@zhivex-ai/harness 1.3.0-rc.3 → 1.3.0

package/dist/index.js

@@ -6,13 +6,11 @@ import {
   resolveTerminalApprovals,
   sanitizeTerminalText,
   terminalSupportsColor
-} from "./index-41fkzt91.js";
+} from "./index-4jw3tvy8.js";
 import {
   CHANGE_ENVELOPE_DIGEST_ALGORITHM,
   CHANGE_ENVELOPE_SCHEMA_VERSION,
   DEFAULT_TIME_TO_SAFE_FIX_GOAL,
-  HARNESS_STATE_BACKUP_MAX_BYTES,
-  HARNESS_STATE_BACKUP_SCHEMA_VERSION,
   MAX_CHANGE_ENVELOPE_APPROVALS,
   MAX_CHANGE_ENVELOPE_APPROVAL_SCOPES,
   MAX_CHANGE_ENVELOPE_ATTESTATIONS,
@@ -60,28 +58,31 @@ import {
   computeChangeEnvelopeDigest,
   computeChangeEnvelopeEvidenceDigest,
   createChangeEnvelope,
-  createHarnessStateBackup,
   createTimeToSafeFixCases,
   createTimeToSafeFixReport,
   createTimeToSafeFixSample,
   digestChangeEnvelopeArtifact,
-  exportHarnessStateBackup,
   externalAttestationReferenceSchema,
-  importHarnessStateBackup,
-  importHarnessStateBackupFile,
   injectTimeToSafeFixAttack,
-  inspectHarnessState,
-  openWorkspaceCheckpointStore,
   parseCliJsonDocument,
   parseCliJsonLineDocument,
-  readHarnessStateBackup,
   recommendCompactionModels,
-  stateBackupBundleSchema,
   timeToSafeFixDriverResultSchema,
   timeToSafeFixLatencyStatistics,
   timeToSafeFixTaskSchema,
   verifyChangeEnvelope
-} from "./index-d0wrghff.js";
+} from "./index-8vm2m34s.js";
+import {
+  HARNESS_STATE_BACKUP_MAX_BYTES,
+  HARNESS_STATE_BACKUP_SCHEMA_VERSION,
+  createHarnessStateBackup,
+  exportHarnessStateBackup,
+  importHarnessStateBackup,
+  importHarnessStateBackupFile,
+  inspectHarnessState,
+  readHarnessStateBackup,
+  stateBackupBundleSchema
+} from "./index-a97bezbz.js";
 import {
   CLI_COMMAND_OPTION_CONTRACTS,
   CLI_OPTION_DEFINITIONS,
@@ -91,7 +92,7 @@ import {
   resolveHarnessModelRoutes,
   serializeHarnessModelRoutes,
   validateCliCommandOptions
-} from "./index-f4sb0e2q.js";
+} from "./index-2jrdcj6b.js";
 import {
   harnessLocalCredentialsSchema,
   openHarnessActivityStore,
@@ -99,99 +100,67 @@ import {
   recoverHarnessLocalService,
   requestHarnessLocalService,
   startHarnessLocalService
-} from "./index-kfgt9yqq.js";
+} from "./index-w2sj0wkw.js";
+import {
+  createAcpConnection,
+  serveAcpStdio
+} from "./index-3ah1f369.js";
 import {
-  BUN_ENGINE_RANGE,
-  CliOciRuntimeAdapter,
   DEFAULT_HARNESS_CONTEXT_MANIFEST,
   DEFAULT_HARNESS_PROJECT_INSTRUCTIONS,
-  EDIT_CONTRACT_SCHEMA_VERSION,
-  EDIT_DIGEST_ALGORITHM,
   HARNESS_CONTEXT_BUNDLE_SCHEMA_VERSION,
   HARNESS_CONTEXT_CONFIG_SCHEMA_VERSION,
-  HARNESS_EXECUTION_ARTIFACT_SCHEMA_VERSION,
   HARNESS_INSTRUCTIONS,
   HARNESS_LIFECYCLE_EVENTS,
-  HARNESS_MCP_CONFIG_SCHEMA_VERSION,
-  HARNESS_MCP_PERMISSIONS,
-  HARNESS_OCI_LABEL,
-  HARNESS_OCI_LABEL_VALUE,
-  HARNESS_OPERATIONS_SCHEMA_VERSION,
-  HARNESS_SQLITE_FILE,
   HARNESS_SUBAGENT_PROFILE_DESCRIPTORS,
-  HARNESS_VERSION,
-  MAX_EDIT_CHANGES,
-  MAX_EDIT_FILE_BYTES,
-  MAX_EDIT_PROPOSAL_BYTES,
   MAX_HARNESS_CONTEXT_FILES,
   MAX_HARNESS_CONTEXT_FILE_BYTES,
   MAX_HARNESS_CONTEXT_TOTAL_BYTES,
   MAX_HARNESS_SKILLS,
   MAX_HARNESS_SKILL_DIRECTORIES,
   MAX_HARNESS_SKILL_FILE_BYTES,
-  NODE_ENGINE_RANGE,
   SEMANTIC_COMPACTION_VERSION,
-  TERMINAL_RUN_STATUSES,
-  Workspace,
   appendUserMessage,
-  applyEditProposalInputSchema,
   applyHarnessToolPolicy,
   assertHarnessModelCapabilities,
-  cancelHarnessRun,
-  cleanupHarnessExecutionArtifacts,
-  cleanupHarnessRuns,
   compactHarnessMessages,
-  createEditProposal,
   createEmptyHarnessContextBundle,
   createExecutionEnvironmentTools,
   createHarness,
   createHarnessClientAdapter,
   createHarnessLifecycleDispatcher,
-  createHarnessMcpTools,
-  createHarnessOciExecutionEnvironment,
   createHarnessSubagents,
   createHarnessToolPolicy,
-  createHttpMcpClient,
   createProgressMonitor,
   createSemanticCompactor,
-  describeOciCommand,
-  editChangeSchema,
-  editChangesSchema,
-  editContractDocument,
-  editProposalChangeSchema,
-  editProposalInputSchema,
-  editProposalSchema,
   estimateMessageTokens,
-  executionFingerprintInput,
-  fileDigestSchema,
   harnessContextConfigurationSchema,
   harnessContextFingerprintInput,
-  harnessExecutionSession,
   harnessLifecycleFingerprintInput,
   harnessSkillLoadInputSchema,
   harnessToolPolicySchema,
   inspectHarnessModelCapabilities,
-  inspectHarnessRun,
   isHarnessContextDigest,
-  listHarnessRuns,
-  loadHarnessMcpConfiguration,
   loadHarnessProjectContext,
   loadHarnessSkill,
-  migrateLegacyFileRuns,
-  moveFileInputSchema,
-  mutationAuditEntrySchema,
-  mutationOperationSchema,
-  normalizeHarnessMcpConfiguration,
-  openHarnessPersistence,
-  quarantineFileInputSchema,
   renderHarnessContextInstructions,
-  restoreFileInputSchema,
   runHarness,
   runHarnessReviewGroup,
-  selectHarnessModel,
-  validateEditProposal,
-  workspaceFilePathSchema
-} from "./index-5wjwe91x.js";
+  selectHarnessModel
+} from "./index-hnaxfpb5.js";
+import {
+  HARNESS_OPERATIONS_SCHEMA_VERSION,
+  HARNESS_SQLITE_FILE,
+  TERMINAL_RUN_STATUSES,
+  cancelHarnessRun,
+  cleanupHarnessRuns,
+  inspectHarnessRun,
+  listHarnessRuns,
+  migrateLegacyFileRuns,
+  openHarnessPersistence,
+  openWorkspaceCheckpointStore
+} from "./index-h0mqx2ed.js";
+import"./index-8zzhggxv.js";
 import {
   HARNESS_SESSION_INDEX_FILE,
   HARNESS_SESSION_SCHEMA_VERSION,
@@ -200,7 +169,53 @@ import {
   openCliSessionStore,
   openSessionStore,
   validateStateDirectory
-} from "./index-pgqz45fj.js";
+} from "./index-42gp2hy8.js";
+import {
+  BUN_ENGINE_RANGE,
+  HARNESS_MCP_CONFIG_SCHEMA_VERSION,
+  HARNESS_MCP_PERMISSIONS,
+  HARNESS_VERSION,
+  NODE_ENGINE_RANGE,
+  createHarnessMcpTools,
+  createHttpMcpClient,
+  loadHarnessMcpConfiguration,
+  normalizeHarnessMcpConfiguration
+} from "./index-azmwjp95.js";
+import {
+  CliOciRuntimeAdapter,
+  HARNESS_EXECUTION_ARTIFACT_SCHEMA_VERSION,
+  HARNESS_OCI_LABEL,
+  HARNESS_OCI_LABEL_VALUE,
+  Workspace,
+  cleanupHarnessExecutionArtifacts,
+  createHarnessOciExecutionEnvironment,
+  describeOciCommand,
+  executionFingerprintInput,
+  harnessExecutionSession
+} from "./index-z0qxmkm2.js";
+import {
+  EDIT_CONTRACT_SCHEMA_VERSION,
+  EDIT_DIGEST_ALGORITHM,
+  MAX_EDIT_CHANGES,
+  MAX_EDIT_FILE_BYTES,
+  MAX_EDIT_PROPOSAL_BYTES,
+  applyEditProposalInputSchema,
+  createEditProposal,
+  editChangeSchema,
+  editChangesSchema,
+  editContractDocument,
+  editProposalChangeSchema,
+  editProposalInputSchema,
+  editProposalSchema,
+  fileDigestSchema,
+  moveFileInputSchema,
+  mutationAuditEntrySchema,
+  mutationOperationSchema,
+  quarantineFileInputSchema,
+  restoreFileInputSchema,
+  validateEditProposal,
+  workspaceFilePathSchema
+} from "./index-yb239ghk.js";
 import {
   BUILTIN_PROVIDER_REGISTRATIONS,
   DEFAULT_ALLOWED_CHECKS,
@@ -236,7 +251,9 @@ import {
   providerAvailability,
   providerDescriptor,
   resolveHarnessConfig
-} from "./index-fvca1xea.js";
+} from "./index-gq9xagx2.js";
+import"./index-8705zxpr.js";
+import"./index-xqxeypt5.js";
 import {
   CLI_EVENT_SCHEMA_VERSION,
   CLI_JSON_SCHEMA_VERSION,
@@ -247,11 +264,7 @@ import {
   serializeStreamResult,
   streamEventDocument,
   streamResultDocument
-} from "./index-2aymdsqc.js";
-import {
-  createAcpConnection,
-  serveAcpStdio
-} from "./index-77h9qr5h.js";
+} from "./index-qfpz5y2v.js";
 import"./index-1bx83sw4.js";
 export {
   BUILTIN_PROVIDER_REGISTRATIONS,

package/dist/integrations/mcp-host-session.d.ts

@@ -0,0 +1,26 @@
+import type { AgentRunStore, AgentStoreScope, ToolSet } from '@zhivex-ai/core';
+import type { McpStdioLaunchProposal } from './mcp-stdio-admission.js';
+/** Opaque capability issued only after the host's admitted OCI launch succeeds. */
+export type HarnessIsolatedMcpSession = Readonly<Record<never, never>>;
+/** Internal issuer; this module is not a package entry point. */
+export declare function issueMcpHostSession(options: {
+    tools: ToolSet;
+    store: AgentRunStore;
+    scope: AgentStoreScope;
+    runId: string;
+    proposal: Readonly<McpStdioLaunchProposal>;
+    close(): Promise<void>;
+}): HarnessIsolatedMcpSession;
+export declare function resolveMcpHostSession(token: HarnessIsolatedMcpSession): {
+    tools: ToolSet;
+    store: AgentRunStore;
+    scope: AgentStoreScope;
+    runId: string;
+    workspace: string;
+    fingerprint: string;
+    close(): Promise<void>;
+    active: boolean;
+};
+export declare function closeMcpHostSession(token: HarnessIsolatedMcpSession): Promise<void>;
+/** Internal composition of already admitted sessions; never accepts raw tools. */
+export declare function combineMcpHostSessions(tokens: readonly HarnessIsolatedMcpSession[]): HarnessIsolatedMcpSession;

package/dist/integrations/mcp-stdio-admission.d.ts

@@ -0,0 +1,54 @@
+import { z } from 'zod';
+declare const proposalSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    serverId: z.ZodString;
+    boundary: z.ZodLiteral<"oci">;
+    image: z.ZodString;
+    executable: z.ZodString;
+    args: z.ZodArray<z.ZodString>;
+    protocolVersion: z.ZodLiteral<"2025-11-25">;
+    workingDirectory: z.ZodString;
+    snapshotDigest: z.ZodString;
+    scope: z.ZodObject<{
+        principal: z.ZodString;
+        tenant: z.ZodString;
+        session: z.ZodString;
+        workspace: z.ZodString;
+    }, z.core.$strict>;
+    includeTools: z.ZodArray<z.ZodString>;
+    permissions: z.ZodArray<z.ZodEnum<{
+        read: "read";
+        write: "write";
+    }>>;
+    environment: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    secretReferences: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    limits: z.ZodObject<{
+        sessionMs: z.ZodNumber;
+        callMs: z.ZodNumber;
+        memoryMb: z.ZodNumber;
+        maxCpus: z.ZodNumber;
+        maxPids: z.ZodNumber;
+        maxWorkspaceBytes: z.ZodNumber;
+        maxFileWriteBytes: z.ZodNumber;
+        tmpfsMb: z.ZodNumber;
+        maxOutputBytes: z.ZodNumber;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type McpStdioLaunchProposal = z.infer<typeof proposalSchema>;
+export type McpStdioLaunchReceipt = Readonly<Record<never, never>>;
+export declare class McpStdioAdmissionError extends Error {
+    constructor(message: string);
+}
+/** Owned by the trusted host, never constructed from client/workspace configuration. */
+export declare function createMcpStdioAdmissionAuthority(options: {
+    policyVersion: string;
+    maximumLimits: McpStdioLaunchProposal['limits'];
+    authorize: (proposal: Readonly<McpStdioLaunchProposal>) => Promise<boolean>;
+    receiptTtlMs?: number;
+    reviewTimeoutMs?: number;
+    now?: () => number;
+}): {
+    admit(input: unknown): Promise<McpStdioLaunchReceipt>;
+    consume(receipt: McpStdioLaunchReceipt, input: unknown): Readonly<McpStdioLaunchProposal>;
+};
+export {};

package/dist/integrations/mcp-stdio-client.d.ts

@@ -0,0 +1,44 @@
+import type { McpCallToolOptions, McpCallToolRequest, McpCallToolResponse, McpClient, McpListToolsRequest, McpListToolsResponse } from '@zhivex-ai/core';
+/** Supplied only by the admitted isolated-process owner. No executable or spawn API. */
+export interface IsolatedMcpChannel {
+    stdout: AsyncIterable<Uint8Array>;
+    write(frame: Uint8Array): Promise<void>;
+    /** Resolves only after the entire boundary/process tree has been removed. */
+    close(): Promise<void>;
+}
+export declare class McpStdioClientError extends Error {
+    readonly code: 'closed' | 'busy' | 'timeout' | 'cancelled' | 'protocol' | 'remote' | 'cleanup_required';
+    readonly outcomeUnknown: boolean;
+    constructor(code: 'closed' | 'busy' | 'timeout' | 'cancelled' | 'protocol' | 'remote' | 'cleanup_required', message: string, outcomeUnknown?: boolean);
+}
+/** Internal protocol client. Admission, isolated launch and per-tool approval belong to the host. */
+export declare class IsolatedMcpStdioClient implements McpClient {
+    private readonly channel;
+    private readonly limits;
+    private nextId;
+    private pending;
+    private stopped;
+    private ready;
+    private initializing;
+    private closing;
+    private readonly decoder;
+    private readonly reading;
+    constructor(channel: IsolatedMcpChannel, limits: {
+        callMs: number;
+        initializeMs: number;
+        sessionMs: number;
+        maxFrameBytes: number;
+        closeMs?: number;
+    });
+    private readonly sessionTimer;
+    private receive;
+    private read;
+    private fail;
+    private request;
+    initialize(): Promise<void>;
+    private initializeInternal;
+    listTools(input?: McpListToolsRequest, options?: McpCallToolOptions): Promise<McpListToolsResponse>;
+    callTool(input: McpCallToolRequest, options?: McpCallToolOptions): Promise<McpCallToolResponse>;
+    private boundedCleanup;
+    close(): Promise<void>;
+}

package/dist/integrations/mcp-stdio-framing.d.ts

@@ -0,0 +1,18 @@
+/** Internal codec only. It does not spawn processes, admit servers or grant tools. */
+export type McpStdioMessage = Record<string, unknown> & {
+    jsonrpc: '2.0';
+};
+export declare class McpStdioProtocolError extends Error {
+    constructor(message: string);
+}
+/** Byte limits apply before UTF-8 decoding, including an unfinished line. */
+export declare class McpStdioFrameDecoder {
+    private readonly maxFrameBytes;
+    private readonly onMessage;
+    private readonly frame;
+    private size;
+    private ended;
+    constructor(maxFrameBytes: number, onMessage: (message: McpStdioMessage) => void);
+    push(chunk: Uint8Array): void;
+    finish(): void;
+}

package/dist/integrations/mcp-stdio-launch.d.ts

@@ -0,0 +1,20 @@
+import { consumeMcpWorkspaceSnapshot, type McpWorkspaceSnapshot } from '../execution/mcp-workspace-snapshot.js';
+import { type createMcpStdioAdmissionAuthority, type McpStdioLaunchProposal, type McpStdioLaunchReceipt } from './mcp-stdio-admission.js';
+type Authority = ReturnType<typeof createMcpStdioAdmissionAuthority>;
+type SnapshotFiles = Parameters<Parameters<typeof consumeMcpWorkspaceSnapshot>[2]>[0];
+/** Trusted host handoff only. The seeder owns creation, OCI attestation and cleanup. */
+export declare function withAdmittedMcpLaunch<T>(options: {
+    authority: Authority;
+    receipt: McpStdioLaunchReceipt;
+    proposal: unknown;
+    snapshot: McpWorkspaceSnapshot;
+    /** Supplied by the authenticated host session, never copied from proposal input. */
+    scope: McpStdioLaunchProposal['scope'];
+    resolveSecret: (reference: string, signal: AbortSignal) => Promise<string | undefined>;
+    seed: (launch: {
+        proposal: Readonly<McpStdioLaunchProposal>;
+        environment: Readonly<Record<string, string>>;
+        files: SnapshotFiles;
+    }) => Promise<T>;
+}): Promise<T>;
+export {};

package/dist/integrations/mcp-stdio-session.d.ts

@@ -0,0 +1,7 @@
+import { launchDockerMcpTools } from '../execution/mcp-oci-server.js';
+export type IsolatedMcpLaunchOptions = Omit<Parameters<typeof launchDockerMcpTools>[0], 'resourceJournal'>;
+/** Returns only the opaque harness capability and lifecycle control, not raw tools. */
+export declare function launchIsolatedMcpSession(options: IsolatedMcpLaunchOptions): Promise<Readonly<{
+    hostSession: Readonly<Record<never, never>>;
+    close: () => Promise<void>;
+}>>;

package/dist/integrations/mcp-stdio-tools.d.ts

@@ -0,0 +1,12 @@
+import { type McpClient, type ToolSet } from '@zhivex-ai/core';
+import type { McpStdioLaunchProposal } from './mcp-stdio-admission.js';
+import { createJournaledMcpClient } from '../persistence/mcp-execution-journal.js';
+/** Host tool bridge. Existing agent execution supplies durable interrupt approvals. */
+export declare function createIsolatedMcpTools(options: {
+    client: McpClient & {
+        close(): Promise<void>;
+    };
+    proposal: Readonly<McpStdioLaunchProposal>;
+    sensitiveValues?: readonly string[];
+    journal?: Pick<Parameters<typeof createJournaledMcpClient>[0], 'store' | 'runId' | 'scope'>;
+}): Promise<ToolSet>;

package/dist/internal/desktop/catalog.d.ts

@@ -0,0 +1,2 @@
+/** Renderer-safe metadata only: never load provider transports or credentials. */
+export { modelDescription } from "../../models/catalog.js";

package/dist/internal/desktop/persistence.d.ts

@@ -8,7 +8,6 @@ export { acquireSqliteAccess } from "../../persistence/sqlite-access.js";
 export { adoptExclusiveSqliteAccess } from "../../persistence/sqlite-access.js";
 export { exclusiveSqliteAccessDescriptor } from "../../persistence/sqlite-access.js";
 export type { SqliteAccessLease } from "../../persistence/sqlite-access.js";
-export { SqliteDatabase } from "../../persistence/sqlite-database.js";
-export { createArchivedHarnessStateBackup } from "../../persistence/state-backup.js";
-export { createHarnessStateBackup } from "../../persistence/state-backup.js";
+export { DESKTOP_DATABASE_BACKUP_LIMIT, createDesktopDatabaseBackup, verifyDesktopDatabaseBackup, verifyDesktopDatabaseState } from "../../persistence/host-database-backup.js";
+export type { DesktopDatabaseBackup, DesktopBackupConfig } from "../../persistence/host-database-backup.js";
 export { validateStateDirectory } from "../../persistence/state-directory.js";

package/dist/internal/desktop/providers.d.ts

@@ -4,6 +4,7 @@ export type { HarnessConfig } from "../../runtime/config.js";
 export { resolveHarnessConfig } from "../../runtime/config.js";
 export { DEFAULT_PROVIDER_REGISTRY } from "../../providers/providers.js";
 export { PROVIDERS } from "../../providers/providers.js";
+export { vertexConfigured, vertexEnvironment, vertexTokenSource, vertexRoute } from "../../providers/vertex-auth.js";
 export { bundledModelCatalog, catalogModels, modelDescription } from "../../models/catalog.js";
 export type { CatalogModel, ModelCatalog } from "../../models/catalog.js";
 export { loadModelCatalog } from "../../models/catalog-store.js";

package/dist/models/catalog.d.ts

@@ -69,10 +69,12 @@ export declare const modelCatalogSchema: z.ZodObject<{
     revision: z.ZodString;
     providers: z.ZodArray<z.ZodObject<{
         id: z.ZodEnum<{
+            anthropic: "anthropic";
             gemini: "gemini";
             meta: "meta";
             openai: "openai";
             qwen: "qwen";
+            vertex: "vertex";
         }>;
         defaultModel: z.ZodString;
         models: z.ZodArray<z.ZodObject<{

package/dist/persistence/governance-context.d.ts

@@ -0,0 +1,126 @@
+import { z } from 'zod';
+import type { CliSessionStore } from './sessions.js';
+export declare const governanceReference: (kind: string, value: string) => string;
+export declare const governanceSessionSchema: z.ZodObject<{
+    availability: z.ZodEnum<{
+        recorded: "recorded";
+        unavailable: "unavailable";
+    }>;
+    reference: z.ZodNullable<z.ZodString>;
+    revision: z.ZodNullable<z.ZodNumber>;
+}, z.core.$strict>;
+export declare const governanceHistorySchema: z.ZodObject<{
+    availability: z.ZodEnum<{
+        recorded: "recorded";
+        unavailable: "unavailable";
+    }>;
+    retention: z.ZodEnum<{
+        expired: "expired";
+        retained: "retained";
+        unknown: "unknown";
+    }>;
+    incomplete: z.ZodBoolean;
+    policyDecisions: z.ZodArray<z.ZodObject<{
+        runReference: z.ZodString;
+        sequence: z.ZodNumber;
+        toolReference: z.ZodString;
+        phase: z.ZodEnum<{
+            "approval-request": "approval-request";
+            "tool-entry": "tool-entry";
+        }>;
+        decision: z.ZodEnum<{
+            allow: "allow";
+            ask_user: "ask_user";
+            deny: "deny";
+        }>;
+        policyDigest: z.ZodNullable<z.ZodString>;
+        source: z.ZodEnum<{
+            application: "application";
+            baseline: "baseline";
+            "operator-file": "operator-file";
+        }>;
+        ruleReferences: z.ZodArray<z.ZodString>;
+        explicitReviewRequired: z.ZodBoolean;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const governanceEnvelopeSchema: z.ZodObject<{
+    source: z.ZodLiteral<"caller-supplied">;
+    envelopeId: z.ZodNullable<z.ZodString>;
+    patchReference: z.ZodNullable<z.ZodString>;
+    patchDigest: z.ZodNullable<z.ZodString>;
+    linkedRunReferences: z.ZodArray<z.ZodString>;
+    schemaValid: z.ZodBoolean;
+    integrity: z.ZodEnum<{
+        invalid: "invalid";
+        valid: "valid";
+    }>;
+    expiration: z.ZodEnum<{
+        current: "current";
+        expired: "expired";
+        "not-yet-valid": "not-yet-valid";
+        unknown: "unknown";
+    }>;
+    checkedAt: z.ZodISODateTime;
+    expiredApprovals: z.ZodNumber;
+    authenticity: z.ZodLiteral<"not-verified">;
+    patchBytes: z.ZodLiteral<"not-verified">;
+}, z.core.$strict>;
+/** Both readers must already be bound to the same workspace and scope as the run store. */
+export interface GovernanceSessionSource {
+    id: string;
+    index: Pick<CliSessionStore, 'get'>;
+    history?: {
+        replay(sessionId: string, after?: number): {
+            schemaVersion: 1;
+            cursorExpired: boolean;
+            hasMore?: boolean;
+            policyEvidenceIncomplete?: boolean;
+            nextCursor: number;
+            events: Array<{
+                sessionId: string;
+                runId: string;
+                sequence: number;
+                activity: Record<string, unknown>;
+            }>;
+        };
+    };
+}
+export declare function readGovernanceSession(source: GovernanceSessionSource | undefined, rootRunId: string, runIds: ReadonlySet<string>): Promise<{
+    session: {
+        availability: "recorded" | "unavailable";
+        reference: string | null;
+        revision: number | null;
+    };
+    history: {
+        availability: "recorded" | "unavailable";
+        retention: "expired" | "retained" | "unknown";
+        incomplete: boolean;
+        policyDecisions: {
+            runReference: string;
+            sequence: number;
+            toolReference: string;
+            phase: "approval-request" | "tool-entry";
+            decision: "allow" | "ask_user" | "deny";
+            policyDigest: string | null;
+            source: "application" | "baseline" | "operator-file";
+            ruleReferences: string[];
+            explicitReviewRequired: boolean;
+        }[];
+    };
+    verify: () => Promise<void>;
+}>;
+/** Envelopes are references supplied by the caller, never inferred signatures or executed checks. */
+export declare function projectGovernanceEnvelopes(envelopes: readonly unknown[], patches: ReadonlyMap<string, readonly string[]>, now: number): {
+    source: "caller-supplied";
+    envelopeId: string | null;
+    patchReference: string | null;
+    patchDigest: string | null;
+    linkedRunReferences: string[];
+    schemaValid: boolean;
+    integrity: "invalid" | "valid";
+    expiration: "current" | "expired" | "not-yet-valid" | "unknown";
+    checkedAt: string;
+    expiredApprovals: number;
+    authenticity: "not-verified";
+    patchBytes: "not-verified";
+}[];