dsh-completion-guard 0.5.3 → 0.6.1

package/dist/{index-BTaiOcE-.d.ts → index-C_N6DaSF.d.ts}

@@ -18,6 +18,13 @@ declare function sanitizeUrl(value: string): string;
 //#region src/domain/protocol-manifest.d.ts
 declare const STOP_PROTOCOL_VERSION = "2.0.0";
 declare const CERTIFICATE_VERSION = "1";
+/**
+* 0.6.0 v5-session identity (P0 §1): v2 certificates bind a work unit's
+* closure instead of the whole session. Version-1 identity keeps its
+* historical meaning for legacy sessions and is never silently re-read.
+*/
+declare const STOP_PROTOCOL_VERSION_V2 = "3.0.0";
+declare const CERTIFICATE_VERSION_V2 = "2";
 declare const ACTION_MANIFEST_VERSION = 1;
 declare const SUPPORTED_EVIDENCE_ADAPTERS: Readonly<Record<string, string>>;
 declare const SEMANTIC_ACTIONS: readonly ["inspect_remote_updates", "install", "apply", "create", "modify", "test", "verify", "pull", "fetch", "commit", "push", "restart", "publish", "generic_run"];
@@ -43,10 +50,29 @@ declare function semanticActionFromCommand(command: string): SemanticAction;
 declare function isStatefulAction(action: SemanticAction): action is StatefulAction;
 declare function actionCompatible(required: SemanticAction, observed: SemanticAction): boolean;
 declare function validateActionTarget(action: SemanticAction, resolved: TargetTuple | undefined, observed: TargetTuple | undefined): boolean;
+/** The single identity field a root instruction must name for this action. */
+declare function requestedIdentityKey(action: SemanticAction): string | undefined;
+/**
+* The 0.6.0 bounded file-choice vocabulary (C07/S03): artifact-type nouns a
+* root instruction may use instead of an exact path. The assistant may pick
+* the exact file INSIDE the captured scope and inside the type, and the
+* choice is frozen by the resolution producer before any effect. An absent
+* extension set (`file`) admits any file the producer accepts.
+*/
+declare const BOUNDED_ARTIFACT_TYPES: Readonly<Record<string, ReadonlySet<string> | null>>;
+/**
+* Whether a bounded-choice requested target authorizes this resolved target:
+* the resolved artifact must live inside the captured scope and match the
+* captured type. The exact file name is the assistant's bounded decision,
+* frozen by resolution — never a root-named identity substitution.
+*/
+declare function boundedArtifactChoiceMatches(action: SemanticAction, requested: TargetTuple | undefined, resolved: TargetTuple | undefined): boolean;
 /**
 * Compare identities captured from the root instruction with a complete
 * adapter-resolved target. Requested targets are partial by design: only
 * explicitly named identities (plus the active repository scope) are frozen.
+* A bounded artifact choice (scope + type, C07) matches when the resolved
+* exact file is inside the scope and of the captured type.
 */
 declare function requestedTargetMatchesResolved(action: StatefulAction, requested: TargetTuple | undefined, resolved: TargetTuple | undefined): boolean;
 /** A mutation requires every user-selectable identity field, not a partial match. */
@@ -95,7 +121,7 @@ interface InterpretOptions {
   coordinationSplit?: boolean;
 }
 /** What one scope does with the action it names. */
-type DirectiveClass = "directive" | "prohibition" | "conditional" | "informational" | "narrative";
+type DirectiveClass = "directive" | "prohibition" | "conditional" | "informational" | "narrative" | "unresolved";
 /** Who is expected to perform the action. */
 type Executee = "agent" | "user" | "unresolved";
 /** How the scope's authority reads. */
@@ -247,6 +273,153 @@ declare function replayRebindResult(p: GuardProjection, args: RebindArgs, record
 * caller processes the remaining text afterwards with its own semantics. */
 declare function confirmRebind(p: GuardProjection, proposalId: string, eventId: string, durable: boolean): boolean;
 //#endregion
+//#region src/domain/release.d.ts
+declare const RELEASE_OPERATIONS: readonly ["npm_publish", "git_tag", "github_release_create", "github_release_update", "github_release_delete", "composite_runner"];
+type ReleaseOperation = (typeof RELEASE_OPERATIONS)[number];
+/**
+* The candidate identity a release contract freezes. Each field names exactly
+* one measurable identity; all are optional except the full commit, because a
+* contract that names nothing cannot be checked against anything.
+*/
+interface ReleaseCandidate {
+  /** The commit the artifact was built from (the artifact's embedded gitHead). */
+  fullSha40: string;
+  /** The ref that commit must be on, when the surface can observe a ref. */
+  ref?: string;
+  /** Repository identity (owner/name or clone URL). */
+  repository?: string;
+  /** Package or artifact name. */
+  packageId?: string;
+  /** Exact released version. */
+  version?: string;
+  /** SHA-256 of the exact artifact bytes (64 lowercase hex). */
+  artifactSha256?: string;
+  /** npm integrity of the exact artifact bytes (`sha512-<base64>`). */
+  artifactSri?: string;
+  /** The registry the artifact is published to (canonical base URL). */
+  registry?: string;
+}
+interface ReleaseContract {
+  contractId: string;
+  adoptedBy: {
+    seq: number;
+    digest: string;
+  };
+  /**
+  * The contract revision the candidate scope was FROZEN at. The closure
+  * certificate must be the one that certified exactly this revision: a later
+  * obligation (including the release instruction itself) does not invalidate
+  * the accepted candidate, while a certificate minted after the adoption — or
+  * a candidate whose content moved on — is refused.
+  */
+  adoptedAtRevision: number;
+  operations: ReleaseOperation[];
+  candidate: ReleaseCandidate;
+  readinessRefs: string[];
+  closureCertRef?: string;
+  /**
+  * The closure certificate as it existed AT ADOPTION, frozen by identity.
+  *
+  * Comparing only the revision let a log entry ADD the certificate after the
+  * adoption and still ratify it: the adoption would be validated by evidence
+  * that did not exist when it was made. Freezing the certification digest (and
+  * its epoch/revision) pins the exact certificate the adopter relied on, so a
+  * certificate that appears later — even one that reuses the same id — is
+  * refused. Absent means the adopter named a closure that did not exist yet,
+  * which is equally refused: a later log entry can never supply it.
+  */
+  frozenClosure?: {
+    id: string;
+    certificationDigest: string;
+    epoch: number;
+    contractRevision: number;
+  };
+  expiresAtEpochMs?: number;
+  /** Durable root revocation; the record is kept for audit, never deleted. */
+  revokedAtSeq?: number;
+}
+interface ReleaseReservation {
+  contractId: string;
+  operation: ReleaseOperation;
+  callId: string;
+  startedAtSeq: number;
+  status: "in_flight";
+  /**
+  * The npm SRI the trusted producer read when the reservation was written.
+  * Recorded so a contract that froze only the byte SHA-256 can still be
+  * reconciled by a registry readback: without it, a SHA-256-only contract
+  * would be permanently unsettleable.
+  */
+  observedArtifactSri?: string;
+}
+type ReleaseOutcome = "settled" | "unconfirmed" | "unknown" | "failed" | "not_effected";
+interface ReleaseSettlement {
+  contractId: string;
+  operation: ReleaseOperation;
+  callId: string;
+  settledAtSeq: number;
+  /** A trusted readback identity, or the reason no producer exists. */
+  readback: {
+    kind: "npm_integrity" | "git_ref" | "github_release";
+    identity: string;
+  } | "unavailable";
+  outcome: ReleaseOutcome;
+}
+/**
+* The identity a trusted producer observed for the candidate. Every field is
+* optional because a given surface can observe only some of them; a field the
+* contract declares but the producer does not observe is a refusal, never a
+* silent pass.
+*/
+interface ReleaseObservedIdentity {
+  fullSha40?: string;
+  /** The ref NAME the candidate is expected to be on. */
+  ref?: string;
+  /** The commit that ref resolves to, read by the audited git producer. */
+  refSha?: string;
+  repository?: string;
+  packageId?: string;
+  version?: string;
+  artifactSha256?: string;
+  artifactSri?: string;
+  registry?: string;
+}
+interface ReleaseGateDecision {
+  status: "granted" | "denied";
+  reasonCode: string;
+  contractId?: string;
+}
+//#endregion
+//#region src/domain/host-selection.d.ts
+/**
+* Trusted host-native selection adapter (0.6.0 DS06-D, C07/S06).
+*
+* Only a PAIRED durable tool round-trip can form a trusted user selection:
+* a `tool/call` whose arguments pose a question with explicit options, and
+* its successful `tool/result` carrying the answer, bound by the same
+* callId in the same session. Pasted answer text, a model restatement, or
+* the answer of another call can never form a selection. Path selections
+* and sandbox approvals are separate facts and are recorded separately.
+*
+* The question tool's name is a host tool-bundle surface: the adapter
+* matches a bounded allowlist supplied by the caller (production wires the
+* names audited for the running cohort; native acceptance pins them).
+*/
+interface TrustedSelection {
+  callId: string;
+  /** Sequence of the tool/result event that settled the selection. */
+  resultSeq: number;
+  turn: number | undefined;
+  toolName: string;
+  questionId: string | undefined;
+  question: string | undefined;
+  options: string[];
+  /** The answer the user actually chose, verbatim from the paired result. */
+  selected: string;
+  /** A directory selection narrows where bounded file choices may land. */
+  kind: "directory" | "value";
+}
+//#endregion
 //#region src/domain/digest.d.ts
 type TypedObject = {
   k: "b" | "i" | "s" | "e" | "x";
@@ -297,7 +470,13 @@ interface PackageRow {
 //#endregion
 //#region src/domain/types.d.ts
 type GuardItemKind = "requirement" | "acceptance" | "prohibition";
-type GuardItemStatus = "pending" | "passed" | "superseded";
+/**
+* `answered` (0.6.0, C03) marks an information-slot obligation closed by a
+* trusted delivery fact: the host-confirmed final answer of a completed turn.
+* It certifies only that delivery happened — never accuracy, sufficiency, or
+* that any execution happened. Legacy sessions (no v5 boundary) never mint it.
+*/
+type GuardItemStatus = "pending" | "answered" | "passed" | "superseded";
 type GuardIntegrity = "valid" | "unknown" | "corrupt";
 type EvidenceOutcome = "success" | "failure" | "unknown" | "durability-unknown";
 type GuardOperation = "create" | "write" | "modify" | "read" | "run" | "verify";
@@ -315,6 +494,28 @@ interface GoalRef {
   id: string;
   revision: number;
 }
+/**
+* 0.6.0 source span (C01): a UTF-8 byte half-open interval `[start, end)`
+* inside the ORIGINAL root message text (before any normalization), bound to
+* that message's content digest. Offsets are byte offsets computed with
+* TextEncoder — never string indices — so Python and TypeScript agree on the
+* same positions.
+*/
+interface SourceSpan {
+  /** Index of the message part the span anchors to (0 = text). */
+  partIndex: number;
+  start: number;
+  end: number;
+  class: "instruction" | "adoption" | "question" | "constraint";
+}
+/** 0.6.0 per-message coverage summary (C01), bounded to the last 16 messages. */
+interface MessageCoverage {
+  seq: number;
+  rawTextSha256: string;
+  byteLength: number;
+  /** Number of obligation spans the message contributed to items. */
+  coveredSpans: number;
+}
 interface WaitAuthorization {
   kind: "root_explicit_wait" | "user_decision_item";
   id: string;
@@ -340,6 +541,37 @@ interface VerificationContract {
   * on the same canonical subject — mentioning the file is not enough. */
   operation?: GuardOperation;
 }
+/**
+* 0.6.1 (W060-01): the durable identity of one non-text root input part. The
+* asset obligation binds the exact message sequence, part index and content
+* digest of the ORIGINAL input — never a model description of it — so an
+* interpretation can only ever be recorded against the asset it interpreted.
+*/
+interface AssetObligation {
+  /** Sequence of the root message that carried the part. */
+  messageSeq: number;
+  /** Index of the non-text part inside that message. */
+  partIndex: number;
+  /** sha256 of the canonical JSON of the part: the media identity. */
+  mediaSha256: string;
+}
+/**
+* 0.6.1 (W060-01): one durable per-asset interpretation record, derived from a
+* confirmed `context_guard_interpret` result that replay re-validated against
+* the contract (call arguments, item, revision, asset identity). It is the
+* model's explicit declaration that it read THAT obligation's asset in THAT
+* host turn; it never proves the interpretation is correct, and it closes
+* nothing by itself — an asset obligation closes only when a delivery of the
+* interpretation's own turn exists. Absent from logs written before this
+* entrypoint existed, which is what keeps upgrade replays from retroactively
+* interpreting old assets.
+*/
+interface AssetInterpretationFact {
+  itemId: string;
+  resultSeq: number;
+  /** The host turn the interpretation happened in. */
+  turn: number;
+}
 interface GuardItem {
   id: string;
   revision: number;
@@ -395,6 +627,52 @@ interface GuardItem {
   waitAuthorization?: WaitAuthorization;
   deferAuthorization?: DeferAuthorization;
   persistenceAuthorization?: PersistenceAuthorization;
+  /**
+  * 0.6.0 C01 provenance: the content digest of the original root message
+  * text and the UTF-8 byte spans inside it that this item's clause came
+  * from. Absent on legacy items, which keep their historical reading.
+  */
+  rawTextSha256?: string;
+  spans?: SourceSpan[];
+  /**
+  * 0.6.0 work-unit assignment (C04), present only for obligations captured
+  * after a v5 protocol boundary in a non-delegated session. Legacy items keep
+  * the whole-session contract and carry no unit.
+  */
+  unitId?: string;
+  /**
+  * The trusted delivery fact that closed an information-slot item: the host's
+  * completed turn and its final assistant message. Derived from durable
+  * events, never from assistant prose alone.
+  */
+  answeredBy?: {
+    turn: number;
+    responseSeq: number;
+    responseSha256: string;
+  };
+  /**
+  * 0.6.0 C08: the pending obligation this item atomically superseded through
+  * a verbatim general clarification. Audit trail only — the superseded item
+  * keeps its own history.
+  */
+  clarifiesItemId?: string;
+  /**
+  * 0.6.1 (W060-01 review round 10): set on the sub-items created when an
+  * unresolved clause is superseded by its recorded interpretation
+  * partition. Names the superseded unresolved obligation; the information
+  * sub-items close through the interpreting turn's delivery, while unknown
+  * and undeclared sub-spans stay pending.
+  */
+  interpretedFromUnresolved?: string;
+  /**
+  * 0.6.1 (W060-01): present only on an asset-interpretation obligation. The
+  * item's information slot closes through the SAME trusted-delivery fact as
+  * any inquiry of its turn; the closing answers the request that carried the
+  * asset, never the correctness of the interpretation, and visual-comparison
+  * proof (strict surface 'visual') stays a separate obligation. Absent on
+  * every other item, so legacy and ordinary text items are unchanged.
+  */
+  asset?: AssetObligation;
 }
 interface GuardEvidence {
   id: string;
@@ -432,6 +710,13 @@ interface GuardEvidence {
   adapterId?: string;
   adapterVersion?: string;
   externalOperationRef?: ExternalOperation;
+  /**
+  * 0.6.0 C04: this fact came from a delegated subagent/task round-trip. A
+  * delegated result is BOUNDED evidence for the parent unit — it is recorded
+  * and visible, and it can never close a parent obligation or a parent unit
+  * by itself. Set only by the derivation, never by a caller.
+  */
+  delegatedSubtask?: true;
 }
 interface ExpectedTransition {
   predicateId: string;
@@ -482,6 +767,58 @@ interface GuardCheckpoint {
   goalRef?: GoalRef;
   certificationDigest: string;
   result: "certified" | "incomplete" | "unknown";
+  /**
+  * 0.6.0 v2 certificate (v5 sessions only): the unit whose closure was
+  * certified. Version-1 certificates keep the whole-session contract and
+  * never carry a unit.
+  */
+  unitId?: string;
+  /** v2 certificates: the digest of the certified unit's open closure. */
+  unitClosureDigest?: string;
+}
+/**
+* One 0.6.0 work unit (C04): the obligations captured from one root task and
+* their closure state. Units are derived from the durable message stream, so
+* they replay deterministically; no unit state is ever written to the log.
+*/
+interface WorkUnit {
+  unitId: string;
+  /** Sequence of the root message that opened the unit. */
+  openedAtSeq: number;
+  /** Root messages folded into this unit, in source order. */
+  rootInputRefs: Array<{
+    seq: number;
+  }>;
+  /** The normalized text of the unit's opening instruction (bounded audit). */
+  headline: string;
+  /** Sequence at which a newer unit became current, when superseded as current. */
+  switchedAwayAtSeq?: number;
+  /**
+  * The unit this one descends from. A delegation-marked root message opens a
+  * CHILD unit of the current unit (C04): the child's open obligations are part
+  * of the parent's required closure, so the parent can never be certified
+  * while a delegated sub-unit still has open work. An ordinary task switch
+  * opens a sibling instead, which is why its residual work never blocks the
+  * newer unit's certificate.
+  */
+  parentUnitId?: string;
+  /**
+  * Delegated round-trips that entered this unit as bounded evidence (C04).
+  * Recorded for audit only: a subagent's completion is never a parent
+  * completion.
+  */
+  delegationRefs?: DelegationRef[];
+}
+/** One durable delegated round-trip observed inside a session. */
+interface DelegationRef {
+  /** The tool call that requested the delegation. */
+  callId: string;
+  /** Sequence of the paired result event. */
+  resultSeq: number;
+  /** Audited delegation tool that produced the result. */
+  toolName: string;
+  /** Whether the delegated round-trip reported success. */
+  status: "completed" | "failed" | "unknown";
 }
 type BoundaryDisposition = "user_wait" | "external_wait" | "deferred" | "guard_bounded_stop";
 type BoundaryQualificationKind = "user_decision_item" | "root_explicit_wait" | "external_operation_pending" | "root_explicit_defer" | "guard_no_progress";
@@ -516,6 +853,67 @@ interface GuardProjection {
   checkpoints: GuardCheckpoint[];
   boundaries: GuardBoundary[];
   externalOperations: Map<string, ExternalOperation>;
+  /**
+  * 0.6.0 work units keyed by unit id, and the id of the unit currently
+  * receiving captured work. Derived; present only after a v5 boundary.
+  */
+  units: Map<string, WorkUnit>;
+  currentUnitId?: string;
+  /**
+  * The session's rule mode: `5` once a v5 protocol boundary exists in the log,
+  * `undefined` (legacy) before it. Determines certificate version, closure
+  * scope, and whether delivery/unit semantics are active.
+  */
+  boundaryProtocol?: 5;
+  /** 0.6.0 responsibility tier (C06), from the effective configuration. */
+  policy: "standard" | "strict" | "release";
+  /** 0.6.0 C01 coverage summaries, one per captured root message (last 16). */
+  coverage: MessageCoverage[];
+  /**
+  * 0.6.0 C10 explicit release records, derived from the durable plugin-notice
+  * channel. A release is never implicit: without an adopted contract the
+  * release gate denies every operation. A malformed record is reported through
+  * {@link releaseDiagnostics} and never makes the whole projection corrupt, so
+  * damaged release state cannot block unrelated ordinary work.
+  */
+  releaseContracts: ReleaseContract[];
+  releaseReservations: ReleaseReservation[];
+  releaseSettlements: ReleaseSettlement[];
+  /** Bounded audit of rejected release records (never raw payloads). */
+  releaseDiagnostics: Array<{
+    seq: number;
+    reasonCode: string;
+  }>;
+  /**
+  * True when a release record could not be read back. Damaged release state
+  * blocks RELEASE operations with `release_state_damaged` while leaving the
+  * projection's own integrity and all ordinary work untouched: the plugin
+  * reports what it cannot read instead of quietly forgetting it.
+  */
+  releaseStateDamaged: boolean;
+  /**
+  * 0.6.0 C07 trusted host selections, derived only from paired durable
+  * question-tool round-trips (last 16). A directory selection narrows where
+  * a bounded file choice may land for obligations of the same unit.
+  */
+  trustedSelections: TrustedSelection[];
+  /**
+  * 0.6.1 (W060-01): the derived per-asset interpretation records (bounded to
+  * the last 64), one per confirmed `context_guard_interpret` result. Derived,
+  * never written by a caller.
+  */
+  interpretationFacts: AssetInterpretationFact[];
+  /**
+  * 0.6.0 C07 sandbox approvals, derived from the host's own
+  * `approval/asked` + `approval/decided` audit pair (last 16). Recorded for
+  * provenance only: an approval is never a target authority.
+  */
+  approvals: Array<{
+    id: string;
+    seq: number;
+    toolName?: string;
+    outcome: "allowed-once" | "rejected" | "cancelled" | "unavailable";
+  }>;
   sessionRefDigest: string;
   hostLockDigest: string;
   hostStatus: HostStatus;
@@ -572,6 +970,16 @@ interface GuardProjection {
   * of the same turn re-reads the same number.
   */
   hostTurn?: number;
+  /**
+  * Runtime-owned durability watermark (0.6.0 fresh-projection contract): the
+  * result of the most recent flush performed by a public read/control entry.
+  * `confirmed` means the last entry observed a durable log, `failed` means a
+  * flush was refused or threw, and `unknown` means no flush has been observed
+  * yet. A `failed` watermark must make read entries report unavailability —
+  * never a stale-cache projection and never an empty ledger. Preserved
+  * across rebuilds like the other runtime-owned liveness state.
+  */
+  durabilityWatermark: "confirmed" | "failed" | "unknown";
   /** Log-derived count of rejected rebind attempts by stable attempt key; survives reload. */
   rebindRejections: Map<string, number>;
   integrity: GuardIntegrity;
@@ -584,6 +992,8 @@ interface DeriveScope {
 }
 interface DeriveConfig {
   activation: "opt-in" | "always";
+  /** 0.6.0 responsibility tier (C06); standard by default. */
+  policy?: "standard" | "strict" | "release";
 }
 interface DeriveResult {
   projection: GuardProjection;
@@ -597,6 +1007,8 @@ interface DeriveResult {
   realRootInputSeen: boolean;
   /** True when the durable log carries the 0.5 first-step protocol boundary. */
   protocolV4Present: boolean;
+  /** True when the durable log carries the 0.6 first-step protocol boundary. */
+  boundaryV5: boolean;
 }
 interface DerivedEnvelope {
   seq: number;
@@ -1088,6 +1500,15 @@ declare function bindExecutableIdentity(resolution: ExecutableIdentity | undefin
 declare const DEFAULT_HOST_LOCK: HostLockEvaluation;
 //#endregion
 //#region src/domain/derive.d.ts
+/**
+* Audited delegation tool names (C04/DS06-B). A tool result from one of these
+* is a subagent's answer: bounded evidence for the unit that asked for it, and
+* never a parent completion. The real names are a host tool-bundle surface —
+* native acceptance pins the audited cohort, exactly like the question-tool
+* allowlist — so this list is the production default and can be overridden by
+* an audited cohort.
+*/
+declare const DEFAULT_DELEGATION_TOOL_NAMES: readonly string[];
 declare const CAPTURE_V042_NOTICE = "Context Guard capture boundary: v0.4.2";
 declare const PROTOCOL_V3_NOTICE = "Context Guard protocol boundary: v3.0.0";
 /**
@@ -1099,6 +1520,15 @@ declare const PROTOCOL_V3_NOTICE = "Context Guard protocol boundary: v3.0.0";
 */
 declare const PROTOCOL_V4_NOTICE = "Context Guard protocol boundary: v4.0.0";
 /**
+* 0.6.0 first-step boundary: same placement discipline as v4. It cuts the
+* work-unit, delivery, and certificate-v2 semantics (P0 §1): messages before
+* it keep their historical rules, messages after it are captured into work
+* units and close through unit-closure certificates and trusted deliveries.
+* An old binary ignores this notice (plugin source, unmatched pattern), so the
+* fail direction on rollback is closed, never a misread.
+*/
+declare const PROTOCOL_V5_NOTICE = "Context Guard protocol boundary: v5.0.0";
+/**
 * Pure, deterministic re-derivation of the guard projection from the DSH
 * native event log. Context Guard never writes custom session events, so every
 * piece of state is derived from `command/run`, `user/message`, `tool/call`,
@@ -1107,6 +1537,18 @@ declare const PROTOCOL_V4_NOTICE = "Context Guard protocol boundary: v4.0.0";
 */
 declare function deriveProjection(sourceEvents: readonly DerivedEnvelope[], config: DeriveConfig, scope: DeriveScope, durableConfirmed: boolean, hostLock?: HostLockEvaluation): DeriveResult;
 //#endregion
+//#region src/domain/reason-class.d.ts
+/**
+* The seven unified reason-class labels (0.6.0 C12).
+*
+* Every fine-grained `reason_code` maps onto exactly one class, so a caller can
+* branch on the class while the existing codes keep their exact meaning and
+* their existing tests. The mapping table below is the frozen table; the
+* fallback for an unmapped code is `source_insufficient`, never a new class —
+* an unknown code must not silently become a different kind of failure.
+*/
+type ReasonClass = "parameter_missing" | "source_insufficient" | "condition_unmet" | "producer_capability_unavailable" | "historical_gap" | "integrity_failure" | "policy_boundary";
+//#endregion
 //#region src/domain/diagnostics.d.ts
 type TaskKind = "inquiry" | "action" | "deliverable" | "constraint" | "unresolved";
 type CertificationSupport = "supported" | "unsupported" | "needs_target" | "needs_evidence" | "unavailable";
@@ -1127,6 +1569,8 @@ interface UnifiedItemDiagnosis {
   task_kind: TaskKind;
   certification: CertificationSupport;
   reason_code: string;
+  /** The seven-class label this fine-grained reason code belongs to (C12). */
+  reason_class: ReasonClass;
   repairability: Repairability;
   missing_fields: string[];
   missing_facets: Array<"resolution" | "effect" | "state">;
@@ -1140,6 +1584,12 @@ interface UnifiedItemDiagnosis {
 * adapter, an executed-without-evidence historical gap, or nothing to do —
 * and it NEVER recommends a rebind that cannot change certification.
 */
+/**
+* The unified diagnosis, with the frozen seven-class label attached (C12).
+*
+* The class is derived from whatever `reason_code` the judge decides, so a new
+* branch cannot drift from the classification table.
+*/
 declare function deriveItemDiagnosis(p: GuardProjection, item: GuardItem): UnifiedItemDiagnosis;
 /** Legacy compact view, now derived from the single unified diagnosis. */
 declare function itemDiagnosis(p: GuardProjection, item: GuardItem): {
@@ -1332,7 +1782,7 @@ interface GitEffectRunner {
 }
 interface GitEffectExecution {
   status: "executed" | "rejected";
-  reasonCode?: GitPrestateCheck["reasonCode"] | "repository_missing";
+  reasonCode?: GitPrestateCheck["reasonCode"] | "repository_missing" | "effect_already_applied";
 }
 interface LinearCommitReadback {
   /** Commit reached after the guarded effect. */
@@ -1488,10 +1938,14 @@ interface FirstStepPreviewInput {
   activation: "opt-in" | "always";
   /** Log-derived enablement: an explicit `off` suppresses `always` until `on`. */
   enabled: boolean;
+  /** The durable log already contains a v5 (0.6) Guard boundary. */
+  boundaryV5Present?: boolean;
   /** The durable log already contains a v4 (or newer) Guard boundary. */
   boundaryPresent: boolean;
   /** The session is a delegated/subagent session, never a root conversation. */
   delegated: boolean;
+  /** 0.6.1 (W060-05): the effective responsibility tier shapes the guidance. */
+  policy?: "standard" | "strict" | "release";
 }
 /**
 * Pure decision for the first-step activation injection when protection is enabled. The
@@ -1499,14 +1953,24 @@ interface FirstStepPreviewInput {
 * persisted step batch; guidance is compact and never claims a recovery that
 * did not happen. `opt-in` reaches this path only after its explicit `on` command. Delegated sessions receive neither: their
 * scope arrives through the parent's delegation prompt (A04).
+*
+* A session without a v5 boundary receives the 0.6 boundary: it cuts the
+* work-unit/delivery/certificate-v2 semantics at exactly this message. A
+* session that already has v5 injects nothing.
 */
 declare function previewFirstStepInjection(input: FirstStepPreviewInput, claimedRealInput: boolean): FirstStepInjection | undefined;
 /**
 * Compact first-step guidance: protection has started, what it protects, and
-* the working order for stateful actions. It is not a task, asks no question,
-* and contains no recovery wording.
+* when the guarded producer path is needed. 0.6.1 (W060-05): the stateful
+* workflow is stated CONDITIONALLY — only an obligation whose own clause
+* demands a certified stateful action runs through prepare/producer/checkpoint.
+* The 0.6.0 text demanded that order for every stateful action unconditionally,
+* which ordinary business work correctly read as a Guard approval gate.
+* Ordinary answers, investigations, and ordinary tool work are never gated, and
+* missing Guard evidence is never a reason to repeat a completed action.
 */
-declare const FIRST_STEP_GUIDANCE = "Context Guard is now protecting this session: requirements from your messages stay open until they are certified with matching durable evidence. Before a stateful action (write, install, commit, push, publish, restart), call context_guard_prepare to see the supported command shape and required resolution/effect/state order; collect evidence with the guarded tools, then close items with context_guard_checkpoint. Ordinary answers and investigations need no certification.";
+declare function firstStepGuidance(policy?: "standard" | "strict" | "release"): string;
+declare const FIRST_STEP_GUIDANCE: string;
 /**
 * Lifecycle phase derived from durable facts. `enabled` is the log-derived
 * enablement (`always`, or the explicit `on`/`off` command sequence), and
@@ -1648,6 +2112,105 @@ declare function bindProofToProjection(projection: GuardProjection, proof: Proof
 declare function canonicalProjection(projection: GuardProjection): Record<string, unknown>;
 declare function sessionQuery(projection: GuardProjection, proof?: ProofManifest): SessionQuery;
 declare function proofEvidenceConstraints(evidence: GuardEvidence, obligation: ProofObligation): boolean;
+declare const PROOF_PROTOCOL_VERSION_V2 = "0.6.0";
+/** The v2 digest domain; the v1 domain string is untouched. */
+declare const PROOF_MANIFEST_DOMAIN_V2 = "ccg.proofManifest.v2";
+declare const PROOF_KINDS_V2: readonly ["subject_readback", "scope_coverage", "state_verification", "input_asset_check", "output_visual_readback", "object_url_readback", "execution_fact", "external_fact"];
+type ProofKindV2 = (typeof PROOF_KINDS_V2)[number];
+/** Host surfaces that can carry a proof producer in the audited cohort. */
+type ProofHostSurface = "native_read" | "native_write_edit" | "shell" | "web" | "jobs" | "subagent" | "visual_capture";
+interface ProofObligationV2 {
+  obligationId: string;
+  kind: ProofKindV2;
+  surface: ProofSurface;
+  /** The current subject identities this obligation binds. */
+  subjectIds: string[];
+  /** Producer/source identities a satisfying fact must originate from. */
+  sourceIds: string[];
+  /** The operation the fact must have actually performed. */
+  operation: GuardOperation;
+  evidenceIds: string[];
+  expectedScopeDigest?: string;
+  observedScopeDigest?: string;
+}
+interface ProofManifestV2 {
+  proofProtocolVersion: typeof PROOF_PROTOCOL_VERSION_V2;
+  obligations: ProofObligationV2[];
+  proofSha256: string;
+}
+/**
+* The frozen capability requirement per proof kind. `capabilities` is the set
+* a satisfying fact must intersect; `readbackRequired` demands an actual read
+* or verify operation (never a bare successful call); `requiredRole` pins the
+* fact to the resolution/effect/state role the semantics need; and
+* `supportedSurfaces` lists the audited host surfaces that can produce it.
+*/
+interface ProofKindCapability {
+  kind: ProofKindV2;
+  capabilities: string[];
+  readbackRequired: boolean;
+  requiredRole?: EvidenceRole;
+  operationOnSubject: boolean;
+  supportedSurfaces: ProofHostSurface[];
+  /** Host surfaces in the audited cohort that CANNOT produce this fact. */
+  unavailableSurfaces: ProofHostSurface[];
+}
+declare const PROOF_CAPABILITY_MATRIX: Readonly<Record<ProofKindV2, ProofKindCapability>>;
+/** The host surface names a fact's tool/adapter identity maps to. */
+declare function proofHostSurfacesOf(evidence: GuardEvidence): ProofHostSurface[];
+declare function proofDigestV2(obligations: readonly ProofObligationV2[]): string;
+declare function createProofManifestV2(obligations: readonly ProofObligationV2[]): ProofManifestV2;
+declare function validateProofManifestV2(manifest: unknown): string[];
+/**
+* Why one fact cannot discharge one v2 obligation, or `undefined` when it can.
+* The checks are ordered so the reported reason names the first unmet
+* requirement: missing producer capability, wrong role, absent readback, wrong
+* source, wrong subject, wrong operation.
+*/
+declare function proofV2Rejection(evidence: GuardEvidence, obligation: ProofObligationV2): string | undefined;
+/**
+* The subjects an item's own obligation requires. They come from the item's
+* frozen verification contract and captured target — never from the proof
+* manifest, which is exactly what a proof must be checked against.
+*/
+declare function requiredSubjectsOf(item: GuardItem): string[];
+/** The frozen coverage digest of a subject set: sorted, then hashed. */
+declare function scopeCoverageDigest(subjects: readonly string[]): string;
+/** Whether the fact performed an operation the kind accepts. */
+declare function proofOperationMatches(evidence: GuardEvidence, obligation: ProofObligationV2): boolean;
+/**
+* Bind a v2 manifest to the live projection; [] means every obligation binds.
+*
+* The binding is the whole chain the review demanded, in one place:
+* the user's obligation (frozen subject and scope on the ITEM) → the trusted
+* producer fact (qualified by the same availability rules ordinary evidence
+* uses) → the declared source → the declared operation and its order relative
+* to the effect → the real coverage set. Only then is the obligation
+* discharged. A manifest that describes a different subject than the item
+* asked about fails even when the manifest and the facts agree with each
+* other.
+*/
+declare function bindProofV2ToProjection(projection: GuardProjection, manifest: ProofManifestV2): string[];
+/** The v2 session query; the v1 `sessionQuery` keeps its own frozen behaviour. */
+interface SessionQueryV2 {
+  sessionRefDigest: string;
+  epoch: number;
+  contractRevision: number;
+  state: "valid" | "unknown" | "corrupt";
+  proof?: ProofManifestV2;
+  cohortId?: string;
+  reasonCode?: "proof_invalid" | "proof_unbound";
+}
+declare function sessionQueryV2(projection: GuardProjection, proof?: ProofManifestV2): SessionQueryV2;
+/**
+* The capability report for one proof kind against the facts a cohort actually
+* produced: `unavailable` with a stable reason when no producer is observable,
+* never a silent pass.
+*/
+declare function proofCapabilityReport(kind: ProofKindV2, facts: Iterable<GuardEvidence>): {
+  status: "supported" | "unavailable";
+  reasonCode?: string;
+};
 //#endregion
 //#region src/domain/alpha3-host.d.ts
 /** Exact 34-row alpha.3 runtime/web graph from the 2026-09-01 annex audit. */
@@ -1856,4 +2419,4 @@ declare function latestAssistantText(events: readonly {
 //#region src/domain/supersession.d.ts
 declare function supersedeItem(items: Map<string, GuardItem>, oldId: string, replacement: GuardItem): boolean;
 //#endregion
-export { COMMAND_SURFACE_MANIFEST as $, kindOfScope as $i, bindLiveGoalCapability as $n, BindingActionClosure as $r, parsePwshCommand as $t, openItems as A, WaitAuthorization as Ai, BASE_HOST_PACKAGES as An, parseConfirmationMessage as Ar, GitCommandManifest as At, SessionQuery as B, proposeRebindV042 as Bi, HostCapabilityId as Bn, extractMethod as Br, commitTreeSnapshotDigest as Bt, RC015_RC2_HOST_PACKAGES as C, canonicalizePath as Ca, HostStatus as Ci, deriveProjection as Cn, TaskIntent as Cr, resolveActiveProfileHostLock as Ct, MIN_RECOVERY_CHAR_BUDGET as D, sanitizeUrl as Da, TargetTuple as Di, ALPHA2_DSHMARKET_139_HOST_PACKAGES as Dn, CONFIRM_LINE_PATTERN as Dr, GIT_COMMAND_TEMPLATES as Dt, DEFAULT_RECOVERY_CHAR_BUDGET as E, sanitizeClauseText as Ea, TargetCaptureStatus as Ei, ACTIVE_HOST_LAUNCHER_VERSION as En, classifyUserInteraction as Er, GIT_COMMAND_MANIFEST_IDS as Et, PROOF_PROTOCOL_VERSION as F, RebindArgs as Fi, GOAL_HOST_PACKAGES as Fn, ClauseSegment as Fr, GitPrestateCheck as Ft, proofEvidenceConstraints as G, DirectiveClass as Gi, HostLockContext as Gn, BoundaryQualification as Gr, revalidateGitPrestate as Gt, canonicalProjection as H, rebindResponse as Hi, HostCohort as Hn, isInformationalMessage as Hr, executeRevalidatedGitEffect as Ht, ProofKind as I, RebindProposal as Ii, HOST_CAPABILITY_PACKAGE_GROUPS as In, captureClause as Ir, GitPrestateEnvelope as It, EvidenceFacetCoverage as J, ScopeInterpretation as Ji, HostPlatform as Jn, GoalBoundaryAccess as Jr, CanonicalCommandSurface as Jt, sessionQuery as K, Executee as Ki, HostLockEvaluation as Kn, BoundaryRequest as Kr, verifiedLinearCommitReadback as Kt, ProofManifest as L, confirmRebind as Li, HOST_COHORTS as Ln, captureItem as Lr, GitTargetIdentity as Lt, renderRecoveryPacket as M, PackageRow as Mi, EXPECTED_HOST_PACKAGES as Mn, RejectedBinding as Mr, GitCommandRejected as Mt, ALPHA3_HOST_PACKAGES as N, BoundedSource as Ni, ExecutableIdentity as Nn, certifyCheckpoint as Nr, GitEffectExecution as Nt, RecoveryOptions as O, sha256 as Oa, TargetValue as Oi, ALPHA2_HOST_PACKAGES as On, ParsedConfirmation as Or, GitAdapterAction as Ot, PROOF_KINDS as P, ProposeOutcome as Pi, ExecutableIdentityBinding as Pn, CaptureScope as Pr, GitEffectRunner as Pt, isVerifyingCapability as Q, isOpenObligation as Qi, bindExecutableIdentity as Qn, qualifyBoundary as Qr, isRunExecutable as Qt, ProofObligation as R, proposeRebind as Ri, HostAuditProvenance as Rn, classifyClause as Rr, LinearCommitReadback as Rt, snapshotSessionEvents as S, validateActionTarget as Sa, GuardProjection as Si, PROTOCOL_V4_NOTICE as Sn, segmentAuthorityBlocks as Sr, readActiveHostGraph as St, RC1_HOST_PACKAGES as T, normalizeClause as Ta, TargetCaptureReasonCode as Ti, ACTIVE_HOST_COHORT_IDS as Tn, classifyTaskIntent as Tr, verifyComposedHostLockDump as Tt, createProofManifest as U, replayRebindResult as Ui, HostCohortSelection as Un, segmentClauses as Ur, gitCommandMatchesTarget as Ut, bindProofToProjection as V, rebindAttemptKey as Vi, HostCapabilityRequest as Vn, extractOperation as Vr, createGitPrestateEnvelope as Vt, proofDigest as W, AuthorityDisposition as Wi, HostCohortSelectionReason as Wn, BoundaryEffectuation as Wr, parseGitCommandManifest as Wt, evidenceCoverage as X, interpretMessage as Xi, HostToolSurface as Xn, effectuateBoundary as Xr, ShellParseStatus as Xt, bindingSatisfies as Y, interpretClause as Yi, HostProfileKind as Yn, availableBoundaryQualifications as Yr, ParsedShell as Yt, evidenceMatchesItem as Z, isExecutableItem as Zi, LEGACY_HOST_COHORTS as Zn, isCurrentAcceptedBoundary as Zr, canonicalArgvFromCommand as Zt, progressFingerprint as _, requestedTargetAuthorizesMutation as _a, GuardIntegrity as _i, evidenceAvailabilityReason as _n, currentContractDigest as _r, hostLockRowsFromComposedDump as _t, NO_PROGRESS_RECORD_PREFIX as a, ACTION_MANIFEST_VERSION as aa, DeriveScope as ai, ToolSubject as an, selectHostCohort as ar, FIRST_STEP_GUIDANCE as at, SessionApiError as b, semanticActionFromText as ba, GuardItemStatus as bi, CAPTURE_V042_NOTICE as bn, AuthorityKind as br, packageRowsFromActiveGraph as bt, classifyCompletionClaim as c, CERTIFICATE_VERSION as ca, EvidenceOutcome as ci, extractToolSubject as cn, LATEST_SUPPORTED_HOST_VERSION as cr, LifecyclePhase as ct, decisionBoundaryKey as d, STOP_PROTOCOL_VERSION as da, ExpectedTransition as di, CertificationSupport as dn, SUPPORTED_HOST_RANGE as dr, previewFirstStepInjection as dt, maskCodeSpans as ea, BoundaryDisposition as ei, parseShellCommand as en, evaluateExternalWaitCapability as er, CommandSurfaceManifest as et, isRootPauseRequest as f, SUPPORTED_EVIDENCE_ADAPTERS as fa, ExternalOperation as fi, DiagnosisNextAction as fn, SUPPORTED_HOST_VERSIONS as fr, ActiveProfileHostLock as ft, observeAssistantOutcome as g, isStatefulAction as ga, GuardEvidence as gi, deriveItemDiagnosis as gn, satisfiesSupportedHostRange as gr, hostLockContextFromComposedDump as gt, latestRootInstruction as h, actionCompatible as ha, GuardCheckpoint as hi, UnifiedItemDiagnosis as hn, parseHostVersion as hr, combineHostPolicy as ht, CompletionDisposition as i, ACTION_MANIFEST as ia, DeriveResult as ii, ToolResultInput as in, hostVersionFromPackages as ir, ClaimedMessage as it, recoveryDigest as j, createProjection as ji, DEFAULT_HOST_LOCK as jn, CheckpointResult as jr, GitCommandParseResult as jt, closingHint as k, VerificationContract as ki, AuditedExecutable as kn, isFrozenV042RebindResponse as kr, GitCommandAccepted as kt, decideTurnBoundary as l, SEMANTIC_ACTIONS as la, EvidenceParseStatus as li, isDeterministicCheck as ln, MIN_SUPPORTED_HOST_VERSION as lr, claimedBatchHasRealRootInput as lt, latestAssistantText as m, StatefulAction as ma, GuardBoundary as mi, TaskKind as mn, evaluateMinimumHostVersion as mr, TargetHostGraph as mt, AssistantOutcomeObservation as n, semanticActionOfScope as na, DeferAuthorization as ni, hasCurrentCertificate as nn, evaluateHostLock as nr, OperationVerbEntry as nt, NO_PROGRESS_TURNS_BEFORE_STOP as o, ActionManifest as oa, DerivedEnvelope as oi, evidenceFromPersistedToolResult as on, HostVersionDecision as or, FirstStepInjection as ot, isWholeTaskCompletionClaim as p, SemanticAction as pa, GoalRef as pi, Repairability as pn, compareHostVersions as pr, HostProfileError as pt, validateProofManifest as q, InterpretOptions as qi, HostLockStatus as qn, GoalActivationState as qr, CanonicalArgv as qt, CONTROL_RECORD_PREFIX as r, statefulActionsOfScope as ra, DeriveConfig as ri, ToolCallInput as rn, evaluateToolSurfaceCapability as rr, validateManifest as rt, TurnStoppingDecision as s, ActionSpec as sa, EvidenceBinding as si, extractTextContent as sn, HostVersionStatus as sr, FirstStepPreviewInput as st, supersedeItem as t, namedActions as ta, BoundaryQualificationKind as ti, goalCompletionDenial as tn, evaluateHostCapability as tr, ManifestIssue as tt, decideTurnStopping as u, STATEFUL_ACTIONS as ua, EvidenceRole as ui, withDurability as un, ParsedHostVersion as ur, lifecyclePhase as ut, SESSION_API_UNSUPPORTED as v, requestedTargetMatchesResolved as va, GuardItem as vi, itemDiagnosis as vn, AuthorityBlock as vr, injectActiveProfileHostLock as vt, RC015_HOST_PACKAGES as w, digestStrings as wa, PersistenceAuthorization as wi, ACTIVE_HOST_COHORT_ID as wn, UserInteractionKind as wr, resolveInstalledHostLock as wt, V3SessionLike as x, validateActionManifest as xa, GuardOperation as xi, PROTOCOL_V3_NOTICE as xn, authorityCaptureCounts as xr, packageRowsFromPnpmLock as xt, SESSION_EVENT_ENVELOPE_INVALID as y, semanticActionFromCommand as ya, GuardItemKind as yi, relevantEvidence as yn, AuthorityBlockKind as yr, inspectTargetHostGraph as yt, ProofSurface as z, proposeRebindOutcome as zi, HostCapabilityEvaluation as zn, extractArtifactPaths as zr, commitIndexSnapshotDigest as zt };
+export { canonicalProjection as $, boundedArtifactChoiceMatches as $a, SourceSpan as $i, AuditedExecutable as $n, isFrozenV042RebindResponse as $r, GitCommandParseResult as $t, openItems as A, interpretMessage as Aa, DeriveConfig as Ai, extractToolSubject as An, HostVersionDecision as Ar, claimedBatchHasRealRootInput as At, ProofHostSurface as B, ActionManifest as Ba, GoalRef as Bi, itemDiagnosis as Bn, satisfiesSupportedHostRange as Br, injectActiveProfileHostLock as Bt, RC015_RC2_HOST_PACKAGES as C, replayRebindResult as Ca, AssetInterpretationFact as Ci, goalCompletionDenial as Cn, bindLiveGoalCapability as Cr, OperationVerbEntry as Ct, MIN_RECOVERY_CHAR_BUDGET as D, InterpretOptions as Da, BoundaryQualificationKind as Di, ToolSubject as Dn, evaluateToolSurfaceCapability as Dr, FirstStepInjection as Dt, DEFAULT_RECOVERY_CHAR_BUDGET as E, Executee as Ea, BoundaryDisposition as Ei, ToolResultInput as En, evaluateHostLock as Er, FIRST_STEP_GUIDANCE as Et, PROOF_KINDS as F, namedActions as Fa, EvidenceOutcome as Fi, Repairability as Fn, SUPPORTED_HOST_RANGE as Fr, HostProfileError as Ft, ProofManifestV2 as G, SEMANTIC_ACTIONS as Ga, GuardItem as Gi, PROTOCOL_V4_NOTICE as Gn, authorityCaptureCounts as Gr, resolveActiveProfileHostLock as Gt, ProofKindCapability as H, BOUNDED_ARTIFACT_TYPES as Ha, GuardCheckpoint as Hi, CAPTURE_V042_NOTICE as Hn, AuthorityBlock as Hr, packageRowsFromActiveGraph as Ht, PROOF_KINDS_V2 as I, semanticActionOfScope as Ia, EvidenceParseStatus as Ii, TaskKind as In, SUPPORTED_HOST_VERSIONS as Ir, TargetHostGraph as It, ProofSurface as J, STOP_PROTOCOL_VERSION_V2 as Ja, GuardOperation as Ji, ACTIVE_HOST_COHORT_ID as Jn, UserInteractionKind as Jr, GIT_COMMAND_MANIFEST_IDS as Jt, ProofObligation as K, STATEFUL_ACTIONS as Ka, GuardItemKind as Ki, PROTOCOL_V5_NOTICE as Kn, segmentAuthorityBlocks as Kr, resolveInstalledHostLock as Kt, PROOF_MANIFEST_DOMAIN_V2 as L, statefulActionsOfScope as La, EvidenceRole as Li, UnifiedItemDiagnosis as Ln, compareHostVersions as Lr, combineHostPolicy as Lt, renderRecoveryPacket as M, isOpenObligation as Ma, DeriveScope as Mi, withDurability as Mn, LATEST_SUPPORTED_HOST_VERSION as Mr, lifecyclePhase as Mt, ALPHA3_HOST_PACKAGES as N, kindOfScope as Na, DerivedEnvelope as Ni, CertificationSupport as Nn, MIN_SUPPORTED_HOST_VERSION as Nr, previewFirstStepInjection as Nt, RecoveryOptions as O, ScopeInterpretation as Oa, DeferAuthorization as Oi, evidenceFromPersistedToolResult as On, hostVersionFromPackages as Or, FirstStepPreviewInput as Ot, PROOF_CAPABILITY_MATRIX as P, maskCodeSpans as Pa, EvidenceBinding as Pi, DiagnosisNextAction as Pn, ParsedHostVersion as Pr, ActiveProfileHostLock as Pt, bindProofV2ToProjection as Q, actionCompatible as Qa, PersistenceAuthorization as Qi, ALPHA2_HOST_PACKAGES as Qn, ParsedConfirmation as Qr, GitCommandManifest as Qt, PROOF_PROTOCOL_VERSION as R, ACTION_MANIFEST as Ra, ExpectedTransition as Ri, deriveItemDiagnosis as Rn, evaluateMinimumHostVersion as Rr, hostLockContextFromComposedDump as Rt, snapshotSessionEvents as S, rebindResponse as Sa, qualifyBoundary as Si, parseShellCommand as Sn, bindExecutableIdentity as Sr, ManifestIssue as St, RC1_HOST_PACKAGES as T, DirectiveClass as Ta, BindingActionClosure as Ti, ToolCallInput as Tn, evaluateHostCapability as Tr, ClaimedMessage as Tt, ProofKindV2 as U, CERTIFICATE_VERSION as Ua, GuardEvidence as Ui, DEFAULT_DELEGATION_TOOL_NAMES as Un, AuthorityBlockKind as Ur, packageRowsFromPnpmLock as Ut, ProofKind as V, ActionSpec as Va, GuardBoundary as Vi, relevantEvidence as Vn, currentContractDigest as Vr, inspectTargetHostGraph as Vt, ProofManifest as W, CERTIFICATE_VERSION_V2 as Wa, GuardIntegrity as Wi, PROTOCOL_V3_NOTICE as Wn, AuthorityKind as Wr, readActiveHostGraph as Wt, SessionQueryV2 as X, SemanticAction as Xa, HostStatus as Xi, ACTIVE_HOST_LAUNCHER_VERSION as Xn, classifyUserInteraction as Xr, GitAdapterAction as Xt, SessionQuery as Y, SUPPORTED_EVIDENCE_ADAPTERS as Ya, GuardProjection as Yi, ACTIVE_HOST_COHORT_IDS as Yn, classifyTaskIntent as Yr, GIT_COMMAND_TEMPLATES as Yt, bindProofToProjection as Z, StatefulAction as Za, MessageCoverage as Zi, ALPHA2_DSHMARKET_139_HOST_PACKAGES as Zn, CONFIRM_LINE_PATTERN as Zr, GitCommandAccepted as Zt, progressFingerprint as _, confirmRebind as _a, GoalActivationState as _i, ParsedShell as _n, HostLockStatus as _r, evidenceCoverage as _t, NO_PROGRESS_RECORD_PREFIX as a, WaitAuthorization as aa, ClauseSegment as ai, GitTargetIdentity as an, semanticActionFromText as ao, GOAL_HOST_PACKAGES as ar, proofEvidenceConstraints as at, SessionApiError as b, proposeRebindV042 as ba, effectuateBoundary as bi, isRunExecutable as bn, HostToolSurface as br, COMMAND_SURFACE_MANIFEST as bt, classifyCompletionClaim as c, PackageRow as ca, classifyClause as ci, commitTreeSnapshotDigest as cn, canonicalizePath as co, HostAuditProvenance as cr, proofV2Rejection as ct, decisionBoundaryKey as d, ReleaseOperation as da, extractOperation as di, gitCommandMatchesTarget as dn, sanitizeClauseText as do, HostCapabilityRequest as dr, sessionQuery as dt, TargetCaptureReasonCode as ea, parseConfirmationMessage as ei, GitCommandRejected as en, isStatefulAction as eo, BASE_HOST_PACKAGES as er, createProofManifest as et, isRootPauseRequest as f, ReleaseSettlement as fa, isInformationalMessage as fi, parseGitCommandManifest as fn, sanitizeUrl as fo, HostCohort as fr, sessionQueryV2 as ft, observeAssistantOutcome as g, RebindProposal as ga, BoundaryRequest as gi, CanonicalCommandSurface as gn, HostLockEvaluation as gr, bindingSatisfies as gt, latestRootInstruction as h, RebindArgs as ha, BoundaryQualification as hi, CanonicalArgv as hn, HostLockContext as hr, EvidenceFacetCoverage as ht, CompletionDisposition as i, VerificationContract as ia, CaptureScope as ii, GitPrestateEnvelope as in, semanticActionFromCommand as io, ExecutableIdentityBinding as ir, proofDigestV2 as it, recoveryDigest as j, isExecutableItem as ja, DeriveResult as ji, isDeterministicCheck as jn, HostVersionStatus as jr, firstStepGuidance as jt, closingHint as k, interpretClause as ka, DelegationRef as ki, extractTextContent as kn, selectHostCohort as kr, LifecyclePhase as kt, decideTurnBoundary as l, ReleaseGateDecision as la, extractArtifactPaths as li, createGitPrestateEnvelope as ln, digestStrings as lo, HostCapabilityEvaluation as lr, requiredSubjectsOf as lt, latestAssistantText as m, ProposeOutcome as ma, BoundaryEffectuation as mi, verifiedLinearCommitReadback as mn, HostCohortSelectionReason as mr, validateProofManifestV2 as mt, AssistantOutcomeObservation as n, TargetTuple as na, RejectedBinding as ni, GitEffectRunner as nn, requestedTargetAuthorizesMutation as no, EXPECTED_HOST_PACKAGES as nr, proofCapabilityReport as nt, NO_PROGRESS_TURNS_BEFORE_STOP as o, WorkUnit as oa, captureClause as oi, LinearCommitReadback as on, validateActionManifest as oo, HOST_CAPABILITY_PACKAGE_GROUPS as or, proofHostSurfacesOf as ot, isWholeTaskCompletionClaim as p, BoundedSource as pa, segmentClauses as pi, revalidateGitPrestate as pn, sha256 as po, HostCohortSelection as pr, validateProofManifest as pt, ProofObligationV2 as q, STOP_PROTOCOL_VERSION as qa, GuardItemStatus as qi, deriveProjection as qn, TaskIntent as qr, verifyComposedHostLockDump as qt, CONTROL_RECORD_PREFIX as r, TargetValue as ra, certifyCheckpoint as ri, GitPrestateCheck as rn, requestedTargetMatchesResolved as ro, ExecutableIdentity as rr, proofDigest as rt, TurnStoppingDecision as s, createProjection as sa, captureItem as si, commitIndexSnapshotDigest as sn, validateActionTarget as so, HOST_COHORTS as sr, proofOperationMatches as st, supersedeItem as t, TargetCaptureStatus as ta, CheckpointResult as ti, GitEffectExecution as tn, requestedIdentityKey as to, DEFAULT_HOST_LOCK as tr, createProofManifestV2 as tt, decideTurnStopping as u, ReleaseObservedIdentity as ua, extractMethod as ui, executeRevalidatedGitEffect as un, normalizeClause as uo, HostCapabilityId as ur, scopeCoverageDigest as ut, SESSION_API_UNSUPPORTED as v, proposeRebind as va, GoalBoundaryAccess as vi, ShellParseStatus as vn, HostPlatform as vr, evidenceMatchesItem as vt, RC015_HOST_PACKAGES as w, AuthorityDisposition as wa, AssetObligation as wi, hasCurrentCertificate as wn, evaluateExternalWaitCapability as wr, validateManifest as wt, V3SessionLike as x, rebindAttemptKey as xa, isCurrentAcceptedBoundary as xi, parsePwshCommand as xn, LEGACY_HOST_COHORTS as xr, CommandSurfaceManifest as xt, SESSION_EVENT_ENVELOPE_INVALID as y, proposeRebindOutcome as ya, availableBoundaryQualifications as yi, canonicalArgvFromCommand as yn, HostProfileKind as yr, isVerifyingCapability as yt, PROOF_PROTOCOL_VERSION_V2 as z, ACTION_MANIFEST_VERSION as za, ExternalOperation as zi, evidenceAvailabilityReason as zn, parseHostVersion as zr, hostLockRowsFromComposedDump as zt };