agent-control-plane-core 0.5.2 → 0.6.0

package/src/index.mjs

@@ -21,7 +21,11 @@ export * from "./control-plane.mjs";
 export { claudeAdapter, HookEvent } from "./adapters/claude.mjs";
 export { codexAdapter } from "./adapters/codex.mjs";
 export { ampAdapter } from "./adapters/amp.mjs";
-export { geminiAdapter, GEMINI_TOOL_ALIASES } from "./adapters/gemini.mjs";
+export {
+  geminiAdapter,
+  GEMINI_TOOL_ALIASES,
+  POST_TOOL_REDACTION_UNSUPPORTED,
+} from "./adapters/gemini.mjs";
 export {
   ADAPTERS,
   AGENT_IDS,

package/types/adapters/amp.d.mts

@@ -5,10 +5,14 @@
 export function parse(native: any): ToolCallEvent;
 /**
  * Render into Amp's pure exit-code transport: the decision is the exit code,
- * with no stdout body. `reason` has no native channel here, so it is dropped
- * (Amp surfaces the helper's own stderr). No `soleGate` option — an allow
- * already renders as exit 0 either way, so there's no distinct "real approve"
- * signal for this transport to opt into.
+ * with no stdout body. An ENFORCED deny also carries its `reason` on
+ * `NativeResponse.stderr`, which `emit` writes to fd 2: the delegate is a PATH
+ * helper whose stderr Amp surfaces, and this render is what that helper writes,
+ * so a block that reached the user with no rationale was the adapter throwing
+ * the reason away. Only the enforced path — a deny this call cannot veto and an
+ * ask have blocked nothing, and `stderr` is the contract's block-reason channel.
+ * No `soleGate` option — an allow already renders as exit 0 either way, so
+ * there's no distinct "real approve" signal for this transport to opt into.
  * @param {Verdict} verdict
  * @param {ToolCallEvent} event
  * @returns {NativeResponse}
@@ -16,8 +20,8 @@ export function parse(native: any): ToolCallEvent;
 export function render(verdict: Verdict, event: ToolCallEvent): NativeResponse;
 /** @typedef {import("../control-plane.mjs").ToolCallEvent} ToolCallEvent */
 /** @typedef {import("../control-plane.mjs").Verdict} Verdict */
-/** @typedef {import("../control-plane.mjs").EventMeta} EventMeta */
 /** @typedef {import("../control-plane.mjs").NativeResponse} NativeResponse */
+/** @typedef {import("../control-plane.mjs").EventMeta} EventMeta */
 export const AGENT: "amp";
 export const INTEGRATION_MODE: "external_hook";
 /**
@@ -27,12 +31,50 @@ export const INTEGRATION_MODE: "external_hook";
  * gates calls inside subagents — so builtin, MCP, and subagent are all COVERED.
  * Resumed-thread firing is a strong-but-uncited structural argument, so it is
  * held at UNKNOWN until an item-⑤ probe confirms it.
+ *
+ * That UNKNOWN is this adapter's own fail-closed reading, NOT a transcription of
+ * the matrix cell, which reads `✅ struct. [A4]` — COVERED, on evidence the
+ * `struct.` suffix marks as uncited. A cell is a CEILING: an adapter may never
+ * claim more than it, but declaring LESS is always safe, since every step down
+ * degrades a deny toward notify. This row takes that conservative option until a
+ * probe cites it; Claude's takes the cell at face value on the same class of
+ * argument. The difference is free today, for the reason below.
+ *
+ * The row is DECLARATIVE ONLY either way: no host marks a lone tool event as
+ * belonging to a resumed session, so {@link classifyCallClass} never returns
+ * RESUMED and `parse` never reads the entry — a call in a resumed thread is
+ * classified by its TOOL, BUILTIN or MCP, and both are COVERED, so it parses
+ * vetoable. (The SUBAGENT row is reachable — the classifier answers it for a
+ * payload carrying `agent_type` — but Amp's subagent coverage is COVERED too,
+ * so it changes nothing here either.) The entry is there for a consumer reading
+ * COVERAGE directly, and becomes load-bearing only once a signal exists.
  */
 /** @type {import("../control-plane.mjs").CoverageMap} */
 export const COVERAGE: import("../control-plane.mjs").CoverageMap;
+/**
+ * The native event a conformance probe should carry for each kind — this
+ * adapter's own answer, so an every-kind probe exercises the branch that kind
+ * really takes. Amp's observer names every event `delegate` and reaches no
+ * other kind.
+ * @type {Record<string, string|undefined>}
+ */
+export const NATIVE_EVENT_FOR: Record<string, string | undefined>;
+/**
+ * Which {@link VERDICT_CONTENT_FIELDS} have no native channel, so `render`
+ * drops them. Amp's transport is the exit code and nothing else — there is no
+ * stdout body to carry a replacement input, a replacement output or extra
+ * context, so ALL THREE are dropped on every kind. A guardrail that needs any of
+ * them cannot use Amp as its only integration. `reason` is not one of them and
+ * is NOT dropped: an enforced deny writes it to the helper's stderr, which Amp
+ * surfaces (see {@link render}). Built over every
+ * {@link EventKind} rather than the one `parse` emits: a row this adapter cannot
+ * reach is still the honest answer for a caller that asks.
+ * @type {Record<string, ReadonlySet<string>|undefined>}
+ */
+export const UNRENDERED_FIELDS: Record<string, ReadonlySet<string> | undefined>;
 /** @type {import("../control-plane.mjs").Adapter} */
 export const ampAdapter: import("../control-plane.mjs").Adapter;
 export type ToolCallEvent = import("../control-plane.mjs").ToolCallEvent;
 export type Verdict = import("../control-plane.mjs").Verdict;
-export type EventMeta = import("../control-plane.mjs").EventMeta;
 export type NativeResponse = import("../control-plane.mjs").NativeResponse;
+export type EventMeta = import("../control-plane.mjs").EventMeta;

package/types/adapters/claude.d.mts

@@ -26,8 +26,8 @@ export function render(verdict: Verdict, event: ToolCallEvent, { soleGate }?: {
 }): NativeResponse;
 /** @typedef {import("../control-plane.mjs").ToolCallEvent} ToolCallEvent */
 /** @typedef {import("../control-plane.mjs").Verdict} Verdict */
-/** @typedef {import("../control-plane.mjs").EventMeta} EventMeta */
 /** @typedef {import("../control-plane.mjs").NativeResponse} NativeResponse */
+/** @typedef {import("../control-plane.mjs").EventMeta} EventMeta */
 /** Producing-agent id stamped onto every event this adapter parses. */
 export const AGENT: "claude";
 /** How this adapter attaches to the agent. */
@@ -37,10 +37,34 @@ export const INTEGRATION_MODE: "external_hook";
  * for builtins, for MCP tools (surfaced as `mcp__<server>__<tool>` through the
  * same hook), and for every tool a subagent uses (subagents do not inherit the
  * parent's permissions, so the hook is often their only gate). Resumed sessions
- * re-read hooks from settings and fire per new call — structural, uncontested.
+ * re-read hooks from settings and fire per new call — `✅ struct. [C4]`, where
+ * the `struct.` suffix marks the status as uncited: no source addresses resumed
+ * sessions directly, and COVERED is an inference from the reload mechanism. This
+ * row takes the cell at face value. Amp holds the equivalent row at UNKNOWN,
+ * which the matrix permits — a cell is a ceiling, and declaring less coverage
+ * than it is always the safe direction. Both are free today, since
+ * `classifyCallClass` never returns RESUMED and no call is judged by this entry.
  */
 /** @type {import("../control-plane.mjs").CoverageMap} */
 export const COVERAGE: import("../control-plane.mjs").CoverageMap;
+/**
+ * Which {@link VERDICT_CONTENT_FIELDS} have no native channel on each event
+ * kind, so `render` drops them. Claude Code splits its content channels by
+ * event: `updatedInput` exists only on PreToolUse (the call has not run yet),
+ * and `updatedToolOutput` only on PostToolUse (there is no tool output to
+ * replace anywhere else). `additionalContext` is the one channel every kind
+ * carries. The conformance harness holds this to what `render` actually emits,
+ * in both directions.
+ *
+ * `additionalContext` on PreToolUse is inherited behaviour, not a checked claim:
+ * Claude Code documents the field for UserPromptSubmit, SessionStart and
+ * PostToolUse, and this adapter has emitted it on PreToolUse since before the
+ * declaration existed. Rule ⑩ can see that the value reaches the wire, never
+ * that the host reads the key — confirm it against the hook reference before
+ * relying on it.
+ * @type {Record<string, ReadonlySet<string>|undefined>}
+ */
+export const UNRENDERED_FIELDS: Record<string, ReadonlySet<string> | undefined>;
 /** Claude Code native hook event names (the `hook_event_name` field). */
 export const HookEvent: Readonly<{
     PRE_TOOL_USE: "PreToolUse";
@@ -48,9 +72,16 @@ export const HookEvent: Readonly<{
     USER_PROMPT_SUBMIT: "UserPromptSubmit";
     SESSION_START: "SessionStart";
 }>;
+/**
+ * The native event a conformance probe should carry for each kind — this
+ * adapter's own answer, so an every-kind probe exercises the branch that kind
+ * really takes. `unknown` has no native name by definition and is absent.
+ * @type {Record<string, string|undefined>}
+ */
+export const NATIVE_EVENT_FOR: Record<string, string | undefined>;
 /** @type {import("../control-plane.mjs").Adapter} */
 export const claudeAdapter: import("../control-plane.mjs").Adapter;
 export type ToolCallEvent = import("../control-plane.mjs").ToolCallEvent;
 export type Verdict = import("../control-plane.mjs").Verdict;
-export type EventMeta = import("../control-plane.mjs").EventMeta;
 export type NativeResponse = import("../control-plane.mjs").NativeResponse;
+export type EventMeta = import("../control-plane.mjs").EventMeta;

package/types/adapters/codex.d.mts

@@ -27,15 +27,20 @@ export function canEnforce(version: unknown): boolean;
  */
 export function parse(native: any): ToolCallEvent;
 /**
- * Render into Codex's native external-hook transport: a `hookSpecificOutput`
- * body preserving the native event name (`PreToolUse`/`PermissionRequest`) plus
- * exit 2 on an enforceable deny. On a pre-v0.135 Codex (`this_call_vetoable`
- * false) the body still renders but exit stays 0 and `enforced` is false —
- * advisory only.
+ * Render into Codex's native external-hook transport: a JSON body preserving the
+ * native event name (`PreToolUse`/`PermissionRequest`/`PostToolUse`) plus exit 2
+ * on an enforceable deny. On a pre-v0.135 Codex (`this_call_vetoable` false) the
+ * body still renders but exit stays 0 and `enforced` is false — advisory only.
+ *
+ * The two kinds use DIFFERENT native shapes, because Codex does: a pre-tool
+ * decision rides `hookSpecificOutput.permissionDecision`, a post-tool one the
+ * top-level `decision`/`reason` pair (`permissionDecision` is accepted but inert
+ * on PostToolUse, so emitting it there would read as a block that never bites).
  *
  * `soleGate` (default `false`) is the same dangerous, explicit opt-in as the
  * Claude adapter: when `true` AND the verdict is `allow`, the render emits the
- * real `permissionDecision: "allow"` instead of abstaining.
+ * real `permissionDecision: "allow"` instead of abstaining. It has no meaning
+ * post-tool — there is no approval left to grant — so it is ignored there.
  * @param {Verdict} verdict
  * @param {ToolCallEvent} event
  * @param {{ soleGate?: boolean }} [options]
@@ -46,25 +51,72 @@ export function render(verdict: Verdict, event: ToolCallEvent, { soleGate }?: {
 }): NativeResponse;
 /** @typedef {import("../control-plane.mjs").ToolCallEvent} ToolCallEvent */
 /** @typedef {import("../control-plane.mjs").Verdict} Verdict */
-/** @typedef {import("../control-plane.mjs").EventMeta} EventMeta */
 /** @typedef {import("../control-plane.mjs").NativeResponse} NativeResponse */
+/** @typedef {import("../control-plane.mjs").EventMeta} EventMeta */
 export const AGENT: "codex";
 export const INTEGRATION_MODE: "external_hook";
 /**
  * Hook-coverage matrix row (`docs/hook-coverage-matrix.md`). `PreToolUse`
  * intercepts the shell (Bash) tool ONLY — other builtins and MCP tools never
- * reach it — so builtin is PARTIAL and MCP is UNCOVERED. Subagent and resumed
- * firing are undocumented ⇒ UNKNOWN (treated as uncovered until an item-⑤ probe
- * proves otherwise).
+ * reach it — so builtin is PARTIAL and MCP is UNCOVERED. A live probe
+ * ([X3]/[X4]) fired `PreToolUse` for a SUBAGENT's call and for a call in a
+ * RESUMED session, so both are PARTIAL too: covered, under the same Bash-only
+ * limit as [X1], rather than the ❓ the matrix carried before the probe ran.
+ *
+ * These rows describe PRE-TOOL routing, which is the only thing the matrix's
+ * [X1]/[X2] sources speak about. `parse` applies them to a pre-tool event only
+ * (see {@link vetoableCall}); Codex's `PostToolUse` fires for tools `PreToolUse`
+ * never sees, so a post-tool event judged by the MCP row would drop a block
+ * Codex documents it honours.
+ *
+ * The SUBAGENT row is the one the classifier now reaches on this host: the same
+ * probe found `agent_id`/`agent_type` present on a subagent's `PreToolUse`
+ * payload and ABSENT on the main thread's, so {@link classifyCallClass} answers
+ * SUBAGENT from that payload alone. It is PARTIAL, so such a call stays vetoable
+ * — the row's job here is to be honest, not to degrade. An MCP-named call takes
+ * the UNCOVERED MCP row either way, subagent or not.
+ *
+ * The RESUMED row is DECLARATIVE ONLY, for a reason no longer about coverage: a
+ * resumed session announces itself on `SessionStart` (`source: "resume"`), not on
+ * its tool payloads, and this package keeps no cross-event state — so the
+ * classifier cannot answer RESUMED from a lone pre-tool event and such a call is
+ * judged by the row its TOOL selects. Both rows are PARTIAL, so that reads the
+ * same either way.
  */
 /** @type {import("../control-plane.mjs").CoverageMap} */
 export const COVERAGE: import("../control-plane.mjs").CoverageMap;
+/**
+ * Which {@link VERDICT_CONTENT_FIELDS} have no native channel on each kind, so
+ * `render` drops them. Codex splits its two content channels by event:
+ * `updatedInput` exists only on PreToolUse (the call has not run yet), and
+ * `hookSpecificOutput.additionalContext` only on PostToolUse — Codex documents
+ * no context field on PreToolUse, where `updatedInput` is the whole surface.
+ *
+ * NEITHER kind can rewrite tool output: PostToolUse "can't undo side effects
+ * from a tool that already ran", and Codex rejects `updatedMCPToolOutput`, so
+ * `mutated_output` is dropped everywhere. A redaction verdict therefore does NOT
+ * reach the model here: the unredacted output stands, and a guardrail that must
+ * redact has to deny (post-tool, that blocks the turn rather than un-showing the
+ * output). Inventing a native key would be worse than the visible gap, because
+ * the host ignores it and the caller reads the render as a redaction applied.
+ * @type {Record<string, ReadonlySet<string>|undefined>}
+ */
+export const UNRENDERED_FIELDS: Record<string, ReadonlySet<string> | undefined>;
 /** Minimum Codex version whose hook can actually veto a tool call. */
 export const MIN_ENFORCING_VERSION: readonly number[];
+/**
+ * The native event a conformance probe should carry for each kind — this
+ * adapter's own answer, so an every-kind probe exercises the branch that kind
+ * really takes. `pre_tool` names `PreToolUse` rather than `PermissionRequest`
+ * because that is the branch a synthesized probe should take; `unknown` has no
+ * native name by definition and is absent.
+ * @type {Record<string, string|undefined>}
+ */
+export const NATIVE_EVENT_FOR: Record<string, string | undefined>;
 export const DEFAULT_DENY_REASON: "blocked by monitor";
 /** @type {import("../control-plane.mjs").Adapter} */
 export const codexAdapter: import("../control-plane.mjs").Adapter;
 export type ToolCallEvent = import("../control-plane.mjs").ToolCallEvent;
 export type Verdict = import("../control-plane.mjs").Verdict;
-export type EventMeta = import("../control-plane.mjs").EventMeta;
 export type NativeResponse = import("../control-plane.mjs").NativeResponse;
+export type EventMeta = import("../control-plane.mjs").EventMeta;

package/types/adapters/gemini.d.mts

@@ -29,8 +29,8 @@ export function render(verdict: Verdict, event: ToolCallEvent, { soleGate }?: {
 }): NativeResponse;
 /** @typedef {import("../control-plane.mjs").ToolCallEvent} ToolCallEvent */
 /** @typedef {import("../control-plane.mjs").Verdict} Verdict */
-/** @typedef {import("../control-plane.mjs").EventMeta} EventMeta */
 /** @typedef {import("../control-plane.mjs").NativeResponse} NativeResponse */
+/** @typedef {import("../control-plane.mjs").EventMeta} EventMeta */
 export const AGENT: "gemini";
 export const INTEGRATION_MODE: "external_hook";
 /**
@@ -38,17 +38,66 @@ export const INTEGRATION_MODE: "external_hook";
  * builtins on v0.26+ (COVERED). MCP routing through the same matcher is only
  * MEDIUM-confidence and unproven, subagent firing for a loaded agent is
  * undocumented, and resumed-session behavior has no source — all three are
- * UNKNOWN, held at fail-closed until an item-⑤ probe upgrades them. A guessed ✅
- * here would be a silent fail-open.
+ * UNKNOWN. A guessed ✅ here would be a silent fail-open.
+ *
+ * Only the MCP row is fail-closed in practice: `parse` reads it, because
+ * {@link classifyCallClass} detects MCP from the tool name or `mcp_context`.
+ * The SUBAGENT row answers only for a payload carrying a non-empty `agent_type`
+ * ({@link classifyCallClass}); Gemini CLI documents no such field, so a
+ * subagent's call is judged today by the row its TOOL selects — BUILTIN
+ * (COVERED, i.e. vetoable), or the MCP row above when the name or `mcp_context`
+ * says so. The RESUMED row has no signal at all and is DECLARATIVE ONLY. Both
+ * record the matrix verdict for a consumer reading COVERAGE directly; the
+ * subagent one starts biting the moment a payload names an agent, which is what
+ * an item-⑤ probe of [G3] would establish.
  */
 /** @type {import("../control-plane.mjs").CoverageMap} */
 export const COVERAGE: import("../control-plane.mjs").CoverageMap;
+/**
+ * Which {@link VERDICT_CONTENT_FIELDS} have no native channel on each event
+ * kind, so `render` drops them. Gemini CLI documents
+ * `hookSpecificOutput.tool_input` on BeforeTool, `systemMessage` on the tool
+ * events and `hookSpecificOutput.additionalContext` on BeforeAgent. It documents
+ * NO AfterTool output-rewrite field, so `mutated_output` is dropped on every
+ * kind. `mutated_input` is dropped everywhere
+ * but BeforeTool: the tool has already run by AfterTool, and BeforeAgent has no
+ * tool input at all, so emitting `tool_input` there names a channel the host
+ * ignores while reading to the caller as a mutation applied.
+ *
+ * ALLOW path only. The enforced-deny branch of `render` returns no stdout at
+ * all, so a deny drops `additional_context` too, on every kind — these rows do
+ * not describe it.
+ *
+ * AfterTool is GATED here, so a redaction verdict does reach this adapter and
+ * cannot be honoured. It renders {@link POST_TOOL_REDACTION_UNSUPPORTED} on
+ * `systemMessage` instead, so the model is told the output above it is
+ * unredacted rather than left to read it as vetted. The raw output still reaches
+ * the model; a guardrail that must actually redact has to deny.
+ * @type {Record<string, ReadonlySet<string>|undefined>}
+ */
+export const UNRENDERED_FIELDS: Record<string, ReadonlySet<string> | undefined>;
+/**
+ * What the model is told when a verdict redacts an AfterTool output Gemini has
+ * no channel to replace. Exported so a caller composing its own `systemMessage`
+ * can recognize it; recognize it with `endsWith`, never equality, because a
+ * verdict carrying `additional_context` too puts that context first (see
+ * {@link decisionBody}).
+ */
+export const POST_TOOL_REDACTION_UNSUPPORTED: string;
 /** Gemini CLI native hook event names (the `hook_event_name` field). */
 export const HookEvent: Readonly<{
     BEFORE_TOOL: "BeforeTool";
     AFTER_TOOL: "AfterTool";
     BEFORE_AGENT: "BeforeAgent";
 }>;
+/**
+ * The native event a conformance probe should carry for each kind — this
+ * adapter's own answer, so an every-kind probe exercises the branch that kind
+ * really takes. `session_start` and `unknown` have no Gemini event and are
+ * absent.
+ * @type {Record<string, string|undefined>}
+ */
+export const NATIVE_EVENT_FOR: Record<string, string | undefined>;
 /**
  * Adapter-scoped native-builtin → canonical tool aliases, applied ONLY when a
  * call classifies as BUILTIN. These names are too generic for the global
@@ -58,10 +107,11 @@ export const HookEvent: Readonly<{
  * `mcp_{server}_{tool}` name (gemini-cli docs/tools/mcp-server.md), so a bare
  * builtin name in `tool_name` can only be the builtin. Renaming the tool also
  * renames its INPUT to the schema that name advertises, via
- * {@link GEMINI_INPUT_ALIASES} — a consumer told `event.tool` is `Read` reads
- * `input.file_path` and finds it, rather than reading `undefined` off a
- * forwarded `absolute_path` and allowing. Targets are pinned to
- * {@link MODELED_TOOLS} at import, every entry must be witnessed by a gemini
+ * {@link GEMINI_INPUT_ALIASES}, and the rename must actually produce that key or
+ * the call keeps its native name (see {@link geminiCall}) — a consumer told
+ * `event.tool` is `Read` reads `input.file_path` and finds it, rather than
+ * reading `undefined` off a forwarded `absolute_path` and allowing. Targets are
+ * pinned to {@link MODELED_TOOLS} at import, every entry must be witnessed by a gemini
  * conformance fixture (`assertToolAliasesCovered`), and every aliased case must
  * carry the canonical input key (`assertAliasedInputsCanonical`).
  * @type {Readonly<Record<string, string>>}
@@ -71,5 +121,5 @@ export const GEMINI_TOOL_ALIASES: Readonly<Record<string, string>>;
 export const geminiAdapter: import("../control-plane.mjs").Adapter;
 export type ToolCallEvent = import("../control-plane.mjs").ToolCallEvent;
 export type Verdict = import("../control-plane.mjs").Verdict;
-export type EventMeta = import("../control-plane.mjs").EventMeta;
 export type NativeResponse = import("../control-plane.mjs").NativeResponse;
+export type EventMeta = import("../control-plane.mjs").EventMeta;

package/types/conformance.d.mts

@@ -97,13 +97,27 @@ export function assertAliasedInputsCanonical(fixturesList: any[], assert: any):
  *      throwing away the objection entirely. The strongest honest signal a
  *      transport has left — an ask, an advisory body — must survive. An
  *      OBSERVE_ONLY render is exempt: it has no pre-emption channel to differ in.
+ *   9. drift honesty: `parse` must ANSWER an event name no host emits with
+ *      EventKind.UNKNOWN rather than throw, and a deny rendered on that answer
+ *      must not claim a block. Probed on a synthesized payload, since an adapter
+ *      whose parse can never emit UNKNOWN has no such fixture to write.
+ *  10. content-channel honesty: for every parsed event, each Verdict content
+ *      field (mutated_input, mutated_output, additional_context) either reaches
+ *      the host's wire or is DECLARED unreachable in the adapter's
+ *      UNRENDERED_FIELDS — and the render must agree with the declaration in
+ *      both directions. Without it an adapter with no channel for a field just
+ *      ignored it, so a redaction verdict rendered a bare allow and the
+ *      unredacted output reached the model with nothing saying so. The fields
+ *      that DID reach a wire come back as `contentFieldsSeen`; a suite covering
+ *      several adapters asserts their union to keep the positive half of the
+ *      rule non-vacuous, since no single host has a channel for all three.
  *
  * `assert` is injected (node:assert/strict) so the harness stays test-framework
  * neutral; it throws on the first mismatch. Returns a summary the caller can
  * assert further on.
  *
  * @param {{ adapter: import("./control-plane.mjs").Adapter, fixtures: any, assert: any }} args
- * @returns {{ cases: number, renders: number, decisionsSeen: Set<string>, mutationSeen: boolean, enforcedDenySeen: boolean, vetoableDenySeen: boolean, unknownKindSeen: boolean, coverageClassesChecked: Set<string>, unenforceableDenyChecks: number }}
+ * @returns {{ cases: number, renders: number, decisionsSeen: Set<string>, mutationSeen: boolean, contentFieldsSeen: Set<string>, enforcedDenySeen: boolean, vetoableDenySeen: boolean, unknownKindSeen: boolean, coverageClassesChecked: Set<string>, unenforceableDenyChecks: number }}
  */
 export function runAdapterConformance({ adapter, fixtures, assert }: {
     adapter: import("./control-plane.mjs").Adapter;
@@ -114,6 +128,7 @@ export function runAdapterConformance({ adapter, fixtures, assert }: {
     renders: number;
     decisionsSeen: Set<string>;
     mutationSeen: boolean;
+    contentFieldsSeen: Set<string>;
     enforcedDenySeen: boolean;
     vetoableDenySeen: boolean;
     unknownKindSeen: boolean;