dsh-completion-guard 0.5.3 → 0.6.1

package/dist/index.d.ts

@@ -1,12 +1,114 @@
-import { $ as COMMAND_SURFACE_MANIFEST, $i as kindOfScope, $n as bindLiveGoalCapability, $r as BindingActionClosure, $t as parsePwshCommand, A as openItems, Ai as WaitAuthorization, An as BASE_HOST_PACKAGES, Ar as parseConfirmationMessage, At as GitCommandManifest, B as SessionQuery, Bi as proposeRebindV042, Bn as HostCapabilityId, Br as extractMethod, Bt as commitTreeSnapshotDigest, C as RC015_RC2_HOST_PACKAGES, Ca as canonicalizePath, Ci as HostStatus, Cn as deriveProjection, Cr as TaskIntent, Ct as resolveActiveProfileHostLock, D as MIN_RECOVERY_CHAR_BUDGET, Da as sanitizeUrl, Di as TargetTuple, Dn as ALPHA2_DSHMARKET_139_HOST_PACKAGES, Dr as CONFIRM_LINE_PATTERN, Dt as GIT_COMMAND_TEMPLATES, E as DEFAULT_RECOVERY_CHAR_BUDGET, Ea as sanitizeClauseText, Ei as TargetCaptureStatus, En as ACTIVE_HOST_LAUNCHER_VERSION, Er as classifyUserInteraction, Et as GIT_COMMAND_MANIFEST_IDS, F as PROOF_PROTOCOL_VERSION, Fi as RebindArgs, Fn as GOAL_HOST_PACKAGES, Fr as ClauseSegment, Ft as GitPrestateCheck, G as proofEvidenceConstraints, Gi as DirectiveClass, Gn as HostLockContext, Gr as BoundaryQualification, Gt as revalidateGitPrestate, H as canonicalProjection, Hi as rebindResponse, Hn as HostCohort, Hr as isInformationalMessage, Ht as executeRevalidatedGitEffect, I as ProofKind, Ii as RebindProposal, In as HOST_CAPABILITY_PACKAGE_GROUPS, Ir as captureClause, It as GitPrestateEnvelope, J as EvidenceFacetCoverage, Ji as ScopeInterpretation, Jn as HostPlatform, Jr as GoalBoundaryAccess, Jt as CanonicalCommandSurface, K as sessionQuery, Ki as Executee, Kn as HostLockEvaluation, Kr as BoundaryRequest, Kt as verifiedLinearCommitReadback, L as ProofManifest, Li as confirmRebind, Ln as HOST_COHORTS, Lr as captureItem, Lt as GitTargetIdentity, M as renderRecoveryPacket, Mi as PackageRow, Mn as EXPECTED_HOST_PACKAGES, Mr as RejectedBinding, Mt as GitCommandRejected, N as ALPHA3_HOST_PACKAGES, Ni as BoundedSource, Nn as ExecutableIdentity, Nr as certifyCheckpoint, Nt as GitEffectExecution, O as RecoveryOptions, Oa as sha256, Oi as TargetValue, On as ALPHA2_HOST_PACKAGES, Or as ParsedConfirmation, Ot as GitAdapterAction, P as PROOF_KINDS, Pi as ProposeOutcome, Pn as ExecutableIdentityBinding, Pr as CaptureScope, Pt as GitEffectRunner, Q as isVerifyingCapability, Qi as isOpenObligation, Qn as bindExecutableIdentity, Qr as qualifyBoundary, Qt as isRunExecutable, R as ProofObligation, Ri as proposeRebind, Rn as HostAuditProvenance, Rr as classifyClause, Rt as LinearCommitReadback, S as snapshotSessionEvents, Sa as validateActionTarget, Si as GuardProjection, Sn as PROTOCOL_V4_NOTICE, Sr as segmentAuthorityBlocks, St as readActiveHostGraph, T as RC1_HOST_PACKAGES, Ta as normalizeClause, Ti as TargetCaptureReasonCode, Tn as ACTIVE_HOST_COHORT_IDS, Tr as classifyTaskIntent, Tt as verifyComposedHostLockDump, U as createProofManifest, Ui as replayRebindResult, Un as HostCohortSelection, Ur as segmentClauses, Ut as gitCommandMatchesTarget, V as bindProofToProjection, Vi as rebindAttemptKey, Vn as HostCapabilityRequest, Vr as extractOperation, Vt as createGitPrestateEnvelope, W as proofDigest, Wi as AuthorityDisposition, Wn as HostCohortSelectionReason, Wr as BoundaryEffectuation, Wt as parseGitCommandManifest, X as evidenceCoverage, Xi as interpretMessage, Xn as HostToolSurface, Xr as effectuateBoundary, Xt as ShellParseStatus, Y as bindingSatisfies, Yi as interpretClause, Yn as HostProfileKind, Yr as availableBoundaryQualifications, Yt as ParsedShell, Z as evidenceMatchesItem, Zi as isExecutableItem, Zn as LEGACY_HOST_COHORTS, Zr as isCurrentAcceptedBoundary, Zt as canonicalArgvFromCommand, _ as progressFingerprint, _a as requestedTargetAuthorizesMutation, _i as GuardIntegrity, _n as evidenceAvailabilityReason, _r as currentContractDigest, _t as hostLockRowsFromComposedDump, a as NO_PROGRESS_RECORD_PREFIX, aa as ACTION_MANIFEST_VERSION, ai as DeriveScope, an as ToolSubject, ar as selectHostCohort, at as FIRST_STEP_GUIDANCE, b as SessionApiError, ba as semanticActionFromText, bi as GuardItemStatus, bn as CAPTURE_V042_NOTICE, br as AuthorityKind, bt as packageRowsFromActiveGraph, c as classifyCompletionClaim, ca as CERTIFICATE_VERSION, ci as EvidenceOutcome, cn as extractToolSubject, cr as LATEST_SUPPORTED_HOST_VERSION, ct as LifecyclePhase, d as decisionBoundaryKey, da as STOP_PROTOCOL_VERSION, di as ExpectedTransition, dn as CertificationSupport, dr as SUPPORTED_HOST_RANGE, dt as previewFirstStepInjection, ea as maskCodeSpans, ei as BoundaryDisposition, en as parseShellCommand, er as evaluateExternalWaitCapability, et as CommandSurfaceManifest, f as isRootPauseRequest, fa as SUPPORTED_EVIDENCE_ADAPTERS, fi as ExternalOperation, fn as DiagnosisNextAction, fr as SUPPORTED_HOST_VERSIONS, ft as ActiveProfileHostLock, g as observeAssistantOutcome, ga as isStatefulAction, gi as GuardEvidence, gn as deriveItemDiagnosis, gr as satisfiesSupportedHostRange, gt as hostLockContextFromComposedDump, h as latestRootInstruction, ha as actionCompatible, hi as GuardCheckpoint, hn as UnifiedItemDiagnosis, hr as parseHostVersion, ht as combineHostPolicy, i as CompletionDisposition, ia as ACTION_MANIFEST, ii as DeriveResult, in as ToolResultInput, ir as hostVersionFromPackages, it as ClaimedMessage, j as recoveryDigest, ji as createProjection, jn as DEFAULT_HOST_LOCK, jr as CheckpointResult, jt as GitCommandParseResult, k as closingHint, ki as VerificationContract, kn as AuditedExecutable, kr as isFrozenV042RebindResponse, kt as GitCommandAccepted, l as decideTurnBoundary, la as SEMANTIC_ACTIONS, li as EvidenceParseStatus, ln as isDeterministicCheck, lr as MIN_SUPPORTED_HOST_VERSION, lt as claimedBatchHasRealRootInput, m as latestAssistantText, ma as StatefulAction, mi as GuardBoundary, mn as TaskKind, mr as evaluateMinimumHostVersion, mt as TargetHostGraph, n as AssistantOutcomeObservation, na as semanticActionOfScope, ni as DeferAuthorization, nn as hasCurrentCertificate, nr as evaluateHostLock, nt as OperationVerbEntry, o as NO_PROGRESS_TURNS_BEFORE_STOP, oa as ActionManifest, oi as DerivedEnvelope, on as evidenceFromPersistedToolResult, or as HostVersionDecision, ot as FirstStepInjection, p as isWholeTaskCompletionClaim, pa as SemanticAction, pi as GoalRef, pn as Repairability, pr as compareHostVersions, pt as HostProfileError, q as validateProofManifest, qi as InterpretOptions, qn as HostLockStatus, qr as GoalActivationState, qt as CanonicalArgv, r as CONTROL_RECORD_PREFIX, ra as statefulActionsOfScope, ri as DeriveConfig, rn as ToolCallInput, rr as evaluateToolSurfaceCapability, rt as validateManifest, s as TurnStoppingDecision, sa as ActionSpec, si as EvidenceBinding, sn as extractTextContent, sr as HostVersionStatus, st as FirstStepPreviewInput, t as supersedeItem, ta as namedActions, ti as BoundaryQualificationKind, tn as goalCompletionDenial, tr as evaluateHostCapability, tt as ManifestIssue, u as decideTurnStopping, ua as STATEFUL_ACTIONS, ui as EvidenceRole, un as withDurability, ur as ParsedHostVersion, ut as lifecyclePhase, v as SESSION_API_UNSUPPORTED, va as requestedTargetMatchesResolved, vi as GuardItem, vn as itemDiagnosis, vr as AuthorityBlock, vt as injectActiveProfileHostLock, w as RC015_HOST_PACKAGES, wa as digestStrings, wi as PersistenceAuthorization, wn as ACTIVE_HOST_COHORT_ID, wr as UserInteractionKind, wt as resolveInstalledHostLock, x as V3SessionLike, xa as validateActionManifest, xi as GuardOperation, xn as PROTOCOL_V3_NOTICE, xr as authorityCaptureCounts, xt as packageRowsFromPnpmLock, y as SESSION_EVENT_ENVELOPE_INVALID, ya as semanticActionFromCommand, yi as GuardItemKind, yn as relevantEvidence, yr as AuthorityBlockKind, yt as inspectTargetHostGraph, z as ProofSurface, zi as proposeRebindOutcome, zn as HostCapabilityEvaluation, zr as extractArtifactPaths, zt as commitIndexSnapshotDigest } from "./index-BTaiOcE-.js";
+import { $ as canonicalProjection, $a as boundedArtifactChoiceMatches, $i as SourceSpan, $n as AuditedExecutable, $r as isFrozenV042RebindResponse, $t as GitCommandParseResult, A as openItems, Aa as interpretMessage, Ai as DeriveConfig, An as extractToolSubject, Ar as HostVersionDecision, At as claimedBatchHasRealRootInput, B as ProofHostSurface, Ba as ActionManifest, Bi as GoalRef, Bn as itemDiagnosis, Br as satisfiesSupportedHostRange, Bt as injectActiveProfileHostLock, C as RC015_RC2_HOST_PACKAGES, Ca as replayRebindResult, Ci as AssetInterpretationFact, Cn as goalCompletionDenial, Cr as bindLiveGoalCapability, Ct as OperationVerbEntry, D as MIN_RECOVERY_CHAR_BUDGET, Da as InterpretOptions, Di as BoundaryQualificationKind, Dn as ToolSubject, Dr as evaluateToolSurfaceCapability, Dt as FirstStepInjection, E as DEFAULT_RECOVERY_CHAR_BUDGET, Ea as Executee, Ei as BoundaryDisposition, En as ToolResultInput, Er as evaluateHostLock, Et as FIRST_STEP_GUIDANCE, F as PROOF_KINDS, Fa as namedActions, Fi as EvidenceOutcome, Fn as Repairability, Fr as SUPPORTED_HOST_RANGE, Ft as HostProfileError, G as ProofManifestV2, Ga as SEMANTIC_ACTIONS, Gi as GuardItem, Gn as PROTOCOL_V4_NOTICE, Gr as authorityCaptureCounts, Gt as resolveActiveProfileHostLock, H as ProofKindCapability, Ha as BOUNDED_ARTIFACT_TYPES, Hi as GuardCheckpoint, Hn as CAPTURE_V042_NOTICE, Hr as AuthorityBlock, Ht as packageRowsFromActiveGraph, I as PROOF_KINDS_V2, Ia as semanticActionOfScope, Ii as EvidenceParseStatus, In as TaskKind, Ir as SUPPORTED_HOST_VERSIONS, It as TargetHostGraph, J as ProofSurface, Ja as STOP_PROTOCOL_VERSION_V2, Ji as GuardOperation, Jn as ACTIVE_HOST_COHORT_ID, Jr as UserInteractionKind, Jt as GIT_COMMAND_MANIFEST_IDS, K as ProofObligation, Ka as STATEFUL_ACTIONS, Ki as GuardItemKind, Kn as PROTOCOL_V5_NOTICE, Kr as segmentAuthorityBlocks, Kt as resolveInstalledHostLock, L as PROOF_MANIFEST_DOMAIN_V2, La as statefulActionsOfScope, Li as EvidenceRole, Ln as UnifiedItemDiagnosis, Lr as compareHostVersions, Lt as combineHostPolicy, M as renderRecoveryPacket, Ma as isOpenObligation, Mi as DeriveScope, Mn as withDurability, Mr as LATEST_SUPPORTED_HOST_VERSION, Mt as lifecyclePhase, N as ALPHA3_HOST_PACKAGES, Na as kindOfScope, Ni as DerivedEnvelope, Nn as CertificationSupport, Nr as MIN_SUPPORTED_HOST_VERSION, Nt as previewFirstStepInjection, O as RecoveryOptions, Oa as ScopeInterpretation, Oi as DeferAuthorization, On as evidenceFromPersistedToolResult, Or as hostVersionFromPackages, Ot as FirstStepPreviewInput, P as PROOF_CAPABILITY_MATRIX, Pa as maskCodeSpans, Pi as EvidenceBinding, Pn as DiagnosisNextAction, Pr as ParsedHostVersion, Pt as ActiveProfileHostLock, Q as bindProofV2ToProjection, Qa as actionCompatible, Qi as PersistenceAuthorization, Qn as ALPHA2_HOST_PACKAGES, Qr as ParsedConfirmation, Qt as GitCommandManifest, R as PROOF_PROTOCOL_VERSION, Ra as ACTION_MANIFEST, Ri as ExpectedTransition, Rn as deriveItemDiagnosis, Rr as evaluateMinimumHostVersion, Rt as hostLockContextFromComposedDump, S as snapshotSessionEvents, Sa as rebindResponse, Si as qualifyBoundary, Sn as parseShellCommand, Sr as bindExecutableIdentity, St as ManifestIssue, T as RC1_HOST_PACKAGES, Ta as DirectiveClass, Ti as BindingActionClosure, Tn as ToolCallInput, Tr as evaluateHostCapability, Tt as ClaimedMessage, U as ProofKindV2, Ua as CERTIFICATE_VERSION, Ui as GuardEvidence, Un as DEFAULT_DELEGATION_TOOL_NAMES, Ur as AuthorityBlockKind, Ut as packageRowsFromPnpmLock, V as ProofKind, Va as ActionSpec, Vi as GuardBoundary, Vn as relevantEvidence, Vr as currentContractDigest, Vt as inspectTargetHostGraph, W as ProofManifest, Wa as CERTIFICATE_VERSION_V2, Wi as GuardIntegrity, Wn as PROTOCOL_V3_NOTICE, Wr as AuthorityKind, Wt as readActiveHostGraph, X as SessionQueryV2, Xa as SemanticAction, Xi as HostStatus, Xn as ACTIVE_HOST_LAUNCHER_VERSION, Xr as classifyUserInteraction, Xt as GitAdapterAction, Y as SessionQuery, Ya as SUPPORTED_EVIDENCE_ADAPTERS, Yi as GuardProjection, Yn as ACTIVE_HOST_COHORT_IDS, Yr as classifyTaskIntent, Yt as GIT_COMMAND_TEMPLATES, Z as bindProofToProjection, Za as StatefulAction, Zi as MessageCoverage, Zn as ALPHA2_DSHMARKET_139_HOST_PACKAGES, Zr as CONFIRM_LINE_PATTERN, Zt as GitCommandAccepted, _ as progressFingerprint, _a as confirmRebind, _i as GoalActivationState, _n as ParsedShell, _r as HostLockStatus, _t as evidenceCoverage, a as NO_PROGRESS_RECORD_PREFIX, aa as WaitAuthorization, ai as ClauseSegment, an as GitTargetIdentity, ao as semanticActionFromText, ar as GOAL_HOST_PACKAGES, at as proofEvidenceConstraints, b as SessionApiError, ba as proposeRebindV042, bi as effectuateBoundary, bn as isRunExecutable, br as HostToolSurface, bt as COMMAND_SURFACE_MANIFEST, c as classifyCompletionClaim, ca as PackageRow, ci as classifyClause, cn as commitTreeSnapshotDigest, co as canonicalizePath, cr as HostAuditProvenance, ct as proofV2Rejection, d as decisionBoundaryKey, da as ReleaseOperation, di as extractOperation, dn as gitCommandMatchesTarget, do as sanitizeClauseText, dr as HostCapabilityRequest, dt as sessionQuery, ea as TargetCaptureReasonCode, ei as parseConfirmationMessage, en as GitCommandRejected, eo as isStatefulAction, er as BASE_HOST_PACKAGES, et as createProofManifest, f as isRootPauseRequest, fa as ReleaseSettlement, fi as isInformationalMessage, fn as parseGitCommandManifest, fo as sanitizeUrl, fr as HostCohort, ft as sessionQueryV2, g as observeAssistantOutcome, ga as RebindProposal, gi as BoundaryRequest, gn as CanonicalCommandSurface, gr as HostLockEvaluation, gt as bindingSatisfies, h as latestRootInstruction, ha as RebindArgs, hi as BoundaryQualification, hn as CanonicalArgv, hr as HostLockContext, ht as EvidenceFacetCoverage, i as CompletionDisposition, ia as VerificationContract, ii as CaptureScope, in as GitPrestateEnvelope, io as semanticActionFromCommand, ir as ExecutableIdentityBinding, it as proofDigestV2, j as recoveryDigest, ja as isExecutableItem, ji as DeriveResult, jn as isDeterministicCheck, jr as HostVersionStatus, jt as firstStepGuidance, k as closingHint, ka as interpretClause, ki as DelegationRef, kn as extractTextContent, kr as selectHostCohort, kt as LifecyclePhase, l as decideTurnBoundary, la as ReleaseGateDecision, li as extractArtifactPaths, ln as createGitPrestateEnvelope, lo as digestStrings, lr as HostCapabilityEvaluation, lt as requiredSubjectsOf, m as latestAssistantText, ma as ProposeOutcome, mi as BoundaryEffectuation, mn as verifiedLinearCommitReadback, mr as HostCohortSelectionReason, mt as validateProofManifestV2, n as AssistantOutcomeObservation, na as TargetTuple, ni as RejectedBinding, nn as GitEffectRunner, no as requestedTargetAuthorizesMutation, nr as EXPECTED_HOST_PACKAGES, nt as proofCapabilityReport, o as NO_PROGRESS_TURNS_BEFORE_STOP, oa as WorkUnit, oi as captureClause, on as LinearCommitReadback, oo as validateActionManifest, or as HOST_CAPABILITY_PACKAGE_GROUPS, ot as proofHostSurfacesOf, p as isWholeTaskCompletionClaim, pa as BoundedSource, pi as segmentClauses, pn as revalidateGitPrestate, po as sha256, pr as HostCohortSelection, pt as validateProofManifest, q as ProofObligationV2, qa as STOP_PROTOCOL_VERSION, qi as GuardItemStatus, qn as deriveProjection, qr as TaskIntent, qt as verifyComposedHostLockDump, r as CONTROL_RECORD_PREFIX, ra as TargetValue, ri as certifyCheckpoint, rn as GitPrestateCheck, ro as requestedTargetMatchesResolved, rr as ExecutableIdentity, rt as proofDigest, s as TurnStoppingDecision, sa as createProjection, si as captureItem, sn as commitIndexSnapshotDigest, so as validateActionTarget, sr as HOST_COHORTS, st as proofOperationMatches, t as supersedeItem, ta as TargetCaptureStatus, ti as CheckpointResult, tn as GitEffectExecution, to as requestedIdentityKey, tr as DEFAULT_HOST_LOCK, tt as createProofManifestV2, u as decideTurnStopping, ua as ReleaseObservedIdentity, ui as extractMethod, un as executeRevalidatedGitEffect, uo as normalizeClause, ur as HostCapabilityId, ut as scopeCoverageDigest, v as SESSION_API_UNSUPPORTED, va as proposeRebind, vi as GoalBoundaryAccess, vn as ShellParseStatus, vr as HostPlatform, vt as evidenceMatchesItem, w as RC015_HOST_PACKAGES, wa as AuthorityDisposition, wi as AssetObligation, wn as hasCurrentCertificate, wr as evaluateExternalWaitCapability, wt as validateManifest, x as V3SessionLike, xa as rebindAttemptKey, xi as isCurrentAcceptedBoundary, xn as parsePwshCommand, xr as LEGACY_HOST_COHORTS, xt as CommandSurfaceManifest, y as SESSION_EVENT_ENVELOPE_INVALID, ya as proposeRebindOutcome, yi as availableBoundaryQualifications, yn as canonicalArgvFromCommand, yr as HostProfileKind, yt as isVerifyingCapability, z as PROOF_PROTOCOL_VERSION_V2, za as ACTION_MANIFEST_VERSION, zi as ExternalOperation, zn as evidenceAvailabilityReason, zr as parseHostVersion, zt as hostLockRowsFromComposedDump } from "./index-C_N6DaSF.js";
 import "@deepseek-ai/dsh-tools";
 import "@deepseek-ai/dsh-session";
 import { Context } from "@deepseek-ai/cordis";
 import z from "@deepseek-ai/schemastery";
 
+//#region src/tools/evidence.d.ts
+
+/** Trusted embedding evidence, never accepted from a model/tool or HTTP response.
+* The embedding must bind its actual loaded provider to this process/service.
+* Current DSH hosts expose no such verifier, so production restart stays
+* unavailable while core Guard protection remains active.
+*/
+interface MarketInstanceBinding {
+  origin: string;
+  profile: string;
+  version: string;
+  integrity: string;
+  loadedTreeSha256: string;
+  processIdentity: string;
+  bootId: string;
+}
+interface EvidenceToolRoots {
+  /** Test/embedding override. Production derives the active profile from this installed module. */
+  profile?: {
+    name: string;
+    path: string;
+  };
+  /** Derived from the live loopback webServer service; never accepted from tool input. */
+  marketOrigin?: string;
+  verifyMarketInstance?: (signal: AbortSignal) => Promise<MarketInstanceBinding | undefined>;
+  /** Test seam for exact HTTP request/response contracts. */
+  fetcher?: typeof fetch;
+  /** Test seam for exact logical executable/argv execution. */
+  commandRunner?: (file: string, args: string[], cwd?: string, signal?: AbortSignal) => Promise<void>;
+  persistRestartIntent?: (agent: {
+    session: unknown;
+  }, intent: {
+    resolutionCallId: string;
+    serviceId: string;
+    preGeneration: string;
+  }) => Promise<boolean>;
+  /** Runtime-supplied, action-scoped host capability decision. */
+  hostCapability?: (action: StatefulAction) => {
+    status: "supported" | "unsupported" | "unavailable";
+    digest: string;
+  };
+  /** Runtime-owned root-contract authorization. Absence is fail-closed. */
+  authorizeMutation?: (request: MutationAuthorizationRequest) => MutationAuthorizationDecision;
+  /** Flush and replay the resolution/contract chain before any side effect. */
+  prepareMutation?: (agent: {
+    session: unknown;
+  }) => Promise<boolean>;
+  /** Test seam for proving that durability/authority rejection precedes probes. */
+  readExecutableIdentity?: (executable: AuditedExecutable, signal: AbortSignal) => Promise<ExecutableIdentity | undefined>;
+  /** Test-only seam; production never enables HTTP registries. */
+  allowLoopbackHttpRegistry?: boolean;
+  /**
+  * C10 release ticket gate, consulted before any release-class effect. Absent
+  * means no release contract governs the session, so the existing Guard-owned
+  * mutation authorization is the whole authority chain.
+  */
+  releaseGate?: (request: ReleaseGateToolRequest) => Promise<ReleaseGateDecision>;
+  /** C10 settlement record, written after the effect from a trusted readback. */
+  releaseSettle?: (request: ReleaseSettlementToolRequest) => Promise<void>;
+}
+interface ReleaseGateToolRequest {
+  agent: {
+    session: unknown;
+  };
+  operation: ReleaseOperation;
+  /** The resolution call the effect is bound to; the replay key. */
+  callId: string;
+  resolvedTarget: TargetTuple;
+  /** What the trusted producers actually observed for this candidate. */
+  observed: ReleaseObservedIdentity;
+}
+/**
+* The outcome the executor can prove, before the runtime decides how it
+* resolves the reservation:
+* - `not_effected` — every pre-effect check refused, so no side effect ran;
+* - `unknown` — the effect was attempted and its result cannot be established;
+* - `completed` — the effect reported success (the runtime still compares the
+*   readback identity before it settles anything).
+*/
+interface ReleaseSettlementToolRequest {
+  agent: {
+    session: unknown;
+  };
+  operation: ReleaseOperation;
+  callId: string;
+  /** The contract the granted reservation belonged to. */
+  contractId?: string;
+  effect: "completed" | "not_effected" | "unknown";
+  readback: ReleaseSettlement["readback"];
+}
+interface MutationAuthorizationRequest {
+  action: StatefulAction;
+  contractItemId: string;
+  contractItemRevision: number;
+  resolvedTarget: TargetTuple;
+}
+interface MutationAuthorizationDecision {
+  status: "authorized" | "denied";
+  reasonCode: string;
+}
+//#endregion
 //#region src/config.d.ts
 declare const Config: z<{
   activation: string;
+  policy?: string;
   hostLockPackages?: PackageRow[];
   hostLockPlatform?: HostPlatform;
   hostLockProfile?: HostProfileKind;
@@ -18,6 +120,28 @@ declare const Config: z<{
 //#region src/runtime.d.ts
 declare const name = "context-guard";
 declare const inject: readonly ["sessions", "commands"];
+/**
+* Executor and network seams for acceptance runs. They replace ONLY the two
+* things a deterministic test cannot do for real — spawning the mutation
+* binary and reaching the registry — and never the authorization gate, the
+* reservation/settlement records, or the evidence producers. Production
+* callers omit them and get the real implementations.
+*/
+interface RuntimeExecutorSeams {
+  commandRunner?: EvidenceToolRoots["commandRunner"];
+  fetcher?: EvidenceToolRoots["fetcher"];
+  allowLoopbackHttpRegistry?: boolean;
+  /**
+  * Pin the audited host cohort instead of reading a live profile graph. An
+  * acceptance run that already declared its cohort needs this because the
+  * migration revalidation reads real filesystem roots; it replaces ONLY the
+  * host-lock EVALUATION. The release ticket gate, the reservation and
+  * settlement records, the evidence producers and the replay stay production
+  * code, and the host lock keeps its own dedicated suites and native
+  * acceptance.
+  */
+  hostLock?: HostLockEvaluation;
+}
 declare function apply(ctx: Context, rawConfig?: {
   activation?: unknown;
   hostLockPackages?: unknown;
@@ -26,6 +150,6 @@ declare function apply(ctx: Context, rawConfig?: {
   hostLockPolicy?: unknown;
   hostLockRuntimeRoot?: unknown;
   hostLockProfileRoot?: unknown;
-}): void;
+}, seams?: RuntimeExecutorSeams): void;
 //#endregion
-export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ACTIVE_HOST_COHORT_ID, ACTIVE_HOST_COHORT_IDS, ACTIVE_HOST_LAUNCHER_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, ActionManifest, ActionSpec, ActiveProfileHostLock, AssistantOutcomeObservation, AuditedExecutable, AuthorityBlock, AuthorityBlockKind, AuthorityDisposition, AuthorityKind, BASE_HOST_PACKAGES, BindingActionClosure, BoundaryDisposition, BoundaryEffectuation, BoundaryQualification, BoundaryQualificationKind, BoundaryRequest, BoundedSource, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, CONTROL_RECORD_PREFIX, CanonicalArgv, CanonicalCommandSurface, CaptureScope, CertificationSupport, CheckpointResult, ClaimedMessage, ClauseSegment, CommandSurfaceManifest, CompletionDisposition, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DeferAuthorization, DeriveConfig, DeriveResult, DeriveScope, DerivedEnvelope, DiagnosisNextAction, DirectiveClass, EXPECTED_HOST_PACKAGES, EvidenceBinding, EvidenceFacetCoverage, EvidenceOutcome, EvidenceParseStatus, EvidenceRole, ExecutableIdentity, ExecutableIdentityBinding, Executee, ExpectedTransition, ExternalOperation, FIRST_STEP_GUIDANCE, FirstStepInjection, FirstStepPreviewInput, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, GitAdapterAction, GitCommandAccepted, GitCommandManifest, GitCommandParseResult, GitCommandRejected, GitEffectExecution, GitEffectRunner, GitPrestateCheck, GitPrestateEnvelope, GitTargetIdentity, GoalActivationState, GoalBoundaryAccess, GoalRef, GuardBoundary, GuardCheckpoint, GuardEvidence, GuardIntegrity, GuardItem, GuardItemKind, GuardItemStatus, GuardOperation, GuardProjection, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostAuditProvenance, HostCapabilityEvaluation, HostCapabilityId, HostCapabilityRequest, HostCohort, HostCohortSelection, HostCohortSelectionReason, HostLockContext, HostLockEvaluation, HostLockStatus, HostPlatform, HostProfileError, HostProfileKind, HostStatus, HostToolSurface, HostVersionDecision, HostVersionStatus, InterpretOptions, LATEST_SUPPORTED_HOST_VERSION, LEGACY_HOST_COHORTS, LifecyclePhase, LinearCommitReadback, MIN_RECOVERY_CHAR_BUDGET, MIN_SUPPORTED_HOST_VERSION, ManifestIssue, NO_PROGRESS_RECORD_PREFIX, NO_PROGRESS_TURNS_BEFORE_STOP, OperationVerbEntry, PROOF_KINDS, PROOF_PROTOCOL_VERSION, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, ParsedConfirmation, ParsedHostVersion, ParsedShell, PersistenceAuthorization, ProofKind, ProofManifest, ProofObligation, ProofSurface, ProposeOutcome, RC015_HOST_PACKAGES, RC015_RC2_HOST_PACKAGES, RC1_HOST_PACKAGES, RebindArgs, RebindProposal, RecoveryOptions, RejectedBinding, Repairability, SEMANTIC_ACTIONS, SESSION_API_UNSUPPORTED, SESSION_EVENT_ENVELOPE_INVALID, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_RANGE, SUPPORTED_HOST_VERSIONS, ScopeInterpretation, SemanticAction, SessionApiError, SessionQuery, ShellParseStatus, StatefulAction, TargetCaptureReasonCode, TargetCaptureStatus, TargetHostGraph, TargetTuple, TargetValue, TaskIntent, TaskKind, ToolCallInput, ToolResultInput, ToolSubject, TurnStoppingDecision, UnifiedItemDiagnosis, UserInteractionKind, V3SessionLike, VerificationContract, WaitAuthorization, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindingSatisfies, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, claimedBatchHasRealRootInput, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, closingHint, combineHostPolicy, commitIndexSnapshotDigest, commitTreeSnapshotDigest, compareHostVersions, confirmRebind, createGitPrestateEnvelope, createProjection, createProofManifest, currentContractDigest, decideTurnBoundary, decideTurnStopping, decisionBoundaryKey, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateMinimumHostVersion, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, hostVersionFromPackages, inject, injectActiveProfileHostLock, inspectTargetHostGraph, interpretClause, interpretMessage, isCurrentAcceptedBoundary, isDeterministicCheck, isExecutableItem, isFrozenV042RebindResponse, isInformationalMessage, isOpenObligation, isRootPauseRequest, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, kindOfScope, latestAssistantText, latestRootInstruction, lifecyclePhase, maskCodeSpans, name, namedActions, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parseHostVersion, parsePwshCommand, parseShellCommand, previewFirstStepInjection, progressFingerprint, proofDigest, proofEvidenceConstraints, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualifyBoundary, readActiveHostGraph, rebindAttemptKey, rebindResponse, recoveryDigest, relevantEvidence, renderRecoveryPacket, replayRebindResult, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, satisfiesSupportedHostRange, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, semanticActionOfScope, sessionQuery, sha256, snapshotSessionEvents, statefulActionsOfScope, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };
+export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ACTIVE_HOST_COHORT_ID, ACTIVE_HOST_COHORT_IDS, ACTIVE_HOST_LAUNCHER_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, ActionManifest, ActionSpec, ActiveProfileHostLock, AssetInterpretationFact, AssetObligation, AssistantOutcomeObservation, AuditedExecutable, AuthorityBlock, AuthorityBlockKind, AuthorityDisposition, AuthorityKind, BASE_HOST_PACKAGES, BOUNDED_ARTIFACT_TYPES, BindingActionClosure, BoundaryDisposition, BoundaryEffectuation, BoundaryQualification, BoundaryQualificationKind, BoundaryRequest, BoundedSource, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, CERTIFICATE_VERSION_V2, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, CONTROL_RECORD_PREFIX, CanonicalArgv, CanonicalCommandSurface, CaptureScope, CertificationSupport, CheckpointResult, ClaimedMessage, ClauseSegment, CommandSurfaceManifest, CompletionDisposition, Config, DEFAULT_DELEGATION_TOOL_NAMES, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DeferAuthorization, DelegationRef, DeriveConfig, DeriveResult, DeriveScope, DerivedEnvelope, DiagnosisNextAction, DirectiveClass, EXPECTED_HOST_PACKAGES, EvidenceBinding, EvidenceFacetCoverage, EvidenceOutcome, EvidenceParseStatus, EvidenceRole, ExecutableIdentity, ExecutableIdentityBinding, Executee, ExpectedTransition, ExternalOperation, FIRST_STEP_GUIDANCE, FirstStepInjection, FirstStepPreviewInput, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, GitAdapterAction, GitCommandAccepted, GitCommandManifest, GitCommandParseResult, GitCommandRejected, GitEffectExecution, GitEffectRunner, GitPrestateCheck, GitPrestateEnvelope, GitTargetIdentity, GoalActivationState, GoalBoundaryAccess, GoalRef, GuardBoundary, GuardCheckpoint, GuardEvidence, GuardIntegrity, GuardItem, GuardItemKind, GuardItemStatus, GuardOperation, GuardProjection, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostAuditProvenance, HostCapabilityEvaluation, HostCapabilityId, HostCapabilityRequest, HostCohort, HostCohortSelection, HostCohortSelectionReason, HostLockContext, HostLockEvaluation, HostLockStatus, HostPlatform, HostProfileError, HostProfileKind, HostStatus, HostToolSurface, HostVersionDecision, HostVersionStatus, InterpretOptions, LATEST_SUPPORTED_HOST_VERSION, LEGACY_HOST_COHORTS, LifecyclePhase, LinearCommitReadback, MIN_RECOVERY_CHAR_BUDGET, MIN_SUPPORTED_HOST_VERSION, ManifestIssue, MessageCoverage, NO_PROGRESS_RECORD_PREFIX, NO_PROGRESS_TURNS_BEFORE_STOP, OperationVerbEntry, PROOF_CAPABILITY_MATRIX, PROOF_KINDS, PROOF_KINDS_V2, PROOF_MANIFEST_DOMAIN_V2, PROOF_PROTOCOL_VERSION, PROOF_PROTOCOL_VERSION_V2, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, PROTOCOL_V5_NOTICE, ParsedConfirmation, ParsedHostVersion, ParsedShell, PersistenceAuthorization, ProofHostSurface, ProofKind, ProofKindCapability, ProofKindV2, ProofManifest, ProofManifestV2, ProofObligation, ProofObligationV2, ProofSurface, ProposeOutcome, RC015_HOST_PACKAGES, RC015_RC2_HOST_PACKAGES, RC1_HOST_PACKAGES, RebindArgs, RebindProposal, RecoveryOptions, RejectedBinding, Repairability, SEMANTIC_ACTIONS, SESSION_API_UNSUPPORTED, SESSION_EVENT_ENVELOPE_INVALID, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, STOP_PROTOCOL_VERSION_V2, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_RANGE, SUPPORTED_HOST_VERSIONS, ScopeInterpretation, SemanticAction, SessionApiError, SessionQuery, SessionQueryV2, ShellParseStatus, SourceSpan, StatefulAction, TargetCaptureReasonCode, TargetCaptureStatus, TargetHostGraph, TargetTuple, TargetValue, TaskIntent, TaskKind, ToolCallInput, ToolResultInput, ToolSubject, TurnStoppingDecision, UnifiedItemDiagnosis, UserInteractionKind, V3SessionLike, VerificationContract, WaitAuthorization, WorkUnit, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindProofV2ToProjection, bindingSatisfies, boundedArtifactChoiceMatches, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, claimedBatchHasRealRootInput, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, closingHint, combineHostPolicy, commitIndexSnapshotDigest, commitTreeSnapshotDigest, compareHostVersions, confirmRebind, createGitPrestateEnvelope, createProjection, createProofManifest, createProofManifestV2, currentContractDigest, decideTurnBoundary, decideTurnStopping, decisionBoundaryKey, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateMinimumHostVersion, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, firstStepGuidance, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, hostVersionFromPackages, inject, injectActiveProfileHostLock, inspectTargetHostGraph, interpretClause, interpretMessage, isCurrentAcceptedBoundary, isDeterministicCheck, isExecutableItem, isFrozenV042RebindResponse, isInformationalMessage, isOpenObligation, isRootPauseRequest, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, kindOfScope, latestAssistantText, latestRootInstruction, lifecyclePhase, maskCodeSpans, name, namedActions, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parseHostVersion, parsePwshCommand, parseShellCommand, previewFirstStepInjection, progressFingerprint, proofCapabilityReport, proofDigest, proofDigestV2, proofEvidenceConstraints, proofHostSurfacesOf, proofOperationMatches, proofV2Rejection, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualifyBoundary, readActiveHostGraph, rebindAttemptKey, rebindResponse, recoveryDigest, relevantEvidence, renderRecoveryPacket, replayRebindResult, requestedIdentityKey, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, requiredSubjectsOf, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, satisfiesSupportedHostRange, scopeCoverageDigest, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, semanticActionOfScope, sessionQuery, sessionQueryV2, sha256, snapshotSessionEvents, statefulActionsOfScope, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, validateProofManifestV2, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };