dsh-completion-guard 0.5.2 → 0.6.0

package/dist/index.d.ts

@@ -1,12 +1,114 @@
-import { $ as COMMAND_SURFACE_MANIFEST, $i as kindOfScope, $n as bindLiveGoalCapability, $r as BindingActionClosure, $t as parsePwshCommand, A as openItems, Ai as WaitAuthorization, An as BASE_HOST_PACKAGES, Ar as parseConfirmationMessage, At as GitCommandManifest, B as SessionQuery, Bi as proposeRebindV042, Bn as HostCapabilityId, Br as extractMethod, Bt as commitTreeSnapshotDigest, C as RC015_RC2_HOST_PACKAGES, Ca as canonicalizePath, Ci as HostStatus, Cn as deriveProjection, Cr as TaskIntent, Ct as resolveActiveProfileHostLock, D as MIN_RECOVERY_CHAR_BUDGET, Da as sanitizeUrl, Di as TargetTuple, Dn as ALPHA2_DSHMARKET_139_HOST_PACKAGES, Dr as CONFIRM_LINE_PATTERN, Dt as GIT_COMMAND_TEMPLATES, E as DEFAULT_RECOVERY_CHAR_BUDGET, Ea as sanitizeClauseText, Ei as TargetCaptureStatus, En as ACTIVE_HOST_LAUNCHER_VERSION, Er as classifyUserInteraction, Et as GIT_COMMAND_MANIFEST_IDS, F as PROOF_PROTOCOL_VERSION, Fi as RebindArgs, Fn as GOAL_HOST_PACKAGES, Fr as ClauseSegment, Ft as GitPrestateCheck, G as proofEvidenceConstraints, Gi as DirectiveClass, Gn as HostLockContext, Gr as BoundaryQualification, Gt as revalidateGitPrestate, H as canonicalProjection, Hi as rebindResponse, Hn as HostCohort, Hr as isInformationalMessage, Ht as executeRevalidatedGitEffect, I as ProofKind, Ii as RebindProposal, In as HOST_CAPABILITY_PACKAGE_GROUPS, Ir as captureClause, It as GitPrestateEnvelope, J as EvidenceFacetCoverage, Ji as ScopeInterpretation, Jn as HostPlatform, Jr as GoalBoundaryAccess, Jt as CanonicalCommandSurface, K as sessionQuery, Ki as Executee, Kn as HostLockEvaluation, Kr as BoundaryRequest, Kt as verifiedLinearCommitReadback, L as ProofManifest, Li as confirmRebind, Ln as HOST_COHORTS, Lr as captureItem, Lt as GitTargetIdentity, M as renderRecoveryPacket, Mi as PackageRow, Mn as EXPECTED_HOST_PACKAGES, Mr as RejectedBinding, Mt as GitCommandRejected, N as ALPHA3_HOST_PACKAGES, Ni as BoundedSource, Nn as ExecutableIdentity, Nr as certifyCheckpoint, Nt as GitEffectExecution, O as RecoveryOptions, Oa as sha256, Oi as TargetValue, On as ALPHA2_HOST_PACKAGES, Or as ParsedConfirmation, Ot as GitAdapterAction, P as PROOF_KINDS, Pi as ProposeOutcome, Pn as ExecutableIdentityBinding, Pr as CaptureScope, Pt as GitEffectRunner, Q as isVerifyingCapability, Qi as isOpenObligation, Qn as bindExecutableIdentity, Qr as qualifyBoundary, Qt as isRunExecutable, R as ProofObligation, Ri as proposeRebind, Rn as HostAuditProvenance, Rr as classifyClause, Rt as LinearCommitReadback, S as snapshotSessionEvents, Sa as validateActionTarget, Si as GuardProjection, Sn as PROTOCOL_V4_NOTICE, Sr as segmentAuthorityBlocks, St as readActiveHostGraph, T as RC1_HOST_PACKAGES, Ta as normalizeClause, Ti as TargetCaptureReasonCode, Tn as ACTIVE_HOST_COHORT_IDS, Tr as classifyTaskIntent, Tt as verifyComposedHostLockDump, U as createProofManifest, Ui as replayRebindResult, Un as HostCohortSelection, Ur as segmentClauses, Ut as gitCommandMatchesTarget, V as bindProofToProjection, Vi as rebindAttemptKey, Vn as HostCapabilityRequest, Vr as extractOperation, Vt as createGitPrestateEnvelope, W as proofDigest, Wi as AuthorityDisposition, Wn as HostCohortSelectionReason, Wr as BoundaryEffectuation, Wt as parseGitCommandManifest, X as evidenceCoverage, Xi as interpretMessage, Xn as HostToolSurface, Xr as effectuateBoundary, Xt as ShellParseStatus, Y as bindingSatisfies, Yi as interpretClause, Yn as HostProfileKind, Yr as availableBoundaryQualifications, Yt as ParsedShell, Z as evidenceMatchesItem, Zi as isExecutableItem, Zn as LEGACY_HOST_COHORTS, Zr as isCurrentAcceptedBoundary, Zt as canonicalArgvFromCommand, _ as progressFingerprint, _a as requestedTargetAuthorizesMutation, _i as GuardIntegrity, _n as evidenceAvailabilityReason, _r as currentContractDigest, _t as hostLockRowsFromComposedDump, a as NO_PROGRESS_RECORD_PREFIX, aa as ACTION_MANIFEST_VERSION, ai as DeriveScope, an as ToolSubject, ar as selectHostCohort, at as FIRST_STEP_GUIDANCE, b as SessionApiError, ba as semanticActionFromText, bi as GuardItemStatus, bn as CAPTURE_V042_NOTICE, br as AuthorityKind, bt as packageRowsFromActiveGraph, c as classifyCompletionClaim, ca as CERTIFICATE_VERSION, ci as EvidenceOutcome, cn as extractToolSubject, cr as LATEST_SUPPORTED_HOST_VERSION, ct as LifecyclePhase, d as decisionBoundaryKey, da as STOP_PROTOCOL_VERSION, di as ExpectedTransition, dn as CertificationSupport, dr as SUPPORTED_HOST_RANGE, dt as previewFirstStepInjection, ea as maskCodeSpans, ei as BoundaryDisposition, en as parseShellCommand, er as evaluateExternalWaitCapability, et as CommandSurfaceManifest, f as isRootPauseRequest, fa as SUPPORTED_EVIDENCE_ADAPTERS, fi as ExternalOperation, fn as DiagnosisNextAction, fr as SUPPORTED_HOST_VERSIONS, ft as ActiveProfileHostLock, g as observeAssistantOutcome, ga as isStatefulAction, gi as GuardEvidence, gn as deriveItemDiagnosis, gr as satisfiesSupportedHostRange, gt as hostLockContextFromComposedDump, h as latestRootInstruction, ha as actionCompatible, hi as GuardCheckpoint, hn as UnifiedItemDiagnosis, hr as parseHostVersion, ht as combineHostPolicy, i as CompletionDisposition, ia as ACTION_MANIFEST, ii as DeriveResult, in as ToolResultInput, ir as hostVersionFromPackages, it as ClaimedMessage, j as recoveryDigest, ji as createProjection, jn as DEFAULT_HOST_LOCK, jr as CheckpointResult, jt as GitCommandParseResult, k as closingHint, ki as VerificationContract, kn as AuditedExecutable, kr as isFrozenV042RebindResponse, kt as GitCommandAccepted, l as decideTurnBoundary, la as SEMANTIC_ACTIONS, li as EvidenceParseStatus, ln as isDeterministicCheck, lr as MIN_SUPPORTED_HOST_VERSION, lt as claimedBatchHasRealRootInput, m as latestAssistantText, ma as StatefulAction, mi as GuardBoundary, mn as TaskKind, mr as evaluateMinimumHostVersion, mt as TargetHostGraph, n as AssistantOutcomeObservation, na as semanticActionOfScope, ni as DeferAuthorization, nn as hasCurrentCertificate, nr as evaluateHostLock, nt as OperationVerbEntry, o as NO_PROGRESS_TURNS_BEFORE_STOP, oa as ActionManifest, oi as DerivedEnvelope, on as evidenceFromPersistedToolResult, or as HostVersionDecision, ot as FirstStepInjection, p as isWholeTaskCompletionClaim, pa as SemanticAction, pi as GoalRef, pn as Repairability, pr as compareHostVersions, pt as HostProfileError, q as validateProofManifest, qi as InterpretOptions, qn as HostLockStatus, qr as GoalActivationState, qt as CanonicalArgv, r as CONTROL_RECORD_PREFIX, ra as statefulActionsOfScope, ri as DeriveConfig, rn as ToolCallInput, rr as evaluateToolSurfaceCapability, rt as validateManifest, s as TurnStoppingDecision, sa as ActionSpec, si as EvidenceBinding, sn as extractTextContent, sr as HostVersionStatus, st as FirstStepPreviewInput, t as supersedeItem, ta as namedActions, ti as BoundaryQualificationKind, tn as goalCompletionDenial, tr as evaluateHostCapability, tt as ManifestIssue, u as decideTurnStopping, ua as STATEFUL_ACTIONS, ui as EvidenceRole, un as withDurability, ur as ParsedHostVersion, ut as lifecyclePhase, v as SESSION_API_UNSUPPORTED, va as requestedTargetMatchesResolved, vi as GuardItem, vn as itemDiagnosis, vr as AuthorityBlock, vt as injectActiveProfileHostLock, w as RC015_HOST_PACKAGES, wa as digestStrings, wi as PersistenceAuthorization, wn as ACTIVE_HOST_COHORT_ID, wr as UserInteractionKind, wt as resolveInstalledHostLock, x as V3SessionLike, xa as validateActionManifest, xi as GuardOperation, xn as PROTOCOL_V3_NOTICE, xr as authorityCaptureCounts, xt as packageRowsFromPnpmLock, y as SESSION_EVENT_ENVELOPE_INVALID, ya as semanticActionFromCommand, yi as GuardItemKind, yn as relevantEvidence, yr as AuthorityBlockKind, yt as inspectTargetHostGraph, z as ProofSurface, zi as proposeRebindOutcome, zn as HostCapabilityEvaluation, zr as extractArtifactPaths, zt as commitIndexSnapshotDigest } from "./index-BTaiOcE-.js";
+import { $ as canonicalProjection, $a as requestedTargetAuthorizesMutation, $i as TargetTuple, $n as BASE_HOST_PACKAGES, $r as parseConfirmationMessage, $t as GitCommandRejected, A as openItems, Aa as kindOfScope, Ai as DerivedEnvelope, An as isDeterministicCheck, Ar as HostVersionStatus, At as claimedBatchHasRealRootInput, B as ProofHostSurface, Ba as CERTIFICATE_VERSION, Bi as GuardEvidence, Bn as relevantEvidence, Br as currentContractDigest, Bt as inspectTargetHostGraph, C as RC015_RC2_HOST_PACKAGES, Ca as Executee, Ci as BoundaryDisposition, Cn as hasCurrentCertificate, Cr as evaluateExternalWaitCapability, Ct as OperationVerbEntry, D as MIN_RECOVERY_CHAR_BUDGET, Da as interpretMessage, Di as DeriveConfig, Dn as evidenceFromPersistedToolResult, Dr as hostVersionFromPackages, Dt as FirstStepInjection, E as DEFAULT_RECOVERY_CHAR_BUDGET, Ea as interpretClause, Ei as DelegationRef, En as ToolSubject, Er as evaluateToolSurfaceCapability, Et as FIRST_STEP_GUIDANCE, F as PROOF_KINDS, Fa as ACTION_MANIFEST, Fi as ExpectedTransition, Fn as TaskKind, Fr as SUPPORTED_HOST_VERSIONS, Ft as TargetHostGraph, G as ProofManifestV2, Ga as STOP_PROTOCOL_VERSION_V2, Gi as GuardOperation, Gn as PROTOCOL_V5_NOTICE, Gr as segmentAuthorityBlocks, Gt as resolveInstalledHostLock, H as ProofKindCapability, Ha as SEMANTIC_ACTIONS, Hi as GuardItem, Hn as DEFAULT_DELEGATION_TOOL_NAMES, Hr as AuthorityBlockKind, Ht as packageRowsFromPnpmLock, I as PROOF_KINDS_V2, Ia as ACTION_MANIFEST_VERSION, Ii as ExternalOperation, In as UnifiedItemDiagnosis, Ir as compareHostVersions, It as combineHostPolicy, J as ProofSurface, Ja as StatefulAction, Ji as MessageCoverage, Jn as ACTIVE_HOST_COHORT_IDS, Jr as classifyTaskIntent, Jt as GIT_COMMAND_TEMPLATES, K as ProofObligation, Ka as SUPPORTED_EVIDENCE_ADAPTERS, Ki as GuardProjection, Kn as deriveProjection, Kr as TaskIntent, Kt as verifyComposedHostLockDump, L as PROOF_MANIFEST_DOMAIN_V2, La as ActionManifest, Li as GoalRef, Ln as deriveItemDiagnosis, Lr as evaluateMinimumHostVersion, Lt as hostLockContextFromComposedDump, M as renderRecoveryPacket, Ma as namedActions, Mi as EvidenceOutcome, Mn as CertificationSupport, Mr as MIN_SUPPORTED_HOST_VERSION, Mt as previewFirstStepInjection, N as ALPHA3_HOST_PACKAGES, Na as semanticActionOfScope, Ni as EvidenceParseStatus, Nn as DiagnosisNextAction, Nr as ParsedHostVersion, Nt as ActiveProfileHostLock, O as RecoveryOptions, Oa as isExecutableItem, Oi as DeriveResult, On as extractTextContent, Or as selectHostCohort, Ot as FirstStepPreviewInput, P as PROOF_CAPABILITY_MATRIX, Pa as statefulActionsOfScope, Pi as EvidenceRole, Pn as Repairability, Pr as SUPPORTED_HOST_RANGE, Pt as HostProfileError, Q as bindProofV2ToProjection, Qa as requestedIdentityKey, Qi as TargetCaptureStatus, Qn as AuditedExecutable, Qr as isFrozenV042RebindResponse, Qt as GitCommandParseResult, R as PROOF_PROTOCOL_VERSION, Ra as ActionSpec, Ri as GuardBoundary, Rn as evidenceAvailabilityReason, Rr as parseHostVersion, Rt as hostLockRowsFromComposedDump, S as snapshotSessionEvents, Sa as DirectiveClass, Si as BindingActionClosure, Sn as goalCompletionDenial, Sr as bindLiveGoalCapability, St as ManifestIssue, T as RC1_HOST_PACKAGES, Ta as ScopeInterpretation, Ti as DeferAuthorization, Tn as ToolResultInput, Tr as evaluateHostLock, Tt as ClaimedMessage, U as ProofKindV2, Ua as STATEFUL_ACTIONS, Ui as GuardItemKind, Un as PROTOCOL_V3_NOTICE, Ur as AuthorityKind, Ut as readActiveHostGraph, V as ProofKind, Va as CERTIFICATE_VERSION_V2, Vi as GuardIntegrity, Vn as CAPTURE_V042_NOTICE, Vr as AuthorityBlock, Vt as packageRowsFromActiveGraph, W as ProofManifest, Wa as STOP_PROTOCOL_VERSION, Wi as GuardItemStatus, Wn as PROTOCOL_V4_NOTICE, Wr as authorityCaptureCounts, Wt as resolveActiveProfileHostLock, X as SessionQueryV2, Xa as boundedArtifactChoiceMatches, Xi as SourceSpan, Xn as ALPHA2_DSHMARKET_139_HOST_PACKAGES, Xr as CONFIRM_LINE_PATTERN, Xt as GitCommandAccepted, Y as SessionQuery, Ya as actionCompatible, Yi as PersistenceAuthorization, Yn as ACTIVE_HOST_LAUNCHER_VERSION, Yr as classifyUserInteraction, Yt as GitAdapterAction, Z as bindProofToProjection, Za as isStatefulAction, Zi as TargetCaptureReasonCode, Zn as ALPHA2_HOST_PACKAGES, Zr as ParsedConfirmation, Zt as GitCommandManifest, _ as progressFingerprint, _a as proposeRebindV042, _i as GoalBoundaryAccess, _n as ShellParseStatus, _r as HostPlatform, _t as evidenceCoverage, a as NO_PROGRESS_RECORD_PREFIX, aa as PackageRow, ai as captureClause, an as LinearCommitReadback, ao as canonicalizePath, ar as HOST_CAPABILITY_PACKAGE_GROUPS, at as proofEvidenceConstraints, b as SessionApiError, ba as replayRebindResult, bi as isCurrentAcceptedBoundary, bn as parsePwshCommand, br as LEGACY_HOST_COHORTS, bt as COMMAND_SURFACE_MANIFEST, c as classifyCompletionClaim, ca as ReleaseOperation, ci as extractArtifactPaths, cn as createGitPrestateEnvelope, co as sanitizeClauseText, cr as HostCapabilityEvaluation, ct as proofV2Rejection, d as decisionBoundaryKey, da as ProposeOutcome, di as isInformationalMessage, dn as parseGitCommandManifest, dr as HostCohort, dt as sessionQuery, ea as TargetValue, ei as CheckpointResult, en as GitEffectExecution, eo as requestedTargetMatchesResolved, er as DEFAULT_HOST_LOCK, et as createProofManifest, f as isRootPauseRequest, fa as RebindArgs, fi as segmentClauses, fn as revalidateGitPrestate, fr as HostCohortSelection, ft as sessionQueryV2, g as observeAssistantOutcome, ga as proposeRebindOutcome, gi as GoalActivationState, gn as ParsedShell, gr as HostLockStatus, gt as bindingSatisfies, h as latestRootInstruction, ha as proposeRebind, hi as BoundaryRequest, hn as CanonicalCommandSurface, hr as HostLockEvaluation, ht as EvidenceFacetCoverage, i as CompletionDisposition, ia as createProjection, ii as ClauseSegment, in as GitTargetIdentity, io as validateActionTarget, ir as GOAL_HOST_PACKAGES, it as proofDigestV2, j as recoveryDigest, ja as maskCodeSpans, ji as EvidenceBinding, jn as withDurability, jr as LATEST_SUPPORTED_HOST_VERSION, jt as lifecyclePhase, k as closingHint, ka as isOpenObligation, ki as DeriveScope, kn as extractToolSubject, kr as HostVersionDecision, kt as LifecyclePhase, l as decideTurnBoundary, la as ReleaseSettlement, li as extractMethod, ln as executeRevalidatedGitEffect, lo as sanitizeUrl, lr as HostCapabilityId, lt as requiredSubjectsOf, m as latestAssistantText, ma as confirmRebind, mi as BoundaryQualification, mn as CanonicalArgv, mr as HostLockContext, mt as validateProofManifestV2, n as AssistantOutcomeObservation, na as WaitAuthorization, ni as certifyCheckpoint, nn as GitPrestateCheck, no as semanticActionFromText, nr as ExecutableIdentity, nt as proofCapabilityReport, o as NO_PROGRESS_TURNS_BEFORE_STOP, oa as ReleaseGateDecision, oi as captureItem, on as commitIndexSnapshotDigest, oo as digestStrings, or as HOST_COHORTS, ot as proofHostSurfacesOf, p as isWholeTaskCompletionClaim, pa as RebindProposal, pi as BoundaryEffectuation, pn as verifiedLinearCommitReadback, pr as HostCohortSelectionReason, pt as validateProofManifest, q as ProofObligationV2, qa as SemanticAction, qi as HostStatus, qn as ACTIVE_HOST_COHORT_ID, qr as UserInteractionKind, qt as GIT_COMMAND_MANIFEST_IDS, r as CONTROL_RECORD_PREFIX, ra as WorkUnit, ri as CaptureScope, rn as GitPrestateEnvelope, ro as validateActionManifest, rr as ExecutableIdentityBinding, rt as proofDigest, s as TurnStoppingDecision, sa as ReleaseObservedIdentity, si as classifyClause, sn as commitTreeSnapshotDigest, so as normalizeClause, sr as HostAuditProvenance, st as proofOperationMatches, t as supersedeItem, ta as VerificationContract, ti as RejectedBinding, tn as GitEffectRunner, to as semanticActionFromCommand, tr as EXPECTED_HOST_PACKAGES, tt as createProofManifestV2, u as decideTurnStopping, ua as BoundedSource, ui as extractOperation, un as gitCommandMatchesTarget, uo as sha256, ur as HostCapabilityRequest, ut as scopeCoverageDigest, v as SESSION_API_UNSUPPORTED, va as rebindAttemptKey, vi as availableBoundaryQualifications, vn as canonicalArgvFromCommand, vr as HostProfileKind, vt as evidenceMatchesItem, w as RC015_HOST_PACKAGES, wa as InterpretOptions, wi as BoundaryQualificationKind, wn as ToolCallInput, wr as evaluateHostCapability, wt as validateManifest, x as V3SessionLike, xa as AuthorityDisposition, xi as qualifyBoundary, xn as parseShellCommand, xr as bindExecutableIdentity, xt as CommandSurfaceManifest, y as SESSION_EVENT_ENVELOPE_INVALID, ya as rebindResponse, yi as effectuateBoundary, yn as isRunExecutable, yr as HostToolSurface, yt as isVerifyingCapability, z as PROOF_PROTOCOL_VERSION_V2, za as BOUNDED_ARTIFACT_TYPES, zi as GuardCheckpoint, zn as itemDiagnosis, zr as satisfiesSupportedHostRange, zt as injectActiveProfileHostLock } from "./index-BJPVGdg9.js";
 import "@deepseek-ai/dsh-tools";
 import "@deepseek-ai/dsh-session";
 import { Context } from "@deepseek-ai/cordis";
 import z from "@deepseek-ai/schemastery";
 
+//#region src/tools/evidence.d.ts
+
+/** Trusted embedding evidence, never accepted from a model/tool or HTTP response.
+* The embedding must bind its actual loaded provider to this process/service.
+* Current DSH hosts expose no such verifier, so production restart stays
+* unavailable while core Guard protection remains active.
+*/
+interface MarketInstanceBinding {
+  origin: string;
+  profile: string;
+  version: string;
+  integrity: string;
+  loadedTreeSha256: string;
+  processIdentity: string;
+  bootId: string;
+}
+interface EvidenceToolRoots {
+  /** Test/embedding override. Production derives the active profile from this installed module. */
+  profile?: {
+    name: string;
+    path: string;
+  };
+  /** Derived from the live loopback webServer service; never accepted from tool input. */
+  marketOrigin?: string;
+  verifyMarketInstance?: (signal: AbortSignal) => Promise<MarketInstanceBinding | undefined>;
+  /** Test seam for exact HTTP request/response contracts. */
+  fetcher?: typeof fetch;
+  /** Test seam for exact logical executable/argv execution. */
+  commandRunner?: (file: string, args: string[], cwd?: string, signal?: AbortSignal) => Promise<void>;
+  persistRestartIntent?: (agent: {
+    session: unknown;
+  }, intent: {
+    resolutionCallId: string;
+    serviceId: string;
+    preGeneration: string;
+  }) => Promise<boolean>;
+  /** Runtime-supplied, action-scoped host capability decision. */
+  hostCapability?: (action: StatefulAction) => {
+    status: "supported" | "unsupported" | "unavailable";
+    digest: string;
+  };
+  /** Runtime-owned root-contract authorization. Absence is fail-closed. */
+  authorizeMutation?: (request: MutationAuthorizationRequest) => MutationAuthorizationDecision;
+  /** Flush and replay the resolution/contract chain before any side effect. */
+  prepareMutation?: (agent: {
+    session: unknown;
+  }) => Promise<boolean>;
+  /** Test seam for proving that durability/authority rejection precedes probes. */
+  readExecutableIdentity?: (executable: AuditedExecutable, signal: AbortSignal) => Promise<ExecutableIdentity | undefined>;
+  /** Test-only seam; production never enables HTTP registries. */
+  allowLoopbackHttpRegistry?: boolean;
+  /**
+  * C10 release ticket gate, consulted before any release-class effect. Absent
+  * means no release contract governs the session, so the existing Guard-owned
+  * mutation authorization is the whole authority chain.
+  */
+  releaseGate?: (request: ReleaseGateToolRequest) => Promise<ReleaseGateDecision>;
+  /** C10 settlement record, written after the effect from a trusted readback. */
+  releaseSettle?: (request: ReleaseSettlementToolRequest) => Promise<void>;
+}
+interface ReleaseGateToolRequest {
+  agent: {
+    session: unknown;
+  };
+  operation: ReleaseOperation;
+  /** The resolution call the effect is bound to; the replay key. */
+  callId: string;
+  resolvedTarget: TargetTuple;
+  /** What the trusted producers actually observed for this candidate. */
+  observed: ReleaseObservedIdentity;
+}
+/**
+* The outcome the executor can prove, before the runtime decides how it
+* resolves the reservation:
+* - `not_effected` — every pre-effect check refused, so no side effect ran;
+* - `unknown` — the effect was attempted and its result cannot be established;
+* - `completed` — the effect reported success (the runtime still compares the
+*   readback identity before it settles anything).
+*/
+interface ReleaseSettlementToolRequest {
+  agent: {
+    session: unknown;
+  };
+  operation: ReleaseOperation;
+  callId: string;
+  /** The contract the granted reservation belonged to. */
+  contractId?: string;
+  effect: "completed" | "not_effected" | "unknown";
+  readback: ReleaseSettlement["readback"];
+}
+interface MutationAuthorizationRequest {
+  action: StatefulAction;
+  contractItemId: string;
+  contractItemRevision: number;
+  resolvedTarget: TargetTuple;
+}
+interface MutationAuthorizationDecision {
+  status: "authorized" | "denied";
+  reasonCode: string;
+}
+//#endregion
 //#region src/config.d.ts
 declare const Config: z<{
   activation: string;
+  policy?: string;
   hostLockPackages?: PackageRow[];
   hostLockPlatform?: HostPlatform;
   hostLockProfile?: HostProfileKind;
@@ -18,6 +120,28 @@ declare const Config: z<{
 //#region src/runtime.d.ts
 declare const name = "context-guard";
 declare const inject: readonly ["sessions", "commands"];
+/**
+* Executor and network seams for acceptance runs. They replace ONLY the two
+* things a deterministic test cannot do for real — spawning the mutation
+* binary and reaching the registry — and never the authorization gate, the
+* reservation/settlement records, or the evidence producers. Production
+* callers omit them and get the real implementations.
+*/
+interface RuntimeExecutorSeams {
+  commandRunner?: EvidenceToolRoots["commandRunner"];
+  fetcher?: EvidenceToolRoots["fetcher"];
+  allowLoopbackHttpRegistry?: boolean;
+  /**
+  * Pin the audited host cohort instead of reading a live profile graph. An
+  * acceptance run that already declared its cohort needs this because the
+  * migration revalidation reads real filesystem roots; it replaces ONLY the
+  * host-lock EVALUATION. The release ticket gate, the reservation and
+  * settlement records, the evidence producers and the replay stay production
+  * code, and the host lock keeps its own dedicated suites and native
+  * acceptance.
+  */
+  hostLock?: HostLockEvaluation;
+}
 declare function apply(ctx: Context, rawConfig?: {
   activation?: unknown;
   hostLockPackages?: unknown;
@@ -26,6 +150,6 @@ declare function apply(ctx: Context, rawConfig?: {
   hostLockPolicy?: unknown;
   hostLockRuntimeRoot?: unknown;
   hostLockProfileRoot?: unknown;
-}): void;
+}, seams?: RuntimeExecutorSeams): void;
 //#endregion
-export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ACTIVE_HOST_COHORT_ID, ACTIVE_HOST_COHORT_IDS, ACTIVE_HOST_LAUNCHER_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, ActionManifest, ActionSpec, ActiveProfileHostLock, AssistantOutcomeObservation, AuditedExecutable, AuthorityBlock, AuthorityBlockKind, AuthorityDisposition, AuthorityKind, BASE_HOST_PACKAGES, BindingActionClosure, BoundaryDisposition, BoundaryEffectuation, BoundaryQualification, BoundaryQualificationKind, BoundaryRequest, BoundedSource, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, CONTROL_RECORD_PREFIX, CanonicalArgv, CanonicalCommandSurface, CaptureScope, CertificationSupport, CheckpointResult, ClaimedMessage, ClauseSegment, CommandSurfaceManifest, CompletionDisposition, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DeferAuthorization, DeriveConfig, DeriveResult, DeriveScope, DerivedEnvelope, DiagnosisNextAction, DirectiveClass, EXPECTED_HOST_PACKAGES, EvidenceBinding, EvidenceFacetCoverage, EvidenceOutcome, EvidenceParseStatus, EvidenceRole, ExecutableIdentity, ExecutableIdentityBinding, Executee, ExpectedTransition, ExternalOperation, FIRST_STEP_GUIDANCE, FirstStepInjection, FirstStepPreviewInput, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, GitAdapterAction, GitCommandAccepted, GitCommandManifest, GitCommandParseResult, GitCommandRejected, GitEffectExecution, GitEffectRunner, GitPrestateCheck, GitPrestateEnvelope, GitTargetIdentity, GoalActivationState, GoalBoundaryAccess, GoalRef, GuardBoundary, GuardCheckpoint, GuardEvidence, GuardIntegrity, GuardItem, GuardItemKind, GuardItemStatus, GuardOperation, GuardProjection, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostAuditProvenance, HostCapabilityEvaluation, HostCapabilityId, HostCapabilityRequest, HostCohort, HostCohortSelection, HostCohortSelectionReason, HostLockContext, HostLockEvaluation, HostLockStatus, HostPlatform, HostProfileError, HostProfileKind, HostStatus, HostToolSurface, HostVersionDecision, HostVersionStatus, InterpretOptions, LATEST_SUPPORTED_HOST_VERSION, LEGACY_HOST_COHORTS, LifecyclePhase, LinearCommitReadback, MIN_RECOVERY_CHAR_BUDGET, MIN_SUPPORTED_HOST_VERSION, ManifestIssue, NO_PROGRESS_RECORD_PREFIX, NO_PROGRESS_TURNS_BEFORE_STOP, OperationVerbEntry, PROOF_KINDS, PROOF_PROTOCOL_VERSION, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, ParsedConfirmation, ParsedHostVersion, ParsedShell, PersistenceAuthorization, ProofKind, ProofManifest, ProofObligation, ProofSurface, ProposeOutcome, RC015_HOST_PACKAGES, RC015_RC2_HOST_PACKAGES, RC1_HOST_PACKAGES, RebindArgs, RebindProposal, RecoveryOptions, RejectedBinding, Repairability, SEMANTIC_ACTIONS, SESSION_API_UNSUPPORTED, SESSION_EVENT_ENVELOPE_INVALID, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_RANGE, SUPPORTED_HOST_VERSIONS, ScopeInterpretation, SemanticAction, SessionApiError, SessionQuery, ShellParseStatus, StatefulAction, TargetCaptureReasonCode, TargetCaptureStatus, TargetHostGraph, TargetTuple, TargetValue, TaskIntent, TaskKind, ToolCallInput, ToolResultInput, ToolSubject, TurnStoppingDecision, UnifiedItemDiagnosis, UserInteractionKind, V3SessionLike, VerificationContract, WaitAuthorization, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindingSatisfies, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, claimedBatchHasRealRootInput, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, closingHint, combineHostPolicy, commitIndexSnapshotDigest, commitTreeSnapshotDigest, compareHostVersions, confirmRebind, createGitPrestateEnvelope, createProjection, createProofManifest, currentContractDigest, decideTurnBoundary, decideTurnStopping, decisionBoundaryKey, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateMinimumHostVersion, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, hostVersionFromPackages, inject, injectActiveProfileHostLock, inspectTargetHostGraph, interpretClause, interpretMessage, isCurrentAcceptedBoundary, isDeterministicCheck, isExecutableItem, isFrozenV042RebindResponse, isInformationalMessage, isOpenObligation, isRootPauseRequest, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, kindOfScope, latestAssistantText, latestRootInstruction, lifecyclePhase, maskCodeSpans, name, namedActions, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parseHostVersion, parsePwshCommand, parseShellCommand, previewFirstStepInjection, progressFingerprint, proofDigest, proofEvidenceConstraints, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualifyBoundary, readActiveHostGraph, rebindAttemptKey, rebindResponse, recoveryDigest, relevantEvidence, renderRecoveryPacket, replayRebindResult, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, satisfiesSupportedHostRange, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, semanticActionOfScope, sessionQuery, sha256, snapshotSessionEvents, statefulActionsOfScope, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };
+export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ACTIVE_HOST_COHORT_ID, ACTIVE_HOST_COHORT_IDS, ACTIVE_HOST_LAUNCHER_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, ActionManifest, ActionSpec, ActiveProfileHostLock, AssistantOutcomeObservation, AuditedExecutable, AuthorityBlock, AuthorityBlockKind, AuthorityDisposition, AuthorityKind, BASE_HOST_PACKAGES, BOUNDED_ARTIFACT_TYPES, BindingActionClosure, BoundaryDisposition, BoundaryEffectuation, BoundaryQualification, BoundaryQualificationKind, BoundaryRequest, BoundedSource, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, CERTIFICATE_VERSION_V2, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, CONTROL_RECORD_PREFIX, CanonicalArgv, CanonicalCommandSurface, CaptureScope, CertificationSupport, CheckpointResult, ClaimedMessage, ClauseSegment, CommandSurfaceManifest, CompletionDisposition, Config, DEFAULT_DELEGATION_TOOL_NAMES, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DeferAuthorization, DelegationRef, DeriveConfig, DeriveResult, DeriveScope, DerivedEnvelope, DiagnosisNextAction, DirectiveClass, EXPECTED_HOST_PACKAGES, EvidenceBinding, EvidenceFacetCoverage, EvidenceOutcome, EvidenceParseStatus, EvidenceRole, ExecutableIdentity, ExecutableIdentityBinding, Executee, ExpectedTransition, ExternalOperation, FIRST_STEP_GUIDANCE, FirstStepInjection, FirstStepPreviewInput, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, GitAdapterAction, GitCommandAccepted, GitCommandManifest, GitCommandParseResult, GitCommandRejected, GitEffectExecution, GitEffectRunner, GitPrestateCheck, GitPrestateEnvelope, GitTargetIdentity, GoalActivationState, GoalBoundaryAccess, GoalRef, GuardBoundary, GuardCheckpoint, GuardEvidence, GuardIntegrity, GuardItem, GuardItemKind, GuardItemStatus, GuardOperation, GuardProjection, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostAuditProvenance, HostCapabilityEvaluation, HostCapabilityId, HostCapabilityRequest, HostCohort, HostCohortSelection, HostCohortSelectionReason, HostLockContext, HostLockEvaluation, HostLockStatus, HostPlatform, HostProfileError, HostProfileKind, HostStatus, HostToolSurface, HostVersionDecision, HostVersionStatus, InterpretOptions, LATEST_SUPPORTED_HOST_VERSION, LEGACY_HOST_COHORTS, LifecyclePhase, LinearCommitReadback, MIN_RECOVERY_CHAR_BUDGET, MIN_SUPPORTED_HOST_VERSION, ManifestIssue, MessageCoverage, NO_PROGRESS_RECORD_PREFIX, NO_PROGRESS_TURNS_BEFORE_STOP, OperationVerbEntry, PROOF_CAPABILITY_MATRIX, PROOF_KINDS, PROOF_KINDS_V2, PROOF_MANIFEST_DOMAIN_V2, PROOF_PROTOCOL_VERSION, PROOF_PROTOCOL_VERSION_V2, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, PROTOCOL_V5_NOTICE, ParsedConfirmation, ParsedHostVersion, ParsedShell, PersistenceAuthorization, ProofHostSurface, ProofKind, ProofKindCapability, ProofKindV2, ProofManifest, ProofManifestV2, ProofObligation, ProofObligationV2, ProofSurface, ProposeOutcome, RC015_HOST_PACKAGES, RC015_RC2_HOST_PACKAGES, RC1_HOST_PACKAGES, RebindArgs, RebindProposal, RecoveryOptions, RejectedBinding, Repairability, SEMANTIC_ACTIONS, SESSION_API_UNSUPPORTED, SESSION_EVENT_ENVELOPE_INVALID, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, STOP_PROTOCOL_VERSION_V2, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_RANGE, SUPPORTED_HOST_VERSIONS, ScopeInterpretation, SemanticAction, SessionApiError, SessionQuery, SessionQueryV2, ShellParseStatus, SourceSpan, StatefulAction, TargetCaptureReasonCode, TargetCaptureStatus, TargetHostGraph, TargetTuple, TargetValue, TaskIntent, TaskKind, ToolCallInput, ToolResultInput, ToolSubject, TurnStoppingDecision, UnifiedItemDiagnosis, UserInteractionKind, V3SessionLike, VerificationContract, WaitAuthorization, WorkUnit, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindProofV2ToProjection, bindingSatisfies, boundedArtifactChoiceMatches, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, claimedBatchHasRealRootInput, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, closingHint, combineHostPolicy, commitIndexSnapshotDigest, commitTreeSnapshotDigest, compareHostVersions, confirmRebind, createGitPrestateEnvelope, createProjection, createProofManifest, createProofManifestV2, currentContractDigest, decideTurnBoundary, decideTurnStopping, decisionBoundaryKey, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateMinimumHostVersion, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, hostVersionFromPackages, inject, injectActiveProfileHostLock, inspectTargetHostGraph, interpretClause, interpretMessage, isCurrentAcceptedBoundary, isDeterministicCheck, isExecutableItem, isFrozenV042RebindResponse, isInformationalMessage, isOpenObligation, isRootPauseRequest, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, kindOfScope, latestAssistantText, latestRootInstruction, lifecyclePhase, maskCodeSpans, name, namedActions, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parseHostVersion, parsePwshCommand, parseShellCommand, previewFirstStepInjection, progressFingerprint, proofCapabilityReport, proofDigest, proofDigestV2, proofEvidenceConstraints, proofHostSurfacesOf, proofOperationMatches, proofV2Rejection, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualifyBoundary, readActiveHostGraph, rebindAttemptKey, rebindResponse, recoveryDigest, relevantEvidence, renderRecoveryPacket, replayRebindResult, requestedIdentityKey, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, requiredSubjectsOf, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, satisfiesSupportedHostRange, scopeCoverageDigest, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, semanticActionOfScope, sessionQuery, sessionQueryV2, sha256, snapshotSessionEvents, statefulActionsOfScope, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, validateProofManifestV2, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };