementResult {
+    retired: true;
+    alreadyRetired: boolean;
+    product: string;
+    batchDigest: string;
+    manifestSha256: string;
+    retainedBatchDir: string;
+    retirementRecordPath: string;
+    reviewedCaseIds: readonly string[];
+    alreadyCommittedCaseIds: readonly string[];
+    remainingCaseIds: readonly string[];
+}
+declare class AdversarialLifecycleBusyError extends Error {
+    readonly lockPath: string;
+    constructor(lockPath: string);
+}
+/** Retain the reviewed batch and publish its operator decision once, under admission's lock. */
+declare function retireStagedAdversarialBatch(input: RetireStagedAdversarialBatchInput): AdversarialRetirementResult;
+/** 422-01's spelling of the same result, retained for its existing callers. */
+type RefreshAdversarialSplitResult = AdversarialAdmissionResult;
+/**
+ * The batch digest (D-02). `stagedAt` is deliberately absent: two refreshes that derive the
+ * same cases must address the same directory, so re-staging is an idempotent no-op rather
+ * than an unbounded pile of near-identical batches.
+ */
+declare function computeAdversarialBatchDigest(product: string, cases: readonly AdversarialBatchManifestCase[]): string;
+/**
+ * Resolve the per-refresh provider-call cap (D-04/D-10).
+ *
+ * Every rejected boundary is rejected LOUDLY, exactly as the seed cap is: zero, negative,
+ * fractional, nonfinite and beyond-safe-integer budgets are a TypeError rather than a silent
+ * fallback. A budget that quietly becomes four because the operator typed `0` is a budget the
+ * operator does not have — and here the silent version would buy provider calls they refused.
+ */
+declare function resolveAdversarialProbeCallCap(input: {
+    value?: number;
+    source?: Exclude<AdversarialCapSource, 'default'>;
+}): AdversarialProbeCallCap;
+/**
+ * D-11's idempotence key: `(seed, kind, promptVersion)` and NOTHING else.
+ *
+ * Not the authored text — that is part of the derived IDENTITY, so keying on it would make
+ * every answer a new tuple and no refresh could ever recognise that it had already asked. Not
+ * the author either: a second host with a second model must not buy a second copy of a probe
+ * this corpus already holds. A future `promptVersion` IS a new tuple, deliberately — different
+ * instructions are a different case, not a duplicate.
+ */
+declare function adversarialProbeTupleKey(seedCassetteId: string, kind: ProbeGeneratorKind, promptVersion: number): string;
+/**
+ * Derive and stage one reviewable adversarial batch for a product.
+ *
+ * Seeds come from a FRESH `/reader` snapshot of the committed root, so a private held-out
+ * entry is structurally unreachable — the proposer's door is the same door this uses.
+ * Nothing under the committed root is written, read-modified, or re-digested.
+ */
+declare function stageAdversarialProposal(input: StageAdversarialProposalInput): Promise<StageAdversarialProposalResult>;
+/**
+ * Load staged batches, verifying identity at every level: the directory name IS the manifest
+ * digest, the digest recomputed from the manifest's own case list equals it, and each staged
+ * document re-hashes to its pinned value. A structural violation throws — a tampered batch is
+ * never handed back as if it were reviewable.
+ */
+declare function listStagedAdversarial(input: {
+    agentQaRoot: string;
+    product?: string;
+    batchDigest?: string;
+    includeRetired?: boolean;
+}): StagedAdversarialBatch[];
+/**
+ * Commit ONE reviewed batch, named by its digest.
+ *
+ * The order is deliberate: integrity first (nothing is trusted because it is on disk), then
+ * blob resolution, then the one sanctioned seeding writer, then a byte-verification of what
+ * actually landed. Only a case whose committed bytes equal the reviewed bytes counts as
+ * admitted; the reviewed bytes are committed as authored (441 D-15), and the writer refuses a
+ * case that still holds a declared value raw under the required mask (441 GAP3-D1), which this
+ * reports as an `unmasked-declared-value` staging skip. No other content check runs.
+ */
+declare function refreshAdversarialSplit(input: RefreshAdversarialSplitInput): RefreshAdversarialSplitResult;
+
+interface JudgeBindingInput {
+    /** The judge model profile — a SECOND profile, never the replay planner's (D-12 disjointness). */
+    profile: ModelProfile;
+    /** Resolved provider auth for the judge model. */
+    auth: ResolvedModelAuth;
+    /** Optional provider overrides — the captured-boundary stub seam for tests (createModel passthrough). */
+    modelOverrides?: ModelProviderOverrides;
+    modelCallObservation?: ModelCallObservation;
+    mask: MaskFn;
+}
+/** N existing bindings in declaration order, each retaining bindJudgePort's fresh copy. */
+declare function bindJudgePanel(inputs: readonly JudgeBindingInput[]): JudgePanelPort;
+/**
+ * Bind the tier-4 JudgePort over the production createModel recipe: a fresh ModelProfile copy
+ * (createModel mutates `profile.capabilities` — RESEARCH Pitfall 8), ONE handle built at bind
+ * time and shared across calls, model identity from the caller profile only.
+ */
+declare function bindJudgePort(input: JudgeBindingInput): JudgePort;
+
+interface LoadJudgeCalibrationEvidenceInput {
+    committedRoot: string;
+    agentQaRoot: string;
+    profile: BaselineProfileKeyInput;
+    /** Explicit operator selection when supplied; never choose the newest matching directory. */
+    replayRunRoots?: readonly string[];
+}
+interface JudgeCalibrationEvidenceRead {
+    /** Executable selected gold before saved-replay admission; not a sum of skip diagnostics. */
+    selected: number;
+    evidence: JudgeCalibrationEvidence[];
+    skippedCounts: JudgeCalibrationDiagnostics;
+    corpusDigest: string;
+    goldSetDigest: string;
+    replayEvidenceDigest: string;
+    evidenceDigest: string;
+    profileKey: string;
+    selectedInputs: {
+        decisionId: string;
+        goldCassetteId: string;
+        replayFile: string;
+        reportFile: string;
+        replayDigest: string;
+        scoreDigest: string;
+        reportDigest: string;
+    }[];
+    /**
+     * 422 D-12: the committed ADVERSARIAL population — the bait disclosure's source, never gold.
+     *
+     * ABSENT means this reader could not open the committed corpus at all, which is a different
+     * fact from a corpus that holds no adversarial member; an empty array standing in for the
+     * former would report a clean zero nobody measured.
+     */
+    adversarialMembers?: readonly JudgeTargetedCalibrationMember[];
+}
+/** Operator-only IO. Every action/truth derivation stays in the neutral package. */
+declare function loadJudgeCalibrationEvidence(input: LoadJudgeCalibrationEvidenceInput): JudgeCalibrationEvidenceRead;
+
+declare const JUDGE_CALIBRATION_SCHEMA_VERSION = 2;
+declare const JUDGE_CALIBRATION_SUBDIR = "judge-calibration";
+declare const schema: z.ZodUnion<readonly [z.ZodObject<{
+    status: z.ZodLiteral<"capability-gap">;
+    reason: z.ZodEnum<{
+        "no-credential": "no-credential";
+        "single-family-host": "single-family-host";
+    }>;
+    n: z.ZodLiteral<0>;
+    schemaVersion: z.ZodLiteral<2>;
+    generationId: z.ZodString;
+    judgeTargeted: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+        basis: z.ZodLiteral<"raw">;
+        source: z.ZodLiteral<"unavailable">;
+        reason: z.ZodEnum<{
+            "not-read": "not-read";
+            "corpus-unreadable": "corpus-unreadable";
+        }>;
+    }, z.core.$strict>, z.ZodObject<{
+        basis: z.ZodLiteral<"raw">;
+        source: z.ZodLiteral<"resolved">;
+        total: z.ZodNumber;
+        metadataUnavailable: z.ZodNumber;
+        byProvenance: z.ZodRecord<z.ZodEnum<{
+            absent: "absent";
+            table: "table";
+            probe: "probe";
+            malformed: "malformed";
+        }>, z.ZodNumber>;
+        byKind: z.ZodRecord<z.ZodEnum<{
+            "fuzz-selector": "fuzz-selector";
+            "fuzz-label": "fuzz-label";
+            "fuzz-error": "fuzz-error";
+            "injection-name": "injection-name";
+            "optimized-trigger": "optimized-trigger";
+            "judge-targeted": "judge-targeted";
+        }>, z.ZodNumber>;
+        judgeTargeted: z.ZodNumber;
+        selfAuthored: z.ZodNumber;
+        byAuthoringModel: z.ZodArray<z.ZodObject<{
+            authoringModel: z.ZodString;
+            authoringFamily: z.ZodString;
+            panelMember: z.ZodBoolean;
+            probeAuthored: z.ZodNumber;
+            judgeTargeted: z.ZodNumber;
+        }, z.core.$strict>>;
+        observedInCalibration: z.ZodNumber;
+    }, z.core.$strict>]>>;
+    profileKey: z.ZodString;
+    profile: z.ZodObject<{
+        plannerModelId: z.ZodString;
+        fingerprint: z.ZodString;
+        matcherVersion: z.ZodNumber;
+        judgeModelId: z.ZodString;
+        judgeVersion: z.ZodNumber;
+    }, z.core.$strict>;
+    identity: z.ZodObject<{
+        judgeModelId: z.ZodString;
+        judgeFamily: z.ZodString;
+        judgeVersion: z.ZodNumber;
+        confidenceThreshold: z.ZodLiteral<"high">;
+        panelSize: z.ZodNumber;
+        members: z.ZodArray<z.ZodObject<{
+            judgeModelId: z.ZodString;
+            judgeFamily: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    constitutionDigest: z.ZodString;
+    corpusDigest: z.ZodString;
+    goldSetDigest: z.ZodString;
+    replayEvidenceDigest: z.ZodString;
+    evidenceDigest: z.ZodString;
+    minN: z.ZodNumber;
+    minNSource: z.ZodEnum<{
+        default: "default";
+        flag: "flag";
+    }>;
+    selected: z.ZodNumber;
+    admitted: z.ZodNumber;
+    cost: z.ZodObject<{
+        callBound: z.ZodNumber;
+        usage: z.ZodObject<{
+            calls: z.ZodNumber;
+            inputTokens: z.ZodOptional<z.ZodNumber>;
+            outputTokens: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    skippedCounts: z.ZodOptional<z.ZodObject<{
+        'missing-executable-correction': z.ZodNumber;
+    }, z.core.$strict>>;
+}, z.core.$strict>, z.ZodObject<{
+    status: z.ZodEnum<{
+        uncalibrated: "uncalibrated";
+        calibrated: "calibrated";
+    }>;
+    n: z.ZodNumber;
+    counts: z.ZodObject<{
+        selected: z.ZodNumber;
+        admitted: z.ZodNumber;
+        eligible: z.ZodNumber;
+        attempted: z.ZodNumber;
+        eligibilityRefused: z.ZodNumber;
+        evidenceSkipped: z.ZodNumber;
+        truthComparable: z.ZodNumber;
+        unresolvedTruth: z.ZodNumber;
+    }, z.core.$strict>;
+    pooled: z.ZodObject<{
+        settled: z.ZodNumber;
+        abstained: z.ZodNumber;
+        errors: z.ZodNumber;
+        n: z.ZodNumber;
+        numerator: z.ZodNumber;
+        denominator: z.ZodNumber;
+        agreement: z.ZodOptional<z.ZodNumber>;
+        wilson95: z.ZodOptional<z.ZodObject<{
+            lower: z.ZodNumber;
+            upper: z.ZodNumber;
+            halfWidth: z.ZodNumber;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    perMember: z.ZodArray<z.ZodObject<{
+        settled: z.ZodNumber;
+        abstained: z.ZodNumber;
+        errors: z.ZodNumber;
+        n: z.ZodNumber;
+        numerator: z.ZodNumber;
+        denominator: z.ZodNumber;
+        agreement: z.ZodOptional<z.ZodNumber>;
+        wilson95: z.ZodOptional<z.ZodObject<{
+            lower: z.ZodNumber;
+            upper: z.ZodNumber;
+            halfWidth: z.ZodNumber;
+        }, z.core.$strict>>;
+        judgeModelId: z.ZodString;
+    }, z.core.$strict>>;
+    pooledAgreement: z.ZodOptional<z.ZodNumber>;
+    wilson95: z.ZodOptional<z.ZodObject<{
+        lower: z.ZodNumber;
+        upper: z.ZodNumber;
+        halfWidth: z.ZodNumber;
+    }, z.core.$strict>>;
+    abstention: z.ZodObject<{
+        numerator: z.ZodNumber;
+        denominator: z.ZodNumber;
+        rate: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>;
+    disagreement: z.ZodObject<{
+        pairs: z.ZodArray<z.ZodObject<{
+            numerator: z.ZodNumber;
+            denominator: z.ZodNumber;
+            rate: z.ZodOptional<z.ZodNumber>;
+            memberModelIds: z.ZodTuple<[z.ZodString, z.ZodString], null>;
+        }, z.core.$strict>>;
+        numerator: z.ZodNumber;
+        denominator: z.ZodNumber;
+        rate: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>;
+    schemaVersion: z.ZodLiteral<2>;
+    generationId: z.ZodString;
+    judgeTargeted: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+        basis: z.ZodLiteral<"raw">;
+        source: z.ZodLiteral<"unavailable">;
+        reason: z.ZodEnum<{
+            "not-read": "not-read";
+            "corpus-unreadable": "corpus-unreadable";
+        }>;
+    }, z.core.$strict>, z.ZodObject<{
+        basis: z.ZodLiteral<"raw">;
+        source: z.ZodLiteral<"resolved">;
+        total: z.ZodNumber;
+        metadataUnavailable: z.ZodNumber;
+        byProvenance: z.ZodRecord<z.ZodEnum<{
+            absent: "absent";
+            table: "table";
+            probe: "probe";
+            malformed: "malformed";
+        }>, z.ZodNumber>;
+        byKind: z.ZodRecord<z.ZodEnum<{
+            "fuzz-selector": "fuzz-selector";
+            "fuzz-label": "fuzz-label";
+            "fuzz-error": "fuzz-error";
+            "injection-name": "injection-name";
+            "optimized-trigger": "optimized-trigger";
+            "judge-targeted": "judge-targeted";
+        }>, z.ZodNumber>;
+        judgeTargeted: z.ZodNumber;
+        selfAuthored: z.ZodNumber;
+        byAuthoringModel: z.ZodArray<z.ZodObject<{
+            authoringModel: z.ZodString;
+            authoringFamily: z.ZodString;
+            panelMember: z.ZodBoolean;
+            probeAuthored: z.ZodNumber;
+            judgeTargeted: z.ZodNumber;
+        }, z.core.$strict>>;
+        observedInCalibration: z.ZodNumber;
+    }, z.core.$strict>]>>;
+    profileKey: z.ZodString;
+    profile: z.ZodObject<{
+        plannerModelId: z.ZodString;
+        fingerprint: z.ZodString;
+        matcherVersion: z.ZodNumber;
+        judgeModelId: z.ZodString;
+        judgeVersion: z.ZodNumber;
+    }, z.core.$strict>;
+    identity: z.ZodObject<{
+        judgeModelId: z.ZodString;
+        judgeFamily: z.ZodString;
+        judgeVersion: z.ZodNumber;
+        confidenceThreshold: z.ZodLiteral<"high">;
+        panelSize: z.ZodNumber;
+        members: z.ZodArray<z.ZodObject<{
+            judgeModelId: z.ZodString;
+            judgeFamily: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    constitutionDigest: z.ZodString;
+    corpusDigest: z.ZodString;
+    goldSetDigest: z.ZodString;
+    replayEvidenceDigest: z.ZodString;
+    evidenceDigest: z.ZodString;
+    minN: z.ZodNumber;
+    minNSource: z.ZodEnum<{
+        default: "default";
+        flag: "flag";
+    }>;
+    selected: z.ZodNumber;
+    admitted: z.ZodNumber;
+    cost: z.ZodObject<{
+        callBound: z.ZodNumber;
+        usage: z.ZodObject<{
+            calls: z.ZodNumber;
+            inputTokens: z.ZodOptional<z.ZodNumber>;
+            outputTokens: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    skippedCounts: z.ZodOptional<z.ZodObject<{
+        'missing-executable-correction': z.ZodNumber;
+    }, z.core.$strict>>;
+}, z.core.$strict>]>;
+type JudgeCalibrationArtifact = z.infer<typeof schema>;
+interface JudgeCalibrationReadInput extends LoadJudgeCalibrationEvidenceInput {
+    identity: JudgeIdentityBlock;
+    minN: JudgeCalibrationMinimum;
+}
+type JudgeCalibrationRead = {
+    kind: 'absent';
+} | {
+    kind: 'loaded';
+    artifact: JudgeCalibrationArtifact;
+} | {
+    kind: 'refused';
+    reason: string;
+};
+type JudgeCalibrationPublication = {
+    kind: 'committed' | 'unchanged';
+    artifact: JudgeCalibrationArtifact;
+    path: string;
+} | {
+    kind: 'refused' | 'busy' | 'input-drift' | 'publication-failed';
+    reason: string;
+} | {
+    kind: 'write-conflict';
+    path: string;
+};
+/** Locator only. Admission always checks the complete key and profile separately. */
+declare function judgeCalibrationPath(profileKey: string): string;
+declare function judgeCalibrationGenerationId(body: unknown): string;
+/** Strict syntax and arithmetic, including independently recomputed Wilson bounds. */
+declare function guardJudgeCalibration(value: unknown): JudgeCalibrationArtifact | undefined;
+/** Project only measured summary data; raw rows, credentials and audit paths cannot cross. */
+declare function createJudgeCalibrationArtifact(input: JudgeCalibrationReadInput, result: {
+    status: 'capability-gap';
+    reason: 'no-credential' | 'single-family-host';
+} | ReturnType<typeof _vostride_agent_qa_eval.summarizeJudgeCalibration>): JudgeCalibrationArtifact;
+declare function readJudgeCalibration(input: Omit<JudgeCalibrationReadInput, 'minN'> & {
+    /** Operators may require an exact minimum; report consumers retain the recorded policy. */
+    minN?: JudgeCalibrationMinimum;
+}): JudgeCalibrationRead;
+/** One checked file, with immutable create or explicit atomic replace under the operator lock. */
+declare function publishJudgeCalibration(input: JudgeCalibrationReadInput & {
+    artifact: JudgeCalibrationArtifact;
+    replace?: boolean;
+    onBoundary?: (stage: string) => void;
+}): Promise<JudgeCalibrationPublication>;
+
+type RunJudgeCalibrationResult = Awaited<ReturnType<typeof runJudgePanelCalibration>> | JudgeCalibrationPublication | {
+    kind: 'capability-gap';
+    status: 'capability-gap';
+    reason: 'panel-not-configured' | 'no-credential' | 'single-family-host';
+    minN: number;
+    minNSource: JudgeCalibrationMinimum['source'];
+    n: 0;
+    identity?: JudgeCalibrationReadInput['identity'];
+    cost: {
+        callBound: number;
+        usage: {
+            calls: number;
+        };
+    };
+    artifactDisposition: 'not-created';
+    judgeTargeted: JudgeTargetedCalibrationDisclosure;
+};
+declare function maskJudgeCalibrationText<T>(value: T, mask: MaskFn): T;
+/** Publication routing is separate from the forced probe, so a missing composite does no IO. */
+declare function runJudgeCalibration(input: {
+    commit?: boolean;
+    replace?: boolean;
+} & ({
+    kind: 'capability-gap';
+    reason: 'panel-not-configured' | 'no-credential' | 'single-family-host';
+    minN: JudgeCalibrationMinimum;
+    publication?: JudgeCalibrationReadInput;
+} | {
+    kind: 'probe';
+    probe: RunJudgePanelCalibrationInput;
+})): Promise<RunJudgeCalibrationResult>;
+interface RunJudgePanelCalibrationInput {
+    committedRoot: string;
+    agentQaRoot: string;
+    profile: BaselineProfileKeyInput;
+    replayProfile: ModelProfile;
+    members: readonly Omit<JudgeBindingInput, 'mask'>[];
+    minN?: JudgeCalibrationMinimum;
+    replayRunRoots?: readonly string[];
+    mask: MaskFn;
+}
+/** Operator-only forced probe. Credentials and source action content never enter its DTO. */
+declare function runJudgePanelCalibration(input: RunJudgePanelCalibrationInput): Promise<{
+    identity: _vostride_agent_qa_eval.JudgeIdentityBlock;
+    profileKey: string;
+    corpusDigest: string;
+    goldSetDigest: string;
+    replayEvidenceDigest: string;
+    evidenceDigest: string;
+    skippedCounts: Partial<Record<_vostride_agent_qa_eval.JudgeCalibrationSkipReason, number>>;
+    rows: ({
+        axis: "value" | "element-identity";
+        outcome: _vostride_agent_qa_eval.JudgePairwiseOutcome;
+        members: _vostride_agent_qa_eval.JudgeMemberOutcome[] | undefined;
+        usage: {
+            outputTokens?: number | undefined;
+            inputTokens?: number | undefined;
+            calls: number;
+        };
+        kind: "skipped" | "not-invoked" | "attempted";
+        eligibility: _vostride_agent_qa_eval.JudgeEligibility;
+        truth: _vostride_agent_qa_eval.JudgeCalibrationTruth;
+        recordedModelId?: string | undefined;
+        decisionId: string;
+        replayedModelId: string;
+    } | {
+        reason: "no-eligible-judge" | "missing-evidence";
+        kind: "skipped" | "not-invoked" | "attempted";
+        eligibility: _vostride_agent_qa_eval.JudgeEligibility;
+        truth: _vostride_agent_qa_eval.JudgeCalibrationTruth;
+        recordedModelId?: string | undefined;
+        decisionId: string;
+        replayedModelId: string;
+    })[];
+    abstention: {
+        rate?: number | undefined;
+        numerator: number;
+        denominator: number;
+    };
+    disagreement: {
+        pairs: {
+            rate?: number | undefined;
+            numerator: number;
+            denominator: number;
+            memberModelIds: readonly [string, string];
+        }[];
+        rate?: number | undefined;
+        numerator: number;
+        denominator: number;
+    };
+    cost: {
+        callBound: number;
+        usage: Omit<UsageAggregator, "members">;
+    };
+    pooledAgreement?: number | undefined;
+    wilson95?: {
+        lower: number;
+        upper: number;
+        halfWidth: number;
+    } | undefined;
+    status: "calibrated" | "uncalibrated";
+    n: number;
+    minN: number;
+    minNSource: "default" | "flag";
+    counts: {
+        selected: number;
+        admitted: number;
+        eligible: number;
+        attempted: number;
+        eligibilityRefused: number;
+        evidenceSkipped: number;
+        truthComparable: number;
+        unresolvedTruth: number;
+    };
+    perMember: {
+        agreement?: number | undefined;
+        wilson95?: {
+            lower: number;
+            upper: number;
+            halfWidth: number;
+        } | undefined;
+        settled: number;
+        abstained: number;
+        errors: number;
+        n: number;
+        numerator: number;
+        denominator: number;
+        judgeModelId: string;
+    }[];
+    pooled: {
+        agreement?: number | undefined;
+        wilson95?: {
+            lower: number;
+            upper: number;
+            halfWidth: number;
+        } | undefined;
+        settled: number;
+        abstained: number;
+        errors: number;
+        n: number;
+        numerator: number;
+        denominator: number;
+    };
+    judgeTargeted: JudgeTargetedCalibrationDisclosure;
+    kind: "dry-run";
+}>;
+
+declare const LABEL_CALIBRATION_PATH = "labels/calibration.json";
+declare const LABEL_CALIBRATION_SCHEMA_VERSION = 2;
+interface LabelCalibrationArtifact extends Omit<LabelCalibrationReport, 'minGold'> {
+    schemaVersion: typeof LABEL_CALIBRATION_SCHEMA_VERSION;
+    minGold: {
+        value: number;
+        source: 'default' | 'cli';
+    };
+    evidenceDigest: string;
+    generationId: string;
+    targetRevisions: readonly {
+        cassetteId: string;
+        revisionId: string;
+    }[];
+}
+type LabelCalibrationRead = {
+    kind: 'absent';
+} | {
+    kind: 'refused';
+    reason: string;
+    targetCassetteIds?: readonly string[];
+} | {
+    kind: 'loaded';
+    artifact: LabelCalibrationArtifact;
+    authorizedRevisionIds: ReadonlySet<string>;
+};
+/** Independent marker loading: never calls the corpus reader and never grants a whole generation. */
+declare function readLabelCalibration(committedRoot: string): LabelCalibrationRead;
+
+interface RunLabelCalibrationInput {
+    committedRoot: string;
+    agentQaRoot: string;
+    commit?: boolean;
+    replace?: boolean;
+    minGold?: {
+        value: number;
+        source: 'default' | 'cli';
+    };
+    /** Synchronous failure injection at actual publication boundaries; never supplied by learners. */
+    onBoundary?: (stage: string) => void;
+}
+type RunLabelCalibrationResult = {
+    kind: 'dry-run' | 'committed' | 'unchanged';
+    artifact: LabelCalibrationArtifact;
+    refreshedCount: number;
+} | {
+    kind: 'refused' | 'busy' | 'input-drift' | 'publication-failed';
+    reason: string;
+} | {
+    kind: 'write-conflict';
+    path: string;
+};
+/** The only explicit operator producer. Immutable revisions precede the one atomic marker swap. */
+declare function runLabelCalibration(input: RunLabelCalibrationInput): Promise<RunLabelCalibrationResult>;
+
+interface LoadLabelEvidenceInput {
+    snapshot: CommittedCorpusSnapshot;
+    agentQaRoot: string;
+    incoming?: CompletedRunHandoff;
+}
+interface LabelEvidenceRead {
+    handoffs: CompletedRunHandoff[];
+    marks: MarkReceipt[];
+    refusals: {
+        runId: string;
+        reason: 'invalid-run-link' | 'handoff-unavailable' | 'run-identity-mismatch' | 'product-mismatch' | 'path-outside-root' | 'conflicting-handoff' | 'marks-unavailable';
+    }[];
+}
+/** Load only positively linked runs. A slug locates bytes; the guarded run identity authorizes them. */
+declare function loadLabelEvidence(input: LoadLabelEvidenceInput): LabelEvidenceRead;
+
+declare const COMMITTED_CASSETTES_DIR = "cassettes";
+declare const COMMITTED_CORPUS_DIR = "corpus";
+declare const COMMITTED_LABELS_DIR = "labels";
+declare const COMMITTED_CONTRACTS_DIR = "contracts";
+declare const COMMITTED_REPORTS_DIR = "reports";
+/** 414 D-02: one committed file per excluded run, product-partitioned. */
+declare const COMMITTED_EXCLUSIONS_DIR = "exclusions";
+/** 414 D-05: the file-name prefix that makes a partition manifest findable under contracts/. */
+declare const PARTITION_MANIFEST_FILE_PREFIX = "partition-";
+/** 413 D-19: baseline pointers live one level under reports/, beside the batchKey dirs. */
+declare const COMMITTED_BASELINES_SUBDIR = "baselines";
+/** 413 D-15: the corpus census lives one level under reports/, beside the batchKey dirs. */
+declare const COMMITTED_CENSUS_SUBDIR = "census";
+/** 415 D-04: one floor artefact per profile, beside the baseline-pointer set. */
+declare const COMMITTED_NOISE_FLOOR_SUBDIR = "noise-floor";
+declare const COMMITTED_ROOT_MARKER_FILE = "eval-root.json";
+declare const COMMITTED_ROOT_SCHEMA_VERSION = 2;
+/** Scaffolded ignore content: one rule covering every blobs/ dir at any depth (D-15). */
+declare const COMMITTED_GITIGNORE_TEXT = "# agent-qa committed eval root: binary blob bytes stay untracked (D-15/L12).\n**/blobs/\n";
+interface CommittedRootStoreConfig {
+    /**
+     * Explicit absolute committed-root path — `<configDir>/agent-qa-eval` for the Phase 372
+     * CLI. Deliberately NO default: nothing may silently resolve into a workdir (OQ-2).
+     */
+    committedRoot: string;
+}
+type CommittedWriteOutcome = {
+    kind: 'written';
+} | {
+    kind: 'unchanged';
+} | {
+    kind: 'write-conflict';
+    path: string;
+};
+declare function buildRootMarkerValue(): {
+    schemaVersion: number;
+};
+declare function committedCassettePath(product: string, cassetteId: string): string;
+declare function committedBlobPath(product: string, cassetteId: string, sha: string): string;
+declare function committedLabelPath(product: string, cassetteId: string): string;
+/** Preserve validated cassette path segments; suffix only the JSON leaf, never slug the whole ID. */
+declare function committedLabelRevisionPath(product: string, cassetteId: string, revisionId: string): string;
+declare function committedCorpusPath(product: string, cassetteId: string): string;
+declare function committedContractPath(fileName: string): string;
+/**
+ * Phase 372 D-13: the baseline report commits beside the corpus/contracts that produced it —
+ * one dir per batchKey, so a changed corpus (⇒ changed key) gets a fresh dir under write-once
+ * while an identical regen byte-compares 'unchanged'. Every segment slugged (T-368-10).
+ */
+declare function committedReportPath(batchKey: string, fileName: string): string;
+/**
+ * Phase 413 D-15: the census commits one dir per CORPUS DIGEST, the reports/<batchKey>/ shape
+ * applied to the population rather than to a replay batch — a grown corpus hashes to a fresh
+ * digest and therefore gets a fresh dir under write-once, while re-running the census over an
+ * unchanged corpus byte-compares 'unchanged' and is an idempotent no-op. Every segment slugged,
+ * so a crafted digest cannot escape the committed root (T-368-10 / T-413-18).
+ */
+declare function committedCensusPath(corpusDigest: string, fileName: string): string;
+/**
+ * Phase 413 D-19: baseline designation is a committed pointer, one file per profile key, so
+ * moving a baseline is a reviewed git edit of that file rather than a silent overwrite. The
+ * key is a single path segment and every segment is slugged (T-368-10).
+ */
+declare function committedBaselinePointerPath(profileKey: string): string;
+/** 415 D-04: the entire profile key is one slugged segment, never a batch report dir. */
+declare function committedNoiseFloorPath(profileKey: string): string;
+/**
+ * Phase 414 D-05: one partition manifest per product, under contracts/ rather than beside the
+ * entries it governs. Two reasons. (1) The recursive corpus/ walk parses every *.json it finds,
+ * so a manifest under corpus/ would be handed to the corpus-entry guard and refused as a corpus
+ * entry — putting it under contracts/ means the walk never sees it (T-414-20). (2) contracts/ is
+ * already where this root keeps its reviewed constitution documents, and a manifest IS one: a
+ * change to its salt or fractions re-partitions a committed corpus, so it lands as a reviewed git
+ * edit and a named migration, never a silent rewrite. Every segment slugged (T-368-10).
+ */
+declare function committedPartitionManifestPath(product: string): string;
+/**
+ * Phase 414 D-02: one committed file per excluded run, so corpus membership becomes a function of
+ * a committed list rather than a fact about whoever ran the growth campaign. 413 dropped excluded
+ * runs before anything was committed and they left no trace; a record per run lets the census
+ * count what never arrived and 422's curator ask why a run is missing. Every segment slugged, so a
+ * crafted product or runSlug cannot escape the committed root (T-368-10 / T-414-16).
+ */
+declare function committedExclusionPath(product: string, runSlug: string): string;
+declare class FsCommittedRootStore {
+    private readonly committedRoot;
+    constructor(config: CommittedRootStoreConfig);
+    /**
+     * Scaffold the committed root deterministically: the blobs-covering .gitignore plus the
+     * schemaVersion root marker (D-15). Both texts arrive as ALREADY-CHECKED strings from
+     * the seeding composition helper — the store never imports the guardrail. Re-scaffolding
+     * an intact root yields two 'unchanged' outcomes and mutates nothing.
+     */
+    scaffold(checkedGitignoreText: string, checkedRootMarkerText: string): {
+        gitignore: CommittedWriteOutcome;
+        rootMarker: CommittedWriteOutcome;
+    };
+    /** The write-once comparison WITHOUT any mkdir or write — pure read + compare. */
+    previewText(relPath: string, text: string): 'absent' | 'identical' | 'conflict';
+    /** Write-once text: read-compare-refuse, never overwrite (D-17). */
+    writeText(relPath: string, text: string): CommittedWriteOutcome;
+    /**
+     * Write-once blob bytes, confined to ignore-covered blobs/ dirs. The sha must match the
+     * lowercase 64-hex content-address format, the byte hash must equal it, and the target
+     * path must be `.../blobs/<sha>` — any verification failure is a typed refusal, so
+     * corrupt bytes never land under an untrue content address (T-371-11).
+     */
+    writeBlob(relBlobPath: string, blob: ExtractedBlob): CommittedWriteOutcome;
+}
+
+interface SeedCommittedCorpusInput {
+    /** The pure eval-core plan — the ONLY decision-maker; this helper executes it verbatim (D-16). */
+    plan: SeedingPlan;
+    /** The extracted cassettes the plan's cases reference (cassette bytes + verified blobs). */
+    cassettes: readonly ExtractedCassette[];
+    /** Explicit absolute committed-root path — `<configDir>/agent-qa-eval` for the 372 CLI. */
+    committedRoot: string;
+    /** 441 GAP3-D1: the workspace's declared-secret mask. Required; a missing one throws first. */
+    mask: MaskFn;
+}
+type SeedingRefusal = {
+    cassetteId: string;
+    kind: 'write-conflict';
+    path: string;
+} | {
+    cassetteId: string;
+    kind: 'missing-cassette';
+}
+/** A committed string of the case still holds a declared value raw; nothing of it is written. */
+ | {
+    cassetteId: string;
+    kind: 'unmasked-declared-value';
+};
+interface SeedingReport {
+    supersededOriginalCount: number;
+    retirementCounts: NonNullable<SeedingPlan['retirementCounts']>;
+    softEvidence?: SeedingPlan['softEvidence'];
+    product: string;
+    runId: string;
+    committedRoot: string;
+    /** Cases with at least one newly written file. */
+    seededCount: number;
+    /** Cases whose every file was byte-identical (D-17 idempotent no-op). */
+    unchangedCount: number;
+    /** Typed per-case refusals — write conflicts and missing cassettes. Never silent. */
+    refusals: SeedingRefusal[];
+    /** Matcher skips, carried verbatim from the plan. */
+    pairSkips: PairSkip[];
+    /** Sampler exclusions, carried verbatim from the plan. */
+    silverExclusions: SilverExclusion[];
+    /** Both pair classes counted, carried verbatim from the plan (D-07). */
+    pairCounts: {
+        total: number;
+        sameState: number;
+        differingState: number;
+    };
+    /** Count of 'procedure-granularity' exclusions, carried verbatim from the plan. */
+    proceduresExcludedCount: number;
+    /** Per-contract-file outcome for the D-04 constitution projections. */
+    contracts: {
+        fileName: string;
+        outcome: CommittedWriteOutcome['kind'];
+    }[];
+    /** D-15 scaffold outcomes for the blobs-covering gitignore and the schemaVersion marker. */
+    scaffold: {
+        gitignore: CommittedWriteOutcome['kind'];
+        marker: CommittedWriteOutcome['kind'];
+    };
+}
+/**
+ * Execute a SeedingPlan against the committed root: scaffold (D-15), contracts projections
+ * (D-04), then each case as an atomic preview-then-write unit (D-14/D-17). Conflicted cases
+ * refuse atomically; the batch always runs to completion.
+ */
+/** 2026-09-08, 418 D-21: one reviewed invocation may contain several actual product/run plans.
+ * The existing per-case sequential writer remains the unit; no whole-root transaction is implied.
+ */
+interface SeedCommittedCorpusBatchInput extends Omit<SeedCommittedCorpusInput, 'plan' | 'cassettes'> {
+    batches: readonly Pick<SeedCommittedCorpusInput, 'plan' | 'cassettes'>[];
+}
+interface SeedingBatchReport {
+    reports: SeedingReport[];
+}
+declare function seedCommittedCorpus(input: SeedCommittedCorpusBatchInput): SeedingBatchReport;
+declare function seedCommittedCorpus(input: SeedCommittedCorpusInput): SeedingReport;
+/** Both writers answer with the same outcomes. */
+type CommittedDocumentOutcome = {
+    kind: 'written' | 'unchanged';
+    path: string;
+} | {
+    kind: 'write-conflict';
+    path: string;
+};
+interface WritePartitionManifestInput {
+    /** An already-guarded manifest; its `product` names the committed file. */
+    manifest: PartitionManifest;
+    /** Explicit absolute committed-root path — `<configDir>/agent-qa-eval` for the CLI. */
+    committedRoot: string;
+}
+type WritePartitionManifestOutcome = CommittedDocumentOutcome;
+interface WriteRunExclusionInput {
+    /** An already-guarded exclusion record; its product + runSlug name the file. */
+    record: RunExclusionRecord;
+    committedRoot: string;
+}
+type WriteRunExclusionOutcome = CommittedDocumentOutcome;
+/**
+ * Commit one product's partition manifest (414 D-05).
+ *
+ * Write-once is the entire point. The salt and the two fractions decide which split every
+ * cassette in the product lands in, so a second manifest whose flags disagree with the committed
+ * one is not an update — it silently re-partitions a corpus that has already been gated against.
+ * That is refused as a `write-conflict` with the committed bytes untouched; changing a live
+ * partition is a reviewed git edit plus a named migration, never a rewrite through this function.
+ */
+declare function writePartitionManifest(input: WritePartitionManifestInput): WritePartitionManifestOutcome;
+/**
+ * Commit one excluded run's record (414 D-02).
+ *
+ * Identical-regen is decided on `runExclusionCore` — the record WITHOUT its `backfill` block —
+ * rather than on the bytes. `backfill` records a LATER act (entries deleted from the root after
+ * the fact); the rest of the record is the original exclusion decision. Comparing bytes would
+ * make re-recording an unchanged decision beside a newly-added backfill look like a conflicting
+ * exclusion, and would equally refuse the mirror case. Anything that differs in the CORE — a
+ * different verdict class, a different analysisDigest — still falls through to the write-once
+ * preview and refuses.
+ */
+declare function writeRunExclusion(input: WriteRunExclusionInput): WriteRunExclusionOutcome;
+
+interface FreezeGoldenTrajectoryInput {
+    agentQaRoot: string;
+    committedRoot: string;
+    product: string;
+    mark: MarkReceipt;
+    handoff: CompletedRunHandoff;
+    supersedes?: string;
+    priorGold?: MarkReceipt['gold'];
+    /** 441 GAP3-D1: the declared mask the run and the mark's correction are frozen under. */
+    mask: MaskFn;
+}
+type FreezeOutcome = {
+    kind: 'ambiguous-correction';
+    decisionCount: number;
+} | {
+    kind: 'frozen';
+    cases: MarkReceipt['gold'];
+    census: 'committed' | 'unchanged' | 'write-conflict';
+} | {
+    kind: 'refused';
+    refusals: SeedingRefusal[];
+} | {
+    kind: 'step-not-found';
+    stepCount: number;
+} | {
+    kind: 'no-leaf-cassette';
+};
+declare function freezeGoldenTrajectory(input: FreezeGoldenTrajectoryInput): FreezeOutcome;
+
+declare const MARKS_LEDGER_FILE = "marks.jsonl";
+declare const MARKS_LEDGER_LOCK_FILE = "marks.jsonl.lock";
+/** A run's one unfinished mark, beside its ledger. */
+declare const MARK_INTENT_FILE = "mark-intent.json";
+declare const intentSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<2>;
+    mark: z.ZodObject<{
+        runSlug: z.ZodString;
+        kind: z.ZodEnum<{
+            "false-fail": "false-fail";
+            "false-pass": "false-pass";
+            "confirmed-bug": "confirmed-bug";
+        }>;
+        origin: z.ZodLiteral<"user">;
+        ordinal: z.ZodNumber;
+        markedAt: z.ZodNumber;
+        note: z.ZodOptional<z.ZodString>;
+        correctedExpectation: z.ZodOptional<z.ZodString>;
+        correctedAction: z.ZodOptional<z.ZodType<_vostride_agent_qa_schema.Action, unknown, z.core.$ZodTypeInternals<_vostride_agent_qa_schema.Action, unknown>>>;
+        rootCause: z.ZodOptional<z.ZodObject<{
+            class: z.ZodEnum<{
+                unknown: "unknown";
+                environment: "environment";
+                timeout: "timeout";
+                test_bug: "test_bug";
+                app_bug: "app_bug";
+                flake: "flake";
+                config_error: "config_error";
+                llm_error: "llm_error";
+            }>;
+            producer: z.ZodString;
+        }, z.core.$strict>>;
+        isRerun: z.ZodOptional<z.ZodLiteral<true>>;
+        disposition: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"quarantined">;
+            class: z.ZodEnum<{
+                environment: "environment";
+                timeout: "timeout";
+                flake: "flake";
+            }>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"applied">;
+            fix: z.ZodEnum<{
+                fact: "fact";
+                caution: "caution";
+                "procedure-hint": "procedure-hint";
+                "test-edit": "test-edit";
+            }>;
+            change: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"knowledge">;
+                changeId: z.ZodString;
+                recordIds: z.ZodArray<z.ZodString>;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"test-file">;
+                filePath: z.ZodString;
+                contentDigest: z.ZodString;
+            }, z.core.$strict>], "kind">;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"no-draftable-fix">;
+            checked: z.ZodObject<{
+                servedRecords: z.ZodNumber;
+                procedureReads: z.ZodNumber;
+                assertionDrift: z.ZodBoolean;
+                rootCause: z.ZodOptional<z.ZodEnum<{
+                    unknown: "unknown";
+                    environment: "environment";
+                    timeout: "timeout";
+                    test_bug: "test_bug";
+                    app_bug: "app_bug";
+                    flake: "flake";
+                    config_error: "config_error";
+                    llm_error: "llm_error";
+                }>>;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"confirmed-bug">;
+            confirmedRecords: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"not-applied">;
+            fix: z.ZodEnum<{
+                fact: "fact";
+                caution: "caution";
+                "procedure-hint": "procedure-hint";
+                "test-edit": "test-edit";
+            }>;
+            reason: z.ZodEnum<{
+                "policy-materialize-refused": "policy-materialize-refused";
+                "target-not-found": "target-not-found";
+                "outside-workspace": "outside-workspace";
+            }>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"drafted">;
+            fix: z.ZodEnum<{
+                fact: "fact";
+                caution: "caution";
+                "procedure-hint": "procedure-hint";
+                "test-edit": "test-edit";
+            }>;
+            proposalId: z.ZodString;
+            proposalKind: z.ZodEnum<{
+                knowledge: "knowledge";
+                "test-draft": "test-draft";
+            }>;
+        }, z.core.$strict>], "kind">;
+        gold: z.ZodArray<z.ZodObject<{
+            cassetteId: z.ZodString;
+            sourceCassetteId: z.ZodString;
+            channel: z.ZodEnum<{
+                "user-mark": "user-mark";
+                "overturned-verdict": "overturned-verdict";
+            }>;
+        }, z.core.$strict>>;
+        evidence: z.ZodObject<{
+            confirmed: z.ZodNumber;
+            overturned: z.ZodNumber;
+        }, z.core.$strict>;
+        supersedes: z.ZodOptional<z.ZodString>;
+        runId: z.ZodType<_vostride_agent_qa_schema.RunId, unknown, z.core.$ZodTypeInternals<_vostride_agent_qa_schema.RunId, unknown>>;
+        testIndex: z.ZodNumber;
+        testId: z.ZodOptional<z.ZodString>;
+        stepIndex: z.ZodOptional<z.ZodNumber>;
+        schemaVersion: z.ZodLiteral<2>;
+        markId: z.ZodString;
+    }, z.core.$strict>;
+    stage: z.ZodEnum<{
+        prepared: "prepared";
+        evidence: "evidence";
+        applied: "applied";
+    }>;
+    operationId: z.ZodUUID;
+    plan: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        fix: z.ZodEnum<{
+            fact: "fact";
+            caution: "caution";
+            "procedure-hint": "procedure-hint";
+        }>;
+        target: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            grain: z.ZodLiteral<"record">;
+            recordId: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            grain: z.ZodLiteral<"bundle">;
+            shortId: z.ZodString;
+        }, z.core.$strict>], "grain">;
+        deltas: z.ZodArray<z.ZodType<_vostride_agent_qa_schema.Delta, unknown, z.core.$ZodTypeInternals<_vostride_agent_qa_schema.Delta, unknown>>>;
+        wording: z.ZodEnum<{
+            floor: "floor";
+            model: "model";
+        }>;
+        schemaVersion: z.ZodLiteral<2>;
+        markId: z.ZodString;
+        feedbackSource: z.ZodObject<{
+            runId: z.ZodType<_vostride_agent_qa_schema.RunId, unknown, z.core.$ZodTypeInternals<_vostride_agent_qa_schema.RunId, unknown>>;
+            testIndex: z.ZodNumber;
+            testId: z.ZodOptional<z.ZodString>;
+            stepIndex: z.ZodOptional<z.ZodNumber>;
+            kind: z.ZodEnum<{
+                "false-fail": "false-fail";
+                "false-pass": "false-pass";
+                "confirmed-bug": "confirmed-bug";
+            }>;
+        }, z.core.$strict>;
+        runTraceRef: z.ZodObject<{
+            runId: z.ZodType<_vostride_agent_qa_schema.RunId, unknown, z.core.$ZodTypeInternals<_vostride_agent_qa_schema.RunId, unknown>>;
+            runSlug: z.ZodString;
+        }, z.core.$strict>;
+        kind: z.ZodLiteral<"knowledge">;
+    }, z.core.$strict>, z.ZodObject<{
+        fix: z.ZodLiteral<"test-edit">;
+        testRef: z.ZodString;
+        intent: z.ZodString;
+        wording: z.ZodEnum<{
+            floor: "floor";
+            model: "model";
+        }>;
+        schemaVersion: z.ZodLiteral<2>;
+        markId: z.ZodString;
+        feedbackSource: z.ZodObject<{
+            runId: z.ZodType<_vostride_agent_qa_schema.RunId, unknown, z.core.$ZodTypeInternals<_vostride_agent_qa_schema.RunId, unknown>>;
+            testIndex: z.ZodNumber;
+            testId: z.ZodOptional<z.ZodString>;
+            stepIndex: z.ZodOptional<z.ZodNumber>;
+            kind: z.ZodEnum<{
+                "false-fail": "false-fail";
+                "false-pass": "false-pass";
+                "confirmed-bug": "confirmed-bug";
+            }>;
+        }, z.core.$strict>;
+        runTraceRef: z.ZodObject<{
+            runId: z.ZodType<_vostride_agent_qa_schema.RunId, unknown, z.core.$ZodTypeInternals<_vostride_agent_qa_schema.RunId, unknown>>;
+            runSlug: z.ZodString;
+        }, z.core.$strict>;
+        kind: z.ZodLiteral<"test-edit">;
+    }, z.core.$strict>, z.ZodObject<{
+        checked: z.ZodObject<{
+            servedRecords: z.ZodNumber;
+            procedureReads: z.ZodNumber;
+            assertionDrift: z.ZodBoolean;
+            rootCause: z.ZodOptional<z.ZodEnum<{
+                unknown: "unknown";
+                environment: "environment";
+                timeout: "timeout";
+                test_bug: "test_bug";
+                app_bug: "app_bug";
+                flake: "flake";
+                config_error: "config_error";
+                llm_error: "llm_error";
+            }>>;
+        }, z.core.$strict>;
+        schemaVersion: z.ZodLiteral<2>;
+        markId: z.ZodString;
+        feedbackSource: z.ZodObject<{
+            runId: z.ZodType<_vostride_agent_qa_schema.RunId, unknown, z.core.$ZodTypeInternals<_vostride_agent_qa_schema.RunId, unknown>>;
+            testIndex: z.ZodNumber;
+            testId: z.ZodOptional<z.ZodString>;
+            stepIndex: z.ZodOptional<z.ZodNumber>;
+            kind: z.ZodEnum<{
+                "false-fail": "false-fail";
+                "false-pass": "false-pass";
+                "confirmed-bug": "confirmed-bug";
+            }>;
+        }, z.core.$strict>;
+        runTraceRef: z.ZodObject<{
+            runId: z.ZodType<_vostride_agent_qa_schema.RunId, unknown, z.core.$ZodTypeInternals<_vostride_agent_qa_schema.RunId, unknown>>;
+            runSlug: z.ZodString;
+        }, z.core.$strict>;
+        kind: z.ZodLiteral<"no-draftable-fix">;
+    }, z.core.$strict>], "kind">>;
+}, z.core.$strict>;
+type MarkIntent = z.infer<typeof intentSchema>;
+declare class MarkLedgerBusyError extends Error {
+    constructor();
+}
+declare class MarkLedgerCorruptError extends Error {
+    readonly line: number;
+    constructor(line: number);
+}
+/**
+ * 2026-10-03 (quick 261003-lgd, Phase 432 review IN-23): the run's unfinished-mark record cannot be
+ * resumed, refused by the record's own name. It used to surface as `MarkLedgerCorruptError` at the
+ * NEXT ordinal, a line `marks.jsonl` does not have. D-02: nothing is migrated or read further; the
+ * message names the file to remove, after which the run can be marked again.
+ */
+declare class MarkIntentUnusableError extends Error {
+    readonly intentPath: string;
+    readonly reason: 'earlier-version' | 'unreadable' | 'mismatched';
+    constructor(intentPath: string, reason: 'earlier-version' | 'unreadable' | 'mismatched');
+}
+/** The one latest-per-address rule, over receipts a caller has already read once. */
+declare function latestMarkReceiptsPerAddress(receipts: readonly MarkReceipt[]): MarkReceipt[];
+declare function latestMarkReceiptFor(receipts: readonly MarkReceipt[], runId: string, address: MarkAddress): MarkReceipt | undefined;
+declare class MarkLedgerNoRunError extends Error {
+    constructor();
+}
+/** Gate-side runtime ledger. The proposer reader entry never exports this store. */
+declare class FsMarkLedger {
+    private readonly dir;
+    private readonly file;
+    private readonly lock;
+    private readonly runId;
+    private readonly runSlug;
+    private inTransaction;
+    private intentValue;
+    constructor(config: {
+        root: string;
+        runId: string;
+    });
+    read(): MarkReceipt[];
+    latestPerAddress(): MarkReceipt[];
+    latestFor(address: MarkAddress): MarkReceipt | undefined;
+    /** Private resumable state is admitted only while this run's existing lock is held. */
+    prepareIntent(mark: MarkReceipt, operationId: string): MarkIntent;
+    checkpointIntent(value: MarkIntent): MarkIntent;
+    transact(fn: (nextOrdinal: number) => Promise<Omit<MarkReceipt, 'ordinal'> | undefined>): Promise<MarkReceipt | undefined>;
+    append(record: Omit<MarkReceipt, 'ordinal'>): Promise<MarkReceipt | undefined>;
+}
+
+interface FsHandoffSourceConfig {
+    /** Runtime root (for example, the workdir's `.agent-qa` directory). */
+    root: string;
+    /** The run to load; runner-local sanitizes it before path use. */
+    runId: string;
+}
+declare class FsHandoffSource implements HandoffSource {
+    private readonly file;
+    constructor(config: FsHandoffSourceConfig);
+    load(): CompletedRunHandoff;
+}
+
+declare const absentArtifactSource: ArtifactSource;
+interface DirArtifactSourceConfig {
+    /** Directory containing one file per lowercase 64-hex content sha. */
+    dir: string;
+}
+declare class DirArtifactSource implements ArtifactSource {
+    private readonly dir;
+    constructor(config: DirArtifactSourceConfig);
+    getBlob(sha: string): Uint8Array | undefined;
+}
+interface FsRunArtifactSourceConfig {
+    /** Runtime root the production run store persisted under (e.g. `.agent-qa`). */
+    root: string;
+    /** The run whose sha-keyed screenshot blobs this source reads. */
+    runId: string;
+}
+declare class FsRunArtifactSource implements ArtifactSource {
+    private readonly store;
+    constructor(config: FsRunArtifactSourceConfig);
+    getBlob(sha: string): Uint8Array | undefined;
+}
+
+declare const CASSETTE_FILE = "cassette.json";
+declare const BLOBS_SUBDIR = "blobs";
+declare const DEFAULT_EVAL_CASSETTES_SUBDIR = "eval/cassettes";
+interface FsCassetteStoreConfig {
+    /** Runtime root (normally the workdir's `.agent-qa` directory). */
+    root: string;
+    /** Optional retargeted root used by later committed-corpus composition. */
+    outputDir?: string;
+}
+interface WrittenCassette {
+    id: string;
+    dir: string;
+    writtenBlobShas: string[];
+    corruptBlobShas: string[];
+}
+declare class FsCassetteStore {
+    private readonly outputRoot;
+    constructor(config: FsCassetteStoreConfig);
+    write(extracted: ExtractedCassette): WrittenCassette;
+}
+
+/** The discriminated bundle-load outcome: a guarded cassette + its blob source, or a typed refusal. */
+type CassetteBundleLoad = {
+    kind: 'loaded';
+    cassette: Cassette;
+    artifacts: ArtifactSource;
+} | {
+    kind: 'refused';
+    refusal: ReplayRefusal;
+};
+/**
+ * Load a cassette bundle directory into a guarded Cassette + DirArtifactSource over its blobs.
+ * Never throws for a malformed bundle — read/parse failures map to a 'parse-failed' refusal and
+ * guard rejections (version or structural) map to 'guard-failed', each carrying the underlying
+ * message in `detail` (D-08).
+ */
+declare function loadCassetteBundle(bundleDir: string): CassetteBundleLoad;
+
+declare const SCORE_FILE = "score.json";
+/** The persisted per-cassette score document — computed entirely in eval core (F9). */
+interface ScoreRecord {
+    cassetteId: string;
+    /** The matcher constitution that minted the score (attribution stamp). */
+    matcherVersion: number;
+    score: CassetteScore;
+    diffs: readonly DecisionDiff[];
+    /**
+     * D-16 score-side reproducibility receipt: the full identity of the judge that produced any
+     * stamp on this score — judge model id, resolved family, judgeVersion, threshold. Computed
+     * entirely by eval-core adjudication and serialized verbatim here (F9: eval-local never
+     * computes, only writes). Typed-absent when no judge walk ran, keeping 369 records
+     * byte-compatible. The cassette's reserved tier4JudgeId is Phase 371 label territory —
+     * the scorer never writes back into the measurement.
+     */
+    judge?: JudgeIdentityBlock;
+    scoringContext?: ScoringContext;
+}
+interface FsScoreStoreConfig {
+    /** Runtime root (normally the workdir's `.agent-qa` directory). */
+    root: string;
+    /** Optional retargeted root used by later committed-corpus composition. */
+    outputDir?: string;
+}
+interface WrittenScoreRecord {
+    cassetteId: string;
+    dir: string;
+    file: string;
+}
+declare class FsScoreStore {
+    private readonly outputRoot;
+    constructor(config: FsScoreStoreConfig);
+    save(record: ScoreRecord): WrittenScoreRecord;
+}
+
+/** The discriminated replay-record read outcome: a persisted outcome, or a typed refusal. */
+type ReplayRecordLoad = {
+    kind: 'loaded';
+    outcome: ReplayCassetteOutcome;
+} | {
+    kind: 'refused';
+    refusal: ReplayRefusal;
+};
+/** The score read outcome: a persisted record, typed absence (never scored), or a typed refusal. */
+type ScoreRecordLoad = {
+    kind: 'loaded';
+    record: ScoreRecord;
+} | {
+    kind: 'absent';
+} | {
+    kind: 'refused';
+    refusal: ReplayRefusal;
+};
+/**
+ * Read a persisted ReplayCassetteOutcome back from `<dir>/replay.json`. A replay dir without its
+ * marker file is corrupt, not empty — a missing or unreadable file refuses like a parse failure.
+ * Never throws; the store serialized the outcome verbatim so the parsed document is it.
+ */
+declare function loadReplayRecord(dir: string): ReplayRecordLoad;
+/**
+ * Read a persisted ScoreRecord back from `<dir>/score.json`. Absence is typed and legitimate
+ * (refusal outcomes are never scored); an existing-but-unreadable/unparseable file refuses.
+ * Never throws.
+ */
+declare function loadScoreRecord(dir: string): ScoreRecordLoad;
+/** Enumerate every staged replay-record dir (contains replay.json) under the replays root, sorted. */
+declare function listReplayRecordDirs(replaysRoot: string): string[];
+/** Enumerate every staged cassette-bundle dir (contains cassette.json) under the cassettes root, sorted. */
+declare function listCassetteBundleDirs(cassettesRoot: string): string[];
+
+declare const DEFAULT_EVAL_REPLAYS_SUBDIR = "eval/replays";
+declare const REPLAY_RECORD_FILE = "replay.json";
+interface FsReplayRecordStoreConfig {
+    /** Runtime root (normally the workdir's `.agent-qa` directory). */
+    root: string;
+    /** Optional retargeted root used by later committed-corpus composition. */
+    outputDir?: string;
+    /** Actual producer seed; embedded in the bytes bound by the run publication. */
+    executionSeed?: number;
+}
+interface WrittenReplayRecord {
+    cassetteId: string;
+    dir: string;
+    file: string;
+}
+declare class FsReplayRecordStore {
+    private readonly outputRoot;
+    private readonly executionSeed?;
+    constructor(config: FsReplayRecordStoreConfig);
+    save(outcome: ReplayCassetteOutcome): WrittenReplayRecord;
+}
+
+type JudgeDeclaration = Omit<JudgeBindingInput, 'mask'>;
+interface RunCassetteReplayInput {
+    /** A loaded, guarded cassette (leaf or procedure) — normally from loadCassetteBundle. */
+    cassette: Cassette;
+    /** Authoritative score metadata; never included in replayCassette's planner inputs. */
+    labelRecord?: StandaloneLabelRecord;
+    /** 417 D-01 / 415 D-05: already applied by the caller; the engine reverses it only before hashing. */
+    declaredBriefDelta?: DeclaredBriefDelta;
+    /** Blob source for full-capture screenshot reconstruction (normally a DirArtifactSource). */
+    artifacts: ArtifactSource;
+    /** The currently-configured model profile — the SOLE source of model selection (D-03). */
+    profile: ModelProfile;
+    /** Resolved provider auth for the configured model. */
+    auth: ResolvedModelAuth;
+    /** Optional provider overrides — the captured-boundary stub seam for tests (createModel passthrough). */
+    modelOverrides?: ModelProviderOverrides;
+    /** Whole-run counter shared by planner and judge, including provider retries. */
+    modelCallObservation?: ModelCallObservation;
+    /** Optional deterministic timing port for repeatable measurement fixtures. */
+    clock?: ReplayClock;
+    /** Sample budget (D-10). Defaults to the engine's k=1. */
+    k?: number;
+    /** Optional replay seed applied through the 366 sampling seam when the provider supports it. */
+    seed?: number;
+    /** k-sample escalation seam (D-10). Defaults to the imported neverEscalate — never re-minted. */
+    escalationPredicate?: ReplayEscalationPredicate;
+    /** Optional persistence: when supplied, the outcome is saved after the replay returns (D-12). */
+    recordStore?: FsReplayRecordStore;
+    /**
+     * Optional D-13 score persistence: when supplied and the outcome is a ReplayResult (refusals are
+     * never scored — reports count them instead), the score + per-decision diffs are computed in
+     * eval core and saved AFTER recordStore.save (record-then-score ordering, OQ-2).
+     */
+    scoreStore?: FsScoreStore;
+    /**
+     * Optional D-06 tier-4 judge bag: an EXPLICIT second ModelProfile plus its auth and stub seam
+     * (372's CLI surfaces it as config). No auto-pick from configured models, no fallback scanning —
+     * absence is a first-class configuration, in which case every unresolved tie is stamped
+     * not-invoked{no-judge-configured} whenever the score leg runs (D-05/D-10).
+     * allowSameFamily (owner override of D-10, 2026-07-12): explicit default-off opt-in threaded
+     * verbatim into assessJudgeEligibility — it lifts ONLY known-same-family refusal and stamps
+     * the D-16 identity block with familyOverride; unknown families stay forbidden.
+     */
+    judge?: (JudgeDeclaration & {
+        allowSameFamily?: boolean;
+    }) | {
+        members: readonly JudgeDeclaration[];
+        allowSameFamily?: boolean;
+    };
+    mask: MaskFn;
+}
+/** Persist the declared identity, including a refused panel; singletons retain old bytes. */
+declare function replayJudgeRequest(judge: RunCassetteReplayInput['judge']): ScoringJudgeRequest;
+/**
+ * Name the resolved temperature-zero replay profile without auth resolution or model creation.
+ * D-11: keep these inputs aligned with the single createModel site below. Override names are
+ * the injected provider identities; seed values and provider disclosures never enter the key.
+ */
+declare function computeReplayProfileFingerprintFor(input: {
+    profile: ModelProfile;
+    seedPolicy: SeedPolicy;
+    modelOverrides?: ModelProviderOverrides;
+}): string;
+/**
+ * Run one loaded cassette through the pure replay engine bound to the production planner/model/
+ * safety stack, optionally persisting the typed outcome. The one sanctioned model+runner
+ * composition in eval-local (D-04).
+ */
+declare function runCassetteReplay(input: RunCassetteReplayInput): Promise<ReplayCassetteOutcome>;
+
+declare function listBaselineRunRoots(agentQaRoot: string, profileKey: string): {
+    root: string;
+    kind: 'gate' | 'floor';
+    seed?: number;
+}[];
+type BaselineCacheRow = {
+    cassetteId: string;
+    kind: 'cached';
+    root: string;
+    replay: ReplayCassetteOutcome;
+    score: ScoreRecord;
+    seed: number;
+    seedSource: string;
+    seedHonored: boolean;
+} | {
+    cassetteId: string;
+    kind: 'refused';
+    root: string;
+    reason: string;
+} | {
+    cassetteId: string;
+    kind: 'uncached';
+    reason: string;
+};
+interface BaselineCacheResolution {
+    rows: BaselineCacheRow[];
+    roots: string[];
+}
+declare function resolveBaselineCache(input: {
+    agentQaRoot: string;
+    profileKey: string;
+    fingerprint: string;
+    matcherVersion: number;
+    plannerModelId: string;
+    judgeIdentity?: {
+        judgeModelId: string;
+        judgeVersion: number;
+    };
+    gateRootSeed: number;
+    gateRootSeedSource: string;
+    cassettes: readonly {
+        id: string;
+        promptInputHash: string;
+    }[];
+}): BaselineCacheResolution;
+
+/** Gate-side effective view; raw committed history and the proposer reader remain unchanged. */
+declare function readActiveCommittedCorpus(committedRoot: string, agentQaRoot: string, calibrationRead?: LabelCalibrationRead): CommittedCorpusRead;
+/** One unreadable or unadmittable committed file, attributable by path (D-08). */
+interface CommittedReadRefusal {
+    path: string;
+    reason: string;
+}
+/** The loaded committed root: eval core's snapshot plus everything the read learned about it. */
+interface CommittedCorpusRead {
+    /** Guarded ownership including scoring-excluded history, for incurred-cost reports. */
+    corpusEntriesById?: ReadonlyMap<string, CorpusEntry>;
+    calibration?: EvalBatchReport['calibration'];
+    retiredMarkedCassetteIds?: ReadonlySet<string>;
+    snapshot: CommittedCorpusSnapshot;
+    productsSeen: readonly string[];
+    notices: string[];
+    refusals: readonly CommittedReadRefusal[];
+    /**
+     * How many committed files declared each schemaVersion, keyed by the declared version as a
+     * string. An absent version key means zero files declared it.
+     */
+    schemaVersionsSeen: Record<string, number>;
+}
+/** Every committed partition manifest under contracts/, and what the read refused (D-05). */
+interface PartitionManifestRead {
+    manifests: readonly PartitionManifest[];
+    notices: string[];
+    refusals: readonly CommittedReadRefusal[];
+}
+/** Every committed run-exclusion record under exclusions/, and what the read refused (D-02). */
+interface RunExclusionRead {
+    exclusions: readonly RunExclusionRecord[];
+    refusals: readonly CommittedReadRefusal[];
+}
+/** One committed batch report keyed by its own dir name. */
+interface CommittedReportEntry {
+    batchKey: string;
+    report: EvalBatchReport;
+    path: string;
+}
+/** One committed per-profile baseline designation (D-19). */
+interface BaselinePointerEntry {
+    schemaVersion: typeof BASELINE_POINTER_SCHEMA_VERSION;
+    profileKey: string;
+    batchKey: string;
+    fingerprint: string;
+    corpusDigest: string;
+    path: string;
+}
+interface NoiseFloorArtefactEntry {
+    profileKey: string;
+    artefact: NoiseFloorArtefact;
+    path: string;
+}
+type CommittedDecisionVectorsLoad = {
+    kind: 'loaded';
+    document: DecisionVectorsDocument;
+    path: string;
+} | {
+    kind: 'absent';
+    path: string;
+} | {
+    kind: 'refused';
+    refusal: CommittedReadRefusal;
+};
+type ResolveMinimumGateSetOutcome = {
+    kind: 'resolved';
+    minimumGateSet: number;
+    path: string;
+} | {
+    kind: 'no-floor';
+} | {
+    kind: 'no-value';
+    path: string;
+};
+/** Read only the per-profile files; the former literal reports/noise-floor.json is invalid. */
+declare function listNoiseFloorArtefacts(committedRoot: string): {
+    artefacts: NoiseFloorArtefactEntry[];
+    refusals: CommittedReadRefusal[];
+};
+declare function readCommittedDecisionVectors(committedRoot: string, batchKey: string): CommittedDecisionVectorsLoad;
+/** 414 D-15 → 417 handoff: resolve the measured integer without changing the pure posture port. */
+declare function resolveMinimumGateSet(input: {
+    committedRoot: string;
+    profileKey: string;
+}): ResolveMinimumGateSetOutcome;
+/**
+ * Load the committed root at `committedRoot` into the snapshot eval core's `deriveCensus` folds.
+ * Never throws for content: every parse or guard failure lands in `refusals`, and a missing root
+ * yields an empty snapshot with a notice naming it.
+ */
+declare function readCommittedCorpus(committedRoot: string, calibrationRead?: LabelCalibrationRead): CommittedCorpusRead;
+/**
+ * Load every committed partition manifest under `contracts/` (414 D-05).
+ *
+ * Manifests are found by file-name prefix, not by parsing every contract: the dir also holds the
+ * D-04 matcher and judge constitution projections, and asking the manifest guard about those would
+ * manufacture refusals for documents that are not manifests. An absent `contracts/` is an empty
+ * list with no refusal — a root that has never been partitioned is a legitimate root.
+ */
+declare function readPartitionManifests(committedRoot: string): PartitionManifestRead;
+/**
+ * Load every committed run-exclusion record under `exclusions/<product>/` (414 D-02).
+ *
+ * Same posture as the corpus walk: a committed root is hand-editable, so an unparseable or
+ * unadmittable record is a refusal row naming its path, never a throw. An absent `exclusions/`
+ * dir is an empty list with no refusal — a root with nothing excluded is the common case.
+ */
+declare function readRunExclusions(committedRoot: string): RunExclusionRead;
+/**
+ * List every committed batch report under `reports/`, one per batchKey dir. The reserved `census/`
+ * and `baselines/`, `noise-floor/`, `judge-calibration/` dirs are not batch reports.
+ */
+declare function listCommittedReports(committedRoot: string): {
+    reports: CommittedReportEntry[];
+    refusals: CommittedReadRefusal[];
+};
+/** List every committed per-profile baseline pointer under `reports/baselines/`, sorted (D-19). */
+declare function listBaselinePointers(committedRoot: string): {
+    pointers: BaselinePointerEntry[];
+    refusals: CommittedReadRefusal[];
+};
+
+declare const GATE1_AUDIT_SUBDIR = "eval/gate1";
+/** A slug locates storage; only the loaded run/step/test establishes target identity. */
+declare function locateTargetCassettes(input: {
+    committedRoot: string;
+    agentQaRoot: string;
+    gate1Dir: string;
+    corpusEntries: readonly CorpusEntry[];
+    target: NonNullable<CandidateInjection['target']>;
+    /** 418 D-02: a live ablation must not substitute a committed/corrected gold record. */
+    source?: 'handoff';
+}): Promise<{
+    kind: 'committed' | 'extracted';
+    cassettes: LeafBundle[];
+    detail: TargetLocationDetail;
+} | {
+    kind: 'unavailable';
+    detail: TargetLocationDetail;
+}>;
+interface TargetLocationDetail {
+    runId: string;
+    stepIndex: number;
+    corpusEntriesForRun: number;
+    handoffPresent: boolean;
+    reason?: string;
+}
+/** The CLI's JSON output uses the same schema-validated DTO as persisted receipts. */
+declare function serializeReplayGateReceipt(receipt: unknown): string;
+type Planner = {
+    profile: ModelProfile;
+    modelOverrides?: ModelProviderOverrides;
+    resolveAuth: () => Promise<ResolvedModelAuth>;
+};
+interface RunReplayGateInput {
+    injection: CandidateInjection;
+    committedRoot: string;
+    agentQaRoot: string;
+    identity: {
+        plannerModelId: string;
+        matcherVersion: number;
+        judgeModelId?: string;
+        judgeVersion?: number;
+        judgeMemberModelIds?: readonly string[];
+        fingerprint: string;
+        profileKey: string;
+    };
+    planner: Planner;
+    judge?: Planner;
+    /** Complete explicit lazy declaration; Gate 1 evaluates the raw members as a unit. */
+    judgeMembers?: readonly Planner[];
+    judgeOverrideConfigured: boolean;
+    k: number;
+    kSource: Gate1KSource;
+    maxScreens: number;
+    baselineSeed: {
+        seed?: number;
+        source: 'flag' | 'config';
+    } | {
+        floorSeeds: readonly number[];
+    };
+    /** Effective CLI selection for a copyable, spend-bearing cache recovery command. */
+    baselineWarmup?: {
+        configPath: string;
+        judge?: string;
+        judges?: readonly string[];
+    };
+    mask: RunCassetteReplayInput['mask'];
+    producedBy: {
+        opId: string;
+    };
+    clock?: () => number;
+    onProgress?: (line: string) => void;
+}
+type RunReplayGateResult = {
+    kind: 'receipt';
+    receipt: Gate1Receipt;
+    lines: string[];
+    notices: string[];
+    refusals: readonly CommittedReadRefusal[];
+    modelCalls: number;
+    wallClockMs: number;
+} | {
+    kind: 'refused';
+    refusal: CommittedReadRefusal;
+    notices: string[];
+};
+type LeafBundle = {
+    cassette: LeafCassette;
+    artifacts: ArtifactSource;
+};
+type ReplayBag = Pick<RunCassetteReplayInput, 'profile' | 'auth' | 'modelOverrides' | 'judge' | 'mask' | 'modelCallObservation' | 'clock'>;
+interface RemovalFlipsOutcomeInput {
+    recordId: string;
+    cassettes: readonly (LeafBundle & {
+        labelRecord?: StandaloneLabelRecord;
+        existing?: {
+            withRecord: ReplaySample;
+            withoutRecord: ReplaySample;
+        };
+        baseSeed?: number;
+        seedHonored?: boolean;
+    })[];
+    mode: {
+        kind: 'injected';
+        injection: CandidateInjection;
+    } | {
+        kind: 'active-record';
+        servedCanary?: true;
+    };
+    k: number;
+    baseSeed: number;
+    existing?: {
+        withRecord: ReplaySample;
+        withoutRecord: ReplaySample;
+    };
+    replay: ReplayBag;
+    gate1Dir: string;
+    /**
+     * 2026-09-11, 422 D-18: the ONE way an ORDINARY candidate — served on channel 1 without a
+     * canary flag — becomes ablatable. Deliberately a sibling of `mode`, not a third mode arm:
+     * the served-canary rule above is an opt-in FLAG, and this is positive PROOF. Absent, the
+     * arbiter removes nothing that the active and served-canary rules did not already admit.
+     */
+    failingPathCandidate?: FailingPathCandidateAuthorization;
+}
+interface RemovalFlipsOutcomeResult {
+    crossCheck: Exclude<CrossCheck, 'not-run'>;
+    perTarget: {
+        cassetteId: string;
+        crossCheck: Exclude<CrossCheck, 'not-run'>;
+    }[];
+    seeds: number[];
+    seedHonored: boolean;
+    detail: NonNullable<Gate1Receipt['samples']['detail']>;
+    modelCalls: number;
+    screens: number;
+    promptTokens: number;
+    completionTokens: number;
+    notices: string[];
+}
+/**
+ * 2026-09-11, 422 D-18: the arbiter's authorization to ablate an ORDINARY candidate.
+ *
+ * Ordinary candidate memory is the user's, and this is the one path in the phase that deletes
+ * it from a replayed input. So the authorization carries the run's OWN recorded bytes and
+ * DECLARES nothing that code can recompute: which step failed is re-derived with the single
+ * exported `failingStepOf` rule, and whether the record was on that step's path is re-read
+ * from that step's own served brief with `deriveMemoryOnPathSites`. A caller can therefore
+ * name a record and hand over evidence, but it cannot assert either fact.
+ */
+interface FailingPathCandidateAuthorization {
+    /** The record to ablate. Must be the record `removalFlipsOutcome` was asked to remove. */
+    readonly recordId: string;
+    /** The run that recorded {@link perTest}. Must be the target cassette's own run. */
+    readonly runId: string;
+    /** The run's own recorded member outcome — the source of the two recomputed facts above. */
+    readonly perTest: PerTestOutcome;
+}
+/**
+ * Three outcomes, never two. `absent` (no authorization was offered) and `refused` (one was,
+ * and it did not establish the removal) both leave memory intact, but they are different
+ * facts about the caller and the gate reports them apart.
+ */
+type FailingPathCandidateAdmission = {
+    kind: 'authorized';
+    stepIndex: number;
+} | {
+    kind: 'absent';
+} | {
+    kind: 'refused';
+    reason: string;
+};
+/**
+ * Evaluate a D-18 authorization against the decision it claims to authorize. Every refusal
+ * names its own cause, because "removed nothing" for six different reasons is one fact a
+ * reader cannot act on.
+ */
+declare function resolveFailingPathCandidate(input: {
+    cassette: LeafCassette;
+    recordId: string;
+    authorization?: FailingPathCandidateAuthorization;
+}): FailingPathCandidateAdmission;
+/** Existing samples count as sample one; every additional sample gets a distinct derived seed. */
+declare function removalFlipsOutcome(input: RemovalFlipsOutcomeInput): Promise<RemovalFlipsOutcomeResult>;
+declare function runReplayGate(input: RunReplayGateInput): Promise<RunReplayGateResult>;
+
+declare const GATE2_AUDIT_SUBDIR = "eval/gate2";
+declare const GATE2_TARGET_SUBDIR = "target";
+declare const FEEDBACK_STAGING_SUBDIR = "eval/feedback";
+declare const feedbackSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<2>;
+    product: z.ZodString;
+    stateDigest: z.ZodString;
+    attributedObservationId: z.ZodString;
+    benefit: z.ZodEnum<{
+        "exercised-benefited": "exercised-benefited";
+        "rode-along": "rode-along";
+        "exercised-harmed": "exercised-harmed";
+    }>;
+    candidateId: z.ZodString;
+    runId: z.ZodString;
+    testId: z.ZodString;
+    stepIndex: z.ZodNumber;
+    stagedAt: z.ZodISODateTime;
+}, z.core.$strict>;
+type FeedbackMetadata = z.infer<typeof feedbackSchema>;
+interface StagedFeedbackEntry extends FeedbackMetadata {
+    dir: string;
+    extracted: ExtractedCassette & {
+        cassette: LeafCassette;
+    };
+}
+interface FeedbackStateInput {
+    agentQaRoot: string;
+    committedRoot: string;
+    product: string;
+    stateDigest: string;
+}
+interface StageFeedbackEntryInput extends FeedbackStateInput {
+    target: {
+        runId: string;
+        testId: string;
+        stepIndex: number;
+    };
+    attributedObservationId: string;
+    benefit: Benefit;
+    candidateId: string;
+    /** 441 GAP3-D1: required. The staged cassette is extracted from the masked run. */
+    mask: MaskFn;
+}
+type StageFeedbackEntryResult = {
+    kind: 'staged';
+    dir: string;
+} | {
+    kind: 'already-staged' | 'not-novel';
+} | {
+    kind: 'target-unavailable' | 'write-conflict';
+};
+declare function isNovelState(input: FeedbackStateInput): boolean;
+declare function stageFeedbackEntry(input: StageFeedbackEntryInput): Promise<StageFeedbackEntryResult>;
+declare function listStagedFeedback(input: {
+    agentQaRoot: string;
+    product?: string;
+}): StagedFeedbackEntry[];
+interface AdmitStagedFeedbackResult {
+    entries: StagedFeedbackEntry[];
+    admitted: StagedFeedbackEntry[];
+    refusals: (SeedingRefusal & {
+        product: string;
+        runId: string;
+    })[];
+    previousCorpusDigest: string;
+    nextCorpusDigest?: string;
+    writesStarted: boolean;
+    failures: {
+        phase: 'write' | 'cleanup' | 'final-digest';
+        reason: 'seeding-unavailable' | 'staging-cleanup-failed' | 'corpus-unavailable';
+        cassetteId?: string;
+        product?: string;
+        runId?: string;
+    }[];
+}
+declare function admitStagedFeedback(input: {
+    agentQaRoot: string;
+    committedRoot: string;
+    product?: string;
+    dryRun: boolean;
+    /** 441 GAP3-D1: required. A staged case still holding a declared value is refused by the writer. */
+    mask: MaskFn;
+}): Promise<AdmitStagedFeedbackResult>;
+interface AblateCanaryStepInput {
+    agentQaRoot: string;
+    committedRoot: string;
+    recordId: string;
+    target: {
+        runId: string;
+        testId: string;
+        stepIndex: number;
+    };
+    /** The gate-2 audit sub-tree this ablation writes under. Slugged before it becomes a path. */
+    attributedObservationId: string;
+    k: number;
+    baseSeed: number;
+    replay: ReplayBag;
+    /**
+     * 2026-09-12, 422 D-18: WHICH removal rule authorizes this ablation.
+     *
+     * ABSENT keeps 418's opt-in served-canary flag, which is what every canary caller means and
+     * what this function did unconditionally before — so no existing caller changes behaviour. The
+     * pre-analysis circularity arbiter passes a D-18 authorization INSTEAD, because its subject is
+     * an ORDINARY candidate that was never flagged a canary, and `resolveFailingPathCandidate`
+     * recomputes the failing step, the served membership and the brief identity from the run's own
+     * bytes before admitting it. The two are a sibling pair rather than one switch: the canary flag
+     * is an opt-in and the authorization is positive proof.
+     */
+    admission?: {
+        servedCanary?: true;
+        failingPathCandidate?: FailingPathCandidateAuthorization;
+    };
+}
+type CommittedCorpusDigestRead = {
+    kind: 'digest';
+    corpusDigest: string;
+} | {
+    kind: 'unavailable';
+    reason: 'corpus-unreadable';
+    detail: string;
+};
+type AblateCanaryStepResult = {
+    kind: 'ablated';
+    crossCheck: CrossCheck;
+    corpusDigest: string;
+    k: number;
+    baseSeed: number;
+    seeds: number[];
+    seedHonored: boolean;
+    spend: {
+        modelCalls: number;
+        screens: number;
+        promptTokens: number;
+        completionTokens: number;
+    };
+    gate2Dir: string;
+    notices: string[];
+} | {
+    kind: 'unavailable';
+    reason: 'target-unavailable' | 'brief-line-not-found' | 'no-live-decision' | 'corpus-unreadable';
+    detail: string;
+};
+/** D-07: the same committed corpus definition the posture resolver cites, including negatives. */
+declare function readCommittedCorpusDigest(input: {
+    committedRoot: string;
+}): CommittedCorpusDigestRead;
+declare function ablateCanaryStep(input: AblateCanaryStepInput): Promise<AblateCanaryStepResult>;
+
+type LoadedCassetteBundle = Extract<CassetteBundleLoad, {
+    kind: 'loaded';
+}>;
+/** Enumerate every bundle once, retaining load refusals as batch counters. */
+declare function loadCassetteBundles(cassettesRoot: string): {
+    swept: number;
+    loaded: LoadedCassetteBundle[];
+    loadRefusals: Record<string, number>;
+};
+interface SweepCassetteReplaysInput {
+    /** Caller-selected order; whole-corpus callers sort by cassette id before sweeping. */
+    selected: readonly LoadedCassetteBundle[];
+    labelRecords?: ReadonlyMap<string, StandaloneLabelRecord>;
+    profile: ModelProfile;
+    auth: ResolvedModelAuth;
+    modelOverrides?: ModelProviderOverrides;
+    modelCallObservation?: RunCassetteReplayInput['modelCallObservation'];
+    clock?: RunCassetteReplayInput['clock'];
+    k?: number;
+    seed?: number;
+    judge?: RunCassetteReplayInput['judge'];
+    mask: RunCassetteReplayInput['mask'];
+    recordStore: FsReplayRecordStore;
+    scoreStore: FsScoreStore;
+    /** The explicit output root shared by the caller's record and score stores. */
+    replaysRoot: string;
+    onProgress?: (cassetteId: string) => void;
+}
+interface SweepCassetteReplaysResult {
+    replayed: number;
+    replayRefusals: Record<string, number>;
+    replayedDirs: string[];
+    /** Only invocations that returned and persisted this time, including typed refusals. */
+    recordedDirs: string[];
+    notices: string[];
+}
+/**
+ * Run the selected batch through the one sanctioned replay composition. Persistence roots
+ * come from the caller so repeat runs can retain independent records. Refusals and thrown
+ * harness errors remain data; one broken cassette never aborts the rest of the batch.
+ */
+declare function sweepCassetteReplays(input: SweepCassetteReplaysInput): Promise<SweepCassetteReplaysResult>;
+
+declare const DEFAULT_EVAL_REPORTS_SUBDIR = "eval/reports";
+interface FsReportStoreConfig {
+    /** Runtime root (normally the workdir's `.agent-qa` directory). */
+    root: string;
+    /** Optional retargeted root used by later committed-corpus composition. */
+    outputDir?: string;
+}
+interface WrittenReport {
+    batchKey: string;
+    file: string;
+    decisionsFile?: string;
+}
+type StagedReportLoad = {
+    kind: 'loaded';
+    report: EvalBatchReport;
+    decisions?: DecisionVectorsDocument;
+    file: string;
+    replayGeneration?: ReplayGeneration;
+} | {
+    kind: 'absent';
+    file: string;
+} | {
+    kind: 'refused';
+    file: string;
+    reason: string;
+};
+declare const replayGenerationSchema: z.ZodObject<{
+    seed: z.ZodNumber;
+    records: z.ZodArray<z.ZodObject<{
+        cassetteId: z.ZodString;
+        replayDigest: z.ZodString;
+        scoreDigest: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+type ReplayGeneration = z.infer<typeof replayGenerationSchema>;
+/** Probe exactly one directory; callers own the gate-root-first search order. */
+declare function loadStagedReport(root: string, batchKey: string, outputDir?: string): StagedReportLoad;
+declare class FsReportStore {
+    private readonly outputRoot;
+    constructor(config: FsReportStoreConfig);
+    save(report: EvalBatchReport, decisions?: DecisionVectorsDocument, replayGeneration?: ReplayGeneration): WrittenReport;
+}
+
+/**
+ * Resolve the product partition from the recorded served-brief scope. Procedures read their
+ * first decision record; a cassette with no decision maps to the typed 'default' partition.
+ */
+declare function cassetteProductPartition(cassette: Cassette): string;
+/**
+ * Assemble report inputs from the caller's replay root, joining labels and product partitions
+ * from cassette bundles. Scores and judge blocks come only from persisted records; every
+ * replay remains an entry, including a record that can only be read as a typed refusal.
+ */
+declare function assembleScoredBatch(input: {
+    replaysRoot: string;
+    cassettesRoot: string;
+    source: string;
+    /** Fresh-run callers supply only completed writes; absence retains the generic disk sweep. */
+    recordDirs?: readonly string[];
+    /** Committed-corpus ownership is authoritative; generic callers retain scope semantics. */
+    productByCassetteId?: ReadonlyMap<string, string>;
+    /** Latest committed mark generations only; historical bundles remain on disk. */
+    eligibleCassetteIds?: ReadonlySet<string>;
+    labelRecords?: ReadonlyMap<string, StandaloneLabelRecord>;
+    corpusEntriesById?: ReadonlyMap<string, CorpusEntry>;
+    excludedLabelIds?: ReadonlySet<string>;
+    calibration?: EvalBatchReport['calibration'];
+    expectedJudgeRequest?: ScoringJudgeRequest;
+}): {
+    entries: ScoredBatchEntry[];
+    judgeBlocks: JudgeIdentityBlock[];
+    partitionsById: Map<string, string>;
+    missingBundleCount: number;
+    notices: string[];
+    calibration?: EvalBatchReport['calibration'];
+};
+/** Attach disclosure only after the caller has compared persisted score identities. */
+declare function copyJudgeCalibrationToReport(report: EvalBatchReport, read?: JudgeCalibrationRead): void;
+/** Existing producer publication must bind the full profile to these exact saved inputs. */
+declare function readReportProfileProof(input: {
+    agentQaRoot: string;
+    replaysRoot: string;
+    report: EvalBatchReport;
+    entries: readonly ScoredBatchEntry[];
+    fingerprint: string;
+    corpusDigest: string;
+    seed?: number;
+}): {
+    runIdentity: NonNullable<EvalBatchReport['runIdentity']>;
+    replayGeneration: ReplayGeneration;
+} | undefined;
+
+interface WriteNoiseFloorArtefactInput {
+    artefact: NoiseFloorArtefact;
+    committedRoot: string;
+}
+type WriteNoiseFloorArtefactOutcome = {
+    kind: 'written' | 'unchanged';
+    path: string;
+} | {
+    kind: 'refused';
+    refusal: FloorRefusal;
+} | {
+    kind: 'write-conflict';
+    path: string;
+};
+declare function writeNoiseFloorArtefact(input: WriteNoiseFloorArtefactInput): WriteNoiseFloorArtefactOutcome;
+
+interface ReplayCorpusOnceInput {
+    committedRoot?: string;
+    selected: readonly LoadedCassetteBundle[];
+    /** Bundle-load refusals excluded from selected; never include returned replay refusals. */
+    loadRefusals?: Readonly<Partial<EvalBatchReport['honesty']['refusalCounts']>>;
+    cassettesRoot: string;
+    agentQaRoot: string;
+    runRoot: string;
+    profile: ModelProfile;
+    auth: ResolvedModelAuth;
+    modelOverrides?: ModelProviderOverrides;
+    judge?: RunCassetteReplayInput['judge'];
+    mask: RunCassetteReplayInput['mask'];
+    seed: number;
+    k?: number;
+    source: string;
+    /** Digest of the committed snapshot supplying this run, when the caller read one. */
+    corpusDigest?: string;
+    productByCassetteId?: ReadonlyMap<string, string>;
+    labelRecords?: ReadonlyMap<string, StandaloneLabelRecord>;
+    corpusEntriesById?: ReadonlyMap<string, CorpusEntry>;
+    excludedLabelIds?: ReadonlySet<string>;
+    calibration?: EvalBatchReport['calibration'];
+    clock?: () => number;
+    onProgress?: (cassetteId: string) => void;
+}
+interface RunNoiseFloorMeasurementInput {
+    committedRoot: string;
+    cassettesRoot: string;
+    agentQaRoot: string;
+    profile: ModelProfile;
+    auth?: ResolvedModelAuth;
+    /** Explicit read-only recovery from complete saved runs and the original cost log. */
+    fromMeasured?: string;
+    modelOverrides?: ModelProviderOverrides;
+    judge?: RunCassetteReplayInput['judge'];
+    mask: RunCassetteReplayInput['mask'];
+    profileKeyInputs: {
+        plannerModelId: string;
+        matcherVersion: number;
+        judgeModelId?: string;
+        judgeVersion?: number;
+    };
+    seeds: readonly number[];
+    repeats: number;
+    bootstrapSeed: number;
+    classifierRepeatability?: ClassifierRepeatability;
+    explanation?: string;
+    commit: boolean;
+    clock?: () => number;
+    onProgress?: (line: string) => void;
+}
+interface RunNoiseFloorMeasurementResult {
+    artefact: NoiseFloorArtefact;
+    profileKey: string;
+    fingerprint: string;
+    runRoots: readonly string[];
+    committed?: WriteNoiseFloorArtefactOutcome;
+    notices: string[];
+    refusals: readonly CommittedReadRefusal[];
+    /** Calls in this invocation, separate from the original observations retained in artefact.cost. */
+    recovery?: {
+        costLog: string;
+        modelCalls: 0;
+    };
+}
+declare class FloorProtocolError extends Error {
+    readonly code = "FLOOR_PROTOCOL_MINIMUM";
+    constructor();
+}
+/** Whole-corpus repetitions, then the pure floor fold and the existing write-once checkpoint. */
+declare function runNoiseFloorMeasurement(input: RunNoiseFloorMeasurementInput): Promise<RunNoiseFloorMeasurementResult>;
+interface ReplayCorpusOnceResult {
+    report: EvalBatchReport;
+    vectors: DecisionCorrectnessVector[];
+    replaysRoot: string;
+    reportFile: string;
+    decisionsFile: string;
+    sweep: SweepCassetteReplaysResult;
+    wallClockMs: number;
+    modelCalls: number;
+    notices: string[];
+}
+declare function replayCorpusOnce(input: ReplayCorpusOnceInput): Promise<ReplayCorpusOnceResult>;
+
+type ReleaseGateMode = {
+    kind: 'fresh';
+    profile: ModelProfile;
+    auth: ResolvedModelAuth;
+    modelOverrides?: ModelProviderOverrides;
+    judge?: RunCassetteReplayInput['judge'];
+    mask: RunCassetteReplayInput['mask'];
+    seed: number;
+    cassettesRoot: string;
+    onProgress?: (line: string) => void;
+} | {
+    kind: 'report';
+    batchKey: string;
+    /** Exactly one report directory; the CLI owns any search order. */
+    stagedOutputDir?: string;
+    profile: ModelProfile;
+    modelOverrides?: ModelProviderOverrides;
+};
+interface RunReleaseGateInput {
+    committedRoot: string;
+    agentQaRoot: string;
+    profileKeyInputs: {
+        plannerModelId: string;
+        matcherVersion: number;
+        judgeModelId?: string;
+        judgeVersion?: number;
+    };
+    mode: ReleaseGateMode;
+    clock?: () => number;
+}
+type RunReleaseGateResult = {
+    kind: 'verdict';
+    verdict: GateVerdict;
+    lines: string[];
+    mode: 'fresh' | 'report';
+    profileKey: string;
+    fingerprint: string;
+    currentReport: EvalBatchReport;
+    currentReportFile: string;
+    /** Actual calls in this invocation, including retries and judge calls; offline is zero. */
+    modelCalls: number;
+    /** Fresh helper replay duration, or offline read/compare duration; never historical cost. */
+    wallClockMs: number;
+    notices: string[];
+    refusals: readonly CommittedReadRefusal[];
+} | {
+    kind: 'refused';
+    refusal: CommittedReadRefusal;
+    notices: string[];
+};
+/** Compose guarded disk evidence with eval core's single comparison law. */
+declare function runReleaseGate(input: RunReleaseGateInput): Promise<RunReleaseGateResult>;
+
+declare const COMMITTED_REPORT_JSON_FILE = "report.json";
+declare const COMMITTED_REPORT_MARKDOWN_FILE = "report.md";
+declare const COMMITTED_REPORT_DECISIONS_FILE = "decisions.json";
+interface CommitEvalReportInput {
+    /** The pure eval-core report DTO — batchKey names the committed dir. */
+    report: EvalBatchReport;
+    /** Optional pairing evidence for this same batch and matcher, never a separate channel. */
+    decisions?: DecisionVectorsDocument;
+    /** The rendered markdown projection; byte-determinism is the renderer's contract. */
+    markdown: string;
+    /** Explicit absolute committed-root path — `<configDir>/agent-qa-eval` for the 372 CLI. */
+    committedRoot: string;
+}
+type CommitEvalReportOutcome = {
+    kind: 'committed';
+    json: 'written' | 'unchanged';
+    markdown: 'written' | 'unchanged';
+    decisions?: 'written' | 'unchanged';
+    reportDir: string;
+} | {
+    kind: 'write-conflict';
+    path: string;
+};
+/**
+ * Commit the baseline report beside the corpus/contracts that produced it: preview ALL paths,
+ * then write — one atomic unit (D-13/D-17).
+ */
+declare function commitEvalReport(input: CommitEvalReportInput): CommitEvalReportOutcome;
+
+interface WriteBaselinePointerInput {
+    /** The report being designated — its judge provenance decides comparator eligibility. */
+    report: EvalBatchReport;
+    /** The v2 pointer, including fingerprint and corpusDigest; batchKey names the same report. */
+    pointer: BaselinePointer;
+    /** Explicit absolute committed-root path — `<configDir>/agent-qa-eval` for the CLI. */
+    committedRoot: string;
+}
+type WriteBaselinePointerOutcome = {
+    kind: 'written' | 'unchanged';
+    path: string;
+} | {
+    kind: 'refused';
+    refusal: BaselineComparatorRefusal;
+} | {
+    kind: 'write-conflict';
+    path: string;
+};
+/**
+ * Designate a per-profile baseline: refuse-then-preview-then-write.
+ *
+ * A pointer whose batchKey does not name the designated report is a CALLER bug, not data — the
+ * outcome union stays closed for the three honest answers and a mismatch raises instead.
+ */
+declare function writeBaselinePointer(input: WriteBaselinePointerInput): WriteBaselinePointerOutcome;
+
+declare const COMMITTED_CENSUS_JSON_FILE = "census.json";
+declare const COMMITTED_CENSUS_MARKDOWN_FILE = "census.md";
+interface CommitCensusInput {
+    /** The pure eval-core census DTO — its corpusDigest names the committed dir. */
+    census: CorpusCensus;
+    /** The rendered markdown projection; byte-determinism is the renderer's contract. */
+    markdown: string;
+    /** Explicit absolute committed-root path — `<configDir>/agent-qa-eval` for the CLI. */
+    committedRoot: string;
+}
+type CommitCensusOutcome = {
+    kind: 'committed';
+    json: 'written' | 'unchanged';
+    markdown: 'written' | 'unchanged';
+    censusDir: string;
+} | {
+    kind: 'write-conflict';
+    path: string;
+};
+/**
+ * Commit the census beside the corpus it measures: preview BOTH paths, then write — one
+ * atomic unit.
+ */
+declare function commitCensus(input: CommitCensusInput): CommitCensusOutcome;
+
+interface ReadGatePostureForInput {
+    /** Explicit absolute committed-root path — `<configDir>/agent-qa-eval` for the CLI. */
+    committedRoot: string;
+    agentQaRoot?: string;
+    /** The scope being asked about; `resolveProductPartition` is the ONE mapping (D-16). */
+    scope: ScopeKey;
+    /** REQUIRED integer floor, >= 1. No default exists anywhere (D-12). */
+    minimumGateSet: number;
+    /** Complete raw judge declaration and recorded identity; passed intact to the pure fold. */
+    judge: JudgeCapabilityInput;
+    /** Canary evidence as DATA; eval never imports knowledge-local. */
+    canary: CanaryEvidenceSummary;
+}
+interface ReadGatePostureForResult {
+    posture: GatePosture;
+    /** Every notice both reads produced, in read order: corpus first, then manifests. */
+    notices: string[];
+    /** Every refusal both reads produced — never dropped, never merged into a count. */
+    refusals: readonly CommittedReadRefusal[];
+}
+/**
+ * Read the committed root and fold it into the gate posture for one scope.
+ *
+ * Throws only what `readGatePosture` throws: a `minimumGateSet` that is not a positive integer is
+ * a caller bug, not data. Everything the DISK got wrong is a refusal row.
+ */
+declare function readGatePostureFor(input: ReadGatePostureForInput): ReadGatePostureForResult;
+
+type CalibrationEvidenceMissingReason = 'corpus-refused' | 'invalid-run-link' | 'path-refused' | 'marks-missing' | 'marks-unreadable' | 'handoff-missing' | 'handoff-unreadable' | 'handoff-refused' | 'source-refused' | 'deterministic-missing' | 'deterministic-refused' | 'analysis-missing' | 'analysis-unreadable' | 'analysis-refused' | 'analyze-run-missing';
+interface CalibrationEvidenceRead extends LabelCalibrationInput {
+    marks: MarkReceipt[];
+    observations: CalibrationObservation[];
+    missingEvidenceCounts: Partial<Record<CalibrationEvidenceMissingReason, number>>;
+}
+/** Guard persisted observations independently; a winning merged verdict loses producer evidence. */
+declare function loadCalibrationEvidence(input: {
+    committedRoot: string;
+    agentQaRoot: string;
+    calibrationRead?: LabelCalibrationRead;
+}): CalibrationEvidenceRead;
+/** Guarded diagnostic read using the caller's already validated calibration generation. */
+declare function readCalibrationGoldIdentity(input: {
+    committedRoot: string;
+    agentQaRoot: string;
+    calibrationRead: LabelCalibrationRead;
+}): {
+    kind: 'loaded';
+    goldSetDigest: string;
+} | {
+    kind: 'unavailable';
+};
+
+export { ADVERSARIAL_DEFAULT_MAX_PROBE_CALLS, ADVERSARIAL_MANIFEST_FILE, ADVERSARIAL_PROBE_SCHEMA_VERSION, ADVERSARIAL_PROBE_SUBDIR, ADVERSARIAL_STAGING_SUBDIR, ADVERSARIAL_STATE_SCHEMA_VERSION, ADVERSARIAL_STATE_SUBDIR, type AblateCanaryStepInput, type AblateCanaryStepResult, type AdmitStagedFeedbackResult, type AdversarialBatchManifest, type AdversarialBatchManifestCase, AdversarialLifecycleBusyError, type AdversarialProbeCallCap, type AdversarialProbeRefusal, type AdversarialProbeSkip, type AdversarialProbeSkipReason, type AdversarialRefreshRecord, type AdversarialRefreshTuple, type AdversarialRefusal, type AdversarialRetirementResult, type AdversarialSeedCap, type AdversarialSpend, type AdversarialStagingSkip, type AdversarialTupleOutcome, BLOBS_SUBDIR, type BaselineCacheResolution, type BaselineCacheRow, type BaselinePointerEntry, CASSETTE_FILE, COMMITTED_BASELINES_SUBDIR, COMMITTED_CASSETTES_DIR, COMMITTED_CENSUS_JSON_FILE, COMMITTED_CENSUS_MARKDOWN_FILE, COMMITTED_CENSUS_SUBDIR, COMMITTED_CONTRACTS_DIR, COMMITTED_CORPUS_DIR, COMMITTED_EXCLUSIONS_DIR, COMMITTED_GITIGNORE_TEXT, COMMITTED_LABELS_DIR, COMMITTED_NOISE_FLOOR_SUBDIR, COMMITTED_REPORTS_DIR, COMMITTED_REPORT_DECISIONS_FILE, COMMITTED_REPORT_JSON_FILE, COMMITTED_REPORT_MARKDOWN_FILE, COMMITTED_ROOT_MARKER_FILE, COMMITTED_ROOT_SCHEMA_VERSION, type CalibrationEvidenceMissingReason, type CalibrationEvidenceRead, type CassetteBundleLoad, type CommitCensusInput, type CommitCensusOutcome, type CommitEvalReportInput, type CommitEvalReportOutcome, type CommittedCorpusDigestRead, type CommittedCorpusRead, type CommittedDecisionVectorsLoad, type CommittedReadRefusal, type CommittedReportEntry, type CommittedRootStoreConfig, type CommittedWriteOutcome, DEFAULT_EVAL_CASSETTES_SUBDIR, DEFAULT_EVAL_REPLAYS_SUBDIR, DEFAULT_EVAL_REPORTS_SUBDIR, DirArtifactSource, type DirArtifactSourceConfig, FEEDBACK_STAGING_SUBDIR, type FailingPathCandidateAdmission, type FailingPathCandidateAuthorization, type FeedbackStateInput, FloorProtocolError, type FreezeGoldenTrajectoryInput, type FreezeOutcome, FsCassetteStore, type FsCassetteStoreConfig, FsCommittedRootStore, FsHandoffSource, type FsHandoffSourceConfig, FsMarkLedger, FsReplayRecordStore, type FsReplayRecordStoreConfig, FsReportStore, type FsReportStoreConfig, FsRunArtifactSource, type FsRunArtifactSourceConfig, FsScoreStore, type FsScoreStoreConfig, GATE1_AUDIT_SUBDIR, GATE2_AUDIT_SUBDIR, GATE2_TARGET_SUBDIR, JUDGE_CALIBRATION_SCHEMA_VERSION, JUDGE_CALIBRATION_SUBDIR, type JudgeBindingInput, type JudgeCalibrationArtifact, type JudgeCalibrationEvidenceRead, type JudgeCalibrationPublication, type JudgeCalibrationRead, type JudgeCalibrationReadInput, LABEL_CALIBRATION_PATH, LABEL_CALIBRATION_SCHEMA_VERSION, type LabelCalibrationArtifact, type LabelCalibrationRead, type LabelEvidenceRead, type LoadJudgeCalibrationEvidenceInput, type LoadLabelEvidenceInput, type LoadedCassetteBundle, MARKS_LEDGER_FILE, MARKS_LEDGER_LOCK_FILE, MARK_INTENT_FILE, MarkIntentUnusableError, MarkLedgerBusyError, MarkLedgerCorruptError, MarkLedgerNoRunError, type NoiseFloorArtefactEntry, PARTITION_MANIFEST_FILE_PREFIX, type PartitionManifestRead, type ProbeAttemptState, type ProbeCompletion, type ProbeCompletionOutcome, type ProbeReservation, type ProbeReservationKey, REPLAY_RECORD_FILE, type ReadGatePostureForInput, type ReadGatePostureForResult, type RefreshAdversarialSplitInput, type RefreshAdversarialSplitResult, type ReleaseGateMode, type RemovalFlipsOutcomeInput, type RemovalFlipsOutcomeResult, type ReplayCorpusOnceInput, type ReplayCorpusOnceResult, type ReplayRecordLoad, type ResolveMinimumGateSetOutcome, type RetireStagedAdversarialBatchInput, type RunCassetteReplayInput, type RunExclusionRead, type RunJudgeCalibrationResult, type RunJudgePanelCalibrationInput, type RunLabelCalibrationInput, type RunLabelCalibrationResult, type RunNoiseFloorMeasurementInput, type RunNoiseFloorMeasurementResult, type RunReleaseGateInput, type RunReleaseGateResult, type RunReplayGateInput, type RunReplayGateResult, SCORE_FILE, type ScoreRecord, type ScoreRecordLoad, type SeedCommittedCorpusInput, type SeedingRefusal, type SeedingReport, type StageAdversarialProposalInput, type StageAdversarialProposalResult, type StageFeedbackEntryInput, type StageFeedbackEntryResult, type StagedAdversarialBatch, type StagedAdversarialCase, type StagedFeedbackEntry, type StagedReportLoad, type SweepCassetteReplaysInput, type SweepCassetteReplaysResult, type WriteBaselinePointerInput, type WriteBaselinePointerOutcome, type WriteNoiseFloorArtefactInput, type WriteNoiseFloorArtefactOutcome, type WritePartitionManifestInput, type WritePartitionManifestOutcome, type WriteRunExclusionInput, type WriteRunExclusionOutcome, type WrittenCassette, type WrittenReplayRecord, type WrittenReport, type WrittenScoreRecord, ablateCanaryStep, absentArtifactSource, admitStagedFeedback, adversarialProbeTupleKey, adversarialRefreshRecordDigest, adversarialTupleKey, assembleScoredBatch, bindJudgePanel, bindJudgePort, buildRootMarkerValue, cassetteProductPartition, commitCensus, commitEvalReport, committedBaselinePointerPath, committedBlobPath, committedCassettePath, committedCensusPath, committedContractPath, committedCorpusPath, committedExclusionPath, committedLabelPath, committedLabelRevisionPath, committedNoiseFloorPath, committedPartitionManifestPath, committedReportPath, completeProbeCall, computeAdversarialBatchDigest, computeReplayProfileFingerprintFor, copyJudgeCalibrationToReport, createJudgeCalibrationArtifact, derivedAdversarialCassetteIds, freezeGoldenTrajectory, guardJudgeCalibration, isNovelState, judgeCalibrationGenerationId, judgeCalibrationPath, latestMarkReceiptFor, latestMarkReceiptsPerAddress, listBaselinePointers, listBaselineRunRoots, listCassetteBundleDirs, listCommittedReports, listNoiseFloorArtefacts, listReplayRecordDirs, listStagedAdversarial, listStagedFeedback, loadCalibrationEvidence, loadCassetteBundle, loadCassetteBundles, loadJudgeCalibrationEvidence, loadLabelEvidence, loadReplayRecord, loadScoreRecord, loadStagedReport, locateTargetCassettes, maskJudgeCalibrationText, probeReservationOf, publishAdversarialRefreshRecord, publishJudgeCalibration, readActiveCommittedCorpus, readAdversarialRefreshRecords, readCalibrationGoldIdentity, readCommittedCorpus, readCommittedCorpusDigest, readCommittedDecisionVectors, readGatePostureFor, readJudgeCalibration, readLabelCalibration, readPartitionManifests, readProbeAttempt, readProbeAttempts, readReportProfileProof, readRunExclusions, refreshAdversarialSplit, removalFlipsOutcome, replayCorpusOnce, replayJudgeRequest, reserveProbeCall, resolveAdversarialProbeCallCap, resolveAdversarialSeedCap, resolveBaselineCache, resolveFailingPathCandidate, resolveMinimumGateSet, retireStagedAdversarialBatch, runCassetteReplay, runJudgeCalibration, runJudgePanelCalibration, runLabelCalibration, runNoiseFloorMeasurement, runReleaseGate, runReplayGate, seedCommittedCorpus, serializeReplayGateReceipt, settledAdversarialTuples, stageAdversarialProposal, stageFeedbackEntry, sweepCassetteReplays, writeBaselinePointer, writeNoiseFloorArtefact, writePartitionManifest, writeRunExclusion };