dsh-completion-guard 0.5.2 → 0.6.0

package/dist/{index-BTaiOcE-.d.ts → index-BJPVGdg9.d.ts}

@@ -18,6 +18,13 @@ declare function sanitizeUrl(value: string): string;
 //#region src/domain/protocol-manifest.d.ts
 declare const STOP_PROTOCOL_VERSION = "2.0.0";
 declare const CERTIFICATE_VERSION = "1";
+/**
+* 0.6.0 v5-session identity (P0 §1): v2 certificates bind a work unit's
+* closure instead of the whole session. Version-1 identity keeps its
+* historical meaning for legacy sessions and is never silently re-read.
+*/
+declare const STOP_PROTOCOL_VERSION_V2 = "3.0.0";
+declare const CERTIFICATE_VERSION_V2 = "2";
 declare const ACTION_MANIFEST_VERSION = 1;
 declare const SUPPORTED_EVIDENCE_ADAPTERS: Readonly<Record<string, string>>;
 declare const SEMANTIC_ACTIONS: readonly ["inspect_remote_updates", "install", "apply", "create", "modify", "test", "verify", "pull", "fetch", "commit", "push", "restart", "publish", "generic_run"];
@@ -43,10 +50,29 @@ declare function semanticActionFromCommand(command: string): SemanticAction;
 declare function isStatefulAction(action: SemanticAction): action is StatefulAction;
 declare function actionCompatible(required: SemanticAction, observed: SemanticAction): boolean;
 declare function validateActionTarget(action: SemanticAction, resolved: TargetTuple | undefined, observed: TargetTuple | undefined): boolean;
+/** The single identity field a root instruction must name for this action. */
+declare function requestedIdentityKey(action: SemanticAction): string | undefined;
+/**
+* The 0.6.0 bounded file-choice vocabulary (C07/S03): artifact-type nouns a
+* root instruction may use instead of an exact path. The assistant may pick
+* the exact file INSIDE the captured scope and inside the type, and the
+* choice is frozen by the resolution producer before any effect. An absent
+* extension set (`file`) admits any file the producer accepts.
+*/
+declare const BOUNDED_ARTIFACT_TYPES: Readonly<Record<string, ReadonlySet<string> | null>>;
+/**
+* Whether a bounded-choice requested target authorizes this resolved target:
+* the resolved artifact must live inside the captured scope and match the
+* captured type. The exact file name is the assistant's bounded decision,
+* frozen by resolution — never a root-named identity substitution.
+*/
+declare function boundedArtifactChoiceMatches(action: SemanticAction, requested: TargetTuple | undefined, resolved: TargetTuple | undefined): boolean;
 /**
 * Compare identities captured from the root instruction with a complete
 * adapter-resolved target. Requested targets are partial by design: only
 * explicitly named identities (plus the active repository scope) are frozen.
+* A bounded artifact choice (scope + type, C07) matches when the resolved
+* exact file is inside the scope and of the captured type.
 */
 declare function requestedTargetMatchesResolved(action: StatefulAction, requested: TargetTuple | undefined, resolved: TargetTuple | undefined): boolean;
 /** A mutation requires every user-selectable identity field, not a partial match. */
@@ -247,6 +273,153 @@ declare function replayRebindResult(p: GuardProjection, args: RebindArgs, record
 * caller processes the remaining text afterwards with its own semantics. */
 declare function confirmRebind(p: GuardProjection, proposalId: string, eventId: string, durable: boolean): boolean;
 //#endregion
+//#region src/domain/release.d.ts
+declare const RELEASE_OPERATIONS: readonly ["npm_publish", "git_tag", "github_release_create", "github_release_update", "github_release_delete", "composite_runner"];
+type ReleaseOperation = (typeof RELEASE_OPERATIONS)[number];
+/**
+* The candidate identity a release contract freezes. Each field names exactly
+* one measurable identity; all are optional except the full commit, because a
+* contract that names nothing cannot be checked against anything.
+*/
+interface ReleaseCandidate {
+  /** The commit the artifact was built from (the artifact's embedded gitHead). */
+  fullSha40: string;
+  /** The ref that commit must be on, when the surface can observe a ref. */
+  ref?: string;
+  /** Repository identity (owner/name or clone URL). */
+  repository?: string;
+  /** Package or artifact name. */
+  packageId?: string;
+  /** Exact released version. */
+  version?: string;
+  /** SHA-256 of the exact artifact bytes (64 lowercase hex). */
+  artifactSha256?: string;
+  /** npm integrity of the exact artifact bytes (`sha512-<base64>`). */
+  artifactSri?: string;
+  /** The registry the artifact is published to (canonical base URL). */
+  registry?: string;
+}
+interface ReleaseContract {
+  contractId: string;
+  adoptedBy: {
+    seq: number;
+    digest: string;
+  };
+  /**
+  * The contract revision the candidate scope was FROZEN at. The closure
+  * certificate must be the one that certified exactly this revision: a later
+  * obligation (including the release instruction itself) does not invalidate
+  * the accepted candidate, while a certificate minted after the adoption — or
+  * a candidate whose content moved on — is refused.
+  */
+  adoptedAtRevision: number;
+  operations: ReleaseOperation[];
+  candidate: ReleaseCandidate;
+  readinessRefs: string[];
+  closureCertRef?: string;
+  /**
+  * The closure certificate as it existed AT ADOPTION, frozen by identity.
+  *
+  * Comparing only the revision let a log entry ADD the certificate after the
+  * adoption and still ratify it: the adoption would be validated by evidence
+  * that did not exist when it was made. Freezing the certification digest (and
+  * its epoch/revision) pins the exact certificate the adopter relied on, so a
+  * certificate that appears later — even one that reuses the same id — is
+  * refused. Absent means the adopter named a closure that did not exist yet,
+  * which is equally refused: a later log entry can never supply it.
+  */
+  frozenClosure?: {
+    id: string;
+    certificationDigest: string;
+    epoch: number;
+    contractRevision: number;
+  };
+  expiresAtEpochMs?: number;
+  /** Durable root revocation; the record is kept for audit, never deleted. */
+  revokedAtSeq?: number;
+}
+interface ReleaseReservation {
+  contractId: string;
+  operation: ReleaseOperation;
+  callId: string;
+  startedAtSeq: number;
+  status: "in_flight";
+  /**
+  * The npm SRI the trusted producer read when the reservation was written.
+  * Recorded so a contract that froze only the byte SHA-256 can still be
+  * reconciled by a registry readback: without it, a SHA-256-only contract
+  * would be permanently unsettleable.
+  */
+  observedArtifactSri?: string;
+}
+type ReleaseOutcome = "settled" | "unconfirmed" | "unknown" | "failed" | "not_effected";
+interface ReleaseSettlement {
+  contractId: string;
+  operation: ReleaseOperation;
+  callId: string;
+  settledAtSeq: number;
+  /** A trusted readback identity, or the reason no producer exists. */
+  readback: {
+    kind: "npm_integrity" | "git_ref" | "github_release";
+    identity: string;
+  } | "unavailable";
+  outcome: ReleaseOutcome;
+}
+/**
+* The identity a trusted producer observed for the candidate. Every field is
+* optional because a given surface can observe only some of them; a field the
+* contract declares but the producer does not observe is a refusal, never a
+* silent pass.
+*/
+interface ReleaseObservedIdentity {
+  fullSha40?: string;
+  /** The ref NAME the candidate is expected to be on. */
+  ref?: string;
+  /** The commit that ref resolves to, read by the audited git producer. */
+  refSha?: string;
+  repository?: string;
+  packageId?: string;
+  version?: string;
+  artifactSha256?: string;
+  artifactSri?: string;
+  registry?: string;
+}
+interface ReleaseGateDecision {
+  status: "granted" | "denied";
+  reasonCode: string;
+  contractId?: string;
+}
+//#endregion
+//#region src/domain/host-selection.d.ts
+/**
+* Trusted host-native selection adapter (0.6.0 DS06-D, C07/S06).
+*
+* Only a PAIRED durable tool round-trip can form a trusted user selection:
+* a `tool/call` whose arguments pose a question with explicit options, and
+* its successful `tool/result` carrying the answer, bound by the same
+* callId in the same session. Pasted answer text, a model restatement, or
+* the answer of another call can never form a selection. Path selections
+* and sandbox approvals are separate facts and are recorded separately.
+*
+* The question tool's name is a host tool-bundle surface: the adapter
+* matches a bounded allowlist supplied by the caller (production wires the
+* names audited for the running cohort; native acceptance pins them).
+*/
+interface TrustedSelection {
+  callId: string;
+  /** Sequence of the tool/result event that settled the selection. */
+  resultSeq: number;
+  turn: number | undefined;
+  toolName: string;
+  questionId: string | undefined;
+  question: string | undefined;
+  options: string[];
+  /** The answer the user actually chose, verbatim from the paired result. */
+  selected: string;
+  /** A directory selection narrows where bounded file choices may land. */
+  kind: "directory" | "value";
+}
+//#endregion
 //#region src/domain/digest.d.ts
 type TypedObject = {
   k: "b" | "i" | "s" | "e" | "x";
@@ -297,7 +470,13 @@ interface PackageRow {
 //#endregion
 //#region src/domain/types.d.ts
 type GuardItemKind = "requirement" | "acceptance" | "prohibition";
-type GuardItemStatus = "pending" | "passed" | "superseded";
+/**
+* `answered` (0.6.0, C03) marks an information-slot obligation closed by a
+* trusted delivery fact: the host-confirmed final answer of a completed turn.
+* It certifies only that delivery happened — never accuracy, sufficiency, or
+* that any execution happened. Legacy sessions (no v5 boundary) never mint it.
+*/
+type GuardItemStatus = "pending" | "answered" | "passed" | "superseded";
 type GuardIntegrity = "valid" | "unknown" | "corrupt";
 type EvidenceOutcome = "success" | "failure" | "unknown" | "durability-unknown";
 type GuardOperation = "create" | "write" | "modify" | "read" | "run" | "verify";
@@ -315,6 +494,28 @@ interface GoalRef {
   id: string;
   revision: number;
 }
+/**
+* 0.6.0 source span (C01): a UTF-8 byte half-open interval `[start, end)`
+* inside the ORIGINAL root message text (before any normalization), bound to
+* that message's content digest. Offsets are byte offsets computed with
+* TextEncoder — never string indices — so Python and TypeScript agree on the
+* same positions.
+*/
+interface SourceSpan {
+  /** Index of the message part the span anchors to (0 = text). */
+  partIndex: number;
+  start: number;
+  end: number;
+  class: "instruction" | "adoption" | "question" | "constraint";
+}
+/** 0.6.0 per-message coverage summary (C01), bounded to the last 16 messages. */
+interface MessageCoverage {
+  seq: number;
+  rawTextSha256: string;
+  byteLength: number;
+  /** Number of obligation spans the message contributed to items. */
+  coveredSpans: number;
+}
 interface WaitAuthorization {
   kind: "root_explicit_wait" | "user_decision_item";
   id: string;
@@ -395,6 +596,35 @@ interface GuardItem {
   waitAuthorization?: WaitAuthorization;
   deferAuthorization?: DeferAuthorization;
   persistenceAuthorization?: PersistenceAuthorization;
+  /**
+  * 0.6.0 C01 provenance: the content digest of the original root message
+  * text and the UTF-8 byte spans inside it that this item's clause came
+  * from. Absent on legacy items, which keep their historical reading.
+  */
+  rawTextSha256?: string;
+  spans?: SourceSpan[];
+  /**
+  * 0.6.0 work-unit assignment (C04), present only for obligations captured
+  * after a v5 protocol boundary in a non-delegated session. Legacy items keep
+  * the whole-session contract and carry no unit.
+  */
+  unitId?: string;
+  /**
+  * The trusted delivery fact that closed an information-slot item: the host's
+  * completed turn and its final assistant message. Derived from durable
+  * events, never from assistant prose alone.
+  */
+  answeredBy?: {
+    turn: number;
+    responseSeq: number;
+    responseSha256: string;
+  };
+  /**
+  * 0.6.0 C08: the pending obligation this item atomically superseded through
+  * a verbatim general clarification. Audit trail only — the superseded item
+  * keeps its own history.
+  */
+  clarifiesItemId?: string;
 }
 interface GuardEvidence {
   id: string;
@@ -432,6 +662,13 @@ interface GuardEvidence {
   adapterId?: string;
   adapterVersion?: string;
   externalOperationRef?: ExternalOperation;
+  /**
+  * 0.6.0 C04: this fact came from a delegated subagent/task round-trip. A
+  * delegated result is BOUNDED evidence for the parent unit — it is recorded
+  * and visible, and it can never close a parent obligation or a parent unit
+  * by itself. Set only by the derivation, never by a caller.
+  */
+  delegatedSubtask?: true;
 }
 interface ExpectedTransition {
   predicateId: string;
@@ -482,6 +719,58 @@ interface GuardCheckpoint {
   goalRef?: GoalRef;
   certificationDigest: string;
   result: "certified" | "incomplete" | "unknown";
+  /**
+  * 0.6.0 v2 certificate (v5 sessions only): the unit whose closure was
+  * certified. Version-1 certificates keep the whole-session contract and
+  * never carry a unit.
+  */
+  unitId?: string;
+  /** v2 certificates: the digest of the certified unit's open closure. */
+  unitClosureDigest?: string;
+}
+/**
+* One 0.6.0 work unit (C04): the obligations captured from one root task and
+* their closure state. Units are derived from the durable message stream, so
+* they replay deterministically; no unit state is ever written to the log.
+*/
+interface WorkUnit {
+  unitId: string;
+  /** Sequence of the root message that opened the unit. */
+  openedAtSeq: number;
+  /** Root messages folded into this unit, in source order. */
+  rootInputRefs: Array<{
+    seq: number;
+  }>;
+  /** The normalized text of the unit's opening instruction (bounded audit). */
+  headline: string;
+  /** Sequence at which a newer unit became current, when superseded as current. */
+  switchedAwayAtSeq?: number;
+  /**
+  * The unit this one descends from. A delegation-marked root message opens a
+  * CHILD unit of the current unit (C04): the child's open obligations are part
+  * of the parent's required closure, so the parent can never be certified
+  * while a delegated sub-unit still has open work. An ordinary task switch
+  * opens a sibling instead, which is why its residual work never blocks the
+  * newer unit's certificate.
+  */
+  parentUnitId?: string;
+  /**
+  * Delegated round-trips that entered this unit as bounded evidence (C04).
+  * Recorded for audit only: a subagent's completion is never a parent
+  * completion.
+  */
+  delegationRefs?: DelegationRef[];
+}
+/** One durable delegated round-trip observed inside a session. */
+interface DelegationRef {
+  /** The tool call that requested the delegation. */
+  callId: string;
+  /** Sequence of the paired result event. */
+  resultSeq: number;
+  /** Audited delegation tool that produced the result. */
+  toolName: string;
+  /** Whether the delegated round-trip reported success. */
+  status: "completed" | "failed" | "unknown";
 }
 type BoundaryDisposition = "user_wait" | "external_wait" | "deferred" | "guard_bounded_stop";
 type BoundaryQualificationKind = "user_decision_item" | "root_explicit_wait" | "external_operation_pending" | "root_explicit_defer" | "guard_no_progress";
@@ -516,6 +805,61 @@ interface GuardProjection {
   checkpoints: GuardCheckpoint[];
   boundaries: GuardBoundary[];
   externalOperations: Map<string, ExternalOperation>;
+  /**
+  * 0.6.0 work units keyed by unit id, and the id of the unit currently
+  * receiving captured work. Derived; present only after a v5 boundary.
+  */
+  units: Map<string, WorkUnit>;
+  currentUnitId?: string;
+  /**
+  * The session's rule mode: `5` once a v5 protocol boundary exists in the log,
+  * `undefined` (legacy) before it. Determines certificate version, closure
+  * scope, and whether delivery/unit semantics are active.
+  */
+  boundaryProtocol?: 5;
+  /** 0.6.0 responsibility tier (C06), from the effective configuration. */
+  policy: "standard" | "strict" | "release";
+  /** 0.6.0 C01 coverage summaries, one per captured root message (last 16). */
+  coverage: MessageCoverage[];
+  /**
+  * 0.6.0 C10 explicit release records, derived from the durable plugin-notice
+  * channel. A release is never implicit: without an adopted contract the
+  * release gate denies every operation. A malformed record is reported through
+  * {@link releaseDiagnostics} and never makes the whole projection corrupt, so
+  * damaged release state cannot block unrelated ordinary work.
+  */
+  releaseContracts: ReleaseContract[];
+  releaseReservations: ReleaseReservation[];
+  releaseSettlements: ReleaseSettlement[];
+  /** Bounded audit of rejected release records (never raw payloads). */
+  releaseDiagnostics: Array<{
+    seq: number;
+    reasonCode: string;
+  }>;
+  /**
+  * True when a release record could not be read back. Damaged release state
+  * blocks RELEASE operations with `release_state_damaged` while leaving the
+  * projection's own integrity and all ordinary work untouched: the plugin
+  * reports what it cannot read instead of quietly forgetting it.
+  */
+  releaseStateDamaged: boolean;
+  /**
+  * 0.6.0 C07 trusted host selections, derived only from paired durable
+  * question-tool round-trips (last 16). A directory selection narrows where
+  * a bounded file choice may land for obligations of the same unit.
+  */
+  trustedSelections: TrustedSelection[];
+  /**
+  * 0.6.0 C07 sandbox approvals, derived from the host's own
+  * `approval/asked` + `approval/decided` audit pair (last 16). Recorded for
+  * provenance only: an approval is never a target authority.
+  */
+  approvals: Array<{
+    id: string;
+    seq: number;
+    toolName?: string;
+    outcome: "allowed-once" | "rejected" | "cancelled" | "unavailable";
+  }>;
   sessionRefDigest: string;
   hostLockDigest: string;
   hostStatus: HostStatus;
@@ -572,6 +916,16 @@ interface GuardProjection {
   * of the same turn re-reads the same number.
   */
   hostTurn?: number;
+  /**
+  * Runtime-owned durability watermark (0.6.0 fresh-projection contract): the
+  * result of the most recent flush performed by a public read/control entry.
+  * `confirmed` means the last entry observed a durable log, `failed` means a
+  * flush was refused or threw, and `unknown` means no flush has been observed
+  * yet. A `failed` watermark must make read entries report unavailability —
+  * never a stale-cache projection and never an empty ledger. Preserved
+  * across rebuilds like the other runtime-owned liveness state.
+  */
+  durabilityWatermark: "confirmed" | "failed" | "unknown";
   /** Log-derived count of rejected rebind attempts by stable attempt key; survives reload. */
   rebindRejections: Map<string, number>;
   integrity: GuardIntegrity;
@@ -584,6 +938,8 @@ interface DeriveScope {
 }
 interface DeriveConfig {
   activation: "opt-in" | "always";
+  /** 0.6.0 responsibility tier (C06); standard by default. */
+  policy?: "standard" | "strict" | "release";
 }
 interface DeriveResult {
   projection: GuardProjection;
@@ -597,6 +953,8 @@ interface DeriveResult {
   realRootInputSeen: boolean;
   /** True when the durable log carries the 0.5 first-step protocol boundary. */
   protocolV4Present: boolean;
+  /** True when the durable log carries the 0.6 first-step protocol boundary. */
+  boundaryV5: boolean;
 }
 interface DerivedEnvelope {
   seq: number;
@@ -1088,6 +1446,15 @@ declare function bindExecutableIdentity(resolution: ExecutableIdentity | undefin
 declare const DEFAULT_HOST_LOCK: HostLockEvaluation;
 //#endregion
 //#region src/domain/derive.d.ts
+/**
+* Audited delegation tool names (C04/DS06-B). A tool result from one of these
+* is a subagent's answer: bounded evidence for the unit that asked for it, and
+* never a parent completion. The real names are a host tool-bundle surface —
+* native acceptance pins the audited cohort, exactly like the question-tool
+* allowlist — so this list is the production default and can be overridden by
+* an audited cohort.
+*/
+declare const DEFAULT_DELEGATION_TOOL_NAMES: readonly string[];
 declare const CAPTURE_V042_NOTICE = "Context Guard capture boundary: v0.4.2";
 declare const PROTOCOL_V3_NOTICE = "Context Guard protocol boundary: v3.0.0";
 /**
@@ -1099,6 +1466,15 @@ declare const PROTOCOL_V3_NOTICE = "Context Guard protocol boundary: v3.0.0";
 */
 declare const PROTOCOL_V4_NOTICE = "Context Guard protocol boundary: v4.0.0";
 /**
+* 0.6.0 first-step boundary: same placement discipline as v4. It cuts the
+* work-unit, delivery, and certificate-v2 semantics (P0 §1): messages before
+* it keep their historical rules, messages after it are captured into work
+* units and close through unit-closure certificates and trusted deliveries.
+* An old binary ignores this notice (plugin source, unmatched pattern), so the
+* fail direction on rollback is closed, never a misread.
+*/
+declare const PROTOCOL_V5_NOTICE = "Context Guard protocol boundary: v5.0.0";
+/**
 * Pure, deterministic re-derivation of the guard projection from the DSH
 * native event log. Context Guard never writes custom session events, so every
 * piece of state is derived from `command/run`, `user/message`, `tool/call`,
@@ -1107,6 +1483,18 @@ declare const PROTOCOL_V4_NOTICE = "Context Guard protocol boundary: v4.0.0";
 */
 declare function deriveProjection(sourceEvents: readonly DerivedEnvelope[], config: DeriveConfig, scope: DeriveScope, durableConfirmed: boolean, hostLock?: HostLockEvaluation): DeriveResult;
 //#endregion
+//#region src/domain/reason-class.d.ts
+/**
+* The seven unified reason-class labels (0.6.0 C12).
+*
+* Every fine-grained `reason_code` maps onto exactly one class, so a caller can
+* branch on the class while the existing codes keep their exact meaning and
+* their existing tests. The mapping table below is the frozen table; the
+* fallback for an unmapped code is `source_insufficient`, never a new class —
+* an unknown code must not silently become a different kind of failure.
+*/
+type ReasonClass = "parameter_missing" | "source_insufficient" | "condition_unmet" | "producer_capability_unavailable" | "historical_gap" | "integrity_failure" | "policy_boundary";
+//#endregion
 //#region src/domain/diagnostics.d.ts
 type TaskKind = "inquiry" | "action" | "deliverable" | "constraint" | "unresolved";
 type CertificationSupport = "supported" | "unsupported" | "needs_target" | "needs_evidence" | "unavailable";
@@ -1127,6 +1515,8 @@ interface UnifiedItemDiagnosis {
   task_kind: TaskKind;
   certification: CertificationSupport;
   reason_code: string;
+  /** The seven-class label this fine-grained reason code belongs to (C12). */
+  reason_class: ReasonClass;
   repairability: Repairability;
   missing_fields: string[];
   missing_facets: Array<"resolution" | "effect" | "state">;
@@ -1140,6 +1530,12 @@ interface UnifiedItemDiagnosis {
 * adapter, an executed-without-evidence historical gap, or nothing to do —
 * and it NEVER recommends a rebind that cannot change certification.
 */
+/**
+* The unified diagnosis, with the frozen seven-class label attached (C12).
+*
+* The class is derived from whatever `reason_code` the judge decides, so a new
+* branch cannot drift from the classification table.
+*/
 declare function deriveItemDiagnosis(p: GuardProjection, item: GuardItem): UnifiedItemDiagnosis;
 /** Legacy compact view, now derived from the single unified diagnosis. */
 declare function itemDiagnosis(p: GuardProjection, item: GuardItem): {
@@ -1488,6 +1884,8 @@ interface FirstStepPreviewInput {
   activation: "opt-in" | "always";
   /** Log-derived enablement: an explicit `off` suppresses `always` until `on`. */
   enabled: boolean;
+  /** The durable log already contains a v5 (0.6) Guard boundary. */
+  boundaryV5Present?: boolean;
   /** The durable log already contains a v4 (or newer) Guard boundary. */
   boundaryPresent: boolean;
   /** The session is a delegated/subagent session, never a root conversation. */
@@ -1499,6 +1897,10 @@ interface FirstStepPreviewInput {
 * persisted step batch; guidance is compact and never claims a recovery that
 * did not happen. `opt-in` reaches this path only after its explicit `on` command. Delegated sessions receive neither: their
 * scope arrives through the parent's delegation prompt (A04).
+*
+* A session without a v5 boundary receives the 0.6 boundary: it cuts the
+* work-unit/delivery/certificate-v2 semantics at exactly this message. A
+* session that already has v5 injects nothing.
 */
 declare function previewFirstStepInjection(input: FirstStepPreviewInput, claimedRealInput: boolean): FirstStepInjection | undefined;
 /**
@@ -1648,6 +2050,105 @@ declare function bindProofToProjection(projection: GuardProjection, proof: Proof
 declare function canonicalProjection(projection: GuardProjection): Record<string, unknown>;
 declare function sessionQuery(projection: GuardProjection, proof?: ProofManifest): SessionQuery;
 declare function proofEvidenceConstraints(evidence: GuardEvidence, obligation: ProofObligation): boolean;
+declare const PROOF_PROTOCOL_VERSION_V2 = "0.6.0";
+/** The v2 digest domain; the v1 domain string is untouched. */
+declare const PROOF_MANIFEST_DOMAIN_V2 = "ccg.proofManifest.v2";
+declare const PROOF_KINDS_V2: readonly ["subject_readback", "scope_coverage", "state_verification", "input_asset_check", "output_visual_readback", "object_url_readback", "execution_fact", "external_fact"];
+type ProofKindV2 = (typeof PROOF_KINDS_V2)[number];
+/** Host surfaces that can carry a proof producer in the audited cohort. */
+type ProofHostSurface = "native_read" | "native_write_edit" | "shell" | "web" | "jobs" | "subagent" | "visual_capture";
+interface ProofObligationV2 {
+  obligationId: string;
+  kind: ProofKindV2;
+  surface: ProofSurface;
+  /** The current subject identities this obligation binds. */
+  subjectIds: string[];
+  /** Producer/source identities a satisfying fact must originate from. */
+  sourceIds: string[];
+  /** The operation the fact must have actually performed. */
+  operation: GuardOperation;
+  evidenceIds: string[];
+  expectedScopeDigest?: string;
+  observedScopeDigest?: string;
+}
+interface ProofManifestV2 {
+  proofProtocolVersion: typeof PROOF_PROTOCOL_VERSION_V2;
+  obligations: ProofObligationV2[];
+  proofSha256: string;
+}
+/**
+* The frozen capability requirement per proof kind. `capabilities` is the set
+* a satisfying fact must intersect; `readbackRequired` demands an actual read
+* or verify operation (never a bare successful call); `requiredRole` pins the
+* fact to the resolution/effect/state role the semantics need; and
+* `supportedSurfaces` lists the audited host surfaces that can produce it.
+*/
+interface ProofKindCapability {
+  kind: ProofKindV2;
+  capabilities: string[];
+  readbackRequired: boolean;
+  requiredRole?: EvidenceRole;
+  operationOnSubject: boolean;
+  supportedSurfaces: ProofHostSurface[];
+  /** Host surfaces in the audited cohort that CANNOT produce this fact. */
+  unavailableSurfaces: ProofHostSurface[];
+}
+declare const PROOF_CAPABILITY_MATRIX: Readonly<Record<ProofKindV2, ProofKindCapability>>;
+/** The host surface names a fact's tool/adapter identity maps to. */
+declare function proofHostSurfacesOf(evidence: GuardEvidence): ProofHostSurface[];
+declare function proofDigestV2(obligations: readonly ProofObligationV2[]): string;
+declare function createProofManifestV2(obligations: readonly ProofObligationV2[]): ProofManifestV2;
+declare function validateProofManifestV2(manifest: unknown): string[];
+/**
+* Why one fact cannot discharge one v2 obligation, or `undefined` when it can.
+* The checks are ordered so the reported reason names the first unmet
+* requirement: missing producer capability, wrong role, absent readback, wrong
+* source, wrong subject, wrong operation.
+*/
+declare function proofV2Rejection(evidence: GuardEvidence, obligation: ProofObligationV2): string | undefined;
+/**
+* The subjects an item's own obligation requires. They come from the item's
+* frozen verification contract and captured target — never from the proof
+* manifest, which is exactly what a proof must be checked against.
+*/
+declare function requiredSubjectsOf(item: GuardItem): string[];
+/** The frozen coverage digest of a subject set: sorted, then hashed. */
+declare function scopeCoverageDigest(subjects: readonly string[]): string;
+/** Whether the fact performed an operation the kind accepts. */
+declare function proofOperationMatches(evidence: GuardEvidence, obligation: ProofObligationV2): boolean;
+/**
+* Bind a v2 manifest to the live projection; [] means every obligation binds.
+*
+* The binding is the whole chain the review demanded, in one place:
+* the user's obligation (frozen subject and scope on the ITEM) → the trusted
+* producer fact (qualified by the same availability rules ordinary evidence
+* uses) → the declared source → the declared operation and its order relative
+* to the effect → the real coverage set. Only then is the obligation
+* discharged. A manifest that describes a different subject than the item
+* asked about fails even when the manifest and the facts agree with each
+* other.
+*/
+declare function bindProofV2ToProjection(projection: GuardProjection, manifest: ProofManifestV2): string[];
+/** The v2 session query; the v1 `sessionQuery` keeps its own frozen behaviour. */
+interface SessionQueryV2 {
+  sessionRefDigest: string;
+  epoch: number;
+  contractRevision: number;
+  state: "valid" | "unknown" | "corrupt";
+  proof?: ProofManifestV2;
+  cohortId?: string;
+  reasonCode?: "proof_invalid" | "proof_unbound";
+}
+declare function sessionQueryV2(projection: GuardProjection, proof?: ProofManifestV2): SessionQueryV2;
+/**
+* The capability report for one proof kind against the facts a cohort actually
+* produced: `unavailable` with a stable reason when no producer is observable,
+* never a silent pass.
+*/
+declare function proofCapabilityReport(kind: ProofKindV2, facts: Iterable<GuardEvidence>): {
+  status: "supported" | "unavailable";
+  reasonCode?: string;
+};
 //#endregion
 //#region src/domain/alpha3-host.d.ts
 /** Exact 34-row alpha.3 runtime/web graph from the 2026-09-01 annex audit. */
@@ -1856,4 +2357,4 @@ declare function latestAssistantText(events: readonly {
 //#region src/domain/supersession.d.ts
 declare function supersedeItem(items: Map<string, GuardItem>, oldId: string, replacement: GuardItem): boolean;
 //#endregion
-export { COMMAND_SURFACE_MANIFEST as $, kindOfScope as $i, bindLiveGoalCapability as $n, BindingActionClosure as $r, parsePwshCommand as $t, openItems as A, WaitAuthorization as Ai, BASE_HOST_PACKAGES as An, parseConfirmationMessage as Ar, GitCommandManifest as At, SessionQuery as B, proposeRebindV042 as Bi, HostCapabilityId as Bn, extractMethod as Br, commitTreeSnapshotDigest as Bt, RC015_RC2_HOST_PACKAGES as C, canonicalizePath as Ca, HostStatus as Ci, deriveProjection as Cn, TaskIntent as Cr, resolveActiveProfileHostLock as Ct, MIN_RECOVERY_CHAR_BUDGET as D, sanitizeUrl as Da, TargetTuple as Di, ALPHA2_DSHMARKET_139_HOST_PACKAGES as Dn, CONFIRM_LINE_PATTERN as Dr, GIT_COMMAND_TEMPLATES as Dt, DEFAULT_RECOVERY_CHAR_BUDGET as E, sanitizeClauseText as Ea, TargetCaptureStatus as Ei, ACTIVE_HOST_LAUNCHER_VERSION as En, classifyUserInteraction as Er, GIT_COMMAND_MANIFEST_IDS as Et, PROOF_PROTOCOL_VERSION as F, RebindArgs as Fi, GOAL_HOST_PACKAGES as Fn, ClauseSegment as Fr, GitPrestateCheck as Ft, proofEvidenceConstraints as G, DirectiveClass as Gi, HostLockContext as Gn, BoundaryQualification as Gr, revalidateGitPrestate as Gt, canonicalProjection as H, rebindResponse as Hi, HostCohort as Hn, isInformationalMessage as Hr, executeRevalidatedGitEffect as Ht, ProofKind as I, RebindProposal as Ii, HOST_CAPABILITY_PACKAGE_GROUPS as In, captureClause as Ir, GitPrestateEnvelope as It, EvidenceFacetCoverage as J, ScopeInterpretation as Ji, HostPlatform as Jn, GoalBoundaryAccess as Jr, CanonicalCommandSurface as Jt, sessionQuery as K, Executee as Ki, HostLockEvaluation as Kn, BoundaryRequest as Kr, verifiedLinearCommitReadback as Kt, ProofManifest as L, confirmRebind as Li, HOST_COHORTS as Ln, captureItem as Lr, GitTargetIdentity as Lt, renderRecoveryPacket as M, PackageRow as Mi, EXPECTED_HOST_PACKAGES as Mn, RejectedBinding as Mr, GitCommandRejected as Mt, ALPHA3_HOST_PACKAGES as N, BoundedSource as Ni, ExecutableIdentity as Nn, certifyCheckpoint as Nr, GitEffectExecution as Nt, RecoveryOptions as O, sha256 as Oa, TargetValue as Oi, ALPHA2_HOST_PACKAGES as On, ParsedConfirmation as Or, GitAdapterAction as Ot, PROOF_KINDS as P, ProposeOutcome as Pi, ExecutableIdentityBinding as Pn, CaptureScope as Pr, GitEffectRunner as Pt, isVerifyingCapability as Q, isOpenObligation as Qi, bindExecutableIdentity as Qn, qualifyBoundary as Qr, isRunExecutable as Qt, ProofObligation as R, proposeRebind as Ri, HostAuditProvenance as Rn, classifyClause as Rr, LinearCommitReadback as Rt, snapshotSessionEvents as S, validateActionTarget as Sa, GuardProjection as Si, PROTOCOL_V4_NOTICE as Sn, segmentAuthorityBlocks as Sr, readActiveHostGraph as St, RC1_HOST_PACKAGES as T, normalizeClause as Ta, TargetCaptureReasonCode as Ti, ACTIVE_HOST_COHORT_IDS as Tn, classifyTaskIntent as Tr, verifyComposedHostLockDump as Tt, createProofManifest as U, replayRebindResult as Ui, HostCohortSelection as Un, segmentClauses as Ur, gitCommandMatchesTarget as Ut, bindProofToProjection as V, rebindAttemptKey as Vi, HostCapabilityRequest as Vn, extractOperation as Vr, createGitPrestateEnvelope as Vt, proofDigest as W, AuthorityDisposition as Wi, HostCohortSelectionReason as Wn, BoundaryEffectuation as Wr, parseGitCommandManifest as Wt, evidenceCoverage as X, interpretMessage as Xi, HostToolSurface as Xn, effectuateBoundary as Xr, ShellParseStatus as Xt, bindingSatisfies as Y, interpretClause as Yi, HostProfileKind as Yn, availableBoundaryQualifications as Yr, ParsedShell as Yt, evidenceMatchesItem as Z, isExecutableItem as Zi, LEGACY_HOST_COHORTS as Zn, isCurrentAcceptedBoundary as Zr, canonicalArgvFromCommand as Zt, progressFingerprint as _, requestedTargetAuthorizesMutation as _a, GuardIntegrity as _i, evidenceAvailabilityReason as _n, currentContractDigest as _r, hostLockRowsFromComposedDump as _t, NO_PROGRESS_RECORD_PREFIX as a, ACTION_MANIFEST_VERSION as aa, DeriveScope as ai, ToolSubject as an, selectHostCohort as ar, FIRST_STEP_GUIDANCE as at, SessionApiError as b, semanticActionFromText as ba, GuardItemStatus as bi, CAPTURE_V042_NOTICE as bn, AuthorityKind as br, packageRowsFromActiveGraph as bt, classifyCompletionClaim as c, CERTIFICATE_VERSION as ca, EvidenceOutcome as ci, extractToolSubject as cn, LATEST_SUPPORTED_HOST_VERSION as cr, LifecyclePhase as ct, decisionBoundaryKey as d, STOP_PROTOCOL_VERSION as da, ExpectedTransition as di, CertificationSupport as dn, SUPPORTED_HOST_RANGE as dr, previewFirstStepInjection as dt, maskCodeSpans as ea, BoundaryDisposition as ei, parseShellCommand as en, evaluateExternalWaitCapability as er, CommandSurfaceManifest as et, isRootPauseRequest as f, SUPPORTED_EVIDENCE_ADAPTERS as fa, ExternalOperation as fi, DiagnosisNextAction as fn, SUPPORTED_HOST_VERSIONS as fr, ActiveProfileHostLock as ft, observeAssistantOutcome as g, isStatefulAction as ga, GuardEvidence as gi, deriveItemDiagnosis as gn, satisfiesSupportedHostRange as gr, hostLockContextFromComposedDump as gt, latestRootInstruction as h, actionCompatible as ha, GuardCheckpoint as hi, UnifiedItemDiagnosis as hn, parseHostVersion as hr, combineHostPolicy as ht, CompletionDisposition as i, ACTION_MANIFEST as ia, DeriveResult as ii, ToolResultInput as in, hostVersionFromPackages as ir, ClaimedMessage as it, recoveryDigest as j, createProjection as ji, DEFAULT_HOST_LOCK as jn, CheckpointResult as jr, GitCommandParseResult as jt, closingHint as k, VerificationContract as ki, AuditedExecutable as kn, isFrozenV042RebindResponse as kr, GitCommandAccepted as kt, decideTurnBoundary as l, SEMANTIC_ACTIONS as la, EvidenceParseStatus as li, isDeterministicCheck as ln, MIN_SUPPORTED_HOST_VERSION as lr, claimedBatchHasRealRootInput as lt, latestAssistantText as m, StatefulAction as ma, GuardBoundary as mi, TaskKind as mn, evaluateMinimumHostVersion as mr, TargetHostGraph as mt, AssistantOutcomeObservation as n, semanticActionOfScope as na, DeferAuthorization as ni, hasCurrentCertificate as nn, evaluateHostLock as nr, OperationVerbEntry as nt, NO_PROGRESS_TURNS_BEFORE_STOP as o, ActionManifest as oa, DerivedEnvelope as oi, evidenceFromPersistedToolResult as on, HostVersionDecision as or, FirstStepInjection as ot, isWholeTaskCompletionClaim as p, SemanticAction as pa, GoalRef as pi, Repairability as pn, compareHostVersions as pr, HostProfileError as pt, validateProofManifest as q, InterpretOptions as qi, HostLockStatus as qn, GoalActivationState as qr, CanonicalArgv as qt, CONTROL_RECORD_PREFIX as r, statefulActionsOfScope as ra, DeriveConfig as ri, ToolCallInput as rn, evaluateToolSurfaceCapability as rr, validateManifest as rt, TurnStoppingDecision as s, ActionSpec as sa, EvidenceBinding as si, extractTextContent as sn, HostVersionStatus as sr, FirstStepPreviewInput as st, supersedeItem as t, namedActions as ta, BoundaryQualificationKind as ti, goalCompletionDenial as tn, evaluateHostCapability as tr, ManifestIssue as tt, decideTurnStopping as u, STATEFUL_ACTIONS as ua, EvidenceRole as ui, withDurability as un, ParsedHostVersion as ur, lifecyclePhase as ut, SESSION_API_UNSUPPORTED as v, requestedTargetMatchesResolved as va, GuardItem as vi, itemDiagnosis as vn, AuthorityBlock as vr, injectActiveProfileHostLock as vt, RC015_HOST_PACKAGES as w, digestStrings as wa, PersistenceAuthorization as wi, ACTIVE_HOST_COHORT_ID as wn, UserInteractionKind as wr, resolveInstalledHostLock as wt, V3SessionLike as x, validateActionManifest as xa, GuardOperation as xi, PROTOCOL_V3_NOTICE as xn, authorityCaptureCounts as xr, packageRowsFromPnpmLock as xt, SESSION_EVENT_ENVELOPE_INVALID as y, semanticActionFromCommand as ya, GuardItemKind as yi, relevantEvidence as yn, AuthorityBlockKind as yr, inspectTargetHostGraph as yt, ProofSurface as z, proposeRebindOutcome as zi, HostCapabilityEvaluation as zn, extractArtifactPaths as zr, commitIndexSnapshotDigest as zt };
+export { canonicalProjection as $, requestedTargetAuthorizesMutation as $a, TargetTuple as $i, BASE_HOST_PACKAGES as $n, parseConfirmationMessage as $r, GitCommandRejected as $t, openItems as A, kindOfScope as Aa, DerivedEnvelope as Ai, isDeterministicCheck as An, HostVersionStatus as Ar, claimedBatchHasRealRootInput as At, ProofHostSurface as B, CERTIFICATE_VERSION as Ba, GuardEvidence as Bi, relevantEvidence as Bn, currentContractDigest as Br, inspectTargetHostGraph as Bt, RC015_RC2_HOST_PACKAGES as C, Executee as Ca, BoundaryDisposition as Ci, hasCurrentCertificate as Cn, evaluateExternalWaitCapability as Cr, OperationVerbEntry as Ct, MIN_RECOVERY_CHAR_BUDGET as D, interpretMessage as Da, DeriveConfig as Di, evidenceFromPersistedToolResult as Dn, hostVersionFromPackages as Dr, FirstStepInjection as Dt, DEFAULT_RECOVERY_CHAR_BUDGET as E, interpretClause as Ea, DelegationRef as Ei, ToolSubject as En, evaluateToolSurfaceCapability as Er, FIRST_STEP_GUIDANCE as Et, PROOF_KINDS as F, ACTION_MANIFEST as Fa, ExpectedTransition as Fi, TaskKind as Fn, SUPPORTED_HOST_VERSIONS as Fr, TargetHostGraph as Ft, ProofManifestV2 as G, STOP_PROTOCOL_VERSION_V2 as Ga, GuardOperation as Gi, PROTOCOL_V5_NOTICE as Gn, segmentAuthorityBlocks as Gr, resolveInstalledHostLock as Gt, ProofKindCapability as H, SEMANTIC_ACTIONS as Ha, GuardItem as Hi, DEFAULT_DELEGATION_TOOL_NAMES as Hn, AuthorityBlockKind as Hr, packageRowsFromPnpmLock as Ht, PROOF_KINDS_V2 as I, ACTION_MANIFEST_VERSION as Ia, ExternalOperation as Ii, UnifiedItemDiagnosis as In, compareHostVersions as Ir, combineHostPolicy as It, ProofSurface as J, StatefulAction as Ja, MessageCoverage as Ji, ACTIVE_HOST_COHORT_IDS as Jn, classifyTaskIntent as Jr, GIT_COMMAND_TEMPLATES as Jt, ProofObligation as K, SUPPORTED_EVIDENCE_ADAPTERS as Ka, GuardProjection as Ki, deriveProjection as Kn, TaskIntent as Kr, verifyComposedHostLockDump as Kt, PROOF_MANIFEST_DOMAIN_V2 as L, ActionManifest as La, GoalRef as Li, deriveItemDiagnosis as Ln, evaluateMinimumHostVersion as Lr, hostLockContextFromComposedDump as Lt, renderRecoveryPacket as M, namedActions as Ma, EvidenceOutcome as Mi, CertificationSupport as Mn, MIN_SUPPORTED_HOST_VERSION as Mr, previewFirstStepInjection as Mt, ALPHA3_HOST_PACKAGES as N, semanticActionOfScope as Na, EvidenceParseStatus as Ni, DiagnosisNextAction as Nn, ParsedHostVersion as Nr, ActiveProfileHostLock as Nt, RecoveryOptions as O, isExecutableItem as Oa, DeriveResult as Oi, extractTextContent as On, selectHostCohort as Or, FirstStepPreviewInput as Ot, PROOF_CAPABILITY_MATRIX as P, statefulActionsOfScope as Pa, EvidenceRole as Pi, Repairability as Pn, SUPPORTED_HOST_RANGE as Pr, HostProfileError as Pt, bindProofV2ToProjection as Q, requestedIdentityKey as Qa, TargetCaptureStatus as Qi, AuditedExecutable as Qn, isFrozenV042RebindResponse as Qr, GitCommandParseResult as Qt, PROOF_PROTOCOL_VERSION as R, ActionSpec as Ra, GuardBoundary as Ri, evidenceAvailabilityReason as Rn, parseHostVersion as Rr, hostLockRowsFromComposedDump as Rt, snapshotSessionEvents as S, DirectiveClass as Sa, BindingActionClosure as Si, goalCompletionDenial as Sn, bindLiveGoalCapability as Sr, ManifestIssue as St, RC1_HOST_PACKAGES as T, ScopeInterpretation as Ta, DeferAuthorization as Ti, ToolResultInput as Tn, evaluateHostLock as Tr, ClaimedMessage as Tt, ProofKindV2 as U, STATEFUL_ACTIONS as Ua, GuardItemKind as Ui, PROTOCOL_V3_NOTICE as Un, AuthorityKind as Ur, readActiveHostGraph as Ut, ProofKind as V, CERTIFICATE_VERSION_V2 as Va, GuardIntegrity as Vi, CAPTURE_V042_NOTICE as Vn, AuthorityBlock as Vr, packageRowsFromActiveGraph as Vt, ProofManifest as W, STOP_PROTOCOL_VERSION as Wa, GuardItemStatus as Wi, PROTOCOL_V4_NOTICE as Wn, authorityCaptureCounts as Wr, resolveActiveProfileHostLock as Wt, SessionQueryV2 as X, boundedArtifactChoiceMatches as Xa, SourceSpan as Xi, ALPHA2_DSHMARKET_139_HOST_PACKAGES as Xn, CONFIRM_LINE_PATTERN as Xr, GitCommandAccepted as Xt, SessionQuery as Y, actionCompatible as Ya, PersistenceAuthorization as Yi, ACTIVE_HOST_LAUNCHER_VERSION as Yn, classifyUserInteraction as Yr, GitAdapterAction as Yt, bindProofToProjection as Z, isStatefulAction as Za, TargetCaptureReasonCode as Zi, ALPHA2_HOST_PACKAGES as Zn, ParsedConfirmation as Zr, GitCommandManifest as Zt, progressFingerprint as _, proposeRebindV042 as _a, GoalBoundaryAccess as _i, ShellParseStatus as _n, HostPlatform as _r, evidenceCoverage as _t, NO_PROGRESS_RECORD_PREFIX as a, PackageRow as aa, captureClause as ai, LinearCommitReadback as an, canonicalizePath as ao, HOST_CAPABILITY_PACKAGE_GROUPS as ar, proofEvidenceConstraints as at, SessionApiError as b, replayRebindResult as ba, isCurrentAcceptedBoundary as bi, parsePwshCommand as bn, LEGACY_HOST_COHORTS as br, COMMAND_SURFACE_MANIFEST as bt, classifyCompletionClaim as c, ReleaseOperation as ca, extractArtifactPaths as ci, createGitPrestateEnvelope as cn, sanitizeClauseText as co, HostCapabilityEvaluation as cr, proofV2Rejection as ct, decisionBoundaryKey as d, ProposeOutcome as da, isInformationalMessage as di, parseGitCommandManifest as dn, HostCohort as dr, sessionQuery as dt, TargetValue as ea, CheckpointResult as ei, GitEffectExecution as en, requestedTargetMatchesResolved as eo, DEFAULT_HOST_LOCK as er, createProofManifest as et, isRootPauseRequest as f, RebindArgs as fa, segmentClauses as fi, revalidateGitPrestate as fn, HostCohortSelection as fr, sessionQueryV2 as ft, observeAssistantOutcome as g, proposeRebindOutcome as ga, GoalActivationState as gi, ParsedShell as gn, HostLockStatus as gr, bindingSatisfies as gt, latestRootInstruction as h, proposeRebind as ha, BoundaryRequest as hi, CanonicalCommandSurface as hn, HostLockEvaluation as hr, EvidenceFacetCoverage as ht, CompletionDisposition as i, createProjection as ia, ClauseSegment as ii, GitTargetIdentity as in, validateActionTarget as io, GOAL_HOST_PACKAGES as ir, proofDigestV2 as it, recoveryDigest as j, maskCodeSpans as ja, EvidenceBinding as ji, withDurability as jn, LATEST_SUPPORTED_HOST_VERSION as jr, lifecyclePhase as jt, closingHint as k, isOpenObligation as ka, DeriveScope as ki, extractToolSubject as kn, HostVersionDecision as kr, LifecyclePhase as kt, decideTurnBoundary as l, ReleaseSettlement as la, extractMethod as li, executeRevalidatedGitEffect as ln, sanitizeUrl as lo, HostCapabilityId as lr, requiredSubjectsOf as lt, latestAssistantText as m, confirmRebind as ma, BoundaryQualification as mi, CanonicalArgv as mn, HostLockContext as mr, validateProofManifestV2 as mt, AssistantOutcomeObservation as n, WaitAuthorization as na, certifyCheckpoint as ni, GitPrestateCheck as nn, semanticActionFromText as no, ExecutableIdentity as nr, proofCapabilityReport as nt, NO_PROGRESS_TURNS_BEFORE_STOP as o, ReleaseGateDecision as oa, captureItem as oi, commitIndexSnapshotDigest as on, digestStrings as oo, HOST_COHORTS as or, proofHostSurfacesOf as ot, isWholeTaskCompletionClaim as p, RebindProposal as pa, BoundaryEffectuation as pi, verifiedLinearCommitReadback as pn, HostCohortSelectionReason as pr, validateProofManifest as pt, ProofObligationV2 as q, SemanticAction as qa, HostStatus as qi, ACTIVE_HOST_COHORT_ID as qn, UserInteractionKind as qr, GIT_COMMAND_MANIFEST_IDS as qt, CONTROL_RECORD_PREFIX as r, WorkUnit as ra, CaptureScope as ri, GitPrestateEnvelope as rn, validateActionManifest as ro, ExecutableIdentityBinding as rr, proofDigest as rt, TurnStoppingDecision as s, ReleaseObservedIdentity as sa, classifyClause as si, commitTreeSnapshotDigest as sn, normalizeClause as so, HostAuditProvenance as sr, proofOperationMatches as st, supersedeItem as t, VerificationContract as ta, RejectedBinding as ti, GitEffectRunner as tn, semanticActionFromCommand as to, EXPECTED_HOST_PACKAGES as tr, createProofManifestV2 as tt, decideTurnStopping as u, BoundedSource as ua, extractOperation as ui, gitCommandMatchesTarget as un, sha256 as uo, HostCapabilityRequest as ur, scopeCoverageDigest as ut, SESSION_API_UNSUPPORTED as v, rebindAttemptKey as va, availableBoundaryQualifications as vi, canonicalArgvFromCommand as vn, HostProfileKind as vr, evidenceMatchesItem as vt, RC015_HOST_PACKAGES as w, InterpretOptions as wa, BoundaryQualificationKind as wi, ToolCallInput as wn, evaluateHostCapability as wr, validateManifest as wt, V3SessionLike as x, AuthorityDisposition as xa, qualifyBoundary as xi, parseShellCommand as xn, bindExecutableIdentity as xr, CommandSurfaceManifest as xt, SESSION_EVENT_ENVELOPE_INVALID as y, rebindResponse as ya, effectuateBoundary as yi, isRunExecutable as yn, HostToolSurface as yr, isVerifyingCapability as yt, PROOF_PROTOCOL_VERSION_V2 as z, BOUNDED_ARTIFACT_TYPES as za, GuardCheckpoint as zi, itemDiagnosis as zn, satisfiesSupportedHostRange as zr, injectActiveProfileHostLock as zt };