memeloop 0.0.1 → 0.1.0

package/dist/browser.d.ts

@@ -0,0 +1,3066 @@
+import { y as OrchestrationResourceStatus, E as OrchestrationResource, t as AgentOrchestrationClient, O as OrchestrationErrorData, z as OrchestrationResourceReference, F as OrchestrationResourceQuery, K as OrchestrationResourceList, N as OrchestrationWatchOptions, P as OrchestrationWatchEvent, u as OrchestrationResourceManifest, Q as OrchestrationDeleteOptions, R as OrchestrationDeleteResult, al as OrchestrationResourceWatchEvent, Y as FullAgentStorage, L as ListConversationsOptions, C as ConversationMeta, G as GetMessagesOptions, b as ChatMessage, A as AttachmentReference, m as AgentDefinition, q as AgentInstanceMeta, a5 as IMChannelBinding, S as AgentFrameworkConfig, I as IAgentStorage, a6 as IMPlatformType } from './interface-IrKBFtL1.js';
+export { n as AgentDefinitionModelConfig, o as AgentDefinitionToolConfig, p as AgentHeartbeatConfig, Z as AgentInfrastructureInterface, $ as AgentOrchestrationCapabilities, a0 as AgentOrchestrationOperation, X as AgentPromptDescription, r as AiAPIConfig, a as ChatAttachmentPart, c as ChatMessagePart, d as ChatReasoningPart, e as ChatRole, f as ChatTextPart, g as ChatToolCallPart, h as ChatToolResultPart, j as ConversationQueryMode, D as DetailRefType, k as DetailReference, H as HostAgentToolConfig, a4 as IMChannel, U as IPrompt, a8 as ImChannelBindingRecord, M as ModelParameters, s as ModelSelection, a9 as ORCHESTRATION_ERROR_CODES, aa as OrchestrationApplyOptions, ab as OrchestrationBookmarkWatchEvent, ac as OrchestrationCondition, ad as OrchestrationConditionStatus, ae as OrchestrationError, af as OrchestrationErrorCode, ag as OrchestrationErrorWatchEvent, ah as OrchestrationEvent, ai as OrchestrationEventSeverity, B as OrchestrationGetOptions, J as OrchestrationListOptions, aj as OrchestrationManifestMetadata, x as OrchestrationObjectMetadata, v as OrchestrationOwnerReference, ak as OrchestrationPreconditions, am as OrchestrationResourceWatchEventType, w as OrchestrationTypeMeta, W as PromptNode, an as PromptPluginConfig, T as ToolCall, V as VersionVector, i as isConversationMeta, ao as isOrchestrationError, ap as toOrchestrationErrorData } from './interface-IrKBFtL1.js';
+import { l as PermissionAction, M as MemeLoopRuntime } from './registry-DV24sI-3.js';
+export { A as ALL_CATEGORIES, a as AgentProfileRegistry, C as CategoryConfig, L as LoadPluginModuleOptions, j as LoadedPlugin, k as MergedPermissions, P as PERMISSIONS_TABLE_DDL, m as PermissionRule, n as PermissionSet, o as PermissionSqlDatabase, p as PermissionSqlStatement, q as PluginAPI, r as PluginAPIOptions, s as PluginExports, t as PluginManifest, u as PluginModule, T as TaskCategory, x as checkPermission, y as clearPluginRegistrations, F as createPluginAPI, G as getAgentProfileRegistry, I as getCategoryConfig, J as getLoadedPlugin, K as getPluginRegistrations, N as isPluginLoaded, O as isTaskCategory, Q as listPlugins, R as loadPluginModule, V as loadPluginModules, W as loadUserPermissions, X as matchPattern, Y as mergePermissionSets, Z as registerPluginHooks, _ as registerPluginTools, $ as resetAgentProfileRegistry, a0 as resolveCategory, a1 as saveUserPermissions, a2 as unloadAllPlugins, a3 as unloadPlugin, a4 as validatePluginManifest } from './registry-DV24sI-3.js';
+export { A as AgentProfile, a as AgentProfileType, B as BUILTIN_AGENT_PROFILES, P as ProviderConfig, b as ProviderRegistry, R as RegisteredProvider, T as ToolPermissionRules, c as buildAgent, e as exploreAgent, l as librarianAgent, o as oracleAgent, p as planAgent } from './providerRegistry-9trr5aoK.js';
+import { s as DeviceRpcHandler } from './types-CdFVSntj.js';
+export { A as AgentExecutionLocation, a as AgentExecutionState, b as AttachmentBlob, C as CloudDeviceClient, c as CloudDeviceRecord, d as ConversationExecutionPlacement, D as Device, e as DeviceAccountBindingRequest, f as DeviceAuthorizer, g as DeviceCapabilities, h as DeviceConnectionGrant, i as DeviceConnectionGrantVerificationInput, j as DeviceNetworkListenOptions, k as DeviceNetworkPath, l as DeviceNetworkService, m as DevicePlatform, n as DeviceProtocolDirection, o as DeviceReachability, p as DeviceReachabilityState, q as DeviceRelayReservationToken, r as DeviceRelayReservationTokenVerificationInput, t as DeviceRpcHandlerInput, u as DeviceSyncTransport, v as DeviceTrustMode, w as DeviceTrustStore, E as ExchangeVersionVectorResult, L as LocalDeviceIdentity, x as LocalPairingRequestOptions, M as MemeLoopDuplexStream, y as MemeLoopProtocol, P as PairingSession, z as PairingSessionDirection, B as PairingSessionStatus, S as SyncResult, T as TrustedDeviceRecord } from './types-CdFVSntj.js';
+export { A as AttachmentBlobWire, D as DEVICE_ORCHESTRATION_PROTOCOL, a as DEVICE_PAIRING_INVITE_PROTOCOL, b as DEVICE_PAIRING_INVITE_TTL_MS, c as DeviceOrchestrationStreamHandler, d as DeviceOrchestrationStreamHandlerInput, e as DeviceOrchestrationStreamHandlerOptions, f as DeviceOrchestrationTransportOptions, g as DevicePairingInvite, L as LIBP2P_RPC_REQUEST_TYPE, h as LIBP2P_RPC_RESPONSE_TYPE, i as LIBP2P_SYNC_REQUEST_TYPE, j as LIBP2P_SYNC_RESPONSE_TYPE, k as Libp2pDeviceSyncTransport, l as Libp2pDeviceSyncTransportOptions, m as Libp2pRpcRequest, n as Libp2pRpcResponse, o as Libp2pSyncMethod, p as Libp2pSyncRequest, q as Libp2pSyncResponse, r as LocalTrustDeviceAuthorizer, s as LocalTrustDeviceAuthorizerOptions, R as RemoteOrchestrationHandler, t as attachmentBlobFromWire, u as createDeviceOrchestrationStreamHandler, v as createDeviceOrchestrationTransport, w as createDevicePairingInvite, x as encodeDevicePairingInvite, y as isLibp2pRpcRequest, z as isLibp2pRpcResponse, B as isLibp2pSyncRequest, C as isLibp2pSyncResponse, E as parseDevicePairingInvite } from './pairingInvite-Cuz0wuq9.js';
+export { M as MemoryDeviceNetworkService, a as MemoryDeviceNetworkServiceOptions, s as syncCloudDevices } from './syncCloudDevices-BEqwgrhD.js';
+import { aU as ControlStoreAuthorizationRequest, aR as ControlStore, aS as ControlStoreActor, af as AgentVolumeResource, bO as NodeTrustClass, co as StorageClassResource, ae as AgentVolumeReplicaStatus, cz as ToolAdmissionAction, cB as ToolAdmissionRule, cA as ToolAdmissionPolicy, cR as ToolOperationResource, cj as SecurityProfileResource, b3 as CredentialGrantResource, y as ToolOperationEffect, ap as AgentWorkloadResource, aq as AgentWorkloadResourceRequirements, cS as ToolOperationResult, bs as ModelClassManifest, bw as ModelEndpointManifest, aw as ArtifactDestination, d1 as VolumeAccessMode, aa as AgentVolumeClaimResource, cO as ToolOperationApprovalEvidence, m as IToolRegistry, cV as ToolOperationStatus, a0 as AgentRunResource, bx as ModelEndpointResource, bt as ModelClassResource, bG as NetworkAttachmentResource, bK as NetworkClassResource, b8 as DataClassification, aV as ControlStoreAuthorizer, aX as ControlStoreCreateOptions, aT as ControlStoreApplyOptions, a_ as ControlStoreStatusUpdateOptions, aQ as ControlLeaseRequest, aO as ControlLeaseGrant, aP as ControlLeaseIdentity, aW as ControlStoreCompactionResult, aZ as ControlStoreSnapshotResult, aY as ControlStoreHealth, cL as ToolExecutorResource, r as LoopScriptCheckpointStore } from './scriptDeploymentPipeline-DsnT0AG6.js';
+export { N as AGENT_RUN_API_VERSION, O as AGENT_RUN_KIND, Q as AGENT_WORKLOAD_API_VERSION, R as AGENT_WORKLOAD_KIND, V as ARTIFACT_RECORD_API_VERSION, W as ARTIFACT_RECORD_KIND, X as AUDIT_RECORD_API_VERSION, Y as AUDIT_RECORD_KIND, z as AgentClient, A as AgentFrameworkContext, a as AgentInstance, b as AgentInstanceLatestStatus, a as AgentInstanceModel, c as AgentInstanceState, d as AgentLoopDefinition, e as AgentLoopGenerator, f as AgentLoopInput, g as AgentLoopRuntime, h as AgentLoopScriptPolicy, i as AgentLoopStep, _ as AgentRunCondition, $ as AgentRunManifest, a1 as AgentRunSpec, a2 as AgentRunStatus, a3 as AgentSnapshotManifest, a4 as AgentSnapshotResource, a5 as AgentSnapshotSpec, a6 as AgentSnapshotStatus, j as AgentToolLoopOptions, a8 as AgentTrustLevel, a9 as AgentVolumeClaimManifest, ab as AgentVolumeClaimSpec, ac as AgentVolumeClaimStatus, ad as AgentVolumeManifest, ag as AgentVolumeSpec, ah as AgentVolumeStatus, ai as AgentWorkloadCompletionPolicy, aj as AgentWorkloadCondition, ak as AgentWorkloadCredentialPolicy, al as AgentWorkloadManifest, am as AgentWorkloadModelPolicy, an as AgentWorkloadNetworkPolicy, ao as AgentWorkloadPlacement, ar as AgentWorkloadSpec, as as AgentWorkloadStatus, at as AgentWorkloadStoragePolicy, au as AgentWorkloadToolPolicy, av as AgentWorkloadVolumeClaim, ax as ArtifactRecordManifest, ay as ArtifactRecordResource, az as ArtifactRecordSpec, aA as ArtifactRecordStatus, aB as ArtifactReviewEvidence, aC as ArtifactReviewKind, aD as ArtifactTrust, aE as AuditRecordManifest, aF as AuditRecordResource, aG as AuditRecordSpec, aH as BUILTIN_RUNTIME_CLASSES, aJ as CREDENTIAL_GRANT_API_VERSION, aK as CREDENTIAL_GRANT_KIND, aL as CheckpointRecord, aM as CheckpointStore, aN as CheckpointSummary, a$ as ControlStoreVerb, b0 as CreateAgentRunOptions, b1 as CreateAgentWorkloadOptions, b2 as CredentialGrantManifest, b4 as CredentialGrantSpec, b5 as CredentialGrantStatus, b6 as DRIVER_MANIFEST_API_VERSION, b7 as DRIVER_MANIFEST_KIND, b9 as DriverManifestConformance, ba as DriverManifestManifest, bb as DriverManifestResource, bc as DriverManifestSpec, bd as DriverManifestStatus, I as IChatSyncAdapter, k as ILLMProvider, l as INetworkService, e2 as InMemoryCheckpointStore, bg as InfrastructureDriverType, L as LoopPlugin, n as LoopProfile, o as LoopProfilePluginEntry, p as LoopProfilePrompt, q as LoopProfileScriptReference, bh as MODEL_CALL_RECORD_API_VERSION, bi as MODEL_CALL_RECORD_KIND, bj as MODEL_CLASS_API_VERSION, bk as MODEL_CLASS_KIND, bl as MODEL_ENDPOINT_API_VERSION, bm as MODEL_ENDPOINT_KIND, M as MemeLoopLogger, bn as ModelCallRecordManifest, bo as ModelCallRecordResource, bp as ModelCallRecordSpec, bq as ModelCallRecordStatus, br as ModelClassCapabilities, bu as ModelClassSpec, bv as ModelClassStatus, by as ModelEndpointSpec, bz as ModelEndpointStatus, bA as ModelModality, bB as NETWORK_ATTACHMENT_API_VERSION, bC as NETWORK_ATTACHMENT_KIND, bD as NETWORK_CLASS_API_VERSION, bE as NETWORK_CLASS_KIND, bF as NetworkAttachmentManifest, bH as NetworkAttachmentSpec, bI as NetworkAttachmentStatus, bJ as NetworkClassManifest, bL as NetworkClassSpec, bM as NetworkClassStatus, bN as NetworkEgressRule, bP as POLICY_DECISION_API_VERSION, bQ as POLICY_DECISION_KIND, bR as PersistedPolicyDecisionKind, bS as PolicyDecisionManifest, bT as PolicyDecisionResource, bU as PolicyDecisionSpec, bV as PolicyDecisionStatus, bW as RemoteDeploymentRequest, bX as RemoteDeploymentResult, bY as RemoteDeploymentWorkloadOptions, bZ as RuntimeClassResource, b_ as RuntimeClassSpec, b$ as SECURITY_PROFILE_API_VERSION, c0 as SECURITY_PROFILE_KIND, c1 as SNAPSHOT_API_VERSION, c2 as SNAPSHOT_KIND, c3 as STORAGE_CLASS_API_VERSION, c4 as STORAGE_CLASS_KIND, c5 as SandboxSelectionResult, c6 as ScriptAdmissionDecision, c7 as ScriptAdmissionRequest, c8 as ScriptArtifactReference, c9 as ScriptArtifactStore, B as ScriptDeploymentClient, ca as ScriptDeploymentClientConfig, cb as ScriptDeploymentClientRequest, cc as ScriptDeploymentPipelineOptions, cd as ScriptDeploymentRequest, ce as ScriptDeploymentResult, S as ScriptLoadGate, cf as ScriptLoadGateConfig, s as ScriptLoadGateDecision, t as ScriptLoadGateRequest, cg as ScriptTrustClass, ch as ScriptValidationResult, ci as SecurityProfileManifest, ck as SecurityProfileSpec, cl as SecurityProfileStatus, cm as SessionStorage, e3 as SessionStorageOptions, cn as StorageClassManifest, cp as StorageClassSpec, cq as StorageClassStatus, cr as TOOL_CLASS_API_VERSION, cs as TOOL_CLASS_KIND, ct as TOOL_EXECUTOR_API_VERSION, cu as TOOL_EXECUTOR_KIND, cv as TOOL_OPERATION_API_VERSION, cw as TOOL_OPERATION_KIND, cD as ToolClassManifest, cE as ToolClassResource, cF as ToolClassSchema, cG as ToolClassSpec, cH as ToolClassStatus, cJ as ToolExecutorCapability, cK as ToolExecutorManifest, cM as ToolExecutorSpec, cN as ToolExecutorStatus, cP as ToolOperationManifest, cQ as ToolOperationPolicy, cT as ToolOperationRetryPolicy, cU as ToolOperationSpec, cW as ToolOperationToolReference, cX as ToolRiskLevel, cZ as VOLUME_API_VERSION, c_ as VOLUME_CLAIM_API_VERSION, c$ as VOLUME_CLAIM_KIND, d0 as VOLUME_KIND, d2 as WaitForConditionOptions, d4 as admitScript, d5 as agentRunReference, d6 as agentWorkloadReference, d7 as canonicalControlStoreValue, d8 as controlStoreApplyMatches, d9 as createAgentClient, da as createAgentRunManifest, db as createAgentWorkloadManifest, dc as createArtifactRecordManifest, dd as createAuditRecordManifest, de as createCheckpointRecord, df as createCredentialGrantManifest, dg as createDriverManifestManifest, u as createInstanceDeltaFromDefinition, dh as createModelCallRecordManifest, di as createModelClassManifest, dj as createModelEndpointManifest, dk as createNetworkAttachmentManifest, dl as createNetworkClassManifest, dm as createPolicyDecisionManifest, dn as createScriptDeploymentClient, dp as createScriptLoadGate, dq as createSecurityProfileManifest, dr as createSnapshotManifest, ds as createStorageClassManifest, dt as createToolClassManifest, du as createToolExecutorManifest, dv as createToolOperationManifest, dw as createVolumeClaimManifest, dx as createVolumeManifest, dy as defaultRequestedInterfacesForTrustClass, dz as deployGeneratedScript, dA as digestNormalizedScript, dB as isAgentRun, dC as isAgentWorkload, dD as isArtifactRecord, dE as isAuditRecord, dF as isCredentialGrant, dG as isDriverManifest, dH as isDriverManifestAdmitted, dI as isModelCallRecord, dJ as isModelClass, dK as isModelEndpoint, dL as isNetworkAttachment, dM as isNetworkClass, dN as isPolicyDecision, dO as isSecurityProfile, dP as isSnapshot, dQ as isStorageClass, dR as isToolClass, dS as isToolExecutor, dT as isToolOperation, v as isUserInitiatedConversation, dU as isVolume, dV as isVolumeClaim, dW as maxScriptBytesForTrustClass, dX as normalizeScript, dY as parseCheckpointRecord, dZ as remoteDeploymentToWorkloadManifest, d_ as selectRuntimeClass, d$ as serializeCheckpointRecord, e0 as validateScript, e1 as waitForCondition } from './scriptDeploymentPipeline-DsnT0AG6.js';
+import { m as ArtifactReviewWriter, w as CredentialBrokerDriver, y as CredentialGrantHandle, I as CredentialManagementDriver, P as DriverRequestEnvelope, G as CredentialIssuePayload, s as AuditTelemetryManagementDriver, bn as PolicyApprovalManagementDriver, bo as PolicyDecision, O as DriverManifest, N as DriverConformanceTest, ba as ModelProviderHealth, b9 as ModelProviderDriver, Q as FakeArtifactManagementState, h as ArtifactInspector, k as ArtifactManagementStateSnapshot, i as ArtifactManagementCapabilities, c as ArtifactDestinationPolicy, j as ArtifactManagementDriver, bx as StorageProvisionPayload, bw as StorageManagementDriver, bB as ToolManagementDriver, bz as ToolExecutionDriver, aK as ManagedToolDescriptor, a1 as IdentityAttestationManagementDriver, bf as NetworkDriverCapabilities, be as NetworkDriver, bk as NetworkManagementDriver, bl as NetworkPreparePayload, ag as LoopRunStartRequest, aj as LoopRuntimeDriver } from './orchestration-portable-Zw0g5tbj.js';
+export { A as ArtifactAdmissionDecision, b as ArtifactContentStore, d as ArtifactInspectionExecutor, e as ArtifactInspectionInput, f as ArtifactInspectionRequest, g as ArtifactInspectionResult, l as ArtifactPutPayload, n as ArtifactSanitizationResult, o as AttestedIdentity, p as AuditEffect, q as AuditProvenance, r as AuditTelemetryCapabilities, t as AuditTelemetryRecord, u as AuditTelemetryRecordKind, v as AuthorizedToolExecution, C as ControlStoreConformanceFactory, x as CredentialGrantClaims, z as CredentialGrantInspection, D as CredentialGrantProof, E as CredentialGrantScope, F as CredentialGrantVerification, H as CredentialManagementCapabilities, J as CredentialProofVerifier, K as DEFAULT_DESTINATION_POLICIES, L as DRIVER_REQUEST_API_VERSION, M as DriverConformanceSuite, R as FakeAuditTelemetryState, S as FakeCredentialManagementState, T as FakeDriverOptions, U as FakeIdentityAttestationState, V as FakeLoopRuntimeState, W as FakeModelManagementState, X as FakeNetworkManagementState, Y as FakePolicyApprovalState, Z as FakeStorageManagementState, _ as FakeToolManagementState, $ as GatewayMediatedLLMProviderOptions, a0 as IdentityAttestationCapabilities, a2 as IdentityChallenge, a3 as IdentityDomain, a4 as IdentityEnrollment, a5 as IdentityInspection, a6 as IdentitySession, a7 as InMemoryCredentialBrokerOptions, a8 as InMemoryModelAccessHandleBrokerOptions, a9 as InProcessLoopRuntimeDriverOptions, aa as InProcessToolExecutionDriverOptions, ab as IssueCredentialGrantRequest, ac as IssueModelAccessHandleRequest, ad as LegacyLLMProviderDriverOptions, ae as LoopRunHandle, af as LoopRunOutcome, ah as LoopRuntimeCapabilities, ai as LoopRuntimeCheckpoint, ak as LoopRuntimeManagementDriver, al as LoopRuntimePreparePayload, am as LoopRuntimePrepared, an as LoopRuntimeStartPayload, ao as ManagedArtifact, ap as ManagedArtifactMount, aq as ManagedCredentialAdapterStateStore, ar as ManagedCredentialBrokerAdapterOptions, as as ManagedCredentialGrant, at as ManagedCredentialMaterialization, au as ManagedLoopRunStatus, av as ManagedLoopRuntimeAdapterOptions, aw as ManagedLoopRuntimeExecutionRoute, ax as ManagedLoopRuntimeExecutionRouteOptions, ay as ManagedModelChunk, az as ManagedModelDescriptor, aA as ManagedModelEstimate, aB as ManagedModelGatewayAccess, aC as ManagedModelGatewayAdapterOptions, aD as ManagedModelRequest, aE as ManagedModelUsage, aF as ManagedNetworkAdapterOptions, aG as ManagedNetworkPolicy, aH as ManagedNetworkStatus, aI as ManagedReplicaHealth, aJ as ManagedServiceResolution, aL as ManagedToolEvidence, aM as ManagedToolExecution, aN as ManagedToolExecutionPhase, aO as ManagedToolOutputChunk, aP as ManagedVolume, aQ as ManagedVolumeBackup, aR as ManagedVolumePublication, aS as ManagedVolumeSnapshot, aT as ManagedVolumeStage, aU as ManagedVolumeStats, aV as ModelAccessHandle, aW as ModelAccessHandleBroker, aX as ModelAccessHandleBudget, aY as ModelAccessHandleClaims, aZ as ModelGateway, a_ as ModelGatewayCallRecord, a$ as ModelGatewayExecutor, b0 as ModelGatewayGenerateRequest, b1 as ModelGatewayOptions, b2 as ModelGatewayRecorder, b3 as ModelGenerateMessage, b4 as ModelGenerateRequest, b5 as ModelHandleSigner, b6 as ModelManagementCapabilities, b7 as ModelManagementDriver, b8 as ModelProviderDataPolicy, bb as ModelStreamChunk, bc as NetworkAttachRequest, bd as NetworkClassSatisfaction, bg as NetworkDriverHealth, bh as NetworkEnforceableFeature, bi as NetworkEnforcementLevel, bj as NetworkManagementCapabilities, bm as PolicyApprovalCapabilities, bp as PolicyDecisionKind, bq as PolicyDecisionOutcome, br as PolicyExplanation, bs as PreparedToolExecution, bt as ResolvedManagedNetworkRequest, bu as RuntimeClassRoutingDriverOptions, bv as StorageManagementCapabilities, by as ToolCatalogSnapshot, bA as ToolManagementCapabilities, bC as ToolOperationApprovalBroker, bD as ToolOperationApprovalDecision, bE as ToolOperationApprovalRequest, bF as VerifyModelAccessHandleOptions, bG as artifactTrustRank, bH as assertArtifactAdmission, bI as assertClassificationAllowed, bJ as assertDriverRequestEnvelope, bK as assertManagedNetworkPolicy, bL as assertNetworkPreparePayload, bM as assertNetworkUpdatePayload, bN as base64UrlDecode, bO as base64UrlEncode, bP as canArtifactEnter, bQ as canDriverSatisfyClass, bR as canonicalDriverValue, bS as classificationRank, bT as countManagedNetworkPolicyRules, bU as createArtifactManagementConformanceSuite, bV as createAuditTelemetryConformanceSuite, bW as createControlStoreConformanceSuite, bX as createCredentialManagementConformanceSuite, bY as createExternalOrchestrationDriverConformanceSuite, bZ as createFakeArtifactManagementDriver, b_ as createFakeArtifactManagementState, b$ as createFakeAuditTelemetryManagementDriver, c0 as createFakeAuditTelemetryState, c1 as createFakeCredentialManagementDriver, c2 as createFakeCredentialManagementState, c3 as createFakeIdentityAttestationManagementDriver, c4 as createFakeIdentityAttestationState, c5 as createFakeLoopRuntimeManagementDriver, c6 as createFakeLoopRuntimeState, c7 as createFakeModelManagementDriver, c8 as createFakeModelManagementState, c9 as createFakeModelProviderDriver, ca as createFakeNetworkDriver, cb as createFakeNetworkManagementDriver, cc as createFakeNetworkManagementState, cd as createFakePolicyApprovalManagementDriver, ce as createFakePolicyApprovalState, cf as createFakeStorageManagementDriver, cg as createFakeStorageManagementState, ch as createFakeToolExecutionDriver, ci as createFakeToolManagementDriver, cj as createFakeToolManagementState, ck as createGatewayMediatedLLMProvider, cl as createIdentityAttestationConformanceSuite, cm as createInMemoryCredentialBroker, cn as createInMemoryModelAccessHandleBroker, co as createInProcessLoopRuntimeDriver, cp as createInProcessToolExecutionDriver, cq as createLoopRuntimeManagementConformanceSuite, cr as createManagedCredentialBrokerAdapter, cs as createManagedLoopRuntimeAdapter, ct as createManagedLoopRuntimeExecutionRoute, cu as createManagedModelGatewayAdapter, cv as createManagedNetworkAdapter, cw as createModelGateway, cx as createModelManagementConformanceSuite, cy as createModelProviderDriverConformanceSuite, cz as createModelProviderDriverFromLLMProvider, cA as createNetworkDriverConformanceSuite, cB as createNetworkManagementConformanceSuite, cC as createPolicyApprovalConformanceSuite, cD as createRuntimeClassRoutingDriver, cE as createStorageManagementConformanceSuite, cF as createToolCatalogConformanceSuite, cG as createToolExecutionDriverConformanceSuite, cH as createToolManagementConformanceSuite, cI as deriveArtifactTrust, cJ as featuresRequiredByClass, cK as inspectAndRecordArtifact, cL as restoreArtifactManagementState, cM as runConformanceSuite, cN as snapshotArtifactManagementState } from './orchestration-portable-Zw0g5tbj.js';
+export { F as FetchOrchestrationTransportOptions, N as NamespacedOrchestrationClientOptions, d as REMOTE_ORCHESTRATION_PROTOCOL, e as ReadOnlyOrchestrationClientOptions, f as RemoteOrchestrationClientOptions, g as RemoteOrchestrationOperation, R as RemoteOrchestrationRequest, a as RemoteOrchestrationResponse, c as RemoteOrchestrationTransport, b as RemoteOrchestrationTransportOptions, h as createFetchOrchestrationTransport, i as createNamespacedOrchestrationClient, j as createReadOnlyOrchestrationClient, k as createRemoteOrchestrationClient, l as createRemoteOrchestrationHandler } from './remoteClient-B_spK019.js';
+
+/**
+ * Verifier-only protected transitions for ArtifactRecord (plan 24.52).
+ *
+ * Artifact review evidence (scan, sanitize, verify) can only be appended by
+ * verifier actors. Storage drivers, controllers, and workers cannot write
+ * review outcomes or unquarantine artifacts. This ensures that trust
+ * promotion is always grounded in an external, attested verification step.
+ */
+interface VerifierOnlyTransitionOptions {
+    /** Actor ID prefix that identifies trusted verifiers. */
+    verifierActorPrefix?: string;
+    /** Allow quarantine by any actor (fail-safe). Default: true. */
+    allowAnyActorQuarantine?: boolean;
+}
+/**
+ * Create a ControlStore authorizer that enforces verifier-only transitions
+ * for ArtifactRecord resources.
+ *
+ * Rules:
+ * 1. Only verifier actors may append reviews or change quarantine status.
+ * 2. Review evidence must be bound to the current content hash.
+ * 3. Review evidence must record the verifier's actor ID.
+ * 4. Quarantine is fail-safe: any actor may quarantine, but only verifiers
+ *    may unquarantine (by appending a passing verify review).
+ * 5. Non-verifier actors may still read and create ArtifactRecords.
+ */
+declare function createVerifierOnlyAuthorizer(options?: VerifierOnlyTransitionOptions): (request: ControlStoreAuthorizationRequest) => void;
+/**
+ * Check whether an actor ID belongs to a verifier.
+ */
+declare function isVerifierActor(actorId: string, verifierPrefix?: string): boolean;
+
+/**
+ * ControlStore-backed ArtifactReviewWriter (plan 24.47).
+ *
+ * Every review append or quarantine goes through ControlStore.updateStatus,
+ * protected by the verifier-only authorizer. The authorizer is injected so
+ * callers in different hosts can wire the verifier actor prefix appropriate
+ * to their trust model.
+ */
+declare function createControlStoreArtifactReviewWriter(store: ControlStore, actor: ControlStoreActor, authorizer?: ReturnType<typeof createVerifierOnlyAuthorizer>): ArtifactReviewWriter;
+
+/**
+ * Hostile artifact defenses (plan 24.48).
+ *
+ * Pure, portable sanitizers run by the artifact driver — OUTSIDE controller
+ * processes. Every function is bounded (explicit size limits) and returns
+ * structured findings; callers quarantine on hostile fixtures. Nothing here
+ * executes, renders, or mounts content.
+ */
+interface SanitizerFinding {
+    kind: 'terminal-escape' | 'active-markup' | 'path-traversal' | 'archive-link' | 'archive-limit' | 'mime-confusion' | 'prompt-injection' | 'oversized';
+    detail: string;
+}
+interface SanitizedText {
+    text: string;
+    findings: SanitizerFinding[];
+    renderAs: 'plain-text';
+}
+/**
+ * Strip ANSI/OSC/control sequences from worker-produced text before display.
+ * Bounded: input beyond `maxLength` is truncated and reported.
+ */
+declare function sanitizeTerminalText(input: string, options?: {
+    maxLength?: number;
+}): SanitizedText;
+/**
+ * Convert untrusted markup to an explicitly plain-text representation. The
+ * result must be displayed as text, never passed back through an HTML or
+ * Markdown renderer.
+ */
+declare function sanitizeMarkup(input: string, options?: {
+    maxLength?: number;
+}): SanitizedText;
+interface ArchiveEntry {
+    path: string;
+    sizeBytes: number;
+    /** Compressed size when known (for ratio checks). */
+    compressedBytes?: number;
+    /** Entry is a symlink/hardlink (never extracted). */
+    link?: 'symlink' | 'hardlink';
+}
+interface ArchiveLimits {
+    maxFiles?: number;
+    maxTotalBytes?: number;
+    maxDepth?: number;
+    maxCompressionRatio?: number;
+}
+/** Normalize a path and reject absolute paths, drive letters, and traversal. */
+declare function assertSafeArchivePath(path: string): string;
+/** Validate an archive manifest without extracting; throws nothing, returns findings. */
+declare function validateArchiveManifest(entries: ArchiveEntry[], limits?: ArchiveLimits): SanitizerFinding[];
+/** Flag content whose declared MIME disagrees with its magic bytes. */
+declare function detectMimeConfusion(declaredMime: string, content: Uint8Array): SanitizerFinding | null;
+/**
+ * Heuristic prompt-injection markers for text derived from untrusted sources.
+ * A hit means the content must stay tainted/quarantined — absence of a hit is
+ * NOT proof of safety.
+ */
+declare function scanForPromptInjection(text: string): SanitizerFinding[];
+interface BoundedCollector {
+    push(chunk: Uint8Array): void;
+    bytes(): Uint8Array;
+    readonly size: number;
+}
+/** Accumulate a stream with a hard cap; throws `oversized` when exceeded. */
+declare function createBoundedCollector(maxBytes: number): BoundedCollector;
+
+interface ControllerReconcileRequest<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus> {
+    resource: OrchestrationResource<TSpec, TStatus>;
+    actor: ControlStoreActor;
+    leaseEpoch: string;
+    now: Date;
+}
+interface ControllerReconcileResult<TStatus extends OrchestrationResourceStatus = OrchestrationResourceStatus> {
+    /** New status to write; omit to leave status unchanged. */
+    status?: TStatus;
+    /** If true, the resource is ready; controller stops reconciling until it changes. */
+    ready?: boolean;
+    /** Optional requeue delay when the controller wants to try again later. */
+    requeueAfterMs?: number;
+}
+interface Controller<TSpec = Record<string, unknown>, TStatus extends OrchestrationResourceStatus = OrchestrationResourceStatus> {
+    reconcile(request: ControllerReconcileRequest<TSpec, TStatus>): Promise<ControllerReconcileResult<TStatus>>;
+}
+interface ControllerRunnerOptions<TSpec = Record<string, unknown>, TStatus extends OrchestrationResourceStatus = OrchestrationResourceStatus> {
+    /** Controller identity used for all ControlStore writes. */
+    actor: ControlStoreActor;
+    /** Lease name; controllers with the same name compete for the lease. */
+    leaseName: string;
+    /** Resource kind this controller reconciles (passed to ControlStore.watch). */
+    watchKind: string;
+    /** How long the lease is valid before it must be renewed. */
+    leaseTtlMs: number;
+    /** How often to renew the lease while running. */
+    leaseRenewIntervalMs?: number;
+    /** Initial backoff after a reconcile failure. */
+    retryBaseDelayMs?: number;
+    /** Maximum backoff after consecutive reconcile failures. */
+    retryMaxDelayMs?: number;
+    /** Filter which resources this controller reconciles. */
+    resourceFilter?: (resource: OrchestrationResource<TSpec, TStatus>) => boolean;
+    /** Injectable clock for deterministic tests. */
+    now?: () => Date;
+    /** Injectable sleep for deterministic tests. */
+    sleep?: (ms: number) => Promise<void>;
+}
+interface ControllerRunnerHandle {
+    /** Stop watching and release the lease. */
+    stop(): Promise<void>;
+    /** Wait until the runner has fully stopped. */
+    done(): Promise<void>;
+}
+/**
+ * Restart-safe generic controller runner.
+ *
+ * Watches a ControlStore query, acquires a lease, and calls `controller.reconcile`
+ * for each matching resource. On success it may update status and mark Ready.
+ * On failure it retries with exponential backoff. If the process crashes, the
+ * lease expires and another runner takes over; watch replay resumes from the
+ * last acknowledged resource version.
+ */
+declare function createControllerRunner<TSpec = Record<string, unknown>, TStatus extends OrchestrationResourceStatus = OrchestrationResourceStatus>(store: ControlStore, controller: Controller<TSpec, TStatus>, options: ControllerRunnerOptions<TSpec, TStatus>): Promise<ControllerRunnerHandle>;
+
+declare const FLEET_ROLLOUT_API_VERSION = "fleet.memeloop.io/v1alpha1";
+declare const FLEET_ROLLOUT_KIND = "FleetRollout";
+type RolloutStrategy = 'batch' | 'canary';
+interface FleetRolloutSpec {
+    /** Target resource kind to roll out (e.g. AgentWorkload). */
+    targetKind: string;
+    /** Target namespace. */
+    targetNamespace?: string;
+    /** Label selector for target resources. */
+    selector?: Record<string, string>;
+    /** Rollout strategy. */
+    strategy: RolloutStrategy;
+    /** Batch size for batch strategy. */
+    batchSize?: number;
+    /** Canary stages for canary strategy. */
+    canaryStages?: Array<{
+        weight: number;
+        pauseDurationMs?: number;
+    }>;
+    /** Maximum unavailable resources during rollout. */
+    maxUnavailable?: number;
+    /** Maximum surge resources during rollout. */
+    maxSurge?: number;
+    /** Maximum concurrent target updates (default: 1 = sequential). */
+    maxConcurrency?: number;
+    /** Rollout deadline in milliseconds. */
+    deadlineMs?: number;
+    /** Pause rollout on failure threshold. */
+    pauseOnFailureThreshold?: number;
+    /**
+     * Pause when at least this many targets report drift — the host observed
+     * their actual state diverging from the desired template (§8.4/§8.8).
+     */
+    pauseOnDriftThreshold?: number;
+    /**
+     * Pause when at least this many targets carry host-reported security
+     * findings (§8.8). Fail-safe recommendation: 1 (any finding pauses).
+     */
+    pauseOnSecurityThreshold?: number;
+    /** Automatically rollback updated targets when failure threshold is reached. */
+    autoRollback?: boolean;
+    /**
+     * Aggregate budget for the whole rollout (§8.8 cost threshold). Usage is
+     * metered from per-target update results; the rollout pauses between
+     * batches/stages once a limit is reached (overshoot is bounded by the
+     * in-flight batch).
+     */
+    budget?: {
+        maxTokens?: number;
+        maxCost?: number;
+    };
+    /**
+     * Per-run budget cap for a single target (§8: bounded per-run model
+     * budget). A target whose reported usage exceeds the cap counts as a
+     * failure with a budget reason.
+     */
+    perTargetBudget?: {
+        maxTokens?: number;
+        maxCost?: number;
+    };
+}
+/** Metered model usage reported by a target update (tokens/cost). */
+interface TargetUsage {
+    tokens?: number;
+    cost?: number;
+}
+/** Result of updating one target; usage feeds rollout budget accounting. */
+interface TargetUpdateResult {
+    usage?: TargetUsage;
+}
+interface RolloutEvidenceEntry {
+    resourceName: string;
+    outcome: 'success' | 'failure' | 'skipped';
+    message?: string;
+    timestamp: string;
+    /** Metered model usage for this target's run. */
+    usage?: TargetUsage;
+}
+/** Sum metered usage across evidence entries (idempotent accounting). */
+declare function sumEvidenceUsage(evidence: readonly RolloutEvidenceEntry[] | undefined): {
+    tokens: number;
+    cost: number;
+};
+interface FleetRolloutStatus {
+    phase?: 'Pending' | 'Rolling' | 'Paused' | 'Completed' | 'Failed' | 'RolledBack';
+    currentBatch?: number;
+    currentCanaryStage?: number;
+    updatedReplicas?: number;
+    readyReplicas?: number;
+    availableReplicas?: number;
+    unavailableReplicas?: number;
+    observedGeneration?: number;
+    startedAt?: string;
+    completedAt?: string;
+    pausedAt?: string;
+    pauseReason?: string;
+    failedAt?: string;
+    failureReason?: string;
+    deadlineExceeded?: boolean;
+    rollbackReason?: string;
+    /** Aggregate metered usage across all processed targets (§8 cost). */
+    consumedBudget?: {
+        tokens: number;
+        cost: number;
+    };
+    evidence?: RolloutEvidenceEntry[];
+}
+type FleetRolloutResource = OrchestrationResource<FleetRolloutSpec>;
+interface RolloutTarget {
+    name: string;
+    namespace?: string;
+    generation: number;
+    available: boolean;
+    /** Host observation: actual state diverged from the desired template (§8.4). */
+    drifted?: boolean;
+    /** Host-reported security finding on this target (§8.8). */
+    securityFlagged?: boolean;
+}
+interface FleetRolloutControllerOptions {
+    actor: ControlStoreActor;
+    listTargets: (rollout: FleetRolloutResource) => Promise<RolloutTarget[]>;
+    updateTarget: (rollout: FleetRolloutResource, target: RolloutTarget) => Promise<TargetUpdateResult | undefined>;
+    rollbackTarget: (rollout: FleetRolloutResource, target: RolloutTarget) => Promise<void>;
+    now?: () => Date;
+}
+/**
+ * Create a controller that manages FleetRollout resources.
+ *
+ * The controller implements batch and canary rollout strategies with
+ * maxUnavailable, pause on failure, deadline, and rollback support.
+ */
+declare function createFleetRolloutController(_store: ControlStore, options: FleetRolloutControllerOptions): Controller<FleetRolloutSpec>;
+
+/**
+ * Replicated storage controller (plan 24.45).
+ *
+ * Pure decision logic plus a thin executor over an injected transport:
+ * - Authoritative replicas are placed only on trusted nodes and spread across
+ *   fault domains.
+ * - Every replica's content hash is verified against the volume's contentHash
+ *   (the source of truth); mismatches and unreadable replicas are rebuilt
+ *   from the primary.
+ * - Transfers originate only from the fenced primary; primary changes bump a
+ *   monotonically increasing epoch so stale primaries cannot serve data.
+ * - Loss and corruption converge to the desired replica count.
+ */
+interface ReplicationNode {
+    nodeId: string;
+    faultDomain?: string;
+    trust: NodeTrustClass;
+}
+/**
+ * Host-owned immutable point-in-time view of the fenced primary. The handle
+ * is ephemeral authority and must never be persisted in ControlStore.
+ */
+interface ReplicationSnapshot {
+    snapshotHandle: string;
+    contentHash: string;
+}
+interface ReplicationTransport {
+    /** Compute a replica's content hash from trusted storage; null when unreadable/missing. */
+    readReplicaHash(volume: AgentVolumeResource, nodeId: string): Promise<string | null>;
+    /**
+     * Atomically compare the previous fence and persist the newly elected
+     * primary fence. Repeating the exact same transition must succeed so a
+     * controller can recover when its subsequent ControlStore CAS loses a race.
+     */
+    commitPrimaryFence(volume: AgentVolumeResource, previous: {
+        nodeId?: string;
+        epoch: number;
+    }, next: {
+        nodeId: string;
+        epoch: number;
+    }): Promise<void>;
+    /**
+     * Capture a storage-native, internally verified immutable snapshot from the
+     * active primary. The transport must reject a stale epoch and make an exact
+     * retry idempotent.
+     */
+    capturePrimarySnapshot(volume: AgentVolumeResource, nodeId: string, epoch: number): Promise<ReplicationSnapshot>;
+    /**
+     * Idempotently transfer the exact captured snapshot, atomically rejecting
+     * an epoch that is not the active primary fence.
+     */
+    transferReplica(volume: AgentVolumeResource, snapshot: ReplicationSnapshot, fromNodeId: string, toNodeId: string, epoch: number): Promise<void>;
+    /** Idempotently release the ephemeral snapshot after reconciliation. */
+    releaseSnapshot(volume: AgentVolumeResource, snapshot: ReplicationSnapshot): Promise<void>;
+}
+interface ReplicationContext extends ReplicationTransport {
+    nodes: ReplicationNode[];
+    now?: () => string;
+}
+type ReplicationAction = {
+    type: 'elect-primary';
+    nodeId: string;
+    epoch: number;
+} | {
+    type: 'mark-degraded';
+    nodeId: string;
+    reason: string;
+} | {
+    type: 'mark-offline';
+    nodeId: string;
+} | {
+    type: 'place-replica';
+    nodeId: string;
+    fromNodeId: string;
+} | {
+    type: 'rebuild-replica';
+    nodeId: string;
+    fromNodeId: string;
+};
+interface ReplicationResult {
+    volume: AgentVolumeResource;
+    actions: ReplicationAction[];
+}
+/**
+ * Choose target nodes for new replicas, preferring fault domains not already
+ * covered by existing replicas and skipping nodes that already host one.
+ * Authoritative storage never uses restricted or quarantine nodes.
+ */
+declare function planReplicaPlacement(existing: AgentVolumeReplicaStatus[], candidates: ReplicationNode[], count: number): ReplicationNode[];
+/**
+ * Reconcile one volume to its desired replica state. Reads and verifies all
+ * replicas, elects/fences a primary, rebuilds corrupt or lost replicas, and
+ * converges to the class's desired factor when autoRebuild is enabled.
+ */
+declare function reconcileVolumeReplication(volume: AgentVolumeResource, storageClass: StorageClassResource, context: ReplicationContext): Promise<ReplicationResult>;
+
+/**
+ * Dependencies for the replication controller beyond what ReplicationTransport covers.
+ */
+interface ReplicationControllerDeps {
+    store: ControlStore;
+    getStorageClass: (volume: AgentVolumeResource) => Promise<StorageClassResource | null>;
+    listNodes: () => Promise<ReplicationNode[]>;
+    /**
+     * The transport must durably commit the elected epoch before accepting a
+     * transfer. ControlStore status is the observable mirror, not the native
+     * data-plane fencing authority.
+     */
+    transport: ReplicationTransport;
+    actor: ControlStoreActor;
+}
+/**
+ * Create a controller runner that reconciles AgentVolume resources through
+ * the pure reconcileVolumeReplication with a transport-owned primary fence.
+ *
+ * Each reconcile reads the latest volume from the store. The injected
+ * transport durably commits a new primary epoch before any transfer can use
+ * it. The resulting mirrored status is then written through `updateStatus`
+ * with resourceVersion CAS; stale writes are retried by the runner.
+ */
+declare function createReplicationController(deps: ReplicationControllerDeps): Promise<ControllerRunnerHandle>;
+
+/**
+ * ControlStore-backed AgentOrchestrationClient (plan 24.14).
+ *
+ * Adapts the trusted controller store to the Agent-facing facade so script
+ * deployment (and later other facade consumers) can run against the real
+ * store instead of test fakes. Actor identity is bound by the host at
+ * construction; callers cannot choose it.
+ *
+ * Apply delegates to the store's atomic declarative update: create when
+ * absent, return an equal spec idempotently, or CAS a changed desired spec
+ * while preserving identity/status and advancing generation.
+ */
+interface ControlStoreOrchestrationClientOptions {
+    /** Resource kinds reported by getCapabilities (default: workload-related kinds). */
+    resourceKinds?: string[];
+}
+declare function createControlStoreOrchestrationClient(store: ControlStore, actor: ControlStoreActor, options?: ControlStoreOrchestrationClientOptions): AgentOrchestrationClient;
+
+interface ToolAdmissionDecision {
+    action: ToolAdmissionAction;
+    source: 'rule' | 'default';
+    reason?: string;
+    matchedRule?: ToolAdmissionRule;
+}
+/**
+ * Default trusted admission posture per node trust class. Trusted nodes keep
+ * the historical allow-by-default posture; restricted and quarantine nodes
+ * deny everything unless an explicit rule allows it.
+ */
+declare function defaultAdmissionPolicyForTrustClass(trustClass: NodeTrustClass): ToolAdmissionPolicy;
+/**
+ * Resolve the effective trusted admission policy for a workload from its
+ * SecurityProfile and the node's trust class. Profile rules are evaluated
+ * first (they can allow specific tools on restricted nodes); the trust-class
+ * default applies after. For restricted/quarantine the resolved default is
+ * forced to `deny` — a profile cannot override it.
+ */
+declare function resolveAdmissionPolicy(profile: Pick<SecurityProfileResource, 'spec'> | undefined, trustClass: NodeTrustClass): ToolAdmissionPolicy;
+/**
+ * Model-facing implied permission default for a trust class. Used by the
+ * AgentToolLoop permission gate when no explicit wildcard rule exists.
+ */
+declare function defaultPermissionActionForTrustClass(trustClass: NodeTrustClass | undefined): PermissionAction;
+declare function evaluateToolAdmission(policy: ToolAdmissionPolicy, operation: Pick<ToolOperationResource, 'spec'>): ToolAdmissionDecision;
+
+interface CredentialBrokerEndpoint {
+    nodeId: string;
+    brokerClass: string;
+    healthy: boolean;
+    audiences: string[];
+    methods?: string[];
+    /** Exact targets or prefix patterns ending in `*`. */
+    targets?: string[];
+    activeGrants?: number;
+    maxGrants?: number;
+}
+interface CredentialGrantPlacementRequirements {
+    brokerClass?: string;
+    requiredNode?: string;
+    /** Host admission denial; binding becomes terminal Failed. */
+    denyReason?: string;
+}
+interface CredentialGrantBindingControllerOptions {
+    listBrokers(): Promise<CredentialBrokerEndpoint[]>;
+    requirementsForGrant?(grant: CredentialGrantResource): Promise<CredentialGrantPlacementRequirements>;
+    now?: () => Date;
+}
+/** Independently selects a healthy broker that can honor the complete scope. */
+declare function createCredentialGrantBindingController(options: CredentialGrantBindingControllerOptions): Controller<CredentialGrantResource['spec']>;
+interface CredentialHandleVault {
+    /** The token remains outside ControlStore; handleRef is safe to persist. */
+    put(handleReference: string, handle: CredentialGrantHandle): Promise<void>;
+    get(handleReference: string): Promise<CredentialGrantHandle | undefined>;
+    delete(handleReference: string): Promise<void>;
+}
+interface CredentialGrantExecutionControllerOptions {
+    nodeId: string;
+    getBroker(brokerClass: string, nodeId: string): Promise<CredentialBrokerDriver | undefined>;
+    vault: CredentialHandleVault;
+    managed?: {
+        getDriver(brokerClass: string, nodeId: string): Promise<CredentialManagementDriver | undefined>;
+        createIssueRequest(input: {
+            grant: CredentialGrantResource;
+            actor: Parameters<Controller['reconcile']>[0]['actor'];
+            leaseEpoch: string;
+        }): Promise<DriverRequestEnvelope<CredentialIssuePayload>>;
+    };
+    now?: () => Date;
+}
+/** Persists a fencing claim before issuing a worker-visible credential. */
+declare function createCredentialGrantExecutionController(options: CredentialGrantExecutionControllerOptions): Controller<CredentialGrantResource['spec']>;
+declare function revokeCredentialGrant(grant: CredentialGrantResource, broker: CredentialBrokerDriver, vault: CredentialHandleVault): Promise<void>;
+interface CredentialGrantLifecycleControllerOptions {
+    nodeId: string;
+    getBroker(brokerClass: string, nodeId: string): Promise<CredentialBrokerDriver | undefined>;
+    vault: CredentialHandleVault;
+    managed?: {
+        getDriver(brokerClass: string, nodeId: string): Promise<CredentialManagementDriver | undefined>;
+        createRevokeRequest(input: {
+            grant: CredentialGrantResource;
+            grantHandle: string;
+            actor: Parameters<Controller['reconcile']>[0]['actor'];
+            leaseEpoch: string;
+        }): Promise<DriverRequestEnvelope<{
+            grantHandle: string;
+        }>>;
+    };
+    isRunTerminal(grant: CredentialGrantResource): Promise<boolean>;
+    now?: () => Date;
+}
+/** Revokes issued grants on Run termination or expiry, including after restart. */
+declare function createCredentialGrantLifecycleController(options: CredentialGrantLifecycleControllerOptions): Controller<CredentialGrantResource['spec']>;
+
+interface ControlStoreAuditTelemetryAdapterOptions {
+    store: ControlStore;
+    name: string;
+    authorizeRequest(request: DriverRequestEnvelope): boolean | Promise<boolean>;
+    now?: () => Date;
+    maxRecordsPerResource?: number;
+    maxAttributes?: number;
+    persistence: 'host' | 'external';
+    threatAssumptions: string[];
+}
+/**
+ * ControlStore-backed production audit sink. A short ControlStore lease
+ * serializes a named stream across processes; immutable AuditRecord resources
+ * retain idempotency, fencing, quota, and hash-chain evidence across restarts.
+ */
+declare function createControlStoreAuditTelemetryAdapter(options: ControlStoreAuditTelemetryAdapterOptions): AuditTelemetryManagementDriver;
+
+interface PolicyEvaluation {
+    outcome: 'allow' | 'deny';
+    reasons: string[];
+    obligations?: string[];
+}
+interface ControlStorePolicyApprovalAdapterOptions {
+    store: ControlStore;
+    name: string;
+    authorizeRequest(request: DriverRequestEnvelope): boolean | Promise<boolean>;
+    evaluateResourceAdmission?(request: Parameters<PolicyApprovalManagementDriver['admitResource']>[0]): PolicyEvaluation | Promise<PolicyEvaluation>;
+    evaluatePlacement?(request: Parameters<PolicyApprovalManagementDriver['authorizePlacement']>[0]): PolicyEvaluation | Promise<PolicyEvaluation>;
+    evaluateToolOperation?(request: Parameters<PolicyApprovalManagementDriver['authorizeToolOperation']>[0], approval: PolicyDecision | undefined): PolicyEvaluation | Promise<PolicyEvaluation>;
+    evaluateTransition?(request: Parameters<PolicyApprovalManagementDriver['verifyTransition']>[0]): PolicyEvaluation | Promise<PolicyEvaluation>;
+    maxApprovalTtlMs?: number;
+    now?: () => Date;
+    persistence: 'host' | 'external';
+    threatAssumptions: string[];
+}
+/**
+ * Durable production Policy/Approval adapter. Policy outcomes come only from
+ * host-injected evaluators or authenticated admin/verifier requests; caller
+ * payloads contain no allow bit.
+ */
+declare function createControlStorePolicyApprovalAdapter(options: ControlStorePolicyApprovalAdapterOptions): PolicyApprovalManagementDriver;
+
+/**
+ * Plan 24.61: record/replay fixtures, capability negotiation, cancel/backpressure,
+ * crash/adoption, idempotency/fencing, downgrade, and security conformance tests.
+ *
+ * These helpers are interface-agnostic: each takes the small set of driver
+ * operations it needs, so the same suites apply to network, model-provider,
+ * tool-execution, storage, and credential drivers.
+ */
+
+interface RecordedInteraction {
+    method: string;
+    arguments: unknown[];
+    result?: unknown;
+    error?: string;
+    recordedAt: string;
+}
+interface DriverFixture {
+    name: string;
+    driverKind: DriverManifest['kind'];
+    interactions: RecordedInteraction[];
+}
+/**
+ * Wrap a driver and record every method call into a fixture. The fixture can
+ * be serialized to JSON and checked into the repo as a portable conformance
+ * artifact.
+ */
+declare function createRecordingDriver<T extends object>(driver: T, kind: DriverManifest['kind'], name: string): {
+    driver: T;
+    fixture: () => DriverFixture;
+};
+/**
+ * Create a driver that replays a recorded fixture. Each method call returns
+ * the recorded result (or throws the recorded error) in order. A call that
+ * does not match the next recorded interaction fails the replay.
+ */
+declare function createReplayingDriver(fixture: DriverFixture): Record<string, unknown>;
+/**
+ * Verify a driver's reported capabilities satisfy the required capability set.
+ * Returns the list of missing capabilities (empty when negotiation succeeds).
+ */
+declare function negotiateCapabilities(reported: Record<string, boolean | string | number>, required: Record<string, boolean | string | number>): string[];
+declare function createCapabilityNegotiationTests(options: {
+    getCapabilities: (driver: unknown) => Promise<Record<string, boolean | string | number>>;
+    requiredCapabilities: Record<string, boolean | string | number>;
+}): DriverConformanceTest[];
+declare function createCancellationTests(options: {
+    startLongOperation: (driver: unknown, signal: AbortSignal) => Promise<unknown>;
+}): DriverConformanceTest[];
+declare function createBackpressureTests(options: {
+    submit: (driver: unknown) => Promise<unknown>;
+    concurrencyLimit: number;
+}): DriverConformanceTest[];
+declare function createAdoptionTests(options: {
+    createResource: (driver: unknown) => Promise<string>;
+    recreateDriver: () => unknown;
+    listResources: (driver: unknown) => Promise<string[]>;
+}): DriverConformanceTest[];
+declare function createIdempotencyTests(options: {
+    submitWithIdempotencyKey: (driver: unknown, key: string) => Promise<unknown>;
+}): DriverConformanceTest[];
+declare function createFencingTests(options: {
+    operateWithFence: (driver: unknown, fenceToken: number) => Promise<unknown>;
+}): DriverConformanceTest[];
+declare function createDowngradeTests(options: {
+    callWithVersion: (driver: unknown, version: string) => Promise<unknown>;
+    supportedVersion: string;
+}): DriverConformanceTest[];
+declare function createSecurityTests(options: {
+    callAsActor: (driver: unknown, actorId: string) => Promise<unknown>;
+    unauthorizedActorId: string;
+    authorizedActorId: string;
+}): DriverConformanceTest[];
+
+interface ExternalToolContract {
+    /** Exact portable tool identity implemented by the external runtime. */
+    kind: string;
+    name: string;
+    /** Host-authoritative effect. A caller cannot downgrade this value. */
+    effect: ToolOperationEffect;
+    /** Portable JSON Schema applied without coercion, defaults, or field removal. */
+    inputSchema: Record<string, unknown>;
+    /** Portable JSON Schema for the untrusted runtime's returned value. */
+    outputSchema: Record<string, unknown>;
+    /** Optional content digest callers may pin through `toolRef.schemaDigest`. */
+    schemaDigest?: string;
+    /** Host-owned hard resource ceiling for the one-shot executor. */
+    resources: {
+        cpuMillicores: number;
+        memoryBytes: number;
+    };
+    /** Exact immutable/tagged image references admitted to implement this contract. */
+    runtimeImages: string[];
+}
+/** Validate a driver-published catalog once at construction/discovery time. */
+declare function assertExternalToolContracts(contracts: readonly ExternalToolContract[]): void;
+/**
+ * Bind an externally placed operation to the driver/runtime's trusted
+ * declaration before any native API call or adoption lookup.
+ */
+declare function assertExternalToolOperationContract(operation: ToolOperationResource, contracts: readonly ExternalToolContract[] | undefined, runtimeImage: string | undefined): ExternalToolContract;
+/** Validate the value returned by an external runtime before persistence. */
+declare function assertExternalToolOperationResult(contract: ExternalToolContract, value: unknown): void;
+/** Contracts implemented by the bundled minimal worker-runtime image. */
+declare function createMinimalExternalRuntimeToolContracts(runtimeImage: string): ExternalToolContract[];
+
+interface ExternalWorkloadRuntimeContract {
+    /** Matches `AgentWorkload.spec.runtimeClass`; `default` matches omission. */
+    runtimeClass: string;
+    /** Host-selected image. Production deployments should pin a manifest digest. */
+    image: string;
+    /** Host-selected entrypoint override, if the image default is insufficient. */
+    command?: string[];
+    /** Host-selected non-secret container environment. */
+    environment?: Record<string, string>;
+    /** Default and maximum enforced CPU/memory allocation. */
+    resources: {
+        cpuMillicores: number;
+        memoryBytes: number;
+    };
+}
+declare function assertExternalWorkloadRuntimeContracts(contracts: readonly ExternalWorkloadRuntimeContract[]): void;
+/**
+ * Resolve only host-published runtime configuration. Legacy annotations are
+ * rejected because they let a workload replace the trusted worker process.
+ */
+declare function resolveExternalWorkloadRuntime(workload: AgentWorkloadResource, contracts: readonly ExternalWorkloadRuntimeContract[] | undefined): ExternalWorkloadRuntimeContract;
+/** Apply host maxima and safe defaults to portable workload requirements. */
+declare function resolveExternalWorkloadResources(workload: AgentWorkloadResource, contract: ExternalWorkloadRuntimeContract): AgentWorkloadResourceRequirements;
+
+interface ExternalRuntimeResult {
+    phase: 'Completed' | 'Failed' | 'Cancelled';
+    summary?: string;
+    result?: ToolOperationResult;
+    error?: OrchestrationErrorData;
+}
+/** Parse the last structured worker-result line from a bounded log tail. */
+declare function parseExternalRuntimeResult(logTail: string): ExternalRuntimeResult | undefined;
+/**
+ * External orchestrator driver contract (24.62).
+ *
+ * Every external orchestrator (Docker Swarm, Kubernetes/K3s, Nomad, etc.)
+ * implements this portable contract so that the memeloop control plane can
+ * map AgentWorkload and ToolOperation resources without importing any
+ * backend SDK into core or the default CLI.
+ *
+ * Driver packages (memeloop-swarm, memeloop-k8s, etc.) are separate optional
+ * Node packages that import this contract from `memeloop` and register
+ * themselves through the ControlStore's driver manifest system.
+ */
+interface ExternalPlacementResult {
+    /** External orchestrator's native resource identifier (service name, pod name, job name). */
+    externalId: string;
+    /** The node where the workload or operation was placed. */
+    nodeName: string;
+    /** Provider-specific metadata (e.g. Docker service ID, K8s UID). */
+    providerMetadata?: Record<string, string>;
+}
+interface ExternalStatusResult {
+    externalId: string;
+    phase: 'Pending' | 'Running' | 'Succeeded' | 'Failed' | 'Cancelled' | 'Unknown';
+    message?: string;
+    /** Structured, validated `MEMELOOP_RESULT` recovered from the worker. */
+    runtimeResult?: ExternalRuntimeResult;
+    /** When the external orchestrator last reported this status. */
+    observedAt: string;
+    /** Resource usage reported by the external runtime. */
+    resources?: {
+        cpuCores?: number;
+        memoryBytes?: number;
+    };
+}
+interface ExternalDriverCapabilities {
+    name: string;
+    version: string;
+    /** What the driver manages: workloads, tool-operations, or both. */
+    manages: Array<'AgentWorkload' | 'ToolOperation'>;
+    /** Whether the driver supports co-located scheduling (workload + tool on same node). */
+    supportsColocation: boolean;
+    /**
+     * Whether repeated placement of the same immutable MemeLoop resource UID
+     * adopts the native object. Required for crash-safe controller recovery.
+     */
+    supportsAdoption: boolean;
+    /** Maximum concurrent workloads this driver can handle. */
+    maxConcurrency?: number;
+    /**
+     * Trusted tool/runtime contracts. Required for every externally placed
+     * ToolOperation; an empty/absent catalog makes tool placement fail closed.
+     */
+    toolContracts?: ExternalToolContract[];
+    /** Host-owned runtimeClass-to-container bindings for AgentWorkloads. */
+    workloadRuntimes?: ExternalWorkloadRuntimeContract[];
+}
+interface ExternalWorkloadPlacementContext {
+    /** Admitted source resolved from the content-addressed artifact store. */
+    scriptSource?: string;
+    /**
+     * Single-use worker bootstrap secret. Drivers must materialize it through
+     * their native secret mechanism as a read-only file, never argv, ordinary
+     * environment, labels, annotations, provider metadata, or ControlStore.
+     */
+    workerBootstrap?: ExternalWorkerBootstrapSecret;
+    /** Portable cancellation for placement requests. */
+    signal?: AbortSignal;
+}
+interface ExternalWorkerBootstrapSecret {
+    apiVersion: 'worker.memeloop.io/v1alpha1';
+    gatewayUrl: string;
+    gatewayPublicKey: string;
+    gatewayKeyFingerprint: string;
+    /** Optional PEM CA certificate for an internal HTTPS worker gateway. */
+    gatewayCaCertificate?: string;
+    enrollmentName: string;
+    bootstrapToken: string;
+}
+/**
+ * Portable external orchestrator driver.
+ *
+ * Implementations translate between memeloop orchestration resources and
+ * the external orchestrator's native API. The control plane never calls
+ * Docker/K8s SDKs directly — it always goes through this contract.
+ */
+interface ExternalOrchestrationDriver {
+    /** Return capabilities so the control plane knows what to route. */
+    getCapabilities(): Promise<ExternalDriverCapabilities>;
+    /** Place an AgentWorkload on the external orchestrator. */
+    placeWorkload(workload: AgentWorkloadResource, actor: ControlStoreActor, context?: ExternalWorkloadPlacementContext): Promise<ExternalPlacementResult>;
+    /** Get the current status of a placed workload. */
+    getWorkloadStatus(externalId: string): Promise<ExternalStatusResult>;
+    /** Stop and remove a placed workload. */
+    stopWorkload(externalId: string, actor: ControlStoreActor): Promise<void>;
+    /** Execute a ToolOperation on the external orchestrator. */
+    executeToolOperation(operation: ToolOperationResource, actor: ControlStoreActor): Promise<ExternalPlacementResult>;
+    /** Get the current status of a tool operation execution. */
+    getToolOperationStatus(externalId: string): Promise<ExternalStatusResult>;
+    /** Cancel a running tool operation. */
+    cancelToolOperation(externalId: string, actor: ControlStoreActor): Promise<void>;
+    /** List all workloads currently managed by this driver. */
+    listWorkloads(): Promise<ExternalStatusResult[]>;
+    /** List all tool operations currently managed by this driver. */
+    listToolOperations(): Promise<ExternalStatusResult[]>;
+    /** Health check for the driver connection. */
+    getHealth(): Promise<{
+        healthy: boolean;
+        detail?: string;
+        checkedAt: string;
+    }>;
+}
+
+/**
+ * Local model endpoint registration (plan 24.36).
+ *
+ * A worker advertises the models its ModelProviderDriver can serve as
+ * ModelClass + ModelEndpoint manifests. Advertisement carries digest, health,
+ * capacity, modalities, data policy, and node trust so the scheduler can
+ * place model calls without contacting the node. Local model output is data
+ * only — it can never authorize tool admission, which is host-bound.
+ */
+interface LocalModelAdvertisementOptions {
+    nodeId: string;
+    trust: 'trusted' | 'restricted' | 'quarantine';
+    /** Prefix for opaque endpoint handles (default `local://<nodeId>`). */
+    endpointPrefix?: string;
+    capacity?: {
+        maxConcurrent?: number;
+        tokensPerMinute?: number;
+    };
+    dataPolicy?: {
+        classification?: string;
+        retention?: string;
+    };
+}
+interface LocalModelAdvertisement {
+    modelClasses: ModelClassManifest[];
+    endpoints: ModelEndpointManifest[];
+    health: ModelProviderHealth;
+}
+/**
+ * Build declarative manifests for every model the driver serves. Endpoint
+ * handles are opaque (`<prefix>/<provider>/<model>`) and never embed
+ * credentials or URLs.
+ */
+declare function describeLocalModelEndpoints(driver: ModelProviderDriver, options: LocalModelAdvertisementOptions): Promise<LocalModelAdvertisement>;
+type ModelEndpointTrust = 'trusted' | 'restricted' | 'quarantine';
+interface ModelSelectionRequirements {
+    /** Required ModelClass name. */
+    modelClassName: string;
+    /** Required model digest; endpoints with a mismatching digest are excluded. */
+    modelDigest?: string;
+    /** Minimum acceptable node trust (default `quarantine` — any node qualifies). */
+    minimumTrust?: ModelEndpointTrust;
+    /** Exclude endpoints whose status reports unhealthy (default true). */
+    requireHealthy?: boolean;
+    /** Required spare concurrency. */
+    minConcurrent?: number;
+}
+interface SelectableModelEndpoint {
+    manifest: ModelEndpointManifest;
+    status?: {
+        healthy?: boolean;
+    };
+}
+/**
+ * Pick the best endpoint for a model call: filters by class name, digest,
+ * trust, health, and capacity, then prefers the highest-capacity endpoint.
+ * Returns null when nothing qualifies — the caller must surface a scheduling
+ * failure rather than silently falling back to an unvetted endpoint.
+ */
+declare function selectModelEndpoint(endpoints: SelectableModelEndpoint[], requirements: ModelSelectionRequirements): ModelEndpointManifest | null;
+
+interface ManagedArtifactDriverAdapterOptions {
+    state: FakeArtifactManagementState;
+    inspector: ArtifactInspector;
+    authorizeRequest(request: DriverRequestEnvelope): boolean | Promise<boolean>;
+    persistState(snapshot: ArtifactManagementStateSnapshot): Promise<void>;
+    name: string;
+    maxArtifactBytes?: number;
+    inspectionIsolation: Exclude<ArtifactManagementCapabilities['inspectionIsolation'], 'none'>;
+    persistence: Exclude<ArtifactManagementCapabilities['persistence'], 'process'>;
+    reviewer?: string;
+    threatAssumptions: string[];
+    now?: () => Date;
+    destinationPolicies?: Partial<Record<ArtifactDestination, ArtifactDestinationPolicy>>;
+}
+/**
+ * Production boundary over the fully tested artifact state engine.
+ *
+ * Calls are serialized so an asynchronous isolated inspector cannot race
+ * mutations. Every accepted request (including one that fails after fencing)
+ * is flushed through the host's atomic persistence port before the lock is
+ * released.
+ */
+declare function createManagedArtifactDriverAdapter(options: ManagedArtifactDriverAdapterOptions): ArtifactManagementDriver;
+
+interface StorageDriverCapabilities {
+    name: string;
+    accessModes: VolumeAccessMode[];
+    snapshots: boolean;
+    encryption: boolean;
+    /** The host stack has a wired replica transport/controller. */
+    replication?: boolean;
+    /** The host stack has a wired durable backup implementation. */
+    backup?: boolean;
+    maxVolumeBytes?: number;
+}
+/** Shared claim/class capability gate used at binding and immediately pre-effect. */
+declare function storageDriverSatisfiesClass(capability: StorageDriverCapabilities, claim: AgentVolumeClaimResource, storageClass: StorageClassResource): boolean;
+interface StorageProvisionRequest {
+    claim: AgentVolumeClaimResource;
+    storageClass: StorageClassResource;
+}
+interface StorageProvisionResult {
+    /** Opaque and stable for the claim UID. */
+    driverHandle: string;
+    capacityBytes?: number;
+    topology?: {
+        nodeId?: string;
+        zone?: string;
+    };
+}
+interface StoragePublishRequest {
+    volume: AgentVolumeResource;
+    nodeId: string;
+    workloadUid: string;
+    readOnly: boolean;
+}
+interface StoragePublishResult {
+    /** Opaque and stable for volume/workload/node. */
+    publishHandle: string;
+    /** Host path or runtime-native mount descriptor; never parsed by core. */
+    mountPath: string;
+}
+/** CSI-like host port. Provision/publish/delete/unpublish must be idempotent. */
+interface StorageDriver {
+    getCapabilities(): Promise<StorageDriverCapabilities>;
+    getHealth(): Promise<{
+        healthy: boolean;
+        detail?: string;
+        checkedAt: string;
+    }>;
+    provision(request: StorageProvisionRequest): Promise<StorageProvisionResult>;
+    delete(volume: AgentVolumeResource): Promise<void>;
+    publish(request: StoragePublishRequest): Promise<StoragePublishResult>;
+    getPublished(publishHandle: string): Promise<StoragePublishResult | undefined>;
+    unpublish(publishHandle: string): Promise<void>;
+}
+
+interface ManagedStorageAdapterStateStore {
+    get(key: string): Promise<unknown>;
+    put(key: string, value: unknown): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+interface ManagedStorageDriverAdapterOptions {
+    authorizeRequest(request: DriverRequestEnvelope): boolean | Promise<boolean>;
+    resolveProvisionInput(request: DriverRequestEnvelope<StorageProvisionPayload>): Promise<{
+        claim: AgentVolumeClaimResource;
+        storageClass: StorageClassResource;
+    }>;
+    resolveVolume(volumeHandle: string, request: DriverRequestEnvelope): Promise<AgentVolumeResource | undefined>;
+    stateStore?: ManagedStorageAdapterStateStore;
+    stableStageHandleFor?(request: DriverRequestEnvelope<{
+        volumeHandle: string;
+        nodeId: string;
+    }>): string;
+    threatAssumptions: string[];
+    now?: () => Date;
+}
+/**
+ * Production bridge for the existing CSI-like StorageDriver. Unsupported data
+ * management operations fail explicitly instead of fabricating capabilities.
+ */
+declare function createManagedStorageDriverAdapter(driver: StorageDriver, options: ManagedStorageDriverAdapterOptions): StorageManagementDriver;
+
+/** Build content-addressed descriptors from the schemas actually registered by the host. */
+declare function createManagedToolDescriptors(registry: IToolRegistry, nodeId: string): Promise<ManagedToolDescriptor[]>;
+interface ManagedToolPolicyDecision {
+    handle: string;
+    policyDigest: string;
+    approval?: ToolOperationApprovalEvidence;
+}
+interface ManagedToolExecutionRouteOptions {
+    descriptors: ManagedToolDescriptor[];
+    resolveOperation(resourceUid: string): Promise<ToolOperationResource | undefined>;
+    authorizeOperation(operation: ToolOperationResource, signal?: AbortSignal): Promise<ManagedToolPolicyDecision>;
+    authorizeRequest(request: DriverRequestEnvelope): boolean | Promise<boolean>;
+    createRequest<T>(input: {
+        method: string;
+        payload: T;
+        operation: ToolOperationResource;
+        actor: ControllerReconcileRequest['actor'];
+        leaseEpoch: string;
+        idempotencyKey: string;
+        payloadFields: string[];
+    }): DriverRequestEnvelope<T>;
+    name: string;
+    maxOutputBytes?: number;
+    maxOutputChunks?: number;
+    now?: () => Date;
+    threatAssumptions: string[];
+}
+interface ManagedToolExecutionRoute {
+    managementDriver: ToolManagementDriver;
+    executionDriver: ToolExecutionDriver;
+}
+/**
+ * Round-trip the existing ToolExecutionDriver through the complete managed
+ * lifecycle while keeping live results and approval evidence host-local.
+ */
+declare function createManagedToolExecutionRoute(narrowDriver: ToolExecutionDriver, options: ManagedToolExecutionRouteOptions): ManagedToolExecutionRoute;
+
+/**
+ * Dedicated outbound worker protocol (plan §13).
+ *
+ * This protocol is deliberately smaller than ResourceClient. A worker can
+ * interact only with its own assignment/run through method-specific gateway
+ * handlers; it cannot list/watch control state, acquire leases, discover
+ * peers, or mutate Node/verification/promotion resources.
+ */
+declare const WORKER_PROTOCOL_VERSION = "worker.memeloop.io/v1alpha1";
+declare const WORKER_PROTOCOL_METHODS: readonly ["assignment.pull", "assignment.ack", "session.heartbeat", "event.submit", "capability.request", "artifact.upload", "operation.complete", "operation.fail", "operation.cancel"];
+type WorkerProtocolMethod = typeof WORKER_PROTOCOL_METHODS[number];
+interface WorkerRunBinding {
+    uid: string;
+    attempt: number;
+    epoch: number;
+}
+interface WorkerProtocolRequest {
+    apiVersion: typeof WORKER_PROTOCOL_VERSION;
+    requestId: string;
+    sessionName: string;
+    sequence: number;
+    nonce: string;
+    deadline: string;
+    audience: string;
+    run: WorkerRunBinding;
+    method: WorkerProtocolMethod;
+    target: string;
+    policyDigest: string;
+    payload: unknown;
+    /** Signature over canonicalWorkerProtocolRequestBytes(request). */
+    signature: string;
+}
+type WorkerProtocolResponse = {
+    apiVersion: typeof WORKER_PROTOCOL_VERSION;
+    requestId: string;
+    ok: true;
+    payload: unknown;
+    receivedAt: string;
+} | {
+    apiVersion: typeof WORKER_PROTOCOL_VERSION;
+    requestId: string;
+    ok: false;
+    error: OrchestrationErrorData;
+    receivedAt: string;
+};
+interface WorkerBootstrapSessionDescriptor {
+    apiVersion: typeof WORKER_PROTOCOL_VERSION;
+    sessionName: string;
+    audience: string;
+    expiresAt: string;
+    run: WorkerRunBinding;
+    policyDigest: string;
+    allowedMethods: WorkerProtocolMethod[];
+    allowedTargets?: string[];
+    workerKeyFingerprint: string;
+    gatewayKeyFingerprint: string;
+    issuedAt: string;
+}
+interface SignedWorkerBootstrapSessionDescriptor extends WorkerBootstrapSessionDescriptor {
+    /** Gateway signature over canonicalWorkerBootstrapDescriptorBytes(...). */
+    gatewaySignature: string;
+}
+interface WorkerGatewaySession {
+    name: string;
+    workerKeyFingerprint: string;
+    workerPublicKey: string;
+    audience: string;
+    protocol: typeof WORKER_PROTOCOL_VERSION;
+    expiresAt: string;
+    revoked: boolean;
+    run: WorkerRunBinding;
+    policyDigest: string;
+    allowedMethods: WorkerProtocolMethod[];
+    allowedTargets?: string[];
+}
+interface WorkerProtocolReplayProtector {
+    /**
+     * Atomically accept exactly the next sequence and a fresh nonce.
+     * Production implementations must persist this state; returning false
+     * fails closed on replay, gaps, or uncertain state.
+     */
+    consume(sessionName: string, sequence: number, nonce: string): Promise<boolean>;
+}
+interface WorkerProtocolGatewayOptions {
+    resolveSession: (sessionName: string) => Promise<WorkerGatewaySession | undefined>;
+    replayProtector: WorkerProtocolReplayProtector;
+    verifySignature: (request: {
+        session: WorkerGatewaySession;
+        message: Uint8Array;
+        signature: string;
+    }) => Promise<boolean>;
+    dispatch: (request: {
+        requestId: string;
+        session: WorkerGatewaySession;
+        method: WorkerProtocolMethod;
+        target: string;
+        payload: unknown;
+        signal: AbortSignal;
+    }) => Promise<unknown>;
+    now?: () => Date;
+    maxClockSkewMs?: number;
+    maxRequestsPerMinute?: number;
+    methodPayloadLimits?: Partial<Record<WorkerProtocolMethod, number>>;
+    maxResponseBytes?: number;
+    onAudit?: (event: WorkerProtocolAuditEvent) => Promise<void> | void;
+    /** Trusted host diagnostics; never serialized to the worker response. */
+    onError?: (error: unknown) => void;
+}
+interface WorkerProtocolAuditEvent {
+    requestId: string;
+    sessionName: string;
+    method: string;
+    target: string;
+    /** Policy snapshot from the verified request/session binding. */
+    policyDigest: string;
+    accepted: boolean;
+    code?: OrchestrationErrorData['code'];
+    receivedAt: string;
+}
+/** Canonical bytes signed by the worker; excludes only the signature field. */
+declare function canonicalWorkerProtocolRequestBytes(request: Omit<WorkerProtocolRequest, 'signature'> | WorkerProtocolRequest): Uint8Array;
+/** Canonical bytes signed by the pinned gateway after enrollment. */
+declare function canonicalWorkerBootstrapDescriptorBytes(descriptor: WorkerBootstrapSessionDescriptor | SignedWorkerBootstrapSessionDescriptor): Uint8Array;
+/**
+ * Create the trusted-side protocol gateway. Session resolution, signature
+ * verification, replay state, and effects are all injected host ports.
+ */
+declare function createWorkerProtocolGateway(options: WorkerProtocolGatewayOptions): {
+    handle(request: WorkerProtocolRequest, signal?: AbortSignal): Promise<WorkerProtocolResponse>;
+};
+/** In-memory replay fixture. Production gateways must use durable state. */
+declare function createInMemoryWorkerReplayProtector(): WorkerProtocolReplayProtector;
+
+declare const WORKER_ENROLLMENT_API_VERSION = "security.memeloop.io/v1alpha1";
+declare const WORKER_ENROLLMENT_KIND = "WorkerEnrollment";
+declare const WORKER_SESSION_API_VERSION = "security.memeloop.io/v1alpha1";
+declare const WORKER_SESSION_KIND = "WorkerSession";
+/**
+ * WorkerEnrollment: one-time bootstrap record for a worker identity.
+ * Created by a trusted controller or admin; never by the worker itself.
+ */
+interface WorkerEnrollmentSpec {
+    /** Node this worker is enrolled on. */
+    nodeRef: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+        namespace?: string;
+    };
+    /** Trust class assigned at enrollment time; immutable after creation. */
+    trustClass: NodeTrustClass;
+    /** Pinned gateway URL and public-key fingerprint known before bootstrap. */
+    expectedGateway: string;
+    gatewayKeyFingerprint: string;
+    /** Narrow protocol/session scope fixed by the trusted enrolling actor. */
+    audience: string;
+    allowedProtocol: string;
+    run: WorkerRunBinding;
+    policyDigest: string;
+    allowedMethods: WorkerProtocolMethod[];
+    allowedTargets?: string[];
+    /** One-time bootstrap token hash; the raw token is only shown once. */
+    bootstrapTokenHash: string;
+    /** Enrolling actor (controller or admin). */
+    enrolledBy: string;
+    /** Expiry of the enrollment record itself. */
+    expiresAt: string;
+}
+interface WorkerEnrollmentStatus extends OrchestrationResourceStatus {
+    phase?: 'Pending' | 'Bound' | 'Expired' | 'Revoked';
+    /** Fingerprint of the worker's ephemeral public key, set after binding. */
+    workerKeyFingerprint?: string;
+    boundAt?: string;
+    revokedAt?: string;
+    revokeReason?: string;
+}
+/**
+ * WorkerSession: ephemeral identity session bound to a worker key.
+ * Created after a worker proves possession of the bootstrap token.
+ */
+interface WorkerSessionSpec {
+    enrollmentRef: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+        namespace?: string;
+    };
+    /** Fingerprint of the worker's ephemeral public key. */
+    workerKeyFingerprint: string;
+    /** Encoded ephemeral public key used for per-message signature checks. */
+    workerPublicKey: string;
+    audience: string;
+    allowedProtocol: string;
+    run: WorkerRunBinding;
+    policyDigest: string;
+    allowedMethods: WorkerProtocolMethod[];
+    allowedTargets?: string[];
+    /** Session TTL in milliseconds. */
+    ttlMs: number;
+}
+interface WorkerSessionStatus extends OrchestrationResourceStatus {
+    phase?: 'Active' | 'Expired' | 'Revoked';
+    issuedAt?: string;
+    expiresAt?: string;
+    lastProofAt?: string;
+    revokedAt?: string;
+    revokeReason?: string;
+    /** Durable replay fence for the dedicated worker protocol. */
+    lastSequence?: number;
+    /** Bounded recent nonce window; sequence remains the primary fence. */
+    recentNonces?: string[];
+}
+type WorkerEnrollmentResource = Omit<OrchestrationResource<WorkerEnrollmentSpec>, 'status'> & {
+    status?: WorkerEnrollmentStatus;
+};
+type WorkerSessionResource = Omit<OrchestrationResource<WorkerSessionSpec>, 'status'> & {
+    status?: WorkerSessionStatus;
+};
+interface BindWorkerSessionRequest {
+    /** Raw, single-use bootstrap token. It must never be persisted or logged. */
+    bootstrapToken: string;
+    /** Fingerprint of the ephemeral public key proved by the worker. */
+    workerKeyFingerprint: string;
+    /** Encoded ephemeral public key; public, but never worker-selected authority. */
+    workerPublicKey: string;
+    /** Pinned gateway identity serving this bootstrap request. */
+    gatewayKeyFingerprint: string;
+    /** Gateway-issued one-time challenge and the worker's signature over it. */
+    proof: {
+        challenge: string;
+        signature: string;
+    };
+    /** Requested session lifetime. It is capped by the enrollment expiry. */
+    ttlMs: number;
+    /**
+     * Host cryptographic verifier. Core deliberately does not prescribe a
+     * password-hash implementation; the verifier compares the raw token with
+     * the enrollment's persisted hash in constant-time.
+     */
+    verifyBootstrapToken: (token: string, expectedHash: string) => Promise<boolean> | boolean;
+    /** Verify key fingerprint and proof-of-possession, consuming the challenge. */
+    verifyWorkerProof: (request: {
+        enrollmentName: string;
+        workerKeyFingerprint: string;
+        workerPublicKey: string;
+        challenge: string;
+        signature: string;
+    }) => Promise<boolean> | boolean;
+}
+declare function createWorkerEnrollmentManifest(name: string, spec: WorkerEnrollmentSpec): {
+    apiVersion: string;
+    kind: string;
+    metadata: {
+        name: string;
+    };
+    spec: WorkerEnrollmentSpec;
+};
+declare function createWorkerSessionManifest(name: string, spec: WorkerSessionSpec): {
+    apiVersion: string;
+    kind: string;
+    metadata: {
+        name: string;
+    };
+    spec: WorkerSessionSpec;
+};
+declare function isWorkerEnrollment(resource: OrchestrationResource<unknown, unknown>): resource is WorkerEnrollmentResource;
+declare function isWorkerSession(resource: OrchestrationResource<unknown, unknown>): resource is WorkerSessionResource;
+/**
+ * Enroll a new worker: create a WorkerEnrollment with a one-time bootstrap token.
+ * Only callable by trusted controller or admin actors.
+ */
+declare function enrollWorker(store: ControlStore, actor: ControlStoreActor, name: string, spec: WorkerEnrollmentSpec): Promise<WorkerEnrollmentResource>;
+/**
+ * Bind a worker to its enrollment: the worker proves possession of the
+ * bootstrap token and receives a WorkerSession with an ephemeral identity.
+ */
+declare function bindWorkerSession(store: ControlStore, actor: ControlStoreActor, enrollmentName: string, request: BindWorkerSessionRequest, now?: () => Date): Promise<WorkerSessionResource>;
+/**
+ * Revoke a worker session, preventing further use of the ephemeral identity.
+ */
+declare function revokeWorkerSession(store: ControlStore, actor: ControlStoreActor, sessionName: string, reason: string, now?: () => Date): Promise<void>;
+/**
+ * Check whether a worker session is currently valid (active and not expired).
+ */
+declare function isWorkerSessionValid(session: WorkerSessionResource, now?: Date): boolean;
+
+interface ManagedWorkerIdentityRequestFactoryInput<T> {
+    method: string;
+    payload: T;
+    enrollment: WorkerEnrollmentResource;
+    actor: ControlStoreActor;
+    idempotencyKey: string;
+    payloadFields: string[];
+}
+interface ManagedWorkerIdentityAdapterOptions {
+    store: ControlStore;
+    actor: ControlStoreActor;
+    authorizeRequest(request: DriverRequestEnvelope): boolean | Promise<boolean>;
+    createRequest<T>(input: ManagedWorkerIdentityRequestFactoryInput<T>): DriverRequestEnvelope<T>;
+    maxChallengeTtlMs?: number;
+    maxSessionTtlMs?: number;
+    now?: () => Date;
+    name: string;
+    threatAssumptions: string[];
+}
+interface ManagedWorkerIdentityRoute {
+    driver: IdentityAttestationManagementDriver;
+    bindWorkerSession(enrollmentName: string, request: BindWorkerSessionRequest): Promise<WorkerSessionResource>;
+}
+/**
+ * Put the existing one-time WorkerEnrollment/WorkerSession Ed25519 flow behind
+ * the general Identity/Attestation contract without claiming hardware
+ * attestation or crash-persistent pending proof material.
+ */
+declare function createManagedWorkerIdentityAdapter(options: ManagedWorkerIdentityAdapterOptions): ManagedWorkerIdentityRoute;
+
+/**
+ * ModelEndpoint registration heartbeat (plan 24.36).
+ *
+ * A node runs one registrar per ModelProviderDriver. Each heartbeat tick
+ * re-describes the driver's models, upserts ModelClass/ModelEndpoint
+ * resources into the ControlStore, and refreshes endpoint `status.healthy`
+ * and `status.heartbeat` so the scheduler can place model calls on live
+ * endpoints. Endpoints the driver stops serving are deleted; when the driver
+ * cannot be interrogated or the registrar stops, owned endpoints are marked
+ * unhealthy (fail-safe: never advertise a possibly-dead model as healthy).
+ *
+ * The actor identity is host-bound; scripts and model output cannot choose
+ * it. Endpoint specs are immutable here because ControlStore intentionally
+ * exposes no spec-update verb — identity changes require delete + recreate.
+ */
+interface ModelEndpointRegistrarOptions {
+    /** Host-bound actor identity used for every ControlStore write. */
+    actor: ControlStoreActor;
+    /** Advertisement identity/policy (nodeId, trust, capacity, data policy). */
+    advertisement: LocalModelAdvertisementOptions;
+    /** Heartbeat interval in milliseconds (default 30_000). */
+    heartbeatIntervalMs?: number;
+    /** CAS attempts per status write before giving up (default 3). */
+    statusWriteAttempts?: number;
+    /** Start the background loop immediately (default true). */
+    autoStart?: boolean;
+    /** Injectable clock for deterministic tests. */
+    now?: () => Date;
+    /** Injectable sleep for deterministic tests. */
+    sleep?: (ms: number) => Promise<void>;
+    /** Observes swallowed tick errors; the loop keeps running regardless. */
+    onError?: (error: unknown) => void;
+}
+interface ModelEndpointRegistrarHandle {
+    /** Run one registration + heartbeat pass (serialized with the loop). */
+    refresh(): Promise<void>;
+    /** Stop the loop and mark owned endpoints unhealthy (best-effort). */
+    stop(): Promise<void>;
+}
+declare function createModelEndpointRegistrar(store: ControlStore, driver: ModelProviderDriver, options: ModelEndpointRegistrarOptions): ModelEndpointRegistrarHandle;
+
+/**
+ * Condition type raised on a ToolOperation whose executor crashed or
+ * disconnected after a side effect may have occurred. While this condition is
+ * `True`, controllers must follow the recorded reconciliation decision instead
+ * of blindly repeating the operation.
+ */
+declare const TOOL_OPERATION_CONDITION_EFFECT_UNKNOWN = "EffectUnknown";
+/**
+ * Evidence gathered by driver/controller inspection after an executor crash or
+ * disconnect. Evidence is produced by the trusted side (driver checkpoints,
+ * verifier probes, artifact records), never by the possibly-failed executor's
+ * own claim alone.
+ */
+interface UnknownEffectEvidence {
+    /**
+     * The executor produced a result before the disconnect and only the
+     * completion acknowledgement was lost. The caller is responsible for
+     * attaching the observed result when applying the decision.
+     */
+    resultObserved?: boolean;
+    /** Reference to independent verification evidence (artifact, verifier run). */
+    evidenceRef?: string;
+    /** ISO timestamp of the observed disconnect/crash. */
+    disconnectedAt?: string;
+}
+type UnknownEffectAction = 'retry' | 'succeeded' | 'verification-required' | 'manual-intervention';
+interface UnknownEffectDecision {
+    action: UnknownEffectAction;
+    reason: string;
+}
+/**
+ * Decide how to reconcile an operation whose effect is unknown. The decision
+ * never blindly repeats destructive work:
+ *
+ * 1. An observed result means only the ack was lost → `succeeded`.
+ * 2. `read` effects have no side effects → `retry` (within attempt budget).
+ * 3. `retry.nonRetryable` operations are never repeated → `manual-intervention`.
+ * 4. Operations with an `idempotencyKey` dedupe at the executor/store, so a
+ *    repeated delivery is safe → `retry` (within attempt budget).
+ * 5. Everything else requires independent verification before any retry →
+ *    `verification-required`.
+ */
+declare function reconcileUnknownEffect(operation: ToolOperationResource, evidence: UnknownEffectEvidence): UnknownEffectDecision;
+/**
+ * Apply a reconciliation decision to an operation, producing the next status:
+ *
+ * - `retry` → back to `Pending` (requeue) with the EffectUnknown condition.
+ * - `succeeded` → `Completed` (caller attaches the observed result separately).
+ * - `verification-required` / `manual-intervention` → stays `Running` with the
+ *   EffectUnknown condition; the operation is not repeated until a verifier or
+ *   operator clears the condition.
+ */
+declare function applyUnknownEffectDecision(operation: ToolOperationResource, decision: UnknownEffectDecision, at?: string): ToolOperationResource;
+
+interface RegisteredExternalOrchestrationDriver {
+    name: string;
+    driver: ExternalOrchestrationDriver;
+    capabilities: ExternalDriverCapabilities;
+}
+interface ExternalOrchestrationControllerOptions {
+    actor: ControlStoreActor;
+    drivers: RegisteredExternalOrchestrationDriver[];
+    pollIntervalMs?: number;
+    statusWriteAttempts?: number;
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => Date;
+    /** Resolve admitted script content without persisting it in ControlStore. */
+    resolveScriptSource?: (scriptReference: string) => Promise<string | undefined>;
+    /** Create a short-lived, single-use bootstrap secret at placement time. */
+    createWorkerBootstrap?: (workload: AgentWorkloadResource, runReference: OrchestrationResourceReference) => Promise<ExternalWorkerBootstrapSecret | undefined>;
+    /**
+     * Host-bound policy/approval authority for external tool effects. The
+     * controller fails closed when this hook is absent.
+     */
+    authorizeToolOperation?: (operation: ToolOperationResource, signal?: AbortSignal) => Promise<{
+        approval?: NonNullable<ToolOperationStatus['approval']>;
+    }>;
+    /**
+     * Host-bound admission for external workload placement. The returned
+     * durable decision identity is persisted before the native side effect.
+     */
+    authorizeWorkloadPlacement?: (workload: AgentWorkloadResource, driver: RegisteredExternalOrchestrationDriver, signal?: AbortSignal) => Promise<{
+        decisionHandle: string;
+        policyDigest: string;
+    }>;
+    onError?: (error: unknown) => void;
+}
+interface ExternalOrchestrationControllerHandle {
+    stop(): Promise<void>;
+}
+/**
+ * Reconcile explicitly external AgentWorkloads and ToolOperations through
+ * registered optional drivers. Placement identity is persisted before status
+ * polling, so controller restart adopts the native resource rather than
+ * creating a second effect. Driver implementations must make placement
+ * idempotent by MemeLoop resource UID.
+ */
+declare function createExternalOrchestrationController(store: ControlStore, options: ExternalOrchestrationControllerOptions): ExternalOrchestrationControllerHandle;
+
+interface ModelEndpointBindingControllerOptions {
+    actor: ControlStoreActor;
+    getWorkload(run: AgentRunResource): Promise<AgentWorkloadResource | null>;
+    listEndpoints(): Promise<ModelEndpointResource[]>;
+    getModelClass(endpoint: ModelEndpointResource): Promise<ModelClassResource | null>;
+    /** Existing bindings used as conservative live capacity reservations. */
+    listRuns?: () => Promise<AgentRunResource[]>;
+    /** Maximum endpoint heartbeat age accepted for placement (default 90s). */
+    endpointHeartbeatTtlMs?: number;
+    /** Clock used only for the persisted binding timestamp. */
+    now?: () => Date;
+}
+/**
+ * Independently binds a Pending AgentRun to a live ModelEndpoint. The
+ * controller re-evaluates every hard policy requirement itself and persists
+ * the lease epoch before workload execution may consume the endpoint.
+ */
+declare function createModelEndpointBindingController(options: ModelEndpointBindingControllerOptions): Controller<AgentRunResource['spec']>;
+
+interface NetworkAttachmentNode {
+    nodeId: string;
+    healthy: boolean;
+    capabilities: NetworkDriverCapabilities[];
+    /** Conservative number of attachments not yet reflected by the driver. */
+    activeAttachments?: number;
+    maxAttachments?: number;
+}
+interface NetworkAttachmentBindingControllerOptions {
+    getNetworkClass(attachment: NetworkAttachmentResource): Promise<NetworkClassResource | null>;
+    getWorkload?(attachment: NetworkAttachmentResource): Promise<AgentWorkloadResource | null>;
+    listNodes(): Promise<NetworkAttachmentNode[]>;
+    now?: () => Date;
+}
+/**
+ * Selects the node-local NetworkDriver independently from workload execution.
+ * NetworkClass capability checks are hard filters; best-effort degradation is
+ * allowed only when the class itself explicitly opts into it.
+ */
+declare function createNetworkAttachmentBindingController(options: NetworkAttachmentBindingControllerOptions): Controller<NetworkAttachmentResource['spec']>;
+interface NetworkAttachmentExecutionControllerOptions {
+    nodeId: string;
+    getNetworkClass(attachment: NetworkAttachmentResource): Promise<NetworkClassResource | null>;
+    getDriver(name: string): Promise<NetworkDriver | undefined>;
+    sandboxRef?(attachment: NetworkAttachmentResource): Promise<string>;
+    managed?: {
+        getDriver(name: string): Promise<NetworkManagementDriver | undefined>;
+        createPrepareRequest(input: {
+            attachment: NetworkAttachmentResource;
+            networkClass: NetworkClassResource;
+            sandboxHandle: string;
+            actor: Parameters<Controller['reconcile']>[0]['actor'];
+            leaseEpoch: string;
+        }): Promise<DriverRequestEnvelope<NetworkPreparePayload>>;
+        createReleaseRequest(input: {
+            attachment: NetworkAttachmentResource;
+            networkHandle: string;
+            actor: Parameters<Controller['reconcile']>[0]['actor'];
+            leaseEpoch: string;
+        }): Promise<DriverRequestEnvelope<{
+            networkHandle: string;
+        }>>;
+    };
+    now?: () => Date;
+}
+/**
+ * Executes a bound attachment on its selected node. prepare() implementations
+ * must be idempotent for an attachment UID. The persisted Preparing claim
+ * prevents a new controller epoch from repeating a possibly completed effect.
+ */
+declare function createNetworkAttachmentExecutionController(options: NetworkAttachmentExecutionControllerOptions): Controller<NetworkAttachmentResource['spec']>;
+
+interface RunVolumeControllerOptions {
+    nodeId: string;
+    getWorkload(run: AgentRunResource): Promise<AgentWorkloadResource | null>;
+    getClaim(name: string, namespace?: string): Promise<AgentVolumeClaimResource | null>;
+    getVolume(claim: AgentVolumeClaimResource): Promise<AgentVolumeResource | null>;
+    getDriver(name: string): Promise<StorageDriver | undefined>;
+    managed?: {
+        getDriver(name: string): Promise<StorageManagementDriver | undefined>;
+        createStageRequest(input: {
+            run: AgentRunResource;
+            volume: AgentVolumeResource;
+            nodeId: string;
+            actor: Parameters<Controller['reconcile']>[0]['actor'];
+            leaseEpoch: string;
+        }): Promise<DriverRequestEnvelope<{
+            volumeHandle: string;
+            nodeId: string;
+        }>>;
+        createPublishRequest(input: {
+            run: AgentRunResource;
+            stageHandle: string;
+            workloadUid: string;
+            readOnly: boolean;
+            actor: Parameters<Controller['reconcile']>[0]['actor'];
+            leaseEpoch: string;
+        }): Promise<DriverRequestEnvelope<{
+            stageHandle: string;
+            workloadUid: string;
+            readOnly: boolean;
+        }>>;
+        createUnpublishRequest(input: {
+            run: AgentRunResource;
+            publishHandle: string;
+            actor: Parameters<Controller['reconcile']>[0]['actor'];
+            leaseEpoch: string;
+        }): Promise<DriverRequestEnvelope<{
+            publishHandle: string;
+        }>>;
+        createUnstageRequest(input: {
+            run: AgentRunResource;
+            stageHandle: string;
+            actor: Parameters<Controller['reconcile']>[0]['actor'];
+            leaseEpoch: string;
+        }): Promise<DriverRequestEnvelope<{
+            stageHandle: string;
+        }>>;
+    };
+    recordPublished?(volume: AgentVolumeResource, workload: AgentWorkloadResource, nodeId: string): Promise<void>;
+    recordUnpublished?(volume: AgentVolumeResource, workload: AgentWorkloadResource, nodeId: string): Promise<void>;
+    now?: () => Date;
+}
+/** Publishes independently provisioned claims to a bound Run's workload node. */
+declare function createRunVolumeController(options: RunVolumeControllerOptions): Controller<AgentRunResource['spec']>;
+
+interface SchedulerNode {
+    name: string;
+    trustClass: NodeTrustClass;
+    faultDomain: string;
+    /** Explicit false removes the node from scheduling immediately. */
+    healthy?: boolean;
+    /** When reported, the node must include `worker` to accept workloads. */
+    roles?: string[];
+    /** Trusted verifier assessment, never a worker self-report. */
+    attested?: boolean;
+    /** Host registry confirms every selected driver has passing conformance evidence. */
+    driverConformancePassed?: boolean;
+    capacity?: {
+        cpuMillicores?: number;
+        memoryBytes?: number;
+        gpuCount?: number;
+        diskBytes?: number;
+        bandwidthKbps?: number;
+    };
+    labels?: Record<string, string>;
+    /** Taints that repel workloads unless they explicitly tolerate them. */
+    taints?: string[];
+    /**
+     * Maximum data classification this node is allowed to process.
+     * Defaults to 'restricted' for trusted, 'internal' for restricted, 'public' for quarantine.
+     */
+    maxDataClassification?: DataClassification;
+    /** Residency labels in which this node may process data. */
+    dataResidency?: string[];
+    /** Runtime classes backed by an admitted runtime driver on this node. */
+    availableRuntimeClasses?: string[];
+    /** Healthy tool executor classes available on this node. */
+    availableToolClasses?: string[];
+    /** Available model endpoints on this node (by model class name). */
+    availableModelClasses?: string[];
+    /** Network classes and the boundary/egress modes they can enforce. */
+    networkCapabilities?: Array<{
+        networkClass: string;
+        enforcementLevel: 'none' | 'process' | 'namespace' | 'host' | 'external';
+        egress?: Array<'none' | 'same-node' | 'restricted' | 'open'>;
+    }>;
+    /** Storage classes provisionable or publishable on this node. */
+    availableStorageClasses?: string[];
+    /** Existing claims local/publishable to this node. */
+    availableVolumeClaims?: string[];
+    /** Credential broker capabilities; these are policy metadata, never handles. */
+    credentialCapabilities?: Array<{
+        brokerClass: string;
+        audiences?: string[];
+        targets?: string[];
+    }>;
+    /** Content-addressed data already present on this node, used only for scoring. */
+    localArtifactReferences?: string[];
+    localCheckpointReferences?: string[];
+    /** Active target count for each rollout batch on this fault domain. */
+    rolloutLoad?: Record<string, number>;
+    /** Spare concurrency slots. */
+    spareConcurrency?: number;
+}
+interface SchedulingDecision {
+    nodeName: string;
+    score: number;
+    reasons: string[];
+}
+interface Scheduler {
+    schedule(workload: AgentWorkloadResource, nodes: SchedulerNode[]): SchedulingDecision | null;
+}
+interface BindingControllerOptions {
+    actor: ControlStoreActor;
+    scheduler: Scheduler;
+    listNodes: () => Promise<SchedulerNode[]>;
+    authorizePlacement?(input: {
+        workload: AgentWorkloadResource;
+        node: SchedulerNode;
+        actor: ControlStoreActor;
+        leaseEpoch: string;
+    }): Promise<{
+        outcome: 'allow' | 'deny';
+        decisionHandle: string;
+        policyDigest: string;
+        reasons: string[];
+    }>;
+}
+/**
+ * Create a controller that binds AgentWorkloads to Nodes.
+ *
+ * The controller watches AgentWorkloads in Pending phase, runs the scheduler
+ * to select a node, and updates the workload status with the binding through
+ * ControlStore CAS. The lease epoch is included in the status update for
+ * fencing.
+ *
+ * Per §7.2 and §23, restricted nodes are the preferred fleet-worker class and
+ * are allowed for ordinary worker workloads. Only quarantine-designated
+ * workloads may run on quarantine nodes.
+ */
+declare function createBindingController(_store: ControlStore, options: BindingControllerOptions): Controller<AgentWorkloadResource['spec']>;
+/**
+ * Capacity scheduler with trust, data-classification, taint/toleration,
+ * model-capability, and anti-affinity filters.
+ *
+ * Trust filtering (§7.2, §23):
+ * - Restricted nodes are allowed for ordinary/restricted workloads.
+ * - Quarantine nodes are only candidates for quarantine-designated workloads.
+ * - Trusted nodes are always eligible (unless filtered by other criteria).
+ *
+ * Data classification filtering:
+ * - Workloads with sensitive data are not scheduled on nodes whose
+ *   `maxDataClassification` is lower than the workload's classification.
+ * - Quarantine nodes default to `public`-only.
+ *
+ * Scoring favors trusted nodes, higher capacity, and data locality.
+ */
+declare function createCapacityScheduler(): Scheduler;
+
+/**
+ * Enforce AuditRecord append-only semantics in the protected ControlStore
+ * write transaction. Only the actor stamped into immutable evidence may
+ * create it; no status, apply, delete, or resource lease mutation is valid.
+ */
+declare function createAuditRecordAuthorizer(): (request: ControlStoreAuthorizationRequest) => void;
+
+type IdentityRevocationReason = 'security-incident' | 'credential-rotation' | 'policy-violation' | 'manual';
+interface IdentityRevocationRecord {
+    enrollmentName: string;
+    sessionNames: string[];
+    reason: IdentityRevocationReason;
+    revokedBy: string;
+    revokedAt: string;
+    evidence?: string;
+}
+interface IdentityPromotionRequest {
+    /** The quarantine enrollment to promote from. */
+    sourceEnrollmentName: string;
+    /** New trust class for the promoted identity. */
+    targetTrustClass: 'trusted' | 'restricted';
+    /** Evidence from trusted verification (e.g. reimage attestation). */
+    verificationEvidence: string;
+    /** Verifier actor ID that performed the verification. */
+    verifiedBy: string;
+    /** Approval actor ID that authorized the promotion. */
+    approvedBy: string;
+}
+/**
+ * Permanently revoke a quarantine identity and all its sessions.
+ * Once revoked, the identity cannot be re-enabled; promotion requires
+ * creating a new enrollment through trusted verification.
+ */
+declare function revokeQuarantineIdentity(store: ControlStore, actor: ControlStoreActor, enrollmentName: string, reason: IdentityRevocationReason, evidence?: string, now?: () => Date): Promise<IdentityRevocationRecord>;
+/**
+ * Promote a quarantine identity to a new ordinary identity after trusted
+ * verification. The old quarantine enrollment is permanently revoked, and a
+ * new enrollment is created with the target trust class.
+ */
+declare function promoteIdentity(store: ControlStore, actor: ControlStoreActor, request: IdentityPromotionRequest, now?: () => Date): Promise<WorkerEnrollmentResource>;
+/**
+ * Check whether an identity is permanently revoked.
+ */
+declare function isIdentityRevoked(store: ControlStore, enrollmentName: string): Promise<boolean>;
+
+declare const NODE_API_VERSION = "memeloop/v1";
+declare const NODE_KIND = "Node";
+interface NodeSpec {
+    nodeId: string;
+    faultDomain: string;
+    capacity?: {
+        cpuMillicores?: number;
+        memoryBytes?: number;
+        gpuCount?: number;
+    };
+    labels?: Record<string, string>;
+}
+interface NodeStatus {
+    trustClass: NodeTrustClass;
+    trustEvidence?: string;
+    trustVerifiedBy?: string;
+    trustVerifiedAt?: string;
+    conditions?: Array<{
+        type: string;
+        status: 'True' | 'False' | 'Unknown';
+        reason: string;
+        lastTransitionTime: string;
+    }>;
+}
+/**
+ * Create a ControlStore authorizer that enforces immutable Node trust admission.
+ *
+ * Rules:
+ * 1. Node trustClass can only be set at creation time in spec.
+ * 2. After creation, trustClass can only be changed by a verifier actor
+ *    providing signed evidence, and only through status updates.
+ * 3. A node cannot modify its own trustClass.
+ * 4. Restricted/quarantine nodes cannot acquire leases for forbidden roles.
+ * 5. Any attempt to use a self-report or label update to change trustClass
+ *    is rejected.
+ */
+declare function createNodeTrustAuthorizer(): (request: ControlStoreAuthorizationRequest) => void;
+/**
+ * Validate that a Node resource's spec does not attempt to self-assert
+ * trust status through labels or annotations.
+ */
+declare function validateNodeSpec(spec: NodeSpec): void;
+/**
+ * Check whether a node with the given trust class is allowed to perform
+ * a sensitive role. This is a pure function for use by schedulers and
+ * admission controllers outside the ControlStore authorizer.
+ */
+declare function isNodeAllowedForRole(trustClass: NodeTrustClass, role: string): boolean;
+
+/**
+ * Protect durable PolicyDecision evidence in the same ControlStore
+ * transaction as its write. Decisions are create-only; only an authenticated
+ * admin may resolve the status of a pending approval.
+ */
+declare function createPolicyDecisionAuthorizer(): (request: ControlStoreAuthorizationRequest) => void;
+
+/**
+ * Quarantine gateway request mediation (plan 24.40).
+ *
+ * All checks run on the trusted gateway side, outside worker control. The
+ * gateway is the worker's only network endpoint — it never receives ordinary
+ * peer topology, sync, or device-directory access through this channel. Every
+ * outbound request is validated for method, scheme, port, host allowlist,
+ * SSRF (literal and DNS-resolved private addresses), redirect targets, body
+ * size, per-method limits, and per-worker rate limits; revoked workers are
+ * rejected before any validation.
+ */
+interface QuarantineGatewayPolicy {
+    /** Allowed HTTP methods (default GET/HEAD/POST). */
+    allowedMethods?: string[];
+    /** Allowed URL schemes (default ['https']). */
+    allowedSchemes?: string[];
+    /** Allowed ports (default [443]). */
+    allowedPorts?: number[];
+    /** Hostname suffix allowlist; when set, only matching hosts pass. */
+    allowedHosts?: string[];
+    /** Allow private/loopback/link-local targets (default false — SSRF blocked). */
+    allowPrivateNetworks?: boolean;
+    /** Maximum followed redirects, each re-validated (default 0). */
+    maxRedirects?: number;
+    /** Global request body cap in bytes (default 1 MiB). */
+    maxBodyBytes?: number;
+    /** Per-method overrides. */
+    methodLimits?: Record<string, {
+        maxBodyBytes?: number;
+        requestsPerMinute?: number;
+    }>;
+    /** Default per-worker+method rate limit (default 60/minute). */
+    defaultRateLimitPerMinute?: number;
+    /** Response body cap in bytes for the executor (default 8 MiB). */
+    maxResponseBytes?: number;
+}
+interface GatewayHttpRequest {
+    workerId: string;
+    method: string;
+    url: string;
+    /** Declared request body size in bytes (0/undefined for bodyless). */
+    bodyBytes?: number;
+}
+interface GatewayValidationContext {
+    /** Injected DNS resolver returning IP literals for a hostname. */
+    resolveHostname?: (hostname: string) => Promise<string[]>;
+    /** Trusted revocation check for worker sessions. */
+    isRevoked?: (workerId: string) => boolean;
+    /** Rate limiter state; one shared limiter per gateway. */
+    rateLimiter?: GatewayRateLimiter;
+    now?: () => number;
+}
+type GatewayValidationResult = {
+    ok: true;
+    normalizedUrl: string;
+    hostname: string;
+    addresses: string[];
+} | {
+    ok: false;
+    error: OrchestrationErrorData;
+};
+/** True when the IP literal is loopback, private, link-local, or otherwise non-public. */
+declare function isPrivateIp(address: string): boolean;
+interface GatewayRateLimiter {
+    /** True when the request is within budget; false when limited. */
+    consume(key: string, perMinute: number): boolean;
+}
+/** Token-bucket rate limiter with an injectable clock (trusted-side state). */
+declare function createGatewayRateLimiter(now?: () => number): GatewayRateLimiter;
+/** Revocation list for quarantine worker sessions (trusted-side state). */
+declare function createWorkerRevocationList(): {
+    revoke(workerId: string): void;
+    isRevoked(workerId: string): boolean;
+};
+/**
+ * Validate one gateway request. Order matters: revocation first, then cheap
+ * syntactic checks, then SSRF (literal before DNS), then rate limits, so a
+ * revoked or malformed request never costs a DNS lookup.
+ */
+declare function validateGatewayRequest(request: GatewayHttpRequest, policy: QuarantineGatewayPolicy, context?: GatewayValidationContext): Promise<GatewayValidationResult>;
+/** Validate a redirect target with the same policy; redirect chains are bounded by the caller. */
+declare function validateRedirectTarget(request: Omit<GatewayHttpRequest, 'method' | 'bodyBytes'> & {
+    method?: string;
+}, location: string, policy: QuarantineGatewayPolicy, context?: GatewayValidationContext): Promise<GatewayValidationResult>;
+
+/**
+ * Secret redaction for logs, status, checkpoints, and crash diagnostics.
+ *
+ * Hosts must run any value through `redactSecrets` before it crosses into
+ * persistent or observable surfaces. Redaction covers both secret-shaped keys
+ * (apiKey, authorization, ...) and secret-shaped values (provider key formats,
+ * model access handles). Redaction is best-effort defense in depth — the
+ * primary guarantee comes from never passing secrets to untrusted contexts in
+ * the first place.
+ */
+interface SecretRedactionOptions {
+    /** Extra key-name patterns treated as secret. */
+    additionalKeyPatterns?: RegExp[];
+    /** Extra value patterns treated as secret. */
+    additionalValuePatterns?: RegExp[];
+    /** Replacement text (default `[REDACTED]`). */
+    replacement?: string;
+}
+/**
+ * Deep-clone `value` with secrets masked. Secret-shaped keys are replaced
+ * wholesale; strings are scanned for secret-shaped values. Handles Map/Set
+ * via their entries; class instances are traversed as plain objects.
+ */
+declare function redactSecrets<T>(value: T, options?: SecretRedactionOptions): T;
+/**
+ * True when the value contains a secret-shaped key or value. Useful as a
+ * final assertion before persisting worker-visible artifacts.
+ */
+declare function containsSecrets(value: unknown, options?: SecretRedactionOptions): boolean;
+
+declare const WORKLOAD_CAPABILITY_GRANT_API_VERSION = "security.memeloop.io/v1alpha1";
+declare const WORKLOAD_CAPABILITY_GRANT_KIND = "WorkloadCapabilityGrant";
+interface WorkloadCapabilityBudget {
+    maxRequests: number;
+    maxInputBytes?: number;
+    maxOutputBytes?: number;
+    maxTokens?: number;
+    maxCost?: number;
+}
+interface WorkloadCapabilityGrantSpec {
+    /** Stable identity included in the signed claims; must equal metadata.name. */
+    grantId: string;
+    sessionRef: {
+        apiVersion: string;
+        kind: 'WorkerSession';
+        name: string;
+    };
+    run: WorkerRunBinding;
+    workerKeyFingerprint: string;
+    /** Pinned gateway/channel identity, never a worker-provided label. */
+    channelBinding: string;
+    audience: string;
+    protocol: string;
+    protocolMethod: WorkerProtocolMethod;
+    capability: string;
+    target: string;
+    policyDigest: string;
+    budget: WorkloadCapabilityBudget;
+    issuedAt: string;
+    expiresAt: string;
+    issuedBy: string;
+    /** Gateway signature over canonicalWorkloadCapabilityGrantBytes(spec). */
+    signature: string;
+}
+interface WorkloadCapabilityGrantStatus extends OrchestrationResourceStatus {
+    phase?: 'Authorized' | 'Consumed' | 'Revoked' | 'Expired' | 'Failed';
+    consumedAt?: string;
+    revokedAt?: string;
+    reason?: string;
+}
+type WorkloadCapabilityGrantResource = Omit<OrchestrationResource<WorkloadCapabilityGrantSpec>, 'status'> & {
+    status?: WorkloadCapabilityGrantStatus;
+};
+interface IssueWorkloadCapabilityGrantRequest {
+    grantId: string;
+    session: WorkerGatewaySession;
+    channelBinding: string;
+    protocolMethod: WorkerProtocolMethod;
+    capability: string;
+    target: string;
+    budget: WorkloadCapabilityBudget;
+    ttlMs: number;
+}
+interface WorkloadCapabilityGrantRequirements {
+    grantId: string;
+    sessionName: string;
+    run: WorkerRunBinding;
+    workerKeyFingerprint: string;
+    channelBinding: string;
+    audience: string;
+    protocol: string;
+    protocolMethod: WorkerProtocolMethod;
+    capability: string;
+    target: string;
+    policyDigest: string;
+}
+declare function canonicalWorkloadCapabilityGrantBytes(spec: WorkloadCapabilityGrantSpec | Omit<WorkloadCapabilityGrantSpec, 'signature'>): Uint8Array;
+declare function createWorkloadCapabilityGrantManifest(name: string, spec: WorkloadCapabilityGrantSpec): {
+    apiVersion: typeof WORKLOAD_CAPABILITY_GRANT_API_VERSION;
+    kind: typeof WORKLOAD_CAPABILITY_GRANT_KIND;
+    metadata: {
+        name: string;
+    };
+    spec: WorkloadCapabilityGrantSpec;
+};
+declare function isWorkloadCapabilityGrant(resource: {
+    apiVersion?: string;
+    kind?: string;
+}): resource is WorkloadCapabilityGrantResource;
+/** Issue and durably record one host-authorized capability grant. */
+declare function issueWorkloadCapabilityGrant(store: ControlStore, actor: ControlStoreActor, request: IssueWorkloadCapabilityGrantRequest, sign: (message: Uint8Array) => Promise<string> | string, now?: () => Date): Promise<WorkloadCapabilityGrantResource>;
+/** Verify signature, expiry, lifecycle, and every authority-bearing claim. */
+declare function verifyWorkloadCapabilityGrant(grant: WorkloadCapabilityGrantResource, requirements: WorkloadCapabilityGrantRequirements, verify: (message: Uint8Array, signature: string) => Promise<boolean> | boolean, now?: () => Date): Promise<void>;
+/** Atomically consume a single-use grant before invoking the capability. */
+declare function consumeWorkloadCapabilityGrant(store: ControlStore, actor: ControlStoreActor, grant: WorkloadCapabilityGrantResource, now?: () => Date): Promise<WorkloadCapabilityGrantResource>;
+
+interface QuorumMember {
+    id: string;
+    peerUrls: string[];
+    isLearner: boolean;
+}
+interface QuorumTopology {
+    members: QuorumMember[];
+    leaderId?: string;
+    term: number;
+}
+/**
+ * Serializable point-in-time state of a QuorumControlStore. Portable core
+ * cannot write files, so persistence flows through `exportSnapshot()` /
+ * `restoreSnapshot()`; the host decides where bytes live. Live leases and
+ * their timers are ephemeral and intentionally excluded; per-name fencing
+ * epochs are preserved so a restored store never re-issues epoch 1.
+ */
+interface QuorumControlStoreSnapshot {
+    revision: number;
+    compactedRevision?: number;
+    term: number;
+    voters: string[];
+    learners: string[];
+    quorumSize: number;
+    leaseEpochs: Record<string, number>;
+    resources: Array<{
+        key: string;
+        resource: OrchestrationResource;
+        revision: number;
+        deleted: boolean;
+    }>;
+    idempotency?: Array<{
+        key: string;
+        requestDigest: string;
+        response: unknown;
+    }>;
+    watchEvents?: Array<{
+        key: string;
+        event: OrchestrationResourceWatchEvent;
+    }>;
+    createdAt: string;
+}
+interface QuorumControlStoreOptions {
+    memberId: string;
+    isLearner?: boolean;
+    authorizer?: ControlStoreAuthorizer;
+    quorumSize?: number;
+    voters?: string[];
+    /** Retained resumable resource events before automatic compaction. */
+    maxWatchEvents?: number;
+}
+/**
+ * In-process quorum ControlStore (plan 24.59).
+ *
+ * Implements full ControlStore semantics: multi-voter consensus, learner
+ * replication, CAS updates, lease management with epochs, watch subscriptions
+ * with revision tracking, compaction, and snapshot. Loss-of-quorum writes
+ * are rejected with UNAVAILABLE.
+ *
+ * A production etcd-backed adapter is planned as a separate package.
+ */
+declare class QuorumControlStore implements ControlStore {
+    private isLearner;
+    private readonly authorizer?;
+    private quorumSize;
+    private readonly voters;
+    private readonly learners;
+    private readonly memberId;
+    private readonly data;
+    private readonly idempotency;
+    private revision;
+    private readonly leases;
+    /** Monotonic fencing epoch per lease name; survives release/expiry and restore. */
+    private readonly leaseEpochs;
+    private readonly watchers;
+    private watcherIdSeq;
+    private readonly watchHistory;
+    private compactedRevision;
+    private readonly maxWatchEvents;
+    private readonly leaseTimers;
+    private closed;
+    private term;
+    constructor(options: QuorumControlStoreOptions);
+    private nextRevision;
+    private manifestKey;
+    private refKey;
+    private queryPrefix;
+    private matchQuery;
+    private checkQuorum;
+    private notify;
+    get<TSpec, TStatus>(reference: OrchestrationResourceReference): Promise<OrchestrationResource<TSpec, TStatus> | null>;
+    list<TSpec, TStatus>(query: OrchestrationResourceQuery): Promise<OrchestrationResourceList<TSpec, TStatus>>;
+    watch<TSpec, TStatus>(query: OrchestrationResourceQuery, options?: OrchestrationWatchOptions): AsyncIterable<OrchestrationWatchEvent<TSpec, TStatus>>;
+    create<TSpec, TStatus>(actor: ControlStoreActor, resource: OrchestrationResourceManifest<TSpec>, options?: ControlStoreCreateOptions): Promise<OrchestrationResource<TSpec, TStatus>>;
+    apply<TSpec, TStatus>(actor: ControlStoreActor, resource: OrchestrationResourceManifest<TSpec>, options?: ControlStoreApplyOptions): Promise<OrchestrationResource<TSpec, TStatus>>;
+    updateStatus<TSpec, TStatus>(actor: ControlStoreActor, reference: OrchestrationResourceReference, status: TStatus, options: ControlStoreStatusUpdateOptions): Promise<OrchestrationResource<TSpec, TStatus>>;
+    delete(actor: ControlStoreActor, reference: OrchestrationResourceReference, options?: OrchestrationDeleteOptions): Promise<OrchestrationDeleteResult>;
+    acquireLease(actor: ControlStoreActor, request: ControlLeaseRequest): Promise<ControlLeaseGrant>;
+    renewLease(actor: ControlStoreActor, id: ControlLeaseIdentity, ttlMs: number): Promise<ControlLeaseGrant>;
+    releaseLease(actor: ControlStoreActor, id: ControlLeaseIdentity): Promise<void>;
+    compact(throughResourceVersion: string): Promise<ControlStoreCompactionResult>;
+    snapshot(_targetPath: string): Promise<ControlStoreSnapshotResult>;
+    /** Serialize the full store state. Excludes live leases/timers; preserves fencing epochs. */
+    exportSnapshot(): QuorumControlStoreSnapshot;
+    /** Replace the store state with a snapshot previously produced by exportSnapshot(). */
+    restoreSnapshot(snapshot: QuorumControlStoreSnapshot): void;
+    getHealth(): Promise<ControlStoreHealth>;
+    close(): Promise<void>;
+    getTopology(): Promise<QuorumTopology>;
+    /** Recompute quorum as a majority of the current voter set (etcd semantics). */
+    private recomputeQuorum;
+    private leaseReference;
+    addVoter(m: QuorumMember): Promise<void>;
+    removeVoter(id: string): Promise<void>;
+    /**
+     * Add an observer that receives no vote and does not count toward quorum
+     * (§17.3: a second node starts as observer, never a fragile two-voter
+     * configuration; promotion is an explicit later step).
+     */
+    addLearner(m: QuorumMember): Promise<void>;
+    removeLearner(id: string): Promise<void>;
+    promoteLearner(id: string): Promise<void>;
+    private expireLease;
+    private clearLeaseTimer;
+}
+
+interface ToolExecutorSelection {
+    executor: ToolExecutorResource;
+    nodeId: string;
+    score: number;
+    reasons: string[];
+}
+/** Select a healthy, schema-compatible executor without loading its implementation. */
+declare function selectToolExecutor(operation: ToolOperationResource, executors: ToolExecutorResource[]): ToolExecutorSelection | null;
+interface ToolOperationBindingControllerOptions {
+    actor: ControlStoreActor;
+    listExecutors: () => Promise<ToolExecutorResource[]>;
+    retryAfterMs?: number;
+}
+/**
+ * Independently bind pending ToolOperations to declarative ToolExecutors.
+ * Explicit external-orchestrator operations remain owned by that controller.
+ */
+declare function createToolOperationBindingController(options: ToolOperationBindingControllerOptions): Controller<ToolOperationResource['spec']>;
+interface ToolOperationExecutionControllerOptions {
+    actor: ControlStoreActor;
+    nodeId: string;
+    driver: ToolExecutionDriver;
+}
+interface ToolOperationExecutionController extends Controller<ToolOperationResource['spec']> {
+    /** Cooperatively abort one currently executing operation. */
+    cancel(operation: Pick<ToolOperationResource, 'metadata'>): boolean;
+    /** Abort all local effects during runtime shutdown. */
+    cancelAll(): number;
+    /** Diagnostic count only; no operation inputs/results are exposed. */
+    activeCount(): number;
+}
+/**
+ * Execute operations assigned to one node. Claiming and effect execution are
+ * deliberately separate reconciles so the claim is durable before any side
+ * effect starts.
+ */
+declare function createToolOperationExecutionController(options: ToolOperationExecutionControllerOptions): ToolOperationExecutionController;
+
+interface StorageDriverEndpoint {
+    nodeId: string;
+    healthy: boolean;
+    capabilities: StorageDriverCapabilities[];
+    trust: NodeTrustClass;
+    labels?: Record<string, string>;
+    activeVolumes?: number;
+    maxVolumes?: number;
+    availableBytes?: number;
+}
+interface VolumeClaimBindingControllerOptions {
+    getStorageClass(claim: AgentVolumeClaimResource): Promise<StorageClassResource | null>;
+    listDrivers(): Promise<StorageDriverEndpoint[]>;
+    requiredNodeForClaim?(claim: AgentVolumeClaimResource): Promise<string | undefined>;
+    now?: () => Date;
+}
+/** Independently binds a claim to a healthy provisioner endpoint. */
+declare function createVolumeClaimBindingController(options: VolumeClaimBindingControllerOptions): Controller<AgentVolumeClaimResource['spec']>;
+interface VolumeClaimExecutionControllerOptions {
+    nodeId: string;
+    getStorageClass(claim: AgentVolumeClaimResource): Promise<StorageClassResource | null>;
+    getDriver(name: string): Promise<StorageDriver | undefined>;
+    managed?: {
+        getDriver(name: string): Promise<StorageManagementDriver | undefined>;
+        createProvisionRequest(input: {
+            claim: AgentVolumeClaimResource;
+            storageClass: StorageClassResource;
+            actor: Parameters<Controller['reconcile']>[0]['actor'];
+            leaseEpoch: string;
+        }): Promise<DriverRequestEnvelope<StorageProvisionPayload>>;
+    };
+    ensureVolume(claim: AgentVolumeClaimResource, storageClass: StorageClassResource, provisioned: StorageProvisionResult): Promise<AgentVolumeResource>;
+    now?: () => Date;
+}
+/** Persists a fencing claim before idempotent volume provisioning. */
+declare function createVolumeClaimExecutionController(options: VolumeClaimExecutionControllerOptions): Controller<AgentVolumeClaimResource['spec']>;
+
+/**
+ * Workload execution controller (Phase 4.2 / plan 24.14).
+ *
+ * Watches AgentWorkloads, and for each one the binding controller (24.56)
+ * has scheduled onto THIS node (`status.phase === 'Scheduling'` with
+ * `status.assignedNode === nodeId`), creates an AgentRun and executes it
+ * through the injected LoopRuntimeDriver. Terminal outcomes are written to
+ * both the run and the workload. Deleting a running workload cancels its
+ * execution. Executions on other nodes are ignored — remote nodes run their
+ * own controller instance.
+ */
+interface WorkloadExecutionControllerOptions {
+    /** Host-bound actor identity for all ControlStore writes. */
+    actor: ControlStoreActor;
+    /** Only execute workloads bound to this node name. */
+    nodeId: string;
+    /** Stable only for this daemon lifetime; changes after restart. */
+    controllerInstanceId?: string;
+    /** Resolve a `spec.scriptReference` (content digest) to admitted source. */
+    resolveScriptSource?: (scriptReference: string) => Promise<string | undefined>;
+    /** Message delivered to the loop (default: workload name). */
+    messageForWorkload?: (workload: AgentWorkloadResource) => string;
+    /** CAS attempts per status write (default 3). */
+    statusWriteAttempts?: number;
+    /** Maximum wait for an independently scheduled ModelEndpoint (default 30s). */
+    modelBindingTimeoutMs?: number;
+    /** Maximum wait for an independently prepared NetworkAttachment (default 30s). */
+    networkAttachmentTimeoutMs?: number;
+    /** Maximum wait for independently published volumes (default 30s). */
+    volumeBindingTimeoutMs?: number;
+    /** Resolve publish handles into ephemeral host mount paths. */
+    resolveVolumeMounts?: (workload: AgentWorkloadResource, run: AgentRunResource) => Promise<NonNullable<LoopRunStartRequest['volumeMounts']>>;
+    /** Poll interval while waiting for model binding (default 25ms). */
+    dependencyPollIntervalMs?: number;
+    /** Revalidate selected endpoint heartbeat age before launch (default 90s). */
+    modelEndpointHeartbeatTtlMs?: number;
+    /** Injectable sleep for watch-retry backoff in tests. */
+    sleep?: (ms: number) => Promise<void>;
+    /** Observes swallowed errors; the controller keeps watching regardless. */
+    onError?: (error: unknown) => void;
+}
+interface WorkloadExecutionControllerHandle {
+    stop(): Promise<void>;
+}
+declare function createWorkloadExecutionController(store: ControlStore, driver: LoopRuntimeDriver, options: WorkloadExecutionControllerOptions): WorkloadExecutionControllerHandle;
+
+declare const LOOP_CHECKPOINT_API_VERSION = "loops.memeloop.io/v1alpha1";
+declare const LOOP_CHECKPOINT_KIND = "LoopCheckpoint";
+interface LoopCheckpointSpec {
+    conversationId: string;
+    key: string;
+    result: unknown;
+    /** SHA-256 hex digest of the serialised result. Verified on load. */
+    digest: string;
+    createdAt: string;
+}
+type LoopCheckpointResource = OrchestrationResource<LoopCheckpointSpec>;
+declare function createControlStoreLoopCheckpointStore(store: ControlStore, actor: ControlStoreActor, now?: () => Date): LoopScriptCheckpointStore;
+
+/**
+ * TiddlyWiki HTTP storage driver (plan 24.44).
+ *
+ * Portable: depends only on an injectable `fetch` (browser and Node 18+).
+ * Every tiddler write is a compare-and-swap: the driver reads the current
+ * ETag, writes with `If-Match`, and retries a bounded number of times on
+ * 412/409 before failing with CONFLICT. Blobs are stored inline as base64 up
+ * to `maxInlineBlobBytes`; larger payloads are rejected with guidance to use
+ * an external BlobStore, keeping tiddlers small.
+ *
+ * Credentials are materialized per request by a trusted resolver from an
+ * opaque handle. Raw credentials never enter this portable driver.
+ */
+interface TiddlyWikiCredentialResolver {
+    resolveHeaders(handle: string, request: {
+        url: string;
+        method: string;
+    }): Promise<Record<string, string>>;
+}
+interface TiddlyWikiHttpStorageOptions {
+    /** Wiki base URL, e.g. `http://localhost:8080`. */
+    baseUrl: string;
+    /** TiddlyWeb recipe (default `default`). */
+    recipe?: string;
+    /** Injectable fetch implementation. */
+    fetchImpl?: typeof fetch;
+    /** Opaque CredentialGrant handle and trusted materialization port. */
+    credentialHandle?: string;
+    credentialResolver?: TiddlyWikiCredentialResolver;
+    /** Maximum inline blob size in bytes (default 256 KiB). */
+    maxInlineBlobBytes?: number;
+    /** CAS retry budget per write (default 3). */
+    maxCasAttempts?: number;
+}
+declare class TiddlyWikiHttpStorage implements FullAgentStorage {
+    private readonly baseUrl;
+    private readonly recipe;
+    private readonly fetchImpl;
+    private readonly credentialHandle?;
+    private readonly credentialResolver?;
+    private readonly maxInlineBlobBytes;
+    private readonly maxCasAttempts;
+    constructor(options: TiddlyWikiHttpStorageOptions);
+    private eventTitle;
+    private metaTitle;
+    private blobTitle;
+    private definitionTitle;
+    private instanceTitle;
+    private imTitle;
+    private tiddlerUrl;
+    private filterUrl;
+    private headers;
+    /** GET a tiddler; returns null on 404. Includes the ETag when the server sends one. */
+    private readTiddler;
+    /** CAS write: If-Match when an ETag is known; bounded retries on 412/409. */
+    private writeTiddler;
+    private listByPrefix;
+    private parsePayload;
+    listConversations(options?: ListConversationsOptions): Promise<ConversationMeta[]>;
+    getMessages(conversationId: string, _options?: GetMessagesOptions): Promise<ChatMessage[]>;
+    appendMessage(message: ChatMessage): Promise<void>;
+    insertMessagesIfAbsent(messages: ChatMessage[]): Promise<void>;
+    getMaxLamportClockForConversation(conversationId: string): Promise<number>;
+    upsertConversationMetadata(meta: ConversationMeta): Promise<void>;
+    getConversationMeta(conversationId: string): Promise<ConversationMeta | null>;
+    saveAttachment(reference: AttachmentReference, data: Uint8Array): Promise<void>;
+    getAttachment(contentHash: string): Promise<AttachmentReference | null>;
+    readAttachmentData(contentHash: string): Promise<Uint8Array | null>;
+    getAgentDefinition(id: string): Promise<AgentDefinition | null>;
+    saveAgentDefinition(definition: AgentDefinition & {
+        id: string;
+    }): Promise<void>;
+    saveAgentInstance(meta: AgentInstanceMeta): Promise<void>;
+    getImBinding(channelId: string, imUserId: string): Promise<IMChannelBinding | null>;
+    setImBinding(record: IMChannelBinding): Promise<void>;
+}
+
+/**
+ * Headless agent management contracts.
+ *
+ * Environment-neutral interfaces for managing agent definitions, agent instances,
+ * conversations, prompt previews, and scheduled tasks.
+ *
+ * Designed to be consumed by:
+ * - Desktop (via Electron IPC adapters)
+ * - Cloud (via REST API adapters)
+ * - CLI (via Ink + local or remote adapters)
+ */
+
+/** Attachment metadata for a wiki tiddler selected in the composer. */
+interface WikiTiddlerAttachment {
+    workspaceName: string;
+    tiddlerTitle: string;
+}
+/** Data passed when a wiki tiddler chip is clicked in a message. */
+interface WikiTiddlerClickData {
+    workspaceId: string;
+    workspaceName: string;
+    tiddlerTitle: string;
+    renderedContent?: string;
+}
+/** Storage contract for agent definition CRUD and template queries. */
+interface AgentDefinitionRepository {
+    createAgentDef(agent: AgentDefinition): Promise<AgentDefinition>;
+    updateAgentDef(agent: Partial<AgentDefinition> & {
+        id: string;
+    }): Promise<AgentDefinition>;
+    getAgentDefs(): Promise<AgentDefinition[]>;
+    getAgentDef(id?: string): Promise<AgentDefinition | undefined>;
+    getAgentTemplates(): Promise<AgentDefinition[]>;
+    deleteAgentDef(id: string): Promise<void>;
+}
+/** Observable agent runtime metadata exposed to the UI layer. */
+interface AgentRuntimeView {
+    id: string;
+    name: string;
+    agentDefId: string;
+    status: {
+        state: 'idle' | 'working' | 'completed' | 'failed' | 'canceled' | 'input-required';
+        progress?: string;
+    };
+    aiApiConfig?: AgentDefinition['aiApiConfig'];
+    /** If applicable, the agent definition merged with instance overrides. */
+    definition?: AgentDefinition;
+}
+/** Subscription callback for agent updates. */
+type AgentUpdateListener = (update: Partial<AgentRuntimeView>) => void;
+/** Client contract for creating, controlling, and subscribing to agent instances. */
+interface AgentInstanceClient {
+    /**
+     * Create a new agent instance from a definition.
+     * @param agentDefinitionId  The definition ID to instantiate from
+     * @param options             Optional creation flags (e.g. { preview: true })
+     */
+    createAgent(agentDefinitionId: string, options?: {
+        preview?: boolean;
+    }): Promise<{
+        id: string;
+    }>;
+    /**
+     * Fetch a full agent runtime view (messages excluded, available via conversation client).
+     */
+    fetchAgent(agentId: string): Promise<AgentRuntimeView>;
+    /**
+     * Update an agent instance with partial data.
+     */
+    updateAgent(agentId: string, data: Partial<AgentDefinition>): Promise<AgentRuntimeView>;
+    /**
+     * Cancel the current operation for an agent instance.
+     */
+    cancelAgent(agentId: string): Promise<void>;
+    /**
+     * Delete an agent instance and its associated conversation.
+     */
+    deleteAgent(agentId: string): Promise<void>;
+    /**
+     * Subscribe to live updates for an agent instance.
+     * Returns an unsubscribe function.
+     */
+    subscribeToUpdates(agentId: string, listener: AgentUpdateListener): () => void;
+    /**
+     * Get the framework (handler) ID for an agent instance.
+     */
+    getAgentFrameworkId(agentId: string): Promise<string>;
+    /**
+     * Get the JSON Schema for the framework configuration.
+     */
+    getFrameworkConfigSchema(frameworkId: string): Promise<Record<string, unknown>>;
+}
+/** Client contract for conversation operations on an agent instance. */
+interface AgentConversationClient {
+    /** Load all messages for an agent's conversation. */
+    getMessages(agentId: string): Promise<ChatMessage[]>;
+    /** Send a user message to the agent. Returns the list of message IDs that were appended. */
+    sendMessage(agentId: string, content: string, file?: File, wikiTiddlers?: WikiTiddlerAttachment[]): Promise<void>;
+    /** Subscribe to new message notifications. */
+    subscribeToMessages(agentId: string, listener: (message: ChatMessage) => void): () => void;
+    /** Delete an agent turn — removes the user message and all subsequent agent responses. */
+    deleteTurn(userMessageId: string): Promise<string | undefined>;
+    /** Retry an agent turn — delete agent responses and re-send the user message. */
+    retryTurn(userMessageId: string): Promise<void>;
+}
+/** Progress callback for prompt preview generation. */
+interface PromptPreviewProgress {
+    progress: number;
+    step: string;
+    currentPlugin?: string;
+}
+/** Result of a prompt preview generation. */
+interface PromptPreviewResult {
+    flatPrompts: unknown[];
+    processedPrompts: unknown[];
+}
+/** Client contract for generating prompt previews. */
+interface PromptPreviewClient {
+    /**
+     * Generate a preview of the prompt tree for the given agent state.
+     * @param agentFrameworkConfig  The agent's framework configuration
+     * @param messages              Current conversation messages
+     * @param inputText             Optional input text to include in the preview
+     * @param onProgress            Optional progress callback
+     */
+    generatePreview(agentFrameworkConfig: AgentFrameworkConfig, messages: ChatMessage[], inputText?: string, onProgress?: (progress: PromptPreviewProgress) => void): Promise<PromptPreviewResult | null>;
+}
+/** Scheduled task input. */
+interface CreateScheduledTaskInput {
+    agentInstanceId: string;
+    agentDefinitionId: string;
+    name: string;
+    scheduleKind: 'interval' | 'cron' | 'at';
+    schedule: {
+        kind: 'interval';
+        intervalSeconds: number;
+    } | {
+        kind: 'cron';
+        expression: string;
+        timezone?: string;
+    } | {
+        kind: 'at';
+        wakeAtISO: string;
+    };
+    payload?: {
+        message: string;
+    };
+    activeHoursStart?: string;
+    activeHoursEnd?: string;
+    createdBy?: string;
+    enabled?: boolean;
+}
+/** Scheduled task model. */
+interface ScheduledTask {
+    id: string;
+    agentInstanceId: string;
+    agentDefinitionId: string;
+    name: string;
+    schedule: CreateScheduledTaskInput['schedule'];
+    payload?: {
+        message?: string;
+    };
+    activeHoursStart?: string;
+    activeHoursEnd?: string;
+    enabled: boolean;
+    createdBy?: string;
+}
+/** Client contract for managing scheduled tasks. */
+interface ScheduledTaskClient {
+    listScheduledTasksForAgent(agentInstanceId: string): Promise<ScheduledTask[]>;
+    createScheduledTask(input: CreateScheduledTaskInput): Promise<ScheduledTask>;
+    updateScheduledTask(id: string, input: Partial<CreateScheduledTaskInput>): Promise<ScheduledTask>;
+    deleteScheduledTask(id: string): Promise<void>;
+    getCronPreviewDates(expression: string, timezone?: string, count?: number): Promise<string[]>;
+}
+/** State for the "Create New Agent" wizard. */
+interface AgentCreationState {
+    /** Current step index in the creation wizard. */
+    currentStep: number;
+    /** Agent name entered by the user. */
+    agentName: string;
+    /** Selected template definition, if any. */
+    selectedTemplate: AgentDefinition | null;
+    /** Temporary agent definition being built. */
+    temporaryAgentDefinition: AgentDefinition | null;
+    /** ID of the preview agent instance created for testing. */
+    previewAgentId: string | null;
+    /** Whether a loading operation is in progress. */
+    isLoading: boolean;
+    /** JSON Schema for the selected agent framework, if loaded. */
+    promptSchema: Record<string, unknown> | null;
+}
+/** State for the "Edit Agent Definition" view. */
+interface AgentDefinitionEditorState {
+    /** The agent definition being edited. */
+    agentDefinition: AgentDefinition | null;
+    /** Agent name. */
+    agentName: string;
+    /** ID of the preview agent instance. */
+    previewAgentId: string | null;
+    /** Whether a loading operation is in progress. */
+    isLoading: boolean;
+    /** Whether a save operation is in progress. */
+    isSaving: boolean;
+    /** JSON Schema for the selected agent framework, if loaded. */
+    promptSchema: Record<string, unknown> | null;
+}
+/** State for the prompt preview/edit dialog. */
+interface PromptPreviewDialogState {
+    open: boolean;
+    baseMode: 'preview' | 'edit';
+    activeTab: 'flat' | 'tree';
+    loading: boolean;
+    progress: number;
+    currentStep: string;
+    currentPlugin: string | null;
+    result: PromptPreviewResult | null;
+    lastUpdated: Date | null;
+    formFieldsToScrollTo: string[];
+}
+
+/**
+ * AgentSessionController — headless controller for an active agent conversation session.
+ *
+ * Manages agent runtime state, message sending, streaming, delete/retry turns,
+ * and subscription to live agent updates.
+ *
+ * No React, DOM, Electron, MUI, Zustand, or RxJS dependency.
+ */
+
+/** Read-only snapshot of the session state. */
+interface AgentSessionSnapshot {
+    agent: AgentRuntimeView | null;
+    loading: boolean;
+    error: Error | null;
+    messages: ChatMessage[];
+    orderedMessageIds: string[];
+    streamingMessageIds: Set<string>;
+}
+/** Listener for snapshot changes. */
+type AgentSessionListener = (snapshot: AgentSessionSnapshot) => void;
+/** Options for creating an AgentSessionController. */
+interface AgentSessionControllerOptions {
+    agentInstanceClient: AgentInstanceClient;
+    conversationClient: AgentConversationClient;
+    /** Polling interval in ms for agent status updates. Default 500. */
+    pollInterval?: number;
+}
+/**
+ * Headless controller for an agent conversation session.
+ *
+ * Call {@link start} to load an agent, then {@link subscribe} to receive snapshot
+ * updates. Use {@link sendMessage}, {@link deleteTurn}, {@link retryTurn}, {@link cancel}
+ * to drive the conversation.
+ *
+ * Host UI frameworks (React, Ink) subscribe via {@link subscribe} and render
+ * the snapshot.
+ */
+declare class AgentSessionController {
+    private readonly options;
+    private listener;
+    private snapshot;
+    private unsubAgentUpdates;
+    private unsubMessages;
+    private pollingTimer;
+    private agentId;
+    constructor(options: AgentSessionControllerOptions);
+    /**
+     * Start a session for the given agent ID.
+     * Fetches the agent, subscribes to live updates, and loads messages.
+     */
+    start(agentId: string): Promise<void>;
+    /** Stop the session and clean up subscriptions. */
+    stop(): void;
+    /** Send a user message. */
+    sendMessage(content: string, file?: File, wikiTiddlers?: WikiTiddlerAttachment[]): Promise<void>;
+    /** Cancel the current agent operation. */
+    cancel(): Promise<void>;
+    /** Delete a turn starting at the given user message ID. */
+    deleteTurn(userMessageId: string): Promise<string | undefined>;
+    /** Retry a turn starting at the given user message ID. */
+    retryTurn(userMessageId: string): Promise<void>;
+    /** Subscribe to snapshot changes. Returns unsubscribe function. */
+    subscribe(listener: AgentSessionListener): () => void;
+    /** Get current snapshot without subscribing. */
+    getSnapshot(): AgentSessionSnapshot;
+    private emitPartial;
+    private handleAgentUpdate;
+    private handleNewMessage;
+    private startPolling;
+    private stopPolling;
+}
+
+/**
+ * AgentDefinitionEditorController — headless controller for editing an agent definition.
+ *
+ * Manages definition loading, autosave, schema loading, preview agent lifecycle,
+ * and scheduled task CRUD.
+ *
+ * No React, DOM, Electron, MUI, Zustand, or RxJS dependency.
+ */
+
+/** Partial state emitted to the listener. */
+type EditorStateChange = Partial<AgentDefinitionEditorState>;
+/** Listener for editor state changes. */
+type EditorStateListener = (change: EditorStateChange) => void;
+/** Schedule editor sub-state for the UI layer. */
+interface ScheduleEditorState {
+    mode: 'none' | 'interval' | 'daily' | 'cron';
+    intervalValue: number;
+    intervalUnit: 's' | 'min' | 'h';
+    dailyTime: string;
+    activeHoursStart: string;
+    activeHoursEnd: string;
+    cronExpression: string;
+    timezone: string;
+    message: string;
+    existingTaskId?: string;
+}
+/** Options for creating an AgentDefinitionEditorController. */
+interface AgentDefinitionEditorControllerOptions {
+    definitionRepository: AgentDefinitionRepository;
+    agentInstanceClient: AgentInstanceClient;
+    scheduledTaskClient: ScheduledTaskClient;
+    /** Debounce interval for autosave in ms. Default 1000. */
+    autosaveDebounceMs?: number;
+}
+/**
+ * Headless controller for editing an agent definition.
+ *
+ * Call {@link loadDefinition} to start, then {@link subscribe} for state updates.
+ */
+declare class AgentDefinitionEditorController {
+    private readonly options;
+    private listener;
+    private state;
+    private autosaveTimer;
+    constructor(options: AgentDefinitionEditorControllerOptions);
+    /** Load an agent definition and its prompt schema. */
+    loadDefinition(definitionId: string): Promise<void>;
+    /** Update the agent definition field. Triggers debounced autosave. */
+    updateDefinition(change: Partial<AgentDefinition> & {
+        id: string;
+    }): void;
+    /** Force an immediate save to the repository. */
+    saveNow(): Promise<void>;
+    /** Reload the prompt schema for a framework ID. */
+    reloadSchema(frameworkId: string): Promise<void>;
+    /** Get or create a preview agent instance tied to this definition. */
+    private findOrCreatePreviewAgent;
+    loadScheduledTasks(): Promise<ScheduledTask[]>;
+    saveScheduledTask(input: CreateScheduledTaskInput): Promise<ScheduledTask>;
+    deleteScheduledTask(taskId: string): Promise<void>;
+    subscribe(listener: EditorStateListener): () => void;
+    getState(): AgentDefinitionEditorState;
+    private emit;
+    private scheduleAutosave;
+}
+
+/**
+ * AgentCreationController — headless controller for the "Create New Agent" wizard.
+ *
+ * Manages creation wizard state: current step, template selection, temporary
+ * agent definition lifecycle, and preview agent setup.
+ *
+ * No React, DOM, Electron, MUI, Zustand, or RxJS dependency.
+ */
+
+/** Listener for creation state changes. */
+type CreationStateListener = (state: AgentCreationState) => void;
+/** Options for creating an AgentCreationController. */
+interface AgentCreationControllerOptions {
+    definitionRepository: AgentDefinitionRepository;
+    agentInstanceClient: AgentInstanceClient;
+    /** Default framework ID for new agents. */
+    defaultFrameworkId?: string;
+}
+/**
+ * Headless controller for the agent creation wizard.
+ *
+ * Call {@link start}, {@link selectTemplate}, {@link nextStep}, etc. to drive
+ * the wizard. Subscribe via {@link subscribe} for state updates.
+ */
+declare class AgentCreationController {
+    private readonly options;
+    private listener;
+    private state;
+    constructor(options: AgentCreationControllerOptions);
+    /** Initialize the creation wizard, optionally from a saved tab state. */
+    start(definitionId?: string, templateDefinitionId?: string): Promise<void>;
+    /** Select a template for the new agent. */
+    selectTemplate(template: AgentDefinition): void;
+    /** Update the agent name. */
+    setAgentName(name: string): void;
+    /** Advance to the next wizard step. */
+    nextStep(): void;
+    /** Go back to the previous wizard step. */
+    previousStep(): void;
+    /** Set the current wizard step directly. */
+    setStep(step: number): void;
+    /** Update the temporary agent definition. */
+    updateTemporaryDefinition(change: Partial<AgentDefinition>): void;
+    /** Set the prompt schema for the selected framework. */
+    setPromptSchema(schema: Record<string, unknown> | null): void;
+    /**
+     * Create a preview agent instance for the chat-preview step.
+     * Should be called when entering step 2 (or the chat preview step).
+     */
+    createPreviewAgent(definitionId: string): Promise<void>;
+    /**
+     * Finalize creation: persist the temporary definition and create the actual
+     * agent instance. Returns the final agent instance ID, or null on failure.
+     */
+    finalize(): Promise<string | null>;
+    /** Clean up temporary resources. */
+    cleanup(): Promise<void>;
+    subscribe(listener: CreationStateListener): () => void;
+    getState(): AgentCreationState;
+    private emit;
+}
+
+/**
+ * PromptPreviewController — headless controller for generating prompt previews.
+ *
+ * Manages preview dialog state, progress tracking, and result accumulation.
+ *
+ * No React, DOM, Electron, MUI, Zustand, or RxJS dependency.
+ */
+
+/** Listener for preview dialog state changes. */
+type PreviewDialogListener = (state: PromptPreviewDialogState) => void;
+/** Options for creating a PromptPreviewController. */
+interface PromptPreviewControllerOptions {
+    previewClient: PromptPreviewClient;
+}
+/**
+ * Headless controller for the prompt preview/edit dialog.
+ *
+ * Call {@link open}, {@link close}, {@link generate} to drive the dialog.
+ * Subscribe via {@link subscribe} for state updates.
+ */
+declare class PromptPreviewController {
+    private readonly options;
+    private listener;
+    private state;
+    constructor(options: PromptPreviewControllerOptions);
+    /** Open the dialog with an optional base mode. */
+    open(baseMode?: 'preview' | 'edit'): void;
+    /** Close the dialog. */
+    close(): void;
+    /** Set the active tab in the dialog. */
+    setActiveTab(tab: 'flat' | 'tree'): void;
+    /** Set form fields to scroll to (for edit mode navigation). */
+    setFormFieldsToScrollTo(fieldPaths: string[]): void;
+    /**
+     * Generate a preview of the prompt tree.
+     * @param agentFrameworkConfig  The agent's framework configuration
+     * @param messages              Current conversation messages
+     * @param inputText             Optional input text to include in the preview
+     */
+    generate(agentFrameworkConfig: AgentFrameworkConfig, messages: ChatMessage[], inputText?: string): Promise<PromptPreviewResult | null>;
+    subscribe(listener: PreviewDialogListener): () => void;
+    getState(): PromptPreviewDialogState;
+    private emit;
+}
+
+interface AgentRuntimeDeviceRpcHandlerOptions {
+    runtime: Pick<MemeLoopRuntime, 'createAgent' | 'sendMessage' | 'cancelAgent'>;
+    storage: IAgentStorage;
+    getAgentDefinitions?: () => AgentDefinition[] | Promise<AgentDefinition[]>;
+    localNodeId?: string;
+}
+declare function createAgentRuntimeDeviceRpcHandler(options: AgentRuntimeDeviceRpcHandlerOptions): DeviceRpcHandler;
+
+declare const PEER_DRIVER_PROTOCOL_VERSION = "memeloop-peer-driver/v1";
+type PeerDriverScope = 'runtime' | 'model' | 'tool';
+interface PeerDriverAssignment {
+    /** Protocol version for forward compatibility. */
+    version: typeof PEER_DRIVER_PROTOCOL_VERSION;
+    /** Scoped driver domain. */
+    scope: PeerDriverScope;
+    /** Assignment ID for idempotency and tracking. */
+    assignmentId: string;
+    /** Target operation within the scope. */
+    operation: string;
+    /** Operation parameters. */
+    parameters: unknown;
+    /** Optional timeout in milliseconds. */
+    timeoutMs?: number;
+}
+interface PeerDriverStatus {
+    version: typeof PEER_DRIVER_PROTOCOL_VERSION;
+    assignmentId: string;
+    state: 'accepted' | 'running' | 'completed' | 'failed';
+    result?: unknown;
+    error?: string;
+    completedAt?: string;
+}
+interface PeerDriverTransportOptions {
+    /** Send a raw RPC to a peer. */
+    sendRpc: (peerId: string, method: string, parameters: unknown) => Promise<unknown>;
+    /** Default timeout for assignments. */
+    defaultTimeoutMs?: number;
+}
+interface PeerDriverRequestContext {
+    /** Authenticated transport identity; never sourced from request parameters. */
+    remotePeerId: string;
+}
+/**
+ * Create a scoped peer driver transport that exchanges versioned assignments
+ * and status through the device network. LLMs and callers use scoped
+ * operations (runtime/model/tool) instead of raw node IDs and RPC methods.
+ */
+declare function createPeerDriverTransport(options: PeerDriverTransportOptions): {
+    submitAssignment: (peerId: string, assignment: Omit<PeerDriverAssignment, "version">) => Promise<PeerDriverStatus>;
+    getAssignmentStatus: (peerId: string, assignmentId: string) => Promise<PeerDriverStatus>;
+    cancelAssignment: (peerId: string, assignmentId: string) => Promise<PeerDriverStatus>;
+};
+/**
+ * Create a DeviceRpcHandler that routes scoped driver protocol calls to the
+ * appropriate local handlers.
+ */
+declare function createPeerDriverRpcHandler(handlers: {
+    onSubmit?: (assignment: PeerDriverAssignment, context: PeerDriverRequestContext) => Promise<PeerDriverStatus>;
+    onStatus?: (assignmentId: string, context: PeerDriverRequestContext) => Promise<PeerDriverStatus>;
+    onCancel?: (assignmentId: string, context: PeerDriverRequestContext) => Promise<PeerDriverStatus>;
+}): DeviceRpcHandler;
+
+/**
+ * IM 接入框架（平台无关）：适配器负责验签/解析；ChannelManager 负责会话路由。
+ */
+
+/** 平台 Webhook 解析后的统一入站消息 */
+interface ImInboundMessage {
+    channelId: string;
+    platform: IMPlatformType;
+    imUserId: string;
+    text: string;
+    /** 平台原始结构，便于调试或扩展富媒体 */
+    raw: unknown;
+}
+interface ImWebhookContext {
+    headers: Record<string, string | string[] | undefined>;
+    body: Uint8Array;
+    /** GET/POST query（如企业微信密文回调的 msg_signature、timestamp、nonce） */
+    query?: Record<string, string>;
+}
+/**
+ * 单平台适配器：verify 失败应返回 false；parse 失败返回 null。
+ */
+interface IIMAdapter {
+    readonly platform: IMPlatformType;
+    verify(context: ImWebhookContext): boolean;
+    parse(channelId: string, context: ImWebhookContext): ImInboundMessage | null;
+}
+/** 将 Agent 输出格式化为 IM 可发送的纯文本 */
+interface IIMMessageRenderer {
+    renderPlainText(content: string): string;
+    /** 单行工具调用摘要（IM 默认不展示完整工具参数/结果） */
+    renderToolCallSummary(toolName: string, arguments_: unknown): string;
+    /**
+     * 工具结果摘要（返回 null 表示隐藏）。
+     * 规则摘要优先：避免把大结果刷到 IM。
+     */
+    renderToolResultSummary(toolName: string, result: unknown): string | null;
+    renderToolApproval(toolName: string, arguments_: unknown): string;
+    renderAskQuestion(question: string, options?: string[]): string;
+    /** IM 默认隐藏 thinking，若要显示由实现自行决定。 */
+    renderThinking(content: string): string | null;
+    renderError(error: string): string;
+    renderTodoList(todos: Array<{
+        id: string;
+        text: string;
+        done?: boolean;
+    }>): string;
+}
+/** 节点侧驱动 Agent 的最小能力（避免循环依赖 MemeLoopRuntime 类型） */
+interface ImAgentDriver {
+    createAgent(options: {
+        definitionId: string;
+        initialMessage?: string;
+    }): Promise<{
+        conversationId: string;
+    }>;
+    sendMessage(options: {
+        conversationId: string;
+        message: string;
+    }): Promise<void>;
+}
+
+/**
+ * 管理 IM 用户与会话的绑定；可选 `storage` 使用 IAgentStorage 的 IM 绑定持久化。
+ */
+declare class IMChannelManager {
+    private readonly storage?;
+    private readonly bindings;
+    constructor(storage?: {
+        getImBinding?(c: string, u: string): Promise<IMChannelBinding | null>;
+        setImBinding?(r: IMChannelBinding): Promise<void>;
+    } | undefined);
+    private key;
+    getBinding(channelId: string, imUserId: string): Promise<IMChannelBinding | undefined>;
+    setBinding(record: IMChannelBinding): Promise<void>;
+    /**
+     * 处理入站文本：无 binding 时创建会话并发送首条用户消息。
+     */
+    dispatchInbound(message: ImInboundMessage, driver: ImAgentDriver, options: {
+        defaultDefinitionId: string;
+    }): Promise<{
+        conversationId: string;
+    }>;
+    switchConversation(channelId: string, imUserId: string, conversationId: string): Promise<void>;
+}
+declare function pickAdapter(adapters: IIMAdapter[], platform: string): IIMAdapter | undefined;
+
+/** Plan §20.6.1 — chunk assistant text before sending to IM APIs. */
+declare function imPlatformMaxMessageChars(platform: string): number;
+
+interface ImSlashCommandContext {
+    rawText: string;
+    channelId: string;
+    imUserId: string;
+    manager: IMChannelManager;
+    storage: IAgentStorage;
+    driver: ImAgentDriver;
+    runtime: MemeLoopRuntime;
+    defaultDefinitionId: string;
+}
+/**
+ * Plan §20.6.4 — parse `/list`, `/switch`, `/new`, `/agent`, `/status`, `/cancel` locally (no LLM).
+ */
+declare function tryHandleImSlashCommand(context: ImSlashCommandContext): Promise<{
+    handled: boolean;
+    messages: string[];
+}>;
+
+/** 通用文本/Markdown 友好输出（IM 端以纯文本展示） */
+declare class TextMessageRenderer implements IIMMessageRenderer {
+    renderPlainText(content: string): string;
+    renderToolCallSummary(toolName: string, arguments_: unknown): string;
+    renderToolResultSummary(toolName: string, result: unknown): string | null;
+    renderToolApproval(toolName: string, arguments_: unknown): string;
+    renderAskQuestion(question: string, options?: string[]): string;
+    renderThinking(_content: string): string | null;
+    renderError(error: string): string;
+    renderTodoList(todos: Array<{
+        id: string;
+        text: string;
+        done?: boolean;
+    }>): string;
+}
+
+type ImStreamFlush = (text: string) => Promise<void>;
+/**
+ * Subscribe to `runtime` agent updates and forward assistant text + light tool summaries to IM,
+ * flushing when the buffer reaches the platform limit (plan §20.6.1).
+ */
+declare function streamRuntimeAgentReplyToIm(options: {
+    runtime: MemeLoopRuntime;
+    conversationId: string;
+    platform: string;
+    renderer: TextMessageRenderer;
+    flush: ImStreamFlush;
+}): Promise<void>;
+
+/**
+ * IM 会话控制工具（计划 20.4）：在带 IM binding 的会话中注入。
+ * 这里仅导出工具 schema 描述，实际注册由上层 ToolRegistry 完成。
+ */
+declare const imToolDefinitions: readonly [{
+    readonly name: "im.listConversations";
+    readonly description: "列出可切换的会话（由 memeloop-cli registerImSessionTools 注册，仅 IM 来源会话可用）。";
+}, {
+    readonly name: "im.switchConversation";
+    readonly description: "切换当前 IM 用户绑定的活跃会话。参数：{ conversationId: string }";
+}, {
+    readonly name: "im.newConversation";
+    readonly description: "创建新会话并切换绑定。参数：{ definitionId?: string }";
+}, {
+    readonly name: "im.summarizeHistory";
+    readonly description: "返回当前会话最近消息的纯文本摘要（规则拼接，非 LLM）。参数：{ maxMessages?: number }";
+}];
+interface ImToolsRuntime {
+    channelId: string;
+    imUserId: string;
+    manager: IMChannelManager;
+    driver: ImAgentDriver;
+    defaultDefinitionId: string;
+}
+/** 供工具实现层调用的命令式 API（避免在 core 内耦合 defineTool） */
+declare function imSwitchConversation(rt: ImToolsRuntime, conversationId: string): Promise<void>;
+
+export { type AgentConversationClient, AgentCreationController, type AgentCreationControllerOptions, type AgentCreationState, AgentDefinition, AgentDefinitionEditorController, type AgentDefinitionEditorControllerOptions, type AgentDefinitionEditorState, type AgentDefinitionRepository, AgentFrameworkConfig, type AgentInstanceClient, AgentInstanceMeta, AgentOrchestrationClient, AgentRunResource, type AgentRuntimeDeviceRpcHandlerOptions, type AgentRuntimeView, AgentSessionController, type AgentSessionControllerOptions, type AgentSessionListener, type AgentSessionSnapshot, type AgentUpdateListener, AgentVolumeClaimResource, AgentVolumeReplicaStatus, AgentVolumeResource, AgentWorkloadResource, AgentWorkloadResourceRequirements, type ArchiveEntry, type ArchiveLimits, ArtifactDestination, ArtifactDestinationPolicy, ArtifactInspector, ArtifactManagementCapabilities, ArtifactManagementDriver, ArtifactManagementStateSnapshot, ArtifactReviewWriter, AttachmentReference, AuditTelemetryManagementDriver, type BindWorkerSessionRequest, type BindingControllerOptions, type BoundedCollector, ChatMessage, ControlLeaseGrant, ControlLeaseIdentity, ControlLeaseRequest, ControlStore, ControlStoreActor, ControlStoreApplyOptions, type ControlStoreAuditTelemetryAdapterOptions, ControlStoreAuthorizationRequest, ControlStoreAuthorizer, ControlStoreCompactionResult, ControlStoreCreateOptions, ControlStoreHealth, type ControlStoreOrchestrationClientOptions, type ControlStorePolicyApprovalAdapterOptions, ControlStoreSnapshotResult, ControlStoreStatusUpdateOptions, type Controller, type ControllerReconcileRequest, type ControllerReconcileResult, type ControllerRunnerHandle, type ControllerRunnerOptions, ConversationMeta, type CreateScheduledTaskInput, type CreationStateListener, CredentialBrokerDriver, type CredentialBrokerEndpoint, type CredentialGrantBindingControllerOptions, type CredentialGrantExecutionControllerOptions, CredentialGrantHandle, type CredentialGrantLifecycleControllerOptions, type CredentialGrantPlacementRequirements, CredentialGrantResource, type CredentialHandleVault, CredentialIssuePayload, CredentialManagementDriver, DataClassification, DeviceRpcHandler, DriverConformanceTest, type DriverFixture, DriverManifest, DriverRequestEnvelope, type EditorStateChange, type EditorStateListener, type ExternalDriverCapabilities, type ExternalOrchestrationControllerHandle, type ExternalOrchestrationControllerOptions, type ExternalOrchestrationDriver, type ExternalPlacementResult, type ExternalRuntimeResult, type ExternalStatusResult, type ExternalToolContract, type ExternalWorkerBootstrapSecret, type ExternalWorkloadPlacementContext, type ExternalWorkloadRuntimeContract, FLEET_ROLLOUT_API_VERSION, FLEET_ROLLOUT_KIND, FakeArtifactManagementState, type FleetRolloutControllerOptions, type FleetRolloutResource, type FleetRolloutSpec, type FleetRolloutStatus, type GatewayHttpRequest, type GatewayRateLimiter, type GatewayValidationContext, type GatewayValidationResult, GetMessagesOptions, IAgentStorage, type IIMAdapter, type IIMMessageRenderer, IMChannelBinding, IMChannelManager, IMPlatformType, IToolRegistry, IdentityAttestationManagementDriver, type IdentityPromotionRequest, type IdentityRevocationReason, type IdentityRevocationRecord, type ImAgentDriver, type ImInboundMessage, type ImSlashCommandContext, type ImStreamFlush, type ImToolsRuntime, type ImWebhookContext, type IssueWorkloadCapabilityGrantRequest, LOOP_CHECKPOINT_API_VERSION, LOOP_CHECKPOINT_KIND, ListConversationsOptions, type LocalModelAdvertisement, type LocalModelAdvertisementOptions, type LoopCheckpointResource, type LoopCheckpointSpec, LoopRunStartRequest, LoopRuntimeDriver, LoopScriptCheckpointStore, type ManagedArtifactDriverAdapterOptions, type ManagedStorageAdapterStateStore, type ManagedStorageDriverAdapterOptions, ManagedToolDescriptor, type ManagedToolExecutionRoute, type ManagedToolExecutionRouteOptions, type ManagedToolPolicyDecision, type ManagedWorkerIdentityAdapterOptions, type ManagedWorkerIdentityRequestFactoryInput, type ManagedWorkerIdentityRoute, ModelClassManifest, ModelClassResource, type ModelEndpointBindingControllerOptions, ModelEndpointManifest, type ModelEndpointRegistrarHandle, type ModelEndpointRegistrarOptions, ModelEndpointResource, type ModelEndpointTrust, ModelProviderDriver, ModelProviderHealth, type ModelSelectionRequirements, NODE_API_VERSION, NODE_KIND, type NetworkAttachmentBindingControllerOptions, type NetworkAttachmentExecutionControllerOptions, type NetworkAttachmentNode, NetworkAttachmentResource, NetworkClassResource, NetworkDriver, NetworkDriverCapabilities, NetworkManagementDriver, NetworkPreparePayload, type NodeSpec, type NodeStatus, NodeTrustClass, OrchestrationDeleteOptions, OrchestrationDeleteResult, OrchestrationErrorData, OrchestrationResource, OrchestrationResourceList, OrchestrationResourceManifest, OrchestrationResourceQuery, OrchestrationResourceReference, OrchestrationResourceStatus, OrchestrationResourceWatchEvent, OrchestrationWatchEvent, OrchestrationWatchOptions, PEER_DRIVER_PROTOCOL_VERSION, type PeerDriverAssignment, type PeerDriverRequestContext, type PeerDriverScope, type PeerDriverStatus, type PeerDriverTransportOptions, PermissionAction, PolicyApprovalManagementDriver, PolicyDecision, type PolicyEvaluation, type PreviewDialogListener, type PromptPreviewClient, PromptPreviewController, type PromptPreviewControllerOptions, type PromptPreviewDialogState, type PromptPreviewProgress, type PromptPreviewResult, type QuarantineGatewayPolicy, QuorumControlStore, type QuorumControlStoreOptions, type QuorumControlStoreSnapshot, type QuorumMember, type QuorumTopology, type RecordedInteraction, type RegisteredExternalOrchestrationDriver, type ReplicationAction, type ReplicationContext, type ReplicationControllerDeps, type ReplicationNode, type ReplicationResult, type ReplicationSnapshot, type ReplicationTransport, type RolloutEvidenceEntry, type RolloutStrategy, type RolloutTarget, type RunVolumeControllerOptions, type SanitizedText, type SanitizerFinding, type ScheduleEditorState, type ScheduledTask, type ScheduledTaskClient, type Scheduler, type SchedulerNode, type SchedulingDecision, type SecretRedactionOptions, SecurityProfileResource, type SelectableModelEndpoint, type SignedWorkerBootstrapSessionDescriptor, StorageClassResource, type StorageDriver, type StorageDriverCapabilities, type StorageDriverEndpoint, StorageManagementDriver, StorageProvisionPayload, type StorageProvisionRequest, type StorageProvisionResult, type StoragePublishRequest, type StoragePublishResult, TOOL_OPERATION_CONDITION_EFFECT_UNKNOWN, type TargetUpdateResult, type TargetUsage, TextMessageRenderer, TiddlyWikiHttpStorage, type TiddlyWikiHttpStorageOptions, ToolAdmissionAction, type ToolAdmissionDecision, ToolAdmissionPolicy, ToolAdmissionRule, ToolExecutionDriver, ToolExecutorResource, type ToolExecutorSelection, ToolManagementDriver, ToolOperationApprovalEvidence, type ToolOperationBindingControllerOptions, ToolOperationEffect, type ToolOperationExecutionController, type ToolOperationExecutionControllerOptions, ToolOperationResource, ToolOperationResult, ToolOperationStatus, type UnknownEffectAction, type UnknownEffectDecision, type UnknownEffectEvidence, type VerifierOnlyTransitionOptions, VolumeAccessMode, type VolumeClaimBindingControllerOptions, type VolumeClaimExecutionControllerOptions, WORKER_ENROLLMENT_API_VERSION, WORKER_ENROLLMENT_KIND, WORKER_PROTOCOL_METHODS, WORKER_PROTOCOL_VERSION, WORKER_SESSION_API_VERSION, WORKER_SESSION_KIND, WORKLOAD_CAPABILITY_GRANT_API_VERSION, WORKLOAD_CAPABILITY_GRANT_KIND, type WikiTiddlerAttachment, type WikiTiddlerClickData, type WorkerBootstrapSessionDescriptor, type WorkerEnrollmentResource, type WorkerEnrollmentSpec, type WorkerEnrollmentStatus, type WorkerGatewaySession, type WorkerProtocolAuditEvent, type WorkerProtocolGatewayOptions, type WorkerProtocolMethod, type WorkerProtocolReplayProtector, type WorkerProtocolRequest, type WorkerProtocolResponse, type WorkerRunBinding, type WorkerSessionResource, type WorkerSessionSpec, type WorkerSessionStatus, type WorkloadCapabilityBudget, type WorkloadCapabilityGrantRequirements, type WorkloadCapabilityGrantResource, type WorkloadCapabilityGrantSpec, type WorkloadCapabilityGrantStatus, type WorkloadExecutionControllerHandle, type WorkloadExecutionControllerOptions, applyUnknownEffectDecision, assertExternalToolContracts, assertExternalToolOperationContract, assertExternalToolOperationResult, assertExternalWorkloadRuntimeContracts, assertSafeArchivePath, bindWorkerSession, canonicalWorkerBootstrapDescriptorBytes, canonicalWorkerProtocolRequestBytes, canonicalWorkloadCapabilityGrantBytes, consumeWorkloadCapabilityGrant, containsSecrets, createAdoptionTests, createAgentRuntimeDeviceRpcHandler, createAuditRecordAuthorizer, createBackpressureTests, createBindingController, createBoundedCollector, createCancellationTests, createCapabilityNegotiationTests, createCapacityScheduler, createControlStoreArtifactReviewWriter, createControlStoreAuditTelemetryAdapter, createControlStoreLoopCheckpointStore, createControlStoreOrchestrationClient, createControlStorePolicyApprovalAdapter, createControllerRunner, createCredentialGrantBindingController, createCredentialGrantExecutionController, createCredentialGrantLifecycleController, createDowngradeTests, createExternalOrchestrationController, createFencingTests, createFleetRolloutController, createGatewayRateLimiter, createIdempotencyTests, createInMemoryWorkerReplayProtector, createManagedArtifactDriverAdapter, createManagedStorageDriverAdapter, createManagedToolDescriptors, createManagedToolExecutionRoute, createManagedWorkerIdentityAdapter, createMinimalExternalRuntimeToolContracts, createModelEndpointBindingController, createModelEndpointRegistrar, createNetworkAttachmentBindingController, createNetworkAttachmentExecutionController, createNodeTrustAuthorizer, createPeerDriverRpcHandler, createPeerDriverTransport, createPolicyDecisionAuthorizer, createRecordingDriver, createReplayingDriver, createReplicationController, createRunVolumeController, createSecurityTests, createToolOperationBindingController, createToolOperationExecutionController, createVerifierOnlyAuthorizer, createVolumeClaimBindingController, createVolumeClaimExecutionController, createWorkerEnrollmentManifest, createWorkerProtocolGateway, createWorkerRevocationList, createWorkerSessionManifest, createWorkloadCapabilityGrantManifest, createWorkloadExecutionController, defaultAdmissionPolicyForTrustClass, defaultPermissionActionForTrustClass, describeLocalModelEndpoints, detectMimeConfusion, enrollWorker, evaluateToolAdmission, imPlatformMaxMessageChars, imSwitchConversation, imToolDefinitions, isIdentityRevoked, isNodeAllowedForRole, isPrivateIp, isVerifierActor, isWorkerEnrollment, isWorkerSession, isWorkerSessionValid, isWorkloadCapabilityGrant, issueWorkloadCapabilityGrant, negotiateCapabilities, parseExternalRuntimeResult, pickAdapter, planReplicaPlacement, promoteIdentity, reconcileUnknownEffect, reconcileVolumeReplication, redactSecrets, resolveAdmissionPolicy, resolveExternalWorkloadResources, resolveExternalWorkloadRuntime, revokeCredentialGrant, revokeQuarantineIdentity, revokeWorkerSession, sanitizeMarkup, sanitizeTerminalText, scanForPromptInjection, selectModelEndpoint, selectToolExecutor, storageDriverSatisfiesClass, streamRuntimeAgentReplyToIm, sumEvidenceUsage, tryHandleImSlashCommand, validateArchiveManifest, validateGatewayRequest, validateNodeSpec, validateRedirectTarget, verifyWorkloadCapabilityGrant };