dsh-completion-guard 0.6.2 → 0.7.0

package/dist/{index-CZSt3D0G.d.ts → index-D45jgmPx.d.ts}

@@ -140,12 +140,25 @@ interface ScopeInterpretation {
   /** True only for an explicit, agent-owned, unconditional instruction. */
   immediatelyExecutable: boolean;
   authorityDisposition: AuthorityDisposition;
+  /** The 0.6.3 execution qualification this reading establishes. */
+  qualification: ExecutionQualification;
   /** Explicitly named tool/method, when the scope names one. */
   method?: string;
   /** Stable identity of this interpretation, reproducible from the same bytes. */
   fingerprint: string;
 }
 /**
+* 0.6.3 K1 regression probe: the 0.6.2 question rule, kept SOLELY so the fixed
+* defect has a test that fails against the old reading.
+*
+* 0.6.2 declared a clause information as soon as a question marker appeared
+* anywhere inside it (`QUESTION_SCOPE.test(masked)`). This function is that
+* rule, verbatim. It is not used by any production path — the current reading
+* is {@link hasQuestionScope} — and its only caller is the regression test that
+* pins the difference between the two readings on the recorded defect input.
+*/
+declare function legacyQuestionReadingIsInformational(masked: string): boolean;
+/**
 * The contract kind a scope maps to. A prohibition and an acceptance keep their
 * own lanes; everything else is a requirement. Acceptance is decided from the
 * clause's own head verb, so "确保构建通过" stays an acceptance while a
@@ -153,6 +166,196 @@ interface ScopeInterpretation {
 */
 declare function kindOfScope(directive: DirectiveClass, body?: string): GuardItemKind;
 declare function maskCodeSpans(text: string): string;
+/**
+* A present explanation speech act can have a time/scope frame before its
+* matrix verb. This only identifies the head; the v6 capture path still checks
+* the complete complement and keeps an independent action or unknown residue.
+* In particular, a quoted or reported head and a future-time frame do not
+* match, so this predicate never grants execution authority.
+*/
+declare function presentExplanationHead(text: string): {
+  end: number;
+} | undefined;
+/** A sourced clause-level condition can govern the next comma-linked matrix. */
+declare function opensConditionLead(text: string): boolean;
+/** Work named inside a governed explanation complement needs its own reading. */
+declare function hasWorkPredicate(text: string): boolean;
+/**
+* Whether a clause asks for information rather than ordering work (0.6.3 K1).
+*
+* 0.6.2 treated the mere presence of a question marker anywhere in a clause as
+* "the whole clause is a question", so one 是否 inside a comma-run of
+* instructions ("更新插件，检查是否存在更新，安装新主题，记录变更。") turned
+* every execution obligation beside it into closable information. The reading
+* is now grammatical — head verb, interrogative position, negation — so a
+* relative or purpose clause inside an order ("Create a file where logs are
+* stored", "更新皮肤中心，看看为什么失败") is never a question, while a real
+* request for an answer ("How do I install this?", "检查是否有更新吗？",
+* "check whether the remote has new commits") still is.
+*/
+declare function hasQuestionScope(masked: string): boolean;
+/**
+* Whether an explanation head GOVERNS its sentence.
+*
+* Everything coordinated inside the sentence the explanation heads is the OBJECT
+* of the explanation, however it is phrased and however long it is: a finite
+* complement ("how I can install …"), a `whether` complement, an infinitive, a
+* list with a long object — all of it is what the root asked to have explained.
+* The scope is therefore structural: it is the SENTENCE, bounded by the sentence
+* splitter, not a pattern with a window. A sentence break ends the governance, so
+* a following sentence can be a real instruction ("Explain the deploy. Then
+* restart service api." stays authorizable), and a question that merely stands
+* beside an order ("What changed and archive the logs?") has no explanation head
+* and keeps its order.
+*/
+declare function reportingHeadGoverns(masked: string): boolean;
+/**
+* Whether a clause is the scope of a QUESTION — any question, not only a reported
+* one: a question word ("How do I install …"), an interrogative auxiliary
+* ("Can you …"), an investigation ("Check whether …") or an explanation
+* ("Explain how …").
+*
+* A question head GOVERNS its clause: everything coordinated inside it is part of
+* what the root asked, so the clause must not be split into an executable child.
+* When such a clause ALSO carries an action of its own it is undecided — the
+* action may be exactly what the question is about — so nothing in it is
+* authority. Exported so the mutation gate and preparation consume the SAME
+* qualification the reading produced instead of re-guessing scope from the split
+* text, and so the rule is testable on its own.
+*/
+declare function isQuestionScopeNeedingReview(text: string): boolean;
+/**
+* 0.6.3 (narrowed contract): the execution qualification of one reading.
+*
+* Recognising an ACTION and holding AUTHORITY to run it are separate facts. The
+* reader decides, ONCE per clause and BEFORE any partition, whether the clause is
+* a `granted` plain instruction or a `restricted` governed scope (a question, an
+* explanation, an investigation, a reported question, or a quote). Every child the
+* partition later produces INHERITS that decision; nothing downstream — not the
+* projection, not recovery, not preparation — may upgrade a child to executable by
+* re-reading its own words (the earlier rounds' fail-open direction).
+*
+* `restricted` is not "no work": a restricted clause that names an action keeps it
+* as an undecided obligation ({@link AuthorityDisposition} `unresolved`) which no
+* answer closes and no certificate covers.
+*/
+type QualificationStatus = "granted" | "restricted";
+type QualificationReason = "plain_instruction" | "governed_scope" | "unproven_scope" | "inherited_restriction" | "legacy_missing_qualification";
+interface ExecutionQualification {
+  status: QualificationStatus;
+  reason: QualificationReason;
+  /** The governing head that restricted the clause, when one exists. */
+  governedBy?: string;
+}
+/** Blank out every quoted span of the text. */
+declare function maskQuotedSpans(text: string): string;
+/**
+* Whether the clause's OWN span asks something, even when no governed head was
+* recognised. This is the fail-closed half of the qualification: a clause whose
+* question content the reader could not classify (`I wonder whether …`, a
+* postposed 是否可行, a stray question mark) is still a scope that cannot host
+* execution authority. Code spans, quotes and subordinate spans do not count:
+* their content belongs to them, not to the clause.
+*/
+declare function clauseAsksOwnQuestion(text: string): boolean;
+/**
+* Whether the clause is a DIRECTIVE: an imperative in the root's voice. The action
+* must OPEN the clause once the request preface is consumed ("重启 api 服务。",
+* "Then restart service api.", "请更新插件"), and the clause must not be a report
+* or a third-party statement ("The technicians restart service api every night.",
+* "日志显示运维人员重启 api 服务。").
+*/
+declare function opensWithDirective(masked: string): boolean;
+/**
+* The content a restatement introduces: the Y of "把 X 明确为 Y" / "record X as Y".
+* Everything the restatement AUTHORIZES comes from this span, and nothing else.
+*/
+declare function restatedContentOf(text: string): string | undefined;
+/** The span a restatement CLARIFIES: everything before its marker. */
+declare function clarifiedSpanOf(text: string): string | undefined;
+/** Whether the clause is an explicit re-statement of what an obligation means. */
+declare function isRestatement(text: string): boolean;
+/**
+* Whether the clause is a PROTECTED scope: a question, an explanation, an
+* investigation, a reported question, a quote, or any span whose own question
+* content the head reader could not classify. A protected scope is indivisible —
+* no separator opens a child of it — and nothing inside it is execution authority.
+*/
+declare function clauseIsProtected(text: string): boolean;
+/** A clause nobody has questioned: its own reading is the authorization. */
+declare const GRANTED_QUALIFICATION: ExecutionQualification;
+/** A record captured before the qualification existed: never granted by default. */
+declare const LEGACY_QUALIFICATION: ExecutionQualification;
+/**
+* Whether a QUESTION/EXPLANATION/INVESTIGATION head governs the clause: the one
+* governance predicate every layer consumes (the partitioner, the classifier, the
+* reading, and — through the stored qualification — the gate and preparation).
+*/
+declare function questionHeadsClause(masked: string): boolean;
+/** Whether the clause's own reading is a governed scope. */
+declare function clauseIsGoverned(masked: string): boolean;
+/** The qualification the reader records for one clause. */
+declare function qualificationOfClause(text: string): ExecutionQualification;
+/**
+* Whether a GOVERNED clause carries work that its own question does not bound, so
+* that the clause must stay undecided rather than enter the answer lane.
+*
+* The test is structural and vocabulary-free in the direction that matters:
+*
+* - a coordination AFTER the clause's own question word puts the coordinated part
+*   inside the question's scope ("…是否安装 foo 并重启 api 服务"), so the whole
+*   clause is undecided whatever the verbs are;
+* - material BEFORE the question word that carries an action is the questioned
+*   span itself ("检查一下[安装 foo 并重启 api 服务]是否安全"), so it is undecided;
+* - a governed head with no question word of its own is undecided as soon as it
+*   names an action ("Check the safety of installing foo and restart service
+*   api.", "Explain the incident, rotate every credential").
+*
+* A pure question — the object list of "检查一下本地插件和皮肤是否有更新", a state
+* question like "检查是否有新版本。" — carries none of these and stays answerable.
+*/
+declare function governedClauseRestrictsExecution(text: string): boolean;
+declare function hasOrderedCoordination(masked: string): boolean;
+/** @deprecated Use {@link isQuestionScopeNeedingReview}: the rule is not limited to explanations. */
+declare const isExplanationScope: (text: string) => boolean;
+/**
+* Whether a coordinated part of the explanation's sentence opens with an action
+* of its own. Those are exactly the parts whose membership in the explanation
+* cannot be decided from the surface, so they make the sentence undecided instead
+* of answerable or executable. `masked` has code spans blanked, so an action that
+* only appears inside backticks contributes nothing.
+*/
+declare function explanationHasActionResidue(masked: string): boolean;
+declare function isInformationalFragment(masked: string): boolean;
+declare function splitTextFragments(text: string, from?: number): Array<{
+  text: string;
+  offset: number;
+}>;
+/**
+* Whether the text after a coordinating conjunction opens a DISTINCT
+* instruction: its own action head, optionally behind a connector and an
+* actor. This is the rule the sentence splitter already used to decide that a
+* conjunction joins two instructions rather than two objects, exposed so the
+* fragment splitter cannot contradict it.
+*/
+declare function introducesActionClause(text: string): boolean;
+/**
+* Every action word in `[offset, before)`, ordered by position, with the words
+* that are only a prefix of a longer action removed (the 升 of 升级, the 然 of
+* 然后). The remaining candidates are the verbs an instruction can be about.
+*/
+declare function actionVerbMatches(text: string, offset?: number, before?: number): Array<{
+  index: number;
+  length: number;
+}>;
+/**
+* True when a negator's scope covers the verb starting at `index`.
+*
+* The negator has to be phrase-initial, so the 不 of 手动 and the 无 of 无论 are
+* not read as bans; a contrast or list separator between the negator and the
+* verb ends its scope ("不仅…而且运行" keeps the run positive).
+*/
+declare function verbIsNegated(text: string, index: number): boolean;
 /** Interpret one already-segmented clause. */
 declare function interpretClause(text: string, options?: InterpretOptions): ScopeInterpretation;
 /** Interpret a whole message into independent scopes, in source order. */
@@ -172,6 +375,23 @@ declare function isExecutableItem(item: {
   authorityDisposition?: AuthorityDisposition;
   waitAuthorization?: unknown;
 }): boolean;
+/**
+* The ONE authority predicate the mutation gate and preparation both consume.
+*
+* A record holds execution authority only when the reader GRANTED it a
+* qualification: a record with no qualification at all (captured before the
+* qualification existed) is refused rather than read from its stored
+* disposition, and a restricted record — anything a question, explanation,
+* investigation, reported question or quote governs — keeps its work as an
+* undecided obligation that authorizes nothing. Within a granted reading, the
+* disposition still decides: a prohibition, a wait, a human actor, a condition or
+* an information range is never a mutation. An `unresolved` GRANTED reading keeps
+* the historical path documented for unrecognised instruction forms.
+*/
+declare function itemHoldsExecutionAuthority(item: {
+  executionQualification?: ExecutionQualification;
+  authorityDisposition?: AuthorityDisposition;
+}): boolean;
 /** Whether an item is an open obligation for certification purposes. */
 declare function isOpenObligation(item: GuardItem): boolean;
 /**
@@ -255,7 +475,7 @@ type ProcessExitStatus = number | "unknown";
 * Why `outcome` says what it says, so a display or a consumer never reads more
 * than the source supports.
 */
-type ProcessOutcomeReason = "declared_exit_code" | "declared_negative_marker" | "host_error_flag" | "unmarked_renderer_success" | "marker_unclassified" | "backgrounded" | "text_scan_inconclusive";
+type ProcessOutcomeReason = "declared_exit_code" | "declared_negative_marker" | "host_error_flag" | "host_result_untrusted" | "unmarked_renderer_success" | "marker_unclassified" | "backgrounded" | "text_scan_inconclusive";
 /**
 * How far the console let the guard attribute effects to the obligation's own
 * operation. `unknown` is the honest answer for every opaque compound runner:
@@ -484,6 +704,8 @@ interface ReleaseReservation {
   operation: ReleaseOperation;
   callId: string;
   startedAtSeq: number;
+  /** Present instead of a Session sequence for provider-invisible sidecar records. */
+  ledgerPosition?: number;
   status: "in_flight";
   /**
   * The npm SRI the trusted producer read when the reservation was written.
@@ -499,6 +721,8 @@ interface ReleaseSettlement {
   operation: ReleaseOperation;
   callId: string;
   settledAtSeq: number;
+  /** Present instead of a Session sequence for provider-invisible sidecar records. */
+  ledgerPosition?: number;
   /** A trusted readback identity, or the reason no producer exists. */
   readback: {
     kind: "npm_integrity" | "git_ref" | "github_release";
@@ -621,6 +845,21 @@ type GuardItemStatus = "pending" | "answered" | "passed" | "superseded";
 type GuardIntegrity = "valid" | "unknown" | "corrupt";
 type EvidenceOutcome = "success" | "failure" | "unknown" | "durability-unknown";
 type GuardOperation = "create" | "write" | "modify" | "read" | "run" | "verify";
+/**
+* 0.6.3 K2: where an obligation's requested target came from. A target is a
+* user SELECTION only when the root named it or a trusted host selection made
+* it; an environment default (the session working directory, a recent tool
+* path, a model-supplied selector) resolves and corroborates a target the root
+* already allowed, and never manufactures root authority. An inherited target
+* comes from another obligation of the same work unit whose own source is
+* auditable.
+*/
+type TargetSourceKind = "explicit_label" | "explicit_path" | "explicit_current_repository" | "host_selection" | "unit_inherited" | "environment_default";
+interface TargetSource {
+  kind: TargetSourceKind;
+  /** Source message id of the obligation a `unit_inherited` target came from. */
+  inheritedFrom?: string;
+}
 type TargetValue = boolean | number | string | {
   k: "b" | "i" | "s" | "e" | "x";
   v: unknown;
@@ -630,7 +869,25 @@ type EvidenceRole = "resolution" | "effect" | "state";
 type EvidenceParseStatus = "supported" | "unsupported_statement_operator" | "unsupported_command" | "malformed_quote" | "adapter_unavailable";
 type HostStatus = "supported" | "unsupported" | "unavailable";
 type TargetCaptureStatus = "resolved" | "clarification_required";
-type TargetCaptureReasonCode = "requested_target_package_id_missing" | "requested_target_artifact_id_missing" | "requested_target_repository_missing" | "requested_target_service_id_missing" | "requested_target_registry_missing_or_invalid";
+/**
+* 0.6.3 K4: why a record captured under the rules of an EARLIER release can no
+* longer be reused as a current pass. The record itself is never rewritten —
+* its historical status (including `answered`) stays the historical fact it
+* was — but the current eligibility layer refuses to inherit it and the
+* obstruction blocks new certificates and Goal completion until the root
+* resolves it. It is deliberately a hard block, not a warning: 0.6.2 published
+* a mixed request as answered, and a warning would have left exactly that
+* misreading in force.
+*/
+type NeedsReviewReason = "legacy_mixed_information_scope" | "legacy_environment_default_target" | "unknown_state_version" | "legacy_missing_execution_qualification" | "legacy_v6_generic_action" | "legacy_v6_ordinary_certification" | "legacy_v6_text_wait";
+interface NeedsReviewFact {
+  reason: NeedsReviewReason;
+  /** Stable identity of the eligibility check that raised it. */
+  checkId: string;
+  /** When the check was applied: this is an upgrade fact, not a birth fact. */
+  recordedAtRevision: number;
+}
+type TargetCaptureReasonCode = "requested_target_package_id_missing" | "requested_target_artifact_id_missing" | "requested_target_repository_missing" | "requested_target_repository_invalid" | "requested_target_repository_ambiguous" | "requested_target_field_ambiguous" | "requested_target_service_id_missing" | "requested_target_registry_missing_or_invalid";
 interface GoalRef {
   id: string;
   revision: number;
@@ -733,10 +990,27 @@ interface GuardItem {
   requestedTarget?: TargetTuple;
   targetCaptureStatus?: TargetCaptureStatus;
   targetCaptureReasonCode?: TargetCaptureReasonCode;
+  /**
+  * 0.6.3 K2 provenance of {@link requestedTarget}. Absent on items captured by
+  * 0.6.2 and earlier, whose target reading is historical and evaluated by the
+  * upgrade eligibility check rather than re-interpreted.
+  */
+  targetSource?: TargetSource;
+  /**
+  * 0.6.3 K4: set by the upgrade eligibility check when this record cannot be
+  * inherited as a current pass. It never overwrites the historical status.
+  */
+  needsReview?: NeedsReviewFact;
   authority?: "root_instruction" | "root_adoption" | "legacy_authority_unclassified";
   legacyFlags?: Array<"legacy_generic_run" | "legacy_authority_unclassified">;
   /** v0.5 intent layer: inquiries keep the obligation but are not machine certifiable. */
-  taskKind?: "inquiry" | "action";
+  taskKind?: "inquiry" | "action" | "context";
+  /** V6 root-sourced read-only method, bound to the unique earlier obligation
+  * in this same root. A tool name alone is never an execution authority. */
+  observerMethod?: {
+    tools: Array<"context_guard_observe_file" | "context_guard_observe_test_readiness">;
+    targetItemIds: string[];
+  };
   /**
   * v0.5.1 interpretation layer, derived from the same source bytes as
   * {@link normalizedText} by `domain/semantics.ts`. These fields record what
@@ -747,6 +1021,14 @@ interface GuardItem {
   directive?: DirectiveClass;
   executee?: Executee;
   authorityDisposition?: AuthorityDisposition;
+  /**
+  * 0.6.3 (narrowed contract): whether this reading may host execution authority.
+  * Established ONCE by the reader, before any partition, and inherited by every
+  * child the partition produces. Absent on records captured before the
+  * qualification existed: the gate and preparation refuse those rather than
+  * reading their stored disposition as permission.
+  */
+  executionQualification?: ExecutionQualification;
   /** The unresolved condition guarding a `conditional_wait` item. */
   condition?: string;
   /** The event that ends a human wait, when the source names one. */
@@ -775,6 +1057,13 @@ interface GuardItem {
   */
   rawTextSha256?: string;
   spans?: SourceSpan[];
+  /** V6 only: a required child relation captured from direct coordination in
+  * the original root, never inferred from a later control or old state. */
+  rootDependency?: {
+    parentItemId: string;
+    rawTextSha256: string;
+    sourceSpan: SourceSpan;
+  };
   /**
   * 0.6.0 work-unit assignment (C04), present only for obligations captured
   * after a v5 protocol boundary in a non-delegated session. Legacy items keep
@@ -850,6 +1139,19 @@ interface GuardEvidence {
   reasonCode?: string;
   adapterId?: string;
   adapterVersion?: string;
+  /** Current-version native readback is causally tied to a persisted host effect call. */
+  causedByCallId?: string;
+  nativeCanonicalPath?: string;
+  nativeCanonicalBase?: string;
+  nativeGitTreeOid?: string;
+  nativeGitParentOid?: string;
+  readinessForItemId?: string;
+  readinessPredicate?: string;
+  readinessManifestSha256?: string;
+  readinessEffectCallId?: string;
+  readinessSelectedPath?: string;
+  readinessScriptName?: string;
+  readinessInputSha256?: string;
   externalOperationRef?: ExternalOperation;
   /**
   * 0.6.2 D062-02: the LAYERED reading of a shell result, kept beside — never
@@ -916,10 +1218,19 @@ interface GuardCheckpoint {
   openDigest: string;
   evidenceSha256: string;
   bindingDigest: string;
+  /** v3 DSH-native certificate extension; older certificate bytes stay intact. */
+  nativeObservations?: {
+    schema: "dsh.native-observation/v1" | "dsh.native-observation/v2";
+    digests: string[];
+  };
+  /** V6-only, root-time Session locator identity; outside historical digest_v3. */
+  rootLocatorIdentity?: string;
   bindings: EvidenceBinding[];
   goalRef?: GoalRef;
   certificationDigest: string;
   result: "certified" | "incomplete" | "unknown";
+  /** Derived persisted result watermark; excluded from historical certificate bytes. */
+  recordedAtSeq?: number;
   /**
   * 0.6.0 v2 certificate (v5 sessions only): the unit whose closure was
   * certified. Version-1 certificates keep the whole-session contract and
@@ -998,6 +1309,8 @@ interface ExternalOperation {
 }
 interface GuardProjection {
   enabled: boolean;
+  /** Explicit root /context-guard on adoption, never inferred from installation or always observation. */
+  goalCompletionAdopted: boolean;
   epoch: number;
   contractRevision: number;
   rebindProposals: Map<string, RebindProposal>;
@@ -1017,7 +1330,29 @@ interface GuardProjection {
   * `undefined` (legacy) before it. Determines certificate version, closure
   * scope, and whether delivery/unit semantics are active.
   */
-  boundaryProtocol?: 5;
+  boundaryProtocol?: 5 | 6;
+  v6BoundarySeq?: number;
+  /** Root-time locator bases from the durable Session header, never a later tool cwd. Windows relative resolution remains unavailable. */
+  rootLocatorContexts: Map<number, {
+    base: string;
+    flavor: "posix" | "windows";
+    sha256: string;
+  }>;
+  /** V6 identity domain binds root bytes, original locator base and Session identity. */
+  rootLocatorIdentity?: string;
+  /** Shared core/v2 projection from confirmed Session sources; absent when the adapter lacks exact source coverage. */
+  coreV2?: Record<string, unknown>;
+  /** Display-only producer relation for derived core requirements (for example
+  * one observer method split into separately sourced tool predicates). It is
+  * rebuilt with coreV2 from the same Session snapshot and is never authority. */
+  coreV2RequirementOrigins?: Map<string, {
+    itemId: string;
+    action: string;
+    target: string;
+    sourceStart: number;
+    sourceEnd: number;
+  }>;
+  coreV2Reason?: "source_not_projectable" | "projection_failed";
   /** 0.6.0 responsibility tier (C06), from the effective configuration. */
   policy: "standard" | "strict" | "release";
   /** 0.6.0 C01 coverage summaries, one per captured root message (last 16). */
@@ -1069,6 +1404,9 @@ interface GuardProjection {
   }>;
   sessionRefDigest: string;
   hostLockDigest: string;
+  /** Runtime-only active renderer byte attestation. Never inferred from text
+  * or a package version, and rebound on every projection/reload. */
+  auditedForegroundRenderers?: Array<"bash" | "pwsh">;
   hostStatus: HostStatus;
   hostReasonCode?: string;
   /** Readback of the audited cohort bound into `hostLockDigest`. */
@@ -1162,6 +1500,7 @@ interface DeriveResult {
   protocolV4Present: boolean;
   /** True when the durable log carries the 0.6 first-step protocol boundary. */
   boundaryV5: boolean;
+  boundaryV6: boolean;
 }
 interface DerivedEnvelope {
   seq: number;
@@ -1249,6 +1588,13 @@ interface CaptureScope {
   /** Session working directory; used as the scope subject when no artifact path is named. */
   cwd?: string;
 }
+/**
+* The repository an obligation resolves to when the root wrote no repository
+* at all (0.6.3 K2). The environment default is preserved so a later
+* work-unit inheritance decision can evaluate it, but it is never reported as
+* a resolved user selection.
+*/
+declare function environmentDefaultRepositoryTarget(action: SemanticAction, subject: string): TargetTuple | undefined;
 declare function extractArtifactPaths(text: string): string[];
 /**
 * Split a single human message into independently tracked clauses. Sentence
@@ -1341,18 +1687,6 @@ declare function isFrozenV042RebindResponse(recorded: unknown): boolean;
 //#endregion
 //#region src/domain/conversation.d.ts
 type UserInteractionKind = "instruction" | "conversational";
-/**
-* Classify a direct user message (or one clause of it) as an actionable
-* `instruction` or a session-layer `conversational` utterance. Only
-* conversational results drop capture, so the classifier fails closed:
-* everything it cannot confidently recognize as session-layer talk stays an
-* instruction and is captured exactly as before.
-*
-* Order matters: progression and prohibition leads first, then strong task
-* features (artifact path, explicit method, or a non-negated operation verb
-* outside progression/meta spans), then the meta-question and meta-comment
-* forms, and finally a progression lead over a featureless remainder.
-*/
 declare function classifyUserInteraction(text: string): UserInteractionKind;
 type TaskIntent = "inquiry" | "action";
 /**
@@ -1536,6 +1870,10 @@ interface HostCapabilityEvaluation {
 interface HostLockEvaluation {
   status: HostLockStatus;
   digest: string;
+  /** Read-only byte attestation of the active foreground shell renderer and
+  * its shared terminal decoder. Set only by production active-graph readback;
+  * the package version/SRI graph alone does not establish renderer behavior. */
+  auditedForegroundRenderers?: Array<"bash" | "pwsh">;
   goalAvailable: boolean;
   reasonCode?: "host_lock_migration_required" | "host_lock_installed_graph_drift" | "host_lock_missing" | "host_lock_version_mismatch" | "host_lock_version_below_minimum" | "host_lock_version_unparseable" | "host_lock_integrity_mismatch" | "host_lock_unknown_package" | "host_lock_duplicate_package" | "host_lock_goal_graph_incomplete" | "host_lock_goal_capability_mismatch" | "host_lock_cohort_mixed_graph" | "host_lock_cohort_unbound_identity" | "host_lock_cohort_platform_not_audited";
   packages: PackageRow[];
@@ -1681,6 +2019,27 @@ declare const PROTOCOL_V4_NOTICE = "Context Guard protocol boundary: v4.0.0";
 * fail direction on rollback is closed, never a misread.
 */
 declare const PROTOCOL_V5_NOTICE = "Context Guard protocol boundary: v5.0.0";
+declare const PROTOCOL_V6_NOTICE = "Context Guard protocol boundary: v6.0.0";
+/**
+* The pure upgrade-eligibility predicate: the records in the current closure
+* scope that may NOT be inherited as a current pass, with the reason that
+* disqualifies each. Exported so the rule can be tested and read back directly,
+* never to let a caller skip it.
+*/
+declare function legacyRecordsNeedingReview(projection: GuardProjection): Array<{
+  itemId: string;
+  reason: NeedsReviewReason;
+}>;
+/**
+* Apply the 0.6.3 eligibility pass to an already-derived projection.
+*
+* This is the upgrade entry: it re-checks the records a session already holds
+* after an EVENT-SOURCED reading has been applied to them. It is idempotent —
+* a project already marked keeps its original reason and revision — and it is
+* the same function the derivation runs, so a replay and an in-place upgrade
+* cannot disagree.
+*/
+declare function applyUpgradeEligibility(projection: GuardProjection): void;
 /**
 * Pure, deterministic re-derivation of the guard projection from the DSH
 * native event log. Context Guard never writes custom session events, so every
@@ -1688,6 +2047,7 @@ declare const PROTOCOL_V5_NOTICE = "Context Guard protocol boundary: v5.0.0";
 * `tool/result`, `tool/ptc-dispatch-start`, `tool/ptc-dispatch`, and
 * `compaction/summary`.
 */
+declare function rootLocatorFlavor(cwd: string): "posix" | "windows" | undefined;
 declare function deriveProjection(sourceEvents: readonly DerivedEnvelope[], config: DeriveConfig, scope: DeriveScope, durableConfirmed: boolean, hostLock?: HostLockEvaluation): DeriveResult;
 //#endregion
 //#region src/domain/reason-class.d.ts
@@ -1785,10 +2145,20 @@ interface ToolCallInput {
 interface ToolResultInput {
   seq: number;
   error?: unknown;
+  /** A persisted return exists but its tool-result identity or status is not trustworthy. */
+  untrusted?: boolean;
   meta?: unknown;
   textContent: string;
 }
 declare function extractTextContent(content: readonly unknown[]): string;
+/**
+* DSH persists the host return flag on a nested `tool-result` block. The
+* surrounding message or event need not carry an `error` field (approval and
+* sandbox denials are examples). Never let a renderer's missing exit marker
+* override that structured return, or accept an ambiguous nested return as
+* a clean result for another call.
+*/
+declare function persistedToolResultStatus(data: unknown, callId: string, kind?: "tool/result" | "tool/ptc-dispatch", matchedStart?: boolean): "clean" | "failure" | "unknown";
 interface ToolOperation {
   op: GuardOperation;
   path?: string;
@@ -1811,6 +2181,18 @@ interface ToolSubject {
   reasonCode?: string;
   adapterId?: string;
   adapterVersion?: string;
+  causedByCallId?: string;
+  nativeCanonicalPath?: string;
+  nativeCanonicalBase?: string;
+  nativeGitTreeOid?: string;
+  nativeGitParentOid?: string;
+  readinessForItemId?: string;
+  readinessPredicate?: string;
+  readinessManifestSha256?: string;
+  readinessEffectCallId?: string;
+  readinessSelectedPath?: string;
+  readinessScriptName?: string;
+  readinessInputSha256?: string;
   /** 0.6.2 D062-02: the layered shell reading, present only for shell tools. */
   processFacts?: DerivedProcessFacts;
   externalOperationRef?: ExternalOperation;
@@ -1820,7 +2202,7 @@ declare function evidenceFromPersistedToolResult(call: ToolCallInput, result: To
 declare function withDurability(evidence: GuardEvidence, confirmed: boolean): GuardEvidence;
 //#endregion
 //#region src/domain/goal-gate.d.ts
-declare function hasCurrentCertificate(projection: GuardProjection): boolean;
+declare function hasCurrentCertificate(projection: GuardProjection, historicalReplay?: boolean): boolean;
 /**
 * Denies `update_goal(action=complete)` while the guard is enabled and no
 * current completion certificate exists. The gate itself has no bypass; a
@@ -2049,6 +2431,22 @@ interface ActiveProfileHostLock {
 * Used by target preflight before a legacy profile can be migrated.
 */
 declare function readActiveHostGraph(runtimeRoot: string, profileRoot: string): PackageRow[];
+declare function activeRendererModule(nodeModulesRoot: string, name: string): {
+  bytes: string;
+  path: string;
+} | undefined;
+/** Verify active, reachable producer bytes without reading credentials or
+* accepting historical package-map entries. Missing/ambiguous paths fail
+* closed for the ordinary markerless-test shortcut. */
+declare function auditedForegroundRenderers(runtimeRoot: string, profileRoot: string): Array<"bash" | "pwsh">;
+/** Exact active implementation route for call-time omitted-workdir evidence. */
+declare function auditedDefaultWorkdirHost(runtimeRoot: string, profileRoot: string, tool: "bash" | "pwsh"): boolean;
+/**
+* The active graph alone does not prove which shell service this Agent uses.
+* Match the scoped service's exact constructor to the audited active module,
+* rejecting another provider with the same public service interface/name.
+*/
+declare function auditedDefaultWorkdirProvider(runtimeRoot: string, profileRoot: string, tool: "bash" | "pwsh", provider: unknown, policyProvider?: unknown): Promise<boolean>;
 interface TargetHostGraph {
   packages: PackageRow[];
   profileGraph: {
@@ -2115,6 +2513,8 @@ interface FirstStepPreviewInput {
   enabled: boolean;
   /** The durable log already contains a v5 (0.6) Guard boundary. */
   boundaryV5Present?: boolean;
+  boundaryV6Present?: boolean;
+  targetProtocol?: 5 | 6;
   /** The durable log already contains a v4 (or newer) Guard boundary. */
   boundaryPresent: boolean;
   /** The session is a delegated/subagent session, never a root conversation. */
@@ -2146,6 +2546,7 @@ declare function previewFirstStepInjection(input: FirstStepPreviewInput, claimed
 */
 declare function firstStepGuidance(policy?: "standard" | "strict" | "release"): string;
 declare const FIRST_STEP_GUIDANCE: string;
+declare function firstStepGuidanceV6(policy?: "standard" | "strict" | "release"): string;
 /**
 * Lifecycle phase derived from durable facts. `enabled` is the log-derived
 * enablement (`always`, or the explicit `on`/`off` command sequence), and
@@ -2588,6 +2989,25 @@ interface AssistantOutcomeObservation {
   kind: "completion_claim" | "user_wait_claim" | "external_wait_claim" | "report";
   reasonCode: string;
 }
+interface CurrentActionBasis {
+  itemId: string;
+  action: string;
+  sourceMessageId: string;
+  unmetPredicate: string;
+  owner: "assistant";
+  readiness: "ready";
+  asOf: number;
+}
+/** A concrete, current root-owned action, with host capability and no pending
+* condition. Historical generic text and old qualifications are not upgraded. */
+declare function testOutcomePredicate(text: string): string;
+/** v6 root outcome intent: running and reporting a named test is distinct
+* from an explicit request to make it pass. A failed run can finish the first
+* duty, while the second remains unmet; neither reading grants repair scope. */
+declare function v6TestPredicate(text: string): "test_run_completed" | "test_passed";
+declare function assessmentOutcomePredicate(text: string): string;
+declare function assessmentAction(text: string): string;
+declare function currentActionBases(projection: GuardProjection, enforceCore?: boolean): CurrentActionBasis[];
 /** Assistant prose is retained only as a bounded diagnostic observation. */
 declare function observeAssistantOutcome(text: string): AssistantOutcomeObservation;
 /**
@@ -2597,7 +3017,7 @@ declare function observeAssistantOutcome(text: string): AssistantOutcomeObservat
 * one fallback correction; subsequent attempts safe-yield. An active, armed
 * Goal remains exclusively owned by the host Goal Round Driver.
 */
-declare function decideTurnBoundary(projection: GuardProjection): TurnStoppingDecision;
+declare function decideTurnBoundary(projection: GuardProjection, latestRootText?: string): TurnStoppingDecision;
 declare function decideTurnStopping(projection: GuardProjection, _assistantText: string, _turn: number, _maxAttempts: number): TurnStoppingDecision;
 /**
 * Whether the last trusted ROOT instruction asked to pause.
@@ -2628,4 +3048,12 @@ declare function latestAssistantText(events: readonly {
 //#region src/domain/supersession.d.ts
 declare function supersedeItem(items: Map<string, GuardItem>, oldId: string, replacement: GuardItem): boolean;
 //#endregion
-export { ProofSurface as $, ScopeInterpretation as $a, GuardItemStatus as $i, deriveProjection as $n, TaskIntent as $r, GIT_COMMAND_MANIFEST_IDS as $t, MIN_RECOVERY_CHAR_BUDGET as A, CapabilityFact as Aa, AssetObligation as Ai, ToolCallInput as An, semanticActionFromText as Ao, evaluateExternalWaitCapability as Ar, ClaimedMessage as At, PROOF_KINDS as B, ProcessOutcomeReason as Ba, EvidenceBinding as Bi, Repairability as Bn, ParsedHostVersion as Br, HostProfileError as Bt, RC015_RC2_HOST_PACKAGES as C, confirmRebind as Ca, GoalActivationState as Ci, ShellParseStatus as Cn, actionCompatible as Co, HostLockStatus as Cr, evidenceMatchesItem as Ct, CLEANUP_CONDITION_RULE_COMPACT as D, rebindAttemptKey as Da, isCurrentAcceptedBoundary as Di, parseShellCommand as Dn, requestedTargetAuthorizesMutation as Do, LEGACY_HOST_COHORTS as Dr, ManifestIssue as Dt, CLEANUP_CONDITION_RULE as E, proposeRebindV042 as Ea, effectuateBoundary as Ei, parsePwshCommand as En, requestedIdentityKey as Eo, HostToolSurface as Er, CommandSurfaceManifest as Et, openItems as F, DependencyStatus as Fa, DelegationRef as Fi, extractToolSubject as Fn, normalizeClause as Fo, selectHostCohort as Fr, claimedBatchHasRealRootInput as Ft, ProofHostSurface as G, capabilityFactOf as Ga, ExternalOperation as Gi, evidenceAvailabilityReason as Gn, parseHostVersion as Gr, injectActiveProfileHostLock as Gt, PROOF_MANIFEST_DOMAIN_V2 as H, actionHasCertificationPath as Ha, EvidenceParseStatus as Hi, UnifiedItemDiagnosis as Hn, SUPPORTED_HOST_VERSIONS as Hr, combineHostPolicy as Ht, recoveryDigest as I, DerivedProcessFacts as Ia, DeriveConfig as Ii, isDeterministicCheck as In, sanitizeClauseText as Io, HostVersionDecision as Ir, firstStepGuidance as It, ProofKindV2 as J, removalIsPartiallyKnown as Ja, GuardCheckpoint as Ji, CAPTURE_V042_NOTICE as Jn, AuthorityBlock as Jr, packageRowsFromPnpmLock as Jt, ProofKind as K, partialFailureOf as Ka, GoalRef as Ki, itemDiagnosis as Kn, satisfiesSupportedHostRange as Kr, inspectTargetHostGraph as Kt, renderRecoveryPacket as L, OperationAttribution as La, DeriveResult as Li, withDurability as Ln, sanitizeUrl as Lo, HostVersionStatus as Lr, lifecyclePhase as Lt, carriesCleanupCondition as M, CapabilityRemedy as Ma, BoundaryDisposition as Mi, ToolSubject as Mn, validateActionTarget as Mo, evaluateHostLock as Mr, FirstStepInjection as Mt, cleanupConditionFor as N, DEPENDENCY_FREE_ONLY_CONDITION as Na, BoundaryQualificationKind as Ni, evidenceFromPersistedToolResult as Nn, canonicalizePath as No, evaluateToolSurfaceCapability as Nr, FirstStepPreviewInput as Nt, CLEANUP_CONDITION_RULE_SHORT as O, rebindResponse as Oa, qualifyBoundary as Oi, goalCompletionDenial as On, requestedTargetMatchesResolved as Oo, bindExecutableIdentity as Or, OperationVerbEntry as Ot, closingHint as P, DeclaredOperationResult as Pa, DeferAuthorization as Pi, extractTextContent as Pn, digestStrings as Po, hostVersionFromPackages as Pr, LifecyclePhase as Pt, ProofObligationV2 as Q, InterpretOptions as Qa, GuardItemKind as Qi, PROTOCOL_V5_NOTICE as Qn, segmentAuthorityBlocks as Qr, verifyComposedHostLockDump as Qt, ALPHA3_HOST_PACKAGES as R, ProcessExitStatus as Ra, DeriveScope as Ri, CertificationSupport as Rn, sha256 as Ro, LATEST_SUPPORTED_HOST_VERSION as Rr, previewFirstStepInjection as Rt, snapshotSessionEvents as S, RebindProposal as Sa, BoundaryRequest as Si, ParsedShell as Sn, StatefulAction as So, HostLockEvaluation as Sr, evidenceCoverage as St, RC1_HOST_PACKAGES as T, proposeRebindOutcome as Ta, availableBoundaryQualifications as Ti, isRunExecutable as Tn, isStatefulAction as To, HostProfileKind as Tr, COMMAND_SURFACE_MANIFEST as Tt, PROOF_PROTOCOL_VERSION as U, admissibleForRemoval as Ua, EvidenceRole as Ui, capabilityRemedyPhrase as Un, compareHostVersions as Ur, hostLockContextFromComposedDump as Ut, PROOF_KINDS_V2 as V, RemovalOutcomeReport as Va, EvidenceOutcome as Vi, TaskKind as Vn, SUPPORTED_HOST_RANGE as Vr, TargetHostGraph as Vt, PROOF_PROTOCOL_VERSION_V2 as W, capabilityConsequence as Wa, ExpectedTransition as Wi, deriveItemDiagnosis as Wn, evaluateMinimumHostVersion as Wr, hostLockRowsFromComposedDump as Wt, ProofManifestV2 as X, DirectiveClass as Xa, GuardIntegrity as Xi, PROTOCOL_V3_NOTICE as Xn, AuthorityKind as Xr, resolveActiveProfileHostLock as Xt, ProofManifest as Y, AuthorityDisposition as Ya, GuardEvidence as Yi, DEFAULT_DELEGATION_TOOL_NAMES as Yn, AuthorityBlockKind as Yr, readActiveHostGraph as Yt, ProofObligation as Z, Executee as Za, GuardItem as Zi, PROTOCOL_V4_NOTICE as Zn, authorityCaptureCounts as Zr, resolveInstalledHostLock as Zt, progressFingerprint as _, ReleaseOperation as _a, extractOperation as _i, parseGitCommandManifest as _n, STATEFUL_ACTIONS as _o, HostCapabilityRequest as _r, sessionQueryV2 as _t, NO_PROGRESS_RECORD_PREFIX as a, SourceSpan as aa, isFrozenV042RebindResponse as ai, GitCommandRejected as an, maskCodeSpans as ao, AuditedExecutable as ar, createProofManifest as at, SessionApiError as b, ProposeOutcome as ba, BoundaryEffectuation as bi, CanonicalArgv as bn, SUPPORTED_EVIDENCE_ADAPTERS as bo, HostCohortSelectionReason as br, EvidenceFacetCoverage as bt, classifyCompletionClaim as c, TargetTuple as ca, RejectedBinding as ci, GitPrestateCheck as cn, statefulActionsOfScope as co, EXPECTED_HOST_PACKAGES as cr, proofDigest as ct, decisionBoundaryKey as d, WaitAuthorization as da, ClauseSegment as di, LinearCommitReadback as dn, ActionManifest as do, GOAL_HOST_PACKAGES as dr, proofHostSurfacesOf as dt, GuardOperation as ea, UserInteractionKind as ei, GIT_COMMAND_TEMPLATES as en, interpretClause as eo, ACTIVE_HOST_COHORT_ID as er, SessionQuery as et, isRootPauseRequest as f, WorkUnit as fa, captureClause as fi, commitIndexSnapshotDigest as fn, ActionSpec as fo, HOST_CAPABILITY_PACKAGE_GROUPS as fr, proofOperationMatches as ft, observeAssistantOutcome as g, ReleaseObservedIdentity as ga, extractMethod as gi, gitCommandMatchesTarget as gn, SEMANTIC_ACTIONS as go, HostCapabilityId as gr, sessionQuery as gt, latestRootInstruction as h, ReleaseGateDecision as ha, extractArtifactPaths as hi, executeRevalidatedGitEffect as hn, CERTIFICATE_VERSION_V2 as ho, HostCapabilityEvaluation as hr, scopeCoverageDigest as ht, CompletionDisposition as i, PersistenceAuthorization as ia, ParsedConfirmation as ii, GitCommandParseResult as in, kindOfScope as io, ALPHA2_HOST_PACKAGES as ir, canonicalProjection as it, RecoveryOptions as j, CapabilityGap as ja, BindingActionClosure as ji, ToolResultInput as jn, validateActionManifest as jo, evaluateHostCapability as jr, FIRST_STEP_GUIDANCE as jt, DEFAULT_RECOVERY_CHAR_BUDGET as k, replayRebindResult as ka, AssetInterpretationFact as ki, hasCurrentCertificate as kn, semanticActionFromCommand as ko, bindLiveGoalCapability as kr, validateManifest as kt, decideTurnBoundary as l, TargetValue as la, certifyCheckpoint as li, GitPrestateEnvelope as ln, ACTION_MANIFEST as lo, ExecutableIdentity as lr, proofDigestV2 as lt, latestAssistantText as m, PackageRow as ma, classifyClause as mi, createGitPrestateEnvelope as mn, CERTIFICATE_VERSION as mo, HostAuditProvenance as mr, requiredSubjectsOf as mt, AssistantOutcomeObservation as n, HostStatus as na, classifyUserInteraction as ni, GitCommandAccepted as nn, isExecutableItem as no, ACTIVE_HOST_LAUNCHER_VERSION as nr, bindProofToProjection as nt, NO_PROGRESS_TURNS_BEFORE_STOP as o, TargetCaptureReasonCode as oa, parseConfirmationMessage as oi, GitEffectExecution as on, namedActions as oo, BASE_HOST_PACKAGES as or, createProofManifestV2 as ot, isWholeTaskCompletionClaim as p, createProjection as pa, captureItem as pi, commitTreeSnapshotDigest as pn, BOUNDED_ARTIFACT_TYPES as po, HOST_COHORTS as pr, proofV2Rejection as pt, ProofKindCapability as q, removalIsComplete as qa, GuardBoundary as qi, relevantEvidence as qn, currentContractDigest as qr, packageRowsFromActiveGraph as qt, CONTROL_RECORD_PREFIX as r, MessageCoverage as ra, CONFIRM_LINE_PATTERN as ri, GitCommandManifest as rn, isOpenObligation as ro, ALPHA2_DSHMARKET_139_HOST_PACKAGES as rr, bindProofV2ToProjection as rt, TurnStoppingDecision as s, TargetCaptureStatus as sa, CheckpointResult as si, GitEffectRunner as sn, semanticActionOfScope as so, DEFAULT_HOST_LOCK as sr, proofCapabilityReport as st, supersedeItem as t, GuardProjection as ta, classifyTaskIntent as ti, GitAdapterAction as tn, interpretMessage as to, ACTIVE_HOST_COHORT_IDS as tr, SessionQueryV2 as tt, decideTurnStopping as u, VerificationContract as ua, CaptureScope as ui, GitTargetIdentity as un, ACTION_MANIFEST_VERSION as uo, ExecutableIdentityBinding as ur, proofEvidenceConstraints as ut, SESSION_API_UNSUPPORTED as v, ReleaseSettlement as va, isInformationalMessage as vi, revalidateGitPrestate as vn, STOP_PROTOCOL_VERSION as vo, HostCohort as vr, validateProofManifest as vt, RC015_HOST_PACKAGES as w, proposeRebind as wa, GoalBoundaryAccess as wi, canonicalArgvFromCommand as wn, boundedArtifactChoiceMatches as wo, HostPlatform as wr, isVerifyingCapability as wt, V3SessionLike as x, RebindArgs as xa, BoundaryQualification as xi, CanonicalCommandSurface as xn, SemanticAction as xo, HostLockContext as xr, bindingSatisfies as xt, SESSION_EVENT_ENVELOPE_INVALID as y, BoundedSource as ya, segmentClauses as yi, verifiedLinearCommitReadback as yn, STOP_PROTOCOL_VERSION_V2 as yo, HostCohortSelection as yr, validateProofManifestV2 as yt, PROOF_CAPABILITY_MATRIX as z, ProcessFactSource as za, DerivedEnvelope as zi, DiagnosisNextAction as zn, MIN_SUPPORTED_HOST_VERSION as zr, ActiveProfileHostLock as zt };
+//#region src/core-v2/project.d.ts
+type Row = Record<string, any>;
+/** Pure, host-neutral core/v2 projection. The adapter owns event trust and durability. */
+declare function projectCoreV2(snapshot: Row): Row;
+//#endregion
+//#region src/core-v2/session.d.ts
+declare function projectSessionCoreV2(events: DerivedEnvelope[], projection: GuardProjection, displayOrigins?: NonNullable<GuardProjection["coreV2RequirementOrigins"]>): Record<string, unknown> | undefined;
+//#endregion
+export { ProofHostSurface as $, CapabilityFact as $a, DeferAuthorization as $i, DiagnosisNextAction as $n, opensConditionLead as $o, selectHostCohort as $r, auditedDefaultWorkdirProvider as $t, snapshotSessionEvents as A, TargetSourceKind as Aa, captureClause as Ai, parseGitCommandManifest as An, clauseAsksOwnQuestion as Ao, HOST_CAPABILITY_PACKAGE_GROUPS as Ar, semanticActionFromCommand as As, evidenceCoverage as At, carriesCleanupCondition as B, ReleaseOperation as Ba, BoundaryQualification as Bi, parseShellCommand as Bn, introducesActionClause as Bo, HostLockEvaluation as Br, FirstStepInjection as Bt, progressFingerprint as C, NeedsReviewFact as Ca, isFrozenV042RebindResponse as Ci, GitTargetIdentity as Cn, InterpretOptions as Co, AuditedExecutable as Cr, StatefulAction as Cs, scopeCoverageDigest as Ct, SESSION_EVENT_ENVELOPE_INVALID as D, TargetCaptureReasonCode as Da, certifyCheckpoint as Di, createGitPrestateEnvelope as Dn, ScopeInterpretation as Do, ExecutableIdentity as Dr, requestedIdentityKey as Ds, validateProofManifestV2 as Dt, SESSION_API_UNSUPPORTED as E, SourceSpan as Ea, RejectedBinding as Ei, commitTreeSnapshotDigest as En, QualificationStatus as Eo, EXPECTED_HOST_PACKAGES as Er, isStatefulAction as Es, validateProofManifest as Et, CLEANUP_CONDITION_RULE_COMPACT as F, WorkUnit as Fa, extractMethod as Fi, ParsedShell as Fn, hasOrderedCoordination as Fo, HostCapabilityRequest as Fr, digestStrings as Fs, ManifestIssue as Ft, renderRecoveryPacket as G, RebindProposal as Ga, effectuateBoundary as Gi, ToolSubject as Gn, isQuestionScopeNeedingReview as Go, LEGACY_HOST_COHORTS as Gr, firstStepGuidanceV6 as Gt, closingHint as H, BoundedSource as Ha, GoalActivationState as Hi, hasCurrentCertificate as Hn, isExplanationScope as Ho, HostPlatform as Hr, LifecyclePhase as Ht, CLEANUP_CONDITION_RULE_SHORT as I, createProjection as Ia, extractOperation as Ii, ShellParseStatus as In, hasQuestionScope as Io, HostCohort as Ir, normalizeClause as Is, OperationVerbEntry as It, PROOF_KINDS as J, proposeRebindOutcome as Ja, AssetInterpretationFact as Ji, extractToolSubject as Jn, kindOfScope as Jo, evaluateExternalWaitCapability as Jr, ActiveProfileHostLock as Jt, ALPHA3_HOST_PACKAGES as K, confirmRebind as Ka, isCurrentAcceptedBoundary as Ki, evidenceFromPersistedToolResult as Kn, isRestatement as Ko, bindExecutableIdentity as Kr, lifecyclePhase as Kt, DEFAULT_RECOVERY_CHAR_BUDGET as L, PackageRow as La, isInformationalMessage as Li, canonicalArgvFromCommand as Ln, hasWorkPredicate as Lo, HostCohortSelection as Lr, sanitizeClauseText as Ls, validateManifest as Lt, RC015_HOST_PACKAGES as M, TargetValue as Ma, classifyClause as Mi, verifiedLinearCommitReadback as Mn, clauseIsProtected as Mo, HostAuditProvenance as Mr, validateActionManifest as Ms, isVerifyingCapability as Mt, RC1_HOST_PACKAGES as N, VerificationContract as Na, environmentDefaultRepositoryTarget as Ni, CanonicalArgv as Nn, explanationHasActionResidue as No, HostCapabilityEvaluation as Nr, validateActionTarget as Ns, COMMAND_SURFACE_MANIFEST as Nt, SessionApiError as O, TargetCaptureStatus as Oa, CaptureScope as Oi, executeRevalidatedGitEffect as On, actionVerbMatches as Oo, ExecutableIdentityBinding as Or, requestedTargetAuthorizesMutation as Os, EvidenceFacetCoverage as Ot, CLEANUP_CONDITION_RULE as P, WaitAuthorization as Pa, extractArtifactPaths as Pi, CanonicalCommandSurface as Pn, governedClauseRestrictsExecution as Po, HostCapabilityId as Pr, canonicalizePath as Ps, CommandSurfaceManifest as Pt, PROOF_PROTOCOL_VERSION_V2 as Q, replayRebindResult as Qa, BoundaryQualificationKind as Qi, CertificationSupport as Qn, namedActions as Qo, hostVersionFromPackages as Qr, auditedDefaultWorkdirHost as Qt, MIN_RECOVERY_CHAR_BUDGET as R, ReleaseGateDecision as Ra, segmentClauses as Ri, isRunExecutable as Rn, interpretClause as Ro, HostCohortSelectionReason as Rr, sanitizeUrl as Rs, ClaimedMessage as Rt, observeAssistantOutcome as S, MessageCoverage as Sa, ParsedConfirmation as Si, GitPrestateEnvelope as Sn, GRANTED_QUALIFICATION as So, ALPHA2_HOST_PACKAGES as Sr, SemanticAction as Ss, requiredSubjectsOf as St, v6TestPredicate as T, PersistenceAuthorization as Ta, CheckpointResult as Ti, commitIndexSnapshotDigest as Tn, QualificationReason as To, DEFAULT_HOST_LOCK as Tr, boundedArtifactChoiceMatches as Ts, sessionQueryV2 as Tt, openItems as U, ProposeOutcome as Ua, GoalBoundaryAccess as Ui, ToolCallInput as Un, isInformationalFragment as Uo, HostProfileKind as Ur, claimedBatchHasRealRootInput as Ut, cleanupConditionFor as V, ReleaseSettlement as Va, BoundaryRequest as Vi, goalCompletionDenial as Vn, isExecutableItem as Vo, HostLockStatus as Vr, FirstStepPreviewInput as Vt, recoveryDigest as W, RebindArgs as Wa, availableBoundaryQualifications as Wi, ToolResultInput as Wn, isOpenObligation as Wo, HostToolSurface as Wr, firstStepGuidance as Wt, PROOF_MANIFEST_DOMAIN_V2 as X, rebindAttemptKey as Xa, BindingActionClosure as Xi, persistedToolResultStatus as Xn, maskCodeSpans as Xo, evaluateHostLock as Xr, TargetHostGraph as Xt, PROOF_KINDS_V2 as Y, proposeRebindV042 as Ya, AssetObligation as Yi, isDeterministicCheck as Yn, legacyQuestionReadingIsInformational as Yo, evaluateHostCapability as Yr, HostProfileError as Yt, PROOF_PROTOCOL_VERSION as Z, rebindResponse as Za, BoundaryDisposition as Zi, withDurability as Zn, maskQuotedSpans as Zo, evaluateToolSurfaceCapability as Zr, activeRendererModule as Zt, decisionBoundaryKey as _, GuardItemKind as _a, TaskIntent as _i, GitCommandParseResult as _n, removalIsPartiallyKnown as _o, rootLocatorFlavor as _r, SEMANTIC_ACTIONS as _s, proofDigestV2 as _t, CONTROL_RECORD_PREFIX as a, EvidenceBinding as aa, SUPPORTED_HOST_RANGE as ai, inspectTargetHostGraph as an, DerivedProcessFacts as ao, evidenceAvailabilityReason as ar, restatedContentOf as as, ProofObligation as at, latestAssistantText as b, GuardProjection as ba, classifyUserInteraction as bi, GitEffectRunner as bn, Executee as bo, ACTIVE_HOST_LAUNCHER_VERSION as br, STOP_PROTOCOL_VERSION_V2 as bs, proofOperationMatches as bt, NO_PROGRESS_RECORD_PREFIX as c, EvidenceRole as ca, evaluateMinimumHostVersion as ci, readActiveHostGraph as cn, ProcessFactSource as co, CAPTURE_V042_NOTICE as cr, statefulActionsOfScope as cs, SessionQuery as ct, assessmentAction as d, GoalRef as da, currentContractDigest as di, verifyComposedHostLockDump as dn, actionHasCertificationPath as do, PROTOCOL_V4_NOTICE as dr, ACTION_MANIFEST_VERSION as ds, bindProofV2ToProjection as dt, DelegationRef as ea, HostVersionDecision as ei, auditedForegroundRenderers as en, CapabilityGap as eo, Repairability as er, opensWithDirective as es, ProofKind as et, assessmentOutcomePredicate as f, GuardBoundary as fa, AuthorityBlock as fi, GIT_COMMAND_MANIFEST_IDS as fn, admissibleForRemoval as fo, PROTOCOL_V5_NOTICE as fr, ActionManifest as fs, canonicalProjection as ft, decideTurnStopping as g, GuardItem as ga, segmentAuthorityBlocks as gi, GitCommandManifest as gn, removalIsComplete as go, legacyRecordsNeedingReview as gr, CERTIFICATE_VERSION_V2 as gs, proofDigest as gt, decideTurnBoundary as h, GuardIntegrity as ha, authorityCaptureCounts as hi, GitCommandAccepted as hn, partialFailureOf as ho, deriveProjection as hr, CERTIFICATE_VERSION as hs, proofCapabilityReport as ht, AssistantOutcomeObservation as i, DerivedEnvelope as ia, ParsedHostVersion as ii, injectActiveProfileHostLock as in, DependencyStatus as io, deriveItemDiagnosis as ir, reportingHeadGoverns as is, ProofManifestV2 as it, RC015_RC2_HOST_PACKAGES as j, TargetTuple as ja, captureItem as ji, revalidateGitPrestate as jn, clauseIsGoverned as jo, HOST_COHORTS as jr, semanticActionFromText as js, evidenceMatchesItem as jt, V3SessionLike as k, TargetSource as ka, ClauseSegment as ki, gitCommandMatchesTarget as kn, clarifiedSpanOf as ko, GOAL_HOST_PACKAGES as kr, requestedTargetMatchesResolved as ks, bindingSatisfies as kt, NO_PROGRESS_TURNS_BEFORE_STOP as l, ExpectedTransition as la, parseHostVersion as li, resolveActiveProfileHostLock as ln, ProcessOutcomeReason as lo, DEFAULT_DELEGATION_TOOL_NAMES as lr, verbIsNegated as ls, SessionQueryV2 as lt, currentActionBases as m, GuardEvidence as ma, AuthorityKind as mi, GitAdapterAction as mn, capabilityFactOf as mo, applyUpgradeEligibility as mr, BOUNDED_ARTIFACT_TYPES as ms, createProofManifestV2 as mt, projectCoreV2 as n, DeriveResult as na, LATEST_SUPPORTED_HOST_VERSION as ni, hostLockContextFromComposedDump as nn, DEPENDENCY_FREE_ONLY_CONDITION as no, UnifiedItemDiagnosis as nr, qualificationOfClause as ns, ProofKindV2 as nt, CompletionDisposition as o, EvidenceOutcome as oa, SUPPORTED_HOST_VERSIONS as oi, packageRowsFromActiveGraph as on, OperationAttribution as oo, itemDiagnosis as or, semanticActionOfScope as os, ProofObligationV2 as ot, classifyCompletionClaim as p, GuardCheckpoint as pa, AuthorityBlockKind as pi, GIT_COMMAND_TEMPLATES as pn, capabilityConsequence as po, PROTOCOL_V6_NOTICE as pr, ActionSpec as ps, createProofManifest as pt, PROOF_CAPABILITY_MATRIX as q, proposeRebind as qa, qualifyBoundary as qi, extractTextContent as qn, itemHoldsExecutionAuthority as qo, bindLiveGoalCapability as qr, previewFirstStepInjection as qt, supersedeItem as r, DeriveScope as ra, MIN_SUPPORTED_HOST_VERSION as ri, hostLockRowsFromComposedDump as rn, DeclaredOperationResult as ro, capabilityRemedyPhrase as rr, questionHeadsClause as rs, ProofManifest as rt, CurrentActionBasis as s, EvidenceParseStatus as sa, compareHostVersions as si, packageRowsFromPnpmLock as sn, ProcessExitStatus as so, relevantEvidence as sr, splitTextFragments as ss, ProofSurface as st, projectSessionCoreV2 as t, DeriveConfig as ta, HostVersionStatus as ti, combineHostPolicy as tn, CapabilityRemedy as to, TaskKind as tr, presentExplanationHead as ts, ProofKindCapability as tt, TurnStoppingDecision as u, ExternalOperation as ua, satisfiesSupportedHostRange as ui, resolveInstalledHostLock as un, RemovalOutcomeReport as uo, PROTOCOL_V3_NOTICE as ur, ACTION_MANIFEST as us, bindProofToProjection as ut, isRootPauseRequest as v, GuardItemStatus as va, UserInteractionKind as vi, GitCommandRejected as vn, AuthorityDisposition as vo, ACTIVE_HOST_COHORT_ID as vr, STATEFUL_ACTIONS as vs, proofEvidenceConstraints as vt, testOutcomePredicate as w, NeedsReviewReason as wa, parseConfirmationMessage as wi, LinearCommitReadback as wn, LEGACY_QUALIFICATION as wo, BASE_HOST_PACKAGES as wr, actionCompatible as ws, sessionQuery as wt, latestRootInstruction as x, HostStatus as xa, CONFIRM_LINE_PATTERN as xi, GitPrestateCheck as xn, ExecutionQualification as xo, ALPHA2_DSHMARKET_139_HOST_PACKAGES as xr, SUPPORTED_EVIDENCE_ADAPTERS as xs, proofV2Rejection as xt, isWholeTaskCompletionClaim as y, GuardOperation as ya, classifyTaskIntent as yi, GitEffectExecution as yn, DirectiveClass as yo, ACTIVE_HOST_COHORT_IDS as yr, STOP_PROTOCOL_VERSION as ys, proofHostSurfacesOf as yt, RecoveryOptions as z, ReleaseObservedIdentity as za, BoundaryEffectuation as zi, parsePwshCommand as zn, interpretMessage as zo, HostLockContext as zr, sha256 as zs, FIRST_STEP_GUIDANCE as zt };