instar 1.3.761 → 1.3.763

package/dist/monitoring/ExternalHogFactBuilder.d.ts

@@ -0,0 +1,71 @@
+/**
+ * ExternalHogFactBuilder — the STAGE-2 deterministic fact + identity derivation (CMT-1901,
+ * docs/specs/external-hog-zombie-autokill-sentinel.md §2, §4). PURE over its inputs.
+ *
+ * Given a candidate's proc row, its FULL argv (fetched off-loop by the impure adapter), the
+ * process tree, the instar-owned set, and a couple of I/O-gathered inputs (own euid, the set of
+ * launchctl-labeled pids), this builds the `ExternalHogFacts` the floor evaluates and the
+ * identity (classId / commandHash / ledgerKey) the ledger + funnel key on. It NEVER spawns a
+ * process or reads a clock — the impure edges (ps -o args=, launchctl, geteuid) live in the
+ * adapter and are passed IN, so every derivation here is unit-testable.
+ *
+ * The load-bearing derivation is `ownerAppRunning` (§ round-6/round-8): for the editor-exthost
+ * class it means "is the SPECIFIC `--parentPid` process that spawned this exthost still alive?"
+ * — NOT "any window of the app," which would veto a real zombie whenever any editor window is
+ * open (the exact 2026-07-03 anchor incident, where multiple windows is the common case). Every
+ * un-establishable branch fails toward `ownerAppRunning:true` → the floor VETOES (alert-never-kill).
+ */
+import type { ProcTableRow } from './ExternalHogProcTable.js';
+import { type ProcTree, type OwnedRefs } from './ExternalHogOwnership.js';
+import { type ExternalHogFacts } from './ExternalHogFloor.js';
+export interface FactBuilderInput {
+    /** The candidate's proc row (from the parsed ps table). */
+    readonly row: ProcTableRow;
+    /** The candidate's FULL argv (ps -o args=), fetched off-loop by the adapter. */
+    readonly argv: string;
+    readonly tree: ProcTree;
+    readonly ownedRefs: OwnedRefs;
+    readonly maxAncestorHops: number;
+    /** The sentinel's own effective uid (process.geteuid()), passed in by the adapter. */
+    readonly ownEuid: number;
+    /** The set of pids that are labeled launchd jobs (from `launchctl`), gathered by the adapter. */
+    readonly launchctlLabeledPids: ReadonlySet<number>;
+    /** Was the candidate over the core threshold THIS window? (The sampler guarantees true for a
+     *  candidate; the orchestrator ANDs this with the N-window streak — see ExternalHogSustained.) */
+    readonly sustainedThisWindow: boolean;
+}
+/** Extract the class-parameterized spawning parent pid (`--parentPid=N`) from argv; null if absent. */
+export declare function parseParentPid(argv: string): number | null;
+/**
+ * Parse an `lstart` token (`ps lstart=` — "Wed Jul  2 10:00:00 2026") to epoch millis, for
+ * ORDERING ONLY (the reused-parent-pid check). Returns null on ANY ambiguity — a null forces the
+ * caller to the fail-safe (conservative veto) branch. The proc-table parser keeps `startTime` an
+ * opaque equality token by design; this targeted parse is confined to the one ordering comparison.
+ */
+export declare function lstartToEpochMs(startTime: string): number | null;
+/**
+ * Is the SPECIFIC spawning parent still alive? (§ round-8 provenance path b.)
+ *  - no `--parentPid` in argv → owner cannot be established → TRUE (veto, safe)
+ *  - `--parentPid=N` absent from the table → parent dead → FALSE (kill-eligible)
+ *  - `N` present, its start-time LATER than this child's → `N` was reused, real parent dead → FALSE
+ *  - `N` present, started before-or-equal the child (or start-times un-orderable) → alive/uncertain
+ *    → TRUE (veto, safe)
+ */
+export declare function deriveOwnerAppRunning(row: ProcTableRow, argv: string, tree: ProcTree): boolean;
+/**
+ * Build the deterministic facts the floor evaluates. Returns null only if the row is structurally
+ * unusable (a non-finite pid) — every OTHER uncertainty is encoded as a veto-leaning fact value,
+ * never a silent drop (the §4 broad-observability floor still surfaces it).
+ */
+export declare function buildFacts(input: FactBuilderInput): ExternalHogFacts | null;
+/**
+ * Derive the kill identity for a candidate: its allowlist class, a stable command-hash, and the
+ * ledger key the P19 breaker uses. Returns null when the candidate is OUTSIDE the code-defined
+ * allowlist (not kill-eligible) — the caller then surfaces it (observability) but never kills it.
+ */
+export declare function buildIdentity(facts: ExternalHogFacts): {
+    classId: string;
+    commandHash: string;
+    ledgerKey: string;
+} | null;
+//# sourceMappingURL=ExternalHogFactBuilder.d.ts.map

package/dist/monitoring/ExternalHogFactBuilder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExternalHogFactBuilder.d.ts","sourceRoot":"","sources":["../../src/monitoring/ExternalHogFactBuilder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAiB,KAAK,QAAQ,EAAE,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACzF,OAAO,EAAuB,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEnF,MAAM,WAAW,gBAAgB;IAC/B,2DAA2D;IAC3D,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,sFAAsF;IACtF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,iGAAiG;IACjG,QAAQ,CAAC,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnD;sGACkG;IAClG,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;CACvC;AAID,uGAAuG;AACvG,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM1D;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIhE;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAW9F;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,IAAI,CAmB3E;AAQD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,gBAAgB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAKzH"}

package/dist/monitoring/ExternalHogFactBuilder.js

@@ -0,0 +1,111 @@
+/**
+ * ExternalHogFactBuilder — the STAGE-2 deterministic fact + identity derivation (CMT-1901,
+ * docs/specs/external-hog-zombie-autokill-sentinel.md §2, §4). PURE over its inputs.
+ *
+ * Given a candidate's proc row, its FULL argv (fetched off-loop by the impure adapter), the
+ * process tree, the instar-owned set, and a couple of I/O-gathered inputs (own euid, the set of
+ * launchctl-labeled pids), this builds the `ExternalHogFacts` the floor evaluates and the
+ * identity (classId / commandHash / ledgerKey) the ledger + funnel key on. It NEVER spawns a
+ * process or reads a clock — the impure edges (ps -o args=, launchctl, geteuid) live in the
+ * adapter and are passed IN, so every derivation here is unit-testable.
+ *
+ * The load-bearing derivation is `ownerAppRunning` (§ round-6/round-8): for the editor-exthost
+ * class it means "is the SPECIFIC `--parentPid` process that spawned this exthost still alive?"
+ * — NOT "any window of the app," which would veto a real zombie whenever any editor window is
+ * open (the exact 2026-07-03 anchor incident, where multiple windows is the common case). Every
+ * un-establishable branch fails toward `ownerAppRunning:true` → the floor VETOES (alert-never-kill).
+ */
+import { createHash } from 'node:crypto';
+import { isInstarOwned } from './ExternalHogOwnership.js';
+import { matchAllowlistClass } from './ExternalHogFloor.js';
+const PARENT_PID_RE = /--parentPid[= ](\d+)/;
+/** Extract the class-parameterized spawning parent pid (`--parentPid=N`) from argv; null if absent. */
+export function parseParentPid(argv) {
+    if (typeof argv !== 'string')
+        return null;
+    const m = PARENT_PID_RE.exec(argv);
+    if (!m)
+        return null;
+    const n = Number(m[1]);
+    return Number.isInteger(n) && n > 0 ? n : null;
+}
+/**
+ * Parse an `lstart` token (`ps lstart=` — "Wed Jul  2 10:00:00 2026") to epoch millis, for
+ * ORDERING ONLY (the reused-parent-pid check). Returns null on ANY ambiguity — a null forces the
+ * caller to the fail-safe (conservative veto) branch. The proc-table parser keeps `startTime` an
+ * opaque equality token by design; this targeted parse is confined to the one ordering comparison.
+ */
+export function lstartToEpochMs(startTime) {
+    if (typeof startTime !== 'string' || startTime.trim().length === 0)
+        return null;
+    const ms = Date.parse(startTime);
+    return Number.isFinite(ms) ? ms : null;
+}
+/**
+ * Is the SPECIFIC spawning parent still alive? (§ round-8 provenance path b.)
+ *  - no `--parentPid` in argv → owner cannot be established → TRUE (veto, safe)
+ *  - `--parentPid=N` absent from the table → parent dead → FALSE (kill-eligible)
+ *  - `N` present, its start-time LATER than this child's → `N` was reused, real parent dead → FALSE
+ *  - `N` present, started before-or-equal the child (or start-times un-orderable) → alive/uncertain
+ *    → TRUE (veto, safe)
+ */
+export function deriveOwnerAppRunning(row, argv, tree) {
+    const n = parseParentPid(argv);
+    if (n === null)
+        return true; // no provenance token → cannot establish owner-dead → veto
+    const parent = tree.get(n);
+    if (!parent)
+        return false; // the specific parent pid is gone → dead → kill-eligible
+    // Parent pid is present — is it the REAL parent, or a reused pid now hosting a newer process?
+    const childMs = lstartToEpochMs(row.startTime);
+    const parentMs = lstartToEpochMs(parent.startTime);
+    if (childMs === null || parentMs === null)
+        return true; // can't order → assume live parent → veto
+    if (parentMs > childMs)
+        return false; // parent started AFTER the child ⇒ pid reused ⇒ real parent dead
+    return true; // parent older-or-equal ⇒ plausibly the live real parent ⇒ veto
+}
+/**
+ * Build the deterministic facts the floor evaluates. Returns null only if the row is structurally
+ * unusable (a non-finite pid) — every OTHER uncertainty is encoded as a veto-leaning fact value,
+ * never a silent drop (the §4 broad-observability floor still surfaces it).
+ */
+export function buildFacts(input) {
+    const { row, argv, tree, ownedRefs, maxAncestorHops, ownEuid, launchctlLabeledPids } = input;
+    if (!row || !Number.isInteger(row.pid) || row.pid <= 0)
+        return null;
+    return {
+        name: row.comm,
+        argv,
+        pid: row.pid,
+        // Defense-in-depth: a candidate is already non-instar-owned (the sampler filtered), recompute.
+        isInstarProcess: isInstarOwned(row.pid, tree, ownedRefs, maxAncestorHops),
+        // A root/system-owned process is never in our same-uid envelope → the floor vetoes it anyway,
+        // but flag it explicitly so the veto reason is honest (`system-root-daemon`).
+        ownerRootDaemon: row.uid === 0,
+        hasLaunchctlLabel: launchctlLabeledPids.has(row.pid),
+        ownerAppRunning: deriveOwnerAppRunning(row, argv, tree),
+        // Single-window confirmation; the orchestrator ANDs this with the N-window streak (§1).
+        sustainedHighCpu: input.sustainedThisWindow === true,
+        targetUid: row.uid,
+        ownEuid,
+    };
+}
+/** Strip the volatile provenance token so the command signature is STABLE across re-launches (a
+ *  fresh exthost gets a new `--parentPid`; the breaker must count respawns of the SAME command). */
+function stableCommandSignature(argv) {
+    return argv.replace(PARENT_PID_RE, '--parentPid=<>');
+}
+/**
+ * Derive the kill identity for a candidate: its allowlist class, a stable command-hash, and the
+ * ledger key the P19 breaker uses. Returns null when the candidate is OUTSIDE the code-defined
+ * allowlist (not kill-eligible) — the caller then surfaces it (observability) but never kills it.
+ */
+export function buildIdentity(facts) {
+    const classId = matchAllowlistClass(facts.name, facts.argv);
+    if (!classId)
+        return null; // outside the narrow killable envelope
+    const commandHash = createHash('sha256').update(stableCommandSignature(facts.argv), 'utf8').digest('hex');
+    return { classId, commandHash, ledgerKey: `${classId}:${commandHash}` };
+}
+//# sourceMappingURL=ExternalHogFactBuilder.js.map

package/dist/monitoring/ExternalHogFactBuilder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExternalHogFactBuilder.js","sourceRoot":"","sources":["../../src/monitoring/ExternalHogFactBuilder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,aAAa,EAAiC,MAAM,2BAA2B,CAAC;AACzF,OAAO,EAAE,mBAAmB,EAAyB,MAAM,uBAAuB,CAAC;AAmBnF,MAAM,aAAa,GAAG,sBAAsB,CAAC;AAE7C,uGAAuG;AACvG,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAiB,EAAE,IAAY,EAAE,IAAc;IACnF,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,2DAA2D;IACxF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC,CAAC,yDAAyD;IACpF,8FAA8F;IAC9F,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,OAAO,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,0CAA0C;IAClG,IAAI,QAAQ,GAAG,OAAO;QAAE,OAAO,KAAK,CAAC,CAAC,iEAAiE;IACvG,OAAO,IAAI,CAAC,CAAC,gEAAgE;AAC/E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAuB;IAChD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,oBAAoB,EAAE,GAAG,KAAK,CAAC;IAC7F,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI;QACJ,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,+FAA+F;QAC/F,eAAe,EAAE,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC;QACzE,8FAA8F;QAC9F,8EAA8E;QAC9E,eAAe,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;QAC9B,iBAAiB,EAAE,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;QACpD,eAAe,EAAE,qBAAqB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC;QACvD,wFAAwF;QACxF,gBAAgB,EAAE,KAAK,CAAC,mBAAmB,KAAK,IAAI;QACpD,SAAS,EAAE,GAAG,CAAC,GAAG;QAClB,OAAO;KACR,CAAC;AACJ,CAAC;AAED;oGACoG;AACpG,SAAS,sBAAsB,CAAC,IAAY;IAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAuB;IACnD,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,CAAC,uCAAuC;IAClE,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1G,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,OAAO,IAAI,WAAW,EAAE,EAAE,CAAC;AAC1E,CAAC"}

package/dist/monitoring/ExternalHogFloor.d.ts

@@ -0,0 +1,87 @@
+/**
+ * ExternalHogFloor — the deterministic, VETO-ONLY safety floor of the External-Hog
+ * Zombie Auto-Kill Sentinel (CMT-1901, docs/specs/external-hog-zombie-autokill-sentinel.md §3-§4).
+ *
+ * SAFETY MODEL (signal-vs-authority): the intelligence (zombie-classify) holds the kill
+ * DECISION authority (kill/leave/alert); this floor holds only VETO authority. A kill
+ * executes iff `evaluateKillFloor(...).permitted === true && classifierVerdict === 'kill'`
+ * — a two-key AND. The floor can ONLY ever BLOCK a kill (downgrade it to an alert); it can
+ * NEVER trigger one. The model's authority is therefore purely SUBTRACTIVE: it may SPARE a
+ * process inside the envelope, but can never widen the envelope the floor has proven safe.
+ *
+ * The floor is a PURE function over a normalized fact set (no I/O). It fails CLOSED: any
+ * missing/unknowable invariant → NOT permitted (→ alert), never a kill. The process name
+ * and argv are attacker-controllable text, so the floor NEVER trusts them beyond the
+ * code-defined allowlist match — a cleverly-named process can at most be SPARED or land a
+ * kill INSIDE the allowlist envelope (the intended action), never expand the target set.
+ */
+/** The code-defined allowlist: v1 seed = orphaned Electron editor extension-host WRAPPERS.
+ *  NOT a config key — growing it is a reviewed source change (§3, blast-radius invariant).
+ *  Each class requires BOTH a name-regex match AND an extension-host/language-server argv
+ *  token (tolerant of extension-path-dominated argv — the token may appear anywhere). */
+export interface AllowlistClass {
+    readonly id: string;
+    readonly nameRegex: RegExp;
+}
+export declare const EXTERNAL_HOG_ALLOWLIST: readonly AllowlistClass[];
+/**
+ * Match a candidate against the code-defined allowlist. Returns the matched class id, or
+ * null. The name-regex is matched on the process `comm`/name (which the discovery layer
+ * reads); the argv token is matched on the FULL argv (never the truncatable `comm`).
+ */
+export declare function matchAllowlistClass(name: string, fullArgv: string): string | null;
+/**
+ * The ORDERED rule-source list for a class — the SINGLE source of truth the content-hash
+ * arm-scope is computed from (docs/specs §7-§8). BOTH the PIN arm route (building the marker's
+ * `allowlistSnapshot`) and the funnel's `currentClassContentHash` MUST derive the hash from THIS,
+ * so a class's armed hash and its re-checked hash always agree — and ANY change to the matcher
+ * (a new name-regex or argv token) yields a different hash, forcing a fresh PIN re-arm before that
+ * class can kill again. Returns null for an unknown class id. Ordered = [nameRegex source, then
+ * the shared argv-token sources] so a reordering (which changes anchored matching) is a new hash.
+ */
+export declare function classRuleSources(classId: string): readonly string[] | null;
+/**
+ * The deterministically-computed facts the floor evaluates. Every field is derived by the
+ * discovery/sampler layer from the live OS (never from model output). Optional fields that
+ * are UNKNOWN (undefined) fail the floor CLOSED — an unestablished invariant is a veto.
+ */
+export interface ExternalHogFacts {
+    /** Process name / `comm` — attacker-controllable; only ever used for the allowlist regex. */
+    readonly name: string;
+    /** Full argv — attacker-controllable; only ever used for the allowlist argv-token match. */
+    readonly argv: string;
+    readonly pid: number;
+    /** Provenance: is the SPECIFIC spawning parent (argv `--parentPid`) still alive? `true` = owner
+     *  app running (or owner cannot be positively established) → floor VETO; `false` = the specific
+     *  `--parentPid` is dead (start-time-verified) → kill-eligible. NOT bare ppid===1. (The invariant
+     *  at evaluateKillFloor step 5 vetoes when this is `true`.) */
+    readonly ownerAppRunning: boolean;
+    /** Confirmed sustained CPU hog (the §1 N-window CPU-delta ≥ cpuCoreThreshold). Hard veto. */
+    readonly sustainedHighCpu: boolean;
+    /** The process is instar-owned (server / session / sampler / a live-session descendant). */
+    readonly isInstarProcess: boolean;
+    /** The owner is a system/root daemon (fseventsd, WindowServer, …) — never killable. */
+    readonly ownerRootDaemon: boolean;
+    /** A labeled launchd job — managed, killing invites a respawn loop → veto. */
+    readonly hasLaunchctlLabel: boolean;
+    /** Target real/effective uid. Must equal the sentinel's own non-root euid (same-uid floor). */
+    readonly targetUid?: number;
+    /** The sentinel's own effective uid (non-root). */
+    readonly ownEuid?: number;
+}
+export type FloorVerdict = {
+    readonly permitted: true;
+    readonly matchedClass: string;
+} | {
+    readonly permitted: false;
+    readonly vetoReason: string;
+};
+/**
+ * Evaluate the VETO-ONLY safety floor over the deterministic facts. Returns
+ * `{ permitted: true }` only when EVERY hard invariant holds; otherwise
+ * `{ permitted: false, vetoReason }` with the FIRST failing invariant. A `permitted:true`
+ * result is a NECESSARY (never sufficient) condition for a kill — the caller must ALSO
+ * have a `classifier === 'kill'` verdict. Fails CLOSED on any unknown invariant.
+ */
+export declare function evaluateKillFloor(facts: ExternalHogFacts): FloorVerdict;
+//# sourceMappingURL=ExternalHogFloor.d.ts.map

package/dist/monitoring/ExternalHogFloor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExternalHogFloor.d.ts","sourceRoot":"","sources":["../../src/monitoring/ExternalHogFloor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;yFAGyF;AACzF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,sBAAsB,EAAE,SAAS,cAAc,EAKlD,CAAC;AAUX;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMjF;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,IAAI,CAI1E;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6FAA6F;IAC7F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4FAA4F;IAC5F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;mEAG+D;IAC/D,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,6FAA6F;IAC7F,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,4FAA4F;IAC5F,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,uFAAuF;IACvF,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,8EAA8E;IAC9E,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,+FAA+F;IAC/F,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,mDAAmD;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/D;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,GAAG,YAAY,CAsDvE"}

package/dist/monitoring/ExternalHogFloor.js

@@ -0,0 +1,123 @@
+/**
+ * ExternalHogFloor — the deterministic, VETO-ONLY safety floor of the External-Hog
+ * Zombie Auto-Kill Sentinel (CMT-1901, docs/specs/external-hog-zombie-autokill-sentinel.md §3-§4).
+ *
+ * SAFETY MODEL (signal-vs-authority): the intelligence (zombie-classify) holds the kill
+ * DECISION authority (kill/leave/alert); this floor holds only VETO authority. A kill
+ * executes iff `evaluateKillFloor(...).permitted === true && classifierVerdict === 'kill'`
+ * — a two-key AND. The floor can ONLY ever BLOCK a kill (downgrade it to an alert); it can
+ * NEVER trigger one. The model's authority is therefore purely SUBTRACTIVE: it may SPARE a
+ * process inside the envelope, but can never widen the envelope the floor has proven safe.
+ *
+ * The floor is a PURE function over a normalized fact set (no I/O). It fails CLOSED: any
+ * missing/unknowable invariant → NOT permitted (→ alert), never a kill. The process name
+ * and argv are attacker-controllable text, so the floor NEVER trusts them beyond the
+ * code-defined allowlist match — a cleverly-named process can at most be SPARED or land a
+ * kill INSIDE the allowlist envelope (the intended action), never expand the target set.
+ */
+export const EXTERNAL_HOG_ALLOWLIST = [
+    { id: 'vscode-exthost', nameRegex: /^Code Helper \(Plugin\)$/ },
+    { id: 'cursor-exthost', nameRegex: /^Cursor Helper \(Plugin\)$/ },
+    { id: 'windsurf-exthost', nameRegex: /^Windsurf Helper \(Plugin\)$/ },
+    { id: 'vscodium-exthost', nameRegex: /^Code - OSS Helper \(Plugin\)$/ },
+];
+/** The extension-host / language-server argv tokens a candidate must ALSO carry. Matched
+ *  case-insensitively ANYWHERE in the full argv (incl. inside a path segment). */
+const ALLOWLIST_ARGV_TOKENS = [
+    /extension[\s._-]*host/i,
+    /language[\s._-]*server/i,
+    /--type=extensionHost/i,
+];
+/**
+ * Match a candidate against the code-defined allowlist. Returns the matched class id, or
+ * null. The name-regex is matched on the process `comm`/name (which the discovery layer
+ * reads); the argv token is matched on the FULL argv (never the truncatable `comm`).
+ */
+export function matchAllowlistClass(name, fullArgv) {
+    if (typeof name !== 'string' || typeof fullArgv !== 'string')
+        return null;
+    const cls = EXTERNAL_HOG_ALLOWLIST.find((c) => c.nameRegex.test(name));
+    if (!cls)
+        return null;
+    const hasToken = ALLOWLIST_ARGV_TOKENS.some((t) => t.test(fullArgv));
+    return hasToken ? cls.id : null;
+}
+/**
+ * The ORDERED rule-source list for a class — the SINGLE source of truth the content-hash
+ * arm-scope is computed from (docs/specs §7-§8). BOTH the PIN arm route (building the marker's
+ * `allowlistSnapshot`) and the funnel's `currentClassContentHash` MUST derive the hash from THIS,
+ * so a class's armed hash and its re-checked hash always agree — and ANY change to the matcher
+ * (a new name-regex or argv token) yields a different hash, forcing a fresh PIN re-arm before that
+ * class can kill again. Returns null for an unknown class id. Ordered = [nameRegex source, then
+ * the shared argv-token sources] so a reordering (which changes anchored matching) is a new hash.
+ */
+export function classRuleSources(classId) {
+    const cls = EXTERNAL_HOG_ALLOWLIST.find((c) => c.id === classId);
+    if (!cls)
+        return null;
+    return [cls.nameRegex.source, ...ALLOWLIST_ARGV_TOKENS.map((t) => t.source)];
+}
+/**
+ * Evaluate the VETO-ONLY safety floor over the deterministic facts. Returns
+ * `{ permitted: true }` only when EVERY hard invariant holds; otherwise
+ * `{ permitted: false, vetoReason }` with the FIRST failing invariant. A `permitted:true`
+ * result is a NECESSARY (never sufficient) condition for a kill — the caller must ALSO
+ * have a `classifier === 'kill'` verdict. Fails CLOSED on any unknown invariant.
+ */
+export function evaluateKillFloor(facts) {
+    // (0) STRICT fail-closed guard — every required boolean invariant must be a genuine
+    //     boolean. A missing/`undefined`/non-boolean value VETOES rather than skipping the
+    //     check. This is load-bearing: `if (facts.X)` truthiness would let an `undefined`
+    //     field fail OPEN, and the fail-closed property must NOT be delegated to the type
+    //     system or sampler correctness — exactly the layer that degrades under the CPU/memory
+    //     starvation this sentinel hunts (a sampler that times out computing `ownerAppRunning`
+    //     and drops the field must never yield a permitted kill of a process whose orphanhood
+    //     was never established). (round-11 — second-pass reviewer.)
+    const requiredBooleans = {
+        isInstarProcess: facts.isInstarProcess,
+        ownerRootDaemon: facts.ownerRootDaemon,
+        hasLaunchctlLabel: facts.hasLaunchctlLabel,
+        ownerAppRunning: facts.ownerAppRunning,
+        sustainedHighCpu: facts.sustainedHighCpu,
+    };
+    for (const [field, value] of Object.entries(requiredBooleans)) {
+        if (typeof value !== 'boolean')
+            return { permitted: false, vetoReason: `field-unknown:${field}` };
+    }
+    // (1) instar-own exclusion — never act on our own process tree (defense-in-depth; also
+    //     excluded at discovery). Checked first so an own-process can never even be reasoned about.
+    if (facts.isInstarProcess)
+        return { permitted: false, vetoReason: 'instar-owned' };
+    // (2) same-uid floor invariant — a hard property, not incidental EPERM. The grant's scope
+    //     is the granting operator's OWN processes. Unknown uid → fail closed.
+    if (facts.ownEuid === undefined || facts.targetUid === undefined) {
+        return { permitted: false, vetoReason: 'uid-unknown' };
+    }
+    if (facts.ownEuid === 0)
+        return { permitted: false, vetoReason: 'refuse-to-arm-as-root' };
+    if (facts.targetUid !== facts.ownEuid)
+        return { permitted: false, vetoReason: 'other-uid' };
+    // (3) system/root daemon — the OS itself is never killable (defense-in-depth denylist).
+    if (facts.ownerRootDaemon)
+        return { permitted: false, vetoReason: 'system-root-daemon' };
+    // (4) launchctl label — a managed launchd job; killing invites a respawn loop.
+    if (facts.hasLaunchctlLabel)
+        return { permitted: false, vetoReason: 'launchctl-labeled' };
+    // (5) provenance-of-orphanhood — the specific spawning parent must be DEAD. A live owner
+    //     app (an exthost whose window is still open) is never a zombie.
+    if (facts.ownerAppRunning)
+        return { permitted: false, vetoReason: 'owner-app-running' };
+    // (6) sustainedHighCpu — HARD VETO. An idle orphan or a momentary spike is NEVER killed,
+    //     regardless of the model's verdict — the feature stays scoped to CPU reclamation by
+    //     construction, not by the model's judgment.
+    if (!facts.sustainedHighCpu)
+        return { permitted: false, vetoReason: 'not-sustained-hog' };
+    // (7) code-defined allowlist class — outside the narrow envelope is a veto regardless of
+    //     the model's call. Attacker-controllable name/argv can at most land INSIDE this
+    //     envelope (the intended action), never expand it.
+    const matchedClass = matchAllowlistClass(facts.name, facts.argv);
+    if (!matchedClass)
+        return { permitted: false, vetoReason: 'outside-allowlist' };
+    return { permitted: true, matchedClass };
+}
+//# sourceMappingURL=ExternalHogFloor.js.map

package/dist/monitoring/ExternalHogFloor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExternalHogFloor.js","sourceRoot":"","sources":["../../src/monitoring/ExternalHogFloor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAWH,MAAM,CAAC,MAAM,sBAAsB,GAA8B;IAC/D,EAAE,EAAE,EAAE,gBAAgB,EAAE,SAAS,EAAE,0BAA0B,EAAE;IAC/D,EAAE,EAAE,EAAE,gBAAgB,EAAE,SAAS,EAAE,4BAA4B,EAAE;IACjE,EAAE,EAAE,EAAE,kBAAkB,EAAE,SAAS,EAAE,8BAA8B,EAAE;IACrE,EAAE,EAAE,EAAE,kBAAkB,EAAE,SAAS,EAAE,gCAAgC,EAAE;CAC/D,CAAC;AAEX;kFACkF;AAClF,MAAM,qBAAqB,GAAsB;IAC/C,wBAAwB;IACxB,yBAAyB;IACzB,uBAAuB;CACxB,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,QAAgB;IAChE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1E,MAAM,GAAG,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrE,OAAO,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAClC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,GAAG,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC;IACjE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAC/E,CAAC;AAoCD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAuB;IACvD,oFAAoF;IACpF,uFAAuF;IACvF,sFAAsF;IACtF,sFAAsF;IACtF,2FAA2F;IAC3F,2FAA2F;IAC3F,0FAA0F;IAC1F,iEAAiE;IACjE,MAAM,gBAAgB,GAAG;QACvB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC;IACF,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC9D,IAAI,OAAO,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,iBAAiB,KAAK,EAAE,EAAE,CAAC;IACpG,CAAC;IAED,uFAAuF;IACvF,gGAAgG;IAChG,IAAI,KAAK,CAAC,eAAe;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;IAEnF,0FAA0F;IAC1F,2EAA2E;IAC3E,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACjE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,uBAAuB,EAAE,CAAC;IAC1F,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;IAE5F,wFAAwF;IACxF,IAAI,KAAK,CAAC,eAAe;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC;IAEzF,+EAA+E;IAC/E,IAAI,KAAK,CAAC,iBAAiB;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAE1F,yFAAyF;IACzF,qEAAqE;IACrE,IAAI,KAAK,CAAC,eAAe;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAExF,yFAAyF;IACzF,yFAAyF;IACzF,iDAAiD;IACjD,IAAI,CAAC,KAAK,CAAC,gBAAgB;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAE1F,yFAAyF;IACzF,qFAAqF;IACrF,uDAAuD;IACvD,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAEhF,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAC3C,CAAC"}

package/dist/monitoring/ExternalHogGuardStatus.d.ts

@@ -0,0 +1,29 @@
+/**
+ * ExternalHogGuardStatus — the guard-posture state of the External-Hog sentinel
+ * (CMT-1901, docs/specs/external-hog-zombie-autokill-sentinel.md §1/§8).
+ *
+ * The posture must reflect VERIFIED kill-capability, NOT a config wish (the `/guards` honesty
+ * rule): `on-confirmed` ONLY when the feature is actually kill-capable (enabled && !dryRun && a
+ * VALID PIN armed marker). The reachable `config.dryRun:false` + marker-absent state reads
+ * `on-dry-run` (v1 maps the deferred `armed-pending` → `on-dry-run`), never `on-confirmed`. A
+ * dead sampler degrades to `on-stale` (§1) — NOT config-only. Pure function.
+ */
+import type { GuardEffectiveState } from './guardPostureView.js';
+export interface ExternalHogGuardInput {
+    /** The resolved `enabled` (dev-gate resolved). */
+    readonly enabled: boolean;
+    readonly dryRun: boolean;
+    /** Is the PIN armed marker currently VALID (armEpoch > lastDisarmEpoch)? */
+    readonly markerValid: boolean;
+    /** Is the sampler heartbeat stale past the sampler-dead threshold (§1)? */
+    readonly samplerDead: boolean;
+}
+/**
+ * Map the live external-hog state to a guard-posture effective state.
+ *  - not enabled            → `off`
+ *  - sampler dead           → `on-stale`   (the §1 liveness degradation; feature is blind)
+ *  - enabled && !dryRun && marker-valid → `on-confirmed` (actually kill-capable)
+ *  - otherwise (dryRun OR no valid marker) → `on-dry-run` (watch-only / armed-pending)
+ */
+export declare function externalHogEffectiveState(input: ExternalHogGuardInput): GuardEffectiveState;
+//# sourceMappingURL=ExternalHogGuardStatus.d.ts.map

package/dist/monitoring/ExternalHogGuardStatus.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExternalHogGuardStatus.d.ts","sourceRoot":"","sources":["../../src/monitoring/ExternalHogGuardStatus.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAEjE,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,qBAAqB,GAAG,mBAAmB,CAK3F"}

package/dist/monitoring/ExternalHogGuardStatus.js

@@ -0,0 +1,27 @@
+/**
+ * ExternalHogGuardStatus — the guard-posture state of the External-Hog sentinel
+ * (CMT-1901, docs/specs/external-hog-zombie-autokill-sentinel.md §1/§8).
+ *
+ * The posture must reflect VERIFIED kill-capability, NOT a config wish (the `/guards` honesty
+ * rule): `on-confirmed` ONLY when the feature is actually kill-capable (enabled && !dryRun && a
+ * VALID PIN armed marker). The reachable `config.dryRun:false` + marker-absent state reads
+ * `on-dry-run` (v1 maps the deferred `armed-pending` → `on-dry-run`), never `on-confirmed`. A
+ * dead sampler degrades to `on-stale` (§1) — NOT config-only. Pure function.
+ */
+/**
+ * Map the live external-hog state to a guard-posture effective state.
+ *  - not enabled            → `off`
+ *  - sampler dead           → `on-stale`   (the §1 liveness degradation; feature is blind)
+ *  - enabled && !dryRun && marker-valid → `on-confirmed` (actually kill-capable)
+ *  - otherwise (dryRun OR no valid marker) → `on-dry-run` (watch-only / armed-pending)
+ */
+export function externalHogEffectiveState(input) {
+    if (input.enabled !== true)
+        return 'off';
+    if (input.samplerDead === true)
+        return 'on-stale';
+    if (input.dryRun === false && input.markerValid === true)
+        return 'on-confirmed';
+    return 'on-dry-run';
+}
+//# sourceMappingURL=ExternalHogGuardStatus.js.map

package/dist/monitoring/ExternalHogGuardStatus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExternalHogGuardStatus.js","sourceRoot":"","sources":["../../src/monitoring/ExternalHogGuardStatus.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAcH;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAA4B;IACpE,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC;IAClD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI;QAAE,OAAO,cAAc,CAAC;IAChF,OAAO,YAAY,CAAC;AACtB,CAAC"}

package/dist/monitoring/ExternalHogKillFunnel.d.ts

@@ -0,0 +1,77 @@
+/**
+ * ExternalHogKillFunnel — the hardened kill sequence of the External-Hog sentinel
+ * (CMT-1901, docs/specs/external-hog-zombie-autokill-sentinel.md §4).
+ *
+ * The ONLY place a real signal is sent. Structured so the watch-only guarantee is by
+ * construction: unless a LIVE kill is authorized (`canKillLive` — enabled && !dryRun && a valid
+ * PIN armed marker for this class), the funnel sends NO signal and returns a `would-kill`
+ * record. All I/O (fact re-read, arm re-read, fd-probe, signal send, aliveness, clock, wait) is
+ * INJECTED so the sequence is fully testable without ever killing a process.
+ *
+ * Sequence (a candidate that has already passed §4 Stage-A CPU admission + §5 classifier=kill):
+ *   1. Gate: re-read the LIVE arm state → not authorized ⇒ `would-kill` (dry-run / not-armed).
+ *   2. Stage-B (pre-SIGTERM): re-read the LIVE facts → the §4 floor must still PERMIT; abort→alert.
+ *   3. SIGTERM → wait `sigtermGraceMs`.
+ *   4. If the process exited during grace → `sigterm-exited` (no SIGKILL needed).
+ *   5. Stage-B (pre-SIGKILL): re-read facts + arm → any change/disarm ⇒ abort (never SIGKILL).
+ *   6. fd-skip: an open writable WORKSPACE file ⇒ DEFER the SIGKILL (bounded by maxKillDeferrals).
+ *   7. SIGKILL → `killed`.
+ */
+import { type ExternalHogFacts } from './ExternalHogFloor.js';
+import { type ArmConfig, type ArmMarker } from './ExternalHogArmMarker.js';
+export type KillOutcome = {
+    action: 'would-kill';
+    reason: 'dry-run' | 'not-armed';
+} | {
+    action: 'killed';
+} | {
+    action: 'sigterm-exited';
+} | {
+    action: 'deferred';
+    reason: 'writable-workspace-file';
+} | {
+    action: 'aborted';
+    reason: string;
+};
+export interface KillTarget {
+    readonly pid: number;
+    readonly startTime: string;
+    readonly commandHash: string;
+    readonly classId: string;
+}
+export interface KillArmState {
+    readonly config: ArmConfig;
+    readonly marker: ArmMarker | null;
+    readonly lastDisarmEpoch: number;
+}
+export interface KillFunnelDeps {
+    /** Re-read the LIVE deterministic facts for (pid, startTime); null if gone/identity-changed.
+     *  May be async (a fresh ps + argv read) — the funnel awaits it. */
+    reReadFacts(pid: number, startTime: string): ExternalHogFacts | null | Promise<ExternalHogFacts | null>;
+    /** Re-read the LIVE arm state (config + marker + lastDisarmEpoch). */
+    reReadArmState(): KillArmState;
+    /** The current content-hash of a class's compiled match rules (for the arm-scope check). */
+    currentClassContentHash(classId: string): string;
+    /** True if the pid holds an open writable REGULAR file under a workspace/document path.
+     *  May be async (an lsof-shaped probe) — the funnel awaits it. */
+    hasOpenWritableWorkspaceFile(pid: number): boolean | Promise<boolean>;
+    /** Send a signal ('SIGTERM' | 'SIGKILL') to the pid. */
+    sendSignal(pid: number, signal: 'SIGTERM' | 'SIGKILL'): void;
+    /** Is (pid, startTime) still the live, same process? */
+    stillAlive(pid: number, startTime: string): boolean;
+    /** Await ms (injected so tests control the grace wait). */
+    wait(ms: number): Promise<void>;
+}
+export interface KillFunnelOpts {
+    readonly sigtermGraceMs: number;
+    readonly maxKillDeferrals: number;
+    /** How many times THIS target has already been deferred (caller-tracked). */
+    readonly currentDeferrals: number;
+}
+/**
+ * Run the kill funnel for one target. Sends real signals ONLY when a live kill is authorized at
+ * BOTH re-check points; otherwise returns a non-destructive outcome. Pure control flow over the
+ * injected I/O.
+ */
+export declare function runKillFunnel(target: KillTarget, opts: KillFunnelOpts, deps: KillFunnelDeps): Promise<KillOutcome>;
+//# sourceMappingURL=ExternalHogKillFunnel.d.ts.map

package/dist/monitoring/ExternalHogKillFunnel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExternalHogKillFunnel.d.ts","sourceRoot":"","sources":["../../src/monitoring/ExternalHogKillFunnel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAA0C,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACtG,OAAO,EAAe,KAAK,SAAS,EAAE,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAExF,MAAM,MAAM,WAAW,GACnB;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,WAAW,CAAA;CAAE,GACzD;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAC5B;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,yBAAyB,CAAA;CAAE,GACzD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,cAAc;IAC7B;wEACoE;IACpE,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACxG,sEAAsE;IACtE,cAAc,IAAI,YAAY,CAAC;IAC/B,4FAA4F;IAC5F,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IACjD;sEACkE;IAClE,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,wDAAwD;IACxD,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,IAAI,CAAC;IAC7D,wDAAwD;IACxD,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IACpD,2DAA2D;IAC3D,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,6EAA6E;IAC7E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAoBD;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,CA4BxH"}